January 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] firewall2 and portforwarding
by Ralf Moeller 20 Jan '02

20 Jan '02

Hi! THX for the tip! But Masqurading for exsample is working fine. but this port forwarding is my problem. the comments are hard to understand for germans like me ;) Thx again! s@mmy

1 0

What is the meaning of FW_TRUSTED_NETS?
by Paul Elliott 20 Jan '02

20 Jan '02

What is the meaning of FW_TRUSTED_NETS? Are the hosts/servers/ports listed hear automaticly allowed access? Or perhaps they are only considered internal? Thank You. -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

2 1

Two questions about services on the local host and SuSEfirewall2?
by Paul Elliott 20 Jan '02

20 Jan '02

Q1) Does it make sense or is it usefull to talk about the loopback interface as a trusted interface? FW_DEV_INT="lo" Or is this in some sense builtin? Q2) Is there any reason while the "root" account can not start a local xterm, but other users can? Password: hrnowl:/home/pelliott # xterm Xlib: connection to ":0.0" refused by server Xlib: Invalid MIT-MAGIC-COOKIE-1 key Warning: This program is an suid-root program or is being run by the root user. The full text of the error or warning message cannot be safely formatted in this environment. You may get a more descriptive message by running the program as a non-root user or by removing the suid bit on the executable. xterm Xt error: Can't open display: %s hrnowl:/home/pelliott # echo $DISPLAY :0 hrnowl:/home/pelliott # How do I do I change this? Only for the localhost, A similar problem is preventing me from doing a "make xconfig" Thank You. P.S. I would be using the personal firewall rather than SuSEfirewall2 except I have to cut a hole for my connection to my ntp server for chrony. -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

2 1

firewall2 and portforwarding
by Ralf Moeller 19 Jan '02

19 Jan '02

Hi everybody! I´m using suse 7.3 and firewall2. Maybe anyone could tell me how to get some ports forwarded to a client? Please tell me how this works with the firewall2 and not with this iptables commands. dont know them a bit... THX in advance!!! s@mmy

1 0

Is bind 9.1.0 secure?
by Praise 19 Jan '02

19 Jan '02

Hi all, I am planning to set up this name server in the near future, so I have looked at ISC web site to see if there were some new bugs I did know of. I have noticed that they raccomend version 9.2.0, but I do not see why, as the vulnerabilities listed are all for version < 8.2.5 Will I be safe with Suse's package of bind (9.1.0) in Suse 7.1? Praise

3 2

FW: [suse-security] optimal kernel config for firewall gateway ?
by Thomas Schmidt 19 Jan '02

19 Jan '02

-----Original Message----- From: Thomas Schmidt Sent: Monday, January 14, 2002 11:16 AM To: 'Torsten Mueller' Subject: RE: [suse-security] optimal kernel config for firewall gateway ? It´s true, that you can use a 486 for Firewall, but a prefer to a P-II or AMD K6-2 as minium requieremnt for 1 Mbit. The problem ist not the traffic, but the syslog. We have serveral costumers, who are connected with 2 mbit. If someone portscan your system or tries an dos-attack, increased your system load dramaticly and the traffic stops :( > -----Original Message----- > From: Torsten Mueller [mailto:torsten@archesoft.de] > Sent: Friday, January 11, 2002 10:40 AM > To: Bernhard Held > Cc: SuSE-Security List > Subject: Re: [suse-security] optimal kernel config for > firewall gateway > ? > > > Hey, > > Bernhard Held schrieb: > > > > >Well, if you compile a kernel with ip-forwarding turned on > but filtering > > >disabled, one would expect that the router is faster > because the code is > > >just missing in the kernel. On a reasonably fast machine > I'd say that > > >these effects should be neglectable. > > But what do think is a reasonable machine? What will I need > for a simple > > firewall with Internet (1 MBit), DMZ (Mailserver) and a > local network in > > terms of MHz and MByte? > > for me works a 486-with i think 33 MHZ and 12 MB RAM. > It connects my wireless lan to the internet (adsl - german > telekom) > > Greetings Torsten > > > > > Thanks, > > Bernhard > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > >

5 4

not security related
by Marios Marti 19 Jan '02

19 Jan '02

I m trying to compile the kernel and have the following error: $make menuconfig $make:**** No rule to make target 'config' . Stop anyone knows how to solve this or a website that would help? Thanks Marios

4 3

Re: [suse-security] vnc masqueraded
by Andreas Schamanek 19 Jan '02

19 Jan '02

On Thu, 17 Jan 2002, Jens Woch wrote: > But sniffing could happen even if I replace 0/0 with something > (much) more specific, couldn't it? The ssh-suggestion by Markus > Gaugusch would prevent it, I guess (have to play with it yet). Jens, in your situation I recommend using SSH port forwarding. Log in to the firewall and port forward your connection. Depending on your setup you have 2 possibilities: a) port forward a port on your firewall to the desired machine b) port forward your localhost through the firewall ad a) you will need _ssh -g -L...._ see _man ssh_ and man sshd especially section AUTHORIZED_KEYS FILE FORMAT on how to restrict the -g (global access) ad b) the better solution: login from the remote machine and forward a port from the remote machine (which is localhost for you) through the firewall to the desired VNC server. i.e. ssh -L12344:vnc_server:5900 firewall (this is for Unix/Linux but other clients are not much different.) then connect your viewer to _localhost:12345_ hope that helps, -- Andreas

1 0

Allow ICQ under SuSEfirewall2?
by Paul Elliott 19 Jan '02

19 Jan '02

I have a single system protected by SuSEfirewall2. I do not use personal firewall because I want to allow chrony to set the time, and for this I need access to offsite NTP servers. How do I allow use of ICQ? Thank you. -- Paul Elliott 1(512)837-1096 pelliott(a)io.com PMB 181, 11900 Metric Blvd Suite J http://www.io.com/~pelliott/pme/ Austin TX 78758-3117

11 10

Re: postfix suse 7.1
by Roman Drahtmueller 19 Jan '02

19 Jan '02

> > we have 5 suse 7.1 servers with postfix marked as open relay > > is there a new postfix problem ? Your email address is known from the support at SuSE. No, it's not a postfix problem, it's a configuration error. > > bye > Ernesto > Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE GmbH - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

1 0