September 2002 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] iptables question
by GentooRulez 27 Sep '02

27 Sep '02

The problem is not iptables, but the routing. A short excourse. The subnet mask connected with an a ip address determines, whether another ip should be reachable via the standard gateway or directly through a certain nic. For example (only 1 NIC in your box) 192.168.1.0/24 means a subnetmask of 255.255.255.0 so if the routing part of your kernel has to reach 192.168.2.1 it does following: own ip AND 255.255.255.0 = 192.168.1 other ip AND 255.255.255.0 = 192.168.2 if the results differ the routing routine decides to take the standard gateway. To be more precious: any box in your 10.1.1.1/8 network will not be routed through your standard gateway according above description. For example 10.1.1.30 want to reach mail server. 10.1.1.20 and 255.0.0.0 = 10.0.0.0 10.1.1.30 and 255.0.0.0 = 10.0.0.0 result DONT differ, so kernel will send packets directly. Solution: add extra routes for e.g mail server route add 10.1.1.20 netmask 255.0.0.0 gw your.ext.ip.addr hope that helps Yours Michael BTW: Why you want to do so - logging purposes ? >I have a dmz firewall setup that connects 2 private networks with the >public Internet (net1 and net2). > >I don't seem to be able to get my configuration to the point where a >machine in net1 can connect to another machine in net1 trough its public >IP address. >Example: >dmz router: 10.1.1.1 >mail server: 10.1.1.20 >http server: 10.1.1.30 > >I would like to enable the http server to to go to the mail server >through the public IP address of the mail server rather than being >limited to going straight to 10.1.1.20. > >All machines have 10.1.1.1 as their default gateway and NAT for mail >connections from the outside works. I don't see any packets being >dropped on the firewall since I allowed port 25 connections from the >inside of the firewall as well.

2 1

AW: [suse-security] trouble with http
by ONAY, Gabriel 27 Sep '02

27 Sep '02

I mean a simple download with http. I click on the hyperlink of the file. The save under window appears. I chose a path, filename and click on save. Now apears the download-status-window but the status bar is still standing. -----Ursprüngliche Nachricht----- Von: Markus Gaugusch [mailto:markus@gaugusch.at] Gesendet: Donnerstag, 26. September 2002 16:06 An: ONAY, Gabriel Cc: suse-security(a)suse.com Betreff: Re: [suse-security] trouble with http On Sep 26, ONAY, Gabriel <G.Onay(a)ove.at> wrote: > I use Suse 8.0 with Susefirewall2 and Squid 2.4. > The main idea is a firewall with transparent proxy. > 1. If FW and Squid (transparent settings) are running: > Browsing with IE is ok but i can't download any files. What do you mean by "download any files"? FTP? It won't work, because you can't intercept ftp transparently (only works with http, don't know about https). Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

4 6

iptables question
by Ferdinand Schmid 26 Sep '02

26 Sep '02

HI, I have a dmz firewall setup that connects 2 private networks with the public Internet (net1 and net2). I don't seem to be able to get my configuration to the point where a machine in net1 can connect to another machine in net1 trough its public IP address. Example: dmz router: 10.1.1.1 mail server: 10.1.1.20 http server: 10.1.1.30 I would like to enable the http server to to go to the mail server through the public IP address of the mail server rather than being limited to going straight to 10.1.1.20. All machines have 10.1.1.1 as their default gateway and NAT for mail connections from the outside works. I don't see any packets being dropped on the firewall since I allowed port 25 connections from the inside of the firewall as well. What am I missing here? Thanks, Ferdinand -- Ferdinand Schmid Architectural Energy Corporation Celebrating 20 Years of Improving Building Energy Performance http://www.archenergy.com

1 0

trouble with http
by ONAY, Gabriel 26 Sep '02

26 Sep '02

Hi I have a special problem. I use Suse 8.0 with Susefirewall2 and Squid 2.4. The main idea is a firewall with transparent proxy. With one windows client and Internet Explorer i want go into the internet My problems are: 1. If FW and Squid (transparent settings) are running: Browsing with IE is ok but i can't download any files. 2. If FW and Squid (without transparent settins) are running: Browsing with IE is ok but i can't download any files. 3. If i go directly to the Internet (without proxy an FW). I can't browsing with IE and i can't download any files. Grazy is, if i run iptraf, then is all ok. What's that??? Thanks for answer Gabriel

3 2

still problems with SuSEfirewall2 rules
by Andreas Meier 26 Sep '02

26 Sep '02

Hi all, i am using Suse 8.0 with the default SuSEfirewall2 settings. i add this rule into my SuSEfirewall2 script ( with advice from jammer, many thanks for quick response ) FW_FORWARD_MASQ="0.0.0.0/0,192.168.0.4,tcp,4662 0.0.0.0/0,192.168.0.4,udp,4665" and i get this one Sep 26 15:33:18 keeper kernel: SuSE-FW-DROP-DEFAULT IN=eth1 OUT= MAC=00:60:9 7:be:66:08:00:05:5f:ee:10:8c:08:00 SRC=217.83.108.173 DST=62.194.178.214 LEN=78 TOS=0x00 PREC=0x00 TTL=118 ID=39213 PROTO=UDP SPT=1464 DPT=137 LEN=58 Sep 26 15:33:22 gatekeeper kernel: SuSE-FW-DROP-DEFAULT IN=eth1 OUT= MAC=00:60:9 7:be:66:08:00:05:5f:ee:10:8c:08:00 SRC=217.83.108.173 DST=62.194.178.214 LEN=78 TOS=0x00 PREC=0x00 TTL=118 ID=51501 PROTO=UDP SPT=1464 DPT=137 LEN=58 Thanks Met vriendelijke groeten, Andreas Meier mailto:a.meier.home@gmx.net ************************************************

2 1

SuSEfirewall2-custom rules don't work
by Andreas Meier 26 Sep '02

26 Sep '02

Hi all - 1) I am running the Firewall2 on Suse 8.0 + Squid/2.4.STABLE6. I wan't to allow the following ports open en forward to 192.168.0.4,but the firewall don't allow. So, whats wrong ? cut from /etc/sysconfig/scripts/SuSEfirewall2-custom iptables -A forblock -i eth1 -p tcp --dport 4661 -j ACCEPT iptables -A forblock -i eth1 -p tcp --dport 4662 -j ACCEPT iptables -A forblock -i eth1 -p udp --sport 4665 -j ACCEPT iptables -A PREROUTING -t nat -p tcp --dport 4661 -i eth1 -j DNAT --to 192.168.0.4 iptables -A PREROUTING -t nat -p tcp --dport 4662 -i eth1 -j DNAT --to 192.168.0.4 iptables -A PREROUTING -t nat -p udp --sport 4665 -i eth1 -j DNAT --to 192.168.0.4 Any ideas anybody? 2) by the way.... where can i find the rules for iptables ??? many thanks Andreas Meier mailto:a.meier.home@gmx.net

3 2

AW: [suse-security] SuSEfirewall2-custom rules don't work
by Wanning, Mike 26 Sep '02

26 Sep '02

Hi, >1) >I am running the Firewall2 on Suse 8.0 + Squid/2.4.STABLE6. >I wan't to allow the following ports open en forward to 192.168.0.4,but the firewall don't >allow. >So, whats wrong ? Why are you using the custom-script? There is a way to configure the Forwarding in the Script /etc/sysconfig/SuSEfirewall2. Enter the Rules in the following style, seperated by spaces. # 14.) # Which services accessed from the internet should be allowed to masqueraded # servers (on the internal network or dmz)? # REQUIRES: FW_ROUTE FW_FORWARD_MASQ="0/0,192.168.0.4,tcp,4661" btw. why dont you use mldonkey? it is 10 times better than the windows-client. Greetings Mike Gesendet über Mailserver: begros.de! Trotz sorgfältiger Virenprüfung können wir für eventuelle Schäden, die durch nicht erkannte Computerviren entstehen, keine Haftung übernehmen.

1 0

Re: Package sendmail-tls with openssl vulnerability?
by Sven Koch 26 Sep '02

26 Sep '02

[repost with subscribed email-address] On Thu, 19 Sep 2002, Hatto von Hatzfeld wrote: > After updating the OpenSSL packages (and restarting the services ) [...] > But on the smtp port 25 with option -s (i.e. with TLS) I get: > > VULNERABLE: does not detect small overflow > > What's wrong? Or: How to close this hole? To the SuSE-Security-Team: SuSE 7.1: # rpm -qf /usr/sbin/sendmail sendmail-tls-8.11.2-36 # ldd /usr/sbin/sendmail libdl.so.2 => /lib/libdl.so.2 (0x4001d000) libdb.so.2 => /lib/libdb.so.2 (0x40020000) libnsl.so.1 => /lib/libnsl.so.1 (0x4002e000) libresolv.so.2 => /lib/libresolv.so.2 (0x40044000) libsasl.so.7 => /usr/lib/libsasl.so.7 (0x40055000) libc.so.6 => /lib/libc.so.6 (0x40060000) libgdbm.so.2 => /usr/lib/libgdbm.so.2 (0x40173000) libcrypt.so.1 => /lib/libcrypt.so.1 (0x4017a000) libpam.so.0 => /lib/libpam.so.0 (0x401a9000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000) (no libssl or libcrypto here -> openssl hardlinked!) The last Update for 7.1 and sendmail-tls is dated Feb 9 2002, and thus before the openssl-hole. # rpm -qf /usr/sbin/sendmail --changelog * Wed Aug 22 2001 - werner(a)suse.de - Security Update: Fix for a signedness buffer overflow in tTflag() (bugtraq ID 3163) [...] How many packages are still there and hardlinked against openssl, but without updates? i.A. Sven Koch Server Management -- com.unit GmbH http://www.comunit.net/ Eiffestr. 598 20537 Hamburg | Germany Fon +49-40-2111 05 25 Fax +49-40-2111 05 26

8 10

8.0 openssh update?
by Michael Galloway 25 Sep '02

25 Sep '02

hmmm .... i must have missed something. i do a clean install of suse 8.0, then when i install the current versions of openssh and openssl: bil:~ # rpm -q openssh openssh-3.4p1-78 bil:~ # rpm -q openssl openssl-0.9.6c-80 sshd now fails to start at boot time. did i miss something in the annoucements about the openssh rpm? -- michael

5 13

How do I put a hole in Firewall2 for ssh2?
by Cyndy Bresloff 24 Sep '02

24 Sep '02

Hello - Please bear with me, but I've tried to find an answer to this question on the suse pages, to no avail. I am running the Firewall2 from SuSE on a 7.1 SuSE system, and I have ssh2 installed; but it doesn't work. I tried to modify the firewall2 script for it to work, but I am doing something wrong. And advice or pointers as to what to read about this, would be most helpful. thank you, Cyndy Bresloff ********************************************************************* Cyndy Bresloff "When passion is not tempered by logic Department of Astronomy And ambition not balanced by gratitude 527 Campbell Hall The truth is obscured in this age of Berkeley, CA 94720-3411 Instantly cured Which values nothing of value (510) 642 - 8184 And puts a price on what it is ... which is ... priceless" --Annette Peacock

2 1