May 2002 - openSUSE Security - openSUSE Mailing Lists

identd questions
by Pedro Marques 13 May '02

13 May '02

Hi, I'd like to know your opinion about identd: First of all, is it worth run it or should I disable it? I've been reading a lot of things about it, and found that the matter is not consensual. Even found this in ident/auth RFC: "If you wouldn't run a 'finger' server due to privacy considerations you may not want to run this protocol." I've tryied to disable ident in my SuSE 7.0 box, without success. Commented the auth line in inetd.conf, turned off the option in rc.config, but it's still running.. maybe it's running through other program like sendmail or popper, is it? any ideas? Any comment/help would be appreciated. Thanks Pedro Marques

2 1

smpppd
by tux the turtle 13 May '02

13 May '02

Hi; is there any way to get informations about which app has triggered smpppd and how to xclude the one app from access but not the other? There's something that connects me to my ISP each time i log in and i don't want to follow the t-a-e-method. Besides that: it would be great for logging... Thanx... -- *** Tux IS a turtle isn't it? *** Sys soft / Sys hard: ====================== SuSE 7.3 prof, Kernel 2.4.10-4GB (SuSE std), KDE 2.2.2 src-tarball, alsa 0.5.11 Athlon 700MHz 640MB, MoBo: Epox EP-7KXA / VT82C686A more Sys soft/ more Sys hard: ====================== SuSE 8.0 pers, Kernel 2.4.18-4GB (SuSE std), KDE 3.0 src-tarball HP Omnibook XT1000 F3433HT

1 0

RE: Why the firewall on Suse8.0 blocks internal packets on externel port?
by charly123 13 May '02

13 May '02

Thank you, but that isn't, what I want. I want to talk on Port 6667 (IRC-Server) of my own Server. You will say, I can probably talk to the internal Adress, but I can't do that with a specially-written program. This program talks to the external Adress, but the Firewall blocks that. Why can I disable this security-option. Best regards, Jost Schöler ____________________________________________________________________________ ______________ SPT=1645 DPT=6667 That means, that from you internal net a service is called, that is hosted on port 6667 of an external server. Thats no standard service as http/pop ect and so it will blocked cauze it MAY be insecure. BTW http/pop maybe insecure too. Port 6667 seems to be IRC related. A good security policy is to allow notthing except services you really need. ____________________________________________________________________________ ___

2 1

Prob: SuSEfirewall2 & FW_MASQ_NETS
by Marc Mueller 13 May '02

13 May '02

Hi, I want to set up a firewall, which should only "protect" ONE MS-WWW-Server (that has no official IP). The server should not have ANY access to anything, the firewall should only offer a telnet from certain addresses (restricted by /etc/xinetd.conf). eth0 is the internet, the WWW-Server is connected to eth1 (the webserver has IP 192.168.0.2). Everytime, a request to port 80 of the firewall is done, it should be forwarded to the server, the answer should be sended back. I'm using SuSE 7.3 and SuSEfirewall2, my configuration file is: FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.2" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="telnet" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="no" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="0/0,192.168.0.2,tcp,80 0/0,192.168.0.2,tcp,443" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" Now the problem is: It only works, when FW_MASQ_NETS is set to "192.168.0.2", but then the server has access to the internet, which I wanted to avoid! If I don't set FW_MAS_NETS to the internal server IP, all http requests are logged as "... ALLOWED ... DST=192.168.0.2 ..." (seems o.k.!) in /var/log/firewall, but there is no response from the server. What can I do? Thank You, Marc

2 1

Why the firewall on Suse8.0 blocks internal packets on externel port?
by charly123 12 May '02

12 May '02

Hallo, on the Suse8.0 prof. with Susefirewall2, all internal requests on the external port was blocked. log: May 12 07:13:43 fs1-cccbbs kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth0 OUT= MAC=00:48:54:1c:a8:fb:00:c0:26:75:3b:28:08:00 SRC=192.168.0.5 DST=217.85.190.27 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=29671 DF PROTO=TCP SPT=1645 DPT=6667 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) May 12 07:13:46 fs1-cccbbs kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth0 OUT= MAC=00:48:54:1c:a8:fb:00:c0:26:75:3b:28:08:00 SRC=192.168.0.5 DST=217.85.190.27 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=29675 DF PROTO=TCP SPT=1645 DPT=6667 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) May 12 07:13:52 fs1-cccbbs kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth0 OUT= MAC=00:48:54:1c:a8:fb:00:c0:26:75:3b:28:08:00 SRC=192.168.0.5 DST=217.85.190.27 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=29683 DF PROTO=TCP SPT=1645 DPT=6667 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) Where in the config I can told him, what he must do with such requests. Why does he blocks that in the default configuration, is it insecure, when I talk from internal to external? Internal: 192.168.0.1 on eth0, External: DynamicIP on ppp0. Best regards, Jost Schöler.

1 0

7.3 with QMail
by Thorsten 10 May '02

10 May '02

Hi, I use QMail instead of sendmail, but YaST still tells me to install sendmail or postfix. How can I manipulate the rpm DB to tell YaST-1 (and apt-get) that sendmail is installed? Thanx Thorsten --

3 2

SuSEfirewall
by Ricardo Javier Aranibar León 10 May '02

10 May '02

Hi my friends, First, Sorry for my Enghish I talk Spanish. I have SuSE 7.2 I have three questions. 1.- I like to use SuSEfirewall but I don't like that my rules are defined with ipchains I like to use iptables, if is posible. 2.- I know that I can't use ipchains and iptables in my system If I run one this, How I can tell to my system that I like to use iptables? 3.- How I can block with SuSEfirewall ping and anothers services? If someone can help I will thankfull. Atentamente RICARDO _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

3 2

Re: [suse-security] SuSEfirewall
by Bill.Light＠kp.org 10 May '02

10 May '02

"Ricardo Javier Aranibar León" <ricardo_jal(a)hotmail.com> 05/10/02 12:33 PM To: suse-security(a)suse.com cc: Subject: [suse-security] SuSEfirewall Hi my friends, First, Sorry for my Enghish I talk Spanish. I have SuSE 7.2 I have three questions. ***> 1.- I like to use SuSEfirewall but I don't like that my rules are defined ***> with ipchains I like to use iptables, if is posible. Use SuSEfirewall2 ***> 2.- I know that I can't use ipchains and iptables in my system If I run one ***> this, How I can tell to my system that I like to use iptables? Make sure iptables is installed see: man rpm With Yast (or Yast2) you can de-install ipchains and install/update iptables ***> 3.- How I can block with SuSEfirewall ping and anothers services? After installation of SuSEfirewall2 look in /etc/rc.config.d/firewall2.rc.config it's toward the bottom

1 0

Re[2]: [SLE] apache-problem / bug?
by da_bug＠gmx.net 10 May '02

10 May '02

Hi! CM> * da_bug(a)gmx.net (da_bug(a)gmx.net) [020509 04:18]: >> I am using SuSE 7.3 with a self-compiled Kernel 2.4.18 >> and I installed the updated suse-rpm for 7.3 "apache-1.3.20-65". >> This is what happens if I want to start apache: >> >> >/etc/init.d/apache start >> >Shutting down httpd done >> >Starting httpd [ PERL PHP4 ] >> >Ouch! ap_mm_create(1048576, "/var/lib/httpd/mm.20330") failed >> >Error: MM: mm:core: failed to acquire shared memory segment >> >(Function not implemented): OS: No such file or directory unused CM> Sounds like you're self-built kernel is missing SysV IPC CM> support...rebuild with CONFIG_SYSVIPC=y. Yes thanks, that was the solution! :) Bye. <da_bug(a)gmx.net>

1 0

Antwort: [suse-security] Help needed for Masquerading with Suse 8.0 and Ipchains
by BLeonhardt＠analytek.de 10 May '02

10 May '02

i'd prefer the kernel auto_module_loader .. maybe it's the best variant ... regards, bruno "Wilfried Philippi" An: SuSE-Security <suse-security(a)suse.com> <philippi@madex. Kopie: com> Thema: [suse-security] Help needed for Masquerading with Suse 8.0 and Ipchains 10.05.02 13:22 Hello there, i have a Problem with the setup of a Firewall Script with the 2.4 Kernel and the ipchains compatible module ipchains.o. When i run my script the module ip_masq_ftp wsn't found. I know that this is a module from the 2.2 kernel. My Question is: What module must i load that i have the same functionality? I will change to iptables in the Future but the system must run quick so i dont have Time in the moment to write a new script. -------------------------------------------------------------------- Here is the part of my Firewall script : # Insert the active ftp module if ! ( /sbin/lsmod | /usr/bin/grep masq_ftp > /dev/null ); then /sbin/insmod ip_masq_ftp fi ----------------------------------- Thanks for your help Wilfried -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

New fou4s release - Fast OnlineUpdate for SuSE 0.3.0
by Markus Gaugusch 10 May '02

10 May '02

Hi! I'm proud to announce the new version of fou4s, 0.3.0. You can get it at http://fou4s.gaugusch.at/. >From the changelog: * Fixes for 0.2.1: + PHP update packages are available again (were filtered out due to a bad wget option) + Package descriptions with missing number after Size: won't crash fou4s now + The RemarkList option actually works now. Previously it disabled downloading of all packages after the first entry was found. * All platforms are now supported (i386, sparc, ...): + RPM is now a noarch.rpm * More information: Downloadsize of all packages (for -e) * Packagelist directory is automatically cleaned from old package description files * New options: + --checkfou4s, checks for an update of fou4s + --proxyuser and --proxypassword + --nocont, to disable checking of patches.cont directory on SuSE 8 + -b, to use fou4s-benchmark and download from the fastest server. + --config, to use another config file (for different servers) * New version of fou4s-benchmark (by G. Sommer) * The fou4s RPM is now signed with key fou4s(a)gaugusch.at (ID AFB66D7C) + Fou4s now supports updating itself, using the checkfou4s switch + New cron script with saner defaults With this release I'm hoping to find no bugs within the first 24 hours after release, so it may be really worth a try ;) If you have any problems, don't hesitate to contact me. I need feedback especially for other architectures than i386 and sparc. regards, Markus Gaugusch -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

2 1

RE: [suse-security] Telnet-Proxy
by Reckhard, Tobias 10 May '02

10 May '02

> I implemented a telnet proxy by using the portforwarding > feature from openssh. > > This gives you the advantage that you do not have to forward > packets on your firewall and some graet authentication schemes. The question remains as to whether that's a proxy... It's a circuit-level-gateway and therefore functionally closer to port forwarding than to an actual proxy, IMHO, since the connection isn't actually terminated, but instead, IP packets are simply sent on by the gateway. Feel free to correct me if I'm wrong. Tobias

2 1

Re: [suse-security] SuSE firewall 2 - iptables-error
by tux the turtle 10 May '02

10 May '02

well, actually this IS SuSEfirewall2 shiped with the 7.3 prof - there's no ShoreWall at all... Tux the turtle ---- Bill.Light(a)kp.org am Freitag, 10. Mai 2002 01:05: > Uninstall Shorewall and use SuSEfirewall2 -or- > > Change /etc/rc.config to START_FW2="no" and set your parameters in > ShoreWall > > But make a choice.....they don't both co-exist -------------------------------------------------------

1 0

Re: [suse-security] SuSE firewall 2 - iptables-error
by Bill.Light＠kp.org 09 May '02

09 May '02

Uninstall Shorewall and use SuSEfirewall2 -or- Change /etc/rc.config to START_FW2="no" and set your parameters in ShoreWall But make a choice.....they don't both co-exist ======================================================================== tux the turtle <tu.th.tu(a)gmx.net> 05/09/02 03:10 PM Please respond to tux the turtle To: suse-security(a)suse.com cc: Subject: [suse-security] SuSE firewall 2 - iptables-error Hi out there; setting up (once more) my SuSE 7.3 I got the following on boot up: Starting Firewall Initialization: (phase 3 of 3) iptables v1.2.2: Can't use -D with -A Try `iptables -h' or 'iptables --help' for more information. iptables v1.2.2: Can't use -D with -A I run a small private net as shown below: ISP <-> Desktop/Firewall <-> Laptop/Firewall The message above is from the Desktop-PC; my firewall2.rc.config contains these: FW_DEV_EXT="ippp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp domain" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ssh smtp domain" FW_SERVICES_INT_UDP="domain syslog" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="domain" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix Firewall " FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" all other unchanged Any hint? Besides that (and OT): i run smpppd. If it's the smpppd that disconnects my ippp0 (capi-drv from Fritz!) the machine hangs while shuting down because of an ippp0 usagecount != 0 (message from kernel: unregister_netdevice). Any hints of setting a timeout or forcing unregistering? Thanks in advance... Tux the turtle -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

SuSE firewall 2 - iptables-error
by tux the turtle 09 May '02

09 May '02

Hi out there; setting up (once more) my SuSE 7.3 I got the following on boot up: Starting Firewall Initialization: (phase 3 of 3) iptables v1.2.2: Can't use -D with -A Try `iptables -h' or 'iptables --help' for more information. iptables v1.2.2: Can't use -D with -A I run a small private net as shown below: ISP <-> Desktop/Firewall <-> Laptop/Firewall The message above is from the Desktop-PC; my firewall2.rc.config contains these: FW_DEV_EXT="ippp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp domain" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ssh smtp domain" FW_SERVICES_INT_UDP="domain syslog" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="domain" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix Firewall " FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" all other unchanged Any hint? Besides that (and OT): i run smpppd. If it's the smpppd that disconnects my ippp0 (capi-drv from Fritz!) the machine hangs while shuting down because of an ippp0 usagecount != 0 (message from kernel: unregister_netdevice). Any hints of setting a timeout or forcing unregistering? Thanks in advance... Tux the turtle

1 0

Iptables
by Ricardo Javier Aranibar León 09 May '02

09 May '02

Hi list, I have a problem and I need your help, I use SuSE 7.2 and kernel 2.4.4-4. Why, When I like use iptables I have execute this command "rmmod ipchains", always restart my server? if I deleted ipchains?. and when initialize my system I have this problem: Failed services in runlevel 2,3 SuSEFirewall_setup and SuSEfirewall_final. Skipped Services in runlevel 3: personal_firewall initial pcmcia personal-firewall. Plese help me with those problems _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

2 1

Run-level editor in 8.0
by Michael Ströder 09 May '02

09 May '02

HI! The run-level editor in SuSE 8.0 always switches port mapper on because it assumes that it's needed by inetd. But I have no service in my inetd.conf at all which needs portmapper. Since portmapper is one of the most evil beasts regarding security this behaviour of the Yast2 run-level editor is complete bullshit! Ciao, Michael.

9 15

What list to subscribe to ?
by arawak 09 May '02

09 May '02

I now this list is about Suse Security. But I would like to know which list I should subscribe to, for questions on wireless networking ? Tia Sorry to annoy anyone Arawak

2 1

Re: [suse-security] Solution "interessantes" Netzwerk Problem
by d_lord＠gmx.de 09 May '02

09 May '02

Hi list, Sorry for posting OT and sorry for german subject and .. thats all I think After all I found a method to solve this problem. :-) IPTUNNEL If you are interessted in read http://www.tldp.org/HOWTO/Adv-Routing-HOWTO-5.html#ss5.3 for setup and http://www.tldp.org/HOWTO/mini/ppp-ssh/bringup.html if you encouter problems If any question remains write me (PM) Greetings D. Lord PS.: DNAT and SNAT didn't really fit (ipchains) -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

SuSEfirewall2 and DMZ problems...
by Bill.Light＠kp.org 09 May '02

09 May '02

Hi Gang ! Given the following scenario...Firewall running SuSE 7.3 / SuSEfirewall2 with 3 NICs: ************ * Internet * ************ * "Real" IP address * eth0 * ************ eth1 ****************** * Firewall ********** DMZ - www/mail * ************ ****************** * eth2 * * ************ * switch * ************ * * * * * * *********************** * Internal Machine(s) * *********************** If AA.aaa.aaa.aaa is a private IP on eth1 and BB.bbb.bbb.bbb is private IP on eth2 (to feed the rest of the network) How are questions answered in /etc/rc.config.d/firewall2.rc.config to get to the dmz computer ?? This is what I have (and I get dropped in the firewall without seeing the DMZ) ... I know I have NOT yet turned on mail, because I want to see www services running first..... FWD_DEV_EXT="eth0" FWD_DEV_INT="eth2" FWD_DEV_DMZ="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASW_DEV="$FW_DEV_EXT" FW_MASQ_NETS="BB.bb.bbb.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="www" FW_SERVICES_EXT_UDP="www" FW_SERVICES_EXT_IP="www" FW_SERVICES_DMZ_TCP="domain www" FW_SERVICES_DMZ_UDP="www" FW_SERVICES_DMZ_IP="www" FW_SERVICES_INT_TCP="www" FW_SERVICES_INT_UDP="www" FW_SERVICES_INT_IP="www" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" ?? -or- FW_FORWARD="0/0,AA.aaa.aaa.aaa,tcp,80" ?? FW_FORWARD_MASQ="0/0,AA.aaa.aaa.aaa,tcp,80" FW_REDIRECT="" ?? -or- FW_REDIRECT="0/0,AA.aaa.aaa.aaa,tcp,80" ?? The "-or-" is my guessing.....no combination seems to work, any help appreciated. What am I missing ?? I always get dropped in the "firewall" box and never get to the web-server. The SuSEfirewall2 examples given by Marc do not seem to address the setup I am attempting ... Is my inherent design bad ? - Bill

2 1

Re: [suse-security] Telnet-Proxy
by support＠ufos-gmbh.de 09 May '02

09 May '02

Hi all, I implemented a telnet proxy by using the portforwarding feature from openssh. This gives you the advantage that you do not have to forward packets on your firewall and some graet authentication schemes. with best regards, Jörg Zaretzke -------- Original Message -------- Subject: [suse-security] Telnet-Proxy (06-Mai-2002 15:02) From: m.sckopke(a)gis-systemhaus.de To: j.zaretzke(a)ufos-gmbh.de > Hi all, > > has anybody ever heard of a telnet-proxy? > Checkpoints Firewall-1 offers this kind of functionality: > > You connect to the firewall on port 23, firewall asks for > authentification and a hostname and afterwards you get a > transparent telnet session to the named host, without > any intererence by the firewall. > > Is something like that available as open source software? > > Thanks a lot, > > Martin > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] Run-level editor in 8.0
by tux the turtle 09 May '02

09 May '02

Alexander Thoma am Sonntag, 5. Mai 2002 14:11: > that's why i'm administrating unix/linux systems using an editor and a > shell. that's all you need. yast(1/2) is running while installation and > can go where ever it likes after that. Yup - I agree. It took me 2 days setting up 8.0 on my HP Omnibook XT1000 as well a on my K7 Desktop (2 days for each!). Result: permanent crashes due to some weired setups in standard-config. On my K7 i'm back to 7.3 and on the HP i have (finally) running a 8.0 minimal system installing all other by hand. But there still is a slight fear of what happends underneath the keys i still don't know... TuThTu --- <<Jo, Jeffrey!>>

2 1

"interessantes" Netzwerk Problem
by d_lord＠gmx.de 09 May '02

09 May '02

Hi @ all, I have got some problems setting up a "virtuall" network. Desktop1 (eth0:1) 192.168.168.5 | (eth0) 192.168.5.25 | | (eth1) 192.168.5.1 Server1 (eth1:1) 192.168.168.3 Server1 (eth0:1) 192.168.168.1 | (eth0) xxx.xxx.xxx.xxx | |-----LAN ---- GW zzz.zzz.zzz.zzz -------- INTERNET | | | (eth1) yyy.yyy.yyy.yyy Server2 (eth1:1) 192.168.168.2 Server2 (eth0:1) 192.168.168.4 | (eth0) 192.168.1.1 | | (eth0) 192.168.1.2 Desktop2 (eth0:1) 192.168.168.6 I have to astablish a direkt connection from Desktop1 to Desktop2 and the other way round. World be best if tunneled over ssh but not really needed As you can see I've assigned a virtuall IP to every NIC I use. Between Server1 and Server2 there is a LAN but the IPs from eth0 of Server1 and eth1 of Server2 are public. So I decided to use some privat IP addresses here too so the Gateway blocks dem. The communication between Desktop1 and Server2 is working well if I use the normal way which means connect to server1 MASQ , connect to server2 but I don't reach Desktop2. Most of the time this is wanted. But sometimes I like to build a cluster from Desktop1 and Desktop2 so i have to have direkt ssh access, smb access and some further ports and services. Portforwarding isn't really usefull I think because I need a couple of ports. Now, lets see what I have: Desktop 1/2 kernel 2.4.16 + ipchains (no iptables at the moment) Server 1/2 kernel 2.2.20 + ipchains At the moment I can ping 192.168.168.4 and 192.168.168.2 from Desktop2 and 192.168.168.3 192.168.168.1 from Desktop1. Server1 kann ping Server2 over the public and the privat adress But I really don't get a connection between Desktop1 and Desktop2 I think something with the routing is broken maybe because both NICs of the Servers are in the same subnet but how could i manage the problem without putting the to NICs into the same subnet? I hope it's clear to you what I like to do so could please anyone give me a hint what I miss or have to do? The only thing that has to work the direkt connection between Desktop1 and 2 Thanks D. Lord PS.: Hope this is not too OT :-) and sorry for my poor english -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

SuSE 8.0
by Bill Eastman 08 May '02

08 May '02

I got SuSE 8.0 yesterday. To begin with, the DVD will not boot, therefore I will be returning it to Best Buy. Next I discovered that locate is not installed. In one of the books, it says it can be installed after the default installation, but the book does not say what group it is in. And the install everything option was not there. Does anyone know what group locate is in, so I can install it? ---------------- The instructions said Requires Windows 95 or better, so I installed Linux

4 3

OT Postings
by Jörg Mayer 08 May '02

08 May '02

Hello, is it just my impression or is the amount of off-topic postings increasing? This is not the suse-highendusers/suse-netadmin mailinglist, it's suse-security. Ciao Jörg -- Jörg Mayer <jmayer(a)loplof.de> Signature fault, brain dumped

8 8

Re: [suse-security] SuSE YOU scheduling
by mario libraro 08 May '02

08 May '02

> I wrote fou4s ( http://www.gaugusch.at/fou4s ) _exactly_ because of this > problem. > Maybe there IS a solution with YOU, but I don't think so. > > check it out ... > Markus oh nice.. really.. this is not what i were looking for but it perfectly solves my problem :)

1 0

Virtual network cards
by Kim L. Christensen 08 May '02

08 May '02

Hello list, Is it possible to create more than 4 different ip addresses for 1 network card.? looking in the rc.config file, there is an example for up to 4 adresses but I would like to know if this is the maximum or not. Regards Kim Christensen

2 1

Yast2 authentication and RPM signature authentication
by Rafael E. Herrera 08 May '02

08 May '02

Hi, I just upgraded to 8.0 from 7.3 and have been experiencing some warnings from Yast2 (although I got the same in 7.3). 1. When launching Yast2 I get: Session management error: Authentication Rejected, reason : None of the authentication protocols specified are supported and host-based authentication failed Why is this message given and how should I configure my system to implement the authentication required? 2. I just got a security announcement and there is a note at the bottom about how to installing suse's signature. I saved the public signature and run the suggested command: # gpg --batch; gpg < announcement.txt | gpg --import gpg: Go ahead and type your message ... something ^D gpg: no valid OpenPGP data found. gpg: processing message failed: eof gpg: Signature made Wed 08 May 2002 05:58:59 AM EDT using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security(a)suse.de>" Could not find a valid trust path to the key. Let's see whether we can assign some missing owner trust values. No path leading to one of our keys found. gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. gpg: Fingerprint: 73 5F 2E 99 DF DB 94 C4 8F 5A A3 AE AF 22 F2 D5 gpg: key 9C800ACA: not changed gpg: key 3D25D3D9: not changed gpg: Total number processed: 2 gpg: unchanged: 2 This is hard to interpret, but I gather the key was not fully authenticated. If I run ca checksig using rpm, I get: # rpm -v --checksig shadow-4.0.2-88.i386.rpm shadow-4.0.2-88.i386.rpm: MD5 sum OK: ee8e88db89c24da38498c8612f3cdfb2 gpg: Signature made Thu 25 Apr 2002 01:40:07 PM EDT using DSA key ID 9C800ACA gpg: Good signature from "SuSE Package Signing Key <build(a)suse.de>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. gpg: Fingerprint: 79C1 79B2 E1C8 20C1 890F 9994 A84E DAE8 9C80 0ACA Again, this does not look good either. How is the suse key installed properly and how do I test that I did it right? Thanks. -- Rafael

1 0

Re: [suse-security] SuSE 8.0 (fwd) - OT
by Markus Gaugusch 08 May '02

08 May '02

Maybe I should have replied to the list ... even if it is off-topic ---------- Forwarded message ---------- Date: Wed, 8 May 2002 14:54:55 +0200 (CEST) From: Markus Gaugusch <markus(a)gaugusch.at> To: Bill Eastman <beastman(a)austin.rr.com> Subject: Re: [suse-security] SuSE 8.0 Try the following (insert first suse cd) mount /cdrom cd /cdrom zgrep locate INDEX.gz if that doesn't work, do zgrep locate ARCHIVES.gz |grep bin I always copy index.gz and archives.gz to my harddrive for convenience. hth, Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

SuSE YOU scheduling
by mario libraro 08 May '02

08 May '02

Hi to all listmates, after many many searches in the web i haven't still understood a pretty simple thing: how can I schedule (with crond for example) the execution of Yast Online Update? I think i must execute y2bignfat via crond with some parameter but i haven't found any clear documentation on it. Can someone help me? Mario Libraro

1 0

Failure mode for SuSEfirewall_setup
by Albert Brandl 08 May '02

08 May '02

Hi! When the init script SuSEfirewall_setup fails, it just writes out a red "failed" and terminates. If you boot up your machine in runlevel 5 and do not closely watch the initialization, you don't realize that the firewall has not been set up sucessfully. Since SuSEfirewall_init calls /sbin/SuSEfirewall close, which allows no incoming traffic, this does not open the machine to the "world". But I'm not quite sure if this "failure mode" is the best possible solution. Any opinions? Best regards, Albert Brandl

1 0

RE: [suse-security] Antwort: Re: Re: [suse-security] IPChains and IPTables
by Reckhard, Tobias 08 May '02

08 May '02

> ... if I have to ask google ... > ... why does this mailing-list exist ? ... To answer those questions that Google doesn't answer. > ... thought this mailing-list is to discuss different topics Yeah, I guess general discussion about security is also OK, as long as it doesn't stray too far from SuSE. However, I don't mean questions to which there are simple or unique answers, and instead discussions of opinions. Tobias

2 1

Antwort: Re: Re: [suse-security] IPChains and IPTables
by BLeonhardt＠analytek.de 08 May '02

08 May '02

... if I have to ask google ... ... why does this mailing-list exist ? ... ... thought this mailing-list is to discuss different topics ... and not only for "Firewall-Experts" ... Regards, Bruno Leonhardt Michael Appeldorn An: suse-security(a)suse.com, BLeonhardt(a)analytek.de <appeldorn@codix Kopie: x.de> Thema: Re: Re: [suse-security] IPChains and IPTables 08.05.02 11:37 Bitte antworten an Appeldorn >... now I'm not sure if I did understand that right ... > >.. IP-Chains can analyze if a packet is permitted to "go to the target >system" or not ( if so, the packet will be dropped or routed ) >.. IP-Tables can analyze all packets and Flags ( SYN, FIN, etc. ) no matter >where the packets destination is ( if a rule will apply the packet will be >dropped or routed ) > >.. right so ?!?!??!?!??!?! not really. again ! ask google ! e.g : compare iptables ipchains here the first link in list http://www.oofle.com/iptables/comparison.htm Yours Michael Appeldorn

4 3

SuSE Security Announcement: sysconfig (SuSE-SA:2002:016)
by Sebastian Krahmer 08 May '02

08 May '02

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: sysconfig Announcement-ID: SuSE-SA:2002:016 Date: Wed May 8 12:00:00 MEST 2002 Affected products: 8.0 Vulnerability Type: remote command execution Severity (1-10): 4 SuSE default package: Yes. Other affected systems: No. Content of this advisory: 1) security vulnerability resolved: Quotation problem in ifup-dhcp. problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The ifup-dhcp script which is part of the sysconfig package is responsible for setting up network-devices using configuration data obtained from a DHCP server by the dhcpcd DHCP client. It is possible for remote attackers to feed this script with evil data via spoofed DHCP replies for example. This way ifup-dhcp could be tricked into executing arbitrary commands as root. The ifup-dhcp shellscript has been fixed to not source the file containing the possible evil data anymore. Even though the sysconfig package is installed by default, this problem only affects systems with certain dhcp network-setups so only users using DHCP should update their sysconfig package. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. i386 Intel Platform: SuSE-8.0 ftp://ftp.suse.com/pub/suse/i386/update/8.0/a1/sysconfig-0.23.14-60.i386.rpm 4d6a9f1a3e1a461ebbea9a6e98f4e894 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/sysconfig-0.23.14-60.src.rpm d0fdfe02cfc9b7fc32fed8da6c16cf9d ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - mozilla/netscape The mozilla browser in version 0.9.7 or higher and the netscape browser in version 6.1 or higher contain a flaw which allows remote sites to read arbitrary files if the user running the browser has the permission to do so. Fixed packages for the mozilla browser will be available soon on our ftp-servers. Patches for the affected netscape browser are not yet available due to missing fixes from Netscape. - xpilot It has been reported that the xpilot server contains a buffer-overflow which allows remote attackers to execute arbitrary commands as the user running the server. The overflow has been fixed and new xpilot packages are available on our ftp-servers. Please update to the newest xpilot packages if you used to run this program. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SuSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SuSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBPNj243ey5gA9JdPZAQFDcQf8DMhbYdX+UsDGAwO4QpPylxxnh31Dt476 czcCmCH8XbzyNxIhdQeYAkSJ0rkRJD7xC+lgXjQbAv7TzAFsl6FGnsZDgB/b62z8 2vG+1iWoxYwQTSl7g7kpsQ+pDuZ8737ZQr7DY2gg9nLK4xPngt/C8TuBDVFIcqcE DrMlfUAWTiAvIVAPZxVWrbOjqVG6B00LeiHu/kQkOgXKQffqKKbNUa9Iyu5Fb/6Q CNO311fw2HCs4Ef7veZXJGmua8TGbbnj7ydWVmteLdYVbxEZ4faIFpJPiuJAcHI3 C49BNAEKo5GEBtvq/CPO35oK97uO5xiEhTDWA76Vbl27kyRluvGdqQ== =spzT -----END PGP SIGNATURE----- -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

1 0

Re: Re: [suse-security] IPChains and IPTables
by BLeonhardt＠analytek.de 08 May '02

08 May '02

Hi again, I 've read the pages ... ... now I'm not sure if I did understand that right ... .. IP-Chains can analyze if a packet is permitted to "go to the target system" or not ( if so, the packet will be dropped or routed ) .. IP-Tables can analyze all packets and Flags ( SYN, FIN, etc. ) no matter where the packets destination is ( if a rule will apply the packet will be dropped or routed ) .. right so ?!?!??!?!??!?! Thanks ! Regards, Bruno Leonhardt Michael Appeldorn An: suse-security(a)suse.com, BLeonhardt(a)analytek.de <appeldorn@codix Kopie: x.de> Thema: Re: [suse-security] IPChains and IPTables 07.05.02 11:34 Bitte antworten an Appeldorn Hi all, > >what exactly are the main differences between IPChains and IPTables ? > ask google 4: difference ipchains iptables snip ------ Message-ID: <EB5EB93D190ED31180430008C7F3714DB4A503@COSEXCH> From: "Woodworth, Lora" <Lora.Woodworth(a)cta.com> To: "'security-discuss(a)linuxsecurity.com'" <security-discuss(a)linuxsecurity.com> Subject: RE: Difference in ipchains and iptable Date: Wed, 31 Oct 2001 10:32:35 -0700 In short and in general iptables is in the 2.4 Kernel and will allow you to build a stateful firewall. ipchains was in 2.2 Kernel and gives you a stateless firewall. There is a good article about building an iptables based firewall at: http://www.linuxworld.com/site-stories/2001/0920.ipchains.html Also if you want more information do a search at: http://www.linuxsecurity.com and it has quite a few links. ------ snap Yours Michael Appeldorn -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] IPChains and IPTables
by Peer Stefan 08 May '02

08 May '02

Hi, > From: BLeonhardt(a)analytek.de [mailto:BLeonhardt@analytek.de] > .. IP-Chains can analyze if a packet is permitted to "go to the target > system" or not ( if so, the packet will be dropped or routed ) yes. that's right. > .. IP-Tables can analyze all packets and Flags ( SYN, FIN, > etc. ) no matter where the packets destination is ( if a > rule will apply the packet will be dropped or routed ) basically yes. as far as this is concerned, ipchains and iptables are similar. packets, which arrive at the iptables/ipchains-host are dropped, rejected, accepted, forwarded ... according to the rules. ipchains also understands syn-flags: #ipchains -h ... [!] --syn -y match TCP packets only when SYN set ... # one main difference is, iptables keeps track of existing connections (connection-states). you may apply rules according to the state of the connection (NEW,ESTABLISHED,...), which may come in handy with udp-connections, since there are no such things as syns. > Thanks ! you're welcome :-) > Regards, > Bruno Leonhardt regards, stefan

1 0

RE: Telnet Proxy
by d_lord＠gmx.de 07 May '02

07 May '02

Hi Martin, Your telnet problem could be solved in two ways with a shell script as "login shell" as mentioned befor. - real proxy, the firewall opens the telnet connection to the host specified - forwarding over ipchains/iptables rule Greetings D. Lord -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

Telnet-Proxy
by Martin Sckopke 07 May '02

07 May '02

Hi all, has anybody ever heard of a telnet-proxy? Checkpoints Firewall-1 offers this kind of functionality: You connect to the firewall on port 23, firewall asks for authentification and a hostname and afterwards you get a transparent telnet session to the named host, without any intererence by the firewall. Is something like that available as open source software? Thanks a lot, Martin

2 1

IPChains and IPTables
by BLeonhardt＠analytek.de 07 May '02

07 May '02

Hi all, what exactly are the main differences between IPChains and IPTables ? Is it true that IPChains is only able to work as packet-filter ( like destination : port forbidden ) ? Regards, Bruno Leonhardt

2 1

blocking certain ips
by Mike Otto 07 May '02

07 May '02

SuSEfirewall2 v2.1 iptables v1.2.5 Linux-Kernel 2.4.18 (5) ------------------------- Hi I´m looking for a way to block certain IP Addresses from all ports on my computer. I tried this at the console: iptables -A FORWARD -p tcp -s 192.168.100.1 -d 0.0.0.0/0.0.0.0 --dport 80 -j DROP but i can still connect from 192.168.100.1 to port 80 with telnet. Do I have to activate this rule first? or does it have to fit into firewall2-custom.rc.config, then restart firewall? Regards, Mike

5 7

RE: [suse-security] blocking certain ips
by Reckhard, Tobias 07 May '02

07 May '02

> Someone who explains to me why I cant just append rule 3,4,5,6 at the > end of the INPUT rules (APPEND) instead I have to INSERT them? > Is it because of rule 23 which cannot be overwritten? > Would make sense to me. Then I better insert right bevore line > 23, right? Is this a serious question? [snip] > 23 DROP all -- 0.0.0.0/0 0.0.0.0/0 > 24 REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp > dpt:113 reject-with tcp-reset [snip] Of course you *can* append rules 3-6 at the end of the INPUT chain, but they won't have any effect because of rule 23, which matches each and every IP packet and drops it on the floor. Rule 23 is in no way read-only, where did you get that idea? BTW, rule 24 is superfluous as well, it will never be hit, you might as well remove it. Tobias

1 0

RE: [suse-security] blocking certain ips
by Reckhard, Tobias 07 May '02

07 May '02

> > Now I need something that lists all INPUT rules by number > on the screen > > Is > > /usr/sbin/iptables -L -nv > > what you need ? If you want numbers, append '--line-numbers' to that, giving you: /usr/sbin/iptables -L -nv --line-numbers Tobias

1 0

RE: [suse-security] Telnet-Proxy
by Reckhard, Tobias 07 May '02

07 May '02

> You connect to the firewall on port 23, firewall asks for > authentification and a hostname and afterwards you get a > transparent telnet session to the named host, without > any intererence by the firewall. > > Is something like that available as open source software? I believe the TIS Firewall Toolkit (FWTK) contains a telnet proxy. Tobias

1 0

RE: [suse-security] Slightly OT but: SuSE 8.0 Yast Online Update and GPG
by Duane Kehoe 06 May '02

06 May '02

Maybe for You and Me a broken YOU is fine or using fou4s is fine. I am thinking about the larger public here. And I do think that a flaw in YOU is a show stopper as it is one of SuSE's main selling and advertising points of this distro. ______________________________________________________________ Duane Kehoe phone: 414.908.1814 Programmer / Analyst fax: 414.908.1601 Weyco Group, Inc. email: dkehoe(a)weycogroup.com -----Original Message----- From: Fred A. Miller [mailto:fm@cupserv.org] Sent: Monday, May 06, 2002 3:16 PM To: Duane Kehoe Subject: Re: [suse-security] Slightly OT but: SuSE 8.0 Yast Online Update and GPG -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Monday 06 May 2002 4:15 pm, Duane Kehoe wrote: > Yah I could, but I really want to use the default distro tools first before > I change over to a third party tool. Especially in areas where I could > negate my support solutions. Really I guess I have been following fou4s > but have no interest in using someone else's tool when I just paid 80.00 to > get the supplied and supported tools that should work. Plus SuSE appears > to have made significant improvements in speed which was the only negative > side of YOU for me. > I really and truly believe this is SuSE's responsibility to it's users, > especially when they make claims like everything is perfect after a 2 month > beta testing period. > > >I think the bug is in KDE, but not sure. For now, just answer "install" > > for all the files, then after the list is downloaded, do the > > upgrade.....it'll only upgrade what's needed. > > Also this is not a kde bug as it occurs from command line, kontrol panel > modules, and stand alone GUI Yast2. [snip] 'Hadn't checked it from command line. Yes, it's annoying, but NOT a show stopper. Fred - -- Fred A. Miller Systems Administrator Cornell Univ. Press Services fm(a)cupserv.org, www.cupserv.org - --- SuSE Linux v8.0 Pro--- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjzW5I4ACgkQB9vk4ichYXe5RQCgh72kSoBYcOP/JLns5Br5kR+C HvwAoLJuvfahupFl1oWBo1kpnodEy3ta =80fl -----END PGP SIGNATURE-----

1 0

RE: [suse-security] Slightly OT but: SuSE 8.0 Yast Online Update and GPG
by Duane Kehoe 06 May '02

06 May '02

Yah I could, but I really want to use the default distro tools first before I change over to a third party tool. Especially in areas where I could negate my support solutions. Really I guess I have been following fou4s but have no interest in using someone else's tool when I just paid 80.00 to get the supplied and supported tools that should work. Plus SuSE appears to have made significant improvements in speed which was the only negative side of YOU for me. I really and truly believe this is SuSE's responsibility to it's users, especially when they make claims like everything is perfect after a 2 month beta testing period. >I think the bug is in KDE, but not sure. For now, just answer "install" for >all the files, then after the list is downloaded, do the upgrade.....it'll >only upgrade what's needed. Also this is not a kde bug as it occurs from command line, kontrol panel modules, and stand alone GUI Yast2. ______________________________________________________________ Duane Kehoe phone: 414.908.1814 Programmer / Analyst fax: 414.908.1601 Weyco Group, Inc. email: dkehoe(a)weycogroup.com -----Original Message----- From: Markus Gaugusch [mailto:markus@gaugusch.at] Sent: Monday, May 06, 2002 2:52 PM To: Duane Kehoe Subject: Re: [suse-security] Slightly OT but: SuSE 8.0 Yast Online Update and GPG > What is the deal with the broken YOU / GPG on SuSE 8.0pro? Is there a work > around, or a fix planned? Can someone please let me know. I updated to 8.0 > over the weekend and everything was great, until ;( I ran YOU. Which > proceeded to tell me that either GPG was not installed, or SuSE had not > signed the update RPMs correctly, I of course installed the updates anyway. > Now I love SuSE but this is a definite show stopper for me(in fact I thought > about downgrading again!!), and worse yet imagine all the new users who will > be alienated by this type of horrific, and it is, error. I can replicate > this on different machines and on every install, this weekend I ran around > 10 installs to verify all of which reported the same error. Did you try fou4s? http://www.gaugusch.at/fou4s It replaces YOU and works with 8.0 (and gpg) Markus -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

SuSE 8.0 no ftp installation possible ? NFS is insecure.
by Gunther Stammwitz 06 May '02

06 May '02

Hello, I've just been trying to install SuSE 8.0 via FTP, but I couldn't believe it hwen I saw it: there is no ftp-installation option. There are only two options left: - Installation via NFS (insecure !!!!) - Installation via SMB/Windows file sharing (doesn't work, because the installer can't find a no further specified module). Please don't force us to use nfs - that sucks and is _really_ insecure. Am I missing something or did SuSE remove the ftp-installer. Andy why doesn't the (also insecure) smb-installer work ? Bye, Gunther

9 11

VPN masquerading
by Joost van der Lugt 06 May '02

06 May '02

Hi all, I am trying to set up VPN masquerading, for a Windows box, and just wondered if there was an easy way to do this, using just the firewall.rc.config script, or do both that plus the custom config script have to be used? I have seen the VPN how-to, however just wondered about a how to aply this with SuSE's scripts. Thanks for any suggestions, (PS if there is someone familiar with setting upo VPN on the SuSe box itself, I would be very interested as well..., of course) - Cheers, Joost

4 4

Partitions
by Ricardo Javier Aranibar León 06 May '02

06 May '02

Hi list, I need information about secure partitions, I have HD 40G, I like a web server an mail server. I saw that web master partitions yours disk with var/, boot/, home/, I like to know what directorys create and how I can asing size for this? If someone can help me, I will Thank full Thanks, Ricardo _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

7 9

Re: [suse-security] DynDNS Clients
by Sven Lehmann 06 May '02

06 May '02

Hello, my English isn't so good, forgives my writing style. I had the problem with the blinking buttons for the standard Kernel of SuSE 7.3, as me used. The problem more highly than 4.2.16 didn't appear after update on any more. Mfg Svele John Andersen <jsa(a)pen.homeip.net> wrote .. > On Sunday 05 May 2002 06:44 am, Andreas.Novak(a)student.fh-nuernberg.de wrote: > > Dear List, > > > > I've recently downloaded the "dyndnsupdate client" for DynDns.org. I > think > > it's much easier to use than the other clients. Anyway I got problems. > > After I execute the binary with the appropriate options, it says that > the > > update was successful, afterwards my WebServer crashes. It refuses any > > input from the keyboard, and the Caps Lock und the Scroll Lock lights > are > > on. I've similar problems with another client for dyndns ( the ddclient > I > > think ). So most probably it's not a specific problem to this client. > > Perhaps I just configured something wrong?? > > Sounds to me like it put your processor in a tight loop. > It matters not how easy to config a daemon is if it causes > this. > > I've been running ez-ipupdate on SuSE, TurboLinux, Mandrake > and FreeBDS without a single problem. Its linked to > the clients pages on dyndns. > > -- > _________________________________________________ > No I Don't Yahoo! > And I'm getting pretty sick of being asked if I do. > _________________________________________________ > John Andersen / Juneau Alaska > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] SuSEfirewall2 and nimda
by Michael Stern 06 May '02

06 May '02

>iptables -A block -p tcp --dport http -m state --state NEW,ESTABLISHED,RELATED \ -m string --string "root.exe" -j DROP< i'm curious .. does this drop the packet only or all further packets (which might come in) too? thank you, michael

2 1

SuSEfirewall2 and nimda
by Ruud H. Koning 06 May '02

06 May '02

Hello, I have installed Suse linux 8 and activated SuSEfirewall2. I would like to black http requests from Nimda/Code Red etc. infected hosts. With iptables this is supposed to be possible with something like iptables -A block -p tcp --dport http -m state --state NEW,ESTABLISHED,RELATED \ -m string --string "root.exe" -j LOG --log-prefix "Nimda virus " iptables -A block -p tcp --dport http -m state --state NEW,ESTABLISHED,RELATED \ -m string --string "root.exe" -j DROP Where would I put these commands in the configuration of SuSEfirewall2? Thanks for any help, Ruud

1 0

Re: [suse-security] Re: User with dots ? Why not in yast2
by ts 06 May '02

06 May '02

> * Lars Vaessen <l.vaessen(a)vvmedien.com> [2002-05-05 16:49 > +0200]: > > > First one. Some implementations of chown expect user and > group > separated by a dot. If your username was "lars.vaessen", > how could > an admin of such a system chown you a file? It would go to > the > different user "lars" and the group "vaessen". That's simply not true. I just chowned bogus.guy /home/bogus.guy/*.x*, as an experiment and it works as expected. > If previous versions of yast didn't mind dots, they are > broken. This is something that needs to be conclusively proven by real world examples of system malfunction arising from this use rather than an aesthetic dislike of the dotted seps. Not to mention that a trivial c program or awk script could probably be used to insulate this problem on systems that do exhibit this behavior. Disclaimer: I don't like using "." seps in legitimate, system usernames, but for mailusers it is something that is sometimes desirable IMO.

3 2

Re: [suse-security] Re: Re: User with dots ? Why not in yast2
by ts 06 May '02

06 May '02

> If you had followed my explanation, you would have come to > this: > > $ touch somefile; ls -ld $_ > -rw-r--r-- 1 root root 0 May 5 21:25 > somefile > $ useradd lars > $ groupadd vaessen > $ chown lars.vaessen somefile && ls -ld somefile > -rw-r--r-- 1 lars vaessen 0 May 5 21:25 > somefile > > $ rm somefile; touch $_; ls -ld $_ > -rw-r--r-- 1 root root 0 May 5 21:25 > somefile > $ useradd lars.vaessen > $ chown lars.vaessen somefile && ls -ld somefile > -rw-r--r-- 1 lars.vae root 0 May 5 21:26 > somefile This is really not a telling example at all; it is more than a little contrived. If you have a situation like this then you are absolutely correct, if you do not it is a non-problem. You made a global statement of recommendation regarding: "a system chown you a file? It would go to the different user "lars" and the group "vaessen"." without an example like that you just gave. This is misleading and erroneous. > As you can see, the behaviour of chown depends on the > contents of your > /etc/passwd . So it's impossible to predict what would > happen by > deriving the commandline. And that's why you really do > *not* want to > use dots in usernames. Also this is easily avoided at user generation time using a simple wrap for useradd. It is incorrect to say that it is "impossible" to predict what would happen. A bare bones proof of concept: awk -v xx="bogus.users" ' { if (m = split(xx,arr,".")) { FS = ":" if ($1 == arr[2]) { printf "%s", "You cannot use this name.\n" exit } } }' /etc/groups > > > If previous versions of yast didn't mind dots, they > are broken. > > This is something that needs to be conclusively proven > by real world > > examples of system malfunction arising from this use > rather than an > > aesthetic dislike of the dotted seps. > I disagree in principle but you seem to be factually correct. > -- > Johannes Franken > > Professional unix/network development > mailto:jfranken@jfranken.de > http://www.jfranken.de/ > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: > suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not > here

1 0

DynDNS Clients
by Andreas.Novak＠student.fh-nuernberg.de 05 May '02

05 May '02

Dear List, I've recently downloaded the "dyndnsupdate client" for DynDns.org. I think it's much easier to use than the other clients. Anyway I got problems. After I execute the binary with the appropriate options, it says that the update was successful, afterwards my WebServer crashes. It refuses any input from the keyboard, and the Caps Lock und the Scroll Lock lights are on. I've similar problems with another client for dyndns ( the ddclient I think ). So most probably it's not a specific problem to this client. Perhaps I just configured something wrong?? Any ideas welcome Thanks in advance Andreas Novak --_OPERAB__-rV87oLfWE37ZzAm43+s4oR--

3 2

file creation with a different gid?
by Axel Zindler 05 May '02

05 May '02

Hi, was wondering how to create files with a different gid then the standard group. Suppose one wants to share files with a second (or third and so far) user. They create a common group different from (standard) users, ie. projectx. If both users are now members of projectx and keep the membership of users the files will be written always with the uid of users, ie: -rw-r--r-- 1 axel users 16 Mär 31 22:50 test.txt How is it possible to edit a file and save files in that way to achive the following without doing a chgrp after the file is saved? -rw-r--r-- 1 axel projectx 16 Mär 31 22:50 test.txt

4 3

User with dots ? Why not in yast2
by Lars Vaessen 05 May '02

05 May '02

Hi Perfect I Love Yast 2 . Really ? Why can't I use dots in my User-Name ? Is that a security problem or only a YAST2 Problem. It was possible in YAST . Why ????????? Lars Vaessen

3 2

Guarddog vs SuSEfirewall2?
by Wesley Skoczen 05 May '02

05 May '02

Hi list I am using SuSE 7.2 and would like to secure it. Is the latest Guarddog as secure as SuSEfirewall2? I would appriciate any comments. Thank You Wesley ______________________________________________________________________ Games, Movies, Music & Sports! http://entertainment.yahoo.ca

3 2

Netsaint
by Jonathan Fondow 05 May '02

05 May '02

Hellow all, I am trying to setup netsaint for network monitoring and am having a few problems. The netsaint documentation doesn't matchup with the RPM that came with 7.3, as far as setup. If anybody can shed some light on this or any other comments on netsaint, please. Thank you.

2 1

Kernel sources (not entirely OT)
by John Andersen 05 May '02

05 May '02

About april 15 the new kernels were announced here. I've installed this one: Linux pen 2.4.16-4GB-SMP #1 SMP Mon Apr 15 09:54:09 GMT 2002 i686 But the source rpm in the same directory on ftp.suse.com does not seem to match, and when I try to install vmware it refuses to configure saying: -----------paste What is the location of the directory of C header files that match your running kernel? [/usr/src/linux/include] The directory of kernel headers (version 2.4.16-4GB) does not match your running kernel (version 2.4.16-4GB-SMP). Even if the module were to compile successfully, it would not load into the running kernel. ------end-paste So, the question is where can I get the source tree for the SMP kernel or is it the same source with a different compile option? -- _________________________________________________ No I Don't Yahoo! And I'm getting pretty sick of being asked if I do. _________________________________________________ John Andersen / Juneau Alaska

2 1

Re: [suse-security] SuSE 8.0 no ftp installation possible ? NFS is insecure
by Lionel 04 May '02

04 May '02

Le Jeudi 2 Mai 2002 01:44, gstammw(a)gmx.net a écrit : > Hello, > > I've just been trying to install SuSE 8.0 via FTP, but I couldn't believe > it > hwen I saw it: > there is no ftp-installation option. What a bad idea ! It was a very good way to install missing programms without cdroms, very interessant when servers are too far , when you don't know where your cdrom's are , or when you have to operate for distant administration tasks. Will We have to plan for another distribution or will next release have ftp option enabled again ? Lionel, disapointed . -- AgrogeomaTIC CNERTA-ENESAD, 4 rue champs-prevois, batiment grand-champs, 21000 Dijon 03.80.77.28.49

1 0

Output from the last command
by Torsten Mueller 04 May '02

04 May '02

Hey, on my SuSE-Linux-FTP-i386-7.2.0 i get 2 lines if i type the last, which i can't interpret: root pts/2 p50883d2e.dip.t- Mon Apr 29 02:56 - down (00:40) root pts/0 p50883d2e.dip.t- Mon Apr 29 02:07 - down (01:28) X******* ****X******* X*******X******* Thu Jan 1 01:00 - down (11806+01:36 root pts/0 pd9533d73.dip.t- Tue Apr 9 09:12 - 10:03 (00:50) root pts/0 pd9e47f88.dip.t- Sat Apr 6 07:07 - 07:15 (00:07) X******* ****X******* X*******X******* Thu Jan 1 01:00 - 01:00 (00:00) root pts/1 p5088308b.dip.t- Sat Mar 30 00:06 - 02:10 (02:03) root pts/0 p5088308b.dip.t- Sat Mar 30 00:06 - 02:10 (02:03) reboot system boot 2.4.7 Fri Mar 29 23:53 (30+02:42) I looked in /var/log/* but could not find mysterious entrys in the files between Sat Mar 30 00:06 and Sat Apr 6 07:07. I first tried to search with google, but the '*' seems to bring me other results, than i wanted. Thanks for your help. Torsten

1 0

iptables und dnat (ftp hinter router)
by killer 04 May '02

04 May '02

hallo zusammen. irgendwie hab ich leichte probleme mit iptables unter SUSE 8.0 ich will einfach nur einen port für den ftpserver an einen host hinter der firewall forwarden. unter ipchains habe ich das immer mit : ipmasqadm autofw -A -v -r tcp 21 21 -h 191.168.0.2 gemacht. laut nat howto sollte das unter iptables mit : iptables -t nat -A PREROUTING -p tcp --dport 21 -i ppp0 -j DNAT --to 192.168.0.2:21 funzen. aber irgendwie landen die packet in meiner default drop: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT=eth0 SRC=130.83.233.186 DST=192.168.0.2 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=7636 DF PROTO=TCP SPT=4468 DPT=666 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405640402080A03D4BDF80000000001030301) bin leider noch nicht ganz so erfahren in iptables, vielleicht kann mir da jemand helfen. mfg christian michallek

1 0

AW: Antw: AW: AW: [suse-security] SUSE 8.0: IS Harden-SuSEsupported ??
by Gunther Stammwitz 03 May '02

03 May '02

Hi, It seems to work well with SuSE8, that's true. But as far as I know it is looking in /etc/rc.config which is no longer being used with SuSE 8.0. Mark should fix this :-) Bye, Gunther -----Ursprungliche Nachricht----- Von: Milan Goellner [mailto:milan.goellner@compu-shack.com] Gesendet: Freitag, 3. Mai 2002 08:00 An: gstammw(a)gmx.net; suse-security(a)suse.com Cc: jschoeler(a)cccbbs.de Betreff: Antw: AW: AW: [suse-security] SUSE 8.0: IS Harden-SuSEsupported ?? Hi, I'm using harden_suse on 8.0 on production Servers, ran like a charm, finished in record time (I've been given new hardware ;) and there are no issues whatsoever SO FAR as the servers all still seem to be un-rooted ... so to speak. regards, Milan

1 0

Re: [suse-security] aaa_base updating /etc/passwd
by James Ogley 03 May '02

03 May '02

> So how would you do this ???? You also had a look at the prein-Script > ??? There the password-template is generated, so all your changes will > be lost. D'oh! Thanks for pointing that out... So, back to my original question - is there a way of preventing this from being done? (Other than every time aaa_base is updated, getting the .spm file, changing the preinstall script and rebuilding it?) And I'd still like to know why it says it's unchanged, when it changes it ;) -- James Ogley, Unix Systems Administrator, Pinnacle Insurance Plc james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 (0) 20 8731 3619 Using Free Software since 1994, running GNU/Linux (SuSE 8.0) Updated GNOME RPMs for SuSE Linux: www.usr-local-bin.org *********************************************************************** CONFIDENTIALITY. This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance Plc. If you have received this e-mail in error please immediately notify our Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

2 1

Need help with iptables: missing .so -- and I can't use DENY or ACCEPT
by JW 03 May '02

03 May '02

Hello, I have been trying for 2 days to get iptables to work. Something is really really wrong. Initially I was trying on a 7.3 install that had been upgraded from 7.2. I thought maybe the software was just messed up so I just finished a clean install of 8.0, yet I am getting exatly the same error messages: bismuth:~ # iptables -A INPUT -p tcp -i eth0 -s 192.168.0.110 -j DENY iptables v1.2.5: Couldn't load target `DENY':/usr/lib/iptables/libipt_DENY.so: cannot open shared object file: No such file or directory Try `iptables -h' or 'iptables --help' for more information. bismuth:~ # iptables -A INPUT -p tcp -i eth0 -s 192.168.0.110 -j deny iptables v1.2.5: Couldn't load target `deny':/usr/lib/iptables/libipt_deny.so: cannot open shared object file: No such file or directory Try `iptables -h' or 'iptables --help' for more information. bismuth:~ # iptables -A INPUT -s 65.166.138.61 -j DENY iptables v1.2.5: Couldn't load target `DENY':/usr/lib/iptables/libipt_DENY.so: cannot open shared object file: No such file or directory Try `iptables -h' or 'iptables --help' for more information. bismuth:~ # I've tried dozens ot test commands too, any of the that use DENY or ACCEPT fail. Even more interesting: According to the Linuxnewbie.org tutorial, both of the following commands should prevent 192.168.0.110 from being able to access the machine running iptables: iptables -A INPUT -s 192.168.0.110 -j DENY iptables -A INPUT -s 192.168.0.110 -j DROP Yet, the exact _opposite_ happens: the local machine ends up not being able to to anything to the remote host, yet the remote host is still able to log in via telnet just fine. Disgusting. Thinking that maybe I was just misunderstanding something, I tried -d in place of -s and that does nothing at all, both hosts are able to log into each other. Something is badly amiss. Please, can anyone explain this? I get similar errors when I try to use ACCEPT. All I'm trying to do is restrict port 5000 (I'm using 5001 as a test) so that only 1 IP can access it. Eventually that IP will be 65.166.138.61 but I'm using 192.168.0.110 as a test. Please, someone strighten me out. And before you say RTFM, I've been reading it for 2 days. I'm going precisly by the book, and it's not working. Something is just plain wrong. Also please don't ask me to use SuSE Firewall2, I've tired it quite a few times and I'm never able to get it to work. Thanks in advance. -- ---------------------------------------------------- Jonathan Wilson System Administrator Clickpatrol.com Cedar Creek Software http://www.cedarcreeksoftware.com

4 6

aaa_base updating /etc/passwd
by James Ogley 03 May '02

03 May '02

As part of our security audit on any new boxen we deploy, we remove all spurious usernames from /etc/passwd and /etc/shadow However, when we updated aaa_base from ftp.suse.com, the RPM update gives this output: Updating /etc/passwd...unchanged Updating /etc/shadow...unchanged But it does change it - it restores all the spurious usernames (zope, amanda, codadmin etc etc) Surely all these usernames are not contained in the package's post-install script, so does it read them from somewhere else? (And really, why does it say it is leaving the files unchanged, when it clearly isn't?) -- James Ogley, Unix Systems Administrator, Pinnacle Insurance Plc james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 (0) 20 8731 3619 Using Free Software since 1994, running GNU/Linux (SuSE 8.0) Updated GNOME RPMs for SuSE Linux: www.usr-local-bin.org *********************************************************************** CONFIDENTIALITY. This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance Plc. If you have received this e-mail in error please immediately notify our Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

2 2

samba problem with cups changing /var/spool/lpd/lp access permissions
by Jochen Staerk 03 May '02

03 May '02

Hi List, When I set access permissions on /var/spool/lpd/lp to public writeable, my samba does work fine, but when i restart, cups (?) changes them back to rwx------ lp lp i can't find any file where i could configure cups not to do so - is there one? is there another possibility except running a script at startup that changes those permissions? The message Permissions for /var/spool/lpd ? From: Robert Casties (robert.casties(a)philo.unibe.ch) at Fri Nov 12 1999 - 04:54:41 PST matches my problem and changing /var/spool/lpd permissions doenst work with me (doenst affect anything). thanks&ciao Jochen

2 2

sendmail attack ? relaying denied
by Gero Lindenblatt 03 May '02

03 May '02

Hi, since yesterday my sendmail 8.11.3 does not relay any more. In the /etc/mail/access nothing was changed. I restarted sendmail again and again. but nothing helped. In /var/log/warn there are serveral lines like "sendmail[11695]: g4212j111695: collect: premature EOM: Error 0" Could this be a reason or am I hacked ? thanks GL ________________________________________________________________ Keine verlorenen Lotto-Quittungen, keine vergessenen Gewinne mehr! Beim WEB.DE Lottoservice: http://tippen2.web.de/?x=13

2 1

Antw: AW: AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Milan Goellner 03 May '02

03 May '02

Hi, I'm using harden_suse on 8.0 on production Servers, ran like a charm, finished in record time (I've been given new hardware ;) and there are no issues whatsoever SO FAR as the servers all still seem to be un-rooted ... so to speak. regards, Milan

1 0

AW: AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Gunther Stammwitz 02 May '02

02 May '02

Hi Jost, did you test it ?? Looks like I'm a cadger. If it workes well with your system I'm going to give it a try on my system :-))) Bye, Gunther -----Ursprüngliche Nachricht----- Von: jschoeler(a)cccbbs.de [mailto:jschoeler@cccbbs.de] Gesendet: Freitag, 3. Mai 2002 00:49 An: Gunther Stammwitz Betreff: Re: AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? Hello, I think, that is my own risk and time, to test the harden_use together with SuSE 8.0. You can wait on another one, who will test it, but you can also test it for yourself. For such tests I can explain VmWare or something else, with a real test-area near the reality of your productive systems. When someone you tells, that it will be gone, that isn't a promise for your systems, or? Many greetings, Jost Schöler cccbbs Kommunikationstechnik Kreuzta/Germany "Gunther Stammwitz" <gstammw(a)gmx.net> wrote on 02.05.2002 19:15:06: > Hello Johan, > > thanks for your reply, but just TRYING is _NOT_ an option for me. > We're using linux in productive enviorments. Errors mustn't happen. > > Maybe Marc can tell us if we can use harden_use together with SuSE 8.0. > > Bye, > Gunther > > -----Ursprüngliche Nachricht----- > Von: Johan Stäring [mailto:js@fy.chalmers.se] > Gesendet: Donnerstag, 2. Mai 2002 15:06 > An: Gunther Stammwitz > Cc: suse-security(a)suse.com; marc(a)suse.de > Betreff: Re: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? > > > On Thu, 2 May 2002, Gunther Stammwitz wrote: > > :can I use harden_suse with SuSE-8.0 ?? > :I'm askin because the latest version of Harden SuSE is v3.5 from the 12th > :June 2001. > :This is definitive BEFORE SuSE 8.0 has been released. > > Why not try instead of ask? :) > > Change the line $debug = 0 to $debug = 1 in the harden_suse script and > execute it. Look for error messages and look through the output files that > in debug mode ends up in a directory named something similar to > /tmp/.harden_suse.<pid> > > If nothing seems to break, the script works. > > /Johan, without a SuSE 8.0-machine to try on > > -- > ================================================================ > || js(a)fy.chalmers.se || Johan Stäring || +46-(0)70-672 79 01 || > || ICQ#: 7290407 || http://www.fy.chalmers.se/~js || > ================================================================ > > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

RE: [suse-security] SuSE 8.0 no ftp installation possible ? NFS is insecure.
by John Trickey 02 May '02

02 May '02

> Stop writing corny firewall & get a hard on SuSE scripts for > newbies. Wheres does this fit into the technical crowd whose I am feeling SuSE are losing their way. I first used 6.2 and was quite happy with its content. In providing a production service, I moved to 7.2 but have gone no further. The lack of kernel updates and now the eventual release of 2.4.16 when we are up to 2.4.19rc4. Yes, 8.0 I believe has 2.4.18 but should I move to 8.0 just for that? No! My biggest complaint - and this is of all distros - is that they will insist on fiddling with the file system layouts. If I find I need to patch a particular application to fix a problem which SuSE have not resolved, I end up with a major effort. Usually it ends up with downloading the updated src from the author's site and then getting it to map SuSE's layout. If you think the above has nothing to do with security you'd be wrong. All I want from a distro is a stable and secure platform. I use a distro to save time in fixing things myself and am willing to pay for that benefit. What I do not want is bells and whistles at the expense of aging products. SuSE - feel free to comment as I'd like to know where you are going. John

1 0

AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Gunther Stammwitz 02 May '02

02 May '02

Hello Johan, thanks for your reply, but just TRYING is _NOT_ an option for me. We're using linux in productive enviorments. Errors mustn't happen. Maybe Marc can tell us if we can use harden_use together with SuSE 8.0. Bye, Gunther -----Ursprüngliche Nachricht----- Von: Johan Stäring [mailto:js@fy.chalmers.se] Gesendet: Donnerstag, 2. Mai 2002 15:06 An: Gunther Stammwitz Cc: suse-security(a)suse.com; marc(a)suse.de Betreff: Re: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? On Thu, 2 May 2002, Gunther Stammwitz wrote: :can I use harden_suse with SuSE-8.0 ?? :I'm askin because the latest version of Harden SuSE is v3.5 from the 12th :June 2001. :This is definitive BEFORE SuSE 8.0 has been released. Why not try instead of ask? :) Change the line $debug = 0 to $debug = 1 in the harden_suse script and execute it. Look for error messages and look through the output files that in debug mode ends up in a directory named something similar to /tmp/.harden_suse.<pid> If nothing seems to break, the script works. /Johan, without a SuSE 8.0-machine to try on -- ================================================================ || js(a)fy.chalmers.se || Johan Stäring || +46-(0)70-672 79 01 || || ICQ#: 7290407 || http://www.fy.chalmers.se/~js || ================================================================

3 2

SSH
by Robert Greenwell 02 May '02

02 May '02

I have SuSe 7.3 with rpm package openssh-2.9.9p2-98. I noticed that openssh is at version 3.1p1. Are there plans to provide the newer version? Thanks, Robert Greenwell

3 2

AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Gunther Stammwitz 02 May '02

02 May '02

Hello Ryan, yes - I have looked at the scripts :-) What I want is that the scrips does exactly what it is supposed to do. Nothing more and nothing less. The functionality is predefined - and yes, it perfectly fits into my security strategy; as one tiny part of course. Where's the problem ? Why shouldn't we use the scripts if they're there AND if we know what they are doing... Bye, Gunther -----Ursprüngliche Nachricht----- Von: Ryan Swenson [mailto:Ryan.Swenson@togethersoft.com] Gesendet: Donnerstag, 2. Mai 2002 19:32 An: Gunther Stammwitz; suse-security(a)suse.com Cc: Johan Stäring Betreff: RE: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? uh have you ever just looked at the scripts ? so many people ask SuSEfirewall1&2, and Harden_SUSE questions yet they are only scripts making practice of what any security conscious going person if within a production environment should already know. I would not want my network protected by administrators that must rely on scripts without knowing the principles behind the script in that they are mostly easy to learn and thus implement. You can modify it or take out of context things you obviuosly know will work. Gruesse/Hadjo Taag/Regards, Ryan S. -----Original Message----- From: Gunther Stammwitz [mailto:gstammw@gmx.net] Sent: Thursday, May 02, 2002 1:15 PM To: suse-security(a)suse.com Cc: Johan Stäring Subject: AW: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? Hello Johan, thanks for your reply, but just TRYING is _NOT_ an option for me. We're using linux in productive enviorments. Errors mustn't happen. Maybe Marc can tell us if we can use harden_use together with SuSE 8.0. Bye, Gunther -----Ursprüngliche Nachricht----- Von: Johan Stäring [mailto:js@fy.chalmers.se] Gesendet: Donnerstag, 2. Mai 2002 15:06 An: Gunther Stammwitz Cc: suse-security(a)suse.com; marc(a)suse.de Betreff: Re: [suse-security] SUSE 8.0: IS Harden-SuSE supported ?? On Thu, 2 May 2002, Gunther Stammwitz wrote: :can I use harden_suse with SuSE-8.0 ?? :I'm askin because the latest version of Harden SuSE is v3.5 from the 12th :June 2001. :This is definitive BEFORE SuSE 8.0 has been released. Why not try instead of ask? :) Change the line $debug = 0 to $debug = 1 in the harden_suse script and execute it. Look for error messages and look through the output files that in debug mode ends up in a directory named something similar to /tmp/.harden_suse.<pid> If nothing seems to break, the script works. /Johan, without a SuSE 8.0-machine to try on -- ================================================================ || js(a)fy.chalmers.se || Johan Stäring || +46-(0)70-672 79 01 || || ICQ#: 7290407 || http://www.fy.chalmers.se/~js || ================================================================ -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

iptables and squid
by Wahlert Andreas 02 May '02

02 May '02

Hi List, i have configured an Linux BOX with Squid, Squid NCSA_AUTH and dansguardian. It works fine. Now i want to implement iptables. The Squid is not tranparent. But i have no idea about the iptables. Can anyone help??? Regrads Andreas Wahlert

3 2

Re: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Martin Peikert 02 May '02

02 May '02

Julian Wingert wrote: > Hallo > > if you need "harden-suse" to make your server secure, > better not put it in the wild. Hahaha. Usually I run debian and OpenBSD... Can you tell me what the harden-suse script is good for if it's not to secure a server running in the wild? GTi

1 0

Re: [suse-security] SUSE 8.0: IS Harden-SuSE supported ??
by Johan Stäring 02 May '02

02 May '02

[Right... one needs to post from and to the correct address. Sorry about that, Gunther and Marc] On Thu, 2 May 2002, Gunther Stammwitz wrote: :can I use harden_suse with SuSE-8.0 ?? :I'm askin because the latest version of Harden SuSE is v3.5 from the 12th :June 2001. :This is definitive BEFORE SuSE 8.0 has been released. Why not try instead of ask? :) Change the line $debug = 0 to $debug = 1 in the harden_suse script and execute it. Look for error messages and look through the output files that in debug mode ends up in a directory named something similar to /tmp/.harden_suse.<pid> If nothing seems to break, the script works. /Johan, without a SuSE 8.0-machine to try on -- ================================================================ || js(a)fy.chalmers.se || Johan Stäring || +46-(0)70-672 79 01 || || ICQ#: 7290407 || http://www.fy.chalmers.se/~js || ================================================================

2 1

SUSE 8.0: IS Harden-SuSE supported ??
by Gunther Stammwitz 02 May '02

02 May '02

Hello, can I use harden_suse with SuSE-8.0 ?? I'm askin because the latest version of Harden SuSE is v3.5 from the 12th June 2001. This is definitive BEFORE SuSE 8.0 has been released. Thanks, Gunther + Serverhousing @ www.rackbase.de + --------------------------------------------------------- Mainlab GmbH Sachsenhäuser Landwehrweg 236 60598 Frankfurt am Main Tel. / Fax: 0700-2MAINLAB (0700-26246522) Email: info(a)mainlab.de Web: www.mainlab.de

1 0

Strange system log entries Can anyone explain and help get rid off
by Ralph F. De Witt 02 May '02

02 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all: I have noticed after doing my SuSE 8.0 install these strange log entires about eth0 can anyone explain them and how to correct what ever is not working right. Just for background I did a clean install of 8.0 pro. I connect to the internet through a cable modem connected to eth0. During setup I did not specifie any addresses except for dns servers and the default 255.x.x.x stuff, I checked DHCP. This is a snip of the system log file: May 2 01:19:12 Unkitty kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:04:bd:c1:18:0f:08:00 SRC=192.168.100.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 May 2 01:22:12 Unkitty kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:04:bd:c1:18:0f:08:00 SRC=192.168.100.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 May 2 01:25:12 Unkitty kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:04:bd:c1:18:0f:08:00 SRC=192.168.100.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 May 2 01:25:47 Unkitty su: (to root) ralph on /dev/pts/2 May 2 01:25:47 Unkitty su: pam_unix2: session started for user root, service su May 2 01:25:47 Unkitty su: pam_unix2: session finished for user root, service su May 2 01:25:47 Unkitty su: (to root) ralph on /dev/pts/2 May 2 01:25:47 Unkitty su: pam_unix2: session started for user root, service su May 2 01:28:12 Unkitty kernel: SuSE-FW-UNAUTHORIZED-TARGET IN=eth0 OUT= MAC=01:00:5e:00:00:01:00:04:bd:c1:18:0f:08:00 SRC=192.168.100.1 DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0xC0 TTL=1 ID=0 PROTO=2 Thanks for your help. - -- Yours, Ralph. It said Use Windows XP or better, so I installed SuSE 8.0 Professional Register Linux User 168814 ICQ #49993234 AIM ralphdewitt GPG Public Key available at http://www.keyserver.net Key fingerprint = 6426 1CFF 0987 9D51 76D6 06BC F22A CFF4 559A 03E7 Kernel version 2.4.18-4GB Current Linux uptime: 2 days 2 hours 22 minutes. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE80Psy8irP9FWaA+cRAvjgAJ0V6w+woqGeHJBDomtPzrUEGPFAWgCfdYwF BwZ20neYoxBdtd7Ylq8E2CI= =Ic/v -----END PGP SIGNATURE-----

1 0

RE: [suse-security] Installing a Firewall on the same system runi ng HTTP, Mail, DNS, ..
by Peer Stefan 02 May '02

02 May '02

Hi > From: Reckhard, Tobias [mailto:tobias.reckhard@secunet.com] > > > Is there some security feature, if we ran a firewall on the > > same server, > > which is running other services like HTTP, .. > > Personally, I'd suggest to get a firewall running on a > > specific server, and > > all other services on other systems. I totally agree with your personal opinion. > The main problem with using a firewall to perform other > services is that > vulnerabilities in those services can have disastrous > effects, typically > much graver ones than if merely a server is compromised. Another thing are users. For larger environments you will have a webteam, which requires several user-accounts on the webserver. You will have ftp enabled, because standard web-design tools like dreamweaver or frontpage allow you to update entire webpages via ftp. Or even worse - you'll have to enable the frontpage extensions - all those services add some new holes to your system. regards, Stefan

1 0

RE: [suse-security] Installing a Firewall on the same system runi ng HTTP, Mail, DNS, ..
by Reckhard, Tobias 02 May '02

02 May '02

> Is there some security feature, if we ran a firewall on the > same server, > which is running other services like HTTP, .. > Personally, I'd suggest to get a firewall running on a > specific server, and > all other services on other systems. The main problem with using a firewall to perform other services is that vulnerabilities in those services can have disastrous effects, typically much graver ones than if merely a server is compromised. Tobias

1 0

Installing a Firewall on the same system runing HTTP, Mail, DNS, ..
by Pascal Miquet 02 May '02

02 May '02

Hi, Just to clarify what I think about Security. Is there some security feature, if we ran a firewall on the same server, which is running other services like HTTP, .. Personally, I'd suggest to get a firewall running on a specific server, and all other services on other systems. Regardless SPOF, of course. Thanks for any advice. Pascal Miquet

1 0

emailing problems - possible spoofing ?
by Matt 01 May '02

01 May '02

Hi, Is it posible to spoof an email address ? Could someone test test(a)jtml.com and find out where it is going too ? Regards Matt

2 1

Re: [Users] IPSEC and SuSEFirewall2 v2.1
by Robert Klein 01 May '02

01 May '02

> I have modified the SuSEfirewall2 Script (Version 2.1) for better > support of FreeSWAN/IPSEC. Nice idea. > Any comments/suggestions/feedback? Two questions: Is it possible to use more than one IPSEC device? E.g. FW_DEV_IPSEC="ipsec0 ipsec1" and: Can I use more than one remote network? E.g. FW_IPSEC_REMOTENET="192.168.3.0/24 192.168.4.0/24" Robert

3 2