January 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Is bind 9.1.0 secure?
by Reckhard, Tobias 21 Jan '02

21 Jan '02

Re Steffen > > > We had a discussion about djbdns on a local maillinglist in > > > Berlin. It's not offering all features that bind offers. > > > > While this may well be true, many people probably don't need certain > > features at all. And there are workarounds or patches for > quite a few of the > > 'problems' that a certain number of people have with the > pure djbdns. > > I know from qmail, that most of the patches are "inofficial" and > not security-checked sometimes, so a patched djbdns may not > secure at all, who knows. True, this could very well be. Which is why I'd try to come by without patching djbdns if I can. However, the djbdns is very compact, as are the patches, so auditing either or both is much more acceptable than is the case for BIND (shudder..). > > Perhaps you could point out which specific features you miss? > > Well, I have some hundert zones on currently a few primary and a > few secondaries, but not any zone is on any secondary. > Secondaries keep track what to transfer when, and this is > controlled by serial number which is not bad. I don't now how > much work it is to set up a secondary for djbdns, i.e. adding new > zones. With bind, it's only a thing of adding them to > configuration, they get the new zone automatically. Well, and the > logging is nice, I see it when something fails, without watching > if zone files are up to date or not, it's in the logs when a zone > transfer failed. This are details but for me they are important. DJB suggests to modify the Makefile used to create the database to rsync&ssh automatically and provides instructions on the Makefile entries to make. There was a discussion on the (DJB)DNS mailing list recently on how to keep separate zones in separate data files - you can do that with scripts or by modifying the Makefile. Actually, with djbdns most things are *different* from BIND, they're not necessarily more work. In fact, djbdns makes a lot of things easier, such as resource record generation, and less error-prone, e.g. by automatic generation of reverse records and automatic handling of serial numbers (if you let it). > > Zone transfers are supported in the current version (djbdns > 1.05), but you > > need the separate ucspi-tcp package to provide TCP client > and server. > > I think that ucspi-tcp is a nice package, but I think it's a > little more efford setting it up than having "native" TCP > support. On the other hand, you have a stable, tested TCP > implementation. It follows the UNIX concept of having lots of small, dedicated and specialised utility programs instead of monster applications. > > DJB argues against zone transfers and urges people to use rsync > > (preferrably over SSH) instead, for several reasons outlined on > > his web page. > > I read it a long time ago IIRC. Rsync+ssh is more secure and so > on, but it's more efford to set up and to watch if it fails I > think. I guess that depends on your abilities to postprocess it. You have more options to intervene into the process. > > transfers just fine. tinydns does not pull zones per zone > > transfer automatically, so you need to use cron jobs to pull > > from the clients on a regular basis to emulate AXFR behaviour. > > Well, with bind I don't need to do anything, it works out of the > box. This is comfortable and cheap. True. I wouldn't mind djbdns to support AXFR myself, but it probably won't, since Dan doesn't like it. > > IMHO, that depends on what you favour: a relatively bloated piece of > > software with a pretty poor security track that most > organisations and > > documents expect, > > This is really a pitty, and I don't like to quality of bind, > really. But on the other hand, I don't have time to do so much > details by hand for so much servers and zones. Actually, after initial setup, the amount of work involved in managing DNS zones with djbdns can very well be less than with BIND. > > than the former and may require some scripting around them > to achieve the > > same features, however usually implemented with higher quality. > > I feel that scripting solutions often seem not as stable as "real > servers", often it's not trivial to do the right error checking > and so on. On rsync cron jobs, I had to take care that error > messages get into syslog, and if I forget somethink, I may not > notice some errors and such. Well, the coders of the 'real servers' needed to get their error-checking stuff right, too, which is just as non-trivial. And I don't know how much faith I'd put into the quality of the BIND code in particular with regards to this respect... Yes, you need to know your tools. But IMHO, that's a prerequisite anyhow and goes without saying. I wager that only a small fraction of the people employing BIND know how to configure it properly, lest the zone data... > > configured to support FreeS/WAN's opportunistic encryption by > > handing out KEY records, and the FreeS/WAN docs speak of > > SecDNS... > > KEY records without SecDNS (signed records and zones) makes not > much sense. I think djbdns can work with KEY records but they are > unsigned, so you cannot use them, since you cannot trust them. As I said below, I don't know enough about SecDNS to be able to say a lot here. It's on my list of interests, though. :) > Ohh, and one thing I forgot: does djbdns support dynamic zone > update? Well, usually I don't like it, and I have the dynamic > names in own zones, but I won't live without it. Well, it's not > really secure (and I use it with a bad script via SSH :(), but > needed for dynamic IP accounts. Yuck! I honestly do not know, but don't think so. It doesn't support NOTIFY, so it probably won't support client-triggered zone updates. I currently see no use in dynamic DNS, I think it's A Bad Thing (TM). It was the first option I disabled on the ISC DHCP server I use. BTW, does anyone know a DHCP server from someone else, with the focus on security, perhaps? Cheers Tobias

2 1

Re: [Users] Building a VPN with FreeS/WAN, SuSEfirewall2 and SSH Sentinel
by Argentium G. Tiger 21 Jan '02

21 Jan '02

>Very nice document! If you permit us, we could add that URL in our support >pages under http://www.ipsec.com I'm working through Nadeem's document now and may have found a slight glitch in the patching of the _updown_custom script, so you might want to hang on just a couple of days... But I will agree: Overall, this document of Nadeem's is wonderfully written and looks like it will address a lot of the problems that I've had in getting SuSE 7.3, SuSEfirewall2, and IPSEC to work hand in hand. Nadeem: Perhaps just include the entire _updown_custom script rather than including a patch to a document located elsewhere in the world? Thanks again for all the work, you've brought me closer to my goal! :-) Argentium

2 1

SuSE 7.3 Firewall2 masquerading
by Boris Kimel 21 Jan '02

21 Jan '02

Hello everybody, Here's a somewhat newbiesh question, but I've seen this topic discussed here. So, I've just moved from RedHat 7.0 to SuSE 7.3 (after an HD failure). This Linux box is used as a company firewall/masquerader, dns, www and mailserver. Under RedHat we've used ipchains with it's simplest setup just to masquerade the internal net on a per machine basis. And, issuing "ipchains -L" I used to get some 10 lines concerning exactly what I configured. With SuSE we tried to set up SuSEfirewall2, and we did it carefully. The problem is that the machines from the internal net cannot access www or mail server through its external interface - and the corresponding DENY is logged clearly. We did not set the firewall protection from the internal net, and it is accessible internally, but the traditional www.ourdomain.ru (or mail.ourdomain.ru) points to the external device, which worked fine with ipchains under RedHat. Now we're using ipchains under SuSE too, but this is surely wrong (just to mention the inability ro use ftp from inside). Should we try to reconfigure SuSEfirewall2? Listing of iptables' rules is so much complicated that I don't think I should read it. Or just throw away the firewall, issue some iptables' rules thru a script and forget it? Thanks in advance, Boris G. Kimel.

2 1

Re: [suse-security] Am I about to give up on SuSE Firewall script??
by Maarten J H van den Berg 21 Jan '02

21 Jan '02

On Monday 21 January 2002 13:39, Omppu wrote: > hello, the cisco works fine ive configured it according, > (as adding the routing definitions) Hmm. So send me (or list, preferably) the 'route -n' output from the SuSE firewall and the equivalent output of the Cisco, so we can see where the problem lies. Or better, if you'd had taken the effort of including such essential information the first time around you would probably have had more reactions... We can't help you if you won't let us :-) Also, please be more elaborate; state which connections DO work, and which don't. So we may get a better picture of the issue. > regards > O. > ----- Original Message ----- > From: "Maarten J H van den Berg" <maarten(a)vbvb.nl> > To: "Omppu" <Omppu(a)aktivist.net>; <suse-linux-e(a)suse.com>; > <suse-security(a)suse.com> > Sent: Monday, January 21, 2002 2:04 PM > Subject: Re: [suse-security] Am I about to give up on SuSE Firewall > script?? > > > On Wednesday 16 January 2002 17:47, Omppu wrote: > > > Hello, > > > > > > after resolving this and that problem i yet still have problems > > > with configuring > > > the firewall script > > > > I think your problem may be that you perhaps did not tell your cisco > > about the intricate routing table. You have to make sure that the > > cisco knows how to reach all the subnets. That means the cisco must > > know that 195.165.91.128/128 can only be reached thru a gateway; your > > suse box. Failing that you will not get any packets through. Did you > > think of this ? -- Maarten J. H. van den Berg ~~//~~ network administrator van Boetzelaer van Bemmel - Amsterdam - The Netherlands http://vbvb.nl T+31204233288 F+31204233286 G+31651994273

1 0

Building a VPN with FreeS/WAN, SuSEfirewall2 and SSH Sentinel
by Nadeem Hasan 21 Jan '02

21 Jan '02

Hi all, I have written an article/document explaining the process of building a VPN with FreeS/WAN, SuSEfirewall2 and SSH Sentinel using X.509 certificates. http://www.nadmm.com/show.php?story=articles/vpn.inc Comments and suggestions are welcome. Goodnight :) cheers, -- Nadeem Hasan nhasan(a)nadmm.com http://www.nadmm.com/ ___________________________________________________________ This mail sent through WebMail at http://webmail.nadmm.com

2 1

RE: [suse-security] Is bind 9.1.0 secure?
by Reckhard, Tobias 21 Jan '02

21 Jan '02

> This is a lot like Sendmail, older versions sucked, so they did a > rewrite/audit and secured it reasonably well. Things change. > > http://www.isc.org/products/BIND/bind-security.html > > So far (knock on wood) Bind 9.x hasn't had any serious security bugs. Have you read DJB's comments? Cheers Tobias

4 4

Am I about to give up on SuSE Firewall script??
by Omppu 21 Jan '02

21 Jan '02

Hello, after resolving this and that problem i yet still have problems with configuring the firewall script this is my scenario and what i have tried, i have the following setup Internet | S0 -------------- | internet | | cisco router | -------------- | F0 195.165.91.1 mask 255.255.255.240 | | | ---------- ---------- | HUB |----------------| server | 195.165.91.3 ---------- ---------- | mask255.255.255.240 | | | 195.165.91.2 netmask 255.255.255.240 GW 195.165.91.1 -------------- | SuSE 7.3 | | |----------------| 195.165.91.129 | | netmask 255.255.255.192 -------------- | 195.165.91.193 netmask 255.255.255.192 | and the following /etc/rc.config.d/firewall2.rc.config configuration FW_DEV_EXT="eth0" FW_DEV_INT="eth2" FW_DEV_DMZ="eth1" FW_ROUTE="yes" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="22" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="193.64.53.192/26" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="0/0,195.165.91.140,tcp,12345 0/0,195.165.91.140,tcp,1234 0/0,195.165.91.140,tcp,1433 0/0,195.165.91.140,tcp,5800 0/0,195.165.91.140,tcp,5801 0/0,195.165.91.140,tcp,5900 0/0,195.165.91.140,tcp,5901" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" (is it really so that FW_FORWARD="" all the input has to be in one line so that it works?, when i tried to add the input as a new line it just did not read my settings!) and this is what im trying to achienve Internet -> Firewall allow (SSH) internet -> internal network deny Internet -> DMZ allow 195.165.91.140 ports 1234, 12345, 5800, 5801, 5900,5901 DMZ -> Firewall allow (SSH) DMZ -> Internal network deny DMZ -> Internet allow (all internet port 1999) Internal network -> Firewall allow (SSH) Internal network -> Internet allow (all internet ports 80, 22, 443, 8080 and 195.165.91.3 all ports) Internal network -> DMZ allow (195.165.91.140 all ports, 195.165.140 port 21, 22, 80) what do i have to do to get this to work, ive lost time and im late on project delivery, if i will not be able to figure this out im going to have to ignore the SuSE firewall scripts and just use plain IPTABLES which wouldnt be nice, all help would be greatly appreciated, regards O.

2 1

ApacheReverse proxy for DMZ web server
by Togan Muftuoglu 21 Jan '02

21 Jan '02

Hi, I am trying to get a webserver in a screened subnet and I am stuck in deciding which one is the better solution. A) forwarding via ipmasqadm B) using Proxypass feature of Apache My brain says it is better to have proxy controling for anything possible rather than simply forwarding yet are there any problems with it that I have not seen Any pointers and suggestions are much appreciated Thanks -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx

2 1

Re: [suse-security] SuSEFirewall2, FreeS/WAN and VPN
by Argentium G. Tiger 21 Jan '02

21 Jan '02

Nadeem Hasan <nhasan(a)nadmm.com> writes (back in December 2001): >I am interested to know if anyone here has tried to build a VPN >setup using SuSEFirewall2 and FreeS/WAN in tunnel mode (host to >subnet). I have been looking to do this but have not been able >to find any info about SuSEFirewall2 config changes for this. I'm in the middle of this with SuSE 7.3 which we installed on two machines, both of which are to run the very latest SuSEfirewall2 from Mark Heuse's page at http://www.suse.de/~marc I'm using SuSE's 2.4.10 kernel (stock, no changes, pentium optimized). I'm using freeswan from the same 7.3 install (which is an rsync Mirror of the 7.3 FTP directory at gatech). Without the firewall enabled, it looks as if freeswan (ipsec) starts correctly. WITH the firewall enabled, here's what we get as an error message: ipsec_setup: Starting FreeS/WAN IPsec 1.91...WARNING: ipsec0 has route filtering turned on, KLIPS may not work ipsec_setup: (/proc/sys/net/ipv4/conf/ipsec0/rp_filter = '1', should be 0) ipsec_setup: WARNING: eth0 has route filtering turned on, KLIPS may not work ipsec_setup: (/proc/sys/net/ipv4/conf/eth0/rp_filter = '1', should be 0) ipsec_setup: This is, frankly, maddening. I need to get this VPN working between two office sites. The first is our office and I'm intending FreeS/WAN to run on the firewall in conjunction with SuSEfirewall2. This machine masquerades to our internal network of 192.168.1.0/24 on the internal leg on eth1. This works fine. The other end is inside of a client's internal network. Through a CISCO PIX firewall, they've locked an external real-ip to the machine's internal IP of 10.100.0.26, and opened up port 22 TCP for me to ssh into the machine from the outside world. This works wonderfully. There is only one ethernet card in here. The goal is to be able to use the machine at the client site to talk to a Microsoft sourcesafe server at an internal address of 10.100.0.17, such that all of us back at our office can directly hit the sourcesafe server at the client's site and develop from there. If I had much hair left, I'd be pulling it out. :-( Configs (with secret keys masked obviously) and configs are available upon request. Has *ANYONE* gotten FreeS/WAN 1.91 to work with SuSE 7.3, Kernel 2.4.10.SuSE and SuSEFirewall2-2.1 ? With much hope that someone has, Argentium >Thanks. > >cheers, >-- >Nadeem Hasan >nhasan(a)nadmm.com >http://www.nadmm.com/ > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com

5 5

DNS on DMZ
by Omppu 21 Jan '02

21 Jan '02

how do i enable the SuSEFirewall2 script to allow certain ports to the world from the DMZ i need this for smtp, and DNS regards O.

2 1