June 2003 - openSUSE Security - openSUSE Mailing Lists

Amavis / Sendmail Problem
by Uwe Boigs 17 Jun '03

17 Jun '03

Hi there, I'm running a SuSE 7.2 as a Mail-Server. Since my last OnlineUpdate, which updated sendmail, I have the problem, that amavis is not started anymore. "rcamavis satus" tells me "amavis:OK", but the following thing is in the /var/log/boot.msg Starting virus-scanning for sendmail (amavis)<notice>startproc: execve (/usr/sbin/amavis-milter) [ /usr/sbin/amavis-milter -p local:/var/run/amavis.sock failed ], [ PWD=/ BOOT_FILE=/boot/vmlinuz HOSTNAME=bart CONSOLE=/dev/console PREVLEVEL=N AUTOBOOT=YES MACHTYPE=i386-suse-linux LINES=25 SHLVL=2 COLUMNS=80 BOOT_IMAGE=linux SHELL=/bin/bash HOSTTYPE=i386 OSTYPE=linux HOME=/ TERM=linux PATH=/sbin:/bin:/usr/sbin:/usr/bin RUNLEVEL=3 INIT_VERSION=sysvinit-2.78 _=/sbin/startproc DAEMON=/usr/sbin/amavis-milter ] done Does anybody have a clue what happened there? I use Sophos sweep for scanning and it works. I even checked /usr/sbin/amavis for changes but everything looks perfect. Thanks Uwe

2 5

SuSE 8.2 and DSL: SuSeFirewall2 not working properly
by Reinhard Moosauer 16 Jun '03

16 Jun '03

Hello List, I have used SuSEfirewall2 with ISDN successfully for some time. Now I changed to DSL. I configured DSL via YaST2 and activated the firewall-checkbox. Everything worked for the first time, but later I noticed it activated QUICKMODE for my dsl line. (Which I do not use!) Then I removed the firewall-checkbox and the firewall-script isn't called anymore at all. Now I call SuSEfirewall2 from a script /etc/ppp/ip-up.d/firewall.sh That helps. But what is wrong here? In "ip-up" I see that SuSEfirewall cannot be called because ifcfg-dsl0 is not sourced and FIREWALL is not set. For ippp*-devices it is. Any Hint would be great! Thanks, Reinhard

1 0

SuSE 8.2 und NAT-Traversal...
by Arndt Faulhaber 16 Jun '03

16 Jun '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi There, has anyone tried to use NAT-T with SuSE 8.2???? They compiled the NAT-T support into freeS/WAN, but not into the kernel... well, that's ok for me but trying to patch the SuSE-provided kernel-sources turned out that in kernel-source-2.4.20.SuSE-62.rpm there is no support for IPSEC anywhere... that leaves me with a big ? What am I supposed to patch? According to /usr/share/doc/packages/freeswan/README.SuSE I should patch the kernel... nice but which one - a vanilla kernel, so that all the other nice patches SuSE has put into the kernel are gone and most stuff stops working... or the kernelbinaries... (I suppose not...) Any ideas? Would be soooooo cool if someone could help (I'm now getting into the n-th week of trying to get that VPN-stuff working properly - I think I could write a book about VPN by now...) 1000 thanks for any input that gets me closer to the solution and almost as many for the other answers ;))) Cheers, Arndt - -- Arndt Faulhaber mailto:arndt.faulhaber@diagnosdata.com gpg-pubkey: http://www.rzuser.uni-heidelberg.de/~afaulhab/arndt.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQE+7JdEEin8GFiSP10RAgV5AJ43YX+K6l/v3fUTrwxpH0D5wuuGNACcCSs+ xNscvwEOD16fI6AFgz0ICIY= =3lmO -----END PGP SIGNATURE-----

5 4

susefirewall2 FW_FORWARD_MASQ???
by bergler＠eca.de 16 Jun '03

16 Jun '03

Hello i have one server with SUSEFIREWALL2 and apache webserver with extern IP address. Behind we have a second server with a intern ip address The firewall server has 2 network cards eth0=62.139.10.68 eth0:0=62.139.10.70 eth1=192.138.7.12 the second server has eth0=192.138.7.14 internet() <---->firewall(62.139.10.64/28)<---->webserver(62.139.10.68) ^ | 192.138.7.14 (second webserver) In the past i use a iptables rule to access the intern webserver echo 1 > /proc/sys/net/ipv4/ip_forward iptables -A PREROUTING -t nat -p tcp -d 62.139.10.70 --dport 80 -j DNAT --to 192.168.7.14:80 iptables -A OUTPUT -t nat -p tcp -d 62.139.10.70 --dport 80 -j DNAT --to 192.168.7.14:80 so i can access the intern server via the 62.139.10.70 Now i want to do the same with the SUSEFIREWALL2, but i can get it work I tried since two days without success, hopefully someone can show me the right direction, a simple example would be very helpful. i try FW_FORWARD_MASQ="62.138.10.70,192.168.7.14,tcp,80" but if add the netmask "/1" all traffic will be linked to the internet server. Howto set the netmask for only on IP Address?? It tried to add my old iptables rule to the SUSECUSTOMRULE FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-mycustom" but the firewall block it. Maybe i have to use FW_REDIRECT="62.139.10.70,192.168.7.14,tcp,80,80 192.168.7.14,62.139.10.70,tcp,80,80" but meanwhile i'm totally confused and ask for help Thank you Manfred

1 0

nmap -> 3306/tcp filtered
by Sebastian Rose 16 Jun '03

16 Jun '03

Hi List, I'm using SuSe 8.0 as firewall/gateway. From another location i tried nmap checking open ports. nmap shows: 22/tcp open <-- ok, right... 3306/tcp filtered <-- ? I did not found any program or process listening or using that port... (lsof,netstat,usw.) google told me about problems with firewall rules. Using reject means that nmap interprets something on that port caused by an SYN-Packet. But there is no rule on port 3306 in my handwritten iptables config. Regards S. Rose

4 3

RE: [suse-security] susefirewall2 FW_FORWARD_MASQ???
by Harro Vos 16 Jun '03

16 Jun '03

<snip> >i try >FW_FORWARD_MASQ="62.138.10.70,192.168.7.14,tcp,80" >but if add the netmask "/1" all traffic will be linked to the >internet server. >Howto set the netmask for only on IP Address?? You probably want a netmask /32, which tells you that all 32 bits have to equal the ip-address. With a /1 mask you would say: Only most significant bit in IP-address is obligatory, the rest: don't care! H.t.h. Harro

1 0

Port forwarding
by Olsson Mattias 16 Jun '03

16 Jun '03

Hi all! Im running SuSE 8.1 with SuSEfirewall at home. Works nice but i wish to do a port forwarding from my external masq. ethernet device to on internal machine. Can that be done with 8.1? Eg -----> http --> external masq dev. ---> internal web server port 80 What is the syntax? Regards /Mattias

3 2

chroot, su and sudo
by Mario Ohnewald 16 Jun '03

16 Jun '03

Hello! I want to chroot a application/gameserver. What is the better/securest way? 1.) "Chroot /path" and then do a "su -s /bin/sh user -c start.sh" or 2.) "su -s /bin/sh user" and then do the "chroot /path" as normal user and execute the "start.sh" in the chroot? Solution 2 does not need a root shell at all, why i think it is a little more secure. What do you think? WHat do u recommend? How would do solve this? Cheers, Mario

2 1

Re: [suse-security] chroot, su and sudo
by GentooRulez 16 Jun '03

16 Jun '03

Or, more complete, you may wanna try this http://www.gcf.de/papers/quota.txt Michael

1 0

Re: [suse-security] chroot, su and sudo
by GentooRulez 16 Jun '03

16 Jun '03

May be you wanna test that: http://www.gsyc.inf.uc3m.es/~assman/jail/index.html Michael

1 0