July 2003 - openSUSE Security - openSUSE Mailing Lists

Problems with k_deflt-2.4.19-329 and IPSEC
by Daniel Nilsson 29 Jul '03

29 Jul '03

All, I upgraded two firewalls to use the new kernel package k_deflt-2.4.19-329 this morning. The upgrade worked fine and the IPSEC tunnel through these firewalls worked fine for a while (about 6 hours). Now the tunnels are down and wont come up again, the kernel is complaining in /var/log/messages: Jul 22 10:55:12 <hostname> pluto[1273]: "maynard-walter" #8: initiating Main Mode to replace #7 Jul 22 10:55:45 <hostname> pluto[1273]: "maynard-walter" #8: ERROR: asynchronous network error report on eth0 for message to <remote ipsec gateway address> port 500, complainant <local firewall ip address>: No route to host [errno 113, origin ICMP type 3 code 1 (not authenticated)] and then later on: Jul 22 14:02:30 <hostname> kernel: ; found spi=0x983262c7, dst=XXX.XXX.XXX.XXX, proto=3/ESP Jul 22 14:02:30 <hostname> kernel: ipsec4_rcv: incoming packet failed policy check; dropped When I try to restart ipsec, I see the following messages: /root# /etc/init.d/ipsec start ipsec_setup: Starting FreeS/WAN IPsec 1.98b... ipsec_setup: Using /lib/modules/2.4.19-4GB/kernel/net/ipv4/ipsec/ipsec.o ipsec_setup: /usr/lib/ipsec/_startklips: line 269: /proc/sys/net/ipsec/inbound_policy_check: No such file or directory I have reverted back to the old kernel, hopefully that will be stable again. Since both machines I upgraded showed that same fault at about the same time, I blame the new kernel... Any thoughts ? Thanks -- Daniel Nilsson Signal Integrity Software Inc.

4 7

Multiport NICs (again...?)
by Arndt Faulhaber 29 Jul '03

29 Jul '03

Hi all! I'm looking for multiport (PCI 32bit, 33MHz) Network interface Cards... (4+ Ports would be great - needed for high availability firewall with DMZ etc.) I found so far: - znyx (4 Port - drivers as source) - SMC (2 Port - drivers in suse 7.1 ... (but later...?)) - intel (2 Port - drivers by intel...) Has anyone any experience with multiport NICs (preferably using SuSE 8.2 stable kernel 2.4.20+) 1000 thanx, cheers, Arndt -- Arndt Faulhaber mailto:arndt.faulhaber@diagnosdata.com

2 1

RE: [suse-security] Re: Problems with a Mail Server and SuSEfirewall2
by subscribe 29 Jul '03

29 Jul '03

There is also a deferred queue to ajust in the /etc/sendmail.cf: O Timeout.hoststatus=30m --- Trond -----Original Message----- From: Rolf Krahl [mailto:rolf@math.uni-bremen.de] Sent: 29. juli 2003 16:59 To: suse-security(a)suse.com Subject: Re: [suse-security] Re: Problems with a Mail Server and SuSEfirewall2 On Tue, 29 Jul 2003, remote wrote: > > Sometimes this is not possible and the mail is saved in a queue. > > Check the SENDMAIL_ARGS parameter in /etc/sysconfig/sendmail for > > something like "-q30m". > > You were right, "-q30m" ist given as an argument in /etc/sysconfig/sendmail. > So, does this argument reroute outgoing mail if there is a problem > with the ISP`s mail server ? If so, what can I do to flush the > resulting queue from time to time, say once a week ? This is just what "-q..." is for. The argument "-q30m" tells sendmail to flush the queue every 30 minutes (e.g. look for mail, that have been queued for some reason or another and retry to send any message found in the queue). So, if this argument was actually given to sendmail before the reboot, then its strange, that you didn't see any try to send the mail. sendmail (in the usual configuration) would have send a warning to the sender if it still failed to send the message after a couple of hours and would have given up to send the message after some days. But this only happens while sendmail tries to resend the message, so if your users didn't see any warning about problems to send mail, it's likely that sendmail actually did not retry to send the mail. (Check your logs!) So maybe, due to some problem, that i'm unable to analyse from here, the "-q30m" didn't make its way to sendmail's command line, although it was given in /etc/sysconfig/sendmail? -- Rolf Krahl <rolf.krahl(a)gmx.net> -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Problems with a Mail Server and SuSEfirewall2
by remote 29 Jul '03

29 Jul '03

Hi all ! I administer a small network of Windows and Linux boxes, which are connected to our ISP via SuSE 8.0 Pro Linux box which acts as router, firewall and mail server. The firewall is SuSEfirewall2, the mail server is sendmail 8.12.2, both pretty much out of the box, I just adapted the SuSEfirewall2- script to my needs (and had enough problems doing so !) A few months ago, our ISP had trouble with their own mail servers which led to mails not being sent at all. However, everything went smoothly after they installed another mail server, no problems since. However, I recently had to reboot my router box, which had been running continuously for months, and after the reboot the my router sent mails which were originally written and sent by users during the time of the ISP mail server problem, but had not been accepted and forwarded by the ISP at that time. I don´t understand this behaviour, especially since the regular e-mail traffic seems to be running without a hitch. I suspect that the firewall somehow blocks another sending of mails if the first one failed, but I don´t see why. Any help would be appreciated. Thanks. _____________________________________________ Dipl.-Ing. Jörg Leicher Ruhr-Universität Bochum Lehrstuhl fuer Energieanlagen und Energieprozesstechnik Gebaeude IB 3/133 D-44780 Bochum Tel: +49 (0) 234 / 32 - 27280 Fax: +49 (0) 234 / 32 - 14227 Email: joerg.leicher(a)leat.ruhr-uni-bochum.de URL: http://www.leat.ruhr-uni-bochum.de _____________________________________________

4 4

IPTABLES Rule for Passive FTP
by Knut Erik Hauslo 29 Jul '03

29 Jul '03

Hi all, I need to create a rule with IPTABLES which only allows passive FTP. The following lines accomplishes this: set IPTABLES = "/usr/sbin/iptables" # Control Connection $IPTABLES -A FORWARD -o eth1 -m state --state NEW -p TCP --sport 1024:65535 --dport ftp -j ACCEPT # Data Connection $IPTABLES -A FORWARD -o eth1 -m state --state NEW -p TCP --sport 1024:65535 --dport 1024:65535 -j ACCEPT There are more rules than only the lines above, but they are intentionally left out. My problem is, that this open the firewall from internal with source port >= 1024 and destination port >= 1024 which typicalliy is used only by passive ftp data connection. This behaviour is by recommendation not wanted. Is there a way to accomplish that data connection only be allowed when FTP control connection has taken place before hand? Cheers Knut Erik

2 1

Re: [suse-security] IPTABLES Rule for Passive FTP
by Marc Samendinger 29 Jul '03

29 Jul '03

> -----Original Message----- > From: Knut Erik Hauslo [mailto:KNUTH@voelcker.com] > Sent: Tuesday, July 29, 2003 2:57 PM > > > Hi all, Hi Knut, > I need to create a rule with IPTABLES which only allows > passive FTP. The > following lines accomplishes this: > > set IPTABLES = "/usr/sbin/iptables" > # Control Connection > $IPTABLES -A FORWARD -o eth1 -m state --state NEW -p TCP --sport > 1024:65535 --dport ftp -j ACCEPT > # Data Connection > $IPTABLES -A FORWARD -o eth1 -m state --state NEW -p TCP --sport > 1024:65535 --dport 1024:65535 -j ACCEPT > > There are more rules than only the lines above, but they are > intentionally left out. No problem, should be enough :) > My problem is, that this open the firewall from internal with source > port >= 1024 and destination port >= 1024 which typicalliy is > used only > by passive ftp data connection. This behaviour is by > recommendation not > wanted. > > Is there a way to accomplish that data connection only be allowed when > FTP control connection has taken place before hand? Yep, my Rules for passive FTP look like this $IPTABLES -A FORWARD -p tcp -s $i --sport 1024:65535 -d $j --dport 21 -m state --state NEW,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -p tcp -s $j --sport 21 -d $i --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -p tcp -s $i --sport 1024:65535 -d $j --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT $IPTABLES -A FORWARD -p tcp -s $j --sport 1024:65535 -d $i --dport 1024:65535 -m state --state RELATED,ESTABLISHED -j ACCEPT Where $i is the ftp client and $j the ftp server. For this to work correctly you need to load the ftp conntrack helper module. > Cheers > Knut Erik HTH marc

1 0

Allow internal Machines to acces an http server on the Firewall
by edvega＠racsa.co.cr 29 Jul '03

29 Jul '03

Hi guys... I had a SuSE 8.0 box acting as a Firewall (with 2 nics)... it also had installed an Apache Web Server, and my problem is that any of my internal Pc's can't reach any service at the Firewall Box. I setup the Firewall Rules using YaST, and even set to don't protect the Firewall from the internal Network... Any clue of how to setup or modify that box in order to allow internal traffic to legitime services provided by the Firewall on my internal Network ? Thanks !! bye --ed

3 2

Re: [suse-security] SuSEfirewall2 & MS/VPN
by Marc Samendinger 28 Jul '03

28 Jul '03

> -----Original Message----- > From: Andy Bennett [mailto:andy@mcrentals.demon.co.uk] > Sent: Monday, July 28, 2003 2:14 PM > > > Hello, Hello Andy, > When you say:- > > > 'You can put the M$ box behind > > a suse firewall if you have an official IP for the box, > too. Then just > > close all exept the PPTP Port and the maschine is as safe as in your > > currently setup it would be (if it would work ;)' > > Do you mean fixed IP address for the SuSEfirewall2 box or the > MS VPN box? In > fact, I have fixed IP addresses for both and they are both publicly > available. So, if my fixed IP address for my MS VPN machine > is 123.456.78.9 > then I should be able to forward packets like so, > > FW_FORWARD="0/0,123.456.78.9,tcp,1723 In addition to tcp 1723 the VPN uses the protocol GRE Take a look at following MS Knowledge Base article http://support.microsoft.com/default.aspx?scid=kb;EN-US;241251 hey that one is really good IMHO ;) *snip* > Rgds > Andy marc

2 1

Re: [suse-security] SuSEfirewall2 & MS/VPN
by Andy Bennett 28 Jul '03

28 Jul '03

Hi, No. Briefly, I have come into the middle of a situation where a someone else has set up a system for a friend of mine in such a way that his MS VPN box is directly connected to the internet alongside his SuSEfirewall2 like this Internet | Exterior router | | SuSEfirewall MS/VPN My first thouht was that the guy had gone mad but then it occurred to me that maybe he knows something I don't. In any event I thought I'd ask here first. I thought it should be possible to simply put something like FW_FORWARD="0/0,192.168.1.2,tcp,1723 as Jorn Ott suggested to forward connections directly to the MS VPN machine and let it handle everything but, like I said, am I missing something? Any help greatly appreciated. Regards Andy On Friday 25 July 2003 17:07, you wrote: > Hi! > > Just one question, do you have the linux firewall > on both ends of the connection? > > CU Lars.

4 8

Problem with freeswan after 2.4.19 kernel update
by Michael Ryan 28 Jul '03

28 Jul '03

Hi list, Since updating our SuSE 8.1 VPN gateway with the latest 2.4.19 kernel update (k_deflt-2.4.19-329), users are reporting problems creating IPsec connections. The following message is repeated in the log during the connection attempt: Jul 27 19:31:50 ns2 kernel: ; found spi=0xb295d8a5, dst=xx.xx.xx.xx, proto=3/ESP Jul 27 19:31:50 ns2 kernel: ipsec4_rcv: incoming packet failed policy check; dropped ... (repeated) ... Any ideas how to fix this? Regards, Michael

2 1