November 2002 - openSUSE Security - openSUSE Mailing Lists

SuSE Firewall on CD
by Guido Ganz 10 Nov '02

10 Nov '02

hello all i have the suse firewall on cd. i have a little problem. i can ping other systems in the internet direct from the firewall but not from any client. here is the message from /var/log/messages Nov 10 13:20:45 obelix kernel: forwarding_violation IN=eth1 OUT=eth0 SRC=192.168.20.10 DST=195.34.133.11 LEN=57 TOS=0x10 PREC=0x00 TTL=63 ID=1216 DF PROTO=UDP SPT=1029 DPT=53 LEN=37 why cant i ping systems in the internet form may client ? regards guido ganz

2 1

Re: [suse-security] Firewall2 and Masquerading
by Frank W.Kooistra 10 Nov '02

10 Nov '02

>>>>>>>>>>>>>>>>>> Original Message <<<<<<<<<<<<<<<<<< On 11/10/02, 3:46:04 PM, "Joe & Sesil Morris (NTM)" <Joe_Morris(a)ntm.org> wrote regarding Re: [suse-security] Firewall2 and Masquerading: > On 11/10/2002 10:23 PM, dave cunningham wrote: > > I'm afraid I don't quite follow. eth0 is my internal network which is > > using the linux box as an internet gateway. > Exactly. You external interface has (or gets) a public (internet > routeable) IP address. It doesn't need masqueraded. Your internal > network should have private, non-internet routeable IP addresses, so for > them to access the internet, their packets need masqueraded to a > routeable address. HTH. That was mu Initial reaction too but i checked my script because i did did not know what terminology is used exactly ( which device is masqueraded (INT:eth0) or is masquareded on (EXT, ippp0 clip from the conf script shows clearly ********************* start clip of /etc/sysconfig/SuSefirewall2 - suse 8.1 ****************** # # You must also define on which interface(s) to masquerade on. This is # normally your external device(s) to the internet. # Most users can leave the default below. # # e.g. "ippp0" or "$FW_DEV_EXT" FW_MASQ_DEV="$FW_DEV_EXT" ********************* end clip of /etc/sysconfig/SuSefirewall2 - suse 8.1 ****************** and than writing this i see that Dave is using suse 7.3 so dave probably the script gives you the answer == you say With Firewall2 active I cannot access the internet from this box (though masquerading appears to be functioning correctly as computers on the LAN can now use the gateway). Trying to ping www.suse.com from the firewall box gives this message in the firewall log " SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= SRC=195.112.4.7 DST=62.136.92.111 LEN=1 44 TOS=0x00 PREC=0x00 TTL=59 ID=12419 PROTO=UDP SPT=53 DPT=1090 LEN=124 SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= SRC=195.112.4.4 DST=62.136.92.111 LEN=1 " where 195.112.4.4 / 195.112.4.7 are my ISP's DNS servers (statically assigned) and 62.136.92.111 is the dynamic IP address that has been assigned by my ISP for the session. == What you see from the above is that the resution of the url www.suse.com (eg the ip adres) is not allowed in , so the Ip adres of suse is not resolved .. so i suggest play with routing DNS ( allow high etc DNS ? Regards Frank

3 4

Firewall2 and Masquerading
by dave cunningham 10 Nov '02

10 Nov '02

Apologies if this is off topic to the list. I am new to Linux and have spent the last few weeks seeking help using other avenues to no success. I have installed SuSE7.3 to a Linux box to act as router/firewall on a small network. The box uses a ISDN line (with dynamic IP address) for internet access. I have set this line up according to the SuSE network manual. With Firewall2 inactive I can access the internet with no problems from this box (though obviously computers on the LAN that are to use this box as an internet gateway cannot). With Firewall2 active I cannot access the internet from this box (though masquerading appears to be functioning correctly as computers on the LAN can now use the gateway). Trying to ping www.suse.com from the firewall box gives this message in the firewall log " SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= SRC=195.112.4.7 DST=62.136.92.111 LEN=1 44 TOS=0x00 PREC=0x00 TTL=59 ID=12419 PROTO=UDP SPT=53 DPT=1090 LEN=124 SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= SRC=195.112.4.4 DST=62.136.92.111 LEN=1 " where 195.112.4.4 / 195.112.4.7 are my ISP's DNS servers (statically assigned) and 62.136.92.111 is the dynamic IP address that has been assigned by my ISP for the session. Could anyone explain why this is occurring (i.e.. the dropping of outgoing connections made from the firewall box) and how I could correct it? My firewall config file is as follows: FW_DEV_EXT="ippp0" FW_DEV_INT="eth0" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="ippp0" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data" FW_ALLOW_INCOMING_HIGHPORTS_UDP="domain time ntp" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_LOG_DROP_CRIT="no" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" Many Thanks. -- Dave Cunningham PGP Key <http://www.upsilon.org.uk/dc.asc> -- Dave Cunningham PGP Key <http://www.upsilon.org.uk/dc.asc>

4 4

FW: [suse-security] SuSEfirewall 2 configuration (samba)
by Andre Vorster 10 Nov '02

10 Nov '02

Hi, I think you should look at samba, netbios broadcasts will not cross a router if you dont tell it to do so. So you will not see the workstations in the browselist. You should if you go to START - RUN ( Windows system ) type in \\ip-address\share get a response. But make sure that the ports are open on the firewall. Andre Vorster South Africa -----Original Message----- From: Matthias Schweinoch [mailto:matthias.schweinoch@epost.de] Sent: Saturday, November 09, 2002 1:21 PM To: suse-security(a)suse.com Subject: [suse-security] SuSEfirewall 2 configuration (samba) hi, i'm sorry if this is not on-topic (i'm not really sure... it's probably more of a networking than a security question, but it involves firewalls...:-)) i have a private network which has windows and linux machines in it (net A). one of the machines (R) is attached to another LAN (B), which also has internet access. R forwards traffic from all machines on net A to B with suse firewall 2. now net B also has some windows shares that i would like to access from any machine on net A. the question is: is it possible to configure suse firewall 2 such that the shares in net B are visible to machines in net A? my guess would be that R would have to get the windows shares information from net B ... but i'm not sure how the windows neighbourhood works. alternatively, is it possible to configure a samba server on R (visible to A and B), which also gets the windows shares information from B, so that machines on A can get to B through R's samba server? thanks for all the help! matthias -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

SuSEfirewall 2 configuration (samba)
by Matthias Schweinoch 09 Nov '02

09 Nov '02

hi, i'm sorry if this is not on-topic (i'm not really sure... it's probably more of a networking than a security question, but it involves firewalls...:-)) i have a private network which has windows and linux machines in it (net A). one of the machines (R) is attached to another LAN (B), which also has internet access. R forwards traffic from all machines on net A to B with suse firewall 2. now net B also has some windows shares that i would like to access from any machine on net A. the question is: is it possible to configure suse firewall 2 such that the shares in net B are visible to machines in net A? my guess would be that R would have to get the windows shares information from net B ... but i'm not sure how the windows neighbourhood works. alternatively, is it possible to configure a samba server on R (visible to A and B), which also gets the windows shares information from B, so that machines on A can get to B through R's samba server? thanks for all the help! matthias

2 1

When does NIS refresh the client's pwds?
by Christian Weickhmann 09 Nov '02

09 Nov '02

Hello! I've set up a NIS Server and Client. So far everything is fine... But when I change a user's PWD with yppasswd on the client machine or with passwd on the server, my client lets the user log in with the old password... Example: User "otto" correctly installed on nisserver // --- 8< --------------- nisclient login: otto password: oldpwd otto@nisclient: # yppasswd Changing NIS account information for otto on zion.rosbach.lan. Please enter old password: oldpwd Changing NIS password for otto on zion.rosbach.lan. Please enter new password: newpwd Please retype new password: newpwd The NIS password has been changed on zion.rosbach.lan. otto@nisclient: # exit nisclient login: otto password: newpwd login failed // ------ >8 ------------------ So actually I'm searching for a way to refresh the password and user information somehow in realtime. Thanks! Christian -- One of the lessons of history is that nothing is often a good thing to do and always a clever thing to say. -- Will Durant

2 1

Re: [suse-security] Adaptive Firewalls with IP Tables
by Thomas Lamy 09 Nov '02

09 Nov '02

Fred A. Miller [mailto:fm@cupserv.org] wrote: > > "What if we could tell the firewall to remember the IP > address of attackers > and block them for a short period of time following their > last attack? By > remembering their past actions, we can block incoming web > server connections > that would otherwise have been allowed." > > > <http://www.ists.dartmouth.edu/IRIA/knowledge_base/adaptive_firewalls.htm> I have a setup running in front of 2 mid-sized and 1 small LAN that does "adaptive" firewalling. The setup: - Snort (an IDS) is listening on the external interface - A (heavily hacked) perl script picks up snort's log file and parses it's alerts - checks destination IP against a list of IPs to be protected - checks source IP against a white list - if source is not whitelisted and destination is in protected list - "touch" source IP - adds source IP to blacklist (and runs a shell script) if new - remove timed out IPs from blacklist (and run a shell script) The perl script is based on "guardian.pl", a hack I found about 1 year ago writen by Anthony Stevens (astevens(a)chaotic.org) but was heavily modified since. I plan to do a rewrite, but since I'm moving now, that will have to wait until Jan 2003. If someone wants to pick up on this, I'm willing to create a sf.net project for this... Thomas

1 0

Adaptive Firewalls with IP Tables
by Fred A. Miller 08 Nov '02

08 Nov '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 'VERY interesting info., and I wonder if SuSE would consider adding this to firewall2? Fred "What if we could tell the firewall to remember the IP address of attackers and block them for a short period of time following their last attack? By remembering their past actions, we can block incoming web server connections that would otherwise have been allowed." <http://www.ists.dartmouth.edu/IRIA/knowledge_base/adaptive_firewalls.htm> - -- Fred A. Miller Systems Administrator Cornell Univ. Press Services fm(a)cupserv.org, www.cupserv.org - --- SuSE Linux v8.0 Pro, KMail 1.4.3--- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: Using GnuPG with Netscape - http://enigmail.mozdev.org iEYEARECAAYFAj3L/tYACgkQB9vk4ichYXcR1wCfbiIlccU/nuy0k2dGcJQknCxI ZRUAn3qN/vCk0Ibl/J4II/hMejVDahFK =hB1x -----END PGP SIGNATURE-----

5 4

Apache attack ?
by Bjoern Engels 08 Nov '02

08 Nov '02

Hi since yesterday httpd logfiles are filling with entries like these: [Thu Nov 7 01:05:03 2002] [error] [client 217.228.21.1] Invalid method in request \xe3D [Thu Nov 7 01:09:44 2002] [info] [client 213.196.194.164] read request line timed out [Thu Nov 7 01:10:49 2002] [info] [client 213.196.194.164] read request line timed out [Thu Nov 7 01:11:47 2002] [error] [client 217.5.71.230] Invalid method in request \xe3B [Thu Nov 7 01:12:42 2002] [error] [client 217.225.105.88] Invalid method in request \xe3A [Thu Nov 7 01:13:44 2002] [error] [client 217.225.105.88] Invalid method in request \xe3A [Thu Nov 7 10:01:28 2002] [error] [client 217.235.143.250] Invalid method in request \xe3D [Thu Nov 7 10:04:30 2002] [error] [client 66.74.222.39] File does not exist: /usr/local/www/htdocs/sumthin Does anybody have seen this before? I never saw the \x??? request stuff before. Maybe some kind of DoS attack / exploit attempt? Most of the clients have german IP addresses (T-Online), so I think it might be an attack targeted especially at my server. Bjoern

1 0

Re: [suse-security] SuseFirewall2 DMZ
by Thorsten Preuss 08 Nov '02

08 Nov '02

> route -n from web server > > Kernel IP routing table > Destination Gateway Genmask Flags Metric Ref Use Iface > 192.168.5.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 You need to set a default route to 192.168.5.1 on your webserver. use route add default gw 192.168.5.1 on the webserver to set the route for the session. for a permanent entry try to do this with yast or yast2. Thorsten

1 0

Re: [suse-security] SuseFirewall2 DMZ
by Frédéric Poulet 08 Nov '02

08 Nov '02

--- Thorsten Preuss <tp(a)thpr.net> a écrit : > Hello Frédéric, > > sorry for my mistake. > > of course the question should then be: > > > if not, can you reach it on the webserver itself > with e.g. wget http://192.168.5.2/ > > Thorsten > I see my webserver ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

4 9

SuseFirewall2 DMZ
by Frédéric Poulet 08 Nov '02

08 Nov '02

I don't again see my server web. My config is : WEB | | (ppp0-eth0) | FIREWALL-----(eth2:192.168.5.1)-------- WEB SERVER (apache) 192.168.5.2 | (eth1) 192.168.1.1 | | INTERN NETWORK 192.168.1.x Susefirwall file : # 1.) # 2.) FW_DEV_EXT="ppp0" # 3.) FW_DEV_INT="eth1" # 4.) FW_DEV_DMZ="eth2" # 5.) FW_ROUTE="yes" #6 FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" # 7.) FW_PROTECT_FROM_INTERNAL="yes" # 8.) FW_AUTOPROTECT_SERVICES="yes" # 9.) FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" # FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" # FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" # 10.) FW_TRUSTED_NETS="" # 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # 12.) FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" # 13.) FW_FORWARD="0/0,192.168.1.0/24" # 14.) FW_FORWARD_MASQ="0/0,192.168.5.2,tcp,80" # 15.) FW_REDIRECT="" # 16.) FW_LOG_DROP_CRIT="no" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" # 17.) FW_KERNEL_SECURITY="yes" # 18.) FW_STOP_KEEP_ROUTING_STATE="no" # 19.) FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="yes" ## # END of rc.firewall ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # # # 20.) # Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall. # This is used for traceroutes to your firewall (or traceroute like tools). # # Please note that the unix traceroute only works if you say "yes" to # FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say # additionally "yes" to FW_ALLOW_PING_FW # # Choice: "yes" or "no", defaults to "no" if not set. # FW_ALLOW_FW_TRACEROUTE="yes" # # 21.) # Allow ICMP sourcequench from your ISP? # # If set to yes, the firewall will notice when connection is choking, however # this opens yourself to a denial of service attack. Choose your poison. # # Choice: "yes" or "no", defaults to "yes" # FW_ALLOW_FW_SOURCEQUENCH="yes" # # 22.) # Allow/Ignore IP Broadcasts? # # If set to yes, the firewall will not filter broadcasts by default. # This is needed e.g. for Netbios/Samba, RIP, OSPF where the broadcast # option is used. # If you do not want to allow them however ignore the annoying log entries, # set FW_IGNORE_FW_BROADCAST to yes. # # Choice: "yes" or "no", defaults to "no" if not set. # FW_ALLOW_FW_BROADCAST="no" # FW_IGNORE_FW_BROADCAST="yes" # # 23.) # Allow same class routing per default? # REQUIRES: FW_ROUTE # # Do you want to allow routing between interfaces of the same class # (e.g. between all internet interfaces, or all internal network interfaces) # be default (so without the need setting up FW_FORWARD definitions)? # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_CLASS_ROUTING="no" # # 25.) # Do you want to load customary rules from a file? # # This is really an expert option. NO HELP WILL BE GIVEN FOR THIS! # READ THE EXAMPLE CUSTOMARY FILE AT /etc/sysconfig/scripts/SuSEfirewall2-custom # #FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom" I need help ! ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

5 17

Re: AW: [suse-security] SuseFirewall2 DMZ
by Frédéric Poulet 08 Nov '02

08 Nov '02

--- Ulrich Roth <Roth(a)impact.de> a écrit : > > WEB > > | > > | > > FIREWALL -eth2-eth3- WEB SERVER > > | > > | > > eth1 > > | > > INTERN NETWORK > > > > I set > > eth1 192.168.1.1 > > eth2 192.168.5.1 > > eth3 192.168.5.2 > By looking at this drawing, the following thoughts > come to me, without big thinking (so I apologize > if I am completely wrong): > Do I understand right that eth2 is on the firewall > and eth3 on the web server? Yes > Is the web server the only machine in the DMZ > and you connect eth2 and eth3 directly without > a hub or switch? > If so, you need a cross-over cable. I use a cross-over cable > Bye > Uli > -- > Ulrich Roth > IMPACT Business & Technology Consulting GmbH > Im Mediapark 8 / KölnTurm > D-50670 Koeln > Phone +49-221-93 70 80-29 > Fax +49-221-93 70 80-15 > E-Mail: roth(a)impact.de ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

1 0

AW: [suse-security] SuseFirewall2 DMZ
by Ulrich Roth 08 Nov '02

08 Nov '02

Hi Frederic, maybe there is some misunderstanding in this whole thread. What's the difference between server web and web server? In your drawing, your web server was in the DMZ. In one of your next postings, your "server web" (web server?) had an official IP address. If your firewall/router has this official IP address and forwards it to your web server in the DMZ, I think you won't be able to see the contents of your web server by typing "http://<official-IP>" in your browser on the computer in the intranet, if that was your question. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

Re: [suse-security] SuseFirewall2 DMZ
by Frédéric Poulet 08 Nov '02

08 Nov '02

WEB | | FIREWALL -eth2-eth3- WEB SERVER | | eth1 | INTERN NETWORK I set eth1 192.168.1.1 eth2 192.168.5.1 eth3 192.168.5.2 --- Chris FitzGerald <mersco(a)pandora.be> a écrit : > question : > > Do all your interfaces get an IP adress ? > > regards ... > > _____________________________________________ > Make money while you work !!! No surfing required! > http://www.degoo.com/index.php?refid=mersco > > This is for real !!! > ----- Original Message ----- > From: "Frédéric Poulet" <pofrederic(a)yahoo.fr> > To: <suse-security(a)suse.com> > Sent: Friday, November 08, 2002 4:59 PM > Subject: Re: [suse-security] SuseFirewall2 DMZ > > > > I don't see again my web server from internet ant from intern network. > > > > ___________________________________________________________ > > Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! > > Yahoo! Mail : http://fr.mail.yahoo.com > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > > > ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

1 0

Re: [suse-security] SuseFirewall2 DMZ
by Thomas Sjögren 08 Nov '02

08 Nov '02

On Friday 08 November 2002 15:45, Frédéric Poulet wrote: > if my public ip is 193.252.183.24 and i select URL > http://193.252.183.24 in explore i must see my server web ? if it's listening on port 80, yes. /Thomas -- thomas(a)se.linux.org thomas(a)northernsecurity.net

1 0

AW: [suse-security] screen locking
by Ulrich Roth 08 Nov '02

08 Nov '02

> But on the new suse 8.1, it has a button "start new session", > which if a student pressed would allow them to re-logon > using their passwords. This would log me out, which > is annoying rather than destructive. > While i would easily be able to discover who did this, id > rather just not have that button. is there an easy way > of disabling it? I don't know how to disable it, but you may enter "xlock" at the command prompt. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

screen locking
by Elfed Lewis 08 Nov '02

08 Nov '02

Guys, I work in a college enviroment where students occasionaly enter my room when im not in to see other staff. This means i need to be able to properly lock my machine using the "lock the desktop" icon to stop others using it. But on the new suse 8.1, it has a button "start new session", which if a student pressed would allow them to re-logon using their passwords. This would log me out, which is annoying rather than destructive. While i would easily be able to discover who did this, id rather just not have that button. is there an easy way of disabling it? cheers, Elf.

2 1

Fw: [SLE] Bind9
by Chris FitzGerald 08 Nov '02

08 Nov '02

Hi All Sorry to post this here as it is off-topic ... but haven't got an answer yet in SLE. And this is quite an urgent matter ... Thanks ----- Original Message ----- From: "Chris FitzGerald" <mersco(a)pandora.be> To: <suse-linux-e(a)suse.com> Sent: Friday, November 08, 2002 11:32 AM Subject: [SLE] Bind9 Hi All, Just to make sure, If i fill in this in named.conf : forward { DNS1; DNS2; }; forward only; where DNS1 and DNS2 are the DNS servers of my ISP, Will I then have a caching DNS server forwarding unknown queries to my ISP's DNS and then updating its cache? Also If I surf to a dynamic DNS and after it has been cached by Bind and the Ip address changes of the Dyanic site, will my cache be updated too ? Do I have to set up a DNS check timer or something everytime a request is made ? Thanks Chris F. Datacenter Supervisor Belgium. _____________________________________________ Make money while you work !!! http://www.degoo.com/index.php?refid=mersco This is for real !!!

2 1

Postfix 1.11 in 8.1
by Hoerst Gerd 08 Nov '02

08 Nov '02

Hi there ! With postfix i have 2 problems 1st is when i did a relay check via mail.abuse.org (afair) at the last check (sender spec. Routing) postfix fails, but the message will be bounced internal but only because of invalid characters 2nd if i specify /[%!@].*[%!@]/ REJECT 550 Sender-specified routing rejected in header_check (exact like example in regexpr_table) => Postfix throw out all mail of e.g. the suse-linux mailing list. Ciao Gerd Gerd Hoerst Department Electrical Engineering TAKATA-PETRI AG Bahnweg 1 D-63743 Aschaffenburg Phone: +49-6021-65-1225 Mobile: +49-171-9781446 Fax: +49-6021-65-1119 e-mail: gerd.hoerst(a)eu.takata.com

1 0

Administrativa: Loop problems
by Roman Drahtmueller 08 Nov '02

08 Nov '02

Hi paranoids, it looks like we have a looping problem on suse-security(a)suse.com: Someone with a braindead mail delivery system, most likely a maildrop mailbox setup, is re-queueing mails delivered via lists.suse.com to suse-security@ to the recipient in the header. This means that the mail is being sent back to the list because that crappy software can't find out that it is supposed to deliver the mail locally. So if you're seeing mails twice or more times, you know what's happening. If you take a closer look at the headers, you will see that some SuSE email server is one of the hops. That one isn't guilty, it's one of the following hops. :-) We have to have an eye on it, trying to eliminate the problem. The header of the mail doesn't clearly reveal the culprit, so we will have to send some test mails sooner or later to single subscribers. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

3 3

Samba-vscan and Kaspersky
by Alex Levit 08 Nov '02

08 Nov '02

-----BEGIN PGP SIGNED MESSAGE----- If somebody got it running on their system maybe you can share some info. I am using SuSE 8.1 Samba 2.2.5 samba-vscan 0.2.5d All packages are default packages from SuSE. Kaspersky Version 4.0.1.0 I am using kaspersky vfs module for samba, and I ran in to some problems, hope you can put me on the right track. Here is samba log output. Samba runs fine without vfs. When vfs is turned on I can't open the share [2002/11/07 09:06:27, 0] smbd/vfs.c:vfs_init_custom(142) Error opening /usr/lib/samba/vscan-kavp.so: /usr/lib/samba/vscan-kavp.so: undefined symbol: KAVResponse [2002/11/07 09:06:27, 0] smbd/vfs.c:smbd_vfs_init(187) smbd_vfs_init: vfs_init_custom failed [2002/11/07 09:06:27, 0] smbd/service.c:make_connection(544) smbd_vfs_init failed for service user part of my smb.conf [homes] comment = Home Directories valid users = %S browseable = no writeable = yes create mask = 0640 directory mask = 0750 vfs object = /usr/lib/samba/vscan-kavp.so - -- Alex Levit Senior Network Engineer Kel-Tek Inc. TEL: 626-571-6927 FAX: 626-571-8794 'Alex(a)kel-tek.com' -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQDVAwUBPcqLCOCcv2bLcfmfAQGjQAX8D5CLcqdbk8OfGflKsVVpXQWHaJgt4wQV xrbdR10+G8keAsgljLcBOwC0RwxjecYxm6W347U3UFXkomJBbJffSPXXlv/0JbOw R8IYzUyvfo/gVwIPNdrvtTOPGwzHmNy+dy3jNEvgHX6MBg6VNj26joPNxv5yMYzx ZEZ1vB/Hhd7SYtUxjtkgmwL8f2Z1Xo2Z+EKdKqiblLSaquu6qTcuua/NAfrI03bS tiZVQ95d5u94H8ZtpGx24ReRu7HRXcf8 =WNi3 -----END PGP SIGNATURE-----

2 1

SuseFirewall DMZ
by Frédéric Poulet 08 Nov '02

08 Nov '02

I don't see my web server from internet and from internal network. I don't see my erros. My system : WEB | | (ppp0-eth0) | FIREWALL-----(eth2:192.168.5.0)-------- WEB SERVER (apache) 192.168.5.2 | (eth1) 192.168.1.0 | | INTERN NETWORK 192.168.1.x My SuseFirewall2 file : # 1.) # 2.) FW_DEV_EXT="ppp0" # 3.) FW_DEV_INT="eth1" # 4.) FW_DEV_DMZ="eth2" # 5.) FW_ROUTE="yes" #6 FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24 192.168.5.2/32" # 7.) FW_PROTECT_FROM_INTERNAL="yes" # 8.) FW_AUTOPROTECT_SERVICES="yes" # 9.) FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" # FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" # FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" # 10.) FW_TRUSTED_NETS="" # 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # 12.) FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" # 13.) FW_FORWARD="0/0,192.168.5.2/32,tcp,80 192.168.1.0/24,192.168.5.2/32,tcp,80" # 14.) FW_FORWARD_MASQ="0/0,192.168.5.2,tcp,80" # 15.) FW_REDIRECT="" # 16.) FW_LOG_DROP_CRIT="no" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" # 17.) FW_KERNEL_SECURITY="yes" # 18.) FW_STOP_KEEP_ROUTING_STATE="no" # 19.) FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="yes" ## # END of rc.firewall ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # # # 20.) # Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall. # This is used for traceroutes to your firewall (or traceroute like tools). # # Please note that the unix traceroute only works if you say "yes" to # FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say # additionally "yes" to FW_ALLOW_PING_FW # # Choice: "yes" or "no", defaults to "no" if not set. # FW_ALLOW_FW_TRACEROUTE="yes" # # 21.) # Allow ICMP sourcequench from your ISP? # # If set to yes, the firewall will notice when connection is choking, however # this opens yourself to a denial of service attack. Choose your poison. # # Choice: "yes" or "no", defaults to "yes" # FW_ALLOW_FW_SOURCEQUENCH="yes" # # 22.) # Allow/Ignore IP Broadcasts? # # If set to yes, the firewall will not filter broadcasts by default. # This is needed e.g. for Netbios/Samba, RIP, OSPF where the broadcast # option is used. # If you do not want to allow them however ignore the annoying log entries, # set FW_IGNORE_FW_BROADCAST to yes. # # Choice: "yes" or "no", defaults to "no" if not set. # FW_ALLOW_FW_BROADCAST="no" # FW_IGNORE_FW_BROADCAST="yes" # # 23.) # Allow same class routing per default? # REQUIRES: FW_ROUTE # # Do you want to allow routing between interfaces of the same class # (e.g. between all internet interfaces, or all internal network interfaces) # be default (so without the need setting up FW_FORWARD definitions)? # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_CLASS_ROUTING="no" # # 25.) # Do you want to load customary rules from a file? # # This is really an expert option. NO HELP WILL BE GIVEN FOR THIS! # READ THE EXAMPLE CUSTOMARY FILE AT /etc/sysconfig/scripts/SuSEfirewall2-custom # #FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom" Help ! ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

4 3

SuSEfirewall start scripts
by Chris FitzGerald 08 Nov '02

08 Nov '02

Hi all, I have my firewall up and running thanks to the firewall2.pdf i found in the list a few days ago ;) But I still have a question : When I boot the box it has: firewall step 1 initialization some services firewall step 2 setup some other services firewall step 3 final named,squid service I get the message : WARNING : NO DNS RUNNING, SQUIDSERVER RUNNING ALTHOUGH STATED IN SuSEfirewall2 file. off course this is normal because they only start up AFTER the final script. So I looked in my folders and did this : I believe the firewall had : S11 or something like that and the named and squid this : S13Named S18Squid So I altered the numbers to 10 for both of them. right after Squid starts up the third script of the firewall runs and still tells me there is no squid server running althoughj stated in configfile. Questions I had : 1. Is it safe to change the startup sequence like that for security reasons ? 2. If the script is parsed and doesn't find the servers, are the ports then open or are they closed out of security and do they stay closed ? 3. Can I safely put SuSEfirewall2_final to S99 ? Thanks in advance regards Chris FitzGerald Datacenter Supervisor Belgium

2 2

Re: [suse-security] SuSEfirewall start scripts
by Chris FitzGerald 08 Nov '02

08 Nov '02

wow quick reply ;) Well out of these 2 mails I know what to do ;) 1. I'll put the Firewall step 3 script at S99 2. Update the SuSEfirewall2 config file 3. put squid somewhere in the beginning S09 or S10 for runlevels 3 and 5 I assume the Kxx-scripts can be left untouched ? ;)) As for the ippp0, handy thing to know about. but luckely i am on cable for the moment and just need the DHCP offer from the ISP, so no dial-ups ;) Thanks Again! Regards Chris ----- Original Message ----- Hi ! I tried it with linking the start script of the final firewall setup to s99 (then ist really started last) and the script doesn't complain about the missing services, it still complain about the missing interface ippp0 because with 8.1 SuSe does not set a host route to the interface (they set only a defaultroute if you use dial on demand) and afair in SuSE 8.0 the fianl firewall script was executed last on startup.. (so i guess that can't be wrong) Take a look at /var/log/messages and you can see how long the real init of squid takes (i guess it takes longer than " starting www-proxy squid done" appears on the display, and when you start the final firewall setup, squid ist still not really up. I read about another solution => uses the firewall of 8.0 :-) At home i tried to setup fwbuilder (www.fwbuilder.org) but i think it takes years (for me) to have a clue about this program :-) Ciao Gerd Hoerst Department Electrical Engineering TAKATA-PETRI AG Bahnweg 1 D-63743 Aschaffenburg Phone: +49-6021-65-1225 Mobile: +49-171-9781446 Fax: +49-6021-65-1119 e-mail: gerd.hoerst(a)eu.takata.com ----- Original Message ----- From: "Andreas Paffrath" <mail(a)andreas-paffrath.com> To: "Chris FitzGerald" <mersco(a)pandora.be> Sent: Friday, November 08, 2002 9:54 AM Subject: Re: [suse-security] SuSEfirewall start scripts > hi again > You might want to change the entries in the firewall configuration file. It > should have the appropriate settings for the proper ports and protocols. > However, I am just working on that myself, since I get the same messages. > Nevertheless, nothing to worry so far, the firewall should work properly > anyway, > > andreas > > > ----- Original Message ----- > From: Chris FitzGerald <mersco(a)pandora.be> > To: <suse-security(a)suse.com> > Sent: Friday, November 08, 2002 9:38 AM > Subject: [suse-security] SuSEfirewall start scripts > > > Hi all, > > I have my firewall up and running thanks to the firewall2.pdf i found in the > list a few days ago ;) > > But I still have a question : > > When I boot the box > it has: > > firewall step 1 initialization > some services > firewall step 2 setup > some other services > firewall step 3 final > named,squid service > > > I get the message : WARNING : NO DNS RUNNING, SQUIDSERVER RUNNING ALTHOUGH > STATED IN SuSEfirewall2 file. > > off course this is normal because they only start up AFTER the final script. > > So I looked in my folders and did this : > > I believe the firewall had : S11 or something like that > and the named and squid this : > > S13Named > S18Squid > > So I altered the numbers to 10 for both of them. > right after Squid starts up the third script of the firewall runs and still > tells me there is no squid server running althoughj stated in configfile. > > Questions I had : > > 1. Is it safe to change the startup sequence like that for security reasons > ? > 2. If the script is parsed and doesn't find the servers, are the ports then > open or are they closed out of security and do they stay closed ? > 3. Can I safely put SuSEfirewall2_final to S99 ? > > Thanks in advance > > regards > > > Chris FitzGerald > Datacenter Supervisor > Belgium > > >

1 0