April 2004 - openSUSE Security - openSUSE Mailing Lists

iptables nat rules for different dns-names [2]
by Philippe Vogel 29 Apr '04

29 Apr '04

Hi! Is it possible to filter with nat rules that I can access two servers on different IP's but with the same port and with apache + mod_backhand? This has nothing to do with the 1st post (both are different ideas). Or in a different setup: dns-names over dyndns Inet | dev-ext (pppoe over dsl) | FW | dev-int (LAN) | servera.local.net:80 (apache+mod_backhand) serverb.local.net:80 (apache+mod_backhand) Server a&b are identical, but sync data. Any ideas? Philippe

1 0

sshd keep alive
by Emiliano Sutil 29 Apr '04

29 Apr '04

Hello, I have Suse 9.0 and I use ssh to create tunnels to access several services of the server. My problem is that ssh close the connections if there is no activity in the tunnel. I have the property KeepAlive yes in the sshd_config but I doesnt work. I have ipchains as firewall, perhaps this is my problem but I don´t know, ¿any idea? Thaks -- Emiliano Sutil García

6 7

RE: [suse-security] sshd keep alive
by sematin＠mtn.co.ug 29 Apr '04

29 Apr '04

Unless you have a specific need for ssh tunnels, you could simply setup a VPN tunnel between your host and the server using ipsec and thus ALL your connections to the server go through that secure tunnel. You don't need keepalives for that. Noah. > -----Original Message----- > From: Emiliano Sutil [mailto:emiliano@iranon.com] > Sent: 29 April 2004 10:15 > To: suse-security(a)suse.com > Subject: [suse-security] sshd keep alive > > > Hello, > > I have Suse 9.0 and I use ssh to create tunnels to access several > services of the server. > My problem is that ssh close the connections if there is no > activity in > the tunnel. > I have the property KeepAlive yes in the sshd_config but I > doesnt work. I have ipchains as firewall, perhaps this is my > problem but I don´t know, > > ¿any idea? > > > Thaks > > -- > Emiliano Sutil García > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

5 6

sasldblistusers2 / saslpasswd2 not not working
by Sheridan West 29 Apr '04

29 Apr '04

Hi I have a suse 8.2 prof setup - the final aim is to get cyrus and exim working. Cyrus is causing headaches so far. A short history: the Suse rpms for cyrus do not seem work / or you get segfaults - so I downloaded and 'make' both sasl and cyrus - now the logic seems to require an entry in /etc/sasl2db before I can get cyradm to work. I have been using this as a guide http://www.tldp.org/HOWTO/Postfix-Cyrus-Web-cyradm-HOWTO/install.html Having a look here sysconfig auth is set to pam - I can see the cyrus server but cant do anything with it can anybody clue me in and help me get this working. It got to be easy ? yes /no sorry about my stupidness. ____________________________________________________________ Yahoo! Messenger - Communicate instantly..."Ping" your friends today! Download Messenger Now http://uk.messenger.yahoo.com/download/index.html

2 2

RE: [suse-security] sshd keep alive
by sematin＠mtn.co.ug 29 Apr '04

29 Apr '04

I have not done ipsec tunnels in linux since my one and only attempt at freeswan proved to be a whole 24 hours of frustration however I have run it very easily in steps taking about 15 minutes with FreeBSD. I assumed that by now freeswan should be useable and easy to setup since about 3 years have passed since my abortive attempt at setting it up. Noah. > -----Original Message----- > From: Geoffrey [mailto:esoteric@3times25.net] > Sent: 29 April 2004 13:13 > To: suse-security(a)suse.com > Subject: Re: [suse-security] sshd keep alive > > > sematin(a)mtn.co.ug wrote: > > Unless you have a specific need for ssh tunnels, you could simply > > setup a VPN tunnel between your host and the server using ipsec and > > thus ALL your connections to the server go through that > secure tunnel. > > You don't need keepalives for that. > > I'm looking for enlightenment here. Personal experience seems to > indicate that ssh is a lot easier to set up then a vpn, > freeswan being > the only solution I've tried, and know of that works on > Linux. So, ssh > is the way I normally approach this problem. I can get ssh up an > running from install, whereas freeswan is an effort measured in hours > and frustration. > > Are there other solutions? > > -- > Until later, Geoffrey Registered Linux > User #108567 > Building secure systems in spite of Microsoft > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

2 1

Re: [suse-security] sshd keep alive
by Armin Schoech 29 Apr '04

29 Apr '04

Hi, > >--> I think you have to enable keek alive in both sshd_config and > >ssh_config, i.e. for the server AND the client. > > > Well, I use a windows machine to access this linux server. I access > with putty, exactly with > the command plink.exe, I don´t know where to indicate this in the > client, do you know? > --> when you start "putty.exe" on your Windows client, you can change the settings for a specified connection (user@host). These settings are then also used by the other programs of the PuTTY suite like pscp.exe and probably also plink.exe Somewhere in the options under "Connections" you will find a check-box for keep-alives. Good luck! Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50

1 0

Re: [suse-security] sshd keep alive
by Paranoiac_User 29 Apr '04

29 Apr '04

>> You can circumvent all this trouble by using ready made solutions >> instead of reinventing the wheel. There are free OpenSource projects >> as autossh and rstunnel (reliable ssh tunnel) that address this issue. >> >> [1] http://sourceforge.net/projects/rstunnel/ >> [2] http://www.harding.motd.ca/autossh/ >> >> the bob >> >> -- http:\\www.hs-pongratz.de >> > I didn´t know this projects, I´ll investigate them, one question before > I start, can I use this solutions on the client machine running windows? > Nope, according to projects descriptions on links mentioned above these are *nix solutions. But ipsec would be interoperable with windows >=2k. the bob -- http://www.hs-pongratz.de

1 0

Re: [suse-security] sshd keep alive
by Paranoiac_User 29 Apr '04

29 Apr '04

> I have Suse 9.0 and I use ssh to create tunnels to access several > services of the server. > My problem is that ssh close the connections if there is no activity in > the tunnel. > I have the property KeepAlive yes in the sshd_config but I doesnt work. > I have ipchains as firewall, perhaps this is my problem but I don´t know, > You can circumvent all this trouble by using ready made solutions instead of reinventing the wheel. There are free OpenSource projects as autossh and rstunnel (reliable ssh tunnel) that address this issue. [1] http://sourceforge.net/projects/rstunnel/ [2] http://www.harding.motd.ca/autossh/ the bob -- http:\\www.hs-pongratz.de

1 0

Re: [suse-security] How to block some IPs with SuSEfirewall2 ?
by Marc Samendinger 28 Apr '04

28 Apr '04

> -----Original Message----- > From: Anders Johansson [mailto:andjoh@rydsbo.net] > Sent: Wednesday, April 28, 2004 7:14 AM > > > On Wednesday 28 April 2004 06.52, Christian Lange wrote: > > Hello Andreas, > > > > > Well, now I did and an > > > IPTABLES -A OUTPUT -j REJECT -d www.x.de > > > in fw_custom_before_antispoofing() > > > > you will need a rules like this: > > > > iptables -A FORWARD -s IP_OF_NAT_BOX_1 -d IP_OF_DESTINATION > -j DROP/REJECT > > iptables -A FORWARD -s IP_OF_NAT_BOX_2 -d IP_OF_DESTINATION > -j DROP/REJECT > > Really? I didn't think NATed packets passed through the > FORWARD table. I > thought that was for unmodified packets only. nope > iptables -t nat -I PREROUTING -d DEST_IP -j DROP > > would have been my guess You guessed wrong, nat in the PREROUTING chain is for DNAT (Destination nat) only. SNAT takes place in the POSTROUTING chain. SNAT packets take their way through the FORWARD chain and can therefore be DROPed/REJECTed in the FORWARD chain. Take a look at the Kernel Packet Traveling Diagram on Stef Coene's site docum.org http://www.docum.org/stef.coene/qos/kptd/ HTH marc

2 1

How to block some IPs with SuSEfirewall2 ?
by Andreas 28 Apr '04

28 Apr '04

Hi, I'd like to make a number of IPs unreachable from within our LAN. The PCs in the LAN have internet access via an SuSE 8.2 box that does NAT for them. Now I'm rather convinced that /etc/sysconfig/scripts/SuSEfirewall2-custom is the place to stop all packets to and from those IPs. I tried to set some rules but didn't get any result. How can I stop any talk between my host and certain IP adresses ? Thanx in advance Andreas

4 4