March 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] iptables firewall -newbie
by Michael Stern 11 Mar '02

11 Mar '02

> iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT do you think that's enough? the FORWARD chain's default policy is already ACCEPT?!

2 1

iptables firewall -newbie
by Mario Ohnewald 11 Mar '02

11 Mar '02

Hello! I have a little network, one firewall/router. I want to allow some ips to surf the net, and some are not allowed to leave the trusted net. I messed around a lot, and that what i have so far, (but it doesnt work at all!) iptables -F OUTPUT iptables -F INPUT iptables -F FORWARD iptables -t nat -F PREROUTING iptables -P OUTPUT ACCEPT iptables -P INPUT DROP iptables -P FORWARD ACCEPT iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE # IP-Forwarding aktivieren echo 1 > /proc/sys/net/ipv4/ip_forward ## Test Client iptables -A INPUT -s 10.10.0.180 -j ACCEPT Why doesnt it work? Can u give me an exampel how it does work? THat would be really really nice!! Thank you! Spiekey

2 1

Kernel crash
by Selcuk Ozturk 10 Mar '02

10 Mar '02

I am running Suse 7.3 with kernel rpm k_deflt-2.4.10-25. And, I am getting this once in a while: Mar 8 08:12:53 lsound2 kernel: Unable to handle kernel paging request at virtua l address 0019003a Mar 8 08:12:53 lsound2 kernel: printing eip: Mar 8 08:12:53 lsound2 kernel: c01337e1 Mar 8 08:12:53 lsound2 kernel: *pde = 00000000 Mar 8 08:12:53 lsound2 kernel: Oops: 0002 Mar 8 08:12:53 lsound2 kernel: CPU: 0 Mar 8 08:12:53 lsound2 kernel: EIP: 0010:[__remove_from_lru_list+21/104] Mar 8 08:12:53 lsound2 kernel: EFLAGS: 00010202 Mar 8 08:12:53 lsound2 kernel: eax: 00000000 ebx: 00000002 ecx: c031ff20 edx: 0019001a Mar 8 08:12:53 lsound2 kernel: esi: c031ff20 edi: c031ff20 ebp: c258c060 esp: c2595ea8 Mar 8 08:12:53 lsound2 kernel: ds: 0018 es: 0018 ss: 0018 Mar 8 08:12:53 lsound2 kernel: Process ecasound (pid: 998, stackpage=c2595000) Mar 8 08:12:53 lsound2 kernel: Stack: 00000002 c0134631 c031ff20 00000000 c031f f20 00001000 c0134662 c031ff20 Mar 8 08:12:53 lsound2 kernel: c01350c8 c031ff20 c258c060 0022b02c 00000 000 c100ac40 00001000 00000000 Mar 8 08:12:53 lsound2 kernel: c0135790 c258c060 c100ac40 00000000 00000 02c c2595f30 0022b02c 00000000 and a freeze after that. Does anybody have an idea, why this is happenning. Is it more likely to be related to a hardware problem or a kernel bug? Any suggestions to prevent that? --- Selcuk Ozturk

3 3

Help with SUSEfirewall2 and FTP
by Lars Christiansen 10 Mar '02

10 Mar '02

I am setting up a network with SUSEfirewall2 and I want to use an FTP-server in the DMZ. As FTP I use Proftp I have a linuxbox with 3 interfaces one for the internal, one for external, and one i want to use for the DMZ. I cant get it to work By the way i want internal to connect to ftp too. Thanks for helping Lars Christiansen The firewall INTERNAl = 192.168.2.0/24 DMZ 10.0.2.1(FTP-server) FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="eth0" FW_MASQ_NETS="192.168.2.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ftp domain" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="ftp domain" FW_SERVICES_DMZ_UDP="domain syslog" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="www ftp domain" FW_SERVICES_INT_UDP="domain" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.2.0/24 10.0.2.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="yes" FW_SERVICE_DHCPD="" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="192.168.2.0/24,10.0.2.1,tcp,21" FW_FORWARD_MASQ="0/0,10.0.2.1,tcp,21" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no"

2 1

problem with updating mod_php4
by mailinglists＠gmx.li 10 Mar '02

10 Mar '02

hi list, the last days i wanted to update an old machine (installed with suse 7.2) in my intranet with the packages for openssh and mod_php4(-core). unfortunately yast2 and his you-tool always kicked me out. no answer, why! after fetching the filelist the application escapes with the message /sbin/yast2: line 62: 16186 Killed /usr/lib/YaST2/bin/y2bignfat $module $arg2 $arg3 ncurses -T already seen on another system? best regards, daniel -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

Re: [suse-security] iptables firewall -newbie
by Michael Stern 10 Mar '02

10 Mar '02

just having a quick look .. but i **think** you are too strict about the rules. if 10.10.0.180 is able to contact someone out there, the response would be immediately dropped by the INPUT rule's default policy, try adding this iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT somewhere. also, if you only want some trusted ips to surf the net, you would do something like iptables -t nat -A POSTROUTING -s 10.10.0.180/32 -o ppp0 -j MASQUERADE ----- Original Message ----- From: "Mario Ohnewald" <mario.ohnewald(a)gmx.de> To: <suse-security(a)suse.com> Sent: Friday, March 08, 2002 11:04 PM Subject: [suse-security] iptables firewall -newbie > Hello! > I have a little network, one firewall/router. > I want to allow some ips to surf the net, and some are not allowed to leave > the trusted net. > I messed around a lot, and that what i have so far, (but it doesnt work at > all!) > ...

2 1

SuSeFirewall2 Squid and Kernel Recompilation?
by tacchino801＠libero.it 09 Mar '02

09 Mar '02

Hi, we discuss few days ago about, SuSefirewall2, Squid, and transparent proxy configuration using kernel v2.4 series. I have read carefully the "SuSe network manual" and concerning kernel 2.2 series it say: " enable transparent proxy support in kernel and recompile it". I checked the kernel v2.2 series and this option is available, as proposed by manual! I also checked the Kernel v2.4 series and this option does not appear! Questions: Is this option renamed? Is this option still available in 2.4 kernel? Is this option automatically enabled or recalled by an other option? Many thanks for your advices and time;) to all List Lorenzo Rossi

2 1

Re: [suse-security] mailserver
by Michael Stern 08 Mar '02

08 Mar '02

I don't think so ... if a mail server want to send a mail to xyz(a)yourdomain.com the first thing it will do is a MX lookup which can return either the hostname or the IP address of your mail server. it will then connect to whatever the dns result was and try to deliver the mail, so if the MX lookup returns a hostname, the hostname must - of course - resolve to your IP address. it would be interesting to know, what the other users get if they try to send you a mail. if you want i can try to contact your mail server (tell me a sample mail address of your domain), if i get errors, i'll let you know.. cheers, michael ----- Original Message ----- From: "G. Lautenbach" <g.lautenbach(a)chello.nl> To: "Michael Stern" <mhstar(a)gmx.at> Sent: Friday, March 08, 2002 7:17 PM Subject: RE: [suse-security] mailserver > michael, > > it seems that some of the remote mta's can not reach my mailserver and some > do. > the only remote who have reached my mailserver are logged and can be found > in my logs. > is it necesary to attach an ip-adress to my mailserver where i registered my > domain? > > thanks > > -----Oorspronkelijk bericht----- > Van: Michael Stern [mailto:mhstar@gmx.at] > Verzonden: vrijdag 8 maart 2002 17:33 > Aan: Suse-Security > Onderwerp: Re: [suse-security] mailserver > > > > there is a problem in resolving my mailserver. i am able to receive mail > > from some > > people but not all. > > that does that mean? do the messages get bounced, do they just lost > somewhere > in the net, does delivery fail because the remote mta cannot reach your mail > server somehow, ...? what's in the logs, the dsn-mails etc.? > > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > > >

1 0

Re: [suse-security] mailserver
by Michael Stern 08 Mar '02

08 Mar '02

> there is a problem in resolving my mailserver. i am able to receive mail > from some > people but not all. that does that mean? do the messages get bounced, do they just lost somewhere in the net, does delivery fail because the remote mta cannot reach your mail server somehow, ...? what's in the logs, the dsn-mails etc.?

1 0

Re: [suse-security] SuSEfirewall2 and viewing your own internal web site.
by Michael Stern 08 Mar '02

08 Mar '02

try monitoring the system where your web server runs -- does the SYN packet arrive there? ----- Original Message ----- From: "Argentium G. Tiger" <agtiger(a)kc.rr.com> To: <suse-security(a)suse.com> Cc: "Carlos Carrera" <ccarrera(a)lamolina.edu.pe> Sent: Friday, March 08, 2002 5:15 PM Subject: RE: [suse-security] SuSEfirewall2 and viewing your own internal web site. > Carlos Carrera writes: > > >Checked > > > >FW_SERVICE_INT_TCP="80" (you can see web server on FIREWALL inside LAN) > > Yes, I have port 80 configured on FW_SERVICE_INT_TCP. >

1 0