September 2002 - openSUSE Security - openSUSE Mailing Lists

Fwd: SuSE-Firewall2 and M$ Dungeon Siege
by Christian Weickhmann 30 Sep '02

30 Sep '02

Hello folks! It sounds ugly but: I friend of mine wants to play Dungeon Siege on the internet via a SuSE-Firewall2-protected (cool word, aiii?) router. Somehow the game needs more than just a connection. It wants M$-Crap to work correctly. All ports necessary described in the so called "Knowledge Base" are _open_. Still nothing. I've got some logs and FW-rules for you. If someone could have a look over it, I'd be thankful. CU Christian Append 1: Firewall Log 1 - 192.168.0.4 tries to play DS via 192.168.0.1 (router) Append 2: Firewall rules (regeln.txt) Append 3: Firewall config (firewall2.rc.config) Thank you so much! -- "Life is too important to take seriously." -- Corky Siegel

1 0

Re: [suse-security] What means "martian source"?
by Kurt Minder 30 Sep '02

30 Sep '02

I had the same prob. But i don't think wrong plugging is the cause. With wrong plugging the adsl connection wouldn't work. I added the local ip's in /etc/route.conf 192.168.0.1 0.0.0.0 255.255.255.255 eth1 ... Then the kernel should accept the packet's as valid form your internal LAN and no more from mars. By Kurt

2 1

Re: [suse-security] What means "martian source"?
by defunct＠urbanyellow.com 30 Sep '02

30 Sep '02

this is a FAQ: http://www.susesecurity.com/faq/ : What does "kernel: martian source aabbccdd for 11223344, dev eth0" mean? -- These are packets that Linux does not expect from the direction they came from (i.e. packets from internal hosts coming in on the external interface). The cause is probably a misconfigured machine on your LAN. You can turn off logging those packets via /proc/sys/net/ipv4/conf/*interface*/log_martians which is documented in /usr/src/linux/Documentation/proc.txt

1 0

What means "martian source"?
by Ingo Doerrie 30 Sep '02

30 Sep '02

Hello! I just installed a DSL-Router that I finished and tested at home into the company's LAN. Only one system can reach the Internet that functions as standard-gateway for all other systems, running some Virus-Scanner on windows NT 4.x. Directly on its console internet works pretty fine but every packages sent to it from the LAN don't go through. The only message shown on the LX-gateway is: "KERNEL:... martian source ..." from the IP-adress pointing to the LAN from the virus scanner system. What does this martian source stuff mean and where does it come from? Thank you for your answer in advance. -- Freundliche Gruesse kind regards Ingo

3 2

Re: [suse-security] iptables --status
by Susan Buczak 30 Sep '02

30 Sep '02

Hey Dirk, run a man personal-firewall query and see what you find on Suse 8.0. zilch. matter of fact search every help doc suse.com has on the web and see what you find too. zilch or next to it. personal-firewall blocks all incoming connections... and that is about it. likewise run your normal iptables commands on see what you find on suse 8.0. zilch. no normally I don't run Suse Dirk hope that is OK with you. I Installed it by just whistling at it how did you do yours? On 2002.09.29 17:58 Dirk Janßen wrote: > Hello Susan Buczak <sbuczak2(a)comcast.net>, > > on Sun, 29 Sep 2002 13:41:10 -0400 you wrote in > <3D973B36.1030609(a)comcast.net>: > > >anybody know the proper command for iptables --list or --status on > suse8.0? > > I read your former questions to the mailinglist, now this and i only have > one question to you: Did you ever learn how to read a man? And how did > you > ever manage to get you computer installed, anyway Windows oder Linux?!? > > Your question for SuSE personal-firewall have been such basics, and this > question on iptables is even more basically. You only have to use the > help > or the man-command. Please try this in future before using the simple way > (for you) to ask any mailinglist... > > Sincerely, > Dirk > > -- > Dirk Janssen | Fon: +49 (0)641 9502070 | PGP-Key available > Giessen, Germany | Fax: +49 (0)641 9502071 | at pgp(a)dja-it.de

2 1

Suseconfig-disable
by Susan Buczak 30 Sep '02

30 Sep '02

I kind of wanted to keep the system as original as possible so as to avoid breaking anything, it has some admirable features... I readjusted the config files to my needs and that went real well, holding tight, a floppy backup of those few files is in order seems the whole system depends heavily on them at bootup... which may actually be a reason to disable suseconfig... don't know, haven't decided... On 2002.09.29 21:03 Doug Glenn wrote: > On Sunday 29 September 2002 11:31, Susan Buczak wrote: > > someone else told me they did this yast deal with 8.0 that it was > > normal prior to that... is it safe to pull the yast deal off till > > the machine is configured properly does anyone know, have they tried > > that? I don't mind yast watching the system after I have it > > configured for my needs but till then it's been a real monster, > > absolutely impossible to deal with... > > You can disable the system from making the changes automatically by > going into the sysconfig editor, selecting Base Administration, > SUSEConfig and then the Suseconfig-enable to no. > > All the changes have been made to conform with the LSB, so blame the LSB > for the "new" locations if you want. At least it should make the > transformation from one distro to another easier in the future instead > of trying to figure out each idiosyncrasy. > >

1 0

RE: initiate personal-firewall
by Susan Buczak 30 Sep '02

30 Sep '02

well it's in there for sure but all it ever says is 'Not initiated'. I checked the run levels already, still all it ever says is 'not initiated'. Suse 8.0 is kind of yasted out or am I missing something? The yast doesn't allow me to make custom configurations to my config files... and if there is some secret it's not in the book... I need to configure this thing to my users and needs and yast wants to control everything... unfortunately it overlooks a lot of things... like hosts allow and access.conf just to get started... someone else told me they did this yast deal with 8.0 that it was normal prior to that... is it safe to pull the yast deal off till the machine is configured properly does anyone know, have they tried that? I don't mind yast watching the system after I have it configured for my needs but till then it's been a real monster, absolutely impossible to deal with... ---------------------------------------------- On 2002.09.29 10:11 paul kaiser wrote: > the personal firewall basically shuts down most if not all incoming > traffic to > your system. it has a default configuration. it is usually started at > system > boot. > > look carefully when you boot the system, personal firewall kicks in at > runlevel > 3. you do not activate it from the command prompt. > > in yast, you should look under security for the category runlevel editor. this will show you your current settings for personal firewall, when >it is started, etc. >

2 1

Re: [suse-security] RE: initiate personal-firewall
by Susan Buczak 29 Sep '02

29 Sep '02

you have to edit the file manually from sysconfig to activate it. they didn't put a link into the yast module. got that a few hours ago anyway... On 2002.09.29 17:33 paul kaiser wrote: > suse made a major transition from verion 7.3 to 8.0. most configuration > was > done within the /etc/rc.config file. and yast worked very well with that > centralized file. > > however, with 8.0, suse decentralized all its configuration files and put > them > in /etc/sysconfig. you will find personal-firewall and SuSEfirewall2 in > this > directory along with a lot of other significant configuration files. yast > does > allow you to interact with all the configuration files at one time using > the > yast --> system --> sysconfig editor. this is somewhat of a help, but > there is > not a lot of information presented while you are in the editor. > personally, i > prefer just editing the files in /etc/sysconfig using vi! > > one suggestion to save yourself some frustration later on. when you have > a > configuration file set up the way you like it, make a backup copy with a > unique > suffix -- your initials or something else you will remember. yast has the > annoying feature of running SuSEconfig when it terminates, which > regenerates > many configuration files based on its configuration scripts. it does > recognize > some changes to configuration files -- but not all! after yast has done > its > magic, i usually use "diff" to compare important configuration files with > my > backup copy -- if different, then it is easy to replace the updated yast > file > with my preferred customized configuration. > > --- Susan Buczak <sbuczak2(a)comcast.net> wrote: > > well it's in there for sure but all it ever says is 'Not initiated'. > > > > I checked the run levels already, still all it ever says is 'not > initiated'. > > > > Suse 8.0 is kind of yasted out or am I missing something? The yast > > doesn't allow me to make custom configurations to my config files... > > and if there is some secret it's not in the book... I need to configure > > > this thing to my users and needs and yast wants to control > everything... > > unfortunately it overlooks a lot of things... like hosts allow and > > access.conf just to get started... > > > > someone else told me they did this yast deal with 8.0 that it was > normal > > prior to that... is it safe to pull the yast deal off till the machine > > > is configured properly does anyone know, have they tried that? I don't > > mind yast watching the system after I have it configured for my needs > > but till then it's been a real monster, absolutely impossible to deal > > with... > > > > > > > > > > ---------------------------------------------- > > > > On 2002.09.29 10:11 paul kaiser wrote: > > > the personal firewall basically shuts down most if not all incoming > > > traffic to > > > your system. it has a default configuration. it is usually started > at > > > system > > > boot. > > > > > > look carefully when you boot the system, personal firewall kicks in > at > > > runlevel > > > 3. you do not activate it from the command prompt. > > > > > > in yast, you should look under security for the category runlevel > > editor. this will show you your current settings for personal firewall, > > > when >it is started, etc. > > >

1 0

Problems with SuSEfirewall2, Masquarding after Connection lost
by Jammer 29 Sep '02

29 Sep '02

Hi * I'm using a SuSE 7.2 Box with SuSEfirewall2 (installed from RPM) to Masquarde my Network at home using my DSL - Connection. Everything works fine, till the one Point: When i loose my Internet-Connection due to a 24h disconnect, reboot or 'playing around with the pppoed' I have the following problem: By default I do the following steps in a cronjob: test if pppoed is running if not, stop everything and restart all the things /sbin/checkproc /usr/sbin/pppoed24 || { /etc/rc.d/pppoed stop > /dev/null sleep 2 /etc/rc.d/pppoed start > /dev/null sleep 5 /usr/bin/killall ddclient sleep 1 /usr/sbin/ddclient /root/bin/settime.sh >/dev/null sleep 2 } It works but with one problem: I have a network masquaraded and when i loose connection and re-establish connection i can ping from the hosts that are masquaraded, but i can not resolve any DNS-Names. I can see no drops in the firewall logs, so everything is ok.. and after 5-10 Minutes DNS-lookups are working. So why does it take 5 Minutes till Namelookups are working on the masquarded hosts? Thx for any hints Jan -- NEVER MESS WITH IDIOTS. FIRST THEY LOWER YOU TO THEIR LEVEL AND THEN THEY BEAT YOU WITH EXPERIENCE!

2 1

iptables --status
by Susan Buczak 29 Sep '02

29 Sep '02

anybody know the proper command for iptables --list or --status on suse8.0?

3 2