January 2002 - openSUSE Security - openSUSE Mailing Lists

Compartment and --cap
by Togan Muftuoglu 23 Jan '02

23 Jan '02

Hi, I am trying to chroot services via Marc's compartment. For instance for chrooting apache I think I understood the need for -cap CAP_NET_BIND_SERVICE since the port binding is below 1024. Hovever I do not want to have root running the services. From reading the README file I should be chowning the directories to something other then root. The README file refers to capability.h file for further reference yet it sounds Greek to me. Again from the README I understand that I can not use --user --group with 2.2.x kernels . I have found a document at ftp://ftp.guardian.no/pub/free/linux/capabilities/capfaq.txt describing the capabilities. Yet is there a plain english bersion that I could not locate or what are the best uses of these for apache and proftp Thanks -- Togan Muftuoglu

2 2

iptables, masquerading & forwarding
by Jens Georg 23 Jan '02

23 Jan '02

hi, i am going to set up my own firewallscript on my suse 7.3 box using iptables in order to get familiar with iptables. i have two nic's setup: eth0 192.168.0.0/24, connected to my private lan with 192.168.0.250 assigned to eth0 eth1 192.168.1.0/24, connected to my dsl-modem with 192.168.1.250 assigned to eth1 at the beginning i would like to achieve the following: 1. blocking all incoming requests to ports 0-1023 with 2. masquerading, so all clients on my network can talk to the net via eth1 first point can be done with iptables -A INPUT -p tcp --dport 1:1023 -j DROP, second with iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 0/0 -j MASQUERADE, right ? what i don't understand is how to "route" packets between eth0 & eth1, so packets from/to the internet are routed via eth1 *WITHOUT* bypassing my firewall. is "echo 1 > /proc/sys/net/ipv4/ip_forward" the right choice ? regards, jens

2 1

SuSEfirewall2 (?) and advanced routing problem.
by Marcin Gryszczuk 23 Jan '02

23 Jan '02

Hi All... 1 - problem 1-st: I have following problem that can not solve under SuSE 7.3 with SuSEfirewall2 - kernel 2.4.16, iptables 1.2.2. Problem is that I have 2 public interfaces (eth1 - default and eth2) with 2 public IP addresses and 1 internal interface (eth0) with 192.168.0.x private class. On that last interface I have small private network which is MASUQREDED on my Linux box. Problem is that I would like to forward part of the traffic (let say all squid proxy requests to my external server) via my 2-nd public interface (eth2). At the moment all traffic goes via default gateway (eth1). I have tried the example I could find in Adv-routing HOWTO - routing all SQUID packets to be forwarded via eth2 : iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 3128 -j MARK --set-mark 1 My rule table looks like: #ip rule ls 0: from all lookup local 32765: from all fwmark 1 lookup ic.out 32766: from all lookup main 32767: from all lookup 253 #ip route ls table ic.out default via y.y.y.97 dev eth2 - but it does not work. What is strange I have had SuSe 6.3 before and under ipchains it worked perfectly! What I have realized is that during testing this connection packets try to goes via eth2 - I could see it on tcpdump - but only packets with S (SYN ?) flag set appears there... And nothing else. What I have also realized is that I could see some (strange for me) lines in firewall log file like: Jan 21 11:24:01 linux kernel: martian source 192.168.0.22 from z.z.z.z, on dev eth2 Jan 21 11:24:01 linux kernel: ll header: 00:00:c0:6a:65:d3:00:c0:df:b0:c2:a8:08:00 192.168.0.22 - is my comp in my private net., z.z.z.z is my proxy server IP address (what in fact I've just realized after the whole day yesterday looking at it). Is there anybody who can help me with that? What should I turn on or off in firewall setting (or maybe somewhere else) to make it run (at the bottom there is more details about my system). As I mentioned before I have had it working perfectly on 6.3 box with ipchains. Anyway - this does not looks like firewall problem as I could not force it to run also with SuSEfirewall2 stopped. 2. problem 2-nd. I thing it is more to SuSEfirewall2 developers. I was just looking at the settings made by SuSEfirewall2 scripts based on my settings and I could realize that there are quite big section for dmz, when I have no DMZ set in SuSEfirewall2 rc.config at all. And also it is mentioned in iptabels -L that there is no references to forward_dmz and input_dmz section at all. So the question is what is it for. I thing it is quite easy to check if there is any DMZ set up or not and do not set all this not needed chains in iptables in "no" case. Just a small tip... Thanx in advance for any help.. Best regards Marcin Gryszczuk Some info about my settings: ifconfig: eth0 Link encap:Ethernet HWaddr ... inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 ... eth1 Link encap:Ethernet HWaddr ... inet addr:x.x.x.x Bcast:x.x.x.191 Mask:255.255.255.192 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 ... eth2 Link encap:Ethernet HWaddr ... inet addr:y.y.y.y Bcast:y.y.y.127 Mask:255.255.255.224 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 ... lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 ... # ip rule ls 0: from all lookup local 32765: from all fwmark 1 lookup ic.out 32766: from all lookup main 32767: from all lookup 253 # ip route ls table ic.out default via y.y.y.97 dev eth2 # ip route ls table main y.y.y.96/27 dev eth2 proto kernel scope link src y.y.y.y x.x.x.128/26 dev eth1 proto kernel scope link src x.x.x.x 192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.100.100 default via x.x.x.129 dev eth1 SuSEfirewall2 settings: FW_DEV_EXT="eth1 eth2" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp domain www ntp https" FW_SERVICES_EXT_UDP="domain ntp" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ftp-data:telnet smtp domain www pop3 ntp 139 https" FW_SERVICES_INT_UDP="domain syslog ntp" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="" # Beware to use this! FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" #FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" SuSE 7.3 kernel 2.4.16 iptables 1.2.2 If anything else is needed to help me - please let me know...

2 4

DNAT problems
by T-Systems.Ertl＠daimlerchrysler.com 23 Jan '02

23 Jan '02

Hi Folks, we are pretty much done with our firewall now, but unfortunately we have a tiny problem. Basically we want to use dNAT. We see that the translation of the IP works out pretty good already. Actually he does everything right, but he still drops the packages. Do we need an additional rule ? Thanks for your help Dirk Ertl T-Systems PCM AG Computing & Desktop Services Business Unit Daimler Chrysler AG / debis Fon: +179/492 63 59 mailto:t-systems.ertl@daimlerchrysler.com mailto:dirk.ertl@t-systems.com

2 1

POSTROUTING SNAT or MASQ
by Nils Wunsch 23 Jan '02

23 Jan '02

Question We wanted official IP for externally however with the internal network over it out is there snat better?? or Masq. Masp is nevertheless better for dynamic IP? status: Chain POSTROUTING (policy ACCEPT 16 packets, 792 bytes) pkts bytes target prot opt in out source destination 0 0 SNAT all -- * eth2 192.168.1.0/24 0.0.0.0/0 to:extip rule: iptables -t nat -A POSTROUTING -o eth2 -s $dmz3 -j SNAT --to-source $extIP eth2 networkkart intern dmz internal network 192.168.1.0/24 eth0 extip /nils

1 0

AW: [suse-security] probs with ftp-masquerading
by Peer Stefan 23 Jan '02

23 Jan '02

ftp-data is port 20, ftp control port is 21. regards, stefan -----Ursprüngliche Nachricht----- Von: Azman Salleh [mailto:azmansal@nti.infomal.com.my] Gesendet: Mittwoch, 23. Jänner 2002 02:38 An: suse-security(a)suse.com Betreff: Re: [suse-security] probs with ftp-masquerading I got similar problem last time. Found out that I had to let through port "ftp-data" as well as "ftp". I think they are ports 21 and 22 respectively. My original firewall config only let thru port "ftp", that's why I could connect to an ftp server, but could not get a dir listing. azman ----- Original Message ----- From: OKDesign oHG Security Administrator <security(a)okdesign.de> To: <suse-security(a)suse.com> Sent: Tuesday, January 22, 2002 3:24 PM Subject: RE: [suse-security] probs with ftp-masquerading > Okay, > > I've now learned a lot of security-wisdom and that the SuSE-firewall 2 is a > damned good tool (something I already knew). > But my problem is still unsolved. For any reasons ftp-masquerading doesn't > work. > I tried what Ralf recommended, but the two iptables-commands didn't have any > result (okay, maybe they had, but they didn't enable ftp-masquerading). > I also looked for the modules ip_conntrack_ftp and ip_nat_ftp as GertJan > told me. I had no luck to find the first one anywhere on my system although > the FW-Packe is installed. The second one is there and I did an insmod, but > this also didn't solve the problem. > Ah yes, Lars pointed me to an error I made. Of course I didn't install my > system from the crab, but from the scratch. Funny to image a crab with > SuSE-Linux tied on the back :-) > To Roman: Of course you are right, but as I already mentioned, I have to > live with DAUs in my LAN, and it's hard enough to have my phone actually > ringing like hell because this damn ftp doesn't work. By now I only answer > "I'm working on it and I'll send a message to all users when it's working > again..."; but to imagine to have to explain all users what FTP-passive-mode > is and how and why it must be used, is as hard as to imagine that my > mother-in-law is going to stay for more than one week (one week is bad > enough, but more will ruin my nerves *sigh*). I really don't know which one > I would prefer if I had only these two choices... > > Anyway, could someone help me in solving my problem ? I'm sure out there on > this list are lots of iptables-freaks knowing nearly all tricks one can do > with it and it should be no big problem for them to find out how to enable > this ftp-masquerading. > > Thanks in advance > > Stephan > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

2 1

SuSEfirewall2 & mysql
by efbiei＠gmx.de 22 Jan '02

22 Jan '02

Obwohl ich den Port 3306 nicht als EXTERNAL TCP definiert habe, ist dieser Port vom mysqld offen laut nmap. Und das seit der mysqld läuft. Wie kann das sein ? FW_SERVICES_EXT_TCP="ssh smtp www pop3 https domain"

2 1

RE: [suse-security] SuSEfirewall2 & mysql
by Boris Kimel 22 Jan '02

22 Jan '02

> And what about high ports access in your config? > > (on the run) > > Boris Kimel. > > > ----- Original Message ----- > From: "Karsten Schell" <efbiei(a)gmx.de> > To: <suse-security(a)suse.com> > Sent: Tuesday, January 22, 2002 4:19 PM > Subject: [suse-security] SuSEfirewall2 & mysql > > > > and now in English, sorry! > > > > Since I am running mysqld on my server the port 3306 is open though its > not > > inlcuded in EXTERNAL_TCP services > > > > services I allow: > > FW_SERVICES_EXT_TCP="ssh smtp www pop3 https domain" > > > > any clue why this port is open ? > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com >

1 0

SuSEpersonal-firewall - Reason for not using a default policy for INPUT
by Robert Davies 22 Jan '02

22 Jan '02

Just curious the reasons for not using default 'policy', but preferring 'back stop' rules in SuSEpersonal-firewall. Can anyone explain the reasons? Initial impression, would be that setting a policy of DENY on INPUT would be more secure. The usage is commented on, but not explained which makes me curious! Rob

2 2

a simple question
by Omppu 22 Jan '02

22 Jan '02

now with the basic installation of susefirewall2 no server from the dmz can access the world. what parameter can should i add and where to if i want the servers on the dmz to access for example ports 22, 25, 80, 5800 hoping for a reply this time, regards O.

2 1