August 2002 - openSUSE Security - openSUSE Mailing Lists

Secure Installation for SuSE 8.0
by Ken Mumme 13 Aug '02

13 Aug '02

Does anyone out there have an installation guide for installing a secure instance of SuSE 8.0?? All I want to do is have the server setup to be an email and web server. The http://www.suse.de/en/support/howto/secure_webserv/ online document is out of date... Any help you can provide would be greatly appreciated. Thanks, -Ken

2 1

Squid 2.4-STABLE-7 and DansGuardian
by BLeonhardt＠analytek.de 13 Aug '02

13 Aug '02

Hi, is anybody using DansGuardian to prevent from downloading special mime-types and file-extensions ? Have the problem, that if I deny images/* - the site will be displayed anyway ... ... and if I deny .gif's - file-extension , the whole site won't be displayed ... Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Telefon : 06433/81403-15 Telefax : 06433/81403-40 Besuchen Sie uns im Internet unter : http://www.analytek.de

2 1

glibc src.rpm for suse6.4 deleted from ftp server?
by Stefan Heinrichs 13 Aug '02

13 Aug '02

Hi, we would like to patch the glibc for our suse 6.4 systems (rpc-bug), but could not find the appropiate source rpm on the ftp server (not in ls-Ral.txt). Simply using the old original one would require additional patches for vulnerabilities that came up in the last two years that we do not have. suse7.0 already uses version 2.2 instead of 2.1. I understand that support for 6.4 is discontinued, but leaving existing files available would be very helpful in situations like these. Thank You, Stefan P.S. Yes, we are in the process of upgrading to 8.0, but it takes some time for a large installation. -- ------------------------------------------------------------------- Email: Stefan.Heinrichs(a)uni-konstanz.de Address: Fachbereich fuer Physik, Universitaet Konstanz, Universitaetsstr.10, Fach M 686, 78457 Konstanz, Germany Phone: +49 7531 88 3814

2 1

Re: Re: [suse-security] Squid 2.4-STABLE-7 and DansGuardian ( P.S. )
by BLeonhardt＠analytek.de 13 Aug '02

13 Aug '02

Hi, thank's for your advice ... ... my config is like following now : squid-2.4.x ( running on 3128 ) dansguardian ( running on 8080 ) prevent direct connections to 3128 with iptables haven't configured about the web-interface but I think it's working ... dansguardian.conf : filterip = myinternalip ( not loopback ) prxyip = 127.0.0.1 I think it's working now correctly ... have added application/pdf to "/etc/dansguardian/bannedmimetypelist" and wasn't able to open such files anymore ... Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Telefon : 06433/81403-15 Telefax : 06433/81403-40 Besuchen Sie uns im Internet unter : http://www.analytek.de "Philippe Vogel" <filiaap(a)freenet.de> 13.08.02 16:43 An: <BLeonhardt(a)analytek.de> Kopie: Thema: Re: [suse-security] Squid 2.4-STABLE-7 and DansGuardian ( P.S. ) >Have the problem, that if I deny images/* - the site will be displayed >anyway ... >... and if I deny .gif's - file-extension , the whole site won't be >displayed ... This makes no sense! If you ban something, the whole site page with that content will be banned. > >... it's even not working if I say in /etc/dansguardian/bannedmimitypelist >: > >application/* > >... have loaded an pdf-file directly over http ... > >why isn't that working have the port of DansGuardian set to 8080 and so in >my client in proxy-configuration ... Dansguardian needs following: webserver, firewall, squid First setup squid correctly. e.g. set squid to 3128 and dansguardian to 8080. let dansguardian use suid on 3128 and add the line "Firewall-Server" should be setup like this: internal net <-> Dansguardian <-> udp_outgoing_address <external ip firewall> <-> Squid <-> udp_incoming_address <internal ip firewall> <-> internet 1) setup squid to udp_outgoing_address <external ip> udp_incoming_address <internal ip> 2) setup dansguardin to listen on 8080 on internal ip (look at bottom of this mail) 3) copy files to apache and configure it running on your host copy danguardian.pl to /usr/local/httpd/cgi-bin and chown root:root chmod 755 4) setup firewall to redirect traffic from internal to external /etc/rc.config.d/firewall2.rc.conf #9.) FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_INT_TCP="80 8080" <- add here what you want to be let throug too FW_SERVICES_INT_UDP="80 8080" <- add here what you want to be let throug too #15.) FW_REDIRECT="$YOUR_LAN,0/0,tcp,80,8080" $YOUR_LAN should look like $YOUR_LAN="192.168.168.0/24" for all ip's from 192.168.168.0 - 255 5) block all incoming Traffic from extern to 8080 firewall (local access from the firewall to external must be allowed) block all incoming traffic from internal to 3128 on firewall NO rules set for this ports in FW_SERVICES_INT and FW_SERVICES_EXT Dansguardian: Expressions for your lan could be 192.168.168.0/24 for all IP's within 192.168.168.0 - 255 $IPTABLES should contain the full path to iptables! Configure the blocktypes and only block URLs! Block Extensions only for malicious code. I use: .ade .adp .bas .bat .cab .chm .cmd .com .cpl .crt .dll .eml .hta .ins .isp .lnk .mdb .mde .msc .msi .msp .mst .ocx .pcd .pif .reg .url .vb .vbe .vbs .wsc .wsf .wsh As for Windows 2000 typical scripts/programms are executed as well with other extensions! For URL-blocking there are several uptodate lists on the dansguardian homepage. I only block porno-content. Even here is a funny thing. I blocked expressions, so assh***.jpg was banned or a page on ebay was blocked because of a "false" meta-tag! So setup expressionlist to your delight or do not use it. It is not easy to get it running to your delight in 5 minutes. You have to modify rules until the filter works fine! It took me a week to get it working fine. Don't forget to restart squid and dansguardian to take changes affect! Philippe P.S.: #<file dansguardian.conf> htmltemplate = /etc/dansguardian/template.html filterip = yourinternalserverip filterport = 8080 proxyport = 3128 proxyip = 127.0.0.1 accessdeniedaddress = http://yourwebserver/cgi-bin/dansguardian.pl bannedphraselist = /etc/dansguardian/bannedphraselist banneduserlist = /etc/dansguardian/banneduserlist bannediplist = /etc/dansguardian/bannediplist bannedextensionlist = /etc/dansguardian/bannedextensionlist bannedmimetypelist = /etc/dansguardian/bannedmimetypelist bannedsitelist = /etc/dansguardian/bannedsitelist bannedurllist = /etc/dansguardian/bannedurllist bannedregexpurllist = /etc/dansguardian/bannedregexpurllist exceptionphraselist = /etc/dansguardian/exceptionphraselist exceptionsitelist = /etc/dansguardian/exceptionsitelist exceptionuserlist = /etc/dansguardian/exceptionuserlist exceptioniplist = /etc/dansguardian/exceptioniplist exceptionurllist = /etc/dansguardian/exceptionurllist weightedphraselist = /etc/dansguardian/weightedphraselist picsfile = /etc/dansguardian/pics maxuploadsize = -1 #maxchildren = 120 maxchildren = 240 weightedphrasemode = 2 naughtynesslimit = 50 logexceptionhits = on showweightedfound = on reverseaddresslookups = createlistcachefiles = on usernameidmethodproxyauth = off usernameidmethodident = forwardedfor = logconnectionhandlingerrors = on logfileformat = 1 reportinglevel = 3 #</file>

1 0

SuSEfirewall2 SUSE-FW-DROP-ICMP SuSE8.0
by foschiatti＠gabler-schorndorf.de 13 Aug '02

13 Aug '02

Hallo Liste, Folgende Rahmenbedinungen: <INTERNET> <---> ROUTER <---> linux <---> <INTRANET> öffentlich <--->3com DSL <--->SuSEfirewall2 <---> privat Konfiguration Linux: Netztwerkarten: eth0 192.168.10.1/24 --> Intranet eth1 192.168.11.1/24 --> DSL-Router Routing: 192.168.10.0 Mask 255.255.255.0 eth0 192.168.10.0 Mask 255.255.255.0 eth1 SuSEfirewall2: FW_ROUTING = YES... usw Der Router wurde Konfiguriert Anwahl t-online (Dynamische Adressvergabe) interne IP 192.168.10.254 Nun das Problem: Nach einer Anforderung aus dem internen Netz wählt der Router den ISP nicht an eine Verbindung mit dem Internet kommt nicht zustande. Fehlermeldung in der Datei /var/log/firewall <SUSE-FW-DROP-ICMP> in=eth1 Type=3.... Trenne ich den Router von der Stromversorgung und stecke ihn danach wieder ein wird eine Probeverbindung zum ISP aufgebaut, die auch funktioniert. Jetzt funktioniert die komplette Installation aber nur solange bis der timeout des routers greift. Eine neue Verbindung aufzubauen ist wiederum nicht möglich. Die Interprätation des Log-Eintrages scheint Aufschluß auf die Problemlösung zu geben. Aber nicht für mich .... bitte hilfe... Bernd

1 0

Re: [suse-security] Squid 2.4-STABLE-7 and DansGuardian (solved?)
by BLeonhardt＠analytek.de 13 Aug '02

13 Aug '02

... i think ... I've solved it ... ... it's not supporting wildcards ( * - asterisk ) ... I think .... Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Telefon : 06433/81403-15 Telefax : 06433/81403-40 Besuchen Sie uns im Internet unter : http://www.analytek.de BLeonhardt(a)analytek.de 13.08.02 15:56 An: suse-security(a)suse.com Kopie: Thema: [suse-security] Squid 2.4-STABLE-7 and DansGuardian Hi, is anybody using DansGuardian to prevent from downloading special mime-types and file-extensions ? Have the problem, that if I deny images/* - the site will be displayed anyway ... ... and if I deny .gif's - file-extension , the whole site won't be displayed ... Regards / Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Telefon : 06433/81403-15 Telefax : 06433/81403-40 Besuchen Sie uns im Internet unter : http://www.analytek.de -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Squid 2.4-STABLE-7 and DansGuardian ( P.S. )
by BLeonhardt＠analytek.de 13 Aug '02

13 Aug '02

... it's even not working if I say in /etc/dansguardian/bannedmimitypelist : application/* ... have loaded an pdf-file directly over http ... why isn't that working have the port of DansGuardian set to 8080 and so in my client in proxy-configuration ... Mit freundlichen Grüßen Bruno Leonhardt CLP Domino R5 Systemadministrator ----------- AnalyTek Systemhaus Hospital Str. 2a D-65589 Hadamar Telefon : 06433/81403-15 Telefax : 06433/81403-40 Besuchen Sie uns im Internet unter : http://www.analytek.de

1 0

BIND 8 Lame Servers
by Thomas Wheeler 13 Aug '02

13 Aug '02

Hi All I believe the only stupid question is the question you have never asked so here goes. I keep getting lame servers popping up if I do a tail -f /var/log/messages. How can I fix this bind problem?. I believe it's a problem with a out dates root.zone or root.hint file?.. were can I get a updated one?.. Aug 13 13:00:02 DoubleHelix named[622]: Lame server on '200.1.6.192.in-addr.arpa' (in '1.6.192.in-addr.arpa'?): [4.2.49.2].53 'KNOCK.SER.BBNPLANET.COM' Regards, Thomas Wheeler -=No Trees Were Harmed By Sending This Email, Only A View Electrons Were Seriously Discomforted =-

3 2

RE: [suse-security] asignar una facility propia al target LOG de iptables
by Aliaga, Alberto 13 Aug '02

13 Aug '02

Hi Harald, I would like to thank you for comment about the generator fwlogwatch, It may be interesting for my issue. As well, I would like to apologize for sending my question to this list in spanish, I did not know that this list is a only english-spoken list. By the way, It seems that the --log-prefix option in LOG target is a good option to select iptables logs from facility kernel.*, as long as you use a specific enough prefix. Thank you for all Alberto Aliaga Zapata Dpto. de Sistemas CABLE & WIRELESS Delivering the Internet PromiseTM www.cw.com/es Email: alberto.aliaga(a)cw.com Tel.: +34 93 264 05 34 Fax: +34 93 264 05 39 -----Mensaje original----- De: Harald Nikolisin [mailto:harald.nikolisin@sofistik.de] Enviado el: Tuesday, August 13, 2002 12:10 PM Para: SuSE Security Discussion (E-mail) Asunto: Re: [suse-security] asignar una facility propia al target LOG de iptables hi list, hi alberto because this is a english-spoken list, all people prefer you use rather a bad english (as me) as a perfect spanish. I hope I understand everything. you want to pipe all logged entries from IPTABLES to a specific log-file. you know the switch "-j LOG" and that you are able to filter all kernel related stuff (kern.*) into a special log file (like /var/log/firewall) which is controlled by the syslog.conf but this is not enough for you. I also searched without success for that topic in the excellented firewall/IPTables book from Wolfgang Barth. maybe he is on the list and can give a hint? but a good solution is for me to filter the /var/log/firewall with the generator fwlogwatch (output also in html possible). http://cert.uni-stuttgart.de/projects/fwlogwatch/ the html-output is very useful to get a quick overview. Am Dienstag, 13. August 2002 11:13 schrieb Aliaga, Alberto: > Hola a todos, > > Alguien sabe si es posible asignar una nueva facility al syslogd > para los registros del target -j LOG de iptables. Sé que se puede añadir un > prefijo a la target del iptables y así poder filtrarlos de la facility > kernel pero esto no me es suficiente. > > > Gracias por vuestra ayuda. > > Alberto Aliaga Zapata > Dpto. de Sistemas > > CABLE & WIRELESS > Delivering the Internet PromiseTM > www.cw.com/es > > Email: alberto.aliaga(a)cw.com > Tel.: +34 93 264 05 34 > Fax: +34 93 264 05 39 -- Mit freundlichen Grüssen / With kind regards Dipl.-Ing. Harald Nikolisin SOFiSTiK AG (Entwicklung) -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

asignar una facility propia al target LOG de iptables
by Aliaga, Alberto 13 Aug '02

13 Aug '02

Hola a todos, Alguien sabe si es posible asignar una nueva facility al syslogd para los registros del target -j LOG de iptables. Sé que se puede añadir un prefijo a la target del iptables y así poder filtrarlos de la facility kernel pero esto no me es suficiente. Gracias por vuestra ayuda. Alberto Aliaga Zapata Dpto. de Sistemas CABLE & WIRELESS Delivering the Internet PromiseTM www.cw.com/es Email: alberto.aliaga(a)cw.com Tel.: +34 93 264 05 34 Fax: +34 93 264 05 39

3 2