July 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] Loading firewall script on boot time
by Knut Erik Hauslo 31 Jul '03

31 Jul '03

I do not want to continue this debate endlessly, but make my final comments: - as mentioned before, activating the YaST Firewall resulted in unwanted results. Firstly, it would only accept incoming services request if you either had them running on the FW Machine or running a DMZ. Neiter was true in my case. - second: by implementing forwarding with Firwall (masqueraded or not) if was always able to break in on those high ports, used for passive FTP - an third: due to this i was forced to do something else. My final script will only allow HTTP in both directions and FTP outbound with Data Connection (RELATED). Nothing more. Nothing less. And yes, i did probe the ruleset with port scanners. I do agree, that if you have a standard "world" (i.e. Outside - Bad World, Inside - LAN and maybe even DMZ) then there's no point in "reinventing the wheel". But specifications was not standard, at was not subject to change. And finaly: i am a Linux newbie allright, but no computer/security newbie. I never take things for granted, like "oh well, my script runs fine when i start it manually, and it is named xy_firewall i guess the system knows that this must be loaded at boot time too. I don't bother testing after boot time however. Port Scan the system? Why should I? I know it works. Sign here, and good bye." Have a nice day KE -----Original Message----- From: Andy Bennett [mailto:andy@mcrentals.demon.co.uk] Sent: Wednesday, July 30, 2003 6:55 PM To: lars Cc: suse-security(a)suse.com Subject: Re: AW: [suse-security] Loading firewall script on boot time Whilst I accept that it is a requirement of a secure system that the person configuring it understands how it works I hope that you're not seriously suggesting that a greater level of security is achieved by having to recreate every single aspect of a secure system rather than using some of the tools, where appropriate, that are readily available? That isn't true, is it. How secure would Knut have been if he hadn't realised that his firewal script wasn't loading when his machine started up? Having said that the exercise has been worthwhile in that he has gained a greater understanding of his system. The only thing I would add is that he needs to run an external scan of his system to make sure it's as closed as he thinks. Andy

1 0

Re: AW: [suse-security] Loading firewall script on boot time
by Andy Bennett 30 Jul '03

30 Jul '03

Whilst I accept that it is a requirement of a secure system that the person configuring it understands how it works I hope that you're not seriously suggesting that a greater level of security is achieved by having to recreate every single aspect of a secure system rather than using some of the tools, where appropriate, that are readily available? That isn't true, is it. How secure would Knut have been if he hadn't realised that his firewal script wasn't loading when his machine started up? Having said that the exercise has been worthwhile in that he has gained a greater understanding of his system. The only thing I would add is that he needs to run an external scan of his system to make sure it's as closed as he thinks. Andy On Wednesday 30 July 2003 16:28, lars wrote: > exactly that is what I prefer ... yast is fine for the beginning, but as > soon as you have learned enough about the system, it makes you feeling ill > ;-) > > hilsen & greetings > > lars > > > Hi, > > > > No problem... > > > > Regarding the point in question, though, can I just enquire why Knut is > > 'cooking his own' script rather than using the SuSEfirewall and > > custom-script route. It's pretty flexible and you don't need to worry > > about how to start/stop them. > > > > Andy > > > > On Wednesday 30 July 2003 13:17, Maxim Cherniavsky wrote: > >> Andy Bennett wrote: > >>> Hi, > >>> > >>> Isn't this what the yast runlevel editor does for you?? > >> > >> Linux makes people lazy :) > >> > >> Linux boot system is like classical System V, which consist of > >> directrories rc1.d, rc2.d ... (run levels) > >> where you have scripts which begins with "Snn" (statrup script) and > >> "Knn" (kill script) > >> In case of firewall i think the good way to start it after the network > >> is up /etc/init.d/rc3.d/S05network start > >> > >> P.S. I did not mean to offend anybody in any way :) > >> > >>> Andy > >>> > >>> On Wednesday 30 July 2003 11:14, Ulrich Roth wrote: > >>>> Hi, Knut Erik, > >>>> > >>>>> Why is my fwscript not loaded at boot time? When i do these steps > >>>>> manually, it will work. > >>>> > >>>> You should put your script into /etc/rc.d. Then you have to > >>>> create a symbolic link in /etc/rc.d/rcX.d which points to your script. > >>>> X is the number of your default runlevel. If you don't know your > >>>> default runlevel, you can have a look at /etc/inittab. There it is > >>>> defined. The name of the link should begin with S and a high number, > >>>> e.g. S99, because it should be the last script to be executed. > >>>> But take care if you install any additional packets afterwards. > >>>> The system will compute the sequence of the startup scripts > >>>> again, and your script will then start with S00. This is because > >>>> some info in your script is missing which tells the system, namely > >>>> the program insserv, which other scripts/services/daemons have > >>>> to be started before. I haven't gone very deep into this subject yet. > >>>> If the SuSE guys have additional info, I appreciate it. > >>>> Bye > >>>> Uli > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Deny IP address's
by Mark Perry 30 Jul '03

30 Jul '03

Hi All, the idea seems sound to me, however shouldn't these new rules be insert at the beginning of the INPUT chain using "iptables -I" rather than "iptables -A"? (Otherwise there is the possibility that an earlier rule make actually accept the packet.) In either case if a script why not use the power of scripting to simplify the task, pass the ip address(es) as parms to the script and use a for loop to index through each passed ip address: #!/bin/bash for x in $@ do iptables -I blah blah blah -s $x blah blah blah done Such a script could then be invoked whenever necessary and with as many ip addresses as required. All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 Nigel Gaylard wrote: >Hi All > >I would like to create a list of IP address's that should be denied all >access to my server. I have currently 2 or 3 people making a deliberate >effort to hack into my SSH port, and so I would like to deny them access to >it at firewall level, as well as all other ports. The following may do the trick and log and drop all attacks coming in through the INPUT chain, FROM THE SPECIFIED IP ADDRESSES ONLY. You should be able to add this to your existing Firewall rules. i.e. don't clear what you already have in IPtables rules. Just make this into an executable script and run it WITHOUT flushing your current rules. ================================================== THIS IS JUST A QUICK FIX - MAY NEED TO BE MODIFIED ** TEST FIRST AND USE AT YOUR OWN RISK!!! ** ================================================== (Replace ip.address(n).to.block with the known IP address of each suspected attacker). # Log attack attempts from know IP address1 IPTABLES -A INPUT -s ip.address1.to.block -j LOG \ --log-prefix 'DROPPED PKTS FROM ip.address1.to.block ' # drop ALL packets from this address1 IPTABLES -A INPUT -s ip.address1.to.block -j DROP # Log attack attempts from know IP address2 IPTABLES -A INPUT -s ip.address2.to.block -j LOG \ --log-prefix 'DROPPED PKTS FROM ip.address2.to.block ' # drop ALL packets from this address2 IPTABLES -A INPUT -s ip.address2.to.block -j DROP # Log attack attempts from know IP address3 IPTABLES -A INPUT -s ip.address3.to.block -j LOG \ --log-prefix 'DROPPED PKTS FROM ip.address3.to.block ' # drop ALL packets from this address3 IPTABLES -A INPUT -s ip.address3.to.block -j DROP see man iptables for more information if required. HTH - Keith Roberts -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

AW: [suse-security] Loading firewall script on boot time
by Ulrich Roth 30 Jul '03

30 Jul '03

Hi, Knut Erik, > Why is my fwscript not loaded at boot time? When i do these steps > manually, it will work. You should put your script into /etc/rc.d. Then you have to create a symbolic link in /etc/rc.d/rcX.d which points to your script. X is the number of your default runlevel. If you don't know your default runlevel, you can have a look at /etc/inittab. There it is defined. The name of the link should begin with S and a high number, e.g. S99, because it should be the last script to be executed. But take care if you install any additional packets afterwards. The system will compute the sequence of the startup scripts again, and your script will then start with S00. This is because some info in your script is missing which tells the system, namely the program insserv, which other scripts/services/daemons have to be started before. I haven't gone very deep into this subject yet. If the SuSE guys have additional info, I appreciate it. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

4 4

RE: AW: [suse-security] Loading firewall script on boot time
by Knut Erik Hauslo 30 Jul '03

30 Jul '03

Oh i do like to cook ;-) Humor aside: my problem was, I only got this very exotic thing working with masquerading. I sort of got it working without masquerading too, but it was still "to open", i.e. if i used forwarding, my high ports for FTP data connection was open not only when needed. The specs was: http both directions and ftp (passive) only outbound. No services on firewall, nothing else! Of course would I have appreciated it if i could go along with SuSEs FW2 script, that would have saved me endless hours of thinking, trying, failing, frustrating, writing e-mails to this list etc. But, on the other side, during this "voyage" I have learned a lot on how to configure firewalls on SuSE with IPTABLES and I have won a lot more insight on Linux in general. Many people out there have given me - Linux Newbie - very useful tips. Thank You all! And by the way my script now start at boot time... I change the first line in my fw-script to read #!/bin/sh and boot.load and it does just fine. I only wonder why it takes so awfully long time from logging on until KDE loads and is ready to use. Not always, but sometimes... At least it does what it is told to. Cheers Knut Erik -----Original Message----- From: Andy Bennett [mailto:andy@mcrentals.demon.co.uk] Sent: Wednesday, July 30, 2003 4:44 PM To: maxim(a)mtu.ru Cc: Ulrich Roth; suse-security(a)suse.com Subject: Re: AW: [suse-security] Loading firewall script on boot time Hi, No problem... Regarding the point in question, though, can I just enquire why Knut is 'cooking his own' script rather than using the SuSEfirewall and custom-script route. It's pretty flexible and you don't need to worry about how to start/stop them. Andy On Wednesday 30 July 2003 13:17, Maxim Cherniavsky wrote: > Andy Bennett wrote: > >Hi, > > > >Isn't this what the yast runlevel editor does for you?? > > Linux makes people lazy :) > > Linux boot system is like classical System V, which consist of > directrories rc1.d, rc2.d ... (run levels) where you have scripts > which begins with "Snn" (statrup script) and "Knn" (kill script) > In case of firewall i think the good way to start it after the network is > up /etc/init.d/rc3.d/S05network start > > P.S. I did not mean to offend anybody in any way :) > > >Andy > > > >On Wednesday 30 July 2003 11:14, Ulrich Roth wrote: > >>Hi, Knut Erik, > >> > >>>Why is my fwscript not loaded at boot time? When i do these steps > >>>manually, it will work. > >> > >>You should put your script into /etc/rc.d. Then you have to create a > >>symbolic link in /etc/rc.d/rcX.d which points to your script. X is > >>the number of your default runlevel. If you don't know your default > >>runlevel, you can have a look at /etc/inittab. There it is defined. > >>The name of the link should begin with S and a high number, e.g. > >>S99, because it should be the last script to be executed. But take > >>care if you install any additional packets afterwards. The system > >>will compute the sequence of the startup scripts again, and your > >>script will then start with S00. This is because some info in your > >>script is missing which tells the system, namely the program > >>insserv, which other scripts/services/daemons have to be started > >>before. I haven't gone very deep into this subject yet. If the SuSE > >>guys have additional info, I appreciate it. Bye > >> Uli -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] Problem with freeswan after 2.4.19 kernel update
by Michael Ryan 30 Jul '03

30 Jul '03

Dieter, Thanks :) have since had a look at the SuSE support pages (http://www.suse.de/en/private/download/updates/81_i386.html) and ... 'The kernel update for SuSE Linux 8.1 from June 2003 (2.4.19-308) broke FreeS/WAN. The reason is that the CGL features (USAGI patches) that provide superior IPv6 support introduce incompatibilities in the pfkey interface that IPsec uses. This package has been adatped to work with the new kernel (but unfortunately not with the old one.) Furthermore, IP compression support has been dropped' ... so I guess, either revert to the old kernel or better still, update the freeswan packages - will post back if the latter approach works. Best Regards, Michael -----Original Message----- From: Dieter Kirchner [mailto:dkirchner@bupnet.de] Sent: Monday, July 28, 2003 12:55 PM To: suse-security(a)suse.com Cc: Karl Flannery Subject: Re: [suse-security] Problem with freeswan after 2.4.19 kernel update Hi, >Since updating our SuSE 8.1 VPN gateway with the latest 2.4.19 kernel >update (k_deflt-2.4.19-329), users are reporting problems creating >IPsec connections. >Any ideas how to fix this? Did you reboot ? If not, try this first. If "depmod -a" after reboot shows errors, wait for the fix by SuSE (they messed up this update AFAIK) or compile a new kernel by yourself. Download for the necessary kernel-patches the super-freeswan (1.98 or so) package, download kernelsource, decompress both, configure your kernel, change into the super-freeswan source dir, issue a "make insert" to generate links and patches, configure the kernel again (this time ipsec will show up), compile and install the kernel and modules, reboot. This procedure worked for me. If you do not configure the kernel before "make insert" the script will complain (it work anyway, I did not test this). This will fix the broken mppe of SuSE also, for usage with pptpd, if you like to use this kind of VPN also make sure you have "bsd-compress" option for ppp enabled too. Regards, Dieter --------------------------------------------------------------- Dieter Kirchner Systemadministration BUPNET +49 551 54707 62 D-Goettingen http://www.bupnet.de --------------------------------------------------------------- -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Loading firewall script on boot time
by Knut Erik Hauslo 30 Jul '03

30 Jul '03

Hello again, I edited my /etc/init.d/boot.local to change directory - where my FW script is - and issued a ./fwscript command: #!/bin/tcsh cd /fwscript ./fwscript Why is my fwscript not loaded at boot time? When i do these steps manually, it will work. Also, I wanted to add some logging when my script is starting, like: echo "doing step X of Y steps" > /fwscript/logfile Unfortunately, every new echo i issue will overwrite the previous file. Is there a way to accomplish this (im sure it is but have not found out how)? Cheers Knut Erik

3 2

RE: [suse-security] IPTABLES Rule for Passive FTP
by Knut Erik Hauslo 30 Jul '03

30 Jul '03

Hmm... My script lacked the ip_conntack_ftp module, and after I added it to my script, it was no longer possible to initiate communication with SPORT >= 1024 and DPORT>=1024 unless it is related and that's how it should behave :-) But now, active ftp has become possible again ... :-S My script looks like this: #!/bin/tcsh # # ------------------------------- # Declare Variables set IPTABLES="/usr/sbin/iptables" set HighPorts = 1024:65535 set EXT = eth1 set INT = eth0 set IF = ($EXT $INT) set INTERNAL = 172.19.0.0/16 set EXTERNAL = 192.168.6.0/24 set LOGHOST = 172.19.2.2 # ------------------------------- # Required Configuration - generall echo "0" > /proc/sys/net/ipv4/ip_forward echo "1" > /proc/sys/net/ipv4/tcp_syncookies echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses /sbin/modprobe ip_conntrack_ftp # Configure Interfaces foreach if ($IF) echo "1" > /proc/sys/net/ipv4/conf/$if/rp_filter echo "0" > /proc/sys/net/ipv4/conf/$if/accept_redirects echo "0" > /proc/sys/net/ipv4/conf/$if/accept_source_route echo "0" > /proc/sys/net/ipv4/conf/$if/bootp_relay echo "1" > /proc/sys/net/ipv4/conf/$if/log_martians end # ------------------------------------- # Default Policy and Flushing of chains $IPTABLES -P INPUT DROP $IPTABLES -P FORWARD DROP $IPTABLES -P OUTPUT DROP $IPTABLES -F $IPTABLES -t nat -F $IPTABLES -X # ------------------------------------- # Allow local processes $IPTABLES -A OUTPUT -o lo -j ACCEPT $IPTABLES -A INPUT -i lo -j ACCEPT # ------------------------------------- # Logging $IPTABLES -A INPUT -p UDP --dport 137 -j DROP $IPTABLES -A INPUT -p UDP --dport 138 -j DROP $IPTABLES -A INPUT -p UDP --dport 139 -j DROP $IPTABLES -A INPUT -p TCP --dport 137 -j DROP $IPTABLES -A INPUT -p TCP --dport 138 -j DROP $IPTABLES -A INPUT -p TCP --dport 139 -j DROP $IPTABLES -A INPUT -p IP -d 172.19.255.255 -j DROP $IPTABLES -A INPUT -p IP -d 255.255.255.255 -j DROP $IPTABLES -N DropList $IPTABLES -A DropList -p ICMP -j LOG --log-prefix "DROP ICMP: " $IPTABLES -A DropList -p UDP -j LOG --log-prefix "DROP UDP : " $IPTABLES -A DropList -p TCP -j LOG --log-prefix "DROP TCP : " $IPTABLES -A DropList -j DROP # -------------------------------------- echo "1" > /proc/sys/net/ipv4/ip_forward # -------------------------------------------------- # Outbound packets, allready established connections $IPTABLES -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -i $INT -o $EXT -m state --state ESTABLISHED,RELATED -j ACCEPT # ---------------------------------------------------------- # Inbound packets, allready established outbound connections $IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A INPUT -m state --state NEW,INVALID -j DropList $IPTABLES -A FORWARD -i $EXT -o $INT -m state --state ESTABLISHED,RELATED -j ACCEPT $IPTABLES -A FORWARD -i $EXT -o $INT -m state --state INVALID -j DropList # ---------- # Syslogging $IPTABLES -A OUTPUT -o $INT -m state --state NEW -p UDP --sport syslog -d $LOGHOST --dport syslog -j ACCEPT # ------------------ # Forwarding Packets # HTTP - both directions are allowed $IPTABLES -A FORWARD -m state --state NEW -p TCP --dport http -j ACCEPT # Passive FTP, Outbound Control Connection $IPTABLES -A FORWARD -o $EXT -m state --state NEW -p TCP --sport $HighPorts --dport ftp -j ACCEPT # Data Connection $IPTABLES -A FORWARD -o $EXT -m state --state ESTABLISHED,RELATED -p TCP --sport $HighPorts --dport $HighPorts -j ACCEPT # --------------------------------- # What's not explicit allowed, deny $IPTABLES -A INPUT -j DropList $IPTABLES -A FORWARD -j DropList $IPTABLES -A OUTPUT -j DropList # End of script -----Original Message----- From: Marc Samendinger [mailto:marc.samendinger@sp-online.de] Sent: Tuesday, July 29, 2003 3:33 PM To: suse-security(a)suse.com Subject: Re: [suse-security] IPTABLES Rule for Passive FTP ... SNIP ... > I need to create a rule with IPTABLES which only allows > passive FTP. The > following lines accomplishes this: > ... SNIP ... > My problem is, that this open the firewall from internal with source > port >= 1024 and destination port >= 1024 which typicalliy is used > only by passive ftp data connection. This behaviour is by > recommendation not > wanted. > > Is there a way to accomplish that data connection only be allowed when > FTP control connection has taken place before hand? Yep, my Rules for passive FTP look like this $IPTABLES -A FORWARD -p tcp -s $i --sport 1024:65535 -d $j --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -p tcp -s $j --sport 21 -d $i --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -p tcp -s $i --sport 1024:65535 -d $j --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -p tcp -s $j --sport 1024:65535 -d $i --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT Where $i is the ftp client and $j the ftp server. For this to work correctly you need to load the ftp conntrack helper module.

1 0

Re: [suse-security] Deny IP address's
by keith＠topaz5.worldonline.co.uk 29 Jul '03

29 Jul '03

Nigel Gaylard wrote: >Hi All > >I would like to create a list of IP address's that should be denied all >access to my server. I have currently 2 or 3 people making a deliberate >effort to hack into my SSH port, and so I would like to deny them access to >it at firewall level, as well as all other ports. The following may do the trick and log and drop all attacks coming in through the INPUT chain, FROM THE SPECIFIED IP ADDRESSES ONLY. You should be able to add this to your existing Firewall rules. i.e. don't clear what you already have in IPtables rules. Just make this into an executable script and run it WITHOUT flushing your current rules. ================================================== THIS IS JUST A QUICK FIX - MAY NEED TO BE MODIFIED ** TEST FIRST AND USE AT YOUR OWN RISK!!! ** ================================================== (Replace ip.address(n).to.block with the known IP address of each suspected attacker). # Log attack attempts from know IP address1 IPTABLES -A INPUT -s ip.address1.to.block -j LOG \ --log-prefix 'DROPPED PKTS FROM ip.address1.to.block ' # drop ALL packets from this address1 IPTABLES -A INPUT -s ip.address1.to.block -j DROP # Log attack attempts from know IP address2 IPTABLES -A INPUT -s ip.address2.to.block -j LOG \ --log-prefix 'DROPPED PKTS FROM ip.address2.to.block ' # drop ALL packets from this address2 IPTABLES -A INPUT -s ip.address2.to.block -j DROP # Log attack attempts from know IP address3 IPTABLES -A INPUT -s ip.address3.to.block -j LOG \ --log-prefix 'DROPPED PKTS FROM ip.address3.to.block ' # drop ALL packets from this address3 IPTABLES -A INPUT -s ip.address3.to.block -j DROP see man iptables for more information if required. HTH - Keith Roberts

1 0

3M Volition NIC's in a SuSE 8.2
by Simon Hoerder 29 Jul '03

29 Jul '03

Hi, some friends of mine and I are managing the network of a student's residence and our predecessors decided to use the 3M Volition fibre system instead of twisted pair. Right now we'd like to setup a new server with a SuSE 8.2. The only problem ist that we can't get the 3M Volition NIC's to work. Has anyone ever tried this successfully? Many Thanks, Simon

1 0