August 2003 - openSUSE Security - openSUSE Mailing Lists

Re: Re: AW: Re: AW: [suse-security] IPTables and filtering Traffic based on content ( e.g. sobig )
by BLeonhardt＠analytek.de 26 Aug '03

26 Aug '03

I'm looking for possibility to look into the data with ip-tables. not proxies or anything - proxies are too slow ... imho Mit freundlichen Grüßen / Best regards Bruno Leonhardt LPI Level 1 Certified Watchguard Certified System Professional CLP Domino R5 Systemadministrator "Bodo Hoffmann" <hoffmann(a)itfuture.de> schrieb am 25.08.2003 11:23:06: > One question to all those who are using IPTables to filter out > patterns in traffic .... > > HOW ?? > > IPTables is ( and please correct me if I am wrong ) a packet-filter > with the ability to store the states of a connection and use them > to increase the range of the rules used to filter packages .. a > stateful inspection packetfilter .. ( works on ISO/OSI Layer 4/5 ) > > YOU are looking for an application level firewall ( e.g. a proxy ) > which works on ISO/OSI Layer 7 ( Application ) and will be able > to look INTO the package .. this can be done by mailfilters, virus- > scanners, proxies etc... > > You can use IPTables to forward those ports ( eg. 25 SMTP ) to > those filters or use IPTables to block traffic which is sent over > specific ports the virus uses to spread/communicate, but not use > IPTables to SCAN for CONTENTpatterns.... !!!! ( Maybe the name > packetfilter firewall is a bit confusing .. ) > > Bodo Hoffmann > > > > ----- Original Message ----- > From: <BLeonhardt(a)analytek.de> > To: "suse-sec" <suse-security(a)suse.com> > Sent: Monday, August 25, 2003 11:02 AM > Subject: Re: AW: Re: AW: [suse-security] IPTables and filtering Traffic > based on content ( e.g. sobig ) > > > Philipp - could you please give me a hint how to build the rule for the > pattern to filter out ??? > > Mit freundlichen Grüßen / Best regards > Bruno Leonhardt > > LPI Level 1 Certified > Watchguard Certified System Professional > CLP Domino R5 Systemadministrator > > > "mailinglists" <mailinglists(a)belfin.ch> schrieb am 25.08.2003 10:50:21: > > > > > > A few hours ago I read, that it's possible ( with stateful > > > inspection ) to > > > filter by content. > > > > Yes, it is. I filter code red that way. But to do so, you need to know > the pattern. > > I googled for it but could not find anything. > > > > Philipp > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > ---- Start SpamAssassin results > -12.60 points, 6 required; > * 1.0 -- From: does not include a real name > * -3.2 -- Has a In-Reply-To header > * -0.6 -- BODY: Contains twice quoted reply > * -6.6 -- BODY: Bayesian classifier says spam probability is 1 to 10% > [score: 0.0138] > * -3.2 -- BODY: Contains what looks like a quoted email text > > ---- End of SpamAssassin results > > >

3 5

Re: [suse-security] Re: stopping DrDOS attacks against Apache???
by keith＠topaz5.worldonline.co.uk 26 Aug '03

26 Aug '03

Hi Philippe and list! On Mon, 25 Aug 2003, Philippe Vogel wrote: > More simple: > > This is a rule for input chain of your server's firewall. > > Analog to synflodd protection insert this in your firewallscript before you > allow conncetion to port 80: > > # Set your number of max. connections here! > CONNECTION_LIMIT="100" > > iptables -A INPUT -p tcp --dport 80 --syn -m limit --limit > $CONNECTION_LIMIT/h \ > -j LOG --log-prefix 'limit of $CONNECTION_LIMIT connections reaced' > > Reguards > > Philippe > Thanks for the suggestion. I understand what your saying, and I have this in my firewall already. What I'm looking for is a way to identify spoofed IP Syn flood attacks. I thought this could be done by keeping a count of each packet that is making an excessive amount of un-ACKnowleged TCP connections to the server. DrDOS attacks are made by sending packets with spoofed IP source address, for the machine the attacker wishes to target. The server will keep responding to these packets by sending out SYN/ACK packets, and wait for an ACK reply. So, if the source IP address is faked, the server is sending packets to a machine that has not asked for the connection. And the server will keep on sending out SYN/ACK packets till it times out, which could be quite a while. My idea was to keep a count of ALL packets coming to the server, and if there is an excessive amount of packets that are coming from one source IP, in a very short period of time, then this would probably indicate a SYN flood attack. With this information, it would then be possible to tell the server to block ALL future packets from the identified SYN flood source IP address, for an hour or more. (Even though the source IP is faked, this will stop Apache responding with SYN/ACK packets, which could in turn foil a SYN flood attack on someone elses machine). After the pre-configured time-out, connections from the blocked IP address would be allowed again. So you are right, this would work like the limit module in IPTables, but will also give alot more information, which Apache could then act upon. The idea is to build Syn flood attack prevention into Apache, so that the server will identify such attacks, and automatically block them, for a certain period of time, depending on the cofiguration directives allowed by the modifications done to the server. I don't mind working on this with someone else that has experience with Apache development, and is able to make the required modifications to the source code, etc. I have not had a chance to check out the other suggestions yet, but thanks to those that have made comments. Kind Regards - Keith Roberts PS Would anyone like a copy of httpd.conf that I have reworked, and divided into 4 main include files? If so, I will email it to you off this list. snip->............. # The configuration directives have been regrouped into four basic sections: # 1. Directives that deal with dynamic loading of different Apache modules, # for extending the functionality of Apache web server. # # 2. Directives that control the operation of the Apache server process as a # whole (the 'global environment'). # # 3. Directives that define the parameters of the 'default' server, # which responds to requests that aren't handled by a virtual host. # These directives also provide default values for the settings # of all following virtual hosts. # # 4. Settings for virtual hosts, which allow Web requests to be sent to # different IP addresses or hostnames and have them handled by the # same Apache server process. snip->............. (a reworked copy of php.ini and chapter 3 configuring PHP is available as well, if anyone would like a copy)

2 1

Stateful Inspection Technology
by BLeonhardt＠analytek.de 25 Aug '03

25 Aug '03

Hi, if somebody is interested of the definition of Stateful Inspection I could send you a Sheet by Checkpoint ( they developed stateful inspection ) where exactly is defined what stateful inspection is - and what it does. Mit freundlichen Grüßen / Best regards Bruno Leonhardt LPI Level 1 Certified Watchguard Certified System Professional CLP Domino R5 Systemadministrator

4 3

[suse-security] unsubscription
by Catalin Nitipir 25 Aug '03

25 Aug '03

> unsubscription

1 0

Re: [suse-security] Re: IPTables and filtering Traffic based on content ( e.g. sobig
by GentooRulez 25 Aug '03

25 Aug '03

Check this: iptables -m string --string "signatur" -j DROP -I INPUT -i ethX -p tcp --sport 110 for pop-server e.g. you'll need libipt_string.so Here is the whole story http://articles.linuxguru.net/view/125 Michael

1 0

Re: AW: AW: Re: AW: [suse-security] IPTables and filtering Traffic based on content ( e.g. sobig )
by BLeonhardt＠analytek.de 25 Aug '03

25 Aug '03

thank you very much ! that helps ... Mit freundlichen Grüßen / Best regards Bruno Leonhardt LPI Level 1 Certified Watchguard Certified System Professional CLP Domino R5 Systemadministrator "mailinglists" <mailinglists(a)belfin.ch> schrieb am 25.08.2003 11:19:40: > > > > Philipp - could you please give me a hint how to build the > > rule for the > > pattern to filter out ??? > > the rules are simple: > iptables -A INPUT -p 6 -s 0/0 -d $ip_laneth --dport 80 -m string --string > "default.ida" -j DROP > iptables -A INPUT -p 6 -s 0/0 -d $ip_laneth --dport 80 -m string --string ". > exe?/c+tftp" -j DROP > iptables -A INPUT -p 6 -s 0/0 -d $ip_laneth --dport 80 -m string --string > "cmd.exe" -j DROP > iptables -A INPUT -p 6 -s 0/0 -d $ip_laneth --dport 80 -m string --string > "root.exe" -j DROP > > this is for code red and some other old stuff still trashing the net. > > the pattern for sobig I don't know, I'm afraid. If anybody does, please feel > free to post it. > > Philipp > >

1 0

AW: [suse-security] IPTables and filtering Traffic based on content ( e.g. sobig )
by Ulrich Roth 25 Aug '03

25 Aug '03

Hi Bruno, > does anybody know a short solution how to check if a special > squence is > inside a packet ( like the string of sobig ) ? I guess you want to block Sobig.F before it hits your MTA. There exist mail filters for sendmail, exim and postfix. Have a look at this: http://www.heise.de/newsticker/data/dab-20.08.03-004/ If you have postfix, you shouldn't use the solution suggested on this page, but use the original solution. There is a link on the page, but for your convenience I give you the URL in this mail: http://sbserv.stahl.bau.tu-bs.de/~hildeb/postfix/postfix_sobigf.shtml This one works great for us. Bye Uli -- Ulrich Roth IMPACT Business & Technology Consulting GmbH Im Mediapark 8 / KölnTurm D-50670 Koeln Phone +49-221-93 70 80-29 Fax +49-221-93 70 80-15 E-Mail: roth at impact dot de

4 4

AW: Re: AW: [suse-security] IPTables and filtering Traffic based on content ( e.g. sobig )
by mailinglists 25 Aug '03

25 Aug '03

> A few hours ago I read, that it's possible ( with stateful > inspection ) to > filter by content. Yes, it is. I filter code red that way. But to do so, you need to know the pattern. I googled for it but could not find anything. Philipp

2 1

IPTables and filtering Traffic based on content ( e.g. sobig )
by BLeonhardt＠analytek.de 25 Aug '03

25 Aug '03

Hi, does anybody know a short solution how to check if a special squence is inside a packet ( like the string of sobig ) ? This should be done with iptables - guessing that SuSE-Firewall isn't able to do that. Mit freundlichen Grüßen / Best regards Bruno Leonhardt LPI Level 1 Certified Watchguard Certified System Professional CLP Domino R5 Systemadministrator

1 0

unsubscription
by Tomáš Vondra 24 Aug '03

24 Aug '03

unsubscription -- Tomáš Vondra Dobřenice 43 503 25 Dobřenice foun: +42603485111 laeticia(a)email.cz

1 0