August 2001 - openSUSE Security - openSUSE Mailing Lists

FreeS/WAN tunnel established, no data transferred
by Stefan_Walther＠gehag-dsk.de 29 Aug '01

29 Aug '01

hi folks, I have the following problem. I have an established IPSec-tunnel between 2 boxes. I'm using SuSE7.1 and FreeS/WAN 1.91. The FreeS/WAN tells me that the tunnel is established (last message in /var/log/messages). My configuration is the following: 1st client------1st FreeS/WAN-gateway-----ROUTER-----2nd FreeS/WAN-gateway-------2nd client eth0---eth0---------------------------eth1---eth1------eth0--eth0-----------------------------eth1----eth0 !Every box is a linux box! The 1st client has the following config: RedHat7.1, IP: 192.168.200.2 The 1st FreeS/WAN-gateway config is: SuSE 7.1, kernel 2.4.7, eth0: 192.168.100.1, eth1: 172.16.100.1, IP-forwarding without masquerading The Router has the following config: SuSE7.1, kernel 2.4.7, eth1: 172.16.100.2, eth0 10.16.100.2, IP-forwarding without masquerading The 2nd FreeS/WAN-gateway config is: SuSE7.1, kernel 2.4.7, eth0: 10.16.100.1, eth1: 192.168.200.1, IP-forwarding without masquerading The 2nd client has the following config: Windows2000, eth (seems to be a littlebit stupid): 192.168.100.2 Every netmask is 255.255.255.0; If i start ipsec via, ipsec start at the shell, no error (exept the IPv6-bind error) occured. Before starting IPSec the routes, the the clients can pinging each other are set by hand. FreeS/WAN sets the routes to the ipsec0 interface. After starting you cannot ping anymore from the 1st client to the 2nd client ans the other way around. Does anybody know a solution for this problem??? THX MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961

4 3

RE: [suse-security] Looking for a secure time service
by Reckhard, Tobias 29 Aug '01

29 Aug '01

> iptables -t filter -A INPUT -i <your interface> -m state -p udp -d <your > ip> -s <ntp server> --sport 123 --state ESTABLISHED -j ACCEPT > iptables -t filter -A OUTPUT -o <your interface> -m state -p udp -s <your > ip> -d <ntp server> --dport 123 --state NEW,ESTABLISHED -j ACCEPT > I must have missed something.. What's the 'filter' table in netfilter? I guess I've been away from that list for too long.. Apart from that, you can further specify the local port, as (x)ntpd will always use UDP port 123. Otherwise, it looks good (IMHO). Tobias

2 1

RE: [suse-security] SuSEfirewall2: are these IPs private or not?
by Reckhard, Tobias 29 Aug '01

29 Aug '01

> Yep, you're right. BTW, I don't know why I shouldn't MASQ > non-private addresses. Let's call it "address hiding" and you > have a security feature which is not that bad! I used this for > protecting call back lines (which wouldn't hangup when a portscan > is done against the called back host otherwise). > Well, I'm one of those who prefers to use NAT what it's for, i.e. make up for a limited number of official IP addresses. I don't see it as a security feature, at least not any more than stateful packet filtering, as that's basically what it requires to work at all. However, you get all sorts of silly side effects by violating TCP/IP. I prefer to do what firewalling I can with ALGs, circumventing the need for NAT. If I can place the ALGs in a DMZ, I try to obtain official IP addresses for them. There is no need to perform NAT between the DMZ and the internal network (with private IP addresses). You only need NAT when packets need to traverse from the internal network to the outside, there being no suitable proxy available. Tobias

1 0

RE: [suse-security] Linux router vs hardware router
by Reckhard, Tobias 29 Aug '01

29 Aug '01

> What's the recommended way to transfer log files securely to a remote > machine? > I'd use a separate administrative network with a syslog server or end-to-end IPSec. Perhaps even both. Tobias

1 0

Getting information about a certain user's activity
by Andreas Achtzehn 29 Aug '01

29 Aug '01

Dear list readers, since I have a user on my system who keeps playing around with my nerves (tries new security holes a.s.o.) I'd like to keep track of his activity. The user logs in using a SSH connection. I'm root on that server. I'd like to see what that user sees on his console. Is there a way to get the same screen the user has? Something like tail -f /dev/pts/0 (which doesn't work)? Thanks in advance, Andreas Achtzehn -- /------------------------------------------\ | the linux-society Andreas Achtzehn| | visit us at www.linux-society.de| | or call (+49)179-4948706| \------------------------------------------/

3 2

Re: FreeS/WAN tunnel established, no data transferred
by Stefan_Walther＠gehag-dsk.de 29 Aug '01

29 Aug '01

Hi Steffen, hi folks 1st: Yes I get the message "SA established" 2nd: I set the routes manually by hand so I can ping w/o FreeS/WAN from one network to the other. 3rd: As I started FreeS/WAN and have a look at "netstat -rn", I saw that FreeS/WAN sets the routes from ethX to ipsecX. 4th: The last one (you mean tcpdump or somthing like that), I forgot to use it (my fault, next time). THX MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 * Stefan_Walther(a)gehag-dsk.de wrote on Wed, Aug 29, 2001 at 07:32 +0200: > I'm using SuSE7.1 and FreeS/WAN 1.91. The FreeS/WAN tells me that the > tunnel is established (last message in /var/log/messages). You got "SA established on both" sides, yes? > My configuration is the following: > > 1st client------1st FreeS/WAN-gateway-----ROUTER-----2nd > FreeS/WAN-gateway-------2nd client > > eth0---eth0---------------------------eth1---eth1------eth0--eth0-----------------------------eth1----eth0 > !Every box is a linux box! (your notation is hard ot read/"parse" :)) > The 1st client has the following config: RedHat7.1, IP: 192.168.200.2 > The 1st FreeS/WAN-gateway config is: SuSE 7.1, kernel 2.4.7, eth0: > 192.168.100.1, usually you sould get a "network unreachable" when trying to set a route via 100.1/24 on 200.2/24... They are in different networks. You may wish to change one of the IPs to be in the same network. I wonder why you can ping w/o tunnel. For testing, put both in 100.0/24 and set a default route through 100.1. > eth1: 172.16.100.1, IP-forwarding without masquerading > The Router has the following config: SuSE7.1, kernel 2.4.7, eth1: > 172.16.100.2, eth0 10.16.100.2, IP-forwarding without masquerading > The 2nd FreeS/WAN-gateway config is: SuSE7.1, kernel 2.4.7, eth0: > 10.16.100.1, eth1: 192.168.200.1, 200.1 is bad, since you already used that network on right side. But if you change it to 100.0/24 it would be ok. > IP-forwarding without masquerading > The 2nd client has the following config: Windows2000, eth (seems to be a > littlebit stupid): 192.168.100.2 Again not in the same network as the router. If you change right to 100.0/24 change it here to i.e. 200.0/24, that means change W2K to 200.2 and give it a default route through 200.1 > Every netmask is 255.255.255.0; > > If i start ipsec via, ipsec start at the shell, no error (exept the > IPv6-bind error) occured. > Before starting IPSec the routes, the the clients can pinging each other > are set by hand. Are you really really sure it works? Are you sure that you reached the right target? I cannot believe it. > FreeS/WAN sets the routes to the ipsec0 interface. It would be interesting to see route -n with and without tunnel (before and after ipsec auto --up ...) > After starting you cannot ping anymore from the 1st client to the 2nd > client ans the other way around. Does anybody know a solution for this > problem??? Yep, trace it :) in the middle, on "router" you can sniff traffic. On IPSec handshake you should see some UDP:500-->500 packets. The ping through the tunnel should generate IP proto=50 packets with source/destination IP of the gateways (and not with the source from the real client and not with the real destination since it's tunneled). Often you see only packets in one direction but no answers. In this case sniff on next machine and check if the packet gets lost somewhere. On a VPN gw you can sniff on ethX (and you see proto=50) and on ipsecX. On ipsecX you see the decrypted packets and you can check if they look good. If you don't see anything on ipsecX the proto=50 packet was wrong and has been dropped. Check this all and mail the results/details. Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel. _______________________________________________ Users mailing list Users(a)lists.freeswan.org http://lists.freeswan.org/mailman/listinfo/users

1 0

Re: [suse-security] Looking for a secure time service
by Ralph Seichter 29 Aug '01

29 Aug '01

jdanield(a)dodin.net wrote: > I beg you pardon if I say something stupid, but why can't you use > a cron task and a small script to do so. I can't see a security > problem as so. once a day should be enough. A time server does a lot more than ask one other host about the current time. There's multiple servers, clock drifts, networking lags and much more involved. I want to provide a couple of machines in my internal network with the most accurate time information available from public Stratum 2 time servers (with a reasonable amount of effort and as-low-as-possible security risk). I think a time server on my firewall is the method of choice. A time server in a DMZ would probably be even better, but as I don't use a DMZ yet, I'll go for the firewall. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

2 1

SuSEfirewall2: are these IPs private or not?
by Florian Pressler 29 Aug '01

29 Aug '01

Hi! In RFC1918, I found this: The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets. 10.0.0.0 - 10.255.255.255 (10/8 prefix) 172.16.0.0 - 172.31.255.255 (172.16/12 prefix) 192.168.0.0 - 192.168.255.255 (192.168/16 prefix) I decides to assign the following IPs to the hosts in my LAN: 172.20.30.40/29, i.e 172.20.30.41 - 172.20.30.46. When I start SuSEfirewall2, there appears an errormessage: The network 172.20.30.40/29 you want to masquerade is not from a private network. Change this! Is this an error of SuSEfirwall2, or do I misunderstand something completely? regards Florian Pressler _________________________________________________________________ Downloaden Sie MSN Explorer kostenlos unter http://explorer.msn.de/intl.asp

6 7

Antwort: Re: [suse-security] WEP and wireless
by christian.burri＠synecta.ch 29 Aug '01

29 Aug '01

WEP is based on the RC4 stream chipher, which has some fundamental design flaws. It has to do with various things; I suggest the audience read http://www.isp-planet.com/technology/2001/wep_p2.html Cheers Chr. Burri btw: Airsnort rulez ;-) .-. /v\ L I N U X // \\ >I know Kung Fu!< /( )\ ^^-^^

1 0

Re: [suse-security] FreeS/WAN tunnel established, no data transferred
by Stefan_Walther＠gehag-dsk.de 29 Aug '01

29 Aug '01

Hi, first this should be a testnetwork, where i can test FreeS/WAN before using it in a productive system. second the routing was needed, because the tunnel do not establish if there are no routeable IPs. the pinging from the first to the second client and the otherway aroud works without starting FreeS/WAN. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hi, > hi folks, > [...] > > My configuration is the following: > > 1st client------1st FreeS/WAN-gateway-----ROUTER-----2nd > FreeS/WAN-gateway-------2nd client > > eth0---eth0---------------------------eth1---eth1------eth0--eth0-----------------------------eth1----eth0 > !Every box is a linux box! > > The 1st client has the following config: RedHat7.1, IP: 192.168.200.2 > The 1st FreeS/WAN-gateway config is: SuSE 7.1, kernel 2.4.7, eth0: > 192.168.100.1, eth1: 172.16.100.1, IP-forwarding without masquerading > The Router has the following config: SuSE7.1, kernel 2.4.7, eth1: > 172.16.100.2, eth0 10.16.100.2, IP-forwarding without masquerading > The 2nd FreeS/WAN-gateway config is: SuSE7.1, kernel 2.4.7, eth0: > 10.16.100.1, eth1: 192.168.200.1, IP-forwarding without masquerading > The 2nd client has the following config: Windows2000, eth (seems to be a > littlebit stupid): 192.168.100.2 > > Every netmask is 255.255.255.0; and you have trafic between 1st client and 2nd client without ipsec-tunnel? I can't believe it. 1st client and 1 FreeS/WAN gate are not in the same net and so aren't 2nd FreeS/WAN-gate and 2nd client. You'll have a very odd routing table. What is the goal of setting up ipsec? I can't see an unauthorized listener on your setup, execpt he/she has access to your FreeS/WAN-gates or the client. In sutch case ipsec will be be no security improvement. Yours Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

1 0