August 2002 - openSUSE Security - openSUSE Mailing Lists

YAST and updates
by Thomas Wheeler 19 Aug '02

19 Aug '02

Hi all Does any one know what ports yast's update use, I know it uses port21 but what other ports dies it use? I am using the ncurses good old text based update. Regards, Thomas Wheeler -=No Trees Were Harmed By Sending This Email, Only A Few Electrons Were Seriously Discomforted =-

2 1

RE: [suse-security] Fileserver access from public networks?
by Reckhard, Tobias 19 Aug '02

19 Aug '02

> The usual scenario is a lan, with the internal servers (e.g. the file > server), secured by firewall solutions, a dmz, with external > servers like www > or ftp, also secured with a firewall. Yep, a tried and trusted architecture. > Everybody tells you: isolate the fileserver from public > networks, don't use > smb or appleshare across the internet. Ok. > > But we have the following scenario: we are at university > here, students want > to acces data from the internet. So there must be some kind > of internet > access to the file server. Here are my questions: > > - Why do people run ftp servers to share files, but tell me > that cifs(smb) > and appleshare are "insecure" on public networks. Both > encrypt passwords... > and data is not encrypted in ftp, too (?). I is much simpler > for users to use > the same protocol (smb/applehare) in university networks and > at home (and ftp > doesn't keep type and creator information important for the > mac-clients). You're misunderstanding what 'everybody' tells you. When they say "isolate the fileserver from public networks, don't use smb or appleshare across the internet", they mean: * Isolate the file server from public networks, * make sure the data on the file server, which is assumed to be sensitive, doesn't leave the private network, * don't allow access to the file server across the Internet without adequate protection. Don't use cleartext protocols such as SMB or Appleshare. FTP and HTTP aren't alternatives to CIFS or Appleshare, they're worse when you're talking about file server access. FTP servers are good to provide free access to public data, same with HTTP servers. You *can* use HTTPS for secure, i.e. strongly encrypted and mutually authenticated access to file resources. Or you can employ VPN techniques. > - I don't want to have one external server and one internal. > I'm almost sure > that just the file I need when connecting from the outside > will always be on > the internal server than ;-), and how to explain our users > that they have one > account, but are to store data ont wo file servers... Is it > the only solution > to have one internal and one external file server, not connected? It is usually sensible, security-wise, to keep a file server with sensitive data well away from the Internet, away from any direct contact. The same applies to databases, BTW. If you were to ask me, you'd need to have very good reasons to place such a beast in a network that's accessible from the Internet without at least a sound application layer gateway inbetween. The alternative is to place a server in the DMZ, which is supplied with copies of (*only*) the necessary data stored on the internal box. It makes things less transparent to users, yes, but I'm sure it can be made to be entirely usable. > - If I really install a second external file server, what > about linking it > into the internal one? So I could create a subdir > "internet_box" in users' > home dir's, pointing to their nfs-mounted directories on the > external server. > So they could decide to make their files internet-accessable > or not (some > will have all their data on the external server, while seeing > only one file > server, while others who only work from university network > won't use this > directory at all). What about this scenario? We security folks typically don't like to use NFS or other remote filesystem schemes, including SMB, across security boundaries. It's not as bad to use them across the DMZ-internal net boundary as it is between the Internet and a private net, but it still gives us very creepy feelings.. If you need to use NFS or SMB, SMB is preferred security-wise. > How do you implement such installations? We are going to > expand our students' > computer lab soon, and I want to have a clear structure of > servers and > networks before. I'd: * Set up a second file server in the DMZ and a replication scheme to (automatically) transfer, i.e. push the relevant data from the internal machine to the DMZ. * Arrange for the students to be able to access the DMZ server via VPN, HTTPS or SMB-over-SSL. Full authentication would be mandatory. * If files need to be modified from the outside, I'd try to use something with the check-out/check-in functionality of CVS. Since this would probably involve inbound communication between the DMZ server and the file server, I'd put a strong focus on security, making sure the DMZ server can't make the file server do anything it shouldn't and also making sure that it can't perform a DoS against anything important. * If files need to be inserted from the outside, I'd try to go with an 'incoming' area on the DMZ server, from which the internal server periodically pulls and subsequently removes new data, which it then sorts to destination directories. These may then be published on the DMZ server in part or whole. Ideally, I'd use a document management system. It'd probably be most appealing to users and most practical if it used WWW techniques. Cheers Tobias

1 0

RE: [suse-security] Encrypt E-Mails without human-agreement
by Reckhard, Tobias 19 Aug '02

19 Aug '02

> > This is called Transport Layer Security (TLS) because it > only encrypts > > the direct connection from one MTA to the next. Every MTA > on the route > > is able to read the mail since it processes mails above the > > transportlayer. Privacy can only be guaranteed if there is a direct > > connection between sending and recieving MTA (and both ca > nbe trusted). > > This is not true for SMTP. > > this is not really true, i can define SMTP routing tables and contact > such smtp server directly, no need for smarthost. I think just of > the possibillity that you can send 'encrypted' mail over the net. > Surely the mail itself isn't encrypted. You can't generally say that sending mails directly to a domain's MXs guarantees that they'll travel encrypted to their destination, you can't even be sure that they won't traverse the Internet again unencrypted before reaching their destination. With e.g. PGP and S/MIME, you can. > > To meet all privacy requirements encryption must take place on the > > application level. > > right, but that isn't possible without users interaction. True. > > And for authentication over insecure networks it is > necassary to have > > cryptographically secure identification data for every person to > > communicate with. This can't be done without the senders/receivers > > cooperation. > > noone 'authenticates' normal mails, so why should i take special > care on a encrypted mail? Authentication and encryption are distinct operations, there is no need for you to take one into account when deciding whether or not to use the other. However, authentication does have its applications, e.g. I expect people to run only those executable attachments that I've signed. > i don't know that my mail travels in > an encrypted 'transport layer' thru the net. For real and approved > security you need pgp or something simmilar, but just to encrypt > the mail transport tls is some kind to think of. So if you want > no user interaction, it is a way to get a bit more security, no > gurantee, no auth, just a bit encryption. You can perform authentication in TLS, but it authenticates only the SMTP client and server, not the email sender or recipient. The use of TLS without authentication equates to missing the point of it entirely, IMHO. Cheers Tobias

1 0

Re: [suse-security] Encrypt E-Mails without human-agreement
by Michel Messerschmidt 18 Aug '02

18 Aug '02

> IF both MTA support ssl, the mail will be transfered encrypted. > So if your MTA and the MTA of the other company speaks TLS, > your clients on both sides also uses ssl for smtp/pop3/imap, > the mail will transfered in an encryption tunnel. No. This is called Transport Layer Security (TLS) because it only encrypts the direct connection from one MTA to the next. Every MTA on the route is able to read the mail since it processes mails above the transportlayer. Privacy can only be guaranteed if there is a direct connection between sending and recieving MTA (and both ca nbe trusted). This is not true for SMTP. To meet all privacy requirements encryption must take place on the application level. And for authentication over insecure networks it is necassary to have cryptographically secure identification data for every person to communicate with. This can't be done without the senders/receivers cooperation. -- Michel Messerschmidt 9messers(a)informatik.uni-hamburg.de http://www.michel-messerschmidt.de

3 2

Need help removing IRC chat room software...
by Andrew Lietzow 17 Aug '02

17 Aug '02

Dear Security wizards, I have what I am coming to believe is a nasty "infection" of BitchX on my system. I can't seem to get the software removed. I may have in confused moment, actually installed this myself but I've never used it and would like to get it removed. Even as root, I cannot remove the user, or the associated .bash* files. The username is "light". Is that the correct default name? Anyone know an online resource that will provide some help for getting rid of these unwanted IRC chat programs? Thanks in advance.. -- Andrew Lietzow The ACL Group, Inc.

1 0

problem with NAT / ip forwarding
by Wojtek 17 Aug '02

17 Aug '02

Hello, I have a problem related to NAT and IP forwarding: My SuSE server has two network interfaces. One is conneted to a LinkSys DSL router (which is conntected to the internet), the other is conncted to my LAN. The problem is that I am not able to access my SuSE server from inside the network with my external IP. Maybe I am missing some routing entry? Here's how my network is setup: SuSE server has 2 interfaces: eth0 (192.168.2.2) connected to LAN eth1 (192.168.1.2) connected to an Linksys router (192.168.1.1) which is doing NAT. On the Linksys router I forwarded port 80 to my SuSE server. Clients from outside (internet) can connect to my SuSE server via the external IP. The SuSE server itself can connect to itself via the external IP. An internal client of the 192.168.2.0 network is not able to connect to the SuSE server using the external IP. The client end's up on the Linksys router. What is the problem? THANKS IN ADVANCE, Wojtek Here's a simple diagram of my network: +-----------------+ | Linksys router | | doing NAT | | | | if0: external IP| | if1: 192.168.1.1| | | | if0 if1 | +--+-------+------+ +------------------+ +----------+ | | | SuSE server | | LAN/ | | | | eth0 192.168.2.2 +----------------+ SWITCH | /--+----\ +------------+ eth1 192.168.1.2 | | | | inter | | | +----+-----+ | net | +------------------+ | \-------/ +--------------+ | hal9000 | | 192.168.2.120| +--------------+ -- Wojtek mailto:ml@lunetta.de

5 4

kernel 2.4.19 in 7.1 box
by vjts 17 Aug '02

17 Aug '02

Can I update el kernel 2.4.19 what is in ftp://ftp.suse.com/pub/people/mantel/next/ for linux 7.1 box ? Is this correct ? ftp://ftp.suse.com/pub/suse/i386/update/7.1/kernel/ only is 2.4.16. thank you

1 0

iptables patches
by Wahlert Andreas 16 Aug '02

16 Aug '02

Hi List, i'm playing around with iptables - extensions and lids. so i have one question: how can i provide a patch like "iplimit" without to change my kernel or change the lilo.conf. regards from germany Andreas Wahlert

1 0

No cron on SuSE 8 ?! (OT for security)
by Schoenwaelder Oliver 16 Aug '02

16 Aug '02

Hi, I wonder if there are any problems with cron on SuSE 8. None of my cron scripts work. It seems that they don't even start. I also put a simple command in my crontab (5 * * * * echo "Cronjob" | mail -s "Mail from cron" root). This doens't work, too. Why? Cron is running, the cronfiles are in /var/spool/cron/tabs. In messages I see that cron recognized that I modified/listed the crontabs. But nothing else. None of the users is listed in cron.allow (doesn't exist) and cron.deny. Any idea? Thx, Oliver

4 3

Help with SuSE firewall2 and VPN (long)
by David Abraham 16 Aug '02

16 Aug '02

I am having problems getting my VPN software to work correctly on a client machine behind my SuSE 8.0 firewall box and was hoping for some help. The client uses the Checkpoint Securemote client to connect to a remote network. I found a FAQ page on changes to firewall rules to make this work, but the instructions are a little unclear to me and I am not sure how to integrate them with SuSEfirewall2. I have pasted part of the FAQ and my current Firewall variables below. Suggestions would be very welcome. Thanks! David The FAQ ( http://www.phoneboy.com/faq/0372.html ) suggests adding rules like this: fw1-ip is the external IP of your firewall client-ip is your SecuRemote Client linux-ip is the IP of your Linux host ext_if refers to external interface /usr/sbin/iptables -A input -s linux-ip -d fw1-ip -p udp --dport 500 -j ACCEPT /usr/sbin/iptables -A input -s linux-ip -d fw1-ip -p 50 -j ACCEPT /usr/sbin/iptables -A input -s fw1-ip -d linux-ip -p udp --dport 500 -j ACCEPT/usr/sbin/iptables -A input -s fw1-ip -d linux-ip -p udp --dport 2746 -j ACCEPT /usr/sbin/iptables -A input -s fw1-ip -d linux-ip -p 50 -j ACCEPT /usr/sbin/iptables -A forward -s linux-ip -d fw1-ip -j ACCEPT /usr/sbin/iptables -t nat -A POSTROUTING -o ext_if -j MASQUERADE How should I do this with SuSEfirewall2? variable in /etc/sysconfig/SuSEfirewall2 --------------------------------------- FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="113 ssh" FW_SERVICES_EXT_UDP="domain" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="domain" FW_SERVICES_INT_UDP="domain" FW_SERVICES_INT_IP="domain" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="yes" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no"

1 0