August 2002 - openSUSE Security - openSUSE Mailing Lists

ARP-Request although blocked Packages
by Sebastian Schucht 19 Aug '02

19 Aug '02

Hallo, I have write me a little firewall with iptables and it works fine. but if I scan my PC he send an ARP-request into the Lan and betray my PC to the scanners PC. I know that he only have to look into his arp-table to find my PC there but I dont wont to give him an reaction on an scan. How can I configure my System that it send only a ARP-request if the Package pass the firewall. -- Mit freundlichen Grüßen \ o Sebastian Schucht / /\ Plattenweg 1 | \ 64823 Groß-Umstadt Tel.: 06078/8723 E-Mail: Sebastian-Schucht(a)gmx.de

1 0

firewall2 help
by Geoffrey Makstutis 19 Aug '02

19 Aug '02

Hi, I'm a bit of a newbie on the firewall front and have a problem that I hope someone can help me with. We have a static IP address over an ADSL connection, with masquerading for the internal network. This server is offering web and mail services to our staff for home work. >From outside the network and , I can access the webserver and mail server without difficulty. However, machines on our local network cannot get to the server via the internet. They can access the server locally, but this causes problems with some configuration files on the server (which want fully qualified names). The local machines, can get other internet sites via the masquerading on the server. If I turn-off SuSEfirewall2, I can access the server via it's static IP address. Can someone advise as to what I need to configure on the firewall to allow local machines to go out on the internet and then come back onto the server? I have attached the current /etc/sysconfig/SuSEfirewall2 file. Thanks! Thanks.

5 4

Re: [suse-security] how can i have public IPs in the DMZ with SuSEfirewall2
by Togan Muftuoglu 19 Aug '02

19 Aug '02

* Andreas Bittner; <bittner(a)rz.fh-heilbronn.de> on 19 Aug, 2002 wrote: >hello there togan, > >i am not very good at these dmz/ip/routing nd iptables stuff.. and i simply dont understand what i would have to set for my dmz ip.. > >the mailserver is x.x.x.66 i agree i set/leave it like that.. i set x.x.x.67 for example to the external eth0 card that connects to the isp router that has x.x.x65. eth0 a has mask of 255.255.255.248 right? and what does the DMZ eth1 have? x.x.x.65 for eaxmple with same 255.255.255.248 mask? will susefirewall2 give the packets for .66 to that eth1 card? will this all work? > >can you please help me. It is always a good idea to reply to list as there are more eyes to correct mistakes, I happen to have only two -) yes x.x.x.65 with 255.255.255.248 for eth1 in DMZ is fine -- Togan Muftuoglu

2 1

Re: [suse-security] firewall2 help - Corrected URL
by Bill.Light＠kp.org 19 Aug '02

19 Aug '02

>Try the Shorewall firewall instead..easier to set up >see www.shorewall.org And when you see that doesn't work - try shorewall.NET

2 1

AW: [suse-security] Sendmail and 2 servers
by Ulrich Roth 19 Aug '02

19 Aug '02

Hi Thomas, > Unfortunately the admin "guru" before me decided to install Microshaft > Exchange 5.5 ( I'd rather run through Berlin naked on a cold > winters day before I touch exchange server ). Well subsequently > the first thing I did when I started here was install suse 8.0 and > sendmail. What I'd like to do is have my sendmail and exchange > server on the same domain name. But I want all the mail to go > via sendmail this part is relatively easy, how ever I want > to move some users off to sendmail and still have them being > able to mail between sendmail and exchange users. Is this > possible and how can this be done? I'm not quite sure if I understood you very well, but try this: If you want an Exchange user to send an e-mail to the user who has his account on the linux box, send it to <user>@<name of the linux box>. Maybe you have to tell sendmail to accept mail for <name of the linux box>, but normally it should simply work. The other way round, the linux user can send mail to <user>@<name of Exchange box>. On the Exchange server, you have to give the user a second SMTP address of the form <user>@<name of the Exchange box>. But the normal address <user>@<domain> has to stay default, which means that it's written in fat letters. Otherwise the sender address will be wrong. Hope it helps Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

2 1

RE: [suse-security] YAST and updates
by Reckhard, Tobias 19 Aug '02

19 Aug '02

> Why is it preferrable to use a proxy instead of the > appropriate firewall > module. It's preferrable IMHO and if the proxy is designed with security in mind. In my and some others' opinions, application layer gateways offer better protection than stateful or dumb packet filters. Ideally, you'll combine an ALG with a packet filter. One reason that I consider ALGs more secure than stateful filters is that they're able to deal with application protocol complexities. Stateful filters typically have a much more limited context, often only the TCP segment or UDP datagram they're currently processing. As such, they can hope to correctly identify PORT and other FTP control statements, but they should also be easier to trick into wrong behaviour. There have been numerous errors in stateful engines, some of them having to do with FTP, one of which allowed an attacker to access any TCP port on (at least, I don't remember well enough) the FTP server, by fragmenting PORT commands. The fix chosen in all stateful filters I know of, which is to allow only PORT commands enclosed within a single TCP segment or IP packet (don't remember which exactly, but it's irrelevant to the point), is a kludge, IMHO. Tobias

1 0

RE: [suse-security] YAST and updates
by Reckhard, Tobias 19 Aug '02

19 Aug '02

> So how do I set up my firewall so to cater for this?.. is it > not a nice > security hole to allow all those ports above 1023 open?. It uses FTP. Set up an FTP proxy (preferrable) or a stateful helper module (simpler) to handle it without opening up the entire 'unprivileged' port range inbound. Cheers Tobias

2 1

Sendmail and 2 servers
by Thomas Wheeler 19 Aug '02

19 Aug '02

Hi All This one has been puzzling me for a while maybe some one can put some light at the end of my tunnel for this matter. Unfortunately the admin "guru" before me decided to install Microshaft Exchange 5.5 ( I'd rather run through Berlin naked on a cold winters day before I touch exchange server ). Well subsequently the first thing I did when I started here was install suse 8.0 and sendmail. What I'd like to do is have my sendmail and exchange server on the same domain name. But I want all the mail to go via sendmail this part is relatively easy how ever I want to move some users off to sendmail and still have them being able to mail between sendmail and exchange users. Is this possible and how can this be done?. Regards, Thomas Wheeler -=No Trees Were Harmed By Sending This Email, Only A Few Electrons Were Seriously Discomforted =-

1 0

Fileserver access from public networks?
by Lars O.Grobe 19 Aug '02

19 Aug '02

Hi! I have some questions how to understand the usual security advices regarding file services and public networks. The usual scenario is a lan, with the internal servers (e.g. the file server), secured by firewall solutions, a dmz, with external servers like www or ftp, also secured with a firewall. Everybody tells you: isolate the fileserver from public networks, don't use smb or appleshare across the internet. Ok. But we have the following scenario: we are at university here, students want to acces data from the internet. So there must be some kind of internet access to the file server. Here are my questions: - Why do people run ftp servers to share files, but tell me that cifs(smb) and appleshare are "insecure" on public networks. Both encrypt passwords... and data is not encrypted in ftp, too (?). I is much simpler for users to use the same protocol (smb/applehare) in university networks and at home (and ftp doesn't keep type and creator information important for the mac-clients). - I don't want to have one external server and one internal. I'm almost sure that just the file I need when connecting from the outside will always be on the internal server than ;-), and how to explain our users that they have one account, but are to store data ont wo file servers... Is it the only solution to have one internal and one external file server, not connected? - If I really install a second external file server, what about linking it into the internal one? So I could create a subdir "internet_box" in users' home dir's, pointing to their nfs-mounted directories on the external server. So they could decide to make their files internet-accessable or not (some will have all their data on the external server, while seeing only one file server, while others who only work from university network won't use this directory at all). What about this scenario? How do you implement such installations? We are going to expand our students' computer lab soon, and I want to have a clear structure of servers and networks before. Thank You, CU, Lars. www.rechnerpool.com

2 1

RE: [suse-security] YAST and updates
by Thomas Wheeler 19 Aug '02

19 Aug '02

Great So how do I set up my firewall so to cater for this?.. is it not a nice security hole to allow all those ports above 1023 open?. Regards, Thomas Wheeler -= No Trees Were Harmed By Sending This Email, Only A Few Electrons Were Seriously Discomforted =- -----Original Message----- From: Armin Schöch [mailto:armin@iap-kborn.de] Sent: Monday, August 19, 2002 8:39 AM To: Thomas Wheeler Cc: 'suse-security(a)suse.com' Subject: Re: [suse-security] YAST and updates Hi ! > Does any one know what ports yast's update use, I know it uses port21 but > what other ports dies it use? I am using the ncurses good old text based > update. The first thing YOU does is sending a "ping" to the ftp-server. If this fails because of a firewall, YOU will tell you: "No network connection". The file transfer is done by standard FTP protocol AFAIK. This means port 21 for the control connection + all highports (>1023) for the data connections. HTH, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

1 0