March 2003 - openSUSE Security - openSUSE Mailing Lists

When will SNORT-Update (rpm) be available?
by HoneyNet Germany 11 Mar '03

11 Mar '03

Together with the Sendmail Remote Buffer Overflow there has been announced a Snort vulnerablity. But until now no one mentioned this on the list, nor is an update availble. When can we expect an updated Snort 1.9.1 RPM? Ciao Uwe HoneyNet Germany

9 16

SuSEfirewall2 customization
by Dirk Borchers 11 Mar '03

11 Mar '03

Hi to all, I need to modify the rules of the firewall2. What I want is to masquerade all internal machines - but not globally! The basis has to be that nothing will be allowed (except tcp port 80 for http). Every other protocol / port has to added as an extra rule; e.g. if a server with a fixed ip in the internet has to be reached on a certain port. I think I have to include the custom rules (FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"). Has anyone experience with it? Bye, Dirk

1 0

Re: [suse-security] AW: mal wieder kazaa
by BLeonhardt＠analytek.de 11 Mar '03

11 Mar '03

Hi, wie ist die Default Policy für FORWARD / OUTPUT / INPUT ??? DROP ? Dann solltest du den kazaa - Port zu deinem Rechner weiterleiten lassen .... "Volker Lieder" <v.lieder(a)gmx.de> 10.03.2003 20:20 An: <suse-security(a)suse.com> Kopie: Thema: [suse-security] AW: mal wieder kazaa > Hallo Liste, > ein kleines, aber wahrscheinlich bekanntes Problem. > Ich habe hier eine Suse 8.1 im Einsatz und dahinter einen > WinXP-Rechner mit Kazaa. > Ich habe mir eine eigene Firewall mit iptables gebaut, die soweit > auch funktioniert. > Jetzt habe ich allerdings dass Problem, dass ich mit Kazaa von > dem Win-Client > keine Verbindung bekomme, in den Drop-Regeln aber auch keine > Pakete auftauchen. > Ich weiss dass ich bei Kazaa den Port 1214 brauche, aber in > welche Chain muss > ich den Einfügen und was brauche ich noch? > Namensauflösung vom WinXP funktioniert soweit. > Bin für jede Hilfe dankbar. Ich nochmal selber, habe noch was an den Firewall-Regeln verändert und bekam ein paar logs dazu. Mittlerweile funktioniert Kazaa, habe folgende Regeln hinzugefügt: iptables -A FORWARD -p TCP -i eth0 --sport 1214 --dport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p UDP -i eth0 --sport 1214 --dport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p TCP -i eth0 --sport 1024:65535 --dport 1214 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p TCP -i ppp0 --sport 1214 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p TCP -i ppp0 --sport 1024:65535 --dport 1214 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p UDP -i ppp0 --sport 1024:65535 --dport 1214 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p TCP -i eth0 --sport 1024:65535 --dport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p TCP -i ppp0 --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT Nun meine Frage... Habe ich durch die letzten beiden Regeln meine Firewall zu sehr aufgebohrt und/oder gibt es eine andere Möglichkeit, das Problem mit Kazaa zu lösen z.B über einen Proxy? Sorry that this mail is in German, i wrote it in another list. The next will be in english ;-) -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

AW: mal wieder kazaa
by Volker Lieder 10 Mar '03

10 Mar '03

> Hallo Liste, > ein kleines, aber wahrscheinlich bekanntes Problem. > Ich habe hier eine Suse 8.1 im Einsatz und dahinter einen > WinXP-Rechner mit Kazaa. > Ich habe mir eine eigene Firewall mit iptables gebaut, die soweit > auch funktioniert. > Jetzt habe ich allerdings dass Problem, dass ich mit Kazaa von > dem Win-Client > keine Verbindung bekomme, in den Drop-Regeln aber auch keine > Pakete auftauchen. > Ich weiss dass ich bei Kazaa den Port 1214 brauche, aber in > welche Chain muss > ich den Einfügen und was brauche ich noch? > Namensauflösung vom WinXP funktioniert soweit. > Bin für jede Hilfe dankbar. Ich nochmal selber, habe noch was an den Firewall-Regeln verändert und bekam ein paar logs dazu. Mittlerweile funktioniert Kazaa, habe folgende Regeln hinzugefügt: iptables -A FORWARD -p TCP -i eth0 --sport 1214 --dport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p UDP -i eth0 --sport 1214 --dport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p TCP -i eth0 --sport 1024:65535 --dport 1214 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p TCP -i ppp0 --sport 1214 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p TCP -i ppp0 --sport 1024:65535 --dport 1214 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p UDP -i ppp0 --sport 1024:65535 --dport 1214 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p TCP -i eth0 --sport 1024:65535 --dport 1024:65535 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -p TCP -i ppp0 --sport 1024:65535 --dport 1024:65535 -m state --state ESTABLISHED,RELATED -j ACCEPT Nun meine Frage... Habe ich durch die letzten beiden Regeln meine Firewall zu sehr aufgebohrt und/oder gibt es eine andere Möglichkeit, das Problem mit Kazaa zu lösen z.B über einen Proxy? Sorry that this mail is in German, i wrote it in another list. The next will be in english ;-)

1 0

strange log
by Dominik Sk?adanowski 10 Mar '03

10 Mar '03

Hi all. During changing my password on SuSE 8.1 Pro, I've noticed line in the log (listed below): mar 7 17:48:06 server_name passwd[8936]: Unknown option: blowhish I think somebody made a little mistake in the word blowfish. -- ++++++++++++++++++++++++++++++++++++++++++ Dominik Sk?adanowski e-mail: dominik.skladanowski(a)ch.pw.edu.pl ++++++++++++++++++++++++++++++++++++++++++

2 2

Re: [suse-security] how to protect?
by MichaelHoeller＠t-online.de 10 Mar '03

10 Mar '03

Hello David, hello Matthias, hello list, Davids your sugguestions "sound" good to my newbie ears I have reposted it with my remarks. Sorry this got a little bit too long but to cut off your list would have given a wrong picture form your suggestion. Maybe the others can comment it? I am too green in some subjects an need to appologize if the question are not so professional. Right now I work myselfe to the man pages. Guess I need to add some words about the contallation: > > Here is the problem, I need to runn a productive server SuSE 8.0 to which > > real terminals are connected (-> no harddrive) the terminals boot via > > tfpt and mount the certain drives via nfs. For "online"backups I run > > rsync. The server must be reachable for remote maintenance via isdn > > dialin, also telnet and ftp. I need rsync only within the local net to mirror some data of the server. ssh/sftp will only be used by a direct dialin connection form *one* phone number - never via the internet. Does this open an option to close more doors? David M. Fetter wrote: > It sounds like you're trying to really lock down this system. Yes, the server should be as much locked as possible - but still usabel :-) > 1. Install susefirewall, configure it to allow only the tftp terminals > to access the various services you plan to run. This is very important > for portmap/nfs. What about sftp, ssh? > 2. Comment out everything in the /etc/inetd.conf. You didn't mention > anything that you plan on using which exists in this so need to have > unnecessary services available. > 3. Use SSH instead of telnet/ftp. You should also run rsync over ssh > using the "-e" switch with rsync. i.e. Don't run the rsync daemon. I will but would that differ since I use it only within the local net? > 4. Do not allow remote access for root in any case, unless for some > reason it is the only way to accomplish some task (perhaps the > backups?). Instead use sudo and configure it so you can execute > privileged commands with that. If you do have to allow root access, be > very specific where root can login from (i.e. tcp wrappers). I am not sure if this is possible, if a remote connection is needed than in emergency situations where privileged rights are needed. The only things which may could "narrow" the access is that the connection must be a dial in connection via isdn from a certian IP Address in the 192.168.x.x space. > 5. SSH can utilize TCP wrappers so use that as an extra layer to your > firewall. This basically means, edit the /etc/hosts.deny file and put > "ALL:ALL" in it, then edit the /etc/hosts.allow and add in the specific > IP address you want to allow (man 5 hosts_access for more info). > > 6. Disable any services you are not using. Only run the specific > services you need. > > 7. For the dialin, if you use mgetty, there are optional parameters you > can use to tighten down who can connect, etc. You'll need to read up on > mgetty more to figure out what it is you specifically want. Well on an other machine I use mgetty/callback (still analog) and this works fine Though you need to complile mgetty to enable the called-id support to block unwanted calls. But in this case the dialin will be only isdn. > 8. Setup tripwire. What is this? > 9. Setup a good log watcher (i.e. swatch). This is important so you > know what's going on. > 10. Don't run portsentry or IDS on this system itself. If you want to > run these they should be on a separate system. They are good if you > want to see if anyone is probing your network and watch the activity. > 11. Things like chkchroot and chkrootkit are tools which will check your > system for chroot processes or rootkits. If they're installed then > you'll be notified and basically in most cases that means you've been > compromised. I need to read more about it, "chkchroot and chkrootkit" is new to me. -- Encrypted eMail welcome! GnuPG/OpenPGP-Key: 0xC82CD70C. Fingerprint: BB76 0DED 1329 D3B7 04D0 F6BB 2033 3B11 C82C D70C

3 2

how to protect?
by MichaelHoeller＠t-online.de 09 Mar '03

09 Mar '03

Hello, I only have few knowledge in the area of security an so i like to ask for some hint on the expert list - please appologize when the question is not really professional. Here is the problem, I need to runn a productive server SuSE 8.0 to which some real terminals are connected (-> no harddrive) the terminals boot via tfpt and mount the certain drives via nfs. For "online"backups I run rsync. The server must be reachable for remote maintenance via isdn dialin, also telnet and ftp. The temporary connects to the internet for surfing and email should also be possible. What would you suggest to protect the machine? It would be great if you could point me to the right direction that way I can focus on the things which are really needed. Thanks a lot Michael -- Encrypted eMail welcome! GnuPG/OpenPGP-Key: 0xC82CD70C. Fingerprint: BB76 0DED 1329 D3B7 04D0 F6BB 2033 3B11 C82C D70C

4 5

pam_mkhomedir: no recursive copy of template directory?
by Heiko Ettelbrueck 07 Mar '03

07 Mar '03

Hi, on a SuSE 7.2 pro machine, I recently encoutered a problem with the PAM module mkhomedir: I doesn't copy the whole template directory, but only the files and directories (with_out_ contents) directly residing in it. The arguments to the module: skel=/etc/skel/ umask=0022 (like in the documentation (/usr/share/doc/packages/pam/modules/README.pam_mkhomedir). Is this a bug in the pam rpm of SuSE 7.2 (updated with YOU), or did I do something wrong, or does it "work as designed"? Thanks in advance Heiko

1 0

gd2 php Suse 8.1
by Franck 07 Mar '03

07 Mar '03

Hello all, Suse 8.1 included gd 1.8x but i must install gd2. How can i obtain rpm of gd2 ? On suse linux website, there is nothing !!! Help me plizz Best regards -- Franck \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ Fingerprint : 20F4 DBE5 7234 52D6 3610 BB17 D73C 1F7A 9E64 F6A1 http://www.linuxpourtous.com \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\

2 1

Re: [suse-security] My LAN user can not surfing in internet after a couple of hours.
by Prabu Subroto 06 Mar '03

06 Mar '03

Dear my friend Ian.... Could you tell me mo detail about the steps? If I want to allow this IP (145.253.2.196), what should I do? What is the name and the port number of DNS translation in "/etc/services"? I thought that is 53, am I wrong? --- Ian David Laws <ian(a)the-laws-clan.de> wrote: > On Friday 28 February 2003 13:54, Prabu Subroto > wrote: > SuSE-FW-ILLEGAL-TARGET > IN=ippp0 > OUT= > MAC= > SRC=145.253.2.196 > DST=145.254.88.223 > LEN=96 > TOS=0x00 > PREC=0x00 > TTL=247 > ID=38391 > DF PROTO=UDP > SPT=53 DNS > DPT=1096 Common Name Resolution Protocol > LEN=76 > > > SPT=53 DPT=1096 > If you look hear you are receiving a DNS translation > if you look up the 2 > ports in /etc/services. > The SRC ip address seems to external ISP but with > nslookup I cannot find this > address. If that ip is legal then allow this ip to > come in for DNS. > > Hopefully this will help you further > > Ian __________________________________________________ Do you Yahoo!? Yahoo! Tax Center - forms, calculators, tips, more http://taxes.yahoo.com/

1 0