June 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] nmap
by arawak 06 Jun '02

06 Jun '02

I've read the online man page but nothing there would get the format correct I require. I'm trying to use a file txt with a list of 194.x.x.x/24 etc & 213.x.x.x/28 etc, to my get my output parsed. So far I use this command "nmap -v -v -oN c:\test -sP 194.183.x.x./27". But I want to use a file with a lot of similar addresses against nmap. Dre :) > -----Original Message----- > From: Ste [mailto:estebantodoloco@inwind.it] > Sent: 05 June 2002 17:58 > To: arawak > Subject: Re: [suse-security] nmap > > > Alle 18:27, mercoledì 5 giugno 2002, arawak ha scritto: > > What would the command options to get this type of output > using Nmap. > [cut] > > I'm new to the scanning with nmap... But I want to learn. > > man nmap > > > Dre .. > > >

6 8

Problem SuSEfirewall2 or Harden_Suse
by Ricardo Javier Aranibar León 06 Jun '02

06 Jun '02

Hi list, I installed SuSEfirewall2 and Harden_suse, Before I can to connect me to my box linux from a remote computer using ssh or with windows with putty. Now I can't to connect me from a remote computer. If somebody can help me i will thankfull _________________________________________________________________ Únase con MSN Hotmail al servicio de correo electrónico más grande del mundo. http://www.hotmail.com

3 2

Re: Re: Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem
by BLeonhardt＠analytek.de 06 Jun '02

06 Jun '02

try this ... echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Robert Szentmihalyi <robert.szentmihalyi(a)entracom.de> 06.06.02 14:59 An: andre <andre(a)andre.co.za> Kopie: suse-security(a)suse.com Thema: Re: Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem On Thursday, 6. June 2002 14:32, andre wrote: > On Thu, 2002-06-06 at 14:25, Robert Szentmihalyi wrote: > > On Thursday, 6. June 2002 14:10, BLeonhardt(a)analytek.de wrote: > > > ... hmmm ... a silly question : > > > > > > ... did you do : echo 1 > /proc/sys/net/ipv4/ip_forward ? > > > ... on your firewall > > > > Yes, of course :-) > > > > IP forwarding is active and has always been (I said that in my > > original posting), but I still can't access the web server > > behind the firewall :-( > > didn't the proxyarp work ? I am just looking into that issue. I have found this on the net: http://www.sjdjweis.com/linux/proxyarp/ According to this, enabling proxy_arp on the web server is only half the job. At the moment, I am trying to configure ARP on the firewall. Perhaps you have a quick example that fits my setup? > > krgds, > > andre Thanks, Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem
by Robert Szentmihalyi 06 Jun '02

06 Jun '02

On Thursday, 6. June 2002 14:32, andre wrote: > On Thu, 2002-06-06 at 14:25, Robert Szentmihalyi wrote: > > On Thursday, 6. June 2002 14:10, BLeonhardt(a)analytek.de wrote: > > > ... hmmm ... a silly question : > > > > > > ... did you do : echo 1 > /proc/sys/net/ipv4/ip_forward ? > > > ... on your firewall > > > > Yes, of course :-) > > > > IP forwarding is active and has always been (I said that in my > > original posting), but I still can't access the web server > > behind the firewall :-( > > didn't the proxyarp work ? I am just looking into that issue. I have found this on the net: http://www.sjdjweis.com/linux/proxyarp/ According to this, enabling proxy_arp on the web server is only half the job. At the moment, I am trying to configure ARP on the firewall. Perhaps you have a quick example that fits my setup? > > krgds, > > andre Thanks, Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de

1 0

Re: Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem
by BLeonhardt＠analytek.de 06 Jun '02

06 Jun '02

... hmmm ... a silly question : ... did you do : echo 1 > /proc/sys/net/ipv4/ip_forward ? ... on your firewall Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Robert Szentmihalyi <robert.szentmihalyi(a)entracom.de> 06.06.02 13:45 An: BLeonhardt(a)analytek.de Kopie: suse-security(a)suse.com Thema: Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem On Thursday, 6. June 2002 13:11, BLeonhardt(a)analytek.de wrote: > > ME: shouldn't the gateway ip be x.x.x.146 ??? the webserver is > connected on (cross over) eth0 ( x.x.x.146 ) ... usually > x.x.x.146 is ME: the standard gateway for the webserver ... am > i wrong ??? That is what I had tried in the first place, but it doesn't work: The web server is not reachable from the other side of the firewall. > > >Also, I don't understand, WHY the gateway should be > > 62.245.134.144. Could somebody please shed some light on that? > > > >> Cheers > >> > >> Thiemo > > Thanks for your help, > Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: Re: AW: [suse-security] Firewall Routing/Forwarding Problem
by BLeonhardt＠analytek.de 06 Jun '02

06 Jun '02

see below .. Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de Robert Szentmihalyi <robert.szentmihalyi(a)entracom.de> 06.06.02 12:24 An: Thiemo Kellner <thiemo(a)gmx.ch>, suse-security(a)suse.com Kopie: Thema: Re: AW: [suse-security] Firewall Routing/Forwarding Problem On Thursday, 6. June 2002 07:55, Thiemo Kellner wrote: > Hi, >> >> > > The firewall's NICs are configured as follows: >> > > eth0 62.245.134.130 netmask 255.255.255.240 >> > > connected directly to the web server via a cross-over cable >> > >> > should not the default gateway of your webserver be >> > 62.245.134.144 instead of 62.245.134.146? >> >> As the NIC to which the web server is connect has 62.245.134.130, >> I'd rather say that the web server's default gateway ought to be >> 62.245.134.130. Try to ping 62.245.134.146 and 62.245.134.144 >> and see iff you can reach them. >Sorry, I mixed hat up yesterday. >The firewall's interfaces are actually configured like this: >eth0 62.245.134.146 netmask 255.255.255.240 >eth1 62.245.134.130 netmask 255.255.255.240 >and the web server is connected to eth0, i.e. 62.245.134.146 >I guess I have been working on this for too long... >I have tried to set the gateway of the web server to >62.245.134.144, but when routing is set up at boot time, I get a >"network unreachable" error, athough I can ping 62.245.134.144. >Any ideas? ME: shouldn't the gateway ip be x.x.x.146 ??? the webserver is connected on (cross over) eth0 ( x.x.x.146 ) ... usually x.x.x.146 is ME: the standard gateway for the webserver ... am i wrong ??? >Also, I don't understand, WHY the gateway should be 62.245.134.144. >Could somebody please shed some light on that? >> >> Cheers >> >> Thiemo Thanks for your help, Robert -- Where do you want to be tomorrow? Entracom. Building Linux systems. http://www.entracom.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

AW: [suse-security] Firewall Routing/Forwarding Problem
by Klingler, Karl 06 Jun '02

06 Jun '02

Hi, should not the default gateway of your webserver be 62.245.134.144 instead of 62.245.134.146? karl > -----Ursprüngliche Nachricht----- > Von: Robert Szentmihalyi [mailto:robert.szentmihalyi@entracom.de] > Gesendet: Mittwoch, 5. Juni 2002 14:50 > An: suse-security(a)suse.com > Betreff: [suse-security] Firewall Routing/Forwarding Problem > > > Hi, > > I have a strange problem which I have been debugging > unsuccessfully for two days now. Perhaps one of you can help. > > We have a web server (SuSE Linux 7.3) behind a firewall > (SuSE Linux 7.1) with iptables filtering rules. > > The firewall's NICs are configured as follows: > > eth0 62.245.134.130 netmask 255.255.255.240 > connected directly to the web server via a cross-over cable > eth1 62.245.134.146 netmask 255.255.255.240 > connected to the internet > > route -n tells > > Destination Gateway Genmask Flags Metric Ref Use Iface > 62.245.134.128 0.0.0.0 255.255.255.240 U > 0 0 0 eth1 > 62.245.134.144 0.0.0.0 255.255.255.240 U > 0 0 0 eth0 > 0.0.0.0 62.245.134.129 0.0.0.0 UG > 0 0 0 eth1 > > > 62.245.134.129 is the gateway IP address assigned to us by the ISP. > > The web servers NIC is configured as > eth0 62.245.134.145 netmask 255.255.255.240 > > and the routing table looks like this: > Destination Gateway Genmask Flags Metric Ref Use Iface > 62.245.134.144 0.0.0.0 255.255.255.240 U > 0 0 0 eth0 > 62.245.134.144 0.0.0.0 255.255.255.240 U > 0 0 0 eth0 > 0.0.0.0 62.245.134.146 0.0.0.0 UG > 0 0 0 eth0 > > The problem is that the web server is not reachable on from > the other side of the firewall although IP forwarding is > activeated on the firewall. > > I don't think the problem is related to the filtering rules, > but I can post the script if neccessary. > > Am I missing something? > Do I have to configure the firewall as an ethernet bridge for > this to work? > > Any hint is appreciated. > Thanks, > Robert > > -- > Where do you want to be tomorrow? > > Entracom. Building Linux systems. > http://www.entracom.de > > -- > To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

3 2

Help for Installing a VPN wanted
by Wilfried Philippi 06 Jun '02

06 Jun '02

Hello, i wan't to install a VPN for secure administration of the Linux Server and need a little bit of info. I don't know is this here OT. When it is then plese give me sources eg. Webadresses please. Installation of the Linux and Windows programs is ok. I have the PPTP server so configured the listenadress is : 192.168.1.1, the serveradress is: 192.168.2.1 and the VPN Network is : 192.168.2.0 so the Dial in Clent has an IP 192.168.2.2 - 250 My questions are: 1. The Windows clients are so configured that the Standard Gateway for the real Network is 192.168.1.1. How can i say to windows( Clients uses 2000 professional and Win98) that it uses the Dial in Connection and not the Standard Gatway for the Connection? 2. When i connect the server via telnet, ssh or Webmin via the VPN Connection what adress for the Server must i use 192.168.1.1 or 192.168.2.1? I hope i can get help here or an Info where i can get an answer to my Questions. Thank You. Wilfried

1 0

Telnet Problem 2
by Stanley Caramoy 06 Jun '02

06 Jun '02

Hello... This is the log from SuSE server : Jun 5 11:09:14 b235 in.telnetd[25273]: connect from 134.x.x.x (134.x.x.x) Jun 5 11:09:24 b235 login: FAILED LOGIN 1 FROM 134.x.x.x FOR UNKNOWN, User not known to the underlying authentication module Jun 5 11:09:34 b235 login: FAILED LOGIN 2 FROM 134.x.x.x FOR stancrm, Authentication failure Jun 5 11:09:46 b235 login: FAILED LOGIN 3 FROM 134.x.x.x FOR stancrm, Authentication failure Jun 5 11:09:53 b235 login: FAILED LOGIN SESSION FROM 134.x.x.x FOR UNKNOWN, User not known to the underlying authentication module Jun 5 11:10:08 b235 in.telnetd[25275]: connect from 134.x.x.x (134.x.x.x) Jun 5 11:10:20 b235 login: FAILED LOGIN 1 FROM 134.x.x.x FOR stancrm, Authentication failure Jun 5 11:10:37 b235 login: FAILED LOGIN 2 FROM 134.x.x.x FOR stancrm, Authentication failure Jun 5 11:10:49 b235 login: FAILED LOGIN 3 FROM 134.x.x.x FOR UNKNOWN, User not known to the underlying authentication module Jun 5 11:11:35 b235 in.telnetd[25285]: connect from 134.x.x.x (134.x.x.x) Thanks -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 2

Re: Re: [suse-security] Telnet Problem 2
by BLeonhardt＠analytek.de 06 Jun '02

06 Jun '02

... everything seems to be okay ... noone from 134.x.x.x could login ... session login failed like described in your log .. .. what's the problem ? Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ___________________________________________________________________________________ AnalyTek Systemhaus Hospitalstr. 2a D-65589 Hadamar Tel.: 06433/81403-15 Fax : 06433/81403-40 Besuchen Sie uns im Internet unter: http://www.analytek.de John Andersen <jsa(a)pen.homeip.net> 06.06.02 08:34 Bitte antworten an jsa An: Stanley Caramoy <s_caramoy(a)gmx.de>, suse-security(a)suse.com Kopie: Thema: Re: [suse-security] Telnet Problem 2 So what was the problem again? The log shows that they did not get in. On Wednesday 05 June 2002 09:43 pm, Stanley Caramoy wrote: > Hello... > > This is the log from SuSE server : > > Jun 5 11:09:14 b235 in.telnetd[25273]: connect from 134.x.x.x (134.x.x.x) > Jun 5 11:09:24 b235 login: FAILED LOGIN 1 FROM 134.x.x.x FOR UNKNOWN, User > not known to the underlying authentication module > Jun 5 11:09:34 b235 login: FAILED LOGIN 2 FROM 134.x.x.x FOR stancrm, > Authentication failure > Jun 5 11:09:46 b235 login: FAILED LOGIN 3 FROM 134.x.x.x FOR stancrm, > Authentication failure > Jun 5 11:09:53 b235 login: FAILED LOGIN SESSION FROM 134.x.x.x FOR > UNKNOWN, User not known to the underlying authentication module > Jun 5 11:10:08 b235 in.telnetd[25275]: connect from 134.x.x.x (134.x.x.x) > Jun 5 11:10:20 b235 login: FAILED LOGIN 1 FROM 134.x.x.x FOR stancrm, > Authentication failure > Jun 5 11:10:37 b235 login: FAILED LOGIN 2 FROM 134.x.x.x FOR stancrm, > Authentication failure > Jun 5 11:10:49 b235 login: FAILED LOGIN 3 FROM 134.x.x.x FOR UNKNOWN, User > not known to the underlying authentication module > Jun 5 11:11:35 b235 in.telnetd[25285]: connect from 134.x.x.x (134.x.x.x) > > > Thanks -- _________________________________________________ No I Don't Yahoo! And I'm getting pretty sick of being asked if I do. _________________________________________________ John Andersen / Juneau Alaska -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0