freebsd-security Digest, Vol 70, Issue 3
freebsd-secu...@freebsd.org
freebsd-...@freebsd.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freebsd.org/mailman/listinfo/freebsd-security
or, via email, send a message with subject or body 'help' to
freebsd-secu...@freebsd.org
You can reach the person managing the list at
freebsd-sec...@freebsd.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of freebsd-security digest..."
Today's Topics:
1. Ipfw config (Nick Twaddell)
2. Ipfw config (Nick Twaddell)
3. Re: Ipfw config (Nigel Houghton)
4. Re: Cisco IOS and racoon (Nickolay A. Kritsky)
----------------------------------------------------------------------
Message: 1
Date: Wed, 28 Jul 2004 12:36:02 -0700
From: "Nick Twaddell" <ni...@webspacesolutions.com>
Subject: Ipfw config
To: <freebsd-...@freebsd.org>
Message-ID:
<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAKmEo4qg7...@webspacesolutions.com>
Content-Type: text/plain; charset="US-ASCII"
If someone has some free time, can you go over my ipfw config. See if I
have any problems, or things i should add. Im not an ipfw expert or
anything. Here is the config.
add 100 allow all from any to any via lo0
add 110 deny log all from any to 127.0.0.0/8
add 120 deny log ip from 127.0.0.0/8 to any
add 00200 check-state
add 00250 deny all from any to any frag in via bge0
add 00260 deny tcp from any to any established in via bge0
###### outbound section ######
## standard http ##
add 00300 allow tcp from any to any 80 out via bge0 setup keep-state
## secure https ##
add 00301 allow tcp from any to any 443 out via bge0 setup keep-state
## dns ##
add 00310 allow tcp from any to any 53 out via bge0 setup keep-state
add 00311 allow udp from any to any 53 out via bge0 keep-state
## pop & smtp ##
add 00330 allow tcp from any to any 25 out via bge0 setup keep-state
add 00331 allow tcp from any to any 110 out via bge0 setup keep-state
## give root all ##
add 00340 allow tcp from me to any out via bge0 setup uid root keep-state
## ftp with passive ports ##
add 00375 allow tcp from me to any 21 out via bge0 setup keep-state
add 00376 allow tcp from me to any 49152-65535 out via bge0 setup keep-state
## ssh ##
add 00380 allow tcp from any to any 22 out via bge0 setup keep-state
## ntp ##
add 00390 allow tcp from any to any 123 out via bge0 setup keep-state
add 00391 allow udp from any to any 123 out via bge0 keep-state
## ident ##
add 00400 allow tcp from any to any 113 out via bge0 setup keep-state
add 00401 allow udp from any to any 113 out via bge0 keep-state
## whois ##
add 00410 allow tcp from any to any 43 out via bge0 setup keep-state
## snmp ##
add 00420 allow udp from any to any 161 out via bge0 keep-state
## finger ##
add 00430 allow tcp from any to any 79 out via bge0 setup keep-state
add 00431 allow udp from any to any 79 out via bge0 keep-state
###### inbound section #######
## standard http ##
add 00600 allow tcp from any to any 80 in via bge0 setup keep-state
## secure https ##
add 00601 allow tcp from any to any 443 in via bge0 setup keep-state
## dns ##
add 00611 allow udp from any to me 53 in via bge0 keep-state
add 00612 allow tcp from any to me dst-port 53 in via bge0 setup keep-state
## pop & smtp ##
add 00630 allow tcp from any to me 25 in via bge0 setup keep-state
add 00631 allow tcp from any to me 110 in via bge0 setup keep-state
## imap ##
add 00635 allow tcp from any to me 143 in via bge0 setup keep-state
## ftp ##
add 00640 allow tcp from any to me 21 in via bge0 setup keep-state
add 00641 allow tcp from any to me 49152-65535 in via bge0 setup keep-state
#add 00641 allow tcp from any 20 to any 1024-49151 out via bge0 setup
keep-state
## ssh ##
add 00660 allow tcp from any to me 22 in via bge0 setup keep-state
## snmp ##
add 00690 allow udp from any to me 161 in via bge0 keep-state
## razor ##
add 00695 allow tcp from me to any dst-port 2703 out via bge0 setup
keep-state
###### ICMP ######
## Allow out & in console traceroot command ##
add 00700 allow udp from me to any 33435-33500 out via bge0 keep-state
add 00701 allow log icmp from any to me icmptype 3,11 in via bge0 limit
src-addr 2
## ping out ##
add 00710 allow icmp from any to any out via bge0 keep-state
## ping in ##
add 00720 allow log icmp from any to me icmptype 0,8 in via bge0
## This sends a RESET to all ident packets ##
add 00730 reset log tcp from any to me 113 in via bge0 limit src-addr 4
## Stop & log external redirect requests ##
add 00740 deny log icmp from any to any icmptype 5 in via bge0
## Stop & log spoofing Attack attempts ##
add 00750 deny log ip from me to me in via bge0
## Stop & log ping echo attacks ##
add 00760 deny log icmp from any to me icmptype 0,8 in via bge0
###### Everything Else #####
## Reject & Log all setup of tcp incoming connections from the outside ##
add 00770 deny log tcp from any to any setup in via bge0
## Reject all port 80 http packets that fall through to here ##
add 00780 deny tcp from any to any 80 out via bge0
## Everything else is denied by default ##
add 00790 deny log logamount 500 all from any to any
Thanks
Nick
------------------------------
Message: 2
Date: Wed, 28 Jul 2004 12:38:56 -0700
From: "Nick Twaddell" <ni...@webspacesolutions.com>
Subject: Ipfw config
To: <freebsd-...@freebsd.org>
Message-ID:
<!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAKmEo4qg7...@webspacesolutions.com>
Content-Type: text/plain; charset="US-ASCII"
That last email got a little garbled, I forgot to take it off of html :)
add 100 allow all from any to any via lo0
add 110 deny log all from any to 127.0.0.0/8
add 120 deny log ip from 127.0.0.0/8 to any
add 00200 check-state
add 00250 deny all from any to any frag in via bge0
add 00260 deny tcp from any to any established in via bge0
###### outbound section ######
## standard http ##
add 00300 allow tcp from any to any 80 out via bge0 setup keep-state
## secure https ##
add 00301 allow tcp from any to any 443 out via bge0 setup keep-state
## dns ##
add 00310 allow tcp from any to any 53 out via bge0 setup keep-state
add 00311 allow udp from any to any 53 out via bge0 keep-state
## pop & smtp ##
add 00330 allow tcp from any to any 25 out via bge0 setup keep-state
add 00331 allow tcp from any to any 110 out via bge0 setup keep-state
## give root all ##
add 00340 allow tcp from me to any out via bge0 setup uid root keep-state
## ftp with passive ports ##
add 00375 allow tcp from me to any 21 out via bge0 setup keep-state
add 00376 allow tcp from me to any 49152-65535 out via bge0 setup keep-state
## ssh ##
add 00380 allow tcp from any to any 22 out via bge0 setup keep-state
## ntp ##
add 00390 allow tcp from any to any 123 out via bge0 setup keep-state
add 00391 allow udp from any to any 123 out via bge0 keep-state
## ident ##
add 00400 allow tcp from any to any 113 out via bge0 setup keep-state
add 00401 allow udp from any to any 113 out via bge0 keep-state
## whois ##
add 00410 allow tcp from any to any 43 out via bge0 setup keep-state
## snmp ##
add 00420 allow udp from any to any 161 out via bge0 keep-state
## finger ##
add 00430 allow tcp from any to any 79 out via bge0 setup keep-state
add 00431 allow udp from any to any 79 out via bge0 keep-state
###### inbound section #######
## standard http ##
add 00600 allow tcp from any to any 80 in via bge0 setup keep-state
## secure https ##
add 00601 allow tcp from any to any 443 in via bge0 setup keep-state
## dns ##
add 00611 allow udp from any to me 53 in via bge0 keep-state
add 00612 allow tcp from any to me dst-port 53 in via bge0 setup keep-state
## pop & smtp ##
add 00630 allow tcp from any to me 25 in via bge0 setup keep-state
add 00631 allow tcp from any to me 110 in via bge0 setup keep-state
## imap ##
add 00635 allow tcp from any to me 143 in via bge0 setup keep-state
## ftp ##
add 00640 allow tcp from any to me 21 in via bge0 setup keep-state
add 00641 allow tcp from any to me 49152-65535 in via bge0 setup keep-state
#add 00641 allow tcp from any 20 to any 1024-49151 out via bge0 setup
keep-state
## ssh ##
add 00660 allow tcp from any to me 22 in via bge0 setup keep-state
## snmp ##
add 00690 allow udp from any to me 161 in via bge0 keep-state
## razor ##
add 00695 allow tcp from me to any dst-port 2703 out via bge0 setup
keep-state
###### ICMP ######
## Allow out & in console traceroot command ##
add 00700 allow udp from me to any 33435-33500 out via bge0 keep-state
add 00701 allow log icmp from any to me icmptype 3,11 in via bge0 limit
src-addr 2
## ping out ##
add 00710 allow icmp from any to any out via bge0 keep-state
## ping in ##
add 00720 allow log icmp from any to me icmptype 0,8 in via bge0
## This sends a RESET to all ident packets ##
add 00730 reset log tcp from any to me 113 in via bge0 limit src-addr 4
## Stop & log external redirect requests ##
add 00740 deny log icmp from any to any icmptype 5 in via bge0
## Stop & log spoofing Attack attempts ##
add 00750 deny log ip from me to me in via bge0
## Stop & log ping echo attacks ##
add 00760 deny log icmp from any to me icmptype 0,8 in via bge0
###### Everything Else #####
## Reject & Log all setup of tcp incoming connections from the outside ##
add 00770 deny log tcp from any to any setup in via bge0
## Reject all port 80 http packets that fall through to here ##
add 00780 deny tcp from any to any 80 out via bge0
## Everything else is denied by default ##
add 00790 deny log logamount 500 all from any to any
This should work
------------------------------
Message: 3
Date: Wed, 28 Jul 2004 15:36:51 -0400
From: Nigel Houghton <ni...@sourcefire.com>
Subject: Re: Ipfw config
To: freebsd-...@freebsd.org
Message-ID: <2004072819...@enterprise.sfeng.sourcefire.com>
Content-Type: text/plain; charset=us-ascii
Without knowing what the purpose of this machine is, there is nothing to
say other than if your syntax is correct or not. Something you will find
out when you try to load the rules.
Also, this list really isn't meant for asking these types of configuration
questions.
On 0, Nick Twaddell <ni...@webspacesolutions.com> allegedly wrote:
> If someone has some free time, can you go over my ipfw config. See if I
> have any problems, or things i should add. Im not an ipfw expert or
> anything. Here is the config.
>
> add 100 allow all from any to any via lo0
> add 110 deny log all from any to 127.0.0.0/8
> add 120 deny log ip from 127.0.0.0/8 to any
>
> add 00200 check-state
>
> add 00250 deny all from any to any frag in via bge0
>
> add 00260 deny tcp from any to any established in via bge0
>
> ###### outbound section ######
> ## standard http ##
> add 00300 allow tcp from any to any 80 out via bge0 setup keep-state
> ## secure https ##
> add 00301 allow tcp from any to any 443 out via bge0 setup keep-state
> ## dns ##
> add 00310 allow tcp from any to any 53 out via bge0 setup keep-state
> add 00311 allow udp from any to any 53 out via bge0 keep-state
> ## pop & smtp ##
> add 00330 allow tcp from any to any 25 out via bge0 setup keep-state
> add 00331 allow tcp from any to any 110 out via bge0 setup keep-state
> ## give root all ##
> add 00340 allow tcp from me to any out via bge0 setup uid root keep-state
> ## ftp with passive ports ##
> add 00375 allow tcp from me to any 21 out via bge0 setup keep-state
> add 00376 allow tcp from me to any 49152-65535 out via bge0 setup keep-state
> ## ssh ##
> add 00380 allow tcp from any to any 22 out via bge0 setup keep-state
> ## ntp ##
> add 00390 allow tcp from any to any 123 out via bge0 setup keep-state
> add 00391 allow udp from any to any 123 out via bge0 keep-state
> ## ident ##
> add 00400 allow tcp from any to any 113 out via bge0 setup keep-state
> add 00401 allow udp from any to any 113 out via bge0 keep-state
> ## whois ##
> add 00410 allow tcp from any to any 43 out via bge0 setup keep-state
> ## snmp ##
> add 00420 allow udp from any to any 161 out via bge0 keep-state
> ## finger ##
> add 00430 allow tcp from any to any 79 out via bge0 setup keep-state
> add 00431 allow udp from any to any 79 out via bge0 keep-state
>
> ###### inbound section #######
> ## standard http ##
> add 00600 allow tcp from any to any 80 in via bge0 setup keep-state
> ## secure https ##
> add 00601 allow tcp from any to any 443 in via bge0 setup keep-state
> ## dns ##
> add 00611 allow udp from any to me 53 in via bge0 keep-state
> add 00612 allow tcp from any to me dst-port 53 in via bge0 setup keep-state
> ## pop & smtp ##
> add 00630 allow tcp from any to me 25 in via bge0 setup keep-state
> add 00631 allow tcp from any to me 110 in via bge0 setup keep-state
> ## imap ##
> add 00635 allow tcp from any to me 143 in via bge0 setup keep-state
> ## ftp ##
> add 00640 allow tcp from any to me 21 in via bge0 setup keep-state
> add 00641 allow tcp from any to me 49152-65535 in via bge0 setup keep-state
> #add 00641 allow tcp from any 20 to any 1024-49151 out via bge0 setup
> keep-state
> ## ssh ##
> add 00660 allow tcp from any to me 22 in via bge0 setup keep-state
> ## snmp ##
> add 00690 allow udp from any to me 161 in via bge0 keep-state
> ## razor ##
> add 00695 allow tcp from me to any dst-port 2703 out via bge0 setup
> keep-state
>
> ###### ICMP ######
> ## Allow out & in console traceroot command ##
> add 00700 allow udp from me to any 33435-33500 out via bge0 keep-state
> add 00701 allow log icmp from any to me icmptype 3,11 in via bge0 limit
> src-addr 2
> ## ping out ##
> add 00710 allow icmp from any to any out via bge0 keep-state
> ## ping in ##
> add 00720 allow log icmp from any to me icmptype 0,8 in via bge0
> ## This sends a RESET to all ident packets ##
> add 00730 reset log tcp from any to me 113 in via bge0 limit src-addr 4
> ## Stop & log external redirect requests ##
> add 00740 deny log icmp from any to any icmptype 5 in via bge0
> ## Stop & log spoofing Attack attempts ##
> add 00750 deny log ip from me to me in via bge0
> ## Stop & log ping echo attacks ##
> add 00760 deny log icmp from any to me icmptype 0,8 in via bge0
>
> ###### Everything Else #####
> ## Reject & Log all setup of tcp incoming connections from the outside ##
> add 00770 deny log tcp from any to any setup in via bge0
> ## Reject all port 80 http packets that fall through to here ##
> add 00780 deny tcp from any to any 80 out via bge0
> ## Everything else is denied by default ##
> add 00790 deny log logamount 500 all from any to any
>
>
> Thanks
>
> Nick
> _______________________________________________
> freebsd-...@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-securi...@freebsd.org"
>
-------------------------------------------------------------
Nigel Houghton Research Engineer Sourcefire Inc.
Vulnerability Research Team
"Dude, dolphins are intelligent and friendly!" -- Wendy
"Intelligent and friendly on rye bread, with some mayonaise." -- Cartman
------------------------------
Message: 4
Date: Thu, 29 Jul 2004 04:44:01 +0400
From: "Nickolay A. Kritsky" <nkri...@internethelp.ru>
Subject: Re: Cisco IOS and racoon
To: Lewey Taylor <ad...@triparish.net>
Cc: freebsd-...@freebsd.org
Message-ID: <1201164112343....@internethelp.ru>
Content-Type: text/plain; charset=us-ascii
Hello Lewey,
<disclaimer>
First, I am really new to IPSEC, so may be my advices will be no use
to you.
Second, I have once succeded in setting up FreeBSD<->Cisco IPSec
link, so may be my advices will be of some use to you.
</disclaimer>
Tuesday, July 27, 2004, 5:34:58 AM, you wrote:
<skip some configs>
LT> <spdadd>
LT> #! /bin/sh
LT> #spdadd 1.1.1.1/32[500] 2.2.2.2/32[500] udp -P out none;
LT> #spdadd 1.1.1.1/32[500] 2.2.2.2/32[500] udp -P out none;
LT> case "$1" in
LT> start)
LT> setkey -F
LT> setkey -FP
LT> setkey -c <<EOF
LT> spdadd 10.0.10.0/24 10.0.3.0/24 ipencap -P out ipsec
LT> esp/tunnel/1.1.1.1-2.2.2.2/require;
LT> spdadd 10.0.3.0/24 10.0.1.0/24 ipencap -P in ipsec
LT> esp/tunnel/2.2.2.2-1.1.1.1/require;
LT> EOF
LT> ;;
LT> stop)
LT> setkey -F
LT> setkey -FP
LT> ;;
LT> *)
LT> echo "Usage: `basename $0` {start|stop}" >&2
LT> ;;
LT> esac
LT> exit 0
LT> </spdadd>
First advice: change `ipencap' to `any' in your spdadd config. If i am
right, you don't need ipencap here since you don't use ipinip on
cisco. If i am wrong, `any' should work anyway.
<skip all logs>
Second advice: do not try to understand racoon's logs. This is the
last thing to do. Only if nothing else helps, you can try it. And
the best way to do it is to build racoon from sources, to have the
ability to put there some human-readable debugprintfs.
Third advice - what really helps: Make some errors. Change the config
file of racoon in strictly wrong way. Use wrong algorithms for
encryption and signing, non-matching psk, play with padding, change
some weird options like `proposal_check', `situation', `doi', etc...
Do the wrong things. _ONE_CHANGE_FOR_ONE_RUN_ . Then take a quick look
in the log. If setting psk from <correctpsk> to <ComeToMeBigFatMama>
produces no change in logs - ie, everything stops on the same error,
then, _maybe_ your <correctpsk> is not correct at all. _But_ , _maybe_
things just become broken before anybody cares about your psk. You
will need to use your brain. I am sorry, but I don't know about silver
bullets on IPSec debugging. Using intentional errors can help you to
narrow your search to some specific sections of racoon.conf, and to
some specific files/functions in src tree. Otherwise you will be lost
in the sea of even possibilities. The most ugly problem I ran into,
was that IPSec uses about 50 different parameters that should match on
each sides of tunnel, and
1. Most of them are named differently in racoon and cisco (that's
called synonym - sounds different, means the same)
2. Some of them can be named the same but mean different (that's called
homonym ;) )
3. Some of them can be hardwired into the system. Different ones on
racoon and cisco.
Well, I hope that will help you.
Good luck!
;-------------------------------------------
; NKritsky
; mailto:nkri...@internethelp.ru
------------------------------
_______________________________________________
freebsd-...@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-securi...@freebsd.org"
End of freebsd-security Digest, Vol 70, Issue 3
***********************************************