May 2003 - openSUSE Security - openSUSE Mailing Lists

A fax problem...
by Chris Bek 21 May '03

21 May '03

Hi there SuSErs, I don't really know if this list is apropriate for such a question so please correct me if I am wrong. I have installed HylaFax (on my SuSE 7.2 machine which acts as a server for 5 Win9X machines) and everything is working fine, the program is sending and receiving faxes, upon reception, it sends an e-mail to the FaxMaster etc.... All is ok. The problem is that the received files cannot be viewed by any user due to the fact that the permissions are set for root only. Can anyone tell me how can I change this so that everyone can view these faxes? Thank you in advance! Chris

1 0

AW: [suse-security] What's keeps changing my inet.d sequence
by Schreiner, Dirk 21 May '03

21 May '03

This evil thing called yast.... Dirk -----Ursprüngliche Nachricht----- Von: John Andersen [mailto:jsa@pen.homeip.net] Gesendet: Mi 21.05.2003 10:39 An: James Ogley; Security List Cc: Betreff: Re: [suse-security] What's keeps changing my inet.d sequence On Wednesday 21 May 2003 00:32, James Ogley wrote: > > Something in SuSE 8.1 insists on changing the sequence > > of my start scripts in /etc/init.d/rc3.d and /etc/init.d/rc5.d > > to its idea of the perfect start order. > > What is it, where can I change it, and how can I get > > it to leave my sequence alone? > > Read man insserv But I never run it, (because I've discovered running it specifying a specific service file STILL causes it to adjust all files - Bug I think). So who/what is running insserv? -- _____________________________________ John Andersen -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here TRIA IT-consulting GmbH Rosenkavalierplatz 4 81925 München Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de -------------------------------------------------------- working hard | for your success -------------------------------------------------------- Registergericht München HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschäftsführer: Hubertus Wagenhäuser -------------------------------------------------------- Nachricht von: Dirk.Schreiner(a)tria.de Nachricht an: jsa(a)pen.homeip.net, james.ogley(a)pinnacle.co.uk, suse-security(a)suse.com # Dateianhänge: 0 Die Mitteilung dieser E-Mail ist vertraulich und nur für den oben genannten Empfänger bestimmt. Wenn Sie nicht der vorgesehene Empfänger dieser E-Mail oder mit der Aushändigung an ihn betraut sind, weisen wir darauf hin, daß jede Form der Kenntnisnahme, Veröffentlichung, Vervielfältigung sowie Weitergabe des Inhalts untersagt ist. Wir bitten Sie uns in diesem Fall umgehend zu unterrichten. Vielen Dank The information contained in this E-Mail is privileged and confidental intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient or competent to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this E-Mail is strictly prohibited. If you have received this E-Mail in error, please notify us immediately. Thank you

1 0

update openssh
by patrick thempel 21 May '03

21 May '03

hi evryone, heres my question, i want to update my openssh , the original one that came with suse8.0 tried to download the patch or the full rpm, from the security annoncement page ftp://ftp.suse.com/pub/suse/i386/update/8.0/sec1/openssh-3.4p1-4.i386.patch… only downloaded 0 bytes ( several times) updating with the new openssh from 8.2 didnt work, needs libraries.so6 and insserv that are not part of 8.0. didnt want to go into a session of rpm.what provides what , cause most of the times i ended up with needing to install most of my system . didnt want to say f... the dependencies just update. any solutions? where can i get the patch, or is it save to just rpm --nodeps openssh3.5.something? thanx in advance ===== Mit freundlichen Gruessen Patrick Thempel mail:patrick_thempel@yahoo.com __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com

5 5

QPopper 4.0.3.-178 + dracd + "Relay access denied"
by Manfred Rebentisch 20 May '03

20 May '03

I installed the patch for SuSE 8.0-Qpopper: linuso:/var/cache/fou4s/packages/ftp.gwdg.de/i386/update/8.0/n4 # popper -v Qpopper Modified by SuSE version 4.0.3 (non-standalone) linuso:~ # rpm -qa | grep popper qpopper-4.0.3-178 linuso:/var/cache/fou4s/packages/ftp.gwdg.de/i386/update/8.0/n4 # popauth -version popauth v4.0.3 After this it is not possible for the external users to authentificate with smtp. The mail.log shows like this: May 19 18:03:28 linuso postfix/smtpd[1638]: connect from unknown[195.243.195.231] May 19 18:03:28 linuso postfix/smtpd[1638]: 743BCCF4: client=unknown[195.243.195.231] May 19 18:03:28 linuso postfix/smtpd[1638]: reject: RCPT from unknown[195.243.195.231]: 554 <MRebentisch(a)comparat.de>: Recipient address rejected: Relay access denied; from=<ingo(a)net-market.de> to=<MRebentisch(a)comparat.de> May 19 18:03:36 linuso postfix/smtpd[1638]: disconnect from unknown[195.243.195.231] In postfix's main.cf is the entry: smtpd_recipient_restrictions = permit_mynetworks, check_client_access btree:/etc/postfix/dracd, check_sender_access btree:/etc/postfix/dracd, check_relay_domains I think, that qpopper is not compiled for dracd ? Or is there another reason for the "Relay access denied"? Manfred Rebentisch -- COMPARAT Software-Entwicklungs-GmbH Mobile Voice Solutions Prießstr. 16, 23558 Lübeck Tel: 0451/479 56 60 Fax: 0451/871 090 26 http://www.comparat.de http://www.mobile-voice.de

1 1

SuSEfirewall2 question?
by Radko L 20 May '03

20 May '03

I have SuSE 8.1 and I roun pptp server on it I'm configurated SuSEfirewall2.conf but I want to put for external interface and any ppp connection when I tried ppp0 ppp1 and so on, everithink work but I want to ask you is there any other way like ppp+ and this to match any ppp0, ppp1 ... connection I've tried it but it doesn't work Could you help me how to do that? Regards __________________________________ Do you Yahoo!? The New Yahoo! Search - Faster. Easier. Bingo. http://search.yahoo.com

1 0

FW_FORWARD_MASQ
by Andre Vorster 20 May '03

20 May '03

Hi All I am trying to setup SuSEfirewall2 to forward & Masq to a Microsoft web server on my internal LAN The website runs ASP scripts so I can't, as far as I know hosts it on apache. Shoot the damm developer !!!! The websites IP is 196.25.208.26, I created a virtual adapter eth1:1 with IP 196.25.208.28. I Have FW_DEV_DMZ="eth1:1" - (IP-196.25.208.26) FW_FORWARD="196.25.208.28,10.0.0.7" - (10.0.0.7 is the private IP of my web server) FW_FORWARD_MASQ ="0/0 10.0.0.7,tcp,80" But it does not work ? Thanks Andre South Africa

3 2

SuSEfirewall2, 3 nics, 2 ISPs, NAT, iproute2, dual routing tables... oh the humanity!
by nhoward＠wichitavalley.com 19 May '03

19 May '03

I am about to build a frankenstein monster out of my SuSE 8.1 Linux internet server / NAT router-firewall machine.... at least I'm going to try. Presently the machine has two nics in it, one is the external internet nic and the other is an internal network nic, with an rfc1918 address, in the classic firewall/router/bastion-host setup. I presently have a wireless ISP who gives me a static IP address, and the bandwidth is good enough for hosting my vanity domain name web and email servers but is not always so good (too much packet delay/latency) for my online game playing from windows boxes on my interior network which is NAT'ed by the Linux box as my internet router and firewall machine. Let's call this one ISP "A". I just signed up for a broadband cablemodem connection, which will only give me a dynamic ip address that will change frequently. Let's call this one ISP "B". I wish to add a third nic into my Linux machine and have it connected to both ISP's and have all my web/email/ssh server traffic running on that Linux machine routed out to the internet via the nic connected to ISP "A" and have my NAT'ed interior network traffic from the windows boxes routed out via the nic connected to the cablemodem ISP "B". Now if it weren't for my SuSEfirewall2 settings coming into play, I think I can do this via setting up two different routing tables and taking advantage of iproute2's abilities... I've found some config examples on usenet and have read the howto at http://lartc.org/howto/lartc.rpdb.multiple-links.html to get the basic networking stuff supporting this abominable nightmare, but I have grown too comfortable with my SuSEfirewall2 settings which make me feel safer against keeping the booger-man out of my Linux machine and the various other machines I have NAT'ed behind the Linux machine. From what I've been able to see with my limited knowledge of SuSEfirewall2, it seems that this wonderful iptables management tool is geared primarily for the model of having one external nic, one internal nic, and perhaps also a "dmz" third nic. Can the SuSEfirewall2 in SuSE 8.1 (in present form as shipped) support both my external nics and two ISP's and the multiple routing tables mess that I desire to have the best of both worlds? If so, can anyone possibly point me to some configuration examples showing me how to protect against evil traffic coming inbound from both external interfaces while still allowing desired traffic coming inbound from both nics, and allowing my desired outbound traffic to go out the appropriate nic as specified in the respective routing table? Also, as if I'm not enough of a glutton for punishment... I may even wish to add a fourth nic in the futire to be a NAT'ed "DMZ" of sorts on yet another rfc1918 network address separate from my windows network, for the purpose of placing a dedicated UT2003 server machine. Am I asking for too much in expecting to be able to do this all with one single Linux machine? I know it would probably be simpler to have dual machines (or just get a cheap Linksys router), one for each ISP, but I'm a cheap bastard who is out of money now after paying for two ISPs and would like to try to make all this complicated mess work on a single Linux box. Thanks for any help. Neal

1 0

Re: [suse-security] IMAP and 8.2
by Bob Vickers 19 May '03

19 May '03

David, stunnel does not work with the imap-2000 package supplied by SuSE 8.2. You have to find an imapd implentation that supports plain text logins. The point of stunnel is to convert an insecure imap server into a secure one. SuSE blew this apart by building imapd in such a way that it would not support this. Bob On Sat, 17 May 2003, David Soltero-Lugo wrote: > > I tried the inet option (on xinetd) and did not work, can you provide > mor information on the stunnel option?? > > Thanks > David > > Björn Róbertsson wrote: > > >I also discovered that my ssl'd imapd service had stopped working. I'd > >created stunnel connection and I found in /etc/stunnel a config file which > >allowed for a very simple configuration... > > > >This however requires the service stunnel started and you need to remove > >the corresponding imap/pop lines from /etc/inetd.conf > > > >Hope to help :) > > > >Bjorn Robertsson > > > >p.s. I use cyrus so the cyrus config does not need to know imaps if you > >use stunnel. > > > > > > > >>Vaclav, > >> > >>Yesterday we too upgraded our mail server and discovered this change > >>that SuSE quietly introduced. It sounds like you have done the hard > >>part; to configure inetd.conf to support SSL-enabled IMAP and POP you > >>just need lines > >> imaps stream tcp nowait root /usr/sbin/tcpd imapd > >> pop3s stream tcp nowait root /usr/sbin/tcpd ipop3d > >> > >>I've found it very hard to find good documentation on how to set up an > >>IMAP service that does not use plaintext passwords. > >> > >>Bob > >> > >> > >>On Wed, 14 May 2003, Vaclav Brunnhofer wrote: > >> > >> > >> > >>>Being prevented here in this group that the support for 7.2 would > >>>finish in the near future (see another thread), I have purchased and > >>>upgraded to 8.2. > >>> > >>>So far, almost everything is working as expected, expect for IMAP (the > >>>same case would be POP3, if I would not use qpopper). > >>>In the mean time, I have found information that the IMAP rpm, shipped > >>>with 8.2 (IMAP 2002) is a major release, enabling to disable fulltext > >>>passwords for identification. Apparently the rpm shipped with 8.2 is > >>>compiled with this in mind. So far it is good, but I cannot find any > >>>information, how to make it work. I have found that it is necessary to > >>>use starttls - a ssl based authentification. > >>> > >>>Just I cannot find (may be I am using incorrect queries in google) how > >>>to setup the IMAP server - I have found how to configure the clients, > >>>how to compile IMAP for disabling authetification by plaintext > >>>passwords, but I am missing information, how to configure inetd (or > >>>even xinetd) to work with this imap daemon. The same applies for > >>>ipop3, just I have installec qpopper and this works fine. > >>> > >>>SuSE installation support claims it is beyond the scope of > >>>installation support. > >>> > >>>Does anyone know how to make the imap over startls or ssl work? > >>>Thanks a lot > >>> > >>>S pozdravem > >>> > >>>Vaclav Brunnhofer > >>> > >>>======================================================== > >>>======= > >>>| Entomologicky ustav e-mail: vbru(a)entu.cas.cz | > >>>| Akademie Ved Ceske Republiky tel.: 038 7775251 > >>>| > >>>| Branisovska 31 fax: 038 5310354 | > >>>| 370 05 Ceske Budejovice mobil: +420 606 632822 | > >>>======================================================== > >>>====== > >>> > >>> > >>>-- > >>>Check the headers for your unsubscription address > >>>For additional commands, e-mail: suse-security-help(a)suse.com > >>>Security-related bug reports go to security(a)suse.de, not here > >>> > >>> > >>> > >>============================================================== > >>Bob Vickers R.Vickers(a)cs.rhul.ac.uk > >>Dept of Computer Science, Royal Holloway, University of London > >>WWW: http://www.cs.rhul.ac.uk/home/bobv > >>Phone: +44 1784 443691 > >> > >> > >> > >>-- > >>Check the headers for your unsubscription address > >>For additional commands, e-mail: suse-security-help(a)suse.com > >>Security-related bug reports go to security(a)suse.de, not here > >> > >> > > > > > > > > > > ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London WWW: http://www.cs.rhul.ac.uk/home/bobv Phone: +44 1784 443691

1 0

Antw: [suse-security] Problems Understanding SuSEfirewall2
by petry 19 May '03

19 May '03

Hello, as I recognize so far you use active ftp (port 20, ftp-data). IMHO it is a quite large security hole. We only allow passive ftp connections. Try http://slacksite.com/other/ftp.html for some explanation. Greetings Olaf ____________________________________________________ Fa. Prof. Dr. G. Hellberg EDV-Beratung & Softwareengineering Dipl.-Ing. Olaf Petry Sonnenweg 7 D-30171 Hannover Germany Fon: +49 (0)511 / 288 25 90 Fax: +49 (0)511 / 288 25 89 Mobil: +49 (0)177 / 230 22 65 Web: www.DrHellberg.de E-Mail: info(a)DrHellberg.de >>> "remote" <remote(a)leat.ruhr-uni-bochum.de> 19.05.2003 08:31 >>> Hi ! LAN except for the following protocols/ports : pop3, pop3s, http, https, ftp, ftps, smtp, ssh, domain. ... FW_SERVICES_EXT_TCP="20 21 22 25 53 80 110 995"

1 0

haveing spuriouse problems with routing I think some are my
by philt 18 May '03

18 May '03

isp but I am a newbie and hoped you might help here is the symptom May 19 07:19:39 redroute1 kernel: SuSE-FW-ILLEGAL-ROUTING IN=ipsec0 OUT=eth0 SRC=192.168.10.150 DST=192.168.0.47 LEN=84 TOS=0x00 PREC=0x00 TTL=62 ID=147 DF PROTO=ICMP TYPE=8 CODE=0 ID=46600 SEQ=512 May 19 07:19:40 redroute1 kernel: SuSE-FW-ILLEGAL-ROUTING IN=ipsec0 OUT=eth0 SRC=192.168.10.150 DST=192.168.0.47 LEN=84 TOS=0x00 PREC=0x00 TTL=62 ID=148 DF PROTO=ICMP TYPE=8 CODE=0 ID=46600 SEQ=768 It seems sometimes I can ping and sometimes I can not. Most problems seem to take place on a connection after I try to connect to a drive on the right side of the connection from the left here is other information up-client:) # connection to my client subnet coming up # If you are doing a custom version, firewall commands go here. iptables -I FORWARD 1 -o ipsec0 -s 192.168.10.0/24 -d 192.169.0.0/24 -j ACCEPT iptables -I FORWARD 1 -i ipsec0 -s 192.168.0.0/24 -d 192.168.10.0/24 -j ACCEPT ;; down-client:) # connection to my client subnet going down # If you are doing a custom version, firewall commands go here. iptables -D FORWARD -o ipsec0 -s 192.168.10.0/24 -d 192.168.0.0/24 -j ACCEPT iptables -D FORWARD -i ipsec0 -s 192.168.0.0/24 -d 192.168.10.0/24 -j ACCEPT config setup # THIS SETTING MUST BE CORRECT or almost nothing will work; #%defaultroute is okay for most simple cases. interfaces=%defaultroute # Debug-logging controls: "none" for (almost) none, "all" for lots. klipsdebug=all plutodebug=none # Use auto= parameters in conn descriptions to control startup actions. plutoload=%search plutostart=%search # Close down old connection when new one using same ID shows up. uniqueids=yes #Enable NAT-Traversal #nat_traversal=yes conn %default authby=rsasig keyingtries=1 ikelifetime=240m keylife=20m compress=yes disablearrivalcheck=no leftrsasigkey=%cert rightrsasigkey=%cert conn dowagiac-redoak left=12.47.77.50 leftsubnet=192.168.0.0/24 leftcert=redroute1cert.pem right=%defaultroute rightsubnet=192.168.10.0/24 rightcert=redroute10cert.pem # To authorize this connection, but not actually start it, at startup, # uncomment this. auto=add pfs=yes # Copyright (c) 2000-2002 SuSE GmbH Nuernberg, Germany. All rights reserved. # # Author: Marc Heuse <marc(a)suse.de>, 2002 # Please contact me directly if you find bugs. # # If you have problems getting this tool configures, please read this file # carefuly and take also a look into # -> /usr/share/doc/packages/SuSEfirewall2/EXAMPLES ! # -> /usr/share/doc/packages/SuSEfirewall2/FAQ ! # -> /usr/share/doc/packages/SuSEfirewall2/SuSEfirewall2.conf.EXAMPLE ! # # /etc/sysconfig/SuSEfirewall2 # # for use with /sbin/SuSEfirewall2 version 3.1 which is for 2.4 kernels! # # ------------------------------------------------------------------------ # # PLEASE NOTE THE FOLLOWING: # # Just by configuring these settings and using the SuSEfirewall2 you are # not secure per se! There is *not* such a thing you install and hence you # are safed from all (security) hazards. # # To ensure your security, you need also: # # * Secure all services you are offering to untrusted networks (internet) # You can do this by using software which has been designed with # security in mind (like postfix, apop3d, ssh), setting these up without # misconfiguration and praying, that they have got really no holes. # SuSEcompartment can help in most circumstances to reduce the risk. # * Do not run untrusted software. (philosophical question, can you trust # SuSE or any other software distributor?) # * Harden your server(s) with the harden_suse package/script # * Recompile your kernel with the openwall-linux kernel patch # (former secure-linux patch, from Solar Designer) www.openwall.com # * Check the security of your server(s) regulary # * If you are using this server as a firewall/bastion host to the internet # for an internal network, try to run proxy services for everything and # disable routing on this machine. # * If you run DNS on the firewall: disable untrusted zone transfers and # either don't allow access to it from the internet or run it split-brained. # # Good luck! # # Yours, # SuSE Security Team # # ------------------------------------------------------------------------ # # Configuration HELP: # # If you have got any problems configuring this file, take a look at # /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example. # # # All types have to set enable SuSEfirewall2 in the runlevel editor # # If you are a end-user who is NOT connected to two networks (read: you have # got a single user system and are using a dialup to the internet) you just # have to configure (all other settings are OK): 2) and maybe 9). # # If this server is a firewall, which should act like a proxy (no direct # routing between both networks), or you are an end-user connected to the # internet and to an internal network, you have to setup your proxys and # reconfigure (all other settings are OK): 2), 3), 9) and maybe 7), 11), 14) # # If this server is a firewall, and should do routing/masquerading between # the untrusted and the trusted network, you have to reconfigure (all other # settings are OK): 2), 3), 5), 6), 9), and maybe 7), 10), 11), 12), 13), # 14), 20) # # If you want to run a DMZ in either of the above three standard setups, you # just have to configure *additionally* 4), 9), 12), 13), 17), 19). # # If you know what you are doing, you may also change 8), 11), 15), 16) # and the expert options 19), 20), 21), 22) and 23) at the far end, but you # should NOT. # # If you use diald or ISDN autodialing, you might want to set 17). # # To get programs like traceroutes to your firewall to work is a bit tricky, # you have to set the following options to "yes" : 11 (UDP only), 18 and 19. # # Please note that if you use service names, that they exist in /etc/services. # There is no service "dns", it's called "domain"; email is called "smtp" etc. # # *Any* routing between interfaces except masquerading requires to set FW_ROUTE # to "yes" and use FW_FORWARD or FW_ALLOW_CLASS_ROUTING ! # # If you just want to do masquerading without filtering, ignore this script # and run this line (exchange "ippp0" "ppp0" if you use a modem, not isdn): # iptables -A POSTROUTING -t nat -j MASQUERADE -o ippp0 # echo 1 > /proc/sys/net/ipv4/ip_forward # and additionally the following lines to get at least a minimum of security: # iptables -A INPUT -j DROP -m state --state NEW,INVALID -i ippp0 # iptables -A FORWARD -j DROP -m state --state NEW,INVALID -i ippp0 # ------------------------------------------------------------------------ # # 1.) # Should the Firewall run in quickmode? # # "Quickmode" means that only the interfaces pointing to external networks # are secured, and no other. all interfaces not in the list of FW_DEV_EXT # are allowed full network access! Additionally, masquerading is # automatically activated for FW_MASQ_DEV devices. and last but not least: # all incoming connection via external interfaces are REJECTED. # You will only need to configure 2.) and FW_MASQ_DEV in 6.) # Optionally, you may add entries to section 9a.) # # Choice: "yes" or "no", if not set defaults to "no" # FW_QUICKMODE="no" FW_DEV_EXT="ppp0 ipsec0" # # 3.) # Which is the interface that points to the internal network? # # Enter all the network devices here which are trusted. # If you are not connected to a trusted network (e.g. you have just a # dialup) leave this empty. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1 eth1:1" or "" # FW_DEV_INT="eth0" # # 4.) # Which is the interface that points to the dmz or dialup network? # # Enter all the network devices here which point to the dmz/dialups. # A "dmz" is a special, seperated network, which is only connected to the # firewall, and should be reachable from the internet to provide services, # e.g. WWW, Mail, etc. and hence are at risk from attacks. # See /usr/share/doc/packages/SuSEfirewall2/EXAMPLES for an example. # # Special note: You have to configure FW_FORWARD to define the services # which should be available to the internet and set FW_ROUTE to yes. # # Choice: leave empty or any number of devices, seperated by a space # e.g. "tr0", "eth0 eth1 eth1:1" or "" # FW_DEV_DMZ="" # # 5.) # Should routing between the internet, dmz and internal network be activated? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ # # You need only set this to yes, if you either want to masquerade internal # machines or allow access to the dmz (or internal machines, but this is not # a good idea). This option supersedes IP_FORWARD from # /etc/sysconfig/network/options # # Setting this option one alone doesn't do anything. Either activate # massquerading with FW_MASQUERADE below if you want to masquerade your # internal network to the internet, or configure FW_FORWARD to define # what is allowed to be forwarded! # # Choice: "yes" or "no", if not set defaults to "no" # FW_ROUTE="yes" # # 6.) # Do you want to masquerade internal networks to the outside? # REQUIRES: FW_DEV_INT or FW_DEV_DMZ, FW_ROUTE # # "Masquerading" means that all your internal machines which use services on # the internet seem to come from your firewall. # Please note that it is more secure to communicate via proxies to the # internet than masquerading. This option is required for FW_MASQ_NETS and # FW_FORWARD_MASQ. # # Choice: "yes" or "no", if not set defaults to "no" # FW_MASQUERADE="yes" # # You must also define on which interface(s) to masquerade on. This is # normally your external device(s) to the internet. # Most users can leave the default below. # # e.g. "ippp0" or "$FW_DEV_EXT" FW_MASQ_DEV="ppp0" # # Which internal computers/networks are allowed to access the internet # directly (not via proxys on the firewall)? # Only these networks will be allowed access and will be masqueraded! # # Choice: leave empty or any number of hosts/networks seperated by a space. # Every host/network may get a list of allowed services, otherwise everything # is allowed. A target network, protocol and service is appended by a comma to # the host/network. e.g. "10.0.0.0/8" allows the whole 10.0.0.0 network with # unrestricted access. "10.0.1.0/24,0/0,tcp,80 10.0.1.0/24,0/0tcp,21" allows # the 10.0.1.0 network to use www/ftp to the internet. # "10.0.1.0/24,tcp,1024:65535 10.0.2.0/24" is OK too. # Set this variable to "0/0" to allow unrestricted access to the internet. # FW_MASQ_NETS="192.168.0.0/24" # # 7.) # Do you want to protect the firewall from the internal network? # REQUIRES: FW_DEV_INT # # If you set this to "yes", internal machines may only access services on # the machine you explicitly allow. They will be also affected from the # FW_AUTOPROTECT_SERVICES option. # If you set this to "no", any user can connect (and attack) any service on # the firewall. # # Choice: "yes" or "no", if not set defaults to "yes" # # "yes" is a good choice FW_PROTECT_FROM_INTERNAL="no" oice: "yes" or "no", if not set defaults to "yes" # FW_AUTOPROTECT_SERVICES="no" FW_SERVICES_EXT_TCP="53 rsync ssh" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_UPD="500" FW_SERVICES_EXT_IP="50 51" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" # # Common: ssh smtp domain FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="192.168.10.0/24 192.168.0.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="yes" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="192.168.0.0/24,192.168.10.0/24 192.168.10.0/24,192.168.0.0/24" # FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="YES" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" # FW_ALLOW_PING_DMZ="no" # FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" # FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" FW_CUSTOMRULES="" FW_REJECT="no" Thank you for any help you can be. -- Absolute Internet Services (http://www.aiserve.net)

1 0