August 2002 - openSUSE Security - openSUSE Mailing Lists

Re: Re: [suse-security] Transparent Proxy
by BLeonhardt＠analytek.de 22 Aug '02

22 Aug '02

Hi , thank's for your replies ... ... after visiting http://www.christian-gerner.de/computer/linux/squidtrans.htm it was working fine :-) ... Thank's ! Regards / Gruß Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Telefon : 06433/81403-15 Telefax : 06433/81403-40 Besuchen Sie uns im Internet unter : http://www.analytek.de Thomas Kerkau <thomas.kerkau(a)io-software.com> 21.08.02 16:57 An: BLeonhardt(a)analytek.de Kopie: suse-security(a)suse.com Thema: Re: [suse-security] Transparent Proxy Hi Bruno, had the same errormessage, but maybe another reason. In my case it was the squid.conf. Setup as recomanded in: http://www.tldp.org/HOWTO/mini/TransparentProxy.html Section: Setting up Squid and everithing worked fin for me. Hope this helps, Gruß, Thomas BLeonhardt(a)analytek.de wrote: > > Hi all, > > have tried to redirect all http-requests on Port 80 to Port 8080 ( > DansGuardian with Squid 2.4-Stable7 ) with : > > iptables -A PREROUTING -t nat -j REDIRECT -s 192.168.x.x/24 -d 0/0 -p tcp > --dport 80 --to-ports 8080 > > but isn't working .. I will get following error-message : > > While trying to retrieve the URL: /index.php > The following error was encountered: > Invalid URL > Some aspect of the requested URL is incorrect. Possible problems: > Missing or incorrect access protocol (should be `http://'' or similar) > Missing hostname > Illegal double-escape in the URL-Path > Illegal character in hostname; underscores are not allowed > > ---------------- > > But the the URL was given correct ... > > .. does anybody know this Problem ? > > Further I've tried to Redirect with DNAT : > > iptables -A PREROUTING -t nat -j DNAT -s 192.168.x.x/24 -d 0/0 -p tcp > --dport 80 --to-destination 192.168.x.x:8080 > > but isn't working too ... :-( > > Best Regards / Gruß > Bruno Leonhardt > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here -- www.ArcStyler.com - the Architectural IDE for MDA:J2EE/CORBA/EAI -> CyberOne Award -> Winner Crossroads A-List Award USA -> IBM Solution Excellence Award winner for Hot Java Solution -> European Information Society Technologies Prize Winner -> Made with ArcStyler www.NewWaveSearchables.com -> OMG Press, John Wiley 2002 www.ConvergentArchitecture.com ----- < iO > --------------------------------------------------------- Interactive Objects Software GmbH mailto:Thomas.Kerkau@io-software.com http://www.io-software.com Basler Strasse 65, D-79100 Freiburg, Germany Tel: [+49]-761-40073-0, Fax: [+49]-761-40073-73 ----------------------------------------------------------------------

1 0

how can i have public IPs in the DMZ with SuSEfirewall2
by Andreas Bittner 22 Aug '02

22 Aug '02

subject: how can i have public IPs in the DMZ with SuSEfirewall2 deutscher text weiter unten / german text follows below ---------------- Hello all, i have been searching around quite a while and couldnt find a solution. i have 8 public ip addresses from our internet service provider (netmask is 255.255.255.248) i have a suse 8 linux box with 3 ethernet network cards. eth0 is external connected directly with crossover to the router of the ISP. eth1 is the dmz ethernet card. eth2 is the internal network. should be 192.168.200.x with netmask 255.255.255.0 ... something like that.. now i have read in the SuSEfirewall2 config file in secion 13, that the SuSEfirewall2 supports public IP in the DMZ zone.. even the EXAMPLE file is talking about a scenario with a webserver with ports 80 and 443 running with public ip 200.200.200.200 in the DMZ... in my case i want to run a mailserver in the DMZ with public ip, and it only needs port25 to the internet, and its getting mails only from secific hosts on the internet. so its not included in an mx record anywhere but gets mails from a virus detection/mailscanning companies mailservers there... now my question is how do i get traffic to that mailserver box in the DMZ... will my router forward the traffic for the ip of the mailserver? what should the IP for the DMZ ethernet card be and what netmask/gateways and do i need any static routing on the box... or how will SuSEfirewall2 script handle all this... this seems somehow weird to me and i dont find any explanation or discussions here in usenet where people succeeded with this... but this scenario should be quite common, shouldnt it? i also heard about proxy arp and other sorts, but since SuSEfirewall2 script and examples explicitly talk about this scenario, can someone explain this to me and what the DMZ card settings and netmasks, gateways should be? i also thought about adding the mailserver ip additionally to the external ethernet card (eth0:1 for the mailserver ip then) and then do portforwarding to the DMZ card, and run another private ip netzwork on the DMZ.. 192.168.300.x for the DMZ or something? what would be the best solution? but my actual question is, how do i make this work with the susefirewall2 scripts and settings since there is that scenario in the EXAMPLES with the webserver in the DMZ with public ip address... could anyone please give me some hints, howtows or detaild explanation... i get confused because i dont know what to set for the DMZ card in this case... thanks already for any help and hints. best regards, Andreas Bittner ------------------ german: hallo leute, ich hab schon eine weile herumgesucht aber keine wirkliche loesung oder erklaerung fuer mein scenario gefunden. ich habe von einem internet service provider einen 8er block oeffentlicher ip adressen bekommen (netzwerkmaske 255.255.255.248) ich hab eine suse linux 8 kiste mit 3 ethernet netzwerk karten. eth0 externes netz, eth1 dmz netz, eth2 internes netz. eth0 ist direkt per cross over kabel an den router des isp angeschlossen. eth2 ist ein netz mit privaten adressen, z.b. 192.168.200.x mit der maske 255.255.255.0 ich habe nun im SuSEfirewall2 config file unter punkt 13 gelesen, dass es oeffentliche ips in der DMZ unterstuetzt. es gibt sogar im EXAMPLE file einscenario mit einem webserver mit port80 und 443 in der DMZ der eine oeffentliche ip 200.200.200.200 hat. in meinem fall moechte ich nur einen einfache mailserver (port25) mit oeffentlicher ip adresse in der DMZ laufen haben. die ip des mailservers ist nicht in einem MX record festgehalten, und der mailserver bekommt nur von einem externen mailvirenscanner provider die mails zugeliefert, also ich will den verkehr genau auf ein paar ips im internet beschraenken, bzw kann das genau sagen woher der mailtraffic kommt... meine frage ist nun, wie schaffe ich es mit bloss 8 oeffentl. ip adressen mit der susefirewall2 die daten fuer die ip des mailservers auf meine DMZ ethernet netzwerkkarte zu routen etc... wasfuer eine IP adresse muss die DMZ netzwerkkarte haben, welche maske, gateway usw... ich habe ein problem mit dem verstaendis... ich kann die 8 ips die ich hab nicht weiter subnetten.. kann das susefirewall2 script die kiste so konfigurieren dass die daten fuer den mailserver mit oeffentlicher ip auf jedenfall dort auf der DMZ netzwerkkarte ankommen und an den weitergegeben werden? wie wird das gemacht? was muss ich fuer die DMZ karte einstellen usw... ich habe auch schon ueber ansaetze mit proxy-arp und auch mit portforwarding gelesen, aber ich weiss nicht was das beste waere, und wenn susefirewall2 das schon kann, dann hab ich bloss ein verstaendnisproblem damit.. vielleicht funtkioniert es ja einfach, aber was stelle ich fuer die DMZ karte ein?? oder soll ich die mailserver ip zusaetzlich noch als eth0:1 auf die externe karte nehmen und dann mit portforwarding das auf die DMZ karte leiten und dort auch private ips fahren? hat jemand ein paar hinweise und genaue schritte wie ich was am besten machen sollte? geht das so einfach mit dem susefirewall2 script? und was muss ich dann fuer die DMZ karte alles einstellen etc.... danke schonmal und gruesse, andreas bittner

7 11

Re: [suse-security] Tips zur tripwire config?
by Philippe Vogel 21 Aug '02

21 Aug '02

Hi all! >hier mal ein `df -h` meiner firewall....[snipped] 1) Nonsense? 2) Look in the /usr/share/doc/packages/tripwire for help and read how tripwire works and how to configure it. 3) Better use aide instead! 4) For all newbies, this is an english mailinglist, because of international users. 5) It is not polite to think everybody is speaking german or whatever here! reguards Philippe P.S.: What about a fund? 5â,¬ for each mail in german, 10â,¬ for offtopic mails! Would be enough money to have a big party after some weeks! :-)

3 5

Transparent Proxy
by BLeonhardt＠analytek.de 21 Aug '02

21 Aug '02

Hi all, have tried to redirect all http-requests on Port 80 to Port 8080 ( DansGuardian with Squid 2.4-Stable7 ) with : iptables -A PREROUTING -t nat -j REDIRECT -s 192.168.x.x/24 -d 0/0 -p tcp --dport 80 --to-ports 8080 but isn't working .. I will get following error-message : While trying to retrieve the URL: /index.php The following error was encountered: Invalid URL Some aspect of the requested URL is incorrect. Possible problems: Missing or incorrect access protocol (should be `http://'' or similar) Missing hostname Illegal double-escape in the URL-Path Illegal character in hostname; underscores are not allowed ---------------- But the the URL was given correct ... .. does anybody know this Problem ? Further I've tried to Redirect with DNAT : iptables -A PREROUTING -t nat -j DNAT -s 192.168.x.x/24 -d 0/0 -p tcp --dport 80 --to-destination 192.168.x.x:8080 but isn't working too ... :-( Best Regards / Gruß Bruno Leonhardt

2 1

RE: [suse-security] Encrypt E-Mails without human-agreement
by Reckhard, Tobias 21 Aug '02

21 Aug '02

> > This is called Transport Layer Security (TLS) because it > only encrypts the > > direct connection from one MTA to the next. Every MTA on > the route is able > > to read the mail since it processes mails above the > transportlayer. Privacy > > can only be guaranteed if there is a direct connection > between sending and > > recieving MTA (and both ca nbe trusted). This is not true for SMTP. > > Presumably they are free to configure the MTAs at either end not to > use the "smart host" relay feature. In this case all connections > are direct and there are no intermediate MTAs. > Is this not correct? Not entirely. Just because you're delivering email directly to the host that is published as the domain's mail exchanger(s) in the DNS, that doesn't mean that it's the final destination or that email won't travel on from there. That host may well send the messages on to someplace else. And if the primary MX is down, mail is typically buffered on the hosts with lower priority MX records until the primary MX comes back up again, in which case they send it all the buffered mail. All these are examples where TLS between you and an MX of a domain result in cleartext transmission of email further along the delivery chain. Michel is correct, for true confidentiality you need to encrypt on the application level. Cheers Tobias

5 4

iptables Tutorial?
by Andrew Lietzow 21 Aug '02

21 Aug '02

Dear SuSE Wizards, Anyone have a favorite tutorial that they reference for setting up iptables? I just finally got myself trained on ipchains but I guess I'm going to have to get retrained.... An online resource would be best, but a good book will do, as well. I have Robert Zigler's "Linux Firewalls" which helped get me up and running for a couple of years, but that is mostly about ipchains--iptables isn't even in the index. His web site, http://linux-firewall-tools.com/linux/firewall was awesome for creating what appeared to have been a decent firewall, though I never could get it to come up on it's own (always had to manually start it, which was a pain). I'm been ruined by point and click!!! Unfortunately, even with support for both ipchains and iptables in the 2.4 kernel, I think it's time to "upgrade" my knowledge base rather than being content to live in the past... TIA for any tips. -- Andrew Lietzow The ACL Group, Inc.

5 4

SuSEfirewall & IPSEC
by Patrick Schneider 21 Aug '02

21 Aug '02

Hi list! I have the following setup: MASQ'ed Network --- SuSE firewall --- the Internet. The firewall is running fine since two years. I now want to open ports with the script (SuSE Firewall) to route a VPN tunnel through the firewall (from inside to a server in the internet). I need UDP Port 500 and 47/ip (GRE) or 50/ip (ESP) data channel traffic The following switch is for masquerading: ---snipp--- # Choice: leave empty or any number of hosts/networks seperated by a space. # Every host/network may get a list of allowed services, otherwise everything # is allowed. A protocol and service is appended by a comma to the host/network. # e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with unrestricted access # "10.0.1.0/24,tcp,80 10.0.1.0/24,tcp,21" allows the 10.0.1.0 network to use # www/ftp to the internet. "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too. # You may NOT set this variable to "0/0" ! # FW_MASQ_NETS="" ---snap--- I can use here protocols tcp,udp and icmp , but I can NOT use "IP" as protocol. Where can I setup, that the IP Protocols get routed through the firewall, or do I need additional modules ? Bye, Patrick

1 0

IP_FOWARD
by bernd.erk＠mindextension.de 20 Aug '02

20 Aug '02

hello all, my problem is, that IP_FORWARDING(ROUTING) on the external firewall works only great, if the firewall is down ]-;. I can access all internet services from internal network without any proxy functionality. if i start the firewall, i always receive deny of ports messages in the log file. in my opinion it's a problem with unprivileged ports, but the settigs in the firewall.rc.config are switch on "yes" for unprivilegd ports. So the question is: how can i route the traffic to the Web-Server, Application-Server and Internal-Firewall on dedicated ports, if the firewall is up and blocks the the most ports except mail, www, domain and so on??? THANKS FOR HELP i've got the following configuration: |-----------------| | | | T-Interconnect | | Router | | | |-----------------| private network address | | | | Transfer-Network private address band (192.168.0.x) | | | |-----------------| private network address | External | | Firewall | | | | firewall/IP_FORW| |-----------------| official network address | | --------------------- | | | | | |-----------------| official network address | | example for | | | DMZ-Server | | | | | | Apache | | |-----------------| | | |-----------------| official network address | Internal | | Firewall | | | | firewall / masq | |-----------------| private network address | | | | | COMPANY LAN (Network with private address band (195.88.235.x)) Bernd Erk Information Systems Engineering Fon: + 049 9123 9772 13 Fax: + 049 9123 9772 22 Mobil: + 049 172 8289944 Mail: <mailto:Bernd.Erk@ise-informatik.de> ---------------------------------------------- Die Demokratie ist ein Verfahren, das garantiert, daß wir nicht besser regiert werden, als wir es verdienen. George Bernard Shaw (1856-1950)

1 0

AW: [suse-security] ARP-Request although blocked Packages
by Reckhard, Tobias 20 Aug '02

20 Aug '02

> I have write me a little firewall with iptables and it works > fine. but if I > scan my PC he send an ARP-request into the Lan and betray my > PC to the > scanners PC. I know that he only have to look into his > arp-table to find my > PC there but I dont wont to give him an reaction on an scan. > > How can I configure my System that it send only a ARP-request > if the Package > pass the firewall. Assuming the scanner's machine has the IP address $SCANIP, are you sure that: iptables -I INPUT -s $SCANIP -j DROP exhibits the behaviour you describe? Have you really configured your firewall box to be entirely silent towards the scanner's computer? How do you know its IP address in advance? What if she changes it? And an entirely different, but probably more important problem: why are you afraid of your firewall being detected? Isn't it well advertised anyway, being a gateway of some sort? Cheers, Tobias

1 0

[suse-security] Re: Apache Exploit Code
by Sebastian Schucht 19 Aug '02

19 Aug '02

Hallo The Linux-magazine have a nice german artikel in 01/2001 and the following issues at http://www.linux-magazin.de/Artikel/ausgabe/2001/01/tripwire/tripwire.html -- Mit freundlichen Grüßen \ o Sebastian Schucht / /\ Plattenweg 1 | \ 64823 Groß-Umstadt Tel.: 06078/8723 E-Mail: Sebastian-Schucht(a)gmx.de

1 0