July 2003 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] SCP-proxy / SFTP-proxy wanted
by Schreiner, Dirk 17 Jul '03

17 Jul '03

Hi, SCP and SFTP use SSH. And there will be no PROXY for SSH due to the Protocol ;-) But there are some WorkArounds like Port redirect. You should describe exactly what you want to do, so we can see if this is possible. Describe the network also. Greetings Dirk -----Original Message----- From: Dr. Christoph Wegener [mailto:christoph.wegener@bph.ruhr-uni-bochum.de] Sent: Wed 16.07.2003 18:01 To: suse-security(a)suse.com Cc: Subject: [suse-security] SCP-proxy / SFTP-proxy wanted Hi list, does somebody know a solution for a transparent SCP-proxy or SFTP-proxy? In the moment we are running SuSE's ftp-prxy but I want to avoid cleartext password as soon as possible... Thanks in advance Christoph PS: Yes I did a google search but that was not very helpfull... -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Dr. Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:christoph.wegener@bph.rub.de http://www.bph.rub.de "Snowflakes are one of nature's most fragile things, but just look what they can do when they stuck together." (Vesta Kelly) -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here TRIA IT-consulting GmbH Rosenkavalierplatz 4 81925 München Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de -------------------------------------------------------- working hard | for your success -------------------------------------------------------- Registergericht München HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschäftsführer: Hubertus Wagenhäuser -------------------------------------------------------- Nachricht von: Dirk.Schreiner(a)tria.de Nachricht an: christoph.wegener(a)bph.ruhr-uni-bochum.de, suse-security(a)suse.com # Dateianhänge: 0 Die Mitteilung dieser E-Mail ist vertraulich und nur für den oben genannten Empfänger bestimmt. Wenn Sie nicht der vorgesehene Empfänger dieser E-Mail oder mit der Aushändigung an ihn betraut sind, weisen wir darauf hin, daß jede Form der Kenntnisnahme, Veröffentlichung, Vervielfältigung sowie Weitergabe des Inhalts untersagt ist. Wir bitten Sie uns in diesem Fall umgehend zu unterrichten. Vielen Dank The information contained in this E-Mail is privileged and confidental intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient or competent to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this E-Mail is strictly prohibited. If you have received this E-Mail in error, please notify us immediately. Thank you

2 1

Re: [suse-security] SCP-proxy / SFTP-proxy wanted
by GentooRulez 17 Jul '03

17 Jul '03

On Thu, 17 Jul 2003 08:51:03 +0200 (CEST), Markus Gaugusch <markus(a)gaugusch.at> wrote: > On Jul 17, GentooRulez <paranoiac_user(a)freenet.de> wrote: > >> Maybe stunnel kann help you de encode your ftp-traffic. > FTP is a very weird protocoll. FTP over SSL is just more weird! I'd > recommend to use HTTP for servers offering files, and sftp/scp for > uploads. > > Markus If you use ftp in passive-mode the control connection that transports the user/password data can by encrypted via stunnel. http://www.stunnel.org/examples/ftp.html snip --- >well, so long, so good maybe it would be a niche idea to >add some info to your faq explaining that secured ftp >control connection, using pasive mode, is possible as >indicated above wheras a secured data connection >evidently cannot be established over stunnel. --- snap Hope that helps Michael

1 0

RE: [suse-security] SuSEfirewall2 and Active ftp
by Knut Erik Hauslo 17 Jul '03

17 Jul '03

I got this working ONLY by masquerading and only from one direction (internal lan) to the other (external lan). The other way around will most probably only work if you have a FTP server in a DMZ. This is my config (with masquerading) FW_DEV_EXT="eth1" FW_DEV_INT="eth0" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="172.19.0.0/16,0/0,tcp,20 172.19.0.0/16,0/0,tcp,21 172.19.0.0/16,0/0,tcp,80" FW_FORWARD_MASQ="0/0,172.19.6.10,tcp,80" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" I am my self using a SuSE firewall between two lans. Another solution might be to use SuSE firewall in combination with Squid or so, but I am working on this issue my self currently. Cheers -----Original Message----- From: André Sänger [mailto:Andre.Saenger@gmx.de] Sent: Wednesday, July 16, 2003 4:46 PM To: suse-security(a)suse.com Subject: [suse-security] SuSEfirewall2 and Active ftp Hallo suse-security, I´m still not sure how to configure SuSEfirewall2 to get active ftp working. The Server is between two LANs and doing no masquerading. from the config: FW_FORWARD="[...] \ myip,ftpserverip,tcp,21 \ myip,ftpserverip,tcp,20" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" Now if I try to establish a connection I get a connect, but when trying to list the ftp-dir the ftp client hangs. The firewall-log says: Jul 16 16:13:51 [firewallmachine] kernel: SuSE-FW-DROP-DEFAULT IN=eth1 OUT=eth0 SRC=[ftpserverip] DST=[myip] LEN=60 TOS=0x08 PREC=0x00 TTL=62 ID=46457 DF PROTO=TCP SPT=20 DPT=1137 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A16229CFF0000000001030300) What else is needed to get active ftp working through SuSEfirewall2? If I insert a rule like $IPTABLES -A $CHAIN -j "$ACCEPT" -m state --state ESTABLISHED,RELATED -d $quelle -s $ziel -p tcp --sport 20 in SuSEfirewall2-custom active ftp works again, but I don´t think that´s the proper way? There has to be something in /etc/sysconfig/SuSEfirewall2 I´m missing. The Firewall machine is running SuSE8.2Professional, Kernel 2.4.20-4GB-athlon -- Mit freundlichen Grüßen, André Sänger mailto:Andre.Saenger@gmx.de -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] SCP-proxy / SFTP-proxy wanted
by GentooRulez 17 Jul '03

17 Jul '03

May be stunnel kann help you de encode your ftp-traffic. www.stunnel.org Michael

2 1

SCP-proxy / SFTP-proxy wanted
by Dr. Christoph Wegener 16 Jul '03

16 Jul '03

Hi list, does somebody know a solution for a transparent SCP-proxy or SFTP-proxy? In the moment we are running SuSE's ftp-prxy but I want to avoid cleartext password as soon as possible... Thanks in advance Christoph PS: Yes I did a google search but that was not very helpfull... -- .-. Ruhr-Universitaet Bochum /v\ L I N U X Lehrstuhl fuer Biophysik // \\ >Penguin Computing< c/o Dr. Christoph Wegener /( )\ Gebaeude ND 04/Nord ^^-^^ D-44780 Bochum, GERMANY Tel: +49 (234) 32-25754 Fax: +49 (234) 32-14626 mailto:christoph.wegener@bph.rub.de http://www.bph.rub.de "Snowflakes are one of nature's most fragile things, but just look what they can do when they stuck together." (Vesta Kelly)

3 2

Re: [suse-security] Problems with a simple Firewall2 config
by GentooRulez 16 Jul '03

16 Jul '03

>There are no services ON THE FIREWALL that need to be accessed (I >allready ran into this problem ;-), they are all on serveres in either >network. Oops, i misunderstood you. >I changed my configuration, just to test. This is how (excerpt) it >looked: > FW_MASQ_NETS="172.19.0.0/16,0/0,tcp,20 172.19.0.0/16,0/0,tcp,21 >172.19.0.0/16,0/0,tcp,80" > FW_FORWARD_MASQ="0/0,172.19.6.10,tcp,80" Looks good so far >Test-configuration > FW_MASQ_NETS="172.19.0.0/16" > FW_FORWARD_MASQ="0/0,172.19.6.10,tcp,80" This is opening any destination port/protocol(icmp,udp,tcp) for inside boxes to get routed through the firewall. >It will work with my test-configuration, but then again, any user could >use any service on the external net, and that is not wanted only FTP and >HTTP. >How can I solve this, whitout doing something like this: > FW_MASQ_NETS="172.19.0.0/16,0/0,tcp,20 172.19.0.0/16,0/0,tcp,21 >172.19.0.0/16,0/0,tcp,80 172.19.0.0/16,0/0,tcp,1024:65535" > FW_FORWARD_MASQ="0/0,172.19.6.10,tcp,80" >??? Using the firewall-script this ist the right way to limit the services to be accessed from the inside. The other way ist to disable masquaring und routing for the internal network completely and to setup following: http://www.squid-cache.org/ http://dansguardian.org/ (cacade, if you want so) and ftp-proxy from here http://www.suse.de/en/whitepapers/proxy_suite/ It is, all in all, the better and more secure solution and you can setup this fully tranparent to internal network. Hope that helps. Yours Michael

3 4

SuSEfirewall2 and Active ftp
by André Sänger 16 Jul '03

16 Jul '03

Hallo suse-security, I´m still not sure how to configure SuSEfirewall2 to get active ftp working. The Server is between two LANs and doing no masquerading. from the config: FW_FORWARD="[...] \ myip,ftpserverip,tcp,21 \ myip,ftpserverip,tcp,20" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" Now if I try to establish a connection I get a connect, but when trying to list the ftp-dir the ftp client hangs. The firewall-log says: Jul 16 16:13:51 [firewallmachine] kernel: SuSE-FW-DROP-DEFAULT IN=eth1 OUT=eth0 SRC=[ftpserverip] DST=[myip] LEN=60 TOS=0x08 PREC=0x00 TTL=62 ID=46457 DF PROTO=TCP SPT=20 DPT=1137 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A16229CFF0000000001030300) What else is needed to get active ftp working through SuSEfirewall2? If I insert a rule like $IPTABLES -A $CHAIN -j "$ACCEPT" -m state --state ESTABLISHED,RELATED -d $quelle -s $ziel -p tcp --sport 20 in SuSEfirewall2-custom active ftp works again, but I don´t think that´s the proper way? There has to be something in /etc/sysconfig/SuSEfirewall2 I´m missing. The Firewall machine is running SuSE8.2Professional, Kernel 2.4.20-4GB-athlon -- Mit freundlichen Grüßen, André Sänger mailto:Andre.Saenger@gmx.de

1 0

Problem with new kernel for 8.0
by Armin Schoech 16 Jul '03

16 Jul '03

Hi ! I have an ACER TravelMate 529TXV notebook running a fully patched SuSE 8.0 system. Now I just installed the latest kernel update for 8.0 that appeared today on the SuSE FTP-server. First I was missing a note that I had to change the lilo.conf file and re-run lilo to get it working. I was kind of hoping YOU would include this. Anyway, now I can boot without error messages in the bootlog. Unfortunately, the system is not running stable anymore and producing kernel errors like the ones shown below. I'm not too good in kernel debugging so I would appreciate any help I can get on this ! Anyone else on this list experiencing similar problems ? Clueless.... Armin Jul 15 19:29:05 pibu7 kernel: kernel BUG at page_alloc.c:99! Jul 15 19:29:05 pibu7 kernel: invalid operand: 0000 Jul 15 19:29:05 pibu7 kernel: CPU: 0 Jul 15 19:29:05 pibu7 kernel: EIP: 0010:[__free_pages_ok+57/892] Not tainted Jul 15 19:29:05 pibu7 kernel: EFLAGS: 00010206 Jul 15 19:29:05 pibu7 kernel: eax: c02afcf8 ebx: c1169250 ecx: c02afb60 edx: 00000060 Jul 15 19:29:05 pibu7 kernel: esi: c1997590 edi: 00001000 ebp: 00000000 esp: c1541edc Jul 15 19:29:05 pibu7 kernel: ds: 0018 es: 0018 ss: 0018 Jul 15 19:29:05 pibu7 kernel: Process lpd (pid: 913, stackpage=c1541000) Jul 15 19:29:05 pibu7 kernel: Stack: c1169250 c1997590 00001000 07861067 03229065 c13c8820 00000001 c02afc2c Jul 15 19:29:05 pibu7 kernel: c1030020 c02afc64 00000203 ffffffff 000035f2 c0131bb1 c01322c5 c1169250 Jul 15 19:29:05 pibu7 kernel: c0125b29 c1169250 00000000 c012608f 07861067 c148b420 c13c8820 40164000 Jul 15 19:29:05 pibu7 kernel: Call Trace: [__free_pages+29/32] [free_page_and_swap_cache+49/52] [__free_pte+89/96] [zap_page_range+495/732] [exit_mmap+181/280] Jul 15 19:29:05 pibu7 kernel: [mmput+57/88] [do_exit+168/624] [sys_exit+15/16] [system_call+51/64] Jul 15 19:29:05 pibu7 kernel: Jul 15 19:29:05 pibu7 kernel: Code: 0f 0b 63 00 06 9c 26 c0 83 7b 08 00 74 08 0f 0b 65 00 06 9c Jul 15 19:29:06 pibu7 kernel: kernel BUG at filemap.c:81! Jul 15 19:29:06 pibu7 kernel: invalid operand: 0000 Jul 15 19:29:06 pibu7 kernel: CPU: 0 Jul 15 19:29:06 pibu7 kernel: EIP: 0010:[add_page_to_hash_queue+26/48] Not tainted Jul 15 19:29:06 pibu7 kernel: EFLAGS: 00010206 Jul 15 19:29:06 pibu7 kernel: eax: c1169010 ebx: c1169010 ecx: 00000000 edx: cff858e4 Jul 15 19:29:06 pibu7 kernel: esi: 00000001 edi: cff858e4 ebp: cff858e4 esp: c1535e44 Jul 15 19:29:06 pibu7 kernel: ds: 0018 es: 0018 ss: 0018 Jul 15 19:29:06 pibu7 kernel: Process smpppd (pid: 968, stackpage=c1535000) Jul 15 19:29:06 pibu7 kernel: Stack: c0129bcf c1169010 c69f9188 00000030 c0129c90 c1169010 c69f9188 00000030 Jul 15 19:29:06 pibu7 kernel: cff858e4 00000030 00000007 00000039 c6069c60 c6069c60 c0129cee 00000000 Jul 15 19:29:06 pibu7 kernel: 00000031 00000039 c69f9188 c012b1c3 c6610400 40058794 c13c8420 00000000 Jul 15 19:29:06 pibu7 kernel: Call Trace: [add_to_page_cache_unique+95/120] [page_cache_read+168/224] [read_cluster_nonblocking+38/64] [filemap_nopage+271/528] [do_no_page+158/780] Jul 15 19:29:06 pibu7 kernel: [handle_mm_fault+94/264] [do_page_fault+423/1356] [do_page_fault+0/1356] [wake_up_process+11/16] [__do_generic_file_read+1139/1152] [generic_file_read+126/268] Jul 15 19:29:06 pibu7 kernel: [file_read_actor+0/196] [sys_read+231/240] [error_code+52/64] Jul 15 19:29:06 pibu7 kernel: Jul 15 19:29:06 pibu7 kernel: Code: 0f 0b 51 00 f3 94 26 c0 6a 01 50 e8 de 6b 00 00 83 c4 08 c3 Jul 15 19:29:13 pibu7 kernel: kernel BUG at page_alloc.c:101! Jul 15 19:29:13 pibu7 kernel: invalid operand: 0000 Jul 15 19:29:13 pibu7 kernel: CPU: 0 Jul 15 19:29:13 pibu7 kernel: EIP: 0010:[__free_pages_ok+71/892] Not tainted Jul 15 19:29:13 pibu7 kernel: EFLAGS: 00010206 Jul 15 19:29:13 pibu7 kernel: eax: c02afcf8 ebx: c12a2c30 ecx: c02afb60 edx: 00000060 Jul 15 19:29:13 pibu7 kernel: esi: c148828c edi: 00002000 ebp: 00000000 esp: c1447edc Jul 15 19:29:13 pibu7 kernel: ds: 0018 es: 0018 ss: 0018 Jul 15 19:29:13 pibu7 kernel: Process rc (pid: 386, stackpage=c1447000) Jul 15 19:29:13 pibu7 kernel: Stack: c12a2c30 c148828c 00002000 0e0eb067 0f5e6065 c13c8320 00000001 c02afc2c Jul 15 19:29:13 pibu7 kernel: c1030020 c02afc64 00000203 ffffffff 000049c4 c0131bb1 c01322c5 c12a2c30 Jul 15 19:29:13 pibu7 kernel: c0125b29 c12a2c30 00001000 c012608f 0e0eb067 c13c6900 c13c8320 400a2000 Jul 15 19:29:13 pibu7 kernel: Call Trace: [__free_pages+29/32] [free_page_and_swap_cache+49/52] [__free_pte+89/96] [zap_page_range+495/732] [exit_mmap+181/280] Jul 15 19:29:13 pibu7 kernel: [mmput+57/88] [do_exit+168/624] [sys_exit+15/16] [system_call+51/64] Jul 15 19:29:13 pibu7 kernel: Jul 15 19:29:13 pibu7 kernel: Code: 0f 0b 65 00 06 9c 26 c0 89 d8 2b 05 b0 13 30 c0 8d 14 80 89 -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

2 1

RE: [suse-security] Firewall2 log problem
by M. Edwin 16 Jul '03

16 Jul '03

Hi, I follow your suggestion and it works. I think I should learn more about how the SuSE work, seems like I missed this part. Thanks also to Ulrich Roth, Stefan Seyfried, Joe Morris, and Arjen de Korte for your explanation (it makes SuSE list very valuable). Kind Regards, M. Edwin -----Original Message----- From: Hans-Peter Willhauck [mailto:hpwillhauck@t-online.de] Sent: Tuesday, July 15, 2003 10:24 PM To: Moh Edwin Subject: AW: [suse-security] Firewall2 log problem Hi, the problem you are describing is: You removed the firewall logfile with a running syslogd. That means your syslogd is using the old firewall file in spite of removing (try lsof -i). Just restart the syslogd (/etc/init.d/syslog restart) and the problem should be fixed. hp -----Ursprüngliche Nachricht----- Von: M. Edwin [mailto:edwin@nsi.co.id] Gesendet: Dienstag, 15. Juli 2003 15:49 An: suse-security(a)suse.com Betreff: [suse-security] Firewall2 log problem Hi list, I just found strange problem on my server. I run Susefirewall2 on 7.3, and i just found that since 3 days ago my firewall didn't write the log to /var/log/firewall and the file size is 0. I try touch firewall to that file but still don't work. I remember that several days ago I gz the file manually, and remove the old firewallxxxxxx.gz to save space. Was it the cause? Can anybody give the clue? TIA Edwin -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: why is new sax2 (8.1) missing SuSE build key ?
by GarUlbricht7＠netscape.net 15 Jul '03

15 Jul '03

Marcus-- I just downloaded from two rpms for my 8.1 box, namely: http://rpmfind.creatis.insa-lyon.fr/linux/RPM/suse/suse/i386/8.1/suse/i586/… http://rpmfind.creatis.insa-lyon.fr/linux/RPM/suse/suse/i386/supplementary/… The first rpm was an October 2002 build labeled "sax2-4.7-171.i586.rpm" and it was signed by the "SuSE Package Signing Key <build(a)suse.de>", whereas the second, labeled "sax2-4.7-440.i586.rpm" (a July 2nd 2003 build) had only a MD5 (MD5 sum OK: bc3d052924097f8266b9f1a147015026) when I checked it using rpm -v --checksig. It appears that both packages were created by you. Can you shead any light on why this is so?? Thank you. Gar -- In the Beginning was the Command Line ---Neal Stephenson -- __________________________________________________________________ McAfee VirusScan Online from the Netscape Network. Comprehensive protection for your entire computer. Get your free trial today! http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397 Get AOL Instant Messenger 5.1 free of charge. Download Now! http://aim.aol.com/aimnew/Aim/register.adp?promo=380455

1 0