September 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Firewall/IPChains or not ?
by Stefan_Walther＠gehag-dsk.de 08 Sep '01

08 Sep '01

Hi, I think you should install a second firewall. Maybe you should use the following model: INTERNET---FW1---(DMZ, with Webserver)---FW2---LAN You should be able to update your websites from the lan via ftp, without getting intrused by someone of the Internet. Maf king wrote that you should use iptables. Thats right, because of the real NAT which you can enable at FW1. At this point you can redirect incoming connections to port 80 to the webserver in the DMZ. The other ports can be closed if you do not need to use them. At FW2 you can enable NAT to the webserver via iptables. THX, have much fun. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hi A.M. On 2001.09.08 15:17:46 +0100 A. Meinerzhagen wrote: > Hi, List. > > > Is there a save way other than sftp/scp to let people update their > webpages? > Clients are using lots of Windows-Computers. After an Intrusion last > week > we don't like the idea anymore, that people use ftp to put their pages > on the server. Can't think of anything easy... are all your users going to update from inside your LAN, or do thay have to update over the internet? One soloution I have seen to this problem is a temporary FTP password : something like 1. you email the server, 2. a pasword is generated and is only valid for one hour 3. password emailed back to the user. Not great, but cracker has less time when she can intrude your box. > > Does it make sense, with our setup, to use SuSE Firewall at all? > Setup is : > IMHO, it nearly always makes sense to firewall - layers of security make it harder for a bad guy to get anywhere even if he breaks into one box... > WWW---->FW---->(eth0) Webserver (eth1)<--->LAN > ^ > | ^ > |------------------------v-----------------| > > Weird, I know. Incomming Traffic will go throug FW, but outgoing not. > > The Webserver-machine runs two instances of apache, to serve > the www-pages and the local www-pages. That's the reason for the > two NIC's. But by design we have to look at both NIC's as hostile > Networks, because any computer is connected any time to the Inter- > net (University). If using the Firewall, how would a setup look like? > Or better IPChains? And what would the Rules be ? We are serving > only ports 80, 443, and 22 (http, https, ssh) to the "outside" and at > the moment to the "inside" also. If people would insist to use ftp > from inside, what then ? > I'm not sure how you gain anything by having 2 NICs on the same LAN, to my eyes, you seem to be making things too complicated... If you are using kernel 2.4.x, try iptables - it is more flexible than ipchains SuSE firewall basically makes rules for ipchains / iptables so one isn't "better" than the other, they use different ways to do the same thing. Given your unusual set-up (but fairly simple needs), I think you would be better to roll your own using iptables (sorry, Marc ;-) ) Have a look at the HOWTO at http://netfilter.samba.org for some iptables ideas. HTH, Maf. > > Thanks in advance, A. Meinerzhagen > -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

non-Random IP ID
by Togan Muftuoglu 08 Sep '01

08 Sep '01

Hi, To test the effects of tinyproxy I have started on the firewall PC I did a nessus test via www.vulnerabilities.org. I did the test with and without the tinyproxy and the below comment is bothering me. This was not coming out with the tests I did before at the same site with the same Hardware and Software (SuSE linux 7.1 Kernel 2.2.19). The only change is the ISP is assigning the IP's from a different pool used to be 212.156.196.x now it 212.174.48.x /212.174.49.x) and maybe it has something to do from the ISP end ?? or my misconfiguration of something Security Warning found on port general/tcp The remote host uses non-random IP IDs, that is, it is possible to predict the next value of the ip_id field of the ip packets sent by this host. An attacker may use this feature to determine if the remote host sent a packet in reply to another request. This may be used for portscanning and other things. Solution : Contact your vendor for a patch Risk factor : Low -- Togan Muftuoglu

2 3

/lib/ld-2.2.2.so md5sum changed ?
by lars＠newsone.org 08 Sep '01

08 Sep '01

Hi there, I have a couple of suse 7.2 systems, on one of them # rpm -V glibc ..5..... /lib/ld-2.2.2.so # md5sum /lib/ld-2.2.2.so 36e9320d606f456f84951ba510209fc0 /lib/ld-2.2.2.so as opposed to 1312001a7eb2ccb4b666fe9f0775b932 /lib/ld-2.2.2.so as should be. this is glibc-2.2.2-38, and I wonder how this can happen. this one is almost always 'busy', so who or what could have changed it? one other shared libs related effect I have right now is that from one moment to the other our coldfusion server won't restart. it complains about unresolved symbols. any Idea? Thanks You, Lars

4 5

transfering accounts
by stephane parenton 07 Sep '01

07 Sep '01

Hi, I have an old RH6.0 box from which I'd like to export all the accounts to a brand new SuSE 7.2 box. here's the method I'd like to apply : Create the accounts with yast copying the /etc/passwd file from RH6.0 to SuSE 7.2 Copying the /etc/shadow file from RH6.0 to SuSE 7.2 Most of the accounts are customers accounts and I don't have all the passwd, so I don't want to miss one thing.... Regarding roots and internal accounts, everything is ok, I have the passwds.... Is the process correct, is it enough ? is there a simpler way to do this all ? Thanx Stephane

4 3

Apache problem behind packet filter
by Andreas Rittershofer 07 Sep '01

07 Sep '01

Due to security considerations my web server is placed behind a packet filter, both linux boxes. The webserver has the internal ip address 10.0.0.171, the packet filter has to the internal side the ip address 10.0.0.170 and to the outside the official ip address which would have the web server itself in case of no packet filter in between. On the webserver are hosted the pages of three domains, all under the same ip address, as name based virtual hosts, say domain1, domain2 and domain3. For domain1 there are the appropriate entries in /etc/hosts. When I want to access the web server apache with domain1 locally, i.e. with wget, all works fine. But for domain2 and domain3, this does not work, wget runs in a timeout. This is quite clear, because DNS gives the official ip address, not the internal 10.0.0.171. I added domain1 and domain2 to /etc/hosts, but two hours later, the server hanged. Was it the wrong syntax in /etc/hosts? How this must be? Or is it not possible to list more then one FQDN in /etc/hosts? Should it be 10.0.0.171 domain1 domain2 domain3 each as FQDN? mfg ar -- mailto:andreas@rittershofer.de http://www.rittershofer.de PGP-Public-Key http://www.rittershofer.de/ari.htm

1 0

Strobe
by Geraint Jones 07 Sep '01

07 Sep '01

Where can I download and how do I use strobe with SuSE 7.2 (kernel 2.4.4)? Thanks, G Jones.

2 1

Re: [suse-security] SuSEfirewall2 and ICMP
by James Bliss 07 Sep '01

07 Sep '01

I have mine with FW_ALLOW_EXT and this allows my internal clients to ping the internet. It sounds like you have something else setup which is preventing this ping. What are your settings for: FW_MASQ_NETS FW_ROUTE FW_MASQ_DEV FW_PROTECT_FROM_INTERNAL Jim 09/04/01 12:57:59 PM, "Peter Menzel" <Peter.Menzel(a)com-gmbh.de> wrote: >Hello, > >I successfully installed SuSEfirewall2 and configured it to my needs. The >firewall box is set up with two external interfaces (ippp0 and eth1). eth1 >is normally connected to an ELSA DSL router and in case DSL will not work I >want to switch back to ISDN. So far I've set up ISDN and that stuff, the box >is doing everything fine. Clients can do http, https, ftp, mail and so on. >Portscans run from the internet report all ports as stealth and the firewall >cannot be pinged from the internet. >But when it comes to a ping from the internal network to the internet, >nothing works. I've tried all the FW_ALLOW_PING_[FW|DMZ|EXT] settings, with >no results. Interesting: when I set FW_FORWARD_PING_DMZ="yes" I am able to >ping the internet from the firewall, but not from the clients. More >interesting: I have not configured a DMZ (yet). >What I would like to do is to ping the internet from the clients and get the >echo-reply back. echo-requests from the internet have to be dropped at the >firewall. >Has anyone experienced these problems? Any help would be appreciated. > >Thanks in advance, Peter >peter.menzel(a)com-gmbh.de > > > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

2 1

SuSEfirewall V1.2 > 1.7 wont work
by Appeldorn 07 Sep '01

07 Sep '01

OK - its Friday - but maybe there is quick hack possible. If if upgrade the script to v1.7 the whole box is closed. Why that ? Easy to circumvent ? Michael

1 0

SuSEfirewall2 all UDP port open ???!!!
by Appeldorn 07 Sep '01

07 Sep '01

At initially test i saw all my udp ports open in my testbed network. In the configfile of SuSEfirewall2 you can read : # 8.) # Do you want to autoprotect all running network services on the firewall? # # If set to "yes", all network access to services TCP and UDP on this machine # will be prevented (except to those which you explicitly allow, see below: # FW_SERVICES_{EXT,DMZ,INT}_{TCP,UDP}) # # Choice: "yes" or "no", defaults to "yes" # FW_AUTOPROTECT_SERVICES="yes" and I did FW_SERVICES_EXT_TCP="22" # Common: smtp domain FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" # For VPN/Routing which END at the firewall!! # FW_SERVICES_DMZ_TCP="" # Common: smtp domain FW_SERVICES_DMZ_UDP="" # Common: domain syslog FW_SERVICES_DMZ_IP="" # For VPN/Routing which END at the firewall!! # FW_SERVICES_INT_TCP="8080" # Common: ssh smtp domain FW_SERVICES_INT_UDP="" # Common: domain syslog FW_SERVICES_INT_IP="" if nmap -sU against the external interface from external host all udp-port comes up with. so why ? Starting nmap V. 2.02 by Fyodor (fyodor(a)dhp.com, www.insecure.org/nmap/) WARNING: -sU is now UDP scan -- for TCP FIN scan use -sF Interesting ports on (10.10.10.10): Port State Protocol Service 1 open udp tcpmux 2 open udp compressnet 3 open udp compressnet ... 48001 open udp nimspooler 48002 open udp nimhub 48003 open udp nimgtw

1 1

[Fwd: Re: [suse-security] Block IP in firewall]
by Jussi Jääskeläinen 07 Sep '01

07 Sep '01

-------- Original Message -------- Subject: Re: [suse-security] Block IP in firewall Date: Fri, 07 Sep 2001 12:58:21 +0300 From: Jussi Jääskeläinen <jussi.jaaskelainen(a)audioriders.fi> To: Boris Lorenz <bolo(a)lupa.de> References: <XFMail.010907110830.bolo(a)lupa.de> Boris Lorenz wrote: > > Jo, > > On 06-Sep-01 dog(a)intop.net wrote: > > you can use a REJECT instead of DENY for the ipchains rule and your > > machine will not appear to even be online. if you use the deny rule, they > > can still tell what ports you have open, but cannot connect to them. > > For the records, ipchains REJECT sends out ICMP type 3 (host/port unreachable) > messages to the client, telling him to stop sending packets because there would > be no service on the port the client is hammering on. DENY silently drops the > packet, telling the client nothing, who may keep on scanning and filling your > logs. How about sending "TTL-timeout" (or what router send when ttl-value goes zero)?

1 0