January 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [SLE] Kernel RPMs in the ftp sites.
by Nadeem Hasan 23 Jan '02

23 Jan '02

Anders Johansson wrote: > > On Saturday 19 January 2002 18.19, Nadeem Hasan wrote: > > You are assuming that > > everyone uses and needs initrd. That is not true. > > and you are assuming everyone uses and needs lilo. That is not true. > > look at grub, for instance My bad in assuming that :) You are right, it would be a *really* bad idea if lilo was executed automatically. But I am still unable to buy the initrd idea from ckm. He keeps talking about people needing initrd, while I was only talking about people who don't. Those are the people who don't use reiserfs for root fs, scsi disks or RAID and hence don't need to build initrd. I was one of those till lately, before I moved to ext3 on LVM :) Cheers, -- Nadeem Hasan nhasan(a)nadmm.com http://www.nadmm.com/

3 2

Apache 1.3.22
by Peter Nixon 23 Jan '02

23 Jan '02

Hi Guys Just wondering if there is going to be an Apache update released by SuSE in the near future? I have compiled my own 1.3.22 rpms (minus SuSE patches) and they work fine on my notebook, but I would prefer to use the SuSE ones on my servers if there are going to be some.. http://www.apache.org/dist/httpd/Announcement.html "This version of Apache is principally a security fix release which closes some problems where a directory listing could be obtained instead of the default index page." Just wondering.. -- Viel Spaß Peter Nixon - nix(a)susesecurity.com SuSE Security FAQ Maintainer http://www.susesecurity.com/faq/ "If you think cryptography will solve the problem, then you don't understand cryptography and you don't understand your problem."

1 0

DNAT problems
by T-Systems.Ertl＠daimlerchrysler.com 23 Jan '02

23 Jan '02

Helo Martin, helo folks, TXL for your help. I got my problem fixt. It was an networkproblem. Crasy :-( Now it works fine. best regards Dirk Ertl T-Systems PCM AG Computing & Desktop Services Business Unit Daimler Chrysler AG / debis Fon: +179/492 63 59 mailto:t-systems.ertl@daimlerchrysler.com mailto:dirk.ertl@t-systems.com

1 0

Restricting rsync to ssh only
by Togan Muftuoglu 23 Jan '02

23 Jan '02

Hi, Sorry if the question has been asked before and already replied then just point me rather sending flames as it has already been an extremely bad day. This is what I want to do I am placing a webserver on DMZ (192.168.2.2) apache is running chrooted via compartment the webpages are located at $CHROOT/webhome the directory and files are owned by wwwrun.nogroup I want to be able to run rsync to update the web pages however I only want to open the minimum number of ports in the firewall. The question is how can I force rsync to except communication from ssh only rather than from rsync port. Thanks -- Togan Muftuoglu

3 4

Antwort: Re: Antwort: Re: [suse-security] DNAT problems
by T-Systems.Ertl＠daimlerchrysler.com 23 Jan '02

23 Jan '02

Helo Martin, helo folks, well that´s problably the fault. I use to try it with a FORWARD rule, but it don´t work. May I do a syntactic fault, but I think it has to be like : $IPTABLES -A FORWARD -i $IF_INT -o $IF_EXT -p tcp -s potsdamerplatz -d IPINTERN --dport FF -j ACCEPT I also try to switch from <<-j MASQUERADE rule>> to <<-j SNAT --to-source MYIP>> I have read: MASQUERADING ins pretty good 4 dynamic IP, I still use static. But it is the same one. :-( Any idea ?? TIA best regards Dirk Ertl T-Systems PCM AG Computing & Desktop Services Business Unit Daimler Chrysler AG / debis Fon: +179/492 63 59 mailto:t-systems.ertl@daimlerchrysler.com mailto:dirk.ertl@t-systems.com Martin.Peikert(a)discon.de 23.01.2002 13:13 Bitte antworten an Martin.Peikert An: T-Systems Ertl/Extern/040/DCAG/DCX@wk-EMEA2 Kopie: suse-security(a)suse.com Thema: Re: Antwort: Re: [suse-security] DNAT problems T-Systems.Ertl(a)daimlerchrysler.com schrieb: > > Helo Martin, helo folks, > > thanks for your responce. > > I can show U the rule: > > $IPTABLES -A PREROUTING -t nat -p tcp --dport FF -j DNAT --to-destination > IPINTERN Ok, that's prerouting. Is there a forwarding rule that accepts that traffic? Martin -- martin.peikert(a)discon.de Discon GmbH Internet Solutions Wrangelstrasse 100 http://www.discon.de/ 10997 Berlin, Germany

3 3

Antwort: Re: [suse-security] ] DNAT problems
by T-Systems.Ertl＠daimlerchrysler.com 23 Jan '02

23 Jan '02

Helo Michael, helo folks, Sorry Michael, but I thought the other folks, looks Martin know what I meen. I'am sure that U understand, that I don´t post thinks like our IP or dport plaintext. best regards Dirk Ertl T-Systems PCM AG Computing & Desktop Services Business Unit Daimler Chrysler AG / debis Fon: +179/492 63 59 mailto:t-systems.ertl@daimlerchrysler.com mailto:dirk.ertl@t-systems.com appeldorn(a)codixx.de 23.01.2002 14:57 Bitte antworten an Appeldorn An: Martin.Peikert(a)discon.de Kopie: suse-security(a)suse.com Thema: Re: [suse-security] ] DNAT problems >T-Systems.Ertl(a)daimlerchrysler.com schrieb: > >> May I do a syntactic fault, but I think it has to be like : >> >> $IPTABLES -A FORWARD -i $IF_INT -o $IF_EXT -p tcp -s potsdamerplatz >> -d IPINTERN --dport FF -j ACCEPT > >Isn't $IF_INT the interface for incoming and $IF_EXT the interface for >outgoing traffic? If it is, you might try >$IPTABLES -A FORWARD -i $IF_EXT -o $IF_INT -p tcp -s potsdamerplatz \ > -d IPINTERN --dport FF -j ACCEPT I think U did -> -d $IPINTERN instead of -d IPINTERN and what you will do with --dport FF is FF a variable too ?? (user $FF) Michael Appeldorn -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] probs with ftp-masquerading
by OKDesign oHG Security Administrator 23 Jan '02

23 Jan '02

Okay, I've now learned a lot of security-wisdom and that the SuSE-firewall 2 is a damned good tool (something I already knew). But my problem is still unsolved. For any reasons ftp-masquerading doesn't work. I tried what Ralf recommended, but the two iptables-commands didn't have any result (okay, maybe they had, but they didn't enable ftp-masquerading). I also looked for the modules ip_conntrack_ftp and ip_nat_ftp as GertJan told me. I had no luck to find the first one anywhere on my system although the FW-Packe is installed. The second one is there and I did an insmod, but this also didn't solve the problem. Ah yes, Lars pointed me to an error I made. Of course I didn't install my system from the crab, but from the scratch. Funny to image a crab with SuSE-Linux tied on the back :-) To Roman: Of course you are right, but as I already mentioned, I have to live with DAUs in my LAN, and it's hard enough to have my phone actually ringing like hell because this damn ftp doesn't work. By now I only answer "I'm working on it and I'll send a message to all users when it's working again..."; but to imagine to have to explain all users what FTP-passive-mode is and how and why it must be used, is as hard as to imagine that my mother-in-law is going to stay for more than one week (one week is bad enough, but more will ruin my nerves *sigh*). I really don't know which one I would prefer if I had only these two choices... Anyway, could someone help me in solving my problem ? I'm sure out there on this list are lots of iptables-freaks knowing nearly all tricks one can do with it and it should be no big problem for them to find out how to enable this ftp-masquerading. Thanks in advance Stephan

3 3

Re: Antwort: Re: [suse-security] DNAT problems
by Martin Peikert 23 Jan '02

23 Jan '02

T-Systems.Ertl(a)daimlerchrysler.com schrieb: > > Helo Martin, helo folks, > > thanks for your responce. > > I can show U the rule: > > $IPTABLES -A PREROUTING -t nat -p tcp --dport FF -j DNAT --to-destination > IPINTERN Ok, that's prerouting. Is there a forwarding rule that accepts that traffic? Martin -- martin.peikert(a)discon.de Discon GmbH Internet Solutions Wrangelstrasse 100 http://www.discon.de/ 10997 Berlin, Germany

1 0

Antwort: Re: [suse-security] DNAT problems
by T-Systems.Ertl＠daimlerchrysler.com 23 Jan '02

23 Jan '02

Helo Martin, helo folks, thanks for your responce. I can show U the rule: $IPTABLES -A PREROUTING -t nat -p tcp --dport FF -j DNAT --to-destination IPINTERN and a pullout of /var/log/kernel.log: Jan 21 17:41:06 FW15 kernel: DROP-TCP IN=tr0 OUT=eth0 SRC=IPEXTERN DST=IPINTERN LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=6234 DF PROTO=TCP SPT=1079 DPT=FF WINDOW=8760 RES=0x00 SYN URGP=0 but, sorry no iptales -L. On this print U can see, that the DNAT is working pretty ( see on DST = is the DNAT IP ) , but packets are dropt. WHY ?? :-( TIA best regards Dirk Ertl T-Systems PCM AG Computing & Desktop Services Business Unit Daimler Chrysler AG / debis Fon: +179/492 63 59 mailto:t-systems.ertl@daimlerchrysler.com mailto:dirk.ertl@t-systems.com Martin.Peikert(a)discon.de 23.01.2002 11:17 Bitte antworten an Martin.Peikert An: suse-security(a)suse.com Kopie: Thema: Re: [suse-security] DNAT problems T-Systems.Ertl(a)daimlerchrysler.com schrieb: > > Hi Folks, > > we are pretty much done with our firewall now, but unfortunately we have a tiny > problem. Basically we want to use dNAT. We see that the translation of the IP > works out pretty good already. > Actually he does everything right, but he still drops the packages. > > Do we need an additional rule ? Could you be a little bit more detailed? What rules do you already have? It would help to send a 'iptables -n -L'... Martin -- martin.peikert(a)discon.de Discon GmbH Internet Solutions Wrangelstrasse 100 http://www.discon.de/ 10997 Berlin, Germany -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

SuSEfirewall2 DMZ question.
by Marcin Gryszczuk 23 Jan '02

23 Jan '02

Hi All. I thing it is more to SuSEfirewall2 developers. I was just looking at the settings made by SuSEfirewall2 scripts based on my settings in rc.config and I could realize that there are quite big section for dmz, when I have no DMZ set in SuSEfirewall2 rc.config at all. Also looking in iptables LIST it is mentioned, that there is no references to forward_dmz and input_dmz chain at all. So the question is what are that chains for. I thing it is quite easy to check if there is any DMZ set up or not and do not set all that not needed chains by SuSEfirewall2 in "no" case. Just a small tip... Best regards Marcin Gryszczuk

1 0