August 2001 - openSUSE Security - openSUSE Mailing Lists

Re:[suse-security]RE:Can't connect hosts behind firewall
by maf king 20 Aug '01

20 Aug '01

Hi Christoph, On 2001.08.20 10:31:35 +0100 Christoph Egger wrote: > On Monday, 20. August 2001 10:55, maf(a)cybereye.co.uk wrote: > > Hi Christoph, > > >From your logfile: > Aug 20 11:39:06 ipseca kernel: Packet log: input ACCEPT eth0 PROTO=1 > 10.0.1.1:8 192.168.2.1:0 L=60 S=0x00 I=5606 F=0x0000 T=128 (#11) > Aug 20 11:39:06 ipseca kernel: Packet log: input ACCEPT eth1 PROTO=50 > 62.180.107.60:65535 62.180.107.61:65535 L=112 S=0x00 I=45938 F=0x0000 > T=64 (#32) > Aug 20 11:39:06 ipseca kernel: Packet log: input DENY ipsec0 PROTO=1 > 192.168.2.1:0 10.0.1.1:0 L=60 S=0x10 I=62222 F=0x0000 T=254 (#59) Looks like the interface ipsec0 is being DENYed by default. Try inserting a couple of rules in your firewall : INPUT : allow everything from interface ipsec0 OUTPUT : allow everything to ipsec0 Maybe you also need to do the routed patches I suggested earlier? Maybe SuSE firewall config needs something like FW_DEV_WORLD = eth1, ipsec0 <---- Will this work??? Hopefully someone who knows if you can do this with SuSE firewall 4.9 will answer here... HTH, Maf. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 8

security policy
by Anders Johansson 20 Aug '01

20 Aug '01

What is the common policy when it comes to reporting 'incidents'? Do people here commonly report, say, script kiddies uploading things to ftp servers in an attempt to exploit frontpage installations that aren't there? Or is that considered overkill? Anders -- Fortune: Truly great madness can not be achieved without significant intelligence. -- Henrik Tikkanen

2 1

can't connect hosts behind firewall
by Christoph Egger 20 Aug '01

20 Aug '01

Hi! My _test_ - LAN looks like this: 192.168.2.0/24 | Host1 with 192.168.2.1 | Gateway (eth0) with 192.168.2.91 Gateway (eth1) | Internet | Gateway (eth1) with firewall Gateway (eth0) with 10.0.1.10 | | Host2 with 10.0.1.21 10.0.1.0/24 I can do a ping from 192.168.2.1 to 10.0.1.10, but not to 10.0.1.21 and vice versa. /proc/sys/net/ipv4/conf/*/rp_filter are set to "0". /proc/sys/net/ipv4/ip_forward is set to "1". SuSE Linux 7.2 is installed on both gateways. routed is running on both gateways, producing these firewall logs: ------------------------------------------------------------------------------------------ ..... Packet log: input DENY eth0 PROTO=17 10.0.1.10:520 10.0.1.255:520 L=52 S=0x00 I=0 F=0x4000 T=64 (#5) [Same for eth1 with official addresses] ------------------------------------------------------------------------------------------ I use a own _updown.local script to set up the firewall rules: ------------------------------------------------------------------------------------------ up-client:) ipchains -I forward -j ACCEPT -b \ -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK ;; down-client:) ipchains -D forward -j ACCEPT -b \ -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK ;; ------------------------------------------------------------------------------------------ What do you think, might be the problem? -- CU, Christoph

3 9

RE: [suse-security] Firewall Problems
by Reckhard, Tobias 20 Aug '01

20 Aug '01

> Im running SUSE 7.0 and i have a problem with the Firewall and VPN's > I've opened my wall to the ports specified in the VPN manual, and the > firewall blocks data anyway. It goes for a high port and even if that high > port is allowed the firewall blocks it anyway. Why is that? > > The port is 655535 > The VPN software that i am running is PPtP > The port you mention doesn't exist, perhaps you mean 65535. TCP and UDP Ports fall into the range 0...65535. As for PPTP, it usually doesn't use port 65535. Rather, it makes use of port 1723 (UDP only, I believe) for key management and the GRE protocol (protocol 47, *not* port 47!) for the actual tunnel. Cheers Tobias

1 0

in.telnetd
by Roman Drahtmueller 18 Aug '01

18 Aug '01

Hi together, Update packages for in.telnetd are available for the 7.1 and 7.2 distributions. They contain a patch against the recently discovered buffer overflow in in.telnetd. The packages for 7.0 are work-in-progress, as well as the ones for the 6.x distributions. Please note that the package for 7.1 is called nkitserv, in 7.2 its name is telnet-server. Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -

1 0

Firewall Problems
by Nuno Higgs 18 Aug '01

18 Aug '01

Im running SUSE 7.0 and i have a problem with the Firewall and VPN's I've opened my wall to the ports specified in the VPN manual, and the firewall blocks data anyway. It goes for a high port and even if that high port is allowed the firewall blocks it anyway. Why is that? The port is 655535 The VPN software that i am running is PPtP Please Help

1 0

[suse-security] X-Problem due to firewall
by Markus Kohli 18 Aug '01

18 Aug '01

Hi! Since I'm so paranoic and locked down my whole machine, I have a problem now... I installed SuSE Firewall 2 and configured it. Now, it's really great, noone getting in at all, BUT:¨At my office I use to rsh to a server quite often, and now I don't get the X-forwarding to work anymore, since my firewall blocks just about everything. Where do I have to change what, to get that up and running again? TIA markus

3 2

security beginner asking for assistance
by Jeff Barnes 18 Aug '01

18 Aug '01

Being new to suse linux may I ask a few questions about suse security? I'm using suse 7.1 Pro and am confused about the firewall. Is there a difference in suse personal firewall and suse packet filter firewall? If different are they mutually exclusive or can they be run simultaneously. whan I boot suse personal firewall says "active" and if I turn on packet filter firewall in rc.config the boot message shows it failed. Does suse firewall use ip chains? What services in suse linux 7.1 are known to have security bugs. I shut down everything except httpd in inetd.conf Are there any file protection settings shipped in the distribution that needed to be changed? Anything else that is security vunerable? Can the ip number assigned to an email address give a path through ones firewall to break in? Thankyou, Jeff Barnes

2 2

RE: [suse-security] Antwort: Re: [suse-security] fetchmail securi ty announcement
by Leithner Wolfgang 17 Aug '01

17 Aug '01

*** PGP Signature Status: good *** Signer: Wolfgang Leithner <wolfgang.leithner(a)grohe.at> *** Signed: 17.08.2001 14:34:17 *** Verified: 17.08.2001 14:34:56 *** BEGIN PGP VERIFIED MESSAGE *** So far i've been only a silent (and very happy) observer of this list, taking (most of) the good advises and increasing my knowledge and the security of my networks, but now I think it high time stand up for some loud applause for the SuSE people. I'd like to thank you for the good work you put up and the speed with which you come forth with patches. Keep going we are in your wake :) Wolfgang ______________________________________________________________________ __ Wolfgang Leithner GROHE GmbH Leiter EDV | EDP Supervisor KS/A Beichlg. 6 EMail: wolfgang.leithner(a)grohe.at A-1100 Wien Mobil:+43-(0)664-413 15 45 Tel.: +43-(0)1-680 60-18 Fax: +43-(0)1-689 87 47 ====================================================================== == _ ASCII Ribbon | / \ against | >> Möge der Tux mit Dir sein! << \_/ HTML | >> May the Tux be with You! << / \ in postings | ______________________________________________________________________ __ === PPGP Public Key can be optained via certserver.pgp.com === *** END PGP VERIFIED MESSAGE ***

2 1

Antwort: Re: [suse-security] fetchmail security announcement
by Sven Westenberg 17 Aug '01

17 Aug '01

I installed the "new" fetchmail rpm 5.6.5 for SuSE 7.1, but unfortunately fetchmail does not poll messages with the ETRN command any more. When starting to fetch the mails, fetchmail asks for a password (from lists.debian.org) >Debian bug #85938: fetchmail asks for a password when using ETRN; This is a bug, which is fixed in 5.6.6. So, for me, this is not the right way "to avoid problems"! What could i do, if SuSE does not offer an upgrade to the latest version? CU Sven Thomas Biege <thomas@suse. An: Suse-Security <suse-security(a)suse.com> de> Kopie: Thema: Re: [suse-security] fetchmail security announcement 17.08.2001 11:17 On Fri, 17 Aug 2001, Togan Muftuoglu wrote: > > Hi, Hi. > Just received teh fetchmail related security announcement and IIRC on > thebugtraq list it was mentioned fetchmail 5.8.17 and above is not > vulnerable. Is it SuSE's numbering scheme diffirent or the patch has > been applied to the preivious versions. > > Second why the package numbers are different for 7.1 and 7.2 platforms That's because we patch the original packets instead of making a version upgrade to avoid problems on older SuSE Linux versions. But in special cases we also did a version upgrade + testing, i.e. when the changes are too big. Have a nice weekend. Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84 -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com _____________________________________________ Sven Westenberg EDV/Schäfer Trennwandsysteme GmbH Phone: +49 (2687) 9151-46 Fax: +49 (2687) 9151-30 Email: s.westenberg(a)schaefer-trennwandsysteme.de

5 6