March 2002 - openSUSE Security - openSUSE Mailing Lists

firewall2
by Leen de Braal 19 Mar '02

19 Mar '02

Hi all, Getting messages like: linux kernel: SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= SRC=192.33.4.12 DST=212.xxx.xxx.xxx LEN=289 TOS=0x00 PREC=0x00 TTL=232 ID=48708 DF PROTO=UDP SPT=53 DPT=1024 LEN=269 System is SuSE7.3, SuSEfirewall2, running with eth0 internal, and ippp0 for the Internet. Running named with standard config (caching only), dhcpd, samba. Winclients logon OK, though it takes long time (server is dialing out). In firewall config I set FW_STOP_KEEP_ROUTING_STATE="yes", i put highports open, using dynip patch, but above messages only seam to dissapear when I restart firewall with line open. As soon as line is down, and up again, things go wrong (other IP address from ISP). I also set lcp-restart 2 in options.ippp0. I don't know where to look now, anybody could give a hint??

4 4

problem with opening ports using iptables
by Tobias Breckle 18 Mar '02

18 Mar '02

hi list, i recently switched from personal-firewall to a self-made firewall script cause i want to share some ports (e.g. www) to the outside world. i decided to filter those ports and simply drop all other packets. to filter out the packets i use some code like this: IPTABLES -N www IPTABLES -A www -j ACCEPT IPTABLES -I INPUT -p tcp -m state --state NEW -i $INET_DEV --dport 80 -j www IPTABLES -I OUTPUT -p tcp -m state --state NEW -o $INET_DEV --dport 80 -j www but it doesn't work. other outside clients say my servers port 80 is opened but they don't recieve anything when accessing it. from the internal lan all things work fine. does anyone know whats wrong? thx in advance [LAN-Power.net] Tobias Breckle

3 3

Re: [suse-security] firewall2 and ip-change with rp-pppoe
by Pierre Naels 18 Mar '02

18 Mar '02

Hallo Richard, Well, if you have a router you don't need, i aprreciate any donnations! In the meantime, i count on the other friendly people in the mailinglist. If you don't want to be one of them, thats up to you. But why don't you just ignore my posting when you don't have time? best regards pierre ----- Original Message ----- From: "Richard Thornton" <richard(a)programming-analytics.org> To: "Pierre Naels" <pierre(a)naels.de> Cc: <suse-security(a)suse.com> Sent: Monday, March 18, 2002 7:46 PM Subject: Re: [suse-security] firewall2 and ip-change with rp-pppoe > Why don't you just buy a decent router? Who has time for all this > configuration nonsense? > > Richard > > > On Mon, 18 Mar 2002, Pierre Naels wrote: > > > Hello, > > > > i'm using suse 7.3 as a router for a privat network. Filtering and masquerading is done by firewall2. Connection to the internet is done by rp-pppoe. After booting, everything works out fine, but when i get a new IP (/usr/sbin/adsl-stop /usr/sbin/adsl-start), the Firewall2 seems to block the whole linux-mashine (not even ping to an IP). The Firewall-log shows (for example): > > > > Mar 18 10:20:57 linux kernel: SuSE-FW-UNALLOWED-TARGETIN=ppp0 OUT= MAC= SRC=193.189.244.205 DST=213.20.25.63 LEN=76 TOS=0x00 PREC=0x 00 TTL=247 ID=50701 PROTO=UDP SPT=53 DPT=1031 LEN=56 > > > > The router-funktion works out fine though. All Clients in my private Network can reach the Internet as usual. When i restart the Firewall, all problems are gone. > > This looks to me like a Firewall-configuration-problem. Any ideas what to do?? Should i ad any CUSTOMRULES? > > > > > > Thanks for reading so far! > > > > pierre > > > > Here is my firewall2.rc.config: > > > > FW_DEV_EXT="ppp0" > > FW_DEV_INT="eth1" > > FW_DEV_DMZ="" > > FW_ROUTE="yes" > > FW_MASQ_DEV="$FW_DEV_EXT" > > FW_MASQ_NETS="192.168.1.0/24" > > FW_PROTECT_FROM_INTERNAL="no" > > FW_AUTOPROTECT_SERVICES="no" > > FW_SERVICES_EXT_TCP="www ftp ssh 3756" > > FW_SERVICES_EXT_UDP="domain" > > FW_SERVICES_EXT_IP="" > > FW_SERVICES_DMZ_TCP="" > > FW_SERVICES_DMZ_UDP="" > > FW_SERVICES_DMZ_IP="" > > FW_SERVICES_INT_TCP="www ftp domain ssh 139" > > FW_SERVICES_INT_UDP="domain" > > FW_SERVICES_INT_IP="" > > FW_TRUSTED_NETS="" > > FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" > > FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" > > FW_SERVICE_AUTODETECT="yes" > > FW_SERVICE_DNS="no" > > FW_SERVICE_DHCLIENT="no" > > FW_SERVICE_DHCPD="no" > > FW_SERVICE_SQUID="no" > > FW_SERVICE_SAMBA="yes" > > FW_FORWARD="" > > FW_FORWARD_MASQ="" > > FW_REDIRECT="" > > FW_LOG_DROP_CRIT="yes" > > FW_LOG_DROP_ALL="no" > > FW_LOG_ACCEPT_CRIT="yes" > > FW_LOG_ACCEPT_ALL="no" > > FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" > > FW_KERNEL_SECURITY="no" > > FW_STOP_KEEP_ROUTING_STATE="no" > > FW_ALLOW_PING_FW="yes" > > FW_ALLOW_PING_DMZ="no" > > FW_ALLOW_PING_EXT="yes" > > FW_ALLOW_ > > FW_TRACEROUTE="yes" > > FW_ALLOW_ > > FW_SOURCEQUENCH="yes" > > FW_ALLOW_ > > FW_BROADCAST="no" > > FW_IGNORE_ > > FW_BROADCAST="yes" > > FW_ALLOW_CLASS_ROUTING="no" > > > > > > >

1 0

RE: [suse-security] What to do against ARP-Poisoning?
by Reckhard, Tobias 18 Mar '02

18 Mar '02

> What worries me most is the possibility of an other > root-server to play > "router" for my traffic. [snip] ..by tricking both your server and the router. OK. > The websites are not too interesting for attackers Umm.. see the issue of Cryptogram released today. Check http://www.counterpane.com/crypto-gram-0203.html#7, lesson number 1. > and login > is done via ssh > (v2) only, so at least I get a warning if something strange > happens. Be sure to notice host key changes and don't use server-stored passwords for authentication. They'd pass through the 'router' as well and he could rather easily set up an SSH proxy. > But the > mail-traffic remains a problem! As far as I can see up to > now, sendmail-tls > and qpopper use plain text at least for the mail-body. So the > content is > disclosed to any attacker if not the username/password. Well, SMTP and POP3 are clear-text protocols by nature. You can stack them on top of SSL/TLS, but you need clients that can do that as well. With emails, encryption and authentication of the message content using PGP or S/MIME is also in widespread use. > I > sure try to avoid > ftp, but webmasters on Mac are used to FTP... Maybe there's a > scp-client for > Macs? I'll have a look. Another option would be to use IPSec or a functionally similar VPN technology. Cheers Tobias

2 1

Re: [suse-security] What to do against ARP-Poisoning?
by Roland Hilkenbach 18 Mar '02

18 Mar '02

Am Montag, 18. März 2002 15:59 schrieb Peter Pfannenschmid: > Hello, > > just one quick question: is it really true that sendmail-tls/ssl and > qpopper-tls/ssl does NOT encrypt message bodies (as stated below)? I do not > want to believe this... > > Thank your very much, > > Peter Pfannenschmid > I forgot to mention, that MS Exchange is capable of TLS and not of SMTP-AUTH and that I used the TLS-option of Netscape-Messenger to produce the Message in my previous posting. I used the Exchange-Server only because that way I could answer the question faster because the root-server is not fully setup yet (I was in the ARP-stage until now ;.) Roland Hilkenbach

1 0

Re: [suse-security] What to do against ARP-Poisoning?
by Roland Hilkenbach 18 Mar '02

18 Mar '02

Am Montag, 18. März 2002 15:59 schrieb Peter Pfannenschmid: > Hello, > > just one quick question: is it really true that sendmail-tls/ssl and > qpopper-tls/ssl does NOT encrypt message bodies (as stated below)? I do not > want to believe this... > > Thank your very much, > > Peter Pfannenschmid > I made a quick test and that's the result of an encrypted Message (I have to admit, via an Exchange-Server, sorry...). I had to masquerade some entries. You'll notice an encrypted login but cleartext body: 220 blabla.de ESMTP Server (Microsoft Exchange Internet Mail Service 5.5.2653.13) ready EHLO profil-hannover.de 250-blabla.de Hello [pD9E35E24.dip.t-dialin.net] 250-XEXCH50 250-HELP 250-ETRN 250-DSN 250-SIZE 0 250-AUTH LOGIN 250 AUTH=LOGIN AUTH LOGIN XxXxXxXxXxXx 334 XxXxXxXxXxXxXx XxXxXxXxXxXx 235 LOGIN authentication successful MAIL FROM:<roland(a)profil-hannover.de> 250 OK - mail from <roland(a)profil-hannover.de> RCPT TO:<rh(a)profil-hannover.de> 250 OK - Recipient <rh(a)profil-hannover.de> DATA 354 Send data. End with CRLF.CRLF Sender: roland Message-ID: <3C960E4A.6DF775C2(a)profil-hannover.de> Date: Mon, 18 Mar 2002 16:56:58 +0100 From: Roland Hilkenbach <roland(a)profil-hannover.de> X-Mailer: Mozilla 4.78 [de] (X11; U; Linux 2.4.10-4GB i686) X-Accept-Language: en MIME-Version: 1.0 To: rh(a)profil-hannover.de Subject: Testmail Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: quoted-printable Ein Test der Verschl=FCsselung . 250 OK QUIT 221 closing connection Bye bye Roland Hilkenbach

1 0

RE: [suse-security] What to do against ARP-Poisoning?
by Reckhard, Tobias 18 Mar '02

18 Mar '02

> I thought about prevention of ARP-Poisoning and came up with > the following > ideas: The question here to me is what you are trying to accomplish. I can see a couple of things resulting from ARP poisoning in the subnet your server is in. I can see others mimicking your web site and tricking visitors this way. I can also see a complete denial of service against your server. One other possibility is that they could mimic your path of administration as well and thereby learning, e.g. your user password from a telnet session across their machine. One thing you need to be aware of is that measures against arp poison on your host alone won't really help a lot, you need to at least protect the router as well to avoid most problems. Since you probably have no influence on the router, you're left with the following answers to the problems I saw: 1. Pretend web site: This one can be solved by using an SSL server certificate for your WWW server name. It breaks if someone is successful in acquiring a certificate that a visitor of yours will accept. 2. Denial of Service: You need a static arp entry on the router to prevent this. A rogue host on the same subnet as your host can probably DoS it in a variety of other ways, though. This kind of thing becomes evident very quickly and it is very easy to trace the source of the attack, though, so I don't think the risk is that high. If you're scared of this kind of thing, you need to take the server to a network of your own. 3. Hack the admin: Don't use telnet, FTP or any other clear-text protocols. If using SSH, use Strict Modes and public key authentication in favour of passwords. Cheers Tobias

2 1

AW: [suse-security] telnet myhost:25
by Albl, Thomas 18 Mar '02

18 Mar '02

I don't if anyone mentioned, but it seems to me that /etc/hosts.allow is your friend. Here is the control, what port is allowable from what host. ;-) Nearby a firewall i guess. But i don't know if it includes ports which are not controlled by inetd. It's worth a try. Should be something like: ALL: 192.168.1.1 # My Remote smtp: 192.168.1.110 # My Workstation Right out of the Brain and not sure how to handle wildcards in the octets... but i hope that helps Otherwise a firewall will help. -- Mit freundlichem Gruß Thomas Albl Deutscher Städtetag Tel. : 0221/3771-210 FAX : 0221/3771-128 eMail: mailto:thomas.albl@staedtetag.de Web : http://www.staedtetag.de -----Ursprüngliche Nachricht----- Von: E. Scichilone [mailto:linux@telsh.de] Gesendet: Freitag, 15. März 2002 18:32 An: suse-security(a)suse.com Betreff: [suse-security] telnet myhost:25 Hello list, how can I turn off the "feature", that anybody can telnet to my smtp-port? Are there any special progs necessary or is the PrivacyOption goaway or similar enough? How do you handle that? thanx Enrico -- -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

[bit OT] FreeS/WAN
by Schoenwaelder Oliver 18 Mar '02

18 Mar '02

Hi, anybody out there who knows how to use SuSE freeswan package with a self made kernel? I configured and tested FreeS/WAN in our development area and now I want to use it in production. But it fails due to missing modules in our customized kernels. It seems that ipsec modules are not installes in the correct module path. It uses the path for the standard kernel, e.g. /lib/modules/2.4.16-4GB. And using make menuconfig I don't see anything ipsec related. Thx, Oliver

4 4

problems with Port Forwarding
by stefan.wurz 17 Mar '02

17 Mar '02

hi List ! i have a great problem with port forwarding ! my network : <db-host>---<firewall>-------<client> LAN WAN on the db-host is running : WIN NT 4 Server with an oracle database configured as MTS server the listener is listening on port 5000 on the firewall : suse 7.1 with ipchains openssh 2.9.9p2 client : win 98 or win nt problem : i connect with teraterm from the <client> to the firewall and forward the localport 5000 to the <dbhost>:5000 all works good with the database but when you do nothing for 2 minutes, the connection to the database failes and i get an oracle error , why? i can see on the log file of the firewall that the packet is comming back from the <db-host>. has anybody an idea ? is there any problem with openssh ? thanx a lot!

1 0