November 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] SuseFirewall2 DMZ
by Thomas Sjögren 08 Nov '02

08 Nov '02

On Friday 08 November 2002 15:45, Frédéric Poulet wrote: > if my public ip is 193.252.183.24 and i select URL > http://193.252.183.24 in explore i must see my server web ? if it's listening on port 80, yes. /Thomas -- thomas(a)se.linux.org thomas(a)northernsecurity.net

1 0

AW: [suse-security] screen locking
by Ulrich Roth 08 Nov '02

08 Nov '02

> But on the new suse 8.1, it has a button "start new session", > which if a student pressed would allow them to re-logon > using their passwords. This would log me out, which > is annoying rather than destructive. > While i would easily be able to discover who did this, id > rather just not have that button. is there an easy way > of disabling it? I don't know how to disable it, but you may enter "xlock" at the command prompt. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

screen locking
by Elfed Lewis 08 Nov '02

08 Nov '02

Guys, I work in a college enviroment where students occasionaly enter my room when im not in to see other staff. This means i need to be able to properly lock my machine using the "lock the desktop" icon to stop others using it. But on the new suse 8.1, it has a button "start new session", which if a student pressed would allow them to re-logon using their passwords. This would log me out, which is annoying rather than destructive. While i would easily be able to discover who did this, id rather just not have that button. is there an easy way of disabling it? cheers, Elf.

2 1

Fw: [SLE] Bind9
by Chris FitzGerald 08 Nov '02

08 Nov '02

Hi All Sorry to post this here as it is off-topic ... but haven't got an answer yet in SLE. And this is quite an urgent matter ... Thanks ----- Original Message ----- From: "Chris FitzGerald" <mersco(a)pandora.be> To: <suse-linux-e(a)suse.com> Sent: Friday, November 08, 2002 11:32 AM Subject: [SLE] Bind9 Hi All, Just to make sure, If i fill in this in named.conf : forward { DNS1; DNS2; }; forward only; where DNS1 and DNS2 are the DNS servers of my ISP, Will I then have a caching DNS server forwarding unknown queries to my ISP's DNS and then updating its cache? Also If I surf to a dynamic DNS and after it has been cached by Bind and the Ip address changes of the Dyanic site, will my cache be updated too ? Do I have to set up a DNS check timer or something everytime a request is made ? Thanks Chris F. Datacenter Supervisor Belgium. _____________________________________________ Make money while you work !!! http://www.degoo.com/index.php?refid=mersco This is for real !!!

2 1

Postfix 1.11 in 8.1
by Hoerst Gerd 08 Nov '02

08 Nov '02

Hi there ! With postfix i have 2 problems 1st is when i did a relay check via mail.abuse.org (afair) at the last check (sender spec. Routing) postfix fails, but the message will be bounced internal but only because of invalid characters 2nd if i specify /[%!@].*[%!@]/ REJECT 550 Sender-specified routing rejected in header_check (exact like example in regexpr_table) => Postfix throw out all mail of e.g. the suse-linux mailing list. Ciao Gerd Gerd Hoerst Department Electrical Engineering TAKATA-PETRI AG Bahnweg 1 D-63743 Aschaffenburg Phone: +49-6021-65-1225 Mobile: +49-171-9781446 Fax: +49-6021-65-1119 e-mail: gerd.hoerst(a)eu.takata.com

1 0

Administrativa: Loop problems
by Roman Drahtmueller 08 Nov '02

08 Nov '02

Hi paranoids, it looks like we have a looping problem on suse-security(a)suse.com: Someone with a braindead mail delivery system, most likely a maildrop mailbox setup, is re-queueing mails delivered via lists.suse.com to suse-security@ to the recipient in the header. This means that the mail is being sent back to the list because that crappy software can't find out that it is supposed to deliver the mail locally. So if you're seeing mails twice or more times, you know what's happening. If you take a closer look at the headers, you will see that some SuSE email server is one of the hops. That one isn't guilty, it's one of the following hops. :-) We have to have an eye on it, trying to eliminate the problem. The header of the mail doesn't clearly reveal the culprit, so we will have to send some test mails sooner or later to single subscribers. Thanks, Roman. -- - - | Roman Drahtmüller <draht(a)suse.de> // "You don't need eyes to see, | SuSE Linux AG - Security Phone: // you need vision!" | Nürnberg, Germany +49-911-740530 // Maxi Jazz, Faithless | - -

3 3

Samba-vscan and Kaspersky
by Alex Levit 08 Nov '02

08 Nov '02

-----BEGIN PGP SIGNED MESSAGE----- If somebody got it running on their system maybe you can share some info. I am using SuSE 8.1 Samba 2.2.5 samba-vscan 0.2.5d All packages are default packages from SuSE. Kaspersky Version 4.0.1.0 I am using kaspersky vfs module for samba, and I ran in to some problems, hope you can put me on the right track. Here is samba log output. Samba runs fine without vfs. When vfs is turned on I can't open the share [2002/11/07 09:06:27, 0] smbd/vfs.c:vfs_init_custom(142) Error opening /usr/lib/samba/vscan-kavp.so: /usr/lib/samba/vscan-kavp.so: undefined symbol: KAVResponse [2002/11/07 09:06:27, 0] smbd/vfs.c:smbd_vfs_init(187) smbd_vfs_init: vfs_init_custom failed [2002/11/07 09:06:27, 0] smbd/service.c:make_connection(544) smbd_vfs_init failed for service user part of my smb.conf [homes] comment = Home Directories valid users = %S browseable = no writeable = yes create mask = 0640 directory mask = 0750 vfs object = /usr/lib/samba/vscan-kavp.so - -- Alex Levit Senior Network Engineer Kel-Tek Inc. TEL: 626-571-6927 FAX: 626-571-8794 'Alex(a)kel-tek.com' -----BEGIN PGP SIGNATURE----- Version: 2.6.3in Charset: noconv iQDVAwUBPcqLCOCcv2bLcfmfAQGjQAX8D5CLcqdbk8OfGflKsVVpXQWHaJgt4wQV xrbdR10+G8keAsgljLcBOwC0RwxjecYxm6W347U3UFXkomJBbJffSPXXlv/0JbOw R8IYzUyvfo/gVwIPNdrvtTOPGwzHmNy+dy3jNEvgHX6MBg6VNj26joPNxv5yMYzx ZEZ1vB/Hhd7SYtUxjtkgmwL8f2Z1Xo2Z+EKdKqiblLSaquu6qTcuua/NAfrI03bS tiZVQ95d5u94H8ZtpGx24ReRu7HRXcf8 =WNi3 -----END PGP SIGNATURE-----

2 1

SuseFirewall DMZ
by Frédéric Poulet 08 Nov '02

08 Nov '02

I don't see my web server from internet and from internal network. I don't see my erros. My system : WEB | | (ppp0-eth0) | FIREWALL-----(eth2:192.168.5.0)-------- WEB SERVER (apache) 192.168.5.2 | (eth1) 192.168.1.0 | | INTERN NETWORK 192.168.1.x My SuseFirewall2 file : # 1.) # 2.) FW_DEV_EXT="ppp0" # 3.) FW_DEV_INT="eth1" # 4.) FW_DEV_DMZ="eth2" # 5.) FW_ROUTE="yes" #6 FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24 192.168.5.2/32" # 7.) FW_PROTECT_FROM_INTERNAL="yes" # 8.) FW_AUTOPROTECT_SERVICES="yes" # 9.) FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" # FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" # FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" # 10.) FW_TRUSTED_NETS="" # 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" # 12.) FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" # 13.) FW_FORWARD="0/0,192.168.5.2/32,tcp,80 192.168.1.0/24,192.168.5.2/32,tcp,80" # 14.) FW_FORWARD_MASQ="0/0,192.168.5.2,tcp,80" # 15.) FW_REDIRECT="" # 16.) FW_LOG_DROP_CRIT="no" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" # 17.) FW_KERNEL_SECURITY="yes" # 18.) FW_STOP_KEEP_ROUTING_STATE="no" # 19.) FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="yes" ## # END of rc.firewall ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # # # 20.) # Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall. # This is used for traceroutes to your firewall (or traceroute like tools). # # Please note that the unix traceroute only works if you say "yes" to # FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say # additionally "yes" to FW_ALLOW_PING_FW # # Choice: "yes" or "no", defaults to "no" if not set. # FW_ALLOW_FW_TRACEROUTE="yes" # # 21.) # Allow ICMP sourcequench from your ISP? # # If set to yes, the firewall will notice when connection is choking, however # this opens yourself to a denial of service attack. Choose your poison. # # Choice: "yes" or "no", defaults to "yes" # FW_ALLOW_FW_SOURCEQUENCH="yes" # # 22.) # Allow/Ignore IP Broadcasts? # # If set to yes, the firewall will not filter broadcasts by default. # This is needed e.g. for Netbios/Samba, RIP, OSPF where the broadcast # option is used. # If you do not want to allow them however ignore the annoying log entries, # set FW_IGNORE_FW_BROADCAST to yes. # # Choice: "yes" or "no", defaults to "no" if not set. # FW_ALLOW_FW_BROADCAST="no" # FW_IGNORE_FW_BROADCAST="yes" # # 23.) # Allow same class routing per default? # REQUIRES: FW_ROUTE # # Do you want to allow routing between interfaces of the same class # (e.g. between all internet interfaces, or all internal network interfaces) # be default (so without the need setting up FW_FORWARD definitions)? # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_CLASS_ROUTING="no" # # 25.) # Do you want to load customary rules from a file? # # This is really an expert option. NO HELP WILL BE GIVEN FOR THIS! # READ THE EXAMPLE CUSTOMARY FILE AT /etc/sysconfig/scripts/SuSEfirewall2-custom # #FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom" Help ! ___________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

4 3

SuSEfirewall start scripts
by Chris FitzGerald 08 Nov '02

08 Nov '02

Hi all, I have my firewall up and running thanks to the firewall2.pdf i found in the list a few days ago ;) But I still have a question : When I boot the box it has: firewall step 1 initialization some services firewall step 2 setup some other services firewall step 3 final named,squid service I get the message : WARNING : NO DNS RUNNING, SQUIDSERVER RUNNING ALTHOUGH STATED IN SuSEfirewall2 file. off course this is normal because they only start up AFTER the final script. So I looked in my folders and did this : I believe the firewall had : S11 or something like that and the named and squid this : S13Named S18Squid So I altered the numbers to 10 for both of them. right after Squid starts up the third script of the firewall runs and still tells me there is no squid server running althoughj stated in configfile. Questions I had : 1. Is it safe to change the startup sequence like that for security reasons ? 2. If the script is parsed and doesn't find the servers, are the ports then open or are they closed out of security and do they stay closed ? 3. Can I safely put SuSEfirewall2_final to S99 ? Thanks in advance regards Chris FitzGerald Datacenter Supervisor Belgium

2 2

Re: [suse-security] SuSEfirewall start scripts
by Chris FitzGerald 08 Nov '02

08 Nov '02

wow quick reply ;) Well out of these 2 mails I know what to do ;) 1. I'll put the Firewall step 3 script at S99 2. Update the SuSEfirewall2 config file 3. put squid somewhere in the beginning S09 or S10 for runlevels 3 and 5 I assume the Kxx-scripts can be left untouched ? ;)) As for the ippp0, handy thing to know about. but luckely i am on cable for the moment and just need the DHCP offer from the ISP, so no dial-ups ;) Thanks Again! Regards Chris ----- Original Message ----- Hi ! I tried it with linking the start script of the final firewall setup to s99 (then ist really started last) and the script doesn't complain about the missing services, it still complain about the missing interface ippp0 because with 8.1 SuSe does not set a host route to the interface (they set only a defaultroute if you use dial on demand) and afair in SuSE 8.0 the fianl firewall script was executed last on startup.. (so i guess that can't be wrong) Take a look at /var/log/messages and you can see how long the real init of squid takes (i guess it takes longer than " starting www-proxy squid done" appears on the display, and when you start the final firewall setup, squid ist still not really up. I read about another solution => uses the firewall of 8.0 :-) At home i tried to setup fwbuilder (www.fwbuilder.org) but i think it takes years (for me) to have a clue about this program :-) Ciao Gerd Hoerst Department Electrical Engineering TAKATA-PETRI AG Bahnweg 1 D-63743 Aschaffenburg Phone: +49-6021-65-1225 Mobile: +49-171-9781446 Fax: +49-6021-65-1119 e-mail: gerd.hoerst(a)eu.takata.com ----- Original Message ----- From: "Andreas Paffrath" <mail(a)andreas-paffrath.com> To: "Chris FitzGerald" <mersco(a)pandora.be> Sent: Friday, November 08, 2002 9:54 AM Subject: Re: [suse-security] SuSEfirewall start scripts > hi again > You might want to change the entries in the firewall configuration file. It > should have the appropriate settings for the proper ports and protocols. > However, I am just working on that myself, since I get the same messages. > Nevertheless, nothing to worry so far, the firewall should work properly > anyway, > > andreas > > > ----- Original Message ----- > From: Chris FitzGerald <mersco(a)pandora.be> > To: <suse-security(a)suse.com> > Sent: Friday, November 08, 2002 9:38 AM > Subject: [suse-security] SuSEfirewall start scripts > > > Hi all, > > I have my firewall up and running thanks to the firewall2.pdf i found in the > list a few days ago ;) > > But I still have a question : > > When I boot the box > it has: > > firewall step 1 initialization > some services > firewall step 2 setup > some other services > firewall step 3 final > named,squid service > > > I get the message : WARNING : NO DNS RUNNING, SQUIDSERVER RUNNING ALTHOUGH > STATED IN SuSEfirewall2 file. > > off course this is normal because they only start up AFTER the final script. > > So I looked in my folders and did this : > > I believe the firewall had : S11 or something like that > and the named and squid this : > > S13Named > S18Squid > > So I altered the numbers to 10 for both of them. > right after Squid starts up the third script of the firewall runs and still > tells me there is no squid server running althoughj stated in configfile. > > Questions I had : > > 1. Is it safe to change the startup sequence like that for security reasons > ? > 2. If the script is parsed and doesn't find the servers, are the ports then > open or are they closed out of security and do they stay closed ? > 3. Can I safely put SuSEfirewall2_final to S99 ? > > Thanks in advance > > regards > > > Chris FitzGerald > Datacenter Supervisor > Belgium > > >

1 0