July 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] SuSE firewall2 configuration for zone transfer
by Knut Erik Hauslo 23 Jul '03

23 Jul '03

Hi there, DNS Requests from Server to Server normaly uses UDP 53 (Source and Destination Port). However, if problems occur or packet size is > 512 bytes, it will change to Source Port >=1024 TCP and destination port 53 TCP. Cheers Knut Erik -----Original Message----- From: M. Edwin [mailto:edwin@nsi.co.id] Sent: Tuesday, July 22, 2003 1:36 PM To: suse-security(a)suse.com Subject: [suse-security] SuSE firewall2 configuration for zone transfer Hi list, I just setup name server for our domain. I allow-transfer on named.conf to external server outside our domain for secondary name server. allow-query { any; }; allow-transfer { 202.158.40.1; }; When I check on the log (/var/log/messages) there are several lines show that the zone transfer to that server on highport is not allow like this one: Jul 22 13:25:25 mail /usr/sbin/named[28877]: client ::ffff:202.158.40.1#54516: zone transfer denied I think it is because the firewall, so I check the firewall configuration. But I think everything is Ok (correct me if I'm wrong). I put the lines FW_SERVICES_EXT_UDP="53" FW_ALLOW_INCOMING_HIGHPORTS_UDP="domain" Anybody can give me advice? Kind Regards, M. Edwin

3 2

Antw: RES: [suse-security] Freeswan problem with multiple XP roadwarriors
by Andreas Thierer 23 Jul '03

23 Jul '03

Do your XP-Roadwarriors have the same certificate? There can only be one tunnel per cert. andy >>> "Valter Rehn" <valter(a)dimed.com.br> 18.06.2003 17:56:39 >>> you could try to create separate "conn" sections for each roadwarrior... I've never tried this configuration, but it's worth a try. regards, Valter Rehn "Windows - A thirty two bit extension and gui shell to a sixteen bit patch to an eight bit operating system originally coded for a four bit microprocessor and sold by a two bit company that can't stand one bit of competition." (Kevin Wilcox) -----Mensagem original----- De: Absender fnr suse-security-mailingliste [mailto:linux@bdr.de] Enviada em: Wednesday, June 18, 2003 06:04 Para: suse-security(a)suse.com Assunto: [suse-security] Freeswan problem with multiple XP roadwarriors I have trouble connecting multiple XP roadworriors to a freeswan gateway. For each client an IPSEC tunnel can be established individually. But to have both clients connected at the same time is not possible. I have the following setup: Roadwarrior1/2 --- ras-router --- vpn-gateway --- internal-subnet 10.5.5.(1,2) --- 10.6.1.3 --- 10.6.1.1/10.7.1.1 --- 192.168.0.0/24 For roadwarrior1 everything works as espected. The tunnel can be established and the client can ping the internal subnet. When roadwarrior2 tries to connect, I get the following error "roadwarrior"[5] 10.5.5.2 #5: discarding duplicate packet; already STATE_MAIN_R2 and the connection of roadwarrior1 hangs too! Seems as if freeswan/x509 (SuSE 8.2) wouldn't be able to separate the connections. My ipsec.conf: --- # basic configuration config setup interfaces="ipsec0=eth0" klipsdebug=none plutodebug=all plutoload=%search plutostart=%search uniqueids=yes #nat_traversal=yes # defaults for subsequent connection descriptions conn %default keyingtries=3 disablearrivalcheck=yes authby=rsasig leftcert=vpncert.pem left=10.6.1.1 leftnexthop=10.6.1.3 leftsubnet=192.168.0.0/24 rightrsasigkey=%cert leftupdown=/usr/lib/ipsec/_updown.x509 pfs=yes auto=add conn roadwarrior right=%any rightsubnetwithin=10.5.5.0/24 auto=add --- Did anybody have a similar problem. Any hints are welcome. Mirko ----------------------------------- Mirko Belick Bundesdruckerei GmbH IT-Netzmanagement 10598 Berlin Oranienstrasse 91 Email: belick(a)bdr.de http://www.bundesdruckerei.de -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] Newbie Question re. Firewall2 vs. IPTABLES
by Knut Erik Hauslo 23 Jul '03

23 Jul '03

With this ruleset (see original message below), you only allow incoming HTTP requests. Let me see if i got this correct (reduced to a minimum for readability): *** BEGIN *** # eth0 internal interface # eth1 external interface iptables -N allowed_out iptables -A allowed_out -i eth0 -p tcp --dport 80 -m state ! --state INVALID -j ACCEPT # Active FTP Rules following iptables -A allowed_out -i eth0 -p tcp --dport 21 -m state ! --state INVALID -j ACCEPT iptables -A allowed_out -i eth0 -p tcp --dport 20 -m state ! --state INVALID -j ACCEPT iptables -N allowed_in # Allow incoming Highports FTP - only when active FTP is being used iptables -A allowed_in -i eth1 -p tcp --sport 20 --dport 1024: -j ACCEPT iptables -N block # Block all other iptables -A block -i eth1 -m state --state NEW,INVALID -j drop *** END *** This sample above, would allow HTTP in both directions, and FTP outbound (from Eth0)? Cheers Knut Erik -----Original Message----- From: keith(a)topaz5.worldonline.co.uk [mailto:keith@topaz5.worldonline.co.uk] Sent: Tuesday, July 22, 2003 6:33 PM To: Knut Erik Hauslo; suse-security(a)suse.com Subject: RE: [suse-security] Newbie Question re. Firewall2 vs. IPTABLES <SNIP> #------------------------------------------------------# # create a new chain for apache connections #------------------------------------------------------# iptables -N open_port_80 # LOG all NEW, ESTABLISHED, RELATED # remote connections coming in on ppp0 to apache port 80 iptables -A open_port_80 -i ppp0 -p tcp --dport 80 \ -m state ! --state INVALID \ -j LOG --log-prefix 'Remote Port 80 connects ' # ACCEPT all NEW, ESTABLISHED, RELATED # remote connections coming in on ppp0 to apache port 80 iptables -A open_port_80 -i ppp0 -p tcp --dport 80 \ -m state ! --state INVALID \ -j ACCEPT # LOG all local connections to apache port 80 iptables -A open_port_80 -i ! ppp0 -p tcp --dport 80 \ -j LOG --log-prefix 'Local Port 80 connects ' # ACCEPT all local connections to apache port 80 iptables -A open_port_80 -i ! ppp0 -p tcp --dport 80 -j ACCEPT #------------------------------------------------------# # create new chain that blocks all other # new connection attempts coming in from ppp0 #------------------------------------------------------# iptables -N block # LOG all other new connection attempts (& invalid packets) coming from ppp0 iptables -A block -i ppp0 -m state --state NEW,INVALID \ -j LOG --log-prefix 'DROPPED NEW CONNS ON PPP0 ' # DROP all new connection attempts (& invalid packets) coming from ppp0 # and not for apache web server iptables -A block -i ppp0 -m state --state NEW,INVALID -j DROP <SNIP>

1 0

RE: [suse-security] SuSE firewall2 configuration for zone transfer
by Knut Erik Hauslo 23 Jul '03

23 Jul '03

Correct, you need to open Highports_TCP too. However, I did encounter some problems when using FW_ALLOW_INCOMIN_HIGHPORTS_TCP="ftp-data" so i changed ftp-data to yes. Cheers, Knut Erik -----Original Message----- From: M. Edwin [mailto:edwin@nsi.co.id] Sent: Wednesday, July 23, 2003 9:10 AM To: Knut Erik Hauslo Cc: suse-security(a)suse.com Subject: RE: [suse-security] SuSE firewall2 configuration for zone transfer It means I also have to open highport TCP and TCP 53, right? My current firewall setting for TCP high port is FW_ALLOW_INCOMING_HIGHPORTS_TCP="ftp-data" regards, Edwin

1 0

SuSE firewall2 configuration for zone transfer
by M. Edwin 23 Jul '03

23 Jul '03

Hi list, I just setup name server for our domain. I allow-transfer on named.conf to external server outside our domain for secondary name server. allow-query { any; }; allow-transfer { 202.158.40.1; }; When I check on the log (/var/log/messages) there are several lines show that the zone transfer to that server on highport is not allow like this one: Jul 22 13:25:25 mail /usr/sbin/named[28877]: client ::ffff:202.158.40.1#54516: zone transfer denied I think it is because the firewall, so I check the firewall configuration. But I think everything is Ok (correct me if I'm wrong). I put the lines FW_SERVICES_EXT_UDP="53" FW_ALLOW_INCOMING_HIGHPORTS_UDP="domain" Anybody can give me advice? Kind Regards, M. Edwin -- Check the headers for your unsubscription address For additional commands send e-mail to suse-linux-e-help(a)suse.com Also check the archives at http://lists.suse.com Please read the FAQs: suse-linux-e-faq(a)suse.com

3 2

AW: AW: [suse-security] strange behaviour useradd / usermod
by mailinglists 23 Jul '03

23 Jul '03

> I think, it's because any user might see the commandline with > the unencrypted > password via ps jax -command ;-) Yes, any user standing right behind me. And also if every user is root. ;-) Philipp

2 1

RE: [suse-security] Newbie Question re. Firewall2 vs. IPTABLES
by Knut Erik Hauslo 22 Jul '03

22 Jul '03

Hello Uli, So if i deactivate firewall2, IPTABLES is still active and i can add my own set of rules (iptables -A TCP etc.) and they are active right away? Cheers -KEH -----Original Message----- From: Ulrich Roth [mailto:Roth@impact.de] Sent: Tuesday, July 22, 2003 1:25 PM To: suse-security(a)suse.com Subject: AW: [suse-security] Newbie Question re. Firewall2 vs. IPTABLES Hi Knut, > i am new to SuSE (Linux in generall) and have been fiddeling with > firewall 2 for some time. > > My question is: If i deactivate SuSEfirewall2 (using YaST), will any > IPTABLES rule i might create afterward still take action? And if not, > where do i enable it (IPTABLES)? Iptables is enabled by default. SuSEfirewall2 is only a shell script that runs many many iptables commands, depending on how you configure it. You may create your own script to execute iptables commands, or you may use SuSE's firewall script. SuSE made this script in order to make life easier for admins. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

OT : Cisco Pix Device Manager
by BLeonhardt＠analytek.de 22 Jul '03

22 Jul '03

Hi, does anybody know the Cisco Pix Device Manager / Cisco Pix 515 ??? Does anybody know where I could get something like a demo / demolab ??? Thanks, event it's off-topic. Best regards Bruno Leonhardt

2 2

RE: [suse-security] SuSE firewall2 configuration for zone transfer
by subscribe 22 Jul '03

22 Jul '03

-----Original Message----- From: M. Edwin [mailto:edwin@nsi.co.id] Sent: 22. juli 2003 13:36 To: suse-security(a)suse.com Subject: [suse-security] SuSE firewall2 configuration for zone transfer Anybody can give me advice? This is maybe some offtopic, but this is a great template for bind: http://www.cymru.com/Documents/secure-bind-template.html btw, did you allow tranfer at the zoneconfig in named.conf? You can add ACLs on global or at zones. And zone tranfer uses TCP not UDP! -- Trond

1 0

AW: [suse-security] Newbie Question re. Firewall2 vs. IPTABLES
by Ulrich Roth 22 Jul '03

22 Jul '03

> > So if i deactivate firewall2, IPTABLES is still active Yes. > and i can add my own set of rules (iptables -A TCP etc.) and they > are active right away? They are active as soon as they are executed, may this be by a script or by commands you type at the command line. You have to ensure that they are active again after a reboot, so you better put them into a script and run this script during boot time, like Ray said. But setting up your own iptables script is a very complex task, because there are many things you have to take care of. I did this three years ago for ipchains, the predecessor of iptables. I think it took me some days to learn about ipchains and to set up the script, but then it worked great. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0