May 2002 - openSUSE Security - openSUSE Mailing Lists

identd questions
by Pedro Marques 13 May '02

13 May '02

Hi, I'd like to know your opinion about identd: First of all, is it worth run it or should I disable it? I've been reading a lot of things about it, and found that the matter is not consensual. Even found this in ident/auth RFC: "If you wouldn't run a 'finger' server due to privacy considerations you may not want to run this protocol." I've tryied to disable ident in my SuSE 7.0 box, without success. Commented the auth line in inetd.conf, turned off the option in rc.config, but it's still running.. maybe it's running through other program like sendmail or popper, is it? any ideas? Any comment/help would be appreciated. Thanks Pedro Marques

2 1

smpppd
by tux the turtle 13 May '02

13 May '02

Hi; is there any way to get informations about which app has triggered smpppd and how to xclude the one app from access but not the other? There's something that connects me to my ISP each time i log in and i don't want to follow the t-a-e-method. Besides that: it would be great for logging... Thanx... -- *** Tux IS a turtle isn't it? *** Sys soft / Sys hard: ====================== SuSE 7.3 prof, Kernel 2.4.10-4GB (SuSE std), KDE 2.2.2 src-tarball, alsa 0.5.11 Athlon 700MHz 640MB, MoBo: Epox EP-7KXA / VT82C686A more Sys soft/ more Sys hard: ====================== SuSE 8.0 pers, Kernel 2.4.18-4GB (SuSE std), KDE 3.0 src-tarball HP Omnibook XT1000 F3433HT

1 0

RE: Why the firewall on Suse8.0 blocks internal packets on externel port?
by charly123 13 May '02

13 May '02

Thank you, but that isn't, what I want. I want to talk on Port 6667 (IRC-Server) of my own Server. You will say, I can probably talk to the internal Adress, but I can't do that with a specially-written program. This program talks to the external Adress, but the Firewall blocks that. Why can I disable this security-option. Best regards, Jost Schöler ____________________________________________________________________________ ______________ SPT=1645 DPT=6667 That means, that from you internal net a service is called, that is hosted on port 6667 of an external server. Thats no standard service as http/pop ect and so it will blocked cauze it MAY be insecure. BTW http/pop maybe insecure too. Port 6667 seems to be IRC related. A good security policy is to allow notthing except services you really need. ____________________________________________________________________________ ___

2 1

Prob: SuSEfirewall2 & FW_MASQ_NETS
by Marc Mueller 13 May '02

13 May '02

Hi, I want to set up a firewall, which should only "protect" ONE MS-WWW-Server (that has no official IP). The server should not have ANY access to anything, the firewall should only offer a telnet from certain addresses (restricted by /etc/xinetd.conf). eth0 is the internet, the WWW-Server is connected to eth1 (the webserver has IP 192.168.0.2). Everytime, a request to port 80 of the firewall is done, it should be forwarded to the server, the answer should be sended back. I'm using SuSE 7.3 and SuSEfirewall2, my configuration file is: FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.2" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="telnet" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="no" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="0/0,192.168.0.2,tcp,80 0/0,192.168.0.2,tcp,443" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" Now the problem is: It only works, when FW_MASQ_NETS is set to "192.168.0.2", but then the server has access to the internet, which I wanted to avoid! If I don't set FW_MAS_NETS to the internal server IP, all http requests are logged as "... ALLOWED ... DST=192.168.0.2 ..." (seems o.k.!) in /var/log/firewall, but there is no response from the server. What can I do? Thank You, Marc

2 1

Why the firewall on Suse8.0 blocks internal packets on externel port?
by charly123 12 May '02

12 May '02

Hallo, on the Suse8.0 prof. with Susefirewall2, all internal requests on the external port was blocked. log: May 12 07:13:43 fs1-cccbbs kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth0 OUT= MAC=00:48:54:1c:a8:fb:00:c0:26:75:3b:28:08:00 SRC=192.168.0.5 DST=217.85.190.27 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=29671 DF PROTO=TCP SPT=1645 DPT=6667 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) May 12 07:13:46 fs1-cccbbs kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth0 OUT= MAC=00:48:54:1c:a8:fb:00:c0:26:75:3b:28:08:00 SRC=192.168.0.5 DST=217.85.190.27 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=29675 DF PROTO=TCP SPT=1645 DPT=6667 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) May 12 07:13:52 fs1-cccbbs kernel: SuSE-FW-NO_ACCESS_INT->FWEXT IN=eth0 OUT= MAC=00:48:54:1c:a8:fb:00:c0:26:75:3b:28:08:00 SRC=192.168.0.5 DST=217.85.190.27 LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=29683 DF PROTO=TCP SPT=1645 DPT=6667 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) Where in the config I can told him, what he must do with such requests. Why does he blocks that in the default configuration, is it insecure, when I talk from internal to external? Internal: 192.168.0.1 on eth0, External: DynamicIP on ppp0. Best regards, Jost Schöler.

1 0

7.3 with QMail
by Thorsten 10 May '02

10 May '02

Hi, I use QMail instead of sendmail, but YaST still tells me to install sendmail or postfix. How can I manipulate the rpm DB to tell YaST-1 (and apt-get) that sendmail is installed? Thanx Thorsten --

3 2

SuSEfirewall
by Ricardo Javier Aranibar León 10 May '02

10 May '02

Hi my friends, First, Sorry for my Enghish I talk Spanish. I have SuSE 7.2 I have three questions. 1.- I like to use SuSEfirewall but I don't like that my rules are defined with ipchains I like to use iptables, if is posible. 2.- I know that I can't use ipchains and iptables in my system If I run one this, How I can tell to my system that I like to use iptables? 3.- How I can block with SuSEfirewall ping and anothers services? If someone can help I will thankfull. Atentamente RICARDO _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

3 2

Re: [suse-security] SuSEfirewall
by Bill.Light＠kp.org 10 May '02

10 May '02

"Ricardo Javier Aranibar León" <ricardo_jal(a)hotmail.com> 05/10/02 12:33 PM To: suse-security(a)suse.com cc: Subject: [suse-security] SuSEfirewall Hi my friends, First, Sorry for my Enghish I talk Spanish. I have SuSE 7.2 I have three questions. ***> 1.- I like to use SuSEfirewall but I don't like that my rules are defined ***> with ipchains I like to use iptables, if is posible. Use SuSEfirewall2 ***> 2.- I know that I can't use ipchains and iptables in my system If I run one ***> this, How I can tell to my system that I like to use iptables? Make sure iptables is installed see: man rpm With Yast (or Yast2) you can de-install ipchains and install/update iptables ***> 3.- How I can block with SuSEfirewall ping and anothers services? After installation of SuSEfirewall2 look in /etc/rc.config.d/firewall2.rc.config it's toward the bottom

1 0

Re[2]: [SLE] apache-problem / bug?
by da_bug＠gmx.net 10 May '02

10 May '02

Hi! CM> * da_bug(a)gmx.net (da_bug(a)gmx.net) [020509 04:18]: >> I am using SuSE 7.3 with a self-compiled Kernel 2.4.18 >> and I installed the updated suse-rpm for 7.3 "apache-1.3.20-65". >> This is what happens if I want to start apache: >> >> >/etc/init.d/apache start >> >Shutting down httpd done >> >Starting httpd [ PERL PHP4 ] >> >Ouch! ap_mm_create(1048576, "/var/lib/httpd/mm.20330") failed >> >Error: MM: mm:core: failed to acquire shared memory segment >> >(Function not implemented): OS: No such file or directory unused CM> Sounds like you're self-built kernel is missing SysV IPC CM> support...rebuild with CONFIG_SYSVIPC=y. Yes thanks, that was the solution! :) Bye. <da_bug(a)gmx.net>

1 0

Antwort: [suse-security] Help needed for Masquerading with Suse 8.0 and Ipchains
by BLeonhardt＠analytek.de 10 May '02

10 May '02

i'd prefer the kernel auto_module_loader .. maybe it's the best variant ... regards, bruno "Wilfried Philippi" An: SuSE-Security <suse-security(a)suse.com> <philippi@madex. Kopie: com> Thema: [suse-security] Help needed for Masquerading with Suse 8.0 and Ipchains 10.05.02 13:22 Hello there, i have a Problem with the setup of a Firewall Script with the 2.4 Kernel and the ipchains compatible module ipchains.o. When i run my script the module ip_masq_ftp wsn't found. I know that this is a module from the 2.2 kernel. My Question is: What module must i load that i have the same functionality? I will change to iptables in the Future but the system must run quick so i dont have Time in the moment to write a new script. -------------------------------------------------------------------- Here is the part of my Firewall script : # Insert the active ftp module if ! ( /sbin/lsmod | /usr/bin/grep masq_ftp > /dev/null ); then /sbin/insmod ip_masq_ftp fi ----------------------------------- Thanks for your help Wilfried -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

New fou4s release - Fast OnlineUpdate for SuSE 0.3.0
by Markus Gaugusch 10 May '02

10 May '02

Hi! I'm proud to announce the new version of fou4s, 0.3.0. You can get it at http://fou4s.gaugusch.at/. >From the changelog: * Fixes for 0.2.1: + PHP update packages are available again (were filtered out due to a bad wget option) + Package descriptions with missing number after Size: won't crash fou4s now + The RemarkList option actually works now. Previously it disabled downloading of all packages after the first entry was found. * All platforms are now supported (i386, sparc, ...): + RPM is now a noarch.rpm * More information: Downloadsize of all packages (for -e) * Packagelist directory is automatically cleaned from old package description files * New options: + --checkfou4s, checks for an update of fou4s + --proxyuser and --proxypassword + --nocont, to disable checking of patches.cont directory on SuSE 8 + -b, to use fou4s-benchmark and download from the fastest server. + --config, to use another config file (for different servers) * New version of fou4s-benchmark (by G. Sommer) * The fou4s RPM is now signed with key fou4s(a)gaugusch.at (ID AFB66D7C) + Fou4s now supports updating itself, using the checkfou4s switch + New cron script with saner defaults With this release I'm hoping to find no bugs within the first 24 hours after release, so it may be really worth a try ;) If you have any problems, don't hesitate to contact me. I need feedback especially for other architectures than i386 and sparc. regards, Markus Gaugusch -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

2 1

RE: [suse-security] Telnet-Proxy
by Reckhard, Tobias 10 May '02

10 May '02

> I implemented a telnet proxy by using the portforwarding > feature from openssh. > > This gives you the advantage that you do not have to forward > packets on your firewall and some graet authentication schemes. The question remains as to whether that's a proxy... It's a circuit-level-gateway and therefore functionally closer to port forwarding than to an actual proxy, IMHO, since the connection isn't actually terminated, but instead, IP packets are simply sent on by the gateway. Feel free to correct me if I'm wrong. Tobias

2 1

Re: [suse-security] SuSE firewall 2 - iptables-error
by tux the turtle 10 May '02

10 May '02

well, actually this IS SuSEfirewall2 shiped with the 7.3 prof - there's no ShoreWall at all... Tux the turtle ---- Bill.Light(a)kp.org am Freitag, 10. Mai 2002 01:05: > Uninstall Shorewall and use SuSEfirewall2 -or- > > Change /etc/rc.config to START_FW2="no" and set your parameters in > ShoreWall > > But make a choice.....they don't both co-exist -------------------------------------------------------

1 0

Re: [suse-security] SuSE firewall 2 - iptables-error
by Bill.Light＠kp.org 09 May '02

09 May '02

Uninstall Shorewall and use SuSEfirewall2 -or- Change /etc/rc.config to START_FW2="no" and set your parameters in ShoreWall But make a choice.....they don't both co-exist ======================================================================== tux the turtle <tu.th.tu(a)gmx.net> 05/09/02 03:10 PM Please respond to tux the turtle To: suse-security(a)suse.com cc: Subject: [suse-security] SuSE firewall 2 - iptables-error Hi out there; setting up (once more) my SuSE 7.3 I got the following on boot up: Starting Firewall Initialization: (phase 3 of 3) iptables v1.2.2: Can't use -D with -A Try `iptables -h' or 'iptables --help' for more information. iptables v1.2.2: Can't use -D with -A I run a small private net as shown below: ISP <-> Desktop/Firewall <-> Laptop/Firewall The message above is from the Desktop-PC; my firewall2.rc.config contains these: FW_DEV_EXT="ippp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp domain" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ssh smtp domain" FW_SERVICES_INT_UDP="domain syslog" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="domain" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix Firewall " FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" all other unchanged Any hint? Besides that (and OT): i run smpppd. If it's the smpppd that disconnects my ippp0 (capi-drv from Fritz!) the machine hangs while shuting down because of an ippp0 usagecount != 0 (message from kernel: unregister_netdevice). Any hints of setting a timeout or forcing unregistering? Thanks in advance... Tux the turtle -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

SuSE firewall 2 - iptables-error
by tux the turtle 09 May '02

09 May '02

Hi out there; setting up (once more) my SuSE 7.3 I got the following on boot up: Starting Firewall Initialization: (phase 3 of 3) iptables v1.2.2: Can't use -D with -A Try `iptables -h' or 'iptables --help' for more information. iptables v1.2.2: Can't use -D with -A I run a small private net as shown below: ISP <-> Desktop/Firewall <-> Laptop/Firewall The message above is from the Desktop-PC; my firewall2.rc.config contains these: FW_DEV_EXT="ippp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp domain" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ssh smtp domain" FW_SERVICES_INT_UDP="domain syslog" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="domain" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix Firewall " FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" all other unchanged Any hint? Besides that (and OT): i run smpppd. If it's the smpppd that disconnects my ippp0 (capi-drv from Fritz!) the machine hangs while shuting down because of an ippp0 usagecount != 0 (message from kernel: unregister_netdevice). Any hints of setting a timeout or forcing unregistering? Thanks in advance... Tux the turtle

1 0

Iptables
by Ricardo Javier Aranibar León 09 May '02

09 May '02

Hi list, I have a problem and I need your help, I use SuSE 7.2 and kernel 2.4.4-4. Why, When I like use iptables I have execute this command "rmmod ipchains", always restart my server? if I deleted ipchains?. and when initialize my system I have this problem: Failed services in runlevel 2,3 SuSEFirewall_setup and SuSEfirewall_final. Skipped Services in runlevel 3: personal_firewall initial pcmcia personal-firewall. Plese help me with those problems _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

2 1

Run-level editor in 8.0
by Michael Ströder 09 May '02

09 May '02

HI! The run-level editor in SuSE 8.0 always switches port mapper on because it assumes that it's needed by inetd. But I have no service in my inetd.conf at all which needs portmapper. Since portmapper is one of the most evil beasts regarding security this behaviour of the Yast2 run-level editor is complete bullshit! Ciao, Michael.

9 15

What list to subscribe to ?
by arawak 09 May '02

09 May '02

I now this list is about Suse Security. But I would like to know which list I should subscribe to, for questions on wireless networking ? Tia Sorry to annoy anyone Arawak

2 1

Re: [suse-security] Solution "interessantes" Netzwerk Problem
by d_lord＠gmx.de 09 May '02

09 May '02

Hi list, Sorry for posting OT and sorry for german subject and .. thats all I think After all I found a method to solve this problem. :-) IPTUNNEL If you are interessted in read http://www.tldp.org/HOWTO/Adv-Routing-HOWTO-5.html#ss5.3 for setup and http://www.tldp.org/HOWTO/mini/ppp-ssh/bringup.html if you encouter problems If any question remains write me (PM) Greetings D. Lord PS.: DNAT and SNAT didn't really fit (ipchains) -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

SuSEfirewall2 and DMZ problems...
by Bill.Light＠kp.org 09 May '02

09 May '02

Hi Gang ! Given the following scenario...Firewall running SuSE 7.3 / SuSEfirewall2 with 3 NICs: ************ * Internet * ************ * "Real" IP address * eth0 * ************ eth1 ****************** * Firewall ********** DMZ - www/mail * ************ ****************** * eth2 * * ************ * switch * ************ * * * * * * *********************** * Internal Machine(s) * *********************** If AA.aaa.aaa.aaa is a private IP on eth1 and BB.bbb.bbb.bbb is private IP on eth2 (to feed the rest of the network) How are questions answered in /etc/rc.config.d/firewall2.rc.config to get to the dmz computer ?? This is what I have (and I get dropped in the firewall without seeing the DMZ) ... I know I have NOT yet turned on mail, because I want to see www services running first..... FWD_DEV_EXT="eth0" FWD_DEV_INT="eth2" FWD_DEV_DMZ="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASW_DEV="$FW_DEV_EXT" FW_MASQ_NETS="BB.bb.bbb.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="www" FW_SERVICES_EXT_UDP="www" FW_SERVICES_EXT_IP="www" FW_SERVICES_DMZ_TCP="domain www" FW_SERVICES_DMZ_UDP="www" FW_SERVICES_DMZ_IP="www" FW_SERVICES_INT_TCP="www" FW_SERVICES_INT_UDP="www" FW_SERVICES_INT_IP="www" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" ?? -or- FW_FORWARD="0/0,AA.aaa.aaa.aaa,tcp,80" ?? FW_FORWARD_MASQ="0/0,AA.aaa.aaa.aaa,tcp,80" FW_REDIRECT="" ?? -or- FW_REDIRECT="0/0,AA.aaa.aaa.aaa,tcp,80" ?? The "-or-" is my guessing.....no combination seems to work, any help appreciated. What am I missing ?? I always get dropped in the "firewall" box and never get to the web-server. The SuSEfirewall2 examples given by Marc do not seem to address the setup I am attempting ... Is my inherent design bad ? - Bill

2 1

Re: [suse-security] Telnet-Proxy
by support＠ufos-gmbh.de 09 May '02

09 May '02

Hi all, I implemented a telnet proxy by using the portforwarding feature from openssh. This gives you the advantage that you do not have to forward packets on your firewall and some graet authentication schemes. with best regards, Jörg Zaretzke -------- Original Message -------- Subject: [suse-security] Telnet-Proxy (06-Mai-2002 15:02) From: m.sckopke(a)gis-systemhaus.de To: j.zaretzke(a)ufos-gmbh.de > Hi all, > > has anybody ever heard of a telnet-proxy? > Checkpoints Firewall-1 offers this kind of functionality: > > You connect to the firewall on port 23, firewall asks for > authentification and a hostname and afterwards you get a > transparent telnet session to the named host, without > any intererence by the firewall. > > Is something like that available as open source software? > > Thanks a lot, > > Martin > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] Run-level editor in 8.0
by tux the turtle 09 May '02

09 May '02

Alexander Thoma am Sonntag, 5. Mai 2002 14:11: > that's why i'm administrating unix/linux systems using an editor and a > shell. that's all you need. yast(1/2) is running while installation and > can go where ever it likes after that. Yup - I agree. It took me 2 days setting up 8.0 on my HP Omnibook XT1000 as well a on my K7 Desktop (2 days for each!). Result: permanent crashes due to some weired setups in standard-config. On my K7 i'm back to 7.3 and on the HP i have (finally) running a 8.0 minimal system installing all other by hand. But there still is a slight fear of what happends underneath the keys i still don't know... TuThTu --- <<Jo, Jeffrey!>>

2 1

"interessantes" Netzwerk Problem
by d_lord＠gmx.de 09 May '02

09 May '02

Hi @ all, I have got some problems setting up a "virtuall" network. Desktop1 (eth0:1) 192.168.168.5 | (eth0) 192.168.5.25 | | (eth1) 192.168.5.1 Server1 (eth1:1) 192.168.168.3 Server1 (eth0:1) 192.168.168.1 | (eth0) xxx.xxx.xxx.xxx | |-----LAN ---- GW zzz.zzz.zzz.zzz -------- INTERNET | | | (eth1) yyy.yyy.yyy.yyy Server2 (eth1:1) 192.168.168.2 Server2 (eth0:1) 192.168.168.4 | (eth0) 192.168.1.1 | | (eth0) 192.168.1.2 Desktop2 (eth0:1) 192.168.168.6 I have to astablish a direkt connection from Desktop1 to Desktop2 and the other way round. World be best if tunneled over ssh but not really needed As you can see I've assigned a virtuall IP to every NIC I use. Between Server1 and Server2 there is a LAN but the IPs from eth0 of Server1 and eth1 of Server2 are public. So I decided to use some privat IP addresses here too so the Gateway blocks dem. The communication between Desktop1 and Server2 is working well if I use the normal way which means connect to server1 MASQ , connect to server2 but I don't reach Desktop2. Most of the time this is wanted. But sometimes I like to build a cluster from Desktop1 and Desktop2 so i have to have direkt ssh access, smb access and some further ports and services. Portforwarding isn't really usefull I think because I need a couple of ports. Now, lets see what I have: Desktop 1/2 kernel 2.4.16 + ipchains (no iptables at the moment) Server 1/2 kernel 2.2.20 + ipchains At the moment I can ping 192.168.168.4 and 192.168.168.2 from Desktop2 and 192.168.168.3 192.168.168.1 from Desktop1. Server1 kann ping Server2 over the public and the privat adress But I really don't get a connection between Desktop1 and Desktop2 I think something with the routing is broken maybe because both NICs of the Servers are in the same subnet but how could i manage the problem without putting the to NICs into the same subnet? I hope it's clear to you what I like to do so could please anyone give me a hint what I miss or have to do? The only thing that has to work the direkt connection between Desktop1 and 2 Thanks D. Lord PS.: Hope this is not too OT :-) and sorry for my poor english -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

SuSE 8.0
by Bill Eastman 08 May '02

08 May '02

I got SuSE 8.0 yesterday. To begin with, the DVD will not boot, therefore I will be returning it to Best Buy. Next I discovered that locate is not installed. In one of the books, it says it can be installed after the default installation, but the book does not say what group it is in. And the install everything option was not there. Does anyone know what group locate is in, so I can install it? ---------------- The instructions said Requires Windows 95 or better, so I installed Linux

4 3

OT Postings
by Jörg Mayer 08 May '02

08 May '02

Hello, is it just my impression or is the amount of off-topic postings increasing? This is not the suse-highendusers/suse-netadmin mailinglist, it's suse-security. Ciao Jörg -- Jörg Mayer <jmayer(a)loplof.de> Signature fault, brain dumped

8 8