April 2002 - openSUSE Security - openSUSE Mailing Lists

chroot with OpenSSH
by Kurt Minder 04 Apr '02

04 Apr '02

hi does anybody know a good howto for configuring a chroot environment with openssh on a linux 7.3 box kurt

1 0

lock out during ssh
by Alexander Pacheco 04 Apr '02

04 Apr '02

Hi, I have a Suse 7.3 with Susefirewall activated at home which I can access from workplace using ssh. My problem is my home PC locks up if I connect using my user name and try to change directory but not when I login as root. I get the same problem when I do ssh localhost on my PC. Could anybody give me a solution to this. Thanks for your help Alex -- ************************************************************* * Alexander Pacheco * * 2323, NPB, Tel: Office (352)-392-3010 * * P.O. box 118435 Home (352)-336-4036 * * University of Florida, * * Gainesville, Fl 32611-8435. * * pacheco(a)qtp.ufl.edu alexp(a)ufl.edu * * http://www.qtp.ufl.edu/~pacheco * *************************************************************

1 0

Antwort: Re: [suse-security] Open Relay Problems
by BLeonhardt＠analytek.de 04 Apr '02

04 Apr '02

Usually you can say in /etc/mail/access : <local-net> RELAY <spammers-domain> ERROR: " 550 Don't wanna have Spam :-) " and then ./sbin/conf.d/SuSEconfig.sendmail [enter] now the new access.db should be build .. and the spammer should be blocked, right ? Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ________________________________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Roman Drahtmueller An: Shonne Beavers <shonnedb(a)directvinternet.com> <draht(a)suse.de> Kopie: suse-security(a)suse.de Thema: Re: [suse-security] Open Relay Problems 03.04.02 19:30 Bitte antworten an Roman Drahtmueller > > I have a SuSE 7.3 Sendmail host running Sendmail v8.11 function as my > Primary MX. Someone is spamming mail into my domain. This host does not > have any accounts on it, just an aliases file. How can I stop this?? > What is your problem? 1) You are running an open relay 2) You get spammed 2) is not easy to solve, and 1) is non-trivial to achieve (that this sendmail in fact does relaying). > Shonne Beavers Roman. -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

4 3

RE: RE: [suse-security] OT: User accounts
by BLeonhardt＠analytek.de 04 Apr '02

04 Apr '02

THANKS ALL FOR YOUR SUGGESTIONS !!! That helps and works :-) ... Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ________________________________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40

1 0

Re: Helmut Dehling/DS/GFK/DE ist außer Haus.
by Michael Stern 03 Apr '02

03 Apr '02

Sie könnten Ihren Autoresponder ruhig so konfigurieren, dass nicht die ganze SuSE-Security Community bei jedem Post von Ihnen eine Autoreponser bekommt (parsen Sie einfach den Header nach List-* Feldern, sodass in diesem Fall keine Mail gesendet wird). Danke, Michael Stern ----- Original Message ----- From: <Helmut.Dehling(a)gfk.de> To: "Michael Stern" <mhstar(a)gmx.at> Sent: Thursday, April 04, 2002 1:01 AM Subject: Helmut Dehling/DS/GFK/DE ist außer Haus. Ich werde ab 02.04.2002 nicht im Büro sein. Ich kehre zurück am 15.04.2002. Ich werde Ihre Nachricht nach meiner Rückkehr beantworten.

2 1

Firewall2 not working with VPN
by Matthias Dietzsch 03 Apr '02

03 Apr '02

Hello can any help? I have a SUSE 7.1 installatin kernel Linux 2.2.18 with Suse Firewall 2 on my pppoe router with masq. eth0 external 192.168.2.1 bond0 internal 192.168.100.1 I want to make with my win2000 computer a connection over this pppoe router to another firewall (3com Superstack 3). In the firewall log file i cannot see any deny information about this vpn connection. What modules must i load or what ports must i give free? Thanks for any help.

1 0

Open Relay Problems
by Shonne Beavers 03 Apr '02

03 Apr '02

I have a SuSE 7.3 Sendmail host running Sendmail v8.11 function as my Primary MX. Someone is spamming mail into my domain. This host does not have any accounts on it, just an aliases file. How can I stop this?? Shonne Beavers shonnedb(a)directvinternet.com ICQ 138341211 "In order to accomplish good, we must compromise some of the evils of this world." --Unknown

2 1

Bandwidth control
by Lars Christiansen 03 Apr '02

03 Apr '02

Does anyone know of a way to limit bandwith when users are useing Kazaa, Napster and other programs like those. I want to limit bandwidth on a IP-adress level. I dont want to deny the use of the programs, only limit bandwidth. If anyone knows of programs or solutions i would like to know where to get programs and doc's. Thanks in advance Lars Christiansen

4 4

Re: [suse-security] Suse Linux Firewall 2
by Michael Appeldorn 03 Apr '02

03 Apr '02

>Hi. > >I am running Suse 7.3 with Firewall 2. >Now i want to disable portforwarding at scheduled times, to disable Microsoft >Messenger from my Lan. >I can'r let MSN run through squid because one of the client's is a iMac and >the MSN client for the iMac won't allow the use of Generic Proxy. > >So i am using portformarding for that. (IP_Forward). Is there a possibility to >make a cron job for disabling MSN in working hours ? > So why not, edit /etc/crontab as follows 0 20 * * * /sbin/SuSEfirewall start file /etc/rc.config.d/firewall2.rc.config.night 0 08 * * * /sbin/SuSEfirewall start file /etc/rc.config.d/firewall2.rc.config.day cp to firewall.configs to day|night and adapt them snip /sbin/SuSEfirewall ------ Options: start generate and load the firewall filter rules from /etc/rc.config.d/firewall2.rc.config stop unload all filter rules close no incoming network traffic except bootp+ping (used for boot security) file FILENAME same as \"start\" but load alternate config file FILENAME test generate and load the filter rules but do not drop any packet but log to syslog anything which *would* be denied status print the output of \"iptables -L -nv\" debug print the iptables command to stdout instead of executing them help this output Calling $0 without any option is the same as the \"start\" option. The \"file FILENAME\" option my be used with the start, test and debug options.\n" exit 0 } ------ snap Yours Michael Appeldorn

1 0

RE: [suse-security] OT: User accounts
by Peer Stefan 03 Apr '02

03 Apr '02

i just recognized that attachements do not make it to the list... so, here it comes: -------------------------------------- #!/usr/bin/perl -w $debug = 1; $exist = 0; open STDIN,"<"; while (<STDIN>){ $exist = 1; ($uname,$x,$uid,$gid,$comment,$homedir,$shell) = split ":",$_; chomp ($uname,$x,$uid,$gid,$comment,$homedir,$shell); # $debug && print " -- found $uname:$x:$uid:$gid:$comment:$homedir:$shell\n"; # checking whether user exist open PASSWD,"</etc/passwd"; while(<PASSWD>){ ($un,$xx,$u,$g,$c,$d,$s) = split ":",$_; chomp ($un,$xx,$u,$g,$c,$d,$s); if ($uname =~ /\$un/) { print " * User $uname already exist!\n"; $exist = 0; } else { $exist = 1; } } close PASSWD; if ($exist != 0) { # changing every shell to false? # $shell =~ s/(bash|csh|ksh|sh|tcsh)/false/g; if ($uid > 100){ print "Executing 'useradd -u $uid -g $gid -c \"$comment\" -d $homedir -s $shell $uname' ... "; #`useradd -u $uid -g $gid -c \"$comment\" -d $homedir -s $shell $uname`; print "done.\n"; } else { print " * useradd -u $uid -g $gid -c \"$comment\" -d $homedir -s $shell $uname\n"; } } else { print " * User $uname already exist!\n"; } } close STDIN; exit 0; ------------------------- -----Original Message----- From: Peer Stefan [mailto:stefan.peer@tiwag.at] Sent: Wednesday, April 03, 2002 2:15 PM To: Suse-Security Subject: RE: [suse-security] OT: User accounts i once wrote a script myself, which adds users from any unix-like password-file to a system (reads STDIN). have a look at the attachment. it's provided 'asis' - feel free to add or delete stuff as you like. cheers stefan ps: it just adds users with uids greater than 100 - so no system user is added. -----Original Message----- From: Michael Stern [mailto:mhstar@gmx.at] Sent: Wednesday, April 03, 2002 2:07 PM To: Suse-Security Subject: Re: [suse-security] OT: User accounts well of course you could create a script manually which reads and parses an input file and passes the data to useradd and whatever program you want to execute ... i don't know whether suse does provide one, but it shouldn't be too difficult to write such a script. ----- Original Message ----- From: <BLeonhardt(a)analytek.de> To: <suse-security(a)suse.com> Sent: Wednesday, April 03, 2002 2:01 PM Subject: [suse-security] OT: User accounts Hello, does anybody have a idea, how to generate more than 100 Users without having to add them manually or with YaST ? Is there anything like a skript ? The users need the home-dir's too ... ! Thank's ! Best Regards / Mit freundlichen Grüßen Bruno Leonhardt -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Suse Linux Firewall 2
by Ralf Ronneburger 03 Apr '02

03 Apr '02

Hi Jasper, sure there is, two possibilities I can think of: 1. make you own iptables-skript and run it by cron 2. make a copy of your /etc/rc.d/suse-firewall2.conf ( don't know the exact name, don't have it installed, use my own script) and then make a script like this (I'm not sure either, if rcsusefw is the right command, but it's probably something like that): morning: mv /etc/rc.d/suse-firewall2.conf /etc/rc.d/suse-firewall2.conf.night mv /etc/rc.d/suse-firewall2.conf.day /etc/rc.d/suse-firewall2.conf rcsusefw restart evening: mv /etc/rc.d/suse-firewall2.conf /etc/rc.d/suse-firewall2.conf.day mv /etc/rc.d/suse-firewall2.conf.night /etc/rc.d/suse-firewall2.conf rcsusefw restart I don't know, if this would be very elegant, but it should work :-). Best regards, Ralf Ronneburger Jasper Rohling wrote: >Hi. > >I am running Suse 7.3 with Firewall 2. >Now i want to disable portforwarding at scheduled times, to disable Microsoft >Messenger from my Lan. >I can'r let MSN run through squid because one of the client's is a iMac and >the MSN client for the iMac won't allow the use of Generic Proxy. > >So i am using portformarding for that. (IP_Forward). Is there a possibility to >make a cron job for disabling MSN in working hours ? > >Met vriendelijke groet, >Kind regards, > >Jasper Rohling >Senior System Engineer > >Business-line Infrastructure and Security >CSS System Integration >Ankersmidplein 2 >1056 CK Zaandam > >Office :+31 (0) 75 6539444 >Mobile :+31 (0) 6 21281247 >E-mail : j.rohling(a)css.nl >website : http://www.css.nl > > >

2 1

RE: [suse-security] OT: User accounts
by Peer Stefan 03 Apr '02

03 Apr '02

i once wrote a script myself, which adds users from any unix-like password-file to a system (reads STDIN). have a look at the attachment. it's provided 'asis' - feel free to add or delete stuff as you like. cheers stefan ps: it just adds users with uids greater than 100 - so no system user is added. -----Original Message----- From: Michael Stern [mailto:mhstar@gmx.at] Sent: Wednesday, April 03, 2002 2:07 PM To: Suse-Security Subject: Re: [suse-security] OT: User accounts well of course you could create a script manually which reads and parses an input file and passes the data to useradd and whatever program you want to execute ... i don't know whether suse does provide one, but it shouldn't be too difficult to write such a script. ----- Original Message ----- From: <BLeonhardt(a)analytek.de> To: <suse-security(a)suse.com> Sent: Wednesday, April 03, 2002 2:01 PM Subject: [suse-security] OT: User accounts Hello, does anybody have a idea, how to generate more than 100 Users without having to add them manually or with YaST ? Is there anything like a skript ? The users need the home-dir's too ... ! Thank's ! Best Regards / Mit freundlichen Grüßen Bruno Leonhardt -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Suse Linux Firewall 2
by Martin Peikert 03 Apr '02

03 Apr '02

Jasper Rohling wrote: > So i am using portformarding for that. (IP_Forward). Is there a possibility to > make a cron job for disabling MSN in working hours ? yes >:-)~ Via cron delete/inject the rule(s) that enables portforwarding. Hint: PREROUTING. man iptables. man cron. HTH GTi

1 0

Re: [suse-security] Bandwidth control
by Michael Stern 03 Apr '02

03 Apr '02

from this mailing list: >From Martin Peikert: > Schoenwaelder Oliver wrote: > > Hi, > > > > now that we have set up our firewall we want traffic shaping on our 2 MBit > > leased line. > > Anybody out there with a working solution, examples or howto? > > Take a look at: Linux Firewall - the Traffic Shaper > http://online.securityfocus.com/infocus/1285 > > HTH > GTi

1 0

ssh error
by Robert Szentmihalyi 03 Apr '02

03 Apr '02

Hi, after having updated the openssh package on a SuSE Linux 7.1 system, sshd says: "Disabling protocol version 2. Could not load host key" Deleting /etc/ssh/ssh_host_key and letting the start script regenerate it does not seem to help. What's wrong? Thanks, Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de

10 11

fou4s - Fast OnlineUpdate for SuSE 0.0.2
by Markus Gaugusch 02 Apr '02

02 Apr '02

Hi! This is the second release of my YOU (Yast Online Update) replacement. New Features: * New version comparison mechanism (0.0.1 missed some updates) * GPG verification (can be turned off) * Can run SuSEconfig after update * Optional: Process only security updates or don't process optional RPMs * Interactive mode (answer "yes" to install a package) * Package removal after successful update The new version and a more informative README can be obtained from http://www.gaugusch.at/fou4s A very interesting thing is, that fou4s found some updates for packages that were NOT upgraded by YOU (for example openldap2-client and cyrus-sasl on SuSE 7.2)! General: After update, look with "lsof | grep -i delete" for files that are in use by services. You should restart all processes, that access deleted files to be on the safe side (and to release the harddisk space :) Markus PS: This will be the last announcement on this list, but I'll create a freshmeat.net entry soon. If you think I should post updates on this list in future, then drop me a note and I'll think about it again. -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

SuSEfirewall2 & IRC (ident port 113)
by Chris Weber 02 Apr '02

02 Apr '02

hi list! my internal net (192.168.1.0/24) is going online via my gateway (192.168.1.1). everything works fine, except irc. grc.com says all my ports on the gateway are stealthed no response, not even that it is closed. every port, except 80, is masqueraded into the internal net. but not 113. if i don't set the FW_FORWARD_MASQ="0/0,192.168.1.1,tcp,113" , grc.com says that the port is closed. with it, it says stealthed. but i need that port masqueraded into the internal, like the other ports. i tried FW_FORWARD="192.168.1.1,192.168.1.0/24,tcp,113" aditionaly, but it didnt work. and when i try FW_FORWARD_MASQ="0/0,192.168.1.0/24,tcp,113" , it didnt work either. it says dest. address must be single host. i'm done. dont have any ideas left. please help. thanx =========================================================== /var/log/messages Apr 2 19:58:19 server kernel: SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= SRC=151.189.12.24 DST=192.168.1.1 LEN=44 TOS=0x00 PREC=0x00 TTL=54 ID=16326 DF PROTO=TCP SPT=4358 DPT=113 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (02040564) =========================================================== firewall2.rc.config FW_DEV_EXT="ippp0 ppp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="www" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="53 www 8080 139" FW_SERVICES_INT_UDP="53" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="4000 6112" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="0/0,192.168.1.1,tcp,113" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="no" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

SuSEfirewall2 & IRC (ident port 113)
by Chris Weber 02 Apr '02

02 Apr '02

hi list! my internal net (192.168.1.0/24) is going online via my gateway (192.168.1.1). everything works fine, except irc. grc.com says all my ports on the gateway are stealthed no response, not even that it is closed. every port, except 80, is masqueraded into the internal net. but not 113. if i don't set the FW_FORWARD_MASQ="0/0,192.168.1.1,tcp,113" , grc.com says that the port is closed. with it, it says stealthed. but i need that port masqueraded into the internal, like the other ports. i tried FW_FORWARD="192.168.1.1,192.168.1.0/24,tcp,113" aditionaly, but it didnt work. and when i try FW_FORWARD_MASQ="0/0,192.168.1.0/24,tcp,113" , it didnt work either. it says dest. address must be single host. i'm done. dont have any ideas left. please help. thanx =========================================================== FW_DEV_EXT="ippp0 ppp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="www" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="53 www 8080 139" FW_SERVICES_INT_UDP="53" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="4000 6112" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="0/0,192.168.1.1,tcp,113" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="no" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

A simple question:
by Francesc Dantí 02 Apr '02

02 Apr '02

Hi, How can I do a chroot when a user login in the server? My idea is that when somebody logs in (with ssh) he/she can't get access to my files. What about editing a script that when it makes a chroot, finaly runs the correct shell? That's creating a new shell that only includes the line "chroot ~" and finally runs sh. When I try it, it returns me that I have no permision. Is it a good idea? I'm new in linux world, and i supose it's a very simple question, but i don't find anything in manuals or texts... Thanks

3 2

Re: [suse-security] Problems with ssh and firewall script
by ralf＠schoenian-online.de 02 Apr '02

02 Apr '02

Hi, > is ssh active on port 10022? > check your /etc/ssh/sshd_conf > > normaly it's port 22 Yes, it is running at port 10022 and listenAddress is 0.0.0.0 that should be ok and I can connect if the firewall is down. > Am Mittwoch 27 März 2002 07:19 schrieben Sie: > > Hello list, > > > > I cannot connect to our network from at home. I always get the error > > message: Connection refused at port 10022. The sshd doesn' t log anything > > in /var/log/messages and the firewall script is also empty. Without the > > active firewall I can login without any problems. We are running SuSE Linux > > 7.3 Has anyone an idea, what is wrong with our firewall script? > > > > Any hint is welcome.

4 3

Re: RE: [suse-security] Problems with ssh and firewall script
by ralf＠schoenian-online.de 02 Apr '02

02 Apr '02

Hello Holger, Holger Gossmann <hgossmann(a)rs2group.com> schrieb am 02.04.2002, 09:49:54: > Hallo Ralf, > you specified IFACE=ppp0 but the packets are received on ippp0. Yes, sorry. I have the same configuration at home. But at work we have the IFACE=ippp0 > thanks for all the answers. Unfortunately, I still cannot find the solution. > My sshd is running on port 10022. I verified this several times. > > If I am opening the firewall with the default policies ACCEPT and drop all > my > rules I can connect to my server from outside without any problem. Therefore > I can guess that I have some problems with the firewall and not the sshd. > > I will cut the parts of my firewall with drop rules and the kernel flags. > Beneath the rules I will paste a short chunk from my logfile. > > Please, please help me. I am really desperate and running out of ideas. > > Regards, Ralf Schoenian. > > # Default policy. > iptables -P INPUT DROP > iptables -P FORWARD DROP > iptables -P OUTPUT DROP > > ### =========================================================== > ### Variablen > > IFACE="ppp0" > IFACE2="vmnet1" > IFACE3="eth0" > > > BROADCAST="192.168.1.255" > LOOPBACK="127.0.0.0/8" > CLASS_C="192.168.0.0/16" > UP_PORTS="1024:65535" > #UP_PORTS="1:65535" > > ### ============================================================ > ### Auf Pings reagieren wir nicht. > /bin/echo "1" >/proc/sys/net/ipv4/icmp_echo_ignore_all > > ### Auf broadcasts wollen wir auch nicht reagieren. > /bin/echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts > > ### Source routed packets werden nicht akzeptiert. Mit ihnen kAönnen > Angreifer > ### vorgeben, dass sie aus dem inneren des Netzwerkes kommen. > /bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_source_route > > ### ICMP redirects wollen wir nicht, da sie missbraucht werden kAönnen, um > ### unsere Routen zu Aändern. > /bin/echo "0" > /proc/sys/net/ipv4/conf/all/accept_redirects > > ### Enable bad error message protection. > /bin/echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses > > ### SYN-FLOODING PROTECTION > # > iptables -N syn-flood > iptables -A INPUT -i $IFACE -p tcp --syn -j syn-flood > iptables -A syn-flood -m limit --limit 1/s --limit-burst 4 -j RETURN > iptables -A syn-flood -j DROP > > ## Make sure NEW tcp connections are SYN packets > iptables -A INPUT -i $IFACE -p tcp ! --syn -m state --state NEW -j DROP > > ### SPOOFING > # > ### Alle Pakete die aus dem Internet kommen u. vorgeben aus einem Class-C > Netz zu stammen > ### werden ignoriert > iptables -A INPUT -i $IFACE -s $CLASS_C -j DROP > > iptables -A INPUT -i $IFACE -d $LOOPBACK -j DROP > # Refuse broadcast address packets. > iptables -A INPUT -i $IFACE -d $BROADCAST -j DROP > > ### SSH inbound > # > iptables -A INPUT -i $IFACE -p tcp --dport 10022 --sport $UP_PORTS -j > ACCEPT > iptables -A OUTPUT -o $IFACE -p tcp --sport 10022 --dport $UP_PORTS -j > ACCEPT > # > ### SSH outbound > # > iptables -A OUTPUT -o $IFACE -p tcp --sport $UP_PORTS --dport 10022 -j > ACCEPT > iptables -A INPUT -i $IFACE -p tcp --dport $UP_PORTS --sport 10022 -j > ACCEPT > > ---------------------------------------- > Here is some part of my firewall log > ----------------------------------------- > > Mar 28 17:01:02 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=42963 DF PROTO=TCP > SPT=32791 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:01:14 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=42964 DF PROTO=TCP > SPT=32791 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:01:38 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=42965 DF PROTO=TCP > SPT=32791 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:02:26 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=42966 DF PROTO=TCP > SPT=32791 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:04:22 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=24380 DF PROTO=TCP > SPT=32792 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:04:25 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=24381 DF PROTO=TCP > SPT=32792 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:04:31 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=24382 DF PROTO=TCP > SPT=32792 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:04:43 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=24383 DF PROTO=TCP > SPT=32792 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:08:07 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=59595 DF PROTO=TCP > SPT=32793 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:08:10 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=59596 DF PROTO=TCP > SPT=32793 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:08:16 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=59597 DF PROTO=TCP > SPT=32793 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > Mar 28 17:08:28 kitrlx01 kernel: IN=ippp0 OUT= MAC= SRC=62.134.105.240 > DST=217.51.83.86 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=59598 DF PROTO=TCP > SPT=32793 DPT=10022 WINDOW=5840 RES=0x00 SYN URGP=0 > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here

1 0

Locked out
by Erwin Zierler - stubainet.at 02 Apr '02

02 Apr '02

Hi list, seems I have a little problem there. On a SuSE 6.4 system (kernel 2.2.19) that I am administering which is running mainly as a mailserver (smtp & pop3) I recently updated libz by fetching the sources from ftp.suse.com and doing a rpm -bb libz... and then rpm -Uhv libz... Anyway, for remote administration I use ssh (latest version available for 6.4) and access is restricted via /etc/hosts.deny. Also protocol version 1 is disabled. The next time (after I updated libz) I could not log in anymore, this is what I get when I try to connect from any of the allowed IP addresses: ssh_exchange_identification: Connection closed by remote host Could it be that the newly installed libz is the reason? I have checked with ldd /usr/sbin/sshd and it tells me on all my other systems that its linked against /usr/lib/libz.so.1 So now the big question: can the libz update really be the reason or is it more likely that I messed something else up that I can't remember? Or in other words: do I have to drive ~ 550 kilometers to fix that server or is there any other way to be able to log in again :-) Thanks in advance for all your help! Erwin -- Erwin Zierler | web- / host- / postmaster - stubainet.at | erwin.zierler(a)stubainet.at / webmaster(a)stubainet.at | Tel.: 0 5225 - 64325 Fax 99 Mobil: 0664 - 130 67 91

3 2

SuSEFirewall2, masquerade port 80 to internal box, please help
by Geordon VanTassle 02 Apr '02

02 Apr '02

-----BEGIN PGP SIGNED MESSAGE----- Hello , I'm trying to get Firewall2 to forward/masquerade port 80 from the public IP address of the firewall to a private IP address on another SuSE box inside. Can someone suggest where I can find a HOWTO? Thanks in advance - -- Best regards, Geordon mailto:gvantass@interaccess.com PGP Key ID: 0xFCF06B79 Your Fortune ==> "Be the change that you want to see in the world." (Mohandas Gandhi) -----BEGIN PGP SIGNATURE----- Version: PGP 6.5i iQEVAwUBPKkEdN77fDX88Gt5AQFVmQf+K+1Kt8vpWiDKQ9DpD6Ebo/9QdFo4xwJf yxfy9mm9evve84X9hk2ek39ECMswFlsAePcvsTDTobTWWXgK1F7FfbIDA8tK5Udz u8OYRnIgZldrikZg/z9FDmeOBwIJj+B0zN9tEbD4Yn6hAZHFmpy7j20vkXloBh9z K13d6vK867oOfRW/TazorMk/l4ZK8rIMACHvMpO8WuJNrUB7BF6PRmb/VXlF/TL2 OULWkObpybHtb87SJnLTCkdCR0j3WZHYaCsZhgvDdKUHvHMaT5SV04Xxc3TZJWnr p9Ds6DZBZSIyXGyTj2BQXq8zISx5C5i4BNEMlV0NOV1/hHrPp7pfjg== =K7HY -----END PGP SIGNATURE-----

3 2

Re: [suse-security] file creation with a different gid?
by Axel Zindler 02 Apr '02

02 Apr '02

Hi all, "problem" solved - newgroup was exactly the cmd I was looking for (hours). Thanks for the quick help. BTW in no section of doc about permissions (I've read) this cmd is mentioned - maybe it can go into the SuSE Reference manual. axel Am Montag, 1. April 2002 16:26 schrieben Sie: > Axel Zindler schrieb: > > Hi, > > > > was wondering how to create files with a different gid then the standard > > group. > > > > Suppose one wants to share files with a second (or third and so far) > > user. They create a common group different from (standard) users, ie. > > projectx. If both users are now members of projectx and keep the > > membership of users the files will be written always with the uid of > > users, ie: > > > > -rw-r--r-- 1 axel users 16 Mär 31 22:50 test.txt > > > > How is it possible to edit a file and save files in that way to achive > > the following without doing a chgrp after the file is saved? > > > > -rw-r--r-- 1 axel projectx 16 Mär 31 22:50 test.txt > > Hi Axel, > > there should be different means of doing that: > 1) Change your primary group from within yast (you'd need to create a > new group prior to that) > 2) edit the user into a new group (same as above) and > use the command "newgrp" to change your group identety. > > cannot say much more to the latter, see the man pages of "newgrp" and > "su". Just dug that up for you. > > Juergen

1 0

Yast2 (ot)
by CJB 01 Apr '02

01 Apr '02

Ok, this doesn't have to do with security, sorry about that. But I'm trying to update my system with yast. It downloaded the You update, but then crashed and didn't get it installed. Now it won't show that there's any packages that need to be updated. How do I get it to re-download the You update, and let me download other packages? Thanks, Cj B

1 0

Re: [suse-security] file creation with a different gid?
by Michael Stern 01 Apr '02

01 Apr '02

>This is definitely the wrong list for such a question ;) why is that? the question is definitely security related. i've seen other posts which were more off-topic than this one. michael

1 0

RE: [suse-security] file creation with a different gid?
by Björn Engels 01 Apr '02

01 Apr '02

Axel Zindler wrote: > was wondering how to create files with a different gid then the standard > group. [...] > How is it possible to edit a file and save files in that way to achive > the > following without doing a chgrp after the file is saved? > > -rw-r--r-- 1 axel projectx 16 Mär 31 22:50 test.txt This is definitely the wrong list for such a question ;) But anyway: change the associated group of the direcory you want to share the files in to the desired group and chmod it SGID. (chmod 2770 for example) That's it. New files will be created with group owenership according to the directory's group. Bjoern

2 1

How to install src.rpm updates
by Nikos Psarrakis 01 Apr '02

01 Apr '02

Has anyone any idea of how can we install ...src.rpm update files? (security patces, updates etc. from Suse) Although there is no error message when we try to install them, when we run a query we see that there hasn't been any update. Therefore, we have no problem installing .rpm files. In that case everything seems to work fine. Do we miss something or there's a special procedure to install ...src.rpm updates? Thanks in advance, i remain...

2 1

How to install src.rpm updates
by Nikos Psarrakis 01 Apr '02

01 Apr '02

Has anyone any idea of how can we install ...src.rpm update files? (security patces, updates etc. from Suse) Although there is no error message when we try to install them, when we run a query we see that there hasn't been any update. Therefore, we have no problem installing .rpm files. In that case everything seems to work fine. Do we miss something or there's a special procedure to install ...src.rpm updates? Thanks in advance, i remain...

2 1