August 2002 - openSUSE Security - openSUSE Mailing Lists

suse 8.0 local root exploit..
by Len Rose 12 Aug '02

12 Aug '02

FYI: http://lists.netsys.com/pipermail/full-disclosure/2002-August/000950.html Len

5 6

RE: [suse-security] FreeS/wan trough NATing Router
by Reckhard, Tobias 12 Aug '02

12 Aug '02

Re > >You may be able to get manually keyed ESP in tunnel mode to work, but > that's > >suboptimal from a management and security perspective. > > Saw websites that recommend this configuration, but it wont > work for me as > well. If it's worked for someone else, you may want to dig into it. > Yep, this could be the solution. Already found this NAT-T patch. Any > experiences ??? Sorry, no. There's an article at SANS about NAT-T, a Google search for 'nat traversal ipsec peace agreement' should make it top of the list. It's got a couple of obvious errors (that any QA would have found), but it gets the message across. Oh, you need to register to be allowed access to their 'reading room'. Bottom line is that NAT-T works for outbound connections and protocols that don't need any special treatment, such as FTP, RPC, etc.. It seems to me that you can't place NAT-T devices in a head-to-head configuration, but I may be wrong here. > >Are you forced to have NAT take place on that outer router? > > ??? Its not my router and they had enabled NTA as a kind of > "security" :O) NAT isn't a security feature, IMnsHO. > PS: I read something about your secunet on tickers. freeS/wan > ipsec for the > certified by RegTP boxes ? > Nice ! Disclaimer: I work for secunet. None of what I say necessarily reflect my employer's opinions, policy, whatever. I do not mean to abuse this list for advertising. Yeah, that'd be our SINA box. It is pretty good security-wise, if I say so myself (see disclaimer). Cheers, Tobias

1 0

RE: [suse-security] FreeS/wan trough NATing Router
by GentooRulez 12 Aug '02

12 Aug '02

>You may be able to get manually keyed ESP in tunnel mode to work, but that's >suboptimal from a management and security perspective. Saw websites that recommend this configuration, but it wont work for me as well. >The other thing that some people think of as a solution to this problem is called NAT traversal. >There's a patch to FreeS/WAN that enables it. It's pretty much a dirty hack, >if you ask me, much like NAT is a dirty hack, too. Yep, this could be the solution. Already found this NAT-T patch. Any experiences ??? >Are you forced to have NAT take place on that outer router? ??? Its not my router and they had enabled NTA as a kind of "security" :O) >Cheers,Tobias Thx a lot Michael PS: I read something about your secunet on tickers. freeS/wan ipsec for the certified by RegTP boxes ? Nice !

1 0

Squirrel-Webmail
by Mario Ohnewald 12 Aug '02

12 Aug '02

Hello! What do you think about Squirrelmail? How secure is it? I have it currently running on a mailserver-only Box. Or should the question be, how secure is imap?! It will only be used internal. Cheers, Mario

2 1

RE: [suse-security] FreeS/wan trough NATing Router
by Reckhard, Tobias 12 Aug '02

12 Aug '02

> 192.168.1.0/24 as Subnet1 --> > 192.168.1.1 : 10.10.10.1 as FreeS/Wan Router 1--> > 192.168.10.11 : ext.ip.addr.no1 as external router does nat --> > INTERNET > > INTERNET <-- ext.ip.addr.no2 : 192.168.2.1 : as FreeS/Wan Router 2 > 192.168.2.0/24 as Subnet 2 > > The error is ever the same: > > packet from ext.ip.addr.no1:xxx: initial Main Mode message received on > ext.ip.addr.no2:500 but no connection has been authorized > > I think the problen is the router that does NAT because > FreeS/Wan Router 1 > gots an privat IP that not routeable. I agree with your conclusion. NAT and IPSec don't coexist very well. It's OK if NAT is performed before IPSec (regarding an outbound packet here), but NAT after IPSec has several problems: * AH fails, because the address(es) in the IP header is/are modified, * IKE fails, because the peers' IP addresses are part of their identities. You may be able to get manually keyed ESP in tunnel mode to work, but that's suboptimal from a management and security perspective. The other thing that some people think of as a solution to this problem is called NAT traversal. There's a patch to FreeS/WAN that enables it. It's pretty much a dirty hack, if you ask me, much like NAT is a dirty hack, too. Are you forced to have NAT take place on that outer router? Another option would be to use a different tunneling protocol, such as CIPE. Cheers, Tobias

1 0

Need help with IPSEC
by SCHULZ, Wolfgang 12 Aug '02

12 Aug '02

Hi! I'm using SuSE 7.0 (with FreeS/WAN 1.4) on a firewall gateway and SafeNet/Softremote for a WIN2000 machine and want to configure a road warrior VPN. The road warriod should connect to a maskeraded net (10.96.1.64/26) behind the firewall. The problem which makes me cracy is the following: I can establish an SA - there is a tunnel between the WIN2000 machine and the firewall. I can ping from the road warrior PC to the internal address of the firewall (10.96.1.102) but I can't ping or make a connection to any other machine in that subnet. I tested everything with and without firewall rules - no difference. Also the firewall script should be configured correctly because I have already a tunnel established between my subnet and another subnet which is working correctly. There are also no warning messges in the log file that the firewall rejects something! I tested with tcpdump that the ICMP packets arrive at the ipsec interfac on the firewall but nothing is sent out at the internal interface (eth0). For me this looks like a routing problem but I have no idea what could be configured in another way. I also searched in the list archives and didn't find anything. Who as an idea? Thanks Wolfgang My configuration: Internal net: 10.96.1.64/26 | | Firewall: intern(eth0): 10.96.1.102 extern(eth1): 213.30.70.235 | | External net: 213.30.70.232/29 | | PC with Softremote: 213.30.70.238 The connection in the ipsec.conf file is configured in the following way: # sample connection conn sample # Left security gateway, subnet behind it, next hop toward right. left=0.0.0.0 leftsubnet= leftnexthop= # Right security gateway, subnet behind it, next hop toward left. right=213.30.70.235 rightsubnet=10.96.1.64/26 rightnexthop=213.30.70.233 auto=add authby=secret

3 3

Using imapd without shell-access?
by Michael Zimmermann 12 Aug '02

12 Aug '02

Hi friends, could you please help me? I fumbled around for some time now, looked at the imapd sources and searched the net but could not solve the following problem: When I call imapd for a user with a normal shell account (e.g. the shell is /bin/bash for that user), imap-access is doing fine. But when I use a dummy shell for the same user (say /bin/false or similiar) imapd refuses to login with the syslog-message ... imapd[27691]: Login failure user=blah host=blah ... Any hint or idea? Anybody using imapd for users without shells? Or are you doing it within chroot environments only? I'm well aware, that the IMAP-protocoll gives the user some sort of shell on the system. But I would like to understand how (and where) imapd is using the normal user's shell in addition to it's own system-access. Thanks for your help Michael BTW the system is a SuSE 8.0 with imap-2000c-139 -- Michael Zimmermann (Vegaa Safety and Security for Internet Services) Key fingerprint = 1E47 7B99 A9D3 698D 7E35 9BB5 EF6B EEDB 696D 5811

2 3

Fwd: [suse-security] Virtual IP adress on the firewall, the dmz and DNAT / MASQUERADE
by Harald Wallus 12 Aug '02

12 Aug '02

High Kai, your patch works great. Only your patch in the email has lost some tabs, so I do the changes by hand and not with patch. Thank You Harald Wallus ---------- Weitergeleitete Nachricht ---------- Subject: [suse-security] Virtual IP adress on the firewall, the dmz and DNAT / MASQUERADE Date: Mon, 27 May 2002 17:39:47 +0200 From: "Kai-H. Weutzing" <suse(a)exozet.com> To: <suse-security(a)suse.com> Cc: <marc(a)suse.de> Hi, my problem was that I have a box with three interfaces (ext, dmz, int) and many IPs on the ext-interface and one (or more) server in the dmz. In the moment the SuSEfirewall2 (v2.1) on my SuSE 8.0 installation can't do that (look in the TODO file). So I spend some time in patching the SuSEfirewall2 script and it works well for me. The patch is very small: 1310c1310,1311 < ERROR=`echo $NETS | $AWK -F, '{print $6}'` --- > DEST=`echo $NETS | $AWK -F, '{print $6}'` > ERROR=`echo $NETS | $AWK -F, '{print $7}'` 1337a1339 > test -z "$DEST" || DEST="-d $DEST" 1339c1341 < $IPTABLES -A PREROUTING -j DNAT -t nat $PROTO $NET1 $PORT1 --to-destination ${NET2}${PORT2} -i $DEV --- > $IPTABLES -A PREROUTING -j DNAT -t nat $PROTO $NET1 $PORT1 $DEST --to-destination ${NET2}${PORT2} -i $DEV Short description: - edit the test of the arguments of FW_FORWARD_MASQ and add the variable DEST for the IP adress on the firewall - add line for test the variable DEST, if set add '-d ' for later use in the iptables command - edit the iptables command for PREROUTING; added the DEST variable And the point 14 in /etc/sysconfig/SuSEfirewall2 gets a fifth argument: The IP adress on that the firewall listen on the ext-interface, e.g. a www-server: FW_FORWARD_MASQ="0/0,192.168.13.130,tcp,80,80,<public IP adress on ext-interface>" Warning: With that parameter file u can't start the unpachted SuSEfirewall2 script because it controlls how many arguments are given. btw. of cource you must configure the public IP adress on the firewall-box (/etc/sysconfig/network ...)! I test this config but maybe there are some points I can't see with my config... Comments are welcome... Greetings Kai -- To unsubscribe, e-mail: suse-security-unsubscribe(a)suse.com For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here netlike-gmbh Am Listholze 78, D-30177 Hannover Tel: +49(0)511 90 95 1-23 Fax: +49(0)511 90 951-90 Email: wallus(a)ntlike-gmbh.de Internet: http://netlike-gmbh.de

1 0

su doesn't work after yast2 security change
by Ferdinand Schmid 09 Aug '02

09 Aug '02

HI, I am noticing that the su command fails after using yast2 (curses based version) to configure security. It appears that the file permissions -> paranoid selection breaks su. One problem that I easily found is that it changes the permissions for /etc/login.defs to 600, which appears to prevent anybody but root to login. But even after fixing those perms to 644 I can't use su anymore. I can't even su to another regular user. /etc/pam.d/su doesn't appear to be the problem. Any hints? Thanks, Ferdinand -- Ferdinand Schmid Architectural Energy Corporation Celebrating 20 Years of Improving Building Energy Performance http://www.archenergy.com

4 5

Nasty NFS-Problem
by Stefan Rauch 09 Aug '02

09 Aug '02

Hi, I have a nasty Problem concerning NFS. Its concerning the integrity of a mailbox in maildir format imported via NFS. I have two Systems with SuSE Linux 8.0 Pro (both updated with YOU), one is running as NFS/NIS Server and the second one is NIS and NFS-Client. The Home Directory for each user is located on the Server. At a first glance everything seems to work fine. All users can work without any problem with files in their home dirs. But if someone uses Kmail (the Maildir is in the Homedirectory) this happens: KMail does not remember, which mails have already been read. E.g. I read a new mail, Kmail marks it correctly as read. After restarting KMail exactly this mail is marked as new. This Problem accours only in a few folders. The Mailbox is in maildir format . In the mailbox, all mails, that have been read are in the folder cur but they are not recognized as already read. I had this problem a few months ago (with SuSE 8.0, too). At this time I was able to ship around by changing the kernel based NFS-Server against an userspace NFS-Server, but now this workaround doesn't help. I never had this problem with an older SuSE-Version. Any hints? best regards Stefan Rauch

2 1