September 2002 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] Outlook Web Access and Opening port 443
by mailinglists＠belfin.ch 09 Sep '02

09 Sep '02

> I got such a setup running on my lan at home. > All it took me was to forward port 443 on my firewall (SuSE > 7.3) to the internal Exchange 2k Server: > > iptables -t nat -A PREROUTING -p tcp --dport 443 -i ppp0 -j > DNAT --to 192.168.0.100:443 That's not the same. The config would be a ssl secured reverse proxy in front of the Ex2k box. philipp

1 0

AW: [suse-security] Outlook Web Access and Opening port 443
by Jörg Fuchs 09 Sep '02

09 Sep '02

>> Or has anybody get Exc2000 gets run behind a application firewall or >> NAT-firewall? >I know of an installation of Exchange Server 2000 running Outlook Web Access through a NAT firewall (xBSD-based router >appliance) as an https service. >Sadly I don't know the configs that make it work. I got such a setup running on my lan at home. All it took me was to forward port 443 on my firewall (SuSE 7.3) to the internal Exchange 2k Server: iptables -t nat -A PREROUTING -p tcp --dport 443 -i ppp0 -j DNAT --to 192.168.0.100:443 Nothing needed to be changed on the Exchange machine. So I really don't what that stuff about changing the internal Script the Exhange Srv is all about. c ya Joerg

1 0

Re: [suse-security] >I try meanwhile for two weeks to successfully connect AND ping and connect
by Michael Boettjer 09 Sep '02

09 Sep '02

At 15:22 09.09.2002 +0200, you wrote: > >I try meanwhile for two weeks to successfully connect AND ping and connect > >to Server in the subnet 192.168.50 or .55 (behind the 2nd Linux-Router). > >The VPN-Tunnel is established also (afaik), but nothing else happens. I > >can't reach on server. no Server in DMZ and no server in the inner-LAN > >behind the second Linux-Router. Also There are no logged drops or rejects > >from the firewall. > >Maybe the answers is simple. According to your logs and your description >everything seems to work fine. > >In the docs of freeswan you can read, that you CAN NOT ping into the >VPN or to the other VPN-gateway from the gateway-box itself as long as you >dont take connection type tunnel! >So try to ping from a box in the VPN-subnet to a box in the other subnet. Yes i know that i can't ping the firewall using freeswan directly. but a ping from the roadwarrior to a server in one of the subnets behind the firewall have to function, or not? but also a "net use" from the roadwarrior to the samba-service of the inner-router don't goes, too. i think, the problem is the SuSEfirewall. I've read, that maskerading for the vpn-client have to switch off, but how i can do that? in my /etc/rc.config.d/firewall2.rc.config the Parameter FW_MASQ_NETS="192.168.0.0/16" contains all Subnets. How can i switch off the maskerading for the connection Server <--> Roadwarrior only? Thanks for any hints... Michael By the way - here is my ipsec.conf from the free/SWAN-Gateway: config setup interfaces="ipsec0=eth0" klipsdebug=none plutodebug=none plutoload=%search plutostart=%search uniqueids=no conn %default keyingtries=1 type=tunnel conn warriors left=0.0.0.0 leftsubnet= leftnexthop= right=195.91.41.11 rightsubnet=192.168.0.0/16 rightnexthop=195.91.41.254 rightupdown=/usr/lib/ipsec/_updown_custom compress=yes keyexchange=ike pfs=yes authby=secret auto=add

1 0

Re: [suse-security] free/SWAN and SuSEfirewall2 (iptables)
by Michael Boettjer 09 Sep '02

09 Sep '02

At 16:02 09.09.2002 +0200, you wrote: > > The Subnet between inner-router and firewall has the > > range 192.168.51.0/24. > > ... > > Destination Gateway Genmask Flags MSS Window irtt >Iface > > 0.0.0.0 195.90.31.254 0.0.0.0 UG 40 0 0 >eth0 > > 193.159.64.92 195.91.41.254 255.255.255.255 UGH 40 0 0 >ipsec0 > > 195.91.41.0 0.0.0.0 255.255.255.0 U 40 0 0 >eth0 > > 195.91.41.0 0.0.0.0 255.255.255.0 U 40 0 0 >ipsec0 > >I can't find a route to the "inner router" in the subnet 192.168.51.0/24 >given above. Can you ping the hosts in 192.168.0.0/16 from the firewall? If >not, then it won't possible through the VPN. Mmh, here is my complete Routing-Table of the Firewall: /root >route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.50.99 192.168.51.99 255.255.255.255 UGH 0 0 0 eth1 62.157.67.137 195.91.41.254 255.255.255.255 UGH 0 0 0 ipsec0 192.168.52.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2 195.91.41.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 195.91.41.0 0.0.0.0 255.255.255.0 U 0 0 0 ipsec0 192.168.51.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 127.0.0.0 0.0.0.0 255.255.255.0 U 0 0 0 lo 0.0.0.0 195.91.41.254 0.0.0.0 UG 0 0 0 eth0 First i want to (to the beginning) ping or "net use" the inner router (192.168.51.99) only. this functions. i can ping the router or telnet on port 139 from the firewall without problems. but not from the roadwarrior. > >up-client:) > > # connection to my client subnet coming up > > # If you are doing a custom version, firewall commands go here. > > iptables -I FORWARD 1 -s >$PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ > > -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK -j >ACCEPT > > iptables -I FORWARD 1 -d >$PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ > > -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK -j >ACCEPT >Did you configure the left/right-protoports in ipsec.conf? >Maybe you can post your ipsec.conf. Protoports? Here is the ipsec.conf from the firewall: config setup interfaces="ipsec0=eth0" klipsdebug=none plutodebug=none plutoload=%search plutostart=%search uniqueids=no conn %default keyingtries=1 type=tunnel conn warriors left=0.0.0.0 leftsubnet= leftnexthop= right=195.91.41.11 rightsubnet=192.168.0.0/16 rightnexthop=195.91.41.254 rightupdown=/usr/lib/ipsec/_updown_custom compress=yes keyexchange=ike pfs=yes authby=secret auto=add As client i'm using a win2k-Notebook and the ipsec-Implementation of it. The Tunnel-Configuration is read from this ipsec.conf-File: conn %default dial=vpn conn warriors left=%any right=195.91.41.11 rightsubnet=192.168.0.0/16 presharedkey=... network=ras auto=start pfs=yes >`iptables -L -nv` shows the packet counter of the rules. You can check, if >the rules are hit. > >tcpdump is always a big help to see, if packets leave or arrive at your >firewall. it's not installed for security reasons... ;-)) i will do that next. any ideas? Thank you very much, Michael

1 0

NIC Fried?
by Marcel Erkens 09 Sep '02

09 Sep '02

G'day guys and gals! Last week, for no apparent reason, my good old p133, suse 7.1 (all updates present) took a nosedive... after being alive for 230 some days it "just" rebooted itself. The logs didn't show anything, so I booted from the install CD, mounted the filesystem read only, and checked it against my tripwire db (which is stored on a cdr)... tripwire didn't find anything out of the ordinary, so I know there's no problem there. Ever since then I've been struggling with it though... Slow transfers (4-6k/sec on a local connect!) and all. Here's what /var/log/messages tells me: Sep 9 08:28:20 adsl187 kernel: eth0: Transmit error, Tx status register 82. Sep 9 08:28:47 adsl187 kernel: eth0: Transmit error, Tx status register 82. Sep 9 08:28:57 adsl187 last message repeated 2 times Sep 9 08:30:20 adsl187 kernel: httpd uses obsolete /proc/pci interface ifconfig says: eth0 Link encap:Ethernet HWaddr 00:50:DA:BB:62:2E inet addr:xxx.xxx.xxx.187 Bcast:xxx.xxx.xxx.191 Mask:255.255.255.248 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:6571 errors:0 dropped:0 overruns:0 frame:0 TX packets:5457 errors:0 dropped:0 overruns:0 carrier:0 collisions:34 txqueuelen:100 Interrupt:11 Base address:0x6400 eth1 Link encap:Ethernet HWaddr 52:54:4C:19:E1:38 inet addr:xxx.xxx.xxx.188 Bcast:xxx.xxx.xxx.191 Mask:255.255.255.248 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:1603 dropped:0 overruns:0 carrier:3206 collisions:27251 txqueuelen:100 Interrupt:3 Base address:0x300 (IP Addresses masked to protect the innocent) what dmesg says about the NICS: 3c59x.c 15Sep00 Donald Becker and others http://www.scyld.com/network/vortex.html eth0: 3Com 3c900 Cyclone 10Mbps TPO at 0x6400, 00:50:da:bb:62:2e, IRQ 11 8K byte-wide RAM 5:3 Rx:Tx split, autoselect/Autonegotiate interface. MII transceiver found at address 24, status 182d. Enabling bus-master transmits and whole-frame receives. ne.c:v1.10 9/23/94 Donald Becker (becker(a)cesdis.gsfc.nasa.gov) NE*000 ethercard probe at 0x300: 52 54 4c 19 e1 38 eth1: NE2000 found at 0x300, using IRQ 3. The odd thing is, eth1 SEEMS to be the card with the problem. Why would it be complaining about eth0 then? Surely it can't be because the default route follows eth0? And why would it be complaining about httpd using obsolete /proc/pci? Tell me... PLEASE! Thanks! Marcel

2 1

Re: AW: [suse-security] Outlook Web Access and Opening port 443
by Harald Wallus 09 Sep '02

09 Sep '02

Am Montag, 9. September 2002 11:12 schrieben Sie: > Hi, > > What you describe I got to work with exchange 5.5 owa. Exchange Server 5.5 is OK, thats work. > Also I tried it with exchange 2k. ssl secured squid 2.5pre-3 and behind it > a win2k server running owa on a iis 5. What happened? As soon as I stopped > reverse proxying on tcp:80 but continued on tcp:443 the connection failed. > I never found out why. > Re-opening tcp:80 owa worked normally but only for a short time over https. > Most of the traffic went through port 80. Not all scripts have this hardcoded line above, so sometimes it looks like it is running. Think on your client side cache. The line: "m_szURL = window.location.protocol + "//" + window.location.host + window.location.pathname;" window.location.protocol is http: or https: window.location.host is your IP or hostname Such a line are often into the cgi-scripts of Exchange Server 2000 Change them all, use cygwin and sed (are to much for do by hand). Perhaps someone tricky can plan a setup, where your external name of the server is the same that squid in reverse mode redirect to. Or has anybody get Exc2000 gets run behind a application firewall or NAT-firewall? With Exc 5.5 I do: IIS with OWA on port 80, squid in reverse mode, listening on localhost port 80, on which stunnel provides the external 443 port. So I can filter the URLs and reject silly GET commands. Greeting Harald Wallus > philipp > > > you know that Bill Gates workers don't understand nothing > > about networking! > > The things which are working are stolen or buyed!! > > The ExchangeServer 2000 is a sample of scripts in different > > script languages > > and also some compiled programs. > > In all of these part, the port, the IP and the protocoll are > > HARDCODED. So > > your Exchange Server has a internal IP-Address like > > 192.168.0.20, your access > > from public network will be redirected to that private > > network. And thus, > > clearly, will not be work. > > So you have to put your Exchange Server into the internet > > without firewall (or > > you have the possibility to subnet a public network, so you can port > > firewalling. But I will use Microsofts IIS only with an > > application layer > > firewall like the accelrator mode of squid). And die! > > I have tried to correct the scripts, and realy somethings > > will be work. > > But you need Billys help for recompile the programms. > > I use horde/imp as frontend and Exchangeserve as imap-Server. > > OK, you got no > > calendar and so on, only the email. > > Else do a VPN into your office. > > > > Greetings > > Harald > > > > Am Freitag, 6. September 2002 19:33 schrieb Jacob Fierberg: > > > I am trying to open port 443 on the firewall to gain access > > > > to Outlook Web > > > > > access on our exchange server. > > > I have already modified the > > > > /etc/rc.config.d/firewallX.rc.config and put in > > > > > the following > > > FW_SERVICES_EXT_TCP="443" > > > FW_SERVICES_EXT_UDP="443" > > > > > > > > > FW_SERVICES_INT_TCP="443" > > > FW_SERVICES_INT_UDP="443" > > > > > > I restarted the firewall but I am still not able to see my > > > > server behind > > > > > the firewall. Any suggestions? > > > > > > > > > Jacob Fierberg > > > Help Desk > > > Teacher's Pal, Inc > > > jacobf(a)teacherspal.com > > > www.teacherspal.com <www.teacherspal.com> > > > 10851 N. Black Canyon Highway, Suite 500 > > > Phoenix, AZ 85029 > > > 800-515-2535 toll-free > > > 602-861-3440 telephone > > > 602-789-6077 fax > > > > -- > > Dr. Harald Wallus > > netlike-gmbh > > Am Listholze 78, D-30177 Hannover > > Tel: +49(0)511 90 95 1-23 Fax: +49(0)511 90 95 = 1-90 > > Email: wallus(a)netlike-gmbh.de > > Internet: http://netlike-gmbh.de > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here -- Dr. Harald Wallus netlike-gmbh Am Listholze 78, D-30177 Hannover Tel: +49(0)511 90 95 1-23 Fax: +49(0)511 90 95 = 1-90 Email: wallus(a)netlike-gmbh.de Internet: http://netlike-gmbh.de

2 1

free/SWAN and SuSEfirewall2 (iptables)
by Michael Boettjer 09 Sep '02

09 Sep '02

Hi, i've problems to connect with a Roadwarrior (with a Dialup-Adapter only) to my network. But i think it would have to funktion. The network begins at the firewall, which is running on SuSE 7.2 with SuSEfirewall2. The firewall is having 3 interfaces: one goes into the DMZ, with private IP-Adresses (Range 192.168.52.0/24). SuSEfirewall is doing Port-Forwarding here. The 2nd interface is connected with an other SuSE-7.0-Server (via X-Link-Cable), which is routing between 2 internal Subnets. All traffic from this Subnets toward firewall is maskeraded (Subnets 192.168.50.0/24 and 192.168.55.0/24). The Subnet between inner-router and firewall has the range 192.168.51.0/24. The 3rd interface is having an official ip-adress. So far, so good. I try meanwhile for two weeks to successfully connect AND ping and connect to Server in the subnet 192.168.50 or .55 (behind the 2nd Linux-Router). The VPN-Tunnel is established also (afaik), but nothing else happens. I can't reach on server. no Server in DMZ and no server in the inner-LAN behind the second Linux-Router. Also There are no logged drops or rejects from the firewall. See my logs: ----------------- Sep 9 14:12:19 goofy Pluto[1003]: packet from 193.159.64.92:500: ignoring Ven dor ID payload Sep 9 14:12:19 goofy Pluto[1003]: "gio-warriors" #1: responding to Main Mode from Road Warrior 193.159.64.92 Sep 9 14:12:19 goofy Pluto[1003]: "gio-warriors" #1: STATE_MAIN_R3: sent MR3, ISAKMP SA established Sep 9 14:12:20 goofy Pluto[1003]: "gio-warriors" #2: responding to Quick Mode Sep 9 14:12:20 goofy Pluto[1003]: "gio-warriors" #2: STATE_QUICK_R2: IPsec SA established /root >iptables -L | grep "dialin" ACCEPT all -- pC19F405C.dip.t-dialin.net 192.168.0.0/16 ACCEPT all -- 192.168.0.0/16 pC19F405C.dip.t-dialin.net /root >ipsec look gateway Mon Sep 9 14:14:27 CEST 2002 192.168.0.0/16 -> 193.159.64.92/32 => tun0x1002(a)193.159.64.92 esp0x24dd43e d(a)193.159.64.92 ipsec0->eth0 mtu=16260->1500 esp0x24dd43ed(a)193.159.64.92 ESP_3DES_HMAC_MD5: dir=out src=195.90.31.11 iv_bits= 64bits iv=0x7010041f4bc4b10c ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)= add(127,0,0) esp0x78a28da1(a)190.91.41.11 ESP_3DES_HMAC_MD5: dir=in src=193.159.64.92 iv_bits= 64bits iv=0x1e51283693e0a222 ooowin=64 alen=128 aklen=128 eklen=192 life(c,s,h)= add(127,0,0) tun0x1001(a)190.91.41.11 IPIP: dir=in src=193.159.64.92 life(c,s,h)=add(127,0,0) tun0x1002(a)193.159.64.92 IPIP: dir=out src=190.91.41.11 life(c,s,h)=add(127,0,0) Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 195.90.31.254 0.0.0.0 UG 40 0 0 eth0 193.159.64.92 190.91.41.254 255.255.255.255 UGH 40 0 0 ipsec0 190.91.41.0 0.0.0.0 255.255.255.0 U 40 0 0 eth0 190.91.41.0 0.0.0.0 255.255.255.0 U 40 0 0 ipsec0 -------------------------- What is the matter? I have edited the file /etc/rc.config.d/firewall2.rc.config as given (port 500 / udp, protocol 50, ipsec0 in field FW_EXT_DEV against rp_filter, etc....). Further i'd setup a /usr/lib/ipsec/_updown_custom, with iptables-Rules as follows: [...] up-client:) # connection to my client subnet coming up # If you are doing a custom version, firewall commands go here. iptables -I FORWARD 1 -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK -j ACCEPT iptables -I FORWARD 1 -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK -j ACCEPT ;; down-client:) # connection to my client subnet going down # If you are doing a custom version, firewall commands go here. iptables -D FORWARD -s $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -d $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK -j ACCEPT iptables -D FORWARD -d $PLUTO_MY_CLIENT_NET/$PLUTO_MY_CLIENT_MASK \ -s $PLUTO_PEER_CLIENT_NET/$PLUTO_PEER_CLIENT_MASK -j ACCEPT ;; [...] Where is the Problem? Thanks in advance for help...i despair...

2 1

>I try meanwhile for two weeks to successfully connect AND ping and connect
by GentooRulez 09 Sep '02

09 Sep '02

>I try meanwhile for two weeks to successfully connect AND ping and connect >to Server in the subnet 192.168.50 or .55 (behind the 2nd Linux-Router). >The VPN-Tunnel is established also (afaik), but nothing else happens. I >can't reach on server. no Server in DMZ and no server in the inner-LAN >behind the second Linux-Router. Also There are no logged drops or rejects >from the firewall. Maybe the answers is simple. According to your logs and your description everything seems to work fine. In the docs of freeswan you can read, that you CAN NOT ping into the VPN or to the other VPN-gateway from the gateway-box itself as long as you dont take connection type tunnel! So try to ping from a box in the VPN-subnet to a box in the other subnet. Yours Michael

1 0

Outlook Web Access and Opening port 443
by Jacob Fierberg 09 Sep '02

09 Sep '02

I am trying to open port 443 on the firewall to gain access to Outlook Web access on our exchange server. I have already modified the /etc/rc.config.d/firewallX.rc.config and put in the following FW_SERVICES_EXT_TCP="443" FW_SERVICES_EXT_UDP="443" FW_SERVICES_INT_TCP="443" FW_SERVICES_INT_UDP="443" I restarted the firewall but I am still not able to see my server behind the firewall. Any suggestions? Jacob Fierberg Help Desk Teacher's Pal, Inc jacobf(a)teacherspal.com www.teacherspal.com <www.teacherspal.com> 10851 N. Black Canyon Highway, Suite 500 Phoenix, AZ 85029 800-515-2535 toll-free 602-861-3440 telephone 602-789-6077 fax

5 4

cant do ftp through squid (susefirewall2 problem with high ports??)
by Andreas Bittner 08 Sep '02

08 Sep '02

Hello all, i dont know how to make susefirewall2 work on a suse8 box running squid when trying to ftp with the squid proxy. these are my logs for example: Sep 7 23:17:58 box kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=212.123.225.148 DST=XXX.X.XXX.XX LEN=48 TOS=0x08 PREC=0x00 TTL=113 ID=55284 DF PROTO=TCP SPT=20 DPT=10269 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402) Sep 7 23:18:01 box kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=212.123.225.148 DST=XXX.X.XXX.XX LEN=48 TOS=0x08 PREC=0x00 TTL=113 ID=56412 DF PROTO=TCP SPT=20 DPT=10269 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402) Sep 7 23:18:08 box kernel: SuSE-FW-DROP-DEFAULT IN=ppp0 OUT= MAC= SRC=212.123.225.148 DST=XXX.X.XXX.XX LEN=48 TOS=0x08 PREC=0x00 TTL=113 ID=58314 DF PROTO=TCP SPT=20 DPT=10269 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402) seems that my connection from the susefirewall2/squid box to the ftp server outside (here ftp.asuscom.de) gets replied to a high port 10260 on my box for the dataconnection (port20) ... what is the proper settings for susefirewall2 to accept this connection (its actually a related connection isnt it?) why doesnt susefirewall/conntrack_ftp or something catch/accept this when the squid is trying to access ftp servers on the inet? i can ftp directly without the squid from the inside lan without any problems, and an ftp client directly on the suse8/squid box can also ftp without problems. only the squid when it wants to connect to ftp sites comes up with these errors and wont connect.... what am i doing wrong? does my squid needs reconfiguring? thanks for any help. cheers, Andy

2 2