January 2002 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] How many firewalls?
by Peer Stefan 16 Jan '02

16 Jan '02

Hi Max, There is no "this is the best solution", it depends on what kind of services you're running in the DMZ. If it's just ftp, mail and web then it's ok to set up a single firewall. If you want to run Samba, NFS and other more complex services I would suggest your first solution with 2 firewalls because of configuration errors. It's not automatically safer because of the 2 firewalls, but it will prevent potential administrative errors (like setting the wrong rules to the wrong nic ...) Try to set up a sample configuration and scan all the firewall's ports (from all networks) and decide for yourself. cheers, Stefan -----Ursprüngliche Nachricht----- Von: Max Lindner [mailto:ml@lofl.de] Gesendet: Dienstag, 15. Jänner 2002 20:30 An: suse-security(a)suse.com Betreff: [suse-security] How many firewalls? Hi! I want to set a up a DMZ in my school. The only thing I want to know, is: - Internet -> HARDWARE-ROUTER -> FW -> DMZ -> FW -> Intranet or - Internet | | Hardware-Router | | | FW DMZ _______/\______Intranet (I hope, this ascii art is good enough... :-/) Our school has no good connection and low traffic but this is for a skilled work (the german term is 'Facharbeit') and so I want a really secure thing (no, I won't cut the cable ;-D). Any comments or proposals? Thanks, Max -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

[suse-security] SuSEfirewall2 and NTP
by Rickey Ingrassia 16 Jan '02

16 Jan '02

I tried to open my firewall up to NTP (client) using the "FW_ALLOW_INCOMING_HIGHPORTS_UDP" in the" firewall2.rc.config" file. This did not work. The problem is that when the NTP request is sent to the server (dest port 123) the response was coming back with a source port of 123 as well. The "FW_ALLOW_INCOMING_HIGHPORTS_UDP" permits NTP replies on source ports 1024-65535. I fixed it by adding the following rule to "firewall2-custom.rc.config"; iptables -A input_ext -j ACCEPT -m state --state ESTABLISHED,RELATED -p udp --sport ntp --dport ntp (Opinions on the security of this rule welcome.) Is this a promblem with the NTP software/configuration on the client or server or a problem with SuSEfirewall2? SuSEfirewall2 is commented as follows, regarding the "FW_ALLOW_INCOMING_HIGHPORTS_UDP" option; # Common: "DNS" or "domain ntp", better is "yes" to be sure ... rickey

1 0

SSH
by JW 16 Jan '02

16 Jan '02

Can anyone tell me if openssh-2.5.2 is vulnerable the crc32 compensation attack? Thanks. ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com Central Texas IT http://www.centraltexasit.com

3 2

ssh reminder
by Thomas Lamy 15 Jan '02

15 Jan '02

Hi all, just to remind some of the lazy ones out there: the ssh crc32 compensation attack is (again) actively being exploitet. From one attack I have actively monitored, there were about 10 machines compromized in one night, after being scanned some days before. I phoned some of the admins, and most of them knowed that the problem exists (most of them were running SuSE 7.0), but were too lazy to fix it. See: http://www.suse.de/de/support/security/2001_045_openssh_txt.txt http://www.suse.de/de/support/security/2001_044_openssh_txt.txt http://www.suse.de/de/support/security/adv004_ssh.txt http://www.suse.de/de/support/security/2000_047_openssh_txt.txt http://defaced.alldas.de/mirror/2002/01/10/accounting.nordwest.net/ http://defaced.alldas.de/mirror/2002/01/10/custmx.ingolstadt-online.net/ http://defaced.alldas.de/mirror/2001/12/30/spider.tmag.de/ Cu, Thomas

5 9

Setup of Sendmail with AUTH using cyrus-sasl
by Evert Smit 15 Jan '02

15 Jan '02

Hi list, by now i found out how to set this up, after spending 3 days of research (i am sorta new to this :) ) Here the link that runs you through the setup of Sendmail >=8.10 using cyrus-sasl to enable sendmail authentication. also i am wondering about your oppinion. Is this a good solution, is it a hack, what do you think http://www.ledge.co.za/scripts.phtml?page=smtpauth My configuration SuSE 7.3 cyrus-sasl-1.5.24-157 openssl-0.9.6b-62 sendmail-tls-8.11.6-82 btw, if someone could mail me the syntax for the following solution smtp over ssl, while running sendmail as independant deamon. probabbly someting like smtps stream tcp nowait root /usr/sbin/stunnel smtp -p /usr/local/ssl/certs/mail.pem -r smtp thanks for yer help, most of my answers i found in the archives here. regards and good nite Evert

2 1

MySQL cluster
by Ralf Koch 15 Jan '02

15 Jan '02

Hi, working with a MySQL-Database (or s.th. similar) gives you always a single point of failure. Does anyone of you know a solution how to keep e.g. 2 MySQL datbases in sync all the time, so if one of them fails, no user of the db has to care of his data? Thanks for any hint to solve this. Ralf * * Ralf 'coko' Koch * mailto:info@formel4.de * --- Gute Nachricht: Windows 2000 ist 100% kompatibel. Die weltweit besten Forscher suchen nur noch, womit.

2 3

AW: Re[2]: [suse-security] MySQL cluster
by Peer Stefan 15 Jan '02

15 Jan '02

Hi Ralf, look at http://www.mysql.com/doc/R/e/Replication.html, which describes how to set up a master-slave-setup for mysql. For further detail please ask the mysql mailinglist (http://www.mysql.org/documentation/lists.html) regards, Stefan -----Ursprüngliche Nachricht----- Von: Ralf Koch [mailto:info@formel4.de] Gesendet: Dienstag, 15. Jänner 2002 14:14 An: SuSE Security List Betreff: Re[2]: [suse-security] MySQL cluster Ralf, I visited the site before, so I was somehow surprised by your comment. I haven't found a bit of information on clustering of MySQL on this site, so can you please be a little bit more precise where to look? Neither their search function nor the menu or documentation shaded light on how to solve this task. And the upcoming 4.x might be interesting, but not a solution. I'm looking for something stable, not for the "latest and gratest" version. Thanks, Ralf >Hi, > >www.mysql.com has lots of information about clustering of >MySQL servers. And they are improving all the time - MySQL >4 should have some improvements above 3.x > >Regards, > >Ralf Schwedler > >Ralf Koch <info(a)formel4.de> wrote .. >> Hi, >> >> working with a MySQL-Database (or s.th. similar) gives you always a >> single point of failure. Does anyone of you know a solution how to keep >> e.g. 2 MySQL datbases in sync all the time, so if one of them fails, no >> user of the db has to care of his data? >> * * Ralf 'coko' Koch * mailto:info@formel4.de * --- Windows-Error: Mouse not found - A mouse driver hasn't been installed. Please click the left mouse button to continue. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com

1 0

Re[2]: [suse-security] MySQL cluster
by Ralf Koch 15 Jan '02

15 Jan '02

Ralf, I visited the site before, so I was somehow surprised by your comment. I haven't found a bit of information on clustering of MySQL on this site, so can you please be a little bit more precise where to look? Neither their search function nor the menu or documentation shaded light on how to solve this task. And the upcoming 4.x might be interesting, but not a solution. I'm looking for something stable, not for the "latest and gratest" version. Thanks, Ralf >Hi, > >www.mysql.com has lots of information about clustering of >MySQL servers. And they are improving all the time - MySQL >4 should have some improvements above 3.x > >Regards, > >Ralf Schwedler > >Ralf Koch <info(a)formel4.de> wrote .. >> Hi, >> >> working with a MySQL-Database (or s.th. similar) gives you always a >> single point of failure. Does anyone of you know a solution how to keep >> e.g. 2 MySQL datbases in sync all the time, so if one of them fails, no >> user of the db has to care of his data? >> * * Ralf 'coko' Koch * mailto:info@formel4.de * --- Windows-Error: Mouse not found - A mouse driver hasn't been installed. Please click the left mouse button to continue.

1 0

Using SuSE-FW2 + SpeakFreely
by Pep Serrano 14 Jan '02

14 Jan '02

Hello secur-susers :-) I am trying to use SpeakFreely conferencing software from an internal masquedare network connected thorught a SuSE 7.3 box with SuSEFirewall 2 doing routing, masquerading and fw rules... I need to do a proxy for UDP 2074:2076 so packets get forwarded to the internal client 192.168.0.10. Following are the iptables rules I would use: iptables -A PREROUTING -t nat -p udp -i ppp0 --dport 2074 -j DNAT --to 192.168.0 iptables -A PREROUTING -t nat -p udp -i ppp0 --dport 2075 -j DNAT --to 192.168.0 iptables -A PREROUTING -t nat -p udp -i ppp0 --dport 2076 -j DNAT --to 192.168.0 (where ppp0 is the external NIC for the masquerading) I tried to load these rules manually either to place them inside the file /etc/rc.config.d/firewall2-custom.rc.config but all packets get drop and never reach my client... Where should I configure this proxy??? Thanks

1 0

ipchains...iptables...help
by Dan Banyard 14 Jan '02

14 Jan '02

Hi, I have 2 machines, one Linux box (running SuSE 7.2) and a Windows NT box. I have setup the ethernet cards on each machine, Linux is 192.168.0.1 and Windows NT is 192.168.0.2. I am trying to configure the Linux box to allow masquerading so I can get access to the net on the windows box via the Linux box. I have tried installing iptables but there seems to be a problem.... The command iptables -L produces loads of errors like xx/xxx/ip_tables.o: init_module: Device or resource busy xx/xxx/ip_tables.o: insmod xx/xxx/ip_tables.o failed ending with ..... Perhaps iptables or your kernel needs to be upgraded. I was lead to believe what I am trying to do is fairly simple....so could someone out there please help before I go mad - I have lost 3 days on this now already. Questions are: I have also looked into using ipchains. To use ipchains do I have to install a firewall? If so can someone give me some ideas of the steps for setup i.e. 1. install firewall 2. setup ipchains 3. configure.... Is it worth trying to sort out the iptables problems?, bearing in mind I want to setup a simple network of 2 machines just for myself..... Can anyone supply some examples of how all this has been done if anyone has done something similar - I find it much easier to work things out with examples.... Hope there is someone out there who can point me in the right direction. Thanks Dan

2 1