January 2004 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 behaves strangely
by Andreas Grommek 09 Jan '04

09 Jan '04

Hi everybody! I do not know exactly if I am right at this mailing list with my problem but I don't know where else to go. I am using a SuSE linux 9.0 box as a DSL-router/gateway for my small LAN at home and have encountered some strange problems with the SuSEfirewall2 v3.1. The firewall is loaded automatically at boot-time and almost everything is ok. Routing for the internal machines works fine and all services running on the firewall (vsftpd, smbd, sshd, dhcpd, ...) can be accessed from internal machines but not from the "outside world". A port scan (via Steve Gibson's "ShieldsUp" at http://www.grc.com/) shows, that all ports are stealthed and my firewall does not react to ICMP pings (but it reacts to "ping" from the internal although I specified FW_ALLOW_PING_*="no" !!!). So far, so good, but I am not able to access the internet *from* the firewall! But that's not all. When I execute # SuSEfirewall2 stop # SuSEfirewall2 start the behavior is different: Now I can access the internet from the firewall (which I like) but another portscan reveals, that the IDENT-port (tcp-port 113) is now "only" closed (not stealth anymore, which I do not like) and occasionally (not reproduceable) the firewall responds to ICMP pings from the outside. OK, I know, that is *not* a very big security-issue, but it IS strange, isn't it? I dont't know if I can trust my firewall if it behaves so strangely. What can I do??? Does anybody know how I can tell the SuSEfirewall2... ... to stealth *all* ports to the internet, including port 113. ... to ignore all ICMP-requests from the outside. ... to allow ICMP-requests from the LAN. ... to access the internet from my firewall-machine. Here is my /etc/sysconfig/SuSEfirewall2 - file (without comments): ********************************************************************* FW_QUICKMODE="no" FW_DEV_EXT="dsl0 eth1 ppp0" FW_DEV_INT="eth0" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.1.0/24 192.168.2.1" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="ftp ssh 137 138 139 445 901 8000 8001" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="no" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="no" FW_LOG_ACCEPT_CRIT="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" # END of /etc/sysconfig/SuSEfirewall2 # Expert options: FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" ******************************************************** Thanks for any help you could offer! Andreas (Berlin, Germany)

2 1

Re: [suse-security] SuSEfirewall2 behaves strangely
by Marc Samendinger 09 Jan '04

09 Jan '04

> -----Original Message----- > From: agrommek(a)web.de [mailto:agrommek@web.de] > Sent: Friday, January 09, 2004 12:21 AM > To: suse-security(a)suse.com > > > Hi everybody! Hi Andreas, first of all sorry but I can't help you with your problem because I don't know SuSEfirewall2. > Does anybody know how I can tell the SuSEfirewall2... > ... to stealth *all* ports to the internet, including port 113. nothing wrong about that > ... to ignore all ICMP-requests from the outside. very bad idea, don't just block all icmp packets. One reaseon why you should _not_ do this is explained here http://www.iks-jena.de/mitarb/lutz/usenet/Firewall.html#PMTUD > ... to allow ICMP-requests from the LAN. > ... to access the internet from my firewall-machine. > Thanks for any help you could offer! > Andreas (Berlin, Germany) marc

1 0

Re: Problems with quota on k_smp 2.4.20
by Philippe Vogel 09 Jan '04

09 Jan '04

Hello! After getting many posts I did a fix within /etc/init.d/quota to enable quotas on SL 8.2/smp kernel: [...] start) echo "Turning on quota " # NOTE: startproc return 0, even if service is # already running to match LSB spec. touch $RUNFILE insmod quota_v2 # <= change here for quotas on SuSE 8.2 with quota v2 support on smp kernel! $QUOTAON_BIN -avug # Remember status and be verbose rc_status -v ;; stop) [...] With this settings quotas work. This is for those having the same problems I had. Philippe

3 3

Crypted filesystem
by Philippe Vogel 08 Jan '04

08 Jan '04

Hi! I got two questions related to crypted filesystems: 1) I use crypted filesystem on a laptop with dualboot for securing data in the case of getting it stolen. hdd0: W2K with crypted filesystem hdd1: SuSE 8.2 with cryptofs provided by SuSE for /home only This leads to following problem: The original bootloader (grub) is replaced by the security driver and I had to use W2K bootloader instead. I followed the steps discribed on http://portal.suse.com/sdb/de/1997/06/nt.html and it worked for me before installing the bootdriver for the hddcrypting using "dd if=/dev/hda0 of=/root/bootsek.lin byte=512 count=1". After installing the security bootdrivers it fails to boot with the W2K bootloader. Afaik grub only needs to know where stage2 is and that is said in stage1 which is placed in the mbr in this case in the bootimage I made. Booting with floppy does work with the same bootimage placed on the floppy. Any hints for copying the image from the floppy? 2) I want to crypt a filesystem on another machine (dual PII 350/512MB ram) with lvm and don't want to have performanceloss because of /dev/loop. I first tested this with cryptofs provided by SuSE but I had a great performanceloss as you can see here: with cryptofs max. 2MB/s over samba w/o cryptofs max. 6-9 MB/s over samba Is there a possibility to directly mount a crypted filesystem within kernel and is there any stable kernelmodule for that purpose (des 128bit would be "secure enough" for me). Philippe

2 1

Problems with mc after kernelupdate from source to 2.4.21-168
by Mario Neubert 08 Jan '04

08 Jan '04

hello list, after a kernelupdate(new installation) from kernel-source-2.4.21-168.tar.bz2, all seems to work correctly. Only the "Midnight Commander 4.5.55" in a non-root-shell make some trouble. As root no problems. mn@merkur:~> mc Screen size 0x0 is not supported. Check the TERM environment variable. mn@merkur:~> What's wrong? Thanks for any hint's. /mario

1 1

Spam catcher on this list? - Pleas get rid of it!
by Hubertus A. Haniel 08 Jan '04

08 Jan '04

It is nice to know that there is some sort of spam catcher on this mailing list. I have posted a message yesterday and today with a seperate reply to field. In each case I have got back a message from maillist(a)promotionfactory.net very shortly after that (on the second post to my reply to) stating: > Please reply to this e-mail to receive our current specials. If others should get > this, include their e-mail also. Can we please get rid of this? Thanx Hubba

4 3

8.1 and kernel-source tarball
by Olaf Kirch 08 Jan '04

08 Jan '04

Hi, by accident, the kernel source tarball for 8.1-i386 that ended up on FTP was for release 169, while the binary kernel was 168. According to several reports, this caused compilation of the vmware modules to fail. I've now placed a new kernel source tarball with the correct release number in /pub/.../update/8.1/kernel/2.4.21-20040105 Olaf -- Olaf Kirch | Stop wasting entropy - start using predictable okir(a)suse.de | tempfile names today! ---------------+

1 0

Can be Authenticated When Checking into CUPS Admin
by John Dey 08 Jan '04

08 Jan '04

Hello Everybody: I am a new SuSE user. I have installed SL9.0. I want to use CUPS to configure printers on a local network. When I browse to http://localhost:631, I get the top level from CUPS. However, when I click on Administration and respond to username and password by entering my root account information, I am informed that can not be authenticated. I am stuck. I have tried with KDE (response with the authentication message) and Mozilla browser (just comes back repeatedly and asks for username and password). I don't have the same problem with RH8--although the version of CUPS are probably different. Does anyone have any ideas how I can correct the situation? If this is the wrong list, please let me know as well. Thanks in advance for your assistance. John Dey

3 2

Tripwire on SLES8
by Tom Knight 08 Jan '04

08 Jan '04

Hi, I'm installing a SLES 8 machine, keeping to three sources: 1. Original CDs 2. United Linux SP3 CD 3. YOU >From these sources I seem to only be able to install Tripwire 1.2, whereas I know that Tripwire 2.3 is available for SuSE Pro 8.2. I've used Tripwire 2.3 before, but not 1.2 - I can't help noticing that with 1.2 I don't have (for example) a twadmin command. I know I could just dopwnload the rpm file from ftp://ftp.suse.com/pub/suse/i386/8.2/suse/i586/ but obviously I'd rather only use software intended for release with SLES... Tom. --------------- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk Tel: (0)20 7928 7371

3 3

samba problem
by Marcos M. Osorio 07 Jan '04

07 Jan '04

Hello, i have the 2.2.3a samba version on a suse machine, the problem is that i want to set several policies in the shared directory, an example could be that some users have to only read permisions and other group of users full control. How can i set this? By the linux or by the samba? thanks.

2 1