May 2004 - openSUSE Security - openSUSE Mailing Lists

Re: [suse-security] SuSEFirewall doesn't work?
by Manuel Balderrábano 11 May '04

11 May '04

Hi, thanks for answering. El Martes, 11 de Mayo de 2004 17:53, Tom Kramer escribió: > > > -----Original Message----- > > From: Manuel Balderrábano [mailto:garibolo@wanadoo.es] > > Sent: Tuesday, May 11, 2004 5:42 PM > > To: suse-security(a)suse.com > > Subject: Re: [suse-security] SuSEFirewall doesn't work? > > > > Hi. > > > > Please, please, please... Can anyone tell me how to use PAT > > under SuSEFirewall2? > > > > Sorry for using this thread to ask this, but Tom mentioned it > > and I got nervous because I have been trying it for a while. > > In the end, used squid for apache, but I found nothing for > > ssh and cvs, so that I have to check the firewall along with > > both the ssh , the cvs and snort logs. > > I don't know what you want to do exactly but check this: > > http://www.sun.com/bigadmin/content/submitted/squid_proxy.html What I need is to redirect all incoming connections on port 80 to another computer on the DMZ. > > Maybe this is the answer you are looking for: > > ".... > > You probably have a more sophisticated NetFilter setup. However, there is > one line that you need to redirect inbound traffic on port 80 to Squid on > port 3128: > > iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT > --to-ports 3128 I do that just by using port 80 on squid, but I would need to do something like: iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-host X.Y.Z.T (I made up that --tol-host rule) Regards. > > ...." > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > -- --------------------------------------------------------------------------------- Manuel Balderrábano e-mail: garibolo(a)wanadoo.es ---------------------------------------------------------------------------------

3 2

SuSEFirewall doesn't work?
by Markus A. Radner 11 May '04

11 May '04

Hi there! I have this weird problem with my SuSEFirewall2 on SuSE 9.0. I haven't opened any ports intentionally, but my log file says, that a lot of access attempts on highports get THROUGH the firewall. I have hundreds of entries like this in my /var/log/messages file: SuSE-FW-ACCEPT IN=eth0 OUT= MAC=00:a0:d1:d5:b4:3c:00:09:5b:a8:3e:c0:08:00 SRC=213.165.x.x DST=192.168.0.2 LEN=73 TOS=0x00 PREC=0x00 TTL=57 ID=16216 DF PROTO=TCP SPT=110 DPT=1435 WINDOW=5792 RES=0x00 ACK PSH URGP=0 OPT (0101080A0A4992810070F15B) My computer is behind a router/firewall. Someone tries to connect at port 1435 (and a lot of different other highports as well!). I disabled access to highports and I only allowed DNS and DHCLIENT as valid services. At least this was what I was thinking! Here's all the settings of my SuSEFirewall2 file. If anybody could explain waht's going on I'd really be grateful. FW_QUICKMODE="no" FW_DEV_EXT="eth0" FW_DEV_INT="" FW_DEV_DMZ="" FW_ROUTE="no" FW_MASQUERADE="no" FW_MASQ_DEV="$FW_DEV_EXT" FW_MASQ_NETS="" FW_PROTECT_FROM_INTERNAL="yes" FW_AUTOPROTECT_SERVICES="yes" FW_SERVICES_EXT_TCP="" FW_SERVICES_EXT_UDP="" FW_SERVICES_EXT_IP="" FW_SERVICES_DMZ_TCP="" FW_SERVICES_DMZ_UDP="" FW_SERVICES_DMZ_IP="" FW_SERVICES_INT_TCP="" FW_SERVICES_INT_UDP="" FW_SERVICES_INT_IP="" FW_SERVICES_QUICK_TCP="" FW_SERVICES_QUICK_IP="" FW_TRUSTED_NETS="" FW_ALLOW_INCOMING_HIGHPORTS_TCP="no" FW_ALLOW_INCOMING_HIGHPORTS_UDP="DNS" FW_SERVICE_AUTODETECT="yes" FW_SERVICE_DHCLIENT="yes" FW_SERVICE_DHCPD="no" FW_SERVICE_SQUID="no" FW_SERVICE_SAMBA="no" FW_FORWARD="" FW_FORWARD_MASQ="" FW_REDIRECT="" FW_LOG_DROP_CRIT="yes" FW_LOG_DROP_ALL="no" FW_LOG_ACCEPT_CRIT="yes" FW_LOG_ACCEPT_ALL="yes" FW_LOG="--log-level warning --log-tcp-options --log-ip-option --log-prefix SuSE-FW" FW_KERNEL_SECURITY="yes" FW_STOP_KEEP_ROUTING_STATE="no" FW_ALLOW_PING_FW="no" FW_ALLOW_PING_DMZ="no" FW_ALLOW_PING_EXT="no" FW_ALLOW_FW_TRACEROUTE="no" FW_ALLOW_FW_SOURCEQUENCH="yes" FW_ALLOW_FW_BROADCAST="no" FW_IGNORE_FW_BROADCAST="yes" FW_ALLOW_CLASS_ROUTING="no" FW_REJECT="no" FW_HTB_TUNE_DEV="" yours, markus.

9 10

yast-re
by cybervision8＠vsnl.net 11 May '04

11 May '04

how do i upgrade/install any pakage with yast with depancy resoveing/checking on the net ,say kde 3.2 sorry last time i miss main subject thx

1 0

Re: [suse-security] SuSEFirewall doesn't work?
by Manuel Balderrábano 11 May '04

11 May '04

Hi. El Martes, 11 de Mayo de 2004 13:11, Christian Heim escribió: > Am Dienstag, 11. Mai 2004 12:58 schrieb Markus A. Radner: > > > Just one more question: Is there any command or tool that can display which > > services or programs are running on a certain port on my computer? [...] > > Markus, try netstat :) and search for your port. Much better would be to use nmap or netcat from outside of your network, that way you will see what everybody can see from the outside and that's what really matters ;-) > > -- > Mfg Christian > ------------------------------------------------ > Auszubildender im Rechenzentrum, Universität Greifswald > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > > -- --------------------------------------------------------------------------------- Manuel Balderrábano e-mail: garibolo(a)wanadoo.es ---------------------------------------------------------------------------------

1 0

RE: [suse-security] Memo on Windows
by sematin＠mtn.co.ug 10 May '04

10 May '04

Take a look at: http://kirch.net/unix-nt/ Noah. > -----Original Message----- > From: A.L Paul [mailto:alikanza@amrefug.org] > Sent: 10 May 2004 09:31 > To: 'suse-security(a)suse.com' > Subject: [suse-security] Memo on Windows > > > Hi all,I need to reassure someone just how unrealiable a > windows platform can be especially if its used as a server of > any sort and is a proxy to the internet.Also,and more > importantly,I need facts and figures on the linux equivalent > so that I can put things into proper perspective for them to > wake up to reality. thanks Paul. > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here > >

3 2

RE: [suse-security] "What manual page do you want?" message when using ssh
by Wheeler, Dr M.D. 10 May '04

10 May '04

Thank you very much, that was driving me nuts.... ---------------------------------------------- Dr. Martyn D. Wheeler Department of Chemistry University of Leicester University Road Leicester, LE1 7RH, UK. Tel (office): +44 (0)116 252 3985 Tel (lab): +44 (0)116 252 2115 Fax: +44 (0)116 252 3789 Email: martyn.wheeler(a)le.ac.uk http://www.le.ac.uk/chemistry/staff/mdw10.html -----Original Message----- From: Armin Schoech [mailto:armin.schoech@web.de] Sent: 10 May 2004 14:32 To: suse-security(a)suse.com Subject: Re: [suse-security] "What manual page do you want?" message when using ssh Hi ! > when I type ssh root@hostname from one of the nodes the following > lines are seen, > Success > What manual page do you want? > Connection to hostname closed. > > The first line is fine, however I do not understand what the second > line is about...? > --> The second line is probably caused by a misconfigured call to the "man" command. I had this problem when installing the Intel Fortran compiler IFC and executing the script /opt/intel/compiler70/ia32/bin/ifcvars.sh in the ~/.bashrc file. Change the line MANPATH="/opt/intel/compiler70/man":$(man -w); export MANPATH to MANPATH="/opt/intel/compiler70/man"; export MANPATH and it will work without the line you get above. If it's not IFC, it's probably some other start-up script that has the "man -w" command which causes the error message. HTH, Armin -- Am Hasenberg 26 office: Institut für Atmosphärenphysik D-18209 Bad Doberan Schloss-Straße 6 Tel. ++49-(0)38203/42137 D-18225 Kühlungsborn / GERMANY Email: schoech(a)iap-kborn.de Tel. +49-(0)38293-68-102 WWW: http://armins.cjb.net/ Fax. +49-(0)38293-68-50 -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

"What manual page do you want?" message when using ssh
by Wheeler, Dr M.D. 10 May '04

10 May '04

Dear All, I have encountered some rather odd behaviour on our network. I get an odd message when is execute a remote command on the node that is connected to the outside world from one of the other nodes. On the node connected to the outside I have placed in the authorized_keys2 file the key generated on one of the other nodes on the local network. no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="echo Success" ssh-dss AA....... when I type ssh root@hostname from one of the nodes the following lines are seen, Success What manual page do you want? Connection to hostname closed. The first line is fine, however I do not understand what the second line is about...? If I do the same between nodes that are not connected to the outside i just get Success Connection to hostname closed. which is fine... Does anyone know what might be causing this behaviour? Has my security been compromised? I am running SuSE 9.0 (64 bit version) ---------------------------------------------- Dr. Martyn D. Wheeler Department of Chemistry University of Leicester University Road Leicester, LE1 7RH, UK. Tel (office): +44 (0)116 252 3985 Tel (lab): +44 (0)116 252 2115 Fax: +44 (0)116 252 3789 Email: martyn.wheeler(a)le.ac.uk http://www.le.ac.uk/chemistry/staff/mdw10.html

2 1

IPSEC/Freeswan - Symentec Internet Security 2003 - invalid ICMP Type 69
by Andreas Ernst 10 May '04

10 May '04

Hi all, i have running on Suse 9.1 Freeswan 2.04_1.5.3_45. On my W2K i installed ipsec from Marcus Mueller (vpn.ebootis.de). Everything works fine, but if i start on the W2K computer the firewall (Symentec Internet Security 2003), i get this error: invalid ICMP Type 69 Is the ICMP Tpye 69 invalid, can i change this in the config? Or is it a bug of Symentec Internet Security 2003? TIA Andreas

1 0

Memo on Windows
by A.L Paul 10 May '04

10 May '04

Hi all,I need to reassure someone just how unrealiable a windows platform can be especially if its used as a server of any sort and is a proxy to the internet.Also,and more importantly,I need facts and figures on the linux equivalent so that I can put things into proper perspective for them to wake up to reality. thanks Paul.

1 0

List still alive?
by Christian Lange 09 May '04

09 May '04

Hello out there, is the list still alive? Nothing security-related since they got the sasser/netsky-kid? Regards, Chris.

2 2