July 2003 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 not logging dropped packets
by Volker Kuhlmann 26 Jul '03

26 Jul '03

Am I the only one who finds that SuSEfirewall2 (SuSE 8.2, latest patches) doesn't log packets in some situations? Most of the times I want to know which ports/etc are dropped, the log is empty, but the packets don't arrive. After SuSEfirewall2 stop the packets arrive. To be clear, this is with FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" Volker -- Volker Kuhlmann is possibly list0570 with the domain in header http://volker.dnsalias.net/ Please do not CC list postings to me.

1 0

SuSEfirewall2 & MS/VPN
by Andy Bennett 25 Jul '03

25 Jul '03

Hi, Is it possible for an MS/PPTP VPN to go through SuSEfirewall2 using IP forwarding in much the same as it is possible to forward connections through a SuSEfirewall2 machine to a machine running a web server like this:- FW_FORWARD="0/0,192.168.1.2,tcp,80 Or does the MS VPN machine need to be accessible from the internet, i.e. bypassing the SuSEfirewall machine altogether. Any help greatly appreciated. Regards Andrew Bennett

2 1

RE: [suse-security] IPTABLES Command slows down the machine
by Knut Erik Hauslo 25 Jul '03

25 Jul '03

Hmmm... Things seems to be stable now. I need to thank all the people out there who have contributed with a lot of helpful hints and tips. Also, I think i learned my lesson today. I have been designing the rules on a completely wrong assumption. What I did not quite understand, until few minutes ago, was how the IPTABLES work. Then I came to think of this: when an FTP client initiates a passive session it will only talk to the firewall because it will most probably not know the real IP of the destination. Only in my "little" world, i do know it. So this got me thinking... When I only "talk" to the firewall, it's by definition a INPUT rule which leads to some processing before it eventually goes to the OUTPUT chain an then eventually leaves the firewall. All the time, i designed FORWARD chains.... Oh well, crash course linux ... A newbies life is not easy, and TGIF... Cheers and have a nice week end all Knut Erik -----Original Message----- From: Mark Perry [mailto:PERRY@de.ibm.com] Sent: Friday, July 25, 2003 2:53 PM To: Knut Erik Hauslo Subject: RE: [suse-security] IPTABLES Command slows down the machine Best would be to add some logging. Add something similar to these statements to the end of your script: iptables --append INPUT \ --jump LOG \ --log-level info \ --log-prefix "iptables t=INPUT:" iptables --append OUTPUT \ --jump LOG \ --log-level info \ --log-prefix "iptables t=OUTPUT:" iptables --append FORWARD \ --jump LOG \ --log-level info \ --log-prefix "iptables t=FORWARD:" Providing you don't have any DROP rules before these statements then anything about to reach the default DROP policy will get LOG'ed. Then depending how your /etc/syslog.conf has been setup you will see these logged messages probably in /var/log/messages. NOTE: the above can be much more sophisticated, but a basic log will be better than none ;-) All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626

1 0

RE: [suse-security] IPTABLES Command slows down the machine
by Mark Perry 25 Jul '03

25 Jul '03

-i $lo do you mean -i lo , or from your previous script: -i $LO_IFACE All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 |---------+----------------------------> | | "Knut Erik | | | Hauslo" | | | <KNUTH(a)voelcker.c| | | om> | | | | | | 25/07/2003 13:37 | | | | |---------+----------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | | | To: Mark Perry/Germany/Contr/IBM@IBMDE | | cc: <suse-security(a)suse.com> | | Subject: RE: [suse-security] IPTABLES Command slows down the machine | | | >-------------------------------------------------------------------------------------------------------------------------------| Well, after addiing "$IPTABLES -a INPUT -i $lo -j ACCEPT" and rebooting, speed have not improved... By the way, if I manually start the script (not via /etc/init.d/boot.local) things are performing at normal speed.... :-S (confused smiley) Cheers Knut Erik -----Original Message----- From: Mark Perry [mailto:PERRY@de.ibm.com] Sent: Friday, July 25, 2003 1:20 PM To: Knut Erik Hauslo Cc: suse-security(a)suse.com Subject: RE: [suse-security] IPTABLES Command slows down the machine I don't see any allowance for INPUT on IFC=lo? I always start my scripts by allowing the local loopback interface - I'll allow others on the List to make the own comments ;-) But here's how my iptable scripts start: # # Enable all I/O to/from the local loopback interface # iptables --append INPUT \ --in-interface lo \ --jump ACCEPT iptables --append OUTPUT \ --out-interface lo \ --jump ACCEPT #--------------------------------# # # Establish our harsh drop-all default policies # iptables --policy INPUT DROP iptables --policy OUTPUT DROP iptables --policy FORWARD DROP <SNIP> -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] IPTABLES Command slows down the machine
by Knut Erik Hauslo 25 Jul '03

25 Jul '03

Well, after addiing "$IPTABLES -a INPUT -i $lo -j ACCEPT" and rebooting, speed have not improved... By the way, if I manually start the script (not via /etc/init.d/boot.local) things are performing at normal speed.... :-S (confused smiley) Cheers Knut Erik -----Original Message----- From: Mark Perry [mailto:PERRY@de.ibm.com] Sent: Friday, July 25, 2003 1:20 PM To: Knut Erik Hauslo Cc: suse-security(a)suse.com Subject: RE: [suse-security] IPTABLES Command slows down the machine I don't see any allowance for INPUT on IFC=lo? I always start my scripts by allowing the local loopback interface - I'll allow others on the List to make the own comments ;-) But here's how my iptable scripts start: # # Enable all I/O to/from the local loopback interface # iptables --append INPUT \ --in-interface lo \ --jump ACCEPT iptables --append OUTPUT \ --out-interface lo \ --jump ACCEPT #--------------------------------# # # Establish our harsh drop-all default policies # iptables --policy INPUT DROP iptables --policy OUTPUT DROP iptables --policy FORWARD DROP <SNIP>

1 0

RE: [suse-security] IPTABLES Command slows down the machine
by Mark Perry 25 Jul '03

25 Jul '03

I don't see any allowance for INPUT on IFC=lo? I always start my scripts by allowing the local loopback interface - I'll allow others on the List to make the own comments ;-) But here's how my iptable scripts start: # # Enable all I/O to/from the local loopback interface # iptables --append INPUT \ --in-interface lo \ --jump ACCEPT iptables --append OUTPUT \ --out-interface lo \ --jump ACCEPT #--------------------------------# # # Establish our harsh drop-all default policies # iptables --policy INPUT DROP iptables --policy OUTPUT DROP iptables --policy FORWARD DROP Also I normally specify the interface on *most* of my rules. Anyway thats my first impression, not given any LOG'ed records to review. All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 |---------+----------------------------> | | "Knut Erik | | | Hauslo" | | | <KNUTH(a)voelcker.c| | | om> | | | | | | 25/07/2003 12:56 | | | | |---------+----------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | | | To: Mark Perry/Germany/Contr/IBM@IBMDE | | cc: <suse-security(a)suse.com> | | Subject: RE: [suse-security] IPTABLES Command slows down the machine | | | >-------------------------------------------------------------------------------------------------------------------------------| I am only allowing ports 21 and 80 outbound, and 80 inbound (customer specs - plz do not comment on this, i know it weird but they are somewhat paranoid). But your hint, regarding DNS got me checking the DNS settings. I had forgotten to remove a DNS server that's no longer active. A reboot after removal of DNS-Server setting did not show any improvements... My script looks as follows: #!/bin/sh # # Initial SIMPLE IP Firewall script # iptables -F iptables -X iptables -Z INET_IP="192.168.1.254" INET_IFACE="eth1" INET_BROADCAST="192.168.1.255" LAN_IP="172.19.6.254" LAN_IP_RANGE="172.16.0.0/16" LAN_IFACE="eth0" LO_IFACE="lo" LO_IP="127.0.0.1" IPTABLES="/usr/sbin/iptables" /sbin/depmod -a /sbin/modprobe ip_tables /sbin/modprobe ip_conntrack /sbin/modprobe iptable_filter /sbin/modprobe iptable_mangle /sbin/modprobe iptable_nat /sbin/modprobe ipt_LOG /sbin/modprobe ipt_limit /sbin/modprobe ipt_state /sbin/modprobe ip_conntrack_ftp echo "1" > /proc/sys/net/ipv4/ip_forward $IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP $IPTABLES -P FORWARD DROP # INPUT Rules # Need not be activated as we have no services running on local machine # Security Tests are to come # FORWARD Rules $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # HTTP-Requests outbound $IPTABLES -A FORWARD -p TCP -s 172.19.0.0/16 -d 192.168.1.0/24 --dport 80 -j ACCEPT # HTTP Requests inbound $IPTABLES -A FORWARD -p TCP -s 192.168.1.0/24 -d 172.19.0.0/16 --dport 80 -j ACCEPT # Settings for active FTP # FTP Control Connection outbound $IPTABLES -A FORWARD -p TCP -s 172.19.0.0/16 -d 192.168.1.0/24 --dport 21 -j ACCEPT # FTP Data Connection inbound - comment next line if only passive FTP is going to be used $IPTABLES -A FORWARD -p TCP -s 192.168.1.0/24 --sport 20 -d 172.19.0.0/16 --dport 1024: -j ACCEPT # Settings for passive FTP # FTP Data Connection outbound $IPTABLES -A FORWARD -p TCP -s 172.19.0.0/16 --sport 1024: -d 192.168.1.0/24 --dport 1024: -j ACCEPT # OUTPUT Rules $IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT $IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT $IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT -----Original Message----- From: Mark Perry [mailto:PERRY@de.ibm.com] Sent: Friday, July 25, 2003 12:27 PM To: Knut Erik Hauslo Cc: suse-security(a)suse.com Subject: Re: [suse-security] IPTABLES Command slows down the machine Are you perhaps restricting some ports that are required by some of the applications run during KDE startup? For example are you blocking DNS? In any case you should design your iptables script to LOG DROPS/REJECTS so that you can see what your iptables rules are actually doing. >From the information you have presented no one is likely to give you an exact answer. If you wish more assistance please show your script and any LOG'ed records that may be relevant. All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 |---------+----------------------------> | | "Knut Erik | | | Hauslo" | | | <KNUTH(a)voelcker.c| | | om> | | | | | | 25/07/2003 11:16 | | | | |---------+----------------------------> >----------------------------------------------------------------------- --------------------------------------------------------| | | | To: <suse-security(a)suse.com> | | cc: | | Subject: [suse-security] IPTABLES Command slows down the machine | | | >----------------------------------------------------------------------- --------------------------------------------------------| Hi all, I have a nice IPTABLES Script which i start upon booting the server (/etc/init.d/boot.local). One of the first commands is this line: IPTABLES="/usr/sbin/iptables" If if run the script without this command, none of the rules are active. If i boot my server with the above command enabled however, the KDE login takes so much longer time and any application I start takes long to open too. The rules are working fine, and it seems that firewall-functions are being handled in a timely fashion (i have tested it while having my sniffer observe..) PS: I am a newbie to Linux and IPTABLES, please beare with me. Cheers Knut Erik -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] IPTABLES Command slows down the machine
by Knut Erik Hauslo 25 Jul '03

25 Jul '03

I am only allowing ports 21 and 80 outbound, and 80 inbound (customer specs - plz do not comment on this, i know it weird but they are somewhat paranoid). But your hint, regarding DNS got me checking the DNS settings. I had forgotten to remove a DNS server that's no longer active. A reboot after removal of DNS-Server setting did not show any improvements... My script looks as follows: #!/bin/sh # # Initial SIMPLE IP Firewall script # iptables -F iptables -X iptables -Z INET_IP="192.168.1.254" INET_IFACE="eth1" INET_BROADCAST="192.168.1.255" LAN_IP="172.19.6.254" LAN_IP_RANGE="172.16.0.0/16" LAN_IFACE="eth0" LO_IFACE="lo" LO_IP="127.0.0.1" IPTABLES="/usr/sbin/iptables" /sbin/depmod -a /sbin/modprobe ip_tables /sbin/modprobe ip_conntrack /sbin/modprobe iptable_filter /sbin/modprobe iptable_mangle /sbin/modprobe iptable_nat /sbin/modprobe ipt_LOG /sbin/modprobe ipt_limit /sbin/modprobe ipt_state /sbin/modprobe ip_conntrack_ftp echo "1" > /proc/sys/net/ipv4/ip_forward $IPTABLES -P INPUT DROP $IPTABLES -P OUTPUT DROP $IPTABLES -P FORWARD DROP # INPUT Rules # Need not be activated as we have no services running on local machine # Security Tests are to come # FORWARD Rules $IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT # HTTP-Requests outbound $IPTABLES -A FORWARD -p TCP -s 172.19.0.0/16 -d 192.168.1.0/24 --dport 80 -j ACCEPT # HTTP Requests inbound $IPTABLES -A FORWARD -p TCP -s 192.168.1.0/24 -d 172.19.0.0/16 --dport 80 -j ACCEPT # Settings for active FTP # FTP Control Connection outbound $IPTABLES -A FORWARD -p TCP -s 172.19.0.0/16 -d 192.168.1.0/24 --dport 21 -j ACCEPT # FTP Data Connection inbound - comment next line if only passive FTP is going to be used $IPTABLES -A FORWARD -p TCP -s 192.168.1.0/24 --sport 20 -d 172.19.0.0/16 --dport 1024: -j ACCEPT # Settings for passive FTP # FTP Data Connection outbound $IPTABLES -A FORWARD -p TCP -s 172.19.0.0/16 --sport 1024: -d 192.168.1.0/24 --dport 1024: -j ACCEPT # OUTPUT Rules $IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT $IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT $IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT -----Original Message----- From: Mark Perry [mailto:PERRY@de.ibm.com] Sent: Friday, July 25, 2003 12:27 PM To: Knut Erik Hauslo Cc: suse-security(a)suse.com Subject: Re: [suse-security] IPTABLES Command slows down the machine Are you perhaps restricting some ports that are required by some of the applications run during KDE startup? For example are you blocking DNS? In any case you should design your iptables script to LOG DROPS/REJECTS so that you can see what your iptables rules are actually doing. >From the information you have presented no one is likely to give you an exact answer. If you wish more assistance please show your script and any LOG'ed records that may be relevant. All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 |---------+----------------------------> | | "Knut Erik | | | Hauslo" | | | <KNUTH(a)voelcker.c| | | om> | | | | | | 25/07/2003 11:16 | | | | |---------+----------------------------> >----------------------------------------------------------------------- --------------------------------------------------------| | | | To: <suse-security(a)suse.com> | | cc: | | Subject: [suse-security] IPTABLES Command slows down the machine | | | >----------------------------------------------------------------------- --------------------------------------------------------| Hi all, I have a nice IPTABLES Script which i start upon booting the server (/etc/init.d/boot.local). One of the first commands is this line: IPTABLES="/usr/sbin/iptables" If if run the script without this command, none of the rules are active. If i boot my server with the above command enabled however, the KDE login takes so much longer time and any application I start takes long to open too. The rules are working fine, and it seems that firewall-functions are being handled in a timely fashion (i have tested it while having my sniffer observe..) PS: I am a newbie to Linux and IPTABLES, please beare with me. Cheers Knut Erik -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] IPTABLES Command slows down the machine
by Mark Perry 25 Jul '03

25 Jul '03

Are you perhaps restricting some ports that are required by some of the applications run during KDE startup? For example are you blocking DNS? In any case you should design your iptables script to LOG DROPS/REJECTS so that you can see what your iptables rules are actually doing. >From the information you have presented no one is likely to give you an exact answer. If you wish more assistance please show your script and any LOG'ed records that may be relevant. All the Best / Mit Freundlichen Gruessen Mark G. Perry IBM Germany Development GmbH / IBM Deutschland Entwicklung GmbH Schoenaicher Strasse 220, 71032 Boeblingen, Germany Email/Sametime: perry(a)de.ibm.com Office Tel: (+49)-7031-16-3626 |---------+----------------------------> | | "Knut Erik | | | Hauslo" | | | <KNUTH(a)voelcker.c| | | om> | | | | | | 25/07/2003 11:16 | | | | |---------+----------------------------> >-------------------------------------------------------------------------------------------------------------------------------| | | | To: <suse-security(a)suse.com> | | cc: | | Subject: [suse-security] IPTABLES Command slows down the machine | | | >-------------------------------------------------------------------------------------------------------------------------------| Hi all, I have a nice IPTABLES Script which i start upon booting the server (/etc/init.d/boot.local). One of the first commands is this line: IPTABLES="/usr/sbin/iptables" If if run the script without this command, none of the rules are active. If i boot my server with the above command enabled however, the KDE login takes so much longer time and any application I start takes long to open too. The rules are working fine, and it seems that firewall-functions are being handled in a timely fashion (i have tested it while having my sniffer observe..) PS: I am a newbie to Linux and IPTABLES, please beare with me. Cheers Knut Erik -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

IPTABLES Command slows down the machine
by Knut Erik Hauslo 25 Jul '03

25 Jul '03

Hi all, I have a nice IPTABLES Script which i start upon booting the server (/etc/init.d/boot.local). One of the first commands is this line: IPTABLES="/usr/sbin/iptables" If if run the script without this command, none of the rules are active. If i boot my server with the above command enabled however, the KDE login takes so much longer time and any application I start takes long to open too. The rules are working fine, and it seems that firewall-functions are being handled in a timely fashion (i have tested it while having my sniffer observe..) PS: I am a newbie to Linux and IPTABLES, please beare with me. Cheers Knut Erik

1 0

RE: [suse-security] SuSE firewall2 configuration for zone transfer
by M. Edwin 25 Jul '03

25 Jul '03

Dear all, The problem already solved. I check again the firewall log, and I found that something went wrong. The server rejected the packet from our secondary dns server from port 53 (source=53 and several destination on high port). I don't know why this happen. I'm sure that I already open the TCP and UDP 53. I restart the firewall2 and named service but this problem still happened. So I decided to reboot the server. After reboot, everything goes to normal, and the zone transfer running automatically, even that both UDP and TCP highport packet is not allow on firewall configuration. Thanks for all your help and suggestion. Kind Regards, M. Edwin -----Original Message----- From: Kringstad, Trond [mailto:trond.kringstad@software-innovation.com] Sent: Thursday, July 24, 2003 5:34 PM To: Moh Edwin Subject: RE: [suse-security] SuSE firewall2 configuration for zone transfer Have you checked your logs ? Im using bind9 with zone transfer of 28 zones. The only ports opened in the firewall is UDP/TCP 53 inbound. Trond -----Original Message----- From: M. Edwin [mailto:edwin@nsi.co.id] Sent: 24. juli 2003 04:58 To: 'Knut Erik Hauslo' Cc: suse-security(a)suse.com Subject: RE: [suse-security] SuSE firewall2 configuration for zone transfer Hi, I opened all highport, but still the zone cannot transfer. I used Bind9 and my named.conf is very standard, and I put the allow-transfer on global options. Do you have other suggestion? Kind Regards, M. Edwin -----Original Message----- From: Knut Erik Hauslo [mailto:KNUTH@voelcker.com] Sent: Wednesday, July 23, 2003 3:48 PM To: Moh Edwin Cc: suse-security(a)suse.com Subject: RE: [suse-security] SuSE firewall2 configuration for zone transfer Correct, you need to open Highports_TCP too. However, I did encounter some problems when using FW_ALLOW_INCOMIN_HIGHPORTS_TCP="ftp-data" so i changed ftp-data to yes. Cheers, Knut Erik -----Original Message----- From: M. Edwin [mailto:edwin@nsi.co.id] Sent: Wednesday, July 23, 2003 9:10 AM To: Knut Erik Hauslo Cc: suse-security(a)suse.com Subject: RE: [suse-security] SuSE firewall2 configuration for zone transfer It means I also have to open highport TCP and TCP 53, right? My current firewall setting for TCP high port is FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data" regards, Edwin -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0