February 2001 - main

Re: [Alug] Firewall/Local network problem
by Barry Samuels 14 Feb '01

14 Feb '01

Laurie Brown <laurie(a)brownowl.com> wrote: > Barry Samuels wrote: > > > > I have a firewall set up on my machine which was put in place > by > > PMFirewall. Very easy for people like me who cannot > understand > > ipchains or its documentation. > > > > However it has left me with a small problem. When running > the > > PMFirewall setup it asks if my local network needs access to > the > > internet. I answered 'No' on the basis that only one machine > > needs access. Now I find that when the firewall is running > > machines on the local network are denied access to the > machine > > running the firewall. > > > > Can some clever firewall guru tell me what to alter to give > > access to this machine from the local network when the > firewall > > is running. These other machines do not need to access the > > Internet. > > > > As an aside I'm still hoping for a meeting somewhere near me > (10 > > miles South East of Colchester). > > > > Best wishes to all. > > > > Barry Samuels > > You'll need to post the script that set up the firewall, so we > can see > what's being set. Try "ipchains -L>file.name" and post > file.name to the > list, for a start. > > Cheers, Laurie. Below are the scripts set up by PMFirewall: =============================================================== #!/bin/sh # pmfirewall.conf - used by pmfirewall package IPCHAINS=/sbin/ipchains ATBOOT=0 CONFIG_DIR=/usr/local/pmfirewall OUTERIF=ppp0 REMOTENET=0/0 OUTERIP=`ifconfig $OUTERIF | grep inet | cut -d : -f 2 | cut -d \ -f 1` OUTERMASK=`ifconfig $OUTERIF | grep Mas | cut -d : -f 4` OUTERNET=$OUTERIP/$OUTERMASK =============================================================== #!/bin/sh # pmfirewall.rules.1 used by pmfirewall package # #### Start Firewall #### ## Allow loopback interface $IPCHAINS -A input -i lo -s 0/0 -d 0/0 -j ACCEPT $IPCHAINS -A output -i lo -s 0/0 -d 0/0 -j ACCEPT # Allow packets with ack bit set, they are from an established connection. $IPCHAINS -A input ! -y -p tcp -s $REMOTENET -d $OUTERNET -j ACCEPT # Block incoming IP Spoofing # Turn on Source Address Verification if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ] then for f in /proc/sys/net/ipv4/conf/*/rp_filter do echo 1 > $f done fi #Turn on SYN COOKIES PROTECTION (Thanks Holger!) if [ -e /proc/sys/net/ipv4/tcp_syncookies ] then echo 1 > /proc/sys/net/ipv4/tcp_syncookies fi # Now read pmfirewall.rules.local =============================================================== #!/bin/sh # pmfirewall.rules.local # ver.PM1 (do not remove this line) ### BEGIN SYSTEM DEFAULTS ### # Block Nonroutable IP's from entering on the External Interface $IPCHAINS -A input -j DENY -s 10.0.0.0/8 -d $OUTERNET -i $OUTERIF $IPCHAINS -A input -j DENY -s 127.0.0.0/8 -d $OUTERNET -i $OUTERIF $IPCHAINS -A input -j DENY -s 172.16.0.0/12 -d $OUTERNET -i $OUTERIF $IPCHAINS -A input -j DENY -s 192.168.0.0/16 -d $OUTERNET -i $OUTERIF # - Specific port blocks on the external interface - # This section blocks off ports/services to the outside that have # vulnerabilities. This will not affect the ability to use these services # within your network. # # Back Orifice (logged) $IPCHAINS -A input -p tcp -s $REMOTENET -d $OUTERNET 31337 -j DENY -l $IPCHAINS -A input -p udp -s $REMOTENET -d $OUTERNET 31337 -j DENY -l # NetBus (logged) $IPCHAINS -A input -p tcp -s $REMOTENET -d $OUTERNET 12345:12346 -j DENY -l $IPCHAINS -A input -p udp -s $REMOTENET -d $OUTERNET 12345:12346 -j DENY -l # Trin00 (logged) $IPCHAINS -A input -p tcp -s $REMOTENET -d $OUTERNET 1524 -j DENY -l $IPCHAINS -A input -p tcp -s $REMOTENET -d $OUTERNET 27665 -j DENY -l $IPCHAINS -A input -p udp -s $REMOTENET -d $OUTERNET 27444 -j DENY -l $IPCHAINS -A input -p udp -s $REMOTENET -d $OUTERNET 31335 -j DENY -l # Multicast $IPCHAINS -A input -s 224.0.0.0/8 -d $REMOTENET -j DENY $IPCHAINS -A input -s $REMOTENET -d 224.0.0.0/8 -j DENY ### END SYSTEM DEFAULTS ### #### EXAMPLES ### ### ALLOWED NETWORKS # Add in any rules to specifically allow connections from hosts/nets that # would otherwise be blocked. #$IPCHAINS -A input -s [trusted host/net] -d $OUTERNET <ports> -j ACCEPT ### BLOCKED NETWORKS # Add in any rules to specifically block connections from hosts/nets that # have been known to cause problems. These packets are logged. #$IPCHAINS -A input -s [banned host/net] -d $OUTERNET <ports> -j DENY -l ### BLOCK ICMP ATTACKS # #$IPCHAINS -A input -b -i $OUTERIF -p icmp -s [host/net] -d $OUTERNET -j DENY -l #### END OF EXAMPLES ### ### AUTOMATICALLY GENERATED BY THE INSTALL SCRIPT ### #DHCP CLIENT BLOCK $IPCHAINS -A input -p udp -s $REMOTENET -d $REMOTENET 67:68 -i $OUTERIF -j DENY #IDENTD $IPCHAINS -A input -p tcp -s $REMOTENET -d $OUTERNET 113 -j REJECT $IPCHAINS -A input -p udp -s $REMOTENET -d $OUTERNET 113 -j REJECT #NETBIOS $IPCHAINS -A input -p tcp -s $REMOTENET -d $REMOTENET 137:139 -i $OUTERIF -j DENY $IPCHAINS -A input -p udp -s $REMOTENET -d $REMOTENET 137:139 -i $OUTERIF -j DENY #RIP $IPCHAINS -A input -p udp -s $REMOTENET -d $REMOTENET 520 -i $OUTERIF -j REJECT #NFS $IPCHAINS -A input -p tcp -s $REMOTENET -d $REMOTENET 2049 -i $OUTERIF -j DENY -l $IPCHAINS -A input -p udp -s $REMOTENET -d $REMOTENET 2049 -i $OUTERIF -j DENY -l #XSERVER $IPCHAINS -A input -p tcp -s $REMOTENET -d $REMOTENET 5999:6003 -i $OUTERIF -j DENY $IPCHAINS -A input -p udp -s $REMOTENET -d $REMOTENET 5999:6003 -i $OUTERIF -j DENY =============================================================== #!/bin/sh #pmfirewall.rules.masq - used by pmfirewall package # ## Masquerading ## Modules to help certain services /sbin/depmod -a >/dev/null 2>&1 /sbin/modprobe ip_masq_ftp >/dev/null 2>&1 /sbin/modprobe ip_masq_raudio >/dev/null 2>&1 /sbin/modprobe ip_masq_irc >/dev/null 2>&1 /sbin/modprobe ip_masq_icq >/dev/null 2>&1 /sbin/modprobe ip_masq_quake >/dev/null 2>&1 /sbin/modprobe ip_masq_user >/dev/null 2>&1 /sbin/modprobe ip_masq_vdolive >/dev/null 2>&1 ## Masquerading firewall timeouts: tcp conns 8hrs, tcp after fin pkt 60s, udp 10min $IPCHAINS -M -S 14400 60 600 ## Set up kernel to enable IP masquerading echo 1 > /proc/sys/net/ipv4/ip_forward ## Set up kernel to handle dynamic IP masquerading echo 1 > /proc/sys/net/ipv4/ip_dynaddr ## Don't Masquerade internal-internal traffic $IPCHAINS -A forward -s $INTERNALNET -d $INTERNALNET -j ACCEPT ## Don't Masquerade external interface direct $IPCHAINS -A forward -s $OUTERNET -d $REMOTENET -j ACCEPT ## Masquerade all internal IP's going outside $IPCHAINS -A forward -s $INTERNALNET -d $REMOTENET -j MASQ ## Set Default rule on MASQ chain to Deny $IPCHAINS -P forward DENY ## Allow all connections from the network to the outside $IPCHAINS -A input -s $INTERNALNET -d $REMOTENET -j ACCEPT $IPCHAINS -A output -s $INTERNALNET -d $REMOTENET -j ACCEPT # This section manipulates the Type Of Service (TOS) bits of the # packet. For this to work, you must have CONFIG_IP_ROUTE_TOS enabled # in your kernel # Set telnet, www, smtp, pop3 and FTP for minimum delay $IPCHAINS -A output -p tcp -d 0/0 80 -t 0x01 0x10 $IPCHAINS -A output -p tcp -d 0/0 22 -t 0x01 0x10 $IPCHAINS -A output -p tcp -d 0/0 23 -t 0x01 0x10 $IPCHAINS -A output -p tcp -d 0/0 21 -t 0x01 0x10 $IPCHAINS -A output -p tcp -d 0/0 110 -t 0x01 0x10 $IPCHAINS -A output -p tcp -d 0/0 25 -t 0x01 0x10 # Set ftp-data for maximum throughput $IPCHAINS -A output -p tcp -d 0/0 20 -t 0x01 0x08 # Allow outgoing ICMP $IPCHAINS -A output -p icmp -s $INTERNALNET -d $REMOTENET -j ACCEPT =============================================================== Thats the lot. I've included the masquerading although I don't use masquerading. I didn't know whether it would be important or not. I hope it all makes sense to somebody. Barry Samuels

1 0

Firewall/Local network problem
by Barry Samuels 14 Feb '01

14 Feb '01

I have a firewall set up on my machine which was put in place by PMFirewall. Very easy for people like me who cannot understand ipchains or its documentation. However it has left me with a small problem. When running the PMFirewall setup it asks if my local network needs access to the internet. I answered 'No' on the basis that only one machine needs access. Now I find that when the firewall is running machines on the local network are denied access to the machine running the firewall. Can some clever firewall guru tell me what to alter to give access to this machine from the local network when the firewall is running. These other machines do not need to access the Internet. As an aside I'm still hoping for a meeting somewhere near me (10 miles South East of Colchester). Best wishes to all. Barry Samuels

1 0

Picky ?!!!
by Simon Parkes 14 Feb '01

14 Feb '01

Don't mean to be picky here, but on the alug website it says that the next meeting in in the year 2000 ?? I know it was a leap year but.... Simon

7 8

RE: [Alug] NFS Install probs.
by Corner Paul 13 Feb '01

13 Feb '01

Thanks Steve. The kernel was compiled on one machine. Most of the RPMs collected from various sources - the rest built 'in house'. The whole lot put together on another machine...mmmm..... I will check the lilo version tonight. Regards, Paul. > -----Original Message----- > From: Steve Fosdick [SMTP:fozzy@pelvoux.demon.co.uk] > Sent: 12 February 2001 23:23 > To: 'A. Lug' > Subject: Re: [Alug] NFS Install probs. > > I get an error message "crc error --system halted--". > > From a quick look at the kernel source it looks as if this error comes > from a module called inflate.c which is used to uncompress the kernel > image once it has been loaded into memory. > > The most likely cause of the message therefore is the compressed > kernel image as loaded into memory being corrupt and in the case of a > kernel being loaded from hard disk the most likely cause of that is > the LILO kernel image map being out of date so LILO loads the wrong > disk blocks. >

1 0

NFS Install probs.
by Corner Paul 12 Feb '01

12 Feb '01

Quietly lurking, I have hit a small problem with an NFS install on a distro I'm compiling. Assembling all the RPM's on the server along with the install shell, everything seemed to be going fine - The early NFS installs of just the base packages worked a treat and the machine would boot up without a problem..... Now I have the bulk of the programs put together for this distro - When I do an NFS install, it all goes as I expect. But on booting up the new machine, lilo does what it should, the kernel starts to load, then trouble. I get an error message "crc error --system halted--". This is before any of the system checks or init scripts are run. I'm rather stumped as to what the problem is, any ideas folk ?? Regards, Paul.

2 1

Re: [Alug] Fw: Very Important New Lethal Virus
by MJ Ray 12 Feb '01

12 Feb '01

Toby Jaffey <toby(a)earth.li> writes: > Ha! I laugh in the face of VBS mail viruses. > User-Agent: Mutt/1.3.12i As will most people here. Kindly refrain from posting security alerts to this mailing list, even those about Linux but *especially* those for Windows. If anyone has the expertise to verify and compile alerts, please share your skills with the wider community on a bigger dedicated security list. As for we mere mortals, I suggest everyone subscribes to a dedicated alert mailing list, eg those at www.linuxsecurity.com -- MJR

1 0

Fw: Very Important New Lethal Virus
by Simon Parkes 12 Feb '01

12 Feb '01

Thought you'd like to be aware of this one..... Simon ----- Original Message ----- From: Nadeen Abdel-Khalek <Nadeen(a)securitypartnerships.co.uk> To: Dan Harris <dharris(a)securitypartnerships.co.uk>; Dan Harris <dharris(a)securitypartnerships.co.uk> Sent: Monday, February 12, 2001 5:51 PM Subject: Very Important New Lethal Virus > > Just Detected... > ...Harmful Virus in the form a VBS. Please see details below. THIS IS BIGGER > THAN THE LOVE BUG. > Thus far, a patch has not been created, but is being developed. The only way > to block it at the moment is with MAILSweeper, creating a manual text > analysis for the word KOURNIKOVA. > If your organisation uses MAILSweeper, please contact us for any advice, and > if you require our helping in setting up the manual text analysis. > > Information on "Anna Kournikova" virus > The virus analysts at Sophos have received a number of calls regarding a new > in-the-wild virus known as VBS/SST-A (also known as Kalamar or Calamar). The > virus fools users into thinking it is a jpeg picture of Russian tennis > player, Anna Kournikova. It does this by sending itself as an attached file > called AnnaKournikova.jpg.vbs. > This Visual Basic Script worm forwards itself to addresses in your Outlook > address book. The virus can use the subject line "Here you have" in this > email. > Sophos researchers are analysing the virus and will release an IDE file > </downloads/ide/> later today. > Sophos recommends customers subscribe </virusinfo/notifications/> to our > email notification service for new viruses discovered in the wild. > > > > Regards, > Nadeen Abdel-Khalek > 0118 902 7849 > > > ********************************************************************** > This email and any files transmitted with it are confidential and > intended solely for the use of the individual or entity to whom they > are addressed. If you have received this email in error please notify > the system manager. > > This footnote also confirms that this email message has been swept by > MIMEsweeper for the presence of computer viruses. > > www.mimesweeper.com > **********************************************************************

2 1

Introduction message about merville and a plea for help [Rob Somerville]
by me＠merville.net 10 Feb '01

10 Feb '01

Hello all. I don't know if I am a Linux newbie or not [If you can compile kernels OK are you a newbie ???] but I have been using Linux for over a year now and am very, very impressed. I try and use Linux instead of MS whenever possible. Unfortunately I have to use MS as well and I boot Win 2000, DOS and Redhat quite happily on my PC. I work as a senior tech support specialist and I also have a good grounding in electronics. Reason for joining ALUG ? Apart from living in Mileham, I think meeting some experienced users would be good as it will knock a good chunk of Microsoft out of me !!! Of course, I will be happy to contribute my limited Linux knowledge but I realise there are lots of far more experienced people then me out there ... Oh yes, and I have a real nasty problem with a Promise Fasttrak controller module that I cannot compile against the vanilla RH6.2 2.2.x kernel or the latest 2.4.x kernel release. Promise support is naff, and they only distribute the SMP module in .o format ... I can boot the box OK as Linux is on a standard IDE drive, but it bombs when insmod tries to load ft.o for the RAID drive with unresolved symbols. I can install ft.o fine on a clean install using the 'expert text dd' options, and mount drives etc. but when I recompile the kernel [I need NTFS support] I get unresolved symbols. Using the insmod -f option does not allow the module to load. I am including SCSI and RAID support in the kernel. I have also checked the symbol versioning : mv .config 000.cfg make mrproper mv 000.cfg .config make dep clean modules modules_install bzImage As I cannot get the source to this module am I doomed to having no NTFS support ? Any suggestions, comments, brickbats etc. more than welcome. Thanks.

3 2

Re: [Alug] Introduction message about merville and a plea for help [Rob Somerville]
by MJ Ray 10 Feb '01

10 Feb '01

<me(a)merville.net> writes: > on a standard IDE drive, but it bombs when insmod tries to load ft.o for the Bombs? And why use insmod instead of modprobe? That's Mileham, Norfolk, right? Nice place. -- MJR

1 0

Re: [Alug] Samba Saga Volume Three
by MJ Ray 10 Feb '01

10 Feb '01

Jenny_Hopkins(a)toby-churchill.com writes: > Hope I'm not bugging anyone making all these posts on one topic, BTW, not > sure what the etiquette is as this is my first mailing group. :-) Let me > know if I am! Nah, as long as the subject line keeps up with the topic being discussed, I don't think anyone minds. Things like this where it may well come to someone having to pay a visit are probably best off here, but sometimes it's better to ask questions in uk.comp.os.linux, as more eyeballs makes shallower problems. -- MJR

1 0