November 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] DHCP and IP Numbers ?
by Knut Erik Hauslo 07 Nov '03

07 Nov '03

Normally, the DHCP-Client would renew it's IP after half the lease period has gone by. Usually it would'nt reassign a new IP address because the DHCP-Client normally tries to renew the one it already has. The server only gives a new IP-Address if the one the clients requests is given away. But as long as the client is active and does not release it's IP-Address, that should not happen. But DHCP for name resolution, this must be wrong... Cheers Knut Erik -----Original Message----- From: remote [mailto:remote@leat.ruhr-uni-bochum.de] Sent: Friday, November 07, 2003 3:40 PM To: suse-security(a)suse.com Subject: [suse-security] DHCP and IP Numbers ? Hi ! I have a question about how DHCP is working. You see, I try to set up a small cluster of boxes to do some parallel computing. The Name Resolution in this cluster is supposed to work with DHCP. Things seem to run smoothly, but after some time, my parallel process is interrupted, with no error message at all. I `d like to know if DHCP reassigns new IPs after a certain amount of time and if this could interrupt my parallel processes (I tried both MPICH and rsh). Any suggestions ? Thanks, Jörg

1 0

RE: [suse-security] masquerading and port range forwarding to internal host (with a private address)
by Benoit Gariod 07 Nov '03

07 Nov '03

I'm already running 2.4, and iptables (said so in my message). >From what i gater from your and Barry's messages, i already had it figured out, but the online documentation had me confused, so i was looking at the wrong place. I should have just sticked to the #comments in the file and then mimmicked the syntax used in other options for the port ranges. thanks for clearing that one out barry, very much appreciated :D I'll try that way and report back Benoit Gariod -----Original Message----- From: Renan Yigitaslan [mailto:renan@eskisehirli.net] Sent: Friday, November 07, 2003 2:17 PM To: Benoit Gariod Subject: Re: [suse-security] masquerading and port range forwarding to internal host (with a private address) Hello Ben, You must update your kernel 2.2.1 to 2.4.x if you will use iptables support. You can update your kernel with yast. Very easy and fast solution. Definitely you must type FW_ROUTE="yes" and FW_ALLOW_INCOMING_HIGHPORTS_TCP(UDP)="yes or port_number". and you must type FW_FORWARD="source_ip,dest_ip,protocol,dest_port" if not use masqueraded network ex. FW_FORWARD="0/0,10.1.1.1,tcp,12010:12100" if use masqueraded network you must use FW_FORWARD_MASQ expression ex. FW_FORWARD_MASQ="0/0,10.1.1.1,tcp,12030:12100" good lucks. Fidel Renan ----- Original Message ----- From: "Benoit Gariod" <ben(a)talon.nl> To: <suse-security(a)suse.com> Sent: Friday, November 07, 2003 2:23 PM Subject: [suse-security] masquerading and port range forwarding to internal host (with a private address) > Hello > > I'm running 8.2 and so far i've ben able to use /etc/sysconfig/SuSEfirewall2 > to do all the firewalling i wanted, but now i want to forward a whole port > range to one of the host on the internal network, and the only option > (FW_FORWARD) takes 2 public IP addies as arguments (from what i read about > it on the list archive anyway). Problem is, most of the messages i've read > are quite old (2000-2001) and address 2.2 kernel issues. > i run iptables (came with 2.4 kernel, and it did what i wanted it to), so > i'm asking here in a fresh message. > > so, in short, if i want to forward ports 12030-12100 to a host on my > internal network, can i do it with /etc/sysconfig/SuSEfirewall2 or do i have > to input an iptables rule myself? > could anyone help building said rule? > > thanks a lot > > Ben > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

masquerading and port range forwarding to internal host (with a private address)
by Benoit Gariod 07 Nov '03

07 Nov '03

Hello I'm running 8.2 and so far i've ben able to use /etc/sysconfig/SuSEfirewall2 to do all the firewalling i wanted, but now i want to forward a whole port range to one of the host on the internal network, and the only option (FW_FORWARD) takes 2 public IP addies as arguments (from what i read about it on the list archive anyway). Problem is, most of the messages i've read are quite old (2000-2001) and address 2.2 kernel issues. i run iptables (came with 2.4 kernel, and it did what i wanted it to), so i'm asking here in a fresh message. so, in short, if i want to forward ports 12030-12100 to a host on my internal network, can i do it with /etc/sysconfig/SuSEfirewall2 or do i have to input an iptables rule myself? could anyone help building said rule? thanks a lot Ben

1 0

RE: [suse-security] sendmail and amavisd on 9.0
by Rainer_Link＠trendmicro.de 07 Nov '03

07 Nov '03

It seems to be supported, because of > AMAVISD_BIN=/usr/sbin/amavisd > AMAVIS_MILTER_BIN=/usr/sbin/amavis-milter > > and > > if [ "$AMAVIS_SENDMAIL_MILTER" == "yes" ]; then ... > > in /etc/init.d/amavis. There is the process > 3317 ? S 0:00 /usr/sbin/amavis-milter -p > local:/var/run/amavis/amavis-milter.sock Fine. Please check /etc/sendmail.cf and grep for "amavis" - there should be a reference to /var/run/amavis/amavis-milter.sock Moreover, please keep in mind, amavisd must be started before sendmail! Otherwise, the amavis-milter.sock can not be found by sendmail. best regards, Rainer Link

2 1

Free Antivirus for Postfix
by Andrei Bintintan 07 Nov '03

07 Nov '03

Hi to all, I am not sure if I am posting this message in the right forum, but maybe you can help. I need a Free Antivirus Software for Postfix MTA. I searched the web a lot, but I thought that I can ask people who already use such kind of thing. Any suggestions? Thnkx in advance. Andy.

6 6

RE: [suse-security] sendmail and amavisd on 9.0
by Rainer_Link＠trendmicro.de 07 Nov '03

07 Nov '03

> On Fri, 7 Nov 2003 10:13:40 +0100, Dirk Borchers > <dirk.borchers(a)gmx.de> > wrote: > > > I installed sendmail, amavisd and AntiVir on my machine > with SuSE 9.0 > > and configured sysconf to use amavisd with milter. But > sendmail does > > not scan the emails; and I can not find any appropiate line in > > sendmail.cf that it should use amavis. I could not find any hint in > > the ReadMes. What's going wrong? > > I have the following line in my sendmail.cf: > > Mlocal, P=/usr/sbin/scanmails, F=olsDFMAw5:/|@qPfhn9, > S=10/30, R=20/40, > T=DNS/RFC822/X-Unix, A=scanmails -Y -a $h -d $u > > see http://www.amavis.org/amavis.html#modsendmail > NO! This refers to the very old AMaViS 0.2.x (shell script), as mentioned at the top of the page (see the important note in red letters). The development of 0.2.x has been stopped two years ago or so. SUSE 9.0 ships with amavisd-new. I do not have a copy of it around; the RPM packages of amavisd-new for SUSE I'm aware of do not support sendmail (sendmail milter) out of the box. But those RPMs I've checked are some month old. Please check /etc/init.d/amavis* (don't know the exact name for 9.0). If /usr/sbin/amavis*-milter is never called, I would assume sendmail milter is not supported. But please take all this with a grain of salt. best regards, Rainer Link (former AMaViS maintainer)

2 1

sendmail and amavisd on 9.0
by Dirk Borchers 07 Nov '03

07 Nov '03

Hello, I installed sendmail, amavisd and AntiVir on my machine with SuSE 9.0 and configured sysconf to use amavisd with milter. But sendmail does not scan the emails; and I can not find any appropiate line in sendmail.cf that it should use amavis. I could not find any hint in the ReadMes. What's going wrong? Dirk

2 2

Security Enhanced Linux kernel RPMs for SuSE
by Paul Dwerryhouse 07 Nov '03

07 Nov '03

Hi all, In September, I built a bunch of SELinux userspace RPMs for SuSE Linux 8.2. I have now ported the 2.4 backport of the 'new' SELinux code to Hubert Mantel's SuSE default kernel 2.4.21-121, and subsequently have built an RPM of the kernel itself. I've cheated in a couple of places: the Mantel release had a patch for a variable HZ value, but I hardcoded it to 100 because I didn't know how to work around a patch conflict it caused; also I really doubt the sonypi code will work now because of a kludge I used to make it compile. The patch, kernel binary and patched kernel sources can all be downloaded from here: http://leapster.org/linux/selinux/suse/ I have not thoroughly tested this patch. The new kernel boots fine on my machine and it hasn't crashed and burned (yet), but I do _not_ recommend anyone try it on production machines. Cheers, Paul -- Paul Dwerryhouse | PGP Key ID: Amsterdam, The Netherlands (X) <-> Melbourne, Australia ( ) | 0x6B91B584

1 0

ROOTKIT ?
by MALDENER.de＠t-online.de 07 Nov '03

07 Nov '03

Hallo Linux-Friends, I scanned my own box (my own dynamic IP) when I was online with: netcat -v -z 80.131.118.62 1-65535 p5083763E.dip.t-dialin.net [80.131.118.62] 33352 (?) open p5083763E.dip.t-dialin.net [80.131.118.62] 32769 (filenet-rpc) open p5083763E.dip.t-dialin.net [80.131.118.62] 32768 (filenet-tms) open p5083763E.dip.t-dialin.net [80.131.118.62] 6000 (?) open p5083763E.dip.t-dialin.net [80.131.118.62] 631 (ipp) open p5083763E.dip.t-dialin.net [80.131.118.62] 111 (sunrpc) open p5083763E.dip.t-dialin.net [80.131.118.62] 22 (ssh) open And now I am afraid not be alone on my box !? What could I do now to close the unwanted ports? I took a fresh new /etc/services from www.iana.org/assignments on my system. rose:~ # grep '6000' /etc/services .... x11 6000-6063/tcp X Window System x11 6000-6063/udp X Window System ... rose:~ # But why the port 6000 is not shown by netcat? only a ? Although it is in my /etc/services! Is this port necessary for a local machine, when I dont want X-forwarding? for ipp I have to look how? to deactivate this in cups? What can i do, to find out what is behind 33352 (?) open 32769 (filenet-rpc) open 32768 (filenet-tms) open ____________________________________ The same thing when I was yesterday offline: 46837 (?) open 32769 (filenet-rpc) open 32768 (filenet-tms) open 6000 (x11) open 631 (ipp) open 111 (sunrpc) open 80 (http) open 22 (ssh) open Best Regards and thank you in advance from Mick ; ~ {o} under shock Now I do logout and go to sleep. -- # MfG Michael Maldener + Das beste Linux ist die Pluralitaet aller Linuxica ;)

2 1

please, I want to unsuscribe
by Jhoam Cabrera 06 Nov '03

06 Nov '03

Hello, I was trying to unsuscribe from this list following the instructions from the help mail, but nothing happens, the mailing from the list keep coming... I need to unsubscribe and now I don't know how.. can any of the list managers tell me??? -- Johan Cabrera MATCOM-UH

2 1