October 2003 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] mysql_connect: Access denied
by Junge, Stefan 22 Oct '03

22 Oct '03

Hi Thomas, which entries are in the mysql user table ? 1. Connect to your MySQL DB (Console) # mysql -> Does this work without any authentication ? 2. Select the mysql Database # \u mysql 3. Select another pager for a better view # pager 4. Lets have a look to your user table ... # SELECT * FROM USER; You should have an entry like this ... Host localhost, User "empty", Password "empty" and with appropriate privileges Is your user 'roth' listed here ? ONLY for testing !!! Create a user with full privileges to all ! mysql > grant all privileges on *.* to testuser@% identified by 'testpassword' with grant option; This command creates the user 'testuser' with the access privilege 'from everywhere' with the right to to bequest his rights. With this user should be able to connect to the database with your PHP Script. Don´t forget to remove the user 'testuser' with his privileges ! Note: MySQL has its own user system - independent from the system users. Maybe this is a first step... Good luck Stefan > -----Ursprüngliche Nachricht----- > Von: Thomas Roth [mailto:thomas.roth@physik.tu-darmstadt.de] > Gesendet: Dienstag, 21. Oktober 2003 20:33 > An: suse-security > Betreff: [suse-security] mysql_connect: Access denied > > > > Hello list, > > I've got that problem with mysql + php. Both run under SuSE > 8.2, (php 4.3.1 as > Apache module, mysql vers. 11.18). > I have tried to follow the instructions, giving 'root' a > password, setting up > a mysql-user with fewer privileges etc. I have set up a table > in db 'test' > and put in some data. Now, when I try to connect via a > php-script, access is > denied: > > mysql_connect() [function.mysql-connect]: Access denied for user: > 'roth@localhost' (Using password: NO) > > The first strange thing is that the username supplied to > mysql_connect() in > the script is not 'roth' (although this username exists on > the system). > > Then I was somewhat successful by not supplying anything to the > mysql_connect() function - until I realized that by default, > there is a > mysql-user '@localhost' without a password. Giving a password > to '@localhost' > of course leads with the access denial as above. > > I also found that the message ' Using password: NO' appears > if you say on > the commandline: 'mysql -u user' > If you instead put int the -p ('mysql -u user -p '), you > will be asked for > the password, as it should be. > But how can you do that via the web/apache/php? The only > advice I've found is > exactly what I did: to put the relevant data into the php > script and use them > in mysql_connect(). > > Somewhere I read that in case of an empty mysql_connect(), > the identity of the > apache-user will be used as the default mysql-user. But > apache is definitly > not running as the user that appears in the complaint above. > > Checking php.ini, I see that php runs in safe_mode. > > Well, I'm somewhat confused and would appreciate your help > > Thomas > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

ipsec freeswan - connection established successfully, but packets are dropped ...
by Markus Feilner 20 Oct '03

20 Oct '03

Hello List, I am using SuSE 8.2 on two systems, together with freeswan ipsec. Both systems run: kernel 2.4.20-4GB freeswan 1.99_0.9.23 I have configured freeswan successfully with a Server-and-roadwarrior setup using Certs. By successfully I mean: in /var/log/messages I find a line like --------- Oct 16 21:54:26 Server ipsec__plutorun: 004 "VPN-ERMER" #2: STATE_QUICK_I2: sent QI2, IPsec SA established --------- or similar after starting ipsec on both systems and there are definitely no errors on both servers. On the server side we have the subnet x.x.89.0 to be accessible, on the roadwarrior side (which is connected via dsl) we have the x.x.0.0 subnet connected. My Problem: When i try to ping from one subnet to the other (of course from a different member of the subnet, not the machine running ipsec), the packets are routed correctly to the ipsec device, but there they vanish: ---------------------------- Server:/ # tcpdump -i ipsec0 tcpdump: listening on ipsec0 22:25:17.996878 217.229.160.84 > x.x.89.0: icmp: echo request (DF) 22:25:18.996902 217.229.160.84 > x.x.89.0: icmp: echo request (DF) 22:25:19.996909 217.229.160.84 > x.x.89.0: icmp: echo request (DF) (...) no answer is given to the ping and on the other side of the tunnel, nothing arrives - this happens to every packet that is sent to the tunnel, no matter which port, protocol and destination. As far as i can see, the packets are dropped, before they are given to ppp0: ----------------------------- Server:/ # ifconfig ipsec0 ipsec0 Link encap:IPIP Tunnel HWaddr inet addr:217.229.160.84 Mask:255.255.255.255 UP RUNNING NOARP MTU:16260 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:2002 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) ---------------------------- I stopped all Firewall rules, and checked the ipsec configuration over and over, but i can't find a solution. Can anyone help me? If you need, I can post both my ipsec.conf files and barfs, but i didn't want to cause big traffic. Perhaps someone already knows the solution.... Thanks!! -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

7 13

SuSEfirewall 2 configuration - computer name problem
by Andrei Bintintan 18 Oct '03

18 Oct '03

Hi I saw there was a little discuttion about suse firewall and samba, but I have another problem here. First of all I'm new in linux, so sorry if I ask stupid things... everyone has to learn right? I have a server in LAN which is web, mail, db server. Samba is also installed. Everything worked fine, but when I activate suse firewall I cannot see the computer name anymore. I have access with samba, I can ping the server but only with the IP address of the server, not with the name. Shortly the server name is not recognized anymore. I waste a lot of time with this... and I couldn't find the problem. The strange part is that I installed the same configuration under vmware and it works fine. I activated port 53 (domain name) but still doesn't work. Please advise. Thanx in advance. Andy.

2 1

fou4s - Fast OnlineUpdate for SuSE 0.10.0
by Markus Gaugusch 14 Oct '03

14 Oct '03

Hi, I'm happy to announce the final release of fou4s 0.10.0. For those who do not know, this software is meant to be an alternative for YOU (YaST OnlineUpdate), especially designed for administrators that need to keep many machines up-to-date in a convenient way. But I also use it on my desktop machines, so you may do so as well ;-) Since the last version many things have changed (hopefully, they have become better :) * SuSE 9.0 support * 2-level caching for even faster updates * Bandwidth limiting for downloads [--limit] * Check remote hosts for needed updates, even if fou4s is not installed there (you just need to be able to read the RPM database) [--host] * More support for foreign updates (packman, ...; hint: use --end!) * Files that are fully retrieved are no longer tried to be resumed * The language of the update descriptions can be chosen [--language] * New output formatting and summary Because of internal changes, the GpdList option should no longer be used. Just add your rsync servers to the Server= list (blank separated or add another Server= line) and run fou4s -u, etc as if it were a normal server. If you are updating to SuSE 9.0, please do a fou4s update FIRST, because the old version is not compatible. If you have already upgraded, run fou4s --auto --checkf -g, to install the new fou4s without signature checking (or just install the new fou4s version with rpm -Uvh ...). As usual, the software can be downloaded from http://fou4s.gaugusch.at/. Previous fou4s users are notified automatically, if the checkfou4s option is set in the cronjob. have a lot of fun ... Markus PS: For everyone who has not seen Terminator III: Machines will take over the world, if we don't keep our computers protected! -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(a)gaugusch.at X Against HTML Mail / \

1 0

test plz ignore
by Arjen Runsink 13 Oct '03

13 Oct '03

ignore

1 0

Re: [suse-security] Problem: permission bits changed on files automatically (SOLVED)
by David C. Grosvold 10 Oct '03

10 Oct '03

Stefan: On Monday 06 October 2003 07:17 am, Stefan Seyfried wrote: > On Fri, Oct 03, 2003 at 10:38:41AM -0500, David C. Grosvold wrote: > > Nope - that's not it, but your comment led me down a new path. Now that > > you mention it, it happens after the On-Line update when SuSEConfig runs. > > > > Guess what? I just had to change the setting of CHECK_PERMISSIONS in > > /etc/ sysconfig/security to "warn" rather than "set" and the problem is > > solved! > > but anyway, SuSEconfig should not do anything in a $HOME. What user are we > talking about? root or a mere mortal? The only thing which would explain > this (to me) is some weird bind-mount or symbolic link into a home, but > this is pure speculation. > > regards, > > Stefan What an interesting thought! We're talking about a mere mortal. I thought I had this solved until earlier today. I updated something in YaST, and once again, the permission bits on all the executables in my normal user's home directory and below were changed from 775 to 675. As far back as SuSE 7.3 I've maintained a symbolic link to /srv/www/htdocs in my "mere mortal" home directory for convenience during web development. To test, I removed the symbolic link, and reran SuSEconfig. The permission bits were NOT changed after removing the link. You might be on to something... Hmmmmm. -- --------------------------------------------------- Dave Grosvold dave(a)rcanyon.com ---------------------------------------------------

1 0

Apache Proxy Acces
by Jan Rüdiger 10 Oct '03

10 Oct '03

Hello I detected a lot of messages like this in my http-access.log 38.117.18.175 - - [01/Oct/2003:00:20:33 +0200] "QUIT" 302 - 38.117.18.177 - - [01/Oct/2003:00:20:40 +0200] "QUIT" 302 - 38.117.18.178 - - [01/Oct/2003:00:20:48 +0200] "POST http://134.155.65.115:25/ HTTP/1.1" 302 318 The Apache is beside a http server also a proxy for a local service running on port 20000. The Access to the Proxy is restricted by: <Directory proxy:*> Order deny,allow Deny from all Allow from 10.0.0. </Directory> Should i be aweare, because 302 means somehting like service temporary unavailable, but there where 318 bytes of data transmited? thanks four your help jan

1 0

Solved ! RE: [suse-security] SuSe Firewall 2 - FW_HTB_TUNE_DEV ???
by Cees Tool 10 Oct '03

10 Oct '03

Hi, > Oh I see you are using SuSEfirewall2 from SuSE 8.1 No, I have Suse 8.2, but I have done updates via Yast Online Update, maybe that goes wrong ?? I have seen more references to Suse 8.1 during upgrading. I will try to find-out what's going wrong with that.... Update after some tests: I have investigated data with "Ethereal", the online-update of Suse 8.2 gets it's updates from pub/suse/i386/update/8.1/.... So the update program was getting the wrong updates (8.1 instead of 8.2) all the time. This is probably also the answer of other minor problems with updating. Now the next thing is to find an updated version of "YOU" (yast online update), and I have to do this manually as the update-program can never find this..... (Probably I am not the only one with this problem ;) > I recomend you to download > SuSEfirewall2-3.1.95.noarch.rpm > from: > ftp.suse.com/pub/suse/i386/update/8.2/rpm/noarch/SuSEfirewall2-3.1- > 95.noarch.rpm [Cees Tool] I have done this, and indeed now the "FW-HTB*" references are in the Susefirewall2 script and it seems to work now ! Thanks all, for the information. Problem (almost) solved. Now I have to see if there is a solution for the wrong directory in yast online update.... Regards, Cees

4 7

RE: [suse-security] Problems with SuSEFirewall
by Sturgis, Grant 09 Oct '03

09 Oct '03

One solution is to have split DNS. The inside DNS points www to the inside address (i.e. 192.168.x.x) while the outside (public) DNS points to the public IP address. -GS -----Original Message----- From: Andrés Tarallo [mailto:atarallo@acm.org] Sent: Thursday, October 09, 2003 10:55 AM To: suse-security(a)suse.com Subject: [suse-security] Problems with SuSEFirewall Hi !!! I have a problem with a firewall I've configured with SuSEFirewall2 and SuSE Linux 8.2. My firewall has a public IP address, and a private IP for a LAN. In the LAN I have a WWW server and a email server. People who want to check their mail from the Internet just connect to the public IP in the firewall and I have set there rules to redirect the trafic to the mail server and WWW server in the LAN. This works fine, also the people in the lan browse the internet via a transparent proxy. My problem starts because the people on the private LAN want's to access the WWW server from the lan, in the same manner they do from the Internet. When they point their browser to http://www.company.com they get a error message from squid that says that the conection was refused. If i ping the WWW server from the LAN by it's name i get no answer. This problems is driving me mad, I don't know what to do. Thanks in advance for your advice. Andrés This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

3 2

root has no shell
by Ulrich Kautz 09 Oct '03

09 Oct '03

Hello All, Ive got a big Problem. I changed the root shell to /bin/false. There is neither a user in the sudoers nor is there any other root-user or even a user in the root group. Is it possible to switch back the shell to /bin/bash or sh or something? Ive tried: sudo -- not in sudoers su -s /bin/bash -c "command" -- "using restricted shell: /bin/false" thanks in advance, Ulrich

19 27

Problems with SuSEFirewall
by Andrés Tarallo 09 Oct '03

09 Oct '03

Hi !!! I have a problem with a firewall I've configured with SuSEFirewall2 and SuSE Linux 8.2. My firewall has a public IP address, and a private IP for a LAN. In the LAN I have a WWW server and a email server. People who want to check their mail from the Internet just connect to the public IP in the firewall and I have set there rules to redirect the trafic to the mail server and WWW server in the LAN. This works fine, also the people in the lan browse the internet via a transparent proxy. My problem starts because the people on the private LAN want's to access the WWW server from the lan, in the same manner they do from the Internet. When they point their browser to http://www.company.com they get a error message from squid that says that the conection was refused. If i ping the WWW server from the LAN by it's name i get no answer. This problems is driving me mad, I don't know what to do. Thanks in advance for your advice. Andrés

1 0

AW: [suse-security] root has no shell
by Ulrich Roth 08 Oct '03

08 Oct '03

Hi Ulrich, > Ive got a big Problem. I changed the root shell to /bin/false. ROTFL! ;-) Okay, boot the machine using the SuSE CDs. Mount the appropriate partition and edit the passwd file. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth at impact dot de

1 0

Secure dynDNS-Update with Router
by Andreas Thierer 07 Oct '03

07 Oct '03

Hi, i want to update my SuSE 8.2 / BIND 9.2 DNS-Server dynamically with TSIG-Keys. Is this possible, if the Client is behind a router? The Netgear RP314 ADSL-Router, as an example, has a builtin DynDNS-Client which happens to work only with dyndns.org (they don't use TSIG-Keys for authorisation). Exist any routers which are able to handle custom dynDNS-servers with TSIG-Keys? Best regards and thanks for any help Andy

2 1

RE: [suse-security] SuSe Firewall 2 - FW_HTB_TUNE_DEV ???
by Cees Tool 07 Oct '03

07 Oct '03

>From: Stefan Seyfried > > On Tue, Oct 07, 2003 at 11:18:57AM +0200, Cees Tool wrote: > > > Do you know if I can check somewhere if the SuseFirewall2 script does > > anything with the "FW_HTB_TUNE_DEV" variable ? > > just read /sbin/SuSEfirewall2, its all in there ;-) > That is the file I have examined too ;) But unfortunately there is no reference to "FW_HTB*" in there. I have searched this file. So probably it does nothing with the "FW_HTB_TUNE_DEV" setting. That's why I asked if I need to install any other thing to have this working.. Regards, Cees

3 3

SuSe Firewall 2 - FW_HTB_TUNE_DEV ???
by Cees Tool 07 Oct '03

07 Oct '03

Hello, I am using Suse 8.2 (kernel 2.4.20) and SuSe Firewall 2. I want to shape my upstream speed and tried to enter : FW_HTB_TUNE_DEV="eth0,125" But I do not see any change in upstream speed, even if I try to enter "eth0,10", my upstream speed remains the same (128 Kbps). From the help-text in sysconfig I understand that this parameter should do the trick, but maybe more has to be set. I cannot find more information. - Do I need to load any module for this ? (Which?) - Do I need to configure anything else to have this parameter work ? - Any other hints ? Regards, Cees

2 2

EXPLOIT?!?!
by Radu Voicu 06 Oct '03

06 Oct '03

"Affected: SuSE Linux 8.2Pro Not affected: SuSE Linux 7.3Pro, non-SuSE distributions Possibly affected: other SuSE distributions Vulnerable package: susewm Impact: Local user can gain root privileges Exploit type: Symlink attack Release date: October 6th 2003 Vendor status: SuSE was contacted on September 4th (> 1 month ago). No SuSE-patch yet. A symlink vulnerability exists in the shell script /sbin/conf.d/SuSEconfig.susewm, line 86. This shell script is part of the "susewm" package. This package is required by the package "kdebase3", so if KDE3 is installed on your system(s), you should be vulnerable." ...please read the link I provided for further details http://amor.rz.hu-berlin.de/~nordhaus/sec/vul/1_index.html

2 1

AW: [suse-security] Re: SSH and Apache warnings Nessus
by Hollweg, Daniel 06 Oct '03

06 Oct '03

> -----Ursprungliche Nachricht----- > Von: Stefan Andreas Tichy [mailto:listuser@pi4tel.de] > Gesendet: Montag, 6. Oktober 2003 14:42 > An: suse-security(a)suse.com > Betreff: [suse-security] Re: SSH and Apache warnings Nessus > > > On Mon, Oct 06, 2003 at 08:09:37AM +0100, Hollweg, Daniel wrote: > > I have two problems with a new installed SuSe Linux > Professional 8.2. > > All current patches are applied. Wehn I am scanning the box > with the > > nessus I get the following warnings: > > > > - You are running a version of OpenSSH which is older than 3.7.1 > > > > - You are running OpenSSH-portable 3.6.1p1 or older. > > If possible SuSE applies fixes to software versions > originally delivered > with some SuSE distribution. Therefore upgrading to the newest > versions is not neccessary. > > > > Is this O.K. and just an Nessus Problem with the SuSe version of > > SSH? > > Yes > > > > - The remote HTTP server allows an attacker to read > arbitrary files > > on the remote web server, simply by adding a slash in > front of its name. > > Example: GET //etc/passwd will return /etc/passwd. > > There has been a vulnerability in mod_rewrite, but it should be no > problem using apache installed with SuSE 8.2. > http://www.apacheweek.com/issues/00-09-22 > > > I already installed the newest SuSe Apache 1.3 package. > Where is the problem? > > Amazing is that the GET request does not return the whole > passwd but only two > > lines. > > Is this just some nessus information or did you reproduce the > problem? I tested it and it returns two lines of my /etc/passwd. Other files like /etc/inittab result in a Error 403. Here is a sample output: root:*:0:0::/:/etc/ftponly foo:x:502:503::/home/foo/public_html/./:/bin/false Regards, Daniel

2 1

passwd on website
by Dominik Składanowski 06 Oct '03

06 Oct '03

Hello list. I need to have change system password through website. I tried chpasswd (https://chpasswd.sourceforge.net/) but on SuSE 8.2 Pro I can't pass compilation. Besides it is rather old soft... Anybody knows other possibility to do that? -- ++++++++++++++++++++++++++++++++++++++++++ Dominik Skladanowski e-mail: dominik.skladanowski(a)ch.pw.edu.pl ++++++++++++++++++++++++++++++++++++++++++

7 7

SSH and Apache warnings Nessus
by Hollweg, Daniel 06 Oct '03

06 Oct '03

Hi List! I have two problems with a new installed SuSe Linux Professional 8.2. All current patches are applied. Wehn I am scanning the box with the nessus I get the following warnings: - You are running a version of OpenSSH which is older than 3.7.1 - You are running OpenSSH-portable 3.6.1p1 or older. As I wrote before I installed the latest SSH Version from SuSe. Is this O.K. and just an Nessus Problem with the SuSe version of SSH? - The remote HTTP server allows an attacker to read arbitrary files on the remote web server, simply by adding a slash in front of its name. Example: GET //etc/passwd will return /etc/passwd. I already installed the newest SuSe Apache 1.3 package. Where is the problem? Amazing is that the GET request does not return the whole passwd but only two lines. Any suggestions? Thanks, Daniel

3 2

Problem: permission bits changed on files automatically
by David C. Grosvold 06 Oct '03

06 Oct '03

Anybody have any experience with this? On an intermittent basis, all of the files in my home directory with mode 0775 are changed to mode 0675 without my knowledge. I've checked the cron jobs for root to see if anything looks out of place, but nothing shows up. I'm running SuSE 8.2, with everything up to date, but this has been happening since version 7.3, it's just now become so frequent that I've decided I have to resolve it. I usually discover the problem when shell scripts or Perl scripts suddenly stop working when I call them from either the command line or cron. My SuSE system is on DSL, with a D-Link 604 DSL router, an internal network with Windoze 2000 (two laptops and a desktop) and an old SCO Unix 5.0 box. I have Samba 2.2.7a running to allow the Windoze boxes to use the SuSE box as a file exchange point, McAfee virusscan is installed on all Windoze boxes. I do cross-platform database development using Linux, Windoze, and Unix, but my primary box and my desktop are Linux. Windoze is there solely for development purposes. I've been a Unix/Linux system administrator for 15 years - my firs Unix box was a Unisys Tower (re-badged NCR Tower) with a Motorola 68020 processor and NCR Tower Unix (AT&T SystemV release 2.5). Things have come a mightly klong way since then. At any rate, if anyone can shed any light on this, it would be appreciated. -- --------------------------------------------------- Dave Grosvold dave(a)rcanyon.com ---------------------------------------------------

3 3

AW: [suse-security] Mail missplaced or lost
by Ulrich Roth 06 Oct '03

06 Oct '03

Hi David, > I have a system running SuSE 7.3 with all updates, and I noticed that > > the old mail (readed) was moving to the Trash folder or there was > another new folder instead with the old mail. I don't know when the > problem started but it is happening on multiple accounts, if > not in all. Did you ask your users if they did anything they didn't do before? Do they use a new mail program? Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth at impact dot de

1 0

Help seeting SuSEfirewall2
by Rafael E. Herrera 05 Oct '03

05 Oct '03

Hello, I would like to be able to have a machine with that allows remote connections through SSH. It should also accept traffic through 15 UDP ports. The SSH and 15 UPD ports traffic should be limited to two subnets: in the example below, they are 12.203.150.0/24 and 12.203.162.0/26. All other traffic should be rejected. The machine will not act as a router, I just want to use SuSEfirewall2 as a personal firewall. I only has one network card. Will the configuration file below satisfy the requirements I've stated? I suspect I'm allowing anybody to connect suing ssh by setting FW_SERVICES_EXT_TCP, is that correct? I'd appreciate any suggestion. Rafael -------------------------- FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="40001:40015" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="12.203.150.0/24 12.203.162.0/26" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" # Beware to use this! FW_FORWARD_MASQ="" # Beware to use this! FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV=""

2 2

SuSE honeyd rpm's
by Thomas Jones 05 Oct '03

05 Oct '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello all, I've taken the liberty of building the RPM's for honeyd 0.6a. I did a quick search on google and didn't find any available. So let me know if there is already one(or all) available. The pre-compiled 0.5 is nice; but i prefer to have everything in it's rightful place. It's getting late ---- so i may have fragged a path or something ----- would someone with a clean system be willing to do a install to check it out for me? These are not CVS pulls, so they should be stable. http://www.linux-howtos.com/releases/honeyd-0.6a-1.i386.rpm http://www.linux-howtos.com/releases/libdnet-1.7-1.i386.rpm http://www.linux-howtos.com/releases/libevent-0.7a-1.i386.rpm Let me know how they work. Thanks for your time. - -- Thomas Jones Linux-Howtos Network Administrator OpenGPG Key: 0x6A3DF6E9 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iD8DBQE/f+W+QT2komo99ukRAq9YAJwLqIDC1TVC/M21jAbVAHOw5TnaCgCeKrpg yY48xiX3TTTf6Ra/JeLImS0= =L//K -----END PGP SIGNATURE-----

1 0

Secure Mail Server
by João Reis 04 Oct '03

04 Oct '03

Hi to all. I would like to implement a secure Mail server. This is an internal mail server and belongs to the network behind the external firewall. I also would like to have a system which permits external users to connect to the internal mail server in order to fetch their internal mail or to send their mail througth this server (POP with SSL and SMTP). The only way i see to have external connection is to add a rule to my firewall teling it to redirect all POP and SMTP traffic to this internal server. Is there a more secure way to do this? Is it secure to implement this scheme? I think this way my internal mail is exposed to the world, but i don't see other solution to do what i pretend.... Any suggestion ? Thanks in advance, P.S : sorry about my english João Reis ==========================================================

4 3

AW: [suse-security] explicitly allow fragmented packets in ipsec environment - unset the DF bit
by mailinglists 03 Oct '03

03 Oct '03

Hi > > I can send 15 Kbyte (I haven't tried larger packets yet but > I'm sure they > > will go through the tunnel as well) pings to the other end > of an ipsec > > (freeswan-freeswan) tunnel. Checking my fragmented packets > the DF bit is > > not set. The other end of the tunnel, however, can "only" > send 1500 Byte > > pings to me. Those packets have the DF bit set. > The following is taken from > /usr/src/linux/Documentation/Configure.help: > > > TCPMSS target support > CONFIG_IP_NF_TARGET_TCPMSS > This option adds a `TCPMSS' target, which allows you to alter the > MSS value of TCP SYN packets, to control the maximum size for that > connection (usually limiting it to your outgoing interface's MTU > minus 40). > > This is used to overcome criminally braindead ISPs or servers which > block ICMP Fragmentation Needed packets. The symptoms of this > problem are that everything works fine from your Linux > firewall/router, but machines behind it can never exchange large > packets > [...] > > > This sounds quite a bit like your problem. One of your > systems seems to be > unable to send fragmented packets. And as 1500 bytes is > probably your MTU, > the host that cannot send fragmented packets cannot send > packets larger than > 1500 bytes. Maybe this is simply because you yourself are > blocking the "ICMP > Fragmentation Needed packets", so check your firewall > rules/logs. Don't need to. ICMP 3 allowed everywhere. > If that > doesn't help, maybe this kernel option will. I'll try. Thanks Philipp

1 0