February 2004 - openSUSE Security - openSUSE Mailing Lists

pop3 proxing!!
by Joao M.C. Alvega 05 Feb '04

05 Feb '04

hello, i'm in need of help i'm using suse 9.0. I want do foward pop3 from my intranet into the external mail server(isp), but i'm not having any luck in doing so, i have susefirewal2 activated and the proxy in yast activated. for http i'm using squid and for ftp i'm using proxy-suite from suse. i would like to let my intranet to see ther mail form the isp server. thank you for any help that can came from anyone on this list!

2 3

Protecting Exchange with Suse proxy & postfix relay
by Eric Kahklen 05 Feb '04

05 Feb '04

I am currently trying to implement an Exchange 2000 server and it was suggested by a friend that I put a SuSE box between the internet and Exchange. He suggested having Postfix relay incoming mail only to the Exchange box and then allow Exchange to send out its mail through the firewall (Watchguard). Then for the OWA/SSL connectivity, he suggested using Apache's mod_proxy & mod_ssl to protect IIS. I am only going to allow https traffic to my exchange server. My question is, is this plan feasible? and does anyone know if there is a how to out there for this type of configuration? I've never setup Postfix or these Apache modules so I am hoping to find out if its possible since I don't have a lot of time to set this up due to the launch date of Exchange. Thanks and I appologize if this isn't totally on topic, Eric

5 6

Squid Proxy Problem
by Stefan.Junge＠ssi-schaefer.de 05 Feb '04

05 Feb '04

Hi, I´m running a squid proxy on a suse 8.1 box. I have got some problems if I try to download files from websites like http://website.de:8080 I got a connection error. I have pasted port 8080 as safe in squid.conf and no other filter rules should block the site. Any hints ? Stefan

4 3

Re: [suse-security] Iptables PREROUTING
by Vincent Lee 05 Feb '04

05 Feb '04

My setting is like this. Internet --> BB router LAN interface(192.168.1.88) --> eth1(192.168.1.10) Linux box eth0(192.168.0.11) --> LAN (192.168.0.30) windows XP I attached my laptop in BB router with IP 192.168.1.xx in order to test the forward. That means my test case is like this Laptop(192.168.1.xx) --> BB router LAN interface(192.168.1.88) --> eth1 (192.168.1.10) Linux box eth0(192.168.0.11) --> LAN (192.168.0.30) windows XP Any hints? Vincent On Thu, 5 Feb 2004 12:48:36 -0300, Augusto S Amaya wrote > For the netmeeting problem , maybe you would need to compile the [UTF-8?]> iptable module (h323) , i don織t remember if that織s the exact name. > > For the rest , this is the correct map of the connection?? > > {INTERNET} <--------> WINDOWS XP <---------------> LINUX BOX <------- > ---> Laptop > > Tell me if i got it right please , maybe i can help you. > > -------------------------------------------------------------- > Augusto S Amaya > Administrador Certif. Servidores Linux - Dto. de Produccion de [UTF-8?]> Sistemas Per籀n 407 Conmutador: 6329-0000 Tel/Interno: > 4370/4371/4372 Fax: augusto.s.amaya(a)bancogalicia.com.ar > http://www.bancogalicia.com.ar > > "Vincent Lee" > > <vincent.lee@vs-pro Para: "Augusto S > Amaya" <augusto.s.amaya(a)bancogalicia.com.ar> > .com> cc: suse- > security(a)suse.com > Asunto: > Re: [suse-security] Iptables PREROUTING > 05/02/2004 11:46 > > a.m. > > Dear Augusto, > > Thanks for your suggestion. > I already did that to enable the ip forward. > > For the nemeeting, may be it is too difficult to discuss it right > now. Let me say in this way. I have setup my Windows XP to have IIS > on it. I tried to forward the traffic from 192.168.1.10:8081 > (external interface of my linux box) to 192.168.0.30:80 (my windows > box). In between, I have eth0 internal interface of my linux box > with 192.168.0.11 in it. > > Inside my linx box, I have this. > > iptables -t nat -A PREROUTING -i eth1 -o eth0 -p tcp --sport > 1024:65535 -d 192.168.1.10 --dport 8081 -j DNAT --to-destination > 192.168.0.30:80 iptables -A FORWARD -i eth1 -o eth0 -p tcp --sport > 1024:65535 -d 192.168.0.30 --dport 80 -m state --state NEW -j ACCEPT > > However, if I try this on my laptop which is using 192.168.1.x (same > segment > with the external interface of my Linux box), I cannot get it work. > > Any suggestion? > > Best Regards, > > Vincent > > On Thu, 5 Feb 2004 11:54:48 -0300, Augusto S Amaya wrote > > Dear Vicent , first at all , sorry about my por english :) > > > > To enable ipfowarding just do write this in a console: > > > > /bin/echo "1" > /proc/sys/net/ipv4/ip_forward > > > > But , if the netmeeting port also is filtered by the firewall they > > may not work. > > > > -------------------------------------------------------------- > > Augusto S Amaya > > Administrador Certif. Servidores Linux - Dto. de Produccion de Sistemas > > Per鏮 407 Conmutador: 6329-0000 Tel/Interno: 4370/4371/4372 > > Fax: augusto.s.amaya(a)bancogalicia.com.ar http://www.bancogalicia.com.ar > > > > "Vincent Lee" > > > > <vincent.lee@vs-pro Para: SuSE Security > > <suse-security(a)suse.com> > > .com> cc: > > > > Asunto: Re: [suse-security] > > Iptables PREROUTING > > 05/02/2004 11:03 > > > > a.m. > > > > Dear all, > > > > Thanks for your info. I try to enabled the ip forwarding function. > > However, > > > > I still cannot pass it through. > > > > Internet traffic --> My boardband router (all WAN traffic) --> external > > interface of my linux box (eth1, 192.168.1.x). > > > > Behind the Linux box with internal interface eth0 (192.168.0.x), I > > have my Windows XP here. I want to know whether I can setup the MS > > netmeeting or not? > > > > Best Regards, > > > > Vincent > > > > On Wed, 04 Feb 2004 13:48:58 +0200, Ray Leach wrote > > > On Wed, 2004-02-04 at 00:46, Geoffrey wrote: > > > > Vincent Lee wrote: > > > > > Dear all, > > > > > > > > > > I am new to SuSE. I would like to setup the MS netmeeting for a > > > > > computer which behind SuSE firewall. When I made change on the nat, > I > > > > > cannot get it through. It seems that the IP forwarding is disabled > > > > > by SuSE. Can anyone tell me how can I enable it? > > > > > > > > Yast -> Network devices -> network card -> change -> > > > > edit -> routing -> enable ip forwarding > > > > > > > > It's a check box at the lower center of the window. > > > > > > > Or just edit /etc/sysconfig/sysctl > > > and then restart your networking (/etc/rc.d/network restart) > > > > > > > -- > > > > Until later, Geoffrey Registered Linux User > #108567 > > > > Building secure systems inspite of Microsoft > > > -- > > > -- > > > Raymond Leach <raymondl(a)knowledgefactory.co.za> > > > Network Support Specialist > > > http://www.knowledgefactory.co.za > > > "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" > > > Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 > > > -- > > > > -- > > Best Regards, > > > > Vincent Lee > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: suse-security-help(a)suse.com > > Security-related bug reports go to security(a)suse.de, not here > > -- > Best Regards, > > Vincent Lee -- Best Regards, Vincent Lee

1 0

Re: [suse-security] Iptables PREROUTING
by Vincent Lee 05 Feb '04

05 Feb '04

Dear Augusto, Thanks for your suggestion. I already did that to enable the ip forward. For the nemeeting, may be it is too difficult to discuss it right now. Let me say in this way. I have setup my Windows XP to have IIS on it. I tried to forward the traffic from 192.168.1.10:8081 (external interface of my linux box) to 192.168.0.30:80 (my windows box). In between, I have eth0 internal interface of my linux box with 192.168.0.11 in it. Inside my linx box, I have this. iptables -t nat -A PREROUTING -i eth1 -o eth0 -p tcp --sport 1024:65535 -d 192.168.1.10 --dport 8081 -j DNAT --to-destination 192.168.0.30:80 iptables -A FORWARD -i eth1 -o eth0 -p tcp --sport 1024:65535 -d 192.168.0.30 --dport 80 -m state --state NEW -j ACCEPT However, if I try this on my laptop which is using 192.168.1.x (same segment with the external interface of my Linux box), I cannot get it work. Any suggestion? Best Regards, Vincent On Thu, 5 Feb 2004 11:54:48 -0300, Augusto S Amaya wrote > Dear Vicent , first at all , sorry about my por english :) > > To enable ipfowarding just do write this in a console: > > /bin/echo "1" > /proc/sys/net/ipv4/ip_forward > > But , if the netmeeting port also is filtered by the firewall they > may not work. > > -------------------------------------------------------------- > Augusto S Amaya > Administrador Certif. Servidores Linux - Dto. de Produccion de Sistemas > Per鏮 407 Conmutador: 6329-0000 Tel/Interno: 4370/4371/4372 > Fax: augusto.s.amaya(a)bancogalicia.com.ar http://www.bancogalicia.com.ar > > "Vincent Lee" > > <vincent.lee@vs-pro Para: SuSE Security > <suse-security(a)suse.com> > .com> cc: > > Asunto: Re: [suse-security] > Iptables PREROUTING > 05/02/2004 11:03 > > a.m. > > Dear all, > > Thanks for your info. I try to enabled the ip forwarding function. > However, > > I still cannot pass it through. > > Internet traffic --> My boardband router (all WAN traffic) --> external > interface of my linux box (eth1, 192.168.1.x). > > Behind the Linux box with internal interface eth0 (192.168.0.x), I > have my Windows XP here. I want to know whether I can setup the MS > netmeeting or not? > > Best Regards, > > Vincent > > On Wed, 04 Feb 2004 13:48:58 +0200, Ray Leach wrote > > On Wed, 2004-02-04 at 00:46, Geoffrey wrote: > > > Vincent Lee wrote: > > > > Dear all, > > > > > > > > I am new to SuSE. I would like to setup the MS netmeeting for a > > > > computer which behind SuSE firewall. When I made change on the nat, I > > > > cannot get it through. It seems that the IP forwarding is disabled > > > > by SuSE. Can anyone tell me how can I enable it? > > > > > > Yast -> Network devices -> network card -> change -> > > > edit -> routing -> enable ip forwarding > > > > > > It's a check box at the lower center of the window. > > > > > Or just edit /etc/sysconfig/sysctl > > and then restart your networking (/etc/rc.d/network restart) > > > > > -- > > > Until later, Geoffrey Registered Linux User #108567 > > > Building secure systems inspite of Microsoft > > -- > > -- > > Raymond Leach <raymondl(a)knowledgefactory.co.za> > > Network Support Specialist > > http://www.knowledgefactory.co.za > > "lynx -source http://www.rchq.co.za/raymondl.asc | gpg --import" > > Key fingerprint = 7209 A695 9EE0 E971 A9AD 00EE 8757 EE47 F06F FB28 > > -- > > -- > Best Regards, > > Vincent Lee > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here -- Best Regards, Vincent Lee

1 0

Iptables PREROUTING
by Vincent Lee 05 Feb '04

05 Feb '04

Dear all, I am new to SuSE. I would like to setup the MS netmeeting for a computer which behind SuSE firewall. When I made change on the nat, I cannot get it through. It seems that the IP forwarding is disabled by SuSE. Can anyone tell me how can I enable it? Best Regards, Vincent

3 3

RE: Re: [suse-security] Iptables PREROUTING
by Barry Gill 05 Feb '04

05 Feb '04

Geoffrey <esoteric(a)3times25.net> wrote the Feb 4, 2004 12:46 AM: > Yast -> Network devices -> network card -> change -> > edit -> routing -> enable ip forwarding Be smarter to set up FW_ROUTE=YES in SuSEfirewall2

1 0

Custom rules for the Susefirewall2
by suse-security 04 Feb '04

04 Feb '04

Hi list, I'm very new to the subject of administrating a linux server, so please forgive my dumb questions. Currently my server is receiving a lot of spam mail from a certain address. I want to block this rubbish before it hits the smtp-server, hence I'd like to add some rules to the firewall that sorts the stuff out. Is the custom script for the SuseFirewall2 (/etc/sysconfig/scripts/Susefirewall2-custom) the right place for this temporary solution? And which section to I have to use inside this script? I know that I have to setup some proper antispam-software, but in the meantime I just want to drop the mails. Any hints are really welcome Sebastian

3 2

test
by suse-security＠ott-service.de 04 Feb '04

04 Feb '04

��Nv�!�,Kb&B;�_��.��OH��7p��#籈��#cV?a�ǧ��~�y�к|0y��b�[�}��-vvs��]�ځ�.W��(�&�!��pX]Lg3l��g�mS��c��P��K_��ͱH�� G*�p�Vq[yŭʑ|.�t�g��3�#H�\Y�~{�!��UCX'iڝ3\� {ʞC�^�� 1��˧Q�c��7��j�蚹3Db Q7º��"��vS,q��l��8Vgŝ�g��,S|ZB��_�F�UH><�&y��|��MNp�&scJ�v� .�l��鈐S<��ͭ ��f�CGtI;�(*0��/2��)��/� �Q�K�Z��z�]ci\-�B��?�ג�J��F"�?��ȟ��s�#��9hL9��;��H9Oz�B�i.5��a��o�R��{�0J��i4) ׶c��rNu��liUpO�G��֩2��W�a�ǧRJ�氎�r~��)��f��,��Y��g��N(\�ӂ�' ��!!� ��wV�E��l.cOy��0��p�b��ʴPS�{q��!�B�ʒ��?�u��}EC7��Y� �z�v�z�ܬTG2Й�3�kӴm�7 �n�}:u<� �K&�A��fKw�W��u��a�r��M��Co�� Luw�31��M�_/�Y\#-�� 7y�Y<W�j�N-1��Vݴ[i}��NU��:{��\��H

2 1

RE: [suse-security] [Announcement] New fou4s release - 0.11.2
by GarUlbricht7＠netscape.net 04 Feb '04

04 Feb '04

Markus Gaugusch <markus(a)gaugusch.at> wrote: > >Fou4s (Fast OnlineUpdate for SuSE) is an alternative implementation of YOU >(YaST Online Update) and is aimed at admin users that want updates as >painless and automated as possible. But it can also be useful for desktop >users. I've used it to update mozilla, gnome, kde and rpms from >packman.links2linux.org as well. > > See: http://fou4s.gaugusch.at/ > > for more information. > -----<Snip>--- Hi Markus, I just downloaded the new patch using: [boxen1 root]# fou4s --auto --checkfou4s --inversecolor --interactive No problem. Afterwards I checked If I am missing an other security updates. I wasn't. I then went to your site to get the latest and greatest: http://fou4s.gaugusch.at/download.shtml And when I clicked on: fou4s-0.11.2-2.noarch.rpm it returned: **** Not Found **** . The requested URL /download/fou4s-0.11.2-2.noarch.rpm .. was not found on this server. .. Apache/1.3.26 Server at fou4s.gaugusch.at Port 80 I don't know if I got the message because your server is overloaded with people getting the update, or because you took it down, and haven't put it back up At any rate, I am good to go for today, and I will try back later. Friendly greetings, Gar -- __________________________________________________________________ New! Unlimited Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Act now to get a personalized email address! Netscape. Just the Net You Need.

4 4