August 2002 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] still problems to use SSH Authentication
by Ulrich Roth 30 Aug '02

30 Aug '02

Hello, On Aug 30, Dominik Metzler <doeme(a)dplanet.ch> wrote: > > tying still to conf. my remot to log in without any passwd > > using the SSH > > Key Authentication. I generate a key via ssh-keygen. copied the > > "identity.pub" file into the "remote:/$HOME/.ssh" --> > > appended the file > > to the "authorized_keys" file. than I restart the sshd on > > both machines There's no need to run sshd on the client machine, except you also want to log in to this machine from another machine. > > --> try to log me in to the remote-machine via ssh and the > > result was > > that I had to enter the remote passwd again. Is there > > anybody who can help me, to solve this problems. > identity.pub sounds like ssh-1. If you use protocol2, you > need another key file. Try to do > ssh -1 user@remotehost > ^use protocol version 1 The other possibility is to change your /etc/ssh/ssh_config. Near the end of the file you find the line # Protocol 2,1 Change it to Protocol 1,2 Then your client will try ssh protocol version 1 first. I think nowadays everybody should change to version 2, but it's a little bit more complicated. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

Antwort: [suse-security] secure login & shutdown with cron
by Andreas Rother 30 Aug '02

30 Aug '02

Hi Philippe, You should take a look at the Network UPS Tools (http://www.exploits.org/nut/). These tools support various client configurations and can also trigger the shutdown of a remote system. Besides they offer a nice status web site :-). I've used this sofware a few months ago. I think SuSE calls that packages "smartups", there were some issues with the shutdown process, the devicename on the upsd server was wrong so the ups was not switched off, when the server went down (that causes the system not to come up again, when the power returns before the ups is absolutly empty). I've also put that command in the background to continue the shutdown script to unmount the drives. Mit freundlichem Gruß, Andreas Rother UNIX-Systemadministration -- Andreas Rother - E-Plus Mobilfunk GmbH & Co. KG Division Operations - System & Application Management - Open Systems Phone : unbekannt / Fax : unbekannt / Mobile : unbekannt "Philippe Vogel" <filiaap(a)freenet.de> 29.08.2002 17:51 An: <suse-security(a)suse.com> Kopie: Thema: [suse-security] secure login & shutdown with cron Hi! I read the mail "secure copy problems". Is it possible to login with ssh, start a script and log out? I got a APC with only one USV cable and no additional module for serial-connectors (smart ups 700). Powerchute cannot stop this machine from remote without a cable or a network module, can it? I want to shutdown a second machine remotely. The shutdown script from the powerchute software should start a script, that loggs in the machine, I want to shutdown, runs shutdown and the loggs out again. This runs before shutdown of local machine runs with a dalay. Is it possible to login as user with ssh and authentification via keyfile? What is to be set in the /etc/ssh/sshd_config? System info: USV-remoted machine: SuSE 7.3 remote: Debian 3.0r0 reguards Philippe

1 0

[suse-security] secure login & shutdown with cron
by Philippe Vogel 29 Aug '02

29 Aug '02

Hi! I read the mail "secure copy problems". Is it possible to login with ssh, start a script and log out? I got a APC with only one USV cable and no additional module for serial-connectors (smart ups 700). Powerchute cannot stop this machine from remote without a cable or a network module, can it? I want to shutdown a second machine remotely. The shutdown script from the powerchute software should start a script, that loggs in the machine, I want to shutdown, runs shutdown and the loggs out again. This runs before shutdown of local machine runs with a dalay. Is it possible to login as user with ssh and authentification via keyfile? What is to be set in the /etc/ssh/sshd_config? System info: USV-remoted machine: SuSE 7.3 remote: Debian 3.0r0 reguards Philippe

5 4

SuSEfirewall2 logs
by Mario Ohnewald 29 Aug '02

29 Aug '02

Hello! I have tons of these logs lines in my messages file: Aug 28 23:00:09 linux kernel: SuSE-FW-UNALLOWED-ROUTINGIN=ppp0 OUT=eth1 SRC=80.11.184.192 DST=192.168.1.40 LEN=46 TOS=0x00 PREC=0x00 TTL=116 ID=65170 DF PROTO=TCP SPT=16392 DPT=4Aug 28 23:00:09 linux kernel: SuSE-FW-UNALLOWED-ROUTINGIN=eth1 OUT=ppp0 SRC=192.168.1.40 DST=172.179.119.14 LEN=45 TOS=0x00 PREC=0x00 TTL=63 ID=21103 DF PROTO=TCP SPT=4662 DPT=10Aug 28 23:00:09 linux kernel: SuSE-FW-UNALLOWED-ROUTINGIN=eth1 OUT=ppp0 SRC=192.168.1.40 DST=217.225.201.254 LEN=57 TOS=0x00 PREC=0x00 TTL=63 ID=60841 DF PROTO=TCP SPT=4662 DPT=1Aug 28 23:00:09 linux kernel: SuSE-FW-UNALLOWED-ROUTINGIN=ppp0 OUT=eth1 SRC=217.81.190.199 DST=192.168.1.40 LEN=63 TOS=0x00 PREC=0x00 TTL=123 ID=31363 DF PROTO=TCP SPT=3300 DPT=4Aug 28 23:00:10 linux kernel: SuSE-FW-UNALLOWED-ROUTINGIN=eth1 OUT=ppp0 SRC=192.168.1.40 DST=217.235.27.95 LEN=196 TOS=0x00 PREC=0x00 TTL=63 ID=46387 DF PROTO=TCP SPT=4662 DPT=20Aug 28 23:00:10 linux kernel: SuSE-FW-UNALLOWED-TARGETIN=ppp0 OUT= MAC= SRC=213.41.190.50 DST=80.145.118.9 LEN=52 TOS=0x00 PREC=0x00 TTL=119 ID=52022 DF PROTO=TCP SPT=4627 DPT=46Aug 28 23:00:11 linux kernel: SuSE-FW-UNALLOWED-ROUTINGIN=ppp0 OUT=eth1 SRC=62.225.224.78 DST=192.168.1.40 LEN=132 TOS=0x00 PREC=0x00 TTL=123 ID=46413 DF PROTO=TCP SPT=3260 DPT=4Aug 28 23:00:11 linux kernel: SuSE-FW-UNALLOWED-ROUTINGIN=ppp0 OUT=eth1 SRC=80.11.184.192 DST=192.168.1.40 LEN=46 TOS=0x00 PREC=0x00 TTL=116 ID=65300 DF PROTO=TCP SPT=16392 DPT=4Aug 28 23:00:11 linux kernel: SuSE-FW-UNALLOWED-ROUTINGIN=eth1 OUT=ppp0 SRC=192.168.1.40 DST=80.14.103.72 LEN=45 TOS=0x00 PREC=0x00 TTL=63 ID=27602 DF PROTO=TCP SPT=4662 DPT=6506 My Firewall nics: ------------------------ eth0 Link encap:Ethernet HWaddr 00:80:48:C5:C9:11 inet addr:192.168.2.254 Bcast:192.168.2.255 Mask:255.255.255.0 eth1 Link encap:Ethernet HWaddr 00:00:21:FE:4C:14 inet addr:192.168.1.254 Bcast:192.168.1.255 Mask:255.255.255.0 eth2 Link encap:Ethernet HWaddr 00:30:84:74:AE:52 inet addr:192.168.0.99 Bcast:192.168.0.255 Mask:255.255.255.0 ppp0 Link encap:Point-to-Point Protocol inet addr:80.145.118.9 P-t-P:217.5.98.130 Mask:255.255.255.255 I am not sure if i should disable these entrys (well, i dont know how to do that anyway), but in the other case they might be important. Or is this a kind of misconfigures network. Thanks! Mario

1 0

AW: [suse-security] secure login & shutdown with cron
by Ulrich Roth 29 Aug '02

29 Aug '02

Hello Philippe, > Is it possible to login with ssh, start a script and log out? Yes, it is. But you needn't even do this, the solution is still easier. > I got a APC with only one USV cable and no additional module for > serial-connectors (smart ups 700). > Powerchute cannot stop this machine from remote without a cable or a > network module, can it? Afaik, yes. The UPS 700 is only a small one. We have the UPS 5000 with a built-in NIC, so we use PowerChute network shutdown. But still we have the same problem as you for our machines in the DMZ. > I want to shutdown a second machine remotely. I solved this problem by running a script on the machine connected to the UPS with this simple line: "ssh <remote-machine> shutdown -h now" > This runs before shutdown of local machine runs with a dalay. > Is it possible to login as user with ssh and authentification via > keyfile? Yes, of course. > What is to be set in the /etc/ssh/sshd_config? Nothing special, afaik. Good luck Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

2 1

IP_FORWARDING TO DMZ
by bernd.erk＠mindextension.de 29 Aug '02

29 Aug '02

hello all, posting my problem once again, because i got no response. My problem is, that IP_FORWARDING(ROUTING) on the external firewall works only great, if the firewall is down ]-;. I can access all internet services from internal network without any proxy functionality. if i start the firewall, i always receive deny of ports messages in the log file. in my opinion it's a problem with unprivileged ports, but the settigs in the firewall.rc.config are switch on "yes" for unprivilegd ports. So the question is: how can i route the traffic to the Web-Server, Application-Server and Internal-Firewall on dedicated ports, if the firewall is up and blocks the the most ports except mail, www, domain and so on??? THANKS FOR HELP i've got the following configuration: |-----------------| | | | T-Interconnect | | Router | | | |-----------------| private network address | | | | Transfer-Network with private address band (192.168.0.x) | | | |-----------------| private network address | External | | Firewall | | | | firewall/IP_FORW| |-----------------| official network address | | ---------------------------- | | | | | |-----------------| official network address | | example for | | | DMZ-Server | | | | | | Apache | | |-----------------| | | |-----------------| official network address | Internal | | Firewall | | | | firewall / masq | |-----------------| private network address | | | | | COMPANY LAN (Network with private address band (195.88.235.x)) Bernd Erk Information Systems Engineering Fon: + 049 9123 9772 13 Fax: + 049 9123 9772 22 Mobil: + 049 172 8289944 Mail: <mailto:Bernd.Erk@ise-informatik.de> ---------------------------------------------- Die Demokratie ist ein Verfahren, das garantiert, daß wir nicht besser regiert werden, als wir es verdienen. George Bernard Shaw (1856-1950)

1 0

Ipsec-Router with SuSE 8.0 Linux and WinXP VPN-Client
by Achim Kirsch 29 Aug '02

29 Aug '02

Hallo! I have a Problem, with ipsec-router on SuSE 8.0 and WinXP as Client VPN. XP-PC1-------------------| 192.168.10.1 | | SuSE 8.0 XP-PC2-------------------|---------------------------------| ipsec-router |-----------------------------------------| Internes LAN 192.168.10.2 | 192.168.10.15 192.168.11.15 192.168.11. | XP-PC3-------------------| 192.168.10.3 1. With version of freeS/WAN did I need? 2. Must the kernel new compiled to use frees/WAN ? 3. With other services must be installed and configured ? Achim Kirsch EDV-Abteilung Alfred Bohn GmbH & Co. KG

2 1

Re: [suse-security] secure copy problems
by Dominik Metzler 29 Aug '02

29 Aug '02

Thanx a lot for your help !! hope it works regards dom ----- Original Message ----- From: "Armin Schöch" <armin(a)iap-kborn.de> To: "Dominik Metzler" <doeme(a)dplanet.ch> Cc: <suse-security(a)suse.com> Sent: Thursday, August 29, 2002 4:35 PM Subject: Re: [suse-security] secure copy problems Hello Dominik ! > I try to copy some directories from one machine to an other with > scp. Now I would like to do this with a cronjob, but it doesn't > work. I think there is a problem with the authentication key for > the remote-machine. Is there anybody who can help me, to solve > this problems. > You need to put the public key from your machine into the ~/.ssh/authorized_keys" file on the remote host. Try to enter the "scp" command on the prompt. Does it work ? do you have to enter a password ? Have you specified the "-r" option for copying directories recursively ? HTH, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

1 0

secure copy problems
by Dominik Metzler 29 Aug '02

29 Aug '02

Hi everybody! I try to copy some directories from one machine to an other with scp. Now I would like to do this with a cronjob, but it doesn't work. I think there is a problem with the authentication key for the remote-machine. Is there anybody who can help me, to solve this problems. thanx Dom ________________________________ Assistent ISB-TeamTechnik Dominik Metzler Plattenstrasse 14 CH-8032 Zuerich

1 0

SuSE Firewall onCD VPN Edition (FreeSWAN) and routing problem
by suse-security＠ott-service.de 28 Aug '02

28 Aug '02

Hello IPSEC professionals, A lot of people seem to have problems getting IPSEC to work properly. My VPN is working fine as long as the Roadwarrior is in the DMZ. but as soon as I use dialup (T-DSL or ISDN: T-Online / Freenet) I have a problem. This is the current setup: LAN: 10.0.0.0/24 | eth0=10.0.0.1 SuSE_Firewall on CD VPN edition eth1=xx.yy.zz.226 | DMZ: xx.yy.zz.224/29 | DSL Router Cisco 1400: xx.yy.zz.225 DSL: T-Online Interconnect I have configured the SSH Sentinel on a Roadwarrior (laptop Win2k) and tested the configuration by connecting the laptop to the DMZ (assigning the IP xx.yy.zz.229). This works fine and I can work on our local servers. As soon as I have the laptop as a mobile client (ISDN T-Online or T/DSL), I can authenticate with the firewall but I can't access any machine in my LAN (not even PING). Turning off all non-essential network adapters (assuming a routing problem on the laptop) has no effect. What I need now is a hint from someone how I can trace that problem. Or maybe someone here knows if Telekom blocks ESP packets on their routers. thanks for your help Jörn ------------------------------------------------------------ Jörn Ott Telefon: (0 22 24) 94 08 - 73 EDV Service & Beratung Telefax: (0 22 24) 94 08 -74 Lohfelder Str. 33 E-Mail: mailto:white@ott-service.de 53604 Bad Honnef WWW: http://www.ott-service.de/

2 1