September 2002 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 on 8.0 masq problem
by Volker Kuhlmann 04 Sep '02

04 Sep '02

I am at my wits end with this problem. Server in dmz, internal net, http, https, ssh, imap, etc on server accessible from the outside. The internal net should have access to the same services on the server as are available from the outside. Problems: ntpdate -q outside does not work on server, dito on firewall. reaching http://outside from server doesn't work. From outside, imap and 7777 are not reachable on server, although http https are reachable and imap and 7777 are configured identically. The internal net can't reach the server (yes I use FW_FORWARD). SuSE 8.0 with all updates current as of yesterday. I tried the same setup on 2 different machines so it's not the hardware (unless realtek 8139 net cards go dead on some ports only, not likely). FW_DEV_EXT="eth2" FW_DEV_INT="eth0" FW_DEV_DMZ="eth1" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.2.0/24 192.168.1.0/24" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="domain" FW_SERVICES_EXT_UDP="domain ntp" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="domain ssh" FW_SERVICES_DMZ_UDP="domain" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="domain ssh" FW_SERVICES_INT_UDP="domain" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD=" 192.168.2.0/24,192.168.1.1,tcp,80 192.168.2.0/24,192.168.1.1,tcp,443 192.168.2.0/24,192.168.1.1,tcp,143 192.168.2.0/24,192.168.1.1,tcp,25 192.168.2.0/24,192.168.1.1,tcp,22 192.168.2.0/24,192.168.1.1,tcp,7777 192.168.2.0/24,192.168.1.1,udp,123 " FW_FORWARD_MASQ=" 0/0,192.168.1.1,tcp,80 0/0,192.168.1.1,tcp,443 0/0,192.168.1.1,tcp,143 0/0,192.168.1.1,tcp,25 0/0,192.168.1.1,tcp,22 0/0,192.168.1.1,tcp,7777 " FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_PING_EXT="yes" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" On a SuSE 7.3 box with iptables, kernel, SuSEfirewall2 packages from SuSE 8.0 an essentially identical setup works as expected (there's no DNS server on that box). Ideas are very much appreciated. Thanks in advance, Volker If you don't want to reply to the list change my email address to list0570 at (sorry). -- Volker Kuhlmann is possibly list0570 with the domain in header http://volker.orcon.net.nz/ Please do not CC list postings to me.

4 5

Transparent proxy + authentication
by sascha.uhl＠gmx.net 03 Sep '02

03 Sep '02

Hi, I hope anybody could be solving this problem concerning authentication and a transparent proxy. Perhaps anybody knows an other solution for this problem!? I have squid running as transparent proxy, cause I do not want that the user behind this proxy has to configure anything in his browser. Only authenticated users should get access to the proxy. The normal authentication works proberply, but not in the transparent mode. I know there are some restrictions with transparent proxies and authentication, but I do not really understand why. Is there any solution for that problem? Perhaps I am going the wrong way? thanks for your help! Regards Sascha -- ------------------------------------ GNU - Gnu is Not Uhlsen ------------------------------------ GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

2 1

SuSEfirewall2 and Printing problems
by Miguel Albuquerque 03 Sep '02

03 Sep '02

Hi, Since I've setup SuSEfirewall2 on SuSE 8 I'm unable to print local. Here is the output: "Status Information: sending job 'mfoacs@ns+22' to lp@localhost connecting to 'localhost', attempt 1 connected to 'localhost' requesting printer lp@localhost job 'mfoacs@ns+22' transfer to lp@localhost failed error 'NONZERO RFC1179 ERROR CODE FROM SERVER' with ack 'ACK_RETRY' sending str '^Blp' to lp@localhost error msg:" What is going wrong? Thanks -- .-. SECNeT /v\ We Run SuSE Project Manager // \\ *The LINUX Experts* c/o Miguel Albuquerque /( )\ Av. Miremont 46 ^^-^^ 1202 - GE, SWITZERLAND Tel: +41 (22) 782 5344 Fax: +41 (22) 782 5348 mailto:mfoacs@e-workshop.ch http://mfoacs.e-workshop.ch

1 1

Why MY DNS is not working" FTP never works]
by sambit 03 Sep '02

03 Sep '02

- Hi , , I am trying to configure my server as DNS i am never able to figure it out what is the error my files looks like the attahcment i have enclosed but it when i do nslookup on my local system and try to resolve my hostname it never work. i did not find any bind program like 'ndc' supported by other unix OS. like nslookup *** Can't find server name for address 64.252.31.94 : No response from server set type=SOA > sambitnanda.com Server: ns2.snet.net Address: 204.60.0.3 *** ns2.snet.net can't find sambitnanda.com: Non-existent host/domain which should work from my local system Question 2 what is the way i can open my ftp , i changed my inetd.conf to like ftp stream tcp nowait root /usr/sbin/tcpd wu.ftpd -a # ftp stream tcp nowait root /usr/sbin/tcpd proftpd # ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd but it never works. thanks Sambit $TTL 172800 @ IN SOA sambitnanda.com. root.sambitnanda.com. ( 25082002 ; Serial 2508 ; Refresh 7200 ; Retry 864000 ; Expire 86400) ; Minimum TTL NS sambitnanda.com. 1 PTR localhost. $TTL 172800 @ IN SOA sambitnanda.com. root.sambitnanda.com. ( 25082002 ; Serial 2508 ; Refresh 7200 ; Retry 864000 ; Expire 86400) ; Minimum TTL NS sambitnanda.com. 4 PTR sambitnanda.com. ; ; There might be opening comments here if you already have this file. ; If not don't worry. ; . 6D IN NS G.ROOT-SERVERS.NET. . 6D IN NS J.ROOT-SERVERS.NET. . 6D IN NS K.ROOT-SERVERS.NET. . 6D IN NS L.ROOT-SERVERS.NET. . 6D IN NS M.ROOT-SERVERS.NET. . 6D IN NS A.ROOT-SERVERS.NET. . 6D IN NS H.ROOT-SERVERS.NET. . 6D IN NS B.ROOT-SERVERS.NET. . 6D IN NS C.ROOT-SERVERS.NET. . 6D IN NS D.ROOT-SERVERS.NET. . 6D IN NS E.ROOT-SERVERS.NET. . 6D IN NS I.ROOT-SERVERS.NET. . 6D IN NS F.ROOT-SERVERS.NET. G.ROOT-SERVERS.NET. 5w6d16h IN A 192.112.36.4 J.ROOT-SERVERS.NET. 5w6d16h IN A 198.41.0.10 K.ROOT-SERVERS.NET. 5w6d16h IN A 193.0.14.129 L.ROOT-SERVERS.NET. 5w6d16h IN A 198.32.64.12 M.ROOT-SERVERS.NET. 5w6d16h IN A 202.12.27.33 A.ROOT-SERVERS.NET. 5w6d16h IN A 198.41.0.4 H.ROOT-SERVERS.NET. 5w6d16h IN A 128.63.2.53 B.ROOT-SERVERS.NET. 5w6d16h IN A 128.9.0.107 C.ROOT-SERVERS.NET. 5w6d16h IN A 192.33.4.12 D.ROOT-SERVERS.NET. 5w6d16h IN A 128.8.10.90 E.ROOT-SERVERS.NET. 5w6d16h IN A 192.203.230.10 I.ROOT-SERVERS.NET. 5w6d16h IN A 192.36.148.17 F.ROOT-SERVERS.NET. 5w6d16h IN A 192.5.5.241 options { directory "/var/named"; datasize 20M; listen-on { 64.252.31.94 } // Uncommenting this might help if you have to go through a // firewall and things are not working out: // query-source port 53; }; zone "." { type hint; file "root.hints"; }; zone "0.0.127.in-addr.arpa" { type master; file "127.0.0"; }; zone "31.252.64.in-addr.arpa" { type master; file "64.252.31"; }; # zone "50.10.10.in-addr.arpa" { # type master; # file "64.252.31"; # }; zone "sambitnanda.com" { type master; notify no; file "sambitnanda.com"; }; search sambitnand.com 64.252.31.94 204.60.0.3 203.60.0.2 nameserver 64.252.31.94 nameserver 204.60.0.3 nameserver 204.60.0.2 $TTL 172800 @ IN SOA sambitnanda.com. root.sambitnanda.com. ( 25082002 ; Serial 2508 ; Refresh 7200 ; Retry 864000 ; Expire 86400 ; Minimum TTL ) @ IN NS sambitnanda.com. IN A 64.252.31.94 IN MX 10 sambitnanda.com. TXT "Sambit Nanda Org " localhost A 127.0.0.1 sambitnanda.com. A 64.252.31.94 ns A 64.252.31.94 www A 64.252.31.94 mail CNAME sambitnanda.com. ftp CNAME sambitnanda.com.

2 1

OT: Congratulations
by Stefan Nauber 02 Sep '02

02 Sep '02

Hello, according to a calendar of the german bookstore "Lehmans", SuSE has beed founded exactly 10 years ago on Sep. 2, 1992. If so: Congratulations to all of SuSE! Keep up the good work! Stefan Nauber Cs2 Informatik GmbH & Co. KG - Niederlassung West - Kurfürstenanlage 3 69115 Heidelberg Germany Tel.: +49 (6221) 6041-0 Fax : +49 (6221) 6041-50 Email: mailto:stefan.nauber@cs2-informatik.de Internet: http://www.cs2-informatik.de

3 2

hylafax buffer overflow
by Kevin Ivory 02 Sep '02

02 Sep '02

The CERT/Debian announcement referring to Hylafax brought me to http://www.hylafax.org/4.1.3.html "Also fixed is a buffer overflow condition when receiving fax image data which potentially could be exploited to execute arbitrary code as root." Are the SuSE packages affected as well? Are you working on update packages? Kevin -- _ | Kevin Ivory | Tel: +49-551-3700000 |_ |\ | | Service Network GmbH | Fax: +49-551-3700009 ._|ER | \|ET | Bahnhofsallee 1b | mailto:Ivory@SerNet.de Service Network | 37081 Goettingen | http://www.SerNet.de/

2 2

AW: [suse-security] Why MY DNS is not working" FTP never works]
by Ulrich Roth 02 Sep '02

02 Sep '02

Hello Sambit, concerning your DNS question, I can't help you for now, missing time, and in these cases I prefer sitting at the machine and trying to solve the problem. But your second question is easy: > what is the way i can open my ftp , i changed my inetd.conf to like > ftp stream tcp nowait root /usr/sbin/tcpd wu.ftpd -a > # ftp stream tcp nowait root /usr/sbin/tcpd proftpd > # ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd First thing: Be sure inetd is installed and up. Second: If it's running, you have to reload after every change in the inetd.conf. Third: Make sure tcpd is installed. Fourth: Have a look at /usr/sbin and see which of the three ftpds mentioned in inetd.conf is there, and uncomment the correct line (ls -la /usr/sbin/*ftpd). If none of them is there , install one and try again. in.ftpd is the easiest to install, you should install then the packets ftp and ftp-dir. But it's also the most insecure one. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

[Security] SuSEfirewall1/2
by Philippe Vogel 02 Sep '02

02 Sep '02

Hi! I wanted to port SuSEfirewall1/2 to Debian and Red Hat. The result ist, that the netfilter works, but logging ist still to /dev/tty1-6. This nerves, if I want to do something direct on the server. If I login from remote (ssh) there is no problem with these logs and anyway the most time I setup things via remote. Any hints what's wrong? I looked in the script but did not find any options which tell iptables to log to console. Is it maybe a patch from SuSE within iptables? Why I did this: Debian and Red Hat offer more packaees than SuSE and the SuSEfirewall is a nice tool for setting up a firewall. Other "nice" firewalls need modifications on the hosts system - SuSEfirewall normally not! A Modification to SuSEfirewall makes it run with e.g. fireparse for giving out the loggs (I changed some of the logging-texts). Modifications are easy to be done (I modified one without DMZ-rules and one with extra blocking options for the config file). Philippe

2 2

Is there any chance for a new version of compartment to come out?
by Ace 02 Sep '02

02 Sep '02

Hi there! I'd really like to make use of the Linux Capabilities, but unfortunately the tool compartment isn't developed any further ... the documentation of version 1.1 says that some special call would be added when the 2.4 kernel came out... well I think 2.4 is out. I've also already spammed the author... nothing happened :-( Isn't there anyone else interested in the capabilities? Don't the capabilities work properly? What is the reason why no new compartment version comes out? Are there any other tools as compartment replacement? Peter Asemann

3 3

Account problem
by Peer-Joachim Koch 02 Sep '02

02 Sep '02

Hello, we have noticed, that it is possible to log into varius suse (7.0-3) linux boxes using an expired account. I thought, if an account expieres a logon will not be possible any longer. We have tried telnet, ftp and ssh. Bye, Peer _________________________________________________________ Max-Planck-Institut fuer Biogeochemie Dr. Peer-Joachim Koch Carl-Zeiss-Promenade 10 Telefon: ++49 3641 6437-52 D-07745 Jena Telefax: ++49 3641 6437-10

1 0