November 2006 - openSUSE Security - openSUSE Mailing Lists

SuSEfirewall2 3.4 seems to have a big hole
by Mathias Homann 04 Nov '06

04 Nov '06

Hi, older versions of SuSEfirewall2 used to have this setting: # Do you want to autoprotect all running network services on the firewall? FW_AUTOPROTECT_SERVICES="yes" but it's missing in 3.4 which comes with suse 10.0. So I have to actively close all high ports which have something running on them which I dont want to be accessible from the internet, but I do need the high ports open. Is there any way to get that old AUTOPROTECT_SERVICES setting bk (or emulated)? bye, MH -- gpg key fingerprint: 5F64 4C92 9B77 DE37 D184 C5F9 B013 44E7 27BD 763C

2 2

SuSEfirewall2 FTP problems since update to 10.0
by Mike Branda 03 Nov '06

03 Nov '06

Hello All! I have a box that is acting as a masquerading firewall between a lan and the great WWW. I used to have a rule for a subnet of machines that were only allowed to FTP due to web abuse issues. This was in SuSEfirewall2 in 9.1. I have just upgraded to 10.0 and now Active FTP is broken. The relative lines were: 192.168.20.224/28,0/0,tcp,20 192.168.20.224/28,0/0,udp,20 192.168.20.224/28,0/0,tcp,21 192.168.20.224/28,0/0,udp,21 in FW_MASQ_NETS. It worked great. Now my FTP clients stop dead in their tracks at the PORT command. The end of the transaction in ethereal reveals: 209 2.017000 192.168.20.226 208.113.147.155 FTP Request: PWD 2001 21 252 2.099551 208.113.147.155 192.168.20.226 FTP Response: 257 "/" is current directory. 21 2001 253 2.114193 192.168.20.226 208.113.147.155 FTP Request: PORT 192,168,20,226,7,210 2001 21 261 2.367009 208.113.147.155 192.168.20.226 FTP [TCP Out-Of-Order] Response: 257 "/" is current directory. 21 2001 262 2.367168 192.168.20.226 208.113.147.155 TCP dc > ftp [ACK] Seq=73 Ack=229 Win=65307 Len=0 2001 21 268 3.336464 192.168.20.226 208.113.147.155 FTP [TCP Retransmission] Request: PORT 192,168,20,226,7,210 2001 21 616 5.961397 192.168.20.226 208.113.147.155 FTP [TCP Retransmission] Request: PORT 192,168,20,226,7,210 2001 21 1025 11.211392 192.168.20.226 208.113.147.155 FTP [TCP Retransmission] Request: PORT 192,168,20,226,7,210 2001 21 1976 21.711380 192.168.20.226 208.113.147.155 FTP [TCP Retransmission] Request: PORT 192,168,20,226,7,210 2001 21 Never is there a single port 20 record line. Outside of the out of order line (which doesn't always show up), I don't see anything wrong up till here. It used to work fine. What happened? I can get passive FTP to work but it requires opening outbound high ports to the abusers who then IM and chat all day long. Any help is greatly appreciated. Mike

3 4

overview of SuseFirewall
by John Ryan 02 Nov '06

02 Nov '06

Hello, Can anyone pint me to an overview of exactly how SuseFirewall works. Some of the questions that I have are: Where are the iptables rules? How do you add extra iptables rules? How do you turn it on and off and check its status? How do you get rid of it and set up your own firewall with iptables? John

3 2

A nice Security Enhancement For SuSE
by John Andersen 01 Nov '06

01 Nov '06

The one thing I really miss from Netware which Novel could port to SuSE is Salvage. For those who don't know, Netware offered a Salvage option where files erased or overwritten could be recovered because Netware would attempt to not write over that same location, preferring instead the least recently used location where the file would fit. (Adhering to theory that unused disk space was wasted disk space). Therefore, UNTIL the system actually needed the space, you could go to the console and recover recently deleted files. Obviously, it didn't help for files discovered missing today, but which were deleted 2 months ago. Files that grew larger but remained in place were not salvageable, so databases and mbox files couldn't be recovered this way, but the document you deleted by accident usually was recoverable if you attended to it right away. Would such a thing be possible in any linux file system? -- _____________________________________ John Andersen

2 1

RE: [suse-security] A nice Security Enhancement For SuSE
by Penhale, Jeff 01 Nov '06

01 Nov '06

You could alias the rm command to a shell script that moves deleted files to a "trash" bin. Then if you made an error, just copy the file back from the trash bin. Does that work for you? -----Original Message----- From: John Andersen [mailto:jsa@pen.homeip.net] Sent: Wednesday, 1 November 2006 4:53 PM To: suse-security(a)suse.com Subject: [suse-security] A nice Security Enhancement For SuSE The one thing I really miss from Netware which Novel could port to SuSE is Salvage. For those who don't know, Netware offered a Salvage option where files erased or overwritten could be recovered because Netware would attempt to not write over that same location, preferring instead the least recently used location where the file would fit. (Adhering to theory that unused disk space was wasted disk space). Therefore, UNTIL the system actually needed the space, you could go to the console and recover recently deleted files. Obviously, it didn't help for files discovered missing today, but which were deleted 2 months ago. Files that grew larger but remained in place were not salvageable, so databases and mbox files couldn't be recovered this way, but the document you deleted by accident usually was recoverable if you attended to it right away. Would such a thing be possible in any linux file system? -- _____________________________________ John Andersen -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0