May 2002 - openSUSE Security - openSUSE Mailing Lists

New fou4s release - Fast OnlineUpdate for SuSE 0.3.0
by Markus Gaugusch 10 May '02

10 May '02

Hi! I'm proud to announce the new version of fou4s, 0.3.0. You can get it at http://fou4s.gaugusch.at/. >From the changelog: * Fixes for 0.2.1: + PHP update packages are available again (were filtered out due to a bad wget option) + Package descriptions with missing number after Size: won't crash fou4s now + The RemarkList option actually works now. Previously it disabled downloading of all packages after the first entry was found. * All platforms are now supported (i386, sparc, ...): + RPM is now a noarch.rpm * More information: Downloadsize of all packages (for -e) * Packagelist directory is automatically cleaned from old package description files * New options: + --checkfou4s, checks for an update of fou4s + --proxyuser and --proxypassword + --nocont, to disable checking of patches.cont directory on SuSE 8 + -b, to use fou4s-benchmark and download from the fastest server. + --config, to use another config file (for different servers) * New version of fou4s-benchmark (by G. Sommer) * The fou4s RPM is now signed with key fou4s(a)gaugusch.at (ID AFB66D7C) + Fou4s now supports updating itself, using the checkfou4s switch + New cron script with saner defaults With this release I'm hoping to find no bugs within the first 24 hours after release, so it may be really worth a try ;) If you have any problems, don't hesitate to contact me. I need feedback especially for other architectures than i386 and sparc. regards, Markus Gaugusch -- _____________________________ /"\ Markus Gaugusch ICQ 11374583 \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

2 1

RE: [suse-security] Telnet-Proxy
by Reckhard, Tobias 10 May '02

10 May '02

> I implemented a telnet proxy by using the portforwarding > feature from openssh. > > This gives you the advantage that you do not have to forward > packets on your firewall and some graet authentication schemes. The question remains as to whether that's a proxy... It's a circuit-level-gateway and therefore functionally closer to port forwarding than to an actual proxy, IMHO, since the connection isn't actually terminated, but instead, IP packets are simply sent on by the gateway. Feel free to correct me if I'm wrong. Tobias

2 1

Re: [suse-security] SuSE firewall 2 - iptables-error
by tux the turtle 10 May '02

10 May '02

well, actually this IS SuSEfirewall2 shiped with the 7.3 prof - there's no ShoreWall at all... Tux the turtle ---- Bill.Light(a)kp.org am Freitag, 10. Mai 2002 01:05: > Uninstall Shorewall and use SuSEfirewall2 -or- > > Change /etc/rc.config to START_FW2="no" and set your parameters in > ShoreWall > > But make a choice.....they don't both co-exist -------------------------------------------------------

1 0

Re: [suse-security] SuSE firewall 2 - iptables-error
by Bill.Light＠kp.org 09 May '02

09 May '02

Uninstall Shorewall and use SuSEfirewall2 -or- Change /etc/rc.config to START_FW2="no" and set your parameters in ShoreWall But make a choice.....they don't both co-exist ======================================================================== tux the turtle <tu.th.tu(a)gmx.net> 05/09/02 03:10 PM Please respond to tux the turtle To: suse-security(a)suse.com cc: Subject: [suse-security] SuSE firewall 2 - iptables-error Hi out there; setting up (once more) my SuSE 7.3 I got the following on boot up: Starting Firewall Initialization: (phase 3 of 3) iptables v1.2.2: Can't use -D with -A Try `iptables -h' or 'iptables --help' for more information. iptables v1.2.2: Can't use -D with -A I run a small private net as shown below: ISP <-> Desktop/Firewall <-> Laptop/Firewall The message above is from the Desktop-PC; my firewall2.rc.config contains these: FW_DEV_EXT="ippp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp domain" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ssh smtp domain" FW_SERVICES_INT_UDP="domain syslog" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="domain" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix Firewall " FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" all other unchanged Any hint? Besides that (and OT): i run smpppd. If it's the smpppd that disconnects my ippp0 (capi-drv from Fritz!) the machine hangs while shuting down because of an ippp0 usagecount != 0 (message from kernel: unregister_netdevice). Any hints of setting a timeout or forcing unregistering? Thanks in advance... Tux the turtle -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

SuSE firewall 2 - iptables-error
by tux the turtle 09 May '02

09 May '02

Hi out there; setting up (once more) my SuSE 7.3 I got the following on boot up: Starting Firewall Initialization: (phase 3 of 3) iptables v1.2.2: Can't use -D with -A Try `iptables -h' or 'iptables --help' for more information. iptables v1.2.2: Can't use -D with -A I run a small private net as shown below: ISP <-> Desktop/Firewall <-> Laptop/Firewall The message above is from the Desktop-PC; my firewall2.rc.config contains these: FW_DEV_EXT="ippp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp domain" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ssh smtp domain" FW_SERVICES_INT_UDP="domain syslog" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="domain" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix Firewall " FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" all other unchanged Any hint? Besides that (and OT): i run smpppd. If it's the smpppd that disconnects my ippp0 (capi-drv from Fritz!) the machine hangs while shuting down because of an ippp0 usagecount != 0 (message from kernel: unregister_netdevice). Any hints of setting a timeout or forcing unregistering? Thanks in advance... Tux the turtle

1 0

Iptables
by Ricardo Javier Aranibar León 09 May '02

09 May '02

Hi list, I have a problem and I need your help, I use SuSE 7.2 and kernel 2.4.4-4. Why, When I like use iptables I have execute this command "rmmod ipchains", always restart my server? if I deleted ipchains?. and when initialize my system I have this problem: Failed services in runlevel 2,3 SuSEFirewall_setup and SuSEfirewall_final. Skipped Services in runlevel 3: personal_firewall initial pcmcia personal-firewall. Plese help me with those problems _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

2 1

Run-level editor in 8.0
by Michael Ströder 09 May '02

09 May '02

HI! The run-level editor in SuSE 8.0 always switches port mapper on because it assumes that it's needed by inetd. But I have no service in my inetd.conf at all which needs portmapper. Since portmapper is one of the most evil beasts regarding security this behaviour of the Yast2 run-level editor is complete bullshit! Ciao, Michael.

9 15

What list to subscribe to ?
by arawak 09 May '02

09 May '02

I now this list is about Suse Security. But I would like to know which list I should subscribe to, for questions on wireless networking ? Tia Sorry to annoy anyone Arawak

2 1

Re: [suse-security] Solution "interessantes" Netzwerk Problem
by d_lord＠gmx.de 09 May '02

09 May '02

Hi list, Sorry for posting OT and sorry for german subject and .. thats all I think After all I found a method to solve this problem. :-) IPTUNNEL If you are interessted in read http://www.tldp.org/HOWTO/Adv-Routing-HOWTO-5.html#ss5.3 for setup and http://www.tldp.org/HOWTO/mini/ppp-ssh/bringup.html if you encouter problems If any question remains write me (PM) Greetings D. Lord PS.: DNAT and SNAT didn't really fit (ipchains) -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

1 0

SuSEfirewall2 and DMZ problems...
by Bill.Light＠kp.org 09 May '02

09 May '02

Hi Gang ! Given the following scenario...Firewall running SuSE 7.3 / SuSEfirewall2 with 3 NICs: ************ * Internet * ************ * "Real" IP address * eth0 * ************ eth1 ****************** * Firewall ********** DMZ - www/mail * ************ ****************** * eth2 * * ************ * switch * ************ * * * * * * *********************** * Internal Machine(s) * *********************** If AA.aaa.aaa.aaa is a private IP on eth1 and BB.bbb.bbb.bbb is private IP on eth2 (to feed the rest of the network) How are questions answered in /etc/rc.config.d/firewall2.rc.config to get to the dmz computer ?? This is what I have (and I get dropped in the firewall without seeing the DMZ) ... I know I have NOT yet turned on mail, because I want to see www services running first..... FWD_DEV_EXT="eth0" FWD_DEV_INT="eth2" FWD_DEV_DMZ="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASW_DEV="$FW_DEV_EXT" FW_MASQ_NETS="BB.bb.bbb.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="www" FW_SERVICES_EXT_UDP="www" FW_SERVICES_EXT_IP="www" FW_SERVICES_DMZ_TCP="domain www" FW_SERVICES_DMZ_UDP="www" FW_SERVICES_DMZ_IP="www" FW_SERVICES_INT_TCP="www" FW_SERVICES_INT_UDP="www" FW_SERVICES_INT_IP="www" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" ?? -or- FW_FORWARD="0/0,AA.aaa.aaa.aaa,tcp,80" ?? FW_FORWARD_MASQ="0/0,AA.aaa.aaa.aaa,tcp,80" FW_REDIRECT="" ?? -or- FW_REDIRECT="0/0,AA.aaa.aaa.aaa,tcp,80" ?? The "-or-" is my guessing.....no combination seems to work, any help appreciated. What am I missing ?? I always get dropped in the "firewall" box and never get to the web-server. The SuSEfirewall2 examples given by Marc do not seem to address the setup I am attempting ... Is my inherent design bad ? - Bill

2 1