October 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] does anybody know such a log
by Thomas Schweikle 12 Oct '02

12 Oct '02

> Yes I do. This is why it doesn't really bother me. I just > can't believe that there's still Nimda/Code Red infected > boxes out there. After more than one year. Unfortunately there are. And often newly installed boxes out there do not incorporate the neccessary fixes to harden them against Nimda/Code Red. Some admins don't apply these patches regulary... -- Thomas

2 1

Re: [suse-security] RE: does anybody know such a log
by Thomas Lamy 12 Oct '02

12 Oct '02

I use a combo of iptables, snort and a script called guardian.pl (got it from freshmeat I think). My snort rules are stripped down to give no (i hope) false positives, every alarm gets picked up by that guardian.pl script, which in turn creates iptables rules to block "intruders" for 24 hours. guardian also features a white list (not a bad thing to have), to keep you (and known freidnly IPs) from locking yourself off. This setup runs fine for me for more than a year now on a SuSE 7.2 + kernel 2.4.x + bridging (so the fw itself is invisible to the net). Thomas

1 0

RE: [suse-security] RE: does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

snort 1.9.0 identified it as [**] WEB-IIS CodeRed v2 root.exe access [**] 10/11-22:26:06.822248 217.219.177.228:1803 -> my.ip.address:80 TCP TTL:112 TOS:0x0 ID:61416 IpLen:20 DgmLen:112 DF ***AP*** Seq: 0x1963F358 Ack: 0xE45FF7F5 Win: 0x4238 TcpLen: 20 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ iptables didn't pick that one up. Code Red came in using cmd.exe. I had no rule for that. philipp > -----Original Message----- > From: Jörg Fuchs [mailto:jf@meriadon.de] > Sent: Friday, October 11, 2002 11:20 PM > To: suse-security(a)suse.com > Subject: AW: [suse-security] RE: does anybody know such a log > > > Philipp wrote: > > >iptables -t filter -A INPUT -i $EXT_IFACE -p tcp \ > > -d $IP --dport http -m string \ > > --string "/default.ida?" -j DROP > >I'm implementing that and lets see how good the stuff works. > > I would be interested in the outcomes of your test. > Especially the impact on your firewall's load. > Please post your expierence - thanx *g* > > Joerg > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

AW: [suse-security] RE: does anybody know such a log
by Jörg Fuchs 11 Oct '02

11 Oct '02

Philipp wrote: >iptables -t filter -A INPUT -i $EXT_IFACE -p tcp \ > -d $IP --dport http -m string \ > --string "/default.ida?" -j DROP >I'm implementing that and lets see how good the stuff works. I would be interested in the outcomes of your test. Especially the impact on your firewall's load. Please post your expierence - thanx *g* Joerg

1 0

RE: [suse-security] RE: does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

Also I'm feeding my reverse proxy with acl nimdaworm urlpath_regex -i \.eml$ http_access deny nimdaworm acl nimda1 url_regex README.EML acl nimda2 url_regex root.exe acl nimda3 url_regex cmd.exe acl nimda4 url_regex readme.eml acl nimda5 url_regex readme.exe acl nimda6 url_regex default.ida http_access deny nimda1 http_access deny nimda2 http_access deny nimda3 http_access deny nimda4 http_access deny nimda5 http_access deny nimda6 I think, that should do it. Philipp > -----Original Message----- > From: Wolfgang Kueter [mailto:wolfgang@shconnect.de] > Sent: Friday, October 11, 2002 10:51 PM > To: suse-security(a)suse.com > Subject: RE: [suse-security] RE: does anybody know such a log > > > On Fri, 11 Oct 2002 mailinglists(a)belfin.ch wrote: > > > > > Can't tell you, but I found some antidote against such stuff in the > > internet: > > > [iptables -m string --string "pattern"] > > well, the stuff from the patch-o-matic and some of that stuff > is not very > stable, however you might try. Both SuSE default kernels 2.4.28 and > 2.4.19 that came with the two last version offer the module > already, so > can run tests even with the default kernel. > > A simple modprobe ipt_string should be enough. > > I'd believe that this pattern matching will be quite CPU consuming, > anyway, why not try it. > > Wolfgang > -- > shconnect Internet Service > web: http://www.shconnect.de EMail: info(a)shconnect.de > Bundesstrasse 2, 24392 Dollrottfeld, Fed. Rep. Germany > phone: +49 4641 644 > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

RE: [suse-security] RE: does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

Can't tell you, but I found some antidote against such stuff in the internet: # DROP HTTP packets related to CodeRed and Nimda # viruses silently iptables -t filter -A INPUT -i $EXT_IFACE -p tcp \ -d $IP --dport http -m string \ --string "/default.ida?" -j DROP iptables -t filter -A INPUT -i $EXT_IFACE -p tcp \ -d $IP --dport http -m string \ --string ".exe?/c+dir" -j DROP iptables -t filter -A INPUT -i $EXT_IFACE -p tcp \ -d $IP --dport http -m string \ --string ".exe?/c+tftp" -j DROP I'm implementing that and lets see how good the stuff works. Philipp > **HI > ** > **http://www.cert.org/advisories/CA-2001-19.html > ** > **Code Red :) > IIRC ,wasn't there a script someone on the Suse linux E list > had , that would > stop the thing from filling up your logs ??? Which is , at > present all it can > do.... > > -- > j > > afterthought If this was funny it would be a tagline. > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

OT: Simple Traffic Control Question (Howto)
by Mario Ohnewald 11 Oct '02

11 Oct '02

Hello! Sorry for posting this, i know its slightly OT. But i hope to get help here cause most of the networking/sysadmin ppl hang around here! ;) I have read the Howto (Section 9 exspecially!) a few times. It might be the language that i not get this or whatever! I want to make sure that port 14567 (upd) is in a priority 1 band (Minimum Delay). Port 14567 is used by an Online game, a low ping is badly needed. I decided to use Token Bucket Filter ( i hope i have chosen the right one) (...)Note that we use 'tc class add' to CREATE classes within a qdisc, but that we use 'tc qdisc add' to actually add qdiscs to these classes.(...) 1.) Do i have to create a class first ? example: tc qdisc add dev ppp0 root handle 1: htb default 30 2.) then i have to add qdisc to a class? example: tc qdisc add dev ppp0 root tbf rate 220kbit latency 50ms burst 1540 3.) set filter ? example: tc filter add dev eth0 protocol ip parent 10: prio 1 u32 match ip dport 22 0xffff flowid 1:1 I have read the howto but i can not find my mistake! I hope u can help me, i am really new to this! Cheers, Mario

1 0

Re: [suse-security] Re: **maillist-work:: Re: [suse-security] doe s anybody know such a log
by m3047＠inwa.net 11 Oct '02

11 Oct '02

Miguel Albuquerque <mfoacs(a)e-workshop.ch> wrote: >Hi, > >What about this: >schebish.c.crosslink.net - - [11/Oct/2002:17:02:57 +0200] "GET >/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN >NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN >NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN >NNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc >bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a > HTTP/1.0" 400 329 ?? > A buffer overflow aimed at a legacy API in IIS if I recall correctly (probably Code Red). Really, you should try a search with Google: http://www.google.com/search?hl=en&ie=ISO-8859-1&q=%2Fdefault.ida%3FNNNNNNNN &btnG=Google+Search In other words, I pasted "/default.ida?NNNNNN" into the search window. It *is* that easy... -- Fred Morris m3047(a)inwa.net

1 0

RE: [suse-security] Re: **maillist-work:: Re: [suse-security] doe s anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

Hi yes, it's really possible. Our reverse proxy just today picked up the same logs coming from a french IP address. I'm just checking what exactly this is. Philipp > -----Original Message----- > From: Thomas Seliger [mailto:CRJLJAKTJORB@spammotel.com] > Sent: Friday, October 11, 2002 2:01 PM > To: suse-security(a)suse.com > Subject: [suse-security] Re: **maillist-work:: Re: > [suse-security] does > anybody know such a log > > > Hi, > > What Hannes says is true. There are quite a few nimda > infected computers > out there that are connected to the internet via T-DSL, even > some with > ISDN. With "flatrates" getting affordable, people often have > their PCs > connected their PCs almost 24h to (e.g. for download or P2P). Also > running a Webserver on such hosts isn't as uncommon as it used to be. > > peace, > Tom > > > Johannes Studt wrote: > > > On Friday 11 October 2002 13:28, mailinglists(a)belfin.ch wrote: > > > >>Who's sleeping here? > >>This isn't neither nimda nor code red. This is a scan. it came from > >>a dial up account. Nimda and Code red never came from dial up > >>accounts. They always came from static IP addresses. > > > > > > Why nimda or code red _must_ come from static ip addresses? > > Think of IIS installed on WinPCs which are 24/7 up and > accessible via > > DynDNS names. Such systems are vulnerable too... > > > > Hannes > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

RE: [suse-security] does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

> > > dig -x ip.address: > > > > > > 90.99.11.217.in-addr.arpa. 86383 IN PTR > dialup-90.iberbanda.es. > > > > > > I've seen a lot of logs dealing with nimda and code red a > year ago. > But I > > > never saw this coming from a dial up link. > > I saw several attempts from dsl and dial up. I checked the french and the spanish ip addresses. These definitely were dial up boxes. And whatever it is they send, it cannot affect my boxes. > Anyway it does not affect any linux-box! > Any responsible admin will not tolerate those insecure iis and use > apache (even with or without asp)! That's for sure. > concerned about this attempts, that do not effect your server (I think > you are running apache, don't you?)? Yes I do. This is why it doesn't really bother me. I just can't believe that there's still Nimda/Code Red infected boxes out there. After more than one year. My installation is very new. That's why snort isn't running yet. I'll be able to see more once snort runs. > If you got iis make some acl's in your reverse proxy will help filter > all nasty requests and don't effect your system(s)! Thank you all for your kind help Philipp

1 0

RE: [suse-security] does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

> On Friday 11 October 2002 13:28, mailinglists(a)belfin.ch wrote: > > Who's sleeping here? > > This isn't neither nimda nor code red. This is a scan. it came from > > a dial up account. Nimda and Code red never came from dial up > > accounts. They always came from static IP addresses. > > Why nimda or code red _must_ come from static ip addresses? > Think of IIS installed on WinPCs which are 24/7 up and accessible via > DynDNS names. Such systems are vulnerable too... > We have do differentate between dhcp assigned ip addresses to always online internet links and old fashioned dial up accounts. The source of our scan looks very much like a dial up account: dig -x ip.address: 90.99.11.217.in-addr.arpa. 86383 IN PTR dialup-90.iberbanda.es. I've seen a lot of logs dealing with nimda and code red a year ago. But I never saw this coming from a dial up link. Philipp

3 2

RE: [suse-security] does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

Who's sleeping here? This isn't neither nimda nor code red. This is a scan. it came from a dial up account. Nimda and Code red never came from dial up accounts. They always came from static IP addresses. (Thanks, Thomas, for your suggestion.) Philipp > -----Original Message----- > From: Wolfgang Kueter [mailto:wolfgang@shconnect.de] > Sent: Friday, October 11, 2002 3:51 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] does anybody know such a log > > > On Fri, 11 Oct 2002 mailinglists(a)belfin.ch wrote: > > > Hello > > > > our reverse proxy picked this up > > > > [typical Nimda Code Red stuff] > > Is there some new IIS/Windows worm spreading? > > New? How deep have you been sleeping during the last 14 months? The > requests you see are typical Code Red and Nimda requests. > > http://www.google.de/search?q=msadc+Nimda&ie=UTF-8&oe=UTF-8&hl > =de&btnG=Google-Suche&meta= > > You might like to tell you proxy to block these though the > requests don't > harm Apache. > > Wolfgang > -- > shconnect Internet Service > web: http://www.shconnect.de EMail: info(a)shconnect.de > Bundesstrasse 2, 24392 Dollrottfeld, Fed. Rep. Germany > phone: +49 4641 644 > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

4 3

RE: [suse-security] does anybody know such a log
by m3047＠inwa.net 11 Oct '02

11 Oct '02

Wolfgang Kueter wrote: >On Fri, 11 Oct 2002 mailinglists(a)belfin.ch wrote: >> This isn't neither nimda nor code red. > >I'm pretty sure it is. > >> This is a scan. it came from a dial up account. Nimda and Code red >> never came from dial up accounts. > >Wrong, there were and stil are lots aof systems even of home users beeing >infected with these. Though it hard be believe for Linux users, there are >lots of people arounf running an IIS on a dial-up machine, often they even >know that they are ruuning it. Win2000 installs IIS by default. Having seen it with my own eyes, it is true; and I suspect there are many people out there with IIS installed and activated who don't even know it. Just wait until one of your friends asks you why his computer keeps dialing out on the modem and go take a look.. -- Fred Morris m3047(a)inwa.net

2 1

RE: does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

HI http://www.cert.org/advisories/CA-2001-19.html Code Red :) Philipp > -----Original Message----- > From: Miguel Albuquerque [mailto:mfoacs@e-workshop.ch] > Sent: Friday, October 11, 2002 5:30 PM > Cc: suse-security(a)suse.com > Subject: Re: [suse-security] Re: **maillist-work:: Re: [suse-security] > doe s anybody know such a log > > > Hi, > > What about this: > schebish.c.crosslink.net - - [11/Oct/2002:17:02:57 +0200] "GET > /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u90 > 90%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190 > %u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a > HTTP/1.0" 400 329 ?? > > > > Hi > > > > yes, it's really possible. Our reverse proxy just today > picked up the same > > logs coming from a french IP address. > > I'm just checking what exactly this is. > > > > Philipp > > > > > >>-----Original Message----- > >>From: Thomas Seliger [mailto:CRJLJAKTJORB@spammotel.com] > >>Sent: Friday, October 11, 2002 2:01 PM > >>To: suse-security(a)suse.com > >>Subject: [suse-security] Re: **maillist-work:: Re: > >>[suse-security] does > >>anybody know such a log > >> > >> > >>Hi, > >> > >>What Hannes says is true. There are quite a few nimda > >>infected computers > >>out there that are connected to the internet via T-DSL, even > >>some with > >>ISDN. With "flatrates" getting affordable, people often have > >>their PCs > >>connected their PCs almost 24h to (e.g. for download or P2P). Also > >>running a Webserver on such hosts isn't as uncommon as it > used to be. > >> > >>peace, > >>Tom > >> > >> > >>Johannes Studt wrote: > >> > >> > >>>On Friday 11 October 2002 13:28, mailinglists(a)belfin.ch wrote: > >>> > >>> > >>>>Who's sleeping here? > >>>>This isn't neither nimda nor code red. This is a scan. it > came from > >>>>a dial up account. Nimda and Code red never came from dial up > >>>>accounts. They always came from static IP addresses. > >>>> > >>> > >>>Why nimda or code red _must_ come from static ip addresses? > >>>Think of IIS installed on WinPCs which are 24/7 up and > >>> > >>accessible via > >> > >>>DynDNS names. Such systems are vulnerable too... > >>> > >>>Hannes > >>> > >>> > >> > >>-- > >>Check the headers for your unsubscription address > >>For additional commands, e-mail: suse-security-help(a)suse.com > >>Security-related bug reports go to security(a)suse.de, not here > >> > >> > > > > > -- > .-. e-SecureNet > /v\ We Run SuSE Project Manager > // \\ *The LINUX Experts* c/o Miguel Albuquerque > /( )\ Av. Miremont 46 > ^^-^^ 1202 - GE, SWITZERLAND > > Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 > mailto:mfoacs@e-securenet.ch http://www.e-securenet.ch > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

Under the hood access to iptables
by Ian Hunter 11 Oct '02

11 Oct '02

OK, I have an i586 running SuSE 8.0 (2.4.18-4GB) acting as a firewall and doing forwarding and masquerading. I have read every conceivable FAQ on firewalls and iptables. I don't claim to understand everything I've read, and my brain is bleeding through my ears now, but I want more. My system is presently working fine. I have a DSL modem connected to eth1 and am using rp-pppoe to get my ppp0 up and running so that several systems on the subnet attached to eth0 can get to the internet. All is well. I even have a machine (SuSE 7.3 SPARC) on the internal network running www, dns, and a couple other things that the firewall machine is forwarding things to, as appropriate. When I run iptables -L, I get reams and reams of junk. I've gone through it and understand more than half of it, but it seems like there are some rules there that I don't want, and there are some that I do that aren't there. I can manually tweak the chains a little bit (for instance, I manually disabled and reenabled forwarding 8079 on the gateway to 8080 on the Sun box via iptables -t nat -R blah blah blah... yay!) but I can't find where the rules live. Is there a cental config file that has all the rules? If I change things via the command line, and like my changes, how do I make them effective after a restart? Another thing I can't figure out is how to allow the internal network to access my domain just like an outside user would; for instance, I'm at 192.168.0.1 and I want to hit http://example.com, which is currently DNATed to 192.168.0.3:80 -- how can I tweak my config such that 192.168.0.1 can surf to http://example.com and have everything get resolved OK? Where do I find this stuff out? Thanks much, Ian

2 1

RE: [suse-security] Under the hood access to iptables
by Reckhard, Tobias 11 Oct '02

11 Oct '02

> When I run iptables -L, I get reams and reams of junk. I've > gone through it and understand more than half of it, but it > seems like there are some rules there that I don't want, and > there are some that I do that aren't there. I can manually > tweak the chains a little bit (for instance, I manually > disabled and reenabled forwarding 8079 on the gateway to 8080 > on the Sun box via iptables -t nat -R blah blah blah... yay!) > but I can't find where the rules live. Is there a cental > config file that has all the rules? I presume you're using SuSEFirewall2. It probably has a central config file, try "rpm -ql SuSEfirewall2 | grep etc". There will also be one or more scripts in /etc/init.d/ that start up and stop the packet filter. You can read those to find out how the thing actually works. I don't use SFw2 myself (I prefer to roll my own), so I can't give you anything more specific. > If I change things via the command line, By using the iptables command, as you have already been doing. > and like my changes, > how do I make them effective after a restart? You need to change the config file and perhaps the SFw2 scripts for this. > Another thing I can't figure out is how to allow the internal > network to access my domain just like an outside user would; > for instance, I'm at 192.168.0.1 and I want to hit >http://example.com, which is currently DNATed to 192.168.0.3:80 -- > how can I tweak my config such that 192.168.0.1 can surf to > http://example.com and have everything get resolved OK? Well, I wouldn't even attempt to do that with IP packet munging, but would instead use internal DNS server and DNS cache to present data of example.com to the inside than the Internet sees. Cheers, Tobias

1 0

does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

Hello our reverse proxy picked this up 1034211881.427 22 217.11.99.90 TCP_MISS/503 1166 GET http://www/scripts/..%c1%1c../winnt/system32/cmd.exe? - NONE/- - 1034211881.925 13 217.11.99.90 TCP_MISS/503 1166 GET http://www/scripts/..%c0%2f../winnt/system32/cmd.exe? - NONE/- - 1034211882.393 19 217.11.99.90 TCP_MISS/503 1166 GET http://www/scripts/..%c0%af../winnt/system32/cmd.exe? - NONE/- - 1034211882.852 10 217.11.99.90 TCP_MISS/503 1166 GET http://www/scripts/..%c1%9c../winnt/system32/cmd.exe? - NONE/- - 1034211883.297 5 217.11.99.90 TCP_MISS/503 1168 GET http://www/scripts/..%%35%63../winnt/system32/cmd.exe? - NONE/- - 1034211883.836 20 217.11.99.90 TCP_MISS/503 1164 GET http://www/scripts/..%%35c../winnt/system32/cmd.exe? - NONE/- - 1034211887.664 22 217.11.99.90 TCP_MISS/503 1172 GET http://www/scripts/..%25%35%63../winnt/system32/cmd.exe? - NONE/- - 1034211888.285 19 217.11.99.90 TCP_MISS/503 1164 GET http://www/scripts/..%252f../winnt/system32/cmd.exe? - NONE/- - 1034215688.223 16 217.11.99.90 TCP_MISS/503 1116 GET http://www/scripts/root.exe? - NONE/- - 1034215689.027 29 217.11.99.90 TCP_MISS/503 1112 GET http://www/MSADC/root.exe? - NONE/- - 1034215689.564 13 217.11.99.90 TCP_MISS/503 1132 GET http://www/c/winnt/system32/cmd.exe? - NONE/- - 1034215690.138 3 217.11.99.90 TCP_MISS/503 1132 GET http://www/d/winnt/system32/cmd.exe? - NONE/- - 1034215690.962 20 217.11.99.90 TCP_MISS/503 1164 GET http://www/scripts/..%255c../winnt/system32/cmd.exe? - NONE/- - 1034215691.552 27 217.11.99.90 TCP_MISS/503 1206 GET http://www/_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe? - NONE/- - 1034215692.265 19 217.11.99.90 TCP_MISS/503 1206 GET http://www/_mem_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe? - NONE/- - 1034215693.017 10 217.11.99.90 TCP_MISS/503 1262 GET http://www/msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../..%c1%1c. ./winnt/s Is there some new IIS/Windows worm spreading? Thanks, Philipp

4 3

Re: [suse-security] problem with routing
by Robert Rottscholl 10 Oct '02

10 Oct '02

Hi Payam, ok, if the dns works from the router, than you have a routing problem. try tcpdump -i eth1 to look what packages are leaving and icoming on your "world device". You get this information by invoking the command above and trying "nslookup www.suse.com" from a client. Greets robert payam payami schrieb: >Hi Robert, > >I have win2k for router in our network now and is >working well, so , i want to replace it with suse 7.3 >I set an dns IP in control center (host name and name >server) in Xwindow & set this IP for dns in >clients(windows machine) >Router can see internet but clients (internal network) >that their OS is win2k can't see internet. >Also router (suse 7.3) can ping clients IP but clients >only can ping eth0(internal network) for router & >can't ping eth1(external network) for router >when i do this command in client machine : >nslookup suse.com >i get thie error: >can't find servername for address ( the Ip that i set >for dns that above told you ) :time out >default servers arenot availabe > ' > ' > ' > ' > ' >What can i do? > >Thanks for your help, >Payam > >--- Robert Rottscholl <lv426(a)rinx.de> wrote: > > >> Hi Payam, >> >>what about your dns server? You have one? Or do you >>add an external dns >>to your client configuration. >>What does nslookup or dig on a client say? (e.g. >>nslookup www.suse.com) >>If these programs can recieve an IP-Adress try to >>ping. >> >>Ciao ;-) >> >>Robert >> >>payam payami schrieb: >> >> >> >>>Hi Robert, >>>I did what did you tell me, FW_route & >>> >>> >>FW_MASQUERADE & >> >> >>>etc, without set the iptables rule but >>> >>> >>UNFORTUNATELY i >> >> >>>can't get result. >>>What can i do? >>> >>>Thanks for your help, >>>Payam >>> >>>--- Robert Rottscholl <lv426(a)rinx.de> wrote: >>> >>> >>> >>> >>>>Hi Payam, >>>>let me repeat what you try to do: You want to >>>> >>>> >>route >> >> >>>>the internet >>>>requests from the internal (eth0) interface to >>>> >>>> >>the >> >> >>>>external interface >>>>(eth1). >>>>You needn't set the rule you posted. >>>>Set >>>>FW_ROUTE="yes" >>>>FW_MASQUERADE="yes" >>>>FW_MASQ_DEV="eth1" >>>>FW_MASQ_NETS="" # to your internal subnet (e.g. >>>>192.168.0.0/24) >>>> >>>>Creets >>>> >>>>robert >>>> >>>>payam payami schrieb: >>>> >>>> >>>> >>>> >>>> >>>>>I want to use suse 7.3 for router & i want to do >>>>>masquerading. >>>>>I have 2 net card that one is for internal >>>>> >>>>> >>network >> >> >>>>> >>>>> >>>>> >>>>> >>>>& >>>> >>>> >>>> >>>> >>>>>another is for external network. >>>>>eth0 for internal network >>>>>eth1 for external network >>>>>I was setting in >>>>> >>>>> >>>>> >>>>> >>>>/etc/rc.config.d/firewall2.rc.config >>>> >>>> >>>> >>>> >>>>>(The options that related to masquerading) and >>>>> >>>>> >>type >> >> >>>>>this command in command line >>>>> >>>>>iptables -t nat -A POSTROUTING -j MASQUERADE -o >>>>> >>>>> >>>>> >>>>> >>>>eth1 >>>> >>>> >>>> >>>> >>>>>Is this any problem with this rule or in my >>>>>configuration file? >>>>>Because only router system can see internet and >>>>>another systems can't see internet >>>>>How can i solve this problem that another systems >>>>>(internal network) can see internet? >>>>> >>>>>Thanks for your help, >>>>>Payam >>>>> >>>>> >>>>> >>>>__________________________________________________ >>>> >>>> >>>>>Do you Yahoo!? >>>>>Yahoo! Mail Plus - Powerful. Affordable. Sign up >>>>> >>>>> >>>>> >>>>> >>>>now. >>>> >>>> >>>> >>>> >>>>>http://mailplus.yahoo.com >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>-- >>>>Check the headers for your unsubscription address >>>>For additional commands, e-mail: >>>>suse-security-help(a)suse.com >>>>Security-related bug reports go to >>>> >>>> >>security(a)suse.de, >> >> >>>>not here >>>> >>>> >>>> >>>> >>>> >>>__________________________________________________ >>>Do you Yahoo!? >>>Yahoo! Mail Plus - Powerful. Affordable. Sign up >>> >>> >>now. >> >> >>>http://mailplus.yahoo.com >>> >>> >>> >>> >>> >>> >> >>-- >>Check the headers for your unsubscription address >>For additional commands, e-mail: >>suse-security-help(a)suse.com >>Security-related bug reports go to security(a)suse.de, >>not here >> >> >> > >__________________________________________________ >Do you Yahoo!? >Yahoo! Mail Plus - Powerful. Affordable. Sign up now. >http://mailplus.yahoo.com > > > >

1 0

affected Systems (?)
by Joerg Henner 10 Oct '02

10 Oct '02

Hi, did anyone know about following CERT-Advisories are allready fixed in SuSE 8.x - or about the patches will be released the next days: - fetchmail - bind - glibc Further infos (only in german) can be found here: http://cert.uni-stuttgart.de/ (Have a look at 09/2002 und 10/2002) Thanx for any advice, Greetings, -- Jörg Henner Fon: +49 (7 11) 48 90 83 - 0 ETES - EDV-Systemhaus GbR Fax: +49 (7 11) 48 90 83 - 50 Libanonstrasse 58 A * D-70184 Stuttgart Web: http://www.etes.de ______________________________________ Inflex - eMail Scanning and Protection Queries to: postmaster(a)etes.de

5 6

Re: [suse-security] SuSEfirewall2 and NAT
by Jan Dus 10 Oct '02

10 Oct '02

Good morning, thank you for your response. I have understood everything (I hope) and I agree. But I don't want (mustn't <- corp. policy) to use these public addresses in our private net. I need every traffic (all ports/protocols) from Internet to our public address <PUB1> to forward/masq to private address <PRIV1> and the same thing with the second -- <PUB2> to forward/masq to <PRIV2>. Is it possible to do it in SuSEfirewall2's configuration? May I use custom rules? --- Se srdecnym pozdravem/Best regards Jan Dus (CNA, CNE, CNS) AG COM, a.s. Smirice Czech Republic kancelar/office +420 495 421 312 fax +420 495 421 108 Andreas J Mueller <andy(a)muelli.net> 08.10.2002 17:14 Komu: suse-security(a)suse.com Kopie: Předmět: Re: [suse-security] SuSEfirewall2 and NAT -----BEGIN PGP SIGNED MESSAGE----- Hi Jan! > I have enough public IP address - there is no problem but is there a > possibility to arrange the same trafic to the second server? Not as long as your firewall has only one public IP address. If you have enough public IP addresses, masquerading is not necessary. You could assign public addresses to your servers and use FW_FORWARD instead of FW_FORWARD_MASQ. They will still be protected by the firewall (i.e., only those ports you actually forward from the FW will be reachable from the outside). I'm sure there are also other possibilities (SNAT?). Regards, Andy - -- Andreas J. Mueller email: <andy(a)muelli.net> PGP RSA Public Key ID 0x3D41D941 FP: ED261973D51D3D20 C840B0542E69F602 We strongly urge you to encrypt information sent by email. Our public PGP key is available from http://132.176.114.28/q4408950/pubkey.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.0 (MingW32) iQC9AwUBPaL2YvobN5o9QdlBAQHEmQU/d1pRoLt5S84CFSE2G8QIEkALJFbraUg5 b3uExJJl75q3g/BdodlEPhz7KHE1QPPNySZlUDw3hDDzgpB8PoZrGsN5GU5NAwXj R5qoOUfF1WxHcBCH1vKb8RIkOTLToWXC8DTZXXz6yx2MfFwe+SqLExJ6OnDh7IwM y1Astan7B27hsVcK19nUEW6oKwXaQIyXn1852/Bzf9hhMls/X5piA+3QcGZl8vgF =LqgG -----END PGP SIGNATURE----- -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

No access to Apache behind SuSEfirewall2
by Dr. Peter Bast 09 Oct '02

09 Oct '02

Hi, I have a small network with a Linux-Server (SuSE 8.0) with SuSEfirewall2. The server has a internal Interface eth0 (ip = 192.168.12.80) and an external interface eth1 (ip = 192.168.0.3). eth1 is connected to a Hadrwarerouter with a LAN-interface (ip = 192.168.0.2) and a WAN-Interface for a dynamic IP-adress. All clients from the internal net can acces to the Internet via squid-proxy on the Linux-Server. But wenn I try to access the Apache webserver on my Linuy-Server from the Internet I get the following log-messages: ....kernel: SUSE-FW-UNAUTHORIZED-TARGED IN=eth1 OUT=MAC=...... SRC='dynamic IP' DST=192.168.12.80 ....... SuSEfirewall2 is configured as following: FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="21 53 http https pop3 pop3s smtp telnet" FW_SERVICES_EXT_UDP="53" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="25 53 80 110 137 3128" FW_SERVICES_INT_UDP="53 137" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" I hope every body can help me Thanks Peter ______________________________________ Inflex - installed on mailserver for domain @inis.inf Queries to: postmaster(a)inis.inf

3 2

AW: [suse-security] No access to Apache behind SuSEfirewall2
by V. Lieder 09 Oct '02

09 Oct '02

>>cut eth1 > is connected to a Hadrwarerouter with a LAN-interface (ip = > 192.168.0.2) > and a WAN-Interface for a dynamic IP-adress. All clients from the > internal net can acces to the Internet via squid-proxy on the > Linux-Server. But wenn I try to access the Apache webserver on my > Linuy-Server from the Internet I get the following log-messages: > > ....kernel: SUSE-FW-UNAUTHORIZED-TARGED IN=eth1 OUT=MAC=...... > SRC='dynamic IP' DST=192.168.12.80 ....... > > SuSEfirewall2 is configured as following: > Hi, perhaps it isn´t a problem of your linux-server. Is it possible taht there is also a firewall in the hardware-router?

3 2

RE: [suse-security] harden_suse on 8.1
by mailinglists＠belfin.ch 09 Oct '02

09 Oct '02

Hi yes, this is a suse linux. rc.config was already nearly empty in suse 8.0. try chkconfig in /sbin/ HTH Philipp > -----Original Message----- > From: Thomas Kerkau [mailto:thomas.kerkau@io-software.com] > Sent: Wednesday, October 09, 2002 4:19 PM > To: SuSE-Security > Subject: [suse-security] harden_suse on 8.1 > > > Hi All, > > yust installed SuSE Linux 8.1 and the harden_suse script. The script > terminates with: > > /etc/rc.config doesn't exist! Is this really a SuSE Linux? > > Not really surprising but will SuSE provide an update or is > harden_suse > no longer usefull?? > > Greetings, Thomas > > > > ----- < iO > --------------------------------------------------------- > Interactive Objects Software GmbH > mailto:Thomas.Kerkau@io-software.com > http://www.io-software.com > Basler Strasse 65, D-79100 Freiburg, Germany > Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 > ---------------------------------------------------------------------- > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

IPSEC aware version of SuSEfirewall2
by wilm＠tas.nl 09 Oct '02

09 Oct '02

Hi, I'm having some troubles trying to configure a site-to-site VPN connection using SuSe 8.0, FreeS/WAN and SuSEfirewall2. The IPSEC tunnel is working fine but as soon as I start the firewallscript things go wrong. In september i read something about extra rules in the latest version of firewall2 (http://lists.suse.com/archive/suse-security/2002-Sep/0164.html) But after downloading the archive I found no snip ---- # 19.) # Say yes, if you use IPSEC # Defaults to "no" # FW_IPSEC="yes" # # 20.) # IPSEC device # FW_DEV_IPSEC="ipsec0" # 21.) # local/remote network # masquerading is disabled through the tunnel automatically, # if you enabled it above # FW_IPSEC_LOCALNET="192.168.1.0/24" FW_IPSEC_REMOTENET="192.168.2.0/24" ---- snap In the config files......... :-( Can anyone tell me where this IPSEC aware version of SuSEfirewall2 is hidden ???? Thanks *************************************************** Wilm v Welbergen *************************************************** Only Robinson Crusoë had everything done by Friday... ***************************************************

1 0

harden_suse on 8.1
by Thomas Kerkau 09 Oct '02

09 Oct '02

Hi All, yust installed SuSE Linux 8.1 and the harden_suse script. The script terminates with: /etc/rc.config doesn't exist! Is this really a SuSE Linux? Not really surprising but will SuSE provide an update or is harden_suse no longer usefull?? Greetings, Thomas ----- < iO > --------------------------------------------------------- Interactive Objects Software GmbH mailto:Thomas.Kerkau@io-software.com http://www.io-software.com Basler Strasse 65, D-79100 Freiburg, Germany Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 ----------------------------------------------------------------------

1 0