February 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Network design
by Togan Muftuoglu 27 Feb '02

27 Feb '02

Hi, * Ken Schneider; <kschneider(a)rtsx.com> on 27 Feb, 2002 wrote: >Togan Muftuoglu wrote: >If you have a Cisco PIX firewall why are also using 2 seperate linux >boxes as firewalls? The cisco PIX can support upto 4 interfaces and is a >VERY powerful firewall in its own right. Or is it NOT a PIX? The project is in the design face, meaning they have not bought anything yet. It is govenment office and they do not want to spend $$ into licenses. However, I want to make sure thy have all the alternatives from the point of view of finacial and security aspects. Thanks for the suggestion -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx

1 0

Network design
by Togan Muftuoglu 27 Feb '02

27 Feb '02

Hi, I need some advice in designing a secure network. A very rough image is located at http://toganm.tripod.com/projects/network.jpg Everything will be running SuSE Linux with Kernel 2.2.19 except the Terminal Sever which will be 2.4.9.ltsp ( or I will recompile the kernel for that server specifically) So terminals will be thinclients I have 60 (and possibly will be added more) thin clients who will be only using Web and Mail. Web server will be hosting the website updates will be done by cron job running hourly Mail server will be accepting mail from the internet and forward them to internal Mail server (possibly LTSP server will handle this also) which would be IMAP Here are the places I am lost 1) Where would be the best location to place snort as IDS 2) Where would be the best location to place a SYSLOG machine for all the bastion hosts 3) What would be the best subnetting structure to minimize broadcast traffic ? 4) What could be my alternatives for Outer firewall (currently it will be a Linux pc based CDROM firewall (ie Cisco PIX ) 5) Will placing Squid proxy to the inner firewall be possibly cauing problems to security or should it be a separate proxy machine. If a separate proxy server where would be be wise to place ? Any thoughts, suggestions pointers much appreciated Thks -- Togan Muftuoglu Unofficial SuSE FAQ Maintainer http://dinamizm.ath.cx

1 0

Re: [suse-security] iptables - pop
by spiekey 27 Feb '02

27 Feb '02

ARGH...www.gmx.de of course ;P ----- Original Message ----- From: "Bitzer,Gerd" <gerd.bitzer(a)Wuerttembergische.de> To: "'spiekey'" <spiekey(a)hotmail.com> Sent: Wednesday, February 27, 2002 4:56 PM Subject: AW: [suse-security] iptables - pop maybe you should try www.gmx.de, not ww.gmx.de ;-). Or is this only a mistyping ? -----Ursprüngliche Nachricht----- Von: spiekey [mailto:spiekey@hotmail.com] Gesendet am: Mittwoch, 27. Februar 2002 16:33 An: suse-security(a)suse.com Betreff: Re: [suse-security] iptables - pop I can get to ww.gmx.de, just the pop doesnt work. Everything looks fine in tcpdump, unfortunatelly, it wont tell me if it denys my packet or not? Does it? Spiekey ----- Original Message ----- From: "Joerg Trowski" <jotro(a)gmx.de> To: "spiekey" <spiekey(a)hotmail.com> Sent: Wednesday, February 27, 2002 4:11 PM Subject: RE: [suse-security] iptables - pop > > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi! > > Do you have any problems to reach some homepages (e.g. GMX)? So if, > it's not a setup-problem of your firewall. If not ignore this mail > ;-0 > > Joerg > > > -----Original Message----- > > From: spiekey [mailto:spiekey@hotmail.com] > > Sent: Wednesday, February 27, 2002 2:56 PM > > To: suse-security(a)suse.com > > Subject: [suse-security] iptables - pop > > > > > > Hello! > > For some reason i can´t get my mail from my gmx pop account, > > this is my > > IPTABLES script: > > > > ---SNIP--- > > > > #Default DROP policy. I set the other eth+ on Accept, to make > > sure its not > > their fault! > > iptables -P INPUT DROP > > iptables -P FORWARD ACCEPT > > iptables -P OUTPUT DROP > > > > IFACE="ppp0" > > > > > > ---SNIP--- > > > > # POP > > # Allow POP, i tried everything to get is workins, as u can see ;) > > iptables -A INPUT -i $IFACE -p tcp --dport 110 -m state --state > > NEW,ESTABLISHED -j ACCEPT > > iptables -A OUTPUT -o $IFACE -p tcp --sport 110 -m state --state > > NEW,ESTABLISHED -j ACCEPT > > > > iptables -A INPUT -i $IFACE -p tcp --dport pop3 -m state --state > > NEW,ESTABLISHED -j ACCEPT > > iptables -A OUTPUT -o $IFACE -p tcp --sport pop3 -m state --state > > NEW,ESTABLISHED -j ACCEPT > > > > iptables -A INPUT -i $IFACE -p udp --dport 110 -m state --state > > NEW,ESTABLISHED -j ACCEPT > > iptables -A OUTPUT -o $IFACE -p udp --sport 110 -m state --state > > NEW,ESTABLISHED -j ACCEPT > > > > iptables -A INPUT -i $IFACE -p udp --dport pop3 -m state --state > > NEW,ESTABLISHED -j ACCEPT > > iptables -A OUTPUT -o $IFACE -p udp --sport pop3 -m state --state > > NEW,ESTABLISHED -j ACCEPT > > > > ---SNIP--- > > > > Anyone any idea what i did wrong? > > > > > > Cheers, Spiekey > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > -----BEGIN PGP SIGNATURE----- > Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> > > iQA/AwUBPHz3K5SHm0LcQT0JEQKvTACguPVmUqkdz6Xd0TDthHUtqBCqsZUAoMwx > H6mhcAi7JdtRUBaevu8+7j26 > =yTbV > -----END PGP SIGNATURE----- > > -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

iptables - pop
by spiekey 27 Feb '02

27 Feb '02

Hello! For some reason i can´t get my mail from my gmx pop account, this is my IPTABLES script: ---SNIP--- #Default DROP policy. I set the other eth+ on Accept, to make sure its not their fault! iptables -P INPUT DROP iptables -P FORWARD ACCEPT iptables -P OUTPUT DROP IFACE="ppp0" ---SNIP--- # POP # Allow POP, i tried everything to get is workins, as u can see ;) iptables -A INPUT -i $IFACE -p tcp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --sport 110 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $IFACE -p tcp --dport pop3 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $IFACE -p tcp --sport pop3 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $IFACE -p udp --dport 110 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $IFACE -p udp --sport 110 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A INPUT -i $IFACE -p udp --dport pop3 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -A OUTPUT -o $IFACE -p udp --sport pop3 -m state --state NEW,ESTABLISHED -j ACCEPT ---SNIP--- Anyone any idea what i did wrong? Cheers, Spiekey

2 1

Problem keeping network alive
by Marios Marti 27 Feb '02

27 Feb '02

Hi all Im running SuSE 7.1 kernel 2.2.18. I have compiled a kernel with only the basics, for server, i.e no module support,only the network and varius hardware. I am having though problems keeping the ethernet alive since it stays on for a while and then it goes of and takes ages to re-activate. Please can some one tell me if there are other packages in the system that deactivate the network module and how can i see when the modules are enabled and when disabled. Also i have disabled all the green functions of the system bios and still have the same problem. I suspect its something in the kernel but dont really know what it is. Like when you let it on the kde login screen and after some time the screen goes black, guess that is cause somewhere there is another power saving module enabled, which affects the network as well. Thanks for any help.

4 5

block forged packets with iptables
by Oliver Krapp - etracker.de 27 Feb '02

27 Feb '02

Hi, since a few day there is much in traffic (~100 kbit/sec) from a specified host to my server, I notice this first on my mrtg graph, then detailed with ntop. I want to block the IP with the following iptables commands: iptables -A OUTPUT -j DROP -d xxx.xxx.xxx.xxx iptables -A OUTPUT -j DROP -s xxx.xxx.xxx.xxx iptables -A INPUT -j DROP -d xxx.xxx.xxx.xxx iptables -A INPUT -j DROP -s xxx.xxx.xxx.xxx A further look with iptables -L INPUT -vn (or OUTPUT) shows that there are no packets dropped. The webmaster of the IP tells me that there is no traffic from this host to my. So I think that the packets are forged. Any ideas/help what I can do against this attack? Thanks Oliver Krapp >-----------------------------------------------< etracker.de e.K. - Schopstraße 16 - 20255 Hamburg http://www.etracker.de we're counting on you! EMail: oliver.krapp(a)etracker.de Tel: +49-40-43180803 Mobil: +49-179-4896999

4 5

AW: [suse-security] DOS Attack !!
by Peer Stefan 27 Feb '02

27 Feb '02

This ain't a bug, this is a feature :-) No honestly, when there's no resource left for the os it start's killing processes. Try setting ulimits for specific users/processes in order to prevent DOS. cheers, Stefan >-----Ursprüngliche Nachricht----- >Von: Dan Am [mailto:suse@dertext.de] >Gesendet: Mittwoch, 27. Februar 2002 10:55 >An: suse-security(a)suse.com >Betreff: [suse-security] DOS Attack !! > > >Hi all, could use a quick hand: > >After a lot of DOS on port 21, I then have this in my logfiles: > >Feb 26 21:27:16 deLonghi kernel: __alloc_pages: 0-order >allocation failed >(gfp=0x1d2/0) >Feb 26 21:27:16 deLonghi kernel: VM: killing process httpd > >"They" also brought down sendmail with this. Q.: Does anybody >know a fix ? >What attack is this ? Running Suse 7.3 with Kernel 2.4. > >thanks >dan > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here >

1 0

long passwords
by michael stone 27 Feb '02

27 Feb '02

On two different SuSE machines (7.2 and 7.3), I am having a problem with them authenticating only from the first 8 characters of a password. Example, password is: ilovemyroot 'ilovemyr' and 'ilovemyr00t' will both pass authentication at console, and in any X applications (i.e. kdesu and kcheckpass) I have md5 enabled, and have verified the md5 entries in /etc/pam.d/passwd, /etc/pam.d/login, and /etc/pam.d/sshd Any thoughts? Anyone else with the same issues? I don't know much about pam and how it works. thanks, michael

3 4

DOS Attack !!
by Dan Am 27 Feb '02

27 Feb '02

Hi all, could use a quick hand: After a lot of DOS on port 21, I then have this in my logfiles: Feb 26 21:27:16 deLonghi kernel: __alloc_pages: 0-order allocation failed (gfp=0x1d2/0) Feb 26 21:27:16 deLonghi kernel: VM: killing process httpd "They" also brought down sendmail with this. Q.: Does anybody know a fix ? What attack is this ? Running Suse 7.3 with Kernel 2.4. thanks dan

1 0

Re: [suse-security] long passwords
by Sven Michels 26 Feb '02

26 Feb '02

> On two different SuSE machines (7.2 and 7.3), I am having a problem with > them authenticating only from the first 8 characters of a password. > > Example, password is: ilovemyroot > > 'ilovemyr' and 'ilovemyr00t' will both pass authentication at console, > and in any X applications (i.e. kdesu and kcheckpass) > > I have md5 enabled, and have verified the md5 entries in > /etc/pam.d/passwd, /etc/pam.d/login, and /etc/pam.d/sshd > > Any thoughts? Anyone else with the same issues? I don't know much about > pam and how it works. after changeing the pam entrys, did you call passwd again to get a md5 password? if not, the password is still crypted and not md5sum'ed. HTH

1 0