December 2003 - openSUSE Security - openSUSE Mailing Lists

IPSec VPN Client f. Win2k,XP,98,NT
by BLeonhardt＠analytek.de 11 Dec '03

11 Dec '03

Hi all, does anybody know where to find a FREE IPSec VPN Client for Windows ? Free, no commercial software ? cu bruno

2 2

Re: unsubscribe
by bowm9808＠bellsouth.net 11 Dec '03

11 Dec '03

> > From: "Gert Seidl" <ridewiththewind(a)gmx.at> > Date: 2003/12/09 Tue PM 04:47:29 EST > To: suse-security(a)suse.com > Subject: [suse-security] Firewall blocks strange ports > > Hi list, > > on my machine (SuSE 8.1, up-to-date by fou4s) SuSE-Firewall2 blocks > connections to UDP-services 2742 and 8777 (about 20-30 per minute). > > 2742 udp/tcp is named tsb2 in /etc/services, 8777 is not listed. > > Googling showed > - tsb2 for port 2742 > - "thaliana tryptophan synthase beta-subunit" for tsb2 > and > - nothing but phone-numbers for 8777 > > Does anyone know what the hell they are searching for on my machine > ?? > > thx, gert. > > -- > "Es gibt kaum etwas auf der Welt, das nicht irgend jemand etwas > schlechter machen und etwas billiger verkaufen könnte. Die Menschen, > die sich nur am Preis orientieren, werden die gerechte Beute solcher > Machenschaften." (John Ruskin) > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

2 1

Hints for Frees/WAN on SuSEFirewall2-protected systems?
by Mathias Homann 11 Dec '03

11 Dec '03

Hi, i got two suse 8.0 systems. Frees/WAN up and running, as far as i can say. in /var/log/messages i see something that looks like a sucessful handshake, and after that the systems have the proper routing tables. Now, how do i tweak SuSEfirewall2 to make the tunnel actually work? Subnet behind box1: 192.168.238.0/24 Subnet behind box2: 192.168.237.0/24 Connectivity in both cases: eth0 points to internal net, ipsec0 (via pppß which is DSL over eth1) is the tunnel. What do i put where in /etc/sysconfig/SuSEfirewall to make the tunnel work? bye, MH -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt! gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C

4 6

Re: wlan on 8.1 after kernel patch
by Roger Larsson 11 Dec '03

11 Dec '03

On Thursday 11 December 2003 00.18, bill s wrote: > Hi Roger, > > I am emailing you off the list as I am not subscribed > to the mailing list and I hope you dont mind! > > I have the same problem as you did. My wireless > stopped working after the latest kernel path. SuSE people I guess you have to investigate this... > I am running Suse 8.1 Professional The wireless > adapter I have is a PCI card (with Orinoco_pci > driver). I had orinoco_cs (but the orinoco part is common for us) > I had it configured as "eth0" and it was > working just fine > until I installed the latest kernel patch (Kernel > "brk" vulnerability). > I rebooted the system after the patch installation and > the wireless stopped working. The system now seems to > use "wlan0". I can't seem to configure the wireless > card using YAST. > The error message I get when I run "rcnetwork start > wlan0" is something like "No configuration found for > wlan0". > I am wondering what could have gone wrong! > How can I make the wireless (using YAST) work again? > How did you fix the problem? Have not succeeded yet - back to 2.4.19 on a SuSE 9.0 system... > Could you send me the > specific steps you took and scripts the you had to > write and use? > The setup configuration has changed (idea is better but it is broken for 8.1) Use yast to reconfigure your network card. It will create the needed files in /etc/sysconfig/network But - yast assumes the interface to be named eth-something... but when used it will try to find wlan0 - confusing... So I created a link in /etc/sysconfig/network from ifcfg-wlan-* to ifcfg-eth-* (you will find out what exact names to use) It will be very interesting to hear if this makes it work for you. BTW What does "uname -r" return? You can always try to configure everything manually first. As root iwconfig wlan0 ssid ... iwconfig wlan0 mode ... iwconfig wlan0 nick ... iwconfig wlan0 channel ... (or freq) iwconfig wlan0 enc ... iwconfig wlan0 rate ... - - - (and I need) iwpriv wlan0 set_port3 1 Now the card config should be ok, on to ip ifconfig wlan0 xxx.xxx.xxx.xxx up route add default gw ggg.ggg.ggg.ggg When I have done this ping still wont work, but when pinging from another computer I can see that ifconfig wlan0 receives packages but gets error on transmit. I have checked out the source for 8.1 and 9.0 (8.1 with patch is not interesting for me now) There are LOTS of changes in orinoco.c when going from 2.4.20 to 2.4.21 I will try to compile the 2.4.19 version in 2.4.21 - later... /RogerL -- Roger Larsson Skellefteå Sweden

1 0

RE: [suse-security] Hints for Frees/WAN on SuSEFirewall2-protected systems?
by Administrator 10 Dec '03

10 Dec '03

Ok I snipped the following lines from my firewall script. Note that $INGLEWOOD is the address of the remote server. ## the lines below allow incoming traffic from trusted sources. (ie ## $INGLEWOOD, or 10.0.0.0/24 which is the remote subnet) $IPTABLES -A INPUT -m state --state NEW,ESTABLISHED,RELATED -s $INGLEWOOD -j ACCEPT IPTABLES -A INPUT -m state --state NEW,ESTABLISHED,RELATED -s 10.0.0.0/24 -j ACCEPT ## this basically allows outgoing traffic to the trusted remote. I always ## log outgoing traffic that has not been explicitly allowed this way I can ## catch services or apps trying to connect to somewhere they shouldn't be $IPTABLES -A OUTPUT -d $INGLEWOOD -j ACCEPT $IPTABLES -A OUTPUT -d 10.0.0.0/24 -j ACCEPT ## this part is very important. If your firewall is masquerading traffic you ## have to tell it not to masquerade traffic outgoing to yrou VPN $IPTABLES -t nat -A POSTROUTING -o $EXTIF ! -d 10.0.0.0/24 -j SNAT --to $EXTIP If I'm not mistaken SuSEFirewall initializes in three parts the second portian having the actual script. You can add these lines directly or define them by variables that can be changed elsewhere. Me personally I always advocate creating yrou own firewall script this way you can control and understand exactly what it does. Hope this helped > -----Original Message----- > From: Mathias Homann [mailto:admin@eregion.de] > Sent: Wednesday, December 10, 2003 3:12 PM > To: Administrator > Subject: Re: [suse-security] Hints for Frees/WAN on SuSEFirewall2- > protected systems? > > Am Mittwoch, 10. Dezember 2003 23:59 schrieben Sie: > > Hoping I can help I only saw this thread just now. I have two SuSE 8.0 > > systems running both FreeSwan and a firewall. I dont use the > > SuSEFirewall however they are all based on IPTables. If you dont mind > > re-posing your initial question I can try my best to help. > > > Hi, > > > i got two suse 8.0 systems. Frees/WAN up and running, as far as i can say. > in /var/log/messages i see something that looks like a sucessful > handshake, > and after that the systems have the proper routing tables. > Now, how do i tweak SuSEfirewall2 to make the tunnel actually work? > > Subnet behind box1: 192.168.238.0/24 > Subnet behind box2: 192.168.237.0/24 > Connectivity in both cases: eth0 points to internal net, ipsec0 (via pppß > which is DSL over eth1) is the tunnel. > What do i put where in /etc/sysconfig/SuSEfirewall to make the tunnel > work? > > bye, > MH > > -- > Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt > gegen §1 > UWG und 823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). > Jede > kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren > Weitergabe an Dritte ist ausdrücklich untersagt! > > gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C

1 0

k_athlon vs nVidia
by jrx＠telia.com 10 Dec '03

10 Dec '03

Hi list, Should I as a newbie update my k_athlon 2.4.20-38 to the security update offered by YOU 2.4.20-101 kernel before or after running sh NVIDIA-Linux-x86-1.0-1.0-4496-pkg1.run to get my old nVidia Vanta 16MB to work OK and configured with Sax? If I do the kernel update before the nVidia update then the nVidia update don't work. If I do the nVidia update before the kernel update then I can't enable 3D. As I understand it there was a linking problem, and that kind of stuff is beyond my capacity for the moment, but I'm learning fast. Please be as detailed as you can. TIA. /Jari, Stockholm

1 0

[Info] Webmin SuSEfirewall2 Modul
by Philippe Vogel 10 Dec '03

10 Dec '03

Hello! For those, who like webmin: There is a new module to configure SuSEfirewall2 from remote within webmin without any console knowledge. You will find it here: http://www.intraredes.com/projects/ Each button has an online-help with the SuSE-Comments inside the SuSEfirewall2 I think this is a nice way for newbees to configure their firewall. For those who know what they do this is only for information. Philippe

8 7

RE: [suse-security] SuSEfirewall2 Logging Question - WORKING THEORY
by Sturgis, Grant 10 Dec '03

10 Dec '03

Thanks to all for the replies that helped me formulate this working theory. Here it is: This system is a low priority MX record, and thus should not regularly receive inbound mail. Seconds before this FW log entry, there was an inbound mail from the listed address, 211.26.232.31. The spam filters rejected the mail and attempted to bounce it or deny it and some router along the way, 203.134.26.220, sent a source-quench (PROTO=ICMP TYPE=4) which was blocked by SuSEfirewall2 and logged. Any comments or corrections are most welcome. Grant -----Original Message----- From: C. E. Brooks [mailto:charles.brooks@swgsys.com] Sent: Tuesday, December 09, 2003 5:55 PM To: Sturgis, Grant; suse-security(a)suse.com Subject: Re: [suse-security] SuSEfirewall2 Logging Question -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The data in the "[]" is from the IP packet that ICMP is reporting. The brackets are used to distinguish the reported SRC/DST from those of the ICMP packet itself. In this case the type code of "0" means that the report is an "echo reply". That is the normal result of executing "ping". The ICMP messages report SRC/DST IP addresses that are copied from the IP packet that caused the ICMP packet to be generated. See RFC792 at URL http://www.ietf.org/rfc/rfc0792.txt Yours, Charles /ceb\ - From RFC792 : " ... Occasionally a gateway or destination host will communicate with a source host, for example, to report an error in datagram processing. For such purposes this protocol, the Internet Control Message Protocol (ICMP), is used. ICMP, uses the basic support of IP as if it were a higher level protocol, however, ICMP is actually an integral part of IP, and must be implemented by every IP module. ICMP messages are sent in several situations: for example, when a datagram cannot reach its destination, when the gateway does not have the buffering capacity to forward a datagram, and when the gateway can direct the host to send traffic on a shorter route. The Internet Protocol is not designed to be absolutely reliable. The purpose of these control messages is to provide feedback about problems in the communication environment, not to make IP reliable. There are still no guarantees that a datagram will be delivered or a control message will be returned. Some datagrams may still be undelivered without any report of their loss. The higher level protocols that use IP must implement their own reliability procedures if reliable communication is required. The ICMP messages typically report errors in the processing of datagrams. To avoid the infinite regress of messages about messages etc., no ICMP messages are sent about ICMP messages. Also ICMP messages are only sent about errors in handling fragment zero of fragemented datagrams. (Fragment zero has the fragment offeset equal zero). " > I am getting the following logs from a SuSEfirewall2: > > Dec 7 23:01:58 mailserver kernel: SuSE-FW-DROP-ICMP-CRIT IN=eth0 OUT= > MAC=00:b0:d0:c6:12:b5:00:e0:b6:03:dc:f2:08:00 SRC=203.134.26.220 > DST=192.168.100.242 LEN=56 TOS=0x00 PREC=0x00 TTL=245 ID=29751 DF > PROTO=ICMP TYPE=4 CODE=0 [SRC=192.168.100.242 DST=211.26.232.31 LEN=60 > TOS=0x00 PREC=0x00 TTL=53 ID=0 FRAG:64 PROTO=TCP ] Dec 7 23:01:58 > mailserver kernel: SuSE-FW-DROP-ICMP-CRIT IN=eth0 OUT= > MAC=00:b0:d0:c6:12:b5:00:e0:b6:03:dc:f2:08:00 SRC=203.134.26.220 > DST=192.168.100.242 LEN=56 TOS=0x00 PREC=0x00 TTL=245 ID=29755 DF > PROTO=ICMP TYPE=4 CODE=0 [SRC=192.168.100.242 DST=211.26.232.31 LEN=111 > TOS=0x00 PREC=0x00 TTL=53 ID=0 FRAG:64 PROTO=TCP ] Dec 7 23:02:02 > mailserver kernel: SuSE-FW-DROP-ICMP-CRIT IN=eth0 OUT= > MAC=00:b0:d0:c6:12:b5:00:e0:b6:03:dc:f2:08:00 SRC=203.134.26.220 > DST=192.168.100.242 LEN=56 TOS=0x00 PREC=0x00 TTL=245 ID=29843 DF > PROTO=ICMP TYPE=4 CODE=0 [SRC=192.168.100.242 DST=211.26.232.31 LEN=72 > TOS=0x00 PREC=0x00 TTL=53 ID=0 FRAG:64 PROTO=TCP ] > > My questions are: > > Why is the MAC address what appears to be 2 MAC addresses concatenated > together? Why is there SRC and DST inside [] and why are they different > from the other IPs mentioned? This system's IP address is 192.168.100.242, > which appears as the DST in the non-[] text, but is the SRC in the test > inside the []. What gives? > > Any comments are most welcome. > > Grant > -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux) iD8DBQE/1m7yu6hVDKPW4HMRAkh7AJ0Yfv2ENHKc+T7ucb5B1YH4geZuBgCcDcYT a1Kr0H9g10ZwFtgxzm2iKR4= =XhW3 -----END PGP SIGNATURE----- This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

1 0

Re: [suse-security] Trace user logins in SAMBA
by J J 10 Dec '03

10 Dec '03

My knowledge is somewhat sketchy and from Samba 2.2.1a so forgive me if it's no use. My crude understanding is that a login to a domain from a Windows box isn't quite like a unix log in, what you're doing is logging on to the *Windows* box and Windows is asking the unix (samba) domain server whether the user has permission to log on locally. Later the user will probably start to use shared network resources (shared drives, etc.) from the unix box and these requests will then start a "session" (in SMB terminology) from that user on that Windows box to that share - these "sessions" are the things that are easy to see on the STATUS page of SWAT* or using smbstatus. But I doubt that's what you want to see. After all, a user could log on and never use network shared resources in theory. The samba log files (eek! - not sure where they've gone! used to be in /var/lock/samba/log.nmbd think they are now in /var/log/samba/) will record what the smbd daemon is doing so somewhere in there there should be some unique kind of SMB message received that corresponds to a domain logon request. Unfortunately I'm not an SMB protocol expert so I couldn't tell you the exact call! The loglevel parameter increases the amount of logging. At 3 you get a log of stuff, probably more than enough. Remember you'll probably need to restart the smbd daemon to make it pick up the change to the loglevel in smb.conf (YMMV). Good luck! Carl *SWAT, if you haven't used it before, is an invaluable tool. It usually comes as part of the samba package (in the rpm) and will probably already be installed. You may need to modify inetd.conf to get it to run. Basically it listens to HTTP requests on port 901. The upshot of this is that you can administer your samba server remotely using a web browser, see who's using what shares, change configuration, restart the servers, etc. Plus view lots of help online! >From: João Reis <joao.reis(a)2000comp.pt> >To: suse-linux-e(a)suse.com, suse-security(a)suse.com >Subject: [suse-security] Trace user logins in SAMBA >Date: Tue, 04 Nov 2003 10:32:25 +0000 > >Hi to all > >I have read a lot of documentation but i cannot find a way to track user >logins, from a Windows machine, in Samba. >Does the log parameter in the smb.conf file does the job. I have the log >files of the machines present (log.%m) but >they do not register the time when the users login and logout. > >is there a way to register this information? > >Thanks > >-- > \|/ "Do or do not. There is no try" - Yoda \|/ > |==============================================| > | 2000Comp - Consultoria e Informática, Lda | > | Tel: +351 22 941 99 32 | >\|/ | Fax: +351 22 941 99 34 | \|/ > O | www: http://www.2000comp.pt | O >-|--| |--|- >\| | João Reis | |/ >/ \ |==============================================| / \ >========================================================== > > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > _________________________________________________________________ Hotmail messages direct to your mobile phone http://www.msn.co.uk/msnmobile

5 4

Another NAT Question
by BLeonhardt＠analytek.de 10 Dec '03

10 Dec '03

HI all, I'm not sure about the PREROUTING chain .. if I say : iptables -t nat -A PREROUTING -i eth1 -o eth0 -p tcp --dport 80 -j DNAT --to-destination 172.16.15.12:8080 is the real source address present or the source address from the router ? cu bruno

2 1