February 2003 - openSUSE Security - openSUSE Mailing Lists

Firewall2 and carbon copy problem
by gonzsanz＠teleline.es 03 Feb '03

03 Feb '03

Here is my instalation Public Ip ----> 3 Com 812 (192.168.1.1)-->Linux eth1 (192.168.1.2) Linux eth0 (10.0.0.49) ----> My lan (10.0.0.xxx) My linux is using firewall2 and squid and is running well But now i have a pc (10.0.0.14) with carbon copy My router (3com812) sends all traffic now in port 1650 to 192.168.1.2 (before to 10.0.0.14 port 1650) I want to anibody who connects from port 1650 goes to 10.0.0.14 to carbon copy and i trie FW_FORWARD_MASQ="0/0 10.0.0.14,tcp,1680,1680" and still not working FW_FORWARD="" Please help

1 0

SuSEfirewall2: FW_SERVICES_INT_* settings not working
by Marc Christensen 03 Feb '03

03 Feb '03

Hello, I posted this earlier to SLE but have had no answers at this point... I have a SuSE 8.1 machine with all currently available online updates applied that I am trying to remote-administer. It is on a DSL connection and I am trying to work on it's firewall settings. It's obviously important that in configuring it's firewall, I don't lock myself out... 8^) I have read through the following files a couple times and as I configured each option. However, I think I must have missed something... /usr/share/doc/packages/SuSEfirewall2/EXAMPLES /usr/share/doc/packages/SuSEfirewall2/FAQ /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.conf.EXAMPLE I have a machine with two interfaces, eth0, eth1. eth0 is external, eth1 is masq (192.168.1.0/24). I want to be able to access some specific services running on the external interface from the internal, masqueraded network: FW_SERVICES_INT_TCP="ssh smtp http ntp https imaps pop3s 8080" FW_SERVICES_INT_UDP="ntp" All names are listed in /etc/services on the firewall machine and I have a squid proxy server running on port 8080. After making the changes in /etc/sysconfig/SuSEfirewall2, I restarted the firewall with this command: rcSuSEfirewall2 restart I also tried 'rcSuSEfirewall2 stop' then 'rcSuSEfirewall2 start'. Despite listing services in FW_SERVICES_INT_(TCP|UDP)=, I am still getting denied when trying to access the services from the internal network. Anyone have any ideas? Here is my full config: # cat /etc/sysconfig/SuSEfirewall2 | egrep -v "^[[:space:]]*$|^#" FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="https imaps pop3s smtp ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ssh smtp http ntp https imaps pop3s 8080" FW_SERVICES_INT_UDP="ntp" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option \ --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" Thanks. -- Marc Christensen http://www.mecworks.com http://www.mecworks.com/~marc/resume

3 6

Login Problems
by Richard Ibbotson 03 Feb '03

03 Feb '03

Hi Got a problem with an SuSE 8.1server which is runing in console mode. No X-windows. After running harden_suse I find that I cannot change the password and log back in again. I followed Roman Drahtmueller's advice which appeared on the SuSE security list back on the 9th of October last year.... >Please "touch /etc/rc.config" to work around this. >This is a bug - depending on the selection of packages on your system >it can happen that said file does not exist any more. It slipped >through last time. This worked for me and I was able to run ./harden_suse. However, on re-booting I now find that I can't log back in again. The password is rejected and if I become a user and then try to do 'su root' I find that once again the root password is rejected. Looking in /var/log/messages I see that my login messages which tell me that someone has tried to login reveal this .... "cannot open login.defs [Permission denied]" Anyone suggest a way out of this ? Perhaps I need to remove harden_suse and start again ? -- Thanks Richard www.sheflug.co.uk

4 5

RE: [suse-security] SuSEfirewall2 & Checkpoint software
by Reckhard, Tobias 03 Feb '03

03 Feb '03

> Short story: > Home LAN - SuSEfirewall2 System (SuSE 8.1 via DSL) - internet > - Checkpoint > FW - Companies LAN [snip] > I installed the software, checked the Checkpoint website for > information how > to configure an iptables fw, and I think I did it: the > neccessary ports are > udp 50, udp 51, udp 500 & udp 2746. > So I added the lines: > FW_FORWARD="212.212.212.212/32,192.168.10.100/24,udp,50 > 212.212.212.212/32,192.168.10.100/24,udp,51 \ > 212.212.212.212/32,192.168.10.100/24,udp,500 > 212.212.212.212/32,192.168.10.100/24,udp,2746" > FW_FORWARD_MASQ="212.212.212.212/32,192.168.10.100/24,udp,50 > 212.212.212.212/32,192.168.10.100/24,udp,51 \ > 212.212.212.212/32,192.168.10.100/24,udp,500 > 212.212.212.212/32,192.168.10.100/24,udp,2746" > (In both cases 212.212.212.212 is just a place holder!!! ... > not the real ip > adress.) > > But it does not work ...... no VPN connection is established > between my MS > client and a system on the companies LAN. > When I connect to the internet directly (eg. via an ISDN > dial-up connection) > it works fine. IPSec doesn't like IP Masquerading. IKE can't cope with it and AH fails, too. A hack (IMHO) has been created to solve the problems that the NAT hack (IMHO again) creates for IPSec, called NAT Traversal, which encapsulates IPSec in UDP. You need NAT-aware implementations on both IPSec peers for it to work. I don't know if SecuRemote falls in that category. Cheers, Tobias

1 0

I need vulnerability analysis tool, help me.
by 정정모 02 Feb '03

02 Feb '03

Hello, First, I'm very sorry for my poor English. We are building internet banking system with IBM zSeries and SuSE Linux. But Now, We need internal vulnerability analysis tool such as ISS Internet Scanner, Symantec ESM. But they did not support SuSE Linux for IBM zSeries. Do you know any other commercial vulnerability analysis tool support SuSE linux for zSeries? If any, Please help me with your advice. I'm very sorry for bothering you with this and looking forward to hearing from you soon. With my best wishes for your prosperity. Thank you in advance. --------------------------------------- Jeongl, Jeong-Mo Solution Service LAC Korea, Inc. Tel: +82-2-3444-2355 Fax: +82-2-3444-6945

3 2

ipsec under suse8.1
by Patrick Schelter 02 Feb '03

02 Feb '03

Hi all, i have some problems with my vpn-gateway running with freeswan 1.98b under suse 8.1. When i start ipsec it seems to be work fine. No errors are in /var/log/messages from ipsec, but there is no secured connection running with if ipsec0. No packets are going through this interface. I test it with a ping -p deadbeef and the same pattern will go out through eth1/ipsec0. In another mailing list, i have read, that there is a problem with freeswan under suse 8.1. Whats the problem and what can i do? Best regards Patrick

2 1

SuSEfirewall2 & Checkpoint software
by T. Ermlich 01 Feb '03

01 Feb '03

Hello there, I've got a question, and I found no answer related to this topic - or maybe I'm simply too stupid and didn't get it .... Short story: Home LAN - SuSEfirewall2 System (SuSE 8.1 via DSL) - internet - Checkpoint FW - Companies LAN Long story: Well, my employer has a Checkpoit FW running to protect the companies LAN. We all got so called tokens (looks like an calculator) and some software to be installed on our PCs. The software is called SecuRemote. At home I have a small LAN (one SuSE 8.1 acting as a gateway, 3 MS based clients). I installed the software, checked the Checkpoint website for information how to configure an iptables fw, and I think I did it: the neccessary ports are udp 50, udp 51, udp 500 & udp 2746. So I added the lines: FW_FORWARD="212.212.212.212/32,192.168.10.100/24,udp,50 212.212.212.212/32,192.168.10.100/24,udp,51 \ 212.212.212.212/32,192.168.10.100/24,udp,500 212.212.212.212/32,192.168.10.100/24,udp,2746" FW_FORWARD_MASQ="212.212.212.212/32,192.168.10.100/24,udp,50 212.212.212.212/32,192.168.10.100/24,udp,51 \ 212.212.212.212/32,192.168.10.100/24,udp,500 212.212.212.212/32,192.168.10.100/24,udp,2746" (In both cases 212.212.212.212 is just a place holder!!! ... not the real ip adress.) But it does not work ...... no VPN connection is established between my MS client and a system on the companies LAN. When I connect to the internet directly (eg. via an ISDN dial-up connection) it works fine. Well, one of my thoughts was to modify the MTU/MRU values - but setting them eg. to 1404 didn't solve it. Has anyone around there an idea? Can I use the SuSEfirewall2 for this? Thanks in advance!!!! c y Torsten

2 2

Re: [suse-security] Does "kpackage" do a "checksig" ???
by GarUlbricht7＠netscape.net 01 Feb '03

01 Feb '03

Hi List Does "kpackage" do a "checksig" ??? I normally do my "security updates" via YOU; whereas, rpm package upgrades I downloaded from SuSE (or a SuSE mirror) to a download directory and then install via "kpackage." My question is does anyone know if "kpackage" does a "checksig" on the rpm before installing? (SuSE 8.0 - personal ) I know it checks dependencies but should I do: "rpm --checksig <package name>.rpm" on each rpm ??? Best regards, -- ~Gar __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

2 1