July 2003 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] Newbie Question re. Firewall2 vs. IPTABLES
by Ulrich Roth 22 Jul '03

22 Jul '03

Hi Knut, > i am new to SuSE (Linux in generall) and have been fiddeling with > firewall 2 for some time. > > My question is: If i deactivate SuSEfirewall2 (using YaST), will any > IPTABLES rule i might create afterward still take action? And if not, > where do i enable it (IPTABLES)? Iptables is enabled by default. SuSEfirewall2 is only a shell script that runs many many iptables commands, depending on how you configure it. You may create your own script to execute iptables commands, or you may use SuSE's firewall script. SuSE made this script in order to make life easier for admins. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth(a)impact.de

1 0

Newbie Question re. Firewall2 vs. IPTABLES
by Knut Erik Hauslo 22 Jul '03

22 Jul '03

Hi there, i am new to SuSE (Linux in generall) and have been fiddeling with firewall 2 for some time. My question is: If i deactivate SuSEfirewall2 (using YaST), will any IPTABLES rule i might create afterward still take action? And if not, where do i enable it (IPTABLES)? Cheers Knut Erik

1 0

AW: [suse-security] strange behaviour useradd / usermod
by mailinglists 22 Jul '03

22 Jul '03

> Sorry, that should read "passwd <username>". No input redirection... Thanks. That does the work I need. Strange that this wasn't implemented in the usermod command. Maybe from some historical reason. Philipp

2 1

IMAP and squirrelmailq
by Wouter 22 Jul '03

22 Jul '03

Hi, I have upgraded form suse 8.1 to 8.2 if have no only a problem whit IMAP. When i try to login by Squirrelmail then he says he dont know the user. When i check /var/log/messages i see this: imapd[15626]: Login disabled user=wouter auth=wouter host=localhost [127.0.0.1] I have read sonmething on the net and i read every time that i most set in xinetd.conf or /ect/init.d/imap disable= no by the imap services. I have try this bud it isn`t work. When i telnet to IMAP i will see: * OK [CAPABILITY IMAP4REV1 LOGIN-REFERRALS STARTTLS LOGINDISABLED] localhost IMAP4rev1 2002.332 at Mon, 21 Jul 2003 10:32:47 +0200 (CEST) But i see again LOGINDISABLED how can i enable the login ? Or have i a onther problem ? Greetz Wouter

2 1

MTU and Poptop
by Stefan Eggert 22 Jul '03

22 Jul '03

Hello all, i have some problems with my T-DSL VPN Gateways. At left side, i have an DSL Linux Router, on ther side there is an DSL Linux Poptop Server. If i try to connect the right side, i become follow error on Server Side: Jul 22 10:58:50 vpm-web01 pppd[2521]: Connect: ppp2 <--> /dev/pts/1 Jul 22 10:58:50 vpm-web01 pptpd[2520]: GRE: read error: Protocol not available Jul 22 10:58:50 vpm-web01 pptpd[2520]: CTRL: PTY read or GRE write failed (pty,gre)=(5,6) Jul 22 10:58:50 vpm-web01 pptpd[2520]: CTRL: Client 192.168.91.1 control connection finished Jul 22 10:58:50 vpm-web01 pptpd[2520]: CTRL: Exiting now If i try to connect from my 2mbit Internet connection to my VPN DSL Server, it works fine. But why? Any Ideas?? stefan

1 0

msn setup in proxy.
by Francisco Acosta 21 Jul '03

21 Jul '03

(First, my english is not good) Hi, In my network, people want and are allowed to use msn. A new release 6 was installed in some windows machines. With iptables, i set policies to drop in input, output and forward. Then, accept established an related connections: iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT And finally allow connections to everywhere, port 1863 iptables -A FORWARD -p tcp -s 10.0.0.0/8 --destination-port 1863 -m state --state NEW -j MSN iptables -A MSN -j LOG --log-prefix "MSN ACCEPT " iptables -A MSN -j ACCEPT I've captured sessions of connections with tcpdump, and as far as i can see, the client connect, first to a messenger.hotmail.com, then negotiate the connections to another site baym-csxxx.msgr.hotmail.com where xxx is the final number of the ip. It seems that always use only the port 1863, but is not working. I've even configured dante, and didn't worked too. Is there any error in my configuration of iptables?. Or is just a FUD?, because connections going through ISA Server work fine.

1 0

AW: [suse-security] strange behaviour useradd / usermod
by mailinglists 21 Jul '03

21 Jul '03

> if you change the password, did you use usermod -p CRYPTEDPASSWORD > or did you use a plaintext password? if plaintext, read man usermod > again ;) Thanks, that's it. Just checked google on how to crypt passwords. Well... How am I supposed to crypt the password? man crypt returns the man for crypt.h and 'whereis crypt' also points me to the same header file. Is there a tool for that? Thanks, Philipp

5 5

RE: RE: [suse-security] SCP-proxy / SFTP-proxy wanted
by Schreiner, Dirk 21 Jul '03

21 Jul '03

Hi Christoph, you got a clear and well-working way to do the job. And if you have not too dumb users, this should work. But you mentioned something about "WI?" ;-) So if the User`s need a verry easy way to access the Server, you could do some real magic ;-) (Although is is something more Work to implement.) I guess, outside is a System produced in Redmond. So you need a graphical Interface. Use WinScp. Generate a Public-Private Key pair with Passphrase for each User. Put the Public-Key in the Home-Directory of the Win-User. This can be opend using pagent (Putty.) Put the Private-Key on the Gateway-Server, and implement a single command in this Key. (e.g. ssh -l user inside-host /bin/scp ;-)) If wanted, create another public-private Pair to authenticate the second connection on inside-Host. So no more Password is needed after opening the first Public-Key on outside with pagent. Use WinScp like explorrer. Outside hacked --> delete Key`s on gateway. Most of the configuration can be distributed by mail to the User on Outside. Didn`t test exact this configuration, but it should work. Greetings Dirk -----Original Message----- From: Dr. Christoph Wegener [mailto:cwe@bph.ruhr-uni-bochum.de] Sent: Thu 17.07.2003 10:46 To: suse-security(a)suse.com; Schreiner, Dirk Cc: Subject: Re: RE: [suse-security] SCP-proxy / SFTP-proxy wanted Hi Dirk, thanks for your suggestion - that is exactly what I was probing yesterday evening. First I had some probs with the port redirection of scp (sometimes it is -p, on another machine it might be -P) but now it works. And it turns out that even most graphical WI? clients are able to work with such a setup. Well, I'll give you a short description of my net first: outside -|- ssh-gateway -|- inside | | firewall firewall Then I did the following: On the outside-machine I started an ssh tunnel to our ssh- gateway: # ssh -L 1234:<machine>.inside.net:22 <user_on_ssh_-gateway> @ssh-gateway When the tunnel was up, I opened another session and did the following: # scp -P 1234 <source-file> <user_on_inside>@localhost: <destination-file> Works like a charm, but maybe there is an easier solution? Thanks in advance Christoph 16.7.2003 19:37:32,"Schreiner, Dirk" <Dirk.Schreiner(a)tria.de> wrote: >Hi, > >SCP and SFTP use SSH. >And there will be no >PROXY for SSH due to the Protocol ;-) > >But there are some WorkArounds like Port redirect. >You should describe exactly what you want to do, >so we can see if this is possible. > >Describe the network also. > >Greetings > Dirk > > > >-----Original Message----- >From: Dr. Christoph Wegener [mailto:christoph.wegener@bph.ruhr-uni-bochum.de] >Sent: Wed 16.07.2003 18:01 >To: suse-security(a)suse.com >Cc: >Subject: [suse-security] SCP-proxy / SFTP-proxy wanted >Hi list, >does somebody know a solution for a transparent SCP-proxy or >SFTP-proxy? In the moment we are running SuSE's ftp-prxy but I >want to avoid cleartext password as soon as possible... > >Thanks in advance >Christoph > >PS: Yes I did a google search but that was not very helpfull... >-- > .-. Ruhr-Universitaet Bochum > /v\ L I N U X Lehrstuhl fuer Biophysik > // \\ >Penguin Computing< c/o Dr. Christoph Wegener > /( )\ Gebaeude ND 04/Nord > ^^-^^ D-44780 Bochum, GERMANY > >Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 >mailto:christoph.wegener@bph.rub.de http://www.bph.rub.de > >"Snowflakes are one of nature's most fragile things, but just >look what they can do when they stuck together." (Vesta Kelly) > > > > > > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > >TRIA IT-consulting GmbH >Rosenkavalierplatz 4 >81925 München >Germany >Tel: +49 (89) 92907-0 >Fax: +49 (89) 92907-100 >http://www.tria.de > >-------------------------------------------------------- > > > working hard | for your success > > > >-------------------------------------------------------- > > >Registergericht München >HRB 113466 > >USt.-IdNr. DE 180017238 >Steuer-Nr. 802/40600 > >Geschäftsführer: >Hubertus Wagenhäuser > > >-------------------------------------------------------- > Nachricht von: >Dirk.Schreiner(a)tria.de > >Nachricht an: >christoph.wegener(a)bph.ruhr-uni-bochum.de, suse- security(a)suse.com > ># Dateianhänge: 0 > >Die Mitteilung dieser E-Mail ist vertraulich und nur für den oben genannten Empfänger bestimmt. Wenn Sie nicht der vorgesehene Empfänger dieser E-Mail oder mit der Aushändigung an ihn betraut sind, weisen wir darauf hin, daß jede Form der Kenntnisnahme, Veröffentlichung, Vervielfältigung sowie Weitergabe des Inhalts untersagt ist. Wir bitten Sie uns in diesem Fall umgehend zu unterrichten. >Vielen Dank > >The information contained in this E-Mail is privileged and confidental intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient or competent to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this E-Mail is strictly prohibited. If you have received this E-Mail in error, please notify us immediately. >Thank you > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > > -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Dr. Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:christoph.wegener@bph.rub.de http://www.bph.rub.de "Snowflakes are one of nature's most fragile things, but just look what they can do when they stuck together." (Vesta Kelly)

7 7

Postfix question
by Vitaly Shishakov 20 Jul '03

20 Jul '03

Dear all! Is it possible to set up postfix in the following way, so that it would permit sending mail with unathorized access from internal private network, and at the same time serve as secured password-authorized SMTP to external public network in other words: if i would like to send mail from internal netwrok, i just specify my server as usual SMPT without auth, and if i want to use it from outside, i configure my mail client to use it with SSL enabled and with user/password auth. Any ideas will be highly welcomed!

4 4

strange behaviour useradd / usermod
by mailinglists 20 Jul '03

20 Jul '03

Hi I have two suse 8.2 pro boxes and added approx 30 users to that system. It takes too long to do this with Yast so I did it with useradd which was ok so far. Once I change the users with usermod (especially the password with -p param) this user could not log on to the system anymore. Messages log said "wrong username or password". Has anybody ever seen this before? thanks, Philipp

3 2