September 2001 - openSUSE Security - openSUSE Mailing Lists

ssh-incompatibility ?
by Daniel Quappe 05 Sep '01

05 Sep '01

hi list, today i've got a problem: maybe someone out there already knows... i connected two hosts by dialin and wanted to use ssh for communication. this was the error-output (ssh -v): SSH Version 1.2.27 [i386-suse-linux], protocol version 1.5. Standard version. Does not use RSAREF. dbs: Reading configuration data /etc/ssh_config dbs: ssh_connect: getuid 0 geteuid 0 anon 0 dbs: Allocated local port 1022. dbs: Connecting to 192.168.23.115 port 22. dbs: Connection established. dbs: Remote protocol version 2.0, remote software version OpenSSH_2.3.0p1 dbs: Waiting for server public key. Local: Bad packet length 1349676916. 192.168.23.115 is the dialin-server and 192.168.23.116 the client-machine. does anyone know this problem (and a solution..;-) ? best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

SuSEfirewall2 questions ?
by Eric Romang 05 Sep '01

05 Sep '01

Hello, I have install SuSEfirewall2 on my serveur with two ethernet card. One for the private network, the other to the internet. I have some crash from the server I can't explain. The server freeze and i don't have the hand on it... no more root login possible and the tty are froozen... I have no error messages in my message log file, and also in my firewall message. But I have this line in my message log and warm message. My message log messages : Sep 6 12:04:36 lithium SuSEfirewall2: Firewall rules successfully set from /etc/rc.config.d/firewall2.rc.config Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: SuSEpersonal-firewall: Loading of module ipchains was not successful. Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No action taken. My warm log messages : Sep 6 12:04:35 lithium kernel: ip_tables: (c)2000 Netfilter core team Sep 6 12:04:35 lithium kernel: ip_conntrack (2047 buckets, 16376 max) Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: SuSEpersonal-firewall: Loading of module ipchains was not successful. Sep 6 12:04:36 lithium /sbin/SuSEpersonal-firewall: Aborting. No action taken. I have also, my sylogd how run dhcp, but i don't have start the dhcpd on startup... I can see a line in process... Somebody can explain me why my server freeze ?? And another question, I wan't to upgrade my SuSEfirewall2. What are the step to remove the old one ? Thanxs. Regards Eric Romang - System Administrator eric.romang(a)synapse.lu ---------------------------------------------------------------------------- --------- Site : http://www.synapse.lu Synapse Internet Services 49, Bd. G-D. Charlotte, L-1331 Luxembourg Tel : +352 / 44 79 44 77 Fax : +352 / 44 79 44 79 GSM : +352 / 021 7000 35 ---------------------------------------------------------------------------- ---------

2 1

[suse-security] problem with firewall and X-forwarding
by kohli＠dplanet.ch 05 Sep '01

05 Sep '01

Hi again. I already asked that question once, but then I didn't get any helpful answers... Following problem: I'm in the intranet at my office, and want to work on a remote server. Let's call him jasper. So, I'm on jasper an make a "xspread". Now I get the following answer: xspread: Can't open display client84.xxxx.xx:0 It doesn't matter whether I use ssh or rlogin or rsh to log in to jasper, it simply doesn't work. My firewall log says: Sep 5 11:17:55 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 xxx.xx.xxx.xx:60972 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5353 F=0x4000 T=255 SYN (#5) Sep 5 11:17:56 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 xxx.xx.xxx.xx:60974 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5354 F=0x4000 T=255 SYN (#5) Sep 5 11:17:57 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 1xxx.xx.xxx.xx:60975 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5355 F=0x4000 T=255 SYN (#5) Sep 5 11:17:58 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 1xxx.xx.xxx.xx:60976 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5356 F=0x4000 T=255 SYN (#5) Sep 5 11:17:59 memphis kernel: Packet log: rulchain REJECT eth0 PROTO=6 xxx.xx.xxx.xx:60977 xxx.xx.xxx.xx:6000 L=44 S=0x00 I=5357 F=0x4000 T=255 SYN (#5) Now, how can I solve that problem? Also, I wonder why the outgoing port on jasper is steadily inceasing by one, with each attempt to connect...? Any help appreciated! TIA markus

2 1

SuSEfirewall2 and ICMP
by Peter Menzel 04 Sep '01

04 Sep '01

Hello, I successfully installed SuSEfirewall2 and configured it to my needs. The firewall box is set up with two external interfaces (ippp0 and eth1). eth1 is normally connected to an ELSA DSL router and in case DSL will not work I want to switch back to ISDN. So far I've set up ISDN and that stuff, the box is doing everything fine. Clients can do http, https, ftp, mail and so on. Portscans run from the internet report all ports as stealth and the firewall cannot be pinged from the internet. But when it comes to a ping from the internal network to the internet, nothing works. I've tried all the FW_ALLOW_PING_[FW|DMZ|EXT] settings, with no results. Interesting: when I set FW_FORWARD_PING_DMZ="yes" I am able to ping the internet from the firewall, but not from the clients. More interesting: I have not configured a DMZ (yet). What I would like to do is to ping the internet from the clients and get the echo-reply back. echo-requests from the internet have to be dropped at the firewall. Has anyone experienced these problems? Any help would be appreciated. Thanks in advance, Peter peter.menzel(a)com-gmbh.de

1 0

ssh question
by Sven Michels 04 Sep '01

04 Sep '01

Hi there, i've a problem with openssh behind a 2.4.x firewall. If i try to connect to the outside, i got no response until setting the -P flag. with -P it works fine. So it seems to be a problem with the nonprivat port. is there a firewall missconfiguration or something i missed? with 2.2.19 all works fine (without -P). Regards, Sven -- intraDAT AG http://www.intradat.com Wilhelm-Leuschner-Strasse 7 Tel: +49 69-25629-0 D - 60329 Frankfurt am Main Fax: +49 69-25629-256

3 5

AW: [suse-security] ucd-snmpd default configuration
by Reckhard, Tobias 04 Sep '01

04 Sep '01

> > SNMP is not only read but write typically. > > In it's default configuration, really? > I'd suppose so as well. It depends on the configuration of the SNMP server. > > easier to sniff (cleartext). > > I thought it's possible to set up SNMP using some encryption by > itself, but a quick search didn't found a useful HOWTO neither > about SNMP nor encryption nor security... Except "disable if not > needed"... > AFAIK, SNMPv3 will support encryption and a decent authentication scheme, but most SNMP implementations out there are still v1 or v2. Actually, I think that the SNMPv3 standard hasn't even been passed yet. > Yep, of course the firewalls restrict it to just one machine, but > I would like to make sure that the snmpd will not allow bad > things under any cirumstances. Firewalling is quite clear, like > always :) > Well, you can never be 100% sure.. (responding to your phrase. "..under *any* circumstances...". And whether things are good or bad depends a lot on the context they happen in. > > and maybe using ssh port forwarding or ipsec to encrypt it. > > IPSec with each machine is to expensive and won't help, since it > the monitor gets compromised IPSec can be used by unauthorized > software - same for SSH, so I don't see a big improvement. > Why do you consider IPSec too expensive? As it is, you don't need to do IPSec with all hosts, you can configure it on a host by host basis. In fact, you need to, unless you've got DNSSEC set up, as you need a host-specific authentication entity for each host. Still, it's not much more work than SSH, IMHO. As far as the security offered by IPSec is concerned, IPSec gives you real authentication of the source of IP packets. SNMP uses UDP, which makes the combination of easy source address spoofing and access to configuration commands (SNMP RW) a very risky thing. IPSec can prevent spoofing and keep sniffers from reading your SNMP data as well. Tobias

2 3

Re: [suse-security] SuSE-FW-DROP-ANTI-SPOOFING
by Burghard W.V. Britzke 04 Sep '01

04 Sep '01

The SuSEfirewall2 v1.6 is quite good! I found the thing. My internal net is 192.175.233.0/24 my external net is 192.175.233.0/30 (a two bit subnet with only the router and my firewall in it). There are rules to prevent boxes from extenal to be routed to internal if they have an internal address. Unfortunally 192.175.233.0/24 (my internal net) includes 192.175.233.0/30 (my extenal net). So my router cannot communicate with internal boxes. This is not as bad as it seems to because all packets which are forwarded from outside are not rejected by the ANTI-SPOOF rule (but it is most likely that they are rejected by other rules ;-)) For configuration purposes I simply delete the two DROP rules and the two LOG rules from input_ext chain (and may be from forward_ext chain if I want forwarding to my router). Steffen Schoch and Martin Haas antworteten (answered) > ... > > "Burghard W.V. Britzke" wrote: > > > > hello, > > I have problems to contact my firewall from outside. Our uunet router is capable to contact our firewall and some of the services provided > > internally from outside. but when I plug a local pc with the same IP address to the FW_DEV_EXT network and try to connect to smtp (for > > example) I get > > SuSE-FW-DROP-ANTI-SPOOF IN=eth0 OUT= MAC=... SRC=<router> DST=<firewall> LEN=48 TOS=0x0 > > 0 PREC=0x00 TTL=128 ID=546 DF PROTO=TCP SPT=1043 DPT=25 WINDOW=16384 RES=0x00 SY > > N URGP=0 OPT (020405B401010402) > > > > again: the uunet router is capable to send mails via smtp port and I do not get the above error message. Why do I get those messages?

1 0

Ftp from DMZ with SuSEfirewall2 v1.7
by wbrune 04 Sep '01

04 Sep '01

Hello, I've setup an Firewall with SuSEfirweall2 v1.7. It has got 3 Interfaces. EXT, DMZ and INT. In the DMZ is a Server running Squid and Sendmail=20 My Problem is, the Server in the DMZ can't do Ftp. I allowed outgoing ftp in FW_FORWARD. Works fine. But if the Server outside starts to send Data from Port 20 the Firewall drops the Packets=20 (SuSE-FW-DROP-DEFAULTIN=3D... spt=3D20 dpt=3Dxxxxx) Ftp from the Firewall itself works fine.=20 I tried to set ftp-data in FW_ALLOW_INCOMING_HIGHPORTS. Didn't work.=20 I tried a Rule for ftp-data in any Direction in FW_FORWARD.=20 Didn't work. Can anyone help? -- Mit freundlichem Gruss Willi Brune

1 0

SuSE-FW-DROP-ANTI-SPOOFING
by Burghard W.V. Britzke 04 Sep '01

04 Sep '01

hello, I have problems to contact my firewall from outside. Our uunet router is capable to contact our firewall and some of the services provided internally from outside. but when I plug a local pc with the same IP address to the FW_DEV_EXT network and try to connect to smtp (for example) I get SuSE-FW-DROP-ANTI-SPOOF IN=eth0 OUT= MAC=... SRC=<router> DST=<firewall> LEN=48 TOS=0x0 0 PREC=0x00 TTL=128 ID=546 DF PROTO=TCP SPT=1043 DPT=25 WINDOW=16384 RES=0x00 SY N URGP=0 OPT (020405B401010402) again: the uunet router is capable to send mails via smtp port and I do not get the above error message. Why do I get those messages?

2 1

compartment and the --cap option
by Andreas Amann 03 Sep '01

03 Sep '01

Hello everybody! I am currently trying to bring several daemons on my system into a chroot jail using Marc Heuse's 'compartment' tool. So far all works quite well but the fine tuning is still to be done. I am wondering what kind of security enhancements can be done by using compartments '--cap' option. Since the documentation of this feature is not very exhaustive i am still looking for some missing link to understand this correctly. Maybe someone here could help me with that. If I understand that correctly, capabilities are a partitioning of root's privileges and using the --cap option i can influence the privileges of a newly started process no matter whether it will run as root or not. So, for example, the command 'compartment --chroot /some/dir --cap none --verbose /daemon/with_uid0/port_below_1024' should fail miserably because the daemon won't be able to bind to it's port. But exactly this works and i am wondering why (compartment tells me that it successfully set caps to 0x0). I am using SuSE 7.2 with a (stock) Kernel 2.4.9 (but it also happens with a SuSE 2.2.19). /proc/sys/kernel/cap_bound says -257, say everything except CAP_SETPCAP. So thinking about that and the stuff i've read in the 'capfaq' from http://www.kernel.org/pub/linux/libs/security/linux-privs/kernel-2.2/capfaq… i have the following questions: - Is it true that --cap only works with CAP_INIT_EFF_SET and CAP_INIT_INH_SET set to -1 in <linux/capability.h> in order to get the CAP_SETPCAP privilege? - If so, doesn't it give even more problems when granting the CAP_SETPCAP right to init? I think this would mean that every process started by init will have it. - If not, do i totally missunderstand something and everything is working well except me? Thanks in advance to everyone who will be so friendly to help me with that! With kind regards Andreas Amann <mailto:andreas.amann@epost.de>

2 4