June 2002 - openSUSE Security - openSUSE Mailing Lists

IPChains and IPv6
by Mark Tinka 10 Jun '02

10 Jun '02

hi list... i have recently installed SuSE Linux 8.0 Pro, and everything seems to be working fine except for the network... i setup some IPChains scripts that i have been using for a long time on my other SuSE 7.2 Pro servers, and they seem to be taken by 8.0 with no problem.. but running them causes the machine not to talk to the network... disabling the IPChains gets the network back, but routing or DNS, or both don't work at all... i can't resolve any names.... i did some looking around and discovered that 8.0 is heavy on IPv6... IPv6 was running ontop of IPv4 and along IPv4 on the network interface and various other apps ... i disabled the ipv6.o module from loading in /etc/modules.conf, and the interface is now talking only INET, and not INET6 .. but i still can't route or resolve, or get network access with the IPChains loaded.. any ideas...?.. i am running kernel 2.2.19-162 .. many thanks.. AKNIT __________________________________________________ Do You Yahoo!? Everything you'll ever need on one web page from News and Sport to Email and Music Charts http://uk.my.yahoo.com

2 2

RE: [suse-security] Ipchains Issue
by Peer Stefan 10 Jun '02

10 Jun '02

> From: Terence [mailto:terencel@sunway.edu.my] > Thanks Stefan, you're welcome :-) > > Is the same thing happening when I connect? If I'm allowing > my host say, > 172.16.0.5 to connect (speficied in the input rule) and the > "deny the rest" > command set, it takes about 30 seconds-1 minute for me to > connect. Once I'm > connected there's no problem. I checked the man pages and > there's no option > (if in fact it's also doing lookups on a connect). Any ideas? hmm, i'm not sure 'bout that one ... perhaps it's looking hostnames up for logging? you can always enter the specified hosts in you're /etc/hosts -file, that will speed things up. regards, stefan

1 0

Re: [suse-security] Ipchains Issue
by Terence 10 Jun '02

10 Jun '02

Thanks Stefan, Is the same thing happening when I connect? If I'm allowing my host say, 172.16.0.5 to connect (speficied in the input rule) and the "deny the rest" command set, it takes about 30 seconds-1 minute for me to connect. Once I'm connected there's no problem. I checked the man pages and there's no option (if in fact it's also doing lookups on a connect). Any ideas? Thanks Terence ----- Original Message ----- From: "Stefan Nauber" <stefan.nauber(a)cs2-informatik.de> To: "'Terence'" <terencel(a)sunway.edu.my>; <suse-security(a)suse.com> Sent: Friday, June 07, 2002 6:22 PM Subject: RE: [suse-security] Ipchains Issue Hi, yes you are right. Just do ipchains -L -n to avoid reverse lookups. Greetings, Stefan > -----Original Message----- > From: Terence [mailto:terencel@sunway.edu.my] > Sent: Friday, June 07, 2002 12:09 PM > To: suse-security(a)suse.com > Subject: [suse-security] Ipchains Issue > > > hi, > > I have the following setup on ipchains (simplified) > > step 1: Set all policies to deny > ipchains -A input -i ! lo -j DENY > ipchains -A output -i ! lo -j DENY > > step 2: Allow whatever else. > ipchains -A input ...... ACCEPT > > step 3: Add the following line (to reject everything else): > > ipchains -A input -j REJECT > > step 4: Restore default policies > > The problem is with step 3. After I run the script, I type in > "ipchains -L" > which takes forever to execute. The same when I try to > connect to my box. > Now I suspect that it might be doing reverse lookups on the > dns. Am I right > or is thre something wrong with my assumption of ipchains? > > thanks to anyone who can help > rgds > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

[suse-security] Re: Konfiguration DSL bei SuSE 8.0
by Bill.Light＠kp.org 09 Jun '02

09 Jun '02

English list only..... Perhaps you require search somedomain Before your name servers ? Mein deutsche is schlect and I probably should not have replied. - Bill ----- Forwarded by Bill Light/CA/KAIPERM on 06/09/02 02:03 PM ----- as_sec <as_sec(a)web.de> Sent by: as_sec(a)web.de 06/09/02 08:18 AM To: suse-security(a)suse.com cc: Subject: [suse-security] Re: Konfiguration DSL bei SuSE 8.0 hi, ich hab zwar kein DSL und nur 7.3 , aber die resolv.conf bestimmt, welche Nameserver zur Auflösung genutzt werden... /etc/resolv.conf nameserver 62.96.128.66 (z.B Addcom NS) nameserver 145.253.2.75 (z.B Arcor NS) gruss Andreas P.S. aber eigentl sollte der nächstliegende NS gewählt werden, so sollte die Namesauflösung am schnellsten gehen, und der nächste ist halt der NS des Providers...?! -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: Konfiguration DSL bei SuSE 8.0
by as_sec 09 Jun '02

09 Jun '02

hi, ich hab zwar kein DSL und nur 7.3 , aber die resolv.conf bestimmt, welche Nameserver zur Auflösung genutzt werden... /etc/resolv.conf nameserver 62.96.128.66 (z.B Addcom NS) nameserver 145.253.2.75 (z.B Arcor NS) gruss Andreas P.S. aber eigentl sollte der nächstliegende NS gewählt werden, so sollte die Namesauflösung am schnellsten gehen, und der nächste ist halt der NS des Providers...?!

1 0

Fw: [suse-security] Problem SuSEfirewall2 or Harden_Suse
by Piotr Flakus 08 Jun '02

08 Jun '02

harden_suse is making changes in /etc/ssh/sshd_config and this is your problem I have the same situation 2 weeks ago No remote ssh connection as root nor "su" command works. PF > > Ricardo Javier Aranibar León wrote: > > > > [...] > > > I had to stop SuSefirewall2 and I can to into my computer using ssh, but > I > > > don't like stop my firewall. > > > > It seems to me, that You have to permit the port for ssh in Your > > SuSEfirewall2.config > > > > I am far away from an expert to SuSEfirewall2 but > > everything You do not permit explicitly, is forbidden. > > > > If I am right You have to open port 22 on both, internal and external > interface. > > [...] > > > Pd: Sorry for my enghish but I understand it. > > Fine for You! I hope You understand my personal version of that language! > ;-) > > > > > > -- > > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here >

1 0

[suse-security] Problem SuSEfirewall2 or Harden_Suse
by Ricardo Javier Aranibar León 08 Jun '02

08 Jun '02

Hi List, I modify the following archives: /etc/hosts.allow /etc/hosts.deny In /etc/hosts.allow I added the following line: sshd: ALL In /etc/host.deny, Only block the following line: #ALL: ALL Except localhost With this way I can to do access remote, but I re-started my computer and I can't have access remote. I had to stop SuSefirewall2 and I can to into my computer using ssh, but I don't like stop my firewall. Please I need your help with this. Maybe I read about Harden_suse and don't recommend to block the line #ALL: ALL Except localhost. I only like use ssh, and others service I don't like to use, please help me. Pd: Sorry for my enghish but I understand it. >This is a FAQ. Harden_suse closes a lot. >To solve this, go over the options in /etc/hosts.allow, >/etc/ssh/sshd.conf and (possibly) /etc/login.defs >And of course -but you did that, right(?)- /var/log/messages... > >Maarten _________________________________________________________________ Envíe y reciba su correo de Hotmail desde el móvil: http://mobile.msn.com

2 1

Antw: [suse-security] Problem SuSEfirewall2 or Harden_Suse
by Milan Goellner 07 Jun '02

07 Jun '02

harden_suse modifies /etc/hosts.deny to include everything external >>> "Ricardo Javier Aranibar León" <ricardo_jal(a)hotmail.com> 06.06.02 19:09:21 >>> Hi list, I installed SuSEfirewall2 and Harden_suse, Before I can to connect me to my box linux from a remote computer using ssh or with windows with putty. Now I can't to connect me from a remote computer. If somebody can help me i will thankfull

2 1

RE: [suse-security] Ipchains Issue
by Peer Stefan 07 Jun '02

07 Jun '02

you can skip reverse lookups by using 'ipchains -L -n' regards, stefan > From: Terence [mailto:terencel@sunway.edu.my] > hi, > > I have the following setup on ipchains (simplified) > > step 1: Set all policies to deny > ipchains -A input -i ! lo -j DENY > ipchains -A output -i ! lo -j DENY > > step 2: Allow whatever else. > ipchains -A input ...... ACCEPT > > step 3: Add the following line (to reject everything else): > > ipchains -A input -j REJECT > > step 4: Restore default policies > > The problem is with step 3. After I run the script, I type in > "ipchains -L" > which takes forever to execute. The same when I try to > connect to my box. > Now I suspect that it might be doing reverse lookups on the > dns. Am I right > or is thre something wrong with my assumption of ipchains? > > thanks to anyone who can help > rgds > > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

RE: [suse-security] IP alias and SuSE firewall
by Peer Stefan 07 Jun '02

07 Jun '02

hi > Aliases in IPTABLES and IPCHAINS do not know aliases. There's no > ippp0:0, only ippp0. You can only distiguish by ip: > -i ippp0 -s 10.0.0.0/8 > and > -i ippp0 -s 172.16.0.0/12 > or something like that. > > Got no clue about SuSE firewall though, but there's no way around the > alias limitiation. FW_DEV_EXT="eth0 eth0:0 eth0:0:1" works (SuSEfirewall2), but SuSEfirewall2 uses IP-addresses, not interfaces - therefore it's a bit tricky with dhcp-addresses ;-) another funny thing is the wildcard character '+': * "iptables -A INPUT -j ACCEPT -i 'eth0:0' -d 10.100.4.216" does not work. * "iptables -A INPUT -j ACCEPT -i 'eth0+' -d 10.100.4.216" works for eth0:0 but not for eth0 (if you have just one virtual interface) regards, stefan

2 1