March 2004 - openSUSE Security - openSUSE Mailing Lists

Configuring SuSEfirewall2 on SuSE 9.0 as a personal firewall
by Marc Saric 12 Mar '04

12 Mar '04

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, I try to use SuSEfirewall2 as included in SuSE 9.0 to secure the eth0-connection of a server-machine (only one interface, connected to the university network, no routing, NAT, bridging, etc.) but I'm a bit confused about the options and the available documentation (especially regarding differences between the current and older versions of SuSEfirewall2): What I have read (but maybe not fully understood :-)) so far: ============================================================= ~ * http://seismo.ethz.ch/linux/firewall.html, which deals with SuSE up to version 8.1 (which has obviously differences to the current version) ~ * http://susefaq.sourceforge.net/articles/firewall/fw_manual.html a nice manual about the same package also up to version 8.1 ~ * the archive of this mailinglist ~ * Googled the usual newsgroups/pages for more help. What I want to do: ================== Secure a server which should be used as a department server running SAMBA, NFS (maybe not), Netatalk, Apache, ssh/scp/sftp, xntpd (i.e. a plain simple standard intranet- and fileserver) against access from the outside world. The setup: ========== All machines are directly connected to the Internet (via the university network thanks to the University of Tuebingen not running their own firewall), therefore I want to grant/deny access to the server based on ~ * IP-address (i.e. "FW_TRUSTED_NETS") individually (per machine) ~ * possibly MAC-address (possible to set this in the firewall-config??) ~ * login and password-protection for services of course (not part of the ~ firewall) and deny access to all services except ssh for the rest of the world. In http://seismo.ethz.ch/linux/firewall.html I found the following entry which seems to be ok for me FW_TRUSTED_NETS="123.123.xxx.yyy 195.195.yyy.zzz" # Adjust FW_SERVICES_TRUSTED_TCP="1:65535" # Should be adjusted to needed services per machine, not globaly everything. FW_SERVICES_TRUSTED_UDP="1:65535" # see above in connection with FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="" # Do I have to set eth0 here as well??? FW_SERVICES_EXT_TCP="" # drop all FW_SERVICES_EXT_UDP="" # drop all FW_AUTOPROTECT_SERVICES="yes" FW_PROTECT_FROM_INTERNAL="yes" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="no" FW_SERVICE_AUTODETECT="yes" ... (among others) to deny everything else from unknown computers. The problem is, that the variables "FW_SERVICES_TRUSTED*" seem to be absent in SuSEfirewall2-3.1-206 (as installed with SuSE 9.0). Can someone point me in the right direction to solve this problem? How to enable (more or less) fine-grained access controll to a computer on IP-address-basis (or better IP and MAC)? Thanks in advance. - -- Bye, Marc Saric Dr. Marc Saric, Bioinformatik, Proteom Centrum Tübingen, Paul-Ehrlich-Str. 15, D-72076 Tübingen, Germany, Tel: +49 (0)7071 29 77645, marc.saric(a)uni-tuebingen.de http://www.proteom-centrum-tuebingen.de -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFAUHy3BLD6PjSWyL4RAk9sAJ9RhHC0uVBfaRTWPPi/NV1OYyJNOwCeLOQ7 9HQHFLZ2fEBBRnt3ziatNF8= =tasY -----END PGP SIGNATURE-----

2 3

foward with SuSEFirewall2.
by Joao M.C. Alvega 12 Mar '04

12 Mar '04

Hello, i'm trying to use squid as a transparante proxy, i have allready configurated squid to do that, but now i don't know how to redirect all tcp trafic from port: 80 to Squid port, can anyone help? thank's in advence for all the help! João Alvega.

3 2

harden_suse for 9.0?
by Lucky Leavell 12 Mar '04

12 Mar '04

I downloaded the RPM which indicated it was for 8.1; will it work on 9.0 or is there a later version available? Thank you, Lucky Leavell

2 1

susefirewall not forwarding
by Paul A. Arbour 12 Mar '04

12 Mar '04

Hi, To make a long story short, I'm moving from one firewall/web server to another. I have my new server plugged in and all setup masquerading for my internal network. I have port 80 forwarded from my new firewall into my existing web server(separate box). Everything is hunky dory from the outside, but from the inside I can not access either the old server, or if I disable port forwarding, the new server by throwing in their external address, i.e. my dyndns domain name. So basically what is happening is that the firewall is rejecting requests on the external IPs from the internal network with this error: Mar 9 21:03:32 grimlock kernel: SuSE-FW-ACCESS_DENIED_INT IN=eth1 OUT= MAC=00:xx:xx:0f:xx:9b:00:07:95:ac:24:e4:08:00 SRC=192.168.0.15 DST=24.xxx.xxx.xxx LEN=48 TOS=0x08 PREC=0x00 TTL=128 ID=23221 DF PROTO=TCP SPT=2131 DPT=80 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405B401010402) What am I missing? Here is a copy of my config file: FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http https imap imaps pop3 pop3s smtp ssh 80 ftp" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_IP="51 50" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="80" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="0/0,0/0,80" FW_FORWARD_MASQ="0/0,192.168.0.5,tcp,80" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE- FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" grimlock:/etc/sysconfig # grep '^[A-Z]' SuSEfirewall2 FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http https imap imaps pop3 pop3s smtp ssh 80 ftp" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_IP="51 50" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="80" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="0/0,0/0,80" FW_FORWARD_MASQ="0/0,192.168.0.5,tcp,80" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE- FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" grimlock:/etc/sysconfig # grep '^[A-Z]' SuSEfirewall2 FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.0.0/24" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http https imap imaps pop3 pop3s smtp ssh 80 ftp" FW_SERVICES_EXT_UDP="500" FW_SERVICES_EXT_IP="51 50" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="80" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="yes" FW_ALLOW_INCOMING_HIGHPORTS_UDP="yes" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="yes" FW_FORWARD="0/0,0/0,80" FW_FORWARD_MASQ="0/0,192.168.0.5,tcp,80" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV=""

2 2

realtek driver.
by Joao M.C. Alvega 12 Mar '04

12 Mar '04

Hello again. I have bought a wireless card with realtek 8180 chip, can anyone tell-me where to find the driver for this card? Thank's all! João Alvega.

2 1

Postfix w. tls/Amavisd/pop-before-smtp/Spamassasin
by Philippe Vogel 11 Mar '04

11 Mar '04

Hi! I got another question: I run several mailservers with already working postfix/tls, amavisd, pop-before-smtp. My problem is to implement spamassasin. I found the spamassasion.sh solution, but it did wot work for me, all mail were deferred (spam nerves :-( ). I saw anotherone implementing spamd in amavis, but I did not find any sources with google (only a patch for an older amavisd). Any clue? Another thing would be for amavisd, is it possible to only inform local postmaster with amavid (there were to many errorous fakened mailheaders last months)? Philippe

3 2

Migration from pop to imap
by Rafael E. Herrera 11 Mar '04

11 Mar '04

We recently installed a suse std. server as a mail server to replace an older machine which delivered through pop. We are trying to get the users to switch from pop to imap. The problem we have is that some users will want to transfer their old messages to their imap folders. We use mozilla as mail client and when we try to copy the old emails, the transfer fail with either one of these messages: "The current command did not succeed. The mail server responded: Message contains bare newlines" "The current command did not succeed. The mail server responded: Message contains invalid header" Is there a way to import old pop mailboxes into these imap accounts that avoids these problems? -- Rafael

1 0

Fw: [suse-security] Postfix w. tls/Amavisd/pop-before-smtp/Spamassasin
by Philippe Vogel 11 Mar '04

11 Mar '04

> Hi! > > I got another question: > > I run several mailservers with already working postfix/tls, amavisd, > pop-before-smtp. My problem is to implement spamassasin. I found the > spamassasion.sh solution, but it did wot work for me, all mail were deferred > (spam nerves :-( ). > > I saw anotherone implementing spamd in amavis, but I did not find any > sources with google (only a patch for an older amavisd). > > Any clue? > > Another thing would be for amavisd, is it possible to only inform local > postmaster with amavid (there were to many errorous fakened mailheaders last > months)? Forgot something: How do I use iptunnel or sslwrap with qpopper shipped with SuSE Linux 8.2 (without recompillation) to support tls? I got a certificate already and looked up everything, but I didn't get it to work propper (service is up, but I get conncetion lost with "telnet server 995"). Philippe

1 0

sorting of tcpdump output
by Philippe Vogel 11 Mar '04

11 Mar '04

Hi! I took a tcpdump of a some kind of strange connection (a permanently 24/7 connected station) and want to sort the content from the content I don't want to read (only the one station is of interest, the rest can got to /dev/trash). I only want to knwo, what he/she is doing, or if he/she forgot to logout of an web-app. I used less | grep -e FILTER1 -e FILTER2 [...] > output, but grep anly shows me single lines. Is there any other programm that can filter the output or any tools on the net? Philippe

3 2

Wierd stuff coming out of SuSE's nameserver?
by suse＠rio.vg 11 Mar '04

11 Mar '04

Over the past two days, one of my servers has been getting connections from ns.suse.de attempting to send mail to strange addresses in my domain. For instance: Mar 11 09:56:38 shadow postfix/smtpd[17219]: connect from ns.suse.de[195.135.220.2] Mar 11 09:56:38 shadow postfix/smtpd[17219]: 9AED41E4F2: client=ns.suse.de[195.135.220.2] Mar 11 09:56:39 shadow postfix/smtpd[17219]: 9AED41E4F2: reject: RCPT from ns.suse.de[195.135.220.2]: 450 <20040203131322.ckkgoccks8owc80s(a)rio.vg>: User unknown in local recipient table; from=<> to=<20040203131322.ckkgoccks8owc80s(a)rio.vg> proto=ESMTP helo=<Cantor.suse.de> Mar 11 09:56:41 shadow postfix/smtpd[17219]: disconnect from ns.suse.de[195.135.220.2] As "ns.x.x" is generally the nameserver, I assume that SuSE would be running linux on such a server. Over the past two days, I have recieved over a dozen of these attempts. I've sent an e-mail to security(a)suse.com and abuse(a)suse.com, but I thought it might be wise to also give a heads up to the list. Is anyone else getting these connections? Has ns.suse.de been owned by nefarious parties? Or is this some new exploit in postfix or even a linux worm?

1 1