January 2002 - openSUSE Security - openSUSE Mailing Lists

Small home network and SuSEfirewall 2
by Stefan Fricke 18 Jan '02

18 Jan '02

I have a small network of three computers at home. All of them are running under SuSE Linux 7.3. I call them A, B and C. A has a permenent connection to the internet with an IP, B and C have private IPs which are masqueraded. On A SuSE firewall 2 is running, right now all connections from outside are blocked, all connections from inside to the internet are open. Now I want to do the following: 1. An SSH connection from outside should be forwarded to B. That means, Users who have an account on B should be able to login from outside (SSH only, no Telnet or RLogin) without getting an account on A. 2. B should work as SMPT server. A connect on port 25 from outside should be forwarded to B so that the SMTP server on B responds and handles the mail. 3. Users on B and C should be able to use all functions of LICQ. 4. Users of B and C should be able to use these computers as X terminal to run X-Window-Software on distant servers. How do I do that? Stefan

1 0

logging users in suse
by Mike Garabedian 18 Jan '02

18 Jan '02

How can I keep a log of users accessing the system. I would like to keep a log of specific users and the times and possibly the commands that they might access during a logon. Please let me know if ou have any ideas. Mikey

3 2

I have been hacked: who to contact
by g x 18 Jan '02

18 Jan '02

Dear Admins Our server has been hacked a few weeks ago (sshd 1.2.27 crc32 compensation attack/rootkit installed/visa- and mastercard scanned/irc relay installed/own sshd installed/ssh attack from tw/irc and logins from ro/lan sniffer installed/collected data sent to yahoo mail address). As we are located in Switzerland, we do not have FBI or CIA to handle this. Who should I contact: police, CERT(a)switch.ch, federal bureau of computer crime (if it exist?) How do you handle hacker attacks: after cleaning your computers you fall back into normal operation or do you have the gouvernment/big boss/... informed? How should I react on this attack? I hope somebody has already made some experience with swiss laws. Yours Andreas (genesis_xix(a)yahoo.com) __________________________________________________ Do You Yahoo!? Send FREE video emails in Yahoo! Mail! http://promo.yahoo.com/videomail/

3 2

Re: [SLE] recover from bad chown?
by Nadeem Hasan 18 Jan '02

18 Jan '02

Christopher Mahmood wrote: > > A good example of why / should be on a separate filesystem from > /var, /home, and /tmp and mounted readonly. If you don't want to do > that, at least chattr +i if using ext2 or chmod -w if using > reiserfs. How would this help when he used -R option with chown? It would still recurse down the whole tree. Only the files in the root filesystem would be protected. Am I missing something? Cheers, -- Nadeem Hasan nhasan(a)nadmm.com http://www.nadmm.com/

1 0

Re: [suse-security] SuSEFirewall2, FreeS/WAN and VPN
by Argentium G. Tiger 18 Jan '02

18 Jan '02

Nadeem Hasan writes: >I have since been successful in getting the setup running >with SuSEFirewall2, FreeS/WAN and SSH Sentinel using X.509 >certificates. I am currently in the process of writing this >whole thing into a nice document. Wait for a couple of days :) Many thanks... I'm looking forward to seeing how you got it working. I need to keep looking at any and all options, because this _has_ to be working by Monday morning. Failure means I'm holding up an entire office from moving from one location to another, and that's the holdup I'd really rather not continue to be the cause of. So, further to that need, here's a bit more information given what I've learned since yesterday (and many thanks to participants in this mailing list, the fact that people are offering suggestions is _very_ much appreciated. I don't feel quite so alone trying to tackle this giant.) I've set up SSH (SSH-1.9.9-OpenSSH_2.9.9p2) with public keys such that the machines can log into each other without any trouble. I used ipsec rsakeysig to generate keys sufficient for my security needs, and I've set up my ipsec.conf and ipsec.secrets files accordingly. On the side where the firewall is actually active, I'm getting the error that I documented last message: ipsec_setup: Starting FreeS/WAN IPsec 1.91...WARNING: ipsec0 has route filtering turned on, KLIPS may not work ipsec_setup: (/proc/sys/net/ipv4/conf/ipsec0/rp_filter = '1', should be 0) ipsec_setup: WARNING: eth0 has route filtering turned on, KLIPS may not work ipsec_setup: (/proc/sys/net/ipv4/conf/eth0/rp_filter = '1', should be 0) I'm assuming this problem will dog me on both sides when I activate the firewall/IPSEC machine on the inside of the CiscoPIX firewall on the 10.100.0.0/24 network. And now to Markus' message: > You must disable IP spoofing protection for ipsec to work properly. > > Something like that should do the job: > echo 0 > /proc/sys/net/ipv4/conf/ipsec0/rp_filter > echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter But where does that go, and when should they be executed? I tried putting those in the /etc/rc.config.d/firewall2-custom.rc.config file in the fw_custom_before_denyall() section at the end, and enabling the customized command script in /etc/rc.config.d/firewall2.rc.config in section 25: FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" With IPSEC not running, I activated the Firewall final portion: /etc/init.d/SuSEfirewall2_final start I get this error message: /sbin/SuSEfirewall2: /proc/sys/net/ipv4/conf/ipsec0/rp_filter: No such file or directory Okay... So ipsec0 doesn't exist without ipsec loaded. That makes sense. So I reactivate ipsec: /etc/init.d/ipsec start It comes back with: ipsec_setup: Starting FreeS/WAN IPsec 1.91...WARNING: ipsec0 has route filtering turned on, KLIPS may not work. ipsec_setup: (/proc/sys/net/ipv4/conf/ipsec0/rp_filter = '1', should be 0) ipsec_setup: Okay, we're down to one error... Do I need to re-run the firewall final portion of the script *again*? From my perception, I have a chicken and the egg problem here. :-( Which comes first? Argentium

2 4

monitor iptables user
by Matthias Krauss 18 Jan '02

18 Jan '02

Hi folks i set my new iptables firewall active in my office, there are ~~ 70 users behind. Is there any way to track/monitor single users by activity ? Thanks Matthias

1 0

Multicast-Müll aus den logs 'rausbringen
by Alexander Topolanek 18 Jan '02

18 Jan '02

Hallo, mein Provider schickt mir jede Minute Multicast-Pakete, die mir die Messages zumüllen: -- Jan 18 00:04:47 rohrpostfix kernel: SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= S RC=195.3.94.57 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=7983 PROTO=2 -- Ich verwende die SuSE-FW2, und brauche jetzt noch eine iptable-regel, die mir die Pakete still verwirft. Ich habs mit "iptables -A INPUT -i ippp0 -d 224.0.0.1/24 -j ACCEPT" versucht, das hat aber nicht so geklappt... wo habe ich den Denkfehler gemacht? danke Alexander

2 1

Request
by Dan Banyard 18 Jan '02

18 Jan '02

Hi, I have signed up to the security list under: dan(a)edentify.com.au dan(a)www.edentify.com.au Could you please unsubscribe me from dan(a)edentify.com.au Thanks Dan

2 1

Re: [suse-security] SuSEFirewall2, FreeS/WAN and VPN
by Argentium G. Tiger 18 Jan '02

18 Jan '02

Kai writes: >what's about the kernel parameter rp_filter?! There is for each network >device a dir in /proc/sys/net/ipv4/conf/ ! Yes, I see those settings there... >And for IPSec it must be set to "0" (the default value, I think)!! Yes, before the SuSEfirewall2 script runs, these are 0. >The >/sbin/SuSEfirewall2 script look at start time for ipsec devices (in v2.0 -> >less +522 /sbin/SuSEfirewall2), but is there no IPSec device present the >rp_filter parmeter ist set to "1"! >May you want to set them all to "0": >for i in /proc/sys/net/ipv4/conf/* ; do { echo "1" > $i/rp_filter ; } done ; Okay, but: When? >If that dosen't help you can switch off the kernel security at #17 in >/etc/rc.config.d/firewall2.rc.config. I checked, it's already off. I left it off until I got a working config, which I don't appear to have yet. I'm trying to give myself the best chance for success. :-) >A litte bug on the /sbin/SuSEfirewall2 script is that the changes on the >kernel parameteres are a one-way-ticket! Once set the script didn't roll it >back to the original values if you stop/refresh/reload the firewall, so the >only way I see is to reboot the machine (or roll back the values by hand ;-) Thank you, I didn't know that! >btw. works IPSec correctly if you didn't start the firewall?! On one end, I'm already behind a CISCO PIX firewall, so I have the luxury of not running the firewall. On the other end, I'm wide open to the world, and I'm not willing to shut the firewall down. That strikes me as downright dangerous. >PS remember: you CAN'T ping from one IPSec router to the other!!! You must >use other IPs than the route IPs a source / target IPs for ping tests: >http://www.freeswan.org/freeswan_trees/freeswan-1.91/doc/faq.html#cantping A good reminder, thank you. >PSS Very important (the real trick): >http://www.freeswan.org/freeswan_trees/freeswan-1.91/doc/faq.html#masq.faq Thanks... though with SuSEfirewall2 in play, I'm not sure how to issue manual commands with IPTables and not screw up what SuSEfirewall2 has done for me. The prospect of manually creating firewall scripts is not a pretty one. I have a bunch of port forwarding going on. :-( >Have a nice day.... I'll try, thanks.

1 0

Re: [suse-security] Firewall setup
by Michael Appeldorn 18 Jan '02

18 Jan '02

>I think there is something wrong with the spacing in >FW_TRUSTED_NETS="192.150.180.137" "192.150.180.138" "192.150.180.139" "192.150.180.140" >Can someone help me. Simple, use FW_TRUSTED_NETS="192.150.180.137 192.150.180.138 192.150.180.139 192.150.180.140" instead nice weekend :O)_ Michael Appeldorn

1 0