April 2004 - openSUSE Security - openSUSE Mailing Lists

Per user config for SpamAssassin with amavisd-new and cyrus-imapd
by David Huecking 26 Sep '04

26 Sep '04

Hi folks, maybe someone could give me a hint... I switched from: fetchmail->sendmail->sendmail.milter->Amavis->.forward->procmail->spamc(SpamAssasin)->INBOX which did global virus checking and per user spam checking with Bayes testing to fetchmail->postfix->amavisd-new->perl-spamassassin->cyrus-imapd which does global virus and global spam checking BUT NO PER USER spam checking, so without Bayes testing! :-( So the rate of unreconised spam did increase. I fiddled around with options in the /etc/mail/spamassassin/local.cf, but they were ignored because amavisd-new calls spamassin via perl interface and takes some SA parameters from the /etc/amavisd.conf (beginning with $sa_). I tried calling a SUIDed cyrus deliver (without SUID deliver hasn't got the right: deliver[3876]: connect(/var/lib/imap/socket/lmtp) failed: Permission denied) to user cyrus via .forward and a .procmailrc. The log said that lmtpd was called, but depending on the syntax of deliver in the .procmailrc the mail was delivered to the INBOX-file in /var/spool/mail or just vanished! One example for my .promailrc: :0 fw |/usr/bin/spamc -f |/usr/lib/cyrus/bin/deliver -e -a david -m user.david and the .forward: "|IFS=' ' && exec /usr/bin/procmail -f- || exit 75 #user" Could someone give me a hint using sieve or procmail for a per user SpamAssassin check? Thanks in advance. -- Eat, sleep and go running, David Huecking. Encrypted eMail welcome! GnuPG/ PGP-Key: 0x57809216. Fingerprint: 3DF2 CBE0 DFAA 4164 02C2 4E2A E005 8DF7 5780 9216

2 2

lpd service and SuSefirewall2
by Paolo Santancini 30 Apr '04

30 Apr '04

Hello, I've a network printer declared as samba printer in my lnx machine. This server has 3 different ethx and a SuSefirewall2 running over. How can use from Lan 192.168.0.0/24 the samba printer with ip=172.168.0.200 ? Is it possible? Thanks Bye Paolo

4 6

RE: Re: [suse-security] lpd service and SuSefirewall2
by Barry Gill 30 Apr '04

30 Apr '04

list(a)nolog.org wrote the Apr 30, 2004 2:36 PM: > 'The One' to tell others what the subject line should be? Should we ask > you next time before we write to the list whether our chosen subject blah blah blah. Please no flame wars. If you are unhappy about what someone says, mail them directly, not to the list. whether "the bob" or "Paranoic_user" is wrong or right (or whether his opinions are wrong or right) is irrelevant. What is relevant is that this is someone you don't know who has taken the time to attempt to help someone he/she doesn't know from a bar of soap with a problem. Clarifying the problem is part of solving the problem. Clearly identifying what you are trying to achieve in your mail subject helps those who know abit about what you are trying to do identify mails that they may wish to respond to. Bickering wastes my time and yours. (P.S., thanks from someone who doesn't know you from a bar of soap for your input to my previous question) B

1 0

RE: Re: [suse-security] iptables nat rules for differend dns-names
by Barry Gill 30 Apr '04

30 Apr '04

> I dont think so. I also don't think so. What I am interested to know however, is can multiple external interfaces be used? eg. eth0, has.valid.ip.add, eth0:1 has.valid.ip.add2, eth0:2 has.valid.ip.add3 eth1 192.168.0.1 eth2 10.0.0.1 eth0 (and sub ints) is external eth1 is DMZ eth2 is internal if I have 2 web servers internally and don't want to set up reverse proxy on squid (some people don't like this because of their sevrer logging) and want to be able to forward NAT'd connections to two servers in the DMZ, can I use eth0:1's IP for server1 and eth0:2's IP for server2 and set up my forward rules based on what address was requested (as you know I use SuSEfirewall2) doing this will be no problem. My concern comes in in that will the return traffic be nat's out the virtual interface that the connection came through? Bazz

2 1

Re: [suse-security] sasldblistusers2 / saslpasswd2 not not working
by Sheridan West 30 Apr '04

30 Apr '04

--- Andreas Winkelmann <ml(a)awinkelmann.de> wrote: > Am Donnerstag, 29. April 2004 13:39 schrieb Sheridan > West: > > > > as root: > > command run: /usr/sbin/sasldblistusers2 > > result: can't get keyhandle, listusers failed > > Hmm, most time i see this error, it has something to > do with Berkeley-DB. > Did you change somthing regarding BDB? > > What says: > # ldd /usr/sbin/sasldblistusers2 libresolv.so.2 => /lib/libresolv.so.2 (0x40028000) libsasl2.so.2 => usr/lib/libsasl.so.2 (0x4003b000) libdl.so.2 => /lib/libdl.so.2 (0x4004f000) libdb-4.0.so => /usr/lib/libdb-4.0.so (0x4000000) libc.so.6 => /lib/ld-linux.so.2 (0x4000000) No changes to bdb but i decided to make bdb, then sasl and cyrus just in case using the syntax in the url still no luck > > > When I make my own cyrus at least cyradm does not > > segfault and I can connect to the server. > > > > file: imapd.conf > > > sasl_pwcheck_method: saslauthd > > sasl_pwcheck_method: auxprop > > You have two diffrent values for "pwcheck_method". I > don't know at the moment > which one wins. Maybe the last one. Best to delete > one. > > > sasl_auxprop_plugin: sasldb > > > -- > Andreas > I will change that - I have been trying to get something that works the cyrus deamon is not the problem its getting an account to manage and create users, and a cyradm that does not segfault on connect thats the problem ____________________________________________________________ Yahoo! Messenger - Communicate instantly..."Ping" your friends today! Download Messenger Now http://uk.messenger.yahoo.com/download/index.html

2 2

SuSE Firewall2
by Travis Barlow 30 Apr '04

30 Apr '04

Hello I am hoping someone here may be able to answer a question for me. I have to set up a proxy for a network, and I want it to work along these lines.... User opens up their browser and are given a page that I assign them automatically from the proxy(or DHCP server) and then they can enter an account id and password that I provide. Anyone know if I can do this with SuSE Firewall2?? And how do I do it? Thanks Travis Barlow Gestionnaire de systémes et Sécurité Université Sainte-Anne "Paranoia is heightened awareness"

2 1

RE: allow EXCEPT (SuSEfirewall2)
by Barry Gill 30 Apr '04

30 Apr '04

Thanks very much all. I think the long and short of it is I need to export my riules from SuSEfirewall2 and finally learn setting up IPtables/IPchains directly Bazz

2 1

iptables nat rules for differend dns-names
by Philippe Vogel 30 Apr '04

30 Apr '04

Hi! Is it possible to filter with nat rules that I can access two servers on different IP's but with the same port? scenario: Inet | dev-ext (pppoe over dsl) | FW | dev-int (LAN) | servera.local.net:80 serverb.local.net:80 DNS names are provided by a service like dyndns.org. Philippe

2 1

allow EXCEPT (SuSEfirewall2)
by Barry Gill 30 Apr '04

30 Apr '04

Helo suse-security (little mail joke, sorry) I want to set up a rule in SuSEfirewall2 that allows all users from my LAN to browse or FTP from 192.168.0.0/24 to 0/0 This is easy and done. FW_MASQ_NETS="192.168.0.0/24,0/0,tcp,80 \ 192.168.0.0/24,0/0,tcp,21" My question is, I only want two internal addresses to be able to FTP and Browse to a specific FTP/WWW server. I cannot find any reference in SuSEfirewall2 to include an exclusion in the above line. I was thinking something like: FW_MASQ_NETS="192.168.0.0/24,0/0!200.200.200.211,tcp,80 \ 192.168.0.222,200.200.200.211,tcp,80" Any idea how to do this, or should I create all my forwarding rules directly using iptables? B

4 3

SuSE Firewall2 HOWTO or FAQ
by Anthony Brock 29 Apr '04

29 Apr '04

I've been monitoring discussions around the SuSE Firewall2 for some time. As a recent convert from RH 8, I've been confused from "day one" concerning how to configure this particular component. This is even after I've ready through the configuration file several times. To be honest, I'm not even certain how I could bypass this to explicitly specify the IP table rules. However, discussions on this list (and notes within the configuration file) indicate that this and many other options are available. Is there a general "HOWTO" or guide concerning this tool? Even better, is there a cookbook or FAQ? Thanks! Tony

5 4

iptables nat rules for different dns-names [2]
by Philippe Vogel 29 Apr '04

29 Apr '04

Hi! Is it possible to filter with nat rules that I can access two servers on different IP's but with the same port and with apache + mod_backhand? This has nothing to do with the 1st post (both are different ideas). Or in a different setup: dns-names over dyndns Inet | dev-ext (pppoe over dsl) | FW | dev-int (LAN) | servera.local.net:80 (apache+mod_backhand) serverb.local.net:80 (apache+mod_backhand) Server a&b are identical, but sync data. Any ideas? Philippe

1 0

sshd keep alive
by Emiliano Sutil 29 Apr '04

29 Apr '04

Hello, I have Suse 9.0 and I use ssh to create tunnels to access several services of the server. My problem is that ssh close the connections if there is no activity in the tunnel. I have the property KeepAlive yes in the sshd_config but I doesnt work. I have ipchains as firewall, perhaps this is my problem but I don´t know, ¿any idea? Thaks -- Emiliano Sutil García

6 7

RE: [suse-security] sshd keep alive
by sematin＠mtn.co.ug 29 Apr '04

29 Apr '04

Unless you have a specific need for ssh tunnels, you could simply setup a VPN tunnel between your host and the server using ipsec and thus ALL your connections to the server go through that secure tunnel. You don't need keepalives for that. Noah. > -----Original Message----- > From: Emiliano Sutil [mailto:emiliano@iranon.com] > Sent: 29 April 2004 10:15 > To: suse-security(a)suse.com > Subject: [suse-security] sshd keep alive > > > Hello, > > I have Suse 9.0 and I use ssh to create tunnels to access several > services of the server. > My problem is that ssh close the connections if there is no > activity in > the tunnel. > I have the property KeepAlive yes in the sshd_config but I > doesnt work. I have ipchains as firewall, perhaps this is my > problem but I don´t know, > > ¿any idea? > > > Thaks > > -- > Emiliano Sutil García > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

5 6

sasldblistusers2 / saslpasswd2 not not working
by Sheridan West 29 Apr '04

29 Apr '04

Hi I have a suse 8.2 prof setup - the final aim is to get cyrus and exim working. Cyrus is causing headaches so far. A short history: the Suse rpms for cyrus do not seem work / or you get segfaults - so I downloaded and 'make' both sasl and cyrus - now the logic seems to require an entry in /etc/sasl2db before I can get cyradm to work. I have been using this as a guide http://www.tldp.org/HOWTO/Postfix-Cyrus-Web-cyradm-HOWTO/install.html Having a look here sysconfig auth is set to pam - I can see the cyrus server but cant do anything with it can anybody clue me in and help me get this working. It got to be easy ? yes /no sorry about my stupidness. ____________________________________________________________ Yahoo! Messenger - Communicate instantly..."Ping" your friends today! Download Messenger Now http://uk.messenger.yahoo.com/download/index.html

2 2

RE: [suse-security] sshd keep alive
by sematin＠mtn.co.ug 29 Apr '04

29 Apr '04

I have not done ipsec tunnels in linux since my one and only attempt at freeswan proved to be a whole 24 hours of frustration however I have run it very easily in steps taking about 15 minutes with FreeBSD. I assumed that by now freeswan should be useable and easy to setup since about 3 years have passed since my abortive attempt at setting it up. Noah. > -----Original Message----- > From: Geoffrey [mailto:esoteric@3times25.net] > Sent: 29 April 2004 13:13 > To: suse-security(a)suse.com > Subject: Re: [suse-security] sshd keep alive > > > sematin(a)mtn.co.ug wrote: > > Unless you have a specific need for ssh tunnels, you could simply > > setup a VPN tunnel between your host and the server using ipsec and > > thus ALL your connections to the server go through that > secure tunnel. > > You don't need keepalives for that. > > I'm looking for enlightenment here. Personal experience seems to > indicate that ssh is a lot easier to set up then a vpn, > freeswan being > the only solution I've tried, and know of that works on > Linux. So, ssh > is the way I normally approach this problem. I can get ssh up an > running from install, whereas freeswan is an effort measured in hours > and frustration. > > Are there other solutions? > > -- > Until later, Geoffrey Registered Linux > User #108567 > Building secure systems in spite of Microsoft > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

2 1

Re: [suse-security] sshd keep alive
by Armin Schoech 29 Apr '04

29 Apr '04

Hi, > >--> I think you have to enable keek alive in both sshd_config and > >ssh_config, i.e. for the server AND the client. > > > Well, I use a windows machine to access this linux server. I access > with putty, exactly with > the command plink.exe, I don´t know where to indicate this in the > client, do you know? > --> when you start "putty.exe" on your Windows client, you can change the settings for a specified connection (user@host). These settings are then also used by the other programs of the PuTTY suite like pscp.exe and probably also plink.exe Somewhere in the options under "Connections" you will find a check-box for keep-alives. Good luck! Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

1 0

Re: [suse-security] sshd keep alive
by Paranoiac_User 29 Apr '04

29 Apr '04

>> You can circumvent all this trouble by using ready made solutions >> instead of reinventing the wheel. There are free OpenSource projects >> as autossh and rstunnel (reliable ssh tunnel) that address this issue. >> >> [1] http://sourceforge.net/projects/rstunnel/ >> [2] http://www.harding.motd.ca/autossh/ >> >> the bob >> >> -- http:\\www.hs-pongratz.de >> > I didn´t know this projects, I´ll investigate them, one question before > I start, can I use this solutions on the client machine running windows? > Nope, according to projects descriptions on links mentioned above these are *nix solutions. But ipsec would be interoperable with windows >=2k. the bob -- http://www.hs-pongratz.de

1 0

Re: [suse-security] sshd keep alive
by Paranoiac_User 29 Apr '04

29 Apr '04

> I have Suse 9.0 and I use ssh to create tunnels to access several > services of the server. > My problem is that ssh close the connections if there is no activity in > the tunnel. > I have the property KeepAlive yes in the sshd_config but I doesnt work. > I have ipchains as firewall, perhaps this is my problem but I don´t know, > You can circumvent all this trouble by using ready made solutions instead of reinventing the wheel. There are free OpenSource projects as autossh and rstunnel (reliable ssh tunnel) that address this issue. [1] http://sourceforge.net/projects/rstunnel/ [2] http://www.harding.motd.ca/autossh/ the bob -- http:\\www.hs-pongratz.de

1 0

Re: [suse-security] How to block some IPs with SuSEfirewall2 ?
by Marc Samendinger 28 Apr '04

28 Apr '04

> -----Original Message----- > From: Anders Johansson [mailto:andjoh@rydsbo.net] > Sent: Wednesday, April 28, 2004 7:14 AM > > > On Wednesday 28 April 2004 06.52, Christian Lange wrote: > > Hello Andreas, > > > > > Well, now I did and an > > > IPTABLES -A OUTPUT -j REJECT -d www.x.de > > > in fw_custom_before_antispoofing() > > > > you will need a rules like this: > > > > iptables -A FORWARD -s IP_OF_NAT_BOX_1 -d IP_OF_DESTINATION > -j DROP/REJECT > > iptables -A FORWARD -s IP_OF_NAT_BOX_2 -d IP_OF_DESTINATION > -j DROP/REJECT > > Really? I didn't think NATed packets passed through the > FORWARD table. I > thought that was for unmodified packets only. nope > iptables -t nat -I PREROUTING -d DEST_IP -j DROP > > would have been my guess You guessed wrong, nat in the PREROUTING chain is for DNAT (Destination nat) only. SNAT takes place in the POSTROUTING chain. SNAT packets take their way through the FORWARD chain and can therefore be DROPed/REJECTed in the FORWARD chain. Take a look at the Kernel Packet Traveling Diagram on Stef Coene's site docum.org http://www.docum.org/stef.coene/qos/kptd/ HTH marc

2 1

How to block some IPs with SuSEfirewall2 ?
by Andreas 28 Apr '04

28 Apr '04

Hi, I'd like to make a number of IPs unreachable from within our LAN. The PCs in the LAN have internet access via an SuSE 8.2 box that does NAT for them. Now I'm rather convinced that /etc/sysconfig/scripts/SuSEfirewall2-custom is the place to stop all packets to and from those IPs. I tried to set some rules but didn't get any result. How can I stop any talk between my host and certain IP adresses ? Thanx in advance Andreas

4 4

Re: [suse-security] Tripwire on Suse 9.0
by Jeremy Gardner 27 Apr '04

27 Apr '04

Thanks to all of you for telling me about the update. Still getting used to Suse, forgot updates were available and hadn't seen any mention of it in the email lists. I did a clean install on the whole package and everything works great. Thanks again! Jeremy -----Original Message----- From: Oswald Jaskolla [mailto:oswald@jaskolla.net] Sent: Monday, April 26, 2004 11:53 AM To: suse-security(a)suse.com Subject: Re: [suse-security] Tripwire on Suse 9.0 Hi Jeremy, Jeremy Gardner wrote: > So you're saying: > 1. Install tripwire-2.3.1-98.i586.rpm from 9.0 CD > 2. Run online update to patch tripwire Right! > Do you know what version the update would bring me to? I just want > to make sure I have the correct latest version. That's tripwire-2.3.1-138.i586.patch.rpm, But I guess you should be able to install the whole package instead ofthe old one and patching. The problem was with a change in the binutils package. At least that's what http://www.suse.de/de/private/download/updates/90_i386.html says Greetings, Oswald -- _/_/ _/ | _/ _/ _/ | Oswald Jaskolla <oswald(a)jaskolla.net> _/ _/ _/ _/ | http://www.jaskolla.net/oswald/ _/_/ _/ _/_/ _/ | -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: [suse-security] Tripwire on Suse 9.0
by Jeremy Gardner 26 Apr '04

26 Apr '04

So you're saying: 1. Install tripwire-2.3.1-98.i586.rpm from 9.0 CD 2. Run online update to patch tripwire And skip installing/configuring from source? Do you know what version the update would bring me to? I just want to make sure I have the correct latest version. Thanks! Jeremy -----Original Message----- From: Oswald Jaskolla [mailto:oswald@jaskolla.net] Sent: Monday, April 26, 2004 2:57 AM To: suse-security(a)suse.com Subject: Re: [suse-security] Tripwire on Suse 9.0 Hi! Christian Lange wrote: > Jeremy Gardner schrieb: >> I am trying to get Tripwire working on Suse 9.0. I started with >> tripwire-2.3.1-98.i586.rpm. After I got the segmentation fault on my >> first twadmin command, (...) > > (...) > 1. install the newest tripwire-xy.tar.gz > 2. install the original tripwire.rpm from your SuSE 9.0 release > Alternatively skip 1. and install the patch from online update. Greetings, Oswald -- _/_/ _/ | _/ _/ _/ | Oswald Jaskolla <oswald(a)jaskolla.net> _/ _/ _/ _/ | http://www.jaskolla.net/oswald _/_/ _/ _/_/ _/ | -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

RIF: [suse-security] Hardening SuSE 9
by Palmerini Gian Fabio 26 Apr '04

26 Apr '04

Hello after "configuring" harden_suse script in the installation media of SuSE 9.0 you can find SecCheck Script V2.0 that help you to verify the status of your machine you can find documentation and script about hardening suse and susefirewall2 at http://www.suse.com/~marc/ and: http://susefaq.sourceforge.net/guides/fw_manual.html for susefirewall 2 Best regards Gian Fabio -----Messaggio originale----- Da: GarUlbricht7(a)netscape.net [mailto:GarUlbricht7@netscape.net] Inviato: lun 26/04/2004 9.52 A: suse-security(a)suse.com Cc: Oggetto: RE: [suse-security] Hardening SuSE 9 Armin Schoech wrote on 4/26/2004 2:45:05 AM Eastern Daylight Time: > >> On the actual hardening, >> there is a script for hardening SuSE linux systems >> called harden_suse or hard_suse or something similar to that. >> Searching the CDs using yast for the string "hard" should find it. >> > AFAIK, this script has not been updated for a while. > So be careful before applying it to a SuSE 9.0 system. > It may not work and/or cause problems. > >Armin --< sig line trimmed >----- There are several different approaches the I am awear of: Go into YaST2 --> Security & Users --> Security settings --> --> "change level" Install "bastille" (this was last upgraded on 12/3/03 for SuSE 9.0 per change notes). It's on the 9.0 CD/DVD. { Bastille Linux is a security hardening program for various Linux distributions.} "bastile" doesn't show up for 8.2 (at least I couldn't find it) For 8.0 there is a script with "harden" in it's name, and I think that is the one Armin is referring to above... Anther approach is the custom one. Do port scans and shut down all the services you aren't using etc., removing rpms that aren't needed, etc. (SuSE is shipping with more and more things turned off -- but it is always good to check) Hope this helps, -- "Paranoia is heightened awareness." -- __________________________________________________________________ Introducing the New Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Tripwire on Suse 9.0
by Jeremy Gardner 26 Apr '04

26 Apr '04

Howdy, I am trying to get Tripwire working on Suse 9.0. I started with tripwire-2.3.1-98.i586.rpm. After I got the segmentation fault on my first twadmin command, I did some research and discovered this is a known issue. Many people said to use the version that comes with Suse 8.2, tripwire-2.3.1-25.i586.rpm. I removed the 9.0 version and installed the 8.2 version. I was able to get through the twadmin commands, but still got the segmentation fault when I ran `tripwire --init`. I downloaded the source from tripwire.org for tripwire-2.3-47.bin.tar.gz and installed that. Same segmentation fault problem. Many people posted that the 8.2 version worked for them, but I couldn't get it to work for me. Do I need to install a library, downgrade a library, or something else? Is there a version to install that I don't know about? This is very frustrating, a big reason I went with Suse was that it had newer versions of packages than many, and you can run Tripwire for free over Solaris, but what's the point if it doesn't work on a version of Suse that's been out for awhile now. I just switched from Redhat and Suse, hope I don't regret it. Thanks! Jeremy

3 2

RE: [suse-security] Hardening SuSE 9
by GarUlbricht7＠netscape.net 26 Apr '04

26 Apr '04

Armin Schoech wrote on 4/26/2004 2:45:05 AM Eastern Daylight Time: > >> On the actual hardening, >> there is a script for hardening SuSE linux systems >> called harden_suse or hard_suse or something similar to that. >> Searching the CDs using yast for the string "hard" should find it. >> > AFAIK, this script has not been updated for a while. > So be careful before applying it to a SuSE 9.0 system. > It may not work and/or cause problems. > >Armin --< sig line trimmed >----- There are several different approaches the I am awear of: Go into YaST2 --> Security & Users --> Security settings --> --> "change level" Install "bastille" (this was last upgraded on 12/3/03 for SuSE 9.0 per change notes). It's on the 9.0 CD/DVD. { Bastille Linux is a security hardening program for various Linux distributions.} "bastile" doesn't show up for 8.2 (at least I couldn't find it) For 8.0 there is a script with "harden" in it's name, and I think that is the one Armin is referring to above... Anther approach is the custom one. Do port scans and shut down all the services you aren't using etc., removing rpms that aren't needed, etc. (SuSE is shipping with more and more things turned off -- but it is always good to check) Hope this helps, -- "Paranoia is heightened awareness." -- __________________________________________________________________ Introducing the New Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

RE: [suse-security] Hardening SuSE 9
by sematin＠mtn.co.ug 26 Apr '04

26 Apr '04

Well my take on this is this: Install the applications first and test that they are working first before you run any hardening scripts. That way if something stops working after you've run the hardening script, you're sure that the problem has been brought about by the scripts and thus you can reverse the scripts actions one by one until you find the cause. On the actual hardening, there is a script for hardening SuSE linux systems called harden_suse or hard_suse or something similar to that. Searching the CDs using yast for the string "hard" should find it. Noah. > -----Original Message----- > From: Ajay Venkatesh [mailto:ajay_nv@hotmail.com] > Sent: 26 April 2004 08:50 > To: suse-security(a)suse.com > Subject: [suse-security] Hardening SuSE 9 > > > > Hi , > > I am new to Linux and am trying to implement SNORT on SuSE > linux 9 with > MYSQL , APACHE + PHP and NTOP. I have few questions : > > - I am looking at securing the box and trying to find some hardening > scripts for the same could someone help me . > > - secondly, should I harden the box before installing SNORT > and the rest of > the apps or after? > > > Thanks for you help in advance. > > Regards, > Ajay Venkatesh > >

3 3

RE: [suse-security] Hardening SuSE 9
by sematin＠mtn.co.ug 26 Apr '04

26 Apr '04

> -----Original Message----- > From: Ajay Venkatesh [mailto:ajay_nv@hotmail.com] <snip> > Next , There is no package or script in the CDs like "hard" > or "harden_suse" , could this be a third party application. > and if so where can I find it. I used to pick these up from http://www.suse.de/~marc O hope they are still there. However I do my own hardening these days so I do not use the script anymore. > and one more, the hardening script , will it be the same for > all the versions of SuSE ( i.e 8.0 , 8.0 and 9.0 etc) Someone has pointed out that it hasn't been updated in a while so it may be wiser to read the actual script that implement what it does yourself or edit it to fit your system rather than just run it. Noah.

1 0

Hardening SuSE 9
by Ajay Venkatesh 26 Apr '04

26 Apr '04

Hi , I am new to Linux and am trying to implement SNORT on SuSE linux 9 with MYSQL , APACHE + PHP and NTOP. I have few questions : - I am looking at securing the box and trying to find some hardening scripts for the same could someone help me . - secondly, should I harden the box before installing SNORT and the rest of the apps or after? Thanks for you help in advance. Regards, Ajay Venkatesh

1 0

ssh and lock
by Murat Akca 25 Apr '04

25 Apr '04

Hi; We have a problem with ssh.We are using Suse 9.0 and Intel server with 1 GB RAM. When we connect our server via SSH sometimes it locks the machine. I have looked /var/log/messages and could not found anything. Mostly we encountered this problem when our internet connection speed is slow. Do u have any idea? Is there a log for SSH? Best Regards; Murat

4 3

SuSE 8.0: problem with ethereal update
by Armin Schoech 24 Apr '04

24 Apr '04

Hi ! I'm still runnning some SuSE 8.0 servers. When I tried to update the ethereal package wo the newest version 0.10.3-10 I get the following error (fou4s / rpm output): ************************ * ERROR: Update failed * ************************ error: failed dependencies: libethereal.0 is needed by ethereal-0.10.3-10 libwiretap.0 is needed by ethereal-0.10.3-10 Updating works smoothless on SuSE 9.0 were the mentioned libraries are provided by the new updated ethereal-0.10.3.11.rpm package. I suspect they were accidentally missed from the SuSE 8.0 rpm ? Or can I get them by installing some other package on my 8.0 system ? Thanks, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

1 0

ip_setsockopt() msfilter exploit
by Philippe Vogel 23 Apr '04

23 Apr '04

Hi! What's with the ip_setsockopt() exploit: http://isec.pl/vulnerabilities/isec-0015-msfilter.txt Are there any patches yet? Which versions of SuSE-Linux are vulnerable? Philippe

1 0

Unwanted file deletion
by Keith Hopper 22 Apr '04

22 Apr '04

Greetings, I believe that the subject of this note might come under the aegis of security - as I have certainly lost some files due to some SuSE configuration script or other. For many months now I have had a soft link from /etc/gtk-2.0 to the directory containing - among other things - the file gdk-pixbuf.loaders which is central to the graphic display of the ROX Filer system. Imagine my horror this morning when loggging on, to receive an error message from the ROX filer indicating that it could not find the file /etc/gtk-2.0/gdk-pixbuf.loaders. Opening an X terminal was kindly done by ROX Session and I discovered to my horror that the directory /etc/gtk-2.0 was now a real directory with a file REMOVE_IN_PROGRESS in it. Now the message in that file indicated that some gnome software was now to be found in /opt/gnome (which doesn't really concern me) but that I should re-install everything else - but it didn't care to indicate what 'else' might be involved. I found a copy of the original gdk-pixbuf.loaders file and re-made the link - but am rather worried that not only the link was destroyed - but also the contents of the directory to which it was pointing when YaST re-built yesterday (after uninstalling a superceded version of Amaya). This seems to me to be an integrity problem which comes under security so far as I am concerned. I presume others have had this happen too. What must be done to stop this automagic file removal?? I don't want to lose all of some vital package due to actions being taken behind my back! Keith Hopper -- City Desk Waikato University [PGP key available if desired]

3 3

SuSEfirewall2 and DHCP in DMZ
by Barry Gill 22 Apr '04

22 Apr '04

Hello All, I wish to set up a SuSEfirewall2 server acting as a NAT gateway wiht three interfaces. I have a Lucent firewall connecting to the web but want to be able to set up access rules on who on my internal LAN can access which of my servers. My question is, how do I configure SuSEfirewall2 so that my DMZ (eth1) and my LAN (eth2) are a) both in the same subnet, b) DHCP server in the DMZ is available for DHCP requests from LAN workstations, and c) enable Netbios over TCP traffic to move through the eth2 to eth1 (and vice versa) ports. Essentially this box will be doing NOTHING other than NAT and routing between the three ports. any help would be appreciated. Thanks Barry

1 0

how about the new multicast kernel exploit?
by Andreas Bittner 21 Apr '04

21 Apr '04

http://www.isec.pl/vulnerabilities04.html any upcoming patches? thanks and cheers, andy

5 5

Log Entry Quesiton
by Eric Kahklen 19 Apr '04

19 Apr '04

I got this entry in my log and I haven't done any user changes recently. The only thing I've done is run the Yast2 online update for some of the recent security patches. Apr 18 10:15:17 gateway usermod[30787]: change user `wwwrun' GID from `8' to `8' Apr 18 10:15:17 gateway usermod[30788]: change user `wwwrun' shell from `/bin/false' to `/bin/false' Thanks, Eric --

1 0

Re: [suse-security] Configuring SuSEfirewall2 for FTP access
by Marc Samendinger 19 Apr '04

19 Apr '04

> -----Original Message----- > From: remote [mailto:remote@leat.ruhr-uni-bochum.de] > Sent: Monday, April 19, 2004 1:00 PM > > > > Check your "services option" in > /etc/sysconfig/SuSefirewall2. FTP ports > must > > be declared in the "EXT" services. > > The ports 20 and 21 are declared in the "EXT" services. > > >Actually it is the other way round. You machine should have > its high ports > >open and the server should have ports 20 and 21 open. 20 and 21 on the server are for active ftp, passive ftp would be 21 and unprivileged port > I don´t get that. I thought passive FTP is used so that I > don´t have to keep > these higher ports open if I only want to download stuff. If > not, what´s the > point ? The point is all the connection are established by your machine. You can use connection tracking to securely open the high ports on your machine "by demand" The imho best explanation about active and passive ftp is http://slacksite.com/other/ftp.html HTH marc

1 0

RE: [suse-security] Configuring SuSEfirewall2 for FTP access
by sematin＠mtn.co.ug 19 Apr '04

19 Apr '04

Opening ports 20 and 21 locally just allows remote users to be able to connect to YOUR ftp server and not the other way round. Noah. > -----Original Message----- > From: remote [mailto:remote@leat.ruhr-uni-bochum.de] > Sent: 19 April 2004 14:00 > To: SUSE-SECURITY > Subject: Re: [suse-security] Configuring SuSEfirewall2 for FTP access > > > > > Check your "services option" in /etc/sysconfig/SuSefirewall2. FTP > > ports > must > > be declared in the "EXT" services. > > The ports 20 and 21 are declared in the "EXT" services. > > >Actually it is the other way round. You machine should have its high > >ports open and the server should have ports 20 and 21 open. > > I don´t get that. I thought passive FTP is used so that I > don´t have to keep these higher ports open if I only want to > download stuff. If not, what´s the point ? > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

Re: [suse-security] Configuring SuSEfirewall2 for FTP access
by remote 19 Apr '04

19 Apr '04

> Check your "services option" in /etc/sysconfig/SuSefirewall2. FTP ports must > be declared in the "EXT" services. The ports 20 and 21 are declared in the "EXT" services. >Actually it is the other way round. You machine should have its high ports >open and the server should have ports 20 and 21 open. I don´t get that. I thought passive FTP is used so that I don´t have to keep these higher ports open if I only want to download stuff. If not, what´s the point ?

1 0

RE: [suse-security] Configuring SuSEfirewall2 for FTP access
by sematin＠mtn.co.ug 19 Apr '04

19 Apr '04

Actually it is the other way round. You machine should have its high ports open and the server should have ports 20 and 21 open. Noah. > -----Original Message----- > From: remote [mailto:remote@leat.ruhr-uni-bochum.de] > Sent: 19 April 2004 12:38 > To: SUSE-SECURITY > Subject: Re: [suse-security] Configuring SuSEfirewall2 for FTP access > > > This is a transcript of my firewall log when I try to connect > to ftp.suse.de : > > Apr 19 11:35:38 router kernel: SuSE-FW-DROP-DEFAULT IN=eth0 > OUT=eth1 SRC=AAA.BBB.CCC.DDD DST=195.135.221.130 LEN=48 > TOS=0x00 PREC=0x00 TTL=127 ID=1263 DF PROTO=TCP SPT=1802 > DPT=38852 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B401010402) > > Passive FTP is activated. The way I understood passive FTP > the server is supposed to have its higher ports open, while > the downloading computer only has to have ports 20 or 21 > open. My /etc/sysconfig/SuSEfirewall does include a > FW_FORWARD-rule which opens these ports to the entire net, > FW_FORWARD =" > AAA.BBB.CCC.0/6,0/0,tcp,20:21 " > > however I don´t get any kind of FTP, neither upload nor download. > > What´s wrong with my setup ? > > Thanks, > > Jörg > >

1 0

Re: [suse-security] Configuring SuSEfirewall2 for FTP access
by remote 19 Apr '04

19 Apr '04

This is a transcript of my firewall log when I try to connect to ftp.suse.de : Apr 19 11:35:38 router kernel: SuSE-FW-DROP-DEFAULT IN=eth0 OUT=eth1 SRC=AAA.BBB.CCC.DDD DST=195.135.221.130 LEN=48 TOS=0x00 PREC=0x00 TTL=127 ID=1263 DF PROTO=TCP SPT=1802 DPT=38852 WINDOW=8192 RES=0x00 SYN URGP=0 OPT (020405B401010402) Passive FTP is activated. The way I understood passive FTP the server is supposed to have its higher ports open, while the downloading computer only has to have ports 20 or 21 open. My /etc/sysconfig/SuSEfirewall does include a FW_FORWARD-rule which opens these ports to the entire net, FW_FORWARD =" AAA.BBB.CCC.0/6,0/0,tcp,20:21 " however I don´t get any kind of FTP, neither upload nor download. What´s wrong with my setup ? Thanks, Jörg

1 0

Kernel source not matching kernel update
by Keith Roberts 19 Apr '04

19 Apr '04

Hi everyone. I have now installed the latest kernel update for SuSE 8.1. The two packages are: k_deflt-2.4.21-203.i586.rpm kernel-source-2.4.21-201.i586.rpm I have run # make cloneconfig && make dep in /usr/src/linux. I get the following error when doing make install in the nv source directory: # make install Unable to determine kernel version. make: *** [select_makefile] Error 1 Can anyone help me with this please as I cannot use X11 now? Kind Regards - Keith Roberts

6 12

Configuring SuSEfirewall2 for FTP access
by remote 19 Apr '04

19 Apr '04

Hi ! I seem to have a problem regarding my firewall configuration. I want to allow my users FTP access to Internet FTP servers. However, for this to work it seems I have to allow communication over the higher ports (1024:65000) via a forwarding rule like : FW_FORWARD =" XXX.YYY.ZZZ.0/6,0./0,tcp,1024:65000" XXX.YYY.ZZZ.0/6 stands for my IP-range, these are official static IPs. I am not happy with this at all because it would leave my domain wide open, but how can I handle this differently ? I use SuSE 8.0 Pro. Thanks for the help, Jörg

2 3

Re: Limits in /etc/group and useradd infinity loop
by Vyacheslav S.Kulchitskee 19 Apr '04

19 Apr '04

Yesterday i'm found the same problem - useradd stop working. This is small workaround, which help me to solve problem: 1. delete string with "GROUPS=" from /etc/default/useradd (i'm found, that all new accounts belong to additional groups "uucp, dialout, audio, video", but i don't need this) After that all created users well be belong to default group "users" 2. create new "fake" group - /usr/sbin/groupadd fake 3. move existing users from additional groups "uucp, dialout, audio, video" to new group - /usr/sbin/usermod -G fake $username (i wrote small perl-script, which make this operation) 4. remove "fake" group - /usr/sbin/groupdel fake 5. play with /usr/sbin/useradd many-many times! :) PS. Sorry for my english... ------------ Vyacheslav S. Kulchitskee --- а?таматычна Ваш легкий поиск ТУТ! http://go.tut.by

2 1

Re: [suse-security] Kernel source not matching kernel update
by Keith Roberts 18 Apr '04

18 Apr '04

On Sun, 18 Apr 2004, Anders Johansson wrote: > To: suse-security(a)suse.com > From: Anders Johansson <andjoh(a)rydsbo.net> > Subject: Re: [suse-security] Kernel source not matching kernel update > > On Sunday 18 April 2004 21:19, Keith Roberts wrote: > > When I use the nvidia-installer it always compiles the > > nvidia kernel-driver interface for me, as no other options > > are found, even though I use the standard SuSE 8.1 k_deflt > > kernel. > > Right, according to the README, for suse versions 8.1 and below, they are > supposed to provide RPMs. And there is one for the 2.4.19 kernel at > ftp://download.nvidia.com/XFree86/Linux-x86/1.0-5336/ > > although there doesn't seem to be one for the new 2.4.21 kernel > > but the advise seems a bit confused, since they seem to say both to install > the rpm *and* run the installer, which seems a bit redundant. > > Anyways, note that the README suggests that the nvidia installer isn't > intended to work with 8.1, which is as you discovered yourself Perhaps that's where I went wrong. I got most of the install done with nvidia-installer. then had to finish it off by hand myself. Keith Roberts

1 0

Kernel source not matching kernel update
by Keith Roberts 18 Apr '04

18 Apr '04

Hi everyone. I have just downloaded the latest kernel update for SuSE 8.1. The two packages are: k_deflt-2.4.21-203.i586.rpm kernel-source-2.4.21-201.i586.rpm Surely the source should be patch 203 as well? Will this cause problems with compiling the nvidia driver, ie unresolved kernel symbols? Kind Regards - Keith Roberts

2 1

RE: [suse-security] Kernel source not matching kernel update
by GarUlbricht7＠netscape.net 17 Apr '04

17 Apr '04

Keith Roberts <lists(a)kar.eclipse.co.uk> wrote: > >Hi everyone. > > I have just downloaded the latest kernel update for SuSE 8.1. > > The two packages are: > > k_deflt-2.4.21-203.i586.rpm > > kernel-source-2.4.21-201.i586.rpm > > Surely the source should be patch 203 as well? > > Will this cause problems with compiling the nvidia driver, > ie unresolved kernel symbols? > > Kind Regards - Keith Roberts > Hi Keith, If You re-read Date the Wed, 14 Apr 2004 17:44:16 +0200 (CEST) From: Thomas Biege for Package: Linux Kernel Announcement-ID: SuSE-SA:2004:009 http://www.suse.com/de/security/2004_09_kernel.html You will notice that for SuSE 8.1 that k_deflt is labled: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/k_deflt-2.4.21-203.i58… 0669fd902f68e9b788d2db1cc8eac71a Whereas: the kernel-source is labled: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/kernel-source-2.4.21-2… ef72aafd7907a68c33efe1749d5a9569 This appears to match what you have downloaded. SuSE has done similar numbering changes. IIWY, I wouldn't worry about it. Friendly greetings, Gar -- In the Beginning was the Command Line ---Neal Stephenson -- __________________________________________________________________ Introducing the New Netscape Internet Service. Only $9.95 a month -- Sign up today at http://isp.netscape.com/register Netscape. Just the Net You Need. New! Netscape Toolbar for Internet Explorer Search from anywhere on the Web and block those annoying pop-ups. Download now at http://channels.netscape.com/ns/search/install.jsp

1 0

Re: [suse-security] Limits in /etc/group and useradd infinity loop
by Sebastian Krahmer 16 Apr '04

16 Apr '04

Hi, > Maxim Cherniavsky wrote: > > > > I've found strange problems with useradd program. Suddenly useradd stops > > to work and begins to eat memory till system crash. > > Sad but true that there's absolutely no response from SuSE. :-( Sorry for the delay, as you have probably seen, there have been a lot of updates yesterday; and especially kernel updates require two eyes per involved persons on it :-) We are investigating the useradd issue already. thanks a lot for the report, Sebastian -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer(a)suse.de - SuSE Security Team ~

2 1

xinetd anonymous ftp
by John Charlton 16 Apr '04

16 Apr '04

I looked back through a few months of messages on this list and so far have not seen anything to address this anonymous ftp error: I am having the following error accessing SuSE 9.0 server from the internet after loging in as anonymous with jdc(a)CharltonCorp.com as password. ftp> ls 200 EPRT command successful. 435 Can't build data connection: Illegal seek. ftp> When I login from the local network as anonymous it works fine. The only problem I had with configuration is that in the xinetd configuration for ftpd, the user and group come up as --default--. I cannot change these and if I select 'accept' it gives me an error and I have to exit using the cancel button. The /etc/xinetd.d/ftpd file is: # default: off # description: The ftpd server serves FTP connections. It uses normal, \ # unencrypted usernames and passwords for authentication. This ftpd is \ # a port of the OpenBSD ftpd to Linux. service ftp { socket_type = stream protocol = tcp wait = no user = root server = /usr/sbin/in.ftpd server_args = -l -l -d disable = no } I added the -l -l -d to get more logging, but it doesn't have any affect on /var/log/xinetd.log ro /var/log/ftpd The /etc/hosts.allow is: in.ftpd : ALL : ALLOW in.ftpd : UNKNOWN : ALLOW As a part of testing I added the follow /etc/ftpaccess file: class local real,guest,anonymous 198.162.100.* class remote anonymous * autogroup ftp remote log transfers inbound,outbound

2 2

RE: [SPAM] - RE: [suse-security] System Update and Online Update - Email found in subject
by Gao, Ruidong 16 Apr '04

16 Apr '04

Thanks. I feel fou4s is better than YOU. My kernel is k_deflt-2.4.19-120 and YOU can not detect the new kernel patch for me by running system update. I have tried with SUSE site. The question is that the site is password protected. Is there workaround of it or how can I get the login info. Ben On Apr 16, Gao, Ruidong <Ruidong.Gao(a)landesk.com> wrote: > Where is patch description file in disk. Is that bundled with fou4s or > SUSE. Where can I find a template of it? The patch descriptions are on the FTP Server. You can use any of them as template, e.g. http://ftp.gwdg.de/pub/linux/suse/ftp.suse.com/suse/i386/update/8.2/patc hes/XFree86-51260 > I came to run fou4s and ended up with following error message: > ---------------------------- > linux:/home/ben # fou4s -u > You are using ftp.gwdg.de and a business product, this will probably not work. > [...] > What's wrong with it. You need to use sdb.suse.de as update server and supply SuSEUser and SuSEPassword in fou4s.conf, because updates for business products are on password protected servers. I'll make the error message more clear in the next version. Markus

2 1

Mozilla S/Mime buffer overflow security hole
by Bob Pearson 16 Apr '04

16 Apr '04

Does anyone know if Mozilla 1.6 is also vulnerable? I don't see patches for Mozilla 1.6 or Mozilla 1.7 beta as yet. Best Regards. -- _/_/_/ Bob Pearson gottadoit(a)mailsnare.net _/_/_/ i) Nil disputandum de gustibus. _/_/_/ ii) Dum spiro, spero!

2 1

RE: [suse-security] System Update and Online Update
by Gao, Ruidong 16 Apr '04

16 Apr '04

Hi, excellent answer. Where is patch description file in disk. Is that bundled with fou4s or SUSE. Where can I find a template of it? I came to run fou4s and ended up with following error message: ---------------------------- linux:/home/ben # fou4s -u You are using ftp.gwdg.de and a business product, this will probably not work. Getting patch descriptions from http://ftp.gwdg.de/pub/linux/suse/ftp.suse.com/suse http://ftp.gwdg.de/pub/linux/suse/ftp.suse.com/suse/i386/update/SuSE-SLES/8…: 15:46:36 ERROR 404: Not Found. FINISHED --15:46:36-- Downloaded: 0 bytes in 0 files ---------------------------- What's wrong with it. Ben -----Original Message----- From: Armin Schoech [mailto:armin.schoech@web.de] Sent: 2004年4月16日 15:53 To: suse-security(a)suse.com Subject: RE: [suse-security] System Update and Online Update Hello, > To make it more clear for my last question, How can I find out if my > SUSE box has got specific vulnerability fixed so that I should not > bother to patch it. > --> you have to look at the changelog of the specific package. "rpm -q --changelog k_deflt | more" lists all changes and patches applied to the default kernel. The same can be used for any application e.g. "rpm -q --changelog openssh" > BTW, could this utility check patches for both application and > kernel? Could it install/uninstall application. > --> Fou4s will update all SuSE packages that you have installed on your system. It will not update packages which are not supported by SuSE (unless you write your own patch description files for these packages). Fou4s is used to update packages that are already installed, it is not meant for installing/uninstalling packages. Use "YaST" instead or the "rpm -U/-I" command from the commandline. Cheers, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

RE: [suse-security] System Update and Online Update
by Gao, Ruidong 16 Apr '04

16 Apr '04

Thanks. To make it more clear for my last question, How can I find out if my SUSE box has got specific vulnerability fixed so that I should not bother to patch it. I just installed fou4s and is reading man pages for usage help. BTW, could this utility check patches for both application and kernel? Could it install/uninstall application. ben -----Original Message----- From: Armin Schoech [mailto:armin.schoech@web.de] Sent: 2004年4月16日 15:14 To: suse-security(a)suse.com Subject: Re: [suse-security] System Update and Online Update Hi, > I come to be working on some stuff of patch on SUSE Linux. And I > wonder if you or someone else out there could recommend some site > or provide some patch artchitecture information on SUSE about how > vulnerabilities are detected and patched. > --> I don't really understand your question. There is no standard way of detecting a vulnerability. In general, someone out there finds a vulnerability either by looking through the source code (code-auditing) or by stumbling upon it when something doesn't work as expected or desired. Most often, the vulnerability is first released to the distributors (like SuSE) so they can fix it before it goes public and can be exploited. Regarding patches: SuSE prepares updated RPM-packages which are published on the SuSE FTP-servers. If you want to get notification about them, subscribe to "suse-security-announce". Minor updates are not announced but simply turn up on the FTP server. To keep your system up-to-date, monitor the FTP-server regularly or run YOU/fou4s regularly (at least once a week). HTH to answer your questions, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

RE: [SPAM] - Re: [suse-security] System Update and Online Update - Email found in subject
by Gao, Ruidong 16 Apr '04

16 Apr '04

Thanks, Armin. I come to be working on some stuff of patch on SUSE Linux. And I wonder if you or someone else out there could recommend some site or provide some patch artchitecture information on SUSE about how vulnerabilities are detected and patched. Ben -----Original Message----- From: Armin Schoech [mailto:armin.schoech@web.de] Sent: 2004年4月16日 14:48 To: suse-security(a)suse.com Subject: [SPAM] - Re: [suse-security] System Update and Online Update - Email found in subject Hi ! > Are there any CLI for patches and software packages maintenances besides > programs like yast? > --> Have a look at fou4s: http://fou4s.gaugusch.at/ Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

System Update and Online Update
by Gao, Ruidong 16 Apr '04

16 Apr '04

Are there any CLI for patches and software packages maintenances besides programs like yast? Benjamin Gao

3 2

Kernel source for SuSE 8.1 2.4.21-203
by William Cutshall 15 Apr '04

15 Apr '04

I just performed the YaST update to pick up the latest kernel patch. "uname -r" now reports "2.4.21-203-default". "rpm -qa | grep kernel" shows that I have "kernel-source-2.4.21-201" - which is what is on the SuSE FTP site. This mismatch between binary and source is preventing me from rebuilding my winmodem driver. Any suggestions on how I can resolve this? Thanks, Bill Cutshall wrcutshall(a)yahoo.com __________________________________ Do you Yahoo!? Yahoo! Tax Center - File online by April 15th http://taxes.yahoo.com/filing.html

1 0

Re: [suse-security] Limits in /etc/group and useradd infinity loop
by Roland Hilkenbach 15 Apr '04

15 Apr '04

Am Mittwoch, 14. April 2004 18:22 schrieb Michael Ströder: > Maxim Cherniavsky wrote: > > I've found strange problems with useradd program. Suddenly useradd stops > > to work and begins to eat memory till system crash. > > Sad but true that there's absolutely no response from SuSE. :-( > > Which kernel are you using? > > Please check with: rpm -qf /boot/vmlinuz > > Ciao, Michael. Hello, I encountered the same problem: I was creating some useraccounts and out of a sudden useradd starts looping. Since then this happens reproducably even after reboot. Also groupadd behaves the same way. Now I have to create the accounts with vipw! My kernel version: k_athlon-2.4.21-202 Number of users: 600+ I even deleted some unused accounts to check if I hit some magic boundary in number of accounts. The sometimes infamous nscd is not running. Is there any workaround/fix for this? Ciao Roland

2 2

ssh and X11 help
by calind＠earthlink.net 14 Apr '04

14 Apr '04

PRODUCT: SuSE Linux (I386) 9.0 I have a problem opening an Xterm window on my Suse linux machine (SL) after I ssh (with X11 forwarding) to a remote machine (RM). The display is set correctly, I see the xterm process running on the remote machine but the xterm does not pop up on my Suse linux machine (SL). In fact I lose keyboard input capabilities in the window where I typed 'xterm' and I only get it back one the connection times out. The IMPORTANT part is that I can accomplish the same thing from a Windows machine from the same network as my SL machine via putty (win ssh client) and Exceed. That indicates that the issue is with my local SUSE setup. The last line of the verbosed ouput is identical in both cases: "confirm x11" except on the Suse machine my xterm window doesn't pop up, on the windows machine it does. This leads me to believe that tI have a Suse ssh (maybe X) related problem. One other important issue: to reach to my remote machine I ssh twice: 1. Linux to remote account management machine (RAM). 2. RAM to RM ( where I finally want the xterm to run) In all cases the displays are set correctly. I also verified the xauth -list and my display is in the output and has a magic cookie. Please let me know if you have any ideeas about how to solve this problem. Any suggestions will be highly appreciated. Additional info below: ** my SUSE (SL) machine suse{cduma}41: ssh -V OpenSSH_3.7.1p2, SSH protocols 1.5/2.0, OpenSSL 0.9.7b 10 Apr 2003 ** the RAM machine (after the 1st ssh from SL to RAM) gatekeeper% ssh -V OpenSSH_3.4p1, SSH protocols 1.5/2.0, OpenSSL 0x0090607f gatekeeper% echo $DISPLAY gatekeeper:14.0 ** the RM machine (where I want to do the work and start the xterm) shaman{cduma}1: echo $DISPLAY shaman:10.0 ** the RC machine ouput after I start the Xterm shaman{cduma}2: debug2: client_check_window_change: changed debug2: channel 0: request window-change debug2: client_check_window_change: changed debug1: channel request 0: window-change shaman{cduma}4: xterm debug1: client_input_channel_open: ctype x11 rchan 3 win 65536 max 16384 debug1: client_request_x11: request from 155.157.86.16 42287 debug2: fd 7 setting O_NONBLOCK debug2: fd 7 is O_NONBLOCK debug1: channel 1: new [x11] debug1: confirm x11 debug1: client_input_channel_open: ctype x11 rchan 1 win 30000 max 1024 debug1: client_request_x11: request from 155.157.121.230 45345 debug1: fd 7 setting TCP_NODELAY debug1: fd 7 setting O_NONBLOCK debug2: fd 7 is O_NONBLOCK debug1: channel 1: new [x11] debug1: confirm x11 ** above is where the xterm window pops uo on my Windows machine, it doesn't on my SUSE machine ** below is the logging after connection TIMEOUT debug1: channel 0: free: client-session, nchannels 2 debug3: channel 0: status: The following connections are open: #0 client-session (t4 r0 i0/0 o0/0 fd 4/5) #1 x11 (t4 r3 i0/0 o0/0 fd 7/7) debug3: channel 0: close_fds r 4 w 5 e 6 debug1: channel 1: free: x11, nchannels 1 debug3: channel 1: status: The following connections are open: #1 x11 (t4 r3 i0/0 o0/0 fd 7/7) debug3: channel 1: close_fds r 7 w 7 e -1 Read from remote host gatekeeper.east.hitc.com: Connection timed out Connection to gatekeeper.east.hitc.com closed. debug1: Transferred: stdin 0, stdout 0, stderr 118 bytes in 1327.8 seconds debug1: Bytes per second: stdin 0.0, stdout 0.0, stderr 0.1 debug1: Exit status -1

2 1

Limits in /etc/group and useradd infinity loop
by Maxim Cherniavsky 14 Apr '04

14 Apr '04

Hi all I've found strange problems with useradd program. Suddenly useradd stops to work and begins to eat memory till system crash. After some hours of experiments, I've found that I reached some strange limit in /etc/group file. I cannot add more than 85 users to one group. When adding 86'th user useradd stops to work, and due to strace, loops in open("/etc/passwd", O_RDONLY) = 4 fcntl64(4, F_GETFD) = 0 fcntl64(4, F_SETFD, FD_CLOEXEC) = 0 _llseek(4, 0, [0], SEEK_CUR) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=6105, ...}) = 0 mmap2(NULL, 6105, PROT_READ, MAP_SHARED, 4, 0) = 0x4036f000 _llseek(4, 6105, [6105], SEEK_SET) = 0 fstat64(4, {st_mode=S_IFREG|0644, st_size=6105, ...}) = 0 munmap(0x4036f000, 6105) = 0 close(4) and so on. First question - what the limit of number of users in one group? And where I can read about this? Second question - why useradd works so terribly? Why it eats memory? It calls mmap2 and then munmap on the same address in a loop .... Third question - why kernel dont kill proccess which eats all of avaliable memory? On other systems swap pager must kill it! I'm using ----- cat /etc/SuSE-release SuSE Linux 9.0 (i586) VERSION = 9.0 ----- uname -a Linux Guantanamo 2.4.21-192-Guantanamo #1 Tue Apr 6 15:32:17 MSD 2004 ----- Thanx -- Best regards, Maxim Cherniavsky MTU-Intel, Internet Department mailto:maxim@mtu.ru

2 2

SUSE Security Announcement: cvs (SuSE-SA:2004:008)
by krahmer＠suse.de 14 Apr '04

14 Apr '04

-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SUSE Security Announcement Package: cvs Announcement-ID: SuSE-SA:2004:008 Date: Wed Apr 14 16:00:00 MEST 2004 Affected products: 8.0, 8.1, 8.2, 9.0 SuSE Firewall on CD 2 SuSE Linux Enterprise Server 7, 8 SLES 8 for IBM iSeries and IBM pSeries SuSE Linux Office Server UnitedLinux 1.0 Vulnerability Type: remote code execution Severity (1-10): 5 SUSE default package: No Cross References: Content of this advisory: 1) security vulnerability resolved: arbitrary file creation in cvs problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - neon - tcpdump - openssh - kdeprint/kdelibs3 - MPlayer - mailman - systat - apache2 - emil 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The Concurrent Versions System (CVS) offers tools which allow developers to share and maintain large software projects. During the analyzation of the CVS protocol and their implementation, the SuSE Security Team discovered a flaw within the handling of pathnames. Evil CVS servers could specify absolute pathnames during checkouts and updates, which allows to create arbitrary files with the permissions of the user invoking the CVS client. This could lead to a compromise of the system. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Intel i386 Platform: SuSE-9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cvs-1.11.6-79.i586.rpm 392353d02948dee01fa98832841699be patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/cvs-1.11.6-79.i586.pat… fd287ccde902d5a93ce54c141f4f888d source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/cvs-1.11.6-79.src.rpm f094e09f54e176747f7441d44c20e12c SuSE-8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cvs-1.11.5-103.i586.rpm a690613adaf637365f8b99a91373f5cf patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/cvs-1.11.5-103.i586.pa… 844400ec62905d78b9e196c311f49207 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/cvs-1.11.5-103.src.rpm 202d2afd939caff003fbe73f65977ee6 SuSE-8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/cvs-1.11.1p1-326.i586.… 90401ed5771c3570310c23efcd503bee patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/cvs-1.11.1p1-326.i586.… 42335546a7937ccc0fc6173ba1697ed9 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/cvs-1.11.1p1-326.src.rpm ca6cb008ba8004635f9892552ed3e569 SuSE-8.0: ftp://ftp.suse.com/pub/suse/i386/update/8.0/d3/cvs-1.11.1p1-326.i386.rpm b24bca587706433d0cfa81ae96822e81 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/d3/cvs-1.11.1p1-326.i386.patch.… b5df706c6862ade002714607ba6027f6 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/cvs-1.11.1p1-326.src.rpm 26b4e34fb562fdccf33f35bfde16a403 Opteron x86_64 Platform: SuSE-9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cvs-1.11.6-78.x86_… dae12f94ea7eb35ed9b5172a8288d032 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/cvs-1.11.6-78.x86_… 07ca7acf86abd38e617a60e28dedfb0c source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/cvs-1.11.6-78.src.rpm 02d1e7f89a0f5372dc8a702032f4f4c2 ______________________________________________________________________________ 2) Pending vulnerabilities in SUSE Distributions and Workarounds: - neon The neon package contained various format string vulnerabilities which have been fixed. New packages are available on our FTP servers. Maintained products do not contain the neon package and are therefore not affected. (CAN-2004-0179) - tcpdump The tcpdump program contains a remotely exploitable denial of service condition in its ISAKMP packet handling. New tcpdump packages are currently being tested and will soon be available on our FTP servers. - openssh The scp program which is part of the openssh package allowed evil servers to trick clients into creating arbitrary files with permissions of the user invoking scp. New packages are available on our FTP servers. - kdeprint/kdelibs3 The kdeprint system called the ghostscript program without the -dSAFER option. This has been fixed. New packages are available on our FTP servers. The package is named "kdelibs3". Maintained products are not affected. - MPlayer The mplayer program contained a buffer overflow while escaping large URLs. This has been fixed. New MPlayer packages are currently being tested and will be available soon on our FTP servers. - mailman The mailing list manager mailman can be tricked to deny service by remote attackers. (CAN-2003-0991) New packages are available on our FTP servers. - sysstat This update close two cases of insecure temporary file handling in the isag code. New packages are available on our FTP servers. - apache2 This update fixes a memory leak in the mod_ssl module of apache2 (CAN-2004-0113), a possible remote DoS attack on accessing rarely used listening ports (CAN-2004-0174), and a problem with unescaped special characters in log files that could present a security hazard for terminal emulators (CAN-2003-0020). New packages are available on our FTP servers. - emil The emil mail filter conatins buffer overflows and format-string bugs that can be exploited remotely if emil is used in conjunction with procmail, sendmail and alike. (CAN-2004-0152, CAN-2004-0153) New packages are available on our FTP servers. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum <name-of-the-file.rpm> after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security(a)suse.de) the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, where <file.rpm> is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an un-installed rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build(a)suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security(a)suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe(a)suse.com>. suse-security-announce(a)suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe(a)suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info(a)suse.com> or <suse-security-faq(a)suse.com> respectively. ===================================================================== SUSE's security contact is <security(a)suse.com> or <security(a)suse.de>. The <security(a)suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security(a)suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build(a)suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/ HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8 QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1 wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8 RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+ AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0 zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7 whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE= =LRKC - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.7 (GNU/Linux) iQEVAwUBQH1dEHey5gA9JdPZAQFt1Af9G1LkLrTC/LAyaTE9qn6XS2gD5HXmN3Tc hWFlO9i9ZsVyn/9GJJsnFq1Grd9s3ka9SPrYKSadi4UxOKDGTp0y4on+rOQZKZo8 7aOs84BG+EMVLBgQ288i5VsngazvT2xcc1AhnAE7oph26QlAevv6j1jEqBITPWou Fmy49I2z/yif9ZDAyw6qzm5khvaSjw5uk922VohjNBec3nLLs+ev+sb8pwPvdN2A jlu7Vo2nclCmSMGM4N4+LWr/0HMUdkoajyuscdZ9+igz50XXjswS6U89LKVmrS59 5IMEJa7h14x+D9rU8dEJKm6qCPB2Dig3N9dfzV8d+0pLmEOQHgEOJA== =I/9T -----END PGP SIGNATURE-----

1 0

RE: [suse-security] List down?
by sematin＠mtn.co.ug 14 Apr '04

14 Apr '04

Must be the latter...:-D Noah. > -----Original Message----- > From: Andreas Bock [mailto:Andreas.Bock@nupis.de] > Sent: 14 April 2004 16:56 > To: suse-security(a)suse.com > Subject: [suse-security] List down? > > > Is the list down, or is everyone still in Easter vacation? > > Andreas > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

3 2

AW: [suse-security] List down?
by dag Danczul Georg 14 Apr '04

14 Apr '04

yep.... :-) georg >-----Ursprüngliche Nachricht----- >Von: sematin(a)mtn.co.ug [mailto:sematin@mtn.co.ug] >Gesendet: Mittwoch, 14. April 2004 15:58 >An: Andreas.Bock(a)nupis.de; suse-security(a)suse.com >Betreff: RE: [suse-security] List down? > > > >Must be the latter...:-D > >Noah. > >> -----Original Message----- >> From: Andreas Bock [mailto:Andreas.Bock@nupis.de] >> Sent: 14 April 2004 16:56 >> To: suse-security(a)suse.com >> Subject: [suse-security] List down? >> >> >> Is the list down, or is everyone still in Easter vacation? >> >> Andreas >> >> -- >> Check the headers for your unsubscription address >> For additional commands, e-mail: suse-security-help(a)suse.com >> Security-related bug reports go to security(a)suse.de, not here >> >> > >-- >Check the headers for your unsubscription address >For additional commands, e-mail: suse-security-help(a)suse.com >Security-related bug reports go to security(a)suse.de, not here > >

1 0

List down?
by Andreas Bock 14 Apr '04

14 Apr '04

Is the list down, or is everyone still in Easter vacation? Andreas

1 0

Newbie TCP Wrappers
by Paul Dean 12 Apr '04

12 Apr '04

Hi all, I'm still learning about Linux and trying to make my home network reasonably secure. I have a network with a Red Hat 8 server which I am trying to replace with SuSE 9. On the Red Hat server I had iptables, portsentry, tripwire and TCP wrappers running. Where can I find information on setting up tcp wrappers with SuSE ? I've set up my hosts.allow and hosts.deny. Is there anything else I need to do ? Any views on Portsentry? It doesn't seem to be on the Psionic site. Is it still supported ? Thanks a lot Paul

2 1

RE: [suse-security] Linux as a commercial alternative to a Cisco router
by sematin＠mtn.co.ug 12 Apr '04

12 Apr '04

Which can be found at http://open.com.au/radiator Noah. > -----Original Message----- > From: Mark Tinka [mailto:aknit444@yahoo.com] > Sent: 09 April 2004 16:34 > To: Lars Ellenberg; suse-security(a)suse.com > Subject: Re: [suse-security] Linux as a commercial > alternative to a Cisco router > > > --- Lars Ellenberg <l.g.e(a)web.de> wrote: > > / 2004-04-07 18:21:25 +0100 > > > I think I have seen this setup somewhere. Probably > > needs to use some > > pam module authenticating against radius. Don't > > know exactly how to > > configure this, though. > > u might want to look at Radiator RADIUS.. it supports > a ton of applications and is easily configurable for > authentication against your MySQL database.. no PAM modules > required.. > > > > > Lars Ellenberg > > Regards, > > Mark. > > __________________________________ > Do you Yahoo!? > Yahoo! Small Business $15K Web Design Giveaway > http://promotions.yahoo.com/design_giveaway/ > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

1 0

IP6
by Ivan Yosifov 09 Apr '04

09 Apr '04

Hello All, Does SuSEfirewall work with ip6, if not will it anytime soon? When entering IP6 addrs in vars like FW_TRUSTED_NETS in /etc/sysconfig/SuSEfirewall2 i get error messages on firewall startup saying iptables does not recognize them.Also when I ping the ip6 localhost with firewall running I get bivus@localhost:~> ping6 ::1 PING ::1(::1) 56 data bytes ping: sendmsg: Operation not permitted ping: sendmsg: Operation not permitted ping: sendmsg: Operation not permitted ... When the firewall is not running ping6 works ok.What can I do about this ? Ivan Yosifov.

3 3

Linux as a commercial alternative to a Cisco router
by Carl Peto 09 Apr '04

09 Apr '04

I am planning to set up ADSL access in to our group of servers at a secure location. The ISPs we have been in touch with will give us a 100Mbit ethernet VLAN to their network so that the L2TP connections from our clients' DSL routers can terminate in our equipment. We are aware that Cisco 3600 series routers can do this but they cost something like £10,000 !! We are interested in getting an alternative running. I suggested that we get a reasonably solid (e.g. Dell) 1U server with SuSE Linux server or SLES and two fast ethernet cards. The questions are these... 1) Can one of the SuSE Linux products (doesn't matter which, we can afford it) act as a fully fledged router? 2) Can it do VLANs over ethernet? 3) Can it act as a LNS for an L2TP circuit, such as those from DSL routers, authenticating against a RADIUS server? 4) Has anyone done anything like this before? It's been surprisingly hard to answer these questions, Googling, etc.! Thanks and Regards, Carl Peto

6 6

RE: [suse-security] Multiple Internal Networks not Routing
by sematin＠mtn.co.ug 07 Apr '04

07 Apr '04

> -----Original Message----- > From: Philipp Rusch [mailto:philipp.rusch@rusch-edv.de] > Sent: 07 April 2004 10:50 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Multiple Internal Networks not Routing > >> In your case, if you are still free to choose your network > adresses > >> and don't have more than 254 hosts, I would strongly > recommend that > >> you go for something like 192.168.1.x/24 on eth1 and > 192.168.2.y/24 > >> on eth2 or if you have more hosts, go for 172.16.1.x/16 on eth1 if > >> there is the majority of your hosts and take > 192.168.2.x/24 for eth2. You do not necessarily have to stick to the old "class" boundaries. You can choose to use only the 172.16.x.x/16 range and then sub divide it into smaller or bigger parts for each network using variable length subnet masks like the /20 /19 /22 etc which give you more hosts without restricting you to the old class boundaries which is exactly what CIDR was meant to solve. ( CIDR= Classless InterDomain Routing) Noah.

3 2

RE: [suse-security] Multiple Internal Networks not Routing
by sematin＠mtn.co.ug 07 Apr '04

07 Apr '04

> -----Original Message----- > From: Philipp Rusch [mailto:philipp.rusch@rusch-edv.de] > Sent: 07 April 2004 11:17 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Multiple Internal Networks not Routing > > > Yes, of course, these classes were never meant to be fix. > But I doubt that M$ clients always stick to the rules when it > comes to routing .... Have you ever tried to "convince" a w2k > DHCP server to hand out "non-standard" ip adresses/masks? Had > a server doing it correctly in the morning and after several > hours it did something else but not what was defined. Have > several experiences like this, never had a problem with > unusual ip/mask combinations with cisco routers for instance. > > Just my 2 cents, Philipp For the record, I do have a win2k DHCP server doing exactly that and it is perfoming quite ok. Maybe you need to apply some "service packs" and any other relevant patches. Of course a linux DHCP server would be preferable if you do not have "political reasons" for running M$ products. ( where political= management) Noah.

1 0

Re: [suse-security] Multiple Internal Networks not Routing
by Philipp Rusch 07 Apr '04

07 Apr '04

Jason, Ok, we are one step further ! To clarify: (this has been defined like that, there is no obvious technical reason for that, ok there are some reasons, but that would lead us too far) there are classes of IP-networks: A-class : mask /8 B-class : mask /16 C-class : mask /24 which some special adresses reserved for "private use", which means, these are "unrouteable" adresses in terms of internet routes, that's the reason for NAT, for instance. OK, 10.a.b.c "normally" has to have a /8 mask (type A class) you can divide this huge network of 16*16*16 hosts in smaller nets using a /16 or a /24 mask for instance. 172.16.m.n "normally" has to have a /16 mask (type B class) but the same concept of breaking it down into parts applies as above, you are free to do so. 192.168.x.y "normally" has to have a /24 mask (type C class) which implies that you choose the "x" and then this part of the network address is fix for your setup. The advantage of having a 10.a.b.c/8 network instead of a 192.168.x.y/24 is that you can have more hosts belonging to the *same" network without the need to route. In your case, if you are still free to choose your network adresses and don't have more than 254 hosts, I would strongly recommend that you go for something like 192.168.1.x/24 on eth1 and 192.168.2.y/24 on eth2 or if you have more hosts, go for 172.16.1.x/16 on eth1 if there is the majority of your hosts and take 192.168.2.x/24 for eth2. Next question: what are the routing entries of your Windows PCs? They have to know about the other net as well ! Post a route print example output of both networks back here. Regards, Philipp Jason Dobbs schrieb: > Ok here is the tracert data: > > From a windows PC (192.168.65.228) to a windows PC (10.62.56.8) > ----------------------------------------------------------------- > 1 <1 ms <1 ms <1 ms 192.168.66.252 > 2 * * * Request timed out. > 3 * * * Request timed out. > 4 * * * Request timed out. > 5 * * * Request timed out. > > > > /var/log/messages > ----------------------------------------------------------------- > Apr 6 04:22:47 terminator kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= > OUT=eth1 SRC=192.168.66.252 DST=192.168.65.228 LEN=120 TOS=0x00 > PREC=0xC0 TTL=64 ID=1245 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.65.228 > DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=1530 PROTO=ICMP > TYPE=8 CODE=0 ID=512 SEQ=24065 ] > Apr 6 04:22:47 terminator kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= > OUT=eth1 SRC=192.168.66.252 DST=192.168.65.228 LEN=120 TOS=0x00 > PREC=0xC0 TTL=64 ID=1246 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.65.228 > DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=1531 PROTO=ICMP > TYPE=8 CODE=0 ID=512 SEQ=24321 ] > Apr 6 04:22:47 terminator kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= > OUT=eth1 SRC=192.168.66.252 DST=192.168.65.228 LEN=120 TOS=0x00 > PREC=0xC0 TTL=64 ID=1247 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.65.228 > DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=1532 PROTO=ICMP > TYPE=8 CODE=0 ID=512 SEQ=24577 ] > Apr 6 04:22:48 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=1 ID=1534 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=24833 > Apr 6 04:22:52 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=1 ID=1577 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25089 > Apr 6 04:22:56 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=1 ID=1579 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25345 > Apr 6 04:23:01 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=2 ID=1581 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25601 > Apr 6 04:23:05 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=2 ID=1589 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25857 > Apr 6 04:23:10 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=2 ID=1591 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26113 > Apr 6 04:23:14 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=3 ID=1593 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26369 > Apr 6 04:23:19 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=3 ID=1597 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26625 > Apr 6 04:23:23 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=3 ID=1599 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26881 > Apr 6 04:23:28 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=4 ID=1601 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27137 > Apr 6 04:23:32 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=4 ID=1605 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27393 > Apr 6 04:23:37 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=4 ID=1607 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27649 > Apr 6 04:23:41 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=5 ID=1609 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27905 > > > 192.168.66.252 is the gateway for the 192.168.0.0/16 network. > 10.62.56.252 is the gateway for the 10.62.56.0/24 network. > > as far as your note on /16 and /24 ... maybe I have them backwards! I > though 192.168.0.0 was /16 and 10.62.56.0 was /24!!!!!! <-- Please > clearify this! > > Thank You, > Jason Dobbs . IT Manager > Westin Casuarina Casino Las Vegas > > > > Philipp Rusch wrote: > >> Hello Jason, >> OK, I see ... >> what about my note about /16 and /24 masks ? >> do you *have* to do it like that ? >> >> When you leave both FW_MASQ_NETS="" (empty) >> and FW_FORWARD="" (empty) >> and do a traceroute from a host on eth1 to a host on eth2 >> or vice versa, what do you see in the firewall logs in >> /var/logs/messages ? >> >> Lets get this to work, Philipp >> >> Jason Dobbs schrieb: >> >>> Kernel IP routing table >>> Destination Gateway Genmask Flags Metric Ref >>> Use Iface >>> <public ip> 0.0.0.0 255.255.255.128 U 0 >>> 0 0 eth0 >>> 10.62.56.0 0.0.0.0 255.255.255.0 U 0 >>> 0 0 eth2 >>> 192.168.0.0 0.0.0.0 255.255.0.0 U 0 >>> 0 0 eth1 >>> 0.0.0.0 <public gw> 0.0.0.0 UG 0 0 >>> 0 eth0 >>> >>> ip forwarding is turned on in yast! >>> >>> Thank You, >>> Jason Dobbs . IT Manager >>> Westin Casuarina Casino Las Vegas >>> p. 702.836.5939 f. 270.913.7462 >>> mailto: jdobbs(a)casuarinacasino.com >>> >>> >>> >>> Philipp Rusch wrote: >>> >>>> Hi Jason what is your routing table looking like ? >>>> post route -nv back here >>>> are you routing at all ? (set ip_forward=yes in YAST) >>>> >>>> other comments inline ... >>>> >>>> Jason Dobbs schrieb: >>>> >>>>> --SNIP --- >>>> >>>> >>>> >>>> >>>> >>>>> FW_MASQ_NETS="192.168.65.224/27 10.62.56.0/24 192.168.0.0/16,<mail >>>>> server ip>/32 10.62.56.0/24,<mail server ip>/32" >>>> >>>> >>>> >>>> >>>> >>>> ----------------------------------^ this >>>> ----------------------------------and this ^ is redundant, >>>> 192.168.65.224/27 is completely contained >>>> in 192.168.0.0./16 network, which means all 192.168."something" >>>> nets ... >>>> you know that normally 192.168.x.y net is a /24-type network and a >>>> 10.x.y.z has a /16 type mask ?? >>>> >>>> --SNIP-- >>>> >>>>> FW_FORWARD="192.168.0.0/16,10.62.56.0/24,tcp,1:65535 >>>>> 10.62.56.0/24,192.168.0.0/16,tcp,1:65535 \ >>>>> 192.168.0.0/16,10.62.56.0/24,udp,1:65535 >>>>> 10.62.56.0/24,192.168.0.0/16,udp,1:65535 \ >>>>> 192.168.0.0/16,10.62.56.0/24,icmp >>>>> 10.62.56.0/24,192.168.0.0/16,icmp" >>>>> FW_FORWARD_MASQ="0/0,192.168.65.227,tcp,5800 >>>>> 0/0,192.168.65.227,tcp,5900 \ >>>>> 0/0,192.168.65.227,tcp,5632 0/0,192.168.65.227,udp,5632" >>>> >>>> >>>> >>>> >>>> >>>> what are you trying to do here ? >>>> If routing just doesn't work then forwarding doesn't help that much >>>> ... >>>> >>>> I think something different is causing your troubles than missing >>>> entries here, >>>> seems you did to much of a work, it is normally quite simple, what >>>> you try to do :-) >>>> >>>> Regards from Germany, Philipp >>>> >>>> >>> >>> >> >> > >

3 4

Re: AW: AW: [suse-security] Multiple Internal Networks not Routing
by Jason Dobbs 07 Apr '04

07 Apr '04

Robert, Yeah the GW is correct for both networks and I can ping both GWs. I can even ping the far side of the box (i.e. - On 192.168.65.228 I can ping it's Gw of 192.168.66.252 and the 10.62.56.x GW of 10.62.56.252. I however can't ping any other 10.62.56.x address. The same goes for any traffic from the 10.62.56.x network to the 192.168.x.x network. 192.168.65.228 Route Print Dump ------------------------------------------------------ Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.66.252 192.168.65.228 20 10.62.56.0 255.255.255.0 192.168.66.252 192.168.65.228 1 127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1 192.168.0.0 255.255.0.0 192.168.65.228 192.168.65.228 20 192.168.65.228 255.255.255.255 127.0.0.1 127.0.0.1 20 192.168.65.255 255.255.255.255 192.168.65.228 192.168.65.228 20 224.0.0.0 240.0.0.0 192.168.65.228 192.168.65.228 20 255.255.255.255 255.255.255.255 192.168.65.228 192.168.65.228 1 Default Gateway: 192.168.66.252 =========================================================================== Persistent Routes: None ***NOTE*** ---- I added the 10.62.56.0 route hoping to produce results. This however did not work either and has been removed. Thank You, Jason Dobbs . IT Manager Westin Casuarina Casino Las Vegas Rasp, Robert wrote: >Jason, > >Routing on the Router is looking good, i think... >Is the Default-Gateway set correct on the workstations ? >Can you Ping this IP ??? > >Can i have the routingtable from your router and the IP's of the Networkcards. >Can i have a Routing-Table from one client on each Network (Windows --> route print) > >CU >Robert > > >-----Ursprüngliche Nachricht----- >Von: Jason Dobbs [mailto:jdobbs@casuarinacasino.com] >Gesendet: Dienstag, 6. April 2004 22:37 >An: suse-security(a)suse.com >Betreff: Re: AW: [suse-security] Multiple Internal Networks not Routing > > >Robert, > >ETH1 Dump >------------------------------------------ >tcpdump: listening on eth1 >05:33:19.653787 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:24.707194 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:30.207866 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:35.708547 192.168.65.228 > 10.62.56.8: icmp: echo request > >4 packets received by filter >0 packets dropped by kernel > > >ETH2 Dump >------------------------------------------- >tcpdump -pni eth2 icmp >tcpdump: listening on eth2 >05:33:19.654447 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:24.707232 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:30.207911 192.168.65.228 > 10.62.56.8: icmp: echo request >05:33:35.708586 192.168.65.228 > 10.62.56.8: icmp: echo request > >4 packets received by filter >0 packets dropped by kernel > > >192.168.65.228 trying to ping 10.62.56.8 >--------------------------------------------------- >Pinging 10.62.56.8 with 32 bytes of data: > >Request timed out. >Request timed out. >Request timed out. >Request timed out. > >Ping statistics for 10.62.56.8: > Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), > > > > >IP-Forwarding >---------------------------------------- >cat /proc/sys/net/ipv4/ip_forward <enter> >1 > > > >Thank You, >Jason Dobbs . IT Manager >Westin Casuarina Casino Las Vegas > > > >Rasp, Robert wrote: > > > >>Hello, >> >>i had this problem by my self... i hate routing sometimes ;-) >>Is IP-Forwaring enabled (cat /proc/sys/net/ipv4/ip_forward) >>Try this: >>Open two Shell's and start "tcpdump -pni eth1 icmp" on one Shell and >>"tcpdump -pni eth2 icmp" on the other. >>Try the Ping again and watch the results... >> >>CU >>Robert >> >> >>-----Ursprüngliche Nachricht----- >>Von: Jason Dobbs [mailto:jdobbs@casuarinacasino.com] >>Gesendet: Dienstag, 6. April 2004 21:49 >>An: Rasp, Robert >>Betreff: Re: *****list-suse***** AW: [suse-security] Multiple Internal >>Networks not Routing >> >> >>Robert, >> >>I took the firewall script down and tried a ping from 192.168.65.228 to >>10.62.56.8 and got the same results, request timed out. >> >>Thank You, >>Jason Dobbs . IT Manager >>Westin Casuarina Casino Las Vegas >> >> >> >>Rasp, Robert wrote: >> >> >> >> >> >>>Hello, >>> >>>if i had this problem, i try it without firewall first.... >>>Then you can be sure your routing is ok. >>>It may be better to stay offline while the firewallscript isn't runnung :-) >>> >>>CU >>>Robert >>> >>>-----Ursprüngliche Nachricht----- >>>Von: Jason Dobbs [mailto:jdobbs@casuarinacasino.com] >>>Gesendet: Dienstag, 6. April 2004 17:18 >>>An: suse-security(a)suse.com >>>Betreff: [suse-security] Multiple Internal Networks not Routing >>> >>> >>>Hi, >>> >>>Hoping someone can point out my mistake here! I have SuSE 9.0 running >>>with 3 NICS (eth0=internet, eth1=192.168.0.0/16, and >>>eth2=10.62.56.0/24). Everything with the internet is working great. The >>>problem is routing traffic between eth1 and eth2. I've set both networks >>>as trusted, set FW_FORWARD, and enabled FW_ALLOW_CLASS_ROUTING. Nothing >>>has seemed to work. Posted is also a copy of my >>>/etc/sysconfig/SuSEfirewall2. I'd like to allow all traffic between >>>these 2 networks. >>> >>>Any ideas? >>> >>>------------------------------------------------------------------- >>>FW_QUICKMODE="no" >>>FW_DEV_EXT="eth0" >>>FW_DEV_INT="eth1 eth2" >>>FW_DEV_DMZ="" >>>FW_ROUTE="yes" >>>FW_MASQUERADE="yes" >>>FW_MASQ_DEV="$FW_DEV_EXT" >>>FW_MASQ_NETS="192.168.65.224/27 10.62.56.0/24 192.168.0.0/16,<mail >>>server ip>/32 10.62.56.0/24,<mail server ip>/32" >>>FW_PROTECT_FROM_INTERNAL="no" >>>FW_AUTOPROTECT_SERVICES="yes" >>>FW_SERVICES_EXT_TCP="http https ssh" >>>FW_SERVICES_EXT_IP="" >>>FW_SERVICES_DMZ_TCP="" >>>FW_SERVICES_DMZ_IP="" >>>FW_SERVICES_INT_TCP="" >>>FW_SERVICES_INT_UDP="" >>>FW_SERVICES_INT_IP="" >>>FW_SERVICES_QUICK_TCP="" >>>FW_SERVICES_QUICK_UDP="" >>>FW_SERVICES_QUICK_IP="" >>>FW_TRUSTED_NETS="192.168.0.0/16 10.62.56.0/24" >>>FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" >>>FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" >>>FW_SERVICE_AUTODETECT="yes" >>>FW_SERVICE_DNS="yes" >>>FW_SERVICE_DHCLIENT="no" >>>FW_SERVICE_DHCPD="yes" >>>FW_SERVICE_SQUID="yes" >>>FW_SERVICE_SAMBA="no" >>>FW_FORWARD="192.168.0.0/16,10.62.56.0/24,tcp,1:65535 >>>10.62.56.0/24,192.168.0.0/16,tcp,1:65535 \ >>> 192.168.0.0/16,10.62.56.0/24,udp,1:65535 >>>10.62.56.0/24,192.168.0.0/16,udp,1:65535 \ >>> 192.168.0.0/16,10.62.56.0/24,icmp 10.62.56.0/24,192.168.0.0/16,icmp" >>>FW_FORWARD_MASQ="0/0,192.168.65.227,tcp,5800 0/0,192.168.65.227,tcp,5900 \ >>> 0/0,192.168.65.227,tcp,5632 0/0,192.168.65.227,udp,5632" >>>FW_REDIRECT="" >>>FW_LOG_DROP_CRIT="yes" >>>FW_LOG_DROP_ALL="yes" # Jason Dobbs >>>FW_LOG_ACCEPT_CRIT="yes" >>>FW_LOG_ACCEPT_ALL="yes" # Jason Dobbs >>>FW_LOG="--log-level warning --log-tcp-options --log-ip-option >>>--log-prefix SuSE-FW" >>>FW_KERNEL_SECURITY="yes" >>>FW_STOP_KEEP_ROUTING_STATE="no" >>>FW_ALLOW_PING_FW="yes" >>>FW_ALLOW_PING_DMZ="no" >>>FW_ALLOW_PING_EXT="no" >>>FW_ALLOW_FW_TRACEROUTE="yes" >>>FW_ALLOW_FW_SOURCEQUENCH="yes" >>>FW_ALLOW_FW_BROADCAST="no" >>>FW_IGNORE_FW_BROADCAST="yes" >>>FW_ALLOW_CLASS_ROUTING="yes" >>>FW_CUSTOMRULES="" >>>FW_REJECT="no" >>>FW_HTB_TUNE_DEV="" >>>----------------------------------------------------------------------------------- >>> >>> >>> >>> >>> >>> >>> >> >> >> >> >> > > > >

3 4

RPM Updates
by Gustavo Castro Puig 06 Apr '04

06 Apr '04

Hi, I'm trying to reinstall a package manually with rpm in SuSE 9.0 and some config files doesn't get updated. I tried with --force, --replacefiles and so on, and that files doesn't get updated anyway. I don't know if it's a security issue or something I have to worry about... Do you know how to *really* reinstall a complete package (including configuration files)? Thanks in advance. Regards, Gustavo.

3 2

AW: [suse-security] Multiple Internal Networks not Routing
by Rasp, Robert 06 Apr '04

06 Apr '04

Hello Philipp, i'm sorry but i think your wrong. You'r right about the network-calsses but yout can of course route a network with a /12 Network to a /19 Notwork.. and so an I Route 5 /19 Networks with 3 /16 Networks in every direction over one Router. As long as they ar not in one Subnet.... For routing-roules ist is possibile to route 192.168.0.0/16 to 10.62.56.0/24 All hosts hav to use a defaultroute to "the Networkcard" of ther Router. If the Router has 192.168.0.1 on eth1 and 10.62.56.1 on eth2 then the default route an the 10.* Net ist 10.62.56.1 and on 192.168.* it ist 192.168.0.1... If you have ip-forwarding enabled, it will work. But have al look at the other Routingrouls on the Router and on the Workstations. CU Robert -----Ursprüngliche Nachricht----- Von: Philipp Rusch [mailto:philipp.rusch@rusch-edv.de] Gesendet: Dienstag, 6. April 2004 22:28 An: suse-security(a)suse.com Betreff: Re: [suse-security] Multiple Internal Networks not Routing Jason, Ok, we are one step further ! To clarify: (this has been defined like that, there is no obvious technical reason for that, ok there are some reasons, but that would lead us too far) there are classes of IP-networks: A-class : mask /8 B-class : mask /16 C-class : mask /24 which some special adresses reserved for "private use", which means, these are "unrouteable" adresses in terms of internet routes, that's the reason for NAT, for instance. OK, 10.a.b.c "normally" has to have a /8 mask (type A class) you can divide this huge network of 16*16*16 hosts in smaller nets using a /16 or a /24 mask for instance. 172.16.m.n "normally" has to have a /16 mask (type B class) but the same concept of breaking it down into parts applies as above, you are free to do so. 192.168.x.y "normally" has to have a /24 mask (type C class) which implies that you choose the "x" and then this part of the network address is fix for your setup. The advantage of having a 10.a.b.c/8 network instead of a 192.168.x.y/24 is that you can have more hosts belonging to the *same" network without the need to route. In your case, if you are still free to choose your network adresses and don't have more than 254 hosts, I would strongly recommend that you go for something like 192.168.1.x/24 on eth1 and 192.168.2.y/24 on eth2 or if you have more hosts, go for 172.16.1.x/16 on eth1 if there is the majority of your hosts and take 192.168.2.x/24 for eth2. Next question: what are the routing entries of your Windows PCs? They have to know about the other net as well ! Post a route print example output of both networks back here. Regards, Philipp Jason Dobbs schrieb: > Ok here is the tracert data: > > From a windows PC (192.168.65.228) to a windows PC (10.62.56.8) > ----------------------------------------------------------------- > 1 <1 ms <1 ms <1 ms 192.168.66.252 > 2 * * * Request timed out. > 3 * * * Request timed out. > 4 * * * Request timed out. > 5 * * * Request timed out. > > > > /var/log/messages > ----------------------------------------------------------------- > Apr 6 04:22:47 terminator kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= > OUT=eth1 SRC=192.168.66.252 DST=192.168.65.228 LEN=120 TOS=0x00 > PREC=0xC0 TTL=64 ID=1245 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.65.228 > DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=1530 PROTO=ICMP > TYPE=8 CODE=0 ID=512 SEQ=24065 ] > Apr 6 04:22:47 terminator kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= > OUT=eth1 SRC=192.168.66.252 DST=192.168.65.228 LEN=120 TOS=0x00 > PREC=0xC0 TTL=64 ID=1246 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.65.228 > DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=1531 PROTO=ICMP > TYPE=8 CODE=0 ID=512 SEQ=24321 ] > Apr 6 04:22:47 terminator kernel: SuSE-FW-TRACEROUTE-ATTEMPT IN= > OUT=eth1 SRC=192.168.66.252 DST=192.168.65.228 LEN=120 TOS=0x00 > PREC=0xC0 TTL=64 ID=1247 PROTO=ICMP TYPE=11 CODE=0 [SRC=192.168.65.228 > DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 TTL=1 ID=1532 PROTO=ICMP > TYPE=8 CODE=0 ID=512 SEQ=24577 ] > Apr 6 04:22:48 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=1 ID=1534 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=24833 > Apr 6 04:22:52 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=1 ID=1577 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25089 > Apr 6 04:22:56 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=1 ID=1579 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25345 > Apr 6 04:23:01 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=2 ID=1581 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25601 > Apr 6 04:23:05 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=2 ID=1589 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=25857 > Apr 6 04:23:10 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=2 ID=1591 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26113 > Apr 6 04:23:14 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=3 ID=1593 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26369 > Apr 6 04:23:19 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=3 ID=1597 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26625 > Apr 6 04:23:23 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=3 ID=1599 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=26881 > Apr 6 04:23:28 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=4 ID=1601 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27137 > Apr 6 04:23:32 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=4 ID=1605 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27393 > Apr 6 04:23:37 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=4 ID=1607 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27649 > Apr 6 04:23:41 terminator kernel: SuSE-FW-ACCEPT-CLASS IN=eth1 > OUT=eth2 SRC=192.168.65.228 DST=10.62.56.8 LEN=92 TOS=0x00 PREC=0x00 > TTL=5 ID=1609 PROTO=ICMP TYPE=8 CODE=0 ID=512 SEQ=27905 > > > 192.168.66.252 is the gateway for the 192.168.0.0/16 network. > 10.62.56.252 is the gateway for the 10.62.56.0/24 network. > > as far as your note on /16 and /24 ... maybe I have them backwards! I > though 192.168.0.0 was /16 and 10.62.56.0 was /24!!!!!! <-- Please > clearify this! > > Thank You, > Jason Dobbs . IT Manager > Westin Casuarina Casino Las Vegas > > > > Philipp Rusch wrote: > >> Hello Jason, >> OK, I see ... >> what about my note about /16 and /24 masks ? >> do you *have* to do it like that ? >> >> When you leave both FW_MASQ_NETS="" (empty) >> and FW_FORWARD="" (empty) >> and do a traceroute from a host on eth1 to a host on eth2 >> or vice versa, what do you see in the firewall logs in >> /var/logs/messages ? >> >> Lets get this to work, Philipp >> >> Jason Dobbs schrieb: >> >>> Kernel IP routing table >>> Destination Gateway Genmask Flags Metric Ref >>> Use Iface >>> <public ip> 0.0.0.0 255.255.255.128 U 0 >>> 0 0 eth0 >>> 10.62.56.0 0.0.0.0 255.255.255.0 U 0 >>> 0 0 eth2 >>> 192.168.0.0 0.0.0.0 255.255.0.0 U 0 >>> 0 0 eth1 >>> 0.0.0.0 <public gw> 0.0.0.0 UG 0 0 >>> 0 eth0 >>> >>> ip forwarding is turned on in yast! >>> >>> Thank You, >>> Jason Dobbs . IT Manager >>> Westin Casuarina Casino Las Vegas >>> p. 702.836.5939 f. 270.913.7462 >>> mailto: jdobbs(a)casuarinacasino.com >>> >>> >>> >>> Philipp Rusch wrote: >>> >>>> Hi Jason what is your routing table looking like ? >>>> post route -nv back here >>>> are you routing at all ? (set ip_forward=yes in YAST) >>>> >>>> other comments inline ... >>>> >>>> Jason Dobbs schrieb: >>>> >>>>> --SNIP --- >>>> >>>> >>>> >>>> >>>> >>>>> FW_MASQ_NETS="192.168.65.224/27 10.62.56.0/24 192.168.0.0/16,<mail >>>>> server ip>/32 10.62.56.0/24,<mail server ip>/32" >>>> >>>> >>>> >>>> >>>> >>>> ----------------------------------^ this >>>> ----------------------------------and this ^ is redundant, >>>> 192.168.65.224/27 is completely contained >>>> in 192.168.0.0./16 network, which means all 192.168."something" >>>> nets ... >>>> you know that normally 192.168.x.y net is a /24-type network and a >>>> 10.x.y.z has a /16 type mask ?? >>>> >>>> --SNIP-- >>>> >>>>> FW_FORWARD="192.168.0.0/16,10.62.56.0/24,tcp,1:65535 >>>>> 10.62.56.0/24,192.168.0.0/16,tcp,1:65535 \ >>>>> 192.168.0.0/16,10.62.56.0/24,udp,1:65535 >>>>> 10.62.56.0/24,192.168.0.0/16,udp,1:65535 \ >>>>> 192.168.0.0/16,10.62.56.0/24,icmp >>>>> 10.62.56.0/24,192.168.0.0/16,icmp" >>>>> FW_FORWARD_MASQ="0/0,192.168.65.227,tcp,5800 >>>>> 0/0,192.168.65.227,tcp,5900 \ >>>>> 0/0,192.168.65.227,tcp,5632 0/0,192.168.65.227,udp,5632" >>>> >>>> >>>> >>>> >>>> >>>> what are you trying to do here ? >>>> If routing just doesn't work then forwarding doesn't help that much >>>> ... >>>> >>>> I think something different is causing your troubles than missing >>>> entries here, >>>> seems you did to much of a work, it is normally quite simple, what >>>> you try to do :-) >>>> >>>> Regards from Germany, Philipp >>>> >>>> >>> >>> >> >> > > -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

3 2

Re: AW: [suse-security] Multiple Internal Networks not Routing
by Jason Dobbs 06 Apr '04

06 Apr '04

Robert, ETH1 Dump ------------------------------------------ tcpdump: listening on eth1 05:33:19.653787 192.168.65.228 > 10.62.56.8: icmp: echo request 05:33:24.707194 192.168.65.228 > 10.62.56.8: icmp: echo request 05:33:30.207866 192.168.65.228 > 10.62.56.8: icmp: echo request 05:33:35.708547 192.168.65.228 > 10.62.56.8: icmp: echo request 4 packets received by filter 0 packets dropped by kernel ETH2 Dump ------------------------------------------- tcpdump -pni eth2 icmp tcpdump: listening on eth2 05:33:19.654447 192.168.65.228 > 10.62.56.8: icmp: echo request 05:33:24.707232 192.168.65.228 > 10.62.56.8: icmp: echo request 05:33:30.207911 192.168.65.228 > 10.62.56.8: icmp: echo request 05:33:35.708586 192.168.65.228 > 10.62.56.8: icmp: echo request 4 packets received by filter 0 packets dropped by kernel 192.168.65.228 trying to ping 10.62.56.8 --------------------------------------------------- Pinging 10.62.56.8 with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 10.62.56.8: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), IP-Forwarding ---------------------------------------- cat /proc/sys/net/ipv4/ip_forward <enter> 1 Thank You, Jason Dobbs . IT Manager Westin Casuarina Casino Las Vegas Rasp, Robert wrote: >Hello, > >i had this problem by my self... i hate routing sometimes ;-) >Is IP-Forwaring enabled (cat /proc/sys/net/ipv4/ip_forward) >Try this: >Open two Shell's and start "tcpdump -pni eth1 icmp" on one Shell and >"tcpdump -pni eth2 icmp" on the other. >Try the Ping again and watch the results... > >CU >Robert > > >-----Ursprüngliche Nachricht----- >Von: Jason Dobbs [mailto:jdobbs@casuarinacasino.com] >Gesendet: Dienstag, 6. April 2004 21:49 >An: Rasp, Robert >Betreff: Re: *****list-suse***** AW: [suse-security] Multiple Internal >Networks not Routing > > >Robert, > >I took the firewall script down and tried a ping from 192.168.65.228 to >10.62.56.8 and got the same results, request timed out. > >Thank You, >Jason Dobbs . IT Manager >Westin Casuarina Casino Las Vegas > > > >Rasp, Robert wrote: > > > >>Hello, >> >>if i had this problem, i try it without firewall first.... >>Then you can be sure your routing is ok. >>It may be better to stay offline while the firewallscript isn't runnung :-) >> >>CU >>Robert >> >>-----Ursprüngliche Nachricht----- >>Von: Jason Dobbs [mailto:jdobbs@casuarinacasino.com] >>Gesendet: Dienstag, 6. April 2004 17:18 >>An: suse-security(a)suse.com >>Betreff: [suse-security] Multiple Internal Networks not Routing >> >> >>Hi, >> >>Hoping someone can point out my mistake here! I have SuSE 9.0 running >>with 3 NICS (eth0=internet, eth1=192.168.0.0/16, and >>eth2=10.62.56.0/24). Everything with the internet is working great. The >>problem is routing traffic between eth1 and eth2. I've set both networks >>as trusted, set FW_FORWARD, and enabled FW_ALLOW_CLASS_ROUTING. Nothing >>has seemed to work. Posted is also a copy of my >>/etc/sysconfig/SuSEfirewall2. I'd like to allow all traffic between >>these 2 networks. >> >>Any ideas? >> >>------------------------------------------------------------------- >>FW_QUICKMODE="no" >>FW_DEV_EXT="eth0" >>FW_DEV_INT="eth1 eth2" >>FW_DEV_DMZ="" >>FW_ROUTE="yes" >>FW_MASQUERADE="yes" >>FW_MASQ_DEV="$FW_DEV_EXT" >>FW_MASQ_NETS="192.168.65.224/27 10.62.56.0/24 192.168.0.0/16,<mail >>server ip>/32 10.62.56.0/24,<mail server ip>/32" >>FW_PROTECT_FROM_INTERNAL="no" >>FW_AUTOPROTECT_SERVICES="yes" >>FW_SERVICES_EXT_TCP="http https ssh" >>FW_SERVICES_EXT_IP="" >>FW_SERVICES_DMZ_TCP="" >>FW_SERVICES_DMZ_IP="" >>FW_SERVICES_INT_TCP="" >>FW_SERVICES_INT_UDP="" >>FW_SERVICES_INT_IP="" >>FW_SERVICES_QUICK_TCP="" >>FW_SERVICES_QUICK_UDP="" >>FW_SERVICES_QUICK_IP="" >>FW_TRUSTED_NETS="192.168.0.0/16 10.62.56.0/24" >>FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" >>FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" >>FW_SERVICE_AUTODETECT="yes" >>FW_SERVICE_DNS="yes" >>FW_SERVICE_DHCLIENT="no" >>FW_SERVICE_DHCPD="yes" >>FW_SERVICE_SQUID="yes" >>FW_SERVICE_SAMBA="no" >>FW_FORWARD="192.168.0.0/16,10.62.56.0/24,tcp,1:65535 >>10.62.56.0/24,192.168.0.0/16,tcp,1:65535 \ >> 192.168.0.0/16,10.62.56.0/24,udp,1:65535 >>10.62.56.0/24,192.168.0.0/16,udp,1:65535 \ >> 192.168.0.0/16,10.62.56.0/24,icmp 10.62.56.0/24,192.168.0.0/16,icmp" >>FW_FORWARD_MASQ="0/0,192.168.65.227,tcp,5800 0/0,192.168.65.227,tcp,5900 \ >> 0/0,192.168.65.227,tcp,5632 0/0,192.168.65.227,udp,5632" >>FW_REDIRECT="" >>FW_LOG_DROP_CRIT="yes" >>FW_LOG_DROP_ALL="yes" # Jason Dobbs >>FW_LOG_ACCEPT_CRIT="yes" >>FW_LOG_ACCEPT_ALL="yes" # Jason Dobbs >>FW_LOG="--log-level warning --log-tcp-options --log-ip-option >>--log-prefix SuSE-FW" >>FW_KERNEL_SECURITY="yes" >>FW_STOP_KEEP_ROUTING_STATE="no" >>FW_ALLOW_PING_FW="yes" >>FW_ALLOW_PING_DMZ="no" >>FW_ALLOW_PING_EXT="no" >>FW_ALLOW_FW_TRACEROUTE="yes" >>FW_ALLOW_FW_SOURCEQUENCH="yes" >>FW_ALLOW_FW_BROADCAST="no" >>FW_IGNORE_FW_BROADCAST="yes" >>FW_ALLOW_CLASS_ROUTING="yes" >>FW_CUSTOMRULES="" >>FW_REJECT="no" >>FW_HTB_TUNE_DEV="" >>----------------------------------------------------------------------------------- >> >> >> >> >> > > > > >

2 1

AW: [suse-security] Multiple Internal Networks not Routing
by Rasp, Robert 06 Apr '04

06 Apr '04

Hello, if i had this problem, i try it without firewall first.... Then you can be sure your routing is ok. It may be better to stay offline while the firewallscript isn't runnung :-) CU Robert -----Ursprüngliche Nachricht----- Von: Jason Dobbs [mailto:jdobbs@casuarinacasino.com] Gesendet: Dienstag, 6. April 2004 17:18 An: suse-security(a)suse.com Betreff: [suse-security] Multiple Internal Networks not Routing Hi, Hoping someone can point out my mistake here! I have SuSE 9.0 running with 3 NICS (eth0=internet, eth1=192.168.0.0/16, and eth2=10.62.56.0/24). Everything with the internet is working great. The problem is routing traffic between eth1 and eth2. I've set both networks as trusted, set FW_FORWARD, and enabled FW_ALLOW_CLASS_ROUTING. Nothing has seemed to work. Posted is also a copy of my /etc/sysconfig/SuSEfirewall2. I'd like to allow all traffic between these 2 networks. Any ideas? ------------------------------------------------------------------- FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1 eth2" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.65.224/27 10.62.56.0/24 192.168.0.0/16,<mail server ip>/32 10.62.56.0/24,<mail server ip>/32" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http https ssh" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="192.168.0.0/16 10.62.56.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" FW_FORWARD="192.168.0.0/16,10.62.56.0/24,tcp,1:65535 10.62.56.0/24,192.168.0.0/16,tcp,1:65535 \ 192.168.0.0/16,10.62.56.0/24,udp,1:65535 10.62.56.0/24,192.168.0.0/16,udp,1:65535 \ 192.168.0.0/16,10.62.56.0/24,icmp 10.62.56.0/24,192.168.0.0/16,icmp" FW_FORWARD_MASQ="0/0,192.168.65.227,tcp,5800 0/0,192.168.65.227,tcp,5900 \ 0/0,192.168.65.227,tcp,5632 0/0,192.168.65.227,udp,5632" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" # Jason Dobbs FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="yes" # Jason Dobbs FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" ----------------------------------------------------------------------------------- -- Thank You, Jason Dobbs . IT Manager Westin Casuarina Casino Las Vegas -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Re: [suse-security] Multiple Internal Networks not Routing
by Philipp Rusch 06 Apr '04

06 Apr '04

Hello Jason, OK, I see ... what about my note about /16 and /24 masks ? do you *have* to do it like that ? When you leave both FW_MASQ_NETS="" (empty) and FW_FORWARD="" (empty) and do a traceroute from a host on eth1 to a host on eth2 or vice versa, what do you see in the firewall logs in /var/logs/messages ? Lets get this to work, Philipp Jason Dobbs schrieb: > Kernel IP routing table > Destination Gateway Genmask Flags Metric Ref > Use Iface > <public ip> 0.0.0.0 255.255.255.128 U 0 0 > 0 eth0 > 10.62.56.0 0.0.0.0 255.255.255.0 U 0 0 > 0 eth2 > 192.168.0.0 0.0.0.0 255.255.0.0 U 0 0 > 0 eth1 > 0.0.0.0 <public gw> 0.0.0.0 UG 0 0 0 > eth0 > > ip forwarding is turned on in yast! > > Thank You, > Jason Dobbs . IT Manager > Westin Casuarina Casino Las Vegas > p. 702.836.5939 f. 270.913.7462 > mailto: jdobbs(a)casuarinacasino.com > > > > Philipp Rusch wrote: > >> Hi Jason what is your routing table looking like ? >> post route -nv back here >> are you routing at all ? (set ip_forward=yes in YAST) >> >> other comments inline ... >> >> Jason Dobbs schrieb: >> >>> --SNIP --- >> >> >> >>> FW_MASQ_NETS="192.168.65.224/27 10.62.56.0/24 192.168.0.0/16,<mail >>> server ip>/32 10.62.56.0/24,<mail server ip>/32" >> >> >> >> ----------------------------------^ this >> ----------------------------------and this ^ is redundant, >> 192.168.65.224/27 is completely contained >> in 192.168.0.0./16 network, which means all 192.168."something" nets ... >> you know that normally 192.168.x.y net is a /24-type network and a >> 10.x.y.z has a /16 type mask ?? >> >> --SNIP-- >> >>> FW_FORWARD="192.168.0.0/16,10.62.56.0/24,tcp,1:65535 >>> 10.62.56.0/24,192.168.0.0/16,tcp,1:65535 \ >>> 192.168.0.0/16,10.62.56.0/24,udp,1:65535 >>> 10.62.56.0/24,192.168.0.0/16,udp,1:65535 \ >>> 192.168.0.0/16,10.62.56.0/24,icmp >>> 10.62.56.0/24,192.168.0.0/16,icmp" >>> FW_FORWARD_MASQ="0/0,192.168.65.227,tcp,5800 >>> 0/0,192.168.65.227,tcp,5900 \ >>> 0/0,192.168.65.227,tcp,5632 0/0,192.168.65.227,udp,5632" >> >> >> >> what are you trying to do here ? >> If routing just doesn't work then forwarding doesn't help that much ... >> >> I think something different is causing your troubles than missing >> entries here, >> seems you did to much of a work, it is normally quite simple, what >> you try to do :-) >> >> Regards from Germany, Philipp >> >> > >

1 0

Multiple Internal Networks not Routing
by Jason Dobbs 06 Apr '04

06 Apr '04

Hi, Hoping someone can point out my mistake here! I have SuSE 9.0 running with 3 NICS (eth0=internet, eth1=192.168.0.0/16, and eth2=10.62.56.0/24). Everything with the internet is working great. The problem is routing traffic between eth1 and eth2. I've set both networks as trusted, set FW_FORWARD, and enabled FW_ALLOW_CLASS_ROUTING. Nothing has seemed to work. Posted is also a copy of my /etc/sysconfig/SuSEfirewall2. I'd like to allow all traffic between these 2 networks. Any ideas? ------------------------------------------------------------------- FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1 eth2" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.65.224/27 10.62.56.0/24 192.168.0.0/16,<mail server ip>/32 10.62.56.0/24,<mail server ip>/32" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http https ssh" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="192.168.0.0/16 10.62.56.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" FW_FORWARD="192.168.0.0/16,10.62.56.0/24,tcp,1:65535 10.62.56.0/24,192.168.0.0/16,tcp,1:65535 \ 192.168.0.0/16,10.62.56.0/24,udp,1:65535 10.62.56.0/24,192.168.0.0/16,udp,1:65535 \ 192.168.0.0/16,10.62.56.0/24,icmp 10.62.56.0/24,192.168.0.0/16,icmp" FW_FORWARD_MASQ="0/0,192.168.65.227,tcp,5800 0/0,192.168.65.227,tcp,5900 \ 0/0,192.168.65.227,tcp,5632 0/0,192.168.65.227,udp,5632" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" # Jason Dobbs FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="yes" # Jason Dobbs FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" ----------------------------------------------------------------------------------- -- Thank You, Jason Dobbs . IT Manager Westin Casuarina Casino Las Vegas

2 1

Postfix + sasl on 8.1?
by Sven 'Darkman' Michels 06 Apr '04

06 Apr '04

Hi there, while setting up smtp-auth, i noticed that postfix shipped with 8.1 is compiled against sasl1 but nearly all other things like cyrus against sasl2. Anyone knows a way to put them together without recompiling stuff? i don't want to start own repositores ;) I just want 'virtual' mail users for security reasons but this seems not to be possible with 8.1? or at least not in an easy way. Regards & thanks, Sven

4 3

SuSEfirewall2 configuration problem
by Robbert Eggermont 05 Apr '04

05 Apr '04

Hi, I have some problems with the configuration of the SuSEfirewall2 (3.1) on a SuSE 9.0 system. I have read the unofficial SuSEFAQ by Togan Muftuoglu, but unfortunately this could not help me to solve the problem. The system is part of a NIS domain with central NFS server. When the firewall is off, I have full network functionality (i.e. the system boots as a NIS client with nfs mounted home directories). However, when I enable SuSEfirewall2 for this system (using YaST), the firewall (/etc/rc.d/rc5.d/S01SuSEfirewall2_init) blocks ("destination unreachable") all {dns, smb, nfs, nis} traffic until (S14SuSEfirewall2_setup) *after* the {smbfs, nfs, ypbind} services are started... I'm wondering if the above functionality is by design, and if so, why? And, more important, how do I configure the firewall so everything works? (I haven't seen any mention of this problem, so I'm wondering if I'm just doing something wrong, or noone else is using SuSE 9.0, SuSEfirewall2 and {smb, nfs, nis}?) Thanx in advance, Robbert Eggermont

3 5

postfix, cyrus, saslauthd -> pam auth mechanism questions
by Markus Feilner 05 Apr '04

05 Apr '04

Hello List, First of all thanks to all the helpful people out there! I have postfix, cyrus and saslauthd running on a suse 9.0 box. postfix and cyrus use tls and sslauthd to authenticate users against pam. In my /etc/pam.d/smtp and imap files i have working definitions for active directory/samba3/winbind, so that both local linux users and windows users can access the mailserver. But: With this combination, only few possibilities are left for encryption: - imap is sort of ok (I hope), since this is manged over ssl, however I would prefer cramd or digest encryption additionally. But I was told: this does not work not with saslauthd and pam. Why? - If I activate tls in postfix, local delivery to cyrus fails with the message: MUST ISSUE A STARTTLS COMMAND. So my questions are: 1) How can I make my setup more secure? 2) How can I setup postfix with cyrus and tls and working local delivery? I can send relevant config files, if you wish. -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

2 3

Re: [suse-security] postfix/imap/cyrus-sasl and Pam backend - again
by chris 05 Apr '04

05 Apr '04

Hello, i finally got it working. My chrooted Postfix uses saslauthd to authenticate users against pam (at least AD). Here are the essentials of my config: /usr/lib/sasl2/smtpd.conf pwcheck_method: saslauthd saslauthd_path: /var/run/sasl2/mux mech_list: plain login Remember to leave smtpd_sasl_local_domain in your main.cf blank: smtpd_sasl_local_domain = Modify your rcsaslauthd to hard-link the socket from sasl2 to postfix, and rm the socket when stopping saslauthd . . . case "$1" in start) echo -n "Starting service saslauthd" /sbin/startproc $AUTHD_BIN -a $SASLAUTHD_AUTHMECH > /dev/null 2>&1 #debug # den socket fuer postfix hardlinken ln /var/run/sasl2/mux /var/spool/postfix/var/run/sasl2/ rc_status -v ;; stop) echo -n "Shutting down service saslauthd" /sbin/killproc -TERM $AUTHD_BIN > /dev/null 2>&1 # den socket fuer postfix loeschen rm -r /var/spool/postfix/var/run/sasl2/mux rc_status -v ;; . . . Of course you need a corresponding /etc/pam.d/smtp . I.E. #%PAM-1.0 # by lanchr70 2003-02-12 auth sufficient pam_krb5.so # auth required pam_unix2.so auth required pam_shells.so account required pam_unix2.so password required pam_unix2.so session required pam_unix2.so The extract from /var/log/messages: Apr 5 14:09:50 xms001 saslauthd[29900]: rel_accept_lock : released accept lock Apr 5 14:09:51 xms001 saslauthd[29900]: pam_krb5: authentication succeeds for `chris' Apr 5 14:09:51 xms001 saslauthd[29900]: pam_krb5: pam_sm_authenticate returning 0 (Success) Apr 5 14:09:51 xms001 saslauthd[29900]: do_auth : auth success: [user=chris] [service=smtp] [realm=] [mech=pam] Apr 5 14:09:51 xms001 saslauthd[29900]: do_request : response: OK Have fun! mfg Chris Christian Lange D-30455 Hannover

1 0

Re: [suse-security] Bridging Firewall with traffic-shaping
by Dusty Bin 05 Apr '04

05 Apr '04

Sorry for drifting slightly [ot] here. But several times I have thought of rebuilding from a stock kernel. Is there anything documented anywhere on what changes SuSE has made to the kernel. If I get a stock kernel, and recompile and install it(correctly) is there anything that will break due to not having the SuSE kernel(aprt from not getting SuSE support that is). Salut. . .Dusty

1 0

Re: List
by draht＠suse.de 05 Apr '04

05 Apr '04

Here is my icq list. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of my_numbers.scr] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

5 8

RE: [suse-security] Bridging Firewall with traffic-shaping
by sematin＠mtn.co.ug 05 Apr '04

05 Apr '04

> -----Original Message----- > From: Backhausen, Sven [mailto:sbackhausen@ntcg.de] > Sent: 05 April 2004 09:30 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Bridging Firewall with traffic-shaping <snip> > Patching/recompiling SuSEs kernels is a mess, I gave up after a few > hours and took debian stable. The box is rock solid and a fine > firewalling, shaping and accounting bridge. Thought I was just slow..nice to know some other people find patching/recompiling SuSE kernels as problematic as I have. Usually anything that requires this means I download a stock kernel from kernel.org and patch rather than attempt the SuSE kernels. Noah.

2 1

RE: [suse-security] Bridging Firewall with traffic-shaping
by sematin＠mtn.co.ug 05 Apr '04

05 Apr '04

Theoretically you should be able to setup a SUSE box as a bridge and then use CBQ or some other mechanism to regulate bandwidth. I've only done this with FreeBSD using dummynet for bandwdith control and it was a breeze to setup using the docs from their handbook. However I have used CBQ on linux to control bandwidth. Noah. > -----Original Message----- > From: Guido Tschakert [mailto:guido.tschakert@src-gmbh.de] > Sent: 01 April 2004 11:43 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Bridging Firewall with traffic-shaping > > > Dana Hudes wrote: > > bridging is not the solution. That doesn't accomplish anything for > > you. You want to use NAT. without bothering your isp etc. > just have a > > public ip on the dsl router Ethernet, another on the 'external' > > interface of your 2-Ethernet PC and on the interal one you use a > > private network (everyone seems enamored of 192.168.0.0/16 but you > > could use 10/8 if you like) > > > > On Thu, 1 Apr 2004, Guido Tschakert wrote: > > Hi Dana, > > oh no, I don't want NAT! > To be honest, I already have NAT for the internal network! > Try to show my network > > ------------ > |DSL-Router| > ------------ > | > | > ------------ -------------- ------------------ > |Switch/HUB|----|Firewall/NAT|-----|INTERNAL-NETWORK| > ------------ -------------- ------------------ > | | > | | -------------- > | ------|External Box| > | -------------- > | > | -------------- > -------------|External Box| > -------------- > > I know the external boxes look a bit strange, but we have our reasons > therefore (all off them have a build in firewall!). > The problem is that sometimes I have to guarantee upstream/downstream > rates for the external boxes. That is why I want to put another box > between the Router and the Switch. This box should do some traffic > control and by the way, why not have some more firewall rules > to protect > the network? > (And no, we don't want to put the external boxes in a DMZ :-) > > guido > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

3 2

ClamAV/Dazuko and user vs. root
by Andreas Wagner 03 Apr '04

03 Apr '04

Hi List, finally I got round to installing Dazuko (and my first self-compiled kernel in the process) on my SuSE 8.0 box. Now I am trying to make up my mind what to do with it. As Virus Scanners, I have Sophos, Antivir f. Workstation, ClamAV and F-Prot (triggered mostly by amavisd-new). At least ClamAV and Antivir should be able to make use of Dazuko. However, it seems that Dazuko only allows root to interact with it and this would mean I would no longer be able to run clamd as a less-privileged user. Did I understand this right? If so, what are the respective drawbacks and advantages of running clamd as root or not using dazuko after all? Also, what do you think whether it would cause problems to have both Antivir and clamd trying to use Dazuko? Thanks a lot in advance, Andreas -- God is real... unless declared as an integer. -- My Public PGP Keys: 1024 Bit DH/DSS: 0x869F81BA 768 Bit RSA: 0x1AD97BA5

3 4

How to adress ClamAV daemon via Unix socket
by Andreas Wagner 03 Apr '04

03 Apr '04

Hi list, while I'm at it, I have another question about ClamAV's clamd: I have modified the SuSE init script that is provided with the clamav archive, because the commands to interact with the server via its Unix socket didn't work (quite probably the init script is for a later SuSE than my 8.0/2.4.18-4GB, but I'm not sure how this woul interfere). AFAIU, the script assumed that it was possible to send commands like +QUIT, +VERSION etc. to some "_clnt" that would in turn pass it - via Unix Socket - to clamd. Those commands are even mentioned on clamd's man page. And obviuosly the script was using clamdscan as that "_clnt" program. Only it didn't work at all - the commands are being interpreted as filenames-to-be-scanned by clamd and I get an error msg, file not found. Now I have to killproc it on shutdown, killproc/start it for a restart and can't reload, while the theory looks very elegant. Any hints on how i send those commands thru the Unix socket? Thanks again, Andreas -- File not found. Should I fake it? (Y/N) -- My Public PGP Keys: 1024 Bit DH/DSS: 0x869F81BA 768 Bit RSA: 0x1AD97BA5

1 0

Tripewire Policy file which works out of the box for SuSE 9?
by Tobias Weisserth 02 Apr '04

02 Apr '04

Hi everybody, Since I am a lazy person and always happy to thrive on the work of other people I was wondering whether SuSE had prepared a thoughtful Tripwire policy file which works out of the box with a SuSE 9 standard installation. I only found the example configuration for Red Hat 7 this simply doesn't fit SuSE 9 without major modifications. And frankly speaking: I think creating a Tripwire policy file from scratch is slave labour ;-) So is there a working template for SuSE 9 to start from or do I have to be my own vi monkey and make the changes myself? cheers, Tobias W. -- *************************************************** ____ _____ | _ \| ____| Tobias Weisserth | | | | _| tobias(a)weisserth.[de|com|net|org] _| |_| | |___ http://www.weisserth.org (_)____/|_____| Encrypted mail is welcome. Key and fingerprint: http://imprint.weisserth.org ***************************************************

2 5

Re: [suse-security] Odd FW Log
by Allen/Gore/SlackWareWolf 02 Apr '04

02 Apr '04

On Wednesday 31 March 2004 08:12, Tom Knight wrote: > I'm seeing odd thiungs in my FW log. > > > No, my machine isn't called xxx. > The same goes for the IP/MAC address. Yea, I know, Your real MAC is 00:0f:1f:02:28:80:00:09:11:7a:20:00:08:00 =D > Any ideas? Yes, have you done a ping on that IP to see if it's running or not? Done a whois on it to get the admin info so you can send him these logs? If you are really bothered by this, send the logs to the admin after doing a whois. > --------------- > Tom Knight > System Administration Officer > Arts & Humanities Data Service > Web: http://www.ahds.ac.uk > Email: tom.knight(a)ahds.ac.uk > Tel: (0)20 7928 7371 -- ____________________________________________ http://www.linux.org http://www.bsd.org http://www.suse.com http://www.slackware.org http://www.irssi.org http://www.antionline.com http://www.cannibalholocaust.net http://www.misfits.com http://www.onethirtyeight.net

3 7

Strange log entries, martian destination
by Sven Geipel 02 Apr '04

02 Apr '04

Hi, today I had some strange log entries in my messages log: External source addresses to external dest address on my internal interface. And these exactly 10 seconds! Sometimes in this 10 seconds a internal address xx.xx.xx.xx tried to connect to a external address from AT&T. These address is a HP Deskjet 1120 on a ExtendNet SX (ESI 2841) printserver box. And there were messages with "martian destination" in these 10 seconds too. Some of these addresses are reserved, some are official addresses. > Apr 1 15:00:27 linux kernel: Packet log: input DENY eth2 PROTO=6 91.168.63.123:51480 133.90.24.101:45686 L=40 S=0x00 I=53509 F=0x0000 T=64 SYN (#31) > Apr 1 15:00:27 linux kernel: Packet log: input DENY eth2 PROTO=6 244.236.235.124:24475 140.202.207.61:13436 L=40 S=0x00 I=48522 F=0x0000 T=64 SYN (#31) > Apr 1 15:00:27 linux kernel: Packet log: input DENY eth2 PROTO=6 104.161.59.77:33401 244.220.3.89:34119 L=40 S=0x00 I=28291 F=0x0000 T=64 SYN (#31) > Apr 1 15:00:27 linux kernel: Packet log: input DENY eth2 PROTO=6 137.200.120.2:48503 5.116.24.73:14488 L=40 S=0x00 I=30175 F=0x0000 T=64 SYN (#31) > Apr 1 15:00:27 linux kernel: Packet log: input DENY eth2 PROTO=6 189.114.54.9:42854 158.176.187.65:36878 L=40 S=0x00 I=36252 F=0x0000 T=64 SYN (#31) [...] > Apr 1 15:00:28 linux kernel: Packet log: input DENY eth2 PROTO=6 xx.xx.xx.xx:10195 32.223.34.115:15138 L=40 S=0x00 I=8296 F=0x0000 T=30 (#31) [...] > Apr 1 15:00:31 linux kernel: martian destination 26ae58f0 from e716450a, dev eth2 [...] > Apr 1 15:00:37 linux kernel: Packet log: input DENY eth2 PROTO=6 171.15.231.59:25185 139.24.120.54:52550 L=40 S=0x00 I=42486 F=0x0000 T=64 SYN (#31) > Apr 1 15:00:37 linux kernel: Packet log: input DENY eth2 PROTO=6 46.180.199.78:25009 170.227.122.106:64977 L=40 S=0x00 I=35370 F=0x0000 T=64 SYN (#31) Has anyone an idea what this could be? regards Sven ...sorry for my bad english

3 4

Bridging Firewall with traffic-shaping
by Guido Tschakert 01 Apr '04

01 Apr '04

Hello, I want to install a Bridge between our dsl-router and company network. Major task should be traffic shaping but an extra firewall wouldn't be that bad. I found that in the standard kernel bridge is compiled as module and I have no problem in loading the module, but I did not find any point to start configure the bridge! Has anybody out there build a bridge with SuSE 8.2 (or higher) and could tell me some links and hints to configure a bridge guido

5 6

Private document
by suse＠archive.cert.uni-stuttgart.de 01 Apr '04

01 Apr '04

I found this document about you. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of document342.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

Re: Approved
by thomas＠ruchs.de 01 Apr '04

01 Apr '04

Please have a look at the attached file. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of all_document.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0