March 2004 - openSUSE Security - openSUSE Mailing Lists

Per user config for SpamAssassin with amavisd-new and cyrus-imapd
by David Huecking 26 Sep '04

26 Sep '04

Hi folks, maybe someone could give me a hint... I switched from: fetchmail->sendmail->sendmail.milter->Amavis->.forward->procmail->spamc(SpamAssasin)->INBOX which did global virus checking and per user spam checking with Bayes testing to fetchmail->postfix->amavisd-new->perl-spamassassin->cyrus-imapd which does global virus and global spam checking BUT NO PER USER spam checking, so without Bayes testing! :-( So the rate of unreconised spam did increase. I fiddled around with options in the /etc/mail/spamassassin/local.cf, but they were ignored because amavisd-new calls spamassin via perl interface and takes some SA parameters from the /etc/amavisd.conf (beginning with $sa_). I tried calling a SUIDed cyrus deliver (without SUID deliver hasn't got the right: deliver[3876]: connect(/var/lib/imap/socket/lmtp) failed: Permission denied) to user cyrus via .forward and a .procmailrc. The log said that lmtpd was called, but depending on the syntax of deliver in the .procmailrc the mail was delivered to the INBOX-file in /var/spool/mail or just vanished! One example for my .promailrc: :0 fw |/usr/bin/spamc -f |/usr/lib/cyrus/bin/deliver -e -a david -m user.david and the .forward: "|IFS=' ' && exec /usr/bin/procmail -f- || exit 75 #user" Could someone give me a hint using sieve or procmail for a per user SpamAssassin check? Thanks in advance. -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

2 2

Bridging Firewall with traffic-shaping
by Guido Tschakert 01 Apr '04

01 Apr '04

Hello, I want to install a Bridge between our dsl-router and company network. Major task should be traffic shaping but an extra firewall wouldn't be that bad. I found that in the standard kernel bridge is compiled as module and I have no problem in loading the module, but I did not find any point to start configure the bridge! Has anybody out there build a bridge with SuSE 8.2 (or higher) and could tell me some links and hints to configure a bridge guido

5 6

RE: [suse-security] Odd FW Log
by Peer Stefan 31 Mar '04

31 Mar '04

Hi, > From: Tom Knight [mailto:thomas.knight@ahds.ac.uk] > I have no problem with people scanning me, it's the "SuSE-FW-ACCEPT" > bit that makes me concerned... I though that that meant the packet > had been accepted (and passed through) the firewall, or am I misinter- > preting this? Do you have FW_ALLOW_INCOMING_HIGHPORTS_TCP or FW_ALLOW_INCOMING_HIGHPORTS_UDP set to yes? If so, then it's normal behaviour. A high port is any port higher than 1023, which includes 1433. > Tom. regards, Stefan

2 1

Odd FW Log
by Tom Knight 31 Mar '04

31 Mar '04

I'm seeing odd thiungs in my FW log. Running SLES 8, all YOU updates applied. Machine has v. limited services (ssh, apache, tomcat, mysql, postfix). Ports 80 and 8080 have just been opened globally, but this happened before then. The only other ports available (22, 3306) are to a few systems locally. Only one nic is configured (and plugged in), eth1. The SuSE FW set up is as comes out of the box except as detailed above, although I had more logging turned on initially... umm, the extra logging is in effect for the entires below. (Log _all_ dropped packets). Question: Why am I seeing these connections being acceppted and dropped on port 1433?? Log (grepped): Mar 31 05:37:02 xxx kernel: SuSE-FW-ACCEPT IN=eth1 OUT= MAC=xxx SRC=66.7.157.125 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=59278 DF PROTO=TCP SPT=44435 DPT=1433 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (0204056401010402) Mar 31 05:37:02 xxx kernel: SuSE-FW-DROP-DEFAULT IN=eth1 OUT= MAC=xxx SRC=66.7.157.125 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=110 ID=59278 DF PROTO=TCP SPT=44435 DPT=1433 WINDOW=16384 RES=0x00 SYN URGP=0 OPT (0204056401010402) Mar 31 09:32:56 xxx kernel: SuSE-FW-ACCEPT IN=eth1 OUT= MAC=00:0f:1f:02:28:80:00:09:11:7a:20:00:08:00 SRC=203.194.164.154 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=101 ID=40393 DF PROTO=TCP SPT=47174 DPT=1433 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204056401010402) Mar 31 09:32:56 xxx kernel: SuSE-FW-DROP-DEFAULT IN=eth1 OUT= MAC=xxx SRC=203.194.164.154 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=101 ID=40393 DF PROTO=TCP SPT=47174 DPT=1433 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204056401010402) Mar 31 09:32:59 xxx kernel: SuSE-FW-ACCEPT IN=eth1 OUT= MAC=xxx SRC=203.194.164.154 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=101 ID=41111 DF PROTO=TCP SPT=47174 DPT=1433 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204056401010402) Mar 31 09:32:59 xxx kernel: SuSE-FW-DROP-DEFAULT IN=eth1 OUT= MAC=xxx SRC=203.194.164.154 DST=xxx LEN=48 TOS=0x00 PREC=0x00 TTL=101 ID=41111 DF PROTO=TCP SPT=47174 DPT=1433 WINDOW=65535 RES=0x00 SYN URGP=0 OPT (0204056401010402) No, my machine isn't called xxx. The same goes for the IP/MAC address. Any ideas? TIA, Tom. --------------- Tom Knight System Administration Officer Arts & Humanities Data Service Web: http://www.ahds.ac.uk Email: tom.knight(a)ahds.ac.uk Tel: (0)20 7928 7371

3 4

Strange Bind log messages
by Markus Gaugusch 31 Mar '04

31 Mar '04

Since a week or so the following message has started to appear in my logs: inet-gw named[25917]: refused query on non-query socket from [206.223.115.112].30221 Does anyone know what is going on there? Markus -- __________________ /"\ Markus Gaugusch \ / ASCII Ribbon Campaign markus(at)gaugusch.at X Against HTML Mail / \

1 0

Re: Your document
by thomas＠ruchs.de 31 Mar '04

31 Mar '04

Your document is attached. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of your_document.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

AW: [suse-security] Per user config for SpamAssassin with amavisd-new and cyrus-imapd
by Rasp, Robert 31 Mar '04

31 Mar '04

Hello David, i dont want to give wrong info to you :-( I use SpamAssassin 2.55 and my rbl_check's are stored in "20_head_tests.cf" gate:/usr/share/spamassassin # grep check_rbl * 20_head_tests.cf:#header RCVD_IN_OSIRUSOFT_COM rbleval:check_rbl('osirusoft', 'relays.osirusoft.com.') 20_head_tests.cf:#header X_OSIRU_OPEN_RELAY rbleval:check_rbl_results_for('osirusoft', '127.0.0.2') 20_head_tests.cf:#header X_OSIRU_DUL rbleval:check_rbl_results_for('osirusoft', '127.0.0.3') 20_head_tests.cf:#header X_OSIRU_SPAM_SRC rbleval:check_rbl_results_for('osirusoft', '127.0.0.4') 20_head_tests.cf:#header X_OSIRU_SPAMWARE_SITE rbleval:check_rbl_results_for('osirusoft', '127.0.0.6') 20_head_tests.cf:#header X_OSIRU_DUL_FH rbleval:check_rbl('osirusoft-dul-firsthop', 'relays.osirusoft.com.') 20_head_tests.cf:# the new first arg for check_rbl() indicates what type of check it is; 20_head_tests.cf:header RCVD_IN_RELAYS_ORDB_ORG rbleval:check_rbl('relay', 'relays.ordb.org.') 20_head_tests.cf:header RCVD_IN_SBL rbleval:check_rbl('relay', 'sbl.spamhaus.org.') 20_head_tests.cf:#header RCVD_IN_ORBS rbleval:check_rbl('relay', 'orbs.dorkslayers.com.') 20_head_tests.cf:header RCVD_IN_OPM rbleval:check_rbl('relay', 'opm.blitzed.org.') 20_head_tests.cf:#header RCVD_IN_DSBL rbleval:check_rbl('relay', 'list.dsbl.org.') 20_head_tests.cf:#header RCVD_IN_MULTIHOP_DSBL rbleval:check_rbl('multihop', 'multihop.dsbl.org.') 20_head_tests.cf:#header RCVD_IN_UNCONFIRMED_DSBL rbleval:check_rbl('relay', 'unconfirmed.dsbl.org.') 20_head_tests.cf:#header RCVD_IN_RFCI rbleval:check_rbl('rfci', 'ipwhois.rfc-ignorant.org.') 20_head_tests.cf:header HABEAS_HIL rbleval:check_rbl('hil', 'hil.habeas.com.') 20_head_tests.cf:header RCVD_IN_BONDEDSENDER rbleval:check_rbl('relay', 'query.bondedsender.org.') 20_head_tests.cf:#header RCVD_IN_BL_SPAMCOP_NET rbleval:check_rbl('spamcop', 'bl.spamcop.net.') 20_head_tests.cf:#header RCVD_IN_RBL rbleval:check_rbl('rbl', 'blackholes.mail-abuse.org.') 20_head_tests.cf:#header RCVD_IN_RSS rbleval:check_rbl('relay', 'relays.mail-abuse.org.') 20_head_tests.cf:#header RCVD_IN_DUL rbleval:check_rbl('dialup', 'dialups.mail-abuse.org.') 20_head_tests.cf:#header RCVD_IN_DUL_FH rbleval:check_rbl('dialup-firsthop', 'dialups.mail-abuse.org.') 20_head_tests.cf:header RCVD_IN_NJABL rbleval:check_rbl('njabl', 'dnsbl.njabl.org.') 20_head_tests.cf:header X_NJABL_OPEN_PROXY rbleval:check_rbl_results_for('njabl', '127.0.0.2') 20_head_tests.cf:header X_NJABL_DIALUP rbleval:check_rbl_results_for('njabl', '127.0.0.3') CU Robert -----Ursprüngliche Nachricht----- Von: David Huecking [mailto:d.huecking@gmx.net] Gesendet: Sonntag, 28. März 2004 01:04 An: suse-security(a)suse.com Betreff: Re: [suse-security] Per user config for SpamAssassin with amavisd-new and cyrus-imapd Hi Robert, first thanks for your hint, but I think that SpamAssassin when run from amavisd-new doesn't get its configuration out of the local.cf file, but from the $sa_* entries in the amavisd.conf. There I found an entry: $sa_local_tests_only = 1; No I set this to 0, so non-local test will be performed(?) and I will see what will happen with realtime blacklisting which I think are non-local tests. BTW I found the check_rbl string in 20_dnsbl_tests.cf and not in 20_head_tests.cf. 8-) Anyway I'm looking for a possibility of Bayes filtering if possible with white- and black-listing per user with my setup. Maybe I will try to integrate dspam (Homepage: http://www.nuclearelephant.com/projects/dspam/ ;German article: http://www.pro-linux.de/news/2004/6620.html) into postfix. But as I'm no postfix configuration hero I will need some time (for reading the Postfix book I ordered...). ;-> On Samstag, 27. März 2004 16:17, Rasp, Robert wrote: > i use spamassassin with qmail and i dont use a per-user-config. > The first few weeks it worked very good but then the spamlevel begun to > increase. Now i enabled RBL-Check. By default RBL is disabled in local.cf. > This works very good but you have to look for servers that are offline or > very slow. I simple tested all the servers in > "/usr/share/spamassassin/20_head_tests.cf" (grep "check_rbl" > 20_head_tests.cf). You can use nslookup for that. > I disabled every slow server with '#'..... -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

10 15

freeswan-1.99: cannot respond to IPsec SA
by Dennis Leist 30 Mar '04

30 Mar '04

Hi all, Due to troubles with freeswan-2.04_1.4.8-12 I try to use freeswan-1.99_0.9.34-80 (www.suse.de/~garloff/linux/FreeSWAN/) /---------------\ /---------------\ /---------------\ /---------------\ | Linux 2.4.19 | | Speed Touch | | W-Lan Router | | WINX W2k | | 62.210.20.146 |<----| 62.210.20.145 |<----| WAN-IP: |<---| W-LAN-IP: | | SuSE 9.0 | | No NAT at all | | 213.39.205.80 | | 192.168.1.99 | \---------------/ \---------------/ \---------------/ \---------------/ VPN-Server: SuSE 9.0, SpeedTouch: static IP, freeswan-1.99_0.9.34-80 <snip v/l/m> vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: cannot respond to IPsec SA request because no connection is known for 62.206.19.146[C=DE, ST=Hamburg, L=Hamburg, CN=<Admin CN>]:17/0...213.39.205.80[C=DE, ST=Koeln, CN=<User CN>]:17/1701==={192.168.1.99/32} vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: sending encrypted notification INVALID_ID_INFORMATION to 213.39.205.80:500 vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xee13aa39 (perhaps this is a duplicated packet) vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: sending encrypted notification INVALID_MESSAGE_ID to 213.39.205.80:500 vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xee13aa39 (perhaps this is a duplicated packet) vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: sending encrypted notification INVALID_MESSAGE_ID to 213.39.205.80:500 vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: Quick Mode I1 message is unacceptable because it uses a previously used Message ID 0xee13aa39 (perhaps this is a duplicated packet) vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: sending encrypted notification INVALID_MESSAGE_ID to 213.39.205.80:500 vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80 #2: received Delete SA payload: deleting ISAKMP State #2 vpnserver pluto[24299]: "w2k-client"[4] 213.39.205.80: deleting connection "w2k-client" instance with peer 213.39.205.80 <snap v/l/m> What do I need to change in ipsec.conf to make it run? I donn't understand the first error. What is wrong with my ipsec.conf? If you need any more information, I'll be glad to provide it !! Thanks in advance. <snip ipsec.conf> config setup interfaces=%defaultroute klipsdebug=none plutodebug=none plutoload=%search plutostart=%search uniqueids=yes conn %default keyingtries=0 disablearrivalcheck=no authby=rsasig leftrsasigkey=%cert rightrsasigkey=%cert conn w2k-client left=62.210.20.146 leftnexthop=62.210.20.145 leftrsasigkey=%cert leftcert=gatecert.pem leftprotoport=17/0 right=%any rightrsasigkey=%cert pfs=no rightsubnet=192.168.1.99/32 rightprotoport=17/1701 keyingtries=0 disablearrivalcheck=no auto=add <snap : ipsec.conf>

2 2

Hidden message
by marco＠hkservice.com 30 Mar '04

30 Mar '04

[cid:nhrteompnc.jpeg] [the SUSE virus scanner removed an attachment of type image/jpeg which had a name of nhrteompnc.jpeg] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses] [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of TextDocument.zip] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

Re: [suse-security] Netfilter Bug -- kernel 2.4.20
by Mark Tinka 30 Mar '04

30 Mar '04

--- Philippe Vogel <philippe(a)fb7-fg6.uni-duisburg.de> wrote: > > > We uses cisco routers as well, but no WCCP in > our > > > network. > > > Maybe it depends on your WCCP-Patch > > > (http://www.sublime.com.au/squid-wccp/) > > > > i haven't yet setup the caching service, i am just > > getting ready to do that.. i like to read up on > all > > sorts of things before i do.. > > > > i've setup a transparent squid cache before, but > this > > was 2 yrs ago, on SuSE Linux 7.2 Pro with kernel > > 2.2.19-SMP, and using route-maps (not WCCP) on > Cisco > > for transparent redirection.. > > Why do you use the cisco for that? > Your linux box can do taht as well. > Security (int/ext/dmz)? well, that was 2 yrs ago.. and also because i am an ISP, so my customers use a 'router' as a gateway, and not a Linux box.. i need to have a way to redirect HTTP requests to the cache server, without having the customers know about it.. > > > > make cloneconfig > > > make dep > > > > > > to get a copy of the config of the SuSE kernel? > > > This may help configureing the right things. > > > > i see.. good tip.. do u mean i could clone the > running > > config of the pre-installed SuSE kernel, and then > add > > anything else i need before i build..?.. > > No! > > (*) > > cd /usr/src/linux > make cloneconfig > make dep > > Maybe you apply your patch with the patch command to > the source before (*) > cloning the config. > If there are any minor or mayor changes the compiler > will ask you for > missing options. > After make dep you can compile your own modules. > The same with iptables if you use a newer one. Cool, thanks! > > Philippe > Regards, Mark. __________________________________ Do you Yahoo!? Yahoo! Finance Tax Center - File online. File on time. http://taxes.yahoo.com/filing.html

3 3