January 2003 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] Help needed with susefirewall2
by mike wilsher 23 Jan '03

23 Jan '03

An Upgrade to 8.1 just might be in order. But I still have to come up with the scripts for my firewall. If any one has something or some advice or tools that would be great. Basically I could pluck around and figure it out but that takes too much time. I'd like to have my site up ASAP. Does anyone have scripts that would allow something like this to work. Say maybe something with one interface to the internet and maybe one web server and dns along with full outbound access for a workstation. I could build off of that pretty easly. I have some scripts that I came up with but I am still trying to put it all together. PS- where can I find the upgrades to what is in the SUSE 8.1 firewall2 as opposed to the SUSE 8.0 Firewall2. Thanks Mike W Howard, Neal wrote: > Actually I'd advise you to upgrade to SuSE 8.1 to get some new features in > the SuSEFirewall2 that will let you have multiple external ip addresses, > even aliases on a single external NIC, and route/forward them using the > FW_FORWARD_MASQ feature to different separate internal ip addresses behind > the firewall. The SuSEFirewall2 features in SuSE 8.0 only assumes that you > have a single external interface with a single external ip address. The new > version handles more elaborate combinations of mix-matching multiple > external addresses to internal ones as well as mix-matching tcp and udp port > numbers too. > > You could also stick with SuSE 8.0 and use another tool like Shorewall > instead of SuSEfirewall2 to generate the brain-hurting iptables configs. > > I chose to upgrade SuSE 8.1 myself instead of having to learn a different > set of firewall managemnt tools. That would let you do away with multiple > external NICS too and just simply stack multiple aliased ip addresses onto a > single external nic. > > > -----Original Message----- > From: mike wilsher [mailto:mwilsher@yahoo.com] > Sent: Wednesday, January 22, 2003 11:36 AM > To: suse-security(a)suse.com > Subject: [suse-security] Help needed with susefirewall2 > > > I have SUSE 8.0 and am running SuSEfirewall2 and I have the below setup; > > ---------------------- > | | > | DSL Modem | > | | > ---------------------- > | > | > ---------------------- > | | > | HUB | > | | > ---------------------- > | | > ---------------------- > |eth1 eth2 | > | | > | SuSE Firewall2 | > | | > | | > | eth0 | > ---------------------- > | > | > ---------------------- > | | > | HUB | > | | > ---------------------- > | | | | | > | | | | | > | | | | L_______ workstation_a > WEB1 | | | x.x.x.30 > x.x.x.6 | | L_________ workstation_b > | | x.x.x.31 > WEB2 | > x.x.x.7 | > | > Mail1/ftp1/scp1 > x.x.x.8 > > IP Addresses; > eth1 and eth2 are ISP assigned STATIC addresses. > > I need to permit the exchange of DNS services to my internal machines > > Internal addresses are 192.168.0.x > > What I want to do; > > web traffic on eth1 needs to go to web1 ( port 80 httpmhttps) my work > web server > > pop, ftp and scp traffic on eth1 needs to Mail1/ftp1/scp1 > > web traffic on eth2 needs to go to web2 ( port 80 http,https) my other > web server > > the workstation_a and workstation_b both shoudl be able to surf the > net as well as access > the internal pop as well as access external pop as well as any other > internet based service. > > So what the heck do I need to do to my SuSEfirewall2 and > SuSEfirewall2-custom files? > > Any help out there? > > Thanks. > -- Mike Wilsher - Unix/Security/Disaster Recovery PGP = 5E 1C 46 C6 0A 49 FF A6 94 72 2C FA D3 C6 1C 28 9D DF 7E EB NIHRC KC5BOD

3 3

RE: [suse-security] FTP Proxy ..?
by Dawson, Alan 23 Jan '03

23 Jan '03

> -----Original Message----- > From: Togan Muftuoglu [mailto:toganm@users.sourceforge.net] > Sent: 23 January 2003 15:25 > To: suse-security(a)suse.com > Subject: Re: [suse-security] FTP Proxy ..? > > > * Dawson, Alan; <DawsonA(a)chesterfield.ac.uk> on 23 Jan, 2003 wrote: > >I have come across the SuSE proxy-suite but it doesn't seem > to do what I > >want, in that it seems to be geared for reverse proxying a > ftp server. > > No it does what you want as I have been using it for a long > time. Check > the documentation. I seem to be confused over the meaning of the variable DestinationAddress in ftp-proxy.conf What should I set it to ? > -- > > Togan Muftuoglu > Unofficial SuSE FAQ Maintainer > http://dinamizm.ath.cx > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

3 2

Samba Server and suse 8.0 setup
by jonathan 23 Jan '03

23 Jan '03

Wow alot of input execellent; Thanks! Im going to post my smb.conf file that I currently have, from the responses it seems I either have to enable WINS proxy , but I have the option set local master = no . should I change this ? someone also pointed out I should add my windows boxes to the /etc/samba/lhhosts ? I think as the example looks i do computer ip address then computer name ? so 192.168.0.19 server-866 thats it ? lol, im not sure . im going to check the man files also . Im going to post my file and see if theres something in there I have done incorrectly. Once again thank you all who replied ! Very much appreciated !!! smb.conf to follow ; [global] domain logons = yes netbios name=nexus workgroup = WORKGROUP security = user encrypt passwords = yes os level = 34 local master = no logon script = user.bat # things to try... # also use %u which depending on the username # will execute a different bat file on the win9x box # to map different printers and shares for that particular # username [netlogon] comment = NEXUS SERVER path = /etc/samba public = no writeable = no browsable = no [public] path=/data read only = no public = yes [space] path =/space read only = no public = yes [ftp] path = /ftp read only = no public = yes [raid] path = /raid read only = no public = yes [backup] path =/backup read only = no public = yes

1 0

FTP Proxy ..?
by Dawson, Alan 23 Jan '03

23 Jan '03

Anybody using a ftp proxy out there My clients need to put to an external ftp site. Rather than allowing them to connect through a nat firewall I would like them to use a proxy, in a similar fashion to web proxy , for the connection and have the proxy perform the put and get on their behalf. I have come across the SuSE proxy-suite but it doesn't seem to do what I want, in that it seems to be geared for reverse proxying a ftp server. Can anybody help ? Alan Dawson

3 2

Antwort: [suse-security] Another Firewall
by Bruno Leonhardt 23 Jan '03

23 Jan '03

Why do you think SuSEFirewall is a Firewall ? The firewall is the Linux-System ! With SuSEFirewall it's easier to make rules for IP-Tables/Netfilter but it's not the firewall - am I wrong ? ..::bruno::.. payam payami <ppayami(a)yahoo.com> 23.01.03 12:24 An: suse-security(a)suse.com Kopie: Thema: [suse-security] Another Firewall Hi, I think Suse Firewall having bug, Is another firewall exist, that i can use from that in Suse? Thanks, Payam __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

firewall and port forwarding
by terry 23 Jan '03

23 Jan '03

Hi pls excuse my ignorance, very new to Linux! 2 x nics in suse 7 server routes adsl to win98/2000 boxes (ip masquerading) - works extremely well. I want to use vnc for remote access. What do I need to set in the firewall.config ? I entered what i thought was coorect addresses but still no luck, the example in the file is not very clear to me. I would be extremely grateful of any assistance many thanks Terry Reynolds I.T. Manager Security and reliability of e-mails are not guaranteed. We operate anti-virus programmes but you must take full responsibility for virus checking this e-mail (including all attachments). Action Express Group do not accept any liability in respect of any damage caused by any virus which is not detected.

4 4

Another Firewall
by payam payami 23 Jan '03

23 Jan '03

Hi, I think Suse Firewall having bug, Is another firewall exist, that i can use from that in Suse? Thanks, Payam __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

2 1

suse samba server
by jonathan 23 Jan '03

23 Jan '03

Hello I have basically a suse samba server setup. Eth0 is for the internet connection (cable). Eth1 is my internal network. I use eth1 for my samba server. When i have the shares/ drive letters mapped, whatever, Ill goto access them and that computer will just lockup or timeout for about 1 minute, then it will resume operation normally. I have approx. 5 comptuers on the suse server, and they all do this from windows xp to windows 98se. I am using set up addresses of 192.168.0.x, where is greater than 2. My question is have or is there something Ive setup wrong to cause this pause to occur. ? Its becomming very annoying..and frustrating. Im using kernel 2.4.18-64GB-SMP with a dual processor setup. If anyone has any ideas please let me know. Every package installed is orginal versions from the suse install cdroms. (no updates done). Anything come to mind. btw, ive replaced the switch, with a new netgear one, and all the networks at startech ST100 Realtek 8139 chipsets on 100Tx. Anyone... !

4 5

pop3s, stunnel and pop-before-smtp configuration
by Michael M. Dienel 23 Jan '03

23 Jan '03

Hi list, i have a question about the following problem i'm facing: I want to use a secure conection to my POP3-service and i'll be able to send mail via smtp. To prevent an open-relay mailserver i set up pop-before-smtp from http://popbsmtp.sourceforge.net. It is using /var/log/mail to update its IP-adress-database to verify access to smtp. Now i'm not shure about the right setup in xinetd.conf: Version 1: service pop3s { disable = no socket_type = stream wait = no user = root server = /usr/sbin/ipop3d server_args = -s log_on_success += USERID log_on_failure += USERID } Version 2: service pop3s { disable = no socket_type = stream wait = no user = root server = /usr/sbin/stunnel server_args = -l /usr/sbin/ipop3d log_on_success += USERID log_on_failure += USERID } Version 2 creates only access from 127.0.0.1 in /var/log/mail. This prevents pop-before-smtp from updating its database but all data is sent via an ssl connection to the server. Now my questions: Is data in version 1 also send via ssl or only some parts like userid and password or nothing? If nothing is send via ssl: How to configure stunnel to send the original ip-adress to /var/log/mail? Thanks and regards Michael M. Dienel --- Michael M. Dienel DIENtronik www.dientronik.de mmdienel(a)dientronik.de michael.m.dienel(a)t-online.de

2 1

VPN connection problems with Windows 200 Pro to Suse Firewall
by Paulson Josh 23 Jan '03

23 Jan '03

I am trying to setup a VPN server for our Windows 2000 network. I purchased the Suse Firewall/VPN for the road warrior capability. I seem to have problems setting up the tunnel with IPSEC. The clients computers are running Windows 2000 professional. Whenever I try and connect using the X.509 certificate It comes up with connection errors. The certificate I am using is generated by the FAS module in the ADMIN cd. Also, with the firewall configuration I didn't set up any filtering rules with IPchains or IPtables. I am not sure if I configured the server or the client properly, also am not sure if I exported the certificate properly. Does anyone have any ideas or better yet any documentation on getting this setup?. The help files and instructions are pretty vague. Thanks

2 1