March 2002 - openSUSE Security - openSUSE Mailing Lists

mailserver
by G. Lautenbach 08 Mar '02

08 Mar '02

Hello list, there is a problem in resolving my mailserver. i am able to receive mail from some people but not all. i have registered my own domain-name and installed a nameserver and using sendmail for mailtransport and qpopper. when i give "dig mx some.net" it resolves my mailserver "mail.some.net" nslookup some.net returnes with my ip-adress what have i overlooked? any help appreciated regards Ger

1 0

Re: [suse-security] ident remains open
by Michael Stern 08 Mar '02

08 Mar '02

> BUT - if you then e.g. try to pop mail from external > pophost you'll need a lot more time until new mail > arrives you, cauzed by the ignored, and not blocked, > ident call of that pop-server :O) same goes for SMTP (especially if you run an smtp server) i think DROPping by default and REJECTing identd is fine. if you just want to secure your private box/server you could also start dropping incoming packets with SYN flags after a certain limit, which makes a "quick portscan from 1:65535" a bit more difficult --- there is plenty of stuff to do (what about MIRRORing identd? the pop servers will get their own identd response, but is this bad?)

1 0

ident remains open
by Mike Otto 08 Mar '02

08 Mar '02

SuSEfirewall2 v2.1 iptables v1.2.5 Linux-Kernel 2.4.18 (5) ------------------------- Hello, today I looked through my firewall2 configs and changed some rules. Using a service from outside I tried a quickscan: http://scan.sygatetech.com/quickscan.html It says that IDENT Port:113 is still open. *ups ... I found another port scanner service at grc.com and repeated the test https://grc.com/x/ne.dll?bh0bkyd2 Result: "113 Ident Closed - Your computer has responded that this port exists but is currently closed to connections." Though there is no service running on this port I began to worry about my connection Fortunatley grc.com has a reasonable explanation. Here is their answer: "You may recall, [...] that attempting to connect to a stealthed port is both costly and painful for the contact initiator -- which is why it's so cool to stealth our machines But the problem with simple stealthing of port 113 is that we don't want to hurt the servers we are trying to contact when they turn around and send us their IDENT query. If they get no response at all from their port 113 query, our connection to them (which initiated their query in the first place) will be delayed or perhaps completely abandoned." Source: http://grc.com/faq-shieldsup.htm#IDENT Ok, I understand this point of view. And I suppose SuSEfirewall just buildet this feature (sic!) in. But there are still questions I d like ask someone: Hoch much sense does it make trying to hide my computer by dropping, for example, icmp packets when there is still a port open which I cannot block myself? - Really ? Is it that I really can not block this port with iptables or is it just a SuSE feature ? ;-) Regards, Mike

2 1

Re: [suse-security] ident remains open
by Michael Stern 08 Mar '02

08 Mar '02

sygatetech.com reports "You are not fully protected: We have detected that some of our probes connected with your computer. If you are not already running our Enterprise Security Agent or our Personal Firewall, try our Award-Winning Personal Firewall now." here ... because my computer responds to a ping (up to 4 pings per minute =) but everything else here is blocked, including ident, so it's definitely possible (why shouldn't it be =) > Hoch much sense does it make trying to hide my computer > by dropping, for example, icmp packets when there is still > a port open which I cannot block myself? quite a bit. if you just reject the packets, the attacker would know that your port is closed. if you just drop the packet, the attacker does not know anything valuable, so there is a very good chance he won't concentrate on your machine any further. also, nmap can (roughly) tell your os if you reject packets - plus it takes some bytes outgoing bandwidth. it's not difficult to just drop the packets with iptables ... so they only reason you would not do it, is because you want to be nice to remote servers. rejecting 113 is not a bad idea, because mail servers like sendmail will - by default - try to connect to your identd port. > Regards, michael

1 0

RE: [suse-security] Firewall2 log - What does this mean
by Steve Fenwick 08 Mar '02

08 Mar '02

Hi Kevin, We've got the same problem from our NT box. The multihomed NT server box has 2 nics. One goes to our internal network. One is dedicated via a switch to our Linux internet server. Both have different ip addresses ( I mean network addresses ie 192.168.7.XX and 192.168.1.XX) The Linux box has 2 nics. One to the internet router, and one to the NT box via the switch(192.168.1.XX). the NT box transmits a broadcast every 5 minutes (exactly 5 mins) on the second nic 192.168.1.xx but the traffic is for the other network (192.168.7.xx). So far we have turned off routing, all the bindings for the second nic, disabled wins, disabled browsing, We still get the broadcast. Why it's on the wrong nic is a mystery. I suspect that this is one of the reasons that MS software is insecure. I am just going to disable the reporting of Martian source on that interface. As for where its coming from in /usr/var/messages ther should be something like this. Mar 8 14:07:34 floyd kernel: martian source 255.255.255.255 from 192.168.7.XX, on dev eth0 Mar 8 14:07:34 floyd kernel: ll header: ff:ff:ff:ff:ff:ff:00:02:b3:3b:6d:73:08:00 The first line will tell you what it is and where from (in this case broadcast from 192.168.7.xx) The second line in my case shows all the ff ie 255.255.255.255 followed by the MAC address of the nic/machine. So now you know a bit more but like me you are no closer to solving the problem :-) I'm just off to turn ours off. Bye for now Steve -----Original Message----- From: Kevin Passey [mailto:kpassey@kdpsoftware.co.uk] Sent: 08 March 2002 14:47 To: SuSE Security (E-mail) Subject: RE: [suse-security] Firewall2 log - What does this mean Hi again, This is what I have set up Internet-------------->>>>> ADSL Router>>>>>>>NT SBS with SMTP only - plus firewall and Proxy --------------------->>>>> Same >>>>>>>>>>>>>Linux 7.3 Suse - Web Server + forward rules to DB server The NT machine is connected to our internal network it has 2 nic's 10.0.0.xxx plus 62.49.zzz.xxx (as in the log) The Linux machine is also connected to our internal network it too has 2 nic's 10.0.0.5 plus 62.49.zzz.yyy. Are the packets somehow getting past the NT firewall - how can I tell where they are coming from. Regards Kevin -----Original Message----- From: Michael Appeldorn [mailto:appeldorn@codixx.de] Sent: 08 March 2002 14:40 To: SuSE Security (E-mail); Kevin Passey Subject: Re: [suse-security] Firewall2 log - What does this mean Quite easy [snip] What does "kernel: martian source aabbccdd for 11223344, dev eth0" mean? These are packets that Linux does not expect from the direction they came from (i.e. packets from internal hosts coming in on the external interface). The cause is probably a misconfigured machine on your LAN. You can turn off logging those packets via /proc/sys/net/ipv4/conf/*interface*/log_martians which is documented in /usr/src/linux/Documentation/proc.txt [snap] Michael Appeldorn This message is sent in confidence for the addressee only. It may contain confidential or sensitive information. The contents are not to be disclosed, copied, or forwarded to anyone other than the addressee without permission. Unauthorised recipients are requested to preserve this confidentiality and to advise us of the error in transmission, by emailing us at: info(a)yeovil-college.ac.uk Thank you for your cooperation.

1 0

RE: [suse-security] Firewall2 log - What does this mean
by Kevin Passey 08 Mar '02

08 Mar '02

Hi again, This is what I have set up Internet-------------->>>>> ADSL Router>>>>>>>NT SBS with SMTP only - plus firewall and Proxy --------------------->>>>> Same >>>>>>>>>>>>>Linux 7.3 Suse - Web Server + forward rules to DB server The NT machine is connected to our internal network it has 2 nic's 10.0.0.xxx plus 62.49.zzz.xxx (as in the log) The Linux machine is also connected to our internal network it too has 2 nic's 10.0.0.5 plus 62.49.zzz.yyy. Are the packets somehow getting past the NT firewall - how can I tell where they are coming from. Regards Kevin -----Original Message----- From: Michael Appeldorn [mailto:appeldorn@codixx.de] Sent: 08 March 2002 14:40 To: SuSE Security (E-mail); Kevin Passey Subject: Re: [suse-security] Firewall2 log - What does this mean Quite easy [snip] What does "kernel: martian source aabbccdd for 11223344, dev eth0" mean? These are packets that Linux does not expect from the direction they came from (i.e. packets from internal hosts coming in on the external interface). The cause is probably a misconfigured machine on your LAN. You can turn off logging those packets via /proc/sys/net/ipv4/conf/*interface*/log_martians which is documented in /usr/src/linux/Documentation/proc.txt [snap] Michael Appeldorn

1 0

Re: [suse-security] SuSEfirewall2 and viewing your own internal web site.
by Michael Stern 08 Mar '02

08 Mar '02

actually i know a problem similar to this one if nat is used to redict a connection from the intranet to another server in the intranetwhich will not work (generating nice log entries in the server's log). regards, michael ----- Original Message ----- From: "Michael Garabedian" <mikejr(a)emergyscorp.com> To: "'Michael Stern'" <mhstar(a)gmx.at>; "'Suse-Security'" <suse-security(a)suse.de> Sent: Friday, March 08, 2002 3:32 PM Subject: RE: [suse-security] SuSEfirewall2 and viewing your own internal web site. > > It is the firewall....and it is supposed to be that way... > > Your internal machines should never have to out to the internet to come > back in, what you need to do is set up the lmhosts files on your local > computers with the web address and internal ip number you want to link > it to. > > Or, if you are using DHCP you may set up an entry to tell it that > www.yoursite.com is actually 10.0.0.2 instad of 44.55.66.77(external > address) > > It is a security feature of the firewall.

1 0

Firewall2 log - What does this mean
by Kevin Passey 08 Mar '02

08 Mar '02

Hi list, I'm new to firewall2 and I am investigating the use of raw iptables as an alternative. May be a stupid question - but here goes anyway - thanks for you patience.. What does this mean:- Mar 7 19:49:31 dilmom kernel: martian source 10.0.0.5 from 62.49.zzz.xxx, on dev eth0 Mar 7 19:49:31 dilmom kernel: ll header: 00:10:4b:00:d4:1b:00:90:27:6d:cb:e9:08:00 Mar 7 19:49:33 dilmom kernel: martian source 10.0.0.5 from 62.49.zzz.xxx, on dev eth0 Mar 7 19:49:33 dilmom kernel: ll header: 00:10:4b:00:d4:1b:00:90:27:6d:cb:e9:08:00 Mar 7 19:49:34 dilmom kernel: martian source 10.0.0.5 from 62.49.zzz.xxx, on dev eth0 Mar 7 19:49:34 dilmom kernel: ll header: 00:10:4b:00:d4:1b:00:90:27:6d:cb:e9:08:00 Mar 7 19:49:37 dilmom kernel: martian source 10.0.0.5 from 62.49.zzz.xxx, on dev eth0 Mar 7 19:49:37 dilmom kernel: ll header: 00:10:4b:00:d4:1b:00:90:27:6d:cb:e9:08:00 Mar 7 19:49:39 dilmom kernel: martian source 10.0.0.5 from 62.49.zzz.xxx, on dev eth0 Mar 7 19:49:39 dilmom kernel: ll header: 00:10:4b:00:d4:1b:00:90:27:6d:cb:e9:08:00 Mar 7 19:49:40 dilmom kernel: martian source 10.0.0.5 from 62.49.zzz.xxx, on dev eth0 The masked ip address in our NT server. Thanks. To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Re: [suse-security] SuSEfirewall2 and viewing your own internal web site.
by Michael Stern 08 Mar '02

08 Mar '02

it may also be a TCPIP/NAT issue, not necessarily the firewall. regards, michael ----- Original Message ----- From: "James Bliss" <bliss(a)attbi.com> To: <suse-security(a)suse.com> Sent: Friday, March 08, 2002 5:36 AM Subject: Re: [suse-security] SuSEfirewall2 and viewing your own internal web site. > This has been an ongoing conversation on the SLE mailing list off and on. > This is an issue with the anti-spoofing rules with the firewall2 configuration > (a valid security implementation by the way) > > First off. we need a view of what the following command provides: > grep -v ^# /etc/rc.config.d/firewall2.rc.config > > Also, I would suggest adding: > At the end of firewall2.rc.config: > Section 25. ) > > FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" > > Then in firewall2-custom.rc.config: > In the fw_custom_before_antispoofing() section add: > iptables -A INPUT -i <external interface, such as eth0> -s <internal network > range, such as 192.168.1.0/24> -d (external IP address> -j ACCEPT > > This line should look like: > iptaqbles -A INPUT -i eth0 -s 192.168.1.0/24 -d 1.1.1.1 -j ACCEPT > 192.169.1.0 should be your internal address range with a 0 at the end. > 1.1.1.1 should be the IP address of you external interface. > > Then let us know what your resolution is. And we can proceed from there. > > (Thanks Togan for the grep command, that is very useful). > > Jim >

2 1

probs with new openssh-pkgs
by Florian Rossol 08 Mar '02

08 Mar '02

Hi security-list, I installed the new openssh-rpms from ftp.suse.com. Now I have to problems: First: Everytime I start ssh via /etc/init.d/ssh start I get in /var/log/warn: ---schnipp--- Mar 7 17:32:25 host sshd[5595]: error: Bind to port 22 on 0.0.0.0 failed: Address already in use. ---schnipp--- sshd runs before i execute /etc/init.d/ssh start not, because ps -aux | grep sshd has no output. Nevertheless sshd starts properly during execution of /etc/init.d/ssh, because I get ---schnipp--- user@host:~ > ps -aux | grep sshd root 6110 0.0 0.3 2236 836 ? S Mar07 0:00 /usr/sbin/sshd user@host:~ > ---schnipp--- and I can log on the host without problems. Is the error-messages in warn something i have to wonder about? Secondly I can't connect from the host, on which i installed the new package, to another host via ssh. This worked fine before the update. Here the output of ssh: ---schnipp--- user@host:~ > ssh -v user(a)ftp.domain.de OpenSSH_2.9.9p2, SSH protocols 1.5/2.0, OpenSSL 0x0090601f debug1: Reading configuration data /etc/ssh/ssh_config debug1: Applying options for * debug1: Seeding random number generator debug1: Rhosts Authentication disabled, originating port will not be trusted. debug1: restore_uid debug1: ssh_connect: getuid 510 geteuid 510 anon 1 debug1: Connecting to ftp.domain.de [XXX.XXX.XXX.XXX] port 22. debug1: temporarily_use_uid: 510/100 (e=510) debug1: restore_uid debug1: temporarily_use_uid: 510/100 (e=510) debug1: restore_uid debug1: Connection established. debug1: identity file /home/user/.ssh/identity type -1 debug1: identity file /home/user/.ssh/id_rsa type -1 debug1: identity file /home/user/.ssh/id_dsa type -1 debug1: Remote protocol version 1.99, remote software version OpenSSH_3.1p1 debug1: match: OpenSSH_3.1p1 pat ^OpenSSH debug1: Local version string SSH-1.5-OpenSSH_2.9.9p2 debug1: Waiting for server public key. debug1: Received server public key (768 bits) and host key (1023 bits). debug1: Host 'ftp.domain.de' is known and matches the RSA1 host key. debug1: Found key in /home/user/.ssh/known_hosts:1 debug1: Encryption type: 3des debug1: Sent encrypted session key. debug1: Installing crc compensation attack detector. Disconnecting: Corrupted check bytes on input. debug1: Calling cleanup 0x8065650(0x0) ---schnipp--- Any ideas? Thanks a lot Florian

2 1