March 2004 - openSUSE Security - openSUSE Mailing Lists

SuSE 9.0: IPSEC-Error inbound_policy_check: No such file or directory
by Dennis Leist 24 Mar '04

24 Mar '04

Hi folks, I encounter following err when starting ipsec (freeswan-2.04_1.4.8-12): ipsec_setup: Stopping FreeS/WAN IPsec... ipsec_setup: Starting FreeS/WAN IPsec 2.04... ipsec_setup: Using /lib/modules/2.4.21-192-default/kernel/net/ipv4/ipsec/ipsec.o ipsec_setup: /usr/lib/ipsec/_startklips: line 309: /proc/sys/net/ipsec/inbound_policy_check: No such file or directory System is: SuSE 9.0 and kernel 2.4.21-192. Any ideas, updates ??? Last YOU-Update didn't help. Any is help is highly welcomed! THX in advance P.S. : My barf file was too big to attach...;-(

1 0

ello! =))
by poeml＠suse.de 24 Mar '04

24 Mar '04

I don't bite, weah! password -- 54665 [demime 1.1d removed an attachment of type application/octet-stream which had a name of TextDocument.zip] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

[Fwd: Re: [suse-security] Firewall]
by Dirk Schreiner 23 Mar '04

23 Mar '04

-------- Original-Nachricht -------- Betreff: Re: [suse-security] Firewall Datum: Tue, 23 Mar 2004 19:18:04 +0100 Von: Dirk Schreiner <dirk.schreiner(a)tria.de> An: lila_lia(a)bluemail.ch Referenzen: <4057CBEA0002ABFF(a)mssazhh-int.msg.bluewin.ch> German below: Hi, confusing Netmasks, I guess: www -- gw -- big -- gwt -- small gw Internet-Gateway big 10.2.x.x /16 (255.255.0.0) gwt Linux-Firewall small 10.2.22.x /24 (255.255.255.0) Check out: Is NAT activated? Then deactivate !! Does gw know, that small is reachable over gwt? Gruss Dirk Hi, konfuse Netzmasken Ich vermute: www -- gw -- big -- gwt -- small gw Internet-Gateway big 10.2.x.x /16 (255.255.0.0) gwt Linux-Firewall small 10.2.22.x /24 (255.255.255.0) Zu den Fragen: Ist eventuell NAT aktiviert? (Könn`t ja sein ;-)) Dann deaktivieren !! Weis denn gw dass small über gwt erreichbar ist? Gruss Dirk lila_lia(a)bluemail.ch schrieb: > Hy! > > I try to make a Firewall. There are two networks. (one is 10.2.x.x/19, the > other one is 10.2.22.x/19) I want that the 10.2.22.x can get trough the10.2.x.x > networt to the internet, the 10.2.22.x must also access certain serversin > the 10.2.x.x network. > At the time, I can get from the small network (10.2.22.x) to the biggernetwork > (10.2.x.x), but I can't get from the bigger to the smaller... > I'm working with iptables. I try to configure the firewall with webmin... > > Can anybody tell my, what I have to do? > > Thanks! > Lia > > > Falls mein Englisch zu unverstaendlich ist, das ganze nochmals auf Deutsch. > > Ich habe eine Firewall aufgesetzt. Ich will das das Firmennetzwerk (10.2.x.x/19) > vor einem Testraum schuetzen (10.2.22.x/19). Im Moment komme ich vom Testraum > ins Firmennetzwerk und ins Internet. Doch vom Firmennetzwerk komme ich nicht > in den Testraum. Wo liegt mein Fehler? > > Gruss > Lia > > TRIA IT-consulting GmbH Joseph-Wild-Straße 20 81829 München Germany Tel: +49 (89) 92907-0 Fax: +49 (89) 92907-100 http://www.tria.de -------------------------------------------------------- working hard | for your success -------------------------------------------------------- Registergericht München HRB 113466 USt.-IdNr. DE 180017238 Steuer-Nr. 802/40600 Geschäftsführer: Hubertus Wagenhäuser -------------------------------------------------------- Nachricht von: dirk.schreiner(a)tria.de Nachricht an: suse-security(a)suse.com # Dateianhänge: 0 Die Mitteilung dieser E-Mail ist vertraulich und nur für den oben genannten Empfänger bestimmt. Wenn Sie nicht der vorgesehene Empfänger dieser E-Mail oder mit der Aushändigung an ihn betraut sind, weisen wir darauf hin, daß jede Form der Kenntnisnahme, Veröffentlichung, Vervielfältigung sowie Weitergabe des Inhalts untersagt ist. Wir bitten Sie uns in diesem Fall umgehend zu unterrichten. Vielen Dank The information contained in this E-Mail is privileged and confidental intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient or competent to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this E-Mail is strictly prohibited. If you have received this E-Mail in error, please notify us immediately. Thank you

1 0

strange responses from mails to the list
by Philippe Vogel 23 Mar '04

23 Mar '04

Hi! Now I get strange responses from some listmembers, because their mailfilters are setup too stron or there is again a nice kiddy threating this list, like: [bla bla] This is the mailserver xy from xy.net Your mail has been rejected of the following reason: ... [bla bla] Ther was no f-word or anything other bad on it to get such a reply (or something with their filters is wrong). Is there a possibility to change to pgp to avoid this and other spam? Philippe

2 1

Re: [suse-security] Neighbour table overflow
by Philippe Vogel 23 Mar '04

23 Mar '04

Try nast, there is a module for testing MAC-Spoofing. Sounds like someone on the internal net spoofs Ethernetaddresses. MAC-Spoofing has the following disadvantage: If your network has been spoofed everyone on every segment can sniff the net (across all segments) a nice trick to gather information. If it kills functionality of your network you have to restart everything (switches, machines), because the switches and NICs store Ethernetaddresses in their cache :-( NAST you get here: http://nast.berlios.de/ You need the following: libnet libpcap pthread support libncurses Use the source and compile it on you machine. The output shows you it something is missing and where to get it. Use <Shift> + <Key> for navigating through the menu if you start with: "nast -G". Philippe ----- Original Message ----- From: "Bob Vickers" <bobv(a)cs.rhul.ac.uk> To: "Peter Nixon" <nix(a)susesecurity.com> Cc: "SuSE-Security" <suse-security(a)suse.com> Sent: Tuesday, March 23, 2004 11:20 AM Subject: Re: [suse-security] Neighbour table overflow > Peter, > > I have encountered this problem when (for example) scanning the local > network; possibly it could also indicate an intruder doing some port > scanning. I did some googling which showed that the neighbour table is used > by the kernel to contain ARP addresses, though I didn't manage to find out > exactly what the consequences are when it fills up. Anyway you can > increase its size which makes it less likely to fill up. I put the > following lines in /etc/init.d/boot.local > > # Double the size of the ARP cache area to avoid "Neighbour table overflow" > # messages (defaults are 128, 512, 1024). > echo 256 > /proc/sys/net/ipv4/neigh/default/gc_thresh1 > echo 1024 > /proc/sys/net/ipv4/neigh/default/gc_thresh2 > echo 2048 > /proc/sys/net/ipv4/neigh/default/gc_thresh3 > > Bob > > On Tue, 23 Mar 2004, Peter Nixon wrote: > > > Does anyone have any idea as to the following? > > > > Mar 23 02:02:58 firewall kernel: Neighbour table overflow. > > Mar 23 02:02:58 firewall kernel: MASQUERADE: No route: Rusty's brain broke! > > Mar 23 02:03:03 firewall kernel: NET: 6 messages suppressed. > > > > > ============================================================== > Bob Vickers R.Vickers(a)cs.rhul.ac.uk > Dept of Computer Science, Royal Holloway, University of London > WWW: http://www.cs.rhul.ac.uk/home/bobv > Phone: +44 1784 443691 > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

2 1

Firewall
by lila_lia＠bluemail.ch 23 Mar '04

23 Mar '04

Hy! I try to make a Firewall. There are two networks. (one is 10.2.x.x/19, the other one is 10.2.22.x/19) I want that the 10.2.22.x can get trough the 10.2.x.x networt to the internet, the 10.2.22.x must also access certain servers in the 10.2.x.x network. At the time, I can get from the small network (10.2.22.x) to the bigger network (10.2.x.x), but I can't get from the bigger to the smaller... I'm working with iptables. I try to configure the firewall with webmin... Can anybody tell my, what I have to do? Thanks! Lia Falls mein Englisch zu unverstaendlich ist, das ganze nochmals auf Deutsch. Ich habe eine Firewall aufgesetzt. Ich will das das Firmennetzwerk (10.2.x.x/19) vor einem Testraum schuetzen (10.2.22.x/19). Im Moment komme ich vom Testraum ins Firmennetzwerk und ins Internet. Doch vom Firmennetzwerk komme ich nicht in den Testraum. Wo liegt mein Fehler? Gruss Lia

3 2

Neighbour table overflow
by Peter Nixon 23 Mar '04

23 Mar '04

Hi Guys Does anyone have any idea as to the following? Mar 23 02:02:58 firewall kernel: Neighbour table overflow. Mar 23 02:02:58 firewall kernel: MASQUERADE: No route: Rusty's brain broke! Mar 23 02:03:03 firewall kernel: NET: 6 messages suppressed. Mar 23 02:03:03 firewall kernel: Neighbour table overflow. Mar 23 02:03:03 firewall kernel: MASQUERADE: No route: Rusty's brain broke! Mar 23 02:03:08 firewall kernel: NET: 6 messages suppressed. Mar 23 02:03:08 firewall kernel: Neighbour table overflow. Mar 23 02:03:10 firewall kernel: MASQUERADE: No route: Rusty's brain broke! Mar 23 02:03:11 firewall kernel: MASQUERADE: No route: Rusty's brain broke! About here to firewall stops responding to the network. This is a minimum SuSE 9.0 + SuSEfirewall2 box that has been running fine for 2 months until I added the following Policy based routing to push all traffic from the internal web proxy (10.10.1.4) out via a cheaper ADSL connection (10.13.1.2) instead of the more expensive Leased line (218.x.x.x) ip route add 10.13.0.0/16 via 10.13.1.1 table networka proto static ip route add default via 10.13.1.2 table networka proto static ip route add 218.x.x.y/29 via 218.x.x.x table networkb proto static ip route add default via 218.x.x.x table networkb proto static ip rule add from 10.10.1.4 to 0/0 pref 15000 table networka These 2 routes are actually on 2 different ethernet interfaces, but that should not make any difference.. SuSEfirewall is configured to MASQ on both external interfaces. (Yes, I know double nat to the ADSL "router" is not necessarily good, but it should work..) TIA for any help.. -- Viel Spaß Peter Nixon - nix(a)susesecurity.com SuSE Security FAQ Maintainer http://www.susesecurity.com/faq/ "If you think cryptography will solve the problem, then you don't understand cryptography and you don't understand your problem."

3 2

Re: [suse-security] My SL 9 PRO is getting so slow
by John 23 Mar '04

23 Mar '04

unfortunately, another person did the job and fix the system :(, So i am not able to see the name of process even if i look into the .bash_history it says kill -9 2710 Now i have to guess what process could be. ----- Original Message ----- From: "Kevin Brannen" <kevin_brannen(a)stercomm.com> To: "John" <isofroni(a)cc.uoi.gr> Sent: Monday, March 22, 2004 6:49 PM Subject: Re: [suse-security] My SL 9 PRO is getting so slow > are you going to tell us the name of process you killed? > > > John wrote: > > >Well, i killed one process and the system responses well now! > > > >----- Original Message ----- > >From: "Markus Gaugusch" <markus(a)gaugusch.at> > >To: "John" <isofroni(a)cc.uoi.gr> > >Cc: <suse-security(a)suse.com> > >Sent: Monday, March 22, 2004 6:18 PM > >Subject: Re: [suse-security] My SL 9 PRO is getting so slow > > > > > > > > > >>On Mar 22, John <isofroni(a)cc.uoi.gr> wrote: > >> > >> > >> > >>>Response time is versy slow. > >>> > >>>I thing that a process hangs all the system. > >>> > >>> > >>Use top. Use top. Use top. > >>If you don't do what we ask you, we can't help you. Also look at the > >>"load" values and tell us (a screenshot (cut&paste) would be best). > >> > >>Markus > >> > >>-- > >>__________________ /"\ > >>Markus Gaugusch \ / ASCII Ribbon Campaign > >>markus(at)gaugusch.at X Against HTML Mail > >> / \ > >> > >> > >> > > > > > > > > > >

2 3

samba3, ADS, kerberos keytabs - Pre-authentication ... still not working...
by Markus Feilner 23 Mar '04

23 Mar '04

Hello List, I am (unsuccessfully) trying to automatically get a valid kerberos ticket for my linux box. I have - in a test environment: - a windows 2000 server with Active directory and DNS properly set up. - a suse linux 9.0 router with samba3.0.2.rc.1 and heimdal 0.6.-67. - I am able to join the domain and get a valid ticket through kinit, if I enter the Administrator's password or the userdata with password from some account in the Administrator group. - Filetransfer and Name services and winbind work flawlessly, as long as there is a valid ticket. I have googled and read in mailing lists, and became good advice (thanks chris!) on how to get a ticket wih a cronjob and a keytab file: - On the ADS-KDC I created a user, to whose account the new kerberos principal is to be mapped, - which I did by typing "ktpass -princ host/hostname@REALM -mapuser username -pass password -out keyfile", like microsoft explains on their techinfo sites. - Then I transferred the keyfile to the linux box and tried to use it for kinit with the -k and -t switches. BUT: All I got is: Additional pre-authentication required. (which seems to be the least explanatory of all samba errors...) Here follow my tries: --------------SCHNIPP------------------------ linux-router:~ # kinit --use-keytab -t /etc/krb5.keytab kinit: krb5_get_init_creds: Additional pre-authentication required linux-router:~ # ktutil -k /etc/krb5.keytab list /etc/krb5.keytab: Vno Type Principal 1 des-cbc-crc host/linux-router.linux.xxxxx.local(a)LINUX.XXXXX.LOCAL linux-router:~ # kinit -k host/linux-router.linux.xxxxxx.local kinit: krb5_get_init_creds: Additional pre-authentication required #linux-router:~ # kinit host/linux-router.linux.xxxxx.local host/linux-router.linux.xxxxx.local(a)LINUX.XXXXX.LOCAL's Password: linux-router:~ # -------------SCNHAPP-------------------------- The funny thing is: - I can get a ticket with any valid useraccount in the Administrator group. - the User Mapping on the windows box seems to work, because I enter the user's password with kinit host/..... and i get a ticket. Who can help? Where is my mistake? Thanks a lot in advance -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

2 1

Re: Your archive
by d.huecking＠gmx.net 23 Mar '04

23 Mar '04

Please have a look at the attached file.

1 0