January 2003 - openSUSE Security - openSUSE Mailing Lists

Re:[suse-security] SuSEFirewall without NAT
by Mario Neubert 19 Jan '03

19 Jan '03

Hello Dominik, hello Raymond, hello list I know that's a SuSE/Linux mailinglist but some people(I also) using other mailclients like Outlook [don't flame me ;)] which do not support your secured messages. However, I can not read your message and therefore i can't help you. Best regards... Mario

4 4

Secure root alias logins
by keith.anthony.roberts＠bigfoot.com 18 Jan '03

18 Jan '03

To: suse-security(a)suse.com From: keith.anthony.roberts(a)bigfoot.com Subject: Secure root alias logins Hi everyone! Surely it would be more difficult for any attacker to break into Linux if they did not know the username for the root account? I just wondered if it was possible to make root logins MUCH more secure with the following suggestions. When a NEW installation of Linux is done, allow the root user to select their -*OWN*- unique username for the root account in YaST, instead of the default 'root' username. Disallow the use of username 'root' for ALL root superuser logins. When a superuser logs-in they provide their unique username that they choose when installing Linux eg. under YaST. Each login program would need to be modified to reject the username of 'root'. The login program then checks say, password file for the unique root alias name (provided by superuser at installation time) and matches this up with the root account. If a matching root alias and a valid password for that alias name are present, then the superuser gets logged into the root account. The root account need not be touched in any way. The superuser alias name is just used as a 'WRAPPER' to protect the username of root for login purposes only. Would this be feasable to implement? This may have been implemented already. If it has - please let me know. Thankyou - Keith Roberts.

10 13

Re: [suse-security] SuSEFirewall without NAT
by George Michelson 18 Jan '03

18 Jan '03

I guess my problem I can't get it to work unless I use FW_FORWARD to specifiy all traffic back and forth. For simplicity purposes I started with FW_FORWARD all out and .... nothing worked ! I have to have all of the traffic going out to be permitted, with restrictions on the inbound (only some ports to some machines). Help ! :) TIA, George Michelson Arjen de Korte wrote: >On Saturday 18 January 2003 00:44, George Michelson wrote: > > > >>I asked before and did not get an answer: was someone successfull with >>configuring SuSEFirewall2 (SuSE v 8) without NAT with public addresses >>on the both side ? >> >> > >The firewall doesn't care at all what types of addresses you use on either >side of it. I don't see the relation between not having NAT and the fact that >you have public addresses on both sides of your firewall. I don't have NAT on >the firewall either, although I use private addresses on both sides (it is >connected to a router which performs the NAT). What is your problem? > >Arjen > >

2 1

Re: [suse-security] SuSEFirewall without NAT
by Dominik Składanowski 18 Jan '03

18 Jan '03

And which ports/services do you want to block for internal users, and which should be blocked for Internet. > Well ... In order to get traffic going I had to use FW_FORWARD, I create > a "rule" for forwarding from inside network /any computer/anyport to 0/0 > and traffic started to go out, but it was all droped on the firewall on > the return - I was hoping that "session" will be created and it > (firewall) will figure out that's going on. I ended up adding one more > "rule" into FW_FORWARD - backword routing all into internal network . > ... But it's a router now, not a firewall ... So I am thinking about > using some other product, unless I can get some help here ! > > TIA, > George Michelson > > Dominik Sk?adanowski wrote: > >> Hi. >> >>> I asked before and did not get an answer: was someone successfull >>> with configuring SuSEFirewall2 (SuSE v 8) without NAT with public >>> addresses on the both side ? >> >> >> >> Can you describe problem more detailed? -- ----------------------------------------------------------------- Dominik Składanowski e-mail: dominik.skladanowski(a)ch.pw.edu.pl -----------------------------------------------------------------

2 1

Re: [suse-security] SuSEFirewall without NAT
by George Michelson 18 Jan '03

18 Jan '03

I guess my problem I can't get it to work unless I use FW_FORWARD to specifiy all traffic back and forth. For simplicity purposes I started with FW_FORWARD all out and .... nothing worked ! I have to have all of the traffic going out to be permitted, with restrictions on the inbound (only some ports to some machines). Help ! :) TIA, George Michelson Arjen de Korte wrote: >On Saturday 18 January 2003 00:44, George Michelson wrote: > > > >>I asked before and did not get an answer: was someone successfull with >>configuring SuSEFirewall2 (SuSE v 8) without NAT with public addresses >>on the both side ? >> >> > >The firewall doesn't care at all what types of addresses you use on either >side of it. I don't see the relation between not having NAT and the fact that >you have public addresses on both sides of your firewall. I don't have NAT on >the firewall either, although I use private addresses on both sides (it is >connected to a router which performs the NAT). What is your problem? > >Arjen > >

1 0

Re: [suse-security] SuSEFirewall without NAT
by Dominik Składanowski 18 Jan '03

18 Jan '03

And which ports/services do you want to block for internal users, and which should be blocked for Internet. > Well ... In order to get traffic going I had to use FW_FORWARD, I create > a "rule" for forwarding from inside network /any computer/anyport to 0/0 > and traffic started to go out, but it was all droped on the firewall on > the return - I was hoping that "session" will be created and it > (firewall) will figure out that's going on. I ended up adding one more > "rule" into FW_FORWARD - backword routing all into internal network . > ... But it's a router now, not a firewall ... So I am thinking about > using some other product, unless I can get some help here ! > > TIA, > George Michelson > > Dominik Sk?adanowski wrote: > >> Hi. >> >>> I asked before and did not get an answer: was someone successfull >>> with configuring SuSEFirewall2 (SuSE v 8) without NAT with public >>> addresses on the both side ? >> >> >> >> Can you describe problem more detailed? -- ----------------------------------------------------------------- Dominik Składanowski e-mail: dominik.skladanowski(a)ch.pw.edu.pl -----------------------------------------------------------------

1 0

SuSEFirewall without NAT
by George Michelson 17 Jan '03

17 Jan '03

Hi all ! I asked before and did not get an answer: was someone successfull with configuring SuSEFirewall2 (SuSE v 8) without NAT with public addresses on the both side ? TIA, George Michelson

2 1

[SuSEfirewall2] NEW_FW_MASQ_DEV ?
by Richard Ems 16 Jan '03

16 Jan '03

Hi list. 1) What is NEW_FW_MASQ_DEV good for? I have in my /etc/sysconfig/SuSEfirewall2 FW_DEV_EXT="eth0 eth0:3" and FW_MASQ_DEV="$FW_DEV_EXT" but in /sbin/SuSEfirewall2 (from SuSEfirewall2-3.1-26) FW_MASQ_DEV is "filtered" and eth0:3 discarded. So after this filtering I have only FW_MASQ_DEV="eth0". Is this needed/wanted? Why? ========== 2) I'm trying to connect from a public external ip (a) to a private internal masqueraded ip, over the public ip address (b) at eth0:3. From tcpdump on both the external and internal devices, pakets are being correctly forwarded from ext to int, but when responses arrive at the internal device they are being dropped on the last forward_int chain rule. For this to work I have set on /etc/sysconfig/SuSEfirewall2 FW_FORWARD_MASQ="1.2.3.4,192.168.30.15,tcp,2222,22,5.6.7.8" where 1.2.3.4 is the ext source public ip (a) and 5.6.7.8 is the public ip address (b) Does someone have any clue? ========== 3) What do _ext/_int/_dmz mean on forward_xxx or input_xxx ? [forward|input]_pakets_COMING_FORM_xxx or [forward|input]_pakets_GOING_TO_xxx ??? Many thanks, Richard

1 0

SuSEfirewall2 - interesting log
by Dominik Składanowski 15 Jan '03

15 Jan '03

Hi all. In my firewall logs I noticed this records (I've cut off some positions): ------------------------------------------------------------------------ SuSE-FW-ACCEPT IN=eth0 SRC= LEN=48 TOS=0x00 PREC=0x80 TTL=108 ID=24399 DF PROTO=TCP SPT=1425 DPT=1433 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402) SuSE-FW-DROP-DEFAULT IN=eth0 SRC= LEN=48 TOS=0x00 PREC=0x80 TTL=108 ID=24399 DF PROTO=TCP SPT=1425 DPT=1433 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (020405B401010402) ------------------------------------------------------------------------ Firewall allow packet to go, and them drop it. Is it normal behaviour? -- ----------------------------------------------------------------- Dominik Składanowski e-mail: dominik.skladanowski(a)ch.pw.edu.pl -----------------------------------------------------------------

3 3

PHP and MSSQL
by Robert Rottscholl 15 Jan '03

15 Jan '03

Dear list, my system is running an apache webserver (1.3.19) and php (4.0.6). I tried to connect (through php) to a MSSQL Database. This didn't work. I found out, that I have to compile PHP with SYSBASE support. Why did suse not include the mssql support through sybase. Is it security related? Can I easily add this feature or do I have to fear a big security leak. Greets Robert

3 3