January 2003 - openSUSE Security - openSUSE Mailing Lists

How to configure two external interfaces
by Rainer Stransky 14 Jan '03

14 Jan '03

I am using SuSE 8.1 with a DSL interface (dynamic IP address) and a dial up ISDN interface, with a fixed IP address. I want to block all of the incomming traffic on the DSL interface and allow some service (smtp) on the dialup interface. But in the SuSEfirewall2 config file there is no chance to configure the two external interfaces in a different manner. Is there another chance ? Rainer

5 4

host header mechanism for ftp servers?
by mailinglists＠belfin.ch 13 Jan '03

13 Jan '03

Hi Is there an ftp server / ftp reverse proxy being capable of resolving multiple domains a similar way http servers do? I have only 1 public IP address and I should run two different ftp server boxes. Thanks & regards philipp

5 4

RE: [suse-security] host header mechanism for ftp servers?
by mailinglists＠belfin.ch 13 Jan '03

13 Jan '03

Hi > Why not RTFM? Yes, of course. > One way is definitely described even in vsftpd manual. vsftpd? great. I already run such a box (unfortunately I didn't find any clues on host headers in the conf file) and it would be nice to have a second one. I'll some digging. Thanks for the hints, boys. Philipp

2 1

RE: [suse-security] host header mechanism for ftp servers?
by Howard, Neal 13 Jan '03

13 Jan '03

About the only thing I can think of that would allow any form of mechanism to share multiple internal ftp servers from a single external ip address would be something like the ftp-gw that was included in the old TIS "FWTK" (Fire Wall Tool Kit). You first FTP into ftp-gw (it listens on the standard ftp port) and then for the username, you use "username@hostname_or_address" and it redirects your ftp session to that internal ftp server. Works well for outbound ftp proxy also. -----Original Message----- From: Andreas Bittner [mailto:bittner@rz.fh-heilbronn.de] Sent: Monday, January 13, 2003 11:02 AM To: suse-security(a)suse.com Subject: Re: [suse-security] host header mechanism for ftp servers? i guess not. since ftp doesnt have any mechanism like http-headers or so forth. you connect to an ip basically, and send user/pass and then you are logged in. no other authentication or extra data can be sent for telling in what ftp server/subsite you want to login .... i dont know of any standard that ftp could achieve such thing... cheers, andy ----- Original Message ----- From: <mailinglists(a)belfin.ch> To: <suse-security(a)suse.com> Sent: Monday, January 13, 2003 5:46 PM Subject: [suse-security] host header mechanism for ftp servers? > Hi > Is there an ftp server / ftp reverse proxy being capable of resolving > multiple domains a similar way http servers do? > I have only 1 public IP address and I should run two different ftp server > boxes. > Thanks & regards > philipp -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

AW: [suse-security] ppp0 & SuSEfirewall2 - restart firewall
by Ulrich Roth 13 Jan '03

13 Jan '03

Hi, > lrwxrwxrwx 1 root root 21 Dec 13 13:45 > S01SuSEfirewall2_init -> ../SuSEfirewall2_init* > lrwxrwxrwx 1 root root 22 Dec 13 13:45 > S08SuSEfirewall2_setup -> ../SuSEfirewall2_setup* > lrwxrwxrwx 1 root root 22 Dec 13 13:45 > S23SuSEfirewall2_final -> ../SuSEfirewall2_final* > > Sounds like a script problem. > Are all symbolic links in place in /etc/rc.d/rc3.d ?? I don't understand your question. Why don't you look if they are there or not? Well, if you want to start and stop the firewall in your own shell scripts, use /sbin/SuSEfirewall2 start and /sbin/SuSEfirewall2 stop instead of the rc-scripts. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

RE: [suse-security] ppp0 & SuSEfirewall2 - restart firewall
by Andre Vorster 13 Jan '03

13 Jan '03

I can only find these I dont know if it is correct lrwxrwxrwx 1 root root 21 Dec 13 13:45 S01SuSEfirewall2_init -> ../SuSEfirewall2_init* lrwxrwxrwx 1 root root 22 Dec 13 13:45 S08SuSEfirewall2_setup -> ../SuSEfirewall2_setup* lrwxrwxrwx 1 root root 22 Dec 13 13:45 S23SuSEfirewall2_final -> ../SuSEfirewall2_final* Sounds like a script problem. Are all symbolic links in place in /etc/rc.d/rc3.d ?? Andrew

1 0

ppp0 & SuSEfirewall2 - restart firewall
by Andre Vorster 13 Jan '03

13 Jan '03

Hi all I am using SuSEfirewall2 my users must access two server on my private LAN via ppp0, all works very well execpt if my Firewall server restarts then I must dial in and restart the firewall wile online. Is there any way of automating this. Andre Vorster Business Print Centre Tel: 012 349 2295 Fax: 012 349 2299

1 0

user login windows don't show by IE
by payam payami 11 Jan '03

11 Jan '03

Hi, I use suse 7.3 Internal network connect to internet by setting port 3128 in IE but when i set in squid.conf for authenticate_program that get windows login for users, IE don't get any windows and Internal network (clients) connect to internet normally without login I set these options in squid.conf: authenticate_program /usr/sbin/pam_auth acl password proxy_auth payam acl users src 192.168.1.0/255.255.252.0 http_access allow users http_access allow password Is this any problem with this configuration that IE can't get windows login when want to browsing? Thanks for your help, Payam __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

1 0

SuSEfirewall2: ping from masqueraded net
by Richard Ems 11 Jan '03

11 Jan '03

Hi list! SuSE Linux 8.1, SuSEfirewall2-3.1-26 I'm trying to ping and traceroute from the internal masqueraded net. But the internal masq. net should only ping/traceroute, nothing else. The problem is that in FW_MASQ_NETS only tcp and udp are accepted, icmp is not. Why? So setting FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" and FW_ALLOW_FW_TRACEROUTE="yes" isn't enough, the internal net isn't masqueraded as it should. I would like to do something like FW_MASQ_NETS="192.168.1.0/24,0/0,icmp" but SuSEfirewall2 will throw an error on this: lines 1583 to 1586 from /sbin/SuSEfirewall2: 1583 test "$PROTO" = tcp -o "$PROTO" = udp || { 1584 echo "Error: The protocol with FW_MASQ_NETS must be tcp or udp -> $NETS" 1585 NET2="" 1586 } Any ideas how to do this? Would it be possible to extend the script to allow also icmp as a valid protocol? Thanks, Richard -- Richard Ems ... e-mail: r.ems(a)gmx.net ... Computer Science, University of Hamburg Unix IS user friendly. It's just selective about who its friends are.

2 2

SuSEfirewall2 1.7 and FreeSWAN
by Andrew Longstreet 11 Jan '03

11 Jan '03

I have another small problem. I am currently operating several SuSE 7.3 servers patched with freeswan 1.99 x.509 at kernel 2.4.16. SuSEfirewall2 is running with the following config, I have included a partial firewall2.rc.config. My question is, when I run newer versions of nmap to audit these systems, it shows tcp port 80 as open. I do not have this port open, and my services file has it stripped out as well. Any ideas ??? FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="no" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_IP="50 51" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="icmp" FW_TRUSTED_NETS="xx.xx.xx.xx,tcp,22 xx.xx.xx.xx,tcp,22" FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data" FW_ALLOW_INCOMING_HIGHPORTS_UDP="" Andrew Longstreet, CNE Senior Network Consultant LONGSTREET NETWORK SERVICES OPERATED BY 1498351 ONTARIO LTD Barrie ON L4N 7G6 705-721-5325

1 0