June 2002 - openSUSE Security - openSUSE Mailing Lists

Fwd: Re: [suse-security] unknown network interface appear
by pr 16 Jun '02

16 Jun '02

---------- Forwarded Message ---------- Subject: Re: [suse-security] unknown network interface appear Date: Sun, 16 Jun 2002 22:30:51 +0200 From: pr <prooroa(a)wanadoo.nl> To: Juergen Braukmann <juergen.braukmann(a)ruhr-west.de> On Sunday 16 June 2002 18:29, you wrote: the name of the two phantom interfaces were weird caracters, the network was down, but adsl-status proved it was up. two ip adresses: 192.203.255.191 and 52.228.255.191 the latter disappeared and showed up again piet > PR schrieb: > > an unknown network interface showed up with an unfamiliar ip-address at > > my box. > > is it possible someone sneaked in my box, though susefirewall2 is on? > > or was it a temp flaw in kde3 (controlcenter/information/network > > interface) piet > > Hi Piet, > > this is difficult to tell, unless someone of the group is able to hack > into your box to find out the interface name and it's IP address and > those IF's that sould be there. ;- (just kidding, but give us the names > and a bit more information) > > Juergen -------------------------------------------------------

1 0

suse web and ftp standalone firewall help
by Ash LWS 16 Jun '02

16 Jun '02

Hello everyone, as usual there are newbie's and alas I am one of those so please be patient while I learn. I am interested in stetting up a fire wall for my house network. There are 6 machines in total all running from a Linksys cable modem router that attaches to att@home cable modem. Below is a diagram and I assume that the firewall would go where the Linksys router is (since it forgets its config and requires a reset and re-config once every 2 weeks) box1 box2 box3 box4 box5 \ \ | / / \ \ | [HUB] \ \ | | ---------------------------------------------- | linksys router | ___________________________ | [cable modem] | (attbi) So I am wondering can and should I use SuSE 7.3 with a minimal install and very few services running including firewall2 (?), NAT, and DHCP. I do not need to access the machine remotely but I would like to packet filter except for basic web use including SSL and ftp and tftp. Games are not much of a concern. I have read a great deal about how a firewall should work "in theory" but I lack the practice of building one. I understand the basics of the rule sets but I do not want to leave something open of undone. Basically if anyone has done this for home use I would love to know how it works for you and if I should even peruse it at all or if I should use a different OS like OpenBSD or such. I hope that this post is warranted upon this newsgroup if it is not please let me know. Sincerely, Ash ash(a)lightwave-systems.net

1 0

filtered ports
by matthew zonderop 16 Jun '02

16 Jun '02

Hi all, I recently performed a scan using nmap on a suse firewall2 server that i am working on. i did nmap -sA x.x.x.x it replied that the ports were open and unfiltered. I know that this is not good? So could some one help me out on how I could get these ports filtered...any ideas thanx matthew

1 0

YAST2 not restarting services
by Graham Murray 16 Jun '02

16 Jun '02

Would it not be a good idea, from a security point of view, for YAST2 to restart dæmons after it has updated them?

2 1

RE: [suse-security] VPN with pptp
by Reckhard, Tobias 16 Jun '02

16 Jun '02

While I agree that IPSec should be favoured over PPTP, I have to make a few comments about this last post. > > The simpler it is the better I like it (both from a > maintenance as well > > as a security point of view). > > That is an important point I think! But IPSec is straight-forward, > but of course you need to read half a page about IPSec to > understand it. Well, there are multiple "modes" for IPSec > operation and so on, at least here is potential for > misconfigurations or such. I don't think that's specific to IPSec, but to all VPN solutions. There isn't a lot to get wrong configuration-wise that's IPSec-specific and that'll get the connection sort of running. It's more of it either works or doesn't at all. However, IPSec isn't that straightforward... CIPE is definitely a lot simpler by pure design. Hmm, thinking about that, it probably would be possible to use IPSec pretty much the same way and keep it almost as simple (still using ESP instead of UDP, though). FreeS/WAN is also not as clean a package as many would like. It's good enough, though, to prefer it to PPTP, IMHO. > > Complex -> much code -> many bugs. > > This rule is definitly wrong. The number (and kind) of bugs > depend on the quality which itselfs depend on the software > creation processes. And many small "hacked-in" things are > horrible :) I disagree, the general rule is quite right. Of course there are ways to reduce the number of bugs even in complex projects, but it is the rule that more lines of code mean more bugs. Theoretically, of course, the number of lines per bug can be extended to infinity, which means that there'll be no bug at all in the associated code, but I think we all agree that this is a truly entirely theoretical and unrealistic proposition. > > Also have a look at cipe. [snip] > > - It runs on most Microsoft platforms. > > Well, for Win it may be ok, and insecure VPN for insecure > systems :) SCNR. He's talking about CIPE, not PPTP. > > - It uses UDP for transport (never use TCP for serious tunnelling). > > Hum, why UDP? IPSec uses protocol 50,51 IIRC. Why not use UDP? What is the advantage of dedicated IP protocols in this context? Note that I'm not against either one, which you choose to use depends on design considerations. It is definitely easier and less hassle to make use of an existing protocol that's in widespread use, such as UDP, instead of applying for another IP protocol.. > Well, tunneling UDP > Packets in a TCP tunnel would dramaticall increase the reliance > :) Not that much, really. If UDP packets get lost between two nodes, TCP packets will almost certainly share their fate. The difference between TCP and UDP is that TCP will notice that packets have been lost and keep trying to retransmit them, while UDP alone won't. If the connection really is bad, though, TCP doesn't have any higher chances of success than UDP. And quite frequently, the application using UDP will take care of TCP's job. This is true for most, if not all of the applications that use UDP in a connection-oriented manner. Having said all that, I don't know if I'd agree that you shouldn't use TCP to build tunnels. No reasons are given, unfortunately. > > - It's got one small config file (and even that causes > enough problems > > to those who don't know - their networking basics). > > Without knowledge noone should start :) Amen! Cheers Tobias

2 1

RE: [suse-security] inittab entry
by Karl.Klingler＠dr-stahl.de 14 Jun '02

14 Jun '02

Hi, it's very usefull if you have a heterogenous network (mixed NT- and linux-workstations), because you get used to hit first those three keys if the screensaver has kicked in and you usualy work at an NT-workstation... you don't really want to reboot say your samba server that often.. karl > -----Ursprüngliche Nachricht----- > Von: Olson, John C [mailto:John.Olson@nationalcity.com] > Gesendet: Freitag, 14. Juni 2002 15:45 > An: 'suse-security(a)suse.com' > Betreff: [suse-security] inittab entry > > > Hello, > > Was concerned about the control-alt-delete entry in the > default /etc/inittab > file. Was curious to hear if good practice was typically to > remove this > entry entirely or replace the shutdown command with something > else. Please > let me know. > > > Thanks, > > John > > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

3 2

SuSEfirewall2 and IPtables setup
by Huseyin Selan 14 Jun '02

14 Jun '02

Dear all, I am in need of an urgent help. I have a Suse Linux box and using SuSEfirewall2. I want to use one of the computers in the LAN as FTP server. Let's assume that FTP server IP = 192.168.1.1 (in Local) FTP server IP = 1.2.3.4 (real IP) Firewall IP = 1.2.3.3 (real IP) I want to say that users coming from internet for ftp to the IP of 1.2.3.4 go to the IP of 192.168.1.1 Thnx ----------------------------------------------------------- Huseyin Selan Technical Consultant Enterprise Servers&Systems Infrastructure & Systems Business Unit Bull Bilgisayar Teknoloji A.S. Phone: +90 212 274 7921 274 3571 275 1775 Fax: +90 212 275 1662 ==============================

2 1

[suse-security] inittab entry
by Olson, John C 14 Jun '02

14 Jun '02

Hello, Was concerned about the control-alt-delete entry in the default /etc/inittab file. Was curious to hear if good practice was typically to remove this entry entirely or replace the shutdown command with something else. Please let me know. > Thanks, > John >

3 2

RE: [suse-security] VPN with pptp
by Reckhard, Tobias 14 Jun '02

14 Jun '02

> to add another view to this > what if you have a provider that do not route type 50 packets? > you have to use cipe! > I myself use it - and its ok I don't find it acceptable for a provider to refuse to route IP. I'd swap providers. It's as simple as that. Cheers Tobias

1 0

RE: [suse-security] susefirewall2 logfile entry
by Peer Stefan 14 Jun '02

14 Jun '02

hi > From: Wolfgang Schaefer [mailto:wolfgang@schaefers-hope.de] > >>> how can i change the logfile entry's to the old style? > >>> since 3 month i have suse8 and susefirewall2 in use. > >>> all works fine, but the style of the logfile entry's is > >>> not the same like susefirewall"1" !! > > >>SuSEfirewall1 used ipchains and susefirewall2 uses > iptables. I don't think > >>that the log format can be changed. > > > >but, why is there an parameter FW_LOG="..." ?? > >the logfile are very confused, how can i make it easily too > understand? > > > > have nobody read the firewall-log anytime ! strange! > or, nobody uses the SuSEfirewall2 ? well, i don't think it's a matter of not using suse-firewall2 or not reading the logs but accepting the new iptables log-format :-) there is the parameter FW_LOG, which uses iptables logging options like --log-level etc. if you want to adapt your log-format read 'man iptables' and search for LOG to get an overview of available log-options and pick those you need. regards, stefan

3 2