May 2002 - openSUSE Security - openSUSE Mailing Lists

identd questions
by Pedro Marques 13 May '02

13 May '02

Hi, I'd like to know your opinion about identd: First of all, is it worth run it or should I disable it? I've been reading a lot of things about it, and found that the matter is not consensual. Even found this in ident/auth RFC: "If you wouldn't run a 'finger' server due to privacy considerations you may not want to run this protocol." I've tryied to disable ident in my SuSE 7.0 box, without success. Commented the auth line in inetd.conf, turned off the option in rc.config, but it's still running.. maybe it's running through other program like sendmail or popper, is it? any ideas? Any comment/help would be appreciated. Thanks Pedro Marques

2 1

smpppd
by tux the turtle 13 May '02

13 May '02

Hi; is there any way to get informations about which app has triggered smpppd and how to xclude the one app from access but not the other? There's something that connects me to my ISP each time i log in and i don't want to follow the t-a-e-method. Besides that: it would be great for logging... Thanx... -- *** Tux IS a turtle isn't it? *** Sys soft / Sys hard: ====================== SuSE 7.3 prof, Kernel 2.4.10-4GB (SuSE std), KDE 2.2.2 src-tarball, alsa 0.5.11 Athlon 700MHz 640MB, MoBo: Epox EP-7KXA / VT82C686A more Sys soft/ more Sys hard: ====================== SuSE 8.0 pers, Kernel 2.4.18-4GB (SuSE std), KDE 3.0 src-tarball HP Omnibook XT1000 F3433HT

1 0

RE: Why the firewall on Suse8.0 blocks internal packets on externel port?
by charly123 13 May '02

13 May '02

Thank you, but that isn't, what I want. I want to talk on Port 6667 (IRC-Server) of my own Server. You will say, I can probably talk to the internal Adress, but I can't do that with a specially-written program. This program talks to the external Adress, but the Firewall blocks that. Why can I disable this security-option. Best regards, Jost Schöler ____________________________________________________________________________ ______________ SPT=1645 DPT=6667 That means, that from you internal net a service is called, that is hosted on port 6667 of an external server. Thats no standard service as http/pop ect and so it will blocked cauze it MAY be insecure. BTW http/pop maybe insecure too. Port 6667 seems to be IRC related. A good security policy is to allow notthing except services you really need. ____________________________________________________________________________ ___

2 1

Prob: SuSEfirewall2 & FW_MASQ_NETS
by Marc Mueller 13 May '02

13 May '02

Hi, I want to set up a firewall, which should only "protect" ONE MS-WWW-Server (that has no official IP). The server should not have ANY access to anything, the firewall should only offer a telnet from certain addresses (restricted by /etc/xinetd.conf). eth0 is the internet, the WWW-Server is connected to eth1 (the webserver has IP 192.168.0.2). Everytime, a request to port 80 of the firewall is done, it should be forwarded to the server, the answer should be sended back. I'm using SuSE 7.3 and SuSEfirewall2, my configuration file is: FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.2" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="telnet" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="no" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="0/0,192.168.0.2,tcp,80 0/0,192.168.0.2,tcp,443" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" Now the problem is: It only works, when FW_MASQ_NETS is set to "192.168.0.2", but then the server has access to the internet, which I wanted to avoid! If I don't set FW_MAS_NETS to the internal server IP, all http requests are logged as "... ALLOWED ... DST=192.168.0.2 ..." (seems o.k.!) in /var/log/firewall, but there is no response from the server. What can I do? Thank You, Marc

2 1

Why the firewall on Suse8.0 blocks internal packets on externel port?
by charly123 12 May '02

12 May '02

Hallo, on the Suse8.0 prof. with Susefirewall2, all internal requests on the external port was blocked. log: May 12 07:13:43 fs1-cccbbs kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth0 OUT= MAC=00:48:54:1c:a8:fb:00:c0:26:75:3b:28:08:00 SRC=192.168.0.5 DST=217.85.190.27 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=29671 DF PROTO=TCP SPT=1645 DPT=6667 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) May 12 07:13:46 fs1-cccbbs kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth0 OUT= MAC=00:48:54:1c:a8:fb:00:c0:26:75:3b:28:08:00 SRC=192.168.0.5 DST=217.85.190.27 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=29675 DF PROTO=TCP SPT=1645 DPT=6667 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) May 12 07:13:52 fs1-cccbbs kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth0 OUT= MAC=00:48:54:1c:a8:fb:00:c0:26:75:3b:28:08:00 SRC=192.168.0.5 DST=217.85.190.27 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=29683 DF PROTO=TCP SPT=1645 DPT=6667 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) Where in the config I can told him, what he must do with such requests. Why does he blocks that in the default configuration, is it insecure, when I talk from internal to external? Internal: 192.168.0.1 on eth0, External: DynamicIP on ppp0. Best regards, Jost Schöler.

1 0

7.3 with QMail
by Thorsten 10 May '02

10 May '02

Hi, I use QMail instead of sendmail, but YaST still tells me to install sendmail or postfix. How can I manipulate the rpm DB to tell YaST-1 (and apt-get) that sendmail is installed? Thanx Thorsten --

3 2

SuSEfirewall
by Ricardo Javier Aranibar León 10 May '02

10 May '02

Hi my friends, First, Sorry for my Enghish I talk Spanish. I have SuSE 7.2 I have three questions. 1.- I like to use SuSEfirewall but I don't like that my rules are defined with ipchains I like to use iptables, if is posible. 2.- I know that I can't use ipchains and iptables in my system If I run one this, How I can tell to my system that I like to use iptables? 3.- How I can block with SuSEfirewall ping and anothers services? If someone can help I will thankfull. Atentamente RICARDO _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

3 2

Re: [suse-security] SuSEfirewall
by Bill.Light＠kp.org 10 May '02

10 May '02

"Ricardo Javier Aranibar León" <ricardo_jal(a)hotmail.com> 05/10/02 12:33 PM To: suse-security(a)suse.com cc: Subject: [suse-security] SuSEfirewall Hi my friends, First, Sorry for my Enghish I talk Spanish. I have SuSE 7.2 I have three questions. ***> 1.- I like to use SuSEfirewall but I don't like that my rules are defined ***> with ipchains I like to use iptables, if is posible. Use SuSEfirewall2 ***> 2.- I know that I can't use ipchains and iptables in my system If I run one ***> this, How I can tell to my system that I like to use iptables? Make sure iptables is installed see: man rpm With Yast (or Yast2) you can de-install ipchains and install/update iptables ***> 3.- How I can block with SuSEfirewall ping and anothers services? After installation of SuSEfirewall2 look in /etc/rc.config.d/firewall2.rc.config it's toward the bottom

1 0

Re[2]: [SLE] apache-problem / bug?
by da_bug＠gmx.net 10 May '02

10 May '02

Hi! CM> * da_bug(a)gmx.net (da_bug(a)gmx.net) [020509 04:18]: >> I am using SuSE 7.3 with a self-compiled Kernel 2.4.18 >> and I installed the updated suse-rpm for 7.3 "apache-1.3.20-65". >> This is what happens if I want to start apache: >> >> >/etc/init.d/apache start >> >Shutting down httpd done >> >Starting httpd [ PERL PHP4 ] >> >Ouch! ap_mm_create(1048576, "/var/lib/httpd/mm.20330") failed >> >Error: MM: mm:core: failed to acquire shared memory segment >> >(Function not implemented): OS: No such file or directory unused CM> Sounds like you're self-built kernel is missing SysV IPC CM> support...rebuild with CONFIG_SYSVIPC=y. Yes thanks, that was the solution! :) Bye. <da_bug(a)gmx.net>

1 0

Antwort: [suse-security] Help needed for Masquerading with Suse 8.0 and Ipchains
by BLeonhardt＠analytek.de 10 May '02

10 May '02

i'd prefer the kernel auto_module_loader .. maybe it's the best variant ... regards, bruno "Wilfried Philippi" An: SuSE-Security <suse-security(a)suse.com> <philippi@madex. Kopie: com> Thema: [suse-security] Help needed for Masquerading with Suse 8.0 and Ipchains 10.05.02 13:22 Hello there, i have a Problem with the setup of a Firewall Script with the 2.4 Kernel and the ipchains compatible module ipchains.o. When i run my script the module ip_masq_ftp wsn't found. I know that this is a module from the 2.2 kernel. My Question is: What module must i load that i have the same functionality? I will change to iptables in the Future but the system must run quick so i dont have Time in the moment to write a new script. -------------------------------------------------------------------- Here is the part of my Firewall script : # Insert the active ftp module if ! ( /sbin/lsmod | /usr/bin/grep masq_ftp > /dev/null ); then /sbin/insmod ip_masq_ftp fi ----------------------------------- Thanks for your help Wilfried -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0