June 2002 - openSUSE Security - openSUSE Mailing Lists

VPN with pptp
by Markus Dahinden 17 Jun '02

17 Jun '02

Hi My pptp VPN connection between W2K and a SuSE Linux8.0 server (with SuSEfirewall2) seems to work (username and password are verified, PC is registered and authentificated). /var/log/messages tells me for the vpn-connection: .... - SuSE-FW-UNALLOWED-TARGETIN.........prot. 47...... (after launching vpn-connection) .... - SuSE-FW-DROP-ANTI-SPOOFIN.................DPT 139.... (after hitting network item) .... - SuSE-FW-DROP-ANTI-SPOOFIN.................DPT 139.... (after Start/run "\\192.168.x.y") - SuSE-FW-DROP-ANTI-SPOOFIN.................DPT 445.... These services (protocols and ports) are accessible according to my SuSEfirewall2 definitions. I opened theme in section 9.) I guess, this is the reason, that I don't see my samba shares on linux. Can someone give me a hand on this problem? Markus

8 13

Re: [suse-security] unknown network interface showed up suddenly
by christian.burri＠synecta.ch 17 Jun '02

17 Jun '02

One could think of some hacker that uses ifconfig to set up a virtual interface in order to use that with IRC bots or the like, but the problem here is that IPs which are off your netblock (given that you have a network with public IP addresses) are generally not routed to you, therefore it would be completely useless to set up such interface; one could not use it to connect to anywhere. Usually one can not even send out packets from a IP that is not inside the site's official netblock since most ISPs are now performing egress filtering on theyre border routers, allowing only traffic to pass to the outside that originates from the ISP's assigned IP range. Cheers Chris .-. /v\ L I N U X // \\ >I know KungFu!!< /( )\ ^^-^^ |--------+-----------------------> | | Markus Kohli | | | <markus@webde| | | ko.com> | | | | | | 17.06.2002 | | | 10:07 | | | | |--------+-----------------------> >--------------------------------------------------------------------------------------------------------------------------| | | | An: suse-security(a)suse.com | | Kopie: "Stefan Nauber" <stefan.nauber(a)cs2-informatik.de> | | Thema: Re: [suse-security] unknown network interface showed up suddenly | >--------------------------------------------------------------------------------------------------------------------------| > I'd bet it was some "sit 6" interface, or something like this. > Showed up on my laptop once, too. In my case it was related to an SSH-tunnel I > had openend. Could that match your case, too? > I just don't think some remote attacker installed a new interface... Doesn't > make to much sense IMO. > Greetz > Markus

1 0

Re: [suse-security] Filtering ports
by matthew zonderop 17 Jun '02

17 Jun '02

Hi Armin Ok thanx for the conformation..I was just a bit worried. So if I run the tcpd on the boxes that have the services then would they be filtered and should I use xinetd on those boxes.... matthew > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hi Matthew ! > > > for that command i get no such file or directory and the ports are > > 80 > - --> This is WWW (webserver) > > > 25 > - --> This is SMTP (for sending and receiving emails) > > > 110 > - --> This is POP3 (for fetching emails with POP3 from your POP3-server) > > > 443 > - --> This is HTTPS (secure WWW connection) > > So I guess you have set the following variable of your firewall: > FW_SERVICES_EXTERNAL_TCP="www smtp pop3 https" > > And it's ok that the ports are "unfiltered" because you want to have > these connections through your firewall. If you don't want this, > change the above setting and restart your firewall. > > By the way, the file firewall.rc.config should be in > /etc/rc.config.d/ > > Bye, > Armin > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: Weitere Infos: siehe http://www.gnupg.org > > iD8DBQE9DmIGG8Xv4GxznLoRAsoLAJ4y381eIoaRFy86r3DJi/1WRN+1gQCeLrsl > Hq/89DJ4DnIi+fNP09puTAU= > =4m4x > -----END PGP SIGNATURE----- > > >

1 0

Re: [suse-security] Filtering ports
by matthew zonderop 17 Jun '02

17 Jun '02

for that command i get no such file or directory and the ports are 80 25 110 443 matthew > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > > I run a normal set of rules configured with the SuSEfirewall2. Is there a > > particular section in which I should be looking..... > > Could you please send a list of the ports that are marked as > "unfiltered" (I guess it's not all ports that are marked like that) > and the output of the command > grep -v "^#" firewall.rc.config | grep -v "^$" > > Thanks, > Armin > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: Weitere Infos: siehe http://www.gnupg.org > > iD8DBQE9Dl2IG8Xv4GxznLoRAlpyAKCJy9jQf8fQkbZXzatsxnS1F+VaSwCfU7ep > YOKMfC0Q3Piz9hmInbVKFLs= > =h0Ck > -----END PGP SIGNATURE----- > > >

1 0

Re: [suse-security] Filtering ports
by matthew zonderop 17 Jun '02

17 Jun '02

I run a normal set of rules configured with the SuSEfirewall2. Is there a particular section in which I should be looking..... matthew > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > > On Mon, 17 Jun 2002, matthew zonderop wrote: > > > > I recently performed a scan using nmap on a suse firewall2 server that i > am > > working on. > > i did nmap -sA x.x.x.x it replied that the ports were open and unfiltered > =2E > > - --> Which ports were reported as "unfiltered" ? > > > know that this is not good? So could some one help me out on how I could > get > > these ports filtered...any ideas > > What ruleset/config options are you using for the firewall in your > firewall.rc.config ? > > Armin > > - -- > Am Hasenberg 26 office: Institut für Atmosphärenphysik > D-18209 Bad Doberan Schloss-Straße 6 > Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY > Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 > WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.6 (GNU/Linux) > Comment: Weitere Infos: siehe http://www.gnupg.org > > iD8DBQE9DlQiG8Xv4GxznLoRAqpEAKDXPypVLw3CWeJyrjZaJ77/frEpFQCggAUY > SFC5hh3u/fX9na5h94fyNas= > =PYGj > -----END PGP SIGNATURE----- > > >

1 0

Filtering ports
by matthew zonderop 17 Jun '02

17 Jun '02

Hi all, I recently performed a scan using nmap on a suse firewall2 server that i am working on. i did nmap -sA x.x.x.x it replied that the ports were open and unfiltered. I know that this is not good? So could some one help me out on how I could get these ports filtered...any ideas thanx matthew

1 0

unknown network interface showed up suddenly
by pr 17 Jun '02

17 Jun '02

an unknown network interface showed up with an unfamiliar ip-address at my box. is it possible someone sneaked in my box, though susefirewall2 is on? or was it a temp flaw in kde3 (controlcenter/information/network interface) piet

3 2

RE: [suse-security] VPN with pptp
by Reckhard, Tobias 17 Jun '02

17 Jun '02

> In the company, we have some very efficient C implementations. > They are small and their developers knew every bitshifting > feature of C. But here you have sometimes a set of a few lines > that look like that they make no sense. Others write "optimized > for reading" and I prefere that. Some programmers optimize for > source(!!) size, and I think that decreases the relialability. That may very well be and there are differences in the number of lines per error between different coders, of course. But for every one of them, the number of errors made increases with the number of lines they write, and be it merely due to simple typos. That's what the rule says. It does not compare one coder to another or one language to another. > > > Hum, why UDP? IPSec uses protocol 50,51 IIRC. > > > > Why not use UDP? What is the advantage of dedicated IP > protocols in this > > context? Note that I'm not against either one, which you > choose to use > > depends on design considerations. > > Yes, why not use UDP, and why not use anything other. I don't > think that this make a big difference. Exactly. Yet you'd asked. > Well, for me it's the same if you implement a protocol into UDP > payload or in another IP protocol. Well, UDP offers ports and > some things, but if you do not need them, why use UDP? Because it's already there and it's easy to code client and server components. There are more people that have experience writing UDP-capable software than that using ESP or AH. And you can't just invent a new IP protocol all by yourself.. Even if you could, it'd probably not be a very good idea. I'm not saying UDP is a better choice than ESP/AH, but for many coders, it's the better choice because it's something they have (at least some) experience with. > > Having said all that, I don't know if I'd agree that you > shouldn't use TCP > > to build tunnels. No reasons are given, unfortunately. > > When you have protocols that do not need any packet, for instance > a real-time monitor, then it's often better to drop packets > (since they are obsoleted by successors) than to repeat them over > wire and drop them in the target application. Well, same for > video or voice streams. Better a short quality reduction as very > high latency. Yes, I know when UDP is favourable over TCP generally, I meant the VPN situation specifically. In the meantime the original poster has given reasons that I can agree with. And since a VPN strives to offer a virtual IP connection, it makes sense to use a connectionless transport mechanism, as IP doesn't provide connections either. Cheers Tobias

1 0

suse web and ftp standalone firewall help
by Ash LWS 17 Jun '02

17 Jun '02

Hello everyone, as usual there are newbie's and alas I am one of those so please be patient while I learn. I am interested in stetting up a fire wall for my house network. There are 6 machines in total all running from a Linksys cable modem router that attaches to att@home cable modem. Below is a diagram and I assume that the firewall would go where the Linksys router is (since it forgets its config and requires a reset and re-config once every 2 weeks) box1 box2 box3 box4 box5 \ \ | / / \ \ | [HUB] \ \ | | ---------------------------------------------- | linksys router | ___________________________ | [cable modem] | (attbi) So I am wondering can and should I use SuSE 7.3 with a minimal install and very few services running including firewall2 (?), NAT, and DHCP. I do not need to access the machine remotely but I would like to packet filter except for basic web use including SSL and ftp and tftp. Games are not much of a concern. I have read a great deal about how a firewall should work "in theory" but I lack the practice of building one. I understand the basics of the rule sets but I do not want to leave something open of undone. Basically if anyone has done this for home use I would love to know how it works for you and if I should even peruse it at all or if I should use a different OS like OpenBSD or such. I hope that this post is warranted upon this newsgroup if it is not please let me know. Sincerely, Ash ash(a)lightwave-systems.net

2 1

Re: [suse-security] suse web and ftp standalone firewall help
by bliss＠attbi.com 17 Jun '02

17 Jun '02

I have done it very successfully. With my setup I am using SuSE Firewall2 and Squid Proxy server. I currently have it setup as a caching proxy and am planning to end the caching and start using it as a plain pass through proxy. I did not have to worry about NAT. DHCP is supposed to be very easy to setup now (since the breakup of ATT and @home). I previously had to setup the machine name to be passed to their DHCP server. But this supposedly is not necessary anymore. The Firewall2 sample files should get you through its setup very well. You do not need a heck of a lot setup in there as I remember (other than most of the default settings which shut most everything down). I am running some services for external consumption so my settings are different from what you are looking for. Give it a try. I think you will find that it is a very good, pleasant learning experience. I was able to do most everything from the documents and did not have to fall back to the list for help. But, you can always post to the list. A better list than the security list would be the plain SuSE English list. It has a great bunch of guys on it. I am off that list now since I do not have time to go through the vlume of mail it generates. Good luck. Jim > Hello everyone, as usual there are newbie's and alas I am one of those so please > be patient while I learn. > > I am interested in stetting up a fire wall for my house network. There are 6 > machines in total all running from a Linksys cable modem router that attaches to > att@home cable modem. Below is a diagram and I assume that the firewall would > go where the Linksys router is (since it forgets its config and requires a reset > and re-config once every 2 weeks) > > box1 box2 box3 box4 box5 > \ \ | / / > \ \ | [HUB] > \ \ | | > ---------------------------------------------- > | linksys router | > ___________________________ > | > [cable modem] > | > (attbi) > > So I am wondering can and should I use SuSE 7.3 with a minimal install and very > few services running including firewall2 (?), NAT, and DHCP. I do not need to > access the machine remotely but I would like to packet filter except for basic > web use including SSL and ftp and tftp. Games are not much of a concern. I > have read a great deal about how a firewall should work "in theory" but I lack > the practice of building one. I understand the basics of the rule sets but I do > not want to leave something open of undone. > > Basically if anyone has done this for home use I would love to know how it works > for you and if I should even peruse it at all or if I should use a different OS > like OpenBSD or such. > > I hope that this post is warranted upon this newsgroup if it is not please let > me know. > > Sincerely, Ash > ash(a)lightwave-systems.net >

1 0