May 2004 - openSUSE Security - openSUSE Mailing Lists

AW: AW: [suse-security] openvpn samba question (sshd keep alive cont..)
by Rasp, Robert 27 May '04

27 May '04

Hello, you don't need a wins-server wen you configured the lmhosts file korrekt. Most of the time, browsing does not work over the VPN. But you can access the Server Press "Start" --> "Run" and then type "\\serverlinux" After a few seconds there apperars a explorer-window with the shares of the server Before you do this, start a shell on the server and use tcpdump: tcpdump -pni [vpn-dev] port 135 or 137 For [vpn-dev] you use the VPN-Device. You can see the traffic between the client and the server (i hope).... CU Robert -----Ursprüngliche Nachricht----- Von: Emiliano Sutil [mailto:emiliano@iranon.com] Gesendet: Mittwoch, 26. Mai 2004 18:36 An: suse-security(a)suse.com Betreff: Re: AW: [suse-security] openvpn samba question (sshd keep alive cont..) Rick Green wrote: >On Wed, 26 May 2004, Emiliano Sutil wrote: > > > >>Well I have put this in the lmhosts >> >>10.4.0.2 serverlinux >> >>But I can?t see it through the vpn. I reached by ping, cvs, vnc, but not >>samba. >> >> > > Sorry to jump in so late in the thread. Windows uses broadcast packets >extensively in its file-sharing protocol to 'discover' its peers. >Broadcast packets aren't generally propagated across a routed path like a >VPN, so you have to do something to tell the workstations on the other >side of the VPN how to even find the WINS server. > Unfortunately, I have just enough knowledge to be dangerous. I don't >know how specifically to tell windows that it's WINS server is 'remote', >but maybe this much will help you ask the right question of a more >windows-astute person... > > > Hi, as I said in my previous post I have added 10.4.0.2 serverlinux to the lmhosts. Now I can do ping serverlinux and I get response from 10.4.0.2 You say I can use WINS Server ¿How I can do that? You say ask a windows-astute person... I´m a total windows-silly person :-(( are there any windows-astute person in the world? :-)) thanks -- Emiliano Sutil García -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

Re: AW: [suse-security] openvpn samba question (sshd keep alive cont..)
by Emiliano Sutil 26 May '04

26 May '04

Rick Green wrote: >On Wed, 26 May 2004, Emiliano Sutil wrote: > > > >>Well I have put this in the lmhosts >> >>10.4.0.2 serverlinux >> >>But I can?t see it through the vpn. I reached by ping, cvs, vnc, but not >>samba. >> >> > > Sorry to jump in so late in the thread. Windows uses broadcast packets >extensively in its file-sharing protocol to 'discover' its peers. >Broadcast packets aren't generally propagated across a routed path like a >VPN, so you have to do something to tell the workstations on the other >side of the VPN how to even find the WINS server. > Unfortunately, I have just enough knowledge to be dangerous. I don't >know how specifically to tell windows that it's WINS server is 'remote', >but maybe this much will help you ask the right question of a more >windows-astute person... > > > Hi, as I said in my previous post I have added 10.4.0.2 serverlinux to the lmhosts. Now I can do ping serverlinux and I get response from 10.4.0.2 You say I can use WINS Server ¿How I can do that? You say ask a windows-astute person... I´m a total windows-silly person :-(( are there any windows-astute person in the world? :-)) thanks -- Emiliano Sutil García

1 0

Re: AW: [suse-security] openvpn samba question (sshd keep alive cont..)
by Manuel Balderrábano 26 May '04

26 May '04

Hi, you forgot to include the list this time, but in this one is included your previous mail. El Miércoles, 26 de Mayo de 2004 17:00, escribió: > Manuel Balderrábano wrote: > > >The LMHOST file just translates network names into IP adresses, just like / > >etc/hosts. > >Check the avaliable ports on the linux server, the firewall, if any, might be > >closing your SMB ports. > > > >I still think you need the bridge to achieve what you are looking for :-) > > > > > > > > > I begin to think so, because I cant access the server through the > windows explorer at all, > I access the web, cvs, vnc, etc etc, but not net-bios . > > One question, In the samba server there isn´t any firewall but between > my windows box and the > samba server there is a firewall, can this firewall be blocking the > traffic? does not go all the traffic through the vpn? All traffic directed to the Linux box through the openvpn goes throug the 5000 port (Or the one you may have choose), but broadcast calls are not routed throug the vpn, so that your netbios traffic stops dead on the linux box. If you can access any service (web, cvs, vnc...) through the vpn, then the firewall will not be a problem. > > > -- > Emiliano Sutil García > > ANÁLISIS Y DESARROLLO DE SOFTWARE S.L. > Urb. San Roque, 22 > 24540 Cacabelos (León) > España > email: emiliano(a)iranon.com > Telf. 902 100 103 > Fax. 902 201 801 > > > > -- --------------------------------------------------------------------------------- Manuel Balderrábano e-mail: garibolo(a)wanadoo.es ---------------------------------------------------------------------------------

1 0

openvpn samba question (sshd keep alive cont..)
by Emiliano Sutil 26 May '04

26 May '04

Hello On 29/04/2004 I asked for the sshd keep alive option of ssh. In that days I used the KeepAlive and ClientAliveInterval without success. Some people told me about other alternatives like ipsec, openvpn., well I have began to use openvpn and it works very fine, I can connect to the vncserver, cvs etc etc now I also want to share my samba volumes through the vpn, but I can reach the samba server. From my windows I try to connect to the server but It´s like there isn´t any samba on the ip Perhaps there is something wrong on my vpnconfig or in my smb.conf file ¿any idea? I run this comand to make the vpn in my windows: "c:\archivos de programa\openvpn\bin\openvpn.exe" --remote SERVER --dev tap --ifconfig 10.4.0.1 255.255.255.0 --verb 3 --secret "c:\archivos de programa\openvpn\config\key.txt" in the linux /usr/local/sbin/openvpn --remote MYPC --dev tap --ifconfig 10.4.0.2 255.255.255.0 --verb 3 --secret key.txt -- Emiliano Sutil García

4 8

RE: [suse-security] Kernel building problem on SuSE 7.x
by Drew J. Como 26 May '04

26 May '04

Trevor, Thanks for your input. I initially built .26, but that failed so I tried .25, which failed as well with the same output. I understand that 7.x is not supported any longer, however I am looking at building my own packages, not getting RPMS from the SuSE gods. I am migrating all of my systems to 9.1 Pro, however 9.1 is backordered from SuSE themselves. In regards to security, I have egg on my face as I posted to the wrong list... Thanks :-) ============================================ Drew J. Como Phone: 631-434-6600 Systems Administrator Fax: 631-434-7800 dcomo(a)bascom.com Web: www.bascom.com BASCOM Global Internet Services, Inc. -------------------------------------------- "When quality is the goal, winning is guaranteed." -----Original Message----- From: Hemsley, Trevor [mailto:Trevor.Hemsley@atosorigin.com] Sent: Wednesday, May 26, 2004 10:17 AM To: Drew J. Como Subject: RE: [suse-security] Kernel building problem on SuSE 7.x a) Looks like a problem with your level of the program `as` installed. `as --version` might tell you something. b) your source directory is referenced as /usr/src/linux-2.4.25 not .26 c) I don't think any version 7 of SuSE Linux is in support any more d) this is security related how exactly? -----Original Message----- From: Drew J. Como [mailto:dcomo@bascom.com] Sent: 26 May 2004 15:08 To: suse-security(a)suse.com Subject: [suse-security] Kernel building problem on SuSE 7.x All, I am trying to build a 2.4.26 kernel from sources, and all goes fine, however during the compile after makeconfig, it quits with the following error: (I am using gcc-2.95) ---------------------------------- filemap.c: In function `sys_sendfile64': filemap.c:1949: internal error--unrecognizable insn: (insn 358 357 367 (set (reg/v:SI 0 %eax) (asm_operands/v ("1: movl %%eax,0(%2) 2: movl %%edx,4(%2) 3: .section .fixup,"ax" 4: movl %3,%0 jmp 3b .previous .section __ex_table,"a" .align 4 .long 1b,4b .long 2b,4b .previous") ("=r") 0[ (reg:DI 1 %edx) (reg/v:SI 3 %ebx) (const_int -14 [0xfffffff2]) (reg/v:SI 0 %eax) ] [ (asm_input:DI ("A")) (asm_input:SI ("r")) (asm_input:SI ("i")) (asm_input:SI ("0")) ] ("filemap.c") 1947)) -1 (insn_list 333 (insn_list 357 (nil))) (nil)) cpp: output pipe has been closed make[2]: *** [filemap.o] Error 1 make[2]: *** Waiting for unfinished jobs.... make[2]: *** Waiting for unfinished jobs.... make[2]: Leaving directory `/usr/src/linux-2.4.25/mm' make[1]: *** [first_rule] Error 2 make[1]: Leaving directory `/usr/src/linux-2.4.25/mm' make: *** [_dir_mm] Error 2 Thanks :-) ============================================ Drew J. Como Phone: 631-434-6600 Systems Administrator Fax: 631-434-7800 dcomo(a)bascom.com Web: www.bascom.com BASCOM Global Internet Services, Inc. -------------------------------------------- "When quality is the goal, winning is guaranteed." -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here __________________________________________________________________________ This e-mail and the documents attached are confidential and intended solely for the addressee; it may also be privileged. If you receive this e-mail in error, please notify the sender immediately and destroy it. As its integrity cannot be secured on the Internet, the Atos Origin group liability cannot be triggered for the message content. Although the sender endeavours to maintain a computer virus-free network, the sender does not warrant that this transmission is virus-free and will not be liable for any damages resulting from any virus transmitted. __________________________________________________________________________

1 0

Kernel building problem on SuSE 7.x
by Drew J. Como 26 May '04

26 May '04

All, I am trying to build a 2.4.26 kernel from sources, and all goes fine, however during the compile after makeconfig, it quits with the following error: (I am using gcc-2.95) ---------------------------------- filemap.c: In function `sys_sendfile64': filemap.c:1949: internal error--unrecognizable insn: (insn 358 357 367 (set (reg/v:SI 0 %eax) (asm_operands/v ("1: movl %%eax,0(%2) 2: movl %%edx,4(%2) 3: .section .fixup,"ax" 4: movl %3,%0 jmp 3b .previous .section __ex_table,"a" .align 4 .long 1b,4b .long 2b,4b .previous") ("=r") 0[ (reg:DI 1 %edx) (reg/v:SI 3 %ebx) (const_int -14 [0xfffffff2]) (reg/v:SI 0 %eax) ] [ (asm_input:DI ("A")) (asm_input:SI ("r")) (asm_input:SI ("i")) (asm_input:SI ("0")) ] ("filemap.c") 1947)) -1 (insn_list 333 (insn_list 357 (nil))) (nil)) cpp: output pipe has been closed make[2]: *** [filemap.o] Error 1 make[2]: *** Waiting for unfinished jobs.... make[2]: *** Waiting for unfinished jobs.... make[2]: Leaving directory `/usr/src/linux-2.4.25/mm' make[1]: *** [first_rule] Error 2 make[1]: Leaving directory `/usr/src/linux-2.4.25/mm' make: *** [_dir_mm] Error 2 Thanks :-) ============================================ Drew J. Como Phone: 631-434-6600 Systems Administrator Fax: 631-434-7800 dcomo(a)bascom.com Web: www.bascom.com BASCOM Global Internet Services, Inc. -------------------------------------------- "When quality is the goal, winning is guaranteed."

1 0

AW: [suse-security] openvpn samba question (sshd keep alive cont..)
by Rasp, Robert 26 May '04

26 May '04

Hello, i think this is a Name-Resolution-Problem (WINS) Try to add the name and IP-Adress of the Sambaserver in the LMHOST. You can find this File on the XP-Box under C:\WINDOWS\system32\drivers\etc This problem is when ever you have no WINS-Server and the connection allows no broadcast. When a Windows-Computer has no WINS-Server then he try to resolve the Server with broadcasts. Of corse only when he wants to acces to Fileshares (Port 135, 137, ...) . Other IP-Services use DNS. CU Robert -----Ursprüngliche Nachricht----- Von: Emiliano Sutil [mailto:emiliano@iranon.com] Gesendet: Di 25.05.2004 19:43 An: suse-security(a)suse.com Cc: Betreff: [suse-security] openvpn samba question (sshd keep alive cont..)

2 1

SuSEfirewall2 not routing when both nics on same subnet
by David Livingston 26 May '04

26 May '04

I want to do basic filtering of ports without having to masquerade. From everything I have read (including the unofficial guide to SuSEfirewall) the below config should do that. Unfortunately I cannot get the firewall to route to eth1 or anything behind it. I am a noob at this so any guidance would be greatly appreciated. Thanks in advance, Dave The Ip's have been changed for obvious reasons. Internet | | eth0 (1.1.1.1) | FireWall---eth1 (1.1.1.2) | | Webserver (1.1.1.3) FW_DEV_EXT="eth0" FW_DEV_DMZ="eth1" FW_ROUTE="yes" FW_MASQUERADE="no" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="ssh" FW_SERVICES_EXT_UDP="ssh" FW_SERVICES_DMZ_TCP="ssh" FW_SERVICES_DMZ_UDP="ssh" FW_SERVICES_DMZ_IP="" FW_TRUSTED_NETS="" FW_FORWARD="0/0,1.1.1.3,tcp,80" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="no" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="no" FW_STOP_KEEP_ROUTING_STATE="yes" FW_ALLOW_PING_FW="yes" FW_ALLOW_PING_DMZ="yes" FW_ALLOW_FW_TRACEROUTE="yes" -- C: Zanzeta, Inc. N: Dave Livingston T: Chief Information Officer P: 469.688.4872 F: 214.292.8578 E: dlivingston(a)zanzeta.com

6 8

Problems with snort and Suse 9.1
by Klaus Niedt 26 May '04

26 May '04

Hi, everybody! I tried to get snort run on Suse 9.1 for several days. A 'rcsnort restart' command has an output in /var/log/messages: snort initialization completed succesfully. But there is no logging of portscans, when I proof the program (doing it with www.heise.de). With Suse 9.0, I got lots of alerts, when I visit this site. A 'snort -T snort.conf' has this output: stargate:/etc/snort # snort -T snort.conf Running in IDS mode with inferred config file: ./snort.conf Log directory = /var/log/snort Initializing Network Interface eth0 ERROR: OpenPcap() FSM compilation failed: syntax error PCAP command: snort.conf Fatal Error, Quitting.. I used the original conf-file and also changed files, but in every case it has the same output. Looking for help with google or the list archive did not have a match. I hope, anybody at the list has a hint. Regards Klaus Niedt

1 0

SuSEfirewall2 SNAT
by Gblanco 25 May '04

25 May '04

Hi : I have a little trouble, i am trying to build a firewall with Snat command, simply because, i must to change my ip to 10.1.X.X when i have one, in the net 172.16.1.X example: 172.16.1.X ----> 10.1.X.X 172.16.2.X -----> 10.2.X.X 172.16.3.X ------> 10.3.X.X I´ve tryied using SuSEfirewall2, but only works with masq. I´ve use the file of custom, and write the next rule, just before masq. iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -p tcp -o eth1 -j SNAT --to-source 10.1.1.1-10.1.1.10:1024-32000 but isn´t works, somebody knows how to use SNAT in SuSEfirewall2 ?, because if I try building the rule more general, It filter the packets yet. Sorry, but my english is not good. Thanks.

1 0