April 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Suse Linux Firewall 2
by Ralf Ronneburger 03 Apr '02

03 Apr '02

Hi Jasper, sure there is, two possibilities I can think of: 1. make you own iptables-skript and run it by cron 2. make a copy of your /etc/rc.d/suse-firewall2.conf ( don't know the exact name, don't have it installed, use my own script) and then make a script like this (I'm not sure either, if rcsusefw is the right command, but it's probably something like that): morning: mv /etc/rc.d/suse-firewall2.conf /etc/rc.d/suse-firewall2.conf.night mv /etc/rc.d/suse-firewall2.conf.day /etc/rc.d/suse-firewall2.conf rcsusefw restart evening: mv /etc/rc.d/suse-firewall2.conf /etc/rc.d/suse-firewall2.conf.day mv /etc/rc.d/suse-firewall2.conf.night /etc/rc.d/suse-firewall2.conf rcsusefw restart I don't know, if this would be very elegant, but it should work :-). Best regards, Ralf Ronneburger Jasper Rohling wrote: >Hi. > >I am running Suse 7.3 with Firewall 2. >Now i want to disable portforwarding at scheduled times, to disable Microsoft >Messenger from my Lan. >I can'r let MSN run through squid because one of the client's is a iMac and >the MSN client for the iMac won't allow the use of Generic Proxy. > >So i am using portformarding for that. (IP_Forward). Is there a possibility to >make a cron job for disabling MSN in working hours ? > >Met vriendelijke groet, >Kind regards, > >Jasper Rohling >Senior System Engineer > >Business-line Infrastructure and Security >CSS System Integration >Ankersmidplein 2 >1056 CK Zaandam > >Office :+31 (0) 75 6539444 >Mobile :+31 (0) 6 21281247 >E-mail : j.rohling(a)css.nl >website : http://www.css.nl > > >

2 1

RE: [suse-security] OT: User accounts
by Peer Stefan 03 Apr '02

03 Apr '02

i once wrote a script myself, which adds users from any unix-like password-file to a system (reads STDIN). have a look at the attachment. it's provided 'asis' - feel free to add or delete stuff as you like. cheers stefan ps: it just adds users with uids greater than 100 - so no system user is added. -----Original Message----- From: Michael Stern [mailto:mhstar@gmx.at] Sent: Wednesday, April 03, 2002 2:07 PM To: Suse-Security Subject: Re: [suse-security] OT: User accounts well of course you could create a script manually which reads and parses an input file and passes the data to useradd and whatever program you want to execute ... i don't know whether suse does provide one, but it shouldn't be too difficult to write such a script. ----- Original Message ----- From: <BLeonhardt(a)analytek.de> To: <suse-security(a)suse.com> Sent: Wednesday, April 03, 2002 2:01 PM Subject: [suse-security] OT: User accounts Hello, does anybody have a idea, how to generate more than 100 Users without having to add them manually or with YaST ? Is there anything like a skript ? The users need the home-dir's too ... ! Thank's ! Best Regards / Mit freundlichen Grüßen Bruno Leonhardt -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Suse Linux Firewall 2
by Martin Peikert 03 Apr '02

03 Apr '02

Jasper Rohling wrote: > So i am using portformarding for that. (IP_Forward). Is there a possibility to > make a cron job for disabling MSN in working hours ? yes >:-)~ Via cron delete/inject the rule(s) that enables portforwarding. Hint: PREROUTING. man iptables. man cron. HTH GTi

1 0

Re: [suse-security] Bandwidth control
by Michael Stern 03 Apr '02

03 Apr '02

from this mailing list: >From Martin Peikert: > Schoenwaelder Oliver wrote: > > Hi, > > > > now that we have set up our firewall we want traffic shaping on our 2 MBit > > leased line. > > Anybody out there with a working solution, examples or howto? > > Take a look at: Linux Firewall - the Traffic Shaper > http://online.securityfocus.com/infocus/1285 > > HTH > GTi

1 0

ssh error
by Robert Szentmihalyi 03 Apr '02

03 Apr '02

Hi, after having updated the openssh package on a SuSE Linux 7.1 system, sshd says: "Disabling protocol version 2. Could not load host key" Deleting /etc/ssh/ssh_host_key and letting the start script regenerate it does not seem to help. What's wrong? Thanks, Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de

10 11

fou4s - Fast OnlineUpdate for SuSE 0.0.2
by Markus Gaugusch 02 Apr '02

02 Apr '02

Hi! This is the second release of my YOU (Yast Online Update) replacement. New Features: * New version comparison mechanism (0.0.1 missed some updates) * GPG verification (can be turned off) * Can run SuSEconfig after update * Optional: Process only security updates or don't process optional RPMs * Interactive mode (answer "yes" to install a package) * Package removal after successful update The new version and a more informative README can be obtained from http://www.gaugusch.at/fou4s A very interesting thing is, that fou4s found some updates for packages that were NOT upgraded by YOU (for example openldap2-client and cyrus-sasl on SuSE 7.2)! General: After update, look with "lsof | grep -i delete" for files that are in use by services. You should restart all processes, that access deleted files to be on the safe side (and to release the harddisk space :) Markus PS: This will be the last announcement on this list, but I'll create a freshmeat.net entry soon. If you think I should post updates on this list in future, then drop me a note and I'll think about it again. -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

SuSEfirewall2 & IRC (ident port 113)
by Chris Weber 02 Apr '02

02 Apr '02

hi list! my internal net (192.168.1.0/24) is going online via my gateway (192.168.1.1). everything works fine, except irc. grc.com says all my ports on the gateway are stealthed no response, not even that it is closed. every port, except 80, is masqueraded into the internal net. but not 113. if i don't set the FW_FORWARD_MASQ="0/0,192.168.1.1,tcp,113" , grc.com says that the port is closed. with it, it says stealthed. but i need that port masqueraded into the internal, like the other ports. i tried FW_FORWARD="192.168.1.1,192.168.1.0/24,tcp,113" aditionaly, but it didnt work. and when i try FW_FORWARD_MASQ="0/0,192.168.1.0/24,tcp,113" , it didnt work either. it says dest. address must be single host. i'm done. dont have any ideas left. please help. thanx =========================================================== /var/log/messages Apr 2 19:58:19 server kernel: SuSE-FW-UNALLOWED-TARGETIN=ippp0 OUT= MAC= SRC=151.189.12.24 DST=192.168.1.1 LEN=44 TOS=0x00 PREC=0x00 TTL=54 ID=16326 DF PROTO=TCP SPT=4358 DPT=113 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (02040564) =========================================================== firewall2.rc.config FW_DEV_EXT="ippp0 ppp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="www" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="53 www 8080 139" FW_SERVICES_INT_UDP="53" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="4000 6112" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="0/0,192.168.1.1,tcp,113" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="no" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

SuSEfirewall2 & IRC (ident port 113)
by Chris Weber 02 Apr '02

02 Apr '02

hi list! my internal net (192.168.1.0/24) is going online via my gateway (192.168.1.1). everything works fine, except irc. grc.com says all my ports on the gateway are stealthed no response, not even that it is closed. every port, except 80, is masqueraded into the internal net. but not 113. if i don't set the FW_FORWARD_MASQ="0/0,192.168.1.1,tcp,113" , grc.com says that the port is closed. with it, it says stealthed. but i need that port masqueraded into the internal, like the other ports. i tried FW_FORWARD="192.168.1.1,192.168.1.0/24,tcp,113" aditionaly, but it didnt work. and when i try FW_FORWARD_MASQ="0/0,192.168.1.0/24,tcp,113" , it didnt work either. it says dest. address must be single host. i'm done. dont have any ideas left. please help. thanx =========================================================== FW_DEV_EXT="ippp0 ppp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="www" FW_SERVICES_EXT_UDP="" # Common: domain FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="53 www 8080 139" FW_SERVICES_INT_UDP="53" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="4000 6112" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="yes" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="0/0,192.168.1.1,tcp,113" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="no" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

A simple question:
by Francesc Dantí 02 Apr '02

02 Apr '02

Hi, How can I do a chroot when a user login in the server? My idea is that when somebody logs in (with ssh) he/she can't get access to my files. What about editing a script that when it makes a chroot, finaly runs the correct shell? That's creating a new shell that only includes the line "chroot ~" and finally runs sh. When I try it, it returns me that I have no permision. Is it a good idea? I'm new in linux world, and i supose it's a very simple question, but i don't find anything in manuals or texts... Thanks

3 2

Re: [suse-security] Problems with ssh and firewall script
by ralf＠schoenian-online.de 02 Apr '02

02 Apr '02

Hi, > is ssh active on port 10022? > check your /etc/ssh/sshd_conf > > normaly it's port 22 Yes, it is running at port 10022 and listenAddress is 0.0.0.0 that should be ok and I can connect if the firewall is down. > Am Mittwoch 27 März 2002 07:19 schrieben Sie: > > Hello list, > > > > I cannot connect to our network from at home. I always get the error > > message: Connection refused at port 10022. The sshd doesn' t log anything > > in /var/log/messages and the firewall script is also empty. Without the > > active firewall I can login without any problems. We are running SuSE Linux > > 7.3 Has anyone an idea, what is wrong with our firewall script? > > > > Any hint is welcome.

4 3