January 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] SuSEfirewall V1 and V2 differences
by Peer Stefan 10 Jan '03

10 Jan '03

Hi, > From: Andy Bennett [mailto:andy@mcrentals.demon.co.uk] > Hi, > > Have recently changed from using SuSE V7.1 with SuSEfirewall > V1 to SuSE V8.1 > with SuSEfirewall V2. > > Now, when I check my ports at http://www.grc.com, I find my > identd port 113 is > marked as closed whereas before it was marked as stealth(sic) > , i.e. it > doesn't respond at all to probes. > > I'm just wondering what the thinking is behind this change. > Is it simply a > preferred option and easier to do with iptables than ipchains. If packets on port 113 are just DROPped instead of REJECTed, some clients will wait the whole identd-timeout (e.g. ssh) before connections can be established. > Regards > Andy Regards, Stefan

2 1

SuSEfirewall2
by Alberto Tarantino 10 Jan '03

10 Jan '03

Hi there, one simple question.. I can't find anymore the file for custom rules. It can't be found in /etc/sysconfig where it's supposed to be. I just wanted to add SFQ discipline to my public interface and I thought that might have been a nice place to add the tc line. Thanks Alberto P.S.: SuSEfirewall rules! Thanks for the great job

2 1

Apache & PHP versions under Suse Linux 7.3
by Oliver Kirchel 10 Jan '03

10 Jan '03

Hi, I have a question about the versionnumbers under Linux Suse 7.3. When I make a networkscan with Nessus Version 1.2.7, Nessus is always saying that Apache Version 1.3.20 isn't secure. I took the latest update 1.3.20-77 and Nessus is still saying, please update to version 1.3.26. So here is my question: Is the Suse Apache version 1.3.20-77 sequre as the Apache 1.3.26 or older ? Olli

2 1

SuSEfirewall2 Logging Options
by Andrew Longstreet 10 Jan '03

10 Jan '03

Here is my dilemma. I currently have 9 SuSE 7.3 boxes logging to a centralized, remote syslog-ng daemon. I have a postgres database operating, some scripts running to insert incoming messages into the postgres database. All works fine. Now, I am trying to securely publish some of this firewall logging for my clients. My postgres skills are weak, so on the backend I have sucked a bunch of data into MS Access2000 through 32 ODBC connect to postgres. The problem is Access only supports a field of 255. The mesg_txt field is longer than this on some records, in the mesg_txt field from postgres. Can I change some options on the SuSEfirewall2 log parameter to log a little less info (TTL, maybe MAC addr. etc) ? Please help Thanks Andrew

3 2

RE: [suse-security] SuSEfirewall2 1.7 and FreeSWAN
by Peer Stefan 10 Jan '03

10 Jan '03

Hi > From: Andrew Longstreet [mailto:alongstr@bmts.com] > I have another small problem. > > I am currently operating several SuSE 7.3 servers patched > with freeswan 1.99 x.509 at kernel 2.4.16. > > SuSEfirewall2 is running with the following config, I have > included a partial firewall2.rc.config. > > My question is, when I run newer versions of nmap to audit > these systems, it shows tcp port 80 as open. > > I do not have this port open, and my services file has it > stripped out as well. > Any ideas ??? [partial firewall2.rc.config left out] Try to 'telnet <YOUR-EXT-IP> 80' to test, if port 80 really is open or not. There is a file named firewall2-custom.rc.config. Did you apply any rules there, which open port 80? Or did you manually insert 'iptables -I INPUT -j ACCEPT -s <SOME_SOURCE> -d <EXT_IP> --dport 80'? regards, Stefan

2 1

SuSEfirewall V1 and V2 differences
by Andy Bennett 10 Jan '03

10 Jan '03

Hi, Have recently changed from using SuSE V7.1 with SuSEfirewall V1 to SuSE V8.1 with SuSEfirewall V2. Now, when I check my ports at http://www.grc.com, I find my identd port 113 is marked as closed whereas before it was marked as stealth(sic) , i.e. it doesn't respond at all to probes. I'm just wondering what the thinking is behind this change. Is it simply a preferred option and easier to do with iptables than ipchains. Regards Andy

1 0

SuSEFirewall2 question
by George Michelson 10 Jan '03

10 Jan '03

Hi, All ! I have interesting (I think) question about SuSE firewall - I installed it many times very successfull using NAT, but I was asked to configure it to protected network with public addresses and .... I failed ! I ended up FW_FORWARDing all the traffic back and forth, but this is just a temp solutions. Did anyone setted up SuSEFirewall2 in similar enviroment ? If so - please help ! TIA, George Michelson

1 0

Re: [suse-security] problem with routing
by Robert Rottscholl 09 Jan '03

09 Jan '03

Hi Payam, what about your dns server? You have one? Or do you add an external dns to your client configuration. What does nslookup or dig on a client say? (e.g. nslookup www.suse.com) If these programs can recieve an IP-Adress try to ping. Ciao ;-) Robert payam payami schrieb: >Hi Robert, >I did what did you tell me, FW_route & FW_MASQUERADE & >etc, without set the iptables rule but UNFORTUNATELY i >can't get result. >What can i do? > >Thanks for your help, >Payam > >--- Robert Rottscholl <lv426(a)rinx.de> wrote: > > >>Hi Payam, >>let me repeat what you try to do: You want to route >>the internet >>requests from the internal (eth0) interface to the >>external interface >>(eth1). >>You needn't set the rule you posted. >>Set >>FW_ROUTE="yes" >>FW_MASQUERADE="yes" >>FW_MASQ_DEV="eth1" >>FW_MASQ_NETS="" # to your internal subnet (e.g. >>192.168.0.0/24) >> >>Creets >> >>robert >> >>payam payami schrieb: >> >> >> >>>I want to use suse 7.3 for router & i want to do >>>masquerading. >>>I have 2 net card that one is for internal network >>> >>> >>& >> >> >>>another is for external network. >>>eth0 for internal network >>>eth1 for external network >>>I was setting in >>> >>> >>/etc/rc.config.d/firewall2.rc.config >> >> >>>(The options that related to masquerading) and type >>>this command in command line >>> >>>iptables -t nat -A POSTROUTING -j MASQUERADE -o >>> >>> >>eth1 >> >> >>>Is this any problem with this rule or in my >>>configuration file? >>>Because only router system can see internet and >>>another systems can't see internet >>>How can i solve this problem that another systems >>>(internal network) can see internet? >>> >>>Thanks for your help, >>>Payam >>> >>>__________________________________________________ >>>Do you Yahoo!? >>>Yahoo! Mail Plus - Powerful. Affordable. Sign up >>> >>> >>now. >> >> >>>http://mailplus.yahoo.com >>> >>> >>> >>> >>> >>-- >>Check the headers for your unsubscription address >>For additional commands, e-mail: >>suse-security-help(a)suse.com >>Security-related bug reports go to security(a)suse.de, >>not here >> >> >> > > >__________________________________________________ >Do you Yahoo!? >Yahoo! Mail Plus - Powerful. Affordable. Sign up now. >http://mailplus.yahoo.com > > > >

1 0

Re: [suse-security] Anyone has experience with RSBAC?
by GentooRulez 09 Jan '03

09 Jan '03

The german paperzine "Linux Magazin" gots a article in editon #1/2003, deals with RSBAC. www.linux-magazin.de Hope that helps. Michael

1 0

Anyone has experience with RSBAC?
by Roland Freeman 09 Jan '03

09 Jan '03

Hi all. I am looking forward to RSBAC to a new installation of Suse Linux 8.0 I know I have to patch the kernel with RSBAC modules, but I would like to know if I can patch the already patched SuSE kernel with any hope of success. I would prefer to use a SuSE kernel because I also like the XFS filesystem, which is not yet in the vanilla kernel. Experiences and advices are very needed:-)) Roland Freeman

2 1