January 2002 - openSUSE Security - openSUSE Mailing Lists

Is it possible to fake /proc/uptime ?
by Max Lindner 21 Jan '02

21 Jan '02

Hi out there! Is it possible to fake the information of /proc/uptime to get 'uptime' say a longer uptime? Thanks for any comment, Max

2 1

RE: [suse-security] is it possible to disable SYN flooding protection for port 80?
by christian.burri＠synecta.ch 21 Jan '02

21 Jan '02

Hi Kai, don't worry about those log messages, it just means that there was a high amount of traffic (SYN's in particular) detected on port 80 and that therefore the server will send out SYN cookies. SYN cookies are a small amount of data that your server includes in its answers to SYN packets, and that the foreign system(s) will have to include in theyr response again (3way Handshake, someone please correct me if I'm wrong here). This was designed to prevent spoofed SYNs from exhausting all resources on your server machine (by leaving tons of half-open connections). I would recommend that you don't turn that off, but thats just my humble opinion. hope this helps Chris Burri .-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^ |--------+-----------------------> | | "Kai-H. | | | Weutzing" | | | <suse(a)exozet.| | | com> | | | | | | 20.01.2002 | | | 15:42 | | | | |--------+-----------------------> >----------------------------------------------------------------------------------------------------------------------------------------| | | | An: <suse-security(a)suse.com> | | Kopie: | | Thema: [suse-security] is it possible to disable SYN flooding protection for port 80? | >----------------------------------------------------------------------------------------------------------------------------------------| Hi, my webserver reports sometimes a Jan 20 14:02:11 xxxxxxxx kernel: possible SYN flooding on port 80. Sending cookies. Jan 20 14:02:11 xxxxxxxx kernel: klogd 1.3-3, ---------- state change ---------- Jan 20 14:02:11 xxxxxxxx kernel: Inspecting /boot/System.map-2.2.18 Jan 20 14:02:11 xxxxxxxx kernel: Loaded 10080 symbols from /boot/System.map-2.2.18. Jan 20 14:02:11 xxxxxxxx kernel: Symbols match kernel version 2.2.18. Jan 20 14:02:11 xxxxxxxx kernel: Loaded 258 symbols from 2 modules. So I think its no attack than a high traffic on my webserver. So what can I do? Is it possible to disable the SYN flood protection for port 80 (I didn't like to it) or can I modify the detection parameters of this protection routine? (I didn't like to read the kernel sources and re-compile it :-) Thx a lot... Kai EOT -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

RE: [suse-security] Production app or web server firewall set-up - questions
by Reckhard, Tobias 21 Jan '02

21 Jan '02

Steven, > In a production environment what is the recommend security > settings with > performance in mind and only services that I will be providing is > http, https, ssh2 - scp, smtp. (i.e. secure , but with as > little overhead) > Kernel 2.4.x and using iptables , postfix, stronghold apache. > > Q.1 What services can hosts.deny & hosts.allow secure? > (mainly in regards to the services that I'm using above) As Kurt already pointed out, those files are checked by tcpd (the TCP Wrappers daemon). SuSE's OpenSSH hast support for it, as well as inetd, but you won't want to use the latter, probably. I don't know if Apache or Postfix do, but a little experimentation ought to tell you. Now the word 'secure' is a little strong, though. The two files *affect* some services, they give some degree of access control. Whether that means securing them depends on your security posture. > Q.2 Should I use stateful connection tracking on all ports or only the > ssh,smtp and https ports? What is the stateful connection > overhead like. Your own call to make. The overhead of statefulness shouldn't be too great and seeing the small number of connection types you want to allow, I'd probably write specific rules. For more detailed info, check http://www.samba.org/netfilter (URL unverified) or the (gasp) source code. > Q3. What ICMP should you block and what must you answer directly or > indirectly, so that you don't break other services or > slow them down. Well, you'd better decide about the utility ICMP types yourself, though I try to be as restrictive as possible. You may want to allow the following inbound: * destination-unreachable * source-quench * time-exceeded * parameter-problem You probably want to drop the following: * redirect * router-advertisement * router-solicitation * timestamp-request * address-mask-request > Q4. What is recommend minimum ports and protocol that I must > log, so that I > can audit attacks , problems and keep logging overhead to > a minimum. > Given that our ISP environment has a lot of broadcast traffic. > e.g. Depends on how much work you're looking for. I often start with full logging, then adapting my rules to filter out the 'usual noise'. > Q5. What DOS of protection options are there with iptables > and how do you > workout the rate to limit @. I have syncookie protection enabled. Well, the most effective DoS countermeasure in iptables ought to be rate limiting. See the HOWTOs. As for rate calculation, you have to do that for your server specifically. > Q6. Is it still recommend to Reject mail server connections > to port 113. > Is the following setting correct: > iptables -A INPUT -i eth1 -p tcp --dport 113 -j REJECT --reject-with > tcp-reset If you talk to mail servers running identd and issuing auth requests, without running the service yourself, yes. Cheers Tobias

1 0

ssh
by Guido Laubender 21 Jan '02

21 Jan '02

Hello everybody! I just have installed SuSEfirewall2 from SuSE 7.3. For logging in from a foreign host I've opened the port 22 for connections via ssh. At the moment I can log in via SSH from all hosts. In which file can I define that login is only allowed from one single host? Thanks for your help, Guido.

2 1

RE: [suse-security] RE: unsuscribe
by GertJan Spoelman 20 Jan '02

20 Jan '02

And what gave you the right to rant me in the first place. And to the rest of the list, sorry to have bothered you, but don't send any further unsolicited mail to me. GertJan > -----Original Message----- > From: John W Higgins [mailto:john@wishdev.com] > Sent: Sunday, January 20, 2002 10:18 PM > To: GertJan Spoelman > Subject: RE: [suse-security] RE: unsuscribe > > > Thank you yet again for ranting at me and wasting bandwidth > > Always a pleasure to deal with foreigners - windmills not working well > today? > > John W Higgins > john(a)wishdev.com > > -----Original Message----- > From: GertJan Spoelman [mailto:rs2000@xs4all.nl] > Sent: Sunday, January 20, 2002 1:04 PM > To: 'John W Higgins' > Subject: RE: [suse-security] RE: unsuscribe > > > I already explained that to 2 others, so I'm not going to > explain it again > to you. > FYI: The list admin didn't mind and mailed me that he already > unsubscribed > him. > > > -----Original Message----- > > From: John W Higgins [mailto:john@wishdev.com] > > Sent: Sunday, January 20, 2002 9:55 PM > > To: GertJan Spoelman > > Subject: RE: [suse-security] RE: unsuscribe > > > > > > I think the bigger question is why you decided that you need > > to rant to the > > entire list. The man living in a glass house should never > > throw stones. > > > > John W Higgins > > john(a)wishdev.com > > > > -----Original Message----- > > From: GertJan Spoelman [mailto:rs2000@xs4all.nl] > > Sent: Sunday, January 20, 2002 9:10 AM > > To: 'Detlev Schmitz'; 'suse-security(a)suse.com' > > Subject: [suse-security] RE: unsuscribe > > > > > > Wake up!!! > > > > Why are you sending me an unsubscribe message??? > > Look at the bottom of the mail how to unsubscribe from the list. > > > > > -----Original Message----- > > > From: Detlev Schmitz [mailto:detlevschmitz@hotmail.com] > > > Sent: Sunday, January 20, 2002 6:04 PM > > > To: rs2000(a)xs4all.nl > > > Subject: unsuscribe > > > > > > < deleted > > > > > > > > > >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > >For additional commands, e-mail: suse-security-help(a)suse.com > > > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > >

1 0

RE: unsuscribe
by GertJan Spoelman 20 Jan '02

20 Jan '02

Wake up!!! Why are you sending me an unsubscribe message??? Look at the bottom of the mail how to unsubscribe from the list. > -----Original Message----- > From: Detlev Schmitz [mailto:detlevschmitz@hotmail.com] > Sent: Sunday, January 20, 2002 6:04 PM > To: rs2000(a)xs4all.nl > Subject: unsuscribe > > < deleted > > > >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

1 0

RE: [suse-security] is it possible to disable SYN flooding protec tion for port 80?
by GertJan Spoelman 20 Jan '02

20 Jan '02

> -----Original Message----- > From: Kai-H. Weutzing [mailto:suse@exozet.com] > Sent: Sunday, January 20, 2002 3:43 PM > > Hi, > > my webserver reports sometimes a > > Jan 20 14:02:11 xxxxxxxx kernel: possible SYN flooding on > port 80. Sending > cookies. > Jan 20 14:02:11 xxxxxxxx kernel: klogd 1.3-3, ---------- state > change ---------- > Jan 20 14:02:11 xxxxxxxx kernel: Inspecting /boot/System.map-2.2.18 > Jan 20 14:02:11 xxxxxxxx kernel: Loaded 10080 symbols from > /boot/System.map-2.2.18. > Jan 20 14:02:11 xxxxxxxx kernel: Symbols match kernel version 2.2.18. > Jan 20 14:02:11 xxxxxxxx kernel: Loaded 258 symbols from 2 modules. > > So I think its no attack than a high traffic on my webserver. > So what can I > do? Is it possible to disable the SYN flood protection for > port 80 (I didn't > like to it) or can I modify the detection parameters of this > protection > routine? (I didn't like to read the kernel sources and > re-compile it :-) It normally gets enabled by your firewall script by: echo 1 > /proc/sys/net/ipv4/tcp_syncookies you can disable it by doing a: echo 0 > /proc/sys/net/ipv4/tcp_syncookies on the commandline or by commenting out or changing it in your firewall script. GertJan

1 0

Further to my Free S/WAN problem...
by Argentium G. Tiger 20 Jan '02

20 Jan '02

I thought I'd take a step back from the problem and describe exactly what it is that I'm trying to accomplish. What we've got is an office of PC's that are running Windows 2000 Professional inside of VMWare on top of SuSE linux 7.3 This is rather amusing, watching W2K run "in jail" and it has no idea. :-) We're developing for a client in W2K, which is why we're running it at all. (Money's gotta come in from somewhere). ;-) The office runs on a private subnet of 192.168.1.0/24. At the front end of this office is a SuSE 7.3 box running SuSEfirewall2 2.1. It's name is: fire01 We have a DSL connection at the front of this office which comes into a router of 1.2.3.73. Our firewall sits at 1.2.3.74 and gateways to 1.2.3.73. (No, those aren't real addresses) ;-) Okay, that describes the office. Now over to the client's site: They have a CISCO Pix Firewall with a bank of addresses. Currently, an address of 5.6.7.220 is bound to an internal address of 10.100.0.26, and only port 22 tcp (SSH) is allowed through. 10.100.0.26 is a SuSE 7.3 box which will be (but is not yet) running SuSEfirewall2 2.1. It only has one NIC card, and I'll explain why here in a bit. It's name is fire03. Another machine on the inside is 10.100.0.17, which is a Windows based development server offering file storage and Microsoft SourceSafe storage of the source code we'd like direct access to from our 192.168.1.0/24 subnet at our office, hidden behind 1.2.3.74/32. So that brings me to the problem at hand: I need a securely encrypted connection between fire01 and fire03. I have this so far using SSH. I have created a user called 'vpn' on both fire01 and fire03, and they have cross-permitted public RSA keys and can ssh back and forth at will (without passwords). Similarly, I've set this up for the root accounts. What I want to accomplish is a secure connection between fire01 at 1.2.3.74 and fire03 at 10.100.0.26, already behind the Pix at 5.6.7.220, such that the machines behind fire01 at 192.168.1.0/24 can see the Microsoft development server at 10.100.0.17 on the client's network. I want to be able to use SuSEfirewall2 on both sides to ensure that ONLY 10.100.0.17 has permissions to talk through fire03, and that only 10.100.0.17 is reachable through our tunnel. (We want to limit the scope of the VPN connection to safeguard our client as much as possible.) I also want to ensure that though 10.100.0.17 is permitted to answer our 192.168.1.0/24 workstations behind fire01, that it is not permitted to see inside our network - the client doesn't have a need to access our internal network, and I must protect _our_ security as well. Lastly, it's got to be seamless. Our 192.168.1.0/24 machines should see the development server at 10.100.0.17 on the client side as if it were a 192.168.1.0/24 machine (let's say 192.168.1.17 for argument's sake, I can leave that IP open) :-) I've tried IPSEC, but haven't been quite able to get it running. I've tried various SSH methods with scripts, but either I'm lacking understanding, or the config isn't right, or... *sigh* Oh: fire01 is up and running with SuSEfirewall2 - taking that protection offline is _not_ an option. The fire03 machine behind the Pix is already being protected by the pix so I've got a bit more freedom to play there. Hopefully someone can help me attack and slay this dragon. I really need a solution that works. Argentium

1 0

is it possible to disable SYN flooding protection for port 80?
by Kai-H. Weutzing 20 Jan '02

20 Jan '02

Hi, my webserver reports sometimes a Jan 20 14:02:11 xxxxxxxx kernel: possible SYN flooding on port 80. Sending cookies. Jan 20 14:02:11 xxxxxxxx kernel: klogd 1.3-3, ---------- state change ---------- Jan 20 14:02:11 xxxxxxxx kernel: Inspecting /boot/System.map-2.2.18 Jan 20 14:02:11 xxxxxxxx kernel: Loaded 10080 symbols from /boot/System.map-2.2.18. Jan 20 14:02:11 xxxxxxxx kernel: Symbols match kernel version 2.2.18. Jan 20 14:02:11 xxxxxxxx kernel: Loaded 258 symbols from 2 modules. So I think its no attack than a high traffic on my webserver. So what can I do? Is it possible to disable the SYN flood protection for port 80 (I didn't like to it) or can I modify the detection parameters of this protection routine? (I didn't like to read the kernel sources and re-compile it :-) Thx a lot... Kai EOT

1 0

Re: [suse-security] firewall2 and portforwarding
by Ralf Moeller 20 Jan '02

20 Jan '02

Hi! Then is this exsample correct? FW_FORWARD_MASQ="0.0.0.0/0,192.168.0.15,tcp,5600" So everybody will get access to the 192.168.0.15 mashine on port 5600 per tcp, right? thx :)) s@mmy

2 1