October 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] does anybody know such a log
by mailinglists＠belfin.ch 14 Oct '02

14 Oct '02

> >Philipp > >Try looking at this web site: > http://online.securityfocus.com/infocus/1531 > >It may fill in some blanks. > > Does the SuSE-Kernels (Preffered 2.4.18-231), supports this ?? Yes, it does it. I checked what Suse compiles into the kernel. It was there. Works wonderfully. Philipp > > Greetings, > -- > Jörg Henner Fon: +49 (7 11) 48 90 83 - 0 > ETES - EDV-Systemhaus GbR Fax: +49 (7 11) 48 > 90 83 - 50 > Libanonstrasse 58 A * D-70184 Stuttgart Web: http://www.etes.de > > > ______________________________________ > Inflex - eMail Scanning and Protection > Queries to: postmaster(a)etes.de > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

Re: [suse-security] SuSEfirewall2
by GentooRulez 14 Oct '02

14 Oct '02

> A user comes up to me and asks why he cannot work with mirc and winmx. >I checked with the linux-e group and they told me that I have to launch >SuSEfirewall. This is i good idea to protect yourself, but the only thing you really have to do is to activate routing between internal and extrenal nic and to masquerade your private ip's. echo 1 > /proc/sys/net/ipv4/ip_forward if the kernel setting relating to this are activated. >So since I read that there is a newer version out, I managed >to download SuSEfirewall2 and managed to get iptables as well. Installed both, >configured SuSEfirewall2 configuration based on a setup that a SuSE user >sent me. I execute SuSEfirewall2 --test, and I get the following message: > Found named running, trying to execute Forward_DNS (I am away > from the server now, so please bear with me....) > A few moments later.... > > Trying to Forward_DNS. Found named running but no DNS server to > forward..... >I executed rcnamed status and found that rcnamed was not running. >I am still trying to understand what is going on.... When I sit on a Win9X >PC, I try to ping www.suse.com, but nothing happens!!! >Can someone please help me with this? It is the only thing that is left for me to >do and I still cannot understand what to do; perhaps because I am such a newbie >with SuSE and Linux... Who knows?!? As i saw in /sbin/SuSEfirewall that the script guesses named is up if the relating entry in the rc.config is set to yes. Try to disable "auto detect services" and activate samba and dhcp for internal nic using: FW_SERVICES_INT_TCP="" # Common: domain syslog FW_SERVICES_INT_UDP="" check etc services and /var/log/message for related ports (to check /sbin/SuSEfirwall seeking for dhcpd and samba will show necessary ports, too) The UDP 53 (DNS) request should get routed+masqueraded by your box. See tail -f /var/log/message while sending such a request to the outside. Maybe this helps Yours Michael

1 0

SuSEfirewall2
by Chris Bek 14 Oct '02

14 Oct '02

Hi all, I have sent a few messages on the suse-linux-e group but I thought I should better send a message to the appropriate group since you will probably have a few answers for the questions that I have. I have a small network of 3 PCs running Win9X and a SuSE7.2 box acting as sever. The Server has DHCPd running fine, Samba running fine so all the Win machines logon as if they were attached to a WindowsNT network; all this works absolutely perfect!!!! Now the problem rised when they asked that they could serf the internet. So I launched Squid and they could all surf simple pages and download stuff that some pages offer to download (utilities, progs etc.) The problem... =========== A user comes up to me and asks why he cannot work with mirc and winmx. I checked with the linux-e group and they told me that I have to launch SuSEfirewall. So since I read that there is a newer version out, I managed to download SuSEfirewall2 and managed to get iptables as well. Installed both, configured SuSEfirewall2 configuration based on a setup that a SuSE user sent me. I execute SuSEfirewall2 --test, and I get the following message: Found named running, trying to execute Forward_DNS (I am away from the server now, so please bear with me....) A few moments later.... Trying to Forward_DNS. Found named running but no DNS server to forward..... I executed rcnamed status and found that rcnamed was not running. I am still trying to understand what is going on.... When I sit on a Win9X PC, I try to ping www.suse.com, but nothing happens!!! Can someone please help me with this? It is the only thing that is left for me to do and I still cannot understand what to do; perhaps because I am such a newbie with SuSE and Linux... Who knows?!? thank you soo much for your reply! Chris

1 0

RE: [suse-security] does anybody know such a log
by mailinglists＠belfin.ch 14 Oct '02

14 Oct '02

> If there is a firewall (SuSE hopefully) between you and the > net. No, not Suse firewall. It's a Microsoft ISA server -- just kidding. It's iptables. > You could > perhaps setup a rule that would look for Nimda's tell tale striNNNNNg. > or code Red's .../winnt/system32..... and drop it. Yeah, right. Unfortunately mine don't work. I've got prefix = "iptables -t nat -A PREROUTING -p 6 -s 0/0 -d $ip_waneth / --dport 80 -m string --string" $prefix "/default.ida?" -j LOG --log-prefix CODE-RED $prefix "/default.ida?" -j DROP $prefix ".exe?/c+dir" -j LOG --log-prefix NIMDA $prefix ".exe?/c+dir" -j DROP $prefix ".exe?/c+tftp" -j LOG --log-prefix NIMDA $prefix ".exe?/c+tftp" -j DROP $prefix "/cmd.exe?" -j LOG --log-prefix CODE-RED $prefix "/cmd.exe?" -j DROP $prefix "/root.exe?" -j LOG --log-prefix CODE-RED $prefix "/root.exe?" -j DROP Have you got some that work? Philipp > ----- Original Message ----- > From: "Thomas Schweikle" <tschweikle(a)fiducia.de> > To: <suse-security(a)suse.com> > Sent: Saturday, October 12, 2002 3:23 PM > Subject: RE: [suse-security] does anybody know such a log > > > > > Yes I do. This is why it doesn't really bother me. I just > > > can't believe that there's still Nimda/Code Red infected > > > boxes out there. After more than one year. > > > > Unfortunately there are. And often newly installed boxes > out there do not > > incorporate the neccessary fixes to harden them against > Nimda/Code Red. > > Some admins don't apply these patches regulary... > > > > -- > > Thomas > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

3 2

Re: [suse-security] SuSEfirewall2 - problems with DMZ
by Michael Boettjer 14 Oct '02

14 Oct '02

>> All works fine. >> But now i want to add a second Server (Mail) to the DMZ. I added the >> appropriate entry to the FW-FORWARD-Parameter. I can ping the two Servers >> from the firewall succesful. >This means, you can the both IPs on 192.168.70.0 >> But from an inner-LAN-Client i can only reach the Webserver, but not the >> Mailserver. Neither a ping works still a telnet to the SMTP-Port. The >> Firewall-Logs relative to DENYs or so what is empty. >If I understand it correct: You allow ping. So you can ping your Webserver >192.168.70.10, but not your mail-Server 192.168.70.1?. Yes, that's right. >> But why? >> When i add the Mailserver to the "FW_FORWARD_MASQ"-Parameter, i can reach >> the Box from the internet without problems. >If you can reach your mail server if it's MASQ, your will masq the IP and the >firewall >May be, your default router is wrong. It must be the IP of NIC of firewall >which belongs to DMZ. >Try a traceroute from your mail server into your internal network to prove >this. Thank you for the thoughts. In the meantime a found the error. I tried to ping the to Boxes in the DMZ successively. On the Firewall i sniffed the packets with tcpdump. So i saw, that the "echo reply" from the Mailserver not came back. Concluding to this the solution is, that the Mailserver can't reach the Clients because no routing entry to the Client-Subnet was registered. I did that and all works fine. The pings came back... Thank you for your help. Michael

1 0

SuSEfirewall2 - problems with DMZ
by Michael Boettjer 14 Oct '02

14 Oct '02

Hi there, i use SuSEfirewall2 on a SuSE 7.2-Gateway. The Firewall has 3 Interfaces - one in direction of the internet (official IP), one to the inner-LAN (192.168.20.x) and one to the DMZ (192.168.70.x). The Computer in the DMZ (Webserver) has an internal IP-Adress (192.168.70.y), so i have to port-masquerade. The inner-LAN-Clients can reach the Webserver because i'm using the "FW_FORWARD"-Parameter in SuSEfirewall-Config-File. One of the entries is "192.168.20.0/24,192.168.70.10,tcp,80". All works fine. But now i want to add a second Server (Mail) to the DMZ. I added the appropriate entry to the FW-FORWARD-Parameter. I can ping the two Servers from the firewall succesful. But from an inner-LAN-Client i can only reach the Webserver, but not the Mailserver. Neither a ping works still a telnet to the SMTP-Port. The Firewall-Logs relative to DENYs or so what is empty. But why? When i add the Mailserver to the "FW_FORWARD_MASQ"-Parameter, i can reach the Box from the internet without problems. Thanks in advance for help. Michael

3 2

RE: [suse-security] RE: does anybody know such a log
by mailinglists＠belfin.ch 14 Oct '02

14 Oct '02

I checked at google.ch. There I got my rules from. The site you point to uses exactly the same rules (they must have copied from each other). But nevertheless the rules don't match the reality. I exended my iptables by these rules. I'm not sure whether they will pick up Code Red. I will have to wait until again some code red source knocks at my door. iptables -t nat -A PREROUTING -p 6 -s 0/0 -d $ip_waneth / --dport 80 -m string --string "/cmd.exe?" -j LOG --log-prefix CODE-RED iptables -t nat -A PREROUTING -p 6 -s 0/0 -d $ip_waneth / --dport 80 -m string --string "/cmd.exe?" -j DROP iptables -t nat -A PREROUTING -p 6 -s 0/0 -d $ip_waneth / --dport 80 -m string --string "/root.exe?" -j LOG --log-prefix CODE-RED iptables -t nat -A PREROUTING -p 6 -s 0/0 -d $ip_waneth / --dport 80 -m string --string "/root.exe?" -j DROP Because squid log looks like this: 217.219.177.228 TCP_MISS/503 1116 GET http://www/scripts/root.exe? - NONE/- - 217.219.177.228 TCP_MISS/503 1112 GET http://www/MSADC/root.exe? - NONE/- - 217.219.177.228 TCP_MISS/503 1132 GET http://www/c/winnt/system32/cmd.exe? - NONE/- - 217.219.177.228 TCP_MISS/503 1132 GET http://www/d/winnt/system32/cmd.exe? - NONE/- - This time an IP from Iran. Philipp > -----Original Message----- > From: Wolfgang Kueter [mailto:wolfgang@shconnect.de] > Sent: Saturday, October 12, 2002 12:03 AM > To: suse-security(a)suse.com > Subject: RE: [suse-security] RE: does anybody know such a log > > > On Fri, 11 Oct 2002 mailinglists(a)belfin.ch wrote: > > > snort 1.9.0 identified it as > > > > [**] WEB-IIS CodeRed v2 root.exe access [**] > > 10/11-22:26:06.822248 217.219.177.228:1803 -> my.ip.address:80 > > TCP TTL:112 TOS:0x0 ID:61416 IpLen:20 DgmLen:112 DF > > ***AP*** Seq: 0x1963F358 Ack: 0xE45FF7F5 Win: 0x4238 TcpLen: 20 > > > =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ > =+=+=+=+=+=+ > > > > iptables didn't pick that one up. Code Red came in using > cmd.exe. I had no > > rule for that. > > You probably used the article at: > > http://articles.linuxguru.net/view/125 > > as a guideline. Unfortunately the article gives an example of > 3 rules but > no further information about the pattern matching syntax. Has > anyone got a > link to the precise syntax of those those pattern matching stuff for > iptables? Anyway, I'll see what google will find ... > > Wolfgang > -- > shconnect Internet Service > web: http://www.shconnect.de EMail: info(a)shconnect.de > Bundesstrasse 2, 24392 Dollrottfeld, Fed. Rep. Germany > phone: +49 4641 644 > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

3 2

IPTABLES firewall - Windows Messenger (voice)
by Paul Kozlenko 13 Oct '02

13 Oct '02

All, I have my SuSE firewall box set up and it works fine. Except one function I haven't figured out. An internal uses wishes to use MSN Messenger - (voice chat). Micrsoft's web site mentions that UDP ports 5005-65535 are required to reach the internal machine. I believe this is set up properly in my POLICY rules. Still no luck. Does anyone have any suggestions? Paul

1 0

RE: [suse-security] does anybody know such a log
by mailinglists＠belfin.ch 13 Oct '02

13 Oct '02

Paul, thanks for the tip. it works now. somebody asked for cpu load. One open connection (I know, this is huge load) resulted in 10:53am up 15 days, 13:13, 3 users, load average: 0.00, 0.00, 0.00 Filtering the string "default.ida" I used telnet ip.address 80 typed in a string "dasisteinTest balbladefault.ida.battest" iptables: Oct 13 10:25:20 rproxy2 kernel: CODE-REDIN=eth1 OUT= MAC=00:a0:24:6a:d0:56:00:00:e8:e5:d9:9f:08:00 SRC=172.10.15.5 DST=172.10.15.6 LEN=88 TOS=0x10 PREC=0x00 TTL=64 ID=5569 DF PROTO=TCP SPT=2812 DPT=80 WINDOW=5840 RES=0x00 ACK PSH URGP=0 the rule now looks like: iptables -A INPUT -p 6 -s 0/0 -d $ip_waneth --dport 80 -m string --string "default.ida" -j LOG --log-prefix CODE-RED iptables -A INPUT -p 6 -s 0/0 -d $ip_waneth --dport 80 -m string --string "default.ida" -j DROP Philipp > -----Original Message----- > From: Paul Kozlenko [mailto:pkozlenko@rogers.com] > Sent: Sunday, October 13, 2002 4:25 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] does anybody know such a log > > > Philipp > Try looking at this web site: > http://online.securityfocus.com/infocus/1531 > It may fill in some blanks. > > - Paul > ----- Original Message ----- > From: <mailinglists(a)belfin.ch> > To: <suse-security(a)suse.com> > Sent: Saturday, October 12, 2002 3:06 PM > Subject: RE: [suse-security] does anybody know such a log > > > > > > > > > If there is a firewall (SuSE hopefully) between you and the > > > net. > > > > No, not Suse firewall. It's a Microsoft ISA server -- just > kidding. It's > > iptables. > > > > > You could > > > perhaps setup a rule that would look for Nimda's tell > tale striNNNNNg. > > > or code Red's .../winnt/system32..... and drop it. > > > > Yeah, right. Unfortunately mine don't work. I've got > > > > prefix = "iptables -t nat -A PREROUTING -p 6 -s 0/0 -d $ip_waneth / > > --dport 80 -m string --string" > > > > $prefix "/default.ida?" -j LOG --log-prefix CODE-RED > > $prefix "/default.ida?" -j DROP > > $prefix ".exe?/c+dir" -j LOG --log-prefix NIMDA > > $prefix ".exe?/c+dir" -j DROP > > $prefix ".exe?/c+tftp" -j LOG --log-prefix NIMDA > > $prefix ".exe?/c+tftp" -j DROP > > $prefix "/cmd.exe?" -j LOG --log-prefix CODE-RED > > $prefix "/cmd.exe?" -j DROP > > $prefix "/root.exe?" -j LOG --log-prefix CODE-RED > > $prefix "/root.exe?" -j DROP > > > > Have you got some that work? > > > > Philipp > > > > > ----- Original Message ----- > > > From: "Thomas Schweikle" <tschweikle(a)fiducia.de> > > > To: <suse-security(a)suse.com> > > > Sent: Saturday, October 12, 2002 3:23 PM > > > Subject: RE: [suse-security] does anybody know such a log > > > > > > > > > > > Yes I do. This is why it doesn't really bother me. I just > > > > > can't believe that there's still Nimda/Code Red infected > > > > > boxes out there. After more than one year. > > > > > > > > Unfortunately there are. And often newly installed boxes > > > out there do not > > > > incorporate the neccessary fixes to harden them against > > > Nimda/Code Red. > > > > Some admins don't apply these patches regulary... > > > > > > > > -- > > > > Thomas > > > > > > > > -- > > > > Check the headers for your unsubscription address > > > > For additional commands, e-mail: suse-security-help(a)suse.com > > > > Security-related bug reports go to security(a)suse.de, not here > > > > > > > > > > > > > -- > > > Check the headers for your unsubscription address > > > For additional commands, e-mail: suse-security-help(a)suse.com > > > Security-related bug reports go to security(a)suse.de, not here > > > > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

Fwd: Problem mit YOU und gpg
by Alexej Khalilzada 12 Oct '02

12 Oct '02

---------- Weitergeleitete Nachricht ---------- Subject: Problem mit YOU und gpg Date: Sat, 12 Oct 2002 22:28:49 +0200 From: Alexej Khalilzada <alexej.khalilzada(a)entracom.de> To: philipp(a)LA-Schmiedeknecht.de wie bekomme ich k-mail dazu meine mails zu verschlüsseln und warum bekomme ich beim YOU die Fehlermeldung "Fehler: Überprüfen der Signatur fehlgeschlagen" ------------------------------------------------------- -- Alexej Khalilzada Where do you want to be tomorrrow? ----------------------------------------------------- Entracom. Building Linux Systems.

1 0