Re: [Security-Discuss] 2007.0 shorewall & ifw problem (bug?)
Antonio <[email protected]> Fri, 5 Jan 2007 14:13:55 +0100
| Newsgroups | gmane.linux.mandrake.security.general |
|---|---|
| Message-ID | <[email protected]> |
I've diggled a bit more about the subject, and I have some details to add. About problem 1) (interactive firewall seem not working): If I delete the saved config with "shorewall forget", at the following reboot shorewall is started fine, and I can read this in syslog: kernel: netfilter PSD loaded - (c) astaro AG kernel: IFWLOG: register target logger: Shorewall started ... but even with PSD and IFWLOG module loaded, shorewall and mandi running, net_applet doesn't show any alert if I scan my machine from another machine with nmap ... Am I doing something wrong? Is outside there anyone who has a working interactive firewall that can help? About problem 2) (shorewall error when started from a saved config): I think this is a bug, see the output of a series of subsequent commands on my console, but before let me rant a bit about one thing: I found that shorewall version that comes with mandriva 2007.0 is 3.2.3. According to the shorewall website, current stable release is 3.2.7, and a lot of bug have been fixed since 3.2.3. Now, since shorewall is the choice of mandriva for configure a netfilter firewall, shouldn't bugfixes for shorewall considered security updates? I can find shorewall 3.2.6 on cooker but well, cooker isn't 2007 official. # shorewall clear # shorewall -vv -f start Restoring Shorewall... Processing /etc/shorewall/params ... iptables-restore v1.3.5: Set ifw_wl doesn't exist. Error occurred at line: 86 Try `iptables-restore -h' or 'iptables-restore --help' for more information. iptables: Index of insertion too big Shorewall restored from /var/lib/shorewall/restore (shorewall at this point is not running, shorewall status reports it is stopped; notice the error reported by iptables: index of insertion too big. There should be a bug in shorewall when saving a working config) # iptables -nL Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain Ifw (0 references) target prot opt source destination RETURN all -- 0.0.0.0/0 0.0.0.0/0 set ifw_wl src DROP all -- 0.0.0.0/0 0.0.0.0/0 set ifw_bl src IFWLOG all -- 0.0.0.0/0 0.0.0.0/0 state INVALID,NEW psd weight-threshold: 10 delay-threshold: 10000 lo-ports-weight: 2 hi-ports-weight: 1 IFWLOG prefix 'SCAN' (this is the whole output of iptables -nL) # shorewall -vv -f start Restoring Shorewall... Processing /etc/shorewall/params ... iptables: Chain already exists ipset v2.2.9: Set already exists ipset v2.2.9: Set already exists Shorewall restored from /var/lib/shorewall/restore (Surprisingly issuing one more time the same command (shorewall -vv -f start) makes shorewall running, but with a "dirty" config, notice the iptables complain about chain that already exists) # iptables -nL Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 Ifw all -- 0.0.0.0/0 0.0.0.0/0 Ifw all -- 0.0.0.0/0 0.0.0.0/0 eth0_in all -- 0.0.0.0/0 0.0.0.0/0 Reject all -- 0.0.0.0/0 0.0.0.0/0 LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 6 prefix `Shorewall:INPUT:REJECT:' reject all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy DROP) target prot opt source destination eth0_fwd all -- 0.0.0.0/0 0.0.0.0/0 Reject all -- 0.0.0.0/0 0.0.0.0/0 LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 6 prefix `Shorewall:FORWARD:REJECT:' reject all -- 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy DROP) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 fw2gw all -- 0.0.0.0/0 192.168.17.100 policy match dir out pol none fw2net all -- 0.0.0.0/0 0.0.0.0/0 policy match dir out pol none Reject all -- 0.0.0.0/0 0.0.0.0/0 LOG all -- 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 6 prefix `Shorewall:OUTPUT:REJECT:' reject all -- 0.0.0.0/0 0.0.0.0/0 Chain Drop (1 references) target prot opt source destination reject tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:113 dropBcast all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 3 code 4 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 11 dropInvalid all -- 0.0.0.0/0 0.0.0.0/0 DROP udp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 135,445 DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpts:137:139 DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:137 dpts:1024:65535 DROP tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 135,139,445 DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:1900 dropNotSyn tcp -- 0.0.0.0/0 0.0.0.0/0 DROP udp -- 0.0.0.0/0 0.0.0.0/0 udp spt:53 Chain Ifw (2 references) target prot opt source destination RETURN all -- 0.0.0.0/0 0.0.0.0/0 set ifw_wl src DROP all -- 0.0.0.0/0 0.0.0.0/0 set ifw_bl src IFWLOG all -- 0.0.0.0/0 0.0.0.0/0 state INVALID,NEW psd weight-threshold: 10 delay-threshold: 10000 lo-ports-weight: 2 hi-ports-weight: 1 IFWLOG prefix 'SCAN' RETURN all -- 0.0.0.0/0 0.0.0.0/0 set ifw_wl src DROP all -- 0.0.0.0/0 0.0.0.0/0 set ifw_bl src IFWLOG all -- 0.0.0.0/0 0.0.0.0/0 state INVALID,NEW psd weight-threshold: 10 delay-threshold: 10000 lo-ports-weight: 2 hi-ports-weight: 1 IFWLOG prefix 'SCAN' ----cutted (this isn't the whole output of iptables -nL, but I cutted here since the other part is long and not related to the problem) I think at this point it is needed to check if this bug is still there in the latest release of shorewall, and if yes then report the bug to the shorewall mantainer. Antonio. ____________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://store.mandriva.com Join the Club : http://www.mandrivaclub.com ____________________________________________________