March 2002 - openSUSE Security - openSUSE Mailing Lists

Re: Lilo 2x Linux --> ups, wrong list!
by spiekey 22 Mar '02

22 Mar '02

Hello! I sent my last post accidently to the security list. I was meant to send it to the normal SuSE Linux list. Sorry for any inconvinience! Mario Ohnewald

1 0

Re: Lilo 2x Linux
by spiekey 22 Mar '02

22 Mar '02

Also meine lilo.conf sieht so aus: boot = /dev/hda vga = 771 read-only menu-scheme = Wg:kw:Wg:Wg lba32 prompt timeout = 80 message = /boot/message image = /boot/vmlinuz.test label = Linux Test root = /dev/hda3 image = /boot/vmlinuz label = Linux_2.4.4 root = /dev/hda3 image = /boot/vmlinuz.suse label = Linux_2.4.13 root = /dev/hda3 image = /vmlinuz label = Linux2 root = /dev/hdb1 image = /vmlinuz.slack label = slack root = /dev/hdb1 optional image = /boot/memtest.bin label = memtest86 Gruss Mario ----- Original Message ----- From: Günther J. Niederwimmer <guenther(a)guennet.priv.at> To: <suse-linux(a)suse.com> Sent: Friday, March 22, 2002 9:46 AM Subject: Lilo 2x Linux > Hallo, > was muß ich einstellen wenn ich zwei mal Linux auf dem Rechner habe > Info > Linux auf hda5 lilo im MBR auf hda > Linux auf hdb5 lilo auf discette > > leider ist wenn ich nach der installation auf hdb was ändere, und ich > vergesse yast2 aufzurufen und extra angebe bootsector auf diskette > schreiben, sondern nur lilo aufrufe der bootblock auf MBR hda. > Bei der installation wird aber angegeben booten von diskette ? > wie muß ich die lilo.conf ändern > man lilo & lilo.conf gelesen aber irgendwie komme ich da nicht drauf. > Gruß > Günther > > -- > Um die Liste abzubestellen, schicken Sie eine Mail an: > suse-linux-unsubscribe(a)suse.com > Um eine Liste aller verfügbaren Kommandos zu bekommen, schicken > Sie eine Mail an: suse-linux-help(a)suse.com > >

1 0

SuSE Firewall
by Alberto Santana 22 Mar '02

22 Mar '02

Hi list, I'm using SuSE firewall. /var/log/firewall has this message Mar 21 18:02:38 localhost kernel: Packet log: input ACCEPT eth0 PROTO=6 202.103.114.70:1207 192.168.0.3:22 L=60 S=0x00 I=348 F=0x4000 T=41 SYN (#13) My firewall should not be accepting any packets from that IP. What's going on? Thanks, alberto --

2 1

[Fwd: Re: [suse-security] IPsec with X509 certs problem]
by Thomas Kerkau 21 Mar '02

21 Mar '02

Hi Vitaly, a guess would be a problem with your certificates. You could try to replace the CA based solution by localy stored certificates: remove all left/rightid and -rsasigkey and add left/rightcert conn %default type=tunnel keyingtries=1 keyexchange=ike ikelifetime=240m keylife=20m # leftrsasigkey=%cert leftcert=leftgatway.cer left=%defaultroute leftupdown=/etc/ipsec.updown # leftid=(a)left.gateway.fqdn.name # rightrsasigkey=%cert pfs=yes compress=yes auth=esp authby=rsasig # sample connection conn sample right=x.y.z.149 rightsubnet=10.0.0.0/24 # rightid=(a)right.gateway.fqdn.name rightcert=right.cer # Right security gateway and subnet behind it. auto=start Then store the certificates in the /etc/ipsec.d directory and try again. In case this works you could review your CA structure. A good paper ist http://www.twi.ch/~sna/strongsec/freeswan/install.htm otherwise you could try to go back to preshared secrets discribed in the freeswan dokumentation to verify basic functionality of your VPN. hope this helps, Thomas Vitaly Shishakov wrote: > > Dear all. i need to establish an IPsec tunnel between two networks. > both gateways use FW2. > i did everything like it is described in > http://www.nadmm.com/show.php?story=articles/vpn.inc > (in respect to my case, of cource) > but i get the following errors: > > Mar 21 19:53:09 cmp240b Pluto[13782]: "sample" #1: responding to Main Mode > Mar 21 19:53:09 cmp240b Pluto[13782]: "sample" #1: Peer ID is ID_FQDN: > '@cmpd2.phys.msu.su' > Mar 21 19:53:09 cmp240b Pluto[13782]: "sample" #1: no RSA public key > known for '@cmpd2.phys.msu.su' > > below is sample of one of mine ipsec.conf. (updown script borrowed from > a link in the above article) > > # basic configuration > config setup > interfaces=%defaultroute > klipsdebug=none > plutodebug=none > plutoload=%search > plutostart=%search > uniqueids=yes > > # defaults for subsequent connection descriptions > conn %default > type=tunnel > keyingtries=1 > keyexchange=ike > ikelifetime=240m > keylife=20m > leftrsasigkey=%cert > left=%defaultroute > leftupdown=/etc/ipsec.updown > leftid=(a)left.gateway.fqdn.name > rightrsasigkey=%cert > pfs=yes > compress=yes > auth=esp > authby=rsasig > > # sample connection > conn sample > right=x.y.z.149 > rightsubnet=10.0.0.0/24 > rightid=(a)right.gateway.fqdn.name > # Right security gateway and subnet behind it. > auto=start > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here -- ArcStyler - the Architectural IDE for MDA/J2EE/EJB -> CyberOne Award 2001 -> Winner Crossroads A-List Award 2001 -> IBM Solution Excellence Award winner for Hot Java Solution -> European Information Society Technologies Prize Winner 2001 -> Free trial-version at http://www.ArcStyler.com -> Made with ArcStyler http://www.NewWaveSearchables.com ----- < iO > --------------------------------------------------------- Interactive Objects Software GmbH mailto:Thomas.Kerkau@io-software.com http://www.io-software.com Basler Strasse 65, D-79100 Freiburg, Germany Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 ----------------------------------------------------------------------

1 0

IPsec with X509 certs problem
by Vitaly Shishakov 21 Mar '02

21 Mar '02

Dear all. i need to establish an IPsec tunnel between two networks. both gateways use FW2. i did everything like it is described in http://www.nadmm.com/show.php?story=articles/vpn.inc (in respect to my case, of cource) but i get the following errors: Mar 21 19:53:09 cmp240b Pluto[13782]: "sample" #1: responding to Main Mode Mar 21 19:53:09 cmp240b Pluto[13782]: "sample" #1: Peer ID is ID_FQDN: '@cmpd2.phys.msu.su' Mar 21 19:53:09 cmp240b Pluto[13782]: "sample" #1: no RSA public key known for '@cmpd2.phys.msu.su' below is sample of one of mine ipsec.conf. (updown script borrowed from a link in the above article) # basic configuration config setup interfaces=%defaultroute klipsdebug=none plutodebug=none plutoload=%search plutostart=%search uniqueids=yes # defaults for subsequent connection descriptions conn %default type=tunnel keyingtries=1 keyexchange=ike ikelifetime=240m keylife=20m leftrsasigkey=%cert left=%defaultroute leftupdown=/etc/ipsec.updown leftid=(a)left.gateway.fqdn.name rightrsasigkey=%cert pfs=yes compress=yes auth=esp authby=rsasig # sample connection conn sample right=x.y.z.149 rightsubnet=10.0.0.0/24 rightid=(a)right.gateway.fqdn.name # Right security gateway and subnet behind it. auto=start

1 0

Re: [suse-security] fw with 2 external if (fwd)
by Wallus wallus 21 Mar '02

21 Mar '02

---------- Forwarded message ---------- Date: Thu, 21 Mar 2002 16:06:26 +0100 From: Robert Klein <RoKlein(a)roklein.de> To: Wallus wallus <wallus(a)netlike-gmbh.de>, suse-security(a)suse.com Subject: Re: [suse-security] fw with 2 external if >Hi, > >comments are interspersed. > >> A request from the third computer on 194.123.123.52:80 is >> forwarded to 192.168.10.11:80 >> independet from the firewall-config of SusEfirewall2 (vers 5.0 >> on SuSE 7.3). >> >> Next step: I disconnectet the Kabel of the Interface >> 194.123.123.52. But the request from the third computer on >> 194.123.123.52 is also replayed until I disconnect the >> the cable from the Interface 194.123.123.51 too. >> I have verified, that the ip of the interfaces are correct! (I >> do a retry on 194.123.123.51 with the same >> behavior). > >> FW_MASQ_NETS=" 192.168.10.0/24" > >Shouldn't you mask your internal network, too?> No, because the dmz has a proxy and sendmail relay, that works. The firewall ist just a secure router. >> FW_FORWARD_MASQ=" 0/0,192.168.10.11,tcp,80" >> >> fw_custom_before_port_handling() { # could also be named >> "after_antispoofing()" >> ....... >> iptables -A PREROUTING -j DNAT -t nat -p tcp -s 0.0/24 -d >> 194.123.217.52 --dport 80 --to-destination 192.168.10.12:80 -i >> eth6 > >Are you sure firewall2-custom.rc.config is included? There >has to be a line > >FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" > >in /etc/rc.config.d/firewall2.rc.config, to achieve that. Yes it is. The bevahior describe above is independent of the custum rules. Perhaps, I have to use REDIR or such thing to achive my wishes. But I use need the MASK of the dmz because of the proxys (on proxy run in accelrator mode to be an application gateway firewall for an e-commerce-shop based on IIS). >Robert Harald Wallus

1 0

fw with 2 external if
by Wallus wallus 21 Mar '02

21 Mar '02

Dears, my problem: (I hope the ascii art arives you in the correct shape) Internet | | Router from providers 194.123.123.49/25.255.255.248 | | |-----------------third computer for testing 194.123.123.53 | | | | | | I have two physical Interfaces 194.123.123.51 und .52 | | on the external side of the firewall | | Firewall--192.168.10.1----------------DMZ with two IP numbers | | | 192.168.10.11 und 12 | | | | | | | | | Internal networks with private adresses 192.168.0.0 192.168.230.0 and such My Aim is to forward 194.123.123.51:80 to 192.168.10.11:80 and 194.123.123.52:80 to 192.168.10.12:80 Now I recognize the following behavior: A request from the third computer on 194.123.123.52:80 is forwarded to 192.168.10.11:80 independet from the firewall-config of SusEfirewall2 (vers 5.0 on SuSE 7.3). Next step: I disconnectet the Kabel of the Interface 194.123.123.52. But the request from the third computer on 194.123.123.52 is also replayed until I disconnect the the cable from the Interface 194.123.123.51 too. I have verified, that the ip of the interfaces are correct! (I do a retry on 194.123.123.51 with the same behavior). Parts of my firewall config (Ip addresses changed): FW_DEV_EXT="eth3 eth6" #with IPs 194.123.123.51 und .52 FW_DEV_INT="eth0 eth1 eth4" FW_DEV_DMZ="eth2" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS=" 192.168.10.0/24" FW_FORWARD_MASQ=" 0/0,192.168.10.11,tcp,80" and I try in the custom config fw_custom_before_port_handling() { # could also be named "after_antispoofing()" ....... iptables -A PREROUTING -j DNAT -t nat -p tcp -s 0.0/24 -d 194.123.217.52 --dport 80 --to-destination 192.168.10.12:80 -i eth6 ... Thanks for hints Harald Wallus

2 1

RE: [suse-security] FTP security...
by Michael Garabedian 21 Mar '02

21 Mar '02

All I want to do is lock down the ftp server so it can't be hacked and nasty things not get stored on it. I don't want it to be too complex, just simple and easy, yet at the same time secure and stable. A computer techs wet dream. -----Original Message----- From: Chad Whitten [mailto:cwhitten@nexband.com] Sent: Thursday, March 14, 2002 9:16 AM To: Robert Szentmihalyi; Michael Garabedian Cc: suse-security(a)suse.com Subject: Re: [suse-security] FTP security... but then he would need to setup a webserver on the ftp server which might not be something he needs. On Wednesday 13 March 2002 05:13 pm, Robert Szentmihalyi wrote: > On Wednesday, 13. March 2002 18:23, Michael Garabedian wrote: > > ...I am setting up a linux machine to do ftp and was wondering if > > there was a secure way to set this up so it is not hacked. I used a > > Windows machine and it took someone two days to hack it. Any > > ideas... > > How about WebDAV over https? > This is much more secure than FTP. > > > Thanks. > > > > Mike > > hth, > Robert -- Chad Whitten Network/Systems Administrator neXband Communications cwhitten(a)nexband.com

3 2

Re: [suse-security] FTP security...
by Robert Szentmihalyi 21 Mar '02

21 Mar '02

On Thursday, 14. March 2002 15:15, Chad Whitten wrote: > but then he would need to setup a webserver on the ftp server > which might not be something he needs. No. He would not run an FTP server at all but a web server INSTEAD. With all the features of an FTP server, just much more secure... > > On Wednesday 13 March 2002 05:13 pm, Robert Szentmihalyi wrote: > > On Wednesday, 13. March 2002 18:23, Michael Garabedian wrote: > > > ...I am setting up a linux machine to do ftp and was > > > wondering if there was a secure way to set this up so it is > > > not hacked. I used a Windows machine and it took someone two > > > days to hack it. Any ideas... > > > > How about WebDAV over https? > > This is much more secure than FTP. > > > > > Thanks. > > > > > > Mike > > > > hth, > > Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de

1 0

Firewall2 Logs
by Andy Fore 21 Mar '02

21 Mar '02

Hi, I am running SuSE 7.3 and Firewall2. In my /var/log/messages I keep getting a bunch of firewall messages. How can I have these routed to a separate file? Thanks, arf -- Andy Fore arfore(a)arfore.com http://www.arfore.com "A computer is like an Old Testament god, with a lot of rules and no mercy." --- Joseph Campbell

4 3