September 2001 - openSUSE Security - openSUSE Mailing Lists

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

VPN masquerading
by Joost van der Lugt 06 May '02

06 May '02

Hi all, I am trying to set up VPN masquerading, for a Windows box, and just wondered if there was an easy way to do this, using just the firewall.rc.config script, or do both that plus the custom config script have to be used? I have seen the VPN how-to, however just wondered about a how to aply this with SuSE's scripts. Thanks for any suggestions, (PS if there is someone familiar with setting upo VPN on the SuSe box itself, I would be very interested as well..., of course) - Cheers, Joost

4 4

SuSEfirewall2 and DHCP relay
by Pablo A. Maurin 01 Nov '01

01 Nov '01

Hello everyone. I am currently using SuSEfirewall2 with the following configuration. FW_DEV_EXT="eth0" FW_DEV_INT="eth1 eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24 192.168.254.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_INT_TCP="ssh" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" I have a firewall with 3 interfaces. eth0 is outside,public. eth1 is one local subnet (192.168.0/24), private. eth2 is a second internal private subnet(192.168.254/24). I have routing setup beween both subnets and I am able to ping across the firewall/router from one subnet to the other. Currently I have a DHCP server installed in the 192.168.0/24 subnet. Address 192.168.0.2. On the firewall I installed the DHCP realy package from the suse 7.2 CD It listenes on eth2 and forwards all request to 192.168.0.2 (the DHCP server). when I check the dhcp server logs I see that it is creating a lease for the new host on eth2 of the firewall. However the host is not receiving the address. I sure that it is a small misconfiguration on the firewall, but I cannot figure out what it is. Any help is greatly appreciated. If you need more information just e-mail me and I will try to get it. Thanks is advance, Pablo A. Maurin

2 1

patching SuSE
by Matthew Dalton 01 Oct '01

01 Oct '01

Please forgive the newbie question -- is there an easy way to patch Suse (7.1) all at once? The only way that I can see from the web-site is to download each patch individually. Thanks for helping! -- Matthew Dalton

4 4

IRC DCC stuff from behind a susefirewall2 NAT router
by Admin 01 Oct '01

01 Oct '01

Hi, see subject, any hints? neither inbound nor outbound dcc works... And as I am botmaster on some IRC bots I REALLY need DCC Chat :( bye M.Homann -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstіпt gegen §1 UWG und §823 I BGB (Beschluп des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der ќbermittelten persіnlichen Daten sowie deren Weitergabe an Dritte ist ausdrќcklich untersagt!

4 4

squid: timeout in SENT_PASV state
by Philipp Snizek 29 Sep '01

29 Sep '01

Hi all, please can somebody tell me what to do against this. Is this a ftp server that is not accepting pasv ftp? Or is it a misconfigured squid? Sep 29 21:23:54 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:24:18 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:24:41 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Sep 29 21:29:03 gate squid[406]: ftpTimeout: timeout in SENT_PASV state Thank you all, Philipp

1 0

still battlecom with linuxserver
by Johannes Schäffner 28 Sep '01

28 Sep '01

ok, i have typed this: ipmasqadm autofw -A -v -r udp 2300 2400 -h 192.168.0.2 (client-ip) ipmasqadm autofw -A -v -r tcp 2300 2400 -h 192.168.0.2 ipmasqadm autofw -A -v -r tcp 47624 47624 -h 192.168.0.2 ipmasqadm autofw -A -v -r udp 47624 47624 -h 192.168.0.2 ipmasqadm autofw -A -v -r udp 28800 28900 -h 192.168.0.2 but it still don´t work. he always prints this at hte screen: Adding autofwd udp ports 2300 - 2400 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd tcp ports 2300 - 2400 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd tcp ports 47624 - 47624 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd udp ports 47624 - 47624 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available Adding autofwd udp ports 28800 - 28900 to fixed host 192.168.0.2 U autofw: setsockopt failed: Protocol not available what do i have to change?? -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

Virus scanner to detect macintosh viruses?
by Thorsten Marquardt 28 Sep '01

28 Sep '01

Hello, I like to know wether there is a linux virusscanner which detects virus for (better against) apple macintosh. Yours sincerly Thom -- ------------------------------------------------------------------- bye bye (c) by Thom | Thorsten Marquardt | EMail: THOM(a)kaupp.chemie.uni-oldenburg.de | Member of the pzt project. | http://kaupp.chemie.uni-oldenburg.de/pzt -------------------------------------------------------------------

2 1

Re: [suse-security] qmail.rpm ... -> courier imap -> virus scanners
by Martin Schichl 28 Sep '01

28 Sep '01

Hi! I've followed the discussion about qmail ... We are running qmail now for a couple of years without any problems (about 250 Mailclients in 50 different virtual domains) But let me get the discussion into a little bit other direction ... >There is no problem. I ran qmail-pop3d off Maildirs for several months, >until I dropped it and switched to courier-imap. On 6.3, procmail is >probably not yet aware of Maildir. 1.) I think of switching some of my users from pop3 to imap ... Matthias you wrote about courier-imap ... My questions: - any experience with imap on qmail? - do I have to switch the whole thing to imap, or can I run pop3 and imap parallel? - what's about security with imap? (ok ... I know pop3 does not have any either) - are there different distributions of imap servers? (which one fits into qmail with vchkpw) 2.) Another theme is about virus scanners in mailer daemons. I've read an article about virus scanners which can be implemented directly into the postfix system ... Any experience with virus scanners for qmail? OK, I think this is enough for today ... Martin ----------------------------------------------------------------- Dipl.-Ing. Martin Schichl SC&C Software, Communication & Consulting GmbH & Co KEG Grottenhofstr. 3, A-8053 Graz Tel. +43/(0)316/265-205, Fax +43/(0)316/265-234 mschichl(a)scc.co.at, http://scc.co.at

8 8

Re: [suse-security] Bastille and other Linux distros
by michael.ryan＠storm.ie 28 Sep '01

28 Sep '01

IMHO any tool/script which offers SuSE users another choice when armouring their system would naturally be welcome :) Regards, Michael "Niki Rahimi" <narahimi@us. To: suse-security(a)suse.com ibm.com> cc: Subject: [suse-security] Bastille and other Linux distros 09/27/2001 05:57 PM Hi Everyone, I work with a security group in IBM's Linux Technology Center and have recently been working on a project to get the Bastille security hardening script to run on SuSE. I would like to get feedback from the discussion list on this project. Would this be something the SuSE community would be receptive to? In case you're not familiar with Bastille, their web site is at www.bastille-linux.org. If you have any further questions about this, please let me know. Thanks, Niki A. Rahimi narahimi(a)us.ibm.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

AW: [suse-security] Can't seem to get .htpasswd to work =(
by Battisti Markus 28 Sep '01

28 Sep '01

> > Bah! For the life of me, I can not get .htpasswd/.htaccess > to work on my > SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 > mod_throttle/3.0 > mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl > PHP/4.0.5 ). > > I have everything (that I know to set up, anyway) set up as: > you tried this one ? http://sdb.suse.de/en/sdb/html/htaccess72.html that could help maybe ,,, /'^'\ ( o o ) oOOO--(_)--OOOo---------------------- Mit Freundlichen Grüssen/Best Regards Battisti Markus

2 1

Can't seem to get .htpasswd to work =(
by Fluffy Bananachunks 28 Sep '01

28 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bah! For the life of me, I can not get .htpasswd/.htaccess to work on my SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 mod_throttle/3.0 mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl PHP/4.0.5 ). I have everything (that I know to set up, anyway) set up as: ########################################################### me@me:~/public_html - -rw-r--r-- 1 me me 209 Sep 27 21:27 .htaccess - -rw-r--r-- 1 me me 13 Sep 27 21:28 /home/me/.htgroup - -rw-r--r-- 1 me me 20 Sep 27 21:32 /home/me/.htpasswd /home/me/public_html/.htaccess: AuthName "Restricted" AuthType Basic AuthUserFile /home/me/.htpasswd AuthGroupFile /home/me/.htgroup <Limit GET POST> Require group chunks </Limit> /home/me/.htpasswd: test:VJdx0yi1Y3LKc {blank line as suggested on one site; also tried without} /home/me/.htgroup: chunks: test ############################################################ I've tried by group, user, "valid-user", with and without "Limit" in .htaccess, with and without a group (left off and /dev/null) .... The 'password box' always comes up, but no matter what, does not authorize me. Anyone have any insight as to what I'm skipping or missing here? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7s9t5o2oOGEnz8fYRAkFeAJ9eP/osgicxUvmQ3TxgUzDA2QeSVgCcC8yU voBtQ9LRKLAqPF17kJeskrA= =dGgz -----END PGP SIGNATURE-----

2 1

Are firewalls necessary?
by Ray Dillinger 28 Sep '01

28 Sep '01

I have a machine, which serves several purposes. It is my main development platform, and it is also my main webserver. I've gone through the system and shut down all network services I'm not using -- for example squid came down, because I am not using proxy service at all, and ftpd came down because I don't want to provide ftp services. Rlogin, fingerd, telnetd, hylafax, etc, are also gone. No trusted hosts are defined for rlogin and friends to use anyway; the other boxes on my network are not considered "safe". I'm using an apache server which I've been through extensive configuration on -- removing most of the modules because I wasn't using them. CGI is still there, but it's not activated on any host except the "default" host (which is only accessible from 127.0.0.1) and there are only two CGI scripts; These are the english-language "search" scripts that hunt through the documentation for keywords and topics, used by the SuSE help system, which I've kept onboard -- both of which I've audited for security. There were similar scripts to search in other languages, but since I'm not using other languages, they are gone now. Finally, the 'su' binary is moved to sbin, and not available to any user except root. I keep copies of my websites offline, on floppy disks. Ditto my inetd.conf, httpd.conf, and a few other configuration files. and, finally, my source code -- so if the machine ever gets subverted, I can restore them easily. Now, here is my question: Do I get material additional security from my firewall, or does over-the-top paranoia on the other aspects of the config obviate the need for it? Bear

9 13

AW: [suse-security] Can't seem to get .htpasswd to work =(
by Thomas Lamy 28 Sep '01

28 Sep '01

Make sure you have something like <Directory /home/*/public_html> AllowOverride AuthConfig ..... </Directory> in your httpd.conf, otherwise .htaccess files get ignored. Thomas -----Ursprüngliche Nachricht----- Von: Fluffy Bananachunks [mailto:suse.announce@bananachunks.org] Gesendet: Freitag, 28. September 2001 04:08 An: suse-security(a)suse.com Betreff: [suse-security] Can't seem to get .htpasswd to work =( -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bah! For the life of me, I can not get .htpasswd/.htaccess to work on my SuSE7.2 ( Apache/1.3.19 (Unix) (SuSE/Linux) mod_layout/1.0 mod_throttle/3.0 mod_fastcgi/2.2.2 mod_ssl/2.8.3 OpenSSL/0.9.6a mod_perl/1.25 mod_dtcl PHP/4.0.5 ). I have everything (that I know to set up, anyway) set up as: ########################################################### me@me:~/public_html - -rw-r--r-- 1 me me 209 Sep 27 21:27 .htaccess - -rw-r--r-- 1 me me 13 Sep 27 21:28 /home/me/.htgroup - -rw-r--r-- 1 me me 20 Sep 27 21:32 /home/me/.htpasswd /home/me/public_html/.htaccess: AuthName "Restricted" AuthType Basic AuthUserFile /home/me/.htpasswd AuthGroupFile /home/me/.htgroup <Limit GET POST> Require group chunks </Limit> /home/me/.htpasswd: test:VJdx0yi1Y3LKc {blank line as suggested on one site; also tried without} /home/me/.htgroup: chunks: test ############################################################ I've tried by group, user, "valid-user", with and without "Limit" in .htaccess, with and without a group (left off and /dev/null) .... The 'password box' always comes up, but no matter what, does not authorize me. Anyone have any insight as to what I'm skipping or missing here? TIA Geo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7s9t5o2oOGEnz8fYRAkFeAJ9eP/osgicxUvmQ3TxgUzDA2QeSVgCcC8yU voBtQ9LRKLAqPF17kJeskrA= =dGgz -----END PGP SIGNATURE----- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

Re: [suse-security] iptables update ?
by Stefan_Walther＠gehag-dsk.de 28 Sep '01

28 Sep '01

Hi, it not only the rpm-archive. Sometimes I think the poeple are to lazy (I also don't want to point at anybody) to compile the packets. If they want the newest packets and dists they have o compile it or have to wait. I know it, because I am sometimes the same. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Roman Drahtmüller wrote: > [Some very good points about code maturity and Linux distributions] Hear, hear. I think it is important that many people who cry out loudly for the latest updates to be integrated in their favourite Linux distribution ASAP (or even go for "c'mon, the fix has been out for two days already, where's the RPM archive?") keep in mind that: - Newer ist not better by default. - Being up-to-date can also be defined as using a stable, if older, version of a product, so that the servers just do their job. - Everybody is free to invest her/his own time and resources on having installed the newest software. It is available for free on the Internet, as Roman pointed out. I have no intention to appear aggressive, and I don't point my finger at anybody. Besides, my colleagues know me for chasing the newest, hottest stuff myself, so I understand the motivation. I only want to express my thanks for the great work the people at SuSE, RedHat and other companies accomplish together with the Open Source community, and I ask all users for some patience on behalf of software developers everywhere... ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Recommended cookie suppression extension for Squid?
by Ralph Seichter 28 Sep '01

28 Sep '01

[This is a repost] I have used WebWasher for cookie suppression for quite some time now, and I think it is a great product. Alas, I want to try Squid as a combined filter/cache, so I am looking for a similar feature to handle cookies based on flexible rules. Internet searches returned Squid extensions like "adzap" ( http://www.zip.com.au/~cs/adzap/ ). What tool do *you* prefer for Squid cookie suppression? BTW, I consider this security related because I don't like the idea of being watched and measured by a trail of cookies, but if there's a different mailing list you suggest for this kind of topic, please point me to it. Thank you. Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

Re: [suse-security] iptables update ?
by Ralph Seichter 28 Sep '01

28 Sep '01

Roman Drahtmüller wrote: > [Some very good points about code maturity and Linux distributions] Hear, hear. I think it is important that many people who cry out loudly for the latest updates to be integrated in their favourite Linux distribution ASAP (or even go for "c'mon, the fix has been out for two days already, where's the RPM archive?") keep in mind that: - Newer ist not better by default. - Being up-to-date can also be defined as using a stable, if older, version of a product, so that the servers just do their job. - Everybody is free to invest her/his own time and resources on having installed the newest software. It is available for free on the Internet, as Roman pointed out. I have no intention to appear aggressive, and I don't point my finger at anybody. Besides, my colleagues know me for chasing the newest, hottest stuff myself, so I understand the motivation. I only want to express my thanks for the great work the people at SuSE, RedHat and other companies accomplish together with the Open Source community, and I ask all users for some patience on behalf of software developers everywhere... ;-) Mit freundlichen Grüssen / Regards Dipl. Inform. Ralph Seichter ISC Informatik Service & Consulting GmbH Tel +49 2241 867-0 mailto:r.seichter@isc-inf.com Fax +49 2241 867-222 http://www.isc-inf.com/

1 0

battlecom with linuxserver
by Johannes Schäffner 28 Sep '01

28 Sep '01

i have counterstrike and battlecom installed on my win98 client.at the linux-server i have ipchains installed, so at the client counterstrike (and also icq,mirc etc.) works without any problems. but i can´t join or host any battlecom sessions. what do i have to change that battlecom works ( every port is open at ipchains) please help me!!! -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

SuSEfirewall2 question regarding FW_FORWARD_MASQ
by Magnus Hagebris 28 Sep '01

28 Sep '01

I have a setup that requires external machines to access an application on an internal machine (masqueraded) when using a specific protocol. A packet sent to the firewall (IP and protocol 200) should be redirected to the internal machine 192.168.0.40. Using tcp or udp instead of protocol 200 would work, but why does not other protocols work??? I'm using... FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24" FW_FORWARD_MASQ="0/0,192.168.0.40,200" If I can't forward other protocols than udp/tcp can I solve this setup in a different way??? I mean instead of installing Solaris, since that OS allows you to forward other protocols (I heard...). Thanks, Magnus

1 0

Swappartition max size
by Thomas Michael Wanka 28 Sep '01

28 Sep '01

Hi, sorry if this is not strictly security related, but it resulted from a (possible) security problem (server was trashed by an intruder or at least from the outside - that has to be investigated). The current max. swap partition can be 2GB. What is recommended to do when more ram is installed to hold the core dump? Enough partitions to meet the actual ram size? A link to where to search is enough. TIA mike

2 2

Re: [suse-security] battlecom with linuxserver
by James Bliss 27 Sep '01

27 Sep '01

Do you have any entries in your firewall log which would possibly help in diagnosing this problem? Also, could you possibly post your ipchains rules (over write any personal IP info with something like <my box> or <my internal network>). This would really help everyone on the list help you. 09/27/01 04:49:25 PM, Johannes Schäffner <34773(a)gmx.de> wrote: >i have counterstrike and battlecom installed on my win98 client.at the >linux-server i have ipchains installed, so at the client counterstrike (and also >icq,mirc etc.) works without any problems. but i can´t join or host any >battlecom sessions. >what do i have to change that battlecom works ( every port is open at >ipchains) >please help me!!! > >-- >GMX - Die Kommunikationsplattform im Internet. >http://www.gmx.net > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: [suse-security] iptables update ?
by James Bliss 27 Sep '01

27 Sep '01

Thank you Roman, I believe that you make several good points in your email. I have only been on SuSE for 6 months now. Started with 7.0, went to 7.1 and then 7.2. Bought the CDs everytime because the cost was much less than the time it would take me to download the software. I think that SuSE is a much better distro than Redhat, and have recommended it to several of my friends. Keep up the good work. If someone thinks that a newer software release is valuable to be installed on their box before it is available through SuSE they should download it from the origination site and therefore be responsible for any quirks which may be caused by doing this. Keep up the good work SuSE. And thank you very much for these mailing lists, some of the best support available for free or money. Jim 09/27/01 04:38:27 PM, Roman Drahtmueller <draht(a)suse.de> wrote: >-----BEGIN PGP SIGNED MESSAGE----- >Hash: SHA1 > >> Hi, >> >> Finally I decided to start learning iptables hence installed the 2.4.7 >> kernel along with the iptables. The version comes on 7.2 is 1.2.1a (yes >> the kernel is also 2.4.4) should not be there an offical update to >> iptables out of curiosity ? > > >(This mail has become somewhat lengthy, but I wanted to write down some >thoughts on closely related topics that arise when I give the answer for >this question. Everything that has nothing to do with the actual question >above on this thread is written below the line "########", and it does not >contribute to the half-technical question. I do not wish that there will >be a discussion about the issues below on this list because it would >generate an off-topic lengthy thread. It's just that some of the things >below need to be said every once in a while in order to prevent >misunderstandings from distorting the aspects and benefits of open source >software.) > >The answer: >Not quite: The iptables utility is only the setup tool, it can't easily >be a security problem without messing up the rules during setup (You'd >easily notice! :-). The actual work of the packet filter engine happens >in the kernel, not in the ipchains utility. If your machine acts as a >packet filter only, you can easily kill all running processes and run >"rm -rf /" over it - it will continue to work until you try to reboot it. > >By consequence, the newer version fixes bugs that may be nasty in some >way, but there are none that were security-related. The version of >iptables that is on the CDs is installed on a few dozen thousand >installations, and in use one some thousands, I guess. A new version is >always different from the one before (this is why there is a new version >in the first place): different functionality and different bugs as well. >We cannot guarantee that the newer version works exatly like the one >before, which is why we don't provide a newer version of the package (with >iptables being just a simple example). > >Please look at the changelogs of single packages in the distribution, >especially the core packages and libraries, and look at the patches that >we include to fix bugs that we found during testing. In order to be taken >seriously in the operating systems market, you have to be able to maintain >a certain level of quality in your software. You make a tradeoff between >the up-to-dateness (and security) and the reliability (and security) of >your software. This implies that the functionality of a single package >must be guaranteed over the updates. By consequence, the version stays the >same: only those bugs are fixed that break the functionality of the >package or impose a security risk. If your favourite email program crashes >if you hit five keys together, then do not hit these five keys together. >If it crashes when a strange email arrives, it may be security related: >Write to security(a)suse.de, and use the pgp key to encrypt your text. New >versions in update packages can only happen if the new version number is >beneficial from the security standpoint, and if no other package >relies/depends on the package to be updated. >(Example: openssh. A user should be able to tell by the version number >that the recently discovered security bugs are fixed.) > > >################## > >There is a specific set of reasons why we make a new distribution every >once in a while (with a decreasing frequency): The opensource community >needs to have a new base to build on (a distribution sets standards that >are most important for the thing as a whole), and new features are desired >on behalf of the usership. Free software is for free: You can download it >from servers worldwide. But I wouldn't want someone else to do the job >that we've accomplished with each distribution (7.3 is out in a few days): >many thousands of hours of CPU-time have been used for compilation of code >and for stresstests, many hundreds of CDs have been burned, network >equipment and computer hardware has been bought just to test the software, >and many millions of keys have been hit, not to mention the thousands of >hours in long nights that developers at SuSE and the rest of the world >have sat down to track down crashes, add improvements to performance, >stability and security, provide a nicer, ergonomic interface and make it >what it is: A secure, powerful, flexible and stable operating system, >ready to use. It is what people expect from it (while everybody expects >something different). > > If you want to give yourself a nice lesson: Play distributor! Install a >SuSE-6.1, just a minimal package selection, then put away the CDs. Then, >get KDE-2.2.1 running on it, with a few dozen applications that do all >kinds of things from showing the time down to burning CDs and sending >mails. Compile from the source tarball, not SuSE source rpms. Modularize >the software that you have installed and keep an overview over it. Add >icons, G/X, eye candy, sounds so that you like it more. Check it for bugs, >identify crashes and find security problems. Deal with buggy hardware and >BIOSes. Ensure consistency of the ready-to-install packages that you >built. Make it possible to exchange parts of the system at full >consistency. Communicate the bugs that you've found to the maintainers and >authors of the software that you use (quite some people, many emails!). > After you have found out that you need to exchange basically everything >in your minimal system in order to be able to even compile the new stuff >(not to mention running or testing!), you can abbreviate to a minimal >SuSE-7.2 installation and restart from the beginning. After a few weeks >without much fun you will find out that kdm behaves strangely under some >obscure, but usual circumstances; watch out for race conditions and buffer >overflows while you nail down the reason why all of your processes get >nuked by SIGTERM sometimes. > If you're there, invest some time to sit down with others and argue the >technical reasons why you (lazily) added your docs to /opt/kde/docs >instead of /usr/share/doc. Be sure to have a comprehensive result >afterwards, so that your distribution follows the defined standards (SuSE >is leading in terms of that). Then you change what doesn't match the >standards, and recompile everything. Don't forget to write down how to use >it for your grandma and your kids. > >SuSE employs the best people that the world has for many of the subsystems >that a SuSE Linux distribution is built on. They are paid for doing their >job and for refining the software they wrote to a thing that you can use. >The software is still for free, the patches are for free (the distributors >even share their additions), but the fact that you can easily install and >use it is not! > Provided you earn only Euro 2.50 an hour, you couldn't make it in time to >be faster than 100 times the price of a Linux distribution (a SuSE in >particular). If you buy all the software that is on the (filled up to the >last byte) SuSE CDs from a commercial vendor, expect a bill of a few >hundred thousand Euro. I've never ever paid a single buck for software, >but if I didn't (proudly) work for SuSE, I'd pay significantly more. I >would want new versions of single software packages every few months, but >as you might know we're not forced to buy it either. It's just easier and >less expensive. > >The price of a Linux distribution does not compare to the price of >commercial software, but to the price your own time and your freedom. > >Thanks, >Roman. >- -- > - - >| Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | > SuSE GmbH - Security Phone: // you need vision!" >| Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | > - - >Feel free to pass on this text, provided that it is complete and unchanged! >-----BEGIN PGP SIGNATURE----- >Version: GnuPG v1.0.6 (GNU/Linux) >Comment: http://www.suse.de/ > >iEYEARECAAYFAjuznF0ACgkQnkDjEAAKq6ThdQCgylOJsQtBgVLgHNSzayO2YIn3 >oIcAn2CM6fOoDfL2z3MmKYcU9Vxdbmci >=phZY >-----END PGP SIGNATURE----- > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

iptables update ?
by Togan Muftuoglu 27 Sep '01

27 Sep '01

Hi, Finally I decided to start learning iptables hence installed the 2.4.7 kernel along with the iptables. The version comes on 7.2 is 1.2.1a (yes the kernel is also 2.4.4) should not be there an offical update to iptables out of curiosity ? -- Togan Muftuoglu

4 3

Re: [suse-security] Bastille and other Linux distros
by Christopher Mahmood 27 Sep '01

27 Sep '01

* Niki Rahimi (narahimi(a)us.ibm.com) [010927 10:23]: > I work with a security group in IBM's Linux Technology Center and have > recently been working on a project to get the Bastille security hardening > script to run on SuSE. I would like to get feedback from the discussion > list on this project. Would this be something the SuSE community would be > receptive to? I haven't looked at Bastille in a while, but I don't remember it doing much more than what the tools our security team has developed. Specifically, the harden-suse script, the SuSEfirewall, and seccheck. I'm not flaming, I'm genuinely curious. -- -ckm

1 0

Re: Bastille and other Linux distros
by Richard Ibbotson 27 Sep '01

27 Sep '01

Niki > I work with a security group in IBM's Linux Technology Center > and have recently been working on a project to get the Bastille > security hardening script to run on SuSE. I would like to get > feedback from the discussion list on this project. Would this be > something the SuSE community would be receptive to? There's already a harden_suse.rpm that does something similar. If you want to know more write to the SuSE Security team. How about on Debian ? Thanks Richard www.sheflug.co.uk

1 0

Bastille and other Linux distros
by Niki Rahimi 27 Sep '01

27 Sep '01

Hi Everyone, I work with a security group in IBM's Linux Technology Center and have recently been working on a project to get the Bastille security hardening script to run on SuSE. I would like to get feedback from the discussion list on this project. Would this be something the SuSE community would be receptive to? In case you're not familiar with Bastille, their web site is at www.bastille-linux.org. If you have any further questions about this, please let me know. Thanks, Niki A. Rahimi narahimi(a)us.ibm.com

1 0

my configuration - ftp is not working
by Roger Rossell 27 Sep '01

27 Sep '01

Here is my configuration script. Ftp clients from my lan (specified in table "ids") can not retreive file lists from ftp servers can you help me please??? # FIREWALL DE IDS # echo "***** Ejecutando Firewall... ********************" # CARGA DE MODULOS modprobe ip_tables modprobe ip_conntrack modprobe ip_conntrack_ftp modprobe iptable_nat # variables LAN_IDS="172.16.0.0/255.255.0.0" LAN_DMZ="192.168.0.0/255.255.255.0" ANYIP="0/0" IP_LAN="172.16.100.100" IP_PUB="217.149.0.xx0" IP_DMZ="192.168.0.1" INT_LAN="eth0" INT_PUB="eth1" INT_DMZ="eth2" UNPRIVPORTS="1024:65535" #ortografia: DMZWEB_num-servidor_num-ip-virtual DMZWEB_0_0="192.168.0.100" DMZWEB_0_1="192.168.0.101" DMZWEB_1_0="192.168.0.200" PUBLIC_DMZWEB_0_0="217.149.0.xx1" PUBLIC_DMZWEB_0_1="217.149.0.xx2" PUBLIC_DMZWEB_1_0="217.149.0.xx5" DNS1="217.149.0.10" DNS2="217.149.0.11" # Añadir ip's publicas virtuales ip address add $PUBLIC_DMZWEB_0_0 dev $INT_PUB ip address add $PUBLIC_DMZWEB_0_1 dev $INT_PUB ip address add $PUBLIC_DMZWEB_1_0 dev $INT_PUB # CLEAR IPTABLES iptables -F iptables -X iptables -Z iptables -t nat -F # aciva el proxy arp para la dmz y para la lan #echo 1 > /proc/sys/net/ipv4/conf/eth2/proxy_arp #echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp # activa el forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # proteccion anti spoofing for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f; done #*/# #proteccion TCP SYN Cookie echo 1 > /proc/sys/net/ipv4/tcp_syncookies #activa el always defrag #echo 1 > /proc/sys/net/ipv4/ip_always_defrag #proteccion echo broadcast #echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_bogus_error_broadcasts #desactiva aceptacion de redireccon icmp for f in /proc/sys/net/ipv4/conf/*/accept_redirects; do echo 0 > $f done #*/# #deshabilita los paquetes SRP (Source Route) for f in /proc/sys/net/ipv4/conf/*/accept_source_route; do echo 0 > $f done #*/# #registra los spoofed packets, source routed packets, redirect packets for f in /proc/sys/net/ipv4/conf/*/log_martians; do echo 1 > $f done #*/# # Politica por defecto echo "Configurando políticas por defecto" iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP # Crear nuevas tablas echo "Creando nuevas tablas" iptables -N dmz iptables -N ids iptables -N loopback #iptables -N lan_dmz echo "Relacionando nuevas tablas" iptables -A FORWARD -s $ANYIP -d $LAN_DMZ -j dmz iptables -A FORWARD -s $LAN_DMZ -j dmz iptables -A FORWARD -s $LAN_IDS -d $ANYIP -j ids iptables -A FORWARD -s $ANYIP -d $LAN_IDS -j ids iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j loopback iptables -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j loopback #iptables -A lan_dmz -j ACCEPT #iptables -A lan_dmz -j LOG --log-prefix "#lan-dmz##" # Logs generales echo "Activando logs" #iptables -A INPUT -j LOG --log-prefix "##IN## " #iptables -A OUTPUT -j LOG --log-prefix "##OUT## " #iptables -A FORWARD -j LOG --log-prefix "##FWD## " # NAT echo "Configurando NAT..." iptables -t nat -A POSTROUTING -o $INT_PUB -j MASQUERADE #iptables -t nat -A POSTROUTING -j LOG --log-prefix "##NATpost##" #PORT FORWARDING - NAT IN echo "Configurando PNAT ..." #transparent proxy # # iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 192.168.0.10:80 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_0_0 -j DNAT --to-destination $DMZWEB_0_0 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_0_1 -j DNAT --to-destination $DMZWEB_0_1 iptables -t nat -A PREROUTING -p tcp -d $PUBLIC_DMZWEB_1_0 -j DNAT --to-destination $DMZWEB_1_0 #iptables -t nat -A PREROUTING -j LOG --log-prefix "##NATpre##" #SERVICIOS PERMITIDOS LAN - FUERA echo "Permisos de salida desde ids_lan..." #tcp iptables -A ids -p tcp -s $LAN_IDS --dport 20 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 21 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 20 -j LOG --log-prefix "##ftp##" iptables -A ids -p tcp -s $LAN_IDS --dport 21 -j LOG --log-prefix "##ftp##" iptables -A ids -p tcp -s $LAN_IDS --dport 23 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 25 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 80 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 110 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 137 -j ACCEPT iptables -A ids -p tcp -s $LAN_IDS --dport 443 -j ACCEPT iptables -A ids -p tcp -s $ANYIP --dport $UNPRIVPORTS -j ACCEPT #icmp iptables -A ids -p icmp -j ACCEPT #udp iptables -A ids -p udp -s $LAN_IDS -d $DNS1 --dport 53 -j ACCEPT iptables -A ids -p udp -s $LAN_IDS -d $DNS2 --dport 53 -j ACCEPT iptables -A ids -p udp -s $DNS1 -d $LAN_IDS --dport $UNPRIVPORTS -j ACCEPT iptables -A ids -p udp -s $DNS2 -d $LAN_IDS --dport $UNPRIVPORTS -j ACCEPT #el resto lo deniego iptables -A ids -j LOG --log-prefix "##DENY ids##" iptables -A ids -j DROP # LOOPBACK iptables -A loopback -j ACCEPT iptables -A loopback -j LOG --log-prefix "##loopback##" echo "Habilitando acceso a servidores Web DMZ..." iptables -A dmz -p tcp --dport 20 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 20 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 20 -d $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 21 -d $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport 80 -d $DMZWEB_1_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 -d $DMZWEB_0_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 -d $DMZWEB_1_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 ! --syn -s $DMZWEB_0_0 -j ACCEPT #iptables -A dmz -p tcp --dport 137 ! --syn -s $DMZWEB_1_0 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_0_0 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_0_1 -j ACCEPT iptables -A dmz -p tcp --dport $UNPRIVPORTS -s $DMZWEB_1_0 -j ACCEPT #tienda virtual (tpv) iptables -A dmz -p tcp -s $LAN_DMZ -d 193.24.33.9 --dport 56005 -j ACCEPT #permitit consultas a los dns autorizados "ojo falta el syn!!! y el source port" iptables -A dmz -p udp -s $LAN_DMZ -d $DNS1 --dport 53 -j ACCEPT iptables -A dmz -p udp -s $LAN_DMZ -d $DNS2 --dport 53 -j ACCEPT iptables -A dmz -p udp -s $DNS1 -d $LAN_DMZ --dport $UNPRIVPORTS -j ACCEPT iptables -A dmz -p udp -s $DNS2 -d $LAN_DMZ --dport $UNPRIVPORTS -j ACCEPT #el resto lo deniego iptables -A dmz -j LOG --log-prefix "##DENY dmz##" iptables -A dmz -j DROP echo "***** Fin de firewall script ********************" Thanks

1 0

test
by Radu Anghel 27 Sep '01

27 Sep '01

test

1 0

[suse-security] still bugging with snort...
by Markus Kohli 27 Sep '01

27 Sep '01

Hi again! Still got a problem with snort, or my setup or whatever... Following: [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:57:21.842870 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:58:21.841503 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/26-22:58:26.134428 And this repeats over and over again... I set alert-mode to full, is that the problem? My alert-file has risen to 1.5MB in only 3 days... HELP ME, PLEASE! TIA markus

2 1

Re: [suse-security] filtering ports
by r.maurizzi＠gvs.it 27 Sep '01

27 Sep '01

Boris Lorenz <bolo(a)lupa.de> wrote: > Hope that sheds more light on the issue. Let's see if I've understood correctly: If I return-rst all incoming connection on my 22 except ones from a "trusted" net, but I don't also drop/deny the unwanted IPs, an attacker can simply ignore the reset packets and happily connect to the port... right? Ciao, Rob!

3 2

filtering ports
by Michael Neumann 27 Sep '01

27 Sep '01

Hi all, I use iptables as a firewall on my local machine to filter any incoming connections one some ports I want to protect. I have tested this with one single port and then run a portscan o that machine. nmap was not able to connect to that protected port but it marked the port as "filtered". How can I prevent this? nmap should not be able to see if and which ports are filtered. I have tried with DENY and REJECT but got the same report. Thanx Michael

5 7

[suse-security] Help router intern ssh
by Nils Wunsch 27 Sep '01

27 Sep '01

Hi I have 2 Problem for ipchains -> ssh and nslookup ? ich find not the correct Rules from Intern Network to intern network and intern network to extern network . my defin. from intern network L_Nets:192.168.100.0/24 who can help my ? /nils -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

Re: [suse-security] SuSE Firewall
by Wilko Heyl 27 Sep '01

27 Sep '01

> # 2.) > # Which is the interface that points to the internet? > # > FW_DEV_WORLD="eth1" Are vour directly connected to the DSL-Modem? Then try "ppp0". > FW_MASQ_NETS="192.168.1.0/32" FW_MASQ_NETS="192.168.1.0/24" sounds better... > # e.g. "ippp0" or "" > FW_MASQ_DEV="eth1" FW_MASQ_DEV="$FW_DEV_WORLD" is better... because I think it's ppp0... > FW_SERVICES_EXTERNAL_TCP="smtp www ftp" You REALLY want the Internet connect to your PC? Its not neccessary to connect TO the Internet... > FW_SERVICES_EXTERNAL_UDP="domain" You REALLY want the Internet connect to your PC? Its not neccessary to connect TO the Internet... > FW_SERVICES_DMZ_TCP="smtp domain" I think you do not need a DMZ. You havent configured a DMZ-Device above... > FW_SERVICES_INTERNAL_TCP="smtp domain" Access to the SMTP- and Nameserver on the firewall-Machine.. FW_SERVICES_INTERNAL_UDP="domain" > # > FW_TRUSTED_NETS="192.168.1.0/32" Normally you dont need it, I think. Let it blank. > FW_SERVICES_TRUSTED_TCP="" > FW_SERVICES_TRUSTED_UDP="" > FW_SERVICES_TRUSTED_IP="" No Trusted Services. So you dont need a TrustedNet. > FW_SERVICE_DNS="no" Above you talk about a Nameserver on the Firewall. So FW_SERVICE_DNS="yes" is better, I think. BTW: I don't know, the above settings for the Nameserver: Must I set FW_SERVICES_INTERNAL_TCP|UDP = "domain" for accessing the DomainNameServer from my ISP? I always set an internal NS... > # Redirect TCP connections > FW_REDIRECT_TCP="80" What do you want to do? Redirecting to Squid-Proxy-Server on the firewall-Machine? FW_REDIRECT_TCP="192.168.1.0/24,0/0,80,3128" Then you have to set FW_SERVICES_INTERNAL_TCP = "3128" IMHO.. > FW_ALLOW_PING_FW="no" FW_ALLOW_PING_FW="yes" for testing... > FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_TRACEROUTE="yes" for testing... thats all for now, its late... Regards, Wilko Heyl Wilko Heyl __________________________________________________ heyl(a)terraconnect.de - www.terraconnect.de terraconnect GbR - Mauritzstrasse 4 - 48301 Nottuln Wilko Heyl und Burkhard Frie Tel: 0251 - 214493 Fax: 0251 - 214492

1 0

masquerading firewall for DSL connection, wich version of SuSE to choose?
by Admin 26 Sep '01

26 Sep '01

Hi, which SuSE is best for a masq. firewall for a dsl connection? 7.0, 7.1 or 7.2? The machine has to be reinstalled anyways... bye MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verst��t gegen �1 UWG und �823 I BGB (Beschlu� des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der �bermittelten pers�nlichen Daten sowie deren Weitergabe an Dritte ist ausdr�cklich untersagt!

2 1

SuSE Firewall
by Richard Ibbotson 26 Sep '01

26 Sep '01

Dear All I've configured a gateway on a friends network with SuSE 7.2. I thought that it might be a good idea to try the SuSE firewall once again. The one that comes on the SuSE CDs. I don't want to upgrade to the new one I want to use this one. After installing the firewall and starting the gateway machine I find that I can't ping the gateway machine and after manually putting in the rules to allow forwarding up to the net nothing works either. You should be able to see the config file for the firewall that I'm using below. Can someone tell me where I've gone wrong and explain what it is that I should change. This is for an ADSL connection with an ethernet card. The external card is eth1 and the internal LAN facing card is eth0. Internal net is 192.168.1.1/24. The manuals do give some simple instructions about what to do but these are confusing and two more pages about configuration options would be helpful. Apologies for the enormously long post .............. # Copyright (c) 1999-2001 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Marc Heuse <marc(a)suse.de>, 1999-2001 # Please contact me directly if you find bugs. ------------------------------------------------------------------------ # # 1.) # Should the Firewall be started? # # This setting is done in /etc/rc.config (START_FW="yes") # # 2.) # Which is the interface that points to the internet? # # Enter all the network devices here which are untrusted. # # Choice: any number of devices, separated by a space # e.g. "eth0", "ippp0 ippp1" # FW_DEV_WORLD="eth1" # # You *may* configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_WORLD_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_WORLD first! # # e.g. for external interface ippp0 #FW_DEV_WORLD_ippp0="10.0.0.1 255.255.255.0" # # 3.) # Which is the interface that points to the internal network? # # Enter all the network devices here which are trusted. # If you are not connected to a trusted network (e.g. you have just a # dialup) leave this empty. # # Choice: leave empty or any number of devices, separated by a space # e.g. "tr0", "eth0 eth1" or "" # FW_DEV_INT="eth0" # # You may configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_INT_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_INT first! # # e.g. for internal interface eth0 #FW_DEV_INT_eth0="192.168.1.1 255.255.255.0" # # 4.) # Which is the interface that points to the dmz network? # # Enter all the network devices here which point to the dmz. # A "dmz" is a special, separated network, which is only connected to the # firewall, and should be reachable from the internet to provide services, # e.g. WWW, Mail, etc. and hence are at risk from attacks. # See /usr/share/doc/packages/SuSEfirewall/EXAMPLES for an example. # # Special note: You have to configure FW_FORWARD_TCP and FW_FORWARD_UDP to # define the services which should be available to the internet and set # FW_ROUTE to yes. # Very special note: servers/networks in FW_MASQ_NETS may access the DMZ to # the same extent they are allowed to access the internet! No FW_FORWARD_* # needed ... # # Choice: leave empty or any number of devices, separated by a space # e.g. "tr0", "eth0 eth1" or "" # FW_DEV_DMZ="" # # You may configure a static IP and netmask to force rule loading even if the # interface is not up and running: set a variable called # FW_DEV_INT_[device]="IP_ADDRESS NETMASK" # see below for an example. Otherwise automatic detection is done. # You will still need to set FW_DEV_DMZ first! # # e.g. for dmz interface eth1 #FW_DEV_DMZ_eth1="192.168.1.1 255.255.255.0" # # 5.) # Should routing between the internet, dmz and internal network be activated? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ # # You need only set this to yes, if you either want to masquerade internal # machines or allow access to the dmz (or internal machines, but this is not # a good idea). This option supersedes IP_FORWARD from /etc/rc.config! # # Setting this option one alone doesn't do anything. Either activate # massquerading with FW_MASQUERADE below if you want to masquerade your # internal network to the internet, or configure FW_FORWARD_TCP and/or # FW_FORWARD_UDP to define what is allowed to be forwarded! # # Choice: "yes" or "no", defaults to "no" # FW_ROUTE="yes" # # 6.) # Do you want to masquerade internal networks to the outside? # REQUIRES: FW_DEV_INT, FW_ROUTE # # "Masquerading" means that all your internal machines which use services on # the internet seem to come from your firewall. # Please note that it is more secure to communicate via proxies to the # internet than masquerading # # Choice: "yes" or "no", defaults to "no" # FW_MASQUERADE="yes" # # Which internal computers/networks are allowed to access the internet # directly (not via proxys on the firewall)? # Only these networks will be allowed access and will be masqueraded! # # Please note this config changed in firewals-2.3: You may either use just # hosts/nets to allow all traffic from them to the internet, or use an extended # syntax, to restrict internet access to certain services! # # Choice: leave empty or any number of hosts/networks seperated by a space. # Every host/network may get a list of allowed services, otherwise everything # is allowed. A protocol and service is appended by a comma to the host/network. # e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with unrestricted access # "10.0.1.0/24,tcp,80 10.0.1.0/24,tcp,21" allows the 10.0.1.0 network to use # www/ftp to the internet. "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too. # You may NOT set this variable to "0/0" ! # FW_MASQ_NETS="192.168.1.0/32" # # If you want (and you should) you may also set the FW_MASQ_DEV option, to # specify the outgoing interface to masquerade on. (You would normally use # the external interface(s), the FW_DEV_WORLD device(s), e.g. "ippp0") # # e.g. "ippp0" or "$FW_DEV_WORLD" FW_MASQ_DEV="eth1" # # 7.) # Do you want to protect the firewall from the internal network? # REQUIRES: FW_DEV_INT # # If you set this to "yes", internal machines may only access services on # the machine you explicitly allow. They will be also affected from the # FW_AUTOPROTECT_GLOBAL_SERVICES option. # If you set this to "no", any user can connect (and attack) any service on # the firewall. # # Choice: "yes" or "no", defaults to "yes" # FW_PROTECT_FROM_INTERNAL="no" # # 8.) # Do you want to autoprotect all global running services? # # If set to "yes", all network access to services TCP and UDP on this machine # which are not bound to a special IP address will be prevented (except to # those which you explicitly allow, see below: FW_*_SERVICES_*) # Example: "0.0.0.0:23" would be protected, but "10.0.0.1:53" not. # # Choice: "yes" or "no", defaults to "yes" # # "yes" is a good choice FW_AUTOPROTECT_GLOBAL_SERVICES="yes" # # 9.) # Which services ON THE FIREWALL should be accessible from either the internet # (or other untrusted networks), the dmz or internal (trusted networks)? # (see no.13 & 14 if you want to route traffic through the firewall) # # Enter all ports or known portnames below, seperated by a space. # TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and # UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP. # e.g. if a webserver on the firewall should be accessible from the internet: # FW_SERVICES_EXTERNAL_TCP="www" # e.g. if the firewall should receive syslog messages from the dmz: # FW_SERVICES_DMZ_UDP="syslog" # For IP protocols (like GRE for PPTP, or OSPF for routing) you need to set # FW_SERVICES_*_IP with the protocol name or number (see /etc/protocols) # # Choice: leave empty or any number of ports, known portnames (from # /etc/services) and port ranges seperated by a space. Port ranges are # written like this, from 1 to 10: "1:10" # e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514" # For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2") # # Services, visible to the external net (normally internet), TCP # Common: smtp domain FW_SERVICES_EXTERNAL_TCP="smtp www ftp" # Services, visible to the external net (normally internet), UDP # Common: domain FW_SERVICES_EXTERNAL_UDP="domain" # Externally visible services, other IP protocols # For VPN/Routing which END at the firewall!! FW_SERVICES_EXTERNAL_IP="" # # Services visible to the DMZ, TCP # Common: smtp domain FW_SERVICES_DMZ_TCP="smtp domain" # Services visible to the DMZ, UDP # Common: domain syslog FW_SERVICES_DMZ_UDP="" # Services visible to the DMZ, other IP protocols # For VPN/Routing which END at the firewall!! FW_SERVICES_DMZ_IP="" # # Services, visible to the internal net, TCP # Common: ssh smtp domain FW_SERVICES_INTERNAL_TCP="smtp domain" # Services, visible to the internal net, UDP # Common: domain syslog FW_SERVICES_INTERNAL_UDP="domain" # For VPN/Routing which END at the firewall!! FW_SERVICES_INTERNAL_IP="" # # 10.) # Which services should be accessible from trusted hosts/nets on the internet? # # Define trusted networks on the internet, and the TCP and/or UDP services # they are allowed to use. # # Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or # networks, seperated by a space. e.g. "172.20.1.1", "172.20.0.0/16" # FW_TRUSTED_NETS="192.168.1.0/32" # # leave FW_SERVICES_TRUSTED_* empty or any number of ports, known portnames # (from /etc/services) and port ranges seperated by a space. # e.g. "25", "ssh", "1:65535", "1 3:5" # # Services, available to trusted hosts/nets, TCP # Common: ssh FW_SERVICES_TRUSTED_TCP="" # Services, available to trusted hosts/nets, UDP # Common: syslog time ntp FW_SERVICES_TRUSTED_UDP="" # Services, available to trusted hosts/nets, other IP protos # For VPN/Routing which END at the firewall!! FW_SERVICES_TRUSTED_IP="" # # Some people want to allow some trusted machines access to some services # and different services to others. OK, here is your hardcore config option: # "trusted_net,protocol,port" e.g. "10.0.1.0/24,tcp,80 10.0.1.6,tcp,21" FW_SERVICES_TRUSTED_ACL="" # # 11.) # How is access allowed to high (unpriviliged [above 1023]) ports? # # You may either allow everyone from anyport access to your highports ("yes"), # disallow anyone ("no"), anyone who comes from a defined port (portnumber or # known portname) [note that this is easy to circumvent!], or just your # defined nameservers ("DNS"). # Note that if you want to use normal (active) ftp, you have to set the TCP # option to ftp-data. If you use passive ftp, you don't need that. # Note that you can't use rpc requests (e.g. rpcinfo, showmount) as root # from a firewall using this script (well, you can if you include range # 600:1023 in FW_SERVICES_EXTERNAL_UDP ...). # # Choice: "yes", "no", "DNS", portnumber or known portname, defaults to "no" # # Incoming connections on ports >= 1024, TCP # Common: "ftp-data" (sadly!) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Incoming connections on ports >= 1024, UDP # Common: "DNS" or "domain ntp" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # # 12.) # Are you running some of the services below? # They need special attention - otherwise they won´t work! # # Set services you are running to "yes", all others to "no", defaults to "no" # # if yes, FW_SERVICES_*_TCP needs to have port 53 # (or "domain") set to allow incoming queries. # also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes" FW_SERVICE_DNS="no" # if you use dhclient to get an ip address # you have to set this to "yes" ! FW_SERVICE_DHCLIENT="yes" # set to "yes" if this server is a DHCP server FW_SERVICE_DHCPD="no" # set to "yes" if this server uses samba as client # or server. As a server, you still have to set # FW_SERVICES_{WORLD,DMZ,INT}_TCP="139" # Everyone may send you udp 137/138 packets if set # to yes! (samba on the firewall is not a good idea!) FW_SERVICE_SAMBA="no" # # 13.) # Which services accessed from the internet should be allowed to the # dmz (or internal network - if it is not masqueraded)? # REQUIRES: FW_ROUTE # # With this option you may allow access to e.g. your mailserver. The # machines must have valid, non-private, IP addresses which were assigned to # you by your ISP. This opens a direct link to your network, so only use # this option for access to your dmz!!!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forwarding rules, seperated each by a space. # A forwarding rule consists of 1) source IP/net, 2) destination IP (dmz/intern) # and 3) destination port (or IP protocol), seperated by a comma (","), e.g. # "4.0.0.0/8,1.1.1.1,22" [means: net 4.0.0.0 with netmask 255.0.0.0 is # allowed to connect to the single server 1.1.1.1 on port 22 (which is SSH)] # "4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" # For FW_FORWARD_IP it is "4.0.0.0/8,1.1.1.1,igmp" or "4.0.0.0/8,1.1.1.1,1" # # Forward TCP connections # Beware to use this! FW_FORWARD_TCP="" # Forward UDP connections # Beware to use this! FW_FORWARD_UDP="" # Forward other IP protocol connections (for VPN setups) # Beware to use this! FW_FORWARD_IP="" # # 14.) # Which services accessed from the internet should be allowed to masqueraded # servers (on the internal network or dmz)? # REQUIRES: FW_ROUTE, FW_MASQUERADE # # With this option you may allow access to e.g. your mailserver. The # machines must be in a masqueraded segment and may not have public IP addesses! # Hint: if FW_DEV_MASQ is set to the external interface you have to set # FW_FORWARD_* from internal to DMZ for the service as well! # # Please note that this should *not* be used for security reasons! You are # opening a hole to your precious internal network. If e.g. the webserver there # is compromised - your full internal network is compromised!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forward masquerade rules, seperated each by a space. # A forward masquerade rule consists of 1) source IP/net, 2) destination IP # (dmz/intern) and 3) destination port, seperated by a comma (","), e.g. # "4.0.0.0/8,1.1.1.1,22", # "4.4.4.4/12,20.20.20.20,22 12.12.12.12/12,20.20.20.20,22" # # Forward TCP connections to masqueraded host # Beware to use this! FW_FORWARD_MASQ_TCP="" # Forward UDP connections to masqueraded host # Beware to use this! FW_FORWARD_MASQ_UDP="" # it is not possible to masquerade other IP protocols, hence no _IP variable # # 15.) # Which accesses to services should be redirected to a localport on the # firewall machine? # # This can be used to force all internal users to surf via your squid proxy, # or transparently redirect incoming webtraffic to a secure webserver. # # Choice: leave empty or use the following explained syntax of redirecting # rules, seperated by a space. # A redirecting rule consists of 1) source IP/net, 2) destination IP/net, # 3) original destination port and 4) local port to redirect the traffic to, # seperated by a colon. e.g. "10.0.0.0/8,0/0,80,3128 0/0,172.20.1.1,80,8080" # # Redirect TCP connections FW_REDIRECT_TCP="80" # Redirect UDP connections FW_REDIRECT_UDP="" # # 16.) # Which logging level should be enforced? # You can define to log packets which were accepted or denied. # You can also the set log level, the critical stuff or everything. # Note that logging *_ALL is only for debugging purpose ... # # Choice: "yes" or "no", FW_LOG_*_CRIT defaults to "yes", # FW_LOG_*_ALL defaults to "no" # # Log critical denied network packets FW_LOG_DENY_CRIT="yes" # Log all denied packets FW_LOG_DENY_ALL="yes" # Log critical accepted packets FW_LOG_ACCEPT_CRIT="yes" # Log all accepted packets FW_LOG_ACCEPT_ALL="yes" # # 17.) # Do you want to enable additional kernel TCP/IP security features? # If set to yes, some obscure kernel options are set. # (icmp_ignore_bogus_error_responses, icmp_echoreply_rate, # icmp_destunreach_rate, icmp_paramprob_rate, icmp_timeexeed_rate, # ip_local_port_range, log_martians, mc_forwarding, mc_forwarding, # rp_filter, routing flush) # Tip: Set this to "no" until you have verified that you have got a # configuration which works for you. Then set this to "yes" and keep it # if everything still works. (It should!) ;-) # # If you are using VPNs (e.g. FreeSWAN) or are combining several ISDN lines # or similar to one, you have to set this to "no" ! # # Choice: "yes" or "no", defaults to "yes" # FW_KERNEL_SECURITY="yes" # # 18.) # Keep the routing set on, if the firewall rules are unloaded? # REQUIRES: FW_ROUTE # # If you are using diald, or automatic dialing via ISDN, if packets need # to be sent to the internet, you need to turn this on. The script will then # not turn off routing and masquerading when stopped. # You *might* also need this if you have got a DMZ. # Please note that this is *insecure*! If you unload the rules, but are still # connected, you might your internal network open to attacks! # The better solution is to remove "/sbin/SuSEfirewall stop" or # "/sbin/init.d/firewall stop" from the ip-down script! # # Choices "yes" or "no", defaults to "no" # FW_STOP_KEEP_ROUTING_STATE="no" # # 19.) # Allow (or don't) ICMP echo pings on either the firewall or the dmz from # the internet? # REQUIRES: FW_ROUTE for FW_ALLOW_PING_DMZ # # Choice: "yes" or "no", defaults to "no" # # Allow ping on firewall FW_ALLOW_PING_FW="no" # Allow ping on DMZ targets FW_ALLOW_PING_DMZ="no" ## # END of firewall.rc.config ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # # # 20.) # Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall. # This is used for traceroutes to your firewall (or traceroute like tools). # # Please note that the unix traceroute only works if you say "yes" to # FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say # "yes" to FW_ALLOW_PING_FW # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_FW_TRACEROUTE="no" # # 21.) # Allow ICMP sourcequench from your ISP? # # If set to yes, the firewall will notice when connection is choking, however # this opens yourself to a denial of service attack. Choose your poison. # # Choice: "yes" or "no", defaults to "yes" # FW_ALLOW_FW_SOURCEQUENCH="yes" # # 22.) # Which masquerading modules should be loaded? # REQUIRES: FW_ROUTE, FW_MASQUERADE # # (omit the path or "ip_masq_" prefix as well as the ".o" suffix!) # FW_MASQ_MODULES="autofw cuseeme ftp irc mfw portfw quake raudio user vdolive" # # 23.) # Do you want to load customary rules from a file? # # This is really an expert option. NO HELP WILL BE GIVEN FOR THIS! # READ THE EXAMPLE CUSTOMARY FILE AT /etc/rc.config.d/firewall-custom.rc.config # #FW_CUSTOMRULES="/etc/rc.config.d/firewall-custom.rc.config" -- Richard

2 1

squid remote exploit/crash
by Wolfram Schlich 26 Sep '01

26 Sep '01

Hi, the recent admins.ws security-newsletter states: german original: --8<-- 5. Squid Web Proxy kann durch bösartige User abgeschossen werden Es wurde ein Fehler im Cache-Handling entdeckt, der es Usern ermöglicht, die in Unix-Kreisen verbreitete Squid Proxy abzuschießen. Das nachfolgende Beispiel führt dazu, daß Squid hängenbleibt, und neu gestartet werden muß : nc proxy:3128 PUT ftp://ftpserver/WEB-INF/1/2/1/ HTTP/1.1 Content-type: application/octet-stream Content-length: 0 Pragma: no-cache Betroffen sind alle Versionen einschließlich der aktuellen Version 2.4 Es wird somit dringend empfohlen, den folgenden Patch herunterzuladen und zu installieren: http://www.squid-cache.org/bugs/showattachment.cgi?attach_id=38 --8<-- translated (logically): --8<-- 5. Squid web proxy can be crashed by mischievous users A bug in the cache-handling was discovered, which makes it possible for users to crash the commonly used squid web proxy. The example given herafter results in squid hanging and needing a restart: nc proxy:3128 PUT ftp://ftpserver/WEB-INF/1/2/1/ HTTP/1.1 Content-type: application/octet-stream Content-length: 0 Pragma: no-cache All versions including 2.4 are affected. You are strongly encouraged to get and install the following patch: http://www.squid-cache.org/bugs/showattachment.cgi?attach_id=38 --8<-- SuSE-ppl: when may we reckon on an update? Thank you. -- Mit freundlichen Gruessen / Yours sincerely Wolfram Schlich * E-Mail: wolfram(a)schlich.org * ICQ: UIN 35713642 Postal: Berghof, D-56626 Andernach-Kell * Phone: +49-(0)2636-941194

3 3

Is it possible to return something, so Nimda would crash?
by Alexey N. Solofnenko 25 Sep '01

25 Sep '01

People just never install patches. It seems the only way to shut the virus up. _____ < http://members.home.com/asolofnenko/ > Alexey N. Solofnenko < http://www.inventigo.com/ Inventigo LLC Pleasant Hill, CA (GMT-8 usually)

13 24

RE: [suse-security] Is it possible to return something, so Nimda would crash?
by Mauricio Latorre 25 Sep '01

25 Sep '01

and three... it's better that you put in a web page :-D By the way, it's a good way to flood a server, but i'm not sure about the accuracy Chubasco ----- Original Message ----- From: "Peter Romianowski" <antarapero(a)gmx.de> Date: Monday, September 24, 2001 8:32 pm Subject: RE: [suse-security] Is it possible to return something, so Nimda would crash? > now we are two :-) > > > -----Original Message----- > > From: Alexey N. Solofnenko [mailto:alexeys@citechlabs.com] > > Sent: Tuesday, September 25, 2001 12:26 AM > > To: > > Subject: RE: [suse-security] Is it possible to return something, > > so Nimda would crash? > > > > > > Maybe you can publish the script here? > > > > _____ > > > > < http://members.home.co > Alexey N. Solofnenko > > < http://www.inventigo.com/ Inventigo LLC > > Pleasant Hill, CA (GMT-8 usually) > > > > > > -----Original Message----- > > From: Thomas Lamy [mailto:Thomas.Lamy@netwake.de] > > Sent: Monday, September 24, 2001 1:38 PM > > To: 'Alexey N. Solofnenko'; suse-security(a)suse.com > > Subject: AW: [suse-security] Is it possible to return something, so > > Nimda would crash? > > > > > > Hi, > > you can always ask ARIN (whois whois.arin.net <ip>) or (in > Europe) RIPE > > (whois.ripe.net) it will give you the administrative contact(s) > for the > > netblock the questioned ip is in. > > > > I hacked a small shell script which takes an access_log file > from my > > servers, extracts the nimda-type requests, does a lookup of the > admin's> email and sends him _one_ mail (with URLs pointing to > NIMDA informations > > and > > how to remove it). > > > > Can't tell how successful I was with this attempt, but sent out 350 > > mails > > and received no "shut up"... > > > > > > Thomas > > > > ..............

1 0

Security Violations
by Eduard Meiler 25 Sep '01

25 Sep '01

Hallo, does anybody understand this Security Violations: Sep 24 17:39:00 wall pppd[12338]: tcflush failed: Input/output error Sep 24 17:48:23 wall pppoe[12633]: Bad TCP checksum fffe best regards eduard

3 2

[suse-security] snort going mad, portscan against myself?
by Markus Kohli 25 Sep '01

25 Sep '01

Hi together! I just figured out how to run snort (altough it doesn't start at boot-up, hell knows why...). Now it keeps telling me, that there is a portscan against myself from my machine running. Look at this: [**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 10.0.3.19 (THRESHOLD 4 connections exceeded in 7 seconds) [**] 09/24-23:52:42.477424 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 6 connections across 6 hosts: TCP(5), UDP(1) [**] 09/24-23:53:58.678712 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:03.679551 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:08.689307 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/24-23:55:00.534798 And I swear, I'm not running any nmap or anything similar, and haven't been running since the last reboot... Could anybody help me please? TIA kind regards markus

2 1

AW: [suse-security] Is it possible to return something, so Nimda would crash?
by Thomas Lamy 25 Sep '01

25 Sep '01

Hi, you can always ask ARIN (whois whois.arin.net <ip>) or (in Europe) RIPE (whois.ripe.net) it will give you the administrative contact(s) for the netblock the questioned ip is in. I hacked a small shell script which takes an access_log file from my servers, extracts the nimda-type requests, does a lookup of the admin's email and sends him _one_ mail (with URLs pointing to NIMDA informations and how to remove it). Can't tell how successful I was with this attempt, but sent out 350 mails and received no "shut up"... Thomas -----Ursprungliche Nachricht----- Von: Alexey N. Solofnenko [mailto:alexeys@citechlabs.com] Gesendet: Montag, 24. September 2001 22:03 An: suse-security(a)suse.com Betreff: RE: [suse-security] Is it possible to return something, so Nimda would crash? Is it possible to retrieve administrator's email address from IIS? Or there is always a standard admin address. _____ < http://members.home.com/asolofnenko/ > Alexey N. Solofnenko < http://www.inventigo.com/ Inventigo LLC Pleasant Hill, CA (GMT-8 usually) -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

4 3

[suse-security] snort going mad, portscan against myself...?
by Markus Kohli 24 Sep '01

24 Sep '01

Hi together! I just figured out how to run snort (altough it doesn't start at boot-up, hell knows why...). Now it keeps telling me, that there is a portscan against myself from my machine running. Look at this: [**] [100:1:1] spp_portscan: PORTSCAN DETECTED from 10.0.3.19 (THRESHOLD 4 connections exceeded in 7 seconds) [**] 09/24-23:52:42.477424 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 6 connections across 6 hosts: TCP(5), UDP(1) [**] 09/24-23:53:58.678712 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:03.679551 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 1 connections across 1 hosts: TCP(0), UDP(1) [**] 09/24-23:54:08.689307 [**] [100:2:1] spp_portscan: portscan status from 10.0.3.19: 2 connections across 2 hosts: TCP(1), UDP(1) [**] 09/24-23:55:00.534798 And I swear, I'm not running any nmap or anything similar, and haven't been running since the last reboot... Could anybody help me please? TIA kind regards markus

1 0

security problem with kdm settings
by Bob Vickers 24 Sep '01

24 Sep '01

Hello, I believe I have found a bug in KDE which has minor security implications. Twice now I have found that my local customisations of KDM have disappeared, and this is very irritating. The default KDM settings are not appropriate for terminals in public areas because: (a) a complete list of valid users is displayed (b) the banner includes the word "Welcome", and I have often been advised that you should not welcome users until after they have passed authentication (whether this advice is good is beside the point!). I believe that the settings revert when I install other software; perhaps when SuSEconfig runs. The sequence of events was : (1) start kcontrol, then become root and customise the login process (2) success, login now OK. (2) I noted that my customisation had changed /opt/kde2/share/config/kdmrc so I copied this to a new file /etc/opt/kde2/share/config/kdmrc in the hope of making the change permanent (3) I installed other software (galeon and netscape6). (4) Customisations have been lost, and /opt/kde2/share/config/kdmrc has reverted to default (5) I copied /etc/opt/kde2/share/config/kdmrc to /opt/kde2/share/config/kdmrc and things are OK again (until next time). I may be doing some things wrong, because I can't find any documentation about customising KDE other than the painstakingly slow GUI method. /etc/kderc contains dir_config=/etc/opt/kde2/share/config:/opt/kde2/share/config though my experience suggests this has no effect. I am running kdebase-2.1.1-89 on SuSE 7.2 Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

4 3

RE: [suse-security] Is it possible to return something, so Nimda
by Michael Sziede 24 Sep '01

24 Sep '01

Excuse me, but a lot of people have short personal messages at the end of their posts. Keep your out-of-context quotes and holier-than-thou "crap" to yourself. -----Original Message----- From: Anders Johansson [mailto:andjoh@cicada.linux-site.net] Sent: Monday, September 24, 2001 1:24 PM To: suse-security(a)suse.com Subject: Re: [suse-security] Is it possible to return something, so Nimda On Monday 24 September 2001 18.55, Wade Chandler wrote: > May God Be With America. USA! Please keep this kind of crap away from technical mailing lists Thank you Anders -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

3 2

RE: [suse-security] Is it possible to return something, so Nimda
by James Bliss 24 Sep '01

24 Sep '01

I am an American and very patriotic. But, I believe that this line of communication should be stopped. The initial response message was uncalled for and should have been ignored. Please do not get into a ridiculous spat here and lets stay on topic of SuSE at least (if not exclusively security). Thanks, Jim 09/24/01 12:31:01 PM, Michael Sziede <Michael.Sziede(a)trx.com> wrote: >Excuse me, but a lot of people have short personal messages at the end of >their posts. Keep your out-of-context quotes and holier-than-thou "crap" to >yourself. > >-----Original Message----- >From: Anders Johansson [mailto:andjoh@cicada.linux-site.net] >Sent: Monday, September 24, 2001 1:24 PM >To: suse-security(a)suse.com >Subject: Re: [suse-security] Is it possible to return something, so >Nimda > > >On Monday 24 September 2001 18.55, Wade Chandler wrote: >> May God Be With America. USA! > >Please keep this kind of crap away from technical mailing lists > >Thank you >Anders > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: SuSE Security Announcement: wmaker/WindowMaker
by Mail2News User 24 Sep '01

24 Sep '01

Hello! It is recommended to update wmaker to SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xwm1/wmaker-0.62.1-42.i386.rpm but it also exists a Version wmaker-0.62.1-68. Is this Version also affected or is there nor need to "downgrade"? Greetings, Jan Suchanek

4 3

SuSE Security Announcement: wmaker/WindowMaker (SuSE-SA:2001:032)
by Thomas Biege 24 Sep '01

24 Sep '01

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: wmaker/WindowMaker Announcement-ID: SuSE-SA:2001:032 Date: Thursday, September 20th 2001 15:10 MEST Affected SuSE versions: (6.0, 6.1, 6.2,) 6.3, 6.4, 7.0, 7.1, 7.2 Vulnerability Type: remote privilege escalation Severity (1-10): 5 SuSE default package: no Other affected systems: all Unix systems running Window Maker < 0.65.1 Content of this advisory: 1) security vulnerability resolved: Window Maker problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The window manager Window Maker was found vulnerable to a buffer overflow due to improper bounds checking when setting the window title. An attacker can remotely exploit this buffer overflow by using malicious web page titles or terminal escape sequences to set a excessively long window title. This attack can lead to remote command execution with the privileges of the user running Window Maker. A temporary fix does not exist; we recommend to update your system with the new RPM from our FTP server. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Uhv file.rpm" to apply the update. After installing the updated RPM - run /sbin/SuSEconfig (the central configuration utility in SuSE Linux distributions) - restart your window manager. If this is not possible for configura- tional reasons, restart your x-session. i386 Intel Platform: SuSE-7.2 ftp://ftp.suse.com/pub/suse/i386/update/7.2/xwm1/WindowMaker-0.64.0-82.i386… 0f5508e10089deecf34b51ab8c007bbf source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/WindowMaker-0.64.0-82.src.r… 6472b87eb8a841d5cefe4f0889f9b4e1 SuSE-7.1 ftp://ftp.suse.com/pub/suse/i386/update/7.1/xwm1/WindowMaker-0.62.1-25.i386… 39c69fab92923eca0cf1f0e077232fef source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/WindowMaker-0.62.1-25.src.r… a8c32f85125bbe7bf041335100e447b8 SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/xwm1/wmaker-0.62.1-42.i386.rpm d825fa6cd78643e880bb89464594a464 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/wmaker-0.62.1-42.src.rpm bd6e55a9b16e836065f59b4dc824416f SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/xwm1/wmaker-0.61.1-59.i386.rpm 7de5a334c4fbbeb6ef3d79d197a585c1 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/wmaker-0.61.1-59.src.rpm 4471d22b705b8b24a1808729a32d1764 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/xwm1/wmaker-0.61.1-59.i386.rpm 8c8453b37e7b69008be2be4929a62d80 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/wmaker-0.61.1-59.src.rpm 0c96f81234e787a48b8d2df4e698843a Sparc Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/sparc/update/7.1/xwm1/WindowMaker-0.62.1-17.spa… c19bc73ccc235bbd35d1e8953cfbabbb source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/WindowMaker-0.62.1-17.src.… e60425cb8ae38b16a3aac3fa23a6c54f SuSE-7.0 ftp://ftp.suse.com/pub/suse/sparc/update/7.0/xwm1/wmaker-0.62.1-2.sparc.rpm 9f0a23eddb8b9dbfc07288871388ff34 source rpm: ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/wmaker-0.62.1-2.src.rpm a95d995b1ea164b8c93a9fc308f703d1 AXP Alpha Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/axp/update/7.1/xwm1/WindowMaker-0.62.1-23.alpha… 55cf56c7bea8fa3e9cf7ca2c90457249 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/WindowMaker-0.62.1-23.src.rpm 7b5bc50ad9e854dc2858a1b0a08385d5 SuSE-7.0 ftp://ftp.suse.com/pub/suse/axp/update/7.0/xwm1/wmaker-0.62.1-5.alpha.rpm 6e7e01c1a1ef1e2ac751638dd7e31d21 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/wmaker-0.62.1-5.src.rpm 2ee34d67aba5c06878623e3ca50f47d1 SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/xwm1/wmaker-0.61.1-57.alpha.rpm dcbfdaf729cb823046f3dc6e913fcf1b source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/wmaker-0.61.1-57.src.rpm 3d045c4fd65d2ce9b69a1890d71fd59a SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/xwm1/wmaker-0.61.1-57.alpha.rpm 6c17c78ef0fe2971b29fe1a2300c4fc3 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/wmaker-0.61.1-57.src.rpm f01b2923ebc6e4e6a52b75e8597cbe50 PPC PowerPC Platform: SuSE-7.1 ftp://ftp.suse.com/pub/suse/ppc/update/7.1/xwm1/WindowMaker-0.62.1-18.ppc.r… 00f099cc26983691641ed041441abfc2 source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/WindowMaker-0.62.1-18.src.rpm 1941b4c46eeb3e4fe4a7e3a1c79ae8a5 SuSE-7.0 ftp://ftp.suse.com/pub/suse/ppc/update/7.0/xwm1/wmaker-0.62.1-49.ppc.rpm f5ef503d073a7e9e34cf28e4eb56fbaa source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/wmaker-0.62.1-49.src.rpm 362468904bd119c44f2c2baa1312a116 SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/xwm1/wmaker-0.61.1-56.ppc.rpm 0408f29d40eebf5bbc84bdcf14a03c5f source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/wmaker-0.61.1-56.src.rpm 50c1a727aec53feb76f451854657b6c8 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - SuSE Linux distributions do not contain the sftp-server as described by Peter W <peterw(a)usa.net> (Message-ID: <20010918082406.M14947(a)usa.net>) on the bugtraq mailing list and are therefore not vulnerable to the problems found. - A new worm called "Nimda" has been reported in the wild. It attacks IIS webservers and uploads a file called "readme.eml" which is being downloaded by the client's browser. Some versions of the Internet Explorer even execute this file without the user's knowledge. A temporary workaround for sites that use a squid proxy to access the internet would be to add these three lines to the /etc/squid.conf file: # filter Nimda worm files: acl nimda urlpath_regex -i \.eml$ acl nimda urlpath_regex -i \.nws$ http_access deny nimda Do not forget to reload your squid server (/usr/sbin/rcsquid reload)! ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We advise against subscribing to lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. =================================================== SuSE's security contact is <security(a)suse.com>. The <security(a)suse.com> public key is listed below. =================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GZkBogQ57vSBEQQAk/GN+ftr 7+DBlSoixDDpfRnUk+jApGEt8hCnrnjVnPs/9Cr33+CXLQbILOO7Y5oiPbJdHh45 t4E0fKyLVzDerCRFB1swz/mNDxT26DLysdBV5fwNHTPhxa67goAZVrehQPqJEckk IpYriOaYcKpF3n5fQIZMEfMaHEElQhcXML8AoJVXDkJYh7vI8EUB8ZURNLZMEECN A/sH0MCnb4Q6ZcRyeZ3+1PHP8hP73b6TepRdLZhaylwVF/iu7uIn62ZUL4//NTOC DY7V63qg4iba/fUbOsWtEnGaiE7mQuAlsSWvRspwRA9/g9rdVf3/JdLJrLmKBThe yG+PSJE3W7cAE4ZWafGxIRCwXhmj3TQnJn2euqylHRubEQP/aL53NZK0kBdvrKgf f6O8Of6tqoss8Dkk55I7QVFSp+My1Dn+mngQKFejTAgtyo/WmR3wPjQ9HoT2lRiY I2lTRYT4uMdHuwVC3b4DqAKmoy375FERwHkrMVyKBJslv8QtbAWw5A1CAUseaHo+ 91wmYJ4/4p6YUahqbG/tZyhbxfq0KFN1U0UgUGFja2FnZSBTaWduaW5nIEtleSA8 YnVpbGRAc3VzZS5kZT6IXAQTEQIAHAUCOe70gQUJA8JnAAQLCgMEAxUDAgMWAgEC F4AACgkQqE7a6JyACspfLACffAYA+NM8NBhyRyH+nTX58CNjwLIAoIx9fj52BJe0 xY7WbKoXs1+72b2AiEYEEBECAAYFAjpwXlIACgkQnkDjEAAKq6TczgCgi+ddhWb7 +FWcfeE6WwPZccqAHowAnjjtRyGwHLQHr5OTFAYTXi2Wv6jNiQEVAwUQOnBgb3ey 5gA9JdPZAQE1pwf/QJ+b34lFBNVUJ7fk/xGJJREt7V12iSafaRzGuH8xWvIz1bb+ VARxnnt16FDQ1cDNjoEhCEmcW83Vxp6iJXE9PE8wVA/Yue/bon5JS7J69+UiQ2eq 2pudfwljp52lYVM53jgPYEz0q/v3091nlZ8CYkAkN9JDS1lV1gEzJ7J0+POngDpU +lDQT2EC6VKaxeWK8pNt6UFDwICRDQxKnlOoiDvTrdWT7QdJZ4sPv8Qotdw9+tKN bWQ2DqdIRxyTdw9xDfAtcj6mXeQr7852Lwem1gSKVnEYHZ9g1FTJqVOutY8KhpUc 9RfOCRv8XuIxrs4KSbfSF0s8qIRCQelxufg9AbkCDQQ57vSSEAgAhJHQTejMX+Vr 6g1pHDEcusJ63fQ2CfFFE5iE9okH9O7UVCiSfb9CV38dmeHdPCEEjDUWquFYEnvj 3WICMtH249t1Ymuf4Du3yRKQ9oXdn/qTJzlrx9qzjiG3mH7ocwHOgUIwCrZoEdBE VE2n0zPVm+hddwjWWTWXw6pxQz+i9dsN89xexRV5M9O0bNwCLaNWX2GXeLAkqTK/ 9EuZy6x2yLxi6du9YYUAXkZpqBhCjtiUXpRoFCdglMznbcAyCk9C2wqb2j/D1Z2B eSBaGCSFkR6pRLebnE17LWcu72Iy+r0z+JecbPiyDpDZj4apn7IC81aNFGi7fNIT sHODbwwjiwADBgf/YPvVdzkc8OC7ztacEWCanwylKvxCdKzTDA+DfES6WUYShyiV JvZzRy25LJ5WcK20kzOS6Qv1OrIXiz/pdGy1aKtJZrAnFEsofpmOj8VoqyyFgp/y AGQBp12+mXek7SCZRhuqalDfEMRiWEJ6J5dLkyShyRDWyPbFh0HXE7QTHN+IKKxx QqNQXL6Z3NSxS61p+5n6BseiDUI39xxkKTFwFrkgUIc5Gs2Or2lhaWvGwSfoCmwb sklszZt6xbU+R0SjFqTvjPWx6eHfqbmNC9WMDdTjGrXDDKXFp2aYlokfN6It9vsb VlGNlOwHt/JjGoPMxW6Xqj0FLA7/VewgCdXW64hMBBgRAgAMBQI57vSSBQkDwmcA AAoJEKhO2uicgArKSyIAmwUHf/vtKQfcmVg4asR7U6XQl0bAAJ4pO22B5U8UH6IY l2LBCXFqw5+5fA== =Jnnf - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQEVAwUBO6oaPXey5gA9JdPZAQEacAf9HZ7Xhi0Yxe+9Z6VfHoJN/6LpMa2yMo6d Oj891kR/i/UhsXy/u5ua1vNoWzR/TyZn8Jv0ctrDWsWQ7aJBguiQITscG5P8epeI +L5NebIwsWQBTCnWtu6H8Q1ivvPyGsObO3AE5i8gInzFsmLFmJYbg9MKi0c3fmHq enBTZ4+81PbJF2DVrpYfnO/9UG4nbgtuHM8+ypQ9d6LlZl3WMj/hOjzG+g+BRnyN 3uyNz8r/DtKyYq3xF7KNh+j8SQ4jdQuEvIaS52Nhq6UAAyCT29SpR8KM4CUFhuq4 szuJBVDlHlBu+xZ8U5iQCzZkxCrC+NPirKOh51iI3T0A0olVlr+gjw== =lRUF -----END PGP SIGNATURE----- Bye, Thomas -- Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg E@mail: thomas(a)suse.de Function: Security Support & Auditing "lynx -source http://www.suse.de/~thomas/contact/thomas.asc | pgp -fka" Key fingerprint = 51 AD B9 C7 34 FC F2 54 01 4A 1C D4 66 64 09 84

3 3

router / ipchains
by Michael Neumann 22 Sep '01

22 Sep '01

Hi all! I want to protect our network with a firewall that should run on a SuSE machine (kernel 2.2 stable). There is a router that provides a permantent DSL connection to the net. Normaly this router is the gateway for all machines on the local net - but not I want to put a firewall between. The network has official ip addresses and all machines shall use these, which means that I do not want to have masquerading. So I have put the firewall machine between router and local net. I have switched on ip_forwarding and - for testing - have set up all ipchains to ACCEPT. Now it should route/forward everything, yes? But it doesn't. I can ping the firewall machine both from outside and from inside. But I cannot reach another host in the network from outside (and the other way around). When I try to ping a host in the network from outside I get a answer from my dsl router that this host is not reachable. Maybe the problem is here, I don't know... Do you have an idea? Thanx a lot! Michael

7 7

Re: [suse-security] nfs on susefirewall2
by Purple Shirt 22 Sep '01

22 Sep '01

Ok I got nfs server on firewall working with the following ports (portmap 111, mount 635, nfsd-status and nfsd-keepalive 1110, NFS 2049) in play. Some may not be required but this is as far as I got it now functional. FW_SERVICES_INT_TCP="smtp domain ftp ssh www telnet 111 139 635 1110 2049" FW_SERVICES_INT_UDP="domain 111 635 1110 2049" mk >From: "Purple Shirt" <purpleshirt(a)hotmail.com> >To: suse-security(a)suse.com >Subject: [suse-security] nfs on susefirewall2 >Date: Fri, 21 Sep 2001 07:18:35 >MIME-Version: 1.0 >X-Originating-IP: [144.132.216.228] >Received: from [202.58.118.7] by hotmail.com (3.2) with ESMTP id >MHotMailBD74350300AC4136E817CA3A76070A8B0; Fri, 21 Sep 2001 00:19:31 -0700 >Received: (qmail 5469 invoked by alias); 21 Sep 2001 07:18:06 -0000 >Received: (qmail 5460 invoked from network); 21 Sep 2001 07:18:05 -0000 >From suse-security-return-9213-purpleshirt Fri, 21 Sep 2001 00:20:06 -0700 >Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm >Precedence: bulk >X-No-Archive: yes >List-Post: <mailto:suse-security@suse.com> >List-Help: <mailto:suse-security-help@suse.com> >List-Unsubscribe: <mailto:suse-security-unsubscribe@suse.com> >List-Subscribe: <mailto:suse-security-subscribe@suse.com> >X-Mailinglist: suse-security >Delivered-To: mailing list suse-security(a)suse.com >Message-ID: <F112uylJc0xvlUQ9cAg00000821(a)hotmail.com> >X-OriginalArrivalTime: 21 Sep 2001 07:18:35.0273 (UTC) >FILETIME=[A061FF90:01C1426D] > >Hello, > >I have a working nfs server on susefirewall2 box (suse 7.2). I know its >working because I put the firewall on unprotect status. If I put it on >protect status for internal I can't mount internally. I put this into >susefirewall2.rc.config: > ># Common: ssh smtp domain >FW_SERVICES_INT_TCP="smtp domain ftp ssh www telnet 111 139 2049" ># Common: domain syslog >FW_SERVICES_INT_UDP="111 2049" ># For VPN/Routing which END at the firewall!! >FW_SERVICES_INT_IP="" > >This o[pens up portmap and nfs server ports, 111 and 2049. But it doesn't >work. > >Maybe the firewall script should contain more options as: > >FW_SERVICE_DNS="no" >FW_SERVICE_DHCLIENT="no" >FW_SERVICE_DHCPD="yes" >FW_SERVICE_SQUID="yes" >FW_SERVICE_SAMBA="yes" > >as in > >FW_SERVICE_NFS >FW_SERVICE_NTPD >... >... > >Well I'd appreciate comments on how to make suse's firewall work with nfs. > >Thanks, > >mk > > > >_________________________________________________________________ >Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp

1 0

Interesting Returned Mail
by Togan Muftuoglu 22 Sep '01

22 Sep '01

Hi, Could someone possible explain me what's going. I know it's basicly a mail delivery problem yet for a mail that I send out 29 July 2001 its a little bit late :-) I have another one similar to this one also TIA -- Togan Muftuoglu From: Mail Delivery Subsystem <MAILER-DAEMON(a)relay.uni-heidelberg.de> Subject: Returned mail: see transcript for details Auto-Submitted: auto-generated (failure) The original message was received at Fri, 21 Sep 2001 16:58:22 +0200 (MET DST) from anatomy1.ana.uni-heidelberg.de [129.206.158.170] ----- The following addresses had permanent fatal errors ----- <svweimann(a)zellbio.ana.uni-heidelberg.de> (reason: 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown) ----- Transcript of session follows ----- ... while talking to zellbio.ana.uni-heidelberg.de.: >>> RCPT To:<svweimann(a)zellbio.ana.uni-heidelberg.de> <<< 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown Reporting-MTA: dns; relay.uni-heidelberg.de Received-From-MTA: DNS; anatomy1.ana.uni-heidelberg.de Arrival-Date: Fri, 21 Sep 2001 16:58:22 +0200 (MET DST) Final-Recipient: RFC822; svweimann(a)zellbio.ana.uni-heidelberg.de Action: failed Status: 5.1.1 Remote-MTA: DNS; zellbio.ana.uni-heidelberg.de Diagnostic-Code: SMTP; 550 5.1.1 <svweimann(a)zellbio.ana.uni-heidelberg.de>... User unknown Last-Attempt-Date: Fri, 21 Sep 2001 16:58:30 +0200 (MET DST) Return-Path: <toganm(a)users.sourceforge.net> Received: from anaserv.ana.uni-heidelberg.de (anatomy1.ana.uni-heidelberg.de [129.206.158.170]) by relay.uni-heidelberg.de (8.10.2+Sun/8.10.2) with ESMTP id f8LEw4l01566 for <svweimann(a)zellbio.ana.uni-heidelberg.de>; Fri, 21 Sep 2001 16:58:22 +0200 (MET DST) Received: from localhost (shire.ana.uni-heidelberg.de [127.0.0.1]) by anaserv.ana.uni-heidelberg.de (8.11.2/8.11.3) with ESMTP id f8LEw6405738 for <svweimann@localhost>; Fri, 21 Sep 2001 16:58:06 +0200 X-Envelope-From: <suse-security-return-8264-linux=sven-weimann.de(a)suse.com> X-Envelope-To: <linux(a)sven-weimann.de> X-Delivery-Time: 996426626 Received: from post.strato.de [192.67.198.79] by localhost with POP3 (fetchmail-5.7.4) for svweimann@localhost (single-drop); Fri, 21 Sep 2001 16:58:06 +0200 (CEST) Received: from lists2.suse.com (lists2.suse.com [202.58.118.7]) by post.webmailer.de (8.9.3/8.8.7) with SMTP id TAA23173 for <linux(a)sven-weimann.de>; Sun, 29 Jul 2001 19:10:25 +0200 (MET DST) Received: (qmail 21007 invoked by alias); 29 Jul 2001 17:07:30 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Precedence: bulk X-No-Archive: yes List-Post: <mailto:suse-security@suse.com> List-Help: <mailto:suse-security-help@suse.com> List-Unsubscribe: <mailto:suse-security-unsubscribe@suse.com> List-Subscribe: <mailto:suse-security-subscribe@suse.com> X-Mailinglist: suse-security Delivered-To: mailing list suse-security(a)suse.com Received: (qmail 20998 invoked from network); 29 Jul 2001 17:07:30 -0000 X-Authentication-Warning: isguzar.dyndns.org: toganm set sender to toganm(a)users.sourceforge.net using -f Date: Sun, 29 Jul 2001 20:04:04 +0300 From: Togan Muftuoglu <toganm(a)users.sourceforge.net> To: Suse-Security <suse-security(a)suse.com> Message-ID: <20010729200404.A3333(a)rc82.org> Mail-Followup-To: Suse-Security <suse-security(a)suse.com> References: <20010729121024.A530(a)rc82.org> <01072917452500.07003@triton> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <01072917452500.07003@triton> Subject: Re: [suse-security] best method to block ip block ----- End forwarded message -----

5 4