April 2002 - openSUSE Security - openSUSE Mailing Lists

RE: Fwd: Re: [suse-security] ipv6 insecure?
by Reckhard, Tobias 24 Apr '02

24 Apr '02

> As the SuSE kernel and some SuSE server packages have IPv6 enabled by > default, I want to be sure that my SuSEfirewall2 is protecting these > running servers. > > What rules/chains should I look for? Do I need to add custom rules? > (In my case I don't want to expose any of them to the dial-up > interface. I use sshd over v6 on internal ethernet but only for > convenience of configuration, I could switch to ipv4 if I need) If you don't *need* a feature, security best practises say to turn it off, better even remove it. Or don't install it in the first place. Tobias

3 2

RE: Fwd: Re: [suse-security] ipv6 insecure?
by Reckhard, Tobias 24 Apr '02

24 Apr '02

> Turning it off is easy for sshd, I think, just put > SSHD_OPTS="-4" > in /etc/rc.config and /usr/sbin/sshd restart > > But I think there are several other local services with v6 capability > that I have no need to expose. > > Is there a correct way to turn it off in the kernel? I can't see it > in the kernel docs, so maybe I should get the 2.4.16 sources and > recompile w/o ipv6 You can disable IPv6 support for your interfaces by replacing the line "alias net-pf-10 ipv6" in /etc/modules.conf with one that reads "alias net-pf-10 off". It's already there (on SuSE 7.3 and 8.0 at least), you just need to remove the comment symbol from the one line and add it to the other. Restart your interfaces for the change to become active (I'm not sure that's all that needs to be updated, though). > Perhaps this is already addressed by some harden script I can use. > > (btw in my situation - of having a laptop moving between networks, it > is nice to have ipv6 as it could save me from installing a dhcpd that > I don't really need.) Well, you'd need to know which services support IPv6.. It's interesting to hear from someone actually using IPv6, you're the first I've come across. Tobias

1 0

Fwd: Re: [suse-security] ssh 3.x exploit
by phil 23 Apr '02

23 Apr '02

I don't think it is a problem if you don't have kerebus or protocol 1 enabled. phil@lead > tgt 192.168.10.2 root ace connected remote protocol version 2.0, software version -- OpenSSH_2.9.9p2 -- client protocol:SSH-1.5-1.3.0 waiting for server public key FATAL: invalid packet length 1349676916 phil@lead > tgt 192.168.0.2 root ace connected remote protocol version 2.0, software version -- OpenSSH_2.9.9p2 -- client protocol:SSH-1.5-1.3.0 waiting for server public key FATAL: invalid packet length 1349676916 phil@lead > tgt 192.168.0.3 root ace connected remote protocol version 2.0, software version -- OpenSSH_2.9.9p2 -- client protocol:SSH-1.5-1.3.0 waiting for server public key FATAL: invalid packet length 1349676916 maybe I am missing something. Is this the same one that is at http://www.security.nnov.ru/search/exploits.asp On Tuesday 23 April 2002 02:17 am, you wrote: > On Mon, 22 Apr 2002, Ben Rosenberg wrote: > > * Martin Köhling (mk(a)lw1.cc-computer.de) [020422 07:46]: > > ::More interesting for me at the moment: is openssh-2.9.9p2, as supplied > > :: by SuSE on the update server, vulnerable? > > > > No it's not vulnerable. SuSE tends to patch the same version numbered > > RPM as not to break deps. The 2.9.9 rpm is full patched and safe. > > I *think* you're making a mistake here: this is (apparently) a *new* > bug - SuSE didn't have time to fix anything yet! > > > As for 3.X being vulnerable..it's 3.0.2 and below..3.1 isn't. > > Umm, no; this is from the openssh announcement list (I got it today): -- Leave the Constitution Alone. http://members.osb.net/phil

1 0

DNAT with SuSEfirewall2 on SuSE8.0
by ProDevTeam 23 Apr '02

23 Apr '02

Aloha, i want to have DNAT for several virtuel non private IP´s with SuSEfirewall2 to masquerade the services in my DMZ which has a private adress range. Something like iptables -A PREROUTING -t nat -p tcp -d 62.16.7.x --dport 80 -j DNAT --to 192.168.7.x:80 or iptables -A PREROUTING -t nat -p tcp --dport 80 -i eth2:2 -j DNAT --to 192.168.7.x:80 in my "old" handmade script. I guess that point 14) FW_FORWAERD_MASQ will be a good place for this kind of rule. It works fine for only one extern device and creates a DNAT rule in the PREROUTING chain ;-} but only for the first extern device :-( I don´t know yet how to DNAT more than one extern IP or device. So does anybody know a way to put in the -d or -i option in the SuSEfirewall2 script or another way to have a DMZ in a private range and benefit from all the fine netfilter rules in the SuSEfirewall script at the same time :o? Best greetings HaDi Wolfertz

1 0

RE: Re: [suse-security] ipv6 insecure?
by Reckhard, Tobias 23 Apr '02

23 Apr '02

> IPv6 has no mechanism like masquerading or PAT/NAT/PNAT per design, > because it breaks the mandatory feature end-to-end security. This > results in an end-to-end connection through anything inbetween. There are people (such as me) who see this as a benefit. More often than not, those people think of PAT/NAT/PNAT as a kludge^H^H^H^H^H^Hsmart hack to conserve IPv4 address space, make (often sloppy) ad-hoc IP network design easier and come by without proxies for many protocols. And not a security mechanism. > 2) if no firewalling is done, but IPv6 access is established, in fact > a client is complete "IPv6-open" to the Internet, even if protected > by IPv4 firewalls. I don't think the Goths would have been exactly dismayed to find only one of the hypothetical two gates to Rome open and the other heavily fortified... This is an option, of course, albeit more of an academic nature. > 4) IPv4 people also have to rethink "We are secure because we use > private IPv4 addresses and a dynamic portfilter FW or simple > transparent proxy FW", because of: > - you are able to tunnel most of the traffic over HTTPS, HTTP (think > about SOAP), ICMP, DNS a.s.o. or other valid encrypted traffic. This is nonsense anyhow. I believe you mean to say the same, so I agree wholeheartedly. > Only very few firewalls (try to) do full payload checking and > rewriting (last one is important). What you say sounds a lot like 'application {layer/level} gateway'. :-) > For IPv6, such transparent check&rewrite proxies are needed. I'm not sure *transparent* proxies are needed, I have a dislike for those. I believe protocols should be designed to be proxy-compatible and I mean ALG, not simply SOCKS. > * For total protection: forget gateway security for IPv6 (for IPv4 > also...), you can block some ports, but what happen if end-to-end > security is established (mandatory feature) - gateway sees nothing > anymore This is already a problem with end-to-end security, it's not restricted to IPSec (which is available for IPv4 as well, just not mandatory and not in widespread use). SSL, SSH, etc. all pose serious problems for firewalls and firewall systems. Cheers Tobias

1 0

ssh 3.x exploit
by Thomas Springer 23 Apr '02

23 Apr '02

anybody out there who got the exploit under http://online.securityfocus.com/bid/4560 to work against ssh 3.x.x? thomas Thomas Springer

3 3

SuSE7.3 -- login possible with 8 charakters !!!
by T.Hollander 22 Apr '02

22 Apr '02

At first I want to say that my english isn't very well ..but I try to say what I mean as clearly and short as possible. I set the passphrase to _min 8_ and _max15_ charakters. I've want to change root pass and I was really suprised as it says thar my pass will be cuted to 8 charakters.My old pass was about 12 charakters.But it wasn't about 12..no ..i've try to use only 8 and it works. Whats that ? Normalerweise hab ich eine min passlänge von 8 und eine max länge von 15 zeichen.Bislang sind mir auch nie probleme diesbezüglich aufgefallen.Jedoch als ich heute das root pass ändern wollte bekam ich auf einmal die sonderbare meldung das das 'pass auf 8 zeichen gekürzt wird'.(dazu muß ich erwähnen das dies das erste mal ist,das ich unter SuSE mein root pass bzw überhaupt ein pass ändern wollte...benutz SuSE erst seit kurzem) Nunja ...daraufhin brach ich ab um wieder in den standart modus zu wechseln und meiner vermutung bzw befürchtung zu überprüfen. Zu meinem entsetzen mußte ich festellen das es möglich war mich mit nur 8 zeichen meines passworts einzuloggen.Und das war bei jedem user möglich. Als erstes dacht ich das dies ja nicht sein könnte und stellte testweise die passlänge auf min12 max15.Auch nach einer passänderung in den account einstellungen war es immer noch möglich mich mit 8 zeichen einzuloggen. Ich bin ernsthaft ein wenig verwirrt und besorgt grade...schließlich würde das ja heißen das ich die ganze zeit mit der illusion gelebt hätte das eine max pass länge von 12 existiert. Die sache ist auch das ich das system heute morgen erst neu aufgesetzt hab und ich zb noch keine dateien manuel bearbeitet hab. In der SuSE support datenbank konnte ich absolut nix dazu finden. Auch in anderen Archiven und über google erzielte ich keinerlei erfolge. Was ist wenn dieses problem auch schon bestand bevor ich neu installiert hab ? Ich weiß diesbezüglich echt absolut nicht mehr weiter :( Sitz mitlerweile auch schon seit 14:00 an genau diesem problem. Kann mir vieleicht jemand ein rat geben wie ich dieses prob in den griff bekommen kann ? Kennt jemand vieleicht das prob selbst ? oder ist das ein generelles prob von SuSE ? Wäre schon froh wenn jemand vieleicht nen link zu ner hilfe wüßte oder irgendwas mit hinweisen ... ansonsten weiß ich grad auch irgendwie nicht :(? ps: Sorry ich weiß ich hätte alles auf englisch schreiben sollen,aber dazu war ich grad wirklich nicht in der lage.Sowohl aus zeitlichen aspekten sowie auch aus gründen fehlender englisch-schreib-fähikeiten.

2 1

Re: [suse-security] SuSE7.3 -- login possible with 8 charakters !!!
by Michael Stern 22 Apr '02

22 Apr '02

no suse problem at all. the crypt function uses only 8 characters, if you need more, you will have to use a different encryption method than crypt - like md5 passwords. have a look at /usr/share/doc/packages/pam/md5.config /usr/share/doc/packages/pam/README.md5 or the archive of the suse security list: http://lists.suse.com/archive/suse-security/2000-May/0073.html michael

1 0

Re: [suse-security] harden_suse on 8.0?
by Markus Kohli 22 Apr '02

22 Apr '02

> > There is a harden script that ships with 8.0. You're given an opportunity > to install it during the 8.0 install. > Agree! But exactly this script tells me, that it's only been tested on SuSEs up to 7.2... ;-) > > Fred -- Beer! I'll drink to that!

1 0

Fwd: Re: [suse-security] ipv6 insecure?
by John Andersen 22 Apr '02

22 Apr '02

---------- Forwarded Message ---------- Subject: Re: [suse-security] ipv6 insecure? Date: Sat, 20 Apr 2002 11:02:29 +0200 From: Peter Bieringer <pb(a)bieringer.de> To: jsa(a)pen.homeip.net, jfweber(a)bellsouth.net, Suse Security <suse-security(a)suse.com> Hi, the author speaks ;-) --On Friday, April 19, 2002 05:37:36 PM -0800 John Andersen <jsa(a)pen.homeip.net> wrote: > On Friday 19 April 2002 03:11 am, jfweber(a)bellsouth.net wrote: >> hiyas Wizards, Wunderkinder, adn general brilliant folks on this >> list., >> >> I read this past week soemthing to the effect of "ipv6" isn't >> secured automagically by firewalls, but must have some special >> things done to secure it? IPv6 has no mechanism like masquerading or PAT/NAT/PNAT per design, because it breaks the mandatory feature end-to-end security. This results in an end-to-end connection through anything inbetween. This leads to some issues: 1) basic firewalling can be done using simple portfilters like in earlier IPv4 days or advanced (dynamic) portfilters like today some commercial and open source firewalls do. Currently known for IPv6: * Cisco routers with static portfilters * BSD ipfiter (don't know about state support) * Linux netfilter (state support experimental) 2) if no firewalling is done, but IPv6 access is established, in fact a client is complete "IPv6-open" to the Internet, even if protected by IPv4 firewalls. 3) A short screening of popular commercial firewall vendors results mostly in "no IPv6 support today" 4) IPv4 people also have to rethink "We are secure because we use private IPv4 addresses and a dynamic portfilter FW or simple transparent proxy FW", because of: - you are able to tunnel most of the traffic over HTTPS, HTTP (think about SOAP), ICMP, DNS a.s.o. or other valid encrypted traffic. Only very few firewalls (try to) do full payload checking and rewriting (last one is important). For IPv6, such transparent check&rewrite proxies are needed. Result: * For a partially protection: establish gateway security as much as you can * For total protection: forget gateway security for IPv6 (for IPv4 also...), you can block some ports, but what happen if end-to-end security is established (mandatory feature) - gateway sees nothing anymore * Establish central managed client security (problem here: buggy clients, unsupported OS...). Some antivirus software vendors already on the way to do that, because what's about an virus in a PGP or S/MIME e-mail or coming over HTTPS? Gateway scanners see nothing here, too! > The article was in the May/02 Linux Magazine (USA edition ). It's already available? Oh...have to wait for the issue here (they send me some). Peter ------------------------------------------------------- -- _________________________________________________ No I Don't Yahoo! And I'm getting pretty sick of being asked if I do. _________________________________________________ John Andersen / Juneau Alaska

3 2