August 2001 - openSUSE Security - openSUSE Mailing Lists

sendmail
by phil 27 Aug '01

27 Aug '01

I need to know something. I type which sendmail and I get /usr/sbin/sendmail BUT I use postfix so. do I need to upgrade sendmail ? I didn't think you can install both at the same time. so why is there a sendmail?

4 3

Re: [suse-security] SuSEfirewall2 v1.6 question? FAQ?
by maf king 27 Aug '01

27 Aug '01

On 2001.08.27 11:48:14 +0100 Tall0n wrote: > > Hi Tall0n > > > > On 2001.08.26 23:45:38 +0100 Tall0n wrote: > > > Ok...Maybe I'm not getting something. I have a SuSE 7.2 machine with > 2 > > > network cards. eth0 is world device (Real Static IP) and eth1 > (Private > > > Static IP) is internal device. Masquerading is happening for > machines on > > > the > > > internal network. > > > > > > > <SNIP> > > > > > in the /var/log/firewall log saying that it denied a request on eth1 > for > > > DPT=80. > > > > > > What am I missing? Losing hair...hehehe > > > > One of my systems is virtually identical to this. Can you post a full > log > > entry for the failed packets please? > > > > Maf. > > > To make this happen, I had an internal machine try to access the > webserver on the firewall machine using the external address. If this > same machine access the webserver using the internal address, then > everything works fine. > However, I don't want to be running an internal dns server to fix this. > I want the internal machines to able to access the external device. > Here is a log entry.... > Aug 27 06:42:21 Tall0n kernel: SuSE-FW-ACCESS_DENIED_FOR_INTIN=eth1 OUT= > MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx > SRC=192.168.xxx.xx DST=216.27.xxx.xxx LEN=60 TOS=0x08 PREC=0x00 TTL=64 > ID=25480 DF PROTO=TCP SPT=32950 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 > OPT (020405B40402080A0065A8AC0000000001030300) > -- > GregWorld.com > Hi Tall0n, I had a similar problem a while ago with a similar set-up : apache running on a firewall box, and the internal hosts couldn't see the external port 80. I think the problem is that the packets arrive on eth1 and get blocked somehow going through the loopback interface, and with the added complication of SNAT "masquerading" it can all become a bit confusing. I ended up adding a rule to the firewall along the lines of : iptables -A input -i eth1 -p tcp -s 192.168.xxx.0/24 -d $public_ip --dport 80 -j ACCEPT where in your case, I guess $public_ip = 216.27.164.230 HTH Maf. > > -- > GregWorld.com > > -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

RE: [suse-security] SuSEfirewall2: are these IPs private or not?
by Ralph Seichter 27 Aug '01

27 Aug '01

Tobias Reckhard wrote: > CIDR with private addresses is just as legal as with any other part of > the IPv4 address space. In fact, it is highly common when using the 10/8 > address space from RFC 1918. I did not try to imply that CIDR is illegal with private addresses, I only said I have not seen it so far. Anyway, as stated before, I am not a networking guru, so I stand humbly and corrected. ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

RE: [suse-security] SuSEfirewall2: are these IPs private or not?
by Reckhard, Tobias 27 Aug '01

27 Aug '01

> Florian used 172.20.30.40/29. This could of course also be interpreted as > a fragment of a Class C network, which I believe is what Florian intended > and what you suggest. > Actually, it *must* be interpreted as a subnet of the class B network 172.20. 172.20 has 16 bits of network address, the use of /29 means that an additional 13 bits define the subnet. > But as 172.20.x.y is historically in "Class B address space" (lacking a > better expression), it might be misinterpreted if you use a different > netmask than 255.255.0.0. I have not yet seen CIDR with *private* Class A > or Class B networks, so my suggestion is to try 192.168.x.0/29 instead. > CIDR with private addresses is just as legal as with any other part of the IPv4 address space. In fact, it is highly common when using the 10/8 address space from RFC 1918. AFAIK, it is even legal in CIDR to do 'supernetting', i.e. use networks such as 192.168/16 or 192.168.64/18. Many programs complain about that, though. Tobias

1 0

Re: [suse-security] SuSEfirewall2 v1.6 question? FAQ?
by Tall0n 27 Aug '01

27 Aug '01

> Hi Tall0n > > On 2001.08.26 23:45:38 +0100 Tall0n wrote: > > Ok...Maybe I'm not getting something. I have a SuSE 7.2 machine with 2 > > network cards. eth0 is world device (Real Static IP) and eth1 (Private > > Static IP) is internal device. Masquerading is happening for machines on > > the > > internal network. > > > > <SNIP> > > > in the /var/log/firewall log saying that it denied a request on eth1 for > > DPT=80. > > > > What am I missing? Losing hair...hehehe > > One of my systems is virtually identical to this. Can you post a full log > entry for the failed packets please? > > Maf. > > > > > TIA, > > > > Tall0n > > -- > > -- > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Maf. King > Standby Exhibition Services > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > "It is easier to do a job right than to explain why you didn't." > > - Martin Van Buren > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com To make this happen, I had an internal machine try to access the webserver on the firewall machine using the external address. If this same machine access the webserver using the internal address, then everything works fine. However, I don't want to be running an internal dns server to fix this. I want the internal machines to able to access the external device. Here is a log entry.... Aug 27 06:42:21 Tall0n kernel: SuSE-FW-ACCESS_DENIED_FOR_INTIN=eth1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.xxx.xx DST=216.27.xxx.xxx LEN=60 TOS=0x08 PREC=0x00 TTL=64 ID=25480 DF PROTO=TCP SPT=32950 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A0065A8AC0000000001030300) -- GregWorld.com

1 0

Re: [suse-security] SuSEfirewall2: are these IPs private or not?
by Tall0n 27 Aug '01

27 Aug '01

> * Ralph Seichter wrote on Mon, Aug 27, 2001 at 10:37 +0200: > > Florian Pressler wrote: > > > > > I decides to assign the following IPs to the hosts in my LAN: > > > 172.20.30.40/29, i.e 172.20.30.41 - 172.20.30.46. > > > > 172.20.x.y is a Class B network with a 255.255.0.0 netmask, so you should > > probably refer to your network as 172.20.0.0/16 in the abbreviated form. > > I'm not a networking guru, however. > > What should this help? Today CIDR is done all the time. Maybe the > script parses the netblock in a wrong way or so. Maybe you should > take a look at the sources. > > oki, > > Steffen > > -- > Dieses Schreiben wurde maschinell erstellt, > es trägt daher weder Unterschrift noch Siegel. > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com To make this happen, I had an internal machine try to access the webserver on the firewall machine using the external address. If this same machine access the webserver using the internal address, then everything works fine. However, I don't want to be running an internal dns server to fix this. I want the internal machines to able to access the external device. Here is a log entry.... Aug 27 06:42:21 Tall0n kernel: SuSE-FW-ACCESS_DENIED_FOR_INTIN=eth1 OUT= MAC=xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx:xx SRC=192.168.xxx.xx DST=216.27.xxx.xxx LEN=60 TOS=0x08 PREC=0x00 TTL=64 ID=25480 DF PROTO=TCP SPT=32950 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A0065A8AC0000000001030300) -- GregWorld.com

1 0

snort config
by oli retsd 27 Aug '01

27 Aug '01

I am using Snort (version 1.7) and a dhchp server on eth. In the config, they told me to use : var HOME_NET $eth0_ADDRESS but it is not working ... so what do I have to write for make it work under suse 7.2 ? ___________________________________________________________ Do You Yahoo!? -- Un e-mail gratuit @yahoo.fr ! Yahoo! Courrier : http://fr.mail.yahoo.com

3 2

Linux router vs hardware router
by Stefan Hoffmeister 27 Aug '01

27 Aug '01

Hi, my Linux gateway appliance (an old notebook), serving a small LAN with essentially just dial-on-demand DSL and basic packet filtering (SuSE firewall), just died, so I need some kind of a replacement. I wonder whether I should go the Linux appliance route (purchase some very silent, inexpensive hardware and build up a system), or whether a specialised hardware appliance would perform better (and cost less). The sole purpose of the appliance will be to provide dial-on-demand DSL services to the LAN, some very basic security (all LAN clients will be running ZoneAlarm or SuSE firewall[2]), and hopefully some VPN functionality. http://www.zyxel.com/product/dslcablesharing/p310.htm supports PPTP and IPsec passthrough. http://www.zyxel.com/product/firewall/zywall10.htm will support IPsec endpoint feature. Instead of running a client on PC your router will act as a client and this will enable AH support as well. It will be a IPsec Client/Server and it will support both IPsec protocols ESP (IP protocol 50) and AH (IP protocol 51) for both modes "transport" and "tunnel" >From a security point of view only, I'd be interested in * how much risk is there for a vulnerability in these routers (and if there is a vulnerability, how bad can it get?); * how good is, potentially, the "protection" (through packet filtering or stateful filtering) compared to the facilities offered by the Linux 2.2 / 2.4 kernels? TIA, Stefan

5 5

Re: [suse-security] SuSEfirewall2: are these IPs private or not?
by Ralph Seichter 27 Aug '01

27 Aug '01

Florian Pressler wrote: > I decides to assign the following IPs to the hosts in my LAN: > 172.20.30.40/29, i.e 172.20.30.41 - 172.20.30.46. 172.20.x.y is a Class B network with a 255.255.0.0 netmask, so you should probably refer to your network as 172.20.0.0/16 in the abbreviated form. I'm not a networking guru, however. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

2 1

RE: [suse-security] sendmail
by Reckhard, Tobias 27 Aug '01

27 Aug '01

> On Sun, Aug 26, 2001 at 07:44:41PM -0700, phil wrote: > > > > I type which sendmail > > and I get /usr/sbin/sendmail > > > > BUT I use postfix > > Maybe that is just a link to some postfix program in order to provide > a sendmail-like interface... > > If you did not install sendmail from a source file and rpm -q sendmail > gives no answer, IMHO your system should be safe wrt. to the sendmail > problem. > Or, better yet, try 'rpm -qf /usr/sbin/sendmail', which will tell you which RPM the file belongs to. Tobias

1 0