May 2002 - openSUSE Security - openSUSE Mailing Lists

how to keep nimda and code red from filling apache logs
by Mathias Homann 25 Sep '03

25 Sep '03

Hi all, here's a bit of a step-by-step description on how to keep nimda and codered from filling your apache logs. Parts used: - SuSE 7.2 Professional - SuSEfirewall2 - iptables 1.2.3 - linux kernel 2.4.13-pre5 steps: 1. install kernel sources for a kernel >> 2.4.9, running 2.4.13- pre5 here, works fine so far 2. get the sources for iptables 1.2.3 from http://netfilter.samba.org 3. unpack sources somewhere 4. export KERNEL_DIR=$(where you put the kernel tree) 5. cd into unpacked iptables sources, there's a subdirectory named patch-o-matic there 6. apply wanted patches by running ./runme $(name.of.patch)patch for this here You'll want the string patch You can also apply other patches, like the irc-conntrack patch 7. now there's a little bug in this patch... here's a diff: --- linux/net/ipv4/netfilter/ipt_string.c~ Sun Oct 21 00:16:29 2001 +++ linux/net/ipv4/netfilter/ipt_string.c Sun Oct 21 16:54:45 2001 @@ -62,7 +62,7 @@ sk = skip[haystack[right_end - i]]; sh = shift[i]; - right_end = max(int, right_end - i + sk, right_end + sh); + right_end = max(right_end - i + sk, right_end + sh); } return NULL; 8. now, make config/menuconfig/xconfig... as usual. You can import your running kernel's config first. 9. enable the experimental stuff 10. go to networking options->netfilter, there's an option there to enable string matching; set that to M 11. compile and install kernel as usual; remember to uncomment the export INSTALL_PATH=/boot in the main makefile. 12. now build a rpm file for the new iptables stuff by installing the source rpm which comes with suse, then edit the spec file, put the iptables source in /usr/src/packages/SOURCE and rebuild. 13. now there are some small changes to the firewall config files. a) uncomment the last line in /etc/rc.config.d/firewall2.rc.config: FW_CUSTOMRULES="/etc/rc.config.d/firewall2-custom.rc.config" b) edit that file, I got the following stuff in mine: for forbidden_string in root.exe cmd.exe .ida; do iptables -I input_ext -p tcp --dport http -m string \ --string $forbidden_string -m state \ --state ESTABLISHED -j REJECT --reject-with tcp-reset done put that in the last supfunction defined in the custom rc file. c) change the FW_LOG setting in firewall2.rc.config from reading -log-level warning to -log-level kernel.warning 14. last: some small changes to /sbin/SuSEfirewall2 search in the script for the parts where the modules are loaded and unloaded; be sure to add ipt_string (and the other new modules you created by patching the kernel and enabling them in make config) to the modules loading/unloading code there. 15. reboot 16. if you try now to access (from outside, of course) one of the nimda or codered URLS, all you get is a 'connection reset by peer', and the request doesn't show in apache log files. btw, no guarantees, and the usual YMMV :) bye [L]

7 7

suse samba server
by jonathan 23 Jan '03

23 Jan '03

Hello I have basically a suse samba server setup. Eth0 is for the internet connection (cable). Eth1 is my internal network. I use eth1 for my samba server. When i have the shares/ drive letters mapped, whatever, Ill goto access them and that computer will just lockup or timeout for about 1 minute, then it will resume operation normally. I have approx. 5 comptuers on the suse server, and they all do this from windows xp to windows 98se. I am using set up addresses of 192.168.0.x, where is greater than 2. My question is have or is there something Ive setup wrong to cause this pause to occur. ? Its becomming very annoying..and frustrating. Im using kernel 2.4.18-64GB-SMP with a dual processor setup. If anyone has any ideas please let me know. Every package installed is orginal versions from the suse install cdroms. (no updates done). Anything come to mind. btw, ive replaced the switch, with a new netgear one, and all the networks at startech ST100 Realtek 8139 chipsets on 100Tx. Anyone... !

4 5

Urgggggg!!! SuSEFirewall2 is getting on my nerves!!!!!
by Chris Bek 08 Jan '03

08 Jan '03

Hi there SuSErs... Well I must be doing something really wrong because everything that I do with SuSEFirewall2 is just not working! I have a small network with 5 PCs (all Win9X) and a Linux box (Currently SuSE 7.3) acting as a server. The server is a DHCP server and a Samba server for the entire network. So far everything is working perfect!!! Users log on the network, logon script executes etc.... Then a new task came up: let's input the internet into the network. Configured a 56Kbps modem on the server with YAST. Manged to get my account setup and running. Made a test connection and netscape works great on the server as well as e-mail (pop3). I tried configuring SuSEfirewall to manage all incoming requests from the PCs of the network. The firewall warned me about masquerading etc. so I downloaded the latest version of SuSEfirewall2 from the internet and installed it. Since I only need direct masquerading to be done (no proxies are currently working on the net) I made all the necessary changes as outlined in the examples supplied with the software. Since I needed to have Samba to keep working on the network, I opened (among others) 139 port for samba to work. Double checked all the changes that I have made and run rcSuSEfirewall2 to see what happens. Strange enough when wvdial executes it tells me that DNS is not functioning properly since www.suse.com cannot be found (or something like that please forgive me I am away from the Linux station now). Further on, when I open mIRC or other like programs (winmx etc) from a station, I look at the activity of IPtraf (I check this to see what happens) and I see no connections being created whatsoever.... mIRC prompts me that there was an error trying to find the host.... I have made no changes to the Win9X PCs. Is there something that I am forgeting to do?? I undestand that it is impossible for all of you to react to this since I have no output of the SuSEfirewall.conf file being published to this message.... I understand. Can someone please send me their configuration file so I can see what you have done, on a system that currently is working fine?? In addition, is there something that I have to do regarding route or routing?? What about the Win9X PCs?? Is there something that I have to do there?? I thank you so very much for all your help is advance!!!! I am killing myself trying to figure this one out for about 2 weeks now and managed nothing more than thin air!!!!! Chris

11 10

SSH Authentication
by Joao Reis 18 Nov '02

18 Nov '02

Hi! I implemented a ssh conection from the outside to my intranet. This ssh requires a username and a password. In terms of security what is more secure: require authentication (username and password) or having the public key of each user that connects to our intranet in the authorized public key lists (in this case there is no need for username and password)? In the second case there is no need of authentication and only the users wich have the public keys in the list are allowed to enter in my intranet. This second solution is a good solution or that brings other security problems ? Thanks. -- Farewell. "Keep your friends close, but your enemies closer." "Do or do not. There is no try" - Yoda João Reis -------------------------------------------------------

2 1

Re: [SLE] Re: [suse-security] NSA SELinux
by JW 03 Jun '02

03 Jun '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 JM >JW writes: JM >I Hope this helps, it is hard to tell what this thread is about. It is about applying the SE Linux security patches to the the SuSE kernel 2.4.18 for 8.0. Currently, the NSA (the SE-Linux authors) work with RedHat. Some work has ben done before on patchign a SuSEsystem to work with SE-Linux, but no one has (yet) gotten very far. I dearly hope to change that... - -- - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE89/3sQ5u80xXOLBcRAgksAJ4lLaPamFTUx/hkhZOJn+lqdv/2uQCfRQKE w5WGBDPonWHvtpiI++rKp00= =YSZC -----END PGP SIGNATURE-----

3 6

IPCHAINS -> IPTABLES on SuSE 7.2
by chemiegott＠gmx.net 01 Jun '02

01 Jun '02

Dear Mailinglist ! On our SuSE 7.2-Webserver has IPCHAINS and SuSEfirewall run. Today I've updated from Kernel 2.2 to 2.4 and replaced IPCHAINS with IPTABLES and SuSEfirewall with SuSEfirwall2. All run very well, but one problem remains. With the old configurations, the Users inside my LAN (IP: 192.168.0.x) were able to connect the server (IP: 192.168.0.100 internal, IP:196.123.22.100 external) directly without a proxy or anything else. With the upgrade this is not possible anymore, but i don't want to change anything on the workstations. Do you have any idea, how the Users inside can reach 196.123.22.100 directy. I've tried it with masquerading, but it doesn't work. Thanx in advance, Michael -- GMX - Die Kommunikationsplattform im Internet. http://www.gmx.net

3 3

template of a tripwire policy file for SuSE 7.3?
by William Bold 31 May '02

31 May '02

Hi, I have been searching on the net, but didn't succedd in finding a tripwire policy file for SuSE 7.3. Although it is recommended to create the policy file according to _your own_ configuration, a good starting point would be a template. Does anybody of you have created something like this or maybe even some scripts that help automate the process of creating a policy file? (The policy creation tool on wiretrip.com's website isn't really useful..) Any help is greatly appreciated. Regards, William B. __________________________________________________ Do You Yahoo!? Yahoo! - Official partner of 2002 FIFA World Cup http://fifaworldcup.yahoo.com

1 0

Re: [suse-security] NSA SELinux
by Matthias Jänichen 31 May '02

31 May '02

At 14:27 31.05.02 +0200, Mark Müller wrote: >We've looked at LIDS, RSBAC and SELinux and decided to give SELinux a >chance. RSBAC is easier to install, but it lacks LSM support and we don't >know where RSBAC is going after Amon has finished its master thesis. RSBAC is OpenSource, so you can continue yourself. There is already a small crew around him so I would not really worry about this. Personally I am sure Amon will keep RSBAC up. I am not exactly uptodate about his plans concerning LSM support. But that should be discussed on his list. You've probably seen the below annoncement. Please feel free to discuss future development on his list and follow the discusion announced below. All I want to do here, is to encourage you to give it a try.. I did and I trust it! Reg. Matthias ---------- Forwarded Message ---------- Subject: [rsbac] The "LIDS versus RSBAC versus MEDUSA DS9" discussion Date: Thu, 30 May 2002 21:31:33 +0200 From: Michal Medvecký <M.Medvecky(a)sh.cvut.cz> To: lids-user(a)lists.sourceforge.net, rsbac(a)rsbac.org, medusa(a)medusa.fornax.sk Hello, we are very proud to invite you to watch and participate the international academic conference OpenWeekend (http://en.openweekend.cz/) held on June 1st on the Czech Technical University (http://www.cvut.cz/) in Prague, Czech republic. The conference will mostly discuss the Linux kernel security. This discussion will include the meeting of the authors of three most significant kernel security patches - Medusa DS9, RSBAC and LIDS - Milan Pikula and Martin Ockajak of Medusa DS9, Amon Ott of RSBAC and Philippe Biondi of LIDS. These guys have never met before. Martin Ockajak and Milan Pikula from MEDUSA DS9 project How can you participate? Whole discussion will be streamed live in the RealMedia format on http://server1.streaming.cesnet.cz:8080/rams/ow2002.ram We will accept questions for tutors on the silcnet (http://silcnet.org) server silcnet.org, channel OW (not #OW!). The english part will start at about 3pm (GMT+2). More info in english at http://en.openweekend.cz/ and in czech - http://www.openweekend.cz/ If anyone would be interested in helping with re-distribution of the signal, please contact me at mailto: misko(a)openweekend.cz Regards, Michal Medvecky Czech technical university, Prague

1 0

System-wide Access Control: how to go about it
by JW 31 May '02

31 May '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Ok, this isn't exactly SuSE specific but it's for a SuSE system, so please bear with me. The reason I'm interestd in SE Linux (Re my previous few posts) is because it was suggested to me that I could use it to control what ports users have access to. I'm a little confused. I've never dealt with this kind of severe security restrictions before and i feel out of my leauge. Here's what I'm trying to do. I have system users who are jailed in a chroot. They will all be running their own system -- i.e. there own software and daemons, but _not_ their own kernel (tit's not VMware or usermode or anything like that) They will each have their own IP address. I have recompiled my kernel to allow common usesr to open ports < 1024 (yes, it works, yes, I'm a little crazy) In my dreams at least, I'd like to be able to prevent all of the following: 1. They cannot access the host filesystem system It's my understanding that on lInux, processes will still be able to access the host system. At least, I got that impression from an article I was reading on FreeBSD jailing, where proccesses _can't_ access the host system. 2. They cannot acess any files anywhere except in their $HOME Basically, something more then just chroot to keep them jailed away. 3. I want to be able to allow/disallow the ports they have access to. 4. I'd like to be able to prevent them from using any IP address but the ones allocated to them. This is currently the worst problem. By default, everything they do (wrt the network) will attempt to use the base ip. Some services like Apache can be set to use only one IP, which helps, and maight be sufficient, but I wish really badly that I could set up somethign in the hosts system that would make it appear as if there's only 1 IP on the system (per user) 5. Processes should not be able to "see" or interact with the host's/other users processes and filesystems. It was suggested to me that SE Linux would allow fine grained controll over things like this, but I'm a little confused after reading some other things. Can anyone offer any other suggestions/advise as to how I should go about this? Have any of you done anything similar before? Would you recommend any other form of system-wide acess control besides SE Linux? All advice, ideas and pointers appreciated. Please don't hesitate to ask for clarification if I did a bad job explaining any particular point (I usually do :-/ ) TIA! - -- - ---------------------------------------------------- Jonathan Wilson System Administrator Cedar Creek Software http://www.cedarcreeksoftware.com -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE89rT6Q5u80xXOLBcRAioZAJ9jdYPbQVBFJVzcy82NwF/SzuXS/gCfWnsj GUYVWZQJUcTex1KoBsmbxx4= =uhLG -----END PGP SIGNATURE-----

5 5

Re: [suse-security] NSA SELinux
by Mark Müller 31 May '02

31 May '02

Matthias Jänichen wrote: > If you need something to use today you should look at www.rsbac.org. > > RSBAC (Role Set Based Access Controll) is _working_ on Suse, > running for over two years on productive systems. We've looked at LIDS, RSBAC and SELinux and decided to give SELinux a chance. RSBAC is easier to install, but it lacks LSM support and we don't know where RSBAC is going after Amon has finished its master thesis. Mark

1 0