December 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] SuSE Firewall Issues
by Togan Muftuoglu 20 Dec '02

20 Dec '02

* Turd Ferguson; <turdferguson(a)infowest.com> on 19 Dec, 2002 wrote: >Actually I did, several times, but can find nothing that tells me why >this is the case. Version 0.9 is the latest not 0.8 >Perhaps you know something that I misunderstood in my readings? 1) port forwarding is dicussed in Chapter 2 Variables look for item 13,14i15 page 28 ( on the a4 version) >* Turd Ferguson; <turdferguson(a)infowest.com> on 19 Dec, 2002 wrote: >>2: Why is it that I cannot go to my domain directly (Phoenix tells me >>the connection was refused) from box on my network other than my >>firewall. I have ensure that the "protect from local area network" box item 14 has a tip which explains other possiblites of forwarding ports also in Chapter 8 section 8.1.6 configuring for internal access to External IP Hope these are helpfull -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx

3 3

ppp0 to internal network
by Andre Vorster 20 Dec '02

20 Dec '02

HI I have a SuSE linux server ( firwall, smtp $ www server) tree adapters eth0 - 192.168.1.4 , eth1 196.25.208.26 & ppp0 192.168.1.11 if my users (trusted) dial in to ppp0 they must be able to telnet into my Unix server 192.168.1.80 & I would like to be able to access my Win2k Server via Windows Terminal Client. This is what my firewall2.rc.config looks like. Thanx for any help. ###################################################### FW_DEV_EXT="ppp0" FW_DEV_INT="eth0" FW_DEV_DMZ="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="23" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="25 80 110" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="21 23 25 53 110 3128" FW_SERVICES_INT_UDP="53" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.1.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="no" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE- FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" # END of rc.firewall FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" ################################################################ Andre Vorster Business Print Centre Tel: 012 349 2295 Fax: 012 349 2299

2 3

RE: AW: [suse-security] Amavis virus detection
by Howard, Neal 19 Dec '02

19 Dec '02

I've had great success using McAfee Antivirus command line scanner (uvscan) with Amavis. You do have to keep your virus definitions data files updated on a regular basis no matter what brand of antivirus scanner you use. I make certain to update mine every week when the new data files are released and more often when emergency unscheduled versions are released. This has saved me big time on one occasion a few months ago when I started getting incoming infected emails with a very new virus only about an hour after I had just updated to the latest data files that could detect this particular new virus. Having an outdated virus scanner is only a very small amount better than not having one at all IMHO. -----Original Message----- From: Marcel Erkens [mailto:merkens@safenebraska.org] Sent: Thursday, December 19, 2002 6:08 AM To: suse-security(a)suse.com Subject: Re: AW: [suse-security] Amavis virus detection VDF Version says it all. Bugbear wasn't around until after June 13 if memory serves time to "antivir --update" ;) On Thursday 19 December 2002 17:47, Andy Bennett wrote: > Hi, > > I obtained an evaluation license for antivir for personal use about a year > ago and I also have the evaluation version from SuSE V8.1. The outputs from > them with bugbear and eicar.com in the same directory are as follows. > ____ > > AntiVir / Linux Version 2.0.3 > Copyright (C) 1994-2002 by H+BEDV Datentechnik GmbH. > All rights reserved. > > Loading /usr/bin/../lib/AntiVir/antivir.vdf ... > > VDF version: 6.14.0.3 created 13 Jun 2002 > > AntiVir license: 149999 for Evaluation licsense for SuSE Linux / > UnitedLinux > > checking drive/path (cwd): /home/andy > /home/andy/eicar.com > Date: 19.12.2002 Time: 17:32:28 Size: 69 > VIRUS: file contains code of the virus 'Eicar-Test-Signatur' > > > ----- scan results ----- > directories: 1 > files: 2 > infected: 1 > repaired: 0 > deleted: 0 > renamed: 0 > scan time: 00:00:01 > ------------------------ > Thank you for using AntiVir. > ___ > > and > > ___ > > AntiVir/Linux Version 6.10.0.0, (Sep 14 2001, 11:31:39) > Copyright(c) 1994-2001 by H+BEDV Datentechnik GmbH > > Loading /usr/lib/AntiVir/antivir.vdf ... > > AntiVir is running in non-key-mode. > > VDF version: 6.10.0.10 - FUP(0), created 09/27/2001 > > checking drive/path (cwd): /home/andy > /home/andy/eicar.com > Date: 1.11.2002 Time: 11:57:17 Size: 69 > VIRUS: file contains code of the virus 'Eicar-Test-Signatur' > > > ----- scan results ----- > directories: 1 > files: 2 > infected: 1 > repaired: 0 > deleted: 0 > renamed: 0 > scan time: 00:00:01 > -------------------------- > Thank you for using AntiVir > ____ > > This may be a strange request but is there some brave soul out there I > could send the suspect file just to check it is a virus. My version of AVG > anti-virus scanner under windows identifies it as such and the method of > it's arrival on my network, (i.e. unrequested file attachment from someone > I'd never heard of), says it is - but I'd like to be sure. > > I'd also like to see if someone else's antivir or whatever finds it. > > TIA > Andy > > On Thursday 19 December 2002 16:10, Ulrich Roth wrote: > > Hello, > > > > > I've just installed SuSE 8.1 with Postfix and Amavis and have > > > tried sending the eicar.com virus pattern in an attachment. > > > This worked great - the virus was detected and blocked. > > > However, I also tried sending a copy of Bugbear to > > > one of my own users externally via a web-based email service, > > > (onetel - similar to hotmail, et al), and this was sent through to the > > > user without being blocked :( > > > > > > The message headers contains the entry > > > > > > X-Virus-Scanned: by AMaViS 0.3.12pre8 > > > > > > Any ideas, anyone? > > > > Which virus scanner do you use on your SuSE box, and is it up to date? > > Bye > > Uli > > On Thursday 19 December 2002 16:10, Ulrich Roth wrote: > > Hello, > > > > > I've just installed SuSE 8.1 with Postfix and Amavis and have > > > tried sending the eicar.com virus pattern in an attachment. > > > This worked great - the virus was detected and blocked. > > > However, I also tried sending a copy of Bugbear to > > > one of my own users externally via a web-based email service, > > > (onetel - similar to hotmail, et al), and this was sent through to the > > > user without being blocked :( > > > > > > The message headers contains the entry > > > > > > X-Virus-Scanned: by AMaViS 0.3.12pre8 > > > > > > Any ideas, anyone? > > > > Which virus scanner do you use on your SuSE box, and is it up to date? > > Bye > > Uli > > On Thursday 19 December 2002 16:10, Ulrich Roth wrote: > > Hello, > > > > > I've just installed SuSE 8.1 with Postfix and Amavis and have > > > tried sending the eicar.com virus pattern in an attachment. > > > This worked great - the virus was detected and blocked. > > > However, I also tried sending a copy of Bugbear to > > > one of my own users externally via a web-based email service, > > > (onetel - similar to hotmail, et al), and this was sent through to the > > > user without being blocked :( > > > > > > The message headers contains the entry > > > > > > X-Virus-Scanned: by AMaViS 0.3.12pre8 > > > > > > Any ideas, anyone? > > > > Which virus scanner do you use on your SuSE box, and is it up to date? > > Bye > > Uli -- os[Linux 2.4.18-4GB - SuSE Linux 8.0 (i386)] up[ 91 days, 2 hours, 53 minutes] -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Amavis virus detection
by Andy Bennett 19 Dec '02

19 Dec '02

Hi, I've just installed SuSE 8.1 with Postfix and Amavis and have tried sending the eicar.com virus pattern in an attachment. This worked great - the virus was detected and blocked. However, I also tried sending a copy of Bugbear to one of my own users externally via a web-based email service, (onetel - similar to hotmail, et al), and this was sent through to the user without being blocked :( The message headers contains the entry X-Virus-Scanned: by AMaViS 0.3.12pre8 Any ideas, anyone? Rgds Andy

2 1

Re: [suse-security] SuSE Firewall Issues
by GentooRulez 19 Dec '02

19 Dec '02

>2: Why is it that I cannot go to my domain directly (Phoenix tells me >the connection was refused) from box on my network other than my >firewall. I have ensure that the "protect from local area network" box >is not checked, however I am still having these issues. what about the possibility that your httpd is only listening on external interface. To check that type netstat -anp | grep -i listen Michael

1 0

SuSE Firewall Issues
by Turd Ferguson 19 Dec '02

19 Dec '02

I have a question or two regarding the SuSE Firewall. My setup is a SuSE box that is masquerading for my desktop box. I have successfully set up masquerading and it works just great. My questions are these: 1: How does one accomplish port forwarding using the SuSE firewall 2: Why is it that I cannot go to my domain directly (Phoenix tells me the connection was refused) from box on my network other than my firewall. I have ensure that the "protect from local area network" box is not checked, however I am still having these issues. Any help would be greatly appreciated. Thanks! Jared Ferguson

2 1

Routing between 2 Networks
by Alan Civita 19 Dec '02

19 Dec '02

Hi all i've a SLES 7 ..on a server with 2 network cards.. one 192.168.0.221 and one with public Ip 90.90.20.1 connected directly to an ADSL router I'd like to use the SLES as a router... I've turned on the ipforward option in /etc/rc.config but if i set as the default gateway on a win98/2000 machine on the lan the 192.168.0.221 ...i cannot ping any ip on internet, and i cannot surf the web too. Obviously i can do it on the SLES, i can ping and surf the web. What can i have to do to use my SLES 7 as a router for the lan? It is necessary to use iptables? Thank very much (@ @) -o00-(_)-00o- ****************************** * Alan Civita * * Datenquelle S.r.l. * * alan.civita(a)datenquelle.it * * tel: +390403721769 * ****************************** NOTICE *********************************************************** This email may contain confidential material. If you were not an intended recipient, Please notify the sender and delete all copies. We may monitor email to and from our network. ***********************************************************

3 2

ppp0 to internal network
by Andre Vorster 19 Dec '02

19 Dec '02

Hi all Using SuSE 7.3 I am trying to setup my firewall so that it will forward port 23 (telnet) to unix server on the internal net. If I dial into my linux box via ppp0. My linux server has two LAN card eth1 - ext & eth0 - int & then the ppp0 dial-up that needs to forward to eth0. I am using my server as a web & mailserver. Can somebody please help. Andre Vorster Business Print Centre Tel: 012 349 2295 Fax: 012 349 2299

4 3

AW: [suse-security] Routing between 2 Networks
by Ulrich Roth 19 Dec '02

19 Dec '02

Hi, > i've a SLES 7 ..on a server with 2 network cards.. > one 192.168.0.221 and one with public Ip 90.90.20.1 connected > directly to an > ADSL router > > I'd like to use the SLES as a router... > I've turned on the ipforward option in /etc/rc.config > > > but if i set as the default gateway on a win98/2000 machine > on the lan the > 192.168.0.221 ...i cannot ping any ip on internet, and i > cannot surf the web > too. > > Obviously i can do it on the SLES, i can ping and surf the web. > > What can i have to do to use my SLES 7 as a router for the lan? > It is necessary to use iptables? You have to set up NAT on your router. Your Win98/2000 machine has a private IP address, and no destination machine in the world knows where to send answer packets to a private IP address. There are so many private networks on our beautiful earth, all using the 192.168.x.x addresses. ;-) NAT means that the packets you send get the IP address of your router instead of the IP address of your client machine. The router then knows to which client machine it has to forward the answer packets it receives. Yes, you can realize NAT with iptables. Bye Uli

1 0

AW: [suse-security] Security in server - PLEASE HELP
by Ulrich Roth 19 Dec '02

19 Dec '02

Hi Marcia, oh dear, I made the same mistake as you. I wanted to send this to the list. We have to replace the address when hitting "Reply". Okay. > accurately in this point that the service stops: > > shutting down samba smbd > sh : no job control in this shell > sh-2.05# > > stting up routing (using /etc/rout.conf) > > sh : no job control in this shell > > sh-2.05# > > I it stou using the distribution of the SuSE7.3. I really don't have any idea why this happens. Please try the following and tell us what you get then: After the computer is up, change directory to /etc/rc.d Type ./sshd stop Does it give you anything else than what we already know? Then type ./sshd start You can also have a look at the log file /var/log/messages Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

2 1