June 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] CFS Crypto-File Problems ::::: THANKS works
by Ryan Swenson 12 Jun '02

12 Jun '02

Hello, Thanks Jens... you made me say, "ok yeah..." under /etc/rc.d there exists a boot.crypto bash script... It provides all the mechanisms for starting the cfs - I should review it so I know a bit more how it works, prob uses loopback mounts.. never fails to check your boot scripts -duh -thanks!! Gruesse/Regards, Ryan S. -----Original Message----- From: jkerle(a)gmx.de [mailto:jkerle@gmx.de] Sent: Wednesday, June 12, 2002 12:46 PM To: suse-security(a)suse.com Cc: Ryan Swenson Subject: Re: [suse-security] CFS Crypto-File Problems Hi, if it is mounted by fstab, check /etc/fstab for a entry with cfs, remount with mount mountpoint if it is mounted by a script in /etc/rc.d (/etc/rc.d/rc.local for example), run it and check then why it fails on startup. if all fails, try grep -ir cfs /etc Jens > > On Wed, 12 Jun 2002, Ryan Swenson wrote: > > > Hello, > > > > Some of us here use SuSe Linux at each foreign site to provide CFS filesystems to protect a directory containing certificates for all our various java security related certs. Its more or less our Key Escrow. Unfortunately a German co-worker took off for a 5 week vacation, and a system crashed and restarted but never mounted the CFS. > > > > Normally in the boot process we are prompted for the passphrase. What can I do to remount the CFS filesystem in the security mount point partion I created. I have a partition all of its own for CFS, the directory exists but has not mounted the filesystem. > > > > Where do I begin, to find where CFS is specified, how to mount it, etc. > > > > Thanks, > > Ryan S. > > > > > > > > >

1 0

SuSE8.0 and SAMBA crash
by Olivier Daigle 12 Jun '02

12 Jun '02

Hi all, We have been using SuSE7.2 and samba (client and server) without any problems for a few months. Now, we migrated some workstations (samba clients) to SuSE8.0 and we get segfaults while accessing files mounted through samba. Here is our network configuration: - SuSE7.2 server with default samba server package. - Few SuSE7.2 workstations with default samba client packages. - Few Windows2000 workstations. - Few SuSE8.0 workstations with default samba client packages. Every SuSE workstation is UP and has a default SuSE UP kernel (2.4.4-4GB for 7.2 and 2.4.18-4GB for 8.0). Windows2000 and SuSE7.2 clients can access our server without any problem. SuSE8.0 clients crashes (segfault) while accessing a mounted directory. The crash happens at a random time (ie: doing a ls -lR in a mounted directory causes a segfault at random). The SuSE8.0 workstations are Intel Pentium 4 1.8GHz with 256MB of ram. I copied the output of lspci below: Here is the log I get: Jun 12 09:31:55 lemans kernel: Unable to handle kernel paging request at virtual address d0000000 Jun 12 09:31:55 lemans kernel: printing eip: Jun 12 09:31:55 lemans kernel: ccaebae9 Jun 12 09:31:55 lemans kernel: *pde = 00000000 Jun 12 09:31:55 lemans kernel: Oops: 0000 Jun 12 09:31:55 lemans kernel: CPU: 0 Jun 12 09:31:55 lemans kernel: EIP: 0010:[nls_cp437:__insmod_nls_cp437_O/lib/modules/2.4.18-4GB/kernel/fs/nls/n+-9823511/96] Tainted: P Jun 12 09:31:55 lemans kernel: EFLAGS: 00210246 Jun 12 09:31:55 lemans kernel: eax: 00000000 ebx: 9f454432 ecx: f80863fd edx: 9a1d91d6 Jun 12 09:31:55 lemans kernel: esi: d0000000 edi: cd53fe44 ebp: cd53fedc esp: cd53fdf4 Jun 12 09:31:55 lemans kernel: ds: 0018 es: 0018 ss: 0018 Jun 12 09:31:55 lemans kernel: Process ls (pid: 29093, stackpage=cd53f000) Jun 12 09:31:55 lemans kernel: Stack: c013fec0 cd53feac d483a252 00000001 00000000 00000000 00000000 cf5bfd80 Jun 12 09:31:55 lemans kernel: c5c3e220 5d812e9f 00e74a2a 64fa5aec 00000000 00000000 cfb99000 00000004 Jun 12 09:31:55 lemans kernel: 00000000 00000000 00000001 00000006 ccaea335 cafb77c0 cd53ffb0 c013fec0 Jun 12 09:31:55 lemans kernel: Call Trace: [filldir+0/216] [nls_cp437:__insmod_nls_cp437_O/lib/modules/2.4.18-4GB/kernel/fs/nls/n+-9829579/96] [filldir+0/216] [filldir+0/216] [nls_cp437:__insmod_nls_cp437_O/lib/modules/2.4.18-4GB/kernel/fs/nls/n+-9829438/96] Jun 12 09:31:55 lemans kernel: [filldir+0/216] [nls_cp437:__insmod_nls_cp437_O/lib/modules/2.4.18-4GB/kernel/fs/nls/n+-9825524/96] [filldir+0/216] [vfs_readdir+97/132] [filldir+0/216] [sys_getdents+74/152] Jun 12 09:31:55 lemans kernel: [filldir+0/216] [system_call+51/64] Jun 12 09:31:55 lemans kernel: Jun 12 09:31:55 lemans kernel: Code: 8a 06 46 89 c2 c1 e2 04 01 da c1 e8 04 01 c2 8d 04 92 8d 1c Here is what lsmod tells me: Module Size Used by Tainted: P nls_cp437 4384 6 (autoclean) nls_iso8859-1 2880 6 (autoclean) smbfs 32064 6 (autoclean) snd-pcm-oss 45152 0 (autoclean) snd-mixer-oss 11136 1 (autoclean) snd-intel8x0 12160 1 snd-pcm 58528 0 [snd-pcm-oss snd-intel8x0] snd-timer 11456 0 [snd-pcm] snd-ac97-codec 24196 0 [snd-intel8x0] snd-mpu401-uart 3504 0 [snd-intel8x0] snd-rawmidi 13536 0 [snd-mpu401-uart] snd-seq-device 4336 0 [snd-rawmidi] snd 31720 0 [snd-pcm-oss snd-mixer-oss snd-intel8x0 snd-pcm snd-timer snd-ac97-codec snd-mpu401-uart snd-rawmidi snd-seq-device] soundcore 3268 3 [snd] ipv6 123424 -1 (autoclean) isa-pnp 27816 0 (unused) joydev 5728 0 (unused) evdev 3904 0 (unused) input 3072 0 [joydev evdev] usb-uhci 20996 0 (unused) usbcore 55136 1 [usb-uhci] af_packet 11528 1 (autoclean) e100 69272 1 reiserfs 158816 1 Here is the output of lspci: 00:00.0 Host bridge: Intel Corp. 82845 845 (Brookdale) Chipset Host Bridge (rev 04) 00:01.0 PCI bridge: Intel Corp. 82845 845 (Brookdale) Chipset AGP Bridge (rev 04) 00:1e.0 PCI bridge: Intel Corp. 82801BA/CA PCI Bridge (rev 05) 00:1f.0 ISA bridge: Intel Corp. 82801BA ISA Bridge (LPC) (rev 05) 00:1f.1 IDE interface: Intel Corp. 82801BA IDE U100 (rev 05) 00:1f.2 USB Controller: Intel Corp. 82801BA/BAM USB (Hub (rev 05) 00:1f.3 SMBus: Intel Corp. 82801BA/BAM SMBus (rev 05) 00:1f.4 USB Controller: Intel Corp. 82801BA/BAM USB (Hub (rev 05) 00:1f.5 Multimedia audio controller: Intel Corp. 82801BA/BAM AC'97 Audio (rev 05) 01:00.0 VGA compatible controller: nVidia Corporation: Unknown device 0171 (rev a3) 02:08.0 Ethernet controller: Intel Corp. 82801BA/BAM/CA/CAM Ethernet Controller (rev 03) And here is the output of uname -a: Linux lemans 2.4.18-4GB #1 Wed Mar 27 13:57:05 UTC 2002 i686 unknown Is there a patch or something I can apply to fix this problem? Thanks, Olivier -- Olivier Daigle <daio3003(a)ele.etsmtl.ca> :wq

2 1

OT: naver.com autoreplier nastiness ?
by Maarten J H van den Berg 11 Jun '02

11 Jun '02

Does anyone else get this back when posting to the list ? Can we boot this sorry (l)user off the list, or what ? Sorry if this in inappropriate, or redundant... Maarten ## headers start here >From NAVER-MAILER(a)naver.com Tue Jun 11 19:20:37 2002 Return-Path: <NAVER-MAILER(a)naver.com> Received: from naver335.naver.com ([211.218.150.15]) by nebula.vbvb.nl (8.11.3/8.11.3/SuSE Linux 8.11.1-0.5) with SMTP id g5BGpa518086 for <maarten(a)vbvb.nl>; Tue, 11 Jun 2002 18:51:37 +0200 Message-Id: <200206111651.g5BGpa518086(a)nebula.vbvb.nl> Received: (qmail 1179 invoked by uid 0); 11 Jun 2002 16:51:33 -0000 Received: from naver332.naver.com (HELO naver332) (211.218.150.12) by naver335.naver.com with SMTP; 11 Jun 2002 16:51:33 -0000 MIME-Version: 1.0 Content-Id: <3D062A95.000001.16352(a)naver332.naver.com> Content-Type: text/plain From: <NAVER-MAILER(a)naver.com> Date: Wed, 12 Jun 2002 01:51:33 +0900 (KST) To: <maarten(a)vbvb.nl> Subject: =?ks_c_5601-1987?B?uN7AzyDA/LzbIL3HxtAgvsu4siA8bWludDExMTVAbmF2ZXIuY29t?= =?ks_c_5601-1987?B?Pg==?= X-Mailer: NAVER Mailer 1.0 X-Virus-Scanned: by AMaViS-perl11-milter (http://amavis.org/) X-UIDL: ,eR"!Ie/"!8&1"!@C`"! Status: R X-Status: N Content-Type: message/rfc822; name="Re: [suse-security] Resetting Firewall2.eml" Content-Disposition: attachment; Filename="Re: [suse-security] Resetting Firewall2.eml" Content-Transfer-Encoding: 8bit Received: (qmail 16348 invoked from network); 11 Jun 2002 16:51:32 -0000 Received: from unknown (HELO naver439.naver.com) (211.218.150.239) by naver332 with SMTP; 11 Jun 2002 16:51:32 -0000 Received: from [217.9.113.68] by naver439.naver.com (Terrace Internet Messaging Server 3.1) with ESMTP id 2002061201:51:31:849232.30220.6329511 for <mint1115(a)naver.com>; Wed, 12 Jun 2002 01:51:28 +0900 (KST) Received: (qmail 6926 invoked by alias); 11 Jun 2002 16:48:42 -0000 Mailing-List: contact suse-security-help(a)suse.com; run by ezmlm Precedence: bulk List-Post: <mailto:suse-security@suse.com> List-Help: <mailto:suse-security-help@suse.com> List-Unsubscribe: <mailto:suse-security-unsubscribe@suse.com> List-Subscribe: <mailto:suse-security-subscribe@suse.com> X-MIME-Notice: attachments may have been removed from this message X-Mailinglist: suse-security Delivered-To: mailing list suse-security(a)suse.com Received: (qmail 6892 invoked from network); 11 Jun 2002 16:48:41 -0000 Content-Type: text/plain; charset="iso-8859-1" From: Maarten J H van den Berg <maarten(a)vbvb.nl> Reply-To: maarten(a)vbvb.nl Organization: VBVB To: suse-security(a)suse.com Date: Tue, 11 Jun 2002 19:10:07 +0200 X-Mailer: KMail [version 1.2] References: <3D061D71.2090305(a)mrichi.com> In-Reply-To: <3D061D71.2090305(a)mrichi.com> MIME-Version: 1.0 Message-Id: <0206111910070H.15680@itux> Content-Transfer-Encoding: 8bit X-Virus-Scanned: by AMaViS-perl11-milter (http://amavis.org/) Subject: Re: [suse-security] Resetting Firewall2 -- Maarten J. H. van den Berg ~~//~~ network administrator VBVB - Amsterdam - The Netherlands - http://vbvb.nl T +31204233288 F +31204233286 G +31651994273

1 0

susefirewall2 examples
by Carlos Carrera 11 Jun '02

11 Jun '02

Hello somebody know more examples of SuSEfirewall2 ???

1 0

apache with mod_ssl and mod_auth_ldap
by Belick, Mirko 11 Jun '02

11 Jun '02

> I have started to build up a secure webaccess solution with SSL > client-authentication , based on apache+mod_ssl and a ldap-based user > administration. I tried mod_authz_ldap ( http://authzldap.othello.ch/ ) > which maps x509 certificate entries to ldap usernames and it works fine > for me. But mod_authz_ldap lacks on support for crypted passwords, as > mod_auth_ldap can. > Does anybody know if mod_ssl and mod_auth_ldap ( included in SuSE ) work > together well? When I try to install both packages, yast prints out a > warning, that it is not recommended to install mod_ssl and mod_auth_ldap > together. Any experiences ... ? > > Many thanks > > Mirko > > > > ----------------------------------- > Mirko Belick > Bundesdruckerei GmbH > IT-Netzmanagement > 10598 Berlin > Oranienstrasse 91 > > Tel: (030) 2598-2113 > Fax: (030) 2598-6083 > Email: belick(a)bdr.de > http://www.bundesdruckerei.de >

1 0

NFS-Server and Firewall
by Florian Rossol 11 Jun '02

11 Jun '02

Hi list, i have to set up an NFS-Server. I want to protect this server with SuSEfirewall2. The question is: What ports do I have to open? Of course I have to open port 111 (udp,tcp) and 2049 (udp,tcp). But that seems not to be enough. Everytime I try to connect to the server the client conntects to some other (randomly choosen?) ports (608, 922, 1024, ...). Do I have to open a range of ports? If so, what range I have to open? Thanks and greetings Florian

2 1

Webmin & SuSEfirewall2
by Dr. Peter Bast 10 Jun '02

10 Jun '02

Hi, is there any modul to managing SuSEfirewall2 with Webmin. Thank's Peter

2 2

RE: [suse-security] bind8 security question
by Herbrechter, Marc 10 Jun '02

10 Jun '02

Michael Ryan wrote: > Hi List, Moinsen > I am running BIND 8.2.3 on a production SuSE 6.4 box and want > to know whether upgrading to 8.3.1 as recommended by the ISC > ('due to certain security vulnerabilities in previous > versions') is going to cause problems ... ? You should Update your BIND as often as possible out of the sources avaiable at http://www.isc.org/. You should also consider updating your BIND to 9.x and running it in a chroot'ed environment for more secure operation. > .. or do SuSE intend providing an updated BIND8 rpm for 6.4 ? For sure... LOL ;)

3 2

bind8 security question
by Michael Ryan 10 Jun '02

10 Jun '02

Hi List, I note from a recent CERT advisory and subsequent SuSE Security announcement that there is a DoS issue with BIND 9 versions prior to 9.2.1. I am running BIND 8.2.3 on a production SuSE 6.4 box and want to know whether upgrading to 8.3.1 as recommended by the ISC ('due to certain security vulnerabilities in previous versions') is going to cause problems ... ? .. or do SuSE intend providing an updated BIND8 rpm for 6.4 ? Thanks, Michael

1 0

Re: [suse-security] Webmin & SuSEfirewall2
by Dr. Peter Bast 10 Jun '02

10 Jun '02

Per R Laursen schrieb: > Try to look at http://www.webmin.com > > > On Friday 07 June 2002 16:26, Dr. Peter Bast wrote: > >>Hi, >> >>is there any modul to managing SuSEfirewall2 with Webmin. >> >>Thank's >> >>Peter > > I can't find any modul for SuSEfirewall2 at http://www.webmin.com.

1 0

IPChains and IPv6
by Mark Tinka 10 Jun '02

10 Jun '02

hi list... i have recently installed SuSE Linux 8.0 Pro, and everything seems to be working fine except for the network... i setup some IPChains scripts that i have been using for a long time on my other SuSE 7.2 Pro servers, and they seem to be taken by 8.0 with no problem.. but running them causes the machine not to talk to the network... disabling the IPChains gets the network back, but routing or DNS, or both don't work at all... i can't resolve any names.... i did some looking around and discovered that 8.0 is heavy on IPv6... IPv6 was running ontop of IPv4 and along IPv4 on the network interface and various other apps ... i disabled the ipv6.o module from loading in /etc/modules.conf, and the interface is now talking only INET, and not INET6 .. but i still can't route or resolve, or get network access with the IPChains loaded.. any ideas...?.. i am running kernel 2.2.19-162 .. many thanks.. AKNIT __________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com

2 2

RE: [suse-security] Ipchains Issue
by Peer Stefan 10 Jun '02

10 Jun '02

> From: Terence [mailto:terencel@sunway.edu.my] > Thanks Stefan, you're welcome :-) > > Is the same thing happening when I connect? If I'm allowing > my host say, > 172.16.0.5 to connect (speficied in the input rule) and the > "deny the rest" > command set, it takes about 30 seconds-1 minute for me to > connect. Once I'm > connected there's no problem. I checked the man pages and > there's no option > (if in fact it's also doing lookups on a connect). Any ideas? hmm, i'm not sure 'bout that one ... perhaps it's looking hostnames up for logging? you can always enter the specified hosts in you're /etc/hosts -file, that will speed things up. regards, stefan

1 0

Re: [suse-security] Ipchains Issue
by Terence 10 Jun '02

10 Jun '02

Thanks Stefan, Is the same thing happening when I connect? If I'm allowing my host say, 172.16.0.5 to connect (speficied in the input rule) and the "deny the rest" command set, it takes about 30 seconds-1 minute for me to connect. Once I'm connected there's no problem. I checked the man pages and there's no option (if in fact it's also doing lookups on a connect). Any ideas? Thanks Terence ----- Original Message ----- From: "Stefan Nauber" <stefan.nauber(a)cs2-informatik.de> To: "'Terence'" <terencel(a)sunway.edu.my>; <suse-security(a)suse.com> Sent: Friday, June 07, 2002 6:22 PM Subject: RE: [suse-security] Ipchains Issue Hi, yes you are right. Just do ipchains -L -n to avoid reverse lookups. Greetings, Stefan > -----Original Message----- > From: Terence [mailto:terencel@sunway.edu.my] > Sent: Friday, June 07, 2002 12:09 PM > To: suse-security(a)suse.com > Subject: [suse-security] Ipchains Issue > > > hi, > > I have the following setup on ipchains (simplified) > > step 1: Set all policies to deny > ipchains -A input -i ! lo -j DENY > ipchains -A output -i ! lo -j DENY > > step 2: Allow whatever else. > ipchains -A input ...... ACCEPT > > step 3: Add the following line (to reject everything else): > > ipchains -A input -j REJECT > > step 4: Restore default policies > > The problem is with step 3. After I run the script, I type in > "ipchains -L" > which takes forever to execute. The same when I try to > connect to my box. > Now I suspect that it might be doing reverse lookups on the > dns. Am I right > or is thre something wrong with my assumption of ipchains? > > thanks to anyone who can help > rgds > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

[suse-security] Re: Konfiguration DSL bei SuSE 8.0
by Bill.Light＠kp.org 09 Jun '02

09 Jun '02

English list only..... Perhaps you require search somedomain Before your name servers ? Mein deutsche is schlect and I probably should not have replied. - Bill ----- Forwarded by Bill Light/CA/KAIPERM on 06/09/02 02:03 PM ----- as_sec <as_sec(a)web.de> Sent by: as_sec(a)web.de 06/09/02 08:18 AM To: suse-security(a)suse.com cc: Subject: [suse-security] Re: Konfiguration DSL bei SuSE 8.0 hi, ich hab zwar kein DSL und nur 7.3 , aber die resolv.conf bestimmt, welche Nameserver zur Auflösung genutzt werden... /etc/resolv.conf nameserver 62.96.128.66 (z.B Addcom NS) nameserver 145.253.2.75 (z.B Arcor NS) gruss Andreas P.S. aber eigentl sollte der nächstliegende NS gewählt werden, so sollte die Namesauflösung am schnellsten gehen, und der nächste ist halt der NS des Providers...?! -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: Konfiguration DSL bei SuSE 8.0
by as_sec 09 Jun '02

09 Jun '02

hi, ich hab zwar kein DSL und nur 7.3 , aber die resolv.conf bestimmt, welche Nameserver zur Auflösung genutzt werden... /etc/resolv.conf nameserver 62.96.128.66 (z.B Addcom NS) nameserver 145.253.2.75 (z.B Arcor NS) gruss Andreas P.S. aber eigentl sollte der nächstliegende NS gewählt werden, so sollte die Namesauflösung am schnellsten gehen, und der nächste ist halt der NS des Providers...?!

1 0

Fw: [suse-security] Problem SuSEfirewall2 or Harden_Suse
by Piotr Flakus 08 Jun '02

08 Jun '02

harden_suse is making changes in /etc/ssh/sshd_config and this is your problem I have the same situation 2 weeks ago No remote ssh connection as root nor "su" command works. PF > > Ricardo Javier Aranibar León wrote: > > > > [...] > > > I had to stop SuSefirewall2 and I can to into my computer using ssh, but > I > > > don't like stop my firewall. > > > > It seems to me, that You have to permit the port for ssh in Your > > SuSEfirewall2.config > > > > I am far away from an expert to SuSEfirewall2 but > > everything You do not permit explicitly, is forbidden. > > > > If I am right You have to open port 22 on both, internal and external > interface. > > [...] > > > Pd: Sorry for my enghish but I understand it. > > Fine for You! I hope You understand my personal version of that language! > ;-) > > > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here >

1 0

[suse-security] Problem SuSEfirewall2 or Harden_Suse
by Ricardo Javier Aranibar León 08 Jun '02

08 Jun '02

Hi List, I modify the following archives: /etc/hosts.allow /etc/hosts.deny In /etc/hosts.allow I added the following line: sshd: ALL In /etc/host.deny, Only block the following line: #ALL: ALL Except localhost With this way I can to do access remote, but I re-started my computer and I can't have access remote. I had to stop SuSefirewall2 and I can to into my computer using ssh, but I don't like stop my firewall. Please I need your help with this. Maybe I read about Harden_suse and don't recommend to block the line #ALL: ALL Except localhost. I only like use ssh, and others service I don't like to use, please help me. Pd: Sorry for my enghish but I understand it. >This is a FAQ. Harden_suse closes a lot. >To solve this, go over the options in /etc/hosts.allow, >/etc/ssh/sshd.conf and (possibly) /etc/login.defs >And of course -but you did that, right(?)- /var/log/messages... > >Maarten _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

2 1

Antw: [suse-security] Problem SuSEfirewall2 or Harden_Suse
by Milan Goellner 07 Jun '02

07 Jun '02

harden_suse modifies /etc/hosts.deny to include everything external >>> "Ricardo Javier Aranibar León" <ricardo_jal(a)hotmail.com> 06.06.02 19:09:21 >>> Hi list, I installed SuSEfirewall2 and Harden_suse, Before I can to connect me to my box linux from a remote computer using ssh or with windows with putty. Now I can't to connect me from a remote computer. If somebody can help me i will thankfull

2 1

RE: [suse-security] Ipchains Issue
by Peer Stefan 07 Jun '02

07 Jun '02

you can skip reverse lookups by using 'ipchains -L -n' regards, stefan > From: Terence [mailto:terencel@sunway.edu.my] > hi, > > I have the following setup on ipchains (simplified) > > step 1: Set all policies to deny > ipchains -A input -i ! lo -j DENY > ipchains -A output -i ! lo -j DENY > > step 2: Allow whatever else. > ipchains -A input ...... ACCEPT > > step 3: Add the following line (to reject everything else): > > ipchains -A input -j REJECT > > step 4: Restore default policies > > The problem is with step 3. After I run the script, I type in > "ipchains -L" > which takes forever to execute. The same when I try to > connect to my box. > Now I suspect that it might be doing reverse lookups on the > dns. Am I right > or is thre something wrong with my assumption of ipchains? > > thanks to anyone who can help > rgds > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

RE: [suse-security] IP alias and SuSE firewall
by Peer Stefan 07 Jun '02

07 Jun '02

hi > Aliases in IPTABLES and IPCHAINS do not know aliases. There's no > ippp0:0, only ippp0. You can only distiguish by ip: > -i ippp0 -s 10.0.0.0/8 > and > -i ippp0 -s 172.16.0.0/12 > or something like that. > > Got no clue about SuSE firewall though, but there's no way around the > alias limitiation. FW_DEV_EXT="eth0 eth0:0 eth0:0:1" works (SuSEfirewall2), but SuSEfirewall2 uses IP-addresses, not interfaces - therefore it's a bit tricky with dhcp-addresses ;-) another funny thing is the wildcard character '+': * "iptables -A INPUT -j ACCEPT -i 'eth0:0' -d 10.100.4.216" does not work. * "iptables -A INPUT -j ACCEPT -i 'eth0+' -d 10.100.4.216" works for eth0:0 but not for eth0 (if you have just one virtual interface) regards, stefan

2 1

RE: [suse-security] nmap
by arawak 06 Jun '02

06 Jun '02

I've read the online man page but nothing there would get the format correct I require. I'm trying to use a file txt with a list of 194.x.x.x/24 etc & 213.x.x.x/28 etc, to my get my output parsed. So far I use this command "nmap -v -v -oN c:\test -sP 194.183.x.x./27". But I want to use a file with a lot of similar addresses against nmap. Dre :) > -----Original Message----- > From: Ste [mailto:estebantodoloco@inwind.it] > Sent: 05 June 2002 17:58 > To: arawak > Subject: Re: [suse-security] nmap > > > Alle 18:27, mercoledì 5 giugno 2002, arawak ha scritto: > > What would the command options to get this type of output > using Nmap. > [cut] > > I'm new to the scanning with nmap... But I want to learn. > > man nmap > > > Dre .. > > >

6 8

Problem SuSEfirewall2 or Harden_Suse
by Ricardo Javier Aranibar León 06 Jun '02

06 Jun '02

Hi list, I installed SuSEfirewall2 and Harden_suse, Before I can to connect me to my box linux from a remote computer using ssh or with windows with putty. Now I can't to connect me from a remote computer. If somebody can help me i will thankfull _________________________________________________________________ Únase con MSN Hotmail al servicio de correo electrónico más grande del mundo. http://www.hotmail.com

3 2

Re: Re: Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem
by BLeonhardt＠analytek.de 06 Jun '02

06 Jun '02

try this ... echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Robert Szentmihalyi <robert.szentmihalyi(a)entracom.de> 06.06.02 14:59 An: andre <andre(a)andre.co.za> Kopie: suse-security(a)suse.com Thema: Re: Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem On Thursday, 6. June 2002 14:32, andre wrote: > On Thu, 2002-06-06 at 14:25, Robert Szentmihalyi wrote: > > On Thursday, 6. June 2002 14:10, BLeonhardt(a)analytek.de wrote: > > > ... hmmm ... a silly question : > > > > > > ... did you do : echo 1 > /proc/sys/net/ipv4/ip_forward ? > > > ... on your firewall > > > > Yes, of course :-) > > > > IP forwarding is active and has always been (I said that in my > > original posting), but I still can't access the web server > > behind the firewall :-( > > didn't the proxyarp work ? I am just looking into that issue. I have found this on the net: http://www.sjdjweis.com/linux/proxyarp/ According to this, enabling proxy_arp on the web server is only half the job. At the moment, I am trying to configure ARP on the firewall. Perhaps you have a quick example that fits my setup? > > krgds, > > andre Thanks, Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem
by Robert Szentmihalyi 06 Jun '02

06 Jun '02

On Thursday, 6. June 2002 14:32, andre wrote: > On Thu, 2002-06-06 at 14:25, Robert Szentmihalyi wrote: > > On Thursday, 6. June 2002 14:10, BLeonhardt(a)analytek.de wrote: > > > ... hmmm ... a silly question : > > > > > > ... did you do : echo 1 > /proc/sys/net/ipv4/ip_forward ? > > > ... on your firewall > > > > Yes, of course :-) > > > > IP forwarding is active and has always been (I said that in my > > original posting), but I still can't access the web server > > behind the firewall :-( > > didn't the proxyarp work ? I am just looking into that issue. I have found this on the net: http://www.sjdjweis.com/linux/proxyarp/ According to this, enabling proxy_arp on the web server is only half the job. At the moment, I am trying to configure ARP on the firewall. Perhaps you have a quick example that fits my setup? > > krgds, > > andre Thanks, Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de

1 0

Re: Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem
by BLeonhardt＠analytek.de 06 Jun '02

06 Jun '02

... hmmm ... a silly question : ... did you do : echo 1 > /proc/sys/net/ipv4/ip_forward ? ... on your firewall Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Robert Szentmihalyi <robert.szentmihalyi(a)entracom.de> 06.06.02 13:45 An: BLeonhardt(a)analytek.de Kopie: suse-security(a)suse.com Thema: Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem On Thursday, 6. June 2002 13:11, BLeonhardt(a)analytek.de wrote: > > ME: shouldn't the gateway ip be x.x.x.146 ??? the webserver is > connected on (cross over) eth0 ( x.x.x.146 ) ... usually > x.x.x.146 is ME: the standard gateway for the webserver ... am > i wrong ??? That is what I had tried in the first place, but it doesn't work: The web server is not reachable from the other side of the firewall. > > >Also, I don't understand, WHY the gateway should be > > 62.245.134.144. Could somebody please shed some light on that? > > > >> Cheers > >> > >> Thiemo > > Thanks for your help, > Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem
by BLeonhardt＠analytek.de 06 Jun '02

06 Jun '02

see below .. Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Robert Szentmihalyi <robert.szentmihalyi(a)entracom.de> 06.06.02 12:24 An: Thiemo Kellner <thiemo(a)gmx.ch>, suse-security(a)suse.com Kopie: Thema: Re: AW: [suse-security] Firewall Routing/Forwarding Problem On Thursday, 6. June 2002 07:55, Thiemo Kellner wrote: > Hi, >> >> > > The firewall's NICs are configured as follows: >> > > eth0 62.245.134.130 netmask 255.255.255.240 >> > > connected directly to the web server via a cross-over cable >> > >> > should not the default gateway of your webserver be >> > 62.245.134.144 instead of 62.245.134.146? >> >> As the NIC to which the web server is connect has 62.245.134.130, >> I'd rather say that the web server's default gateway ought to be >> 62.245.134.130. Try to ping 62.245.134.146 and 62.245.134.144 >> and see iff you can reach them. >Sorry, I mixed hat up yesterday. >The firewall's interfaces are actually configured like this: >eth0 62.245.134.146 netmask 255.255.255.240 >eth1 62.245.134.130 netmask 255.255.255.240 >and the web server is connected to eth0, i.e. 62.245.134.146 >I guess I have been working on this for too long... >I have tried to set the gateway of the web server to >62.245.134.144, but when routing is set up at boot time, I get a >"network unreachable" error, athough I can ping 62.245.134.144. >Any ideas? ME: shouldn't the gateway ip be x.x.x.146 ??? the webserver is connected on (cross over) eth0 ( x.x.x.146 ) ... usually x.x.x.146 is ME: the standard gateway for the webserver ... am i wrong ??? >Also, I don't understand, WHY the gateway should be 62.245.134.144. >Could somebody please shed some light on that? >> >> Cheers >> >> Thiemo Thanks for your help, Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

AW: [suse-security] Firewall Routing/Forwarding Problem
by Klingler, Karl 06 Jun '02

06 Jun '02

Hi, should not the default gateway of your webserver be 62.245.134.144 instead of 62.245.134.146? karl > -----Ursprüngliche Nachricht----- > Von: Robert Szentmihalyi [mailto:robert.szentmihalyi@entracom.de] > Gesendet: Mittwoch, 5. Juni 2002 14:50 > An: suse-security(a)suse.com > Betreff: [suse-security] Firewall Routing/Forwarding Problem > > > Hi, > > I have a strange problem which I have been debugging > unsuccessfully for two days now. Perhaps one of you can help. > > We have a web server (SuSE Linux 7.3) behind a firewall > (SuSE Linux 7.1) with iptables filtering rules. > > The firewall's NICs are configured as follows: > > eth0 62.245.134.130 netmask 255.255.255.240 > connected directly to the web server via a cross-over cable > eth1 62.245.134.146 netmask 255.255.255.240 > connected to the internet > > route -n tells > > Destination Gateway Genmask Flags Metric Ref Use Iface > 62.245.134.128 0.0.0.0 255.255.255.240 U > 0 0 0 eth1 > 62.245.134.144 0.0.0.0 255.255.255.240 U > 0 0 0 eth0 > 0.0.0.0 62.245.134.129 0.0.0.0 UG > 0 0 0 eth1 > > > 62.245.134.129 is the gateway IP address assigned to us by the ISP. > > The web servers NIC is configured as > eth0 62.245.134.145 netmask 255.255.255.240 > > and the routing table looks like this: > Destination Gateway Genmask Flags Metric Ref Use Iface > 62.245.134.144 0.0.0.0 255.255.255.240 U > 0 0 0 eth0 > 62.245.134.144 0.0.0.0 255.255.255.240 U > 0 0 0 eth0 > 0.0.0.0 62.245.134.146 0.0.0.0 UG > 0 0 0 eth0 > > The problem is that the web server is not reachable on from > the other side of the firewall although IP forwarding is > activeated on the firewall. > > I don't think the problem is related to the filtering rules, > but I can post the script if neccessary. > > Am I missing something? > Do I have to configure the firewall as an ethernet bridge for > this to work? > > Any hint is appreciated. > Thanks, > Robert > > -- > Where do you want to be tomorrow? > > Entracom. Building Linux systems. > http://www.entracom.de > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

3 2

Help for Installing a VPN wanted
by Wilfried Philippi 06 Jun '02

06 Jun '02

Hello, i wan't to install a VPN for secure administration of the Linux Server and need a little bit of info. I don't know is this here OT. When it is then plese give me sources eg. Webadresses please. Installation of the Linux and Windows programs is ok. I have the PPTP server so configured the listenadress is : 192.168.1.1, the serveradress is: 192.168.2.1 and the VPN Network is : 192.168.2.0 so the Dial in Clent has an IP 192.168.2.2 - 250 My questions are: 1. The Windows clients are so configured that the Standard Gateway for the real Network is 192.168.1.1. How can i say to windows( Clients uses 2000 professional and Win98) that it uses the Dial in Connection and not the Standard Gatway for the Connection? 2. When i connect the server via telnet, ssh or Webmin via the VPN Connection what adress for the Server must i use 192.168.1.1 or 192.168.2.1? I hope i can get help here or an Info where i can get an answer to my Questions. Thank You. Wilfried

1 0

Telnet Problem 2
by Stanley Caramoy 06 Jun '02

06 Jun '02

Hello... This is the log from SuSE server : Jun 5 11:09:14 b235 in.telnetd[25273]: connect from 134.x.x.x (134.x.x.x) Jun 5 11:09:24 b235 login: FAILED LOGIN 1 FROM 134.x.x.x FOR UNKNOWN, User not known to the underlying authentication module Jun 5 11:09:34 b235 login: FAILED LOGIN 2 FROM 134.x.x.x FOR stancrm, Authentication failure Jun 5 11:09:46 b235 login: FAILED LOGIN 3 FROM 134.x.x.x FOR stancrm, Authentication failure Jun 5 11:09:53 b235 login: FAILED LOGIN SESSION FROM 134.x.x.x FOR UNKNOWN, User not known to the underlying authentication module Jun 5 11:10:08 b235 in.telnetd[25275]: connect from 134.x.x.x (134.x.x.x) Jun 5 11:10:20 b235 login: FAILED LOGIN 1 FROM 134.x.x.x FOR stancrm, Authentication failure Jun 5 11:10:37 b235 login: FAILED LOGIN 2 FROM 134.x.x.x FOR stancrm, Authentication failure Jun 5 11:10:49 b235 login: FAILED LOGIN 3 FROM 134.x.x.x FOR UNKNOWN, User not known to the underlying authentication module Jun 5 11:11:35 b235 in.telnetd[25285]: connect from 134.x.x.x (134.x.x.x) Thanks -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

Re: Re: [suse-security] Telnet Problem 2
by BLeonhardt＠analytek.de 06 Jun '02

06 Jun '02

... everything seems to be okay ... noone from 134.x.x.x could login ... session login failed like described in your log .. .. what's the problem ? Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de John Andersen <jsa(a)pen.homeip.net> 06.06.02 08:34 Bitte antworten an jsa An: Stanley Caramoy <s_caramoy(a)gmx.de>, suse-security(a)suse.com Kopie: Thema: Re: [suse-security] Telnet Problem 2 So what was the problem again? The log shows that they did not get in. On Wednesday 05 June 2002 09:43 pm, Stanley Caramoy wrote: > Hello... > > This is the log from SuSE server : > > Jun 5 11:09:14 b235 in.telnetd[25273]: connect from 134.x.x.x (134.x.x.x) > Jun 5 11:09:24 b235 login: FAILED LOGIN 1 FROM 134.x.x.x FOR UNKNOWN, User > not known to the underlying authentication module > Jun 5 11:09:34 b235 login: FAILED LOGIN 2 FROM 134.x.x.x FOR stancrm, > Authentication failure > Jun 5 11:09:46 b235 login: FAILED LOGIN 3 FROM 134.x.x.x FOR stancrm, > Authentication failure > Jun 5 11:09:53 b235 login: FAILED LOGIN SESSION FROM 134.x.x.x FOR > UNKNOWN, User not known to the underlying authentication module > Jun 5 11:10:08 b235 in.telnetd[25275]: connect from 134.x.x.x (134.x.x.x) > Jun 5 11:10:20 b235 login: FAILED LOGIN 1 FROM 134.x.x.x FOR stancrm, > Authentication failure > Jun 5 11:10:37 b235 login: FAILED LOGIN 2 FROM 134.x.x.x FOR stancrm, > Authentication failure > Jun 5 11:10:49 b235 login: FAILED LOGIN 3 FROM 134.x.x.x FOR UNKNOWN, User > not known to the underlying authentication module > Jun 5 11:11:35 b235 in.telnetd[25285]: connect from 134.x.x.x (134.x.x.x) > > > Thanks -- _________________________________________________ No I Don't Yahoo! And I'm getting pretty sick of being asked if I do. _________________________________________________ John Andersen / Juneau Alaska -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Fou4s - Fast OnlineUpdate for SuSE 0.6.0
by Markus Gaugusch 05 Jun '02

05 Jun '02

Hi, A major new release of my Yast OnlineUpdate replacement is out. Fou4s is best suited to be run as a cron job and automatically download/install update packages. >From the Changelog: 0.6.0, Wed Jun 5 2002 * Fixes for 0.5.0 + Fixed error "too many arguments", if Auto= in config file was empty or not set + lsof now uses -n parameter to disable network resolution (faster!) + If there are installation problems, a recommendation for -a option is printed + "Need to download ... packages" counted packages from remarklist too * Multiple Server support!! This should make multi-configfile "hacks" obsolete. * /etc/fou4s.conf will not be moved away anymore during RPM update. The new version is now saved as /etc/fou4s.conf.rpmnew when updating. This behaviour will be kept as long as possible from now on. * Fou4s public GPG key is now delivered with fou4s itself and not downloaded from the keyservers (some people behind proxies had problems with this). * Support for patch.rpm files (has always worked, but now it's official ;) * Use http://ftp.gwdg.de as default server, because ftp doesn't work with proxy and http is faster. BTW: you can ignore HTTP 416 errors from wget. (please change your current config file if you are updating) Fou4s is available from http://fou4s.gaugusch.at or via fou4s -u --checkfou4s && fou4s -i Bad News: SuSE has removed package description files for SuSE 6.4 and 7.0. See also the statement on my homepage. This will also break Email Server II updates. I'm sorry, but there is nothing I can do. Maybe some volunteer can provide package descriptions (they are only simple text files), that point to a SuSE mirror. Fou4s could then use those package descriptions. I don't run SuSE 7.0 anymore, so don't ask Me. Fou4s checks all packages against the SuSE build key, so there won't be a security problem with trojaned packages! The only exception is fou4s itself, which is checked against fou4s(a)gaugusch.at regards, Markus Gaugusch -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

nmap
by arawak 05 Jun '02

05 Jun '02

Hi What would the command options to get this type of output using Nmap. list of one line per network with the name, ip network address, number of addresses and number of hosts.? output to a file... I'm new to the scanning with nmap... But I want to learn. Dre ..

2 1

Telnet Problem
by Stanley Caramoy 05 Jun '02

05 Jun '02

Hello.... I'm having a problem with my Linux Server (SuSE 7.0). Someone has tried to login to my machine without username and password. He/She tried to login with Telnet (from Windows) with extra commands behind the telnet command. He/She can access my Linux Server without Username and Password. How to make the security of my Linux Server better ? Thanks... -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

9 10

Re: [suse-security] Telnet Problem
by BLeonhardt＠analytek.de 05 Jun '02

05 Jun '02

Hi, never use telnet for remote access or something like that... ... all traffic ( inclusive username / password ) will be transmitted as "plain text" over the network(s) ... user ssh ... there is a sshd on the linux-distro... install that ... use my howto on http://www.linux-it.net ... Install putty onto your client .. ...you've to login as root for sshd installation ... ! Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Stanley Caramoy <s_caramoy(a)gmx.de> 05.06.02 13:30 An: suse-security(a)suse.com Kopie: Thema: [suse-security] Telnet Problem Hello.... I'm having a problem with my Linux Server (SuSE 7.0). Someone has tried to login to my machine without username and password. He/She tried to login with Telnet (from Windows) with extra commands behind the telnet command. He/She can access my Linux Server without Username and Password. How to make the security of my Linux Server better ? Thanks... -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Firewall Routing/Forwarding Problem
by Robert Szentmihalyi 05 Jun '02

05 Jun '02

Hi, I have a strange problem which I have been debugging unsuccessfully for two days now. Perhaps one of you can help. We have a web server (SuSE Linux 7.3) behind a firewall (SuSE Linux 7.1) with iptables filtering rules. The firewall's NICs are configured as follows: eth0 62.245.134.130 netmask 255.255.255.240 connected directly to the web server via a cross-over cable eth1 62.245.134.146 netmask 255.255.255.240 connected to the internet route -n tells Destination Gateway Genmask Flags Metric Ref Use Iface 62.245.134.128 0.0.0.0 255.255.255.240 U 0 0 0 eth1 62.245.134.144 0.0.0.0 255.255.255.240 U 0 0 0 eth0 0.0.0.0 62.245.134.129 0.0.0.0 UG 0 0 0 eth1 62.245.134.129 is the gateway IP address assigned to us by the ISP. The web servers NIC is configured as eth0 62.245.134.145 netmask 255.255.255.240 and the routing table looks like this: Destination Gateway Genmask Flags Metric Ref Use Iface 62.245.134.144 0.0.0.0 255.255.255.240 U 0 0 0 eth0 62.245.134.144 0.0.0.0 255.255.255.240 U 0 0 0 eth0 0.0.0.0 62.245.134.146 0.0.0.0 UG 0 0 0 eth0 The problem is that the web server is not reachable on from the other side of the firewall although IP forwarding is activeated on the firewall. I don't think the problem is related to the filtering rules, but I can post the script if neccessary. Am I missing something? Do I have to configure the firewall as an ethernet bridge for this to work? Any hint is appreciated. Thanks, Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de

1 0

RE: [suse-security] SuSE-FW-DROP-ANTI-SPOOFING IN
by Peer Stefan 05 Jun '02

05 Jun '02

> The adsl-router is connected direct to the externel device > (eth1) of the > server. The internel device (eth0) is connect to a switch. > The same configuration was running on an ohter server with > SuSE Linux 7.0 > (Kernel 2.2) and SuSEfirewall1. do you have a routerdaemon up and running, listening and shouting on udp-port 520? ('netstat -anp | grep 0.0.0.0:520') if so, you can either configure your routerdaemon not to shout on both interfaces or you disable the logging of these messages. regards, stefan

2 1

Kaspersky AntiVirus Trouble
by sc＠optomed.de 05 Jun '02

05 Jun '02

hi all, i am trying to install Kaspersky AV Linux, but having serious trouble while compiling the monitor (better "klmon" module - for on access scans) i folled the handbook-instructions (just a few) but this ends up in more than 40 lines of errors....at the end of this mail, www.kaspersky.com, google + groups doesn't helped so far... any kind of help is welcome - thank you Andreas (Rainer, could you help again ?) -------------------------------------------------------------------------------------------------------------- comp1:/opt/AVP/kavmonitor/module.linux # make gcc -c -D__KERNEL__ -I/usr/src/linux/include -Wall -O2 -fomit-frame-pointer -fno-strict-aliasing -pipe -fno-strength-reduce -m486 -malign-loops=2 -malign-jumps=2 -malign-functions=2 -DCPU=686 -DMODULE handle_execve.c In file included from module.h:8, from handle_execve.c:6: /usr/include/linux/version.h:2: #error "=======================================================" /usr/include/linux/version.h:3: #error "You should not include/usr/include/{linux,asm}/ header" /usr/include/linux/version.h:4: #error "files directly for the compilation of kernel modules." /usr/include/linux/version.h:5: #error "" /usr/include/linux/version.h:6: #error "glibc now uses kernel header files from a well-defined" /usr/include/linux/version.h:7: #error "working kernel version (as recommended by Linus Torvalds)" /usr/include/linux/version.h:8: #error "These files are glibc internal and may not match the" /usr/include/linux/version.h:9: #error "currently running kernel. They should only be" /usr/include/linux/version.h:10: #error "included via other system header files - user space" /usr/include/linux/version.h:11: #error "programs should not directly include <linux/*.h> or" /usr/include/linux/version.h:12: #error "<asm/*.h> as well." /usr/include/linux/version.h:13: #error "" /usr/include/linux/version.h:14: #error "To build kernel modules please do the following:" /usr/include/linux/version.h:15: #error "" /usr/include/linux/version.h:16: #error " o Have the kernel sources installed" /usr/include/linux/version.h:17: #error "" /usr/include/linux/version.h:18: #error " o Make sure that the symbolic link" /usr/include/linux/version.h:19: #error " /lib/modules/`uname -r`/build exists and points to" /usr/include/linux/version.h:20: #error " the matching kernel source directory" /usr/include/linux/version.h:21: #error "" /usr/include/linux/version.h:22: #error " o Now copy /boot/vmlinuz.version.h to" /usr/include/linux/version.h:23: #error " /lib/modules/`uname -r`/build/include/linux/version.h" /usr/include/linux/version.h:24: #error "" /usr/include/linux/version.h:25: #error " o When compiling, make sure to use the following" /usr/include/linux/version.h:26: #error " compiler option to use the correct include files:" /usr/include/linux/version.h:27: #error "" /usr/include/linux/version.h:28: #error " -I/lib/modules/`uname -r`/build/include" /usr/include/linux/version.h:29: #error "" /usr/include/linux/version.h:30: #error " instead of" /usr/include/linux/version.h:31: #error "" /usr/include/linux/version.h:32: #error " -I/usr/include/linux" /usr/include/linux/version.h:33: #error "" /usr/include/linux/version.h:34: #error " Please adjust the Makefile accordingly." /usr/include/linux/version.h:35: #error "======================================================="

4 4

RE: [suse-security] SuSE-FW-DROP-ANTI-SPOOFING IN
by Peer Stefan 05 Jun '02

05 Jun '02

hello, > From: Dr. Peter Bast [mailto:pb@infai.de] > Hello, > > I get permanently the following messages in my /var/log/messages: > > Jun 5 11:05:20 inis kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth0 OUT= > MAC= SRC=192.168.201.55 DST=192.168.201.255 LEN=32 TOS=0x00 PREC=0x00 > TTL=64 ID=0 DF PROTO=UDP SPT=520 DPT=520 LEN=12 > Jun 5 11:05:20 inis kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth1 OUT= > MAC= SRC=192.168.0.2 DST=192.168.0.255 LEN=32 TOS=0x00 > PREC=0x00 TTL=64 > ID=0 DF PROTO=UDP SPT=520 DPT=520 LEN=12 according to /etc/services udp-port 520 serves a routing protocoll. > > I use a Server with SuSE Linux 8.0 connected to a LAN via eth0 > (192.168.201.55) and to an externel ADSL-Router via eth1 > (192.168.0.2). > The LAN-IP of the Hardware-Router is 192.168.0.1. All Netmasks are set > to 255.255.255.0. The connections between the internal > Netdevice (eth0) > and the external Netdevice (eth1) are very slow. On the > Server running > BIND9, Squid Samba and Sendmail. did you enable routing in the kernel (i guess so) and do you need it? do you use a hub where eth0 is connected to the adsl-router? if you just want to get rid of the entries you have to configure /etc/rc.config.d/firewall2-custom.rc.config and add something like fw_custom_before_antispoofing() { iptables -A INPUT -j [DROP|ACCEPT] -p udp --dport 520 true } hope that helps you a bit. regards, stefan

2 1

IP alias and SuSE firewall
by Juergen.Mell＠t-online.de 05 Jun '02

05 Jun '02

Hi List, I need to configure our firwall machine for two different static IP addresses on the same ISDN dial-up interface. The configuration is: SuSE 7.1 SuSE Firewall 4.7 Kernel 2.2.19 I did already configure the alias address for the interface and I can ping or connect to services from the local machine. But any packet coming from the internet via the dial-up line to the secondary IP address is rejected by the firewall (pakets to the primary address pass normally). I tried to configure FW_DEV_WORLD = "ippp0 ippp0:0" but that did not help either. How can I tell the firewall script to accept pakets for the secondary address? Any help is greatly appreciated! Jürgen

2 1

SuSE-FW-DROP-ANTI-SPOOFING IN
by Dr. Peter Bast 05 Jun '02

05 Jun '02

Hello, I get permanently the following messages in my /var/log/messages: Jun 5 11:05:20 inis kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth0 OUT= MAC= SRC=192.168.201.55 DST=192.168.201.255 LEN=32 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=520 DPT=520 LEN=12 Jun 5 11:05:20 inis kernel: SuSE-FW-DROP-ANTI-SPOOFING IN=eth1 OUT= MAC= SRC=192.168.0.2 DST=192.168.0.255 LEN=32 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=520 DPT=520 LEN=12 I use a Server with SuSE Linux 8.0 connected to a LAN via eth0 (192.168.201.55) and to an externel ADSL-Router via eth1 (192.168.0.2). The LAN-IP of the Hardware-Router is 192.168.0.1. All Netmasks are set to 255.255.255.0. The connections between the internal Netdevice (eth0) and the external Netdevice (eth1) are very slow. On the Server running BIND9, Squid Samba and Sendmail. The follgenden firewall settings are used for SuSEfirewall2: FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="http https pop3 pop3s smtp telnet 53" FW_SERVICES_EXT_UDP="53" FW_SERVICES_INT_TCP="25 53 80 110 137 3128" FW_SERVICES_INT_UDP="53 137" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_SQUID="yes" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" I hope everybody can help.me..................... Thanks! Peter

1 0

Kaspersky AntiVirus Trouble - solved !?
by as_sec 04 Jun '02

04 Jun '02

Hi list, according to my posting this morning, i tried the same at home, ....it works fine (as you said Rainer) well, i tought my SuSE at work is similar to my home box (wrong!), now i am looking for the differences....thanx so far to all Andreas

1 0

VPN-Connection.
by Benjamin.Grogg＠isc-ejpd.admin.ch 04 Jun '02

04 Jun '02

Hi, I can established a VPN-Connection from the Internet through my Firewall to my VPN-Server (SuSE 8.0 Kernel 2.4.18). The Authenticate works correctly. The only wrong thing is that I loose my connection after a few seconds. Log-File: pppd[22572]: sent [LCP EchoReq id=0x4 magic=0xe5e560e9] pppd[22572]: rcvd [LCP EchoRep id=0x4 magic=0x16f709d7] pppd[22572]: sent [LCP EchoReq id=0x5 magic=0xe5e560e9] pppd[22572]: rcvd [LCP EchoRep id=0x5 magic=0x16f709d7] pppd[22572]: sent [LCP EchoReq id=0x6 magic=0xe5e560e9] pppd[22572]: sent [LCP EchoReq id=0x7 magic=0xe5e560e9] pppd[22572]: sent [LCP EchoReq id=0x8 magic=0xe5e560e9] pppd[22572]: No response to 3 echo-requests pppd[22572]: Serial link appears to be disconnected. pppd[22572]: cbcp_lowerdown pppd[22572]: Script /etc/ppp/ip-down started (pid 22621) Summary of lsmod : ppp_async 6080 0 (autoclean) ppp_mppe 20128 0 ppp_generic 14984 0 [bsd_comp ppp_async ppp_mppe] Last but not least the option-file : name mein_server_name lock mtu 1490 mru 1490 proxyarp auth +chap #+chapms +chapms-v2 ipcp-accept-local ipcp-accept-remote lcp-echo-failure 3 lcp-echo-interval 5 deflate 0 mppe-128 mppe-stateless debug What's wrong with my config? Why I loose always my connection? Thanks in advance Rocksteady

1 0

Passwords displayed in clear text upon expiring
by michael stone 04 Jun '02

04 Jun '02

When adding a new user, I set their password as expired so they have to change it at first login. chage -d 0 <username> But at their first login, when it prompts for the old password then the new one, they are echoed. Bug, or am I missing something? Thanks. -- Michael Stone Linux / High Performance Computing Administrator The University of Texas at Austin Mechanical Engineering Department ETC 3.130 ph: 471.5951 agentsmith(a)mail.utexas.edu

3 3

Re: [SLE] Re: [suse-security] NSA SELinux
by JW 03 Jun '02

03 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 JM >JW writes: JM >I Hope this helps, it is hard to tell what this thread is about. It is about applying the SE Linux security patches to the the SuSE kernel 2.4.18 for 8.0. Currently, the NSA (the SE-Linux authors) work with RedHat. Some work has ben done before on patchign a SuSEsystem to work with SE-Linux, but no one has (yet) gotten very far. I dearly hope to change that... - -- - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE89/3sQ5u80xXOLBcRAgksAJ4lLaPamFTUx/hkhZOJn+lqdv/2uQCfRQKE w5WGBDPonWHvtpiI++rKp00= =YSZC -----END PGP SIGNATURE-----

3 6

How to go about mixing kernel patches...
by JW 03 Jun '02

03 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I hope no one minds tme posting this here, if you do, flame away. My first difficulty is applying the SE Linux patch to the SuSE-patched kernel. I applied lsm-2.4-2002050211.patch.gz to vanila 2.4.18 and they apply perfectly. I applied it to linux-2.4.18-SuSE and got some errors, producing the following rejects: linux-2.4.18.SuSE/fs/dquot.c.rej linux-2.4.18.SuSE/fs/namei.c.rej linux-2.4.18.SuSE/fs/inode.c.rej linux-2.4.18.SuSE/mm/memory.c.rej linux-2.4.18.SuSE/mm/mprotect.c.rej linux-2.4.18.SuSE/mm/filemap.c.rej linux-2.4.18.SuSE/net/socket.c.rej linux-2.4.18.SuSE/arch/i386/kernel/entry.S.rej linux-2.4.18.SuSE/arch/ia64/kernel/entry.S.rej linux-2.4.18.SuSE/init/main.c.rej linux-2.4.18.SuSE/kernel/fork.c.rej linux-2.4.18.SuSE/kernel/sched.c.rej linux-2.4.18.SuSE/Makefile.rej linux-2.4.18.SuSE/include/linux/fs.h.rej Or if this helps any: jw:/work/dl/se_linux/se_build/linux-2.4.18.SuSE # zcat ../../opt5/all-opt-4-together/patches/lsm-2.4-2002050211.patch.gz | patch -s -p1 1 out of 3 hunks FAILED -- saving rejects to file Makefile.rej 1 out of 1 hunk FAILED -- saving rejects to file arch/i386/kernel/entry.S.rej 1 out of 1 hunk FAILED -- saving rejects to file arch/ia64/kernel/entry.S.rej Reversed (or previously applied) patch detected! Assume -R? [n] Apply anyway? [n] 1 out of 1 hunk ignored -- saving rejects to file fs/binfmt_elf.c.rej 1 out of 2 hunks FAILED -- saving rejects to file fs/dquot.c.rej 1 out of 3 hunks FAILED -- saving rejects to file fs/inode.c.rej 1 out of 22 hunks FAILED -- saving rejects to file fs/namei.c.rej 1 out of 6 hunks FAILED -- saving rejects to file include/linux/fs.h.rej 1 out of 2 hunks FAILED -- saving rejects to file init/main.c.rej 1 out of 4 hunks FAILED -- saving rejects to file kernel/fork.c.rej 1 out of 7 hunks FAILED -- saving rejects to file kernel/sched.c.rej 1 out of 3 hunks FAILED -- saving rejects to file mm/filemap.c.rej 1 out of 1 hunk FAILED -- saving rejects to file mm/memory.c.rej 1 out of 2 hunks FAILED -- saving rejects to file mm/mprotect.c.rej 1 out of 15 hunks FAILED -- saving rejects to file net/socket.c.rej At this point I'm presuming the the correct course of action is to diff those files one at a time between the "good" patched {.c|.h} files and the "bad" suse-patched {.c|.h} files. Would there be any benefit to try to do the opposite, i.e. apply the LSM patches first, and the SuSE patches second? I'm a little worried since I have to mix 3 patches actually. I suppose there's not much chance of the actual se-linux patches applying to my mixed lsm/suse kernel? Sorry to ask such basic questions, I've never had to do something like this before -- but I'm detirmined to do it right. If any one has advise as far as how to go about this, I'd really appreciate hearing from you. Thanks! - - -- - - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8+DebQ5u80xXOLBcRAnC3AJ0WJLFJ5BBvH+O1QR7vDKlrAjHj5QCgl7bT ptAtzKpfP4CohTP4UE7pwO4= =YSt4 -----END PGP SIGNATURE-----

5 7

Announce: Project to port SE Linux to SuSE 8.0
by JW 01 Jun '02

01 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I don't have any idea how far I'll get with this, but I've decided to at least try real hard to get SE Linux to work on SuSE. It seems that there's a few SuSE-users around (besides myself) who want to use SE Linux, so I've start a mailing list and web site hoping that maybe we can work together. Web site (nothing fancy): http://se-linux-suse.cedarcreeksoftware.com/ Mailing list: I don't have any listserve installed currently, so for now, if you want to "join" the mailing list just send me a message telling me what address you want subscribed, and I'll add you to the list. My idea is to post patches and RPMs to the web site as I (and others) manage to build them. If anyone already has anything (SuSE-specific) they want put up on the site, please send the files directly to me via email. If enough interest is shown, I expect to be able to get more "normal" file sharing/mailing list features, maybe CVS. I think this is good enough for now, until there's proven interest. If anyone is aware of any legal issues with this, please notify me ASAP. Since the project's only purpose is to collaborate with fellow SuSE users on SE-Linux, I think I should be fine, but I'd rather be safe then sorry. If possible, I would apprecite hearing from one of the NSA people that this is at least un-officially 'permissable' (I have no expectations of receiving official acknowledgment of any kind). Thanks... hopefully we'll get somewhere with this. - - -- - - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE8+Bz2Q5u80xXOLBcRArdiAJwNZSnJUQ9WYcCoCH80X0+NyodonwCeNn9O yMBPl8o5WLXSiFnbkG7n/0o= =GSnC -----END PGP SIGNATURE-----

1 1

port 1214
by PR 01 Jun '02

01 Jun '02

I can't find port 1214 in /etc/services but still I don't like the fact it is accepted. What should I do do have it dropeed or rejected? piet Jun 1 22:00:58 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=212.64.124.28 DST=213.17.34.237 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=16629 DF PROTO=TCP SPT=63959 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Jun 1 22:00:59 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=212.64.124.28 DST=213.17.34.237 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=18165 DF PROTO=TCP SPT=63960 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Jun 1 22:01:00 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=212.64.124.28 DST=213.17.34.237 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=19701 DF PROTO=TCP SPT=63961 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402) Jun 1 22:01:02 photoserver kernel: SuSE-FW-ACCEPTIN=ppp0 OUT= MAC= SRC=212.64.124.28 DST=213.17.34.237 LEN=48 TOS=0x00 PREC=0x00 TTL=121 ID=22517 DF PROTO=TCP SPT=63963 DPT=1214 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (0204058401010402)

2 3

IPCHAINS -> IPTABLES on SuSE 7.2
by chemiegott＠gmx.net 01 Jun '02

01 Jun '02

Dear Mailinglist ! On our SuSE 7.2-Webserver has IPCHAINS and SuSEfirewall run. Today I've updated from Kernel 2.2 to 2.4 and replaced IPCHAINS with IPTABLES and SuSEfirewall with SuSEfirwall2. All run very well, but one problem remains. With the old configurations, the Users inside my LAN (IP: 192.168.0.x) were able to connect the server (IP: 192.168.0.100 internal, IP:196.123.22.100 external) directly without a proxy or anything else. With the upgrade this is not possible anymore, but i don't want to change anything on the workstations. Do you have any idea, how the Users inside can reach 196.123.22.100 directy. I've tried it with masquerading, but it doesn't work. Thanx in advance, Michael -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 3