July 2003 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] ftp server "best practice"
by Jörn Ott 24 Jul '03

24 Jul '03

Hi Daniel, > I think what the software teams is looking to do is to setup an > account for that customer on the ftp site where the customer can log > in and download files intended for that customer only. That's simple > with > an ftp server since it will have the concept of a "home directory" for > that ftp user. That concept also exists on a webserver. When you use the SuSE default config for a webserver, the http://server/~user/ is directed to the dir /home/user/public_html (apache: mod_userdir). Of course, you'd still have to secure the dir with a .htaccess. I personally don't like the mod userdir, so we use normal subdirectories in /srv/www and have authentication to each dir by a .htaccess file. The authentication is done against a mysql database but afaik apache also supports auth against ldap. So, all the techie has to do is to create a directory for a certain user, copy a prepped .htaccess into it and modify the allowed users/groups in it. This can also be done by a script. mfg Jörn Ott -- ------------------------------------------------------------ Jörn Ott Telefon: (0 22 24) 94 08 - 73 EDV Service & Beratung Telefax: (0 22 24) 94 08 -74 Lohfelder Str. 33 E-Mail: mailto:white@ott-service.de 53604 Bad Honnef WWW: http://www.ott-service.de/

2 1

ftp server "best practice"
by Daniel Nilsson 24 Jul '03

24 Jul '03

All, I'm tasked to add an ftp server to our companys "internet presence", the ftp server will need to have accounts on it since the data is not for the public. Currently our setup consists of a number of Linux firewalls for our 4 office locations that then in turn connects these 4 office locations using ipsec. In addition, at our main office location we have a DMZ with a webserver. The ftp server should be located at the main office, but I could use some recommendations on where to place this server. From reading mailing lists I understand the issue of active vs. passive ftp and placing the ftp server in the DMZ. I don't think I can ask our customers to toggle the active/passive flag of their ftp client since are customers are usually not very computer savvy people. Putting an ftp server in the DMZ that supports both active and passive ftp seems tricky, does anyone have a recipe of how to make that work (using SuSEFirewall 2 on the firewall machine). Other options include using the firewall machine itself as the ftp server, but that makes me very nervous. I was leaning toward using the vsftpd, but regardless how secure that is by design I'm still not to comfortable using the firewall as the ftp server (what if the ftpd is hacked ???). The last option is to place the ftp server outside the company LAN and make it a standalone machine with it's own firewall. This would probably be the best solution in terms of company LAN security, but the only thing I don't like about this solution is that I will have to administer accounts on this machine. I was hoping to be able to hook up to an LDAP server that is available inside the firewall (not in the DMZ). Any thoughts / recommendations are greatly appreciated. Thanks -- Daniel Nilsson

5 5

RE: [suse-security] ftp server "best practice"
by DDepue＠rochgrp.com 24 Jul '03

24 Jul '03

I would suggest using pure-ftpd instead of vsftp. Pure is a lot easier to set up. It'll talk to LDAP if you need it to, but I think the security gained by putting it in the DMZ is worth the loss of management convenience. You should be able to set it up so that the ftp server in the DMZ can talk to the LDAP server through the firewall if you really want it to, but if your FTP service gets hacked the hacker then has access to your directory and that's not good. If you have large numbers of users to manage, use the password database feature. I'm sure you can find a way to export user info from LDAP and import to the database. If you have good ftp client software, it should automatically detect the need for passive mode. I have a setup of this with pureftp running inside a DMZ that has a private address and it runs very well. It's easy to set up with privilege separation or chrooted, it's as secure as vsftp. Make sure your server only supports ssl-ftp and get clients that do as well. SSH/SFTP is also a good solution, but requires local accounts on the server, and a bit more tech savvy from your users. With pure or vsftp you can do it without adding any real users to the box. It'll boil down to whatever is the easiest to manage. You really should put it in the DMZ if you can. Don't run it on the firewall. Never run anything on the firewall. Good luck. -----Original Message----- From: Daniel Nilsson [mailto:dnilsson@sisoft.com] Sent: Thursday, July 24, 2003 8:44 AM To: suse-security(a)suse.com Subject: [suse-security] ftp server "best practice" All, I'm tasked to add an ftp server to our companys "internet presence", the ftp server will need to have accounts on it since the data is not for the public. Currently our setup consists of a number of Linux firewalls for our 4 office locations that then in turn connects these 4 office locations using ipsec. In addition, at our main office location we have a DMZ with a webserver. The ftp server should be located at the main office, but I could use some recommendations on where to place this server. From reading mailing lists I understand the issue of active vs. passive ftp and placing the ftp server in the DMZ. I don't think I can ask our customers to toggle the active/passive flag of their ftp client since are customers are usually not very computer savvy people. Putting an ftp server in the DMZ that supports both active and passive ftp seems tricky, does anyone have a recipe of how to make that work (using SuSEFirewall 2 on the firewall machine). Other options include using the firewall machine itself as the ftp server, but that makes me very nervous. I was leaning toward using the vsftpd, but regardless how secure that is by design I'm still not to comfortable using the firewall as the ftp server (what if the ftpd is hacked ???). The last option is to place the ftp server outside the company LAN and make it a standalone machine with it's own firewall. This would probably be the best solution in terms of company LAN security, but the only thing I don't like about this solution is that I will have to administer accounts on this machine. I was hoping to be able to hook up to an LDAP server that is available inside the firewall (not in the DMZ). Any thoughts / recommendations are greatly appreciated. Thanks -- Daniel Nilsson -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] Newbie Question re. Firewall2 vs. IPTABLES (fwd)
by keith＠topaz5.worldonline.co.uk 24 Jul '03

24 Jul '03

Hi Knuth! I have just checked the Packet Filtering HOWTO. According to the HOWTO, packets destined for the local machine go through the INPUT chain, and any other packets not for localhost get sent to the FORWARD chain. So you could receive bad packets sent directly to the FORWARD chain! If you are going to do IP FORWARDING then you will NEED to filter the packets that you are passing along to others. Just removing the -j block will pass UNFILTERED packets to others, even though the INPUT CHAIN is being filtered!!! As I don't use the FORWARD chain, then blocking it is fine for me. You may need to make a seperate chain with rules that will filter the FORWARD chain, and use that. eg. FORWARD -j my_fwd_filter Regards - Keith ---------- Forwarded message ---------- To: Knut Erik Hauslo <KNUTH(a)voelcker.com> From: keith(a)topaz5.worldonline.co.uk Subject: RE: [suse-security] Newbie Question re. Firewall2 vs. IPTABLES Opps! I've just noticed the -j block on the FORWARD chain. You might need to remove this to enable packets to pass through the FORWARD chain... let me know if this works. Keith On Thu, 24 Jul 2003, Knut Erik Hauslo wrote: > Keith gave me a very simple example on how to create simple iptable configuration. I adopted most of it - leaving out the logs and denying ICMP on eth1 - and this is how it looks now: -- snip -- > iptables -A INPUT -j open_port_80 > iptables -A INPUT -j block > iptables -A FORWARD -j block <-- THIS MAY BE YOUR PROBLEM > *** End > However, no packets are ever reaching it's destination on the internal network. How come? My external network is on eth1 and my internal is on eth0. IP Forwarding (YaST, Network Services, Routing) is not enabled. If I do enable IP Forwarding, any packets will go trough the firewall, and eh, that's not what i expected ;-) > > >From sources that i have found, the way of a packet is described like this: > - if a packet is destined for local host, it will be redirected to the input chain > - if a packet is not destined for local host, it will be redirected to the forward chain (forwarding needs to be enabled in the kernel - but where - and there must be a routing table in place. Routing table is ok, but since I am a newbie, i do not know where to change this forwarding setting if it is not the setting mentioned above?!?!? :-S (confused smiley) > > Any hints are deeply appreciated!

1 0

RE: [suse-security] Newbie Question re. Firewall2 vs. IPTABLES (fwd)
by keith＠topaz5.worldonline.co.uk 24 Jul '03

24 Jul '03

Opps! I've just noticed the -j block on the FORWARD chain. You might need to remove this to enable packets to pass through the FORWARD chain... let me know if this works. Keith On Thu, 24 Jul 2003, Knut Erik Hauslo wrote: > Keith gave me a very simple example on how to create simple iptable configuration. I adopted most of it - leaving out the logs and denying ICMP on eth1 - and this is how it looks now: -- snip -- > iptables -A INPUT -j open_port_80 > iptables -A INPUT -j block > iptables -A FORWARD -j block <-- THIS MAY BE YOUR PROBLEM > *** End > However, no packets are ever reaching it's destination on the internal network. How come? My external network is on eth1 and my internal is on eth0. IP Forwarding (YaST, Network Services, Routing) is not enabled. If I do enable IP Forwarding, any packets will go trough the firewall, and eh, that's not what i expected ;-) > > >From sources that i have found, the way of a packet is described like this: > - if a packet is destined for local host, it will be redirected to the input chain > - if a packet is not destined for local host, it will be redirected to the forward chain (forwarding needs to be enabled in the kernel - but where - and there must be a routing table in place. Routing table is ok, but since I am a newbie, i do not know where to change this forwarding setting if it is not the setting mentioned above?!?!? :-S (confused smiley) > > Any hints are deeply appreciated!

1 0

RE: [suse-security] Newbie Question re. Firewall2 vs. IPTABLES
by Knut Erik Hauslo 24 Jul '03

24 Jul '03

Keith gave me a very simple example on how to create simple iptable configuration. I adopted most of it - leaving out the logs and denying ICMP on eth1 - and this is how it looks now: ** Begin ** echo "*** Flush all rules " iptables -F echo "*** Clear all counters" iptables -Z echo "*** Delete user defined rules" iptables -X echo "*** Log all packets going through the FORWARD chain" iptables -A FORWARD -j LOG --log-prefix 'FILTER-FWD PKTS ' #echo "*** NAT Rules" #echo "*** MANGLE Rules" #echo "*** FILTER rules" iptables -A INPUT -i eth1 -p tcp --syn -m limit --limit 1/s -j ACCEPT iptables -A INPUT -i eth1 -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT iptables -A INPUT -i eth1 -p icmp --icmp-type echo-request -j DROP iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j DROP iptables -N open_port_80 iptables -A open_port_80 -i eth1 -p tcp --dport 80 -m state ! --state INVALID -j ACCEPT iptables -A open_port_80 -i ! eth1 -p tcp --dport 80 -j ACCEPT iptables -N block iptables -A block -i eth1 -m state --state NEW,INVALID -j DROP iptables -A INPUT -j open_port_80 iptables -A INPUT -j block iptables -A FORWARD -j block *** End However, no packets are ever reaching it's destination on the internal network. How come? My external network is on eth1 and my internal is on eth0. IP Forwarding (YaST, Network Services, Routing) is not enabled. If I do enable IP Forwarding, any packets will go trough the firewall, and eh, that's not what i expected ;-) >From sources that i have found, the way of a packet is described like this: - if a packet is destined for local host, it will be redirected to the input chain - if a packet is not destined for local host, it will be redirected to the forward chain (forwarding needs to be enabled in the kernel - but where - and there must be a routing table in place. Routing table is ok, but since I am a newbie, i do not know where to change this forwarding setting if it is not the setting mentioned above?!?!? :-S (confused smiley) Any hints are deeply appreciated! Cheers Knut Erik

1 0

rsync wrapper perlscript (was SCP-proxy / SFTP-proxy wanted)
by Stefan Seyfried 24 Jul '03

24 Jul '03

On Mon, Jul 21, 2003 at 09:15:07AM +0200, Steffen Dettmer wrote: > You do "client push" of files for backup (instead server poll), no, i do server poll, since my backup server accesses the clients through a masquerading router -> no way back :-) But the wrapper should also work for client push, just check the rsync commandline as described below, probably you don't need to check for "--sender", but in fact check, that it is _not_ there to prevent stealing of your data from the backup server. > yes? How do you do that? I found it is not so easy using rsync, > because this likes root permissions on the backup host because > maybe you want perserve UID and such. Having root-rsync access > likes to limit the access to same backup-tree, at least. Does you > perl-wrapper protects against this? I mean, the cilent can rsync > to e.g. /.../backup/client-hostname/ as root, but not below /etc > and such? In that case, would you share your script? no, i completely mirror the whole machines, including /etc/, excluding only a few directories (/proc, postgres datadir, tomcat work-dir), but it should be easy to hack into the perlscript. The rsync_wrapper is simple: --snip--- #!/usr/bin/perl # # rsync wrapper, borrowed from # http://www.sct.gu.edu.au/~anthony/info/apps/rsync.hints # $line=$ENV{SSH_ORIGINAL_COMMAND}; if ( $line =~ m#^/usr/bin/rsync --server --sender # ) { # this regexp will need tweaking to handle unusual # (but legal) characters in paths. eg: [_\.] ($safeline=$line) =~ s|[^\w\s\d\-\/\.]||g; if ( $line ne $safeline ) { exit 1; } system("$line"); } else { exit 1; } ---snip-- i put this in /root/bin/rsync_wrapper, my authorized_keys is like this: command="bin/rsync_wrapper",no-pty,no-port-forwarding,no-agent-forwarding ssh-dss AAA... this is all on the "client machine", the one which is backed up. On the server, it is important to call rsync with the "--rsync-path="-Option, otherwise, the $SSH_ORIGINAL_COMMAND will be "rsync --server --sender..." and not "/usr/bin/rsync --server --sender..." So you have to do (on the server) "rsync --rsync-path=/usr/bin/rsync -e ssh ..." If you are really paranoid, just do something like rsync -e ssh -avP --bwlimit=1 localhost:/etc /tmp/ and in another terminal search the output of "ps auxwwf" for the exact command-line which is executed via ssh on the client, then you can put that command into authorized_keys or check especially against it in the wrapper. In my example, it was rsync --server --sender -vlogDtpr --bwlimit=1 --partial . /etc so you can check if only the paths you want to allow are at the end of the commandline. This script is not my invention, as stated in the comment. -- Stefan Seyfried Senior Consultant community4you GmbH, Chemnitz, Germany. http://www.community4you.de http://www.open-eis.com

2 4

RE: [suse-security] SuSE firewall2 configuration for zone transfer
by M. Edwin 24 Jul '03

24 Jul '03

Hi, I opened all highport, but still the zone cannot transfer. I used Bind9 and my named.conf is very standard, and I put the allow-transfer on global options. Do you have other suggestion? Kind Regards, M. Edwin -----Original Message----- From: Knut Erik Hauslo [mailto:KNUTH@voelcker.com] Sent: Wednesday, July 23, 2003 3:48 PM To: Moh Edwin Cc: suse-security(a)suse.com Subject: RE: [suse-security] SuSE firewall2 configuration for zone transfer Correct, you need to open Highports_TCP too. However, I did encounter some problems when using FW_ALLOW_INCOMIN_HIGHPORTS_TCP="ftp-data" so i changed ftp-data to yes. Cheers, Knut Erik -----Original Message----- From: M. Edwin [mailto:edwin@nsi.co.id] Sent: Wednesday, July 23, 2003 9:10 AM To: Knut Erik Hauslo Cc: suse-security(a)suse.com Subject: RE: [suse-security] SuSE firewall2 configuration for zone transfer It means I also have to open highport TCP and TCP 53, right? My current firewall setting for TCP high port is FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data" regards, Edwin

2 1

AW: [suse-security] SuSE firewall2 configuration for zone transfer
by Ulrich Roth 24 Jul '03

24 Jul '03

> I opened all highport, but still the zone cannot transfer. > I used Bind9 and my named.conf is very standard, and I put the > allow-transfer on global options. Do you have other suggestion? Yes, put the allow-transfer statement into the zone definitions. That's how we configured our named and how it works for us. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

IPSec on Win2k/WinXP: per-user-certificates possible?
by Andreas Thierer 23 Jul '03

23 Jul '03

Hi, i have a little problem with understanding how windows manages certificates. i have running a freeswan-server (suse 8.2) and multiple Win2k/WinXP- roadwarriors. in windows the certificates are located in "local computer". so every user at this machine can establish an ipsec-connection with this certificate. my questions: - how can install the certificates per-user? - if more than one certificate is installed on one machine, how can i ensure that only a specific cert is used for every user? thx, andy

2 1