September 2003 - openSUSE Security - openSUSE Mailing Lists

lsh
by Adam Daniel 17 Sep '03

17 Sep '03

Has anyone tried getting lsh working on a SuSE machine? http://www.lysator.liu.se/~nisse/lsh/ adam -- Technical Consultant ----------------------------------------------------------------------- FORENSIC DATA SERVICES PTY LIMITED http://www.forensicdata.com.au ------------------------------------------------------------------------ The information contained in this e-mail is confidential and is intended solely for the addressee. If you received this e-mail by mistake please notify us immediately and delete all copies of this message. You must not disclose or use in any way the information in the e-mail. It is the responsibility of the recipient to virus scan this e-mail and any attachments included.

3 2

SuSEfirewall2 for transparent ftp-proxy (proxy-suite)?
by Tim Wilson 17 Sep '03

17 Sep '03

Hi folks, Has anyone made SuSEfirewall2 work with ftp-proxy (proxy-suite) in transparent mode? I have set everything up according to the mini-howto except using SuSEfirewall2 instead of direct ipchains commands. Non-transparent mode (UseMagicChar etc) works fine (and so does my transparent Squid http proxy), but when I attempt to ftp in tranparent mode eg $ ftp ftp.suse.de then I get the following message: USER-WRN requested transparent proxy dest 192.168.3.3 is local ^^^^^^^^^^^ This is the internal address of my firewall (running the proxy). Is there is something about the way SuSEfirewall2 does redirection that loses the original destination address? Or does it work for everyone else and I've just messed up the configuration? A few details: I do not use masquerading, since the external network is connected to the Internet with a ADSL modem/bridge that does NAT, so I redirect with FW_FORWARD. I am interested only in FTPing from the internet to local machines. I am using SuSEfirewall2-3.1-28 and ftp proxy "(Version 1.7tp7 - 2001/06/20 21:05:20)" on SuSE 7.2 (kernel 2.4.4) straight off the CD (apart from those two packages). Thanks for your help, Tim _________________________________________________________________ Surf the net and talk on the phone with Xtra Jetstream @ http://www.xtra.co.nz/products/0,,5803,00.html !

1 0

Problems with postfix and TLS
by Roland Freeman 16 Sep '03

16 Sep '03

Hi all! I am trying to configure postix with sasl and tls. The sasl part works nicely, not so the tls part: 220 my_obscured_hostname ESMTP My Mail 1.0 (i386) EHLO my_obscured_hostname 250-my-obscured_hostname 250-PIPELINING 250-SIZE 90000000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH GSSAPI PLAIN LOGIN DIGEST-MD5 CRAM-MD5 250-AUTH=GSSAPI PLAIN LOGIN DIGEST-MD5 CRAM-MD5 250-XVERP 250 8BITMIME STARTTLS 454 TLS not available due to temporary reason I have followed closely the instructions in this web page: http://postfix.state-of-mind.de/patrick.koetter/smtpauth/index.html In my logs, this is the problem: Sep 17 00:41:18 my_hostname postfix/smtpd[21918]: starting TLS engine Sep 17 00:41:18 my_hostname postfix/smtpd[21918]: unable to get private key from '/etc/postfix/newreq.pem' Sep 17 00:41:18 my_hostname postfix/smtpd[21918]: 21918:error:0906406D:PEM routines:DEF_CALLBACK:problems getting password:pem_lib.c:114: Sep 17 00:41:18 my_hostname postfix/smtpd[21918]: 21918:error:0906A068:PEM routines:PEM_do_header:bad password read:pem_lib.c:430: Sep 17 00:41:18 my_hostname postfix/smtpd[21918]: 21918:error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:missing asn1 eos:ssl_rsa.c:707: Sep 17 00:41:18 my_hostname postfix/smtpd[21918]: TLS engine: cannot load RSA cert/key data my_hostname is my obscured hostname. I am not clear how to solve this problem.

2 2

Load balancing + SFQ
by Ariel Sabiguero 16 Sep '03

16 Sep '03

Hi there! I am about to set-up an Internet connection that binds two ADSL lines (don't ask why two instead of one bigger!). I also would like to implement fair queuing over both lines. As I have really little time to do this I would like to ask your comments so I try less and do more. Regards Ariel

3 2

Encrypted Directories and loopback
by -linux_lad 16 Sep '03

16 Sep '03

According to the suse.com website, a new feature in 8.2 is "Encryption of directories and partitions ". I can't find a detailed explanation of what this entails or how to use it. My guess is that this is simply loopback encryption, and really isn't new(if so, it's dishonest to suggest that it's a new feature). I bought Suse 8.2 Pro soley because I thought that this is a new feature, but I can't find a good explanation of it anywhere. Has anyone gotten anywhere with the directory encryption? Is it really just loopback, or is there some new feature that they just didn't document real well? I found the tool to add encrypted loopback devices in the partition manager, but can't find anything that supports the "encrypted folders claim. Could someone enlighten me please? -- -ll

1 0

openssh exploit?
by Frank Steiner 16 Sep '03

16 Sep '03

Hi, is there already a statement if the SuSE openssh versions are vulnerable? http://lists.netsys.com/pipermail/full-disclosure/2003-September/010103.html I looked in the patched version for SuSE 7.3 and if I understand the fix at http://www.freebsd.org/cgi/cvsweb.cgi/src/crypto/openssh/buffer.c.diff?r1=1… then the 7.3 version seems to be vulnerable, too. cu, Frank -- Dipl.-Inform. Frank Steiner Mail: fst(a)bio.informatik.uni-muenchen.de Lehrstuhl f. Bioinformatik Mail: frank(a)familiesteiner.de LMU, Theresienstrasse 39 Phone: +49 89 2180-4049, Fax: -4054 80333 Muenchen, Germany http://www.informatik.uni-kiel.de/~fst/

2 1

Re: [suse-security] Load balancing + SFQ
by GentooRulez 16 Sep '03

16 Sep '03

@Ariel Sabiguero You asked 4 loadbalancing(sharing) over 2 DSL Here are the chapters i know that deals with this topic http://lartc.org/howto/lartc.rpdb.multiple-links.html http://lartc.org/howto/lartc.loadshare.html http://lartc.org/howto/lartc.qdisc.html Does that help? Michael

1 0

Re: [suse-security] Load balancing + SFQ
by GentooRulez 16 Sep '03

16 Sep '03

For your education http://lartc.org/#download Here you'll find all informations you need to setup those things. Yours Michael

1 0

DOS problem with SuSE 8.1 kernel 2.4.19- (neighbour table overflow)
by Philipp Rusch 16 Sep '03

16 Sep '03

Hello all, Sorry for the long post, but I really have a no idea anymore ... I'm still having problems with "neighbour table overflows" when we use iptables 1.2.7a and kernel 2.4.19 form SuSE 8.1 original distro. The PC is working as firewall/proxy between a LAN (10.104.0.0/16), an intranet (10.101.0.0 - 10.107.0.0/16) and the internet, which we can only acces through cascaded proxies at 149.206.x.y. I thought last week that we solved it, when our cisco found "incomplete" TCP connections and we switched network cards, but the problem keeps coming back. We even switched the complete machine in the meantime. Today we have the situation as follows: One of the other participants in the intranet got the blaster worm in their net, they are still struggling with this. So we get bombed with tons of connections on port 135 from their destination, when the worm(s) scan our net. This fills our arp table / ip connection table with some 17.000-20.000(!) connections in "half open" state, the kernel then throws thousnads of messages like "Neighbour table overflow" and "neighbour table flood" at high rates. When memory is filled, the network services on this box simply stop working. I would call this a classical DOS attack, but what can I do against it ? I already drop all relevant packets from that source, I would have thought that the iptables / kernel code could manage this traffic (sitting behind a 2 MBit link with a PIII-500 / 256 MB RAM) Here is what I do against the most common "attacks" # NETBIOS # run_iptables -A common -p udp --dport 137:139 -j reject run_iptables -A common -p udp --dport 445 -j reject run_iptables -A common -p tcp --dport 139 -j reject run_iptables -A common -p tcp --dport 445 -j reject run_iptables -A common -p tcp --dport 135 -j reject ############################################################################ # UPnP # run_iptables -A common -p udp --dport 1900 -j DROP ############################################################################ # BROADCASTS # run_iptables -A common -d 255.255.255.255 -j DROP run_iptables -A common -d 224.0.0.0/4 -j DROP ############################################################################ # AUTH -- Silently reject it so that connections don't get delayed. # run_iptables -A common -p tcp --dport 113 -j reject ############################################################################ # DNS -- Silenty drop late replies run_iptables -A common -p udp --sport 53 -mstate --state NEW -j DROP Any helping tip is welcome, Philipp

2 3

Re: [suse-security] SuSEfirewall2 and Reverse Masq HELP !
by Chris de Orla 16 Sep '03

16 Sep '03

No luck ! Just to confirm the last message, I should have the following: FW_DEV_EXT="eth1" (this is a public address -lets say eee.eee.eee.1) FW_DEV_INT="eth0" (this is a private address -lets say iii.iii.iii.1) FW_DEV_DMZ="eth2" (this is also a private address -lets say ddd.ddd.ddd.1) FW_MASQ_NETS= iii.iii.iii.0/24 ddd.ddd.ddd.0/24 FW_FORWARD="0/0,ddd.ddd.ddd.2" (ddd.ddd.ddd.2 is the mailserver on the far side of the DMZ) FW_FORWARD_MASQ="0/0,ddd.ddd.ddd.2,tcp,25" The rest, although not needed, shouldn't matter (FW_SERVICE_*_*) if there or not. When I did this, I still get an ACCEPT message in the syslog but no connection through to the DMZ postfix server. Does it matter if an application on the firewall using port 25 is running also ? I can telnet from the firewall to the DMZ on port 25. I can telnet from the DMZ to port 25 on the firewall (not really used or usefull but it is open). Connections from the outside, the message in the syslog is SuSE_FW_ACCEPT versus how I had it before. (FW_FORWARD_MASQ to an internal ip gave a SuSE_FW_ACCEPT_REVERSE_MASQ in the syslog) @$%$U*^&*&^*^(&*( HELP !!!!!!! > ----- Original Message ----- > From: "Thomas Schweiger" <El_Don(a)schweigisito.de> > To: <suse-security(a)suse.com> > Sent: Monday, September 15, 2003 5:25 PM > Subject: Re: [suse-security] SuSEfirewall2 and Reverse Masq HELP ! > > > > On Mon, 15 Sep 2003, Chris de Orla wrote: > > > > > I want to reverse masquerade on port 25 from the internet to a DMZ > address. > > > > [...] > > > > > If I make the reverse-masq to something on the internal network, it > connects > > > no problem, anything on the DMZ does not and no failures in syslog. > > > > > > What am I missing here ? > > > > > > I am running SuSE 7.3 and iptables 1.2.8 > > > > > > Below is my firewall2.rc.config : > > > > > > FW_DEV_EXT="eth1" > > > FW_DEV_INT="eth0" > > > FW_DEV_DMZ="eth2" > > > > eth2: > > Is it a private net-address? (e. g. 192.168.0.1 = yyy.yyy.yyy.yyy) > > > > > FW_ROUTE="yes" > > > FW_MASQUERADE="yes" > > > > > > FW_MASQ_DEV="$FW_DEV_EXT" > > > FW_MASQ_NETS="xxx.xx.x.x/24" > > > > I asume xxx.xxx.xxx.xxx as your private LAN net-address? (e. g. > > 192.168.1.1) > > > > You should include yyy.yyy.yyy.yyy/aa or at least the ports the DMZ should > > reach in the internet. > > > > > FW_PROTECT_FROM_INTERNAL="yes" > > > FW_AUTOPROTECT_SERVICES="yes" > > > > > > FW_SERVICES_EXT_TCP="123 25" > > ^^^^ > > You don't need this, because the service (smtpd) is not running on the > > firewall. > > > > > FW_SERVICES_EXT_UDP="123" > > > FW_SERVICES_EXT_IP="" > > > FW_SERVICES_DMZ_TCP="25" > > ^^^^ > > Here the same. You don't need this. > > > > > FW_SERVICES_DMZ_UDP="" > > > FW_SERVICES_DMZ_IP="" > > > FW_SERVICES_INT_TCP="22 123 25 10000" > > ^^^^ > > And again. > > > > > FW_SERVICES_INT_UDP="123" > > > FW_SERVICES_INT_IP=""FW_TRUSTED_NETS="xxx.xx.x.x/24" > > > > > > FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" > > > FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" > > > > > > FW_SERVICE_AUTODETECT="yes" > > > FW_SERVICE_DNS="no" > > > FW_SERVICE_DHCLIENT="no" > > > FW_SERVICE_DHCPD="no" > > > FW_SERVICE_SQUID="no" > > > FW_SERVICE_SAMBA="no" > > > > > > FW_FORWARD="" > > > > Here you have to put in the services which should be routed from LAN to > > DMZ (in general packets from private network to private network or from > > official IPs to official IPs which don't need NAT oder DNAT) > > > > > FW_FORWARD_MASQ="0/0,y.y.y.y,tcp,25" > > > > This should be ok, if y.y.y.y is a private IP-address in the DMZ. > > > > > > All the FW_*_*-parameters are just for this case, if the services are > > running _ON_ the firewall. > > > > > > > > # > # > > > > #-------------------------------------------------------------------------# > > > # > # > > > # EXPERT OPTIONS - all others please don't change these! > # > > > # > # > > > > #-------------------------------------------------------------------------# > > > # > # > > > > [...] > > > > Best regards, > > Thomas Schweiger > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > >

1 0