September 2001 - openSUSE Security - openSUSE Mailing Lists

rotate_logfiles possibly loss of information
by Severin Wiedemann 10 Sep '01

10 Sep '01

Hello ! I discovered that the script /etc/cron.daily/aaa_base_rotate_logs may loose information in the logfiles. it performs the following steps (a bit simplified) 1. cp "logfile" "logfile".o 2. cp "/dev/null" "logfile" 3. reload the service 4. compress the logfile etc. All data written to the logfile between step 1 and 2 will be lost. I don't know if it's save to cp a file while another process is writing to it, if not, step 1 alone may loose data. I wonder why this script doesn't do it the "normal" (or what I thought the normal way is):(a bit simplified) 1. mv "logfile" "logfile".o 2. touch "logfile" 3. reload the service 4. ... I think the security ml is appropriate, because (in)complete are very relevant for the security of our systems. thank you Nicolas/Severin -- Wiedemann EDV Systeme GmbH Landsbergerstr. 77 80339 München Tel.: 089/5108599-0 Fax.: 089/5108599-99

1 0

Firewall/IPChains or not ?
by A. Meinerzhagen 10 Sep '01

10 Sep '01

Hi, List. I have a question regarding the setup of our Webserver, well actually two. Is there a save way other than sftp/scp to let people update their webpages? Clients are using lots of Windows-Computers. After an Intrusion last week we don't like the idea anymore, that people use ftp to put their pages on the server. Does it make sense, with our setup, to use SuSE Firewall at all? Setup is : WWW---->FW---->(eth0) Webserver (eth1)<--->LAN ^ | ^ |------------------------v-----------------| Weird, I know. Incomming Traffic will go throug FW, but outgoing not. The Webserver-machine runs two instances of apache, to serve the www-pages and the local www-pages. That's the reason for the two NIC's. But by design we have to look at both NIC's as hostile Networks, because any computer is connected any time to the Inter- net (University). If using the Firewall, how would a setup look like? Or better IPChains? And what would the Rules be ? We are serving only ports 80, 443, and 22 (http, https, ssh) to the "outside" and at the moment to the "inside" also. If people would insist to use ftp from inside, what then ? Thanks in advance, A. Meinerzhagen

10 10

Re: [suse-security] Firewall/IPChains or not ?
by Wagner, Uwe 10 Sep '01

10 Sep '01

Hi, I'm using the following model with dynamic IP-Adress : Internet --- FW with webserver and ftp-proxy --- ftp-server --- LAN Updates from the LAN are done by rsync with ssh. The ftp-server exports a partition to the firewall, do you think, this is a problem ? And what's about exporting a partition from the ftp-server to the LAN for direct updates ? uwe -----Ursprungliche Nachricht----- Von: Stefan_Walther(a)gehag-dsk.de [mailto:Stefan_Walther@gehag-dsk.de] Gesendet: Samstag, 8. September 2001 20:28 An: suse-security(a)suse.com Betreff: Re: [suse-security] Firewall/IPChains or not ? Hi, I think you should install a second firewall. Maybe you should use the following model: INTERNET---FW1---(DMZ, with Webserver)---FW2---LAN You should be able to update your websites from the lan via ftp, without getting intrused by someone of the Internet. Maf king wrote that you should use iptables. Thats right, because of the real NAT which you can enable at FW1. At this point you can redirect incoming connections to port 80 to the webserver in the DMZ. The other ports can be closed if you do not need to use them. At FW2 you can enable NAT to the webserver via iptables. THX, have much fun. MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 Hi A.M. On 2001.09.08 15:17:46 +0100 A. Meinerzhagen wrote: > Hi, List. > > > Is there a save way other than sftp/scp to let people update their > webpages? > Clients are using lots of Windows-Computers. After an Intrusion last > week > we don't like the idea anymore, that people use ftp to put their pages > on the server. Can't think of anything easy... are all your users going to update from inside your LAN, or do thay have to update over the internet? One soloution I have seen to this problem is a temporary FTP password : something like 1. you email the server, 2. a pasword is generated and is only valid for one hour 3. password emailed back to the user. Not great, but cracker has less time when she can intrude your box. > > Does it make sense, with our setup, to use SuSE Firewall at all? > Setup is : > IMHO, it nearly always makes sense to firewall - layers of security make it harder for a bad guy to get anywhere even if he breaks into one box... > WWW---->FW---->(eth0) Webserver (eth1)<--->LAN > ^ > | ^ > |------------------------v-----------------| > > Weird, I know. Incomming Traffic will go throug FW, but outgoing not. > > The Webserver-machine runs two instances of apache, to serve > the www-pages and the local www-pages. That's the reason for the > two NIC's. But by design we have to look at both NIC's as hostile > Networks, because any computer is connected any time to the Inter- > net (University). If using the Firewall, how would a setup look like? > Or better IPChains? And what would the Rules be ? We are serving > only ports 80, 443, and 22 (http, https, ssh) to the "outside" and at > the moment to the "inside" also. If people would insist to use ftp > from inside, what then ? > I'm not sure how you gain anything by having 2 NICs on the same LAN, to my eyes, you seem to be making things too complicated... If you are using kernel 2.4.x, try iptables - it is more flexible than ipchains SuSE firewall basically makes rules for ipchains / iptables so one isn't "better" than the other, they use different ways to do the same thing. Given your unusual set-up (but fairly simple needs), I think you would be better to roll your own using iptables (sorry, Marc ;-) ) Have a look at the HOWTO at http://netfilter.samba.org for some iptables ideas. HTH, Maf. > > Thanks in advance, A. Meinerzhagen > -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Maf. King Standby Exhibition Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "It is easier to do a job right than to explain why you didn't." - Martin Van Buren ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Fw: Re: [suse-security] Strobe
by Peter Nixon 10 Sep '01

10 Sep '01

On Fri, 7 Sep 2001 14:02:12 +0100 Geraint Jones <geraint(a)jones5555.fsnet.co.uk> wrote: > Where can I download and how do I use strobe with SuSE 7.2 (kernel 2.4.4)? Errm. Why exactly do you want to use strobe? By your question it wouls seem that someone has told you to have a play with strobe, and you are not familiar with what it does exactly. Strobe is a very old portscanner (the first one ever) written by an Aussie named Julian Assange (homepage at http://www.iq.org) (As usual, us Aussies are the first!!!) He is now working on bigger and better things like Rubber Hose (http://www.rubberhose.org) It is very old, but if you still want a copy, you can find it at http://www.cotse.com/tools/pscan.htm Instead of strobe however, I suggest you take a look at Nmap (http://www.insecure.org/nmap/) which SuSE kindly include as an rpm in the Security secion of their cds -- Viel Spaß Nix - nix(a)susesecurity.com http://www.susesecurity.com

2 1

Re: [suse-security] Howto spread around the ext ip adress
by Stefan Knodt 09 Sep '01

09 Sep '01

I have a Firewall with a masqueraded DMZ. The adress of the external interface is not static (DHCP). The adress may change sometime. One of the servers in the DMZ needs to know the external adress. external interface | V Internet --------- Firewall ------ Intranet | | masq DMZ | |--- Server How can the Server determine the adress of the external interface or how can the firewall tell the adress of the external interface to the server Tks On Wed, 5 Sep 2001 12:25:21 -0500 (CDT), dog(a)intop.net wrote: >what exactly do you mean by this? > >On Wed, 5 Sep 2001, Stefan Knodt wrote: > >>Hi, >> >>since the external adress is assigned via dhcp and changes from time to time. >>What ist the most secure way to spread around the external ip adress to systems >>behind the firewall, e.g. in a masqueraded DMZ ? >>BTW the systems behind the firewall runs various OS. >> >>Thanks for your advice --------------------------- sknodt(a)bluewin.ch ---------------------------

2 1

stunnel vs sslwrap
by Steven Thompson 09 Sep '01

09 Sep '01

Hi All I would like to know which is best to use for IMAP. Is the one better than the other (ie faster, more stabe, more flexable, secure). Im currently using sslwrap. Thanks in Advance Steven Thompson

3 2

Re: [suse-security] IPCHAINS with dynamic DNS
by Stefan_Walther＠gehag-dsk.de 09 Sep '01

09 Sep '01

Hi you should use the ip-up and ip-down script in the /etc/ppp directory. In addition you should have a look at the SuSE-support-database, If I remember correctly, there is a way described how you can read the current IP of your interface to the internet and enabling the rules for this directly by use this IP. But if you do not want to do it in this way, switch to iptables with kernel 2.4.x. THX MfG. Stefan Walther stefan_walther(a)gehag-dsk.de dienst.: +4930/89786448 Funk: +49172/3943961 eric.draven(a)aon.at 09.09.01 13:19 To: suse-security(a)suse.com cc: Subject: [suse-security] IPCHAINS with dynamic DNS Hi all, i recognized a strange (?) behavior of IPCHAINS toward dynamic DNS names. I have the following problem: i use a dialup-connection at home and want to grant SSH-access to our company server, but (of course) only for my IP. So I registered some dynamic DNS-service and applied the host "xxx.ath.cx". Now i added the neccessary rules to ipchains, using this hostname. It was working fine. But after i reconnected (and got a new IP) it was not working anymore. Strange. Then i re-checked the rules and saw that ipchains obviously resolves the IP of "xxx.ath.cx", reverse lookups it and inserts THIS result (which is now the hostname given by my provider) to the final rules. So the original rule of: ipchains -I input 1 -j ACCEPT -l -p tcp -i eth0 -s xxx.ath.cx -d dst 22 is translated to: (ipchains -L) target prot opt source destination ports ACCEPT tcp ----l- L0099P99.dipool.highway.telekom.at dst any -> ssh which is not really what i want.. :/ Is there any solution? Deleting and re-inserting this rules every minute via crontab is something i would not really like to do.. best regards, E. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re: [suse-security] /lib/ld-2.2.2.so md5sum changed ?
by lars＠newsone.org 09 Sep '01

09 Sep '01

On Sat, Sep 08, 2001 at 04:53:19PM +0000, Fabian Haischmann <fcch(a)gmx.de> wrote: > Hi Lars, > > You have a via 82686 chip, which is buggy, if DMA is enabled. what does this mean exactly? necessary data corruption? > > I think in the Bios DMA is enabled for hda (dmesg output). > When did you make the hdparam output? There is DMA off, but (I think) in > the hdparam -i it's on (UDMA2). well, I wondered about it myself. the hdparm and hdparm -i where about the same second, few minutes after reboot... and I found no message about disabling DMA in the syslogs. suse 7.2 by default enables DMA support, if it thinks it worked (?). I did not fiddle with the settings myself. Not on this box, at least ;) so seemingly the kernel and the drive do not agree about the (en/dis)abled status of DMA? how comes? if hdparm shows me DMA is of, I probably can not disable it further... how can I disable this, then; and am I out of trouble if I could? will disabling DMA in the BIOS help? I thought the linux drivers do not care about bios settings. where can I find a list of known buggy, or even better a positiv list of recommended hardware?

1 0

VPN behind iptables v1.2.2
by Andreas Wahlert 09 Sep '01

09 Sep '01

Hi list, i have a VPN Gateway behind a linux iptables Firewall with v 1.2.2. But the iptables rules are not be able to allow or drop the GRE protocol (number 47). How can i configure the iptables to allow this protocol? If i allow only tcp or udp, the signing up to the Gateway don't work. Thanx for help Andreas Wahlert

1 0

Re: [suse-security] http proxy
by Volker Kuhlmann 08 Sep '01

08 Sep '01

> even something 5 years old. Squid is also good for blocking ads (sites load > much faster). So is SuSEfirewall. nslookup doubleclick.com etc and entered into the output chain with label "dump" works extremely well. I wrote a short script and just add IPs to a file. Volker

4 3