March 2005 - openSUSE Security - openSUSE Mailing Lists

Problem with SuSEfirewall and Postfix SMTP?
by Jürgen Mell 18 Mar '05

18 Mar '05

Hi List, today we had an outage of our internet provider. The connection was broken for several hours during which the mail server of the internet provider stored our e-mails. Now after the connection is established again these mails are sent to our own mail server from the provider's server at a pretty high rate. Our system is SuSE 9.2 with Postfix 2.1.5 as the SMTP server and the SUSEfirewall which comes with 9.2. All current patches are applied. The problem now is that after a small number of mails from our provider the SMTP server does not accept any more connections. Instead it complains about timeouts, lost connections or SMTP EOFs. When telnetting to the server in this state a connection is made but there is no prompt "220 <servername> ESMT Postfix". The only way to fix this I found up to now is restarting Postfix (the cron job does it now every 3 minutes...) but that is only a very crude fix. Even setting the max_use parameter in main.cf to 1 to get a new smtpd for each connection does not help. Has anybody an idea what is causing this behaviour? Is it the firewall or is it Postfix or anything else who is limiting the connections? There are some firewall errors in the logs, but not nearly as many as the lost connections of the SMTP server: Mar 17 21:52:18 pluto kernel: SFW2-OUT-ERROR IN= OUT=dsl0 SRC=<our IP> DST=<Provider's mail server IP> LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=3530 DF PROTO=TCP SPT=25 DPT=58506 WINDOW=1404 RES=0x00 ACK RST URGP=0 OPT (0101080A015E41E40C059CEB) Any help would be greatly appriciated! Jürgen

2 1

Linux Magazin Jahres-CD
by Patrick Holzinger 18 Mar '05

18 Mar '05

Hallo Zusammen, hat jemand zufällig, die Linux Magazin Jahres CD 2004 ich bräuchte das Heft 12/2004 im pdf Format. Danke für die Hilfe und lg Patrick

3 3

password change from LDAP client (pwdutils and shadow RPMs)
by Prakash Velayutham 17 Mar '05

17 Mar '05

Hi, I have already sent this question to openldap-software mailing list. There seems to be a whole lot of package changes between 9.0 and 9.1 SuSE Pro, that I thought of posting this here too to get experts' opinions. I have a OpenLDAP server (openldap2-2.1.22-65 RPM version) running on a SuSE Pro 9.0 server (Kernel 2.4.21-192). There are different clients connecting to this server for authentication (a mix of SuSE Pro 9.0 and 9.1 systems). I have the following packages in the 9.0 clients: pam_ldap-164-42 nss_ldap-207-80 openldap2-client-2.1.22-65 and the following in the 9.1 clients: pam_ldap-169-24 nss_ldap-215-55 openldap2-client-2.2.6-34 I want the users to be able to change their own passwords using the "passwd" command. Here are the scenarios: In the server slapd.conf, I have the following ACLs, access to attrs=userPassword by self write by anonymous auth by dn="cn=Manager,o=tchrf,c=us" write by * none access to attrs=shadowLastChange by dn="cn=Manager,o=tchrf,c=us" write by self write by * auth access to * by * read I also have the "password-hash {SSHA}" option. In all the clients, I have "pam_password exop" enabled. I am able to do the passwd change successfully from the 9.0 systems, but not from the 9.1 systems. The /var/log/messages shows an error like the following: pam_ldap: ldap_extended_operation_s Server is unwilling to perform Please help. If you need more info, please ask. Thanks, Prakash

1 0

Default policy setting with iptables
by Stefan.Junge＠ssi-schaefer.de 17 Mar '05

17 Mar '05

Hello, I have got a question concerning setting up a default policy with iptables. There is a system with kernel 2.6. I have configured a rule set in a script which will be loaded at boot time. On SuSE 8.2 there was the same rule set - and it works. Now, 1. with the kernel 2.6 I have not any logging as configured in syslog Kern.* /var/log/firewall 2. The default policy is not set as I have expected. Here is the beginning: Some basics ... And then ... iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT DROP iptables -F iptables -t nat -F iptables -X # ======================================================================= # Loopback Devices # ======================================================================= iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT iptables -A OUTPUT -p icmp -j ACCEPT # ======================================================================== === # DROP & LOG Chain # ======================================================================== = iptables -N my_drop iptables -A my_drop -p icmp -j LOG --log-prefix "DROP-ICMP " iptables -A my_drop -p udp -j LOG --log-prefix "DROP-UDP " iptables -A my_drop -p tcp -j LOG --log-prefix "DROP-TCP " iptables -A my_drop -j DROP .... Rules for SSH, http ... What could be wrong? Regards, Stefan Junge

3 2

SuSE 9.2 + SuSEfirewall2 + pptp vpn
by Frank Krüger 17 Mar '05

17 Mar '05

Hi List, > That's strange. I'd suggest you to start from scratch and then post > your /etc/sysconfig/SuSEfirewall2 file. Just copy > /var/adm/fillup-templates/sysconfig.SuSEfirewall2 to > /etc/sysconfig/SuSEfirewall2 to restore the default configuration > file. > > cu > Ludwig Could it be that there is something wrong with the last build of SFW2? Ich got strage FW probs too, tryin' to get a pptp-vpn working. Mar 15 17:04:59 *** kernel: SFW2-IN-ILL-TARGET IN=ppp1 OUT= MAC= SRC=192.168.21.210 DST=255.255.255.255 LEN=96 TOS=0x00 PREC=0x00 TTL=128 ID=11508 PROTO=UDP SPT=137 DPT=137 LEN=76 Mar 15 17:04:59 *** kernel: SFW2-IN-ILL-TARGET IN=ppp1 OUT= MAC= SRC=192.168.21.210 DST=255.255.255.255 LEN=96 TOS=0x00 PREC=0x00 TTL=128 ID=11512 PROTO=UDP SPT=137 DPT=137 LEN=76 Mar 15 17:05:00 *** pptpd[21201]: Error writing GRE packet: Operation not permitted Mar 15 17:05:00 *** pptpd[21201]: CTRL: GRE read or PTY write failed (gre,pty)=(6,5) ppp1 is set as a INT interface, class-routing is activated. I got no further idea, with SuSE8.0 I had no problems. Best regards, Frank -------------------------------------------- netlogistics Frank Krueger <frank(a)netlogistics.de> you may have a look at http://www.netlogistics.de --------------------------------------------

2 3

security update suse professional
by Cristian Del Carlo 16 Mar '05

16 Mar '05

Hi list, I have same questions about the update policy that novell have for the suse professional distributions. How many years can i found the security patch for? And when is the end of support for suse 9.X professional? Is there a web page where is that explained? Best regards, Cristian Del Carlo

2 1

Suse 9.1 and SuSEfirewall2-custom
by germ germ 15 Mar '05

15 Mar '05

If i want to accept any new connections for port 5432, which function do I include it in within the SuSEfirewall2-custom file? or is there a more appropriate place to put it? __________________________________ Do you Yahoo!? Make Yahoo! your home page http://www.yahoo.com/r/hs

2 1

Ownership of Tomcat files
by Bob Vickers 15 Mar '05

15 Mar '05

I have been asked to set up a Tomcat server, and am just grappling with the extensive documentation. It isn't a production site, just a demonstration site for students to play with, but I'm very puzzled by the file ownerships which SuSE set up as they seem to break security principles as well as being inconvenient. When the Tomcat server starts, /etc/init.d/tomcat changes the ownership of all the files in $CATALINA_BASE to be tomcat:tomcat, i.e. the same as the user running the web server. So the web server has write access to its own configuration and to all the pages it serves, which is obviously a potential security hazard. It is also inconvenient, because the local user who owns the pages can no longer change them without asking a superuser. I am using SuSE 9.1 by the way, but it looks very similar on 9.2. Is there a good reason for it being done like this? Forgive me if I have missed something; I know nothing at all about servlets and am just trying to get the server going without expending too much effort. Regards, Bob ============================================================== Bob Vickers R.Vickers(a)cs.rhul.ac.uk Dept of Computer Science, Royal Holloway, University of London

4 3

SuSE 9.2 + SuSEfirewall2 + nfs problems
by Simon Oliver 15 Mar '05

15 Mar '05

I have a new fileserver running SuSE 9.2. Amongst other services it exports NFS shares. I've used Yast to configure the firewall, checking the NFS option. I have had problems where remote NFS clients either timeout trying to communicate with the server (ping/ssh work fine). After some messing (turn services on and off, flush iptables, etc) it now seems to work. However I notice some dropped packets from one of the NFS clients: Mar 15 09:38:55 zzz kernel: SFW2-INext-DROP-DEFLT-INV IN=eth0 OUT= MAC=00:0d:56: b8:5a:f4:08:00:69:0d:9a:2e:08:00 SRC=130.88.xxx.yyy DST=130.88.xxx.zzz LEN=40 TOS =0x00 PREC=0x00 TTL=60 ID=12095 DF PROTO=TCP SPT=757 DPT=2049 WINDOW=32761 RES=0 x00 ACK RST URGP=0 These are occurring on average about once a minute, but the timings vary - there can be gaps of up to eight minutes and then again they may be as close as a few seconds apart. rpcinfo indicates the following for port 2049: 100003 2 udp 2049 nfs 100003 3 udp 2049 nfs 100227 3 udp 2049 nfs_acl 100003 2 tcp 2049 nfs 100003 3 tcp 2049 nfs 100227 3 tcp 2049 nfs_acl There are no noticeable affects on the remote client! Any ideas what is happening? Regards -- Simon Oliver

3 5

Question About Sys/Sec Logs
by Don Parris 15 Mar '05

15 Mar '05

In my syslog (via Yast) I found the following entries: (020405B401010402) Mar 14 08:04:42 luke kernel: SFW2-INext-ACC-TCP IN=dsl0 OUT= MAC= SRC=218.153.147.92 DST=67.35.166.180 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=41916 DF PROTO=TCP SPT=34654 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A032FB2830000000001030300) Mar 14 08:04:44 luke sshd[26285]: Invalid user test from ::ffff:218.153.147.92 Mar 14 08:04:45 luke kernel: SFW2-INext-ACC-TCP IN=dsl0 OUT= MAC= SRC=218.153.147.92 DST=67.35.166.180 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=27312 DF PROTO=TCP SPT=34740 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A032FB3A50000000001030300) Mar 14 08:04:46 luke sshd[26287]: Invalid user guest from ::ffff:218.153.147.92 Mar 14 08:04:47 luke kernel: SFW2-INext-ACC-TCP IN=dsl0 OUT= MAC= SRC=218.153.147.92 DST=67.35.166.180 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=61758 DF PROTO=TCP SPT=34796 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A032FB47A0000000001030300) Mar 14 08:04:49 luke sshd[26289]: Invalid user admin from ::ffff:218.153.147.92 Mar 14 08:04:49 luke kernel: SFW2-INext-ACC-TCP IN=dsl0 OUT= MAC= SRC=218.153.147.92 DST=67.35.166.180 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=34621 DF PROTO=TCP SPT=34842 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A032FB54B0000000001030300) Mar 14 08:04:51 luke sshd[26291]: Invalid user admin from ::ffff:218.153.147.92 Mar 14 08:04:51 luke kernel: SFW2-INext-ACC-TCP IN=dsl0 OUT= MAC= SRC=218.153.147.92 DST=67.35.166.180 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=17521 DF PROTO=TCP SPT=34909 DPT=22 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A032FB61C0000000001030300) Mar 14 08:04:53 luke sshd[26293]: Invalid user user from ::ffff:218.153.147.92 Mar 14 08:05:01 luke sshd[26301]: Invalid user test from ::ffff:218.153.147.92 Mar 14 08:08:20 luke kernel: SFW2-INext-DROP-DEFLT IN=dsl0 OUT= MAC= SRC=219.128.154.132 DST=67.35.166.180 LEN=48 TOS=0x00 PREC=0x00 TTL=112 ID=40245 DF PROTO=TCP SPT=3984 DPT=9898 WINDOW=65044 RES=0x00 SYN URGP=0 OPT (0204058601010402) Mar 14 08:19:59 luke kernel: SFW2-INext-DROP-DEFLT IN=dsl0 OUT= MAC= SRC=218.83.155.77 DST=67.35.166.180 LEN=364 TOS=0x00 PREC=0x00 TTL=51 ID=0 DF PROTO=UDP SPT=49964 DPT=1026 LEN=344 Mar 14 08:41:56 luke kernel: SFW2-INext-DROP-DEFLT IN=dsl0 OUT= MAC= SRC=222.88.173.5 DST=67.35.166.180 LEN=681 TOS=0x00 PREC=0x00 TTL=111 ID=62714 PROTO=UDP SPT=17219 DPT=1026 LEN=661 Mar 14 08:51:43 luke kernel: SFW2-INext-DROP-DEFLT IN=dsl0 OUT= MAC= SRC=12.6.153.198 DST=67.35.166.180 LEN=908 TOS=0x00 PREC=0x00 TTL=116 ID=13705 PROTO=UDP SPT=29582 DPT=1028 LEN=888 It appears that someone was trying to login on my system while it was connected to the 'Net. My real question is whether this indicates my defenses are working, or should I be looking elsewhere for that confirmation. There is no other activity recorded until 12:46 and I have not noticed any problems with my system. However, I also understand that wiley crackers will attempt to make themselves invisible and cover their tracks. I'm not wiley enough yet to get the really wiley ones. ;) I'm not in a state of panic, but do feel I need to spend more time understanding and applying the security monitoring stuff. Is this where Snort would be useful? Thanks for your input. Don -- evangelinux GNU Evangelist http://matheteuo.org/ http://chaddb.sourceforge.net/ "Free software is like God's love - you can share it with anyone anytime anywhere."

4 3