January 2004 - openSUSE Security - openSUSE Mailing Lists

AW: [suse-security] hotmail messager
by Rasp, Robert 30 Jan '04

30 Jan '04

Hello, what's about a transparent Proxy with iptables and squid?? - you have full control what your users can do/see in the I-Net - with 'squidguard' you can filter the content - the configuration of the users does not change CU Robert -----Ursprüngliche Nachricht----- Von: Frédéric Poulet [mailto:pofrederic@yahoo.fr] Gesendet: Freitag, 30. Januar 2004 09:26 An: suse-security(a)suse.com Betreff: RE: [suse-security] hotmail messager --- "Sturgis, Grant" <Grant.Sturgis(a)arraybiopharma.com> a écrit : > To block MSN Messenger (what you are calling hotmail messager), you must either know all the IP > addresses that MS will use for this (all of loginnet.passport.msn.com) and be willing to change > them every time MS makes changes (which is frequently) or you must use an HTTP proxy. Other > options include other application firewalls, but we can ignore them for now. > > Do you let all your clients surf the web directly? yes > If so, then you probably will have to opt > for the blocking of all the IP addresses. Please note that this will also break Hotmail and any > other Passport related websites. ok but how i do it ? > HTH- > > -GS > > > -----Original Message----- > > From: Frédéric Poulet [mailto:pofrederic@yahoo.fr] > > Sent: Thursday, January 29, 2004 3:35 PM > > To: suse-security(a)suse.com > > Subject: Re: [suse-security] hotmail messager > > > > > > i can, i think so what i must do ? > > > > > > Pardon this: > > > This electronic message transmission is a PRIVATE communication which contains > information which may be confidential or privileged. The information is intended > to be for the use of the individual or entity named above. If you are not the > intended recipient, please be aware that any disclosure, copying, distribution > or use of the contents of this information is prohibited. Please notify the > sender of the delivery error by replying to this message, or notify us by > telephone (877-633-2436, ext. 0), and then delete it from your system. > Yahoo! Mail: votre e-mail personnel et gratuit qui vous suit partout ! Créez votre adresse à http://mail.yahoo.fr -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

susefirewall and port
by Frédéric Poulet 30 Jan '04

30 Jan '04

Hi, I would like to configure my susefirewall to use only the ports 80, 25, 21. How i can do this ? Thanks for your help ! _________________________________________________________________ Do You Yahoo!? -- Une adresse @yahoo.fr gratuite et en français ! Yahoo! Mail : http://fr.mail.yahoo.com

5 19

RE: [suse-security] hotmail messager
by Sturgis, Grant 30 Jan '04

30 Jan '04

To block MSN Messenger (what you are calling hotmail messager), you must either know all the IP addresses that MS will use for this (all of loginnet.passport.msn.com) and be willing to change them every time MS makes changes (which is frequently) or you must use an HTTP proxy. Other options include other application firewalls, but we can ignore them for now. Do you let all your clients surf the web directly? If so, then you probably will have to opt for the blocking of all the IP addresses. Please note that this will also break Hotmail and any other Passport related websites. HTH- -GS > -----Original Message----- > From: Frédéric Poulet [mailto:pofrederic@yahoo.fr] > Sent: Thursday, January 29, 2004 3:35 PM > To: suse-security(a)suse.com > Subject: Re: [suse-security] hotmail messager > > > i can, i think so what i must do ? > Pardon this: This electronic message transmission is a PRIVATE communication which contains information which may be confidential or privileged. The information is intended to be for the use of the individual or entity named above. If you are not the intended recipient, please be aware that any disclosure, copying, distribution or use of the contents of this information is prohibited. Please notify the sender of the delivery error by replying to this message, or notify us by telephone (877-633-2436, ext. 0), and then delete it from your system.

3 2

Ruxcon - Call For Papers
by Adam Daniel 30 Jan '04

30 Jan '04

CALL FOR PAPERS RUXCON's call for papers has commenced and we are accepting presentation and workshop submissions for RUXCON 2004. The venue of the conference is hosted at the UNIVERSITY OF TECHNOLOGY, SYDNEY. RUXCON will open on Saturday the 10th of July and run for 2 days over the weekend. Presentations and workshops will continue to be accepted up until May 15th. * What is RUXCON? http://www.ruxcon.org RUXCON is a conference organised by and for the Australian computer security community. It is an attempt to bring together the individual talents of the Australian scene through live presentations, activities and demonstrations. The conference is held over two days in a relaxed and informal atmosphere, allowing attendees to enjoy themselves whilst expanding their knowledge of security. Live presentations, activities and workshops will cover a full range of defensive and offensive security topics, varying from unpublished research to required reading for the public security community. * Presentation Submissions Presentations are set to run for 50 minutes and are generally of a more in-depth and technical nature. Workshops are slightly shorter, between 30-40 minutes in length in a less formal format, more of a general or introductory skill level. If you have any enquiries, or would like to make a submission, please send an e-mail to presentations(a)ruxcon.org. Submissions should thoroughly outline your desired presentation or workshop subject. Accompanying your submission should be the slides you intend to use or a detailed paper explaining your subject. If approved we will additionally require: i. A brief personal biography (between 2-5 paragraphs in length), including: skill set; experience, and credentials. ii. A description on your presentation or workshop (between 2-5 paragraphs in length). * Selection Criteria Presentation selection will be based on technical merit. Presentations discussing new, previously undisclosed, defensive or offensive security related material will receive first priority. * Contact Details Presentation Submissions: presentations(a)ruxcon.org Private Enquiries: rux(a)ruxcon.org General Enquiries: staff-con(a)ruxcon.org

1 0

Re: [suse-security] FreeSwan Kernel Config
by David White 29 Jan '04

29 Jan '04

Thanks for the reply, however, I still get an error when I issue the command. What directory should I be in when I execute it? When I try make coloneconfig in the /usr/src/linux directory it responds with # make: ***No Rule to make target ** Stop. I have 2.4.21-15 Kernel installed according to YaST. David ----- Original Message ----- From: "Philippe Vogel" <filiaap(a)freenet.de> To: "David White" <dwhite(a)fddisystems.com> Sent: Monday, January 26, 2004 6:01 PM Subject: Re: [suse-security] FreeSwan Kernel Config > > I then issued the following commands > > # cd /usr/src/linux > > # make xconfig > > (left all the default settings in xconfig) > > # make dep > > # make bzImage > > # cd /usr/src/kernel-module/zz_freeswan > > # make xgo > > If you got kernel-source fresh installed, the config does not match the > installed one. > > make coloneconfig && make deps > > Makes the configfile from SuSE original config and the deps needed by > kernel-source. > > Afterwards do, what is said in the manual, > e.g.: > > cd /usr/src/kernel-modules/zz_freeswan && make xgo > > Philippe > >

4 3

SuSEfirewall2: outgoing packets, IPv6
by Marciano Siniscalchi 29 Jan '04

29 Jan '04

Hi, I am running SUSE 9.0, Kernel 2.4.21-166-default on my office PC; I have a standard Ethernet connection with a static IP address. My PC is for desktop use only, i.e. not as a server, router, etc. etc. I am running Gnome 2.4 (from the SuSE RPM's). My employer (Northwestern University) has a firewall in place. I have also set up SuSEfirewall2 using Yast2 to block all incoming traffic except for SSH, which I use to access my PC from home. So no Web/FTP/SMTP/IMAP/POP/SMB/NFS servers. Only SSH (or at least that's my intention!) Other than that, everything is set to its default configuration, and I have not tweaked the SuSEfirewall2 config file. Now, looking at the firewall logs, I have noticed the following warning regarding *outgoing* packets dropped: Jan 28 15:34:21 marciano kernel: SuSE-FW-OUT-IPv6_PROHIB IN= OUT=eth0 SRC=<my IPv6 address> DST=2001:0610:0240:0000:0193:0000:0000:0202 LEN=80 TC=0 HOPLIMIT=64 FLOWLBL=0 PROTO=TCP SPT=16925 DPT=80 WINDOW=5760 RES=0x00 SYN URGP=0 OPT (020405A00402080A0534B7830000000001030300) There are quite a few of these, although not every day; for instance, I had 6 yesterday, and none as of today at noon. The SPT is not always the same, but it's never a "known" (to me, i.e. from /etc/services or the Firewall Forensics Web page) port. Moreover, I really don't know what could be sending out these packets. This is the only outgoing packet that appears in the firewall logs. A while back I installed Ximian-Gnome, including Red Carpet; the Red Carpet daemon also generated outgoing packets which SuSEfirewall2 blocked, but I have since uninstalled it, so that should not be a concern. Any ideas? Thanks in advance! -- Marciano Siniscalchi Ph (847) 491-5398 Department of Economics Fax (847) 491-7001 Northwestern University http://www.faculty.econ.northwestern.edu/faculty/siniscalchi

1 0

SuSEfirewall2 as bridging firewall
by Christian Richter 29 Jan '04

29 Jan '04

Good Morning list, I have following problem: I have been unable to set up a working SuSEfirewall2 on a bridge running on a SuSE 9.0 system using kernel 2.6.1 (also tried the supplied 2.6.0-test-5, but didn't change anything). The bridge is working fine, the firewall loads and runs without errors, I can see logs that make quite sense. Only what doesn't work is the forwarding. No matter from where I try to forward where I receive a message like: SuSEfirewall ILLEGAL-ROUTING phsyindev=eth0 physoutdev=eth1 .... So my question: is it possible to get this setup working at all? Any comments appreciated. Thanx in advance, Christian internal net ---- bridge ---- router ---- external net

3 2

Re: [suse-security] nat of locally generated connections (correction)
by BLeonhardt＠analytek.de 29 Jan '04

29 Jan '04

I'll correct my statement : it shouldn't work - MASQUERADE is only valid for POSTORUTING :-( ... but how do I do that instead ? didn't find anything useful yet - even not at netfilter.org in the nat howtos... I need to masq locally generated outgoing packets for dynamic ip ... -bruno

3 2

Tripwire now works
by suse＠rio.vg 29 Jan '04

29 Jan '04

I'd just like to say 'thanks' to the SuSE people. Tripwire now works great... The list can now go back to whining about promotionfactory, viruses, and whether ext3 is cooler than reiserfs. :-)

1 0

Fw: Fw: Fw: [suse-security] sftp with no ssh login
by Manuel Balderrábano 29 Jan '04

29 Jan '04

> Manuel Balderrábano wrote: > > >Ups! You are absolutely right! > > > >I did not want to change my instalation, but it looks not only the best > >solution but the only one. > > > >Regards. > > > > > > Why don't change in /etc/password the shell to /bin/false ? Because if I did so, users wouldn't be able to use the sftp service. > > > > > > > > >

2 1