April 2004 - openSUSE Security - openSUSE Mailing Lists

Multiple Internal Networks not Routing
by Jason Dobbs 06 Apr '04

06 Apr '04

Hi, Hoping someone can point out my mistake here! I have SuSE 9.0 running with 3 NICS (eth0=internet, eth1=192.168.0.0/16, and eth2=10.62.56.0/24). Everything with the internet is working great. The problem is routing traffic between eth1 and eth2. I've set both networks as trusted, set FW_FORWARD, and enabled FW_ALLOW_CLASS_ROUTING. Nothing has seemed to work. Posted is also a copy of my /etc/sysconfig/SuSEfirewall2. I'd like to allow all traffic between these 2 networks. Any ideas? ------------------------------------------------------------------- FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="eth1 eth2" FW_DEV_DMZ="" FW_ROUTE="yes" FW_MASQUERADE="yes" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="192.168.65.224/27 10.62.56.0/24 192.168.0.0/16,<mail server ip>/32 10.62.56.0/24,<mail server ip>/32" FW_PROTECT_FROM_INTERNAL="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="http https ssh" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_UDP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="192.168.0.0/16 10.62.56.0/24" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DNS="yes" FW_SERVICE_DHCLIENT="no" FW_SERVICE_DHCPD="yes" FW_SERVICE_SQUID="yes" FW_SERVICE_SAMBA="no" FW_FORWARD="192.168.0.0/16,10.62.56.0/24,tcp,1:65535 10.62.56.0/24,192.168.0.0/16,tcp,1:65535 \ 192.168.0.0/16,10.62.56.0/24,udp,1:65535 10.62.56.0/24,192.168.0.0/16,udp,1:65535 \ 192.168.0.0/16,10.62.56.0/24,icmp 10.62.56.0/24,192.168.0.0/16,icmp" FW_FORWARD_MASQ="0/0,192.168.65.227,tcp,5800 0/0,192.168.65.227,tcp,5900 \ 0/0,192.168.65.227,tcp,5632 0/0,192.168.65.227,udp,5632" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="yes" # Jason Dobbs FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="yes" # Jason Dobbs FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="yes" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="yes" FW_CUSTOMRULES="" FW_REJECT="no" FW_HTB_TUNE_DEV="" ----------------------------------------------------------------------------------- -- Thank You, Jason Dobbs . IT Manager Westin Casuarina Casino Las Vegas

2 1

Postfix + sasl on 8.1?
by Sven 'Darkman' Michels 06 Apr '04

06 Apr '04

Hi there, while setting up smtp-auth, i noticed that postfix shipped with 8.1 is compiled against sasl1 but nearly all other things like cyrus against sasl2. Anyone knows a way to put them together without recompiling stuff? i don't want to start own repositores ;) I just want 'virtual' mail users for security reasons but this seems not to be possible with 8.1? or at least not in an easy way. Regards & thanks, Sven

4 3

SuSEfirewall2 configuration problem
by Robbert Eggermont 05 Apr '04

05 Apr '04

Hi, I have some problems with the configuration of the SuSEfirewall2 (3.1) on a SuSE 9.0 system. I have read the unofficial SuSEFAQ by Togan Muftuoglu, but unfortunately this could not help me to solve the problem. The system is part of a NIS domain with central NFS server. When the firewall is off, I have full network functionality (i.e. the system boots as a NIS client with nfs mounted home directories). However, when I enable SuSEfirewall2 for this system (using YaST), the firewall (/etc/rc.d/rc5.d/S01SuSEfirewall2_init) blocks ("destination unreachable") all {dns, smb, nfs, nis} traffic until (S14SuSEfirewall2_setup) *after* the {smbfs, nfs, ypbind} services are started... I'm wondering if the above functionality is by design, and if so, why? And, more important, how do I configure the firewall so everything works? (I haven't seen any mention of this problem, so I'm wondering if I'm just doing something wrong, or noone else is using SuSE 9.0, SuSEfirewall2 and {smb, nfs, nis}?) Thanx in advance, Robbert Eggermont

3 5

postfix, cyrus, saslauthd -> pam auth mechanism questions
by Markus Feilner 05 Apr '04

05 Apr '04

Hello List, First of all thanks to all the helpful people out there! I have postfix, cyrus and saslauthd running on a suse 9.0 box. postfix and cyrus use tls and sslauthd to authenticate users against pam. In my /etc/pam.d/smtp and imap files i have working definitions for active directory/samba3/winbind, so that both local linux users and windows users can access the mailserver. But: With this combination, only few possibilities are left for encryption: - imap is sort of ok (I hope), since this is manged over ssl, however I would prefer cramd or digest encryption additionally. But I was told: this does not work not with saslauthd and pam. Why? - If I activate tls in postfix, local delivery to cyrus fails with the message: MUST ISSUE A STARTTLS COMMAND. So my questions are: 1) How can I make my setup more secure? 2) How can I setup postfix with cyrus and tls and working local delivery? I can send relevant config files, if you wish. -- Mit freundlichen Grüßen Markus Feilner -- Linux Solutions, Training, Seminare und Workshops - auch Inhouse Feilner IT Linux & GIS Erlangerstr. 2 93059 Regensburg fon: +49 941 70 65 23 - mobil: +49 170 302 709 2 web: http://feilner-it.net mail: mfeilner(a)feilner-it.net

2 3

Re: [suse-security] postfix/imap/cyrus-sasl and Pam backend - again
by chris 05 Apr '04

05 Apr '04

Hello, i finally got it working. My chrooted Postfix uses saslauthd to authenticate users against pam (at least AD). Here are the essentials of my config: /usr/lib/sasl2/smtpd.conf pwcheck_method: saslauthd saslauthd_path: /var/run/sasl2/mux mech_list: plain login Remember to leave smtpd_sasl_local_domain in your main.cf blank: smtpd_sasl_local_domain = Modify your rcsaslauthd to hard-link the socket from sasl2 to postfix, and rm the socket when stopping saslauthd . . . case "$1" in start) echo -n "Starting service saslauthd" /sbin/startproc $AUTHD_BIN -a $SASLAUTHD_AUTHMECH > /dev/null 2>&1 #debug # den socket fuer postfix hardlinken ln /var/run/sasl2/mux /var/spool/postfix/var/run/sasl2/ rc_status -v ;; stop) echo -n "Shutting down service saslauthd" /sbin/killproc -TERM $AUTHD_BIN > /dev/null 2>&1 # den socket fuer postfix loeschen rm -r /var/spool/postfix/var/run/sasl2/mux rc_status -v ;; . . . Of course you need a corresponding /etc/pam.d/smtp . I.E. #%PAM-1.0 # by lanchr70 2003-02-12 auth sufficient pam_krb5.so # auth required pam_unix2.so auth required pam_shells.so account required pam_unix2.so password required pam_unix2.so session required pam_unix2.so The extract from /var/log/messages: Apr 5 14:09:50 xms001 saslauthd[29900]: rel_accept_lock : released accept lock Apr 5 14:09:51 xms001 saslauthd[29900]: pam_krb5: authentication succeeds for `chris' Apr 5 14:09:51 xms001 saslauthd[29900]: pam_krb5: pam_sm_authenticate returning 0 (Success) Apr 5 14:09:51 xms001 saslauthd[29900]: do_auth : auth success: [user=chris] [service=smtp] [realm=] [mech=pam] Apr 5 14:09:51 xms001 saslauthd[29900]: do_request : response: OK Have fun! mfg Chris Christian Lange D-30455 Hannover

1 0

Re: [suse-security] Bridging Firewall with traffic-shaping
by Dusty Bin 05 Apr '04

05 Apr '04

Sorry for drifting slightly [ot] here. But several times I have thought of rebuilding from a stock kernel. Is there anything documented anywhere on what changes SuSE has made to the kernel. If I get a stock kernel, and recompile and install it(correctly) is there anything that will break due to not having the SuSE kernel(aprt from not getting SuSE support that is). Salut. . .Dusty

1 0

Re: List
by draht＠suse.de 05 Apr '04

05 Apr '04

Here is my icq list. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of my_numbers.scr] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

5 8

RE: [suse-security] Bridging Firewall with traffic-shaping
by sematin＠mtn.co.ug 05 Apr '04

05 Apr '04

> -----Original Message----- > From: Backhausen, Sven [mailto:sbackhausen@ntcg.de] > Sent: 05 April 2004 09:30 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Bridging Firewall with traffic-shaping <snip> > Patching/recompiling SuSEs kernels is a mess, I gave up after a few > hours and took debian stable. The box is rock solid and a fine > firewalling, shaping and accounting bridge. Thought I was just slow..nice to know some other people find patching/recompiling SuSE kernels as problematic as I have. Usually anything that requires this means I download a stock kernel from kernel.org and patch rather than attempt the SuSE kernels. Noah.

2 1

RE: [suse-security] Bridging Firewall with traffic-shaping
by sematin＠mtn.co.ug 05 Apr '04

05 Apr '04

Theoretically you should be able to setup a SUSE box as a bridge and then use CBQ or some other mechanism to regulate bandwidth. I've only done this with FreeBSD using dummynet for bandwdith control and it was a breeze to setup using the docs from their handbook. However I have used CBQ on linux to control bandwidth. Noah. > -----Original Message----- > From: Guido Tschakert [mailto:guido.tschakert@src-gmbh.de] > Sent: 01 April 2004 11:43 > To: suse-security(a)suse.com > Subject: Re: [suse-security] Bridging Firewall with traffic-shaping > > > Dana Hudes wrote: > > bridging is not the solution. That doesn't accomplish anything for > > you. You want to use NAT. without bothering your isp etc. > just have a > > public ip on the dsl router Ethernet, another on the 'external' > > interface of your 2-Ethernet PC and on the interal one you use a > > private network (everyone seems enamored of 192.168.0.0/16 but you > > could use 10/8 if you like) > > > > On Thu, 1 Apr 2004, Guido Tschakert wrote: > > Hi Dana, > > oh no, I don't want NAT! > To be honest, I already have NAT for the internal network! > Try to show my network > > ------------ > |DSL-Router| > ------------ > | > | > ------------ -------------- ------------------ > |Switch/HUB|----|Firewall/NAT|-----|INTERNAL-NETWORK| > ------------ -------------- ------------------ > | | > | | -------------- > | ------|External Box| > | -------------- > | > | -------------- > -------------|External Box| > -------------- > > I know the external boxes look a bit strange, but we have our reasons > therefore (all off them have a build in firewall!). > The problem is that sometimes I have to guarantee upstream/downstream > rates for the external boxes. That is why I want to put another box > between the Router and the Switch. This box should do some traffic > control and by the way, why not have some more firewall rules > to protect > the network? > (And no, we don't want to put the external boxes in a DMZ :-) > > guido > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

3 2

ClamAV/Dazuko and user vs. root
by Andreas Wagner 03 Apr '04

03 Apr '04

Hi List, finally I got round to installing Dazuko (and my first self-compiled kernel in the process) on my SuSE 8.0 box. Now I am trying to make up my mind what to do with it. As Virus Scanners, I have Sophos, Antivir f. Workstation, ClamAV and F-Prot (triggered mostly by amavisd-new). At least ClamAV and Antivir should be able to make use of Dazuko. However, it seems that Dazuko only allows root to interact with it and this would mean I would no longer be able to run clamd as a less-privileged user. Did I understand this right? If so, what are the respective drawbacks and advantages of running clamd as root or not using dazuko after all? Also, what do you think whether it would cause problems to have both Antivir and clamd trying to use Dazuko? Thanks a lot in advance, Andreas -- God is real... unless declared as an integer. -- My Public PGP Keys: 1024 Bit DH/DSS: 0x869F81BA 768 Bit RSA: 0x1AD97BA5

3 4

How to adress ClamAV daemon via Unix socket
by Andreas Wagner 03 Apr '04

03 Apr '04

Hi list, while I'm at it, I have another question about ClamAV's clamd: I have modified the SuSE init script that is provided with the clamav archive, because the commands to interact with the server via its Unix socket didn't work (quite probably the init script is for a later SuSE than my 8.0/2.4.18-4GB, but I'm not sure how this woul interfere). AFAIU, the script assumed that it was possible to send commands like +QUIT, +VERSION etc. to some "_clnt" that would in turn pass it - via Unix Socket - to clamd. Those commands are even mentioned on clamd's man page. And obviuosly the script was using clamdscan as that "_clnt" program. Only it didn't work at all - the commands are being interpreted as filenames-to-be-scanned by clamd and I get an error msg, file not found. Now I have to killproc it on shutdown, killproc/start it for a restart and can't reload, while the theory looks very elegant. Any hints on how i send those commands thru the Unix socket? Thanks again, Andreas -- File not found. Should I fake it? (Y/N) -- My Public PGP Keys: 1024 Bit DH/DSS: 0x869F81BA 768 Bit RSA: 0x1AD97BA5

1 0

Tripewire Policy file which works out of the box for SuSE 9?
by Tobias Weisserth 03 Apr '04

03 Apr '04

Hi everybody, Since I am a lazy person and always happy to thrive on the work of other people I was wondering whether SuSE had prepared a thoughtful Tripwire policy file which works out of the box with a SuSE 9 standard installation. I only found the example configuration for Red Hat 7 this simply doesn't fit SuSE 9 without major modifications. And frankly speaking: I think creating a Tripwire policy file from scratch is slave labour ;-) So is there a working template for SuSE 9 to start from or do I have to be my own vi monkey and make the changes myself? cheers, Tobias W. -- *************************************************** ____ _____ | _ \| ____| Tobias Weisserth | | | | _| tobias(a)weisserth.[de|com|net|org] _| |_| | |___ http://www.weisserth.org (_)____/|_____| Encrypted mail is welcome. Key and fingerprint: http://imprint.weisserth.org ***************************************************

2 5

Re: [suse-security] Odd FW Log
by Allen/Gore/SlackWareWolf 02 Apr '04

02 Apr '04

On Wednesday 31 March 2004 08:12, Tom Knight wrote: > I'm seeing odd thiungs in my FW log. > > > No, my machine isn't called xxx. > The same goes for the IP/MAC address. Yea, I know, Your real MAC is 00:0f:1f:02:28:80:00:09:11:7a:20:00:08:00 =D > Any ideas? Yes, have you done a ping on that IP to see if it's running or not? Done a whois on it to get the admin info so you can send him these logs? If you are really bothered by this, send the logs to the admin after doing a whois. > --------------- > Tom Knight > System Administration Officer > Arts & Humanities Data Service > Web: http://www.ahds.ac.uk > Email: tom.knight(a)ahds.ac.uk > Tel: (0)20 7928 7371 -- ____________________________________________ http://www.linux.org http://www.bsd.org http://www.suse.com http://www.slackware.org http://www.irssi.org http://www.antionline.com http://www.cannibalholocaust.net http://www.misfits.com http://www.onethirtyeight.net

3 7

Strange log entries, martian destination
by Sven Geipel 02 Apr '04

02 Apr '04

Hi, today I had some strange log entries in my messages log: External source addresses to external dest address on my internal interface. And these exactly 10 seconds! Sometimes in this 10 seconds a internal address xx.xx.xx.xx tried to connect to a external address from AT&T. These address is a HP Deskjet 1120 on a ExtendNet SX (ESI 2841) printserver box. And there were messages with "martian destination" in these 10 seconds too. Some of these addresses are reserved, some are official addresses. > Apr 1 15:00:27 linux kernel: Packet log: input DENY eth2 PROTO=6 91.168.63.123:51480 133.90.24.101:45686 L=40 S=0x00 I=53509 F=0x0000 T=64 SYN (#31) > Apr 1 15:00:27 linux kernel: Packet log: input DENY eth2 PROTO=6 244.236.235.124:24475 140.202.207.61:13436 L=40 S=0x00 I=48522 F=0x0000 T=64 SYN (#31) > Apr 1 15:00:27 linux kernel: Packet log: input DENY eth2 PROTO=6 104.161.59.77:33401 244.220.3.89:34119 L=40 S=0x00 I=28291 F=0x0000 T=64 SYN (#31) > Apr 1 15:00:27 linux kernel: Packet log: input DENY eth2 PROTO=6 137.200.120.2:48503 5.116.24.73:14488 L=40 S=0x00 I=30175 F=0x0000 T=64 SYN (#31) > Apr 1 15:00:27 linux kernel: Packet log: input DENY eth2 PROTO=6 189.114.54.9:42854 158.176.187.65:36878 L=40 S=0x00 I=36252 F=0x0000 T=64 SYN (#31) [...] > Apr 1 15:00:28 linux kernel: Packet log: input DENY eth2 PROTO=6 xx.xx.xx.xx:10195 32.223.34.115:15138 L=40 S=0x00 I=8296 F=0x0000 T=30 (#31) [...] > Apr 1 15:00:31 linux kernel: martian destination 26ae58f0 from e716450a, dev eth2 [...] > Apr 1 15:00:37 linux kernel: Packet log: input DENY eth2 PROTO=6 171.15.231.59:25185 139.24.120.54:52550 L=40 S=0x00 I=42486 F=0x0000 T=64 SYN (#31) > Apr 1 15:00:37 linux kernel: Packet log: input DENY eth2 PROTO=6 46.180.199.78:25009 170.227.122.106:64977 L=40 S=0x00 I=35370 F=0x0000 T=64 SYN (#31) Has anyone an idea what this could be? regards Sven ...sorry for my bad english

3 4

Bridging Firewall with traffic-shaping
by Guido Tschakert 01 Apr '04

01 Apr '04

Hello, I want to install a Bridge between our dsl-router and company network. Major task should be traffic shaping but an extra firewall wouldn't be that bad. I found that in the standard kernel bridge is compiled as module and I have no problem in loading the module, but I did not find any point to start configure the bridge! Has anybody out there build a bridge with SuSE 8.2 (or higher) and could tell me some links and hints to configure a bridge guido

5 6

Private document
by suse＠archive.cert.uni-stuttgart.de 01 Apr '04

01 Apr '04

I found this document about you. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of document342.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0

Re: Approved
by thomas＠ruchs.de 01 Apr '04

01 Apr '04

Please have a look at the attached file. [the SUSE virus scanner removed an attachment of type application/octet-stream which had a name of all_document.pif] [if you need the message in its original form including all attachments, please ask the SENDER for a version free of viruses]

1 0