May 2002 - openSUSE Security - openSUSE Mailing Lists

fou4s - Fast OnlineUpdate for SuSE 0.4.0
by Markus Gaugusch 20 May '02

20 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The next version of fou4s is out! - From the changelog: * Fixes for 0.3.0: + Environment variable LANG is unset, because GPG sig check fails with non-english environment + Check if /etc/suseservers exists * New options: --buildtime, --force, --fullpath, --version * New config file options: CheckFou4s, UseFullPath, DefaultVerbosity, ProxyUser, ProxyPasswd, Interactive, PatchesCont, Benchmark, RemoveAfterInstall * Downloaded files can now be placed in subdirectories (a1, n1, ...) * The -f option supports more than one RPM now (if used as last option) * Less messages with verbosity level 1 (-v), to see update info from cronjobs * Update descriptions are formatted now for better readability * New option handling with getopt, supporting now "-ab" in addition to "-a -b" * Options -u and -e/-i are allowed together now (package list update and check/installation in one step) MD5sums: d6640f65a348ca3411fa9872075a2e47 fou4s-0.4.0.tar.bz2 6add4bc11149281074e00d01766f1063 fou4s-0.4.0-8.noarch.rpm Users of the --checkfou4s option will be notified about the new version automatically during the next run of fou4s. regards, Markus Gaugusch - -- _____________________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign fou4s(a)gaugusch.at X Against HTML Mail / \ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE86L89DqGTK6+2bXwRAoUlAKDP46vxTWBNEFxaFt8pQylHATqBGwCffLZX B/UuYxGbVMaN1tExFNzV2Qg= =qyKH -----END PGP SIGNATURE-----

1 0

Sendmail out-of-box secure enough?
by Pep Serrano 20 May '02

20 May '02

Hello list, Here is a question perhaps a little naive :-) I am not sendmail expert at all and I do wonder... Is sendmail in SuSE Linux out-of-thebox secure enough for a with permanent connection to inet? I mean just setting the configuration "Host with permanent network connection" in Yast2... In case it is not (I guess) what minimal config do you propose to run a sendmail to just deliver emails from localhost to inet and to allow receiving only emails for its own domain? Any good recommendations? Cheers Pep Serrano.

13 19

Firewall2 config
by Luis Oliveira 19 May '02

19 May '02

Hi, I want to activate the firewall in Suse 8.0 Pro. I use my laptop at work and home. I have just one ethernet interface eth0. At home I have a ADSL connection (modem connected to a linksys router that functions also as a 4 port switch to my home network). IP address is given in both situations (home and office) by dhcp server. What should I configure as internal and external interface in yast2 - security - firewall ? I just want to enable ssh service on my machine. Thanks ./ luis oliveira

2 1

SuSE 7.3 on sparc and ip portforwarding
by Alexander Topolanek 19 May '02

19 May '02

Hi, Not shure to which list this question belongs, so I'm sending to both... I'm running a 7.3 on a sparc, which is used as an ADSL-router - I'm using a 2.2 Kernel and SuSEfirewall, and the I tried to setup some ip portforwarding. SuSEfirewall now tells me "I need /usr/sbin/ipmasqadm for running but can not find it, aborting." Did't find any rpm for that... Funny enough, on my intel box (with 7.3 & 2.4.x) it's there, but binary. Is that tool somewhere hidden in another rpm? Or should I get the sources and build it? Best regards Alexander

1 0

Re: ezmlm response
by Aaron Flores 17 May '02

17 May '02

--------------------------------- Do You Yahoo!? La emoción e intensidad del deporte enYahoo! Deportes.

1 0

RE: [suse-security] Ok, I Give...
by Peer Stefan 17 May '02

17 May '02

hi, > From: Gary Counsellor [mailto:sineigs@eskimo.com] > > I have been seeing this since I started SFW2 and conect via ppp. > Not sure why it's there, tried looking for clues as to why, > who but found nothing meaningful. Figured it might be me and my > isp (Well, I gotta think of something) this is most likely your isp, because 224.0.0.1 is the address for IGMP, a multicast routing protocol. have a look at /etc/rc.config.d/firewall2-custom.rc.config, line 26 onward: #example: allow incoming multicast packets for any routing protocol iptables -A INPUT -j ACCEPT -d 224.0.0.0/24 it's nothing to worry about, if you don't have routing protocols enabled. > Usually I just copy error messages into google and find what > I need to know but that didn't work this time. > Any suggestions? I'd be happy just to stop seeing it reported > but stopping it entirely, if feasible, would be cool also. > > SuSE-FW-UNAUTHORIZED-TARGET IN=ppp0 OUT= MAC= SRC=209.244.43.100 > DST=224.0.0.1 LEN=28 TOS=0x00 PREC=0x00 TTL=1 ID=24643 PROTO=2 i asked google about DST=224.0.0.1 and got this link (first page): http://lists.debian.org/debian-firewall/2001/debian-firewall-200108/msg00056 .html > > Thanks for the help, you're welcome :) > -- > Gary Counsellor > http://www.musician2000.com > sineigs.all.attitudes(a)eskimo.com > Please remove .all.attitudes before replying regards, stefan

5 6

FTP-Proxy
by Michael Appeldorn 17 May '02

17 May '02

Hi list to increase to security i've installed suse-ftp-proxy to not directly contact the internet with the clients. but now all ftp-session ends up the ftp-server on the firewall and wont get transparent routed Thx for all proposals in advance Michael Appeldorn The config file [-Global-] User ftp ServerType standalone LogDestination daemon DestinationTransferMode passive PortResetsPasv yes Listen 192.168.11.11 # may be needed in NAT'ed/Masqueraded environments #TranslatedAddress 0.0.0.0 UseMagicChar % AllowMagicUser yes AllowTransProxy yes

2 1

RE: [suse-security] NTP über Firewall
by adkorte 17 May '02

17 May '02

>===== Original Message From "Reckhard, Tobias" >That's seems strange to me, ntpdate should fail, saying that it can't >find any suitable servers for synchronisation. It should not segfault. That was the behaviour in SuSE 7.3. After an upgrade to SuSE 8.0 I also see the reported behaviour. If ntpdate cannot connect to my (local) ntp server (because it is taken offline), it crashes on a segfault. Not a very nice way to terminate... Regards, Arjen

1 0

What can i do if someone tries to exploit me?
by Martin Gudel 17 May '02

17 May '02

Hi all, following almost all security relevant problems, one of my machines got exploited last week. After i fixed this hole, my firewall now repeated the same trials from the same source on other machines which are already protected against this attack. The person on the other side retries and retries. It's a uk-source, I'm in Germany. What can I do?- Is there any "global police department" for this? Thanks for help Martin

3 2

No FW
by Florian Winger 17 May '02

17 May '02

Hi everybody, I want a absolutly open system, cause it is not connected to the internet only in my LAN. I´m using SuSE 8.0 and have already removed SUSEfirewall2, personal-firewall, yast2-config-firewall and yast2-trans-firewall packages with yast2. Is there anything more to do? thank a lot!! Flo -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

Problem with harden_suse
by Ricardo Javier Aranibar León 17 May '02

17 May '02

Hi my friends, I read that if I like a server secure I need install harden_suse. Yesterday I installed harden_suse-3.5-0.noarch.rpm, in my server I have Apache, my database in Postgresql, my scripts cron and my OS is SuSE 7.3 and kernel 2.4.4-4GB but now I have two problems: 1.- I restarted my machine and my services apache and postgres didn't to initialize I have to write as a root:rcpostgres start and rcapache start this method it's slow my work, I need information about a command that initialize my services, chkconfig didn't function if someone can to provide me about a command equal chkconfig I will thankfull. 2.- Before, that I installed harden_suse I worded fine with PostgreSQL I connected as user postgres with: #su - postgres and execute #psql hb and I entered to my Data base, but after that I installed harden_suse I can't connect as user postgres when I writted: su - postgres in my pront didn't show me postgres:~# I don't know what happend,maybe I executed postmaster and I have this message: "root execution of PostgreSQL backend is not permitted. The backend must be started under its own userid to prevent a possible system security comprise. See the Install file for more information on how properly start the postmaster". I try to execute as root: #psql hb I have this message:"psql: FATAL 1 :SetUserId: user "root" is not in pg_shadow". Before, I dind't have this problems I think that harden_suse cause this errors if someone can help me I will be thankfull, because I didn't enter to my database and this is important for me. Please help me Thansks :-( _________________________________________________________________ Descargue GRATUITAMENTE MSN Explorer en http://explorer.yupimsn.com/intl.asp.

5 4

multiple NAT
by Omppu 17 May '02

17 May '02

Hello i am sick and tired of intervally changing operators and ip addresses for my production environment... ive known for a long time that i can do NAT but i am a little bit worried on the load it would cause on the firewall and then again how efficient and easy to maintain it would be. i have a half a C class of Public IP addresses of which about 70 are very active, at best the bandwidth continuous capacity consumption reaches up to 800kb/sec now i have SuSE 7.3 with the latest patches (kernel is the default that comes with the installation) and i intent to use SuSEFirewall 2 on a dual pentium 450mhz with 128mb ram now the question is how can i do so that i have about 40 servers with private addresses in the inside with all sorts of services starting from ftp, telnet, ssh, dns, pop, smtp, imap, stream, http, sms, terminal services, pptp, etc etc how can i configure about 128 IP addresses with NAT to private internal addresses to all ports and port restrictions and what is the most feasible setup regards O.

5 5

Re: [suse-security] NTP über Firewall
by Comptek informatik AG - R. Klippel 17 May '02

17 May '02

At 10:22 17.05.2002 +0200, Michael Seewald wrote: >On Fri, 17 May 2002, Wilfried Philippi wrote: > > ich möchte mit xntp über die Firewall auf meinem Server die Zeit updaten. > > > Kann mir jemand sagen wo mein Fehler liegt und ob ich evtl ausser Port > 37 noch > > einen anderen Port brauche. > >If I remember correctly, you need >FW_SERVICES_EXT_UDP="ntp" > >Regards, >Michael > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here Hi, probier mal folgendes in der Konsole oder auch in einem Xterm Fenster # ntpdate -s -u <timeserver.tld> Die beiden Parameter sind meines Wissens für das Überwinden der Firewall notwendig. Mit freundlichen Grüssen Comptek informatik AG Reinhardt Klippel ________________________________ Comptek informatik AG Poststrasse 9 CH-6300 Zug Tel. ++41 +41 720 20 90 Fax ++41 +41 720 20 99 http://www.comptek.ch ________________________________

1 0

RE: [suse-security] NTP über Firewall
by Reckhard, Tobias 17 May '02

17 May '02

Note that this is an english-speaking list. > ich möchte mit xntp über die Firewall auf meinem Server die > Zeit updaten. It's usually also a good idea to have firewalls synchronised to global time as well. > Wenn ich die Firewall abschalte ( alle chains geflusht ) > läuft nntpdate ganz > normal Mit eingeschalteter Firewall meldet mir ntpdate > Segmentation Errors und > bricht ab. That's seems strange to me, ntpdate should fail, saying that it can't find any suitable servers for synchronisation. It should not segfault. > Meine Firewall regeln sind: > /sbin/iptables -A OUTPUT -o eth1 -m tcp -p tcp -s $SELF > --dport 37 -j ACCEPT # > ntp > /sbin/iptables -A INPUT -i eth1 -m tcp -p tcp -d $SELF > --sport 37 -j ACCEPT # > ntp > Kann mir jemand sagen wo mein Fehler liegt und ob ich evtl > ausser Port 37 noch > einen anderen Port brauche. You definitely need further rules for NTP. NTP servers listen only on UDP port 123 (no TCP is used, further clarifying what Roman already said). (x)ntpd uses UDP 123 as its source port as well, while ntpdate allocates a high port (i.e. one above 1023) as its query source port. Tobias

1 0

SMTP and POP3 Proxy
by Fiorenza Meini 17 May '02

17 May '02

Hi there! Does anyone know about a SMTP proxy and a POP3 proxy? I'm configuring a firewall and I'd like to use proxy for WWW, FTP, SMTP and POP3; so I'm using squid, ftp proxy from SUSE proxy suite and....I can't find anything for SMTP and POP3. Thanks Fiorenza

4 4

RE: [suse-security] multiple NAT
by Reckhard, Tobias 17 May '02

17 May '02

> now i have SuSE 7.3 with the latest patches (kernel is the > default that comes with the installation) Isn't that one susceptible to the SYN-Cookie vulnerability? If so, you might want to deactivate them. > and i intent to use SuSEFirewall 2 on a dual pentium 450mhz > with 128mb ram Does anyone know if the Linux kernel or, more specifically, netfilter actually benefits from a multi-processor box? I wouldn't expect it to, but I haven't looked at the code (nor am I a coder of any worth). > now the question is how can i do so that i have about 40 > servers with private addresses in the inside > > with all sorts of services starting from ftp, telnet, ssh, > dns, pop, smtp, imap, stream, http, sms, terminal services, > pptp, etc etc > > how can i configure about 128 IP addresses with NAT to > private internal addresses to all ports and port restrictions > > and what is the most feasible setup Well, you're out for opinions, so here's mine. I try to avoid NAT where I can. IMHO, it makes things easy in the short term when prior planning of IP layout was short-sighted and has failed and IP system administration is bad as well and the cost of modifications is high. It doesn't solve the problems but only reduces the impact of the symptoms. However, NAT is complicated and confusing, and thereby tends to turn into an administrative nightmare of its own after a while. Add to that the problems that numerous protocols have with NAT and which force you to use helper applications (the kernel nat modules) that I have rather bad feelings about in general concerning their security, and which quite often don't get the protocol working as (well as) it would without NAT. NAT is fine in small scenarios, where the cost of official IP addresses matters (this means all you home users), where you can't use proxies instead or where substantial cost can be avoided by introducing it (such as connecting a couple of networks of two administratively independent organisations, but that's quite a can of beans in and of itself, security-wise). Tobias

1 0

RE: [suse-security] proftpd and exe uploads
by Peer Stefan 17 May '02

17 May '02

hi > From: Carlos [mailto:linux@lpis.com] > For securiy reasons i want to deny, in my suse proftpd > server, the *.exe > files uploads. > is this posible? > can anybody says me how? PathDenyFilter "\.exe$" should do the trick. > thanks you're welcome ;) stefan

1 0

RE: [suse-security] SMTP and POP3 Proxy
by Peer Stefan 17 May '02

17 May '02

From: Hipolito A. Gonzalez M. [mailto:hgonzale@cantv.net] > Remember, the defintion of Proxy is only for HTTP, FTP and GOPHEr, if > you need access to other protocol, like POP, SMTP, DNS, etc > etc you must > have Ip Masq/NAT .... or an application gateway. for mail you can use fetchmail (pop) and any mta, which works as relay-agent. just be carefull in setting up relaying. regards, stefan

1 0

Auto Online Update!?!
by mario ohnewald 17 May '02

17 May '02

Hallo! Can suse do a Auto online update automatically, lets say every day or something? If yes, where is the option, or how do i do that then? ;) Cheers Mario

2 1

RE: [suse-security] SMTP and POP3 Proxy
by Reckhard, Tobias 17 May '02

17 May '02

> Remember, the defintion of Proxy is only for HTTP, FTP and GOPHEr, if > you need access to other protocol, like POP, SMTP, DNS, etc > etc you must > have Ip Masq/NAT Huh?! No way, dude, you're way out on this one. A proxy server is a broker between client and server, acting as a server towards the client and issuing its requests to the server, thereby acting as a client there. It's a concept and in no way restricted to certain application protocols based on TCP/IP. However, some protocols make it easier to use proxies than others. NAT is an entirely different concept. Tobias

1 0

RE: [suse-security] how to open ports
by Reckhard, Tobias 17 May '02

17 May '02

Re Flo, [snip] > conferences. I´m able to connect to this server, but there´s > no transmition > of sound and video. So I scan with nmap -p 1-65535 > [localhost] and look there > only the lisenport 1720 is open. All other ports which should > be open are > closed. Is there any possibilty to open the ports by hand? I [snip] It is perfectly normal for you to see only port 1720 open, since that's where the H.323 server is listening for incoming calls. The additional connections are only established later on, after they have been negotiated on the 'incoming call' connection. As such, you won't see any other ports as open, because there's no process listening on them. This is absolutely OK. See if you can increase the volume of output on your H.323 client and server and check what they say when you try to setup an H.323 session. And perhaps sniffing the network traffic will provide some insights as well. Tobias

1 0

Strange Web Behavior
by Austin Morgan 16 May '02

16 May '02

I am using an gateway on my network with NAT and firewall. Everything seems to work fine, but I am not able to connect to google.com. This is very strange because for the past 1 1/2 years I have been using this system I have not had a problem with it. I discovered that if I ssh into the firewall and use lynx that I can access google and run searches, but none of the computers behind the firewall can. There are no logs saying that the firewall is droping anything and the DNS reports an accurate ip address. Does anyone have any suggestions as to what might be happening? -- __ __ ____ ____ | \/ |/ ___/ ___| Austin Morgan | |\/| | | \___ \ Morgan Computer Services | | | | |___ ___) | 479-857-1189 |_| |_|\____|____/ www.morgancomputers.net

8 9

AW: AW: [suse-security] password not accepted
by mailinglists＠belfin.ch 16 May '02

16 May '02

Hi Andrés, +OK ready <21962.1021586037(a)pop.domain.ch> user test +OK Password required for test. pass Ct%I6+X -ERR [AUTH] Password supplied for "test" is incorrect. as you can see, it didn't work. Thanks, Philipp -----Originalnachricht----- Von: Andrés A. Nogueiras Meléndez An: 'suse-security(a)suse.com' Gesendet: 16.05.02 10:16 Betreff: Re: AW: [suse-security] password not accepted Raymond Leach wrote: > 02/05/16 9:37:20, mailinglists(a)belfin.ch wrote: > >>HI MIkkel >> >>there is NO spelling error. I tested it 10 times, even with direct use of >>pop3 commands and set local_echo on win2k telnet client. >>The UID of the users is 500+. So no mistake there either. >> > Maybe something is getting screwed up in the telnet translation of the % character ? > I bet too that this is happening. Some telnet/ftp/http conection use %20 as white space and %16 looks like an ASCII control char. In the other hand, I can tell that this kind of behaviour is strange, because I used to have a password with char "%" inside and nothing strange happened, maybe because the previously and next char where simple alphabetical characters, not numbers. Can you try with something like Ct%I6+X ( an uppercase i in place of the one digit ) and tell us in the list ? TIA -- [---------------------------------------------------------------] [ Prof. Andres Augusto Nogueiras Melendez ] [ Departamento de Tecnologia Electronica - Universidad de Vigo ] [ Campus Lagoas Marcosende, 9 http://www.dte.uvigo.es ] [ 36280 - Vigo, Pontevedra mailto:aaugusto@uvigo.es ] [ Spain tel: +34 986 812 091 fax: +34 986 469 547 ] [---------------------------------------------------------------] -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Linux Security theory/practice
by Ryan Swenson 16 May '02

16 May '02

> -----Original Message----- > From: Ryan Swenson > Sent: Wednesday, May 15, 2002 11:15 AM > To: 'suse-security(a)suse.com' > Subject: Linux Security theory/practice > > Hello, > > 1. Is it possible to take 2x kernel 2.4.18 systems with bridging, and = > the firewall bridge patch compiled in and setup transparent bridging = > along with iptable Forwarding permit or deny rules; Where we join both = > interfaces of the bridge and configure static addresses on the bridged = > ID interface, is it possible to now configure OSPF or BGP to provide = > failover among 2 Linux Bridge Peer devices? In short you take two = > switches and put in between them 2 transparent linux bridge firewalls = > which will both have unique bridge ip addresses: should 1 of these = > systems or interfaces fail, then the other will fail into a BGP = > secondary until the primary is reinstated? Any enhanced dynamic = > protocol should be fine and the only metric really concern is the weight = > of each peer and perhaps a few iptable rules to limit the size of tables = > for CPU/memory benefits as well.=20 > > If not with BGP or OSPF: with pirannha can serial/loadbalancing be = > applied to the situation or interfaces of this kind of setup where = > regardless of which device is up it must forward packets and extend the = > medium for which traffic is within the same broadcasts domains?=20 > > In theory or practice? > > > Regards/Gruesse, > > Ryan S.

3 2

Re: [suse-security] Suse Firewall Warranty
by Steve 16 May '02

16 May '02

On Thursday 16 May 2002 02:27 pm, you wrote: >* Steve (steve(a)videogroup.com) [020516 11:23]: >> What you might get is proof that it follows these standards: <list>. >> Gov's like to see some kind, ANY kind, of proof of SOMETHING. > >It's hard to imagine what <list> might be though. Oh, SSL version so and so RSA, blowfish etc. This many bits... >> I've always used my own F/W's so I don't know what they come with. But I >> doubt it's ever going to say you are never going to get hacked. Would be a >> dumb promise. >> >> But look on encryption. Something using one or another says that it's >> using this or that type of encryption. If you look at banking they have >> their standards, not always the best but if you have what they use you're >> OK with them. > >There's nothing magically on the SuSE firewall...if you build your >own using the SuSE forewall script it won't even be that different >probably. The features of the firewall on a cd product are that it >runs entirely from a cdrom and a read-only floppy disk. I guess you >could consider the gui configuration tool a feature but I find it >easier to just edit the configuration files on the floppy. -- Steve Szmidt V.P. Information Video Group Distributors, Inc.

1 1