May 2003 - openSUSE Security - openSUSE Mailing Lists

Problems Understanding SuSEfirewall2
by remote 22 May '03

22 May '03

Hi ! I seem to have a problem with SuSEfirewall2. I administrate a Linux router (SuSE 8.0) for a small network. This router serves as a gateway to the Internet as well as a firewall between the Net and my LAN. The LAN`s mail server is also located on this machine, while the web server ist on 100.120.55.2. Every PC in the LAN has a public IP, so I have to use routing without masquerading. The firewall is supposed to block all traffic between the Internet and the LAN except for the following protocols/ports : pop3, pop3s, http, https, ftp, ftps, smtp, ssh, domain. I also have to keep the port 7271 open for licensing purposes. Following the example files I built the Config-file listed below. However, I am not really satisfied with its performance. For example, it should not be possible to establish a ftp- connection from the outside to one of my LAN computers, but the firewall doesn´t prevent this at all. Also I want only certain outside machines to be able to connect to port 7271 on a certain computer within the LAN, yet it seems everybody can. What did I do wrong ??? BTW, the IPs in the config-file below were changed, just to be on the safe side. Please help ! Thanks in advance, Jörg PS : Please reply to JLeicher(a)gmx.de, since I have not subscribed to this mailing list. Here comes /etc/sysconfig/SuSEfirewall2 : FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="no" FW_MASQ_DEV="" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="20 21 22 25 53 80 110 995" FW_SERVICES_EXT_UDP="53" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="20 21 22 25 53 80 110 995" FW_SERVICES_INT_UDP="53" FW_SERVICES_INT_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="no" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="100.120.55.0/6,0/0,tcp,80 / 100.120.55.0/6,0/0,tcp,110 / 100.120.55.0/6,0/0,tcp,22 / 100.120.55.0/6,0/0,tcp,25 / 100.120.55.0/6,0/0,udp,53 / 100.120.55.0/6,0/0,tcp,53 / 100.120.55.0/6,0/0,tcp,995 / 0/0,100.120.55.2,tcp,80 / 100.120.204.51,100.120.55.18,tcp,7127 / 100.120.204.56,100.120.55.18,tcp,7127 / 100.120.204.58,100.120.55.18,tcp,7127 " FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="yes" ## # END of rc.firewall ## # # #-------------------------------------------------------------------------# # # # EXPERT OPTIONS - all others please don't change these! # # # #-------------------------------------------------------------------------# # # FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" #FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom"

3 4

Re: [suse-security] SSH and CHROOT alternatives...
by jonathanneto＠indg.com.br 22 May '03

22 May '03

Hi, I never did what you mean but here is what I have in mind. The problem with chroot with ssh (if it really can be run this way), seems to be that the users could not access /bin /usr/bin,etc so they can not even list files using ls. Of course you can copy this directories to the chrooted directory. To access the home you could use a workaround mounting the homes with nfs and using iptables to allow only localhost to use nfs at all. I think the easiest way is to get another machine just for ssh, and mount the home using nfs as soon as user logs in. You can also replace nfs for another network file system like samba. You can also forget about chroot and treat with the filesystem permission, puttin 700 mode on the directories you dont want users to access. Eg. you can let users access /usr, but not /var. In this case care must be taken on directories like /etc. Hope it helps Regards Jonathan > Howdoo all, > > I've been looking at trying to secure SSH sessions so that specified users > can > only browse their home diretories. > > I've found a couple of bodges that can be made to do the trick, but none of > them seem particulalry ideal. > > Has anyone got any suggestions on how I could secure SSH in this fashion, > whether using CHROOT or something else entirely I don't mind. > > Cheers. > > > > ----~~~~==oOo==~~~~---- > Duncan Carter > ----~~~~==oOo==~~~~---- > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

4 3

SuSEfirewall2 DMZ, FW_FORWARD, POSTROUTING & PREROUTING
by Radko L 22 May '03

22 May '03

Hi I have some question connected with SuSEfirewall2 if I have real IP for DMZ network and in DMZ network used squid server is needed to allow connections from DMZ to public internet and respons for them request in FW_FORWARD if I have to do it I can to allow DMZ to internet conncetion but how to do firewall not to block response on DNZ squid server request? /the prblem are there that connections from squid server comming form diferent ports/ The second question is when SuSEfirewall2 loaded and running if I made iptables -L -n there no POSTROUTING and PREROUTING chain? I thought that this chains exist by default in iptables? __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com

1 0

glibc update
by Graham Murray 22 May '03

22 May '03

What architecture is the 2.2.5-177 glibc update for 8.1? Currently I am running the i686 version and do not want to 'downgrade' to a 386 or 586.

3 3

SuSEfirewall2 and trusted nets
by Jörg Brandenburg 22 May '03

22 May '03

My linux box runs with SuSe 8.2, SuSEfirewall2 and one NIC (eth0). I want to restrict the access to the web server to only one allowed client. But the web server is only accessible to the trusted client (and the whole world) if I add the web-service to FW_SERVICES_EXT_TCP. Has anybody out there an idea? My configuration is: FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="smtp ssh" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="<ip-of-trusted-client>,tcp,80" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS ntp" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV=""

1 0

rcsshd reload
by Hofmann Informatik 22 May '03

22 May '03

Hello, I updated to mod_php4 4.2.2-215/mod_php4-core 4.2.2-215 Now when a user loggs in he's forced to relogin after each click. I guess that it has something to do with php.ini but...... Any clues are welcome. btw: register_globals = On Thanks Best regards Sandro Trinkler

1 0

What's keeps changing my inet.d sequence
by John Andersen 22 May '03

22 May '03

Something in SuSE 8.1 insists on changing the sequence of my start scripts in /etc/init.d/rc3.d and /etc/init.d/rc5.d to its idea of the perfect start order. What is it, where can I change it, and how can I get it to leave my sequence alone? It insists on starting my shorewall firewall before vmware, which causes a failure. -- _____________________________________ John Andersen

7 12

SuSEFirewall long lines
by Jeff Harris 21 May '03

21 May '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 As I work on my firewall, I'm getting some long lines in the /etc/sysconfig firewall file. What is the correct way to wrap the lines? Thanks, Jeff - -- Registered Linux user #304026. "lynx -source http://www.rallycentral.us/~linux/jharris.asc | gpg --import" or "gpg --keyserver pgp.mit.edu --recv-key BD23A31E" Key fingerprint = FB8C 3210 8DE1 78F4 6505 5918 0C34 BE94 BD23 A31E -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQE+y802DDS+lL0jox4RAo3WAJoCuMlyHsolZ3vaHnOvYiuo0RDZWACdHfOk mJgJaCF0TWfwKetNqfROiWw= =dp1W -----END PGP SIGNATURE-----

2 1

CA-2003-10 SunRPC XDR glibc
by Helge Hansemann 21 May '03

21 May '03

Hi, without the attention to annoy anyone, I would like to ask for some information about the current status of the fixed glibc. Is there a release date ? Thanks and greetings, Helge Hansemann

1 0

Re: IMAP and 8.2
by Peter Hinterseer 21 May '03

21 May '03

> David, > > stunnel does not work with the imap-2000 package supplied by SuSE 8.2. > You have to find an imapd implentation that supports plain text logins. > > The point of stunnel is to convert an insecure imap server into a secure > one. SuSE blew this apart by building imapd in such a way that it would > not support this. > > Bob Hi! This is not entirely true. SuSE's imap-2002 package released with 8.2 has to be enabled to accept plaintext passwords. This is easily done by creating a file '/etc/c-client.cf' with the following content: -- I accept the risk set disable-plaintext 0 -- WIthout the '--' of course... ;-) Have fun, Peter

2 1