July 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] TCP port 113
by Herbrechter, Marc 16 Jul '02

16 Jul '02

oliver.z wrote: > ya-indeed the port is in reject mode, ok thats fine. It is not. > But, I don't use ftp, sendmail and so on, only http and ssh. So why do you want to protect the other ports? > From my sight, tcp port 113 should not appaer in any scan! > Is there a way to do that? Turn off the "firewall". You do not need it.

1 0

RE: [suse-security] TCP port 113
by oliver.z 16 Jul '02

16 Jul '02

Hey ya-indeed the port is in reject mode, ok thats fine. But, I don't use ftp, sendmail and so on, only http and ssh. >From my sight, tcp port 113 should not appaer in any scan! Is there a way to do that? oliver >===== Original Message From Daniel Lord <d_lord(a)gmx.de> ===== >Hi, > >The Port 113/tcp _is_ closed!!! >The Firewall Rule for port 113 is IMHO REJECT not DROP. >To avoide long timeouts for ftp. > >try something like ip[tables|chains] -L -n | grep 113 > >Greetings Daniel > > >-- >To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here

2 1

Advanded (?) Routing Problem
by sc＠optomed.de 16 Jul '02

16 Jul '02

hello list, has anyone of you ever used 2 Internet-Connections at the same time ? well, want to use 2 DSL Connections parallel (one with static IP), while the second Line should transfer Port 80 Traffic only (Flatrate). The Problem is; using iptables, i can redirect Port 80 Traffic to my eth3, but i only have one default-route at the end....? iNet DSL static 212. | | DSL Flat | | eth1 | | eth3 ------Router------- | | | | LAN eth0 | | eth2 DMZ at this time, i can only route all traffic either over eth1 or eth3 through changing route (route del default gw 212./add default gw 217), but thats not so satisfiying... i got in mind: route ?? using squid ??......any hints are welcome, thx Andreas

2 1

secumod?
by oliver.z 16 Jul '02

16 Jul '02

Hello it is unbelivable, but I can't find any download source for secumod... I greatly appreciate any info thanks Oliver

1 0

SuSE daily security: af_packet
by M. Neubert 16 Jul '02

16 Jul '02

Hello, can anyone explain me this event in SuSE daily security output: ---cut--- OLD: /var/lib/secchk/security-report-daily Fri Jul 12 00:00:06 2002 NEW: /var/lib/secchk/security-report-daily.new Sat Jul 13 00:00:05 2002 * Changes (+: new entries, -: removed entries): + af_packet ---cut--- I have found only the same question, but no answer. http://lists.suse.com/archive/suse-security/2001-Nov/0188.html I don't have any critical entry arround this time above in my logfiles. Thanks & Regards Mario

2 1

SuSEFirewall2 and DNS, def Route
by Mario Ohnewald 16 Jul '02

16 Jul '02

Hello Sec-Experts! ;) I have SuSE7.3 (uptodate) with 3 Interfaces. Everything runs smothly! But after some time, the Firewall-PC can not reach the Externam Network anymore, but the - ppp0 is up - ip is ok - DNS is correct - routing table fine The Clients behind the Firewall can still ping and surf the web and everything! Look like the Firewall changes something oversudden. The logs look ok. I just have a bunch of these logs, where can i disable the logging of this entries (kinda different subject ;)? Jul 16 09:01:15 linux pppd[23519]: rcvd [LCP EchoRep id=0xd magic=0x464f146b] Jul 16 09:01:35 linux pppd[23519]: sent [LCP EchoReq id=0xe magic=0x463697ea] Jul 16 09:01:35 linux pppd[23519]: rcvd [LCP EchoRep id=0xe magic=0x464f146b] Jul 16 09:01:55 linux pppd[23519]: sent [LCP EchoReq id=0xf magic=0x463697ea] Jul 16 09:01:55 linux pppd[23519]: rcvd [LCP EchoRep id=0xf magic=0x464f146b] Jul 16 09:02:15 linux pppd[23519]: sent [LCP EchoReq id=0x10 magic=0x463697ea] Thanks a lot! Mario

2 2

URGENT: SuSE 8.0 freezes when using iptables..
by Christian Bjørnbak 16 Jul '02

16 Jul '02

Hi I just upgraded a server running SuSE 7.2 (kernel 2.4.16, SuSEFirewall(=ipchains)) to SuSE 8.0 (kernel 2.4.18, SuSEFirewall2(=iptables)).. The inside nic is a Intel ethernet card and the outside nic is a IBM olympic token ring card. The server is running as a internet gateway, router with masqurading and firewall. After the upgrade when using some protocols like ftp the server freezes and the caps lock and scroll lock LED's on the keyboard blinks. I found out that using wget from the server against a ftp site made the server freeze. Then I tried stopping SuSEFirewall2 and there by removing any routing. Tried wget again - works fine.. Restarting the firewall and wget makes the server freeze... Can iptables make the server freeze like that?? Earlier we had some problems with stability in the token ring drivers in the original kernel of kernel 7.2 (2.4.7). But after upgrading the kernel 2.4.16 the problems disapered. As stated above the ipchains in SuSE 7.2 worked perfectly is the any issues in downgrading the firewall and continue using ipchains? Without conf files (I don't have them at hand before tomorrow) can anyone give me a lead to were the problem might be??? The /var/log/messages doesn't contain any clue. Is there a log file some where or some I need to turn on to get some debug info??? Thanks, Christian Bjørnbak --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com) Version: 6.0.375 / Virus Database: 210 - Release Date: 10-07-2002

3 2

Re: AW: [suse-security] how to check if sshd update was succesful?
by Martin Köhling 16 Jul '02

16 Jul '02

On Mon, 15 Jul 2002, Alex Levit wrote: Hi! > telnet localhost 22 This just returns something like "SSH-2.0-OpenSSH_3.3", but not the complete version string (e.g. "3.3p1-6"); since most SuSE security updates don't change the version (just the release number, as indicated by the -nnn suffix), this doesn't tell us much. (Because of this, a few months ago, an "ssh vulnerability scanner" returned *lots* of false positives on SuSE ssh installations that were actually already fixed...) Cheers, Martin

1 0

RE: [suse-security] SuSEFirewall2 and DNS, def Route
by Peer Stefan 16 Jul '02

16 Jul '02

hi > From: Mario Ohnewald [mailto:mario.ohnewald@gmx.de] > Hello Sec-Experts! ;) > > I have SuSE7.3 (uptodate) with 3 Interfaces. > Everything runs smothly! But after some time, the Firewall-PC > can not reach > the Externam Network anymore, but the > - ppp0 is up > - ip is ok > - DNS is correct > - routing table fine > > The Clients behind the Firewall can still ping and surf the web and > everything! > Look like the Firewall changes something oversudden. The logs look ok. did you try to shut down the firewall and check the connection? didn't the external ip change after, like, 4 hours or so? how can internal clients ping the web when the firewall's lost its connection? can you post some of your firewall-logs for further analysis? perhaps there's a clue to see why your firewall-host has been cut of the internet. what does your syslog say? > [... snip ...] > > Thanks a lot! > > Mario regards, stefan

1 0

TCP port 113
by oliver.z 16 Jul '02

16 Jul '02

Hello could anyone explain me why I get different results when I doing nmap -sS <ip> from a remote site to my system and when I do nmap -sS localhost on my system? >From remote site I get results with a closed tcp port 113, with nmap with localhost not. And of course, why respond the system to tcp port 113, even if inetd is not startet? System: suse 8.0, susefirewall2 I greatly appreciate your feedback Oliver

3 2