October 2002 - openSUSE Security - openSUSE Mailing Lists

SuSEFirewall2, IPSec -> SuSE-FW-UNALLOWED-TARGETIN
by Maik Ellinger 20 Oct '02

20 Oct '02

Hello, I've a little problem with denied packets if I use SuSEfirewall2 for protecting the VPN-Gateway. I get messages like this if I ping (or try to get a other connection like ssh) to a System in the internal Network through the ipsec tunnel: Oct 20 20:13:16 gigant kernel: SuSE-FW-UNALLOWED-TARGETIN=ipsec0 OUT= MAC=00:05:5d:0a:93:00:00:09:5b:24:3e:67:08:00 SRC=192.168.2.2 DST=192.168.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=25665 SEQ=1280 192.168.1.0/24 is the internal network which should be accessed from the Roadwarriors through ipsec from all other networks (in this test-case the roadwarrior is 192.168.2.2). My SuSEfirewall2 setup : FW_DEV_INT="eth0" # 192.168.1.0/24 FW_DEV_DMZ="eth1 ipsec0" # 192.168.2.0/24 FW_ROUTE="yes" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="500" FW_SERVICES_DMZ_IP="50 51" FW_FORWARD="192.168.1.0/24,192.168.2.0/24 192.168.2.0/24,192.168.1.0/24" Without the firewall all works fine. Can someone see my mistakes ? With the iptables-rules I can start the ipsec-tunnel and I can ping the IP (192.168.2.1) of the ipsec-Gateway. And all what I see are ESP-packets on the wire .. so I think the tunnel is ok. thanks a lot, -mael -- email: mael(a)m-ellinger.de -> www: http://www.m-ellinger.de GPG-Key: http://www.m-ellinger.de/output/mael.gpg Mitglied der Zwickau Linux User Group zLUG e.V. http://www.zlug.org

1 0

h232 over FW?
by Pep Serrano 20 Oct '02

20 Oct '02

Hi, Anybody using any h323 client over firewall? What ports do you need to open?

1 0

Online Test to check Suse-Firewall
by Al Bogner 20 Oct '02

20 Oct '02

Are tests at http://grc.com/ or at http://scan.sygatetech.com/ reliable to check the configuration of the Suse-firewall? Can you recommend other online-tests? Albert

3 2

harden_suse not maintained anymore?
by Richard Ems 19 Oct '02

19 Oct '02

Hi list! Is harden_suse not maintained anymore? >From the SuSE Linux 8.1 distro: # head /usr/share/doc/packages/harden_suse/CHANGES v3.5 12.06.01 (gamma release) * f*ck, I missed a / ... thanks to matthew(a)psychohorse.com for reporting v3.4 10.06.01 (gamma release) * wont disable some special SuSE 7.2 stuff: CRYPTO_FILESYSTEMS IDLED, POWERTWEAKD, PPTPD, IJB, IPPL, ARGUS, etc. v3.3 06.05.01 (gamma release) * wont disable SNORT, ADSL, NESSUSD and many many other things now which either do not affect security or are security daemons AND from /usr/lib/harden_suse/harden_suse-3.5.pl line 4: # Harden SuSE Linux 6.0 - 7.2, Perl Script by Marc Heuse <marc(a)suse.de> # line 38: $MAX_SUSE_VERSION="7.2"; lines 67-73: if ($suse_version > $MAX_SUSE_VERSION) { print STDERR "\007 WARNING: You seemed to have installed a SuSE version which is not yet supported by this hardening script! (Verified to work with 5.3 up to $MAX_SUSE_VERSION) Try to get an update from ftp://ftp.suse.com or http://www.suse.de/~marc ... Use at own risk!\n" } >From all this I conclude that it is not maintained anymore? I used it to build a firewall and would like to use it again when reinstalling it, but ... Is Marc Heuse not working anymore at SuSE? Is anyone maintaining his scripts? At http://www.suse.de/~marc/SuSE.html the last updated script is from the 8th January 2002! No errors/corrections/todo's anymore? Thanks for any info's, Richard -- Richard Ems ... e-mail: r.ems(a)gmx.net ... Computer Science, University of Hamburg Unix IS user friendly. It's just selective about who its friends are.

2 1

New TCP-stack-exploit a hoax
by GentooRulez 18 Oct '02

18 Oct '02

What do you think about the new tcp-stack exploit abfrag.c. Just true or only a hoax ?? best regards Michael

4 3

Re: [suse-security] New TCP-stack-exploit a hoax
by GentooRulez 18 Oct '02

18 Oct '02

>> Thats not what a asked. Assuming conn-track works fine and my >> ip-filter decides to drop the package. When will this take place ? >> Before defragmenting packet or with defragmented packets,. The >> last case means such an exploit would work. >Thats more than theoretical. If you do not know where the >bug is (if there is one) then why making the assumption >that part X is safe? Simply because not the netfilter code was adressed to be buggy, but the tcp "stack" implementaion. >It will probably only put you into wrong feeling of security if such a >bug really exists. No, dont think so. That is why i asked that theoretical question which is not answered until know. Will netfilter block such kind of packets when a attacker tries to root my box ??? Or is a malicious packets handled by the kernel before netfilter comes to inspect them ??? >Who tells that such a fragmented packet does not belong to a connection >at all? :) If you have a public webserver I guess its easy to have fragmented >packets for a tracked connection. This is another possibility to get infected, but it doesnt affect e.g. vpn router. >Anyway, its probably not necessary to discuss that if noone >knows any details. Dont think so. Its always good to talk about. GTIF Michael

1 0

Re: [suse-security] New TCP-stack-exploit a hoax
by GentooRulez 18 Oct '02

18 Oct '02

>> BTW. If i've a stateful inspection of my ip-packets and drop >> all packets not related to a connection i established such fragmented >> packets mentioned should not care me ?!? OR am i FALSE ?? >Why? Connection-tracking could be buggy too? ;-) Thats not what a asked. Assuming conn-track works fine and my ip-filter decides to drop the package. When will this take place ? Before defragmenting packet or with defragmented packets,. The last case means such an exploit would work. greetingz Michael

2 1

Re: [suse-security] New TCP-stack-exploit a hoax
by GentooRulez 18 Oct '02

18 Oct '02

>currently i belive its just a hoax, if you see the discussion >on bugtraq, the exploit shows that it works until kernel 2.4.20pre2x >which is far away from the actually relased develkernel (2.4.20pre11). >If not we've maybe a big problem ;) That can be a typo. BTW. If i've a stateful inspection of my ip-packets and drop all packets not related to a connection i established such fragmented packets mentioned should not care me ?!? OR am i FALSE ?? Michael

2 1

Sec. Update of KDE
by matthias-wieser＠t-online.de 17 Oct '02

17 Oct '02

Hi, are there any Suse advisories for KPF (part of KDE3) and kghostview? KDE recommends an update to KDE 3.0.4. At http://www.suse.de/de/private/download/updates/81_i386.html (I use Suse 8.1) and within YOU I could not find an update of KDE. Any advice? Matthias

11 16

RE: [suse-security] public key encryption
by Reckhard, Tobias 17 Oct '02

17 Oct '02

> I am wondering if people would comment on a security > configuration where a > PGP public key and private key are both well known, but the > private key is > protected with a very strong passphrase. Let's assume that > in this case, > that is the only security I can guarantee. How safe would messages > encrypted with the public key be? The maximum strength is determined by the passphrase. Weaknesses in the private key file format or other things could well lower the strength of the private key's secrecy. For a provocative question, define "a very strong passphrase". Why is the secret key in the hands of someone who mustn't have it? Is this party the root user? Tobias

6 5