April 2006 - openSUSE Security - openSUSE Mailing Lists

Statefull packet inspection in SuSEfirewall2
by pronco＠conae.gov.ar 25 Jul '06

25 Jul '06

Hi, Is it there any way to configure stateful packet inspection rules in SuSEfirewall2 for masquerade networks? When I configure a rule in FW_MASQ_NETS in order to allow traffic from the outside to the DMZ, I also have to configure a rule for responses. Example: Incoming traffic to my web server in a DMZ with private addresses FW_FORWARD_MASQ="0/0,192.168.1.5,tcp,80 I also need to set up the following rules in order to let responses out FW_MASQ_NETS="192.168.1.5/32,0/0,tcp,1024:65535" This rule permits not only established sessions, but additionally it allows my web server to establish connections to the outside world. Dont know why the FW_FORWARD rules are stateful as I want, but FW_MASQ_NETS ones dont. Any suggestion? Is it possible to math the SYN, ACK and FIN TCP bits with SuSEfirewall2? Thanks in advance. Pablo Ronco

4 5

AppArmor in SUSE 10.0
by Malte Gell 08 May '06

08 May '06

Hello, if I understood it correctly the AppArmor version 1.2 of SUSE 10.0 does not allow to create new profiles with the Add Profile Wizard. But when I played with it I found out the command line tool "genprof" actually does allow to generate a new profile and genprof is nothing else than the Yast Wizard, is this right? So I actually can add a new profile using genprof, but just not using the Yast Wizard? BTW, are there Novell/OpenSUSE sites that offer new profiles for download? Thanks Malte

5 10

SuSE 10.0 yast2 vpn module seg faults when importing certs - manual, config?
by Michael Reilly 28 Apr '06

28 Apr '06

I am new to SuSE so if the answers to these questions are well known please point me to the appropriate resource. I have searched but not found anything relevant (maybe I used the wrong search terms). I am attempting to configure my laptop running SuSE 10.0 to setup an IPSec tunnel to my office router (a Cisco) so that I am able to access servers behind the router. I selected the vpn module in yast and imported my key. Then I tried to import the CA certificate in pem format. When I double click on the certificate filename in the dialog box the entire VPN config window goes away. The yast control center window remains. I ran the ipsec module from the command line and this is what I see when the windows disappears - Host:/etc/ipsec/certificates # /sbin/yast2 ipsec Segmentation fault at ipsec/complex.ycp:509 /sbin/yast2: line 209: 22020 Segmentation fault $ybindir/y2base $module "$@ " qt -geometry "$Y2_GEOMETRY" $Y2QT_ARGS Is this a known problem? The certificates were provided by our CA - I manually generated a CSR using openssl and enrolled with our CA. I now have my private key, laptop certificate and CA certificate all in pem format. As an alternative is there a HowTo or similar document to allow me to manually configure openswan to use X.509 certificates and to be able to access the servers at the office? Thanks, michael -- ---- ---- ---- Michael Reilly michaelr(a)cisco.com Cisco Systems, California

1 0

VPN and SuSEfirewall2
by Jonathan Baxter 28 Apr '06

28 Apr '06

Please excuse me if this is not the correct forum for VPN and firewall issues on SuSE. I am trying to setup an ipsec VPN between two private subnets, and I have run into a snag that I cannot resolve. The VPN establishes itself fine, and I can connect from any machine on the right subnet to any machine on the left subnet, but not vice versa. Here's the setup: 192.168.1.0/24===a.a.a.a---b.b.b.b...c.c.c.c---d.d.d.d===192.168.200.0/24 "a.a.a.a" is the external interface of a SuSE 10.0 box which masquerades machines on the internal 192.168.1.0/24 subnet. "b.b.b.b" is its nexthop router. "d.d.d.d" is the external interface of my home linksys AG241 DSL router. "c.c.c.c" is its nexthop router (at the ISP). I have an ipsec, pre-shared key tunnel from a.a.a.a to d.d.d.d. The SuSE box is running it with OpenSwan, the linksys router is just set up via the normal linksys configuration (which may well be OpenSwan under the hood). Everything works fine from right-to-left - ie all machines on the 192.168.200.0 subnet behind the linksys router can see all machines on the 192.168.1.0 subnet behind the SuSE box. But nothing works from left-to right; neither the SuSE router box itself, nor from any machines on the 192.168.1.0 subnet behind it can see any machines on the 192.168.200.0 subnet at the other end of the tunnel. This seems to me like it must be a routing problem, but I can't for the life of me work out how to fix it. I am running SuSEfirewall2 on the SuSE router. I have explicitly enabled forwarding between the two subnets by setting FW_FORWARD in /etc/sysconfig/SuSEfirewall2: FW_FORWARD="192.168.1.0/24,192.168.200.0/24,,,ipsec \ 192.168.200.0/24,192.168.1.0/24,,,ipsec" I have explicitly disabled NAT of packets between the two subnets by adding the following line to the fw_custom_before_port_handling() section of /etc/sysconfig/scripts/SuSEfirewall2-custom: iptables -t nat -A POSTROUTING -o eth2 -s 192.168.1.0/24 -d \! 192.168.200.0/24 -j MASQUERADE the tunnel config in /etc/ipsec.conf looks like: conn net-to-net # Key exchange method authby=secret # Left security gateway, subnet behind it, nexthop toward right. left=a.a.a.a leftsubnet=192.168.1.0/24 leftnexthop=b.b.b.b # Right security gateway, subnet behind it, nexthop toward left. right=d.d.d.d rightsubnet=192.168.200.0/24 rightnexthop=c.c.c.c auto=start Any suggestions? Thanks, Jonathan Baxter

3 7

[Fwd: Re: [suse-security] VPN and SuSEfirewall2]
by Carsten Voigt 27 Apr '06

27 Apr '06

Jonathan, if you ping one interface of a host you can surely reach by another, you might get an answer, even if the host adressed even does not forward anything. You just do really know routers are routing, if something behind router A is reaching something behind router B. -- Kind regards i.A. Carsten Voigt bios ag (hrb-hh 73193) brauhausstieg 15-17 d-22041 hamburg fon +49 40 689 439 0 fax +49 40 689 439 39 cvo(a)bios.de www.bios.de aufsichtsratsvorsitzender: wolfgang borchert vorstand: ulrich kalthoff, heinrich zwiebelmann -------- Original-Nachricht -------- Betreff: Re: [suse-security] VPN and SuSEfirewall2 Datum: Thu, 27 Apr 2006 18:28:57 +0930 Von: Jonathan Baxter <jbaxter(a)panscient.com> An: suse-security(a)suse.com Referenzen: <200604271536.13792.jbaxter(a)panscient.com> <20060427071254.GA16610(a)suse.de> On Thursday 27 April 2006 16:42, Ludwig Nussel wrote: > Jonathan Baxter wrote: > > [...] > > But nothing works from left-to right; neither the SuSE router box > > itself, nor > > The router itself cannot reach the subnet on the other side if you > use it's external IP as source. You'd need a second tunnel for that. I think I understand what you're getting at. If the external IP address is the source address the packets won't get redirected down the tunnel, because the tunnel's source is the internal network. Reproducing the network diagram: 192.168.1.0/24===a.a.a.a---b.b.b.b...c.c.c.c---d.d.d.d===192.168.200.0/24 "a.a.a.a" is the external interface of the problematic SuSE box, 192.168.1.1 is its internal interface. d.d.d.d is the external interface of the linksys router, 192.168.200.1 is the internal interface. With tcpdump on the SuSE router, I see the following when pinging from right to left (192.168.200.2 -> 192.168.1.2): IP 192.168.200.2 > 192.168.1.2: ICMP echo request, id 51223, seq 18, length 64 IP 192.168.200.2 > 192.168.1.2: ICMP echo request, id 51223, seq 18, length 64 IP a.a.a.a > b.b.b.b: ESP(spi=xxx,seq=0x15), length 116 So that works fine (I don't know why there are two decoded lines per ping, but at least it seems correct: ESP packet between the external addresses decoded to the ICMP packet between the internal addresses). However, if I ping the other way (192.168.1.2 -> 192.168.200.2), tcpdump on the SuSE router shows: IP a.a.a.a > 192.168.200.2: ICMP echo request, id 25444, seq 18, length 64 No "ESP" packet. Since the source address is rewritten as "a.a.a.a", does that means the packets from 192.168.1.2 are being masqueraded, which per Ludwig's comment above means they are not being directed down the tunnel? If so, I guess my iptables directive in /etc/sysconfig/scripts/SuSEfirewall2-custom is not working: > > I have explicitly disabled NAT of packets between the two subnets by > > adding the following line to the fw_custom_before_port_handling() section > > of /etc/sysconfig/scripts/SuSEfirewall2-custom: > > > > iptables -t nat -A POSTROUTING -o eth2 -s 192.168.1.0/24 -d \! > > 192.168.200.0/24 -j MASQUERADE > But if I do as Ludwig suggests and set FW_MASQ_NETS="0/0,!192.168.200.0/24" in /etc/sysconfig/SuSEfirewall2 then the firewall drops the packets from 192.168.1.2 altogether - they never make it to the external interface on the SuSE router at all. I get the following in /var/log/firewall: SFW2-FWDint-DROP-DEFLT IN=eth1 OUT=eth2 SRC=192.168.1.2 DST=192.168.200.2 So I guess the left->right packets are not making it down the tunnel, but I am still confused as to why not..... - Jonathan -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

2 1

[Fwd: [suse-security] VPN and SuSEfirewall2]
by Carsten Voigt 27 Apr '06

27 Apr '06

Hi Jonathan, I am not absolutely sure, how to interpret your "A can see B". But it sounds like "Ping from A to B is answered" or "A can see B's samba shares"? In that case to me your problem seems to be at the "linksys"-side. It is a stadard-behaviour of some firewalls, to let everything out of but only authorized things into the local network. Some firewalls provide opportunities, to filter VPN-traffic like that, too. Can it be, the linksys device does have filters, which keep the Linux-side from adressing services needed to "see" things behind the linksys? It is a standard-behaviour of NAT-Routers to translate non-reserved ports proxy-vise (to the internet only the outside interfaces IP of the router is visible). But all services of internal Servers have to be translated from local host IP and Port to Router's outside Interface's IP and Port. Do your really have evidence, your connection "A to B" is going through the IPSec-tunnel? Other possible problems might be, that the Linux-Router-Side can not resolve names or access directory services at the linksys side. If you say "B does not see A" - do you mean, it does not find it by name or by IP? -- Kind Regards i.A. Carsten Voigt bios ag (hrb-hh 73193) brauhausstieg 15-17 d-22041 hamburg fon +49 40 689 439 0 fax +49 40 689 439 39 cvo(a)bios.de www.bios.de aufsichtsratsvorsitzender: wolfgang borchert vorstand: ulrich kalthoff, heinrich zwiebelmann -------- Original-Nachricht -------- Betreff: [suse-security] VPN and SuSEfirewall2 Datum: Thu, 27 Apr 2006 15:36:13 +0930 Von: Jonathan Baxter <jbaxter(a)panscient.com> An: suse-security(a)suse.com Please excuse me if this is not the correct forum for VPN and firewall issues on SuSE. I am trying to setup an ipsec VPN between two private subnets, and I have run into a snag that I cannot resolve. The VPN establishes itself fine, and I can connect from any machine on the right subnet to any machine on the left subnet, but not vice versa. Here's the setup: 192.168.1.0/24===a.a.a.a---b.b.b.b...c.c.c.c---d.d.d.d===192.168.200.0/24 "a.a.a.a" is the external interface of a SuSE 10.0 box which masquerades machines on the internal 192.168.1.0/24 subnet. "b.b.b.b" is its nexthop router. "d.d.d.d" is the external interface of my home linksys AG241 DSL router. "c.c.c.c" is its nexthop router (at the ISP). I have an ipsec, pre-shared key tunnel from a.a.a.a to d.d.d.d. The SuSE box is running it with OpenSwan, the linksys router is just set up via the normal linksys configuration (which may well be OpenSwan under the hood). Everything works fine from right-to-left - ie all machines on the 192.168.200.0 subnet behind the linksys router can see all machines on the 192.168.1.0 subnet behind the SuSE box. But nothing works from left-to right; neither the SuSE router box itself, nor from any machines on the 192.168.1.0 subnet behind it can see any machines on the 192.168.200.0 subnet at the other end of the tunnel. This seems to me like it must be a routing problem, but I can't for the life of me work out how to fix it. I am running SuSEfirewall2 on the SuSE router. I have explicitly enabled forwarding between the two subnets by setting FW_FORWARD in /etc/sysconfig/SuSEfirewall2: FW_FORWARD="192.168.1.0/24,192.168.200.0/24,,,ipsec \ 192.168.200.0/24,192.168.1.0/24,,,ipsec" I have explicitly disabled NAT of packets between the two subnets by adding the following line to the fw_custom_before_port_handling() section of /etc/sysconfig/scripts/SuSEfirewall2-custom: iptables -t nat -A POSTROUTING -o eth2 -s 192.168.1.0/24 -d \! 192.168.200.0/24 -j MASQUERADE the tunnel config in /etc/ipsec.conf looks like: conn net-to-net # Key exchange method authby=secret # Left security gateway, subnet behind it, nexthop toward right. left=a.a.a.a leftsubnet=192.168.1.0/24 leftnexthop=b.b.b.b # Right security gateway, subnet behind it, nexthop toward left. right=d.d.d.d rightsubnet=192.168.200.0/24 rightnexthop=c.c.c.c auto=start Any suggestions? Thanks, Jonathan Baxter -- Check the headers for your unsubscription address For additional commands, e-mail: suse-security-help(a)suse.com Security-related bug reports go to security(a)suse.de, not here

1 0

RE: [suse-security] VPN and SuSEfirewall2
by Thorsten Hahn 27 Apr '06

27 Apr '06

Hi Jonathan, perhaps it will be a good start to enable some debugging and look at the logs - on both sides. Maybe the packets are lost in your SuSE-Box, but I think not, you wouldn't be able to reach 192.168.1.0 from 192.168.200.0 if routing is the problem. Did you check MTU sizes? Perhaps (I don't know b.b.b.b) a.a.a.a sends packets to large and they reach the Linksys fragmented and are dropped (is ping allowed and does it work?) Can you give some more input? Sincerly, Thorsten Hahn

1 0

MozillaFirefox 1.0.8 update for SUSE 10.0
by Malte Gell 23 Apr '06

23 Apr '06

Hi there, just installed MozillaFirefox-1.0.8-0.2.i586.rpm and during the process I got "su: user /dev/null does not exist" Of course /dev/null does exist, a minor bug in a script somehwere? Nevertheless the rpm can be installed. Malte

3 6

load script at boot
by Walter Pabon Guerra 23 Apr '06

23 Apr '06

hi, i need load a script to start suse, how i do ?.... -- Atte. <<_waltico_>> Walter Pabon Guerra "Don't worry, Be Linux..." http://www.utpinux.org http://waltico.utpinux.org http://www.jawservices.net

5 4

Firewall denying outgoing connections?
by Carlos E. R. 14 Apr '06

14 Apr '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 What causes this error in the firewall? Apr 14 17:03:37 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=85.85.72.60 LEN=40 TOS=0x08 PREC=0x00 TTL=64 ID=53126 DF PROTO=TCP SPT=6881 DPT=4712 WINDOW=32767 RES=0x00 ACK URGP=0 Apr 14 17:03:57 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=85.85.72.60 LEN=40 TOS=0x08 PREC=0x00 TTL=64 ID=53548 DF PROTO=TCP SPT=6881 DPT=4712 WINDOW=32767 RES=0x00 ACK URGP=0 Apr 14 17:04:17 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=85.85.72.60 LEN=40 TOS=0x08 PREC=0x00 TTL=64 ID=53840 DF PROTO=TCP SPT=6881 DPT=4712 WINDOW=32767 RES=0x00 ACK URGP=0 Apr 14 17:04:37 nimrodel kernel: SFW2-OUT-ERROR IN= OUT=eth0 SRC=192.168.1.12 DST=85.85.72.60 LEN=40 TOS=0x08 PREC=0x00 TTL=64 ID=54228 DF PROTO=TCP SPT=6881 DPT=4712 WINDOW=32767 RES=0x00 ACK URGP=0 Why am I denied outgoing access to some ports now and then? These seem to be triggered by bttorrent downloading the RC1, but I also get some to port 80. At the moment, dozens like the log entry above. port 6881 is allowed entry in the config: FW_SERVICES_EXT_TCP="6881:6889" - -- Cheers, Carlos Robinson -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Made with pgp4pine 1.76 iD8DBQFEP7qbtTMYHG2NR9URAhFtAJ48MvbrCMKjutgoJ9gHCeUs8ElONwCfTrGj i4PJS6b+KLMEChJSXp2KmSg= =RrDm -----END PGP SIGNATURE-----

3 4