March 2004 - openSUSE Security - openSUSE Mailing Lists

SuSE-FW-ACCESS_DENIED_INT HELP
by Regilberto Girão 22 Mar '04

22 Mar '04

Dear Sirs: Please. My customer is using PCANYWHERE to connect, from internal network (10.1.1.11), to external HOST. This service was used until last month without problems. It has two weeks, the service left to function. I´m receiving the follow message, since then: Mar 22 14:25:38 linux kernel: SuSE-FW-ACCESS_DENIED_INT IN=eth0 OUT= MAC=00:e0:7d:c8:19:81:01:03:88:00:bf:1e:08:00 SRC=10.1.1.11 DST=200.X.X.X LEN=30 TOS=0x00 PREC=0x00 TTL=128 ID=57029 PROTO=UDP SPT=3190 DPT=5632 LEN=10 What´s happen? Somebody can help me? Please. Thank you and best regards. Regilberto Girão

1 0

securing Suse 9.0 with postfix/squid
by Eric Kahklen 22 Mar '04

22 Mar '04

Can people offer some helpful tips or links on securing a suse 9.0 box that will be running postfix and squid? I've used the built in security settings for a server, ran all the updates, and my firewall is only allowing ports 25 and 443 to the box. Thanks, Eric

2 1

My SL 9 PRO is getting so slow
by John 22 Mar '04

22 Mar '04

I have noticed that my machine is so slow. There is a significant amount of free memory and swap ,as well. Nothing consumes too much cpu but is so slow :( What faults for that?

5 10

Question about SuSE security alerts
by Avtar Gill 22 Mar '04

22 Mar '04

Perhaps someone from SuSE could clear this up. I am subscribed to the SuSE security announcements mailing list - I was actively monitoring the list so I could know when updates for mod_python and libxml2 would be available. The last security announcement (before today's openssl one) mentioned this.. http://lists.suse.com/archive/suse-security-announce/2004-Feb/0002.html - mod_python A remote denial-of-service attack can be triggered against the Apache web server by sending a specific query string that is processed by mod_python. New packages will be available soon. - libxml2 A buffer overflow in the URI parsing cde is fixed. This bug can lead to remote access to a system using libxml2. New packages will be available soon. - pwlib This update addresses several security vulnerabilities that may be exploited remotely via applications that link with pwlib, like GnomeMeeting or alike. New packages will be available soon. I maintain my own FTP server which contains the base SuSE RPMs and some of my own custom packages. Yesterday when rsync was run from cron on my FTP server I noticed that those three updates were in the mirrors. But there were no security announcements for these updates. And now in today's OpenSSL announcement it says that new packages for the above mentioned software are available on the SuSE ftp servers.. http://lists.suse.com/archive/suse-security-announce/2004-Mar/0001.html My question is what is the reason for not issuing separate security announcements for updates such as these? Other distributions (like Debian) post one announcement per update which seems like a logical choice. Any thoughts? Regards, Avtar Gill

10 14

Re: [suse-security] Suse 8.2 firewall configuration: blocking port 25 from the internal network
by Wilfred van Velzen 22 Mar '04

22 Mar '04

Hi, Met vriendelijke groet / Best regards, Wilfred van Velzen >>> Arjen de Korte <suse-security(a)de-korte.org> 2004-03-19 16:23:02 >>> > > Our Suse machine is configured to masquerade/route and firewall > > between the internet and our internal network. > > Ik weet niet wat je bij de masquerading hebt ingesteld, maar waarschijnlijk > maak je geen selectie van de poorten die bereikbaar zijn. Dat is jammer, > aangezien het waarschijnlijk helemaal niet nodig is dat iedere interne > gebruiker alle services op alle externe IP's kan gebruiken. Ik zou allereerst > wat restrictiever zijn in het openen van de toegang naar buiten (alles dicht > en alleen de poorten openen die nodig zijn) in plaats van alles open te > zetten en alleen ongewenste services af te sluiten. Voor een goede > beveiliging van een LAN, is het nodig om een policy op te stellen van wat er > wel en niet mag. Met een firewall kun je dan vervolgens die policy afdwingen. Our policy is to let anything go out. ;-) > > How do I configure /etc/sysconfig/SuSEfirewall2 when I want to block > > access from the internal network (192.168.0.x) to the external > > internet on port 25 (smtp). Except for the mailserver which has ipnr.: > > 192.168.0.1 ?? > > Op zich is dat eenvoudig. In /etc/sysconfig/scripts/SuSEfirewall2-custom de > volgende regel toevoegen onder het kopje 'fw_custom_after_antispoofing()', > vóór de regel met 'true': > > iptables -A forward_int -p tcp --dport 25 -j DROP I changed this to: iptables -A forward_int -s 192.168.0.1 -p tcp --dport 25 -j ACCEPT iptables -A forward_int -p tcp --dport 25 -j REJECT Because our email server needs to be able to go through! > In deze file staan overigens nog een paar hints voor wat je zou kunnen > aanpassen. Verder eraan denken dat in /etc/sysconfig/SuSEfirewall2 de regel > met > > FW_CUSTOMRULES="/etc/sysconfig/scripts/SuSEfirewall2-custom" > > is ingesteld. I already had this, because I'm trying to be able to use the external IP adres from the inside network, with an extra line in the: fw_custom_before_antispoofing() { section... -- SERCOM Regeltechniek b.v. Heereweg 9 2161 AB Lisse Nederland +31 (0)252 416530 (voice) +31 (0)252 419481 (fax) <http://www.sercom.nl/> Op al onze offertes, op alle opdrachten aan ons en op alle met ons gesloten overeenkomsten zijn toepasselijk de METAALUNIEVOORWAARDEN, gedeponeerd ter Griffie van de Rechtbank te Rotterdam, zoals deze luiden volgens de laatstelijk aldaar neergelegde tekst. De leveringsvoorwaarden worden u op verzoek toegezonden.

1 0

warning
by wiersig-ml＠dns.glamus.de 22 Mar '04

22 Mar '04

take it easy

1 0

kdm - 'security'
by Thomas Roth 19 Mar '04

19 Mar '04

Hi list, didn't somebody else stumble that nice kdm-feature called 'Automatic login' ? Must have crept into my systems via some recent update or maybe it's a SuSE 9.0-'feature'. Anyhow I'm appalled that this is now enabled by default - can't believe someone could be stupid enough to implement such crap! Why don't they just abandon passwords altogether? Is this distro now called SuSE-Windows? Thomas

4 4

Suse 8.2 firewall configuration: blocking port 25 from the internal network
by Wilfred van Velzen 19 Mar '04

19 Mar '04

Our Suse machine is configured to masquerade/route and firewall between the internet and our internal network. How do I configure /etc/sysconfig/SuSEfirewall2 when I want to block access from the internal network (192.168.0.x) to the external internet on port 25 (smtp). Except for the mailserver which has ipnr.: 192.168.0.1 ?? Met vriendelijke groet / Best regards, Wilfred van Velzen -- SERCOM Regeltechniek b.v. Heereweg 9 2161 AB Lisse Nederland +31 (0)252 416530 (voice) +31 (0)252 419481 (fax) <http://www.sercom.nl/> Op al onze offertes, op alle opdrachten aan ons en op alle met ons gesloten overeenkomsten zijn toepasselijk de METAALUNIEVOORWAARDEN, gedeponeerd ter Griffie van de Rechtbank te Rotterdam, zoals deze luiden volgens de laatstelijk aldaar neergelegde tekst. De leveringsvoorwaarden worden u op verzoek toegezonden.

1 0

warning
by wiersig-ml＠dns.glamus.de 19 Mar '04

19 Mar '04

my hero

1 0

DHCP over subnet to subnet VPN
by Dietmar Simons 18 Mar '04

18 Mar '04

The FreeSwan VPN works perfect, but i can't figure out how I should setup the isc-dhcprelayer, so that DHCP-Broadscast from the 192.168.2.0/24 net will be forwarded to the DHCP Server 192.168.1.2 in the 192.168.1.0/24 Network. My first attempt was to setup the isc dhcprelayer shiped with the SuSE 9.0 on the Gateway 1 but no packets reached the second Gateway 2 on interface ipsec0. Should I setup the dhcp relayer on both Gateways or only on the first or second Gateway?. On both Gateway runs SuSeFirewall 2 with 50 IP, 500 UDP extern opened. Could it be an firewall issue, or doesn's work the isc dhcprelayer together with FreeSwan? Tcpdump Gateway 1 on ipsec0 shows: 19:17:25.364504 gateway-dus.local.bootps > 192.168.1.2.bootps: (request) hops:1 xid:0xa9419560 secs:51135 flags:0x8000 G:gateway-dus.local ether 0:c:6e:f2:d1:4a file ""[|bootp] (DF) 19:17:58.364405 gateway-dus.local.bootps > 192.168.1.2.bootps: (request) hops:1 xid:0x1861440d flags:0x8000 G:gateway-dus.local ether 0:c:6e:f2:d1:4a file ""[|bootp] (DF) 19:18:01.364169 gateway-dus.local.bootps > 192.168.1.2.bootps: (request) hops:1 xid:0x1861440d secs:35263 flags:0x8000 G:gateway-dus.local ether 0:c:6e:f2:d1:4a file ""[|bootp] (DF) but no Broadcast packets reached Gateway 2 on ipsec0. Here my current configuration: 192.168.2.0/24 Network | +-SuSE-Gateway-1--+ |eth1 intern | |192.1682.254 | | | |eth0/ipsec extern| |192.168.0.1 | +-----------------+ ||| VPN Tunnel ||| +-ISP DSL-ROUTER--+ |192.168.0.254 | |with NAT but | |ipsec passthrough| |enabled | |puplic static IP | |111.111.111.111 | +-----------------+ ||| ||| VPN Tunnel ||| ||| +-SuSE-Gateway-2--+ |ISP DSL-Modem | |connected on eth0| | |ipsec/ppp0 extern| |222.222.222.222 | |dynamic IP | | | |eth1 intern | |192.168.1.99 | +-----------------+ | 192.168.1.0/24 Network | | 192.168.1.2 DHCP Server Regards Dietmar Simons

1 0