September 2003 - openSUSE Security - openSUSE Mailing Lists

Firewall on CD 2 und PSK im Roadwarrior Modus
by Jan Frederik Pielhau 01 Sep '03

01 Sep '03

Hallo Group, Wir verwenden die Suse Linux Firewall on CD 2 mit dem Linux Kernel 2.4.7. Die Firewall verfügt über eine Statische IP-Adresse. Mehrere Aussendienstmitarbeiter Können sich mit IPSec und X.509 Zertifikaten in das Interne Netz einwählen. Nun möchten wir eine Zweigstelle über einen Tunnel anbinden. Die Zweigstelle hat nur eine dynamische IP-Adresse sowie 5 Clients. Für die Anbindung möchten wir keine zweite Suse Linux Firewall nehmen sondern etwas in der Art von Smoothwall - sprich PSK-Authentifikation. Laut Dokumentation ist die Verwendung von PSKs bei Roadwarrior- Clients nicht zulässig. Wie kann man also eine Net-To-Net Verbindung aufbauen, wenn auf einer Seite eine dynamische IP-Adresse vorhanden ist, und man keine X.509 Zertifikate für die Verbindung nutzen kann? Wie wäre es mit Cipe? Aus anderen Projekten ist es mir sehr gut in Erinnerung, lediglich die Interoperabiliät hapert, aber bei einer Net-To-Net Verbindung ist dies ja irrelevant. Vielen Dank für alle Hilfestellungen. Mit freundlichen Grüßen, Jan Pielhau

3 2

Suse Firewall on CD 2 and PSKs in Roadwarrior Configuration
by Jan Frederik Pielhau 01 Sep '03

01 Sep '03

Hello Group, At first, Sorry for the german post, in the archive i found a few german posts and then thought it could be that people here speak german. So - sorry for that - here again in english. We use Suse Linux Firewall on CD with the Kernel # 2.4.7. We never received or installed Updates - so it seems like an initial Release of The Software. The Firewall is set up wit an static IP-Adress. Some homeworkers connect via IPSec and authenticate themselfes with X.509 Certificates. No we would like to connect a branch office. The branch office is connected to the internet by a dsl dialup line, and through PAT, 5 Clients connect to the internet. To connect the whole branch office, we don't like to use a second Suse Linux Firewall, we think for eg. the Smoothwall or something else with Authentfikation by shared secret. The Documentation says that the use of PSK in Roadwarriorconnections is not possible. How can i then build up a Net-To-Net Connection based on Ipsec when the one side has only got a dial-up line an does not support X.509 Certificates? I'd prefer the use of IPSec, but in several tests, the connection between the Suse Linux Firewall and a another box [Fli4l], the authentification failed because fli4l doesn't seem to support 3DES Authentification, just RSA. >From a few other VPN-Projects i know Cipe. What about the Cipe-Implementation in the Suse Linux Firewall, Any recomments? Thank you for any help Regards, Jan Pielhau

1 0

amavisd-new compromised?
by GentooRulez 01 Sep '03

01 Sep '03

Hi all, When i do root@box:/home/sources > md5sum amavisd-new-20030616-p5.tar.gz 13e2ff0818e07f2a86327b641b97a5d6 amavisd-new-20030616-p5.tar.gz with a freshly downloaded tar.gz from http://www.ijs.si/software/amavisd/#download http://www.ijs.si/software/amavisd/amavisd-new-20030616-p5.tar.gz the md5 sum differs from the one i find near by the download link. http://www.ijs.si/software/amavisd/amavisd-new-20030616-p5.tar.gz.md5 which is 13c76432e957ccd302856f64526483a2 amavisd-new-20030616-p5.tar.gz Any hints? Michael

2 1

Re: [suse-security] amavisd-new compromised?
by GentooRulez 01 Sep '03

01 Sep '03

>> the md5 sum differs from the one i find near by the download link. >> >> Any hints? > > Corrupted download? I get the correct one... > (Try what "tar ztf file" says about the it?) Yep, my fault. The file was corrupt, not compromised. Thanks Michael

1 0