From owner-fwtk-users@ex.tis.com Tue Feb 1 04:54 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA01483 Tue, 1 Feb 2000 04:54:14 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA15122; Tue, 1 Feb 2000 01:57:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 1 Feb 2000 01:54:14 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA14395 for fwtk-users-outgoing; Tue, 1 Feb 2000 01:54:12 -0800 (PST) Message-Id: Mime-Version: 1.0 Date: Tue, 1 Feb 2000 10:51:09 -0800 To: fwtk-users@lists.nai.com From: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.) Subject: smap/smapd/sendmail Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 799 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I use smap/smapd and the mails are correct delivered from the internal clients to external destinations. But after each mail apears the following error messages in /var/adm/messages on the FW-machine: .....sendmail[477] AA00477: SYSERR: Who are you ?:No such file or directory .....localhost smapd[476]: discard (OS error) pid=477 code=71 The settings are: /usr/local/etc/netperm-table: smap, smapd: userid 4 smap, smapd: directory /var/spool/smap smapd: executable /usr/local/etc/smapd smapd: sendmail /usr/sbin/sendmail smap: timeout 3600 Temp directory for sendmail: /var/spool/mqueue ------- Thanks! From owner-fwtk-users@ex.tis.com Tue Feb 1 08:19 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA01930 Tue, 1 Feb 2000 08:19:03 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA22934; Tue, 1 Feb 2000 05:22:38 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 1 Feb 2000 05:15:39 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA21989 for fwtk-users-outgoing; Tue, 1 Feb 2000 05:15:38 -0800 (PST) Message-Id: Mime-Version: 1.0 Date: Tue, 1 Feb 2000 14:12:58 -0800 To: fwtk-users@lists.nai.com From: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.) Subject: AppleTalk Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 229 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Have anyone a suggested methodology for running AppleTalk through SunOS 4 running FWTK ? Thanks! From owner-fwtk-users@ex.tis.com Tue Feb 1 09:00 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA02075 Tue, 1 Feb 2000 09:00:20 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA26041; Tue, 1 Feb 2000 06:03:52 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 1 Feb 2000 06:00:56 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA25275 for fwtk-users-outgoing; Tue, 1 Feb 2000 06:00:54 -0800 (PST) Message-ID: <3896E72A.22DECBB5@v-one.com> Date: Tue, 01 Feb 2000 09:01:14 -0500 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.7 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: "Stefan Heim, Dipl.-Ing." CC: fwtk-users@lists.nai.com Subject: Re: AppleTalk References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 563 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] "Stefan Heim, Dipl.-Ing." wrote: > > Have anyone a suggested methodology for running AppleTalk > through SunOS 4 running FWTK ? Impossible using SunOS and the FWTK. The FWTK only supports TCP/IP. I don't even know of a kernel mod for SunOS 4.x which allows AppleTalk. Have you looked at using TCP/IP between your Apple PCs instead of AppleTalk? -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Tue Feb 1 09:58 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA02270 Tue, 1 Feb 2000 09:58:20 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA01126; Tue, 1 Feb 2000 07:01:40 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 1 Feb 2000 06:58:10 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA00252 for fwtk-users-outgoing; Tue, 1 Feb 2000 06:58:08 -0800 (PST) Date: Tue, 1 Feb 2000 15:43:47 +0100 (CET) From: Ratkai Peter To: fwtk-users@ex.tis.com Subject: cannot fork Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 726 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] HI, I have these messages in syslog, and mails are standing in smapd's queue. What can go wrong? eb 1 16:29:31 sendmail.quaestor.hu smapd[7606]: fwtksyserr: cannot fork: Resource temporarily unavailable Feb 1 16:29:31 sendmail.quaestor.hu smapd[28126]: fwtksyserr: file=sma026804 deliver cannot fork, Resource temporarily unavailable Feb 1 16:29:31 sendmail.quaestor.hu smapd[178]: fwtksyserr: cannot fork: Resource temporarily unavailable Feb 1 16:29:31 sendmail.quaestor.hu smapd[28127]: fwtksyserr: file=sma027448 deliver cannot fork, Resource temporarily unavailable TIA, --Rp. From owner-fwtk-users@ex.tis.com Tue Feb 1 10:20 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA02366 Tue, 1 Feb 2000 10:20:11 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA04089; Tue, 1 Feb 2000 07:23:33 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 1 Feb 2000 07:19:34 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA02844 for fwtk-users-outgoing; Tue, 1 Feb 2000 07:19:30 -0800 (PST) From: "Yakov Kravets" To: "'Ratkai Peter'" , Subject: RE: cannot fork Date: Tue, 1 Feb 2000 10:19:22 -0500 Message-ID: <1704D3C62B8DD211A1BE0020484008FD0276228C@exch-ut2.nb.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <1704D3C62B8DD211A1BE0020484008FD027E153A@exch-ut2.nb.com> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="US-ASCII" Content-Length: 941 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > I have these messages in syslog, and mails are standing in > smapd's queue. > > What can go wrong? > > > eb 1 16:29:31 sendmail.quaestor.hu smapd[7606]: fwtksyserr: > cannot fork: > Resource temporarily unavailable > Feb 1 16:29:31 sendmail.quaestor.hu smapd[28126]: fwtksyserr: > file=sma026804 deliver cannot fork, Resource temporarily unavailable > Feb 1 16:29:31 sendmail.quaestor.hu smapd[178]: fwtksyserr: > cannot fork: > Resource temporarily unavailable > Feb 1 16:29:31 sendmail.quaestor.hu smapd[28127]: fwtksyserr: > file=sma027448 deliver cannot fork, Resource temporarily unavailable > check child-limit fro smapd also look at max number of proc. for kernel you may have to increase those. ------------------------------------- Yakov Kravets, CISSP, NeubergerBerman ygk@nb.com From owner-fwtk-users@ex.tis.com Tue Feb 1 12:07 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA02779 Tue, 1 Feb 2000 12:07:55 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA24576; Tue, 1 Feb 2000 09:11:13 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 1 Feb 2000 09:02:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA21948 for fwtk-users-outgoing; Tue, 1 Feb 2000 09:02:32 -0800 (PST) Message-ID: <389711A4.4EBC335@fadesa.es> Date: Tue, 01 Feb 2000 18:02:29 +0100 From: "=?iso-8859-1?Q?Jos=E9?= M. =?iso-8859-1?Q?Fandi=F1o?=" Organization: Inmobiliaria FADESA X-Mailer: Mozilla 4.7 [en] (X11; U; Linux 2.2.13 i686) X-Accept-Language: es, en MIME-Version: 1.0 To: Rick Murphy , FWTK List Subject: problem with http-gw and ftp-proxy (III) References: <4.2.2.20000131142934.00b31600@mail.itm-inst.com> X-Logged: Logged by tierra.fadesa.es as TAA23125 at Tue Feb 1 19:49:43 2000 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id JAA21853 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 2245 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] H., no, my intention is what http-gw manage http and ftp request, but ftp request are relied to ftp-gw. I found two solutions, but both don't work for me. 1.- according to FAQ You should add a "ftp-proxy" line in your netperm-table. What "ftp-proxy foo" should do is to change the handling of ftp URLs from connecting to the target host to using the given ftp host. For example, if you send "ftp://target/dir/file" with a line in your netperm-table like "http-gw: ftp-proxy proxy" what will change is that the http-gw will connect to host "proxy" on the ftp port, then send "user anonymous@target" as the user (expecting that there's a ftp-gw proxy in use.) Your netperm-table seems to be configured with the "ftp-proxy" having the name of a program to run; what you probably want is "http-gw: ftp-proxy 127.0.0.1" I understand what "http-gw: ftp-proxy 127.0.0.1" could connect to ftp-gw from the http-gw in the same machine(127.0.0.1). 2.- according to HTTP-README http-gw: forward * -protocol ftp -tohost localhost but the ftp protocol is disable any help will be welcome. Rick Murphy wrote: > > At 05:05 PM 1/31/00 +0100, José M. Fandiño wrote: > >yes, the http-gw support ftp type urls, but in a restrict mode. It not > >retrieve the normal information of ftp server (date, size, ...). This > >be a problem for mirrors and any utilities that I need use. > >The possible solution could be the ftp-proxy method of http-gw. It call > >for the ftp-gw at localhost and ftp-gw established the connection to ftp > >server. > >ftp-proxy seem easy of configure, but I don't get that it work. > > You must point the ftp-proxy at a *HTTP FTP Proxy*. An ftp proxy takes > requests of the form 'GET ftp://host/dir' and returns a formatted HTTP page > that should be displayed to the user. You're pointing it to a ftp server; > those don't generate http. > -Rick -- -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCC d- s+: a- C+>+++ UL++++ P+ L+++ E--- W++ N+ o+ K- w--- O M V- PS PE+ Y PGP+>+++ t+ 5 X+++ R- !tv b+++ DI-- D+++ G e- h++ !r !y+ ------END GEEK CODE BLOCK------ From owner-fwtk-users@ex.tis.com Tue Feb 1 14:10 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA03366 Tue, 1 Feb 2000 14:10:53 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA14296; Tue, 1 Feb 2000 11:14:27 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 1 Feb 2000 11:09:06 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA12614 for fwtk-users-outgoing; Tue, 1 Feb 2000 11:09:03 -0800 (PST) Message-ID: <006d01bf6ce7$3a24d200$fc00a8c0@k62350> From: "Larry Jackson" To: "FWTK List" Subject: FWTK - Filtering content Date: Tue, 1 Feb 2000 14:04:51 -0500 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 504 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Does anyone know how to configure FWTK to filter content through JunkBuster? I want to leave the proxies on the default ports, but filter incoming info through junkbuster. ie Internet:80 -> Proxy -> Junkbuster -> localnet:80 also I was thinking about running POP through BlackMail or some other email SPAM filter. Ant thoughts or suggestions would be appreciated. Larry From owner-fwtk-users@ex.tis.com Wed Feb 2 04:17 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA05700 Wed, 2 Feb 2000 04:17:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA20344; Wed, 2 Feb 2000 01:21:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 2 Feb 2000 01:16:27 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA19485 for fwtk-users-outgoing; Wed, 2 Feb 2000 01:16:26 -0800 (PST) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <3897F5FF.7FC0F9C7@usrconsult.be> Date: Wed, 02 Feb 2000 10:16:47 +0100 From: Michel Bardiaux Organization: UsrConsult SPRL X-Mailer: Mozilla 4.5 [en] (X11; I; IRIX64 6.5 IP27) X-Accept-Language: en MIME-Version: 1.0 To: FWTK List Subject: Re: FWTK - Filtering content References: <006d01bf6ce7$3a24d200$fc00a8c0@k62350> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 999 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Larry Jackson wrote: > > Does anyone know how to configure FWTK to filter content through JunkBuster? > I want to leave the proxies on the default ports, but filter incoming info > through junkbuster. > ie Internet:80 -> Proxy -> Junkbuster -> localnet:80 Depends where JunkBuster runs. If on the FW, it must accept requests on port 80, and forward them to http-gw, which must accept on some other port. However, IIRC JunkBuster allows fine control on which origin sites to filter, how to handle cookies, etc... which are things each user might wish to control personnally, in which case it might be better to allow each user to designate one (intranet!) machine to be used as his JunkBuster server, in which case the FW needs no tinkering. -- Michel Bardiaux UsrConsult S.P.R.L. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 From owner-fwtk-users@ex.tis.com Wed Feb 2 06:35 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA06337 Wed, 2 Feb 2000 06:35:26 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA28819; Wed, 2 Feb 2000 03:39:03 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 2 Feb 2000 03:35:11 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA28031 for fwtk-users-outgoing; Wed, 2 Feb 2000 03:35:10 -0800 (PST) To: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.) Cc: fwtk-users@lists.nai.com Subject: Re: smap/smapd/sendmail References: Mime-Version: 1.0 (generated by tm-edit 7.108) From: Michel Arboi Date: 02 Feb 2000 12:39:22 +0100 In-Reply-To: heim@sip.medizin.uni-ulm.de's message of "Tue, 1 Feb 2000 10:51:09 -0800" Message-ID: Lines: 21 X-Mailer: Gnus v5.5/XEmacs 20.4 - "Emerald" Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 1026 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.) writes: > .....sendmail[477] AA00477: SYSERR: Who are you ?:No such file or directory I think you should rather look in sendmail configuration. > .....localhost smapd[476]: discard (OS error) pid=477 code=71 This happens if sendmails returns EX_OSERR or EX_OSFILE. man sendmail says : Sendmail returns an exit status describing what it did. The codes are defined in : /usr/include/sysexits.h: * EX_OSERR -- An operating system error has been detected. * This is intended to be used for such things as "cannot * fork", "cannot create pipe", or the like. It includes * things like getuid returning a user that does not * exist in the passwd file. * EX_OSFILE -- Some system file (e.g., /etc/passwd, /etc/utmp, * etc.) does not exist, cannot be opened, or has some * sort of error (e.g., syntax error). From owner-fwtk-users@ex.tis.com Wed Feb 2 09:05 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA07032 Wed, 2 Feb 2000 09:05:20 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA10927; Wed, 2 Feb 2000 06:08:57 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 2 Feb 2000 06:00:29 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA08017 for fwtk-users-outgoing; Wed, 2 Feb 2000 06:00:27 -0800 (PST) Message-Id: <3.0.3.32.20000201132939.00700bd8@mail.denver.gd-is.com> X-Sender: dsmith@mail.denver.gd-is.com X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) Date: Tue, 01 Feb 2000 13:29:39 -0700 To: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.), fwtk-users@lists.nai.com From: Donald J Smith Subject: Re: AppleTalk In-Reply-To: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 1369 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 02:12 PM 2/1/00 -0800, Stefan Heim, Dipl.-Ing. wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >Have anyone a suggested methodology for running AppleTalk appletalk is a protocal not supported by fwtk. FWTK is a ip based firewall. What are u trying to do. Share files, print ???? There are methods to tunneling appletalk via ip but would need more info. >through SunOS 4 running FWTK ? > >Thanks! > > > ------------------------------------------------------------------------------ Don Smith General Dynamics Information Systems Systems Administrator 8005 South Chester St EngleWood, Co. 80112 Phone (303) 649-7554 FAX (303) 649-7504 donald.j.smith@gd-is.com Error msgs that I love: "Keyboard not found press F1 to continue" (pc bios) "Harddrive controller failure insert new disk and press any key to continue" (pc bios) "The disk is write protected Remove the write protect or use another disk." (nt) User must change his password before he logs in the first time. (nt) ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Wed Feb 2 09:05 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA07028 Wed, 2 Feb 2000 09:05:11 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA10873; Wed, 2 Feb 2000 06:08:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 2 Feb 2000 06:00:33 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA08016 for fwtk-users-outgoing; Wed, 2 Feb 2000 06:00:27 -0800 (PST) Mime-Version: 1.0 X-Sender: farone@mail.gvillesun.com Message-Id: In-Reply-To: References: Date: Tue, 1 Feb 2000 13:42:05 -0500 To: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.) From: Mark C Farone Subject: Re: AppleTalk Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 731 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 2:12 PM -0800 2/1/00, Stefan Heim, Dipl.-Ing. wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >Have anyone a suggested methodology for running AppleTalk >through SunOS 4 running FWTK ? Since you are asking to run it through fwtk, I assume you mean that you want to proxy TCP based appletalk (afp over tcp/ip). I've utilized plug-gw for this purpose through the standard port, 548. -- Mark C. Farone In the future, Systems Analyst, Gainesville Sun everything will work. From owner-fwtk-users@ex.tis.com Wed Feb 2 09:05 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA07035 Wed, 2 Feb 2000 09:05:25 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA10953; Wed, 2 Feb 2000 06:09:01 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 2 Feb 2000 06:03:33 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA08859 for fwtk-users-outgoing; Wed, 2 Feb 2000 06:03:32 -0800 (PST) X-Authentication-Warning: proxy.tfcc.com: mail set sender to using -f From: "Todd Williams" To: Subject: http-gw logging options question Date: Tue, 1 Feb 2000 00:10:29 -0500 Message-ID: <046e01bf6c72$a8cd6d90$8702a8c0@twilliams.tfcc.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 809 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I attempted to send this to lists.nai.com, and it didn't make it out. Here is the second attempt, this time to ex.tis.com. Is there an easy way to allow http-gw to log what web sites the proxy users are browsing? I've looked at the documentation and read the FAQ's and haven't found anything that covers that subject. The -log option for ftp-gw works great. I'm currently using "-log {read write ftp}" on the http-gw configuration in netperm-table. Am I missing something? I'm not really looking for content filtering, although that might eventually be an option, I'm simply looking for a way to log the web sites users are visiting. Running on FWTK 2.1. Thanks, Todd From owner-fwtk-users@ex.tis.com Wed Feb 2 09:11 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA07224 Wed, 2 Feb 2000 09:09:52 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA12642; Wed, 2 Feb 2000 06:13:29 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 2 Feb 2000 06:05:58 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA09195 for fwtk-users-outgoing; Wed, 2 Feb 2000 06:04:31 -0800 (PST) Message-Id: <3.0.6.32.20000202093826.01590100@pop.thehub.com.au> X-Sender: djames@pop.thehub.com.au X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.6 (32) Date: Wed, 02 Feb 2000 09:38:26 +1000 To: fwtk-users@lists.nai.com From: Damian James Subject: Re: AppleTalk In-Reply-To: <3896E72A.22DECBB5@v-one.com> References: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 517 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Stefan, >"Stefan Heim, Dipl.-Ing." wrote: >> Have anyone a suggested methodology for running AppleTalk >> through SunOS 4 running FWTK ? > You need to use something like IPRemote-AT, a tunneling solution for AppleTalk over TCP/IP. See: http://www.cs.mu.oz.au/appletalk/atalk.html You may also be interested to look at: http://www.umich.edu/~rsug/netatalk/ Cheers Damian From owner-fwtk-users@ex.tis.com Wed Feb 2 10:34 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA08661 Wed, 2 Feb 2000 10:33:58 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA22844; Wed, 2 Feb 2000 07:36:49 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 2 Feb 2000 07:32:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA21536 for fwtk-users-outgoing; Wed, 2 Feb 2000 07:32:35 -0800 (PST) Message-ID: <38984591.AAAF6B64@sci.yakutia.ru> Date: Wed, 02 Feb 2000 23:56:17 +0900 From: a.a.turpanov@sci.yakutia.ru (Turpanov A.A.) X-Mailer: Mozilla 4.05 [en] (Win95; I) MIME-Version: 1.0 To: Todd Williams CC: fwtk-users@ex.tis.com Subject: Re: http-gw logging options question References: <046e01bf6c72$a8cd6d90$8702a8c0@twilliams.tfcc.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=koi8-r Content-Length: 1076 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] It seems to me that squid + sqmgrlog is what you really need. Alexei Turpanov Todd Williams wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I attempted to send this to lists.nai.com, and it didn't make it out. Here > is the second attempt, this time to ex.tis.com. > > Is there an easy way to allow http-gw to log what web sites the proxy users > are browsing? I've looked at the documentation and read the FAQ's and > haven't found anything that covers that subject. The -log option for ftp-gw > works great. I'm currently using "-log {read write ftp}" on the http-gw > configuration in netperm-table. Am I missing something? > > I'm not really looking for content filtering, although that might eventually > be an option, I'm simply looking for a way to log the web sites users are > visiting. Running on FWTK 2.1. > > Thanks, > > Todd From owner-fwtk-users@ex.tis.com Wed Feb 2 22:05 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA11023 Wed, 2 Feb 2000 22:05:51 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA08015; Wed, 2 Feb 2000 19:09:29 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 2 Feb 2000 19:04:44 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA07225 for fwtk-users-outgoing; Wed, 2 Feb 2000 19:04:43 -0800 (PST) Message-ID: <08E056359810D2118E4900805FC1F94503610601@dsntexsrv1.diasham.com> From: "Gober, Lowman" To: "'fwtk-users@ex.tis.com'" Subject: trans.pch causing proxies to dump core Date: Wed, 2 Feb 2000 21:03:07 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 277 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] after if apply the trans patch my proxies core (tn-gw,ftp-gw,http-gw). if i don't apply the patches they function fine. any ideas? thanks, lowman From owner-fwtk-users@ex.tis.com Wed Feb 2 23:58 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA11162 Wed, 2 Feb 2000 23:58:16 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id VAA13102; Wed, 2 Feb 2000 21:01:56 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 2 Feb 2000 20:57:47 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id UAA12214 for fwtk-users-outgoing; Wed, 2 Feb 2000 20:57:46 -0800 (PST) Message-ID: <001e01bf6e02$d9c94720$fc00a8c0@k62350> From: "Larry Jackson" To: "Gober, Lowman" Cc: "FWTK List" References: <08E056359810D2118E4900805FC1F94503610601@dsntexsrv1.diasham.com> Subject: Re: trans.pch causing proxies to dump core Date: Wed, 2 Feb 2000 23:55:09 -0500 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 820 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Manually check the what the patch program is doing. I noticed that the patch line numbers didn't match up with the current source files. So I just added the code manually in the right location. Larry ----- Original Message ----- From: Gober, Lowman To: Sent: Wednesday, February 02, 2000 10:03 PM Subject: trans.pch causing proxies to dump core > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > after if apply the trans patch my proxies core (tn-gw,ftp-gw,http-gw). if i > don't apply the patches they function fine. > any ideas? > > thanks, > lowman > From owner-fwtk-users@ex.tis.com Thu Feb 3 15:37 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA14684 Thu, 3 Feb 2000 15:37:44 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA16078; Thu, 3 Feb 2000 12:41:09 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 3 Feb 2000 12:31:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA14723 for fwtk-users-outgoing; Thu, 3 Feb 2000 12:31:38 -0800 (PST) Message-ID: <4137C256100ED2119632080009DB781C044184@ECHIDNA> From: Carl Blosser To: "'fwtk-users@ex.tis.com'" Subject: yao-smap.pch Date: Thu, 3 Feb 2000 13:04:07 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 754 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] When I try and compile the smap.c after running patch < yao-smap.pch this is the error I get cc -I.. -g -c smap.c -o smap.o cc -g -o smap smap.o arpadate.o ../libfwall.a smap.o: In function `from_address_ok': /usr/local/etc/fwtk/smap/smap.c:2006: undefined reference to `res_query' /usr/local/etc/fwtk/smap/smap.c:2006: undefined reference to `res_query' collect2: ld returned 1 exit status make: *** [smap] Error 1 Any help would be apprecitated. TIA Carl Blosser, MCSE CCNA NT/Network Administrator SKLD Information Services 720 S. Colorado Blvd, Suite 1000N Denver, CO 80246 303-820-0870 cblosser@skld.com From owner-fwtk-users@ex.tis.com Thu Feb 3 19:03 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA15410 Thu, 3 Feb 2000 19:03:14 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA04937; Thu, 3 Feb 2000 16:06:44 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 3 Feb 2000 15:56:55 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA02068 for fwtk-users-outgoing; Thu, 3 Feb 2000 15:56:51 -0800 (PST) Date: Thu, 3 Feb 2000 18:56:29 -0500 (EST) From: Ted Keller To: Carl Blosser cc: "'fwtk-users@ex.tis.com'" Subject: Re: yao-smap.pch In-Reply-To: <4137C256100ED2119632080009DB781C044184@ECHIDNA> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1093 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Carl, Looks like you have to add the -lresolv to your make file to pick up the resolver library modules. ted keller On Thu, 3 Feb 2000, Carl Blosser wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > When I try and compile the smap.c after running patch < yao-smap.pch this is > the error I get > cc -I.. -g -c smap.c -o smap.o > cc -g -o smap smap.o arpadate.o ../libfwall.a > smap.o: In function `from_address_ok': > /usr/local/etc/fwtk/smap/smap.c:2006: undefined reference to `res_query' > /usr/local/etc/fwtk/smap/smap.c:2006: undefined reference to `res_query' > collect2: ld returned 1 exit status > make: *** [smap] Error 1 > Any help would be apprecitated. > > TIA > Carl Blosser, MCSE CCNA > NT/Network Administrator > SKLD Information Services > 720 S. Colorado Blvd, Suite 1000N > Denver, CO 80246 > 303-820-0870 > cblosser@skld.com > > From owner-fwtk-users@ex.tis.com Fri Feb 4 03:57 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA16828 Fri, 4 Feb 2000 03:57:08 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA05176; Fri, 4 Feb 2000 01:00:26 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 00:50:08 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA03967 for fwtk-users-outgoing; Fri, 4 Feb 2000 00:50:00 -0800 (PST) X-Authentication-Warning: aeria.eic.at: nobody set sender to using -f Message-ID: <389A92C5.AD87922C@eic.at> Date: Fri, 04 Feb 2000 09:50:13 +0100 From: "Johann G. Hautzinger" Organization: Erste Bank AG X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.13 i686) X-Accept-Language: en MIME-Version: 1.0 To: TIS Mailing List Subject: abuse of my mail gateway Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 776 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi all, yesterday i found out that someone is abusing my mail gateway for sending spam (though i thought i did everything necessary to stop that). fiddling with sendmail (which should be responsible for delivering mail, as far as i understood the concept behind smap/smapd) did not change anything. my box is running SuSE Linux 6.1 with kernel 2.2.5 and FWTK 2.1 please help me to stop spam coming from my site *greetz* from Vienna Hannes -- Johann Georg Hautzinger, email: trema@eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at From owner-fwtk-users@ex.tis.com Fri Feb 4 05:17 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA17099 Fri, 4 Feb 2000 05:17:44 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA11590; Fri, 4 Feb 2000 02:20:32 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 02:16:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA10815 for fwtk-users-outgoing; Fri, 4 Feb 2000 02:16:41 -0800 (PST) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <389AA704.D9634E72@usrconsult.be> Date: Fri, 04 Feb 2000 11:16:36 +0100 From: Michel Bardiaux Organization: UsrConsult SPRL X-Mailer: Mozilla 4.5 [en] (X11; I; IRIX64 6.5 IP27) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: Re: Firewalls and SQLNet References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1077 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] ividal wrote: > Hello: > Maybe this subject is not in the right place but I think some of you can > have some information. > I need an aplication proxy for sqlnet connections through a firewall: > somebody knows a non commercial proxy (in the fwtk style) for testing it? > (I got some 1995-papers from Oracle, and it seems not as easy as a plug > proxy or similars) > Any point/opinion/word will be very appreciated > Thank you all > Greets We run (outgoing) sqlnet through our FW using plug-gw (part of FWTK). Works fine, but of course totally unaware of SQL, which means that, should you use it for *incoming* sqlnet, you would have no more access control than 'machine w.x.y.z can call sql on port P here'. One port per service. An SQL-aware proxy would be needed for access control based on SQL usernames. Greetings. -- Michel Bardiaux UsrConsult S.P.R.L. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 From owner-fwtk-users@ex.tis.com Fri Feb 4 07:51 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA17501 Fri, 4 Feb 2000 07:51:53 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA18810; Fri, 4 Feb 2000 04:55:31 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 04:49:45 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA17901 for fwtk-users-outgoing; Fri, 4 Feb 2000 04:49:42 -0800 (PST) From: ark@eltex.ru Date: Fri, 4 Feb 2000 15:11:30 +0300 Message-Id: <200002041211.PAA29133@paranoid.eltex.spb.ru> Organization: "Klingon Imperial Intelligence Service" Subject: Re: Firewalls and SQLNet To: mbardiaux@usrconsult.be Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 848 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, .does anybody here have protocol specs (maybe reverse-engineered at least)? _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOJrB76H/mIJW9LeBAQGcSgP/YMhpN8oB4LBZTjAGHE31u17UFxwb6wCQ S8B6drvgzA/4QyAWfV8j3X8eb/vPJRhb00o2lfWNMkc6mzQCrdzndt88ljjlocus kbZaQvRpixohY4k3xyJiQ9aqgn2Luf8oAQ4W9KP+uIJVTOQitVNTBamD+z2QdgZX 8HLLEKooiGU= =g195 -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Fri Feb 4 08:28 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA17685 Fri, 4 Feb 2000 08:28:31 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA22123; Fri, 4 Feb 2000 05:32:03 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 05:26:31 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA20816 for fwtk-users-outgoing; Fri, 4 Feb 2000 05:26:29 -0800 (PST) Message-Id: <3.0.6.32.20000204103808.00c22ce0@mail.lr.isla.pt> X-Sender: ngg@mail.lr.isla.pt X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.6 (32) Date: Fri, 04 Feb 2000 10:38:08 +0000 To: "Johann G. Hautzinger" From: Nuno Guarda Subject: Re: abuse of my mail gateway Cc: fwtk-users@ex.tis.com In-Reply-To: <389A92C5.AD87922C@eic.at> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 852 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 09:50 04-02-2000 +0100, you wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >hi all, > >yesterday i found out that someone is abusing my mail gateway for >sending spam (though i thought i did everything necessary to stop that). >fiddling with sendmail (which should be responsible for delivering mail, >as far as i understood the concept behind smap/smapd) did not change >anything. > >my box is running SuSE Linux 6.1 with kernel 2.2.5 and FWTK 2.1 > >please help me to stop spam coming from my site > Try installing the patch avalable at http://www.sabernet.net/software/nospam.html It should help you stopping spam. Nuno From owner-fwtk-users@ex.tis.com Fri Feb 4 08:31 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA17696 Fri, 4 Feb 2000 08:31:42 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA23013; Fri, 4 Feb 2000 05:35:20 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 05:28:00 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA21287 for fwtk-users-outgoing; Fri, 4 Feb 2000 05:27:57 -0800 (PST) Date: Fri, 4 Feb 2000 07:28:00 -0300 (ART) From: ividal To: ark@eltex.ru cc: mbardiaux@usrconsult.be, fwtk-users@ex.tis.com Subject: Re: Firewalls and SQLNet In-Reply-To: <200002041211.PAA29133@paranoid.eltex.spb.ru> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 310 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Feb 4, 2000, ark@eltex.ru wrote: > >nuqneH, > >.does anybody here have protocol specs (maybe reverse-engineered at least)? Surely nobody has Oracle's specs ;) Greets Ignacio From owner-fwtk-users@ex.tis.com Fri Feb 4 08:37 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA17714 Fri, 4 Feb 2000 08:37:13 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA24573; Fri, 4 Feb 2000 05:40:49 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 05:33:32 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA22448 for fwtk-users-outgoing; Fri, 4 Feb 2000 05:33:29 -0800 (PST) To: fwtk-users@lists.nai.com Subject: Status of FWTK package X-Sun-Charset: US-ASCII Message-Id: <20000204133343.F34EB2C15C@skynet.medar.com> Date: Fri, 4 Feb 2000 08:33:43 -0500 (EST) From: jseymour@medar.com (James Seymour) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1537 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Greetings, I recently queried about a relatively inexpensive firewall package for another corporate division of ours that I could run upon a Linux box (for example) and someone suggested FWTK. (Which I had completely forgotten about. Which is odd since I run Gauntlet here.) On the face of it, it *sounded* like a good idea, *except*... Checking out http://www.fwtk.org I see that the current version, 2.1, was released on March 2nd, 1998! And under the question "When will the next version be released?" is the answer "As soon as it is ready." and "TIS tries to release a new version often, but since it is a volunteer effort, it depends on the free time of the programmers." I find it kind of hard to believe that in all this time "the programmers" haven't been able to at least find the time to apply the patches to fix known bugs and at least release, oh, say 2.1.1. Leads me to suspect that the package is perhaps being left to die on the vine? And since the license is so restrictive, nobody else can maintain it either. So I'm not so sure this is a good way to go. I guess what I'm looking for is some kind of reassurance that FWTK is "alive." TIA, Jim -- Jim Seymour | Medar, Inc. jseymour@medar.com | 24775 Crestview Ct. Systems & Network Administrator | Farmington Hills, MI. 48335 | FAX: (248)477-8897 From owner-fwtk-users@ex.tis.com Fri Feb 4 09:56 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA17965 Fri, 4 Feb 2000 09:56:23 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA02692; Fri, 4 Feb 2000 07:00:00 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 06:56:35 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA01731 for fwtk-users-outgoing; Fri, 4 Feb 2000 06:56:33 -0800 (PST) To: trema@eic.at, nuno.guarda@lr.isla.pt Subject: Re: abuse of my mail gateway Cc: fwtk-users@ex.tis.com X-Sun-Charset: US-ASCII Message-Id: <20000204141350.2D7562C15D@skynet.medar.com> Date: Fri, 4 Feb 2000 09:13:50 -0500 (EST) From: jseymour@medar.com (James Seymour) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1404 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Message-Id: <3.0.6.32.20000204103808.00c22ce0@mail.lr.isla.pt> > Date: Fri, 04 Feb 2000 10:38:08 +0000 > From: Nuno Guarda > Subject: Re: abuse of my mail gateway > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > At 09:50 04-02-2000 +0100, "Johann G. Hautzinger" (?) wrote: [snip] > > > >yesterday i found out that someone is abusing my mail gateway for > >sending spam ... [snip] > > > >please help me to stop spam coming from my site > > > > Try installing the patch avalable at > http://www.sabernet.net/software/nospam.html > > It should help you stopping spam. I simply replaced the whole smap/smapd/sendmail thing with Postfix (http://www.postfix.org) on my Gauntlet firewall. By application of the appropriate config parameters I brought e-mail spam into our site down by at least an order-of-magnitude. No kidding. And I no longer dread facing MTA re-configuration issues :-). Regards, Jim -- Jim Seymour | Medar, Inc. jseymour@medar.com | 24775 Crestview Ct. Systems & Network Administrator | Farmington Hills, MI. 48335 | FAX: (248)477-8897 From owner-fwtk-users@ex.tis.com Fri Feb 4 10:23 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA18097 Fri, 4 Feb 2000 10:23:24 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA06586; Fri, 4 Feb 2000 07:26:57 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 07:23:12 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA05481 for fwtk-users-outgoing; Fri, 4 Feb 2000 07:23:11 -0800 (PST) From: ark@eltex.ru Date: Fri, 4 Feb 2000 18:16:59 +0300 Message-Id: <200002041516.SAA29922@paranoid.eltex.spb.ru> In-Reply-To: <20000204133343.F34EB2C15C@skynet.medar.com> from "jseymour@medar.com (James Seymour)" Organization: "Klingon Imperial Intelligence Service" Subject: Re: Status of FWTK package To: jseymour@medar.com Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 2325 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, FWTK is alive, though most development efforts are performed outside of TIS/NAI these days. See www.fwtk.org. Many new proxies, some minor bugfixes are there (though not everything that was done..). Hope they will change licensing policy someday.. But the toolkit is not going to die anyways. jseymour@medar.com (James Seymour) said : > Greetings, > > I recently queried about a relatively inexpensive firewall package for > another corporate division of ours that I could run upon a Linux box > (for example) and someone suggested FWTK. (Which I had completely > forgotten about. Which is odd since I run Gauntlet here.) > > On the face of it, it *sounded* like a good idea, *except*... > > Checking out http://www.fwtk.org I see that the current version, 2.1, > was released on March 2nd, 1998! And under the question "When will the > next version be released?" is the answer "As soon as it is ready." and > "TIS tries to release a new version often, but since it is a volunteer > effort, it depends on the free time of the programmers." > > I find it kind of hard to believe that in all this time "the > programmers" haven't been able to at least find the time to apply the > patches to fix known bugs and at least release, oh, say 2.1.1. > > Leads me to suspect that the package is perhaps being left to die on > the vine? And since the license is so restrictive, nobody else can > maintain it either. So I'm not so sure this is a good way to go. > > I guess what I'm looking for is some kind of reassurance that FWTK is > "alive." _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOJrtaqH/mIJW9LeBAQEV7gP+OD8sJAmnfVdjEHG6utTd/5+WCY+oVVqU hfMRRXDWcH+BTL7uaOq6tSXOzT95xpaKBJKeCdo2AzOlA+IQ8ZGKXJTc3ggEt91R KZ28J42eQHtFEAOwTIb6Ca0lf3rKaVuBonh+bYMd4AshOuVZ+N9k7YdQ7MLEowYC H8D1PNCvgXE= =sEwB -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Fri Feb 4 10:37 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA18128 Fri, 4 Feb 2000 10:37:16 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA09845; Fri, 4 Feb 2000 07:40:54 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 07:35:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA08442 for fwtk-users-outgoing; Fri, 4 Feb 2000 07:35:35 -0800 (PST) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <389AF1D2.54D60B6@usrconsult.be> Date: Fri, 04 Feb 2000 16:35:46 +0100 From: Michel Bardiaux Organization: UsrConsult SPRL X-Mailer: Mozilla 4.5 [en] (X11; I; IRIX64 6.5 IP27) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: Re: abuse of my mail gateway References: <3.0.6.32.20000204103808.00c22ce0@mail.lr.isla.pt> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1192 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Nuno Guarda wrote: > At 09:50 04-02-2000 +0100, you wrote: > >hi all, > > > >yesterday i found out that someone is abusing my mail gateway for > >sending spam (though i thought i did everything necessary to stop that). > >fiddling with sendmail (which should be responsible for delivering mail, > >as far as i understood the concept behind smap/smapd) did not change > >anything. > > > >my box is running SuSE Linux 6.1 with kernel 2.2.5 and FWTK 2.1 > > > >please help me to stop spam coming from my site > > > > Try installing the patch avalable at > http://www.sabernet.net/software/nospam.html > > It should help you stopping spam. This patch is to suppress *incoming* spam. The OPs problem seems to be *relayed* spam. What we have done is to create a modified smap.c with the SPECIALDOMAIN hack activated (and somewhat modified because we have one firewall for 2 top-domains). The netperm-table specifies the 'regular' smap for smtp requests from the intranet, and the 'norelay special' for requests from other addresses. Greetings. -- Michel Bardiaux From owner-fwtk-users@ex.tis.com Fri Feb 4 10:53 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA18176 Fri, 4 Feb 2000 10:53:56 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA15269; Fri, 4 Feb 2000 07:57:34 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 07:39:23 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA09447 for fwtk-users-outgoing; Fri, 4 Feb 2000 07:39:05 -0800 (PST) Date: Fri, 4 Feb 2000 16:38:08 +0100 (CET) From: Saverio Armeni X-Sender: armeni@bode.dsi.unifi.it To: fwtk-users@lists.nai.com Subject: http-gw (failed to connect...) Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 907 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I've compiled the fwtk toolkit on a linux system (RH6.1, with kernel version 2.2.14). I've tested http-gw in to two different ways: from inetd, standalone daemon both on 8080 port. That's what i get: when i connect to some http server through the http-gw proxy, i get the error message "failed to connect to http server www.xxx.yyy (80)" or "Network connection closed during write" The http-gw proxy works fine if i tell to the browser the ip number of the server http. I've tested my dns and it still works fine. I've used the conn_server(...) function from libfwall.a library and the net_connect(..) (in gio.c), from a simple test-file, and it still works fine, but when http-gw calls net_connet(..) it fails. Can someone help me? Thanks. From owner-fwtk-users@ex.tis.com Fri Feb 4 10:54 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA18180 Fri, 4 Feb 2000 10:54:23 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA15466; Fri, 4 Feb 2000 07:58:01 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 07:40:17 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA09593 for fwtk-users-outgoing; Fri, 4 Feb 2000 07:40:01 -0800 (PST) X-Authentication-Warning: aeria.eic.at: nobody set sender to using -f Message-ID: <389ADFB3.78D57B17@eic.at> Date: Fri, 04 Feb 2000 15:18:27 +0100 From: "Johann G. Hautzinger" Organization: Erste Bank AG X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.13 i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: Re: abuse of my mail gateway References: <3.0.6.32.20000204103808.00c22ce0@mail.lr.isla.pt> <423806.A1EE5AA3@eic.at> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 489 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] "Johann G. Hautzinger" wrote: > i used the Yao-smap.pch and on SuSE 6.3 had to change the following: make that SuSE 6.1 ;-) wishing a nice weekend Hannes -- Johann Georg Hautzinger, email: trema@eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at From owner-fwtk-users@ex.tis.com Fri Feb 4 10:54 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA18185 Fri, 4 Feb 2000 10:54:52 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA15646; Fri, 4 Feb 2000 07:58:31 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 07:40:15 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA09590 for fwtk-users-outgoing; Fri, 4 Feb 2000 07:40:01 -0800 (PST) X-Authentication-Warning: aeria.eic.at: nobody set sender to using -f Message-ID: <423806.A1EE5AA3@eic.at> Date: Fri, 20 Feb 1970 06:28:38 +0100 From: "Johann G. Hautzinger" Organization: Erste Bank AG X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.13 i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: Re: abuse of my mail gateway References: <3.0.6.32.20000204103808.00c22ce0@mail.lr.isla.pt> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1552 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Nuno Guarda wrote: > > At 09:50 04-02-2000 +0100, you wrote: [...] > >fiddling with sendmail (which should be responsible for delivering mail, > >as far as i understood the concept behind smap/smapd) did not change > >anything. > >please help me to stop spam coming from my site > Try installing the patch avalable at > http://www.sabernet.net/software/nospam.html yup - right, different patch but right idea, thnx to Andreas Waller for helping me as the first one. the reason was simple but i (and i think as many others do) did not think of it: as soon as smap takes a mail it is coming from a local machine (your own mailserver) and therefor it is rather complicated to tell sendmail _not_ to consider it a local email going out. solution for this: just patch smap! i used the Yao-smap.pch and on SuSE 6.3 had to change the following: in Makefile.config, line 57 add the necessary libraries (i did "AUXLIB= -lresolv -lcrypt -lgdbm" where "-lresolv" is the real important thing for smap to compile) if you do not want the idea of smap crying out loud "HEY! IT'S ME - HOSTNAME.DOMAIN.TLD!!!" then change the source for smap.c (around line 1165) thnx again to Alex and the community *greetz* from vienna Hannes -- Johann Georg Hautzinger, email: trema@eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at From owner-fwtk-users@ex.tis.com Fri Feb 4 10:56 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA18189 Fri, 4 Feb 2000 10:56:17 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA16209; Fri, 4 Feb 2000 07:59:56 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 07:42:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA10310 for fwtk-users-outgoing; Fri, 4 Feb 2000 07:42:35 -0800 (PST) From: WEBER_Rene/CO@IEC.iec.ch X-OpenMail-Hops: 1 Date: Fri, 4 Feb 2000 16:39:39 +0100 Message-Id: Subject: FWTK vs CISCO PIX520 MIME-Version: 1.0 TO: fwtk-users@ex.tis.com Content-Disposition: inline; filename="FWTK" Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII; name="FWTK" Content-Length: 531 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, Since 1995 we are running a firewall using FWTK. My company now wants to replace it by a CISCO PIX520, saying its easier to manage and has better performance. Has anyone some information comparing these two firewall solutions? Has anyone information about the CISCO PIX520 (not the official CISCO information). Thanks and have a fine weekend. Rene Weber IT-Mgr. IEC-CO GENEVA, Switzerland From owner-fwtk-users@ex.tis.com Fri Feb 4 11:57 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA18532 Fri, 4 Feb 2000 11:57:20 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA28135; Fri, 4 Feb 2000 09:00:56 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 08:52:32 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA25637 for fwtk-users-outgoing; Fri, 4 Feb 2000 08:52:23 -0800 (PST) Message-ID: <20000204165222.16081.qmail@hotmail.com> X-Originating-IP: [204.144.241.231] From: "Carl Blosser" To: fwtk-users@ex.tis.com Subject: yao-smap.pch Date: Fri, 04 Feb 2000 08:52:22 PST Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; format=flowed Content-Length: 464 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] After, installing the patch I couldn't send mail to outside hosts. This is the error I received 551 Recipient must be in the local domain(s). And in /var/log/messages the error just said Mail not local TIA Carl Blosser ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From owner-fwtk-users@ex.tis.com Fri Feb 4 11:57 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA18531 Fri, 4 Feb 2000 11:57:19 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA28131; Fri, 4 Feb 2000 09:00:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 08:53:28 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA25884 for fwtk-users-outgoing; Fri, 4 Feb 2000 08:53:25 -0800 (PST) From: ark@eltex.ru Date: Fri, 4 Feb 2000 19:48:01 +0300 Message-Id: <200002041648.TAA30262@paranoid.eltex.spb.ru> In-Reply-To: from "WEBER_Rene/CO@IEC.iec.ch" Organization: "Klingon Imperial Intelligence Service" Subject: Re: FWTK vs CISCO PIX520 To: WEBER_Rene/CO@IEC.iec.ch Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1425 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, They are comparing 2 completely different things. PIX is good for protecting DMZ, fwtk is much better for protecting LAN. PIX definitely has better performance due to its architecture and not so deep protocol analysis. About "easier to manage" it depends what do you mean when saying that. WEBER_Rene/CO@IEC.iec.ch said : > Since 1995 we are running a firewall using FWTK. > My company now wants to replace it by a CISCO PIX520, saying its easier to > manage and has better performance. > > Has anyone some information comparing these two firewall solutions? > Has anyone information about the CISCO PIX520 (not the official CISCO > information). _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOJsCv6H/mIJW9LeBAQGh0AQArVPsFN3EMYhSCNVBiY6biBN6EI+JmhM7 JR+4mujcN3Dh2dU7Dqxi8ksYpQyZsvMYibL3DM/svAejU2f67RUPrAtdSRgn+m22 wPPwPsnD6ScHW2eZCOdfhzQptcFbHOUrqWA+Tfl/ZFncEV2c7JeMssF9oEBIGeQq YFgAbuq0YC0= =Bw+Z -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Fri Feb 4 12:15 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA18628 Fri, 4 Feb 2000 12:14:59 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA01839; Fri, 4 Feb 2000 09:18:37 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 09:13:58 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA00472 for fwtk-users-outgoing; Fri, 4 Feb 2000 09:13:47 -0800 (PST) Mime-Version: 1.0 X-Sender: christianr@ntmail.signalgene.com Message-Id: Date: Fri, 4 Feb 2000 12:13:35 -0500 To: fwtk-users@ex.tis.com From: Christian Raymond Subject: a few questions... Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 997 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all I know this is a little off topic, but I'm in the process of updating my firewall. I'm currently running FWTK 1.3 on an old kernel. My plan is to install FWTK 2.1 on RedHat 6.1. firstt, what are the pros and cons of using FWTK instead of IPChains. It is my understanding that fwtk rely on IPChains, but is IPChains alone is enough for a firewall? second, is there a way to implement a VPN solution through fwtk? I need to connect either Mac and PC to my lan with VPN encription. Can I do it through fwtk, and do any of you know a tool I can use? I know this is a little off-topic, but if any of you can help, it'd be great. Thanks in advance, Chris ------------------------------------------------------------ Christian Raymond System Administrator SignalGene Inc. craymond@signalgene.com ------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Fri Feb 4 14:37 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA19358 Fri, 4 Feb 2000 14:37:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA20409; Fri, 4 Feb 2000 11:40:52 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 4 Feb 2000 11:35:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA19195 for fwtk-users-outgoing; Fri, 4 Feb 2000 11:35:10 -0800 (PST) Message-ID: <389B203F.8C9AE039@norstedtstryckeri.se> Date: Fri, 04 Feb 2000 19:53:51 +0100 From: Penty Wenngren Organization: Graphium Norstedts Tryckeri X-Mailer: Mozilla 4.7 [en] (X11; U; Linux 2.2.14 i686) X-Accept-Language: sv, en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: Re: yao-smap.pch References: <20000204165222.16081.qmail@hotmail.com> <389B14AA.10B437E9@usrconsult.be> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1389 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Michel Bardiaux wrote: > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Carl Blosser wrote: > > > > After, installing the patch I couldn't send mail to outside hosts. > > > > This is the error I received > > > > 551 Recipient must be in the local domain(s). > > > > And in /var/log/messages > > the error just said Mail not local > > > > TIA > > Carl Blosser > > > > ______________________________________________________ > > Get Your Private, Free Email at http://www.hotmail.com > > You have to use *two* smap executables: unpatched for outgoing mail, > i.e. > SMTP requests from internal net; patched for incoming SMTP requests. > I really don't think so, or else I have misconfigured my smap awfully. This is what my netperm-table looks like and this works just fine in both directions. smap, smapd: userid mail smap, smapd: directory /var/spool/smap smapd: executable /usr/local/etc/smapd smapd: sendmail /usr/sbin/sendmail smap: timeout 3600 smap: check-from-address 1 smap: check-user-address 1 smap: domains domain.com smap: hosts 10.10.10.* smap: require-full-email 1 -- Penty Wenngren // Graphium Norstedts Tryckeri From owner-fwtk-users@ex.tis.com Sat Feb 5 10:33 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA21844 Sat, 5 Feb 2000 10:33:49 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA06604; Sat, 5 Feb 2000 07:37:26 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 5 Feb 2000 07:30:50 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA05904 for fwtk-users-outgoing; Sat, 5 Feb 2000 07:30:49 -0800 (PST) Date: Sat, 5 Feb 2000 19:00:39 +0330 (IRT) From: Hossein Pourreza To: fwtk users Subject: Question about FWTK Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 356 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi to all I read source code of http-gw and found that it checks some options in netperm-table that fwtk neve talks about them i.e. url-filter, noproxy and etc. Does some one help me about using this options? Regards Pourreza From owner-fwtk-users@ex.tis.com Sun Feb 6 00:42 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id AAA23486 Sun, 6 Feb 2000 00:42:55 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id VAA18525; Sat, 5 Feb 2000 21:46:35 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 5 Feb 2000 21:42:14 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA17821 for fwtk-users-outgoing; Sat, 5 Feb 2000 21:42:03 -0800 (PST) From: doctor@fruitbat.org Message-Id: <200002060543.VAA18405@gremlin.fruitbat.org> Subject: Re: Firewalls and SQLNet To: ividal@mecon.ar (ividal) Date: Sat, 5 Feb 2000 21:43:39 -0800 (PST) Cc: ark@eltex.ru, mbardiaux@usrconsult.be, fwtk-users@ex.tis.com In-Reply-To: from "ividal" at Feb 04, 2000 07:28:00 AM X-Mailer: ELM [version 2.5 PL1] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 692 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] ividal said ... > On Feb 4, 2000, ark@eltex.ru wrote: > > > >nuqneH, > > > >.does anybody here have protocol specs (maybe reverse-engineered at least)? > > Surely nobody has Oracle's specs ;) It would be more trouble than it's worth to reverse-engineered it. You'd end up having to find and parse character-set dependent strings containing the SQL*Net connect string. Your best bet would be to file a bug with Oracle Support and hope they can find a solution for you. > Greets > Ignacio -- Peter A. Castro (doctor@fruitbat.org) or (pcastro@us.oracle.com) From owner-fwtk-users@ex.tis.com Mon Feb 7 03:50 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA27356 Mon, 7 Feb 2000 03:50:10 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA06652; Mon, 7 Feb 2000 00:53:43 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 7 Feb 2000 00:45:18 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA05849 for fwtk-users-outgoing; Mon, 7 Feb 2000 00:45:18 -0800 (PST) Date: Mon, 7 Feb 2000 09:45:50 +0100 (CET) From: Saverio Armeni X-Sender: armeni@bode.dsi.unifi.it To: fwtk-users@lists.nai.com Subject: Re: http-gw (failed to connect to http server www.xxx.yyy (80)) In-Reply-To: <389E0F31.BF08D170@erols.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1740 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Sun, 6 Feb 2000, Keith Young wrote: > Saverio Armeni wrote: > > > > Hi, I've compiled the fwtk toolkit on a linux system (RH6.1, with kernel > > version 2.2.14). > > I've tested http-gw in to two different ways: > > from inetd > > standalone daemon > > both on 8080 port > > > > That's what i get: > > when i connect to the proxy from a http browser, i get the error message > > failed to connect to http server www.xxx.yyy (80) > > or > > Network connection closed during write > > No idea... have you looked at your routing to get to www.xxx.yyy? Yes with ip numbers all works fine, and when i disable the proxy in my browser there are no problems with my dns, it works fine with a naming caching server (named daemon on Linux machine configured as in HOWTO-DNS) and with a "direct" connection with my isp dns. I've tested the conn_server(...) and the net_connect(...) functions, and standalone these function works very well, something happens when these functions are called in http-gw.c > Anything showing in the logs? Which version of the FWTK are you using? No other messages in the logs. I've used the latest version of fwtk available: 2.1 in may, but the same thinks happens with release 2.1 in february. It's possible that there are some problems using the glibc-2.1 instead of using old glibc-2.0 version? > > You might want to add the answers to the above questions and post them > to the FWTK user's mailing list. Address info is at: > http://www.fwtk.org/fwtk/download/downloading.html#3.2 > > Cheers, > > --Keith > -avenger@erols.com > From owner-fwtk-users@ex.tis.com Mon Feb 7 04:23 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA27437 Mon, 7 Feb 2000 04:23:49 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA09477; Mon, 7 Feb 2000 01:27:29 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 7 Feb 2000 01:25:22 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA08741 for fwtk-users-outgoing; Mon, 7 Feb 2000 01:25:21 -0800 (PST) From: adrian.blount@police.wa.gov.au Message-ID: <0FC3120E5F7AD3118BAD00508B1378B81DCFDF@exhsrv4.police.wa.gov.au> To: fwtk-users@lists.nai.com Subject: Lots of smap processes runnning Date: Mon, 7 Feb 2000 17:25:37 +0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1390 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I've got smap/smapd (part of the TIS Firewall Toolkit at http://www.fwtk.org) running as a wrapper for sendmail (v8.9.3) on a Solaris 2.6(sparc) box and there are LOTS of smap processes that have been around for up to a few days. Other mail servers are getting SMTP timeouts connecting to my server, I think due to smap having too many connections open and the kernel being unable to bind another smap tcp/ip connection. I am very new to smap and sendmail (inherited this job from someone else) so am not entirely sure where to go from here. I saw a patch for smap (http://www.fwtk.org/fwtk/patches/patches.html#2.2) regarding reading an EOF instead of just a "." by itself as a valid end-of-message and have noticed the /var/spool/mqueue directory that smap writes to has many qf* files with just a "." at the end. Could these things be related? Has anyone got any ideas about what might be causing smap processes to not die? Any suggestions appreciated. I will summarise any responses and post for the information of others. Regards, Adrian Blount Unix Administrator E-mail: adrian.blount@police.wa.gov.au IMD Systems Phone : +61 8 9222 1117 Western Australia Police Service Fax : +61 8 9222 1698 From owner-fwtk-users@ex.tis.com Mon Feb 7 08:31 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA28273 Mon, 7 Feb 2000 08:31:14 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA22582; Mon, 7 Feb 2000 05:34:54 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 7 Feb 2000 05:32:04 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA21771 for fwtk-users-outgoing; Mon, 7 Feb 2000 05:32:01 -0800 (PST) Date: Mon, 7 Feb 2000 08:29:51 -0500 (EST) From: Ted Keller To: adrian.blount@police.wa.gov.au cc: fwtk-users@lists.nai.com Subject: Re: Lots of smap processes runnning In-Reply-To: <0FC3120E5F7AD3118BAD00508B1378B81DCFDF@exhsrv4.police.wa.gov.au> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2377 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Adrian, The smap timeout processing is a bit suspect at time. It's been an area that I re-implemented with a simpler process which seems to be much better at finding and killing off old connections. The issue is when the remote site goes away, sometimes smap can't detect that - and hangs waiting for the completion of a read from that site. Stock smap does have timeout processing included - but sometimes I think that gets mixed up with sokeepalive and other tcp parameters. Sesstions that are older than a few hours can certainly be killed off. Some have implemented cron jobs to do this. I've re-implemented the smap code - and in part - the timeout processing. I can provide if you are interested. ted keller - bfg.com On Mon, 7 Feb 2000 adrian.blount@police.wa.gov.au wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > I've got smap/smapd (part of the TIS Firewall Toolkit at > http://www.fwtk.org) running as a wrapper for sendmail (v8.9.3) on a Solaris > 2.6(sparc) box and there are LOTS of smap processes that have been around > for up to a few days. Other mail servers are getting SMTP timeouts > connecting to my server, I think due to smap having too many connections > open and the kernel being unable to bind another smap tcp/ip connection. I > am very new to smap and sendmail (inherited this job from someone else) so > am not entirely sure where to go from here. > > I saw a patch for smap (http://www.fwtk.org/fwtk/patches/patches.html#2.2) > regarding reading an EOF instead of just a "." by itself as a valid > end-of-message and have noticed the /var/spool/mqueue directory that smap > writes to has many qf* files with just a "." at the end. > > Could these things be related? Has anyone got any ideas about what might be > causing smap processes to not die? > > Any suggestions appreciated. I will summarise any responses and post for > the information of others. > > Regards, > > Adrian Blount > > Unix Administrator E-mail: adrian.blount@police.wa.gov.au > IMD Systems Phone : +61 8 9222 1117 > Western Australia Police Service Fax : +61 8 9222 1698 > From owner-fwtk-users@ex.tis.com Mon Feb 7 08:39 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA28335 Mon, 7 Feb 2000 08:39:41 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA24720; Mon, 7 Feb 2000 05:43:15 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 7 Feb 2000 05:40:09 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA23514 for fwtk-users-outgoing; Mon, 7 Feb 2000 05:40:07 -0800 (PST) X-Authentication-Warning: aeria.eic.at: nobody set sender to using -f Message-ID: <389E6632.A8A4F2E6@eic.at> Date: Mon, 07 Feb 2000 07:29:06 +0100 From: "Johann G. Hautzinger" Organization: Erste Bank AG X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.13 i686) X-Accept-Language: en MIME-Version: 1.0 To: Carl Blosser CC: fwtk-users@ex.tis.com Subject: Re: yao-smap.pch References: <20000204165222.16081.qmail@hotmail.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1042 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Carl Blosser wrote: > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > After, installing the patch I couldn't send mail to outside hosts. > > This is the error I received > > 551 Recipient must be in the local domain(s). > > And in /var/log/messages > the error just said Mail not local hi, there are several new options for the netperm-table (you can find them documented in the source) i am using the following: smap: check-from-address 1 smap: permit-domains mydomain.at smap: permit-hosts mymailserver.mydomain.at its.ip.add.ress smap: require-full-email 1 hth Hannes -- Johann Georg Hautzinger, email: trema@eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at From owner-fwtk-users@ex.tis.com Mon Feb 7 08:41 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA28342 Mon, 7 Feb 2000 08:41:02 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA25344; Mon, 7 Feb 2000 05:44:42 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 7 Feb 2000 05:41:13 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA23892 for fwtk-users-outgoing; Mon, 7 Feb 2000 05:41:10 -0800 (PST) X-Authentication-Warning: proxy.tfcc.com: mail set sender to using -f From: "Todd Williams" To: Subject: smap usage error when encountering a long list of e-mail delivery addresses Date: Mon, 7 Feb 2000 05:53:17 -0500 Message-ID: <008c01bf7159$8ac5f380$8702a8c0@twilliams.tfcc.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1854 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] What I'm seeing is that smap/smapd is discarding several e-mails due to the length/number of addresses in the "To:" field of the e-mail messages. (The names are changed to protect the innocent.) FWTK 2.1 on Redhat 5.2 Here is a sample: Feb 4 21:35:50 proxy smap[1972]: connect host=foo.localnet.com/192.168.150.55 Feb 4 21:35:50 proxy smap[1972]: host=foo.localnet.com/192.168.150.55 bytes=504 from= to= using -f Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: <200002060543.VAA18405@gremlin.fruitbat.org> References: <200002060543.VAA18405@gremlin.fruitbat.org> Date: Mon, 7 Feb 2000 13:23:25 -0700 To: ark@eltex.ru From: Blair Lowe Subject: Re: Firewalls and SQLNet Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 1403 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, Actually sometimes reverse engineering is easier than dealing with ORACLE support;) Before you talk to them, you will have to set up a scenario that a Junior ORACLE programmer can look at and make sense out of. Be patient, and expect nothing. We would love to hear your results. Oh yes. ORACLE tech net is sometimes a better place to get support: http://technet.oracle.com. Sometimes oracle support is the only option. Blair. >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >ividal said ... > > On Feb 4, 2000, ark@eltex.ru wrote: >> > >> >nuqneH, >> > >> >.does anybody here have protocol specs (maybe reverse-engineered at least)? >> >> Surely nobody has Oracle's specs ;) > >It would be more trouble than it's worth to reverse-engineered it. You'd >end up having to find and parse character-set dependent strings >containing the SQL*Net connect string. Your best bet would be to file a >bug with Oracle Support and hope they can find a solution for you. > >> Greets >> Ignacio > >-- >Peter A. Castro (doctor@fruitbat.org) or (pcastro@us.oracle.com) Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) From owner-fwtk-users@ex.tis.com Wed Feb 9 06:24 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA07726 Wed, 9 Feb 2000 06:24:06 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA27422; Wed, 9 Feb 2000 03:27:46 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 9 Feb 2000 03:15:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA26551 for fwtk-users-outgoing; Wed, 9 Feb 2000 03:15:36 -0800 (PST) Message-ID: <1A2B916673DFD211ABC700805FA7AA689612D5@MSX11002> From: "Lidgate, Chris A" To: "'fwtk-users@ex.tis.com'" Subject: FTP error 425 Date: Wed, 9 Feb 2000 05:15:41 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1461 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I've just seen an odd message that I've never seen before and wondered if someone could shed some light on what was happening. >From a browser, accessing ftp://ftp.adaptec.com I always get this message from http-gw on our firewall. FTP Error- 425 425 Can't build data connection: Connection refused. However if I use command line ftp the connection works perfectly as the following transcipt shows. sun20{lidgaca} ftp firewall Connected to firewall. 220- 220- Welcome to the FOO.COM ftp proxy. 220- ================================= 220- 220- ... Usual legal bollox here ... 220 Name (firewall:expcl): anonymous@ftp.adaptec.com 331-(----GATEWAY CONNECTED TO ftp.adaptec.com----) 331-(220 jester FTP server (Version wu-2.4.2-academ (1) Thu Apr 1 17:16:29 PST 1999) ready.) 331 Guest login ok, send your complete e-mail address as password. Password: 230-************************************************************ 230-* 230-* Welcome to Adaptec's FTP Site. 230-* 230-* By downloading software from this site, you agree 230-* to Adaptec's legal terms and conditions described 230-* in this URL: Obviusly http-gw is objecting to the site for some reason, but does anyone know why ? Our firewall is Linux based, and is running fwtk v2.1. Regards, Chris Lidgate. From owner-fwtk-users@ex.tis.com Wed Feb 9 07:18 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA07941 Wed, 9 Feb 2000 07:18:04 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA00797; Wed, 9 Feb 2000 04:21:45 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 9 Feb 2000 04:18:30 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA00018 for fwtk-users-outgoing; Wed, 9 Feb 2000 04:18:29 -0800 (PST) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) MIME-Version: 1.0 In-Reply-To: <1A2B916673DFD211ABC700805FA7AA689612D5@MSX11002> Date: Wed, 09 Feb 2000 12:18:45 -0000 (GMT) From: Tony Gale To: "Lidgate, Chris A" , avenger@erols.com Subject: RE: FTP error 425 Cc: "fwtk-users@ex.tis.com" Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="_=XFMail.1.4.4.Linux:20000209121845:21948=_" Content-Length: 3656 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format --_=XFMail.1.4.4.Linux:20000209121845:21948=_ Content-Type: text/plain; charset=iso-8859-1 Bizarre. I've only ever encountered this problem with a particular broken version of IIS 4. The included patch should fix this. Let me know how it goes. Problem description: Some FTP servers don't like receiving commands split over multiple packets. They are broken. avenger: a FAQ/patches candidate. -tony On 09-Feb-2000 Lidgate, Chris A wrote: > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I've just seen an odd message that I've never seen before > and wondered if someone could shed some light on what was > happening. > >>From a browser, accessing ftp://ftp.adaptec.com I always > get this message from http-gw on our firewall. > > FTP Error- 425 > > 425 Can't build data connection: Connection refused. > > However if I use command line ftp the connection works perfectly > as the following transcipt shows. > > sun20{lidgaca} ftp firewall > Connected to firewall. > 220- > 220- Welcome to the FOO.COM ftp proxy. > 220- ================================= > 220- > 220- ... Usual legal bollox here ... > 220 > Name (firewall:expcl): anonymous@ftp.adaptec.com > 331-(----GATEWAY CONNECTED TO ftp.adaptec.com----) > 331-(220 jester FTP server (Version wu-2.4.2-academ (1) Thu Apr 1 > 17:16:29 PST 1999) ready.) > 331 Guest login ok, send your complete e-mail address as password. > Password: > 230-************************************************************ > 230-* > 230-* Welcome to Adaptec's FTP Site. > 230-* > 230-* By downloading software from this site, you agree > 230-* to Adaptec's legal terms and conditions described > 230-* in this URL: > > Obviusly http-gw is objecting to the site for some reason, but does > anyone know why ? > > Our firewall is Linux based, and is running fwtk v2.1. > > > > > > Regards, > > > > > Chris Lidgate. --- E-Mail: Tony Gale The average income of the modern teenager is about 2 a.m. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. --_=XFMail.1.4.4.Linux:20000209121845:21948=_ Content-Disposition: attachment; filename="fwtk-broken-ftp-svr.patch" Content-Transfer-Encoding: base64 Content-Description: fwtk-broken-ftp-svr.patch Content-Type: application/octet-stream; name=fwtk-broken-ftp-svr.patch; SizeOnDisk=533 KioqIGZ3dGsuZGlzdC9md3RrL2h0dHAtZ3cvaG1haW4uYwlGcmkgRmViICA2IDIzOjMyOjE2IDE5 OTgKLS0tIGZ3dGsvZnd0ay9odHRwLWd3L2htYWluLmMJV2VkIEp1biAgOSAxNjoxODoxNyAxOTk5 CioqKioqKioqKioqKioqKgoqKiogOTQ1LDk1MyAqKioqCiAgY2hhcgkqczsKICBpbnQJbjsKICB7 CiEgCWlmKG5ldF93cml0ZShmZCxzLG4pICE9IG4pCiEgCQlyZXR1cm4oMSk7CiEgCXJldHVybihu ZXRfd3JpdGUoZmQsIlxyXG4iLDIpICE9IDIpOwogIH0KICAKICAKLS0tIDk0Miw5NTggLS0tLQog IGNoYXIJKnM7CiAgaW50CW47CiAgewohIAljaGFyICpidWZmOwohIAlpbnQgcmV0dmFsOwohIAoh IAlpZiAoIChidWZmID0gbWFsbG9jKG4rMikpID09IE5VTEwpCiEgCQlyZXR1cm4oMCk7CiEgCW1l bWNweShidWZmLCBzLCBuKTsKISAJYnVmZltuXT0nXHInOwohIAlidWZmW24rMV09J1xuJzsKISAJ cmV0dmFsID0gbmV0X3dyaXRlKGZkLGJ1ZmYsbisyKTsKISAJZnJlZShidWZmKTsKISAJcmV0dXJu KHJldHZhbCk7CiAgfQogIAogIAo= --_=XFMail.1.4.4.Linux:20000209121845:21948=_-- End of MIME message From owner-fwtk-users@ex.tis.com Wed Feb 9 07:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA07996 Wed, 9 Feb 2000 07:32:51 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA02600; Wed, 9 Feb 2000 04:36:30 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 9 Feb 2000 04:33:09 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA01790 for fwtk-users-outgoing; Wed, 9 Feb 2000 04:33:07 -0800 (PST) X-Authentication-Warning: aeria.eic.at: nobody set sender to using -f Message-ID: <38A15E63.9A00F320@eic.at> Date: Wed, 09 Feb 2000 13:32:35 +0100 From: "Johann G. Hautzinger" Organization: Erste Bank AG X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.13 i686) X-Accept-Language: en MIME-Version: 1.0 To: TIS Mailing List Subject: smap once again ... Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 794 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi all, from time to time (especially when sending out mails to a lot of recipients) i get the following error: Feb 9 09:11:43 hostname smap[8041]: fwtksyserr: Reset state following questions arise: 1. what is this? 2. where does it come from? 3. what can i do to prevent it? 4. have i overread the important part in the docu? maybe you can answer one or two of them i am using fwtk 2.1 with yao-smap.pch applied on SuSE 6.1 *greetz* from Vienna Hannes -- Johann Georg Hautzinger, email: trema@eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at From owner-fwtk-users@ex.tis.com Wed Feb 9 08:21 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA08163 Wed, 9 Feb 2000 08:21:37 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA06461; Wed, 9 Feb 2000 05:25:19 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 9 Feb 2000 05:21:34 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA05025 for fwtk-users-outgoing; Wed, 9 Feb 2000 05:21:31 -0800 (PST) Message-ID: <000c01bf7290$98bddce0$212fd4c8@saoit.br.originit.com> From: "ddss" To: Subject: HELP ... TIS works at ... Date: Tue, 8 Feb 2000 21:59:36 -0200 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2014.211 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2014.211 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 576 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi TIS workers ... Please, I need some help ... I would like to clear some questions: 01. Where the proxy TIS FWTK work ??? (a). Application level (gateway) (s). Session level (circuit relay) (t). Transport level (circuit relay) 02. Are there some way to verify the context of data ??? 03. Where I can find statistics about the use of TIS FWTK against others ??? Thanks, ddss@zaz.com.br From owner-fwtk-users@ex.tis.com Wed Feb 9 08:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA08166 Wed, 9 Feb 2000 08:22:02 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA06638; Wed, 9 Feb 2000 05:25:43 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 9 Feb 2000 05:21:32 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA05024 for fwtk-users-outgoing; Wed, 9 Feb 2000 05:21:31 -0800 (PST) From: doctor@fruitbat.org Message-Id: <200002082227.OAA21806@gremlin.fruitbat.org> Subject: Re: Firewalls and SQLNet To: Blair.Lowe@compeng.net (Blair Lowe) Date: Tue, 8 Feb 2000 14:27:04 -0800 (PST) Cc: ark@eltex.ru, fwtk-users@ex.tis.com In-Reply-To: from "Blair Lowe" at Feb 07, 2000 01:23:25 PM X-Mailer: ELM [version 2.5 PL1] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2025 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Blair Lowe said ... > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > Actually sometimes reverse engineering is easier than dealing with > ORACLE support;) > > Before you talk to them, you will have to set up a scenario that a > Junior ORACLE programmer can look at and make sense out of. Actually, for simple questions like "how can I do SQL*Net through firewall brand X" Oracle support has canned answers. If not, it'll be routed to a SQL*Net engineer. There aren't any Junior SQL*Net programmers, at least none that get any customer contact :-) > Be patient, and expect nothing. > We would love to hear your results. > > Oh yes. ORACLE tech net is sometimes a better place to get support: > http://technet.oracle.com. Very, true. Technet is a good resource. > Sometimes oracle support is the only option. > > Blair. > > >[To be removed from this list send the message "unsubscribe fwtk-users" in the > >BODY of a mail message to majordomo@ex.tis.com.] > > > >ividal said ... > > > On Feb 4, 2000, ark@eltex.ru wrote: > >> > > >> >nuqneH, > >> > > >> >.does anybody here have protocol specs (maybe reverse-engineered at least)? > >> > >> Surely nobody has Oracle's specs ;) > > > >It would be more trouble than it's worth to reverse-engineered it. You'd > >end up having to find and parse character-set dependent strings > >containing the SQL*Net connect string. Your best bet would be to file a > >bug with Oracle Support and hope they can find a solution for you. > > > >> Greets > >> Ignacio > > > >-- > >Peter A. Castro (doctor@fruitbat.org) or (pcastro@us.oracle.com) > > Computer Engineering Inc. > http://www.compeng.net > Phone: 780 499 5687 (9 - 5 MST) > Fax: 780 435 0693 (24 Hours) > -- Peter A. Castro (doctor@fruitbat.org) or (pcastro@us.oracle.com) From owner-fwtk-users@ex.tis.com Wed Feb 9 16:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA11018 Wed, 9 Feb 2000 16:22:55 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA02646; Wed, 9 Feb 2000 13:26:32 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 9 Feb 2000 13:22:39 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA01808 for fwtk-users-outgoing; Wed, 9 Feb 2000 13:22:38 -0800 (PST) From: pazhamalai.raman@wipro.com (Pazhamalai Jayaraman) To: fwtk-users@tis.com Subject: Smap Errors X-Mailer: Netscape Messenger Express 3.5.2 [Mozilla/4.7 [en] (X11; I; SunOS 5.6 sun4u)] Date: Thu, 10 Feb 2000 02:21:30 +0530 Message-ID: <7735E5B8140A.AAA4046@ace.wipsys.soft.net> Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 653 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi gurus - I am getting the following error on my mail server. I am running TIS FWTK on a linux box and the FWTK version is 2.0 The errors are related to smap and i am getting too many such messages in the log file. ----------------------------------------------- Feb 1 00:08:42 mailhub.wipsys.soft.net smap[6435]: n2a get_local_info: open to get interface configuration: No such file or directory ----------------------------------------------- Any help in this regard will be highly appreciated. regards JJ From owner-fwtk-users@ex.tis.com Wed Feb 9 22:29 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA12165 Wed, 9 Feb 2000 22:29:03 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA02961; Wed, 9 Feb 2000 19:32:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 9 Feb 2000 19:27:26 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA01900 for fwtk-users-outgoing; Wed, 9 Feb 2000 19:27:25 -0800 (PST) From: Toby.Schau@idob.state.ia.us Message-Id: <200002100328.TAA03838@relay.nai.com> Reply-To: Toby Schau To: fwtk-users@tis.com Subject: winsock Date: 09 Feb 00 21:20:56 -0600 X-Mailer: NeoPlanet Version: 5.0.0.1042 X-ID: 6104BD40AF6311D38697444553540000 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 424 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello fellow fwtk users, I am wondering if it is possible to use winsock proxying to get windows machines, IIS Exchange, to listen to the external port on the FWTK for incoming requests. Any ideas? Thanks Toby Toby.Schau@idob.state.ia.us Download NeoPlanet at http://www.neoplanet.com From owner-fwtk-users@ex.tis.com Thu Feb 10 06:25 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA13392 Thu, 10 Feb 2000 06:25:15 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA27105; Thu, 10 Feb 2000 03:28:58 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 10 Feb 2000 03:23:27 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA26311 for fwtk-users-outgoing; Thu, 10 Feb 2000 03:23:26 -0800 (PST) Message-Id: Mime-Version: 1.0 Date: Thu, 10 Feb 2000 12:20:39 -0800 To: fwtk-users@lists.nai.com From: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.) Subject: spoofing Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 587 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, Have anyone a suggestion about spoofing-protection with FWTK or with onather programm ? Thanks! /--------------------------------o00-----00o-------------------------\ Stefan Heim Uni Ulm Sektion Informatik in der Psychotherapie Am Hochstraess 8 89081 Ulm Germany E-Mail: heim@sip.Medizin.Uni-Ulm.de http://sip.medizin.uni-ulm.de Tel: +49-(0)731-50-25702 Fax: +49-(0)731-50-25662 \-------------------------------ooo0-----0ooOo---------------------/ From owner-fwtk-users@ex.tis.com Thu Feb 10 07:53 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA13601 Thu, 10 Feb 2000 07:53:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA03717; Thu, 10 Feb 2000 04:56:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 10 Feb 2000 04:54:13 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA02841 for fwtk-users-outgoing; Thu, 10 Feb 2000 04:54:11 -0800 (PST) Message-ID: <1A2B916673DFD211ABC700805FA7AA689612DD@MSX11002> From: "Lidgate, Chris A" To: "'fwtk-users@ex.tis.com'" Cc: fwtk-users@ex.tis.com Subject: RE: FTP error 425 Date: Thu, 10 Feb 2000 06:54:39 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 2232 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Just to report that the Patch that Tony provided seems to have done the trick. I made the changes to http-gw last night, was able to acces the troublesome site, and have not seen any side effects through today. I would recommend that this patch be included on the fwtk site. I'd also like to extend my thanks to Tony for being so quick off the mark in sorting this out. It's times like this that the value of open source software really becomes apparent. I've emailed the admin of ftp.adaptec.com to inform them that it looks like there's something wrong with their ftp server, but so far haven't got to talk to anybody technical enough to get the point across to. However it does look as though the problem that Tony describes here is perhaps more prevalent amongst ftp servers than Tony thought. Thanks again, Chris > ---------- > From: Tony Gale[SMTP:gale@syntax.dera.gov.uk] > Sent: 09 February 2000 12:18 > To: Lidgate, Chris A; avenger@erols.com > Cc: fwtk-users@ex.tis.com > Subject: RE: FTP error 425 > > <> > > Bizarre. I've only ever encountered this problem with a particular > broken version of IIS 4. > > The included patch should fix this. Let me know how it goes. > > Problem description: > Some FTP servers don't like receiving commands split over > multiple packets. They are broken. > > avenger: a FAQ/patches candidate. > > -tony > > > On 09-Feb-2000 Lidgate, Chris A wrote: > > [To be removed from this list send the message "unsubscribe > > fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > I've just seen an odd message that I've never seen before > > and wondered if someone could shed some light on what was > > happening. > > > >>From a browser, accessing ftp://ftp.adaptec.com I always > > get this message from http-gw on our firewall. > > > > FTP Error- 425 > > > > 425 Can't build data connection: Connection refused. > > > > However if I use command line ftp the connection works perfectly > > as the following transcipt shows. > > > [snip] From owner-fwtk-users@ex.tis.com Fri Feb 11 14:24 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA19744 Fri, 11 Feb 2000 14:23:58 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA00538; Fri, 11 Feb 2000 11:27:35 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 11 Feb 2000 11:18:53 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA28391 for fwtk-users-outgoing; Fri, 11 Feb 2000 11:18:52 -0800 (PST) Date: Fri, 11 Feb 2000 14:19:37 -0500 From: Joseph S D Yao To: WEBER_Rene/CO@IEC.iec.ch Cc: fwtk-users@ex.tis.com Subject: Re: FWTK vs CISCO PIX520 Message-Id: <20000211141937.P14390@washington.cospo.osis.gov> Mail-Followup-To: WEBER_Rene/CO@IEC.iec.ch, fwtk-users@ex.tis.com References: Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from WEBER_Rene/CO@IEC.iec.ch on Fri, Feb 04, 2000 at 04:39:39PM +0100 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1008 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Feb 04, 2000 at 04:39:39PM +0100, WEBER_Rene/CO@IEC.iec.ch wrote: > Since 1995 we are running a firewall using FWTK. > My company now wants to replace it by a CISCO PIX520, saying its easier to > manage and has better performance. > > Has anyone some information comparing these two firewall solutions? > Has anyone information about the CISCO PIX520 (not the official CISCO > information). Of course the PIX is faster and easier to manage. It's a glorified router. It does NOT do the kind of proxying that makes FWTK and others superior. Look at TIS [NAI] Gauntlet, ANS [UUNet] Interlock, or Eagle [Axent] Raptor, in order of preference. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Feb 11 14:24 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA19747 Fri, 11 Feb 2000 14:24:00 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA00568; Fri, 11 Feb 2000 11:27:39 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 11 Feb 2000 11:09:22 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA27103 for fwtk-users-outgoing; Fri, 11 Feb 2000 11:09:21 -0800 (PST) Date: Fri, 11 Feb 2000 14:10:04 -0500 From: Joseph S D Yao To: Todd Williams Cc: fwtk-users@ex.tis.com Subject: Re: http-gw logging options question Message-Id: <20000211141004.O14390@washington.cospo.osis.gov> Mail-Followup-To: Todd Williams , fwtk-users@ex.tis.com References: <046e01bf6c72$a8cd6d90$8702a8c0@twilliams.tfcc.com> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <046e01bf6c72$a8cd6d90$8702a8c0@twilliams.tfcc.com>; from twilliams@tfcci.com on Tue, Feb 01, 2000 at 12:10:29AM -0500 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1003 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Tue, Feb 01, 2000 at 12:10:29AM -0500, Todd Williams wrote: > Is there an easy way to allow http-gw to log what web sites the proxy users > are browsing? I've looked at the documentation and read the FAQ's and > haven't found anything that covers that subject. The -log option for ftp-gw > works great. I'm currently using "-log {read write ftp}" on the http-gw > configuration in netperm-table. Am I missing something? Doesn't -log on the http-gw hosts line work for you? I believe that's what we're using. Checked - yes. We have -log { all }. I'd have to check in the source code what options are available to http-gw. What version? -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Feb 11 14:29 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA19772 Fri, 11 Feb 2000 14:29:13 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA02635; Fri, 11 Feb 2000 11:32:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 11 Feb 2000 11:27:02 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA00292 for fwtk-users-outgoing; Fri, 11 Feb 2000 11:26:59 -0800 (PST) Date: Fri, 11 Feb 2000 14:27:43 -0500 From: Joseph S D Yao To: "Lidgate, Chris A" Cc: fwtk-users@ex.tis.com Subject: Re: FTP error 425 Message-Id: <20000211142743.Q14390@washington.cospo.osis.gov> Mail-Followup-To: "Lidgate, Chris A" , fwtk-users@ex.tis.com References: <1A2B916673DFD211ABC700805FA7AA689612D5@MSX11002> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <1A2B916673DFD211ABC700805FA7AA689612D5@MSX11002>; from lidgaca@texaco.com on Wed, Feb 09, 2000 at 05:15:41AM -0600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 793 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Wed, Feb 09, 2000 at 05:15:41AM -0600, Lidgate, Chris A wrote: > >From a browser, accessing ftp://ftp.adaptec.com I always > get this message from http-gw on our firewall. > > FTP Error- 425 > > 425 Can't build data connection: Connection refused. It is not clear from your message ... from Navigator's Manual Proxy setup page, do you have HTTP and FTP's proxies both set to your firewall, port 80? This is the correct settings. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Feb 11 14:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA19801 Fri, 11 Feb 2000 14:32:53 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA03939; Fri, 11 Feb 2000 11:36:34 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 11 Feb 2000 11:29:46 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA01337 for fwtk-users-outgoing; Fri, 11 Feb 2000 11:29:43 -0800 (PST) Date: Fri, 11 Feb 2000 14:30:21 -0500 From: Joseph S D Yao To: ddss Cc: fwtk-users@ex.tis.com Subject: Re: HELP ... TIS works at ... Message-Id: <20000211143021.R14390@washington.cospo.osis.gov> Mail-Followup-To: ddss , fwtk-users@ex.tis.com References: <000c01bf7290$98bddce0$212fd4c8@saoit.br.originit.com> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <000c01bf7290$98bddce0$212fd4c8@saoit.br.originit.com>; from ddss@zaz.com.br on Tue, Feb 08, 2000 at 09:59:36PM -0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 976 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Tue, Feb 08, 2000 at 09:59:36PM -0200, ddss wrote: > 01. Where the proxy TIS FWTK work ??? > (a). Application level (gateway) > (s). Session level (circuit relay) > (t). Transport level (circuit relay) a > 02. Are there some way to verify the context of data ??? Explain, please. > 03. Where I can find statistics about the use of TIS FWTK against > others ??? I doubt that you can. Anybody? It's pretty wide-spread, but it is not registered anywhere. [Yes, it should be registered at NAI/TIS. We have seen that this doesn't always happen. Does anyone at NAI/TIS want to share?] -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Feb 11 14:41 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA19848 Fri, 11 Feb 2000 14:41:03 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA06920; Fri, 11 Feb 2000 11:44:46 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 11 Feb 2000 11:35:17 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA03428 for fwtk-users-outgoing; Fri, 11 Feb 2000 11:35:14 -0800 (PST) Date: Fri, 11 Feb 2000 14:34:54 -0500 From: Joseph S D Yao To: Toby.Schau@idob.state.ia.us Cc: fwtk-users@tis.com Subject: Re: winsock Message-Id: <20000211143454.S14390@washington.cospo.osis.gov> Mail-Followup-To: Toby.Schau@idob.state.ia.us, fwtk-users@tis.com References: <200002100328.TAA03838@relay.nai.com> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <200002100328.TAA03838@relay.nai.com>; from Toby.Schau@idob.state.ia.us on Tue, Mar 18, 2036 at 03:49:12AM -0600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 895 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Tue, Mar 18, 2036 at 03:49:12AM -0600, Toby.Schau@idob.state.ia.us wrote: > I am wondering if it is possible to use winsock proxying to get windows machines, IIS > Exchange, to listen to the external port on the FWTK for incoming requests. Very bad idea. Why not just let FWTK do normal SMTP mail proxying, and then let the MS machine inside handle it, if you have to? You do not want to "proxy" all Winsock sockets to the outside, because that's essentially identical to replacing your firewall machine with a piece of copper wire. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Feb 11 20:28 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA21541 Fri, 11 Feb 2000 20:28:18 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA12023; Fri, 11 Feb 2000 17:32:00 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 11 Feb 2000 17:29:11 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA11233 for fwtk-users-outgoing; Fri, 11 Feb 2000 17:29:09 -0800 (PST) Message-ID: <001e01bf74f8$a06a5da0$64ccd3c8@saoit.br.originit.com> From: "ddss" To: "Joseph S D Yao" Cc: References: <000c01bf7290$98bddce0$212fd4c8@saoit.br.originit.com> <20000211143021.R14390@washington.cospo.osis.gov> Subject: Re: HELP ... TIS works at ... Date: Fri, 11 Feb 2000 23:29:23 -0200 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2014.211 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2014.211 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1546 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Thanks !!! But, about my question number two: There are some add on to TIS FWTK to make a scanning in the traffic for ftp, http and smtp ??? For http reject pages with some words and for smtp reject some attached files like *.exe, *.dll and so on ... Thanks, ddss@zaz.com.br ----- Original Message ----- From: Joseph S D Yao To: ddss Cc: Sent: Friday, February 11, 2000 5:30 PM Subject: Re: HELP ... TIS works at ... > On Tue, Feb 08, 2000 at 09:59:36PM -0200, ddss wrote: > > 01. Where the proxy TIS FWTK work ??? > > (a). Application level (gateway) > > (s). Session level (circuit relay) > > (t). Transport level (circuit relay) > > a > > > 02. Are there some way to verify the context of data ??? > > Explain, please. > > > 03. Where I can find statistics about the use of TIS FWTK against > > others ??? > > I doubt that you can. Anybody? It's pretty wide-spread, but it is not > registered anywhere. [Yes, it should be registered at NAI/TIS. We have > seen that this doesn't always happen. Does anyone at NAI/TIS want to > share?] > > -- > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao > COSPO/OSIS Computer Support EMT-B > ----------------------------------------------------------------------- > This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Feb 11 22:14 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA21762 Fri, 11 Feb 2000 22:14:21 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA18366; Fri, 11 Feb 2000 19:18:04 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 11 Feb 2000 19:14:47 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA17640 for fwtk-users-outgoing; Fri, 11 Feb 2000 19:14:46 -0800 (PST) Date: Fri, 11 Feb 2000 22:15:06 -0500 (EST) From: Ted Keller To: ddss cc: Joseph S D Yao , fwtk-users@ex.tis.com Subject: Re: HELP ... TIS works at ... In-Reply-To: <001e01bf74f8$a06a5da0$64ccd3c8@saoit.br.originit.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2190 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have modified smap to allow scanning of header data for particular strings - primarily spam mail. The basic scanning routines could also be used to scan the body - I haven't implemented that for preformance issues. With this scan, the routines could easily look for attachments (non-encyrpted - non compressed ---) for things like .exe .dll and the like to reject. ted keller On Fri, 11 Feb 2000, ddss wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Thanks !!! > > But, about my question number two: > > There are some add on to TIS FWTK to make a scanning > in the traffic for ftp, http and smtp ??? > For http reject pages with some words and > for smtp reject some attached files like *.exe, *.dll and so on > ... > Thanks, > ddss@zaz.com.br > > ----- Original Message ----- > From: Joseph S D Yao > To: ddss > Cc: > Sent: Friday, February 11, 2000 5:30 PM > Subject: Re: HELP ... TIS works at ... > > > > On Tue, Feb 08, 2000 at 09:59:36PM -0200, ddss wrote: > > > 01. Where the proxy TIS FWTK work ??? > > > (a). Application level (gateway) > > > (s). Session level (circuit relay) > > > (t). Transport level (circuit relay) > > > > a > > > > > 02. Are there some way to verify the context of data ??? > > > > Explain, please. > > > > > 03. Where I can find statistics about the use of TIS FWTK against > > > others ??? > > > > I doubt that you can. Anybody? It's pretty wide-spread, but it is not > > registered anywhere. [Yes, it should be registered at NAI/TIS. We have > > seen that this doesn't always happen. Does anyone at NAI/TIS want to > > share?] > > > > -- > > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao > > COSPO/OSIS Computer Support EMT-B > > ----------------------------------------------------------------------- > > This message is not an official statement of COSPO policies. > From owner-fwtk-users@ex.tis.com Sun Feb 13 16:14 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA27252 Sun, 13 Feb 2000 16:13:54 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA13226; Sun, 13 Feb 2000 13:16:28 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 13 Feb 2000 11:40:41 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA10444 for fwtk-users-outgoing; Sun, 13 Feb 2000 11:40:30 -0800 (PST) Message-Id: <200002131940.UAA05919@carno.brus.online.be> Comments: Authenticated sender is From: "jean duerinckx" Organization: manta design To: fwtk-users@ex.tis.com Date: Sun, 13 Feb 2000 20:41:15 +0000 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: ftp-gw starts an endless loop Reply-to: jeanduer@manta-design.com X-mailer: Pegasus Mail for Win32 (v2.53/R1) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 3055 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I need some advice on the configuration of the ftp-gw software : every time I try to access an external system trough the ftp-gw module it gets in an endless loop, I do not see where I made the error in the configuration. configuration is as follows : OS : slackware linux 2.2.6 192.168.80.13 client on internal network 192.168.80.220 firewall connection on internal network 192.168.201.220 firewall connection to external network 192.168.201.99 ftp server on external network I first connect to the firewall : ftp> open 192.168.80.220 Connected to 192.168.80.220. 220-ftp-gw : welcome 220 User (192.168.80.220:(none)): jeanduer@192.168.201.99 now the client does not get any further response . the system log on the firewall contains following messages: Feb 13 20:21:41 bastion1 netacl[1851]: permit host=bison.mynet/192.168.80.13 service=ftp-gw execute=/usr/local/etc/ftp-gw Feb 13 20:21:41 bastion1 netacl[1851]: permit host=bison.mynet/192.168.80.13 service=ftp-gw execute=/usr/local/etc/ftp-gw Feb 13 20:21:41 bastion1 ftp-gw[1851]: permit host=bison.mynet/192.168.80.13 use of gateway Feb 13 20:21:41 bastion1 ftp-gw[1851]: permit host=bison.mynet/192.168.80.13 use of gateway Feb 13 20:21:58 bastion1 ftp-gw[1851]: permit host=bison.mynet/192.168.80.13 connect to (null) Feb 13 20:21:58 bastion1 ftp-gw[1851]: permit host=bison.mynet/192.168.80.13 connect to (null) Feb 13 20:21:58 bastion1 netacl[1852]: permit host=bastion0.mynet/192.168.80. 220 service=ftp-gw execute=/usr/local/etc/ftp-gw Feb 13 20:21:58 bastion1 netacl[1852]: permit host=bastion0.mynet/192.168.80. 220 service=ftp-gw execute=/usr/local/etc/ftp-gw Feb 13 20:21:58 bastion1 ftp-gw[1852]: permit host=bastion0.mynet/192.168.80. 220 use of gateway .. snip ... Feb 13 20:22:00 bastion1 inetd[71]: ftp/tcp server failing (looping), service te rminated Feb 13 20:22:00 bastion1 inetd[71]: ftp/tcp server failing (looping), service te rminated my inetd.conf has following entry : ftp stream tcp nowait root /usr/local/etc/netacl ftp-gw the netperm-table entries are : # # ftp netacl gateway rules: # ------------------------ netacl-ftp-gw: denial-msg /usr/local/etc/ftp-deny.txt netacl-ftp-gw: welcome-msg /usr/local/etc/ftp-welcome.txt netacl-ftp-gw: help-msg /usr/local/etc/ftp-help.txt netacl-ftp-gw: timeout 3600 netacl-ftp-gw: permit-hosts jean.mynet -exec /usr/local/etc/ftp-gw netacl-ftp-gw: permit-hosts 192.168.80.* -exec /usr/local/etc/ftp-gw # # ftp-gw gateway rules: # --------------------- ftp-gw: deny-hosts unknown ftp-gw: permit-hosts 192.168.80.* ftp-gw: denial-msg /usr/local/etc/ftp-deny.txt ftp-gw: welcome-msg /usr/local/etc/ftp-welcome.txt ftp-gw: help-msg /usr/local/etc/ftp-help.txt ftp-gw: timeout 3600 now where did I make the mistake(s)? any suggestions ? thanks in advance Jean From owner-fwtk-users@ex.tis.com Sun Feb 13 17:58 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA27478 Sun, 13 Feb 2000 17:58:35 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA17560; Sun, 13 Feb 2000 15:01:41 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 13 Feb 2000 13:50:01 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA14083 for fwtk-users-outgoing; Sun, 13 Feb 2000 13:49:45 -0800 (PST) Message-Id: <4.2.2.20000213163951.00b19c30@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Sun, 13 Feb 2000 16:41:11 -0500 To: jeanduer@manta-design.com, fwtk-users@ex.tis.com From: Rick Murphy Subject: Re: ftp-gw starts an endless loop In-Reply-To: <200002131940.UAA05919@carno.brus.online.be> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 645 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 08:41 PM 2/13/00 +0000, jean duerinckx wrote: >I need some advice on the configuration of the ftp-gw software : >every time I try to access an external system trough the ftp-gw module >it gets in an endless loop, I do not see where I made the error in >the configuration. Are you running the Linux firewall software - specifically the FTP masquerading module? It looks like your connection from the firewall to the external FTP server is being redirected back to the firewall for some reason. -Rick From owner-fwtk-users@ex.tis.com Sun Feb 13 18:16 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA27557 Sun, 13 Feb 2000 18:16:46 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA18442; Sun, 13 Feb 2000 15:19:59 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 13 Feb 2000 14:13:31 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA14853 for fwtk-users-outgoing; Sun, 13 Feb 2000 14:13:16 -0800 (PST) Message-Id: <4.2.2.20000213165153.00ae6e10@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Sun, 13 Feb 2000 16:54:32 -0500 To: "Johann G. Hautzinger" , TIS Mailing List From: Rick Murphy Subject: Re: smap once again ... In-Reply-To: <38A15E63.9A00F320@eic.at> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 850 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 01:32 PM 2/9/00 +0100, Johann G. Hautzinger wrote: >from time to time (especially when sending out mails to a lot of >recipients) i get the following error: > >Feb 9 09:11:43 hostname smap[8041]: fwtksyserr: Reset state That means that a mail server sent a "RSET" (reset state) command. This is common and nothing to worry about. RSET is used to reset the SMTP connection to the initial state; after RSET, the sender can use a new MAIL FROM and RCPT TO command; this permits a mail server to send multiple messages to a destination network over a single SMTP connection. It's not logged because it's something to worry about - it's logged in the interest of logging everything that takes place. -Rick From owner-fwtk-users@ex.tis.com Sun Feb 13 18:17 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA27563 Sun, 13 Feb 2000 18:17:21 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA18466; Sun, 13 Feb 2000 15:20:29 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 13 Feb 2000 14:13:41 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA14864 for fwtk-users-outgoing; Sun, 13 Feb 2000 14:13:30 -0800 (PST) Message-Id: <4.2.2.20000213165602.00b15a10@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Sun, 13 Feb 2000 16:57:22 -0500 To: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.), fwtk-users@lists.nai.com From: Rick Murphy Subject: Re: spoofing In-Reply-To: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 411 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 12:20 PM 2/10/00 -0800, Stefan Heim, Dipl.-Ing. wrote: >Have anyone a suggestion about spoofing-protection with >FWTK or with onather programm ? Use a secure mail program such as PGP or S/MIME. SMTP can't be secured against spoofing without external assistance. -Rick From owner-fwtk-users@ex.tis.com Mon Feb 14 05:48 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA29148 Mon, 14 Feb 2000 05:48:06 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA27526; Mon, 14 Feb 2000 02:51:02 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 14 Feb 2000 01:37:13 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA24326 for fwtk-users-outgoing; Mon, 14 Feb 2000 01:37:02 -0800 (PST) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <38A7CCDA.77560BFE@usrconsult.be> Date: Mon, 14 Feb 2000 10:37:30 +0100 From: Michel Bardiaux Organization: UsrConsult SPRL X-Mailer: Mozilla 4.5 [en] (X11; I; IRIX64 6.5 IP27) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: Re: yao-smap.pch References: <20000204165222.16081.qmail@hotmail.com> <389B14AA.10B437E9@usrconsult.be> <389B203F.8C9AE039@norstedtstryckeri.se> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1689 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Penty Wenngren wrote: > Michel Bardiaux wrote: > > Carl Blosser wrote: > > > > > > After, installing the patch I couldn't send mail to outside hosts. > > > > > > This is the error I received > > > > > > 551 Recipient must be in the local domain(s). > > > > > > And in /var/log/messages > > > the error just said Mail not local > > > > > > TIA > > > Carl Blosser > > > > You have to use *two* smap executables: unpatched for outgoing mail, > > i.e. > > SMTP requests from internal net; patched for incoming SMTP requests. > > > > I really don't think so, or else I have misconfigured my smap awfully. > This is what my netperm-table looks like and this works just fine in > both directions. > > smap, smapd: userid mail > smap, smapd: directory /var/spool/smap > smapd: executable /usr/local/etc/smapd > smapd: sendmail /usr/sbin/sendmail > smap: timeout 3600 > smap: check-from-address 1 > smap: check-user-address 1 > smap: domains domain.com > smap: hosts 10.10.10.* > smap: require-full-email 1 > > -- > > Penty Wenngren // Graphium Norstedts Tryckeri Thanks for correcting me. Plea: we set up FWTK1.3 without anti-relay, later upgraded to FWTK2.0 still without anti-relay and trying to change as little of the config files as possible, then later we had to install anti-relay *in a hurry* after a relay-rape. So, I'm afraid we did not take enough time to read the documentation... Greetings. -- Michel Bardiaux UsrConsult S.P.R.L. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 From owner-fwtk-users@ex.tis.com Mon Feb 14 07:11 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA29329 Mon, 14 Feb 2000 07:11:09 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA02425; Mon, 14 Feb 2000 04:14:14 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 14 Feb 2000 03:04:07 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA28657 for fwtk-users-outgoing; Mon, 14 Feb 2000 03:03:50 -0800 (PST) Message-ID: <1A2B916673DFD211ABC700805FA7AA689612E1@MSX11002> From: "Lidgate, Chris A" To: "'Joseph S D Yao'" Cc: fwtk-users@ex.tis.com Subject: RE: FTP error 425 Date: Mon, 14 Feb 2000 05:04:38 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1669 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Sorry, Yes both my http and ftp proxies point to fwtk-firewall port 80. I wasn't clear, but *most* ftp sites do work correctly, it's just this specific one that doesn't. In case you haven't seen the rest of this thread, Tony Gale provided me with a patch for http-gw that solved the problem. The underlying problem (in Tony's words) is as follows: Problem description: Some FTP servers don't like receiving commands split over multiple packets. They are broken. Thanks for your help, Chris > ---------- > From: Joseph S D Yao[SMTP:jsdy@cospo.osis.gov] > Sent: 11 February 2000 19:27 > To: Lidgate, Chris A > Cc: fwtk-users@ex.tis.com > Subject: Re: FTP error 425 > > [To be removed from this list send the message "unsubscribe fwtk-users" in > the > BODY of a mail message to majordomo@ex.tis.com.] > > On Wed, Feb 09, 2000 at 05:15:41AM -0600, Lidgate, Chris A wrote: > > >From a browser, accessing ftp://ftp.adaptec.com I always > > get this message from http-gw on our firewall. > > > > FTP Error- 425 > > > > 425 Can't build data connection: Connection refused. > > It is not clear from your message ... from Navigator's Manual Proxy > setup page, do you have HTTP and FTP's proxies both set to your > firewall, port 80? This is the correct settings. > > -- > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. > Yao > COSPO/OSIS Computer Support EMT-B > ----------------------------------------------------------------------- > This message is not an official statement of COSPO policies. > From owner-fwtk-users@ex.tis.com Mon Feb 14 12:33 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA00357 Mon, 14 Feb 2000 12:33:55 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA20959; Mon, 14 Feb 2000 09:36:56 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 14 Feb 2000 08:48:01 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA15544 for fwtk-users-outgoing; Mon, 14 Feb 2000 08:47:44 -0800 (PST) Message-ID: <1A2B916673DFD211ABC700805FA7AA689612E4@MSX11002> From: "Lidgate, Chris A" To: "'fwtk-users@ex.tis.com'" Subject: Can MS vpn packets be passed through fwtk ? Date: Mon, 14 Feb 2000 09:30:29 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1945 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I've been asked to look at setting up a MicroSoft vpn for our company, a vpn gateway that will work with the standard VPN tools provided by Win 95 / 98 / NT etc. >From what I can find out I'm not happy :=( Here is the secenario as I have it at the moment. Some / all of the following may be incorrect and if anyone has any other information that contradicts any of this, please jump in and let me know. >From the setup instructions that I've been mailed, I've been told that I should set up a Win NT box, with two NIC's, that must be placed IN PARALLEL with out existing fwtk firewall, one nic on the DMZ, and one nic on our normal 'private' network. This machine will then handle the vpn traffic directly. I've been told that all of the data to and from the vpn is an IP protocol of type GRE (General Routing Encapsulation). I'm particularly unhappy that the Win NT box will straddle my current firewall, thus any attacks on this box can totally circumvent the current firewall. I'm not an NT expert and I'm not at all sure about if or how the NT box can be made secure (lets say as secure as my current firewall). I've heard it said that it is not possible to pass vpn traffic through an fwtk firewall. >From a (very cursory) look at the rfc's which describe GRE (1701 & 1702 - any others ?) I presume that the problem is that the GRE packet's will need to be modified as they pass through fwtk, is this correct. ? If this *is* correct then presumably the reason that plug-gw would not work is that it's 'dumb' and is not going to modify the packet contents. Finally do any other fwtk users face this problem, and if so how would you suggest that I proceed. (Telling my boss to stuff his NT box *is* an option, but I'll need to have an alternative employer lined up first ;=} Chris From owner-fwtk-users@ex.tis.com Tue Feb 15 10:12 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA04864 Tue, 15 Feb 2000 10:12:01 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA06645; Tue, 15 Feb 2000 07:15:26 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 15 Feb 2000 07:10:14 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA05797 for fwtk-users-outgoing; Tue, 15 Feb 2000 07:10:08 -0800 (PST) Message-ID: <38A9139D.12E43804@gelrevision.nl> Date: Tue, 15 Feb 2000 09:51:41 +0100 From: Ruud Rijkse X-Mailer: Mozilla 4.7 [nl] (Win98; U) X-Accept-Language: nl,zh-TW,zh-CN MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: problems with chat programs/FWTK Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 635 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I can get it fixed. I try to run ICQ and AOL messenger(from Netscape) I put the next lines in: /usr/local/etc/netperm-table icq: port icq 192.168.0.* -plug-to icq.mirabilis.com -port 4000 aol: port aol 192.168.0.* -plug-to americanonline.aol.com -port 5190 in: /etc/inetd.conf icq dgram udp wait root /usr/local/plug-gw plug-gw icq aol stream tcp nowait root /usr/local/plug-gw plug-gw aol in: /etc/services icq 4000/udp aol 5190/tcp Can someone help me, please, thanks greetings Ruud Rijkse From owner-fwtk-users@ex.tis.com Tue Feb 15 19:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA07702 Tue, 15 Feb 2000 19:22:25 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA12029; Tue, 15 Feb 2000 16:26:12 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 15 Feb 2000 16:15:29 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA10957 for fwtk-users-outgoing; Tue, 15 Feb 2000 16:15:27 -0800 (PST) Message-ID: <005a01bf781b$36f773a0$80ccd3c8@saoit.br.originit.com> From: "ddss" To: Cc: "Joseph S D Yao" , "Ted Keller" References: Subject: Re: HELP ... TIS works at ... Date: Tue, 15 Feb 2000 22:14:37 -0300 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2014.211 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2014.211 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2829 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Ted, Please, Can you explain how can I scanning smtp for particular string in the header and data ??? Thanks, ddss@zaz.com.br ----- Original Message ----- From: Ted Keller To: ddss Cc: Joseph S D Yao ; Sent: Saturday, February 12, 2000 12:15 AM Subject: Re: HELP ... TIS works at ... > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I have modified smap to allow scanning of header data for particular > strings - primarily spam mail. The basic scanning routines could also be > used to scan the body - I haven't implemented that for preformance issues. > With this scan, the routines could easily look for attachments > (non-encyrpted - non compressed ---) for things like .exe .dll and the > like to reject. > > ted keller > > > On Fri, 11 Feb 2000, ddss wrote: > > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > Thanks !!! > > > > But, about my question number two: > > > > There are some add on to TIS FWTK to make a scanning > > in the traffic for ftp, http and smtp ??? > > For http reject pages with some words and > > for smtp reject some attached files like *.exe, *.dll and so on > > ... > > Thanks, > > ddss@zaz.com.br > > > > ----- Original Message ----- > > From: Joseph S D Yao > > To: ddss > > Cc: > > Sent: Friday, February 11, 2000 5:30 PM > > Subject: Re: HELP ... TIS works at ... > > > > > > > On Tue, Feb 08, 2000 at 09:59:36PM -0200, ddss wrote: > > > > 01. Where the proxy TIS FWTK work ??? > > > > (a). Application level (gateway) > > > > (s). Session level (circuit relay) > > > > (t). Transport level (circuit relay) > > > > > > a > > > > > > > 02. Are there some way to verify the context of data ??? > > > > > > Explain, please. > > > > > > > 03. Where I can find statistics about the use of TIS FWTK against > > > > others ??? > > > > > > I doubt that you can. Anybody? It's pretty wide-spread, but it is not > > > registered anywhere. [Yes, it should be registered at NAI/TIS. We have > > > seen that this doesn't always happen. Does anyone at NAI/TIS want to > > > share?] > > > > > > -- > > > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao > > > COSPO/OSIS Computer Support EMT-B > > > ----------------------------------------------------------------------- > > > This message is not an official statement of COSPO policies. > > > From owner-fwtk-users@ex.tis.com Tue Feb 15 21:13 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA08365 Tue, 15 Feb 2000 21:13:17 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA20746; Tue, 15 Feb 2000 18:16:59 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 15 Feb 2000 18:11:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA19792 for fwtk-users-outgoing; Tue, 15 Feb 2000 18:11:14 -0800 (PST) Date: Tue, 15 Feb 2000 21:09:38 -0500 (EST) From: Ted Keller To: ddss cc: fwtk-users@ex.tis.com, Joseph S D Yao Subject: Re: HELP ... TIS works at ... In-Reply-To: <005a01bf781b$36f773a0$80ccd3c8@saoit.br.originit.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 3623 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] ddss..... I intercepted all data comming in through crunchbody, once received, I verify what type of header it is (subject: from: to: ...) and compare the contents of that line with a set of filters with common spam data. The original list came from.... Linkname: Oasel the Spam-Catcher's Report to the Nation URL: http://www.cnx.com/stopspam.html It contains some 7000+ lines of common spam data. Last week, I blocked over 10,000 message total from comming through my firewall. Many of theme (~2000) were as a direct result of these spam fileters. ted keller On Tue, 15 Feb 2000, ddss wrote: > Hi Ted, > Please, > Can you explain how can I scanning smtp for particular string in the > header and data ??? > Thanks, > ddss@zaz.com.br > > ----- Original Message ----- > From: Ted Keller > To: ddss > Cc: Joseph S D Yao ; > Sent: Saturday, February 12, 2000 12:15 AM > Subject: Re: HELP ... TIS works at ... > > > > [To be removed from this list send the message "unsubscribe fwtk-users" in > the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > I have modified smap to allow scanning of header data for particular > > strings - primarily spam mail. The basic scanning routines could also be > > used to scan the body - I haven't implemented that for preformance issues. > > With this scan, the routines could easily look for attachments > > (non-encyrpted - non compressed ---) for things like .exe .dll and the > > like to reject. > > > > ted keller > > > > > > On Fri, 11 Feb 2000, ddss wrote: > > > > > [To be removed from this list send the message "unsubscribe fwtk-users" > in the > > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > Thanks !!! > > > > > > But, about my question number two: > > > > > > There are some add on to TIS FWTK to make a scanning > > > in the traffic for ftp, http and smtp ??? > > > For http reject pages with some words and > > > for smtp reject some attached files like *.exe, *.dll and > so on > > > ... > > > Thanks, > > > ddss@zaz.com.br > > > > > > ----- Original Message ----- > > > From: Joseph S D Yao > > > To: ddss > > > Cc: > > > Sent: Friday, February 11, 2000 5:30 PM > > > Subject: Re: HELP ... TIS works at ... > > > > > > > > > > On Tue, Feb 08, 2000 at 09:59:36PM -0200, ddss wrote: > > > > > 01. Where the proxy TIS FWTK work ??? > > > > > (a). Application level (gateway) > > > > > (s). Session level (circuit relay) > > > > > (t). Transport level (circuit relay) > > > > > > > > a > > > > > > > > > 02. Are there some way to verify the context of data ??? > > > > > > > > Explain, please. > > > > > > > > > 03. Where I can find statistics about the use of TIS FWTK against > > > > > others ??? > > > > > > > > I doubt that you can. Anybody? It's pretty wide-spread, but it is > not > > > > registered anywhere. [Yes, it should be registered at NAI/TIS. We > have > > > > seen that this doesn't always happen. Does anyone at NAI/TIS want to > > > > share?] > > > > > > > > -- > > > > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao > > > > COSPO/OSIS Computer Support EMT-B > > > > > ----------------------------------------------------------------------- > > > > This message is not an official statement of COSPO policies. > > > > > > From owner-fwtk-users@ex.tis.com Wed Feb 16 05:03 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA10352 Wed, 16 Feb 2000 05:03:23 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA10902; Wed, 16 Feb 2000 02:07:09 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 16 Feb 2000 02:03:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA10173 for fwtk-users-outgoing; Wed, 16 Feb 2000 02:03:37 -0800 (PST) Message-ID: <38AA7692.8F6198B3@yahoo.com> Date: Wed, 16 Feb 2000 15:36:10 +0530 From: Naresh Narang X-Mailer: Mozilla 4.7 [en] (Win95; I) X-Accept-Language: en MIME-Version: 1.0 To: "fwtk-users@ex.tis.com" Subject: pop-gw Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 242 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello The option: pop-gw: user xxx works for pop-gw but not pop-gw: user * Is there a way? NKN From owner-fwtk-users@ex.tis.com Wed Feb 16 07:13 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA10966 Wed, 16 Feb 2000 07:13:05 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA18015; Wed, 16 Feb 2000 04:16:50 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 16 Feb 2000 04:14:09 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA17238 for fwtk-users-outgoing; Wed, 16 Feb 2000 04:14:08 -0800 (PST) Message-ID: <51C0648C64FDD0119041006097291BC66DA05D@lenin.fnplzen.cz> From: Mikes Roman To: fwtk-users@ex.tis.com Subject: Plug-gw and 2 ifaces Date: Wed, 16 Feb 2000 13:18:04 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 398 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, how could I configure plug-gw to work for two outside interfaces. I have "aliased" outside interface to use 2 IP addresses and I need set different rules (base on destination address) for connections witch will made on different IP (virtual interface). Thanks From owner-fwtk-users@ex.tis.com Wed Feb 16 09:51 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA11924 Wed, 16 Feb 2000 09:51:05 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA04385; Wed, 16 Feb 2000 06:54:51 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 16 Feb 2000 06:51:20 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA03358 for fwtk-users-outgoing; Wed, 16 Feb 2000 06:51:19 -0800 (PST) Message-ID: <43BAED4FFC4ED311897B00104BAD8FDF0AB35D@io.compudata.ch> From: Schlienger Thomas To: fwtk-users@ex.tis.com Subject: problems with yao patch for smap Date: Wed, 16 Feb 2000 15:52:08 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1032 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi I have some trouble with the yao smap patch. Patching the source version 2.1 worked fine. Also compilation was successfully. But when I replaced smap with the patched version, no mail went out or came in anymore. I can see the process of smap, but if I telnet to port 25 there is no answer from smap. I run a linux system with kernel 2.2.7 on a pc box. My netperm-table: smap, smapd: userid mail smap, smapd: groupid mail smap, smapd: directory /var/spool/smap smapd: executable /usr/local/etc/smapd smapd: sendmail /usr/sbin/sendmail smap: timeout 3600 smap: check-from-adress 1 smap: domains ourdomain.com smap: hosts 172.16.0.1 Has anyone an idea or a solution to my problem? Thanks in advance... Thomas Schlienger schlienger@compudata.ch From owner-fwtk-users@ex.tis.com Wed Feb 16 15:33 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA14052 Wed, 16 Feb 2000 15:33:58 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA24586; Wed, 16 Feb 2000 12:37:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 16 Feb 2000 12:34:28 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA23678 for fwtk-users-outgoing; Wed, 16 Feb 2000 12:34:26 -0800 (PST) Message-ID: <38AB09E4.A5EB2085@actfs.co.nz> Date: Thu, 17 Feb 2000 09:34:44 +1300 From: "Dave.Oldershaw" Organization: ACT Financial Systems Ltd X-Mailer: Mozilla 4.7 [en] (WinNT; I) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: telnet problem Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1132 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] How do I fix the following : Clients can telnet to the firewall and from there telnet to the servers Dave Oldershaw. -- _______________________________________________________________________ Dave Oldershaw Phone: (+64 4) 473 1480 Systems Administrator DDI: (+64 4) 496 3872 ACT Financial Systems, Fax: (+64 4) 473 1515 Level 10, Dalmuir House, Wellington. Mobile: 025 997 636 PO Box 10-278, Wellington. email: dave.oldershaw@actfs.co.nz *********************************************************************** This communication is confidential to ACT Financial Systems (Asia Pacific) and is intended for use only by the addressee. The views and opinions expressed in this email are the senders own and do not represent the views and opinions of ACT Financial Systems (Asia Pacific). *********************************************************************** From owner-fwtk-users@ex.tis.com Wed Feb 16 15:52 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA14154 Wed, 16 Feb 2000 15:52:30 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA27540; Wed, 16 Feb 2000 12:56:20 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 16 Feb 2000 12:54:03 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA26717 for fwtk-users-outgoing; Wed, 16 Feb 2000 12:54:01 -0800 (PST) Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: <43BAED4FFC4ED311897B00104BAD8FDF0AB35D@io.compudata.ch> References: <43BAED4FFC4ED311897B00104BAD8FDF0AB35D@io.compudata.ch> Date: Wed, 16 Feb 2000 13:53:53 -0700 To: fwtk-users@ex.tis.com From: Blair Lowe Subject: patching problems for yao-smap.pch Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 571 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, Platform: RedHat 6.1 Software: fwtk 2.1 I cannot patch the smap.c file properly. Here is the command I used. #patch < yao-smap.pch patching file `smap.c' Hunk #1 FAILED at 1. 1 out of 40 hunks FAILED -- saving rejects to smap.c.rej What is a hunk, and more importantly what do I need to do to avoid this. Thanks, Blair. Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) From owner-fwtk-users@ex.tis.com Wed Feb 16 16:43 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA14440 Wed, 16 Feb 2000 16:43:11 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA04737; Wed, 16 Feb 2000 13:47:00 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 16 Feb 2000 13:43:15 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA03342 for fwtk-users-outgoing; Wed, 16 Feb 2000 13:43:14 -0800 (PST) X-Authentication-Warning: castle.entridia.com: mail set sender to using -f Message-ID: <38AB1A5E.80F4F0E9@entridia.com> Date: Wed, 16 Feb 2000 13:45:02 -0800 From: Dennis Chandler Organization: Entridia Corp. X-Mailer: Mozilla 4.5 [en] (X11; I; SunOS 5.5.1 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: CryptoCard Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 214 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Does anyone know if TIS can be used with CryptoCard and RADIUS? Thanks, D Chandler From owner-fwtk-users@ex.tis.com Wed Feb 16 18:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA14936 Wed, 16 Feb 2000 18:45:45 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA20522; Wed, 16 Feb 2000 15:49:34 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 16 Feb 2000 15:45:33 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA18971 for fwtk-users-outgoing; Wed, 16 Feb 2000 15:45:32 -0800 (PST) Message-Id: <4.2.2.20000216183157.00ae8c30@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Wed, 16 Feb 2000 18:32:39 -0500 To: Mikes Roman , fwtk-users@ex.tis.com From: Rick Murphy Subject: Re: Plug-gw and 2 ifaces In-Reply-To: <51C0648C64FDD0119041006097291BC66DA05D@lenin.fnplzen.cz> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 565 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 01:18 PM 2/16/00 +0100, Mikes Roman wrote: >how could I configure plug-gw to work for two outside interfaces. I have >"aliased" outside interface to use 2 IP addresses and I need set different >rules (base on destination address) for connections witch will made on >different IP (virtual interface). Use the ipbind patch. (Available from the FAQ site.) It lets you bind an instance of plug-gw to a specific address. -Rick From owner-fwtk-users@ex.tis.com Wed Feb 16 18:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA14937 Wed, 16 Feb 2000 18:45:46 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA20526; Wed, 16 Feb 2000 15:49:35 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 16 Feb 2000 15:45:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA19011 for fwtk-users-outgoing; Wed, 16 Feb 2000 15:45:37 -0800 (PST) Message-Id: <4.2.2.20000216183322.00b26d60@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Wed, 16 Feb 2000 18:34:16 -0500 To: Dennis Chandler , fwtk-users@ex.tis.com From: Rick Murphy Subject: Re: CryptoCard In-Reply-To: <38AB1A5E.80F4F0E9@entridia.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 372 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 01:45 PM 2/16/00 -0800, Dennis Chandler wrote: >Does anyone know if TIS can be used with CryptoCard and RADIUS? There is no RADIUS support that I know of. You can use CryptoCard in SNK mode and use the authsrv SNK support. -Rick From owner-fwtk-users@ex.tis.com Wed Feb 16 19:04 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA14993 Wed, 16 Feb 2000 19:04:35 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA23527; Wed, 16 Feb 2000 16:08:25 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 16 Feb 2000 16:06:25 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA22770 for fwtk-users-outgoing; Wed, 16 Feb 2000 16:06:24 -0800 (PST) Message-ID: <01D13B3463B9D3119F7300508B2C9955035FEB@RT02> From: Gabriel Murrieta To: fwtk-users@ex.tis.com Subject: Support on Gauntlet 5.5 vpn on NT Date: Wed, 16 Feb 2000 18:04:09 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 201 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Can anyone help me with a Gauntlet 5.5 vpn on NT??? Thanks in advanced From owner-fwtk-users@ex.tis.com Wed Feb 16 20:01 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA15234 Wed, 16 Feb 2000 20:01:49 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA28255; Wed, 16 Feb 2000 17:05:39 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 16 Feb 2000 17:01:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA27370 for fwtk-users-outgoing; Wed, 16 Feb 2000 17:01:41 -0800 (PST) Message-ID: <005001bf78ea$dae0a8e0$3a2cd4c8@saoit.br.originit.com> From: "ddss" To: Cc: "Joseph S D Yao" , "Ted Keller" References: Subject: Re: HELP ... TIS works at ... Date: Wed, 16 Feb 2000 23:00:54 -0300 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2014.211 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2014.211 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 4503 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Ted ... Newly, I would like to thanks for you help !!! I can see that your Site can solve my problem and I beleave that I will find my right answer !!! But, I will check that with all attention ... After this I will return for you, ok ??? Now, thanks for your help !!! ddss@zaz.com.br ----- Original Message ----- From: Ted Keller To: ddss Cc: ; Joseph S D Yao Sent: Tuesday, February 15, 2000 11:09 PM Subject: Re: HELP ... TIS works at ... > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > ddss..... > > I intercepted all data comming in through crunchbody, once received, I > verify what type of header it is (subject: from: to: ...) and compare the > contents of that line with a set of filters with common spam data. > > The original list came from.... > > Linkname: Oasel the Spam-Catcher's Report to the Nation > URL: http://www.cnx.com/stopspam.html > > It contains some 7000+ lines of common spam data. > > Last week, I blocked over 10,000 message total from comming through my > firewall. Many of theme (~2000) were as a direct result of these spam > fileters. > > ted keller > > > On Tue, 15 Feb 2000, ddss wrote: > > > Hi Ted, > > Please, > > Can you explain how can I scanning smtp for particular string in the > > header and data ??? > > Thanks, > > ddss@zaz.com.br > > > > ----- Original Message ----- > > From: Ted Keller > > To: ddss > > Cc: Joseph S D Yao ; > > Sent: Saturday, February 12, 2000 12:15 AM > > Subject: Re: HELP ... TIS works at ... > > > > > > > [To be removed from this list send the message "unsubscribe fwtk-users" in > > the > > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > I have modified smap to allow scanning of header data for particular > > > strings - primarily spam mail. The basic scanning routines could also be > > > used to scan the body - I haven't implemented that for preformance issues. > > > With this scan, the routines could easily look for attachments > > > (non-encyrpted - non compressed ---) for things like .exe .dll and the > > > like to reject. > > > > > > ted keller > > > > > > > > > On Fri, 11 Feb 2000, ddss wrote: > > > > > > > [To be removed from this list send the message "unsubscribe fwtk-users" > > in the > > > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > > > Thanks !!! > > > > > > > > But, about my question number two: > > > > > > > > There are some add on to TIS FWTK to make a scanning > > > > in the traffic for ftp, http and smtp ??? > > > > For http reject pages with some words and > > > > for smtp reject some attached files like *.exe, *.dll and > > so on > > > > ... > > > > Thanks, > > > > ddss@zaz.com.br > > > > > > > > ----- Original Message ----- > > > > From: Joseph S D Yao > > > > To: ddss > > > > Cc: > > > > Sent: Friday, February 11, 2000 5:30 PM > > > > Subject: Re: HELP ... TIS works at ... > > > > > > > > > > > > > On Tue, Feb 08, 2000 at 09:59:36PM -0200, ddss wrote: > > > > > > 01. Where the proxy TIS FWTK work ??? > > > > > > (a). Application level (gateway) > > > > > > (s). Session level (circuit relay) > > > > > > (t). Transport level (circuit relay) > > > > > > > > > > a > > > > > > > > > > > 02. Are there some way to verify the context of data ??? > > > > > > > > > > Explain, please. > > > > > > > > > > > 03. Where I can find statistics about the use of TIS FWTK against > > > > > > others ??? > > > > > > > > > > I doubt that you can. Anybody? It's pretty wide-spread, but it is > > not > > > > > registered anywhere. [Yes, it should be registered at NAI/TIS. We > > have > > > > > seen that this doesn't always happen. Does anyone at NAI/TIS want to > > > > > share?] > > > > > > > > > > -- > > > > > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao > > > > > COSPO/OSIS Computer Support EMT-B > > > > > > > ----------------------------------------------------------------------- > > > > > This message is not an official statement of COSPO policies. > > > > > > > > > > From owner-fwtk-users@ex.tis.com Thu Feb 17 10:18 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA20249 Thu, 17 Feb 2000 10:18:23 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA19644; Thu, 17 Feb 2000 07:23:21 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 17 Feb 2000 07:17:51 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA18514 for fwtk-users-outgoing; Thu, 17 Feb 2000 07:17:49 -0800 (PST) Date: Wed, 16 Feb 2000 18:30:04 -0500 From: Tim Sailer To: Dennis Chandler Cc: fwtk-users@ex.tis.com Subject: Re: CryptoCard Message-ID: <20000216183004.A26092@bnl.gov> References: <38AB1A5E.80F4F0E9@entridia.com> Mime-Version: 1.0 User-Agent: Mutt/1.0.1i In-Reply-To: <38AB1A5E.80F4F0E9@entridia.com>; from chandler@entridia.com on Wed, Feb 16, 2000 at 01:45:02PM -0800 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 799 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Wed, Feb 16, 2000 at 01:45:02PM -0800, Dennis Chandler wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > Does anyone know if TIS can be used with CryptoCard and RADIUS? Actually, we have and are in the process of hacking the auth stuff for TIS to talk directly to the crypto server. Currently the telnet gw is working, and we're poking at FTP Tim -- (work) sailer@bnl.gov / (home) tps@buoy.com - http://www.buoy.com/~tps I'm not tense, just terribly, terribly alert. ** Disclaimer: My views/comments/beliefs, as strange as they are, are my own.** From owner-fwtk-users@ex.tis.com Thu Feb 17 10:49 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA20544 Thu, 17 Feb 2000 10:49:33 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA24922; Thu, 17 Feb 2000 07:54:30 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 17 Feb 2000 07:52:00 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA24030 for fwtk-users-outgoing; Thu, 17 Feb 2000 07:51:59 -0800 (PST) From: ark@eltex.ru Date: Thu, 17 Feb 2000 18:48:58 +0300 Message-Id: <200002171548.SAA20413@paranoid.eltex.spb.ru> In-Reply-To: <20000216183004.A26092@bnl.gov> from "Tim Sailer " Organization: "Klingon Imperial Intelligence Service" Subject: Re: CryptoCard To: sailer@sailer.itd.bnl.gov Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1538 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, What for? (and if you do amyways doesn't it look more logical to hack a replacement library function(s) instead)? Tim Sailer said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > On Wed, Feb 16, 2000 at 01:45:02PM -0800, Dennis Chandler wrote: > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > Does anyone know if TIS can be used with CryptoCard and RADIUS? > > Actually, we have and are in the process of hacking the auth stuff > for TIS to talk directly to the crypto server. Currently the telnet gw > is working, and we're poking at FTP _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOKwYaaH/mIJW9LeBAQF59QP+IKJd7Biz3DLbelTA7UHyCUAodZ5HAGyA WWclgrKaMEEEzu/xIq6Ept0rzKkKsOENq+oGsxu1XP7FTeiQ/z4V4urIu3wFHG42 IjPWlo1/Vbn6Y4CZ4kIdxn2i9KyTqqxmqIQDBZIrcwGK8qJzSb1RWdBrxGgnlh2M UG67PRmbp1Q= =C9or -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Thu Feb 17 16:41 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA22634 Thu, 17 Feb 2000 16:41:30 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA18215; Thu, 17 Feb 2000 13:46:13 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 17 Feb 2000 13:42:09 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA17135 for fwtk-users-outgoing; Thu, 17 Feb 2000 13:42:08 -0800 (PST) Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: References: <43BAED4FFC4ED311897B00104BAD8FDF0AB35D@io.compudata.ch> Date: Thu, 17 Feb 2000 14:40:36 -0700 To: fwtk-users@ex.tis.com From: Blair Lowe Subject: idle ports Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 312 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Does fwtk close idle ports? I am on RH 6.1/ fwtk 2.1. Thanks, Blair. Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) From owner-fwtk-users@ex.tis.com Thu Feb 17 18:55 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA23272 Thu, 17 Feb 2000 18:55:30 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA06131; Thu, 17 Feb 2000 16:00:17 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 17 Feb 2000 15:57:05 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA05260 for fwtk-users-outgoing; Thu, 17 Feb 2000 15:57:02 -0800 (PST) Date: Thu, 17 Feb 2000 18:53:14 -0500 (EST) From: Ted Keller To: Blair Lowe cc: fwtk-users@ex.tis.com Subject: Re: idle ports In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 647 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Blair, Idle ports should be closed when the proxy exits. This normally occurs when the timeout values have been reached. ted keller On Thu, 17 Feb 2000, Blair Lowe wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Does fwtk close idle ports? > > I am on RH 6.1/ fwtk 2.1. > > Thanks, > Blair. > Computer Engineering Inc. > http://www.compeng.net > Phone: 780 499 5687 (9 - 5 MST) > Fax: 780 435 0693 (24 Hours) > From owner-fwtk-users@ex.tis.com Fri Feb 18 08:10 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA26869 Fri, 18 Feb 2000 08:10:21 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA14387; Fri, 18 Feb 2000 05:15:22 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 18 Feb 2000 05:09:11 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA13459 for fwtk-users-outgoing; Fri, 18 Feb 2000 05:09:10 -0800 (PST) X-Authentication-Warning: ruunat.phys.uu.nl: munnik owned process doing -bs Date: Fri, 18 Feb 2000 14:09:04 +0100 (MET) From: Martijn de Munnik To: fwtk-users@ex.tis.com Subject: Problems with make on FreeBSD 3.3 (fwd) Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 517 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I'm trying to build fwtk on FreeBSD 3.3. When I execute make all in the source dir (after a fixmake to change the makefile) the compiler complains about parse errors. I think it's because the code is written using K&R style C but gcc wants to compile using ANSI style. How do I tell make to force gcc to compile K&R (has it something to do with the -traditionel flag)... grtz Martijn From owner-fwtk-users@ex.tis.com Fri Feb 18 09:23 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA27065 Fri, 18 Feb 2000 09:23:55 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA20036; Fri, 18 Feb 2000 06:28:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 18 Feb 2000 06:25:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA19108 for fwtk-users-outgoing; Fri, 18 Feb 2000 06:25:14 -0800 (PST) X-Mailer: exmh version 2.0.2 2/24/98 To: Martijn de Munnik cc: fwtk-users@ex.tis.com Subject: Re: Problems with make on FreeBSD 3.3 (fwd) In-reply-to: Your message of "Fri, 18 Feb 2000 14:09:04 +0100." Mime-Version: 1.0 Date: Fri, 18 Feb 2000 14:24:44 +0000 From: David Pick Message-Id: Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 757 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > I'm trying to build fwtk on FreeBSD 3.3. When I execute make all in the > source dir (after a fixmake to change the makefile) the compiler complains > about parse errors. I think it's because the code is written using K&R > style C but gcc wants to compile using ANSI style. How do I tell make to > force gcc to compile K&R (has it something to do with the -traditionel > flag)... Use the FreeBSD "port" (in the "ports" optional distribution element) of "fwtk" and it all happens as if by magic -- the correct compiler flags are used, patches are applied where necessary, &c, &c, &c. -- David Pick (who did it that way) From owner-fwtk-users@ex.tis.com Fri Feb 18 14:43 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA29093 Fri, 18 Feb 2000 14:43:37 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA28787; Fri, 18 Feb 2000 11:48:26 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 18 Feb 2000 11:41:28 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA27309 for fwtk-users-outgoing; Fri, 18 Feb 2000 11:41:26 -0800 (PST) Message-ID: <20000218194043.41126.qmail@hotmail.com> X-Originating-IP: [160.43.146.219] From: "Dameon" To: fwtk-users@ex.tis.com Cc: dameon34@hotmail.com Subject: tn-gw permissioning Date: Fri, 18 Feb 2000 14:40:43 EST Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; format=flowed Content-Length: 1474 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello! Say I've got this permission file for a 2.1 tn-gw and netacl on solaris 2.6... Imagine a filtered backbone with two machines that should be accessible in the backbone, also also other machines in the greater network. Plug in your standard rules: netacl-tn-gw: permit-hosts 127.0.0.1 -exec /opt/fwtk21/tn-gw netacl-tn-gw: permit-hosts a.b.* -exec /opt/fwtk21/tn-gw tn-gw: denial-msg /opt/fwtk21/txt/tn-deny.txt tn-gw: denydest-msg /opt/fwtk21/txt/tn-denydest.txt tn-gw: welcome-msg /opt/fwtk21/txt/tn-welcome.txt tn-gw: help-msg /opt/fwtk21/txt/tn-help.txt tn-gw: timeout 7200 tn-gw: prompt "gw1 tn-gw-> " Ok, now we add some rules. This is the ideal: tn-gw: hosts * -dest x.y.z.20 tn-gw: hosts * -dest x.y.z.21 tn-gw: hosts * -dest !x.y.z.* tn-gw: hosts * -dest x.y.* With some experimentation, I find one set of allow and deny destinations per "*" source match seems to be allowed. ie, only: tn-gw: hosts * -dest x.y.z.20 -dest x.y.z.21 -dest !x.y.z.* -dest x.y.* The problem is that I have way too many hosts that I need to list and the line becomes too long. Then I get the message: fwtkcfgerr: /opt/fwtk21/netperm-table line 16 too long Any ideas? ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From owner-fwtk-users@ex.tis.com Fri Feb 18 15:02 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA29268 Fri, 18 Feb 2000 15:02:56 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA03250; Fri, 18 Feb 2000 12:07:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 18 Feb 2000 12:02:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA01708 for fwtk-users-outgoing; Fri, 18 Feb 2000 12:02:37 -0800 (PST) Message-Id: <4.2.0.58.20000218135201.0099fbe0@lsli.com> Date: Fri, 18 Feb 2000 13:57:46 -0600 To: From: Charles Manick Livermore Subject: T.REX Firewall Source now downloadable Cc: , , Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 654 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, The source for the T.REX firewall is now available for download at www.opensourcefirewall.com. We are sorry for the delays in posting and know that many thousand of you have visited the site in the last few days expecting to find it. __________________________________________________________________ Charles Manick Livermore Livermore Software Laboratories div of Freemont Avenue Software, Inc. 1830 S. Kirkwood, Suite 205 Houston, TX 77077 vox: 281-759-3274 or 800-240-5754 fax: 281-759-8558 www.lsli.com From owner-fwtk-users@ex.tis.com Mon Feb 21 03:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA09380 Mon, 21 Feb 2000 03:22:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA05231; Mon, 21 Feb 2000 00:27:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 00:16:37 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA04118 for fwtk-users-outgoing; Mon, 21 Feb 2000 00:16:35 -0800 (PST) Message-ID: <379340446.951120765278.JavaMail.root@web15.pub01> Date: Mon, 21 Feb 2000 03:12:45 -0500 (EST) From: Tony Mai To: FWTK Mailing List Subject: HLP: Applying patches Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: mail.com X-Originating-IP: 63.196.226.106 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 776 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello all, When I downloaded fwtk 2.1 from the ftp site, I noted there were some patches files located under the patches directory. I have a few questions and would appreciately greatly if someone can point me to the right direction. 1)Are those patches to be applied on top of 2.1? 2)Is there a quick way (a script perhaps) to apply all the patches? It would be painful and errorprone to do it by hand. Thanks, Tony Mai ................................................................................. iWon.com http://www.iwon.com why wouldn't you? ................................................................................. From owner-fwtk-users@ex.tis.com Mon Feb 21 08:15 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA10739 Mon, 21 Feb 2000 08:15:10 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA17880; Mon, 21 Feb 2000 05:20:15 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 05:04:14 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA16065 for fwtk-users-outgoing; Mon, 21 Feb 2000 05:04:10 -0800 (PST) Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: <4.2.2.20000213165602.00b15a10@mail.itm-inst.com> References: <4.2.2.20000213165602.00b15a10@mail.itm-inst.com> Date: Mon, 21 Feb 2000 06:01:32 -0700 To: Rick Murphy , heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.), fwtk-users@lists.nai.com From: Blair Lowe Subject: Re: spoofing Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 1673 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Stefan, LINUX RedHat 6.1 also has IP layer protection for spoofing (IP spoofing, not mail spoofing) that you can set in the kernel. Re-configuring the kernel is also not necessary. This is most likely available on a slew of other LINUX distributions. If you can't use LINUX, then another technique is obviously required. Here is a script that you can activate in your startup (rc3.d and rc5.d areas) before your network is started up (taken from a LINUX HOWTO document): #!/bin/sh if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then echo -n "Setting up IP spoofing protection..." for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 1 > $f done echo "done." else echo PROBLEMS SETTING UP IP SPOOFING PROTECTION. BE WORRIED. echo "CONTROL-D will exit from this shell and continue system startup." echo # Start a single user shell on the console /sbin/sulogin $CONSOLE fi TTYL, Blair. At 16:57 -0500 2000/02/13, Rick Murphy wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >At 12:20 PM 2/10/00 -0800, Stefan Heim, Dipl.-Ing. wrote: >>Have anyone a suggestion about spoofing-protection with >>FWTK or with onather programm ? >Use a secure mail program such as PGP or S/MIME. SMTP can't be >secured against spoofing without external assistance. > -Rick Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) From owner-fwtk-users@ex.tis.com Mon Feb 21 08:15 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA10736 Mon, 21 Feb 2000 08:15:09 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA17876; Mon, 21 Feb 2000 05:20:14 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 05:04:15 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA16066 for fwtk-users-outgoing; Mon, 21 Feb 2000 05:04:12 -0800 (PST) Message-ID: <038001bf7c6c$0e09d1e0$b400000a@k-180.nutricia.com.pl> From: "Mariusz Potocki" To: Subject: Netmeeting proxy Date: Mon, 21 Feb 2000 14:03:32 +0100 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.2106.4 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-2" Content-Length: 201 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Anyone already configured proxy for this program? -- Mariusz Potocki From owner-fwtk-users@ex.tis.com Mon Feb 21 08:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA10862 Mon, 21 Feb 2000 08:45:20 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA20864; Mon, 21 Feb 2000 05:50:22 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 05:39:26 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA19819 for fwtk-users-outgoing; Mon, 21 Feb 2000 05:39:16 -0800 (PST) Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: References: Date: Mon, 21 Feb 2000 06:13:18 -0700 To: Sachin Dole From: Blair Lowe Subject: Re: tis on rh linux 6.1 Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 797 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, At 21:04 +0530 1999/11/25, Sachin Dole wrote: >firewalls require that ipv4 packet forwarding be disabled... i dont know Why? >whether the rhl 6.1 (free distribution) installation is with or without >packet forwarding... if it is .... how do i disable it in the kernel ... >ie how do i recompile the kernel... ??? > >the contents of /proc/sys/net/ipv4/ip_forward are just a "0"... does it >mean ip forwarding is disabled by default??? Yes. Turn it on with "cat 1 > /proc/sys/net/ipv4/ip_forward". Reconfiguring the Kernel is NOT necessary. Blair. Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) From owner-fwtk-users@ex.tis.com Mon Feb 21 09:25 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA11090 Mon, 21 Feb 2000 09:25:14 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA23033; Mon, 21 Feb 2000 06:30:17 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 06:22:19 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA21995 for fwtk-users-outgoing; Mon, 21 Feb 2000 06:22:16 -0800 (PST) Message-ID: <042901bf7c76$e8fc57a0$b400000a@k-180.nutricia.com.pl> From: "Mariusz Potocki" To: "Ted Keller" Cc: Subject: Re: Netmeeting proxy Date: Mon, 21 Feb 2000 15:21:09 +0100 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.2106.4 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-2" Content-Length: 642 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] >Mariusz, > >I've run netmeeting through socks5 before.... > OK. But I don't want to mix fwtk and socks. In worst case: Can I limit use socks only to netmeeting? If it's possible, can you provide your socks setup for NM? >ted keller > > >On Mon, 21 Feb 2000, Mariusz Potocki wrote: > >> [To be removed from this list send the message "unsubscribe fwtk-users" in the >> BODY of a mail message to majordomo@ex.tis.com.] >> >> Anyone already configured proxy for this program? >> >> -- >> Mariusz Potocki >> >> > From owner-fwtk-users@ex.tis.com Mon Feb 21 09:43 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA11196 Mon, 21 Feb 2000 09:43:08 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA25044; Mon, 21 Feb 2000 06:48:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 06:40:04 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA24105 for fwtk-users-outgoing; Mon, 21 Feb 2000 06:39:53 -0800 (PST) Date: Mon, 21 Feb 2000 09:28:17 -0500 (EST) From: Ted Keller To: Mariusz Potocki cc: fwtk-users@lists.nai.com Subject: Re: Netmeeting proxy In-Reply-To: <042901bf7c76$e8fc57a0$b400000a@k-180.nutricia.com.pl> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 949 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I run netmeeting under sockscap32. Simply set up sockscap32 to point to your socks5 firewall (they can run together with fwtk), and have your socks configuration set to allow that connection. ted keller On Mon, 21 Feb 2000, Mariusz Potocki wrote: > > >Mariusz, > > > >I've run netmeeting through socks5 before.... > > > > OK. > But I don't want to mix fwtk and socks. > In worst case: Can I limit use socks only to netmeeting? If it's possible, > can you provide your socks setup for NM? > >ted keller > > > > > >On Mon, 21 Feb 2000, Mariusz Potocki wrote: > > > >> [To be removed from this list send the message "unsubscribe fwtk-users" > in the > >> BODY of a mail message to majordomo@ex.tis.com.] > >> > >> Anyone already configured proxy for this program? > >> > >> -- > >> Mariusz Potocki > >> > >> > > > From owner-fwtk-users@ex.tis.com Mon Feb 21 10:14 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA11365 Mon, 21 Feb 2000 10:14:33 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA28007; Mon, 21 Feb 2000 07:19:35 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 07:11:54 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA26663 for fwtk-users-outgoing; Mon, 21 Feb 2000 07:11:50 -0800 (PST) Date: Mon, 21 Feb 2000 08:44:04 -0500 (EST) From: Ted Keller To: Mariusz Potocki cc: fwtk-users@lists.nai.com Subject: Re: Netmeeting proxy In-Reply-To: <038001bf7c6c$0e09d1e0$b400000a@k-180.nutricia.com.pl> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 464 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Mariusz, I've run netmeeting through socks5 before.... ted keller On Mon, 21 Feb 2000, Mariusz Potocki wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Anyone already configured proxy for this program? > > -- > Mariusz Potocki > > From owner-fwtk-users@ex.tis.com Mon Feb 21 13:25 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA12145 Mon, 21 Feb 2000 13:25:19 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA09803; Mon, 21 Feb 2000 10:30:20 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 10:25:18 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA08845 for fwtk-users-outgoing; Mon, 21 Feb 2000 10:25:17 -0800 (PST) Message-ID: <51C0648C64FDD0119041006097291BC66DA06C@lenin.fnplzen.cz> From: Mikes Roman To: "'fwtk-users@ex.tis.com'" Subject: RE: Plug-gw and 2 ifaces Date: Mon, 21 Feb 2000 19:28:03 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id KAA08826 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-2" Content-Length: 899 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] OK, it seems to be usefull but it works fine when plug-gw is running like a daemon, but what to do when I run it from inetd. Roman > -----Original Message----- > From: Rick Murphy [SMTP:rmurphy@itm-inst.com] > Sent: 17. února 2000 0:33 > To: Mikes Roman; fwtk-users@ex.tis.com > Subject: Re: Plug-gw and 2 ifaces > > At 01:18 PM 2/16/00 +0100, Mikes Roman wrote: > >how could I configure plug-gw to work for two outside interfaces. I have > >"aliased" outside interface to use 2 IP addresses and I need set > different > >rules (base on destination address) for connections witch will made on > >different IP (virtual interface). > Use the ipbind patch. (Available from the FAQ site.) It lets you bind an > instance of plug-gw to a specific address. > -Rick From owner-fwtk-users@ex.tis.com Mon Feb 21 14:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA12512 Mon, 21 Feb 2000 14:38:28 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA18004; Mon, 21 Feb 2000 11:43:35 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 11:39:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA17176 for fwtk-users-outgoing; Mon, 21 Feb 2000 11:39:16 -0800 (PST) Message-Id: <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Mon, 21 Feb 2000 14:17:06 -0500 To: Blair Lowe , Sachin Dole From: Rick Murphy Subject: Re: tis on rh linux 6.1 Cc: fwtk-users@ex.tis.com In-Reply-To: References: < Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 654 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 06:13 AM 2/21/00 -0700, Blair Lowe wrote: >At 21:04 +0530 1999/11/25, Sachin Dole wrote: >>firewalls require that ipv4 packet forwarding be disabled... i dont know > >Why? Because it's a *firewall*, not a router. If you enable forwarding, then I just route around your firewall software. (Unless you've got something else running that makes routing decisions that requires ipforwarding to be enabled. Really bad idea, that - anything that goes wrong with your ipchains/etc. means you're wide open.) -Rick From owner-fwtk-users@ex.tis.com Mon Feb 21 14:52 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA12572 Mon, 21 Feb 2000 14:52:41 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA19949; Mon, 21 Feb 2000 11:57:46 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 11:54:44 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA19198 for fwtk-users-outgoing; Mon, 21 Feb 2000 11:54:43 -0800 (PST) Message-Id: <4.2.2.20000221142458.00b364b0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Mon, 21 Feb 2000 14:28:06 -0500 To: Mikes Roman , "'fwtk-users@ex.tis.com'" From: Rick Murphy Subject: RE: Plug-gw and 2 ifaces In-Reply-To: <51C0648C64FDD0119041006097291BC66DA06C@lenin.fnplzen.cz> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 571 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 07:28 PM 2/21/00 +0100, Mikes Roman wrote: >OK, it seems to be usefull but it works fine when plug-gw is running like a >daemon, but what to do when I run it from inetd. "It" being the ipbind patch.. You'll need to find a copy of inetd that can bind to a specific interface. I try to never run proxies under inetd, myself - the overhead of an additional plug-gw doing nothing waiting for a connection isn't significant. -Rick From owner-fwtk-users@ex.tis.com Mon Feb 21 15:55 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA12846 Mon, 21 Feb 2000 15:55:40 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA24094; Mon, 21 Feb 2000 13:00:46 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 12:56:54 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA23338 for fwtk-users-outgoing; Mon, 21 Feb 2000 12:56:53 -0800 (PST) <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> References: < <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> Date: Mon, 21 Feb 2000 13:55:37 -0700 To: Rick Murphy From: Blair Lowe Subject: Re: tis on rh linux 6.1 Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 1156 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Thanks Rick, But I am still curious: So if you use ipchains (correctly), what is wrong with a router[ipchains]/firewall[fwtk] config. I thought that this was a standard configuration? The LINUX Firewall HOWTO recommends it in fact. I suppose you could screw up your netperm-table config too, so what's the difference? Blair. At 14:17 -0500 2000/02/21, Rick Murphy wrote: >At 06:13 AM 2/21/00 -0700, Blair Lowe wrote: >>At 21:04 +0530 1999/11/25, Sachin Dole wrote: >>>firewalls require that ipv4 packet forwarding be disabled... i dont know >> >>Why? > >Because it's a *firewall*, not a router. If you enable forwarding, >then I just route around your firewall software. (Unless you've got >something else running that makes routing decisions that requires >ipforwarding to be enabled. Really bad idea, that - anything that >goes wrong with your ipchains/etc. means you're wide open.) > -Rick Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) From owner-fwtk-users@ex.tis.com Mon Feb 21 16:23 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA12929 Mon, 21 Feb 2000 16:23:05 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA26603; Mon, 21 Feb 2000 13:28:10 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 13:24:43 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA25856 for fwtk-users-outgoing; Mon, 21 Feb 2000 13:24:42 -0800 (PST) Message-Id: <4.2.2.20000221160302.00b29860@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Mon, 21 Feb 2000 16:06:03 -0500 To: Blair Lowe From: Rick Murphy Subject: Re: tis on rh linux 6.1 Cc: fwtk-users@ex.tis.com In-Reply-To: References: <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> < <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 806 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 01:55 PM 2/21/00 -0700, Blair Lowe wrote: >Thanks Rick, > >But I am still curious: > >So if you use ipchains (correctly), what is wrong with a >router[ipchains]/firewall[fwtk] config. I thought that this was a standard >configuration? The LINUX Firewall HOWTO recommends it in fact. Right. As long as you don't enable ip forwarding if there's nothing limiting what gets forwarded. Does ipchains actually require ip forwarding to be on? >I suppose you could screw up your netperm-table config too, so what's the >difference? Enabling IP forwarding allows anyone to bypass your firewall entirely - that's a pretty heavy consequence for one problem :-) -Rick From owner-fwtk-users@ex.tis.com Mon Feb 21 22:40 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA14690 Mon, 21 Feb 2000 22:40:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA15882; Mon, 21 Feb 2000 19:45:19 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 21 Feb 2000 19:33:32 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA14817 for fwtk-users-outgoing; Mon, 21 Feb 2000 19:33:26 -0800 (PST) Message-ID: <952FAEB97E0AD111BB7000805F0D84F6035C3FF2@eesusciexs3.eesus.jnj.com> From: "Drash, Jim [EESUS]" To: "'Rick Murphy'" , Blair Lowe Cc: fwtk-users@ex.tis.com Subject: RE: tis on rh linux 6.1 Date: Mon, 21 Feb 2000 20:50:30 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="windows-1252" Content-Length: 1356 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Actually, having ip forwardng on and ipchains means nothing unless you mess up the forwarding ruleset (and the input rules and the output rules). That is true of everything in life. You will have problems if you mess things up. -----Original Message----- From: Rick Murphy [mailto:rmurphy@itm-inst.com] Sent: Monday, February 21, 2000 4:06 PM To: Blair Lowe Cc: fwtk-users@ex.tis.com Subject: Re: tis on rh linux 6.1 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 01:55 PM 2/21/00 -0700, Blair Lowe wrote: >Thanks Rick, > >But I am still curious: > >So if you use ipchains (correctly), what is wrong with a >router[ipchains]/firewall[fwtk] config. I thought that this was a standard >configuration? The LINUX Firewall HOWTO recommends it in fact. Right. As long as you don't enable ip forwarding if there's nothing limiting what gets forwarded. Does ipchains actually require ip forwarding to be on? >I suppose you could screw up your netperm-table config too, so what's the >difference? Enabling IP forwarding allows anyone to bypass your firewall entirely - that's a pretty heavy consequence for one problem :-) -Rick From owner-fwtk-users@ex.tis.com Tue Feb 22 10:33 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA17796 Tue, 22 Feb 2000 10:33:47 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA25834; Tue, 22 Feb 2000 07:38:49 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 22 Feb 2000 07:25:33 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA24458 for fwtk-users-outgoing; Tue, 22 Feb 2000 07:24:55 -0800 (PST) Message-ID: <38B2A9AF.11D5B52D@v-one.com> Date: Tue, 22 Feb 2000 10:22:23 -0500 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.7 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Tony Mai CC: FWTK Mailing List Subject: Re: HLP: Applying patches References: <379340446.951120765278.JavaMail.root@web15.pub01> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 940 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Tony Mai wrote: > > When I downloaded fwtk 2.1 from the ftp site, I noted there were some > patches files located under the patches directory. I have a few questions > and would appreciately greatly if someone can point me to the right > direction. > > 1)Are those patches to be applied on top of 2.1? No. Those are the 2.0 patches. > 2)Is there a quick way (a script perhaps) to apply all the patches? It would > be painful and errorprone to do it by hand. Newer (and non-official) patches for 2.1 can be found at the FWTK FAQ site: http://www.fwtk.org/ If you need help applying the patches, Joe Yao wrote an excellent tutorial on how to use the "patch" program: http://www.fwtk.org/fwtk/docs/documentation.html#3.3 -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Tue Feb 22 10:46 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA17858 Tue, 22 Feb 2000 10:46:43 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA29875; Tue, 22 Feb 2000 07:51:50 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 22 Feb 2000 07:42:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA26487 for fwtk-users-outgoing; Tue, 22 Feb 2000 07:42:38 -0800 (PST) Message-ID: <380335467.951234106975.JavaMail.root@web16.pub01> Date: Tue, 22 Feb 2000 10:41:46 -0500 (EST) From: Tony Mai To: Keith Young Subject: Re: HLP: Applying patches CC: FWTK Mailing List Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: mail.com X-Originating-IP: 63.196.226.106 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1346 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Thanks Keith. ------Original Message------ From: Keith Young To: Tony Mai Sent: February 22, 2000 3:22:23 PM GMT Subject: Re: HLP: Applying patches Tony Mai wrote: > > When I downloaded fwtk 2.1 from the ftp site, I noted there were some > patches files located under the patches directory. I have a few questions > and would appreciately greatly if someone can point me to the right > direction. > > 1)Are those patches to be applied on top of 2.1? No. Those are the 2.0 patches. > 2)Is there a quick way (a script perhaps) to apply all the patches? It would > be painful and errorprone to do it by hand. Newer (and non-official) patches for 2.1 can be found at the FWTK FAQ site: http://www.fwtk.org/ If you need help applying the patches, Joe Yao wrote an excellent tutorial on how to use the "patch" program: http://www.fwtk.org/fwtk/docs/documentation.html#3.3 -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com ................................................................................. iWon.com http://www.iwon.com why wouldn't you? ................................................................................. From owner-fwtk-users@ex.tis.com Tue Feb 22 10:46 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA17861 Tue, 22 Feb 2000 10:46:46 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA29903; Tue, 22 Feb 2000 07:51:54 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 22 Feb 2000 07:42:43 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA26626 for fwtk-users-outgoing; Tue, 22 Feb 2000 07:42:38 -0800 (PST) Message-ID: <38B2AC9B.ED3BE475@v-one.com> Date: Tue, 22 Feb 2000 10:34:51 -0500 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.7 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: For fwtk.org mirror admins: status Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1273 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I apologize for blasting this out to the entire FWTK list, but unfortunately my old company killed off my FWTK mirror e-mail list before I could save it. The main www.fwtk.org site has been upgraded to a new/fast Sun box. We now have 18GB of disk space to "play" with, along with with a much more secure site. However, this upgrade broke existing mirroring sites. To fix this, mirror site admins will need to make the following changes: 1) Change mirroring login name from "ftpmirror" to "ftpmirro". This is due to a restriction in the length of login names under Solaris. The password should stay the same. 2) Download and install the wu-ftpd patch for mirror. You can find the patch at: http://sunsite.org.uk/packages/mirror/ftp.pl_wupatch The mirror home site is at: http://sunsite.org.uk/packages/mirror/ 3) (optional) Read and install the security fix for the " .." file name bug in mirror. Info is at: http://sunsite.org.uk/packages/mirror/security_note.txt If anyone has any questions, either e-mail me here or at home (avenger@erols.com). -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Tue Feb 22 11:20 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA18241 Tue, 22 Feb 2000 11:20:18 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA05946; Tue, 22 Feb 2000 08:24:53 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 22 Feb 2000 08:14:05 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA03181 for fwtk-users-outgoing; Tue, 22 Feb 2000 08:14:02 -0800 (PST) Message-ID: <10B94DB22F15D211B5740008C728A30205D7D0D5@KECMSG01> From: rajkumarr To: "'fwtk-support@tis.com'" , "'fwtk-users@tis.com'" Subject: help required - http slow access problem Date: Fri, 18 Feb 2000 19:59:15 +0530 Importance: high X-Priority: 1 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 543 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, We have Linux 2.2.5-15 with fwtk2.1 proxy Suddenly we noticed that our http access went slow via this appln proxy. When we churned "messages" file in /var/log - we get the following error whenever we connect to a http site. http-gw[26925]: getpeername failed: Transport endpoint is not connected If we bypass the proxy and test the connection - response is excellent. Please advise a solution. Thanks Raj From owner-fwtk-users@ex.tis.com Tue Feb 22 11:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA18290 Tue, 22 Feb 2000 11:32:57 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA08846; Tue, 22 Feb 2000 08:37:59 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 22 Feb 2000 08:21:47 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA05534 for fwtk-users-outgoing; Tue, 22 Feb 2000 08:21:43 -0800 (PST) Message-ID: <20000221143827.7516.qmail@www0x.netaddress.usa.net> 14: 38:27 GMT 2000 Date: 21 Feb 00 06:38:27 PST From: George Saich To: TIS FWTK Subject: host name resolution X-Mailer: USANET web-mailer (M3.3.1.96) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id GAA24070 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 1551 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I was recently looking at my logs and saw a lot of the following entries: 'Feb 21 09:22:13 server7 http-gw[1010]: 10.1.1.128 host address lookup failed Feb 21 09:22:13 server7 http-gw[1010]: permit host=unknown/10.1.1.128 use of gateway (V2.1) Feb 21 09:22:13 server7 http-gw[1010]: log host=unknown/10.1.1.128 protocol=HTTP cmd=get dest=cnn.com path=/ads/advertiser/promo/9910/entertain120_tv_cnn.gif ' Everyone is able to pass through to the web, but I thought I'd fix the, 'host address lookup failed' message by adding everyone to the hosts file. Then I started getting this: 'Feb 21 07:13:48 server7 http-gw[23897]: permit host=george_s/10.1.1.129 use of \gateway (V2.1) Feb 21 07:13:49 server7 http-gw[23897]: log host=george_s/10.1.1.129 protocol=H\TTP cmd=dir dest=home.netscape.com path=/ Feb 21 07:13:49 server7 http-gw[23897]: failed to connect to http server home.n\etscape.com (80) Feb 21 07:13:49 server7 http-gw[23897]: exit host=george_s/10.1.1.129 cmds=1 in\=0 out=0 user=unauth duration=1 ', and was no longer able to access any http through the firewall. There must be an additional configuration that I missed. (The '/' are complements of emacs.) I'm using a Linux Mandrake 6.5 box. Any ideas would be appreciated, thanks. G. Saich ____________________________________________________________________ Get your own FREE, personal Netscape WebMail account today at http://webmail.netscape.com. From owner-fwtk-users@ex.tis.com Tue Feb 22 11:33 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA18302 Tue, 22 Feb 2000 11:33:24 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA08892; Tue, 22 Feb 2000 08:38:26 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 22 Feb 2000 08:21:48 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA05538 for fwtk-users-outgoing; Tue, 22 Feb 2000 08:21:44 -0800 (PST) X-Authentication-Warning: ruunat.phys.uu.nl: munnik owned process doing -bs Date: Fri, 18 Feb 2000 14:06:32 +0100 (MET) From: Martijn de Munnik To: fwtk-users@ex.tis.com Subject: Problems with make on FreeBSD 3.3 Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 516 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I'm trying to build fwtk on FreeBSD 3.3. When I execute make all in the source dir (after a fixmake to change the makefile) the compiler complains about parse errors. I think it's because the code is written using K&R style C but gcc wants to compile using ANSI style. How do I tell make to force gcc to compile K&R (has it something to do with the -traditionel flag)... grtz Martijn From owner-fwtk-users@ex.tis.com Tue Feb 22 19:08 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA20163 Tue, 22 Feb 2000 19:08:28 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA05036; Tue, 22 Feb 2000 16:13:33 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 22 Feb 2000 16:08:11 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA04074 for fwtk-users-outgoing; Tue, 22 Feb 2000 16:08:10 -0800 (PST) Message-ID: <38B3252E.1902F75A@citec.qld.gov.au> Date: Wed, 23 Feb 2000 10:09:18 +1000 From: Ken Blinco X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.5-15 i686) X-Accept-Language: en MIME-Version: 1.0 To: FWTK Mailing List Subject: smap problems Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1262 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, We've been experiencing intermittant problems with smap. When a client makes a connection to smap and begins sending data, at some stage smap decides that the client has gone away and sends the client a "550 you could say goodbye" error and then closes the connection. smap logs a "SMTP QUIT with no message" to syslog. This seems to happen more often when the client is sending large emails > 2Meg. (we do not have a limit on size) We are presuming that we are looking at intermittent network problems here and that data is simply not arriving at the socket correctly (we put in some debug statements in smap.c and found that we were getting read errors periodically). This machine on which smap is running is quite busy which may be another factor. I'm posting this just to see if anyone else out there has had similar problems, and if so, what did they do to fix the problem. Thanks Ken -- ----------------------------------------------------------- Ken Blinco E-Mail: Ken.Blinco@citec.com.au Unix Support Group Phone: +61 7 322 76970 CITEC, GPO Box 297 Brisbane, Queensland 4001 Australia From owner-fwtk-users@ex.tis.com Tue Feb 22 19:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA20256 Tue, 22 Feb 2000 19:32:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA08139; Tue, 22 Feb 2000 16:37:18 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 22 Feb 2000 16:33:59 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA07240 for fwtk-users-outgoing; Tue, 22 Feb 2000 16:33:57 -0800 (PST) Message-Id: <3.0.6.32.20000223113455.007f58f0@mailhost.uniq.com.au> X-Sender: pauline@mailhost.uniq.com.au X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.6 (32) Date: Wed, 23 Feb 2000 11:34:55 +1100 To: Ken Blinco , FWTK Mailing List From: Pauline van Winsen Subject: Re: smap problems In-Reply-To: <38B3252E.1902F75A@citec.qld.gov.au> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 865 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:09 AM 2/23/00 +1000, Ken Blinco wrote: > >I'm posting this just to see if anyone else out there has had similar >problems, and if so, what did they do to fix the problem. not specific to your problem but i "fixed" my smap problems quite some years ago by switching to smtpd: http://www.obtuse.com/smtpd.html pretty much a drop-in replacement for smap/smapd, support for the RBL & the best anti-spam/relay support i've seen. extensible with stuff like: ftp://ftp.quick.com.au/pub/unix/smtp-filter.shar.Z for quick'n'ugly content filtering. for your problem though... is it always one particular site you have problems with? or one particular connecting MTA? some of them are not very well behaved. hope this helps, pauline From owner-fwtk-users@ex.tis.com Tue Feb 22 19:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA20328 Tue, 22 Feb 2000 19:38:44 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA09917; Tue, 22 Feb 2000 16:43:51 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 22 Feb 2000 16:39:52 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA08802 for fwtk-users-outgoing; Tue, 22 Feb 2000 16:39:50 -0800 (PST) Message-ID: <38B32C9C.1822EC7D@citec.qld.gov.au> Date: Wed, 23 Feb 2000 10:41:00 +1000 From: Ken Blinco X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.5-15 i686) X-Accept-Language: en MIME-Version: 1.0 To: Pauline van Winsen CC: FWTK Mailing List Subject: Re: smap problems References: <3.0.6.32.20000223113455.007f58f0@mailhost.uniq.com.au> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1342 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Thanks for the reply, I'll take a look at smtpd as a possible future solution. And yes, the problem is particular to a couple of clients (both runing NT exchange server)..?? Ken Pauline van Winsen wrote: > > At 10:09 AM 2/23/00 +1000, Ken Blinco wrote: > > > >I'm posting this just to see if anyone else out there has had similar > >problems, and if so, what did they do to fix the problem. > > not specific to your problem but i "fixed" my smap problems quite > some years ago by switching to smtpd: > http://www.obtuse.com/smtpd.html > pretty much a drop-in replacement for smap/smapd, support for the > RBL & the best anti-spam/relay support i've seen. > extensible with stuff like: > ftp://ftp.quick.com.au/pub/unix/smtp-filter.shar.Z > for quick'n'ugly content filtering. > > for your problem though... > is it always one particular site you have problems with? > or one particular connecting MTA? some of them are not very well > behaved. > > hope this helps, > pauline -- ----------------------------------------------------------- Ken Blinco E-Mail: Ken.Blinco@citec.com.au Unix Support Group Phone: +61 7 322 76970 CITEC, GPO Box 297 Brisbane, Queensland 4001 Australia From owner-fwtk-users@ex.tis.com Tue Feb 22 20:28 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA20556 Tue, 22 Feb 2000 20:28:11 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA14512; Tue, 22 Feb 2000 17:33:13 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 22 Feb 2000 17:29:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA13578 for fwtk-users-outgoing; Tue, 22 Feb 2000 17:29:41 -0800 (PST) Date: Tue, 22 Feb 2000 20:28:40 -0500 (EST) From: Ted Keller To: Ken Blinco cc: FWTK Mailing List Subject: Re: smap problems In-Reply-To: <38B3252E.1902F75A@citec.qld.gov.au> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1889 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Ken, This message is generated when the remote side exits for some reason of another - possibly due to timeout. Standard smap is written such that if it receives an EOF from the socket - it returns back that the message was incomplete - deletes the temporary file - and exits. It's very possible the remote side gave up - closed the connection - and went away... ted keller On Wed, 23 Feb 2000, Ken Blinco wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > We've been experiencing intermittant problems with smap. When a client > makes a connection to smap and begins sending data, at some stage smap > decides that the client has gone away and sends the client a > "550 you could say goodbye" error and then closes the connection. > > smap logs a "SMTP QUIT with no message" to syslog. > > This seems to happen more often when the client is sending large emails > > 2Meg. (we do not have a limit on size) > > We are presuming that we are looking at intermittent network problems > here and that data is simply not arriving at the socket correctly (we > put in some debug statements in smap.c and found that we were getting > read errors periodically). > > This machine on which smap is running is quite busy which may be another > factor. > > I'm posting this just to see if anyone else out there has had similar > problems, and if so, what did they do to fix the problem. > > Thanks > > Ken > > -- > ----------------------------------------------------------- > Ken Blinco E-Mail: Ken.Blinco@citec.com.au > Unix Support Group Phone: +61 7 322 76970 > > CITEC, GPO Box 297 Brisbane, Queensland 4001 Australia > From owner-fwtk-users@ex.tis.com Wed Feb 23 07:19 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA22835 Wed, 23 Feb 2000 07:19:42 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA16077; Wed, 23 Feb 2000 04:24:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 23 Feb 2000 04:19:07 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA14768 for fwtk-users-outgoing; Wed, 23 Feb 2000 04:19:04 -0800 (PST) To: Pauline.van.Winsen@eserv.com.au Subject: Re: smap problems Cc: citeckeb@citec.qld.gov.au, fwtk-users@ex.tis.com X-Sun-Charset: US-ASCII Message-Id: <20000223121854.424352C15B@skynet.medar.com> Date: Wed, 23 Feb 2000 07:18:54 -0500 (EST) From: jseymour@medar.com (James Seymour) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1527 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Message-Id: <3.0.6.32.20000223113455.007f58f0@mailhost.uniq.com.au> > Date: Wed, 23 Feb 2000 11:34:55 +1100 > From: Pauline van Winsen > Subject: Re: smap problems > > At 10:09 AM 2/23/00 +1000, Ken Blinco wrote: > > > >I'm posting this just to see if anyone else out there has had similar > >problems, and if so, what did they do to fix the problem. > > not specific to your problem but i "fixed" my smap problems quite > some years ago by switching to smtpd: [snip] > It seems I've seen a number of smap-related questions go by of late. As I noted to the mailing-list a couple of weeks ago: I solved my smap problems (under Gauntlet) with Postfix (http://www.postfix.org). Works like a champ. And spam is reduced vastly. Postfix uses an architecture similar to the smap/smapd/sendmail combination used by Gauntlet/TWTK. But the thing is a complete "from-scratch" implementation of a secure e-mail MTA. Its creator is Wietse Venema. (Author of TCP wrappers and other tools. Co-author of SATAN.) One of Postfix's best features, IMO, is that its configuration files don't look like line noise :-). Regards, Jim -- Jim Seymour | Medar, Inc. jseymour@medar.com | 24775 Crestview Ct. Systems & Network Administrator | Farmington Hills, MI. 48335 | FAX: (248)477-8897 From owner-fwtk-users@ex.tis.com Wed Feb 23 16:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA26613 Wed, 23 Feb 2000 16:45:33 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA29427; Wed, 23 Feb 2000 13:50:40 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 23 Feb 2000 13:36:22 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA27484 for fwtk-users-outgoing; Wed, 23 Feb 2000 13:36:18 -0800 (PST) Message-Id: <4.2.2.20000223160810.00b1b820@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Wed, 23 Feb 2000 16:13:29 -0500 To: Ken Blinco , FWTK Mailing List From: Rick Murphy Subject: Re: smap problems In-Reply-To: <38B3252E.1902F75A@citec.qld.gov.au> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 985 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:09 AM 2/23/00 +1000, Ken Blinco wrote: >We've been experiencing intermittant problems with smap. When a client >makes a connection to smap and begins sending data, at some stage smap >decides that the client has gone away and sends the client a >"550 you could say goodbye" error and then closes the connection. > >smap logs a "SMTP QUIT with no message" to syslog. > >This seems to happen more often when the client is sending large emails > > 2Meg. (we do not have a limit on size) Probably caused by the timer firing while in the middle of the read; the alarm signal causes the read to exit with an error (errno=EINTR). The fix was to resume the read. There was a thread a month or so ago about this - if I remember correctly, adding "if (errno == EINTR) {siz++;continue}" after "if((x=fgetc(fp))==EOF)" in crlfgets fixes it. -Rick From owner-fwtk-users@ex.tis.com Wed Feb 23 18:24 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA26987 Wed, 23 Feb 2000 18:24:46 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA09443; Wed, 23 Feb 2000 15:29:44 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 23 Feb 2000 15:16:59 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA07372 for fwtk-users-outgoing; Wed, 23 Feb 2000 15:16:51 -0800 (PST) Message-ID: <38B46A5C.D37D226F@citec.qld.gov.au> Date: Thu, 24 Feb 2000 09:16:44 +1000 From: Ken Blinco X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.5-15 i686) X-Accept-Language: en MIME-Version: 1.0 To: Rick Murphy , FWTK Mailing List Subject: Re: smap problems References: <4.2.2.20000223160810.00b1b820@mail.itm-inst.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1582 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This sounds like it could well be our problem. I will check the archives of this list if I can find them, and try this fix. Will let you know how I get on. Thanks very much Ken Rick Murphy wrote: > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > At 10:09 AM 2/23/00 +1000, Ken Blinco wrote: > >We've been experiencing intermittant problems with smap. When a client > >makes a connection to smap and begins sending data, at some stage smap > >decides that the client has gone away and sends the client a > >"550 you could say goodbye" error and then closes the connection. > > > >smap logs a "SMTP QUIT with no message" to syslog. > > > >This seems to happen more often when the client is sending large emails > > > 2Meg. (we do not have a limit on size) > Probably caused by the timer firing while in the middle of the read; the > alarm signal causes the read to exit with an error (errno=EINTR). The fix > was to resume the read. There was a thread a month or so ago about this - > if I remember correctly, adding "if (errno == EINTR) {siz++;continue}" > after "if((x=fgetc(fp))==EOF)" in crlfgets fixes it. > -Rick -- ----------------------------------------------------------- Ken Blinco E-Mail: Ken.Blinco@citec.com.au Unix Support Group Phone: +61 7 322 76970 CITEC, GPO Box 297 Brisbane, Queensland 4001 Australia From owner-fwtk-users@ex.tis.com Wed Feb 23 18:28 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA27011 Wed, 23 Feb 2000 18:28:53 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA10026; Wed, 23 Feb 2000 15:33:58 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 23 Feb 2000 15:20:17 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA07946 for fwtk-users-outgoing; Wed, 23 Feb 2000 15:20:00 -0800 (PST) Message-ID: <38B46B3C.63D33670@citec.qld.gov.au> Date: Thu, 24 Feb 2000 09:20:28 +1000 From: Ken Blinco X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.5-15 i686) X-Accept-Language: en MIME-Version: 1.0 To: FWTK Mailing List Subject: archive for his list? Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 509 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I'm new to this list as your probably guessed. Could someone let me know a good location to get/search the archives of this list? Thanks Ken -- ----------------------------------------------------------- Ken Blinco E-Mail: Ken.Blinco@citec.com.au Unix Support Group Phone: +61 7 322 76970 CITEC, GPO Box 297 Brisbane, Queensland 4001 Australia From owner-fwtk-users@ex.tis.com Wed Feb 23 19:08 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA27162 Wed, 23 Feb 2000 19:08:16 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA15113; Wed, 23 Feb 2000 16:13:22 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 23 Feb 2000 16:06:50 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA13773 for fwtk-users-outgoing; Wed, 23 Feb 2000 16:06:48 -0800 (PST) Message-ID: <38B47633.1360C652@citec.qld.gov.au> Date: Thu, 24 Feb 2000 10:07:15 +1000 From: Ken Blinco X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.5-15 i686) X-Accept-Language: en MIME-Version: 1.0 To: Carl Blosser , FWTK Mailing List Subject: Re: archive for his list? References: <4137C256100ED2119632080009DB781C0441A6@echidna.skld.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1440 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Thanks for that :) Ken Carl Blosser wrote: > > Ken This is a searchable version. Hope this helps > http://www.progressive-comp.com/Lists/?l=fwtk-users&r=1&w=2#fwtk-users > Carl Blosser, MCSE CCNA > NT/Network Administrator > SKLD Information Services > 720 S. Colorado Blvd, Suite 1000N > Denver, CO 80246 > 303-820-0870 > cblosser@skld.com > > -----Original Message----- > From: Ken Blinco [mailto:citeckeb@citec.qld.gov.au] > Sent: Wednesday, February 23, 2000 4:20 PM > To: FWTK Mailing List > Subject: archive for his list? > > [To be removed from this list send the message "unsubscribe fwtk-users" in > the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > I'm new to this list as your probably guessed. Could someone let me > know a good location to get/search the archives of this list? > > Thanks > > Ken > > -- > ----------------------------------------------------------- > Ken Blinco E-Mail: Ken.Blinco@citec.com.au > Unix Support Group Phone: +61 7 322 76970 > > CITEC, GPO Box 297 Brisbane, Queensland 4001 Australia -- ----------------------------------------------------------- Ken Blinco E-Mail: Ken.Blinco@citec.com.au Unix Support Group Phone: +61 7 322 76970 CITEC, GPO Box 297 Brisbane, Queensland 4001 Australia From owner-fwtk-users@ex.tis.com Wed Feb 23 19:21 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA27226 Wed, 23 Feb 2000 19:21:44 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA17298; Wed, 23 Feb 2000 16:26:50 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 23 Feb 2000 16:16:34 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA15703 for fwtk-users-outgoing; Wed, 23 Feb 2000 16:16:30 -0800 (PST) Message-Id: <4.2.2.20000223185838.00aed6e0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Wed, 23 Feb 2000 18:59:40 -0500 To: Ken Blinco , FWTK Mailing List From: Rick Murphy Subject: Re: archive for his list? In-Reply-To: <38B46B3C.63D33670@citec.qld.gov.au> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 462 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 09:20 AM 2/24/00 +1000, Ken Blinco wrote: >I'm new to this list as your probably guessed. Could someone let me >know a good location to get/search the archives of this list? Not searchable, unfortunately. Does anyone know of a searchable archive? -Rick From owner-fwtk-users@ex.tis.com Wed Feb 23 19:36 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA27317 Wed, 23 Feb 2000 19:36:15 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA19829; Wed, 23 Feb 2000 16:41:24 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 23 Feb 2000 16:37:19 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA18825 for fwtk-users-outgoing; Wed, 23 Feb 2000 16:37:17 -0800 (PST) Message-Id: <3.0.6.32.20000224113811.007b5d90@mailhost.uniq.com.au> X-Sender: pauline@mailhost.uniq.com.au X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.6 (32) Date: Thu, 24 Feb 2000 11:38:11 +1100 To: Ken Blinco , FWTK Mailing List From: Pauline van Winsen Subject: Re: archive for his list? In-Reply-To: <38B46B3C.63D33670@citec.qld.gov.au> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 459 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi ken, At 09:20 AM 2/24/00 +1000, Ken Blinco wrote: >I'm new to this list as your probably guessed. Could someone let me >know a good location to get/search the archives of this list? best mailing list archive site i know is: http://marc.theaimsgroup.com/ fwtk-users is under information security. hope this helps, pauline From owner-fwtk-users@ex.tis.com Fri Feb 25 05:29 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA05865 Fri, 25 Feb 2000 05:29:11 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA12747; Fri, 25 Feb 2000 02:33:15 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 25 Feb 2000 00:52:53 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA07432 for fwtk-users-outgoing; Fri, 25 Feb 2000 00:52:47 -0800 (PST) X-Authentication-Warning: kgvgate.gkd-el.de: smap set sender to using -f From: =?iso-8859-1?Q?Karl_Gro=DFe_Vogelsang?= To: Subject: Multiple Domains Date: Fri, 25 Feb 2000 09:51:44 +0100 Message-ID: <000101bf7f6d$8b80cc60$2201010a@gkdel.de> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 997 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello! 2.1 with SuSE Linux 6.2 works fine for me. But one problem is still remaining: We have free domains: aaa.de, bbb.de, ccc.de, the Firewall has the hostname firewall.aaa.de. Now I found this error message in the Maillogfile: Feb 24 15:32:37 firewall sendmail[19540]: PAA19540: Authentication-Warning: firewall.aaa.de: smap set sender to using -f Feb 24 15:32:37 firewall sendmail[19540]: PAA19540: from=, size=66153, class=0, pri=96153, nrcpts=1, msgid=<01BF7EDC.5D11B650.sender@aaa.de>, relay=smap@localhost Feb 24 15:32:38 firewall sendmail[19542]: PAA19540: to=, delay=00:00:01, xdelay=00:00:01, mailer=esmtp, relay=mx.xyz.de. [123.456.789.012], stat=Sent (OK id=12NzJm-0002XU-00) But when the sender will use the domain "bbb.de", his domain will be also changed to "aaa.de". Any tips? Karl Gr. Vogelsang From owner-fwtk-users@ex.tis.com Sat Feb 26 04:03 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA10885 Sat, 26 Feb 2000 04:03:37 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA20627; Sat, 26 Feb 2000 01:07:59 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 25 Feb 2000 23:58:51 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id XAA19113 for fwtk-users-outgoing; Fri, 25 Feb 2000 23:58:43 -0800 (PST) Message-ID: <381897378.951550914777.JavaMail.root@web16.pub01> Date: Sat, 26 Feb 2000 02:41:54 -0500 (EST) From: Tony Mai To: FWTK Mailing List Subject: T-Rexx Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: mail.com X-Originating-IP: 63.196.226.106 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 865 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello all, I am in a process of building an internal firewall, one that sits between my LAN and DMZ. At first, I was going to use FWTK. Then I saw a message the other day about T-Rexx firewall. I followed the link on message and downloaded the product. Before I attempt to learn about T-Rexx, I would like to know if there is anyone in this board has used or heard this product. I would like very much to hear your opinion. Please drop me a note on this board or to tmai@2xtreme.net. Much appreciated. Tony Mai ................................................................................. iWon.com http://www.iwon.com why wouldn't you? ................................................................................. From owner-fwtk-users@ex.tis.com Mon Feb 28 01:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id BAA18125 Mon, 28 Feb 2000 01:32:48 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id WAA03564; Sun, 27 Feb 2000 22:37:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 27 Feb 2000 21:07:33 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA00438 for fwtk-users-outgoing; Sun, 27 Feb 2000 21:07:27 -0800 (PST) Date: Sun, 27 Feb 2000 19:39:46 -0800 From: Bill Kocik Subject: First impression of T.Rex To: fwtk-users@lists.nai.com Message-id: <38B9EE02.58EE6165@velocityhsi.com> MIME-version: 1.0 X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.12-20 i586) Content-transfer-encoding: 7bit X-Accept-Language: en Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 3039 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, I've spent the last three days fiddling with a copy of the T.Rex source code. Just a quick first impression: It won't compile on Solaris 7 x86, so unless you're really good at trouble-shooting compile problems and fixing code, I wouldn't try it on that platform. Of course, noone ever told me it *would*, but I tried it anyways since it's reported to compile on 2.6. (HINT: Modifying 100/src/include/firewall.h will get you past step 1). If anyone does get it to run on Sol7 x86, I'd love to hear your story. It will build on Red Hat Linux 6.1. A friend of mine reports to have built it with virtually no problems. I had to tweak a few things, but nothing major. The documentation has some errors. If you plan to run this, plan on reading Makefiles, and plan on working past a lot of errors in the documentation. A couple of hints: Four of the keys you're told to change are *not* random alphanumeric strings as the documentation says (two of the six keys you need to change are, four are not), they're 4-byte hex values and must be treated as such unless you really have a thing for compiler errors like "numeric constant contains digits beyond the radix". Also, when you try to create your first user or group and you can't figure out why "gwuser.dir" doesn't exist or where it's supposed to come from, the answer is "gwuser -c". If following the included README.build file actually works, consider it a stroke of luck. There is typically a fine line firewalls must walk between having an ultra-secure network, and having a usable network. In my opinion (read that carefully: this is just my opinion) T.Rex crosses over that line in a couple of ways. For example, if you want to do authenticated FTP you're going to have to get a CryptoCard (or one of a couple of other similar products which are also supported). I can see this being an option...but with T.Rex you *can't* authenticate to the FTP proxy without one. Same goes for ptelnet (their encrypted telnet proxy). In all, though, it seems to be quite a feature-rich package, especially when you consider it's free if you don't mind compiling it yourself. The documentation could sure use some fixing, though. Just my $.02. Anyone else have anything to contribute? (By the way, I know this is the FWTK mailing list, but I saw a few other posts about T.Rex so I figured I'd go ahead and share my experience with you all...sorry if you think I shouldn't have.) Also, if anyone's really interested in it, I might see if I have time over the coming days/weeks to put together a comprehensive how-to for building and installing the thing on Red Hat Linux 6.1. Lemme know if you'd like a copy. If there's enough interest it might inspire me to get the thing done (anyone from Freemont Avenue listening? It's okay for me to do that, right?). -- Bill Kocik Taos Mountain - "The Sys Admin Company" Santa Clara, California http://www.taos.com From owner-fwtk-users@ex.tis.com Mon Feb 28 06:34 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA18965 Mon, 28 Feb 2000 06:34:57 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA21019; Mon, 28 Feb 2000 03:39:27 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 28 Feb 2000 02:46:22 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA18335 for fwtk-users-outgoing; Mon, 28 Feb 2000 02:46:16 -0800 (PST) Message-ID: <38BA5103.53490BA5@bicho.eui.upm.es> Date: Mon, 28 Feb 2000 11:42:12 +0100 From: Maria Alandes Pradillo X-Mailer: Mozilla 4.03 [es] (Win95; I) MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: Problem with Netbios Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 981 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello! I am trying to share a directory of a server (WinNT) in my LAN, which is protected by the firewall. Following Microsoft specifications, a netbios session uses port 139. I am using plug-gw when this service is called to connect it to the server. It doesn't work, could it be because I didn't set up the correct entries in netperm-table or maybe because this protocol is more complex and plug-gw cannot deal with it? I have no idea of what else I can try to share files between the LAN and DMZ. Thanks! -- María Alandes Pradillo Universidad Politécnica de Madrid (Madrid Technical University) E.U. Informática. Organización y Estructura de la Información Ctra. de Valencia, Km. 7. E-28031 Madrid. Spain T.: (+34)-913367881 Fax. (+34)-913367520 e-mail: malandes@bicho.eui.upm.es From owner-fwtk-users@ex.tis.com Mon Feb 28 07:50 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA19185 Mon, 28 Feb 2000 07:50:51 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA25758; Mon, 28 Feb 2000 04:55:17 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 28 Feb 2000 04:04:01 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA22572 for fwtk-users-outgoing; Mon, 28 Feb 2000 04:03:50 -0800 (PST) From: ark@eltex.ru Date: Mon, 28 Feb 2000 15:15:55 +0300 Message-Id: <200002281215.PAA00806@paranoid.eltex.spb.ru> In-Reply-To: <38B9EE02.58EE6165@velocityhsi.com> from "Bill Kocik " Organization: "Klingon Imperial Intelligence Service" Subject: Re: First impression of T.Rex To: bkocik@velocityhsi.com Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1193 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Bill Kocik said : > Just my $.02. Anyone else have anything to contribute? (By the > way, I know this is the FWTK mailing list, but I saw a few other > posts about T.Rex so I figured I'd go ahead and share my > experience with you all...sorry if you think I shouldn't have.) I just tried to get rpcproxy from there and compile it standalone on BSD system. Only a few patches and it works ;) _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOLpm+qH/mIJW9LeBAQEymQP+J3UcyqnTeg5hvm0KLOGyYiq8sw2cS4Qj B7NxrS0ojp9ZO5IHs+Z85DqlX964pNRwomvuxjZEimydlrKq/sWHOwBP78+lbE5W wzF45XMhW5WGOu+Y74JgjIETiI6wSnqkRZDc5dMC5RlikALXKWwqZQAn1mufXxu6 y/hlrtH/zGI= =478R -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Mon Feb 28 12:00 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA20653 Mon, 28 Feb 2000 12:00:40 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA11993; Mon, 28 Feb 2000 09:05:10 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 28 Feb 2000 07:57:01 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA06374 for fwtk-users-outgoing; Mon, 28 Feb 2000 07:56:54 -0800 (PST) Message-Id: <4.2.0.58.20000228091137.009d47c0@lsli.com> Date: Mon, 28 Feb 2000 09:12:23 -0600 To: FWTK Mailing List From: Charles Manick Livermore Subject: Re: T-Rexx In-Reply-To: <381897378.951550914777.JavaMail.root@web16.pub01> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1745 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] T.REX was just announced on February 11,2000. To date we have had over 1000 downloads of the source code. We have had much positive feedback from both those who built the product using the source code, as well as from those who purchased the CDs (ready to install + user manuals + source code). Installation from the CD is very smooth. Thanks for your interest, Charles t 02:41 AM 2/26/2000 -0500, Tony Mai wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >Hello all, > >I am in a process of building an internal firewall, one that sits between my >LAN and DMZ. At first, I was going to use FWTK. Then I saw a message the >other day about T-Rexx firewall. I followed the link on message and >downloaded the product. > >Before I attempt to learn about T-Rexx, I would like to know if there is >anyone in this board has used or heard this product. I would like very much >to hear your opinion. Please drop me a note on this board or to >tmai@2xtreme.net. > >Much appreciated. >Tony Mai > >........................................................................... >....... >iWon.com http://www.iwon.com why wouldn't you? >........................................................................... >....... __________________________________________________________________ Charles Manick Livermore Livermore Software Laboratories div of Freemont Avenue Software, Inc. 1830 S. Kirkwood, Suite 205 Houston, TX 77077 vox: 281-759-3274 or 800-240-5754 fax: 281-759-8558 www.lsli.com www.opensourcefirewall.com From owner-fwtk-users@ex.tis.com Mon Feb 28 17:06 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA22345 Mon, 28 Feb 2000 17:06:38 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA08790; Mon, 28 Feb 2000 14:10:56 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 28 Feb 2000 13:02:14 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA00006 for fwtk-users-outgoing; Mon, 28 Feb 2000 12:09:30 -0800 (PST) Date: Mon, 28 Feb 2000 07:19:57 -0800 From: Bill Kocik Subject: Re: Problem with Netbios To: Maria Alandes Pradillo Cc: fwtk-users@lists.nai.com Message-id: <38BA921D.5EDD77CD@velocityhsi.com> MIME-version: 1.0 X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.12-20 i586) Content-transfer-encoding: 7bit X-Accept-Language: en References: <38BA5103.53490BA5@bicho.eui.upm.es> Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 909 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Maria Alandes Pradillo wrote: > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > I am trying to share a directory of a server (WinNT) in my LAN, > which is protected by the firewall. Following Microsoft specifications, > a netbios session uses port 139. I am using plug-gw when this service is > called to connect it to the server. > > It doesn't work, could it be because I didn't set up the correct > entries in netperm-table or maybe because this protocol is more complex > and plug-gw cannot deal with it? If I remember correctly, it uses port 139 but with UDP, not TCP. -- Bill Kocik Taos Mountain - "The Sys Admin Company" Santa Clara, California http://www.taos.com From owner-fwtk-users@ex.tis.com Mon Feb 28 18:59 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA22815 Mon, 28 Feb 2000 18:59:30 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA25889; Mon, 28 Feb 2000 16:03:32 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 28 Feb 2000 15:08:33 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA17816 for fwtk-users-outgoing; Mon, 28 Feb 2000 15:08:04 -0800 (PST) Reply-To: From: "Nico Baggus" To: "'Bill Kocik'" , "'Maria Alandes Pradillo'" Cc: Subject: RE: Problem with Netbios Date: Mon, 28 Feb 2000 23:20:04 +0100 Message-ID: <001a01bf8239$f6b49600$1106a8c0@niconet.adenc.nl> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 In-Reply-To: <38BA921D.5EDD77CD@velocityhsi.com> Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1573 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Netbios uses various services: 137 UDP name service 138 UDP datagram service 139 TCP data xfer. You can find more about this protocols at the samba site http://www.samba.org/ regards, Nico Baggus > -----Original Message----- > From: owner-fwtk-users@ex.tis.com > [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Bill Kocik > Sent: Monday, February 28, 2000 4:20 PM > To: Maria Alandes Pradillo > Cc: fwtk-users@lists.nai.com > Subject: Re: Problem with Netbios > > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Maria Alandes Pradillo wrote: > > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > I am trying to share a directory of a server > (WinNT) in my LAN, > > which is protected by the firewall. Following Microsoft > specifications, > > a netbios session uses port 139. I am using plug-gw when > this service is > > called to connect it to the server. > > > > It doesn't work, could it be because I didn't set > up the correct > > entries in netperm-table or maybe because this protocol is > more complex > > and plug-gw cannot deal with it? > > If I remember correctly, it uses port 139 but with UDP, not TCP. > > -- > Bill Kocik > Taos Mountain - "The Sys Admin Company" > Santa Clara, California > http://www.taos.com > > From owner-fwtk-users@ex.tis.com Mon Feb 28 19:01 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA22831 Mon, 28 Feb 2000 19:01:10 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA26098; Mon, 28 Feb 2000 16:05:19 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 28 Feb 2000 15:15:52 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA18120 for fwtk-users-outgoing; Mon, 28 Feb 2000 15:08:37 -0800 (PST) Message-ID: <003001bf8240$fecfeae0$3702040a@healtheon.com> From: "Bill Kocik" To: , "'Maria Alandes Pradillo'" Cc: References: <001a01bf8239$f6b49600$1106a8c0@niconet.adenc.nl> Subject: Re: Problem with Netbios Date: Mon, 28 Feb 2000 15:10:25 -0800 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 433 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Netbios uses various services: > > 137 UDP name service > 138 UDP datagram service > 139 TCP data xfer. So I guess I didn't remember correctly. Apologies, and thanks to Nico for pointing out my mistake. Bill Kocik Taos Mountain - "The Sys Admin Company" Santa Clara, California http://www.taos.com From owner-fwtk-users@ex.tis.com Mon Feb 28 19:08 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA22854 Mon, 28 Feb 2000 19:08:41 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA26831; Mon, 28 Feb 2000 16:12:51 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 28 Feb 2000 15:20:00 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA20498 for fwtk-users-outgoing; Mon, 28 Feb 2000 15:19:43 -0800 (PST) From: "Tom Krotchko" To: "Bill Kocik" , "Maria Alandes Pradillo" Cc: Subject: RE: Problem with Netbios Date: Mon, 28 Feb 2000 18:13:35 -0500 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <38BA921D.5EDD77CD@velocityhsi.com> X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Importance: Normal Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 525 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] It uses ports 137, 138 & 139. 137 & 138 are UDP, 139 is TCP. If you really want to understand NetBIOS, aka SMB, I highly recommend the two books on Samba; one is a SAMS book "Teach Yourself SAMBA", the other...I can't remember and someone has "borrowed" it...hmmm. Anyway, I'm sure its on Amazon. -----Original Message----- If I remember correctly, it uses port 139 but with UDP, not TCP. From owner-fwtk-users@ex.tis.com Mon Feb 28 19:36 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA22940 Mon, 28 Feb 2000 19:36:56 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA00072; Mon, 28 Feb 2000 16:41:00 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 28 Feb 2000 15:46:22 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA23985 for fwtk-users-outgoing; Mon, 28 Feb 2000 15:46:04 -0800 (PST) Message-Id: <4.2.2.20000228183003.00b42360@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Mon, 28 Feb 2000 18:36:28 -0500 To: Bill Kocik , Maria Alandes Pradillo From: Rick Murphy Subject: Re: Problem with Netbios Cc: fwtk-users@lists.nai.com In-Reply-To: <38BA921D.5EDD77CD@velocityhsi.com> References: <38BA5103.53490BA5@bicho.eui.upm.es> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1478 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 07:19 AM 2/28/00 -0800, Bill Kocik wrote: >Maria Alandes Pradillo wrote: > > > > I am trying to share a directory of a server (WinNT) in my LAN, > > which is protected by the firewall. Following Microsoft specifications, > > a netbios session uses port 139. I am using plug-gw when this service is > > called to connect it to the server. > > > > It doesn't work, could it be because I didn't set up the correct > > entries in netperm-table or maybe because this protocol is more complex > > and plug-gw cannot deal with it? > >If I remember correctly, it uses port 139 but with UDP, not TCP. There's actually three different ports. NetBIOS session service is used for user authentication; when you log in to a domain, you're connecting to the netbios session service. TCP Port 139. The shared drive data is carried over NetBIOS datagram service, UDP 138. Name lookups use NetBIOS name service, UDP port 137. You can't connect to a shared drive unless you permit UDP 138 and TCP 139. Name service isn't necessary. You can't plug nbdatagram because it's UDP; you can't NAT it in an simple packet filter because the prototcol contains imbedded IP addresses that must also be translated. Opening NetBIOS session service can open you to a dictionary attack, leaving your shared directories open to the world. -Rick From owner-fwtk-users@ex.tis.com Tue Feb 29 02:55 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA24904 Tue, 29 Feb 2000 02:55:20 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id XAA16048; Mon, 28 Feb 2000 23:59:52 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 28 Feb 2000 22:32:25 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id WAA14013 for fwtk-users-outgoing; Mon, 28 Feb 2000 22:32:06 -0800 (PST) Message-ID: <383889501.951805652521.JavaMail.root@web16.pub01> Date: Tue, 29 Feb 2000 01:27:32 -0500 (EST) From: Tony Mai To: Bill Kocik , fwtk-users@lists.nai.com Subject: RE: First impression of T.Rex Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: mail.com X-Originating-IP: 63.196.226.106 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 4121 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Bill. I for one would like to read your How-to document when it is ready. However, an intro/eval of the product would be super at this time since I am (and I am pretty there are plenty of others) would be more interested in learning if this product is 'like you said' usable. If you're hestitate about posting T-Rexx related message to this board, please email me directly at tonymai@2xtreme.net. I know that may be a lot to ask but I would greatly appreciate the help since I am new at this application proxy/firewall stuffs. Best regards, Tony Mai ------Original Message------ From: Bill Kocik To: fwtk-users@lists.nai.com Sent: February 28, 2000 3:39:46 AM GMT Subject: First impression of T.Rex [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, I've spent the last three days fiddling with a copy of the T.Rex source code. Just a quick first impression: It won't compile on Solaris 7 x86, so unless you're really good at trouble-shooting compile problems and fixing code, I wouldn't try it on that platform. Of course, noone ever told me it *would*, but I tried it anyways since it's reported to compile on 2.6. (HINT: Modifying 100/src/include/firewall.h will get you past step 1). If anyone does get it to run on Sol7 x86, I'd love to hear your story. It will build on Red Hat Linux 6.1. A friend of mine reports to have built it with virtually no problems. I had to tweak a few things, but nothing major. The documentation has some errors. If you plan to run this, plan on reading Makefiles, and plan on working past a lot of errors in the documentation. A couple of hints: Four of the keys you're told to change are *not* random alphanumeric strings as the documentation says (two of the six keys you need to change are, four are not), they're 4-byte hex values and must be treated as such unless you really have a thing for compiler errors like "numeric constant contains digits beyond the radix". Also, when you try to create your first user or group and you can't figure out why "gwuser.dir" doesn't exist or where it's supposed to come from, the answer is "gwuser -c". If following the included README.build file actually works, consider it a stroke of luck. There is typically a fine line firewalls must walk between having an ultra-secure network, and having a usable network. In my opinion (read that carefully: this is just my opinion) T.Rex crosses over that line in a couple of ways. For example, if you want to do authenticated FTP you're going to have to get a CryptoCard (or one of a couple of other similar products which are also supported). I can see this being an option...but with T.Rex you *can't* authenticate to the FTP proxy without one. Same goes for ptelnet (their encrypted telnet proxy). In all, though, it seems to be quite a feature-rich package, especially when you consider it's free if you don't mind compiling it yourself. The documentation could sure use some fixing, though. Just my $.02. Anyone else have anything to contribute? (By the way, I know this is the FWTK mailing list, but I saw a few other posts about T.Rex so I figured I'd go ahead and share my experience with you all...sorry if you think I shouldn't have.) Also, if anyone's really interested in it, I might see if I have time over the coming days/weeks to put together a comprehensive how-to for building and installing the thing on Red Hat Linux 6.1. Lemme know if you'd like a copy. If there's enough interest it might inspire me to get the thing done (anyone from Freemont Avenue listening? It's okay for me to do that, right?). -- Bill Kocik Taos Mountain - "The Sys Admin Company" Santa Clara, California http://www.taos.com ................................................................................. iWon.com http://www.iwon.com why wouldn't you? ................................................................................. From owner-fwtk-users@ex.tis.com Tue Feb 29 09:21 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA26132 Tue, 29 Feb 2000 09:21:28 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA02889; Tue, 29 Feb 2000 06:26:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 29 Feb 2000 05:17:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA00266 for fwtk-users-outgoing; Tue, 29 Feb 2000 05:17:27 -0800 (PST) To: fwtk-users@lists.nai.com Subject: RE: First impression of T.Rex Cc: tonymai@mail.com X-Sun-Charset: US-ASCII Message-Id: <20000229131125.3117C2C15B@skynet.medar.com> Date: Tue, 29 Feb 2000 08:11:25 -0500 (EST) From: jseymour@medar.com (James Seymour) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 3532 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Message-ID: <383889501.951805652521.JavaMail.root@web16.pub01> > Date: Tue, 29 Feb 2000 01:27:32 -0500 (EST) > From: Tony Mai > Subject: RE: First impression of T.Rex > [snip] > However, an intro/eval of the product would be super at this time since I am > (and I am pretty there are plenty of others) would be more interested in > learning if this product is 'like you said' usable. Looks "usable" to me. A few initial random observations/thoughts... Built, installed and configured on a Dell PowerEdge 1300 running RH Linux 6.1. I've a terse list of build/install documentation errata that may smooth the road. (I've already sent 'em in to FAS, so maybe the main docs will soon be corrected.) Otherwise built cleanly with no untoward problems. The telnet and ftp proxies are not transparent. The HTTP proxy, which would appear to have been built atop a lobotomized Apache, is. Haven't fooled with the other proxies yet. (Don't know when or if I will. Don't really need 'em, myself.) It's paranoid. Once it's fully installed as per the instructions, you cannot telnet into it even from the "trusted" network. Except with ptelnet. Which, of course, requires that you build/install ptelnet clients on each machine from which you wish to login to the firewall. And using ptelnet: not only are you not allowed to log in as root--you can't "su" to root, either. A little *too* paranoid for me: I chose instead to install OpenSSH. It's got something called "fwmon" that I have not looked into thoroughly yet. It would appear to be a daemon that wakes up at scheduled intervals and checks the integrity of the "core system." (I'm running the old familiar tripwire as well anyway.) I'm gonna figure out a way to trigger it to see what happens :-). For SMTP, it runs a separate smtpd daemon like FWTK/Gauntlet does-- with something called "smwrapd." (I just out-right replaced the whole shootin' match with Postfix, just like I did on my Gauntlet firewall--so this was a non-issue for me.) It doesn't config/work at all like Gauntlet/FWTK. (I've been running Gauntlet for several years now. And will likely [?] continue to do so. This is a new firewall for a new location.) But like those: it's "componentized." So the neat thing is: you can pick-and-choose which components you want to use, which not, and which, if any, you might want to replace with alternatives. (Like I did.) I don't see any particular reason why, for example, one couldn't create a hybrid from T.REX and FWTK--choosing the combination of components that they felt best suited their needs. (I think somebody noted that they already snagged the RPC proxy and got it to fly "stand-alone". One would assume on a FWTK-based firewall.) I've got one more custom piece to install, then I'm going to spend the remainder of the week hammering it with the likes of nmap, fine-tuning it, cleanup, etc. If it all works out, off it goes to the vict^H^H^H^H target site. > If you're hestitate about posting T-Rexx related message to this > board, [snip] Nobody's objected so far. T.REX's mailing list is *supposed* to be up tomorrow anyway. Regards, Jim -- Jim Seymour | Medar, Inc. jseymour@medar.com | 24775 Crestview Ct. Systems & Network Administrator | Farmington Hills, MI. 48335 | FAX: (248)477-8897 From owner-fwtk-users@ex.tis.com Tue Feb 29 18:49 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA29280 Tue, 29 Feb 2000 18:49:22 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA25556; Tue, 29 Feb 2000 15:47:25 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 29 Feb 2000 14:44:39 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA17689 for fwtk-users-outgoing; Tue, 29 Feb 2000 14:44:29 -0800 (PST) Message-Id: <4.2.0.58.20000229163627.00962aa0@132.203.250.27> X-Sender: crsfajmg@132.203.250.27 X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.0.58 Date: Tue, 29 Feb 2000 17:03:19 -0500 To: fwtk-users@lists.nai.com From: Jean-Martin Guay Subject: newbie pop3 and DNS Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 946 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I'm trying to let pop pass thrut a new firewall that i'm setting. I followed the howto with the plug-gw using the port 2009 as the doc said. But it does not work. here are my settings and adn my log messages taht are returned /etc/services pop-gw 2009/tcp mail-gw 2010/tcp /etc/inetd.conf pop-gw stream tcp nowait root /usr/etc/local/etc/plug-gw 2009 mail-gw stream tcp nowait root /usr/etc/local/etc/plug-gw 2010 /usr/local/etc/netperm-table plug-gw: port 2009 my.net.* -plug-to popmail.host -port 110 plug-gw: port 2010 my.net.* -plug-to popmail.host -port 25 Here are the log messages that i have localhost plug-gw[699]: my.machine.doing.emailcheck host adress lookup failed localhost plug-gw[699]: deny host=unknown/my.machine.doing.emailcheck service=2009 Can anyone help me any responses TIA JM From owner-fwtk-users@ex.tis.com Tue Feb 29 19:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA29455 Tue, 29 Feb 2000 19:26:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA28051; Tue, 29 Feb 2000 16:24:29 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 29 Feb 2000 15:30:36 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA24380 for fwtk-users-outgoing; Tue, 29 Feb 2000 15:30:23 -0800 (PST) Message-ID: <381960449.951866909888.JavaMail.root@web15.pub01> Date: Tue, 29 Feb 2000 18:28:29 -0500 (EST) From: Tony Mai To: jseymour@medar.com (James Seymour), fwtk-users@lists.nai.com Subject: RE: First impression of T.Rex Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: mail.com X-Originating-IP: 198.80.42.4 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 4190 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Thanks James. Can I have that errata note from your? I'm going to try to build starting tonight. Please keep us posted with your findings... Much appreciated. Tony Mai ------Original Message------ From: jseymour@medar.com (James Seymour) To: fwtk-users@lists.nai.com Sent: February 29, 2000 1:11:25 PM GMT Subject: RE: First impression of T.Rex [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Message-ID: <383889501.951805652521.JavaMail.root@web16.pub01> > Date: Tue, 29 Feb 2000 01:27:32 -0500 (EST) > From: Tony Mai > Subject: RE: First impression of T.Rex > [snip] > However, an intro/eval of the product would be super at this time since I am > (and I am pretty there are plenty of others) would be more interested in > learning if this product is 'like you said' usable. Looks "usable" to me. A few initial random observations/thoughts... Built, installed and configured on a Dell PowerEdge 1300 running RH Linux 6.1. I've a terse list of build/install documentation errata that may smooth the road. (I've already sent 'em in to FAS, so maybe the main docs will soon be corrected.) Otherwise built cleanly with no untoward problems. The telnet and ftp proxies are not transparent. The HTTP proxy, which would appear to have been built atop a lobotomized Apache, is. Haven't fooled with the other proxies yet. (Don't know when or if I will. Don't really need 'em, myself.) It's paranoid. Once it's fully installed as per the instructions, you cannot telnet into it even from the "trusted" network. Except with ptelnet. Which, of course, requires that you build/install ptelnet clients on each machine from which you wish to login to the firewall. And using ptelnet: not only are you not allowed to log in as root--you can't "su" to root, either. A little *too* paranoid for me: I chose instead to install OpenSSH. It's got something called "fwmon" that I have not looked into thoroughly yet. It would appear to be a daemon that wakes up at scheduled intervals and checks the integrity of the "core system." (I'm running the old familiar tripwire as well anyway.) I'm gonna figure out a way to trigger it to see what happens :-). For SMTP, it runs a separate smtpd daemon like FWTK/Gauntlet does-- with something called "smwrapd." (I just out-right replaced the whole shootin' match with Postfix, just like I did on my Gauntlet firewall--so this was a non-issue for me.) It doesn't config/work at all like Gauntlet/FWTK. (I've been running Gauntlet for several years now. And will likely [?] continue to do so. This is a new firewall for a new location.) But like those: it's "componentized." So the neat thing is: you can pick-and-choose which components you want to use, which not, and which, if any, you might want to replace with alternatives. (Like I did.) I don't see any particular reason why, for example, one couldn't create a hybrid from T.REX and FWTK--choosing the combination of components that they felt best suited their needs. (I think somebody noted that they already snagged the RPC proxy and got it to fly "stand-alone". One would assume on a FWTK-based firewall.) I've got one more custom piece to install, then I'm going to spend the remainder of the week hammering it with the likes of nmap, fine-tuning it, cleanup, etc. If it all works out, off it goes to the vict^H^H^H^H target site. > If you're hestitate about posting T-Rexx related message to this > board, [snip] Nobody's objected so far. T.REX's mailing list is *supposed* to be up tomorrow anyway. Regards, Jim -- Jim Seymour | Medar, Inc. jseymour@medar.com | 24775 Crestview Ct. Systems & Network Administrator | Farmington Hills, MI. 48335 | FAX: (248)477-8897 ................................................................................. iWon.com http://www.iwon.com why wouldn't you? .................................................................................