February 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] MS VPN over SuSefirewall2 (7.3)
by Devenport, Jimmy 09 Feb '03

09 Feb '03

I ran into this same problem using OpenBSD as a firewall also... Don't know why it is so difficult for everyone to behave nicely together. I love Linux/Unix because of the security, reliability, and the "geek" in me says it's cool. But I have to face reality - the majority of the computers out there on the desktop are using Windows. My corporate network uses a Microsoft VPN (not SSH, or anything else that they could have used), and I have DSL at home. So I created a firewall using floppyfw (http://www.zelow.no/floppyfw/) - it works great, easy to set up my DSL connection, NAT, port forwarding was a piece of cake. There on that site they specifically tell you what you need for a MS VPN connection, so just add that to your firewall rules, reboot. Piece of cake! So now I can very easily connect from my internal protected network thru the firewall to our corporate VPN. No problems at all. If you have questions about floppyfw and my setup or firewall rules, e-mail me personally. My floppyfw runs on an old Pentium 133, 24M memory, no hard drive required (I don't care for logging currently - I have other things to do that to watch my logs) - but supposedly you can send syslog to another box inside your firewall also. -----Original Message----- From: Rainer Hofmeister [mailto:rh@webkom.net] Sent: Thursday, February 06, 2003 7:19 AM To: suse-security(a)suse.com Subject: [suse-security] MS VPN over SuSefirewall2 (7.3) Hi, I'm trying to build a VPN tunnel from an internal Win2K machine to a server on the Internet (also MS). We are using a SuSEfirewall2 (SuSE 7.3) to protect our internal Lan. The internal Lan is masqueraded. Is there a way to configure the firewall to allow VPN connections from the Win2K machine? I opened the following ports in FW_MASQ_NETS: 10.0.0.0/24,0/0,tcp,1723 10.0.0.0/24,0/0,udp,1723 10.0.0.0/24,0/0,tcp,47 10.0.0.0/24,0/0,udp,47 10.0.0.0/24,0/0,udp,500 This didn't work. I read somewhere that the communication over port 47 is not tcp or udp but gre. Since I can't set that in SuSEfirewall2 I tried to open up the complete network by using: 10.0.0.0/8 This didn't help, either. Connecting the Win2K machine directly to the ISDN router works so there seems to be no problem with its configuration. Is it possible to configure VPN over SuSEfirewall2 at all? If yes, what am I doing wrong? Best regards, Rainer -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Firewall and vpn
by gonzsanz＠teleline.es 08 Feb '03

08 Feb '03

Now i have a suse firewall2 installed Internet ----> Firewall2 ----> Lan In my lan i have a windows NT with vpn. I Know that i must open port 1723 and protocol 47 in my susefirewall2 to allow comunicate from internet to my server in NT Where can I open these ports in suse firewall2 scripts? and how redirect the traffic), Must i use iP-Tables on my rc-custom?. Help!!!

1 0

MS VPN over SuSefirewall2 (7.3)
by Rainer Hofmeister 08 Feb '03

08 Feb '03

Hi, I'm trying to build a VPN tunnel from an internal Win2K machine to a server on the Internet (also MS). We are using a SuSEfirewall2 (SuSE 7.3) to protect our internal Lan. The internal Lan is masqueraded. Is there a way to configure the firewall to allow VPN connections from the Win2K machine? I opened the following ports in FW_MASQ_NETS: 10.0.0.0/24,0/0,tcp,1723 10.0.0.0/24,0/0,udp,1723 10.0.0.0/24,0/0,tcp,47 10.0.0.0/24,0/0,udp,47 10.0.0.0/24,0/0,udp,500 This didn't work. I read somewhere that the communication over port 47 is not tcp or udp but gre. Since I can't set that in SuSEfirewall2 I tried to open up the complete network by using: 10.0.0.0/8 This didn't help, either. Connecting the Win2K machine directly to the ISDN router works so there seems to be no problem with its configuration. Is it possible to configure VPN over SuSEfirewall2 at all? If yes, what am I doing wrong? Best regards, Rainer

5 4

pam + chroot
by Jacques Weewer 08 Feb '03

08 Feb '03

Hi, I'm expiremnting with PAM at the moment, ans I saw that there was a module for chroot, i've been trying to get ssh-logins chrooted with this, but I can't seem to get it right, is there any solution for this or isn't this possible. Thanks in advance, Jacques

1 0

Re: [suse-security] going nuts with rpm --checksig / gpg, works onsuse 7.3, doesnt work on suse 8.0How do you
by GarUlbricht7＠netscape.net 08 Feb '03

08 Feb '03

Markus Gaugusch <markus(a)gaugusch.at> wrote in reply to Andreas Bittner: ***snip*** > You must import the key into the keyring of the RPM system > export GPGHOME=/usr/lib/rpm/gnupg > ... import the key ... > > If you had done sig checking NOT AS ROOT, it would have worked. > > It's not a bug, it's a feature ... ;) > >Markus > Markus made a similar comment a month or so ago earlier. I have looked at the the man pages for "exports" and "import" as well as searched the help files both on my machine and on SuSE web site, but I still at a loss how to import a new key into the keyring of the RPM system :(( Any help would be appreciated. ~Gar Note: Markus wrote "gpg" rather than "gnupg"above but in a later email said it was a typo, so I changed herein. -- __________________________________________________________________ The NEW Netscape 7.0 browser is now available. Upgrade now! http://channels.netscape.com/ns/browsers/download.jsp Get your own FREE, personal Netscape Mail account today at http://webmail.netscape.com/

2 1

squid - winbind - wb_group: could not fetch trust account password
by Markus Feilner 08 Feb '03

08 Feb '03

Hello List, I am just using the NTLM Authentication of an AD-Domain with wb_group for Squid. All Users in the group WWW_Benutzer are allowed to surf, others not. I have therefore successfully configured samba to use winbindd and winbind bound to the Domain (via smb.conf). At least it seems so: wbinfo -u gives me all Usernames of the Domain, wbinfo -g the group names. Squid-2.5 (self-compiled with <configure –-enable-auth=“ntlm,basic“ --enable-basic-auth-helpers=“winbind“ --enable-ntlm-auth-helpers=“winbind“>) starts without errors, with a squid.conf where, following the readme.txt from .../squid.../helpers/external_auth/winbind_group/ an acl and more is defined for the WWW_Benutzer O.K, but it doesn't work: I always get the error: ----------- Feb 7 19:35:15 netapp01 winbindd[762]: [2003/02/07 19:35:15, 0] nsswitch/winbindd_pam.c:winbindd_pam_auth_crap(181) Feb 7 19:35:15 netapp01 winbindd[762]: winbindd_pam_auth: could not fetch trust account password for domain R-ERMER ------------ in my /var/log/messages, when an authorized User (of the group WWW_Benutzer) wants to access the proxy, and he won't be allowed to log in. Besides that, wbinfo -t tells me, " Secret is bad" Does that have anything to do with the error above? Thanks a lot! -- Mit freundlichen Grüßen Markus Feilner May you always grok in fullness! Beachten Sie bitte unsere neue Email-Adresse! ------------------------------------------------------------------------------------------------- Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

2 1

SuSEFirewall2 and SQUID and LOTS of help needed :)
by Ash Corbin 08 Feb '03

08 Feb '03

Hello all, I am in search of "desperately" for help with configuring my SuSEfirewall2 on 8.1 Pro and Squid with a few windows 2000 and Xp pro machines. present configuration SuSE 8.1 no DNS (ips provides dns), no DHCP server or clients, FTPd, SSH, http&https, in the future... SQUID and SAMBA I use a broadband connection -> Linksys BEFSX41 (vpn endpoint router which accepts its Wan IP via DHCP C.C.C.C/255.255.255.0, internal Static IP 10.x.x.A/255.255.255.0) -> Linux pro 8.1 [eth0 Static IP 10.x.x.B/255.255.255.0, eth1 Static IP 10.x.x.C/255.255.255.0] , Win Xp Pro Static IP 10.x.x.D/255.255.255.0, and Win2k Pro Static IP 10.x.x.E/255.255.255.0 It works fine and I use personal software firewalls for the Windows machines. My hopes are to set up the network like this..... Broadband connection -> Linksys BEFSX41 Wan DHCP, INT IP Static -> [Eth0] Linux Firewall-2 & Squid proxy [eth1] -> Hub {or better yet internal print server box w/hub in it} -> Windows machines with Static IPs. I have been reading the susefirewall2 examples and a great "unofficial faq" SuSE Firewall2 by Togan Muftoglu. First and foremost I am NEW to configuring firewalls. Second I should pick it up quickly if I can make heads or tails of what combination of rules to use together. Second I would like to just get the firewall up and running with windows clients connecting through it WITHOUT THE PROXY that I can work out later. 1.) FW_Quickmode_"no" 2.) FW_DEV_EXT="eth0" 3.) FW_DDEV_INT="eth1" 4.) FW_DEV_DMZ="" This is where I get a bit lost if I should or not set these switches/options 5.) FW_ROUTE="no" I should set this to YES until I get my proxy going? 6.) FW_MASQUERADE="no" I should set this to YES until I get my proxy going, then set it back to NO 6a.) FW_MASQ_DEV="eth0" or "$FW_DEV_EXT" 6b.) FW_MASQ_NETS="" This I want to restrict to only the services I use, WWW, FTP, SSH, SC, receive email via POP3, send email via SMTP, (a few games Starcraft, CounterStrike but these are to important) my internal IPs are 10.x.x.x/255.255.255.0, there are 3 machines, 2 workstations and 1 laptop. 7.) FW_PROTECT_FROM_INTERNAL="yes" Is this similar to FW_MASQ_NETS? 8.) FW_AUTOPROTECT_SERVICES="yes" So with this set to YES then I have to add the IP/net/protocol/port# and these need to be set in FW_SERVICES_EXT_TCP,UDP & FW_SERVICES_INT_TCP,UDP ? But that about an entry FW_SERVICE_*_TCP,UDP...? 9.) FW_SERVICES_EXT_TCP="www ssh" but what about SSL and FTP? 9.) FW_SERVICES_EXT_UDP="" 9.) FW_SERVICES_INT_TCP="" 9.) FW_SERVICES_INT_UDP="" 9a.) FW_SERVICES_QUICK_TCP="" 9a.) FW_SERVICES_QUICK_UDP="" 9a.) FW_SERVICES_QUICK_IP="" 10.) FW_TRUSTED_NETS="" 11.) FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" can I specify the port #s in here? 11.) FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" Is this required for DNS for the internal network machines? 12.) FW_SERVICE_AUTOPROTECT="yes" 12.) FW_SERVICE_DNS="no" 12.) FW_SERVICE_DHCLIENT='no" 12.) FW_SERVICE_DHCPD="no" 12.) FW_SERVICE_SQUID="no" Soon I hope to configure SQUID but I need to buy a book or read a lot more online. 12.) FW_SERVICE_SAMBA="no" 13.) FW_FORWARD="" 14.) FW_FORWARD_MASQ="" 15.) FW_REDIRECT="" This I should setup for SQUID? 10.x.x.x/y,0/0,tcp,80,3128 0/0, 10.x.x.a,tcp,80,8080 16.) FW_LOG_DROP_CRIT="yes" 16.) FW_LOG_DROP_ALL="no" 16.) FW_LOG_ACCEPT_CRIT=yes" 16.) FW_LOG_ACCEPT_ALL="no" 16.) FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" 17.) FW_KERNEL_SECURITY="yes" 18.) FW_STOP_KEEP_ROUTING_STATE="no" 19.) FW_ALLOW_PING_FW="yes" 19.) FW_ALLOW_PING_DMZ="no" 19.) FW_ALLOW_PING_EXT="no" 20.) FW_ALLOW_TRACEROUTE="no" 21.) FW_ALLOW_SOURCEQUELCH="yes" 22.) FW_ALLOW_FW_BROADCASTS="no" 22.) FW_IGNORE_FW_BROADCASTS="yes" 23.) FW_ALLOW_CLASS_ROUTING="no" 25.) FW_CUSTOMRULES="" 26.) FW_REJECT="no" So if anyone has some time to help me out I would be greatly appreciative and send you all the good karma I can muster :) If anyone can recommend any books that I should pick up that may help me understand these rules that would be great also. Sincerely, Ash

2 1

kmail 1.5 and s/MIME
by Mathias Homann 07 Feb '03

07 Feb '03

Hi, did someone here get the s/MIME support for kmail 1.5 to work? especially compiling all the needed libraries (see http://kmail.kde.org/kmail-pgpmime-howto.html) gives me headaches, libgcrypt refuses to compile on a SuSE 8.0 with errors concerning ld :( any hints? bye, [MH] -- Die unaufgeforderte Zusendung einer Werbemail an Privatleute verstößt gegen §1 UWG und §823 I BGB (Beschluß des LG Berlin vom 2.8.1998 Az: 16 O 201/98). Jede kommerzielle Nutzung der übermittelten persönlichen Daten sowie deren Weitergabe an Dritte ist ausdrücklich untersagt!

1 0

going nuts with rpm --checksig / gpg, works on suse 7.3, doesnt work on suse 8.0
by Andreas Bittner 07 Feb '03

07 Feb '03

hi all, gpg / rpm --checksig are driving me crazy.... i have two systems... suse 7.3 the one, suse 8.0 the other... i have downloaded to both systems the latest webmin 1.060 webmin-1.060-1.noarch.rpm, and they gpg/pgp key from the author http://switch.dl.sourceforge.net/sourceforge/webadmin/webmin-1.060-1.noarch… http://www.webmin.com/jcameron-key.asc the problem is, the one system gives me errors when rpm --checksig webmin-1.060-1.noarch.rpm the other system works fine... both have gpg installed and i have imported the public key of the webmin author... i dont see any difference... see here: the correctly working system (suse 7.3) # gpg --list-keys -v /root/.gnupg/pubring.gpg ------------------------ gpg: NOTE: signature key 9C800ACA expired Sat Oct 19 15:17:53 2002 CEST pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> gpg: NOTE: signature key 9C800ACA expired Sat Oct 19 15:17:53 2002 CEST sig 9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> sub 2048g/8495160C 2000-10-19 [expires: 2002-10-19] sig 9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> pub 1024D/11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> sig 11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> sub 1024g/1B24BE83 2002-02-28 sig 11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> --------------- then rpm: # rpm --checksig webmin-1.060-1.noarch.rpm -v webmin-1.060-1.noarch.rpm: MD5 sum OK: 547eb528952c96eec64ae3910e9c5aa5 gpg: Signature made Wed Feb 5 00:48:41 2003 CET using DSA key ID 11F63C51 gpg: Good signature from "Jamie Cameron <jcameron(a)webmin.com>" gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. gpg: Fingerprint: 1719 003A CE3E 5A41 E2DE 70DF D97A 3AE9 11F6 3C51 everything fine here, signature's been correctly checked on the suse 7.3 system... ------------------------------------------------------------------------- ------------------------------------------------------------------------- now in contrast the suse 8.0 system: # gpg --list-keys -v /root/.gnupg/pubring.gpg ------------------------ pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> sig B1CA3C45 1999-03-06 [User id not found] sig 3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> sig 000AABA4 2001-06-06 [User id not found] sig CEFC9215 1999-08-15 [User id not found] sig B0DFF780 2000-11-21 [User id not found] pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> sig 9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> sig 000AABA4 2001-01-25 [User id not found] sig 3D25D3D9 2001-01-25 SuSE Security Team <security(a)suse.de> sig 9C800ACA 2002-02-13 SuSE Package Signing Key <build(a)suse.de> sub 2048g/8495160C 2000-10-19 [expires: 2006-02-12] sig 9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> sig 9C800ACA 2002-02-13 SuSE Package Signing Key <build(a)suse.de> pub 1024D/AFB66D7C 2002-04-28 fou4s build key <fou4s(a)gaugusch.at> sig AFB66D7C 2002-04-28 fou4s build key <fou4s(a)gaugusch.at> sub 1024g/8B6432D7 2002-04-28 sig AFB66D7C 2002-04-28 fou4s build key <fou4s(a)gaugusch.at> pub 1024D/11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> sig 11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> sub 1024g/1B24BE83 2002-02-28 sig 11F63C51 2002-02-28 Jamie Cameron <jcameron(a)webmin.com> ------------- now the rpm output: rpm -v --checksig webmin-1.060-1.noarch.rpm webmin-1.060-1.noarch.rpm: MD5 sum OK: 547eb528952c96eec64ae3910e9c5aa5 gpg: Signature made Wed Feb 5 00:48:41 2003 CET using DSA key ID 11F63C51 gpg: Can't check signature: public key not found ---------------- jeez... am i stupid or not seeing the problem here? what the heck.... the pub key of jcameron(a)webmin.com is there on both systems... so what the heck is wrong here??? the md5 hash key is the very same on both systems, so the downloaded files are exactly the same... so why the heck cant suse 8.0 verify the file then???? can anyone help?? thanks and regards, andy

2 3

[mpcfir1] How to configure forwarding in suse 8.0 ?
by Marc Chassoulier 07 Feb '03

07 Feb '03

Hello I'm neebees in firewall security. I Have configured my firewall with yast2 all works fine but now I must configure 1 port of a workstation to be access from the net. it's urgent and I ddidn't now how to do this. Anyone can help me? My port is 4899, my internet port is eth1 and my local port is eth0, my workstation adress is 10.0.0.59 Where can I put this (in wich file), what command line I must run after, Is the Yast configurator work after this? Thanks for your answers marc

2 1