March 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] E-mail account disabling warning. -- not from SuSE
by GarUlbricht7＠netscape.net 04 Mar '04

04 Mar '04

george on Wed, 3 Mar 2004 7:01:49 PM EST wrote: > >On 3/3/04 6:56 PM, "george" <gasjr4wd(a)mac.com> wrote: > >> >> What is it??? >> >> Is it from suse or fake? >> >> I've received a few of these odd ball things. > > Never mind- > > I should have continued reading the others first before posting. > > Sorry- > Hi George, I accept your apology ;) "Yes, Virginia, it is a Fake." However, Did you notice what you snipped off from your first past and your second post, namely: #> -- #> Check the headers for your unsubscription address #> For additional commands, e-mail: suse-security-help(a)suse.com #> #> *** Security-related bug reports go to security(a)suse.de, not here *** #> ( ****+ __"stars"__ added for emphasis****** ) You caught the fact that someone is "spoofing" the list, and probably worse... In fact, before they sent this, they probably sent "Jessica" http://lists.suse.com/archive/suse-security/2004-Mar/0009.html and: "Tammy" http://lists.suse.com/archive/suse-security/2004-Mar/0007.html because I don't think "krahmer(a)suse.de' would have wasted band width on quote no matter how nice it is. (Or maybe they had pretty pictures included, whatever) If it was a true message from SuSE they would have signed it with PGP similar to way that Thomas Biege did: http://lists.suse.com/archive/suse-security/2004-Feb/0272.html But if I really wondered, I would have sent it direct to SuSE Security for as "you quoted in: http://lists.suse.com/archive/suse-security/2004-Mar/0048.html #> Security-related bug reports go to security(a)suse.de, not here Gar -- "The quickest way to get information on the web is not to ask a question, but to post the wrong information." - Aahz' Law restated -- __________________________________________________________________ New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

Fw: [suse-security] E-mail account disabling warning.
by Philippe Vogel 04 Mar '04

04 Mar '04

> Dear user, the management of Suse.com mailing system wants to let you know that, > > We warn you about some attacks on your e-mail account. Your computer may > contain viruses, in order to keep your computer and e-mail account safe, > please, follow the instructions. > > For details see the attach. > > In order to read the attach you have to use the following password: 26753. > > Sincerely, > The Suse.com team http://www.suse.com Damn, I cannot run this file coming from SuSE-team (can anybody do on his tux-box?). _At last I don't see any fun in here, would be a pleasure to follow the "real" headers and have some fun._ Why can't those kiddies learn, that linux is not vulnerable to w32-viruses? Would be a pleasure to get all this been moved to /dev/null instead to the list. Philippe P.S.: For fun I allways rewrite my headers to seem to be coming from Outlook :-)

2 1

Zope updates: SuSE 8.2, mirror is build 31, CD is 26, no update notice?
by m3047＠inwa.net 03 Mar '04

03 Mar '04

Hi, Not important (presumably), since there has been no security announcement. However the FTP mirror at oregonstate (haven't checked anywhere else) shows zope-2.6.1-31 for suse/i386/8.2/i586 whereas the CD has zope-2.6.1-26. I have seen no security announcements concerning Zope whatsoever on suse-security-announce since subscribing in early 2002. YOU has given me no notice (SuSE Professional). Again, I presume this is a discrepancy barely worth mentioning; buuut.... -- Fred Morris fredm3047(a)inwa.net (<--I-ACK)

4 4

Freedom for everyone
by poeml＠suse.de 03 Mar '04

03 Mar '04

1 0

RE: [suse-security] firewall help..
by Gilmore, Eric 03 Mar '04

03 Mar '04

Sorry about that --> off list <-- Well I totally understand what you're saying about "ease of setup". But I believe the reasons I was given for using iptables instead of SuSEfirewall went something like, "it's quicker to re-establish connectivity if the firewall machine burns down..." and "we want to standardize across all our systems...yada, yada". Even though I had a working instance of SuSEfirewall2 in place doing exactly what I needed it to do. <sigh> And yes I do understand the security implications of doing it this way (Open then close) this was to be more of a test instance where access from the internet would only be given to certain machines, not sub-nets, not lans, machines. There will be approx. 3-4 attaching to it from the internet via FTP, ssh, AFP & SAMBA. -----Original Message----- From: Maarten J H van den Berg [mailto:maarten@vbvb.nl] Sent: Tuesday, March 02, 2004 4:49 PM To: suse-security(a)suse.com Subject: Re: [suse-security] firewall help.. Hi Eric, Please reply to the list, not to me directly. I read the list. There is no need to take this off-list. On Tuesday 02 March 2004 18:21, you wrote: > Maarten, > > To answer: > -if you mean allow routing between the networks, yes > -the ip's I used in the note are examples OK > -I did use SuSe firewall2, but my dept. wanted to use iptables instead Does your dept. realize that SuSEfirewall is just a convenient (and complex) "wrapper" for iptables ? > :( Indeed. Building filters from scratch is difficult. I tend to avoid it when possible, i.e. use some framework that more or less suits your needs. > -from anywhere means the internet also. I haven't gotten to the part Whoa! I don't plan to reeducate your dept. but you really shouldn't be doing that, not even considering it. What is the goal here ? If it is offering access to remote offices / staff users then read up on deploying a VPN. If the goal is offering access to anybody, read up on using other means (http / ftp / whatever). Just my opinion of course, but my bet is you'll find that most anybody here will agree with me on this... I have not looked at your script in detail yet, but it seems to me you maybe had better rethink your strategy. You cannot "fix" things afterwards with firewallrules, you need to get it right and logical from the start. For instance, you need to draft policies. If you are not completely clear on what you have to do then I would suggest you are not well advised to build your own filter from scratch. > where you > actually start blocking things yet. This is the initial setup. That approach won't work. That would be akin to checking a door for leakage when it's open. In other words, if you do use that approach you get connectivity, but not security. Maarten > -----Original Message----- > From: maarten van den Berg [mailto:maarten@vbvb.nl] > Sent: Tuesday, March 02, 2004 11:52 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] firewall help.. > > On Tuesday 02 March 2004 17:05, Gilmore, Eric wrote: > > Can anyone give me a clue? The basics are: > > 1 machine: SuSE 8.2 > > 3 nics > > 2 internal networks (examples): > > $INTLAN1:> 192.0.0.2 $INTLAN2:> 192.0.5.2 > > Does LAN1 trust LAN2 and vice versa ? > > > 3 good ip's (examples): > > eth0> 128.0.0.1 eth0:1> 128.0.0.2 eth0:2> 128.0.0.3 > > > > 2 spoofed ip's: > > $INTIF1> 192.0.5.2 $INTIF2> 192.0.48.3 > > If by spoofed you mean reserved,internal adresses: be aware that > you're outside the allowed range (192.168.0.0/16) (See RFC 1918) > > > works: > > -connecting from the internet/external LAN to all machines via (ssh, > > FTP, > > HTTP) > > not: > > -connecting between $INTLAN1 & $INTLAN2 > > If full and mutual trust is expected / wanted: > set FW_ALLOW_CLASS_ROUTING="yes" > Hm... reading on I notice you don't use the Suse firewall filter. Why > not ? > > > -samba connections from anywhere > > Explain. From ANYwhere implies "from internet". Surely you CAN not > want that. If you mean from LAN1 <-> LAN2 then either the above class > routing will fix it (when you use AD + properly configured DNS > servers) or you may need to specify the exact share by IPnumber (net > use * \\192....\C If both are not options you will need to find a way > to relay the Netbios > > broadcast(s) over the firewall. Dunno offhand how to do that (and > wouldn't want to either). > > > -afp (apple) connections from anywhere > > See samba, the services are fairly similar. > > Maarten > > -- > Yes of course I'm sure it's the red cable. I guarante[^%!/+)F#0c|'NO > CARRIER -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] firewall help..
by Maarten J H van den Berg 02 Mar '04

02 Mar '04

Hi Eric, Please reply to the list, not to me directly. I read the list. There is no need to take this off-list. On Tuesday 02 March 2004 18:21, you wrote: > Maarten, > > To answer: > -if you mean allow routing between the networks, yes > -the ip's I used in the note are examples OK > -I did use SuSe firewall2, but my dept. wanted to use iptables instead Does your dept. realize that SuSEfirewall is just a convenient (and complex) "wrapper" for iptables ? > :( Indeed. Building filters from scratch is difficult. I tend to avoid it when possible, i.e. use some framework that more or less suits your needs. > -from anywhere means the internet also. I haven't gotten to the part Whoa! I don't plan to reeducate your dept. but you really shouldn't be doing that, not even considering it. What is the goal here ? If it is offering access to remote offices / staff users then read up on deploying a VPN. If the goal is offering access to anybody, read up on using other means (http / ftp / whatever). Just my opinion of course, but my bet is you'll find that most anybody here will agree with me on this... I have not looked at your script in detail yet, but it seems to me you maybe had better rethink your strategy. You cannot "fix" things afterwards with firewallrules, you need to get it right and logical from the start. For instance, you need to draft policies. If you are not completely clear on what you have to do then I would suggest you are not well advised to build your own filter from scratch. > where you > actually start blocking things yet. This is the initial setup. That approach won't work. That would be akin to checking a door for leakage when it's open. In other words, if you do use that approach you get connectivity, but not security. Maarten > -----Original Message----- > From: maarten van den Berg [mailto:maarten@vbvb.nl] > Sent: Tuesday, March 02, 2004 11:52 AM > To: suse-security(a)suse.com > Subject: Re: [suse-security] firewall help.. > > On Tuesday 02 March 2004 17:05, Gilmore, Eric wrote: > > Can anyone give me a clue? The basics are: > > 1 machine: SuSE 8.2 > > 3 nics > > 2 internal networks (examples): > > $INTLAN1:> 192.0.0.2 $INTLAN2:> 192.0.5.2 > > Does LAN1 trust LAN2 and vice versa ? > > > 3 good ip's (examples): > > eth0> 128.0.0.1 eth0:1> 128.0.0.2 eth0:2> 128.0.0.3 > > > > 2 spoofed ip's: > > $INTIF1> 192.0.5.2 $INTIF2> 192.0.48.3 > > If by spoofed you mean reserved,internal adresses: be aware that you're > outside the allowed range (192.168.0.0/16) (See RFC 1918) > > > works: > > -connecting from the internet/external LAN to all machines via (ssh, > > FTP, > > HTTP) > > not: > > -connecting between $INTLAN1 & $INTLAN2 > > If full and mutual trust is expected / wanted: > set FW_ALLOW_CLASS_ROUTING="yes" > Hm... reading on I notice you don't use the Suse firewall filter. Why > not ? > > > -samba connections from anywhere > > Explain. From ANYwhere implies "from internet". Surely you CAN not want > that. If you mean from LAN1 <-> LAN2 then either the above class routing > will fix it > (when you use AD + properly configured DNS servers) or you may need to > specify the exact share by IPnumber (net use * \\192....\C > If both are not options you will need to find a way to relay the Netbios > > broadcast(s) over the firewall. Dunno offhand how to do that (and > wouldn't > want to either). > > > -afp (apple) connections from anywhere > > See samba, the services are fairly similar. > > Maarten > > -- > Yes of course I'm sure it's the red cable. I guarante[^%!/+)F#0c|'NO > CARRIER

1 0

RE: [suse-security] Re: firewall help..
by Gilmore, Eric 02 Mar '04

02 Mar '04

This is only the beginning of the script. I wanted to make sure everything worked before I locked it down, that's all. -----Original Message----- From: Stefan Tichy [mailto:nobody@localhost.invalid] Sent: Tuesday, March 02, 2004 1:05 PM To: suse-security(a)suse.com Subject: [suse-security] Re: firewall help.. On Tue, Mar 02, 2004 at 05:51:52PM +0100, maarten van den Berg wrote: > On Tuesday 02 March 2004 17:05, Gilmore, Eric wrote: > > Can anyone give me a clue? The basics are: > Hm... reading on I notice you don't use the Suse firewall filter. Why > not ? The listing of iptables rules looks strange. There is an allow policy and there are lots of allow rules, but nothing is denied. There are LOG targets at the end. They will not log anything because the pakets have already been accepted. The rule specifications for POSTROUTING chain are probably uneccessary. I am not shure, because I did not really find out what you are trying to do. Maybe it is easier to use the SuSE firewall script to generate the iptables rules (that is what SuSE firewall does). > > -afp (apple) connections from anywhere > > See samba, the services are fairly similar. In addition to the filter rules it is neccessary to allow the connection with some /etc/hosts.allow entry. -- Stefan Tichy ( s.list at pi4tel dot de ) -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

firewall help..
by Gilmore, Eric 02 Mar '04

02 Mar '04

Can anyone give me a clue? The basics are: 1 machine: SuSE 8.2 3 nics 2 internal networks (examples): $INTLAN1:> 192.0.0.2 $INTLAN2:> 192.0.5.2 3 good ip's (examples): eth0> 128.0.0.1 eth0:1> 128.0.0.2 eth0:2> 128.0.0.3 2 spoofed ip's: $INTIF1> 192.0.5.2 $INTIF2> 192.0.48.3 works: -connecting from the internet/external LAN to all machines via (ssh, FTP, HTTP) not: -connecting between $INTLAN1 & $INTLAN2 -samba connections from anywhere -afp (apple) connections from anywhere -Thanks in advance.... PATH="$PATH:/usr/bin/:/usr/sbin" DEPMOD=/sbin/depmod INSMOD=/sbin/insmod EXTIF=eth0 INTIF1=eth1 INTIF2=eth2 case "$1" in 'start') echo "Clearing any existing rules and setting default policy.." iptables -P INPUT ACCEPT iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -F iptables -F INPUT iptables -F OUTPUT iptables -F FORWARD iptables -X iptables -t nat -F # loopback rules iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT iptables -A INPUT -i $EXTIF -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -o $EXTIF -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i $EXTIF -j ACCEPT echo "Adding Masquerade support for 192.0.0.0 subnet..." iptables -A FORWARD -i $EXTIF -o $INTIF1 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $INTIF1 -o $EXTIF -j ACCEPT echo "Adding Masquerade support for 192.0.5.0 subnet..." iptables -A FORWARD -i $EXTIF -o $INTIF2 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $INTIF2 -o $EXTIF -j ACCEPT echo "Allowing traffic between internal networks..." iptables -A FORWARD -i $INTIF1 -o $INTIF2 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $INTIF2 -o $INTIF1 -j ACCEPT iptables -A FORWARD -i $INTIF2 -o $INTIF1 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i $INTIF1 -o $INTIF2 -j ACCEPT iptables -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE echo "Associating internal address 192.0.0.2 with external address 128.0.0.2" iptables -t nat -A PREROUTING -p tcp --dst 128.0.0.2 -j DNAT --to-destination 192.0.0.2 iptables -t nat -A PREROUTING -p udp --dst 128.0.0.2 -j DNAT --to-destination 192.0.0.2 iptables -t nat -A PREROUTING -p icmp --dst 128.0.0.2 -j DNAT --to-destination 192.0.0.2 iptables -t nat -A POSTROUTING -p tcp --dst 128.0.0.2 -j SNAT --to-source 192.0.0.2 iptables -t nat -A POSTROUTING -p udp --dst 128.0.0.2 -j SNAT --to-source 192.0.0.2 iptables -t nat -A POSTROUTING -p icmp --dst 128.0.0.2 -j SNAT --to-source 192.0.0.2 echo "Associating internal address 192.0.5.2 with external address 128.0.0.3" iptables -t nat -A PREROUTING -p tcp --dst 128.0.0.3 -j DNAT --to-destination 192.0.5.2 iptables -t nat -A PREROUTING -p udp --dst 128.0.0.3 -j DNAT --to-destination 192.0.5.2 iptables -t nat -A PREROUTING -p icmp --dst 128.0.0.3 -j DNAT --to-destination 192.0.5.2 iptables -t nat -A POSTROUTING -p tcp --dst 128.0.0.3 -j SNAT --to-source 192.0.5.2 iptables -t nat -A POSTROUTING -p udp --dst 128.0.0.3 -j SNAT --to-source 192.0.5.2 iptables -t nat -A POSTROUTING -p icmp --dst 128.0.0.3 -j SNAT --to-source 192.0.5.2 # add logging iptables -A INPUT -j LOG #iptables -A FORWARD -j LOG #iptables -t nat -A PREROUTING -j LOG #iptables -t nat -A POSTROUTING -j LOG #iptables -A OUTPUT -j LOG #iptables -A block -j LOG ;; 'stop') echo "Flushing iptables firewall..." iptables -P INPUT ACCEPT iptables -F INPUT iptables -P OUTPUT ACCEPT iptables -F OUTPUT iptables -P FORWARD DROP iptables -F FORWARD #iptables -F block iptables -t nat -F ;; 'restart') $0 stop $0 start ;; *) echo "$0 {start|stop}" exit 1 ;; esac exit 0

3 2

selinux kernel addtion to SuSE
by Jeffrey Ivins 02 Mar '04

02 Mar '04

I was wonder if any of the security items from SE Linux are going to be added to future kernels of 2.4.x and 2.6.x __________________________________ Do you Yahoo!? Get better spam protection with Yahoo! Mail. http://antispam.yahoo.com/tools

4 3

FSCKING VIRII
by Arjen Runsink 02 Mar '04

02 Mar '04

Hi. Can't you block the IP's that send the virii? BB, Arjen

6 13