February 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] MS VPN over SuSefirewall2 (7.3)
by Devenport, Jimmy 09 Feb '03

09 Feb '03

I ran into this same problem using OpenBSD as a firewall also... Don't know why it is so difficult for everyone to behave nicely together. I love Linux/Unix because of the security, reliability, and the "geek" in me says it's cool. But I have to face reality - the majority of the computers out there on the desktop are using Windows. My corporate network uses a Microsoft VPN (not SSH, or anything else that they could have used), and I have DSL at home. So I created a firewall using floppyfw (http://www.zelow.no/floppyfw/) - it works great, easy to set up my DSL connection, NAT, port forwarding was a piece of cake. There on that site they specifically tell you what you need for a MS VPN connection, so just add that to your firewall rules, reboot. Piece of cake! So now I can very easily connect from my internal protected network thru the firewall to our corporate VPN. No problems at all. If you have questions about floppyfw and my setup or firewall rules, e-mail me personally. My floppyfw runs on an old Pentium 133, 24M memory, no hard drive required (I don't care for logging currently - I have other things to do that to watch my logs) - but supposedly you can send syslog to another box inside your firewall also. -----Original Message----- From: Rainer Hofmeister [mailto:rh@webkom.net] Sent: Thursday, February 06, 2003 7:19 AM To: suse-security(a)suse.com Subject: [suse-security] MS VPN over SuSefirewall2 (7.3) Hi, I'm trying to build a VPN tunnel from an internal Win2K machine to a server on the Internet (also MS). We are using a SuSEfirewall2 (SuSE 7.3) to protect our internal Lan. The internal Lan is masqueraded. Is there a way to configure the firewall to allow VPN connections from the Win2K machine? I opened the following ports in FW_MASQ_NETS: 10.0.0.0/24,0/0,tcp,1723 10.0.0.0/24,0/0,udp,1723 10.0.0.0/24,0/0,tcp,47 10.0.0.0/24,0/0,udp,47 10.0.0.0/24,0/0,udp,500 This didn't work. I read somewhere that the communication over port 47 is not tcp or udp but gre. Since I can't set that in SuSEfirewall2 I tried to open up the complete network by using: 10.0.0.0/8 This didn't help, either. Connecting the Win2K machine directly to the ISDN router works so there seems to be no problem with its configuration. Is it possible to configure VPN over SuSEfirewall2 at all? If yes, what am I doing wrong? Best regards, Rainer -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Firewall and vpn
by gonzsanz＠teleline.es 08 Feb '03

08 Feb '03

Now i have a suse firewall2 installed Internet ----> Firewall2 ----> Lan In my lan i have a windows NT with vpn. I Know that i must open port 1723 and protocol 47 in my susefirewall2 to allow comunicate from internet to my server in NT Where can I open these ports in suse firewall2 scripts? and how redirect the traffic), Must i use iP-Tables on my rc-custom?. Help!!!

1 0

MS VPN over SuSefirewall2 (7.3)
by Rainer Hofmeister 08 Feb '03

08 Feb '03

Hi, I'm trying to build a VPN tunnel from an internal Win2K machine to a server on the Internet (also MS). We are using a SuSEfirewall2 (SuSE 7.3) to protect our internal Lan. The internal Lan is masqueraded. Is there a way to configure the firewall to allow VPN connections from the Win2K machine? I opened the following ports in FW_MASQ_NETS: 10.0.0.0/24,0/0,tcp,1723 10.0.0.0/24,0/0,udp,1723 10.0.0.0/24,0/0,tcp,47 10.0.0.0/24,0/0,udp,47 10.0.0.0/24,0/0,udp,500 This didn't work. I read somewhere that the communication over port 47 is not tcp or udp but gre. Since I can't set that in SuSEfirewall2 I tried to open up the complete network by using: 10.0.0.0/8 This didn't help, either. Connecting the Win2K machine directly to the ISDN router works so there seems to be no problem with its configuration. Is it possible to configure VPN over SuSEfirewall2 at all? If yes, what am I doing wrong? Best regards, Rainer

5 4

pam + chroot
by Jacques Weewer 08 Feb '03

08 Feb '03

Hi, I'm expiremnting with PAM at the moment, ans I saw that there was a module for chroot, i've been trying to get ssh-logins chrooted with this, but I can't seem to get it right, is there any solution for this or isn't this possible. Thanks in advance, Jacques

1 0

Re: [suse-security] going nuts with rpm --checksig / gpg, works onsuse 7.3, doesnt work on suse 8.0How do you
by GarUlbricht7＠netscape.net 08 Feb '03

08 Feb '03

Markus Gaugusch <markus(a)gaugusch.at> wrote in reply to Andreas Bittner: ***snip*** > You must import the key into the keyring of the RPM system > export GPGHOME=/usr/lib/rpm/gnupg > ... import the key ... > > If you had done sig checking NOT AS ROOT, it would have worked. > > It's not a bug, it's a feature ... ;) > >Markus > Markus made a similar comment a month or so ago earlier. I have looked at the the man pages for "exports" and "import" as well as searched the help files both on my machine and on SuSE web site, but I still at a loss how to import a new key into the keyring of the RPM system :(( Any help would be appreciated. ~Gar Note: Markus wrote "gpg" rather than "gnupg"above but in a later email said it was a typo, so I changed herein. -- __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

2 1

squid - winbind - wb_group: could not fetch trust account password
by Markus Feilner 08 Feb '03

08 Feb '03

Hello List, I am just using the NTLM Authentication of an AD-Domain with wb_group for Squid. All Users in the group WWW_Benutzer are allowed to surf, others not. I have therefore successfully configured samba to use winbindd and winbind bound to the Domain (via smb.conf). At least it seems so: wbinfo -u gives me all Usernames of the Domain, wbinfo -g the group names. Squid-2.5 (self-compiled with <configure –-enable-auth=“ntlm,basic“ --enable-basic-auth-helpers=“winbind“ --enable-ntlm-auth-helpers=“winbind“>) starts without errors, with a squid.conf where, following the readme.txt from .../squid.../helpers/external_auth/winbind_group/ an acl and more is defined for the WWW_Benutzer O.K, but it doesn't work: I always get the error: ----------- Feb 7 19:35:15 netapp01 winbindd[762]: [2003/02/07 19:35:15, 0] nsswitch/winbindd_pam.c:winbindd_pam_auth_crap(181) Feb 7 19:35:15 netapp01 winbindd[762]: winbindd_pam_auth: could not fetch trust account password for domain R-ERMER ------------ in my /var/log/messages, when an authorized User (of the group WWW_Benutzer) wants to access the proxy, and he won't be allowed to log in. Besides that, wbinfo -t tells me, " Secret is bad" Does that have anything to do with the error above? Thanks a lot! -- Mit freundlichen Grüßen Markus Feilner May you always grok in fullness! Beachten Sie bitte unsere neue Email-Adresse! ------------------------------------------------------------------------------------------------- Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

2 1

SuSEFirewall2 and SQUID and LOTS of help needed :)
by Ash Corbin 08 Feb '03

08 Feb '03

Hello all, I am in search of "desperately" for help with configuring my SuSEfirewall2 on 8.1 Pro and Squid with a few windows 2000 and Xp pro machines. present configuration SuSE 8.1 no DNS (ips provides dns), no DHCP server or clients, FTPd, SSH, http&https, in the future... SQUID and SAMBA I use a broadband connection -> Linksys BEFSX41 (vpn endpoint router which accepts its Wan IP via DHCP C.C.C.C/255.255.255.0, internal Static IP 10.x.x.A/255.255.255.0) -> Linux pro 8.1 [eth0 Static IP 10.x.x.B/255.255.255.0, eth1 Static IP 10.x.x.C/255.255.255.0] , Win Xp Pro Static IP 10.x.x.D/255.255.255.0, and Win2k Pro Static IP 10.x.x.E/255.255.255.0 It works fine and I use personal software firewalls for the Windows machines. My hopes are to set up the network like this..... Broadband connection -> Linksys BEFSX41 Wan DHCP, INT IP Static -> [Eth0] Linux Firewall-2 & Squid proxy [eth1] -> Hub {or better yet internal print server box w/hub in it} -> Windows machines with Static IPs. I have been reading the susefirewall2 examples and a great "unofficial faq" SuSE Firewall2 by Togan Muftoglu. First and foremost I am NEW to configuring firewalls. Second I should pick it up quickly if I can make heads or tails of what combination of rules to use together. Second I would like to just get the firewall up and running with windows clients connecting through it WITHOUT THE PROXY that I can work out later. 1.) FW_Quickmode_"no" 2.) FW_DEV_EXT="eth0" 3.) FW_DDEV_INT="eth1" 4.) FW_DEV_DMZ="" This is where I get a bit lost if I should or not set these switches/options 5.) FW_ROUTE="no" I should set this to YES until I get my proxy going? 6.) FW_MASQUERADE="no" I should set this to YES until I get my proxy going, then set it back to NO 6a.) FW_MASQ_DEV="eth0" or "$FW_DEV_EXT" 6b.) FW_MASQ_NETS="" This I want to restrict to only the services I use, WWW, FTP, SSH, SC, receive email via POP3, send email via SMTP, (a few games Starcraft, CounterStrike but these are to important) my internal IPs are 10.x.x.x/255.255.255.0, there are 3 machines, 2 workstations and 1 laptop. 7.) FW_PROTECT_FROM_INTERNAL="yes" Is this similar to FW_MASQ_NETS? 8.) FW_AUTOPROTECT_SERVICES="yes" So with this set to YES then I have to add the IP/net/protocol/port# and these need to be set in FW_SERVICES_EXT_TCP,UDP & FW_SERVICES_INT_TCP,UDP ? But that about an entry FW_SERVICE_*_TCP,UDP...? 9.) FW_SERVICES_EXT_TCP="www ssh" but what about SSL and FTP? 9.) FW_SERVICES_EXT_UDP="" 9.) FW_SERVICES_INT_TCP="" 9.) FW_SERVICES_INT_UDP="" 9a.) FW_SERVICES_QUICK_TCP="" 9a.) FW_SERVICES_QUICK_UDP="" 9a.) FW_SERVICES_QUICK_IP="" 10.) FW_TRUSTED_NETS="" 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" can I specify the port #s in here? 11.) FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" Is this required for DNS for the internal network machines? 12.) FW_SERVICE_AUTOPROTECT="yes" 12.) FW_SERVICE_DNS="no" 12.) FW_SERVICE_DHCLIENT='no" 12.) FW_SERVICE_DHCPD="no" 12.) FW_SERVICE_SQUID="no" Soon I hope to configure SQUID but I need to buy a book or read a lot more online. 12.) FW_SERVICE_SAMBA="no" 13.) FW_FORWARD="" 14.) FW_FORWARD_MASQ="" 15.) FW_REDIRECT="" This I should setup for SQUID? 10.x.x.x/y,0/0,tcp,80,3128 0/0, 10.x.x.a,tcp,80,8080 16.) FW_LOG_DROP_CRIT="yes" 16.) FW_LOG_DROP_ALL="no" 16.) FW_LOG_ACCEPT_CRIT=yes" 16.) FW_LOG_ACCEPT_ALL="no" 16.) FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" 17.) FW_KERNEL_SECURITY="yes" 18.) FW_STOP_KEEP_ROUTING_STATE="no" 19.) FW_ALLOW_PING_FW="yes" 19.) FW_ALLOW_PING_DMZ="no" 19.) FW_ALLOW_PING_EXT="no" 20.) FW_ALLOW_TRACEROUTE="no" 21.) FW_ALLOW_SOURCEQUELCH="yes" 22.) FW_ALLOW_FW_BROADCASTS="no" 22.) FW_IGNORE_FW_BROADCASTS="yes" 23.) FW_ALLOW_CLASS_ROUTING="no" 25.) FW_CUSTOMRULES="" 26.) FW_REJECT="no" So if anyone has some time to help me out I would be greatly appreciative and send you all the good karma I can muster :) If anyone can recommend any books that I should pick up that may help me understand these rules that would be great also. Sincerely, Ash

2 1

kmail 1.5 and s/MIME
by Mathias Homann 07 Feb '03

07 Feb '03

Hi, did someone here get the s/MIME support for kmail 1.5 to work? especially compiling all the needed libraries (see http://kmail.kde.org/kmail-pgpmime-howto.html) gives me headaches, libgcrypt refuses to compile on a SuSE 8.0 with errors concerning ld :( any hints? bye, [MH] -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und §823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt!

1 0

going nuts with rpm --checksig / gpg, works on suse 7.3, doesnt work on suse 8.0
by Andreas Bittner 07 Feb '03

07 Feb '03

hi all, gpg / rpm --checksig are driving me crazy.... i have two systems... suse 7.3 the one, suse 8.0 the other... i have downloaded to both systems the latest webmin 1.060 webmin-1.060-1.noarch.rpm, and they gpg/pgp key from the author http://switch.dl.sourceforge.net/sourceforge/webadmin/webmin-1.060-1.noarch… http://www.webmin.com/jcameron-key.asc the problem is, the one system gives me errors when rpm --checksig webmin-1.060-1.noarch.rpm the other system works fine... both have gpg installed and i have imported the public key of the webmin author... i dont see any difference... see here: the correctly working system (suse 7.3) # gpg --list-keys -v /root/.gnupg/pubring.gpg ------------------------ gpg: NOTE: signature key 9C800ACA expired Sat Oct 19 15:17:53 2002 CEST pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> gpg: NOTE: signature key 9C800ACA expired Sat Oct 19 15:17:53 2002 CEST sig 9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> sub 2048g/8495160C 2000-10-19 [expires: 2002-10-19] sig 9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> pub 1024D/11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> sig 11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> sub 1024g/1B24BE83 2002-02-28 sig 11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> --------------- then rpm: # rpm --checksig webmin-1.060-1.noarch.rpm -v webmin-1.060-1.noarch.rpm: MD5 sum OK: 547eb528952c96eec64ae3910e9c5aa5 gpg: Signature made Wed Feb 5 00:48:41 2003 CET using DSA key ID 11F63C51 gpg: Good signature from "Jamie Cameron <jcameron(a)webmin.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. gpg: Fingerprint: 1719 003A CE3E 5A41 E2DE 70DF D97A 3AE9 11F6 3C51 everything fine here, signature's been correctly checked on the suse 7.3 system... ------------------------------------------------------------------------- ------------------------------------------------------------------------- now in contrast the suse 8.0 system: # gpg --list-keys -v /root/.gnupg/pubring.gpg ------------------------ pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> sig B1CA3C45 1999-03-06 [User id not found] sig 3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> sig 000AABA4 2001-06-06 [User id not found] sig CEFC9215 1999-08-15 [User id not found] sig B0DFF780 2000-11-21 [User id not found] pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> sig 9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> sig 000AABA4 2001-01-25 [User id not found] sig 3D25D3D9 2001-01-25 SuSE Security Team <security(a)suse.de> sig 9C800ACA 2002-02-13 SuSE Package Signing Key <build(a)suse.de> sub 2048g/8495160C 2000-10-19 [expires: 2006-02-12] sig 9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> sig 9C800ACA 2002-02-13 SuSE Package Signing Key <build(a)suse.de> pub 1024D/AFB66D7C 2002-04-28 fou4s build key <fou4s(a)gaugusch.at> sig AFB66D7C 2002-04-28 fou4s build key <fou4s(a)gaugusch.at> sub 1024g/8B6432D7 2002-04-28 sig AFB66D7C 2002-04-28 fou4s build key <fou4s(a)gaugusch.at> pub 1024D/11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> sig 11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> sub 1024g/1B24BE83 2002-02-28 sig 11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> ------------- now the rpm output: rpm -v --checksig webmin-1.060-1.noarch.rpm webmin-1.060-1.noarch.rpm: MD5 sum OK: 547eb528952c96eec64ae3910e9c5aa5 gpg: Signature made Wed Feb 5 00:48:41 2003 CET using DSA key ID 11F63C51 gpg: Can't check signature: public key not found ---------------- jeez... am i stupid or not seeing the problem here? what the heck.... the pub key of jcameron(a)webmin.com is there on both systems... so what the heck is wrong here??? the md5 hash key is the very same on both systems, so the downloaded files are exactly the same... so why the heck cant suse 8.0 verify the file then???? can anyone help?? thanks and regards, andy

2 3

[mpcfir1] How to configure forwarding in suse 8.0 ?
by Marc Chassoulier 07 Feb '03

07 Feb '03

Hello I'm neebees in firewall security. I Have configured my firewall with yast2 all works fine but now I must configure 1 port of a workstation to be access from the net. it's urgent and I ddidn't now how to do this. Anyone can help me? My port is 4899, my internet port is eth1 and my local port is eth0, my workstation adress is 10.0.0.59 Where can I put this (in wich file), what command line I must run after, Is the Yast configurator work after this? Thanks for your answers marc

2 1

SuSEfirewall2 DNat
by Andreas Roth 07 Feb '03

07 Feb '03

Hello, I have a problem, which, at first look is handled by the FAQ, but the answer there ist for Kernel 2.2 The Situation is like this. I have a externel, fixed ip (193.254.21.55 @ eth0), (internal 192.168.2.1 @ eth1)and i am masqerading (nat) the lan (192.168.2/24) wich was my basic need and wich was easy to enable with SuSE 8.0 and SuSEFirewall2 (assistant). There is a W2k system with behind the firewall (192.168.2.2) for which i want to set a destination nat. Below I included my configuration files, with whom I did several tries, but nothing worked. Now to see is the version, wich should work as the comments in /etc/sysconfig/SuSEfirewall2 suggest. It didn't worked, so I took the FW_FORWARD_MASQ="0/0,192.168.2.2,80" To FW_REDIRECT, It didn't work, so I tried to do costum iptables seen below, it didn't work, so i tried arround with the Ports in FW_SERVICES_EXT_TCP. Now I don't knowany further , where I have to set something strait to get it to work. Does anyone have any suggestions? Greetings, Andreas # Copyright (c) 2001 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Marc Heuse <marc(a)suse.de>, 2001 # Please contact me directly if you find bugs. # # If you have problems getting this tool configures, please read this file # carefuly and tTitel bitte Einfügenake also a look into # -> /usr/share/doc/packages/SuSEfirewall2/EXAMPLES ! # -> /usr/share/doc/packages/SuSEfirewall2/FAQ ! # -> /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.conf.EXAMPLE ! # # /etc/sysconfig/SuSEfirewall2 # # for use with /sbin/SuSEfirewall2 version 2.1 which is for 2.4 kernels! # # ------------------------------------------------------------------------ # # PLEASE NOTE THE FOLLOWING: # # Just by configuring these settings and using the SuSEfirewall2 you are # not secure per se! There is *not* such a thing you install and hence you # are safed from all (security) hazards. # # To ensure your security, you need also: # # * Secure all services you are offering to untrusted networks (internet) # You can do this by using software which has been designed with # security in mind (like postfix, apop3d, ssh), setting these up without # misconfiguration and praying, that they have got really no holes. # SuSEcompartment can help in most circumstances to reduce the risk. # * Do not run untrusted software. (philosophical question, can you trust # SuSE or any other software distributor?) # * Harden your server(s) with the harden_suse package/script # * Recompile your kernel with the openwall-linux kernel patch # (former secure-linux patch, from Solar Designer) www.openwall.com # * Check the security of your server(s) regulary # * If you are using this server as a firewall/bastion host to the internet # for an internal network, try to run proxy services for everything and # disable routing on this machine. # * If you run DNS on the firewall: disable untrusted zone transfers and # either don't allow access to it from the internet or run it split-brained. # # Good luck! # # Yours, # SuSE Security Team # # ------------------------------------------------------------------------ # # Configuration HELP: # # If you have got any problems configuring this file, take a look at # /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example. # # # All types have to set enable SuSEfirewall2 in the runlevel editor # # If you are a end-user who is NOT connected to two networks (read: you have # got a single user system and are using a dialup to the internet) you just # have to configure (all other settings are OK): 2) and maybe 9). # # If this server is a firewall, which should act like a proxy (no direct # routing between both networks), or you are an end-user connected to the # internet and to an internal network, you have to setup your proxys and # reconfigure (all other settings are OK): 2), 3), 9) and maybe 7), 11), 14) # # If this server is a firewall, and should do routing/masquerading between # the untrusted and the trusted network, you have to reconfigure (all other # settings are OK): 2), 3), 5), 6), 9), and maybe 7), 10), 11), 12), 13), # 14), 20) # # If you want to run a DMZ in either of the above three standard setups, you # just have to configure *additionally* 4), 9), 12), 13), 17), 19). # # If you know what you are doing, you may also change 8), 11), 15), 16) # and the expert options 19), 20), 21), 22) and 23) at the far end, but you # should NOT. # # If you use diald or ISDN autodialing, you might want to set 17). # # To get programs like traceroutes to your firewall to work is a bit tricky, # you have to set the following options to "yes" : 11 (UDP only), 18 and 19. # # Please note that if you use service names, that they exist in /etc/services. # There is no service "dns", it's called "domain"; email is called "smtp" etc. # # *Any* routing between interfaces except masquerading requires to set FW_ROUTE # to "yes" and use FW_FORWARD or FW_ALLOW_CLASS_ROUTING ! # # If you just want to do masquerading without filtering, ignore this script # and run this line (exchange "ippp0" "ppp0" if you use a modem, not isdn): # iptables -A POSTROUTING -t nat -j MASQUERADE -o ippp0 # echo 1 > /proc/sys/net/ipv4/ip_forward # and additionally the following lines to get at least a minimum of security: # iptables -A INPUT -j DROP -m state --state NEW,INVALID -i ippp0 # iptables -A FORWARD -j DROP -m state --state NEW,INVALID -i ippp0 # ------------------------------------------------------------------------ # # 1.) # Should the Firewall be started? # # This setting is done via the links in the /etc/init.d/rc?.d runlevel # directories, which can be tweaked with a runlevel editor (or manually) # # 2.) # Which is the interface that points to the internet/untrusted networks? # # Enter all the network devices here which are untrusted. # # Choice: any number of devices, seperated by a space # e.g. "eth0", "ippp0 ippp1 eth0:1" # FW_DEV_EXT="eth0" # # 3.) # Which is the interface that points to the internal network? # # Enter all the network devices here which are trusted. # If you are not connected to a trusted network (e.g. you have just a # dialup) leave this empty. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1 eth1:1" or "" # FW_DEV_INT="eth1" # # 4.) # Which is the interface that points to the dmz or dialup network? # # Enter all the network devices here which point to the dmz/dialups. # A "dmz" is a special, seperated network, which is only connected to the # firewall, and should be reachable from the internet to provide services, # e.g. WWW, Mail, etc. and hence are at risk from attacks. # See /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example. # # Special note: You have to configure FW_FORWARD to define the services # which should be available to the internet and set FW_ROUTE to yes. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1 eth1:1" or "" # FW_DEV_DMZ="" # # 5.) # Should routing between the internet, dmz and internal network be activated? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ # # You need only set this to yes, if you either want to masquerade internal # machines or allow access to the dmz (or internal machines, but this is not # a good idea). This option supersedes IP_FORWARD from # /etc/sysconfig/network/options # # Setting this option one alone doesn't do anything. Either activate # massquerading with FW_MASQUERADE below if you want to masquerade your # internal network to the internet, or configure FW_FORWARD to define # what is allowed to be forwarded! # # Choice: "yes" or "no", defaults to "no" # FW_ROUTE="yes" #FW_ROUTE ="no" # # 6.) # Do you want to masquerade internal networks to the outside? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ, FW_ROUTE # # "Masquerading" means that all your internal machines which use services on # the internet seem to come from your firewall. # Please note that it is more secure to communicate via proxies to the # internet than masquerading. This option is required for FW_MASQ_NETS and # FW_FORWARD_MASQ. # # Choice: "yes" or "no", defaults to "no" # FW_MASQUERADE="yes" # # You must also define on which interface(s) to masquerade on. This is # normally your external device(s) to the internet. # Most users can leave the default below. # # e.g. "ippp0" or "$FW_DEV_EXT" FW_MASQ_DEV="$FW_DEV_EXT" # # Which internal computers/networks are allowed to access the internet # directly (not via proxys on the firewall)? # Only these networks will be allowed access and will be masqueraded! # # Choice: leave empty or any number of hosts/networks seperated by a space. # Every host/network may get a list of allowed services, otherwise everything # is allowed. A target network, protocol and service is appended by a comma to # the host/network. e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with # unrestricted access. "10.0.1.0/24,0/0,tcp,80 10.0.1.0/24,0/0tcp,21" allows # the 10.0.1.0 network to use www/ftp to the internet. # "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too. # Set this variable to "0/0" to allow unrestricted access to the internet. # FW_MASQ_NETS="192.168.2.0/24" # # 7.) # Do you want to protect the firewall from the internal network? # REQUIRES: FW_DEV_INT # # If you set this to "yes", internal machines may only access services on # the machine you explicitly allow. They will be also affected from the # FW_AUTOPROTECT_SERVICES option. # If you set this to "no", any user can connect (and attack) any service on # the firewall. # # Choice: "yes" or "no", defaults to "yes" # # "yes" is a good choice FW_PROTECT_FROM_INTERNAL="no" # # 8.) # Do you want to autoprotect all running network services on the firewall? # # If set to "yes", all network access to services TCP and UDP on this machine # will be prevented (except to those which you explicitly allow, see below: # FW_SERVICES_{EXT,DMZ,INT}_{TCP,UDP}) # # Choice: "yes" or "no", defaults to "yes" # FW_AUTOPROTECT_SERVICES="no" # # 9.) # Which services ON THE FIREWALL should be accessible from either the internet # (or other untrusted networks), the dmz or internal (trusted networks)? # (see no.13 & 14 if you want to route traffic through the firewall) XXX # # Enter all ports or known portnames below, seperated by a space. # TCP services (e.g. SMTP, WWW) must be set in FW_SERVICES_*_TCP, and # UDP services (e.g. syslog) must be set in FW_SERVICES_*_UDP. # e.g. if a webserver on the firewall should be accessible from the internet: # FW_SERVICES_EXT_TCP="www" # e.g. if the firewall should receive syslog messages from the dmz: # FW_SERVICES_DMZ_UDP="syslog" # For IP protocols (like GRE for PPTP, or OSPF for routing) you need to set # FW_SERVICES_*_IP with the protocol name or number (see /etc/protocols) # # Choice: leave empty or any number of ports, known portnames (from # /etc/services) and port ranges seperated by a space. Port ranges are # written like this: allow port 1 to 10 -> "1:10" # e.g. "", "smtp", "123 514", "3200:3299", "ftp 22 telnet 512:514" # For FW_SERVICES_*_IP enter the protocol name (like "igmp") or number ("2") # # Common: smtp domain FW_SERVICES_EXT_TCP="https imap ssh" # Common: domain FW_SERVICES_EXT_UDP="" # Common: domain # For VPN/Routing which END at the firewall!! FW_SERVICES_EXT_IP="" # # Common: smtp domain FW_SERVICES_DMZ_TCP="" # Common: domain FW_SERVICES_DMZ_UDP="" # For VPN/Routing which END at the firewall!! FW_SERVICES_DMZ_IP="" # # Common: ssh smtp domain FW_SERVICES_INT_TCP="" # Common: domain syslog FW_SERVICES_INT_UDP="" # For VPN/Routing which END at the firewall!! FW_SERVICES_INT_IP="" # # 10.) # Which services should be accessible from trusted hosts/nets? # # Define trusted hosts/networks (doesnt matter if they are internal or # external) and the TCP and/or UDP services they are allowed to use. # Please note that a trusted host/net is *not* allowed to ping the firewall # until you set it to allow also icmp! # # Choice: leave FW_TRUSTED_NETS empty or any number of computers and/or # networks, seperated by a space. e.g. "172.20.1.1 172.20.0.0/16" # Optional, enter a protocol after a comma, e.g. "1.1.1.1,icmp" # Optional, enter a port after a protocol, e.g. "2.2.2.2,tcp,22" # FW_TRUSTED_NETS="" # # 11.) # How is access allowed to high (unpriviliged [above 1023]) ports? # # You may either allow everyone from anyport access to your highports ("yes"), # disallow anyone ("no"), anyone who comes from a defined port (portnumber or # known portname) [note that this is easy to circumvent!], or just your # defined nameservers ("DNS"). # Note that you can't use rpc requests (e.g. rpcinfo, showmount) as root # from a firewall using this script (well, you can if you include range # 600:1023 in FW_SERVICES_EXT_UDP ...). # Please note that with v2.1 "yes" is not mandatory for active FTP from # the firewall anymore. # # Choice: "yes", "no", "DNS", portnumber or known portname, defaults to "no" # if not set # # Common: "ftp-data", better is "yes" to be sure that everything else works :-( FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" # Common: "DNS" or "domain ntp", better is "yes" to be sure ... FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" # # 12.) # Are you running some of the services below? # They need special attention - otherwise they wont work! # # Set services you are running to "yes", all others to "no", defaults to "no" # if not set. # FW_SERVICE_AUTODETECT="yes" # Autodetect the services below when starting # # If you are running bind/named set to yes. Remember that you have to open # port 53 (or "domain") as udp/tcp to allow incoming queries. # Also FW_ALLOW_INCOMING_HIGHPORTS_UDP needs to be "yes" FW_SERVICE_DNS="no" # # if you use dhclient to get an ip address you have to set this to "yes" ! FW_SERVICE_DHCLIENT="no" # # set to "yes" if this server is a DHCP server FW_SERVICE_DHCPD="no" # # set to "yes" if this server is running squid. You still have to open the # tcp port 3128 to allow remote access to the squid proxy service. FW_SERVICE_SQUID="no" # # set to "yes" if this server is running a samba server. You still have to open # the tcp port 139 to allow remote access to SAMBA. FW_SERVICE_SAMBA="no" # # 13.) # Which services accessed from the internet should be allowed to the # dmz (or internal network - if it is not masqueraded)? # REQUIRES: FW_ROUTE # # With this option you may allow access to e.g. your mailserver. The # machines must have valid, non-private, IP addresses which were assigned to # you by your ISP. This opens a direct link to your network, so only use # this option for access to your dmz!!!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forwarding rules, seperated each by a space. # A forwarding rule consists of 1) source IP/net and 2) destination IP # seperated by a comma. e.g. "1.1.1.1,2.2.2.2 3.3.3.3/16,4.4.4.4/24" # Optional is a protocol, seperated by a comma, e.g. "5.5.5.5,6.6.6.6,igmp" # Optional is a port after the protocol with a comma, e.g. "0/0,0/0,udp,514" # FW_FORWARD="" # Beware to use this! # # 14.) # Which services accessed from the internet should be allowed to masqueraded # servers (on the internal network or dmz)? # REQUIRES: FW_ROUTE # # With this option you may allow access to e.g. your mailserver. The # machines must be in a masqueraded segment and may not have public IP addesses! # Hint: if FW_DEV_MASQ is set to the external interface you have to set # FW_FORWARD from internal to DMZ for the service as well to allow access # from internal! # # Please note that this should *not* be used for security reasons! You are # opening a hole to your precious internal network. If e.g. the webserver there # is compromised - your full internal network is compromised!! # # Choice: leave empty (good choice!) or use the following explained syntax # of forward masquerade rules, seperated each by a space. # A forward masquerade rule consists of 1) source IP/net, 2) destination IP # (dmz/intern), 3) a protocol (tcp/udp only!) and 4) destination port, # seperated by a comma (","), e.g. "4.0.0.0/8,1.1.1.1,tcp,80" # Optional is a port after the destination port, to redirect the request to # a different destination port on the destination IP, e.g. # "4.0.0.0/8,1.1.1.1,tcp,80,81" # FW_FORWARD_MASQ="0/0,192.168.2.2,80" # Beware to use this! # # 15.) # Which accesses to services should be redirected to a localport on the # firewall machine? # # This can be used to force all internal users to surf via your squid proxy, # or transparently redirect incoming webtraffic to a secure webserver. # # Choice: leave empty or use the following explained syntax of redirecting # rules, seperated by a space. # A redirecting rule consists of 1) source IP/net, 2) destination IP/net, # 3) protocol (tcp or udp) 3) original destination port and 4) local port to # redirect the traffic to, seperated by a colon. e.g.: # "10.0.0.0/8,0/0,tcp,80,3128 0/0,172.20.1.1,tcp,80,8080" # FW_REDIRECT="" # # 16.) # Which logging level should be enforced? # You can define to log packets which were accepted or denied. # You can also the set log level, the critical stuff or everything. # Note that logging *_ALL is only for debugging purpose ... # # Choice: "yes" or "no", FW_LOG_*_CRIT defaults to "yes", # FW_LOG_*_ALL defaults to "no" # FW_LOG_DROP_CRIT="yes" # FW_LOG_DROP_ALL="no" # FW_LOG_ACCEPT_CRIT="yes" # FW_LOG_ACCEPT_ALL="no" # # only change/activate this if you know what you are doing! FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" # # 17.) # Do you want to enable additional kernel TCP/IP security features? # If set to yes, some obscure kernel options are set. # (icmp_ignore_bogus_error_responses, icmp_echoreply_rate, # icmp_destunreach_rate, icmp_paramprob_rate, icmp_timeexeed_rate, # ip_local_port_range, log_martians, mc_forwarding, mc_forwarding, # rp_filter, routing flush) # Tip: Set this to "no" until you have verified that you have got a # configuration which works for you. Then set this to "yes" and keep it # if everything still works. (It should!) ;-) # # Choice: "yes" or "no", defaults to "yes" # FW_KERNEL_SECURITY="yes" # # 18.) # Keep the routing set on, if the firewall rules are unloaded? # REQUIRES: FW_ROUTE # # If you are using diald, or automatic dialing via ISDN, if packets need # to be sent to the internet, you need to turn this on. The script will then # not turn off routing and masquerading when stopped. # You *might* also need this if you have got a DMZ. # Please note that this is *insecure*! If you unload the rules, but are still # connected, you might your internal network open to attacks! # The better solution is to remove "/sbin/SuSEfirewall2 stop" or # "/sbin/init.d/firewall stop" from the ip-down script! # # # Choices "yes" or "no", defaults to "no" # FW_STOP_KEEP_ROUTING_STATE="no" # # 19.) # Allow (or don't) ICMP echo pings on either the firewall or the dmz from # the internet? The internet option is for allowing the DMZ and the internal # network to ping the internet. # REQUIRES: FW_ROUTE for FW_ALLOW_PING_DMZ and FW_ALLOW_PING_EXT # # Choice: "yes" or "no", defaults to "no" if not set # FW_ALLOW_PING_FW="yes" # FW_ALLOW_PING_DMZ="yes" # FW_ALLOW_PING_EXT="yes" ## # END of rc.firewall ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # # # 20.) # Allow (or don't) ICMP time-to-live-exceeded to be send from your firewall. # This is used for traceroutes to your firewall (or traceroute like tools). # # Please note that the unix traceroute only works if you say "yes" to # FW_ALLOW_INCOMING_HIGHPORTS_UDP, and windows traceroutes only if you say # additionally "yes" to FW_ALLOW_PING_FW # # Choice: "yes" or "no", defaults to "no" if not set. # FW_ALLOW_FW_TRACEROUTE="yes" # # 21.) # Allow ICMP sourcequench from your ISP? # # If set to yes, the firewall will notice when connection is choking, however # this opens yourself to a denial of service attack. Choose your poison. # # Choice: "yes" or "no", defaults to "yes" # FW_ALLOW_FW_SOURCEQUENCH="yes" # # 22.) # Allow/Ignore IP Broadcasts? # # If set to yes, the firewall will not filter broadcasts by default. # This is needed e.g. for Netbios/Samba, RIP, OSPF where the broadcast # option is used. # If you do not want to allow them however ignore the annoying log entries, # set FW_IGNORE_FW_BROADCAST to yes. # # Choice: "yes" or "no", defaults to "no" if not set. # FW_ALLOW_FW_BROADCAST="no" # FW_IGNORE_FW_BROADCAST="yes" # # 23.) # Allow same class routing per default? # REQUIRES: FW_ROUTE # # Do you want to allow routing between interfaces of the same class # (e.g. between all internet interfaces, or all internal network interfaces) # be default (so without the need setting up FW_FORWARD definitions)? # # Choice: "yes" or "no", defaults to "no" # FW_ALLOW_CLASS_ROUTING="no" # # 25.) # Do you want to load customary rules from a file? # # This is really an expert option. NO HELP WILL BE GIVEN FOR THIS! # READ THE EXAMPLE CUSTOMARY FILE AT /etc/sysconfig/scripts/SuSEfirewall2-custom # #FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-weiterleitung" # Copyright (c) 2001 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Authors: Marc Heuse <marc(a)suse.de>, # Volker Kuhlmann <kuhlmav(a)elec.canterbury.ac.nz> # # /etc/sysconfig/scripts/SuSEfirewall2-custom # # ------------------------------------------------------------------------ # # This is file is for SuSEfirewall2 and is an example for using # the hooks which are supplied to load customized ipchains rules. # # THERE IS NO HELP FOR USING HOOKS EXCEPT THIS FILE ! SO READ CAREFULLY ! # IT IS USEFUL TO CROSS-READ /sbin/SuSEfirewall2 TO SEE HOW HOOKS WORK ! # # ------------------------------------------------------------------------ fw_custom_before_antispoofing() { # these rules will be loaded before any anti spoofing rules will be # loaded. Effectively the only filter lists already effective are # 1) allow any traffic via the loopback interface, 2) allow DHCP stuff, # 3) allow SAMBA stuff [2 and 3 only if FW_SERVICE_... are set to "yes"] # You can use this hook to prevent logging of uninteresting broadcast # packets or to allow certain packet through the anti-spoofing mechanism. #example: allow incoming multicast packets for any routing protocol #iptables -A INPUT -j ACCEPT -d 224.0.0.0/24 true } fw_custom_before_port_handling() { # could also be named "after_antispoofing()" # these rules will be loaded after the anti-spoofing and icmp handling # but before any IP protocol or TCP/UDP port allow/protection rules # will be set. # You can use this hook to allow/deny certain IP protocols or TCP/UDP # ports before the SuSEfirewall2 generated rules are hit. #example: always filter backorifice/netbus trojan connect requests and log them. #for target in LOG DROP; do # for chain in input_ext input_dmz input_int forward_int forward_ext forward_dmz; do # iptables -A $chain -j $target -p tcp --dport 31337 # iptables -A $chain -j $target -p udp --dport 31337 # iptables -A $chain -j $target -p tcp --dport 12345:12346 # iptables -A $chain -j $target -p udp --dport 12345:12346 # done #done true } fw_custom_before_masq() { # could also be named "after_port_handling()" # these rules will be loaded after the IP protocol and TCP/UDP port # handling, but before any IP forwarding (routing), masquerading # will be done. # NOTE: reverse masquerading is before directly after # fw_custom_before_port_handling !!!! # You can use this hook to ... hmmm ... I'm sure you'll find a use for # this ... true } fw_custom_before_denyall() { # could also be named "after_forwardmasq()" # these are the rules to be loaded after IP forwarding and masquerading # but before the logging and deny all section is set by SuSEfirewall2. # You can use this hook to prevent the logging of annoying packets. #example: prevent logging of talk requests from anywhere #for chain in input_ext input_dmz input_int forward_int forward_ext forward_dmz; do # iptables -A $chain -j DENY -p udp --dport 517:518 #done iptables -t nat -A PREROUTING -i eth0 -p tcp \--sport 1024:65535 -d 193.254.21.55 --dport 80 \-j DNAT --to-destination 192.168.2.2 iptables -A FORWARD -i eth0 -o eth1 -p tcp \--sport 1024:65535 -d 192.168.2.2 --dport 80 \-m state --state NEW -j ACCEPT iptables -A FORWARD -i eth1 -o eth0 \-m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i eth0 -o eth1 \-m state --state ESTABLISHED,RELATED -j ACCEPT true }

1 0

RE: [suse-security] MS VPN over SuSefirewall2 (7.3)
by Janowsky Ronald (BTMT/EDV) * 07 Feb '03

07 Feb '03

Hi Rainer, > I'm trying to build a VPN tunnel from an internal Win2K machine to a > server on the Internet (also MS). We are using a SuSEfirewall2 (SuSE > 7.3) to protect our internal Lan. The internal Lan is masqueraded. What do you want to achieve? VPN via PPTP or L2TP? PPTP uses protocol 47 (GRE) and protocol TCP port 1723 L2TP uses protocol 50 and/or 51 and protocol UPD port 500 src/dst and protocol UPD port 1701 as tunnel maintenaince > > Is there a way to configure the firewall to allow VPN > connections from > the Win2K machine? > > I opened the following ports in FW_MASQ_NETS: > > 10.0.0.0/24,0/0,tcp,1723 > 10.0.0.0/24,0/0,udp,1723 > 10.0.0.0/24,0/0,tcp,47 > 10.0.0.0/24,0/0,udp,47 > 10.0.0.0/24,0/0,udp,500 > As far as I know L2TP/IPSEC needs a NAT Traversal patch to be usable with masquerading. I'm using both PPTP and L2TP but with official IP's and without masquerading and my FW_FORWARD rules are as follows: a.b.c.d ==> W2K-Server with RRAS 0/0 ==> Mobile VPN Clients (W2K) PPTP first: FW_FORWARD="a.b.c.d/32,0/0,47 0/0,a.b.c.d/32,47 \ a.b.c.d/32,0/0,tcp,1024:65536 0/0,a.b.c.d/32,tcp,1723" and now L2TP: FW_FORWARD="a.b.c.d/32,0/0,50 0/0,a.b.c.d/32,50 \ a.b.c.d/32,0/0,udp,500 0/0,a.b.c.d/32,udp,500" You don't need a rule for UPD port 1701 because all the tunnel maintenaince will be done within the ESP packets and the Linux fw won't see these - their are encrypted. By the way you don't mention the use of certificates and so I believe you are going to do the simplier PPTP VPN. To raise the security level of the network it is a good idea to do input and output-filtering at the VPN-Server - only accept the packets you need for the VPN at the network card connecting to the firewall. Yust in case the firewall gets compromised. > Is it possible to configure VPN over SuSEfirewall2 at all? If > yes, what > am I doing wrong? VPN over SuSEfirewall2 is no big deal, if you are using official IP's. I think VPN via PPTP is possible with masquerading, but I don't do it this way and so I'm not quite helpful. L2TP/IPSEC is not so easy, because the Microsoft implementation needs digital certifactes AND you have the problem with the masquerading. > > Best regards, > Rainer > Best luck Ronald --

1 0

Re: [suse-security] Does "kpackage" do a "checksig" ???
by GarUlbricht7＠netscape.net 06 Feb '03

06 Feb '03

Hi Lars, Thanks for the hints (below) in determining if "kpackage" does the equivalent of "rpm -v --checksig" before installing a rpm.-- (from your quick check, it appears it does not) I keep forgetting about "grep". Yesterday I learned about using "locate" instead of "find" I know fou4s does do "--checksig" and my System Admin does all his rpm installations from the command line. He uses "rpm -v --checksig (rpm package)" before all his installs... amd so will I untill I find out whether "kpackage" does it too. If any one else has other hints or thoughts -- please pass them on ~ Gar ------ Lars Ellenberg <l.g.e(a)web.de> wrote: >On Wed, Feb 05, 2003 at 06:40:30PM -0500, GarUlbricht7(a)netscape.net wrote: >[ basically: do I need rpm --checksig -v *.rpm or not ] > >> My question remains: >> >> Does "kpackage" do a "--checksig" >> (i.e. against the suse key ring, MD5, etc) >> ***snip** > >I did a brief grep on the source (I do not use this package), which is >comming with the suse CDs, and it showed calls to rpmlib verifying the >headers, but nothing about signatures. only reference about MD5 sums is >when verifying files of installed packages against rpm db. you may want >to have a look yourself. >to prove: just move all suspective keyrings somewhere else, and see what >happens. or do strace the program, and grep there for acess of the >keyrings. you won't find any, I guess. > ***snap** > > Lars > >-- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

1 0

KDM listening on port 32768
by James Ogley 06 Feb '03

06 Feb '03

Hi, Did an audit on my colleague's machine, which is running SuSE 8.0, and noticed that KDM seems to be listening on TCP port 32768. I'm running 8.1, and I don't see this on my machine, just wondered if this is the correct stat of affairs, and why KDM listens on that port? Cheers James -- James Ogley, Unix Systems Administrator, Pinnacle Insurance Plc james.ogley(a)pinnacle.co.uk www.pinnacle.co.uk +44 (0) 20 8731 3619 Using Free Software since 1994, running GNU/Linux (SuSE 8.1) Updated GNOME RPMs for SuSE Linux: www.usr-local-bin.org ********************************************************************** CONFIDENTIALITY.This e-mail and any attachments are confidential and may also be privileged. If you are not the named recipient, please notify the sender immediately and do not disclose the contents to another person, use it for any purpose, or store or copy the information in any medium. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the views of Pinnacle Insurance plc. If you have received this email in error please immediately notify the Pinnacle Helpdesk on +44 (0) 20 8207 9555. This footnote also confirms that this email message has been swept by MIMEsweeper for the presence of computer viruses. www.mimesweeper.com **********************************************************************

2 1

Re: [suse-security] Does "kpackage" do a "checksig" ???
by GarUlbricht7＠netscape.net 06 Feb '03

06 Feb '03

Hi List: *On Fri, 31 Jan 2003 20:18 EST, I asked: > >Does "kpackage" do a "checksig" ??? I would still like to know. > I explained: > I normally do my "security updates" via YOU; > whereas, rpm package upgrades I downloaded from SuSE (or a SuSE mirror) > to a (home) download directory and then install via "kpackage." > > My question is does anyone know if "kpackage" does a "checksig" > on the rpm before installing it? > > I know it checks dependencies but should I do: > > "rpm --checksig <package name>.rpm" > > on each rpm ??? In reply , Andreas Hasenack wrote: Don't forget to add "-v", otherwise you won't know who signed the package, only that it was signed (or not). He is right, but.... My question remains: Does "kpackage" do a "checksig" (i.e. against the suse key ring, MD5) TIA ~Gar -- __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

2 1

unsubscription
by Juan Ignacio Carballo 05 Feb '03

05 Feb '03

>From: "studio3arc.com Admin" <admin(a)studio3arc.com> >To: 'Chris Garcia' <chrisgsirhc(a)yahoo.com>, suse-security(a)suse.com >Subject: RE: [suse-security] After harden_suse, server goes to sleep >Date: Wed, 05 Feb 2003 09:12:44 -0800 > > > >I've disabled apm on al my firewall systems. I really dont need it only >because the system is always available. Initially I would have problems >with the system timing out then only coming back after a few minutes. >Removing the apm stuff from my kernel helped the problem. > > > I'm running suse 7.3, and have recently installed > > harden_suse, and susefirewall2. Since, I've found > > that my machine "goes to sleep" after some idle period > > of time. To be able to connect to the machine over > > the network, I have to hit the a key on the keyboard. > > Does anyone know how to fix this? > > Thanks in advance, > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here _________________________________________________________________ Help STOP SPAM with the new MSN 8 and get 2 months FREE* http://join.msn.com/?page=features/junkmail

1 0

After harden_suse, server goes to sleep
by Chris Garcia 05 Feb '03

05 Feb '03

I'm running suse 7.3, and have recently installed harden_suse, and susefirewall2. Since, I've found that my machine "goes to sleep" after some idle period of time. To be able to connect to the machine over the network, I have to hit the a key on the keyboard. Does anyone know how to fix this? Thanks in advance, __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com

3 2

mod_auth_kerb and heimdal
by michse 05 Feb '03

05 Feb '03

Hi list Did anybody have success to authenticate against a KerberosV5 server (Heimdal) with SuSE´s mod_auth_kerb-Modul ? There seems to be no documentation for mod_auth_kerb in the SuSE distribution. :-( I have tried to configure httpd.conf like it is specified at http://modauthkerb.sourceforge.net but I always get an error: ... configuration error: couldn`t check user. No user file?:/ /etc/krb5.conf and /etc/krb5.keytab are installed correctly. Mirko .: .: there`s no rock like snowrock :: http://www.plasticivy.de <http://www.plasticivy.de/> :. .:

2 1

RE: [suse-security] SuseFirewall2 - HTTPS
by Peer Stefan 05 Feb '03

05 Feb '03

Hi Joao, > From: Joao Reis [mailto:joao.reis@2000comp.pt] > Hi everyone! > > I am using the susefirewall2 in a machine which connects > directly to the internet and acts as a proxy for the other > workstations in my > network. What proxy did you set up? Squid? > All the workstations connect to the Internet throw that machine. > > I have tested with trafic www and it worked, but the trafic > that comes from https is blocked in the firewall. > > I have tried to place the https port in the parameter > FW_SERVICES_INT_TCP="https", but it didn't work. I don't think it's a problem with your firewall rules, it looks more like a problem with your proxy. Your webbrowsers send their requests to your proxy, which then fetches the sites and serves them to the browsers. Therefore the question is: does your proxy support HTTPS? > Any idea ? > > thanks > > Joao Reis > > P.S: Sorry about my english :-) regards, Stefan

1 0

SuseFirewall2 - HTTPS
by Joao Reis 05 Feb '03

05 Feb '03

Hi everyone! I am using the susefirewall2 in a machine which connects directly to the internet and acts as a proxy for the other workstations in my network. All the workstations connect to the Internet throw that machine. I have tested with trafic www and it worked, but the trafic that comes from https is blocked in the firewall. I have tried to place the https port in the parameter FW_SERVICES_INT_TCP="https", but it didn't work. Any idea ? thanks Joao Reis P.S: Sorry about my english :-)

2 1

Firewall2 and carbon copy problem
by gonzsanz＠teleline.es 03 Feb '03

03 Feb '03

Here is my instalation Public Ip ----> 3 Com 812 (192.168.1.1)-->Linux eth1 (192.168.1.2) Linux eth0 (10.0.0.49) ----> My lan (10.0.0.xxx) My linux is using firewall2 and squid and is running well But now i have a pc (10.0.0.14) with carbon copy My router (3com812) sends all traffic now in port 1650 to 192.168.1.2 (before to 10.0.0.14 port 1650) I want to anibody who connects from port 1650 goes to 10.0.0.14 to carbon copy and i trie FW_FORWARD_MASQ="0/0 10.0.0.14,tcp,1680,1680" and still not working FW_FORWARD="" Please help

1 0

SuSEfirewall2: FW_SERVICES_INT_* settings not working
by Marc Christensen 03 Feb '03

03 Feb '03

Hello, I posted this earlier to SLE but have had no answers at this point... I have a SuSE 8.1 machine with all currently available online updates applied that I am trying to remote-administer. It is on a DSL connection and I am trying to work on it's firewall settings. It's obviously important that in configuring it's firewall, I don't lock myself out... 8^) I have read through the following files a couple times and as I configured each option. However, I think I must have missed something... /usr/share/doc/packages/SuSEfirewall2/EXAMPLES /usr/share/doc/packages/SuSEfirewall2/FAQ /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.conf.EXAMPLE I have a machine with two interfaces, eth0, eth1. eth0 is external, eth1 is masq (192.168.1.0/24). I want to be able to access some specific services running on the external interface from the internal, masqueraded network: FW_SERVICES_INT_TCP="ssh smtp http ntp https imaps pop3s 8080" FW_SERVICES_INT_UDP="ntp" All names are listed in /etc/services on the firewall machine and I have a squid proxy server running on port 8080. After making the changes in /etc/sysconfig/SuSEfirewall2, I restarted the firewall with this command: rcSuSEfirewall2 restart I also tried 'rcSuSEfirewall2 stop' then 'rcSuSEfirewall2 start'. Despite listing services in FW_SERVICES_INT_(TCP|UDP)=, I am still getting denied when trying to access the services from the internal network. Anyone have any ideas? Here is my full config: # cat /etc/sysconfig/SuSEfirewall2 | egrep -v "^[[:space:]]*$|^#" FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="0/0" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="https imaps pop3s smtp ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ssh smtp http ntp https imaps pop3s 8080" FW_SERVICES_INT_UDP="ntp" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option \ --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" Thanks. -- Marc Christensen http://www.mecworks.com http://www.mecworks.com/~marc/resume

3 6

Login Problems
by Richard Ibbotson 03 Feb '03

03 Feb '03

Hi Got a problem with an SuSE 8.1server which is runing in console mode. No X-windows. After running harden_suse I find that I cannot change the password and log back in again. I followed Roman Drahtmueller's advice which appeared on the SuSE security list back on the 9th of October last year.... >Please "touch /etc/rc.config" to work around this. >This is a bug - depending on the selection of packages on your system >it can happen that said file does not exist any more. It slipped >through last time. This worked for me and I was able to run ./harden_suse. However, on re-booting I now find that I can't log back in again. The password is rejected and if I become a user and then try to do 'su root' I find that once again the root password is rejected. Looking in /var/log/messages I see that my login messages which tell me that someone has tried to login reveal this .... "cannot open login.defs [Permission denied]" Anyone suggest a way out of this ? Perhaps I need to remove harden_suse and start again ? -- Thanks Richard www.sheflug.co.uk

4 5

RE: [suse-security] SuSEfirewall2 & Checkpoint software
by Reckhard, Tobias 03 Feb '03

03 Feb '03

> Short story: > Home LAN - SuSEfirewall2 System (SuSE 8.1 via DSL) - internet > - Checkpoint > FW - Companies LAN [snip] > I installed the software, checked the Checkpoint website for > information how > to configure an iptables fw, and I think I did it: the > neccessary ports are > udp 50, udp 51, udp 500 & udp 2746. > So I added the lines: > FW_FORWARD="212.212.212.212/32,192.168.10.100/24,udp,50 > 212.212.212.212/32,192.168.10.100/24,udp,51 \ > 212.212.212.212/32,192.168.10.100/24,udp,500 > 212.212.212.212/32,192.168.10.100/24,udp,2746" > FW_FORWARD_MASQ="212.212.212.212/32,192.168.10.100/24,udp,50 > 212.212.212.212/32,192.168.10.100/24,udp,51 \ > 212.212.212.212/32,192.168.10.100/24,udp,500 > 212.212.212.212/32,192.168.10.100/24,udp,2746" > (In both cases 212.212.212.212 is just a place holder!!! ... > not the real ip > adress.) > > But it does not work ...... no VPN connection is established > between my MS > client and a system on the companies LAN. > When I connect to the internet directly (eg. via an ISDN > dial-up connection) > it works fine. IPSec doesn't like IP Masquerading. IKE can't cope with it and AH fails, too. A hack (IMHO) has been created to solve the problems that the NAT hack (IMHO again) creates for IPSec, called NAT Traversal, which encapsulates IPSec in UDP. You need NAT-aware implementations on both IPSec peers for it to work. I don't know if SecuRemote falls in that category. Cheers, Tobias

1 0

I need vulnerability analysis tool, help me.
by 정정모 02 Feb '03

02 Feb '03

Hello, First, I'm very sorry for my poor English. We are building internet banking system with IBM zSeries and SuSE Linux. But Now, We need internal vulnerability analysis tool such as ISS Internet Scanner, Symantec ESM. But they did not support SuSE Linux for IBM zSeries. Do you know any other commercial vulnerability analysis tool support SuSE linux for zSeries? If any, Please help me with your advice. I'm very sorry for bothering you with this and looking forward to hearing from you soon. With my best wishes for your prosperity. Thank you in advance. --------------------------------------- Jeongl, Jeong-Mo Solution Service LAC Korea, Inc. Tel: +82-2-3444-2355 Fax: +82-2-3444-6945

3 2