August 2003 - openSUSE Security - openSUSE Mailing Lists

How-to configure telnet?
by Tommy Rönnholm 16 Aug '03

16 Aug '03

Hi list and Gurus! I use SuSE Linux 8.1 (Computer 1), Windows XP Pro (Computer 2) and network gateway to internet ISP. I want to run telnet or ssh from Computer 2 to Computer 1. Do anyone now how-to configure this? I need your advise. Hälsningar/Regards - Tommy Rönnholm ======================================= Tel/phone: 070-6400232 Int: +46(70)6400232 Fax: 070-3889387 Int: +46(70)3889387 tommy.ronnholm(a)elcaro.se http://www.elcaro.se

4 4

Postfix Update on 8.1
by Pierre Bernhardt 16 Aug '03

16 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, after an Postfix Update on 8.11 i get no new mails further. After I have reinstall old Version, the problem is not there. For every mail, that i should receive I got an message looks like these: Aug 13 00:17:01 hostname postfix/qmgr[29475]: 568B5C1FB:to=<user(a)host.de>, relay=none, delay=286010, status=deferred (unknown mail transport error) Later in logfile found these message: Aug 13 00:17:01 space postfix/qmgr[29475]: warning: premature end-of-input from private/local socket while reading input attribute n ame Aug 13 00:17:01 space postfix/qmgr[29475]: warning: private/local socket: malformed response Aug 13 00:17:01 space postfix/qmgr[29475]: warning: transport local failure -- see a previous warning/fatal/panic logfile record for ~ the problem description Can anybody give an hint, how the problem can be solved? Especially i'm using procmail as the local transport agent. MfG... Pierre Bernhardt -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE/Ow6ZuOJP+ESj7AoRAgPOAJ9M9plaQKuCgGYE74PcVswmHYYk4wCeLGeq tO45rn3byUx2piTPD8BkDbc= =11Rp -----END PGP SIGNATURE-----

2 3

Re: [suse-security] Postfix Update on 8.1
by Pierre Bernhardt 16 Aug '03

16 Aug '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sven 'Darkman' Michels schrieb: | Pierre Bernhardt wrote: |> Hello, Hi and thx for your help 1st. | is it possible that you don't restart postfix? afaik it's a version | update, too (from 1.1.11 -> 1.1.12) so if you don't restart postfix, | it may have compatibily problems due to internal changes. Thats not the Problem. I have restartet postfix and further on the whole compter. Nothing has helped me. MfG... Pierre -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (MingW32) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQE/PdHkuOJP+ESj7AoRArX0AJ9EPpi9BgQJmJmZ06iHvlUL7PoxzwCgr5y2 i9gxPmRSOSpnNSK8ZGisN0w= =h7Y8 -----END PGP SIGNATURE-----

1 0

YOU does not install Kernel Update
by matthias-wieser＠t-online.de 15 Aug '03

15 Aug '03

Hi, I'm using Suse 8.2 with Kernel k_athlon-2.4.20-86. There should be an update to k_athlon-2.4.20-100 which YOU doesn't show. YOU only installed the kernel-source update (without first showing it (maybe because You thinks this packet have been updated in the past) until you click on "include installed patches" (dt: installierte Patches einschließen). What should I do to install the Kernel? Should I click on "include installed patches" then manually select "kernel optimized for Athlon CPUs" and then select update? Is this really the way to do it? Matthias -- The site www.sco.com is running Apache/1.3.14 (Unix) mod_ssl/2.7.1 OpenSSL/0.9.6 PHP/4.0.3pl1 on Linux. (http://uptime.netcraft.com/up/graph?site=www.sco.com)

5 7

Stealthing Port 113
by Philip B Cook 15 Aug '03

15 Aug '03

I am running SUSE Linux 8.2 (v2.4 kernel). I am using the machine as a router, firewall (SUSEFirewall2) and http proxy (squid) for my home network. I have checked using www.grc.com which ports I have open to the outside world and find that all ports up to 1056 are in stealth mode EXCEPT port 113 (IDENT) which is reported as closed. So my machine can be detected on this port although it will not respond. I have seen suggestions that it is possible to ROUTE any incoming traffic on port 113 to a fictitious IP address on my local net, resulting in full stealth. Does anyone know how this can be done by configuring my SUSEFirewall2.conf file. I do not have a DMZ setup. The firewall machine is also providing a caching DNS and DHCP services to the local network as well as being the Browse Master for my Windows network using SAMBA. Any suggestions on how to prevent port 113 being visible. Also.. is there a way to get new settings from SUSFirewall2.conf to be loaded without having to reboot. Thanks for your help. Philip

7 7

Re: [suse-security] YOU does not install Kernel Update
by GarUlbricht7＠netscape.net 15 Aug '03

15 Aug '03

*Matthias-wieser(a)t-online.de (Matthias Wieser) wrote on Thu, 14 Aug 2003: > >> Hi, >> >> I'm using Suse 8.2 with Kernel k_athlon-2.4.20-86. >> There should be an update to k_athlon-2.4.20-100 which YOU doesn't show. ... ... YOU may not show it, but SuSE does at: http://www.suse.com/us/private/download/updates/82_i386.html .. .. >> YOU only installed the kernel-source update (without first showing it >> (maybe because You thinks this packet have been updated in the past) >> until you click on "include installed patches" >> (dt: installierte Patches einschließen). >> What should I do to install the Kernel? ---- <text deleted> --- In reply Hilbert.Steinbach(a)t-online.de (Hilbert Steinbach) wrote on 8/14/03: > >Hi Matthias, > >before downloading and installing the new kernel think if you really >need to upgrade within a patchlevel. If you need/want urgently >update, you can download the wanted kernel on ftp.suse.com (...). .. ... Or as I mentioned above from: http://www.suse.com/us/private/download/updates/82_i386.html .. ... >Find out your current working kernel version with 'uname -r'. Choose >now the rpm packet with the corresponding newest kernel. As i recall >you should use for installation rpm -Uvh --force --nodeps >kernel<version>.rpm. There is also an article on the SuSE support >pages covering this topic. Doublecheck if SuSE has some new specific >informations there. > >Best regards Hil > .. Matthias, I have couple of comments: 1.) uname -r doesn't give rpm version number, assuming you don't have a custom kernel, whereas for the stock SuSE kernel's "pin k_athlon" does. (in my box I need to use "pin k_deflt" because that is the kernel I am using; others "pin k_psmp") .. 2.) SuSE provides patch rpms to cut down the load on their servers. However, in the case of kernel the difference between patch and "whole" in general is relatively small and I want the whole kernel anyways in case I have to reinstall... so why use patch ??? 3.) But if you are using a "patch", I wouldn't use: "rpm -Uvh --force --nodeps *.rpm" I would want to know if patch worked with what I got installed. (in fact using Kpackage I would do a test install) 4.) However, as I said, I prefer not to use the patch kernel. Also not to use YOU to upgrade kernels. I get the kernel via ftp, run "rpm -qpi ..." on it to verify it's name, do "rpm -v --checksig ..." to verify that it's for real and then install from "init 1" using: rpm -Uvh *.rpm 2>&1 | tee text.txt in case the install give any interesting messages, then run "SuSEconfig" SuSE is getting more sophisticated with YOU, but there are enough horror stories" about YOU that the above approach seems better, at least to me. Those who are running custom kernels are probably laughing out loud over my approach, but hey it works... HTH GAr __________________________________________________________________ McAfee VirusScan Online from the Netscape Network. Comprehensive protection for your entire computer. Get your free trial today! http://channels.netscape.com/ns/computing/mcafee/index.jsp?promo=393397 Get AOL Instant Messenger 5.1 free of charge. Download Now! http://aim.aol.com/aimnew/Aim/register.adp?promo=380455

2 1

RE: Re[2]: [suse-security] SuSEfirewall2 and Active ftp
by Knut Erik Hauslo 15 Aug '03

15 Aug '03

The problem with FTP is, that at some point during the communication, FTP Client and FTP Server "agreee" on using a different port than 21 and 20 TCP. If you use a sniffer you would see that the FTP client sends packets on destination port 21 with source port > 1024. When transfer starts the FTP clients send a port request on which port to use for transfer. In most cases this is source port + 1. With the sniffer, at some point you will see (provided you use normal FTP an not passive) something like this "PORT 12,34,56,78,65,43". This means the client will listen on ip address 12.34.56.78 on Port 16683 for the data channel. (NOTE: the port is the 65,43 pair and is calculated like this: (65x256)+43=16683). Without masquerading, and allowed FTP, I only got this working by additionally open ports 1024-65535. Now, suppose you allow outgoing 20,21 for FTP, you'd also need to open incoming high ports. Unfortunately, this parameter does not seem to work if you do not masquerade, so you need to add a forwarding rule which permits high ports from the outside world. This again leaves those ports always open, not only when FTP sessions needs them. With masquerading, this worked fine: FW_MASQ_NETS="172.19.0.0/16,0/0,tcp,20 172.19.0.0/16,0/0,tcp,21 172.19.0.0/16,0/0,tcp,80" FW_FORWARD_MASQ="0/0,172.19.6.10,tcp,80" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" Cheers

5 6

Why more than 1 hole in FW for IPSec
by René Matthäi 15 Aug '03

15 Aug '03

Hi, if my VPN GW is behind the firewall, why is it - generally, in theory - neccessary to have the firewall open IP 50, 51 and UDP 500 (ISAKMP). Why - in theory - is hasn't everything been designed to use ONE single connection through one port and protocol? Why not e. g. use SSL/TLS with PKI and that's it? Higher and lower level traffic can be packed and tunneled through even a higher network layer, can't it? Greetings, René

3 2

Re: [suse-security] VPN, NAT and LDAP or FTP
by René Matthäi 15 Aug '03

15 Aug '03

Hi, Mark C. wrote: > > [...] > > All the machines on LAN-A have a route added: > > 10.2.0.0/255.255.255.0 via VPN-A Default route via FW-A That's okay - but I don't understand right at this moment why this is neccessary. Can't the FW route the traffic to 10.2.0.0/255.255.0.0 (resp. the other addresses on LAN-B)? > FW-A is setup to forward appropriate ports to the VPN-A to allow the > VPN to establish. Eg, with CIPE, just a single udp forwarding is > needed. > > [...] > > I have this exact setup running perfectly fine. You might put a rule > on both firewalls to block traffic to the other LAN (except from the > VPN machine) from being NAT'd - this basically ensures you don't leak > any information for a machine that's missing the right routing. You talked of CIPE. Do you use CIPE or another solution? Do you think that a VPN with FTP and LDAP between two VPN GWs each inside a NATed intranet would be possible with IPSec implementations, e. g. FreeS/WAN? My impression is that this - quite useful as I mean - setup maybe only works with L2TP, IPSec over L2TP (if _that_ exists), CIPE or (v)tun or tinc. Ré

2 4

Securing postfix with saslauthd
by Evert Smit 14 Aug '03

14 Aug '03

Hi List, i just had to completely resetup my server, du to the fact that it's been hacked :( so i am switching from sendmail to postfix atm. i managed to setup saslauth, but every reboot test ends up, that i have to manually reboot saslauthd and postfix before sasl authentication for smtp works again. Does anyone experience the same issue? i don't want to run the risk, to be on vacation, experience a server reboot and be left with an open relay. regards Evert -------------------------------------------------- Evert Smit Mob +41 (079) 419 4865 Pho +41 (01) 607 4034 Fax +41 (01) 687 4033 Mail evert.smit(a)sidhe.net -------------------------------------------------- This mail is sent to the recipient only and is not meant to be passed on to third parties at any time without written permission of the sender. Statements in this mail reflect purely my personal points of view and are not connected in any way to other parties such as Companyies or other people. --------------------------------------------------

2 1