May 2005 - openSUSE Security - openSUSE Mailing Lists

ipsec problem
by Markus Feilner 11 May '05

11 May '05

Hello List, How can I Use one IPSEC tunnel for several hosts? something like leftsubnet= 1.1.1.1/32, 2.2.2.2/32, 3.3.3.3/32 is that possible? I have a tunnel between two locations and i want to specify five hosts on each side, each of which is allowed to connect to one host on the other side. I would have preferred a separate tunnel for each connection, but the other side does not want that. (cisco) Thanks! -- --------------------------- Bitte beachten Sie unsere neuen Adressdaten! Vielen Dank. --------------------------- Feilner IT Linux & GIS Linux Solutions, Training, Seminare und Workshops - auch Inhouse Beraiterweg 4 93047 Regensburg fon +49 941 9465243 fax +49 941 9465244 mobil + +49 170 3027092 mail mfeilner(a)feilner-it.net web http://www.feilner-it.net

1 1

2 internet links
by suse-list 10 May '05

10 May '05

we have 2 inet providers, with 2 different ip addr in one server. 1st ip is the default, default route goes thru it, second have no routes. how to set up squid to use 2 links? option squid.conf:tcp_outgoing_address works fine, but tcpdump -i $eth_second_provider sometimes shows icmp: host 81.211.104.10 unreachable - admin prohibited filter second provider iface should be open, iptables rules are up ... please help, or point to manual.

2 1

Multiple NIC scenario
by Torsten E. 10 May '05

10 May '05

Hello there, I'm not sure, if this question belongs to this ML, but as its FW2 related I think I'd post it here ... An external office has two DSL connections (don't ask why ... they have it ... ;)). The LAN (office systems) should be connected to the internet for browsing, email, etc. using one DSL connection. The second one should be dedicated to get remote access to one special system there. Scenario: ____________ | | DSL-line 1 --- |eth0 -- eth2| --- LAN (browsing, email, etc.) (Provider 1 | | | SuSE 9.2 | | | DSL-line 2 --- |eth1 -- eth3| --- dedicated system (separate network) (Provider 1 | | ------------ Restrictions: - no permitted connections from eth1 <-> eth2 & eth0 <-> eth3 - FW for eth0 accepts traffic for browsing, emails, etc. only - FW for eth1 accepts traffic for rc-software (vnc or rdp or so) only Can this be realized using an SuSE 9.2 system? If Yes, how to configure/setup it? As we have some 9.2 systems running, acting as webservers or routers, we'd like to use one for this szenario, too ... Thanks in advance & have a nice day Torsten

4 5

transparent proxy (Squid) / Gracenote
by Dirk Wetter 10 May '05

10 May '05

Hi there, I have for a customers site build a solution with a transparent proxy using squid. The machine is running Suse 9.1. Since some time a user is complaining that he cannot use iTunes' CDDB (gracenote) anymore. I reproduced it, he's right. :-/ According to the logs a while back the queries to cddb.net were logged with 'TCP_MISS/200 411 POST /<URL>' Now the logs are showing "Internal Server Error" (TCP_MISS/500 411 POST /<URL>). The user just doesn't see an answer (the cddb-info) to his POST request then. There's a timely coincidence with the latest patch containing bugzilla#78093. Sincewithout proxy it rocks like a charm I would rather suspect the problem within squid. Before digging deeper or just going ahead and circumvent this with an ACL my question: Does anybody have the same problem? Thx in advance, Dirk -- Dr. Dirk Wetter http://drwetter.org Consulting IT-Security + Open Source Key fingerprint = 80A2 742B 8195 969C 5FA6 6584 8B6E 59C1 E41B 9153 __________________________________ Do you Yahoo!? Yahoo! Mail - You care about security. So do we. http://promotions.yahoo.com/new_mail

2 1

SpammAssassin in 9.3 lets spam pass trhough
by Carlos E. R. 10 May '05

10 May '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm getting spam mail that the Bayesian filter marks as 99% spam, but the overall score is below 5. For me, this is a security related problem, as I'm getting intruded by Spam that previously was dumped. For example, the report for one such email says: X-Spam-Status: No, score=2.6 required=5.0 tests=ALL_TRUSTED,BAYES_99, HTML_20_30,HTML_IMAGE_ONLY_24,HTML_MESSAGE autolearn=no version=3.0.2 To me, something that the bayessian filter says is spam within 99%, _is_ spam. However, the scoring used that I see from the tables in /usr/share/spamassassin/50_scores.cf seems to be this: ALL_TRUSTED -2.867 What is that? :-/ BAYES_99 4.070 HTML_20_30 0.567 HTML_IMAGE_ONLY_24 0.787 HTML_MESSAGE 0.001 Total: 2.558 (matches above) What is that "ALL_TRUSTED"? I see in "20_compensate.cf" this: # The message was never sent via an untrustworthy host. header ALL_TRUSTED eval:check_all_trusted() describe ALL_TRUSTED Did not pass through any untrusted hosts tflags ALL_TRUSTED nice It probably means that it was sent through verizon.net. So what? Ok, I'll try to disable it. The default scoring is set in 50_scores.cf as: score ALL_TRUSTED -2.400 -2.820 -2.867 -3.300 The third scoring column is used: Bayessian tests enabled, network tests dissabled. So I go to "/etc/mail/spamassassin/local.cf" and change the score, initially dividing all the values by 4, to: score ALL_TRUSTED -0.600 -0.705 -0.717 -0.825 I suppose that a "score" set in there supplants the default one, no? Well, no! I send that spam email to myself, after restarting the spamd service, and I get: X-Spam-Status: No, score=2.8 required=5.0 tests=ALL_TRUSTED,BAYES_95 autolearn=no version=3.0.2 It is not working. How do I disable that "ALL_TRUSTED" test? I also did the change directly in "/usr/share/spamassassin/50_scores.cf", and the result is the same: X-Spam-Status: No, score=2.8 required=5.0 tests=ALL_TRUSTED,BAYES_95 How on earth do I disable that $&%$/$/* "ALL_TRUSTED" test? How do I make that spam marked as BAYES_99 does get flagged as SPAM: yes? Configuration changes in scoring are not read at all... not even after a reboot. :-/ - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFCfJ2ItTMYHG2NR9URAp7pAKCQfWKZIV8oXw/D+qXrt+6QSvW3GwCdFmU+ Ewo8BKblWvru48yVXhstswQ= =N+7g -----END PGP SIGNATURE-----

6 9

Encrypted USB disk
by Alex Hargrove 10 May '05

10 May '05

Hello all- Not sure if this has been asked before, but anyone know of a decent guide for setting up an encrypted USB disk? Can't seem to find anything in the docs or on Novell's site... Thanks!

2 1

SuSEfirewall and VPN routing
by Dirk Borchers 09 May '05

09 May '05

Hi, I'm trying to make a vpn-connection from the internet to an internal ms-vpn-server. So I configured SuSEfirewall to forward tcp port 1723 with FW_FORWARD_MASQ="0/0,192.168.17.15,tcp,1723". The vpn-server is allowed to have masquerading FW_MASQ_NETS="192.168.17.15/32,0/0". But all I get is a connection timeout. How do I have to configure the GRE forwarding? Greetings, Dirk

2 2

Re: [suse-security] SpammAssassin in 9.3 lets spam pass trhough
by Carlos E. R. 08 May '05

08 May '05

El 2005-05-07 a las 17:51 +0200, Markus Schwaiger escribió: > The "ALL_TRUSTED"-rule matches usually only if you habe a whitelist_from or > whitelist_to entry in one of your config files (local.cf...), eg: > > whitelist_from robin1.listas(a)tiscali.es > whitelist_to getseverything(a)tiscali.es No, that's not the case, and I don't have any white list rules that could match. The fact is that the ALL_TRUSTED is scoring, adding a negative value. I just want to give it a 0 value (so that it doesn't act), and my changes are ignored. > > X-Spam-Status: No, score=2.6 required=5.0 tests=ALL_TRUSTED,BAYES_99, The rule is described in the brief doc as "Did not pass through any untrusted hosts". When a user is in a whitelist, you get the "USER_IN_WHITELIST" token, like this: X-Spam-Status: No, score=-99.7 required=5.0 tests=MSGID_FROM_MTA_HEADER, OPTING_OUT,OPTING_OUT_CAPS,RCVD_DOUBLE_IP_LOOSE,USER_IN_WHITELIST autolearn=no version=3.0.2 -- Saludos Carlos Robinson

1 0

AW: [suse-security] IPSec question (freeswan + cisco)
by Rasp, Robert 07 May '05

07 May '05

Hello, I don't know much about openswan. I use freeswan for a long time and now I use strongswan. The Message you get may be because you have PFS (perfect forwars secret) enabled and The cisco-box not. --- OR --- There is no Secret in the secret file (ipsec.secret in freeswan) --- OR --- The configuration of the Subnets are not the same on your box to the cisco-box (this is my favourite Error ;-) )--- OR --- The Subnet are already in use with an other tunnel on the cisco-box. Hope this helps Robert -----Ursprüngliche Nachricht----- Von: Aleksandar Ivanovski [mailto:dambo5@yahoo.com] Gesendet: Freitag, 6. Mai 2005 14:19 An: Dana Hudes Cc: suse-security(a)suse.com Betreff: Re: [suse-security] IPSec question (freeswan + cisco) OK I have |migrated to openswan installed it successfully and here are the log messages that i get on my linux box: May 6 12:23:42 encmail pluto[5947]: "mm" #1: initiating Main Mode May 6 12:23:42 encmail ipsec__plutorun: 104 "mm" #1: STATE_MAIN_I1: initiate May 6 12:23:42 encmail ipsec__plutorun: ...could not start conn "mm" May 6 12:23:44 encmail pluto[5947]: "mm" #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2 May 6 12:23:48 encmail pluto[5947]: "mm" #1: ignoring Vendor ID payload [01a3437e1d6102df5918a08c21f0ad33] May 6 12:23:48 encmail pluto[5947]: "mm" #1: I did not send a certificate because I do not have one. May 6 12:23:48 encmail pluto[5947]: "mm" #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3 May 6 12:23:49 encmail pluto[5947]: "mm" #1: Peer ID is ID_IPV4_ADDR: '195.26.157.18' May 6 12:23:49 encmail pluto[5947]: "mm" #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4 May 6 12:23:49 encmail pluto[5947]: "mm" #1: ISAKMP SA established May 6 12:23:49 encmail pluto[5947]: "mm" #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP {using isakmp#1} May 6 12:23:53 encmail pluto[5947]: "mm" #1: ignoring informational payload, type NO_PROPOSAL_CHOSEN May 6 12:23:53 encmail pluto[5947]: "mm" #1: received and ignored informational message May 6 12:24:59 encmail pluto[5947]: "mm" #2: max number of retransmissions (2) reached STATE_QUICK_I1. No acceptable response to our first Quick Mode messa ge: perhaps peer likes no proposal I am desperate and have no idea what to do next? here is the cisco log on the other site: 2w1d: %CRYPTO-4-IKMP_NO_SA: IKE message from 82.214.208.99 has no SA (Security Associations) and is not an initialization offer looking forward to hear from you aleks --- Dana Hudes <dhudes(a)tcp-ip.info> wrote: > freeswan is no longer under active development or maintenance by its > developers, per the project home page. > I suggest you find an alternative ipsec implementation...perhaps > openvpn will suit your needs. > > > On Wed, 4 May 2005, Aleksandar Ivanovski wrote: > > > Hi List, > > > > I have installed freeswan on suse9.0 pro, > > 2.4.21-99-default . > > freeswan-1.99_0.9.34-27 > > freeswan.ca says that 2.4.2x+ works OK with > > freeswan1.99 > > > > The remote site uses cisco IPSec. Since I am very > new > > to IPSec issues, sorry for the stupid questions > below > > sad.gif > > The other site gave me these infos: > > > > PHASE1 (ISAKMP): > > encryption algorithm: 3DES > > hash algorithm: Secure Hash Standard > > authentication method: Pre-Shared Key > > Diffie-Hellman group: #2 (1024 bit) > > lifetime: 86400 seconds, no volume limit > > > > PHASE2 (IPSEC): > > encryption algorithm: 3DES > > hash algorithm: Secure Hash Standard > > Security association lifetime 4608000 > kilobytes/3600 > > seconds > > No PFS > > > > and that all we need to do is exchange the > pre-shared > > keys and IP addresses. > > > > > > First question is wheather it is possible at all > to > > establish such a connection? > > > > I have been reading a pdf Implementing > site-to-site > > ipsec between cisco router and freeswan and have > done > > all the steps > > > > Iam attaching here the conf files and the logs: > > > > config setup > > # THIS SETTING MUST BE CORRECT or almost nothing > will > > work; > > # %defaultroute is okay for most simple cases. > > interfaces="ipsec0=eth0" > > # Debug-logging controls: "none" for (almost) > none, > > "all" for lots. > > klipsdebug=none > > plutodebug=none > > # Use auto= parameters in conn descriptions to > control > > startup actions. > > plutoload=%search > > plutostart=%search > > # Close down old connection when new one using > same ID > > shows up. > > uniqueids=yes > > ...... > > > > conn freeswan-cisco > > # Left security gateway, subnet behind it, next > hop > > toward right. > > left=hidden IP address > > leftsubnet=10.1.10.0/24 (my LAN) > > leftnexthop= gateway that takes me to internet > static > > IP) > > # Right security gateway, subnet behind it, next > hop > > toward left. > > right= IP provided by the operator > > rightsubnet= > > rightnexthop= > > # To authorize this connection, but not actually > start > > it, at startup, > > # uncomment this. > > auto=add > > authby=secret > > > > > > > > and add row at the end of ipsec.secrets: > > theirIP myIP : PSK "shared-key that were sent to > me by > > the operator" > > > > /var/log/messages: > > > > Apr 29 14:57:14 linux pluto[4663]: > "freeswan-cisco" > > #1: initiating Main Mode > > Apr 29 14:57:17 linux pluto[4663]: > "freeswan-cisco" > > #1: Can't authenticate: no preshared key found for > > `10.1.10.176' and `195.26.157.18'. Attribute > OAKLEY_A > > UTHENTICATION_METHOD > > Apr 29 14:57:17 linux pluto[4663]: > "freeswan-cisco" > > #1: no acceptable Oakley Transform > > Apr 29 14:57:17 linux pluto[4663]: > "freeswan-cisco" > > #1: sending notification NO_PROPOSAL_CHOSEN to > > 195.26.157.18:500 > > Apr 29 14:57:26 linux pluto[4663]: > "freeswan-cisco" > > #1: Can't authenticate: no preshared key found for > > `10.1.10.176' and `195.26.157.18'. Attribute > OAKLEY_A > > UTHENTICATION_METHOD > > > > > > Since I do not have where to read and where to > search > > for these error messages please drop few lines > > anything, links, pdf's, whats the solution for > errors > > ..... > > > > 10x to you all > > > > __________________________________________________ > > Do You Yahoo!? > > Tired of spam? Yahoo! Mail has the best spam > protection around > > http://mail.yahoo.com > > > > -- > > Check the headers for your unsubscription address > > For additional commands, e-mail: > suse-security-help(a)suse.com > > Security-related bug reports go to > security(a)suse.de, not here > > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: > suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, > not here > > __________________________________ Yahoo! Mail Mobile Take Yahoo! Mail with you! Check email on your mobile phone. http://mobile.yahoo.com/learn/mail -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

Out of the office autoresponders in suse-security...
by Carlos E. R. 07 May '05

07 May '05

Why must people use them on lists, I wonder - and on this list precisely? |Subject: Rainer Beideck ist außer Haus. | |Ich werde ab 06.05.2005 nicht im Büro sein. Ich kehre zurück am 16.05.2005. | |In dringenden Fällen, wenden Sie sich bitte an unsere Zentrale 0621-40182-0 or: |Subject: Tom R. Sheaffer/wohlsen is out of the office. | |I will be out of the office starting 05/06/2005 and will not return until 06/03/2005. | |PLEASE READ! I will be out starting May 6th and will not return for several |weeks. If you need assistance, please contact Debbie Fogal-Zink. Ah! This one is traveling to the past. Or he is not aware that dates in that format are not internationally interpreted the same... -- Cheers, Carlos Robinson

1 0