October 2002 - openSUSE Security - openSUSE Mailing Lists

SuSE 8.1 & Firewall2
by Andreas Hallstein 25 Oct '02

25 Oct '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I recently installed SuSE 8.1 with SuSEFirewall2 using YAST2. I am using a ISDN dialup connction and have a second PC connected via eth0. When the firewall is up, nothing seems to work, ping etc. fails. Here is a part of the syslog from /var/log/messages (195.226.96.132 is the address of the DNS of my provider) - ----schnipp-------- Oct 24 19:55:15 gandalf kernel: SuSE-FW-ILLEGAL-TARGET IN=ippp0 OUT=MAC= SRC=195.226.96.132 DST=195.226.102.216 LEN=118 TOS=0x00 PREC=0x00 TTL=252ID=36333 DF PROTO=UDP SPT=53 DPT=1146 LEN=98 Oct 24 19:55:15 gandalf kernel: SuSE-FW-ILLEGAL-TARGET IN=ippp0 OUT=MAC= SRC=195.226.96.132 DST=195.226.102.216 LEN=124 TOS=0x00 PREC=0x00 TTL=252ID=36334 DF PROTO=UDP SPT=53 DPT=1147 LEN=104 - ----schnipp-------- Here are the settings of the SuSEfirewall2 config. file. I don't use any other services except for samba to grant access to the other (win98) PC FW_QUICKMODE="no" FW_DEV_EXT="ippp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="ext" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option - --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="YES" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" FW_CUSTOMRULES="" FW_REJECT="no" I think it's no big problem, maybe I'm just too blind to see the right setting in the list above. So I'd like to have the list take a look. Thanks a lot Andreas ahallstein(a)tesionmail.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iD8DBQE9uWMe5RlbrxDjpvMRApXKAJ90ee2nK21WJnCOrqeM87+VMakqlACgvgW+ YLYed1CsB1NgJVcit9X1xKI= =pp37 -----END PGP SIGNATURE-----

1 0

Security flaws in Kerberos implementations.
by Fred A. Miller 25 Oct '02

25 Oct '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 People running Kerberos should be aware of the recent remotely exploitable security flaws in kth-krb, Heimdal and MIT-krb5. At least one exploit already exists. http://www.pdc.kth.se/kth-krb/ http://www.pdc.kth.se/heimdal/ http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2002-002-kadm4.txt I assume SuSE will release a fix for Heimdal? Fred - -- Fred A. Miller Systems Administrator Cornell Univ. Press Services fm(a)cupserv.org, www.cupserv.org - --- SuSE Linux v8.0 Pro, KMail 1.4.3--- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Using GnuPG with Netscape - http://enigmail.mozdev.org iEYEARECAAYFAj25VoMACgkQB9vk4ichYXfO5wCcCe/MvrPVn50XkoUZ8Gye8XYy RlAAmwY7cyHKoEj7HlkqBXKoRurxV0G4 =nmWJ -----END PGP SIGNATURE-----

1 0

mounting a crypto fs gives write access to root only
by Jochen Staerk 25 Oct '02

25 Oct '02

Hi List, I have a crypto filesystem which looks as follows in the fstab: /dev/hda6 /sec reiserfs loop,enryption=twofish,noauto,user As in http://sdb.suse.de/de/sdb/html/jsj_crypto_filesystem_mini_howto.html, /sec lists as drwx------ jochen root ... unfortunately, mounting it will overwrite these settings. After a mount and entering my password /sec will list as drwxr-xr-x root root ... and consequently deny write access to all users except root. I tried some options i was used from FAT, like uid=500 oder umask=700 but the mount will fail with the german equivalent to "wrong file sytem type, invalid options, the superblock of /dev/loop0 is damaged or there are too many mounted filesystems". Has anybody got the right set of options for me? Or am i wrong somewhere else? thanks in advance, Jochen Stärk

2 1

Kerberos
by Joerg Henner 25 Oct '02

25 Oct '02

Hi, did anyone know, about SuSE had allready fixed this: http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2002-002-kadm4.txt Greetings, -- Jörg Henner Fon: +49 (7 11) 48 90 83 - 0 ETES - EDV-Systemhaus GbR Fax: +49 (7 11) 48 90 83 - 50 Libanonstrasse 58 A * D-70184 Stuttgart Web: http://www.etes.de ______________________________________ Inflex - eMail Scanning and Protection Queries to: postmaster(a)etes.de

3 2

Chroot or not for vsftpd
by Togan Muftuoglu 25 Oct '02

25 Oct '02

Hi, I am planning to install Vsftpd (vsftpd-1.1.0-3.i386.rpm) for SuSE 7.3 running SuSE compiled kernel 2.2.19. which will allow anonymous uploads also The machine has private IP and will be behind SuSE ftp-proxy. The default looks it needs to be run from inetd /xinetd. Here is what I have in mind a) run it as standalone b) use Marc Heuse's compartment to run it in a chroot environment c) use the ftpdir package of SuSE which is also in the chrooted environment where vsftd runs First of all is this overkill ? If not then I do not understand the following 1) The ftpdir package has passwd file (/usr/local/ftp/etc) root:x:0:0:Super User:/root:/bin/bash My understanding is it is now chrooted to "/usr/local/ftp" and since there is no "bash" under the bin directory what is the reasoning behind it. Why not use "false" and provide "false" executable under the bin directory ? 2) Why user root and not "ftp" for instance Thoughts, ideas appreciated Thanks -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx

3 4

AW: [suse-security] SuSE Firewall capabilities
by Ulrich Roth 25 Oct '02

25 Oct '02

> Just a quick question befor I dig into this to deep. Does > SuSE firewall2 allow for configuration for an external nic > that is set up with multiple alias? Yes, the firewall configuration accepts interfaces like eth0:1 or eth1:0 or eth2:2. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

network connections
by Dirk Borchers 25 Oct '02

25 Oct '02

hi to all, i just set a server with 8.1 pro. i have some problems with the network connection. the computer has two ethernet cards and an isdn card. one ethernet card goes straight up to the internal etwork, the other one is used for pppoe (default gw) and the isdn card is used for routing to specific servers. when booting and setting up the network devices i get the following messages: setting up network interfaces lo eth0 192.168.120.1/255.255.255.0 eth1 192.168.0.99/255.255.255.0 ippp0 dsl0 error: connection to smpppd failed (use --verbose for more information) ifup-dsl: interface dsl0 is not known by smpppd failed and (due to this, i think): starting firewall /sbin/SuSEfirewall2 line 687: test 192.168.120.22. integer expression expected iptables v1.2.7a: host/network 'ippp0' not found after booting can fix this with the following three lines: /etc/sysconfig/network/scripts/ifdown-ippp ippp0 /etc/sysconfig/network/scripts/ifup-dsl dsl0 /etc/sysconfig/network/scripts/ifup-ippp ippp0 another thing is that the computer looses the routing information from /etc/sysconfig/network/routes when the ippp0-connection gets closed. with /etc/sysconfig/network/scripts/ifup-route ippp0 the routing gets the state it should have. what went wrong with 8.1? -- Dirk Borchers ----------------------------------------------------- WebMen Internet GmbH Am Wall 196 - 28195 Bremen Tel.: (0421) 24 34 9-40 - Fax: (0421) 24 34 9-41 E-Mail: dirk.borchers(a)webmen.de -----------------------------------------------------

3 2

Two minded DNS-Server
by Ingo Doerrie 25 Oct '02

25 Oct '02

Hello! What is a "Two Minded DNS-Server"? Who can explain this to me and send a sample config for Bind8-DNS Server on SuSE 8.0? -- Freundliche Grüße kind regards Ingo

3 2

SuSE Firewall capabilities
by Chris Herrnberger 25 Oct '02

25 Oct '02

Greetings: Just a quick question befor I dig into this to deep. Does SuSE firewall2 allow for configuration for an external nic that is set up with multiple alias? Currently the webserver it needs to protect is using both virtual domains and virtual hosts whos IP need to be migrated to the external nic ot the proposed firewall. Best and thanks. /ch

2 1

Re: [suse-security] SuSE Security Announcement: postgresql (SuSE-SA:2002:038)
by Joerg Henner 24 Oct '02

24 Oct '02

On Don, 24 Okt 2002, Armin Schöch wrote: >> It makes no sense to me, to list "Pending vulnerabilities" within security >> announcements, but dont list then later anymore.... >> >--> It makes perfect sense to me: If they are not listed any more, >they are no longer "pending" but "resolved" and the update package is >there and can be picked up manually, by YOU or by fou4s And how do you realize that they are "no longer pending", while no new announcements are posted for a while ?? Another problem is/was the "fetchmail"-problem, which was listed, and later not anymore - but a fetchmail-update does'nt appear at YOU :( In all the cases, i preffer the way to publish the "pending"-list at www.suse.de - so we (and the rest of users/admins) can see comming/pending updates and published updates ... Greetings, -- Jörg Henner Fon: +49 (7 11) 48 90 83 - 0 ETES - EDV-Systemhaus GbR Fax: +49 (7 11) 48 90 83 - 50 Libanonstrasse 58 A * D-70184 Stuttgart Web: http://www.etes.de ______________________________________ Inflex - eMail Scanning and Protection Queries to: postmaster(a)etes.de

2 1