December 2002 - openSUSE Security - openSUSE Mailing Lists

UNDELIVERED MAIL RTURNED TO SENDER
by Philippe Vogel 12 Dec '02

12 Dec '02

Hi! Why the hell do I get round about 50% of my mails to suse-security(a)suse.com returned? Is the mailserver so damn bad or is it my provider? Philippe

3 2

SuSEfirewall2
by Hofmann Informatik 12 Dec '02

12 Dec '02

Hi, How can I adjust SuSEfirewall2 to accept ICMP type 5, (Redirect message) /etc/rc.config.d/firewall2.rc.config: FW_TRUSTED_NETS="192.168.0.1,icmp,5" SuSE Linux 7.3 (i386) - kernel 2.4.16-4GB I've got always the following output in /var/log/messages: kernel: Redirect from 192.168.0.1 on eth0 about 192.168.0.12 ignored. kernel: Advised path = 192.168.0.103 -> 192.168.1.197, tos 00 Best regards Sandro Trinkler

2 1

Portforwarding with Iptables
by Claus Weber 12 Dec '02

12 Dec '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I have got a problem with portforwarding with iptables. Situation: I have got a Host (2 Interfaces, one with official IP-Adress, one private) that shold forward incoming tcp-connections on a specific port to a second host in the private net. My specific rules: $IPTABLES -A FORWARD -i $IF -o $INTIF -m state --state NEW,ESTABLISHED -p tcp -s $i -d 192.168.10.4 --dport 4899 - -j ACCEPT $IPTABLES -A FORWARD -i $INTIF -o $IF -m state --state ESTABLISHED -p tcp -s 192.168.10.4 --sport 4899 -d $i -j ACCEPT $IPTABLES -t nat -A PREROUTING -i $IF -p tcp --dport 4899 - -j DNAT --to-destination 192.168.10.4:4899 where $IF is the external IF, $INTIF is the internal IF and $i is the permitted host IP. I added Logging for debugging, then I tried telnetting from an external host: Dec 11 15:51:23 hosting4 kernel: 4899 forward: IN=eth0 OUT=eth1 SRC=<external host> DST=192.168.10.4 LEN=60 TOS=0x10 PREC=0x00 TTL=57 ID=50329 DF PROTO=TCP SPT=3221 DPT=4899 WINDOW=32120 RES=0x00 SYN URGP=0 Seems, that packets are forwarded, but then??? Do I need an SNAT-rule for backward packets? Telnetting directly from this (forwarding)host works perfectly. Thanks, Claus - -- PGP-Key fingerprint: E94C 5E65 B4FB 2E7D 82A8 814C A450 C01E F990 A9FD -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE991aVpFDAHvmQqf0RAjmFAJ4vmV5xI73P5dM9DHsKV21YLp+SDQCgmTbI vcY0MHJct7d5EvH2VYRLGEI= =gxMl -----END PGP SIGNATURE-----

2 1

Filtering JScript/ActiveX
by dhoffmann＠obg-bau.de 12 Dec '02

12 Dec '02

Hi there, i'm looking for some kind of http-content-filter to avoid having malicious jscript/activex-stuff delivered to local clients browsing the web. Does anyone know an appropiate open source solution? Kind regards, Denis Hoffmann

7 6

Re: [suse-security] DOS on sendmail daemon
by GarUlbricht7＠netscape.net 11 Dec '02

11 Dec '02

GarUlbricht7 wrote: Hi list-- i tried to send this direct to Michael, but it kept getting bounced... so ..if you're not Michael you probably just want to stop reading here--- To: Miguel Albuquerque I got a strange email with your name and "usual signature" on the bottom-- The Subject of the email was: "STOP BUSH" The email was in either Spanish or Italian or some other language I couldn't read--- if I cared I could have put it through a translation program -- but it looked to me like a chain letter or some other form of "spam' If I turned it over to my system admin -- I know his first question will be: "Where did they get your email address?" Are you mining the SuSE Security list for email addresses ??? If so --- stop :( __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

1 0

Re: [suse-security] Portforwarding with Iptables
by Claus Weber 11 Dec '02

11 Dec '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, > >My specific rules: > >$IPTABLES -A FORWARD -i $IF -o $INTIF -m state --state > >NEW,ESTABLISHED -p tcp -s $i -d 192.168.10.4 --dport > > 4899 - -j ACCEPT > > > >$IPTABLES -A FORWARD -i $INTIF -o $IF -m state --state > >ESTABLISHED -p tcp -s 192.168.10.4 --sport 4899 -d $i -j > >ACCEPT > > > >$IPTABLES -t nat -A PREROUTING -i $IF -p tcp --dport > > 4899 - -j DNAT --to-destination 192.168.10.4:4899 > > > > if i understood correctly you need a DNAT-Rule yes, that's what I thought. > > >Telnetting directly from this (forwarding)host works > >perfectly. > > (because you are in the same subnet i guess...) > > try something like this: > > $IPTABLES -t nat -A PREROUTING -p TCP -i $IF --dport 4899 > -j DNAT --to-destination 192.168.10.4 look at my 3rd rule, that's exactly what I already have. > > (perhaps you also need to add some rules like -A INPUT > and -A OUTPUT to let your host4 (?) accept and output the > port 4899 Traffic, perhaps you already have the > output rule ?) No, there is no filtering done on this host... Maybe this isn't an iptables but a routing problem! What happens, if the "background"-host's default route is different? > > hope this helps, Andreas Thank you, Claus. - -- Kostenlose Stundenerfassung mit http://time.jambit.com - ------------------------------------------------------ Claus Weber, Network Administrator jambit Software Development & Management GmbH Sendlinger Straße 24, D-80331 München http://www.jambit.com fon: +49.89.260 19 593, gsm: +49.177.867 17 34 fax: +49.89.260 19 585 PGP-Key fingerprint: E94C 5E65 B4FB 2E7D 82A8 814C A450 C01E F990 A9FD -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE994dupFDAHvmQqf0RAiMYAJ9g7F/GU9l7FJLyt1ijJRlxp/ruKACcDFpq hYIi9YPk6u/Mrg0XijMnSqU= =7aEl -----END PGP SIGNATURE-----

1 0

Re: AW: [suse-security] OT because ...
by Michael Ryan 11 Dec '02

11 Dec '02

Thanks Matthias, will try what you suggest. Regards, Michael "Becher Matthias" <becher(a)ip-exchange.de> wrote: > > Hello Michael, > just try to reinstall the kernel-packages.... > there you might get the loop.o. > Otherwise compile the kernel again and just take loop-device support into > the kernel. > > hope good luck for you. > PS: just try cat /proc/filesystems ... > there the supported filesystems are listed > > > -----Ursprungliche Nachricht----- > Von: Michael Ryan [mailto:ryanm3@eircom.net] > Gesendet: Mittwoch, 11. Dezember 2002 16:01 > An: suse-security(a)suse.com > Betreff: [suse-security] OT because ... > > > > ... posted this query twice on suse-linux-e(a)suse.com with no joy :( so I'm > hoping someone here might help ... > > --- Original Message --- > > Hi list, > > I'm having a problem upgrading the kernel on an old SuSE 6.4 disto to kernel > 2.2.19 using the SuSE supplied k_deflt_22-2.2.19-162.i386.rpm. > > I have followed the SuSE kernel update instructions carefully but am having > the following problem creating a new ram disk for my scsi and network device > drivers: > > ****:/ # mk_initrd > using "/dev/sda1" as root device (mounted on "/") > > creating initrd "//boot/initrd" for kernel "//boot/vmlinuz" (2.2.19) > mount: Could not find any loop device, and, according to /proc/devices, > this kernel does not know about the loop device. > (If so, then recompile or `insmod loop.o'.) > failed to mount image > ****:/ # > > The file loop.o does not (or no longer) exists on my system :( > > Any help VERY much appreciated. > > Thanks - Michael > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > >

1 0

OT because ...
by Michael Ryan 11 Dec '02

11 Dec '02

.. posted this query twice on suse-linux-e(a)suse.com with no joy :( so I'm hoping someone here might help ... --- Original Message --- Hi list, I'm having a problem upgrading the kernel on an old SuSE 6.4 disto to kernel 2.2.19 using the SuSE supplied k_deflt_22-2.2.19-162.i386.rpm. I have followed the SuSE kernel update instructions carefully but am having the following problem creating a new ram disk for my scsi and network device drivers: ****:/ # mk_initrd using "/dev/sda1" as root device (mounted on "/") creating initrd "//boot/initrd" for kernel "//boot/vmlinuz" (2.2.19) mount: Could not find any loop device, and, according to /proc/devices, this kernel does not know about the loop device. (If so, then recompile or `insmod loop.o'.) failed to mount image ****:/ # The file loop.o does not (or no longer) exists on my system :( Any help VERY much appreciated. Thanks - Michael

1 0

SuSEfirewall2 forwarding
by Miguel Albuquerque 11 Dec '02

11 Dec '02

A company wants to use it's SuSE Linux PC to access the internet via an ADSL router but wants the clients PC not reacheable from outside. The firewall provides no services whatsoever from outside the local area network. To inside network it provides an dhcp server. Plus, they need to access Remote LAN Servers using Citrix, IKA and Oracle. Most of the clients (win 98) are unable to connect to internet and then switch to Citrix or whatever without rebooting. The picture: internet ¦ ¦ ppp0 10.17.4.1 ¦ ¦ SuSEfirewall2 (8.0) 10.17.4.2 ----------------------------- Remote Office ¦ VAX: 10.17.16.1 (local) ¦ GW1: 10.17.2.1 ¦ GW2: 10.1.2.1 ¦ GW3: 10.192.2.10 ¦ ¦ LAN (was 10.17.20.0) 192.168.0.0/24 By reasons that I ignore, the folks at other side complain, if LAN and the DSL's internal IP are in the same subnet (it masquerades the public IP). I configured the FW: FW_DEV_EXT="ppp0 eth0" FW_DEV_INT="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_NETS="192.168.0.0/24, 10.0.0.0/16 10.0.0.0/16, 192.168.0.1/24" FW_REDIRECT="192.168.0.0/24,10.17.2.1,tcp,611,611,192.168.0.0/24,10.17.2.1,udp,161,161, 192.168.0.0/24,10.17.16.1,tcp,23,23" What is wrong? Internet connection works fine, but none to the Remote Office. One more info: the gateways listed above are in a Cisco. I've listened some complains to connect SFW2 with a Cisco Router. Any help will be welcome! -- <<The Man, he is not...he Becomes.>> .-. e-SecureNet /v\ We Run SuSE Project Manager // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-securenet.ch http://www.e-securenet.ch _____________________________________________________________

2 1

cyrus imap buffer overflow patch from suse (when?)?
by Mark Wassermann 11 Dec '02

11 Dec '02

hi list hi suse security team Iam still wondering when there will ba a patch for this problem! We use cyrus imap on suse (7.3 and 8.1). We have no problem with the users with a fix IP (firewall - we allowed only the users with fix ips access to our mailserver) but the users with a simple dail-up isp are going kill us soon - they have no access to their mails. So my question to suse security - when will there be a patch? Are there any porblen - if so tell us Mark -- Mark Wassermann intos IT Solutions & Consulting GmbH St. Veiter Straße 4 a, A-9020 Klagenfurt mailto:mwassermann@intos.com

3 2