September 2001 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] http proxy
by r.maurizzi＠gvs.it 07 Sep '01

07 Sep '01

> I want to enable http proxy on my firewall/router which has 24 MB RAM > and very limited HD space. I've a 486dx2 50MHz PC with 24 MB of ram and 400MB HD, and I use it as as both FW and proxy for a small lan. I use wwwoffle as a proxy, since it's rather small, blocks ads, and its cache can be kept to a fixed minimum. However... doing a base SuSE 7.0 installation, plus a couple of other security related rpms, I do have more than 100 MB of free disk space, and proxying is somewhat useful (mainly since using a 64kb/64kb cablemodem is way slower than the very old harddisk ;) Did you try a 'rpm -qa'? Maybe you mistakenly installed a very "fat" rpm. Ciao, Roberto.

1 0

Back Orifice (31337)
by Jesse yep 07 Sep '01

07 Sep '01

Hello, It appears that out of all my ports this is the only one open, I don't really know how to close it. I tried: /sbin/ipchains -I input -p UDP -s 0/0 -d 0/0 (port) -j REJECT Is this completely wrong, or is there another way to close all UDP ports? I'm using SuSE 7.1 2.4.0 __________________________________________________ Do You Yahoo!? Get email alerts & NEW webcam video instant messaging with Yahoo! Messenger http://im.yahoo.com

2 1

Block IP in firewall
by Radu Anghel 07 Sep '01

07 Sep '01

Hi, Got an ip witch is scanning during the night (an internet cafe sez pcnet). How can I block all the ports for this IP? Many thanks, Radu

5 8

AW: [suse-security] ssh and harden_suse
by Wagner, Uwe 07 Sep '01

07 Sep '01

Hi, thanks a lot for your help. After including the line sshd: 192.168.1.0/255.255.255.0 in /etc/hosts.allow everything works fine. uwe -----Ursprüngliche Nachricht----- Von: Guido Tschakert [mailto:gt@src-gmbh.de] Gesendet: Donnerstag, 6. September 2001 11:40 An: Wagner, Uwe; 'suse-security(a)suse.com' Betreff: Re: [suse-security] ssh and harden_suse Am Donnerstag, 6. September 2001 08:28 schrieb Wagner, Uwe: > > Hi, > > I want to use OpenSSH to connect to a server on which the harden_suse > script was installed. > If I try 'ssh servername' the connection was refused by the server. The > message is : ssh_exchange_identification. > If I try to connect with ssh to another server with not installed the > harden_suse script, it works. > > I'm using SuSE 7.1 with the OpenSSH patch. > > Any idea ? > > uwe > > > <<Wagner, Uwe.vcf>> Hello, when "installing" harden_suse the tcp-wrapper konfiguration is also changed. You have to modify your /etc/hosts.allow and /etc/hosts.deny. Example: you want to connect from 192.168.1.0/24, so you have to include the line sshd: 192.168.1.0/255.255.255.0 and don't forget: man is your friend (here man tcpd). also you should have a look at /etc/ssh/sshd_config. HTH Guido ---------------------------------------- Content-Type: application/octet-stream; charset="iso-8859-1"; name="Wagner, Uwe.vcf" Content-Transfer-Encoding: 7bit Content-Description: ---------------------------------------- ---------------------------------------- Content-Type: text/plain; charset="us-ascii"; name="Anhang: 2" Content-Transfer-Encoding: 7bit Content-Description: ---------------------------------------- -- ----------------- Guido Tschakert SRC, SysAd ----------------- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

single user mode
by Gregory M. Begumisa 07 Sep '01

07 Sep '01

Is it possible to boot in single user mode in linux? ---- Greg

5 7

Re: [suse-security] Block IP in firewall
by James Bliss 06 Sep '01

06 Sep '01

Are you using ipchains or iptables? 09/06/01 11:06:59 AM, Radu Anghel <anr(a)aral.ro> wrote: >Hi, > >Got an ip witch is scanning during the night (an internet cafe sez pcnet). >How can I block all the ports for this IP? > > >Many thanks, > >Radu > > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com > >

1 0

Re: ports scaned
by teo＠gecadsoftware.com 06 Sep '01

06 Sep '01

Hi Radu! On Thu, 06 Sep 2001, Radu Anghel wrote: > Hi, > > Got an ip witch is scanning during the night (an internet cafe sez pcnet). > How can I block all the ports for this IP? > iptables -A INPUT -s $IP_HERE -j DROP want something more elaborated than this? -- teodor

1 0

Re: BCC?: [suse-security] firewall2 and SPOOFIN
by Burghard W.V. Britzke 06 Sep '01

06 Sep '01

again: try using "SuSEfirewall2 status | grep DROP-DEFAULT" to figure out which rule does it. use "iptables -Z <chain>" to zero package count for every chain. Once you got the rule you can look which part of SuSEfirewall2 set it. good luck! Anthony Hogbin schrieb: > Alas - machines in DMZ are not getting out at all, despite their ability to > resolve IP's using the firewall..... FW_FORWARD="$DMZ_MACHINE,0/0" does not > seem to be letting it out?! Packets are being dropped with > SuSE-FE-DROP-DEFAULTIN :( > > They can be seen by machines in the 192 LAN which is a bonus - but just not > get out themselves - I am sure I am missing the point somewhere?

1 0

RE: [suse-security] ssh problem
by Reckhard, Tobias 06 Sep '01

06 Sep '01

Hi Yuri [Machine has two A records] > So now the problem arises: I normally only use the easy-to-remember > hostname: it's the one I named the machine with (not even telling it about > the other one) and this is therefore also the one that ssh-keygen uses > when generating the keys. Unfortunately ssh, scp and sftp resolve the > IP-address to the other hostname, and fail to recognize the relevant key > in $HOME/.ssh/authorized_keys2 (regardless of which "direction" I go). I > assume there is an easy way to solve this, but I haven't found it. Can > someone help me out? > Hmm.. I fail to see where the hostname matters in the authorized_keys[2] files, except for the 'from="pattern-list"' parameter, which you don't seem to mean. The hostname does matter when the server's public key is checked against the known_hosts[2] files, so I assume that is where your problem actually lies. And concerning that, the sshd man page section titled "SSH_KNOWN_HOSTS FILE FORMAT" says: Each line in these files contains the following fields: hostnames, bits, exponent, modulus, comment. The fields are separated by spaces. Hostnames is a comma-separated list of patterns ('*' and '?' act as wild- cards); each pattern in turn is matched against the canonical host name (when authenticating a client) or against the user-supplied name (when authenticating a server). A pattern may also be preceded by `!' to indi- cate negation: if the host name matches a negated pattern, it is not ac- cepted (by that line) even if it matched another pattern on the line. Therefore, all you need to do is add the complicated name to the appropriate entry in the known hosts files. I.e. modify an entry of the form: hostname 1024 35 1768399887... to: hostname,complicated_hostname 1024 35 1768399887... Does that help you in any way? Tobias

2 1

Re: BCC?: [suse-security] firewall2 and SPOOFIN
by Burghard W.V. Britzke 06 Sep '01

06 Sep '01

> use "SuSEfirewall2 status | grep ANTI-SPOOF" > to figure out which rule stops your ICMP Packets (the first column shows you the # of packets which match the rule) > In my case it has been that the external net was a subnet of the internal net (eg. int=192.168.0.0/24 and ext=192.168.0/3) > But this does not bother too much. You just don't reach your dsl router directly. if it is configured correctly you can send packages > through your router (and vice versa). if you want to configure your rooter you have to delete 2/4 rules (depends on wether you have turned > loggin on or off) from one of your chains using iptables. after that restart the firewall to regain anti-spoof security. > > Anthony Hogbin schrieb: > > > Hello > > > > I am running repeatedly into a brick wall here over SuSEfirewall2 > > > > Three NIC's - a real IP DMZ, a masqueraded LAN on 192, and a DSL router > > which is my DFG and name server. > > > > I can do most stuff I hoped it would do when I sat down and figured out what > > I needed - like web, mail, imap, ssh, MSN IM blah blah. BUT I CANNOT PING. > > > > No where on the network can ping at all. > > > > Masqueraded clients can resolve but then nothing. > > > > This is what I get in the /var/log/firewall (where 14 is the router - and > > the 192 address is the test client): > > > > Sep 5 15:40:40 prometheus kernel: SuSE-FW-DROP-ANTI-SPOOFIN=eth0 OUT= > > MAC=00:01:02:24:8b:9a:00:20:6f:09:7c:b5:08:00 SRC=217.34.212.14 > > DST=217.34.212.2 LEN=315 TOS=0x00 PREC=0x00 TTL=60 ID=42849 PROTO=UDP SPT=53 > > DPT=1027 LEN=295 > > > > ....this is just one example of many SPOOF issues - but the one that I think > > points the strongest towards my current issues. > > > > With a bit of luck the act of asking for help will bring some > > enlightenment?! > > > > ---- > > > > For your entertainment (take it easy on me!) is the setup > > > > # 2.) > > FW_DEV_EXT="eth0" > > > > # 3.) > > FW_DEV_INT="eth2" > > > > # 4.) > > FW_DEV_DMZ="eth1" > > > > # 5.) > > FW_ROUTE="yes" > > > > # 6.) > > FW_MASQUERADE="yes" > > FW_MASQ_DEV="$FW_DEV_EXT" > > FW_MASQ_NETS="$INT_LAN_RANGE,0/0,tcp,20 $INT_LAN_RANGE,0/0,tcp,21 > > $INT_LAN_RANGE,0/0,tcp,22 $INT_LAN_RANGE,0/0,tcp,23 > > $INT_LAN_RANGE,0/0,tcp,25 $INT_LAN_RANGE,0/0,tcp,37 > > $INT_LAN_RANGE,0/0,udp,37 $INT_LAN_RANGE,0/0,udp,43 > > $INT_LAN_RANGE,0/0,udp,53 $INT_LAN_RANGE,0/0,tcp,53 > > $INT_LAN_RANGE,0/0,tcp,80 $INT_LAN_RANGE,0/0,tcp,110 > > $INT_LAN_RANGE,0/0,tcp,113 $INT_LAN_RANGE,0/0,tcp,123 > > $INT_LAN_RANGE,0/0,udp,123 $INT_LAN_RANGE,0/0,tcp,143 > > $INT_LAN_RANGE,0/0,tcp,443 $INT_LAN_RANGE,0/0,tcp,554 > > $INT_LAN_RANGE,0/0,tcp,993 $INT_LAN_RANGE,0/0,tcp,1863 > > $INT_LAN_RANGE,0/0,tcp,2401 $INT_LAN_RANGE,0/0,tcp,5800 > > $INT_LAN_RANGE,0/0,tcp,5900 $INT_LAN_RANGE,0/0,tcp,6800:6900 > > $INT_LAN_RANGE,0/0,udp,6800:6900 $INT_LAN_RANGE,0/0,tcp,6901 > > $INT_LAN_RANGE,0/0,udp,6901 $INT_LAN_RANGE,0/0,tcp,6970:7170 > > $INT_LAN_RANGE,0/0,tcp,7070" > > > > # 7.) > > FW_PROTECT_FROM_INTERNAL="yes" > > > > # 8.) > > FW_AUTOPROTECT_SERVICES="yes" > > > > # 9.) > > FW_SERVICES_EXT_TCP="" > > FW_SERVICES_EXT_UDP="" # Common: domain > > FW_SERVICES_EXT_IP="" > > FW_SERVICES_DMZ_TCP="53 3128" > > FW_SERVICES_DMZ_UDP="53" > > FW_SERVICES_DMZ_IP="" > > FW_SERVICES_INT_TCP="23 53 3128" > > FW_SERVICES_INT_UDP="53" > > FW_SERVICES_INT_IP="" > > > > # 10.) > > FW_TRUSTED_NETS="$EXT_ZFT_GATE,tcp,22" > > > > # 11.) > > FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" > > FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" > > > > # 12.) > > FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting > > FW_SERVICE_DNS="yes" > > FW_SERVICE_DHCLIENT="no" > > FW_SERVICE_DHCPD="no" > > FW_SERVICE_SQUID="yes" > > FW_SERVICE_SAMBA="no" > > > > # 13.) > > FW_FORWARD="$INT_LAN_RANGE,$DMZ_IP_RANGE 0/0,$DMZ_EXCHANGE,tcp,25 > > 0/0,$DMZ_EXCHANGE,tcp,80 0/0,$DMZ_EXCHANGE,tcp,135 0/0,$DMZ_EXCHANGE,tcp,443 > > 0/0,$DMZ_BACKUP,tcp,21 0/0,$DMZ_BACKUP,tcp,20" > > > > # 14.) > > FW_FORWARD_MASQ="" # Beware to use this! > > > > # 15.) > > FW_REDIRECT="" > > > > # 16.) > > FW_LOG_DROP_CRIT="yes" > > FW_LOG_DROP_ALL="yes" > > FW_LOG_ACCEPT_CRIT="no" > > FW_LOG_ACCEPT_ALL="no" > > FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix > > SuSE-FW" > > > > # 17.) > > FW_KERNEL_SECURITY="yes" > > > > # 18.) > > FW_STOP_KEEP_ROUTING_STATE="yes" > > > > # 19.) > > FW_ALLOW_PING_FW="no" > > FW_ALLOW_PING_DMZ="no" > > FW_ALLOW_PING_EXT="yes" > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com

1 0