From owner-fwtk-users@ex.tis.com Wed Mar 1 01:19 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id BAA00545 Wed, 1 Mar 2000 01:19:02 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id WAA11054; Tue, 29 Feb 2000 22:16:49 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 29 Feb 2000 21:09:06 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA08535 for fwtk-users-outgoing; Tue, 29 Feb 2000 21:08:53 -0800 (PST) Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: <4.2.0.58.20000229163627.00962aa0@132.203.250.27> References: <4.2.0.58.20000229163627.00962aa0@132.203.250.27> Date: Tue, 29 Feb 2000 21:56:36 -0700 To: Jean-Martin Guay , fwtk-users@lists.nai.com From: Blair Lowe Subject: Re: newbie pop3 and DNS Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 1709 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Salut Jean, You may want to know that running pop on the Internet can be a bad idea. Anyone sniffing packets can read your email password, as it is sent in plain text. You may want to look at a summary page I did on the subject at http://www.compeng.net/pages/email_security.html. I have checked out imp, and it is quite good. It's only drawback is that it is slow, but some future enhancements should fix this. TTYL, Blair. At 17:03 -0500 2000/02/29, Jean-Martin Guay wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > > >I'm trying to let pop pass thrut a new firewall that i'm setting. >I followed the howto with the plug-gw using the port 2009 as the doc said. >But it does not work. > >here are my settings and adn my log messages taht are returned > >/etc/services > >pop-gw 2009/tcp >mail-gw 2010/tcp > >/etc/inetd.conf > >pop-gw stream tcp nowait root /usr/etc/local/etc/plug-gw 2009 >mail-gw stream tcp nowait root /usr/etc/local/etc/plug-gw 2010 > >/usr/local/etc/netperm-table > >plug-gw: port 2009 my.net.* -plug-to popmail.host -port 110 >plug-gw: port 2010 my.net.* -plug-to popmail.host -port 25 > >Here are the log messages that i have > >localhost plug-gw[699]: my.machine.doing.emailcheck host adress lookup failed >localhost plug-gw[699]: deny >host=unknown/my.machine.doing.emailcheck service=2009 > > >Can anyone help me > >any responses TIA > >JM Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) From owner-fwtk-users@ex.tis.com Wed Mar 1 07:56 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA01824 Wed, 1 Mar 2000 07:56:14 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA26346; Wed, 1 Mar 2000 05:00:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 1 Mar 2000 03:26:43 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA21523 for fwtk-users-outgoing; Wed, 1 Mar 2000 03:26:20 -0800 (PST) From: ark@eltex.ru Date: Wed, 1 Mar 2000 14:21:03 +0300 Message-Id: <200003011121.OAA13266@paranoid.eltex.spb.ru> In-Reply-To: from "Blair Lowe " Organization: "Klingon Imperial Intelligence Service" Subject: Re: newbie pop3 and DNS To: Blair.Lowe@compeng.net Cc: jean-martin.guay@crsfa.ulaval.ca, fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 2700 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Blair Lowe said : > You may want to know that running pop on the Internet can be a bad > idea. Anyone sniffing packets can read your email password, as it is > sent in plain text. Wrong. > > You may want to look at a summary page I did on the subject at > http://www.compeng.net/pages/email_security.html. APOP was not even mentioned there. > > I have checked out imp, and it is quite good. It's only drawback is > that it is slow, but some future enhancements should fix this. I don't think webmail is good. There are protocols designed for mail and specific MUAs that serve that purpose much better than any web-based thing can. > > TTYL, > Blair. > > At 17:03 -0500 2000/02/29, Jean-Martin Guay wrote: > >[To be removed from this list send the message "unsubscribe fwtk-users" in the > >BODY of a mail message to majordomo@ex.tis.com.] > > > > > >I'm trying to let pop pass thrut a new firewall that i'm setting. > >I followed the howto with the plug-gw using the port 2009 as the doc said. > >But it does not work. > > > >here are my settings and adn my log messages taht are returned > > > >/etc/services > > > >pop-gw 2009/tcp > >mail-gw 2010/tcp > > > >/etc/inetd.conf > > > >pop-gw stream tcp nowait root /usr/etc/local/etc/plug-gw 2009 > >mail-gw stream tcp nowait root /usr/etc/local/etc/plug-gw 2010 > > > >/usr/local/etc/netperm-table > > > >plug-gw: port 2009 my.net.* -plug-to popmail.host -port 110 > >plug-gw: port 2010 my.net.* -plug-to popmail.host -port 25 > > > >Here are the log messages that i have > > > >localhost plug-gw[699]: my.machine.doing.emailcheck host adress lookup failed > >localhost plug-gw[699]: deny > >host=unknown/my.machine.doing.emailcheck service=2009 > > > > > >Can anyone help me > > > >any responses TIA > > > >JM > > Computer Engineering Inc. > http://www.compeng.net > Phone: 780 499 5687 (9 - 5 MST) > Fax: 780 435 0693 (24 Hours) > _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOLz9HaH/mIJW9LeBAQFo0QP+JKLNtQxZAPs9vuxKvEOGc/urFitRr+vE 2X8aJrvst2qO/edy5p1L6hIngD7o0bjVtqg3YEqXoeXwrn8Nsl2RWoacv9ANtKFP s8dNSgWZCwo6ESPWSPO0EY8Y7VEhRuxZZdqeUGhWYcizZU43uUJCNp6XEdeGE6kE RrrxAHzJ0t0= =XH+f -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Wed Mar 1 09:55 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA02537 Wed, 1 Mar 2000 09:55:16 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA03022; Wed, 1 Mar 2000 06:59:41 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 1 Mar 2000 05:57:20 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA28613 for fwtk-users-outgoing; Wed, 1 Mar 2000 05:57:09 -0800 (PST) To: fwtk-users@lists.nai.com Subject: Re: newbie pop3 and DNS X-Sun-Charset: US-ASCII Message-Id: <20000301131753.ADE142C15B@skynet.medar.com> Date: Wed, 1 Mar 2000 08:17:53 -0500 (EST) From: jseymour@medar.com (James Seymour) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 877 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > From: ark@eltex.ru > Date: Wed, 1 Mar 2000 14:21:03 +0300 > Message-Id: <200003011121.OAA13266@paranoid.eltex.spb.ru> > Subject: Re: newbie pop3 and DNS > > Blair Lowe said : > > > You may want to know that running pop on the Internet can be a bad > > idea. Anyone sniffing packets can read your email password, as it is > > sent in plain text. > > Wrong. > [remainder snipped] It *is*??? That's news to me. And, I would imagine, to a lot of other people as well! Regards Jim -- Jim Seymour | Medar, Inc. jseymour@medar.com | 24775 Crestview Ct. Systems & Network Administrator | Farmington Hills, MI. 48335 | FAX: (248)477-8897 From owner-fwtk-users@ex.tis.com Wed Mar 1 10:40 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA02780 Wed, 1 Mar 2000 10:40:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA07067; Wed, 1 Mar 2000 07:44:16 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 1 Mar 2000 06:43:50 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA01434 for fwtk-users-outgoing; Wed, 1 Mar 2000 06:43:28 -0800 (PST) Message-ID: <38BCE038.9C7B2BBD@bicho.eui.upm.es> Date: Wed, 01 Mar 2000 10:17:45 +0100 From: Maria Alandes Pradillo X-Mailer: Mozilla 4.03 [es] (Win95; I) MIME-Version: 1.0 To: Rick Murphy CC: Bill Kocik , fwtk-users@lists.nai.com Subject: Re: Problem with Netbios References: <38BA5103.53490BA5@bicho.eui.upm.es> <4.2.2.20000228183003.00b42360@mail.itm-inst.com> Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 1247 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > You can't connect to a shared drive unless you permit UDP 138 and TCP 139. > Name service isn't necessary. You can't plug nbdatagram because it's UDP; Is there any other application, similar to plug-gw, that could plug UDP? In any rate, maybe if I use ip forwading I can dothat, but then I cannot use fwtk > you can't NAT it in an simple packet filter because the prototcol contains > imbedded IP addresses that must also be translated. > The nature of netbios will never allow for this "redirection" even with ip forwarding, right? > Opening NetBIOS session service can open you to a dictionary attack, > leaving your shared directories open to the world. > -Rick So you mean that sharing filesystems with machines in the internet is not a good idea, right? is there any secure way of doing it? Thanks! -- María Alandes Pradillo Universidad Politécnica de Madrid (Madrid Technical University) E.U. Informática. Organización y Estructura de la Información Ctra. de Valencia, Km. 7. E-28031 Madrid. Spain T.: (+34)-913367881 Fax. (+34)-913367520 e-mail: malandes@bicho.eui.upm.es From owner-fwtk-users@ex.tis.com Wed Mar 1 13:19 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA03434 Wed, 1 Mar 2000 13:19:25 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA18124; Wed, 1 Mar 2000 10:23:38 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 1 Mar 2000 09:12:04 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA11024 for fwtk-users-outgoing; Wed, 1 Mar 2000 09:11:53 -0800 (PST) Message-ID: From: Nick Colakovic To: "'Maria Alandes Pradillo'" Cc: fwtk-users@lists.nai.com Subject: RE: Problem with Netbios Date: Wed, 1 Mar 2000 10:07:06 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1769 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] UDP >138 and TCP 139. >> Name service isn't necessary. You can't plug nbdatagram >because it's UDP; > >Is there any other application, similar to plug-gw, that could >plug UDP? In any >rate, maybe if I use ip forwading I can dothat, but then I >cannot use fwtk Udprelay. It works like plug-gw for UDP. Depending on what OS you compile under you will likely need patches to get it to work. It works alright for in our use, but it is rough around the edges. The real issue it has is that the no one has unified the various patches made for it. >So you mean that sharing filesystems with machines in the >internet is not a good >idea, right? Yes. Opening up the SMB ports exposes the machine in question to a large number of well documented attacks. These include DoS attacks, password dictionary attacks, etc. >is there any secure way of doing it? Sure setup a IPSEC encrypted tunnel between the two machines. There are a few open source products for linux and xBSD that allow a IPSEC tunnel to be created between two Unix machines. Natively in WinNT 4.0 and Win 9x IPSEC is not available. There are a good number of third party products that implement IPSEC under WinNT 4.0. The real issue here is the interoperability with two different products. Many times Product A cannot talk to product B. Personally I wouldn't bother with the open source stuff as these have limited throughput and the implementations seem to be beta quality at best. But then I again I haven't used these products so someone else might have a better opinion of them. Personally I would use a hardware VPN box(s) to do this. -NRC From owner-fwtk-users@ex.tis.com Wed Mar 1 13:19 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA03437 Wed, 1 Mar 2000 13:19:26 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA18119; Wed, 1 Mar 2000 10:23:38 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 1 Mar 2000 09:16:39 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA11868 for fwtk-users-outgoing; Wed, 1 Mar 2000 09:16:13 -0800 (PST) From: ark@eltex.ru Date: Wed, 1 Mar 2000 20:14:02 +0300 Message-Id: <200003011714.UAA14805@paranoid.eltex.spb.ru> Organization: "Klingon Imperial Intelligence Service" Subject: Re: newbie pop3 and DNS To: Blair.Lowe@compeng.net Cc: ark@eltex.ru, jean-martin.guay@crsfa.ulaval.ca, fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 948 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, APOP is md5-based challenge/responce authentication protocol. It is based on md5 of password combined with session-unical timestamp. Not a bad solution, what's wrong with it? _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOL1P2aH/mIJW9LeBAQFfZAP/YGvYEUTGtIHYS11/7j3KVH+etv7P7mq/ M46BQxguXxn5ws8N15qyqAIUguf5OeGIxxbe7m4BQeUCH/e+HSyyyX1GgGNHu8pp WPuTElWQ4iOReJTie2+duZ2TH1Xwn23+aLWga2zKOMl2X2ZjLEUNNYRO5krruaaO h+L0qiOxDv4= =Da/V -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Wed Mar 1 13:21 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA03441 Wed, 1 Mar 2000 13:21:17 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA18510; Wed, 1 Mar 2000 10:25:25 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 1 Mar 2000 09:26:02 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA12665 for fwtk-users-outgoing; Wed, 1 Mar 2000 09:25:49 -0800 (PST) Message-Id: <4.2.0.58.20000301111548.009554b0@hermes.ulaval.ca> X-Sender: crsfajmg@hermes.ulaval.ca X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.0.58 Date: Wed, 01 Mar 2000 11:21:57 -0500 To: 5chavez@gte.net From: Jean-Martin Guay Subject: Re: newbie pop3 and DNS Cc: fwtk-users@lists.nai.com In-Reply-To: <38BCA84C.70AACC2D@gte.net> References: <4.2.0.58.20000229163627.00962aa0@132.203.250.27> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 948 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 00:19 00-03-01 , you wrote: >Jean-Martin, > >I was having a simular problem, now i have in my netperm-table > >pop-gw: timeout 3600 >pop-gw: port pop-gw my.internal.ip.address -plug-to my.pop3.server > -port 110 >mail-gw: timeout 3600 >mail-gw: port mail-gw my.internal.ip.address -plug-to my.smtp.server >-port 25 > >I think that was the problem using plug-gw instead of pop-gw or >mail-gw. Let me >know if that >helps you. > >Have a great day [original skiped] Well, seems that it does not work for me, I still get the message that tells me host adress lookup failed, I am begining to think that it's because i don't have a "DNS" like function. That was my initial question, does some pop3 servers verify your name (not username but machine's) before letting you in? Thanks anyway JM From owner-fwtk-users@ex.tis.com Wed Mar 1 15:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA03992 Wed, 1 Mar 2000 15:32:23 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA27286; Wed, 1 Mar 2000 12:36:40 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 1 Mar 2000 11:26:09 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA06537 for fwtk-users-outgoing; Wed, 1 Mar 2000 07:33:52 -0800 (PST) Message-ID: <017e01bf8392$4364b300$b400000a@k-180.nutricia.com.pl> From: "Mariusz Potocki" To: "Maria Alandes Pradillo" Cc: Subject: Odp: Problem with Netbios Date: Wed, 1 Mar 2000 16:24:40 +0100 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 4.72.2106.4 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-2" Content-Length: 506 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > >> You can't connect to a shared drive unless you permit UDP 138 and TCP 139. >> Name service isn't necessary. You can't plug nbdatagram because it's UDP; > >Is there any other application, similar to plug-gw, that could plug UDP? In any >rate, maybe if I use ip forwading I can dothat, but then I cannot use fwtk > Find (somewhere at purdue uni) and check out UDPrelay. From owner-fwtk-users@ex.tis.com Thu Mar 2 05:18 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA06235 Thu, 2 Mar 2000 05:18:25 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA07773; Thu, 2 Mar 2000 02:23:01 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 01:10:51 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA03816 for fwtk-users-outgoing; Thu, 2 Mar 2000 01:10:38 -0800 (PST) X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E995611B58E@exchange.pdv.de> From: "Dirk.Nerling" Reply-To: Dirk.Nerling@pdv.de To: "Firewall Toolkit (M-list)" Cc: "'pat@patsat.isis.co.za'" Subject: what did they with my smap/d ???? Date: Thu, 2 Mar 2000 10:00:10 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="---- =_NextPart_000_01BF8425.B6B12102" Content-Length: 22386 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------ =_NextPart_000_01BF8425.B6B12102 Content-Type: text/plain Hello all, I'm using fwtk 2.1 in conjunction with the yao patch. It seems as somebody is trying to use my machine for sending spam. I (as postmaster) got the following mails from my mailerdaemon. I have sendmail 8.9.3 - could somebody help me??? Does anybody know a method to ignore the yao patch??? best regards Dirk <> <> -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de ------ =_NextPart_000_01BF8425.B6B12102 Content-Type: message/rfc822 Content-Description: Postmaster notify: User unknown Message-ID: <200002292118.WAB23520@wall.pdv.de> From: Mail Delivery Subsystem To: postmaster@wall.pdv.de Subject: Postmaster notify: User unknown Date: Tue, 29 Feb 2000 22:18:12 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_002_01BF8425.B6B12102" ------ =_NextPart_002_01BF8425.B6B12102 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 22:18:12 +0100 (CET) from mail@localhost ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- 550 ... User unknown 554 /no/such/directory/dead.letter... cannot open /no/such/directory/dead.letter: No such file or directory ------ =_NextPart_002_01BF8425.B6B12102 Content-Type: application/octet-stream; name="ATT04521.TXT" Content-Disposition: attachment; filename="ATT04521.TXT" Reporting-MTA: dns; wall.pdv.de Arrival-Date: Tue, 29 Feb 2000 22:18:12 +0100 (CET) Final-Recipient: RFC822; Action: failed Status: 5.1.1 Last-Attempt-Date: Tue, 29 Feb 2000 22:18:13 +0100 (CET) ------ =_NextPart_002_01BF8425.B6B12102 Content-Type: message/rfc822 Message-ID: From: postmaster@clart1.clart.co.jp To: ancq3f1nkrz5xza@pdv.de Subject: Delivery failure Date: Tue, 29 Feb 2000 22:17:43 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: text/plain; charset="iso-8859-1" Your message has encountered delivery problems to bambo@earthlink.net. 550 ... User unknown Your message reads (in part): Received: from localhost (unverified [209.82.3.2]) by clart1.clart.co.jp (EMWAC SMTPRS 0.83) with SMTP id ; Wed, 01 Mar 2000 06:17:35 +0900 Message-ID: Date: Tue, 29 Feb 2000 16:15:33 References: 071866788 Content-Transfer-Encoding: 7bit Importance: Medium To: X-See-Also: 06B630866 Subject: How ToReach Thousands Of Prospects With E-Marketing MessageID: Content-Type: text/plain From: X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.7 MIME-Version: 1.0 X-Other-References: 0094AA9AD _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ S P E C I A L R E P O R T - How To Reach Thousands Of Prospects Every Month _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ Our research has found that many people have tried one or more of the following... Free Classifieds? (They just don't work anymore) Web Site? (Takes thousands of surfers) Banners? (Expensive and losing their punch) E-Zine? (Hope they have a -huge- subscriber list) Search Engines? (Forget it, unless you're in the top 20) S O W H A T D O E S W O R K ? Although often misunderstood, there is one method that has proven to succeed time-after-time. E - M A I L M A R K E T I N G ! ! IT'S A FACT... It if you're not using your computer to generate income, GOOD income, you're leaving money on the table. Here's what the experts have to say about E-Mail Marketing: "A gold mine for those who can take advantage of bulk e-mail programs" - The New York Times "E-mail is an incredible lead generation tool" -Crains Magazine "Blows away traditional Mailing" - Advertising Age Here's a potential earnings example: Let's say you have a product or service that can bring a profit of around $30. Remember, on the Internet, you can make money 7 days a week, 24 hours a day... even while you sleep, orders come from all over the world! Orders Per Day Weekly Monthly Yearly 1 $ 210 $ 840 $ 10,080 2 420 1,680 20,160 3 630 2,520 30,240 5 1,050 4,200 50,400 10 2,100 8,400 100,000 15 3,150 12,600 151,200 The way to reach thousands of people, generate orders and build wealth is person-to-person direct. 1. How do you find the millions of people on the Internet? 2. What are you going to tell them when you do reach them? HERE'S THE ANSWER TO QUESTION #1 M I L L I O N S V O L U M E 9 ***New - 10 Million addresses - Just Released*** The cleanest, most comprehensive e-mail address list in the world, BAR NONE! We're proud to offer it. O N E O F A K I N D This is a first. No one has gone to the work it takes to produce an e-mail address list of this quality. Here's how we prepare our e-mail lists: 1. We clean and eliminate all duplicates. 2. Next, we use a filter list of 400+ words/phrases to clean even more. No address with inappropriate or profane wording survive! 3. Then we used our private database of thousands of known "extremists", opposed to commercial e-mail, and kicked off every one we could find. 4. And finally, we sorted the list into easy-to-manage packets of 20,000 addresses in a simple text (.txt) format. 5. All domains have been verified as valid. WHAT DID WE END UP WITH? Volume 9... 10 Million Addresses Strong! An address list so clean you'll want to start mailing today! N O B R A G - J U S T F A C T With our super clean e-mail address lists you'll send less...and get better results... * Y O U G E T W H A T Y O U P A Y F O R * Our NEW 10 Million, Volume 9, address list CD will result in: * Higher Response Rates * Higher Sales Conversion Ratios * More Receptive prospects; Less Flames & Non-Buyers. * Less Contact With Anti-Commerce Radicals & Extremists. Remember that potential income chart at the beginning of this message? Can you imagine the kind of money you could make if you mailed one million pieces and sold only one tenth (.01%) of one percent? You do the math, you'll be amazed! We've been in the list brokerage business for over 5 years and we've never compromised on quality. We won't release any address list until it passes our "high standards" test. This is not a rental list that is restricted to a one-time mailing. You are purchasing an e-mail address list for your own personal mailings and may use it over-and-over. DON'T HESITATE on this offer or you will miss out on the least expensive, legal and most effective way to market... PERIOD! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ *** RETURNED MESSAGE TRUNCATED *** ------ =_NextPart_002_01BF8425.B6B12102-- ------ =_NextPart_000_01BF8425.B6B12102 Content-Type: message/rfc822 Content-Description: Postmaster notify: Host unknown (Name server: 209.166.134.57: host not found) Message-ID: <200002292118.WAC23502@wall.pdv.de> From: Mail Delivery Subsystem To: postmaster@wall.pdv.de Subject: Postmaster notify: Host unknown (Name server: 209.166.134.57: hos t not found) Date: Tue, 29 Feb 2000 22:18:09 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_002_01BF8425.B6B12102" ------ =_NextPart_002_01BF8425.B6B12102 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 22:18:08 +0100 (CET) from localhost ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- 550 ... Host unknown (Name server: 209.166.134.57: host not found) ------ =_NextPart_002_01BF8425.B6B12102 Content-Type: application/octet-stream; name="ATT04512.TXT" Content-Disposition: attachment; filename="ATT04512.TXT" Reporting-MTA: dns; wall.pdv.de Arrival-Date: Tue, 29 Feb 2000 22:18:08 +0100 (CET) Final-Recipient: RFC822; MAILMAX-MAIL-DAEMON@209.166.134.57 Action: failed Status: 5.1.2 Remote-MTA: DNS; 209.166.134.57 Last-Attempt-Date: Tue, 29 Feb 2000 22:18:09 +0100 (CET) ------ =_NextPart_002_01BF8425.B6B12102 Content-Type: message/rfc822 Message-ID: <200002292118.WAB23502@wall.pdv.de> From: Mail Delivery Subsystem To: MAILMAX-MAIL-DAEMON@209.166.134.57 Subject: Returned mail: User unknown Date: Tue, 29 Feb 2000 22:18:08 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_004_01BF8425.B6B12102" ------ =_NextPart_004_01BF8425.B6B12102 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 22:18:08 +0100 (CET) from mail@localhost ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- 550 ... User unknown ------ =_NextPart_004_01BF8425.B6B12102 Content-Type: application/octet-stream; name="ATT04518.TXT" Content-Disposition: attachment; filename="ATT04518.TXT" Reporting-MTA: dns; wall.pdv.de Arrival-Date: Tue, 29 Feb 2000 22:18:08 +0100 (CET) Final-Recipient: RFC822; Action: failed Status: 5.1.1 Last-Attempt-Date: Tue, 29 Feb 2000 22:18:09 +0100 (CET) ------ =_NextPart_004_01BF8425.B6B12102 Content-Type: message/rfc822 Message-ID: <200002292118.WAA23502@wall.pdv.de> From: MailMAX Error Responder To: ancq3f1nkrz5xza@pdv.de Subject: Undeliverable Mail Date: Tue, 29 Feb 2000 22:19:16 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: text/plain; charset="iso-8859-1" Sorry ancq3f1nkrz5xza@pdv.de, Your message to: iveta@earthlink.net was not delivered. When we said... RCPT TO: .. the remote server gave us this error response ... 550 ... User unknown This is a Permanent error, and we will not try to deliver it again. *** This message was automatically generated by the MailMAX Error Responder *** -- 8< -- 8< -- [ Original Message As Follows ] -- >8 -- >8 -- Received: from localhost (216.1.23.9[216.1.23.9])by MAILSERVER(MailMax 2.040) with ESMTP id 0 for ancq3f1nkrz5xza@pdv.de; Tue, 29 Feb 2000 16:18:36 -0500 EST Subject: Special Report: How To Get The Edge With E-Marketing Content-Transfer-Encoding: 7bit Sensitivity: Public MIME-Version: 1.0 Date: Tue, 29 Feb 2000 16:09:11 To: MessageID: References: 0540A1E72 From: Content-Type: text/plain X-See-Also: 0DC3DCE44 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 X-Other-References: 0677DE43F X-Mailer: Microsoft Outlook Express 4.72.3110.1 X-In-Response-To: 011267540 _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ S P E C I A L R E P O R T - How To Reach Thousands Of Prospects Every Month _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ Our research has found that many people have tried one or more of the following... Free Classifieds? (They just don't work anymore) Web Site? (Takes thousands of surfers) Banners? (Expensive and losing their punch) E-Zine? (Hope they have a -huge- subscriber list) Search Engines? (Forget it, unless you're in the top 20) S O W H A T D O E S W O R K ? Although often misunderstood, there is one method that has proven to succeed time-after-time. E - M A I L M A R K E T I N G ! ! IT'S A FACT... It if you're not using your computer to generate income, GOOD income, you're leaving money on the table. Here's what the experts have to say about E-Mail Marketing: "A gold mine for those who can take advantage of bulk e-mail programs" - The New York Times "E-mail is an incredible lead generation tool" -Crains Magazine "Blows away traditional Mailing" - Advertising Age Here's a potential earnings example: Let's say you have a product or service that can bring a profit of around $30. Remember, on the Internet, you can make money 7 days a week, 24 hours a day... even while you sleep, orders come from all over the world! Orders Per Day Weekly Monthly Yearly 1 $ 210 $ 840 $ 10,080 2 420 1,680 20,160 3 630 2,520 30,240 5 1,050 4,200 50,400 10 2,100 8,400 100,000 15 3,150 12,600 151,200 The way to reach thousands of people, generate orders and build wealth is person-to-person direct. 1. How do you find the millions of people on the Internet? 2. What are you going to tell them when you do reach them? HERE'S THE ANSWER TO QUESTION #1 M I L L I O N S V O L U M E 9 ***New - 10 Million addresses - Just Released*** The cleanest, most comprehensive e-mail address list in the world, BAR NONE! We're proud to offer it. O N E O F A K I N D This is a first. No one has gone to the work it takes to produce an e-mail address list of this quality. Here's how we prepare our e-mail lists: 1. We clean and eliminate all duplicates. 2. Next, we use a filter list of 400+ words/phrases to clean even more. No address with inappropriate or profane wording survive! 3. Then we used our private database of thousands of known "extremists", opposed to commercial e-mail, and kicked off every one we could find. 4. And finally, we sorted the list into easy-to-manage packets of 20,000 addresses in a simple text (.txt) format. 5. All domains have been verified as valid. WHAT DID WE END UP WITH? Volume 9... 10 Million Addresses Strong! An address list so clean you'll want to start mailing today! N O B R A G - J U S T F A C T With our super clean e-mail address lists you'll send less...and get better results... * Y O U G E T W H A T Y O U P A Y F O R * Our NEW 10 Million, Volume 9, address list CD will result in: * Higher Response Rates * Higher Sales Conversion Ratios * More Receptive prospects; Less Flames & Non-Buyers. * Less Contact With Anti-Commerce Radicals & Extremists. Remember that potential income chart at the beginning of this message? Can you imagine the kind of money you could make if you mailed one million pieces and sold only one tenth (.01%) of one percent? You do the math, you'll be amazed! We've been in the list brokerage business for over 5 years and we've never compromised on quality. We won't release any address list until it passes our "high standards" test. This is not a rental list that is restricted to a one-time mailing. You are purchasing an e-mail address list for your own personal mailings and may use it over-and-over. DON'T HESITATE on this offer or you will miss out on the least expensive, legal and most effective way to market... PERIOD! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ F R E E B O N U S E S Order within 72 hours and we'll include the following FREE Bonuses... we call this our "BUSINESS ON A CD" bonus. 1. To help you get started we include basic proven Professional Mailing Software. This software has sold for as high as $499.00 in the past. No demo, but a full working version (SORRY, SINCE THE SOFTWARE IS FREE WE CANNOT OFFER ANY TECHNICAL SUPPORT, however set-up instructions are included). 2. Every survey has always indicated that the most profitable product to sell on the Internet is INFORMATION! Our "BUSINESS ON A CD" gives you 650 reports/manuals/books that are yours to use and sell. With these "Special Reports" you may instantly start your "Information Product" business... plus a sample SALES LETTER is included to help you GET STARTED FAST! 3. "THE BULK E-MAIL SURVIVAL GUIDE" A manual/guide that addresses the Bulk E-Mail business. Especially useful for beginners. "THE BULK E-MAIL SURVIVAL GUIDE" will answer most of your questions and concerns about Bulk E-Mail. An exclusive for our customers... INCLUDED FREE. 4. "LISTMATE" - This is the software the Pro's use to manage their mailing lists. We've included two versions, both are fully functional demo's, the only limit is the file size. 5. "SCIENTIFIC ADVERTISING"! This is the book that is responsible for untold millions of dollars in sales and profits. Many of today's Internet "gurus" have used this powerful book as the foundation for marketing courses that they have written and sold for as much as $495. Marketeer's that have studied this book have been so deeply inspired, that it has changed their entire way of doing business, and they've gone on to make fortunes -- it's yours FREE with your order! This "BUSINESS ON A CD" bonus is yours absolutely FREE if you order within the next 72 hours --- After that... Poof!... it's gone! ***SPECIAL BONUS*** Order within the next 72 hours and receive an additional 972,565 e-mail addresses as a prompt ordering bonus. Order Now! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ D O N ' T H E S I T A T E E-Marketing is the most effective and fastest way to market anywhere... PERIOD! O R D E R N O W . . . SAME DAY SERVICE (M-F) if your order is received before 2pm Pacific. 24hour fax service, just fax to: 1-801-760-8911 To order, via credit card simply cut/paste and print out the EZ ORDER FORM below and fax to our office today. ***** MILLIONS CD - Volume 9 ***** ***** NOW ONLY $247! ***** This "Special Price" is in effect for the next 72 hours, after that we go back to our regular price of $299.00 ... Don't delay... you can be in business tomorrow! We accept Visa, Mastercard, Amex and Checks by Fax. Fax your order to: 1-500-677-4016 or 1-801-760-8911 ----------------------Cut & Paste---------------------- ---------------------EZ Order Form--------------------- _____Yes! I want everything! I am ordering within 72 hours. Include my FREE "Business On A CD" bonus along with your 10 Million Vol. 9 E-Mail address CD (plus 972,565 bonus addresses) for the special price of only $247.00 + shipping as indicated below. _____Oop's I missed the 72 hour "special". I am ordering Vol. 9 at the regular price of $299.00 + shipping. ***PLEASE SELECT YOUR SHIPPING OPTION*** ____I would like to receive my package FedEx OVERNIGHT. I am including $15 for shipping. (Hawaii & Alaska $20 - Canada $25, all other International add an *additional* $25 [$40 total] for shipping) ____I would like to receive my package FedEx 2nd Day delivery. I'm including $10 for shipping. (Sorry FedEx 2nd Day is NOT AVAILABLE for shipments to Alaska, Hawaii, Canada or any International destination - Continental U.S. shipping addresses only). ***Please Print Carefully*** NOTE: Orders cannot be shipped without complete information including your signature. No exceptions! NAME____________________________________________________ COMPANY NAME____________________________________________ ADDRESS_________________________________________________ (FedEx can only ship to street addresses - no P.O. boxes) CITY, STATE, ZIP________________________________________ PHONE NUMBER____________________________________________ (required for shipping & tracking) EMAIL ADDRESS___________________________________________ (Print Carefully - required in case we have a question and to send you a confirmation that your order has been shipped) TYPE OF CREDIT CARD: ______VISA _____MASTERCARD _____AMEX CREDIT CARD# __________________________________________ EXPIRATION DATE________________________________________ NAME ON CARD___________________________________________ TOTAL AMOUNT (Including Shipping): $___________________ DATE:x__________________ (Required) SIGNATURE:x_________________________________ I understand that I am purchasing the Millions Vol. 9 e-mail address CD, the addresses are not rented, but are mine to use for my own mailing, over-and-over. Free bonuses are included, but cannot be considered part of the financial transaction. I understand that it is my responsibility to comply with any laws applicable to my local area. As with all software, once opened the CD may not be returned, however, if found defective it will be replaced with like product at no charge. You may fax your order to us at: 1-500-677-4016 or 1-801-760-8911 CHECK BY FAX SERVICES! Please Note: Sorry, we can only accept checks drawn on U.S. banks. If you would like to fax a check, tape your check below and fax it to our office along with the EZ Order Form to: 1-500-677-4016 or 1-801-760-8911 ***************************************************************** ***24 HOUR FAX SERVICES*** PLEASE PASTE YOUR CHECK HERE AND FAX IT TO US AT 1-500-677-4016 or 1-801-760-8911 ***************************************************************** If You fax a check, there is no need for you to mail the original. We will prepare a one-time draft, with the exact information on your original check. All checks will be held for bank clearance. (7-10 days) Make payable to: "CD-Marketing" ******************************************************** Do not reply to this message - ******************************************************** To register your e-mail address for removal from unsolicited mailings, visit: http://www.OptList.com ******************************************************** -- 8< -- 8< -- [ Original Message End ] -- >8 -- >8 -- ------ =_NextPart_004_01BF8425.B6B12102-- ------ =_NextPart_002_01BF8425.B6B12102-- ------ =_NextPart_000_01BF8425.B6B12102-- From owner-fwtk-users@ex.tis.com Thu Mar 2 09:35 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA07003 Thu, 2 Mar 2000 09:35:06 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA15457; Thu, 2 Mar 2000 06:38:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 05:14:53 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA12226 for fwtk-users-outgoing; Thu, 2 Mar 2000 05:14:36 -0800 (PST) Date: Thu, 2 Mar 2000 08:12:41 -0500 (EST) From: Ted Keller To: "Dirk.Nerling" cc: "Firewall Toolkit (M-list)" , "'pat@patsat.isis.co.za'" Subject: Re: what did they with my smap/d ???? In-Reply-To: <6CC81B07CB44D311A1D20001FA7E995611B58E@exchange.pdv.de> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 985 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Dirk, What do your logs report? Are you seeing connections from an external site that is trying to relay to someone else? ted keller On Thu, 2 Mar 2000, Dirk.Nerling wrote: > Hello all, > > I'm using fwtk 2.1 in conjunction with the yao patch. It seems as somebody > is trying to use my machine for sending spam. I (as postmaster) got the > following mails from my mailerdaemon. I have sendmail 8.9.3 - could somebody > help me??? Does anybody know a method to ignore the yao patch??? > > best regards Dirk > <> < (Name server: 209.166.134.57: host not found)>> > > > -- > Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: > ++49-361-4407144 > PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 > CC83 > http://www.pdv.de > From owner-fwtk-users@ex.tis.com Thu Mar 2 10:43 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA07299 Thu, 2 Mar 2000 10:43:27 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA18803; Thu, 2 Mar 2000 07:48:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 06:50:25 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA15895 for fwtk-users-outgoing; Thu, 2 Mar 2000 06:50:17 -0800 (PST) From: a.blount@mbox.com.au Date: Thu, 02 Mar 2000 06:38:25 +0800 (WST) Date-warning: Date header was inserted by perth.mbox.com.au Subject: E-mail relaying problem and netperm-table To: fwtk-users@lists.nai.com Message-id: <78e8c723.c72378e8@mbox.com.au> MIME-version: 1.0 X-Mailer: Netscape Webmail Content-language: en Content-disposition: inline Content-transfer-encoding: 7BIT X-Accept-Language: en Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1862 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Greetings, I have smap installed on a system I use and no matter what I do with my /opt/TISfwtk/etc/netperm-table file I can't seem to get it to stop relaying mail. Below is the anti-spam section of my netperm-table along with the lines to allow relaying from authorised hosts (hostnames and IP addresses substituted for bogus ones). I know there are patches for using blocking lists and stuff but for the moment I'd just like to stop domains except for my own and hosts except the ones in my network from relaying through the server. Also, if I have a relay-net and then someone from an authorised host tries to spoof mail from another domain how can I make it drop the smtp connection when an invalid domain is entered? (ie. authorised host 10.1.2.3 connects to port 25 and does 'HELO some.domain.com MAIL FROM: user@some.domain.com ...' where some.domain.com is not one of the domains I want to relay for). I have done a 'strings' to ensure the smap/smapd programs are looking at the correct netperm-table file (I inherited the system and there's about 5 of them scattered around the place) and that seems fine. I'm at a total loss with this one and think it may be a misconfiguration of the netperm-table but none of the doco seems to mention half the stuff already in my netperm-table, let alone additional information. Thanks in advance for any help. # anti-spam smap: nospam ns-required smap: nospam debug smap: relay-net 10.1.1.0:255.255.255.0 #Net smap: relay-net 127.0.0.1:255.255.255.255 #Localhost smap: relay-net 1.2.3.0:255.255.255.0 #Net smap: relay-net 1.2.3.4:255.255.255.255 #Host smap: relay-domain relay.domain1.com smap: relay-domain relay.domain2.com Adrian Blount Unix Administrator From owner-fwtk-users@ex.tis.com Thu Mar 2 11:53 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA00421 Thu, 2 Mar 2000 11:53:46 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA24866; Thu, 2 Mar 2000 08:58:31 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 07:59:04 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA19612 for fwtk-users-outgoing; Thu, 2 Mar 2000 07:58:47 -0800 (PST) Message-Id: <4.3.0.20000302103914.00ae7140@mailhost.research.ryerson.ca> X-Sender: pdunphy@mailhost.research.ryerson.ca X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Thu, 02 Mar 2000 10:48:29 -0500 To: fwtk-users@lists.nai.com From: Paul Dunphy Subject: Accessing NT Domain from Behind Firewall Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1208 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have one Win98 PC behind my firewall which needs access to an NT domain that exists outside of the firewall. (The reason it needs access is simply so it can map a shared drive from the outside domain.) I have tried opening up ports 137 and 138 for UDP, and port 139 for TCP, as per the recent Netbios discussions, but still cannot access the shared drive. If I try setting up Win98 to log into the NT domain on boot-up, it complains that it is not able to find the NT domain server. If I try just mapping a drive, it says that it cannot find the computer or drive in question. Does anyone know what might be causing this, and if there is any way of getting around it while still maintaining a reasonable degree of security on the firewall? Thanks, Paul --------------------------------------------------------------------- Paul T. Dunphy, P.Eng. Technical Services Officer/Technology Manager Office of Research Services Ryerson Polytechnic University Toronto, Ontario, CANADA Phone: (416) 979-5000 ext. 7112 Fax: (416) 979-5336 E-mail: pdunphy@research.ryerson.ca From owner-fwtk-users@ex.tis.com Thu Mar 2 13:41 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA00841 Thu, 2 Mar 2000 13:41:07 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA02361; Thu, 2 Mar 2000 10:45:41 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 09:41:24 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA27334 for fwtk-users-outgoing; Thu, 2 Mar 2000 09:40:58 -0800 (PST) Date: Thu, 2 Mar 2000 11:00:57 -0500 (EST) From: Ted Keller To: a.blount@mbox.com.au cc: fwtk-users@lists.nai.com Subject: Re: E-mail relaying problem and netperm-table In-Reply-To: <78e8c723.c72378e8@mbox.com.au> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2232 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Adrian, Are you sure that you have one of the anti-relaying patches installed? ted keller On Thu, 2 Mar 2000 a.blount@mbox.com.au wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Greetings, > > I have smap installed on a system I use and no matter what I do with > my /opt/TISfwtk/etc/netperm-table file I can't seem to get it to stop > relaying mail. > > Below is the anti-spam section of my netperm-table along with the lines > to allow relaying from authorised hosts (hostnames and IP addresses > substituted for bogus ones). > > I know there are patches for using blocking lists and stuff but for the > moment I'd just like to stop domains except for my own and hosts except > the ones in my network from relaying through the server. > > Also, if I have a relay-net and then someone from an authorised host > tries to spoof mail from another domain how can I make it drop the smtp > connection when an invalid domain is entered? (ie. authorised host > 10.1.2.3 connects to port 25 and does 'HELO some.domain.com MAIL FROM: > user@some.domain.com ...' where some.domain.com is not one of the > domains I want to relay for). > > I have done a 'strings' to ensure the smap/smapd programs are looking > at the correct netperm-table file (I inherited the system and there's > about 5 of them scattered around the place) and that seems fine. > > I'm at a total loss with this one and think it may be a > misconfiguration of the netperm-table but none of the doco seems to > mention half the stuff already in my netperm-table, let alone > additional information. > > Thanks in advance for any help. > > # anti-spam > smap: nospam ns-required > smap: nospam debug > smap: relay-net 10.1.1.0:255.255.255.0 #Net > smap: relay-net 127.0.0.1:255.255.255.255 #Localhost > smap: relay-net 1.2.3.0:255.255.255.0 #Net > smap: relay-net 1.2.3.4:255.255.255.255 #Host > smap: relay-domain relay.domain1.com > smap: relay-domain relay.domain2.com > > Adrian Blount > Unix Administrator > > From owner-fwtk-users@ex.tis.com Thu Mar 2 14:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA01005 Thu, 2 Mar 2000 14:22:01 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA07460; Thu, 2 Mar 2000 11:26:41 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 10:36:43 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA00816 for fwtk-users-outgoing; Thu, 2 Mar 2000 10:36:19 -0800 (PST) X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E9956115054@exchange.pdv.de> From: "Dirk.Nerling" To: "Firewall (M-list)" , "Firewall Toolkit (M-list)" Subject: got relayed - need your help! Date: Thu, 2 Mar 2000 18:15:20 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="---- =_NextPart_000_01BF846A.E37602A8" Content-Length: 28469 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------ =_NextPart_000_01BF846A.E37602A8 Content-Type: text/plain Hello all, I'm using fwtk 2.1 and the yao patch to disable relaying. The tests from abuse.net and orbs.com think that we couldn't used as a relay host. But there is another strange (?) thing. The facts: someone seems to send email from my email server, but I couldn't found this in my logs. They sent the email as "ancq3f1nkrz5xza@pdv.de" and I (as postmaster) got the "user unknown" spam mails which doesn't receivied the users, because of a wrong address or so on. I inlcude one of this emails here (I got ~700). Because of my logs I found domain near ours, which also was used as a realay I contacted the admin and got some logs. The logs show the ancq3f1nkrz5xza was used at other hosts to. AND what I don't understand they have TO ancq3f1nkrz5xza@relay and FROM ancq3f1nkrz5xza@relay mails. Jan 1 05:07:17 wall sendmail[2545]: FAA02545: from=, size=10768, class=0, pri=640768, nrcpts=21, msgid=<199701010407.FAA02545@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) Jan 1 05:07:18 wall sendmail[2547]: FAA02547: from=, size=10834, class=0, pri=640834, nrcpts=21, msgid=<199701010407.FAA02547@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) Jan 1 05:07:19 wall sendmail[2546]: FAA02546: from=, size=11048, class=0, pri=641048, nrcpts=21, msgid=<199701010407.FAA02546@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) Jan 1 05:07:25 wall sendmail[2544]: FAA02544: from=, size=10911, class=0, pri=640911, nrcpts=21, msgid=<199701010407.FAA02544@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) Jan 1 05:07:25 wall sendmail[2559]: FAA02559: from=, size=10834, class=0, pri=100834, nrcpts=3, msgid=<199701010407.FAA02559@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) Jan 1 05:07:26 wall sendmail[2562]: FAA02562: from=, size=11048, class=0, pri=101048, nrcpts=3, msgid=<199701010407.FAA02562@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) ********* schnipp: ********* Why do they sent the mails to us again???? Jan 1 05:07:56 wall sendmail[2557]: FAA02557: to=, delay=00:00:08, xdelay=00:00:08, mailer=esmtp, relay=ns.pdv.de. [194.139.111.2], stat=Sent (Mail accepted) Jan 1 05:07:57 wall sendmail[2561]: FAA02561: to=, delay=00:00:11, xdelay=00:00:10, mailer=esmtp, relay=monday.dk. [195.184.47.130], stat=Sent (2.5.0 OK.) Does anybody has an idea? How could I prevent this? Whats is going on here???? best reagrds Dirk <> <> -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de ------ =_NextPart_000_01BF846A.E37602A8 Content-Type: message/rfc822 Content-Description: Postmaster notify: User unknown Message-ID: <200002292219.XAB25698@wall.pdv.de> From: Mail Delivery Subsystem To: postmaster@wall.pdv.de Subject: Postmaster notify: User unknown Date: Tue, 29 Feb 2000 23:19:07 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_002_01BF846A.E37602A8" ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 23:19:06 +0100 (CET) from mail@localhost ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- 550 ... User unknown 554 /no/such/directory/dead.letter... cannot open /no/such/directory/dead.letter: No such file or directory ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: application/octet-stream; name="ATT06553.TXT" Content-Disposition: attachment; filename="ATT06553.TXT" Reporting-MTA: dns; wall.pdv.de Arrival-Date: Tue, 29 Feb 2000 23:19:06 +0100 (CET) Final-Recipient: RFC822; Action: failed Status: 5.1.1 Last-Attempt-Date: Tue, 29 Feb 2000 23:19:07 +0100 (CET) ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: message/rfc822 Message-ID: <200002292217.XAA07964@pandora.etos.com.pl> To: ancq3f1nkrz5xza@pdv.de Subject: Returned mail: User unknown Date: Tue, 29 Feb 2000 23:17:38 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_004_01BF846A.E37602A8" ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 23:17:32 +0100 (GMT+0100) from [216.1.23.9] ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- .. while talking to grebe.prod.itd.earthlink.net.: >>> RCPT To: <<< 550 ... User unknown 550 ... User unknown ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: application/octet-stream; name="ATT06556.TXT" Content-Disposition: attachment; filename="ATT06556.TXT" Reporting-MTA: dns; pandora.etos.com.pl Received-From-MTA: dns; [216.1.23.9] Arrival-Date: Tue, 29 Feb 2000 23:17:32 +0100 (GMT+0100) Final-Recipient: rfc822; gambrel@earthlink.net Action: failed Status: 5.1.1 Remote-MTA: dns; grebe.prod.itd.earthlink.net Diagnostic-Code: smtp; 550 ... User unknown Last-Attempt-Date: Tue, 29 Feb 2000 23:17:37 +0100 (GMT+0100) ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: message/rfc822 Message-ID: <200002292217.XAA07959@pandora.etos.com.pl> To: worsing@earthlink.net Subject: Special Report: E-Marketing - Reach Thousands of Prospects Date: Tue, 29 Feb 2000 18:10:43 +0100 Importance: high X-Priority: 1 Sensitivity: Company-Confidential MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: text/plain; charset="iso-8859-1" _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ S P E C I A L R E P O R T - How To Reach Thousands Of Prospects Every Month _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ Our research has found that many people have tried one or more of the following... Free Classifieds? (They just don't work anymore) Web Site? (Takes thousands of surfers) Banners? (Expensive and losing their punch) E-Zine? (Hope they have a -huge- subscriber list) Search Engines? (Forget it, unless you're in the top 20) S O W H A T D O E S W O R K ? Although often misunderstood, there is one method that has proven to succeed time-after-time. E - M A I L M A R K E T I N G ! ! IT'S A FACT... It if you're not using your computer to generate income, GOOD income, you're leaving money on the table. Here's what the experts have to say about E-Mail Marketing: "A gold mine for those who can take advantage of bulk e-mail programs" - The New York Times "E-mail is an incredible lead generation tool" -Crains Magazine "Blows away traditional Mailing" - Advertising Age Here's a potential earnings example: Let's say you have a product or service that can bring a profit of around $30. Remember, on the Internet, you can make money 7 days a week, 24 hours a day... even while you sleep, orders come from all over the world! Orders Per Day Weekly Monthly Yearly 1 $ 210 $ 840 $ 10,080 2 420 1,680 20,160 3 630 2,520 30,240 5 1,050 4,200 50,400 10 2,100 8,400 100,000 15 3,150 12,600 151,200 The way to reach thousands of people, generate orders and build wealth is person-to-person direct. 1. How do you find the millions of people on the Internet? 2. What are you going to tell them when you do reach them? HERE'S THE ANSWER TO QUESTION #1 M I L L I O N S V O L U M E 9 ***New - 10 Million addresses - Just Released*** The cleanest, most comprehensive e-mail address list in the world, BAR NONE! We're proud to offer it. O N E O F A K I N D This is a first. No one has gone to the work it takes to produce an e-mail address list of this quality. Here's how we prepare our e-mail lists: 1. We clean and eliminate all duplicates. 2. Next, we use a filter list of 400+ words/phrases to clean even more. No address with inappropriate or profane wording survive! 3. Then we used our private database of thousands of known "extremists", opposed to commercial e-mail, and kicked off every one we could find. 4. And finally, we sorted the list into easy-to-manage packets of 20,000 addresses in a simple text (.txt) format. 5. All domains have been verified as valid. WHAT DID WE END UP WITH? Volume 9... 10 Million Addresses Strong! An address list so clean you'll want to start mailing today! N O B R A G - J U S T F A C T With our super clean e-mail address lists you'll send less...and get better results... * Y O U G E T W H A T Y O U P A Y F O R * Our NEW 10 Million, Volume 9, address list CD will result in: * Higher Response Rates * Higher Sales Conversion Ratios * More Receptive prospects; Less Flames & Non-Buyers. * Less Contact With Anti-Commerce Radicals & Extremists. Remember that potential income chart at the beginning of this message? Can you imagine the kind of money you could make if you mailed one million pieces and sold only one tenth (.01%) of one percent? You do the math, you'll be amazed! We've been in the list brokerage business for over 5 years and we've never compromised on quality. We won't release any address list until it passes our "high standards" test. This is not a rental list that is restricted to a one-time mailing. You are purchasing an e-mail address list for your own personal mailings and may use it over-and-over. DON'T HESITATE on this offer or you will miss out on the least expensive, legal and most effective way to market... PERIOD! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ F R E E B O N U S E S Order within 72 hours and we'll include the following FREE Bonuses... we call this our "BUSINESS ON A CD" bonus. 1. To help you get started we include basic proven Professional Mailing Software. This software has sold for as high as $499.00 in the past. No demo, but a full working version (SORRY, SINCE THE SOFTWARE IS FREE WE CANNOT OFFER ANY TECHNICAL SUPPORT, however set-up instructions are included). 2. Every survey has always indicated that the most profitable product to sell on the Internet is INFORMATION! Our "BUSINESS ON A CD" gives you 650 reports/manuals/books that are yours to use and sell. With these "Special Reports" you may instantly start your "Information Product" business... plus a sample SALES LETTER is included to help you GET STARTED FAST! 3. "THE BULK E-MAIL SURVIVAL GUIDE" A manual/guide that addresses the Bulk E-Mail business. Especially useful for beginners. "THE BULK E-MAIL SURVIVAL GUIDE" will answer most of your questions and concerns about Bulk E-Mail. An exclusive for our customers... INCLUDED FREE. 4. "LISTMATE" - This is the software the Pro's use to manage their mailing lists. We've included two versions, both are fully functional demo's, the only limit is the file size. 5. "SCIENTIFIC ADVERTISING"! This is the book that is responsible for untold millions of dollars in sales and profits. Many of today's Internet "gurus" have used this powerful book as the foundation for marketing courses that they have written and sold for as much as $495. Marketeer's that have studied this book have been so deeply inspired, that it has changed their entire way of doing business, and they've gone on to make fortunes -- it's yours FREE with your order! This "BUSINESS ON A CD" bonus is yours absolutely FREE if you order within the next 72 hours --- After that... Poof!... it's gone! ***SPECIAL BONUS*** Order within the next 72 hours and receive an additional 972,565 e-mail addresses as a prompt ordering bonus. Order Now! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ D O N ' T H E S I T A T E E-Marketing is the most effective and fastest way to market anywhere... PERIOD! O R D E R N O W . . . SAME DAY SERVICE (M-F) if your order is received before 2pm Pacific. 24hour fax service, just fax to: 1-801-760-8911 To order, via credit card simply cut/paste and print out the EZ ORDER FORM below and fax to our office today. ***** MILLIONS CD - Volume 9 ***** ***** NOW ONLY $247! ***** This "Special Price" is in effect for the next 72 hours, after that we go back to our regular price of $299.00 ... Don't delay... you can be in business tomorrow! We accept Visa, Mastercard, Amex and Checks by Fax. Fax your order to: 1-500-677-4016 or 1-801-760-8911 ----------------------Cut & Paste---------------------- ---------------------EZ Order Form--------------------- _____Yes! I want everything! I am ordering within 72 hours. Include my FREE "Business On A CD" bonus along with your 10 Million Vol. 9 E-Mail address CD (plus 972,565 bonus addresses) for the special price of only $247.00 + shipping as indicated below. _____Oop's I missed the 72 hour "special". I am ordering Vol. 9 at the regular price of $299.00 + shipping. ***PLEASE SELECT YOUR SHIPPING OPTION*** ____I would like to receive my package FedEx OVERNIGHT. I am including $15 for shipping. (Hawaii & Alaska $20 - Canada $25, all other International add an *additional* $25 [$40 total] for shipping) ____I would like to receive my package FedEx 2nd Day delivery. I'm including $10 for shipping. (Sorry FedEx 2nd Day is NOT AVAILABLE for shipments to Alaska, Hawaii, Canada or any International destination - Continental U.S. shipping addresses only). ***Please Print Carefully*** NOTE: Orders cannot be shipped without complete information including your signature. No exceptions! NAME____________________________________________________ COMPANY NAME____________________________________________ ADDRESS_________________________________________________ (FedEx can only ship to street addresses - no P.O. boxes) CITY, STATE, ZIP________________________________________ PHONE NUMBER____________________________________________ (required for shipping & tracking) EMAIL ADDRESS___________________________________________ (Print Carefully - required in case we have a question and to send you a confirmation that your order has been shipped) TYPE OF CREDIT CARD: ______VISA _____MASTERCARD _____AMEX CREDIT CARD# __________________________________________ EXPIRATION DATE________________________________________ NAME ON CARD___________________________________________ TOTAL AMOUNT (Including Shipping): $___________________ DATE:x__________________ (Required) SIGNATURE:x_________________________________ I understand that I am purchasing the Millions Vol. 9 e-mail address CD, the addresses are not rented, but are mine to use for my own mailing, over-and-over. Free bonuses are included, but cannot be considered part of the financial transaction. I understand that it is my responsibility to comply with any laws applicable to my local area. As with all software, once opened the CD may not be returned, however, if found defective it will be replaced with like product at no charge. You may fax your order to us at: 1-500-677-4016 or 1-801-760-8911 CHECK BY FAX SERVICES! Please Note: Sorry, we can only accept checks drawn on U.S. banks. If you would like to fax a check, tape your check below and fax it to our office along with the EZ Order Form to: 1-500-677-4016 or 1-801-760-8911 ***************************************************************** ***24 HOUR FAX SERVICES*** PLEASE PASTE YOUR CHECK HERE AND FAX IT TO US AT 1-500-677-4016 or 1-801-760-8911 ***************************************************************** If You fax a check, there is no need for you to mail the original. We will prepare a one-time draft, with the exact information on your original check. All checks will be held for bank clearance. (7-10 days) Make payable to: "CD-Marketing" ******************************************************** Do not reply to this message - ******************************************************** To register your e-mail address for removal from unsolicited mailings, visit: http://www.OptList.com ******************************************************** ------ =_NextPart_004_01BF846A.E37602A8-- ------ =_NextPart_002_01BF846A.E37602A8-- ------ =_NextPart_000_01BF846A.E37602A8 Content-Type: message/rfc822 Content-Description: Postmaster notify: Host unknown (Name server: ip130.lth2.k12.il.us: host not found) Message-ID: <200002292218.XAC25678@wall.pdv.de> From: Mail Delivery Subsystem To: postmaster@wall.pdv.de Subject: Postmaster notify: Host unknown (Name server: ip130.lth2.k12.il.u s: host not found) Date: Tue, 29 Feb 2000 23:18:37 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_002_01BF846A.E37602A8" ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 23:18:37 +0100 (CET) from localhost ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- 550 ... Host unknown (Name server: ip130.lth2.k12.il.us: host not found) ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: application/octet-stream; name="ATT06529.TXT" Content-Disposition: attachment; filename="ATT06529.TXT" Reporting-MTA: dns; wall.pdv.de Arrival-Date: Tue, 29 Feb 2000 23:18:37 +0100 (CET) Final-Recipient: RFC822; Postmaster@ip130.lth2.k12.il.us Action: failed Status: 5.1.2 Remote-MTA: DNS; ip130.lth2.k12.il.us Last-Attempt-Date: Tue, 29 Feb 2000 23:18:37 +0100 (CET) ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: message/rfc822 Message-ID: <200002292218.XAB25678@wall.pdv.de> From: Mail Delivery Subsystem To: Postmaster@ip130.lth2.k12.il.us Subject: Returned mail: User unknown Date: Tue, 29 Feb 2000 23:18:37 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_004_01BF846A.E37602A8" ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 23:18:36 +0100 (CET) from mail@localhost ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- 550 ... User unknown ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: application/octet-stream; name="ATT06532.TXT" Content-Disposition: attachment; filename="ATT06532.TXT" Reporting-MTA: dns; wall.pdv.de Arrival-Date: Tue, 29 Feb 2000 23:18:36 +0100 (CET) Final-Recipient: RFC822; Action: failed Status: 5.1.1 Last-Attempt-Date: Tue, 29 Feb 2000 23:18:37 +0100 (CET) ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: message/rfc822 Message-ID: <200002292218.XAA25678@wall.pdv.de> From: Postmaster To: ancq3f1nkrz5xza@pdv.de Subject: Non-Delivery Report Date: Tue, 29 Feb 2000 23:18:29 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: text/plain; charset="iso-8859-1" Could not deliver message (ID=77882) to remote account 'spettee@earthlink.net'. Remote server returned error: 550 Mailbox not found (user unknown). The first portion of the original message text follows: ------------------------------------------------------- Received: from localhost by ip130.lth2.k12.il.us (AppleShare IP Mail Server 6.1) id 77882 via TCP with SMTP; Tue, 29 Feb 2000 16:18:21 -0600 MessageID: Content-Type: text/plain Subject: How To Reach Thousands Of Prospects Every Month? X-References: 052E1F1ED, 01E9871A6 From: MIME-Version: 1.0 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 To: Sensitivity: Public Date: Tue, 29 Feb 2000 17:09:54 References: 032D542C8 X-See-Also: 0F8CC5442 X-Mailer: Microsoft Outlook Express 4.72.3110.6 _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ S P E C I A L R E P O R T - How To Reach Thousands Of Prospects Every Month _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ Our research has found that many people have tried one or more of the following... Free Classifieds? (They just don't work anymore) Web Site? (Takes thousands of surfers) Banners? (Expensive and losing their punch) E-Zine? (Hope they have a -huge- subscriber list) Search Engines? (Forget it, unless you're in the top 20) S O W H A T D O E S W O R K ? Although often misunderstood, there is one method that has proven to succeed time-after-time. E - M A I L M A R K E T I N G ! ! IT'S A FACT... It if you're not using your computer to generate income, GOOD income, you're leaving money on the table. Here's what the experts have to say about E-Mail Marketing: "A gold mine for those who can take advantage of bulk e-mail programs" - The New York Times "E-mail is an incredible lead generation tool" -Crains Magazine "Blows away traditional Mailing" - Advertising Age Here's a potential earnings example: Let's say you have a product or service that can bring a profit of around $30. Remember, on the Internet, you can make money 7 days a week, 24 hours a day... even while you sleep, orders come from all over the world! Orders Per Day Weekly Monthly Yearly 1 $ 210 $ 840 $ 10,080 2 420 1,680 20,160 3 630 2,520 30,240 5 1,050 4,200 50,400 10 2,100 8,400 100,000 15 3,150 12,600 151,200 The way to reach thousands of people, generate orders and build wealth is person-to-person direct. 1. How do you find the millions of people on the Internet? 2. What are you going to tell them when you do reach them? HERE'S THE ANSWER TO QUESTION #1 M I L L I O N S V O L U M E 9 ***New - 10 Million addresses - Just Released*** The cleanest, most comprehensive e-mail address list in the world, BAR NONE! We're proud to offer it. O N E O F A K I N D This is a first. No one has gone to the work it takes to produce an e-mail address list of this quality. Here's how we prepare our e-mail lists: 1. We clean and eliminate all duplicates. 2. Next, we use a filter list of 400+ words/phrases to clean even more. No address with inappropriate or profane wording survive! 3. Then we used our private database of thousands of known "extremists", opposed to commercial e-mail, and kicked off every one we could find. 4. And finally, we sorted the list into easy-to-manage packets of 20,000 addresses in a simple text (.txt) format. 5. All domains have been verified as valid. WHAT DID WE END UP WITH? Volume 9... 10 Million Addresses Strong! An address list so clean you'll want to start mailing today! N O B R A G - J U S T F A C T With our super clean e-mail address lists you'll send less...and get better results... * Y O U G E T W H A T Y O U P A Y F O R * Our NEW 10 Million, Volume 9, address list CD will result in: * Higher Response Rates * Higher Sales Conversion Ratios * More Receptive prospects; Less Flames & Non-Buyers. * Less Contact With Anti-Commerce Radicals & Extremists. Remember that potential income chart at the beginning of this message? Can you imagine the kind of money you could make if you mailed one million pieces and sold only one tenth (.01%) of one percent? You do the math, you'll be amazed! We've been in the list brokerage business for over 5 years and we've never compromised on quality. We won't release any address list until it passes our "high standards" test. This is not a rental list that is restricted to a one-time mailing. You are purchasing an e-mail address list for your own personal mailings and may use it over-and-over. DON'T HESITATE on this offer or you will miss out on the least expensive, legal and most effective way to market... PERIOD! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ F R E E B O N U S E S Order within 72 hours and we'll include the following FREE Bonuses... we call this our "BUSINESS ON A CD" bonus. 1. To help you get started we include basic proven Professional Mailing Software. This software has sold for as high as $499.00 in the past. No demo, but a full working version (SORRY, SINCE THE SOFTWARE IS FREE WE CANNOT OFFER ANY TECHNICAL SUPPORT, however set-up instructions are included). 2. Every survey has always indicated that the most profitable product to sell on the Internet is INFORMATION! Our "BUSINESS ON A CD" gives you 650 reports/manuals/books that are yours to use and sell. With these "Special Reports" you may instantly start your "Information Product" business... plus a sample SALES LETTER is included to help you GET STARTED FAST! 3. "THE BULK E-MAIL SURVIVAL GUIDE" A manual/guide that addresses the Bulk E-Mail business. Especially useful for beginners. "THE BULK E-MAIL SURVIVAL GUIDE" will answer most of your questions and concerns about Bulk E-Mail. An exclusive for our customers... INCLUDED FREE. 4. "LISTMATE" - This is the software the Pro's use to manage their mailing lists. We've included two versions, both are fully functional demo's, the only limit is the file size. 5. "SCIENTIFIC ADVERTISING"! This is the book that is responsible for untold millions of dollars in sales and profits. Many of today's Internet "gurus" have used this powerful book as the foundation for marketing courses that they have written and sold for as much as $495. Marketeer's that have studied this book have been so deeply inspired, that it has changed their entire way of doing business, and they've gone on to make fortunes -- it's yours FREE with your order! This "BUSINESS ON A CD" bonus is yours absolutely FREE if you order within the next 72 hours --- After that... Poof!... it's gone! ***SPECIAL BONUS*** Order within the next 72 hours and receive an additional 972,565 e-mail addresses as a prompt ordering bonus. Order Now! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ D O N ' T H E S I T A T E E-Marketing is the most effective and fastest way to market anywhere... PERIOD! O R D E R N O W . . . SAME DAY SERVICE (M-F) if your order is received before 2pm Pacific. 24hour fax service, just fax to: 1-801-760-8911 To order, via credit card simply cut/paste and print out the EZ ORDER FORM below and fax to our office today. ***** MILLIONS CD - Volume 9 ***** ***** NOW ONLY $247! ***** This "Special Price" is in effect for the next 72 hours, after that we go back to our regular price of $299.00 ... Don't delay... you can be in business tomorrow! We accept Visa, Mastercard, Amex and Checks by Fax. Fax your order to: 1-500-677-4016 or 1-801-760-8911 ----------------------Cut & Paste---------------------- ---------------------EZ Order Form--------------------- _____Yes! I want everything! I am ordering within 72 hours. Include my FREE "Business On A CD" bonus along with your 10 Million Vol. 9 E-Mail address CD (plus 972,565 bonus addresses) for the special price of only $247.00 + shipping as indicated below. _____Oop's I missed the 72 hour "special". I am ordering Vol. 9 at the regular price of $299.00 + shipping. ***PLEASE SELECT YOUR SHIPPING OPTION*** ____I would like to receive my packa ------ =_NextPart_004_01BF846A.E37602A8-- ------ =_NextPart_002_01BF846A.E37602A8-- ------ =_NextPart_000_01BF846A.E37602A8-- From owner-fwtk-users@ex.tis.com Thu Mar 2 18:55 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA02144 Thu, 2 Mar 2000 18:55:13 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA25718; Thu, 2 Mar 2000 15:59:59 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 15:00:01 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA18066 for fwtk-users-outgoing; Thu, 2 Mar 2000 14:59:42 -0800 (PST) Message-Id: <4.2.2.20000302173258.00b6db20@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.2 Date: Thu, 02 Mar 2000 17:51:23 -0500 To: "Dirk.Nerling" , "Firewall (M-list)" , "Firewall Toolkit (M-list)" From: Rick Murphy Subject: Re: got relayed - need your help! In-Reply-To: <6CC81B07CB44D311A1D20001FA7E9956115054@exchange.pdv.de> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 2362 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 06:15 PM 3/2/00 +0100, Dirk.Nerling wrote: >Hello all, > >I'm using fwtk 2.1 and the yao patch to disable relaying. The tests from >abuse.net and orbs.com think that we couldn't used as a relay host. But >there is another strange (?) thing. > >The facts: someone seems to send email from my email server, but I couldn't >found this in my logs. They sent the email as "ancq3f1nkrz5xza@pdv.de" and I >(as postmaster) got the "user unknown" spam mails which doesn't receivied >the users, because of a wrong address or so on. I inlcude one of this emails >here (I got ~700). It's possible they sent the mails with a "From" or "Reply-To" header forging your domain but actually sent them through some other system. There's no way for you to fix that other than to trace the mails back to their origin and complain. Looking at the bounce message: >Message-ID: <200002292217.XAA07959@pandora.etos.com.pl> >To: worsing@earthlink.net Probably a polish server was used to send the mails - pandora.etos.com.pl, or 195.117.61.129. This host is on the MAPS Relay Spam Stopper list (see ) so it's a known spam relay. Unfortunately, this bounce message is lacking "Received:" headers so it's hard to trace. Looking at another message: >Received: from localhost by ip130.lth2.k12.il.us (AppleShare IP Mail Server >6.1) id 77882 via TCP with SMTP; Tue, 29 Feb 2000 16:18:21 -0600 >MessageID: >Content-Type: text/plain >Subject: How To Reach Thousands Of Prospects Every Month? >X-References: 052E1F1ED, 01E9871A6 >From: >MIME-Version: 1.0 >X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 >To: Sent through a school's mail server at at school in Illinois. (Took a little searching to find this; there's no valid DNS lookup.) It appears that the mail server has been taken off line; notice the forged "From:" line. Basically, you're the victim, not the source. If you have any usable "Received" lines that say where the spew was injected in any of those messages, you might be able to track down the chickenboner that sent them; there's no way to stop this from happening again, unfortunately. -Rick From owner-fwtk-users@ex.tis.com Thu Mar 2 19:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA02385 Thu, 2 Mar 2000 19:45:51 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAB00378; Thu, 2 Mar 2000 16:51:40 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 16:31:27 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA27883 for fwtk-users-outgoing; Thu, 2 Mar 2000 16:31:12 -0800 (PST) Message-ID: <20000302182604.K450@wizard.deepthought.com> Date: Thu, 2 Mar 2000 18:26:04 -0600 From: Frank Pittel To: fwtk-users@ex.tis.com Subject: Stopping relaying Mime-Version: 1.0 X-Mailer: Mutt 0.93.2 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 585 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am in the process of trying to prevent my site from being used as a mail relay. I installed the "yao" patches and recompiled smap. In my netperm-table I added the line "smap: domain deepthought.com". While this allows me to send mail from my internal machines to external machines. All incoming connections are blocked. While I can do without the spam blocking I would really like to stop the relaying. Anyone know what I'm missing?? Thnx Frank Pittel From owner-fwtk-users@ex.tis.com Thu Mar 2 20:42 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA02697 Thu, 2 Mar 2000 20:42:07 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA05686; Thu, 2 Mar 2000 17:47:58 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 17:40:14 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA04357 for fwtk-users-outgoing; Thu, 2 Mar 2000 17:40:11 -0800 (PST) From: "Tom Krotchko" To: "Frank Pittel" , Subject: RE: Stopping relaying Date: Thu, 2 Mar 2000 20:00:21 -0500 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 In-Reply-To: <20000302182604.K450@wizard.deepthought.com> Importance: Normal Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1194 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] If I remember correctly, I believe the line should be: smap: relay-domain domain.com Although I'm at home right now, and I think I might've installed a version of the NoSpam! patch that I modified. My mind isn't what it used to be. Of course, it never was. -----Original Message----- From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On Behalf Of Frank Pittel Sent: Thursday, March 02, 2000 7:26 PM To: fwtk-users@ex.tis.com Subject: Stopping relaying [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am in the process of trying to prevent my site from being used as a mail relay. I installed the "yao" patches and recompiled smap. In my netperm-table I added the line "smap: domain deepthought.com". While this allows me to send mail from my internal machines to external machines. All incoming connections are blocked. While I can do without the spam blocking I would really like to stop the relaying. Anyone know what I'm missing?? Thnx Frank Pittel From owner-fwtk-users@ex.tis.com Thu Mar 2 21:34 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA02859 Thu, 2 Mar 2000 21:34:04 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA08108; Thu, 2 Mar 2000 18:39:54 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 18:36:08 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA07229 for fwtk-users-outgoing; Thu, 2 Mar 2000 18:36:04 -0800 (PST) Delivered-To: firewalls@lists.gnac.net X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E9956115059@exchange.pdv.de> From: "Dirk.Nerling" To: "Firewall \(M-list\)" , "Firewall Toolkit \(M-list\)" Subject: UPDATE for: got relayed - need your help! Date: Thu, 2 Mar 2000 22:01:42 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) X-Loop: firewalls@lists.gnac.net Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1266 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I now had a more quailified look at my logfiles and it seems as my machine wasn't used as a relay host because I cant find any outgoing message from= only a lot of to=. How could I prove this??? ( The logfile in my former email is from an another relayed host, I used this to show a from= and to= in one logfile. How could I prove this??? Does annybody know the program or spamer which normaly create ancq3f1nkrz5xza? Is it possible/normal that somebody relayed at one machine/domain at the net but used a different domain and faked an email account? Why? Should the relaying domain not get the error mails? How could I prevent this in future??? best regards and thanks for any hint! Dirk Nerling -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de - [To unsubscribe, send mail to majordomo@lists.gnac.net with "unsubscribe firewalls" in the body of the message.] From owner-fwtk-users@ex.tis.com Thu Mar 2 22:06 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA03014 Thu, 2 Mar 2000 22:06:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA10827; Thu, 2 Mar 2000 19:12:25 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 19:04:19 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA13235 for fwtk-users-outgoing; Thu, 2 Mar 2000 13:22:16 -0800 (PST) X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E9956115059@exchange.pdv.de> From: "Dirk.Nerling" To: "Firewall (M-list)" , "Firewall Toolkit (M-list)" Subject: UPDATE for: got relayed - need your help! Date: Thu, 2 Mar 2000 22:01:42 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1151 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I now had a more quailified look at my logfiles and it seems as my machine wasn't used as a relay host because I cant find any outgoing message from= only a lot of to=. How could I prove this??? ( The logfile in my former email is from an another relayed host, I used this to show a from= and to= in one logfile. How could I prove this??? Does annybody know the program or spamer which normaly create ancq3f1nkrz5xza? Is it possible/normal that somebody relayed at one machine/domain at the net but used a different domain and faked an email account? Why? Should the relaying domain not get the error mails? How could I prevent this in future??? best regards and thanks for any hint! Dirk Nerling -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de From owner-fwtk-users@ex.tis.com Thu Mar 2 22:16 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA03071 Thu, 2 Mar 2000 22:16:23 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA12487; Thu, 2 Mar 2000 19:22:13 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 19:13:00 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA02838 for fwtk-users-outgoing; Thu, 2 Mar 2000 10:48:11 -0800 (PST) Message-ID: From: "Wilson, Aaron" To: "'Paul Dunphy '" Cc: "'fwtk-users@lists.nai.com '" Subject: RE: Accessing NT Domain from Behind Firewall Date: Thu, 2 Mar 2000 08:51:46 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="windows-1252" Content-Length: 3243 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Paul, Start at the lower levels first. You're using a firewall that is directly connected to both segments, correct? Just to make sure, check and see if your internal host (98) has a route out to the NT box and that the NT box has a route back to the 98 host. You can use "route print" or "netstat", then "tracert" in the command prompt. You might need to temporarily open ICMP on your f/w to do the trace. Next, try mapping a drive by using IP addresses instead of names. You'll definately need those ports (137,138,139) open. Next, to use the convenience of names, look into the meaning of the LMHOSTS file. The WinNT resource kit books have a great discussion on this. There is a LMHOSTS.SAM file on each of your Win boxes. This is a sample file that will explain its uses. You'll need to create an LMHOST (with no extension) file of your own for each box containing the proper info. That info will most likely consist of: For the Win98 box - the NetBIOS name and IP of the NT server and the #DOM: directive. Good idea to include #PRE too. For the NT box - just the NetBIOS name of the 98 box. This file is only necessary if you want to map back out to the 98 box from inside. This is a simple way to get two Win boxes to see each other by name without the help of a WINS server. You asked about security - I wouldn't really condone this procedure but I've had instances (*ahem* - Exchange servers, etc) where management overruled security policy in favor of more functionality. It's a classic argument that takes place in almost every institution. But the short of it is, if your Win98 box is compromised (BackOrifice or whatnot), it will already have an allowed path into your private network. Good Luck! -Aaron -----Original Message----- From: Paul Dunphy To: fwtk-users@lists.nai.com Sent: 03/02/2000 7:48 AM Subject: Accessing NT Domain from Behind Firewall [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have one Win98 PC behind my firewall which needs access to an NT domain that exists outside of the firewall. (The reason it needs access is simply so it can map a shared drive from the outside domain.) I have tried opening up ports 137 and 138 for UDP, and port 139 for TCP, as per the recent Netbios discussions, but still cannot access the shared drive. If I try setting up Win98 to log into the NT domain on boot-up, it complains that it is not able to find the NT domain server. If I try just mapping a drive, it says that it cannot find the computer or drive in question. Does anyone know what might be causing this, and if there is any way of getting around it while still maintaining a reasonable degree of security on the firewall? Thanks, Paul --------------------------------------------------------------------- Paul T. Dunphy, P.Eng. Technical Services Officer/Technology Manager Office of Research Services Ryerson Polytechnic University Toronto, Ontario, CANADA Phone: (416) 979-5000 ext. 7112 Fax: (416) 979-5336 E-mail: pdunphy@research.ryerson.ca From owner-fwtk-users@ex.tis.com Thu Mar 2 22:23 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA03102 Thu, 2 Mar 2000 22:23:45 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA13602; Thu, 2 Mar 2000 19:29:36 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 19:20:34 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA12215 for fwtk-users-outgoing; Thu, 2 Mar 2000 19:20:31 -0800 (PST) Delivered-To: firewalls@lists.gnac.net X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E9956115059@exchange.pdv.de> From: "Dirk.Nerling" To: "Firewall \(M-list\)" , "Firewall Toolkit \(M-list\)" Subject: UPDATE for: got relayed - need your help! Date: Thu, 2 Mar 2000 22:01:42 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) X-Loop: firewalls@lists.gnac.net Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1266 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I now had a more quailified look at my logfiles and it seems as my machine wasn't used as a relay host because I cant find any outgoing message from= only a lot of to=. How could I prove this??? ( The logfile in my former email is from an another relayed host, I used this to show a from= and to= in one logfile. How could I prove this??? Does annybody know the program or spamer which normaly create ancq3f1nkrz5xza? Is it possible/normal that somebody relayed at one machine/domain at the net but used a different domain and faked an email account? Why? Should the relaying domain not get the error mails? How could I prevent this in future??? best regards and thanks for any hint! Dirk Nerling -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de - [To unsubscribe, send mail to majordomo@lists.gnac.net with "unsubscribe firewalls" in the body of the message.] From owner-fwtk-users@ex.tis.com Thu Mar 2 22:57 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA03215 Thu, 2 Mar 2000 22:57:38 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA16499; Thu, 2 Mar 2000 20:03:31 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 19:56:33 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA15601 for fwtk-users-outgoing; Thu, 2 Mar 2000 19:56:23 -0800 (PST) Message-ID: <005301bf84c3$a2e885e0$fc00a8c0@k62350> From: "Larry Jackson" To: "FWTK List" Subject: [FWTK] - RealPlayer problems Date: Thu, 2 Mar 2000 22:50:35 -0500 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 12986 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am having some problems using RealPlayer via my OpenBSD v2.6 firewall running ipf and FWTK v2.1 on my cable modem. I am forcing RealPlayer to use the HTTP proxy and have blocked incoming packets on the standard Real ports. Is this the best way to handle streaming media or are there any GOOD proxies available? The problem I'm having is that MOST media streams do not play. Realplayer seems to want to try to use its standard ports even though I told it to only use HTTP. Its not even working with ipf disabled. I heard a rumor there is a bug with Realplayer and proxies and some workaround modifying its registry settings. Anyone know the details? EXAMPLES: One such example is http://stations.real.com/play_stations.rxml?index=21&odata=skutu Realplayer reports the following error: Unable to establish a connection with the server rtsp://realg2.mp.intervu.net/farm/*/encoder/nr_hits.rt and the firewall reports pretty much the same as the next example, but on a different port and server. Another more indepth example is http://fm97.com/97.ram . This consists of two .ra files the first is an add that works fine the second clip is the live radio feed from this station. It always fails and RealPlayer reports: Requested file does not found. pnm://207.44.18.200:7070/97live.ra and my firewall reports: Mar 2 13:18:49 firewall http-gw[32108]: Network error: net_flags[0] set (write) ... Mar 2 13:18:50 firewall http-gw[21019]: failed to connect to http server 207.44.18.200 (8080) Mar 2 13:18:50 firewall http-gw[2343]: failed to connect to http server 207.44.18.200 (554) ... Mar 2 13:18:52 firewall http-gw[4501]: Network error: net_flags[4] set (read) ... Mar 2 13:18:59 firewall http-gw[21941]: Network connection closed during write A Full log follows (sorry for the long logfile but I'm not sure what might be important): Mar 2 13:18:39 firewall http-gw[16160]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:39 firewall http-gw[16160]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=fm97.com path=/97.ram Mar 2 13:18:40 firewall http-gw[16160]: exit host=pc.local.net/192.168.0.1 cmds=1 in=0 out=0 user=unauth duration=2 Mar 2 13:18:48 firewall http-gw[32108]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:48 firewall http-gw[32108]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:18:48 firewall http-gw[1829]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:48 firewall http-gw[1829]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/SmpDsBhgRl56d97a60-f066-11d3-816a-0050bab00869 Mar 2 13:18:49 firewall http-gw[1829]: content-type= text/html Mar 2 13:18:49 firewall http-gw[1829]: exit host=pc.local.net/192.168.0.1 cmds=1 in=148 out=0 user=unauth duration=1 Mar 2 13:18:49 firewall http-gw[32108]: Network error: net_flags[0] set (write) Mar 2 13:18:49 firewall http-gw[32108]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:18:49 firewall http-gw[150]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:49 firewall http-gw[150]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/SmpDsBhgRl56d97a61-f066-11d3-816a-0050bab00869 Mar 2 13:18:49 firewall http-gw[27163]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:49 firewall http-gw[27163]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:18:50 firewall http-gw[150]: content-type= text/html Mar 2 13:18:50 firewall http-gw[150]: exit host=pc.local.net/192.168.0.1 cmds=1 in=148 out=0 user=unauth duration=1 Mar 2 13:18:50 firewall http-gw[21019]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:50 firewall http-gw[21019]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/SmpDsBhgRl56d97a62-f066-11d3-816a-0050bab00869 Mar 2 13:18:50 firewall http-gw[27163]: Network error: net_flags[0] set (write) Mar 2 13:18:50 firewall http-gw[27163]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:18:50 firewall http-gw[13467]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:50 firewall http-gw[13467]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:18:50 firewall http-gw[21019]: failed to connect to http server 207.44.18.200 (8080) Mar 2 13:18:50 firewall http-gw[21019]: exit host=pc.local.net/192.168.0.1 cmds=1 in=0 out=0 user=unauth duration=0 Mar 2 13:18:50 firewall http-gw[13467]: failed to connect to http server 207.44.18.200 (8080) Mar 2 13:18:50 firewall http-gw[13467]: exit host=pc.local.net/192.168.0.1 cmds=1 in=0 out=0 user=unauth duration=0 Mar 2 13:18:50 firewall http-gw[2343]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:50 firewall http-gw[2343]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:18:50 firewall http-gw[12005]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:50 firewall http-gw[2343]: failed to connect to http server 207.44.18.200 (554) Mar 2 13:18:50 firewall http-gw[12005]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/SmpDsBhgRl56d97a63-f066-11d3-816a-0050bab00869 Mar 2 13:18:50 firewall http-gw[2343]: exit host=pc.local.net/192.168.0.1 cmds=1 in=0 out=0 user=unauth duration=0 Mar 2 13:18:50 firewall http-gw[12005]: failed to connect to http server 207.44.18.200 (554) Mar 2 13:18:50 firewall http-gw[12005]: exit host=pc.local.net/192.168.0.1 cmds=1 in=0 out=0 user=unauth duration=0 Mar 2 13:18:50 firewall http-gw[21941]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:50 firewall http-gw[21941]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/SmpDsBhgRl56d97a64-f066-11d3-816a-0050bab00869 Mar 2 13:18:50 firewall http-gw[4501]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:50 firewall http-gw[4501]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:18:51 firewall http-gw[21941]: content-type= audio/x-pn-realaudio Mar 2 13:18:51 firewall http-gw[20903]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:51 firewall http-gw[20903]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:18:52 firewall http-gw[4501]: Network error: net_flags[4] set (read) Mar 2 13:18:52 firewall http-gw[4501]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:18:52 firewall http-gw[19046]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:52 firewall http-gw[19046]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:18:53 firewall http-gw[21732]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:53 firewall http-gw[21732]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:18:53 firewall http-gw[20903]: Network error: net_flags[4] set (read) Mar 2 13:18:53 firewall http-gw[20903]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:18:53 firewall http-gw[19046]: Network error: net_flags[4] set (read) Mar 2 13:18:53 firewall http-gw[19046]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:18:59 firewall http-gw[21941]: Network connection closed during write Mar 2 13:18:59 firewall http-gw[21941]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:18:59 firewall http-gw[17247]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:59 firewall http-gw[17247]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/SmpDsBhgRl56d97a65-f066-11d3-816a-0050bab00869 Mar 2 13:18:59 firewall http-gw[21732]: Network error: net_flags[4] set (read) Mar 2 13:18:59 firewall http-gw[21732]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:18:59 firewall http-gw[6736]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:59 firewall http-gw[6736]: exit host=pc.local.net/192.168.0.1 cmds=1 in=0 out=0 user=unauth duration=0 Mar 2 13:18:59 firewall http-gw[10933]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:18:59 firewall http-gw[10933]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:19:00 firewall http-gw[17247]: content-type= text/html Mar 2 13:19:00 firewall http-gw[17247]: exit host=pc.local.net/192.168.0.1 cmds=1 in=148 out=0 user=unauth duration=1 Mar 2 13:19:00 firewall http-gw[10933]: Network error: net_flags[0] set (write) Mar 2 13:19:00 firewall http-gw[10933]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:19:00 firewall http-gw[19218]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:19:00 firewall http-gw[21001]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:19:00 firewall http-gw[19218]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:19:00 firewall http-gw[21001]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/SmpDsBhgRl56d97a66-f066-11d3-816a-0050bab00869 Mar 2 13:19:01 firewall http-gw[21001]: content-type= text/html Mar 2 13:19:01 firewall http-gw[21001]: exit host=pc.local.net/192.168.0.1 cmds=1 in=148 out=0 user=unauth duration=1 Mar 2 13:19:01 firewall http-gw[1915]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:19:01 firewall http-gw[1915]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/SmpDsBhgRl56d97a67-f066-11d3-816a-0050bab00869 Mar 2 13:19:01 firewall http-gw[19218]: Network error: net_flags[0] set (write) Mar 2 13:19:01 firewall http-gw[19218]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:19:01 firewall http-gw[25769]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:19:01 firewall http-gw[25769]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:19:02 firewall http-gw[1915]: failed to connect to http server 207.44.18.200 (8080) Mar 2 13:19:02 firewall http-gw[1915]: exit host=pc.local.net/192.168.0.1 cmds=1 in=0 out=0 user=unauth duration=1 Mar 2 13:19:02 firewall http-gw[25769]: Network connection closed during write Mar 2 13:19:02 firewall http-gw[25769]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:19:02 firewall http-gw[13011]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:19:02 firewall http-gw[13011]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/SmpDsBhgRl56d97a68-f066-11d3-816a-0050bab00869 Mar 2 13:19:02 firewall http-gw[28907]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:19:02 firewall http-gw[13011]: failed to connect to http server 207.44.18.200 (554) Mar 2 13:19:02 firewall http-gw[28907]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:19:02 firewall http-gw[13011]: exit host=pc.local.net/192.168.0.1 cmds=1 in=0 out=0 user=unauth duration=0 Mar 2 13:19:02 firewall http-gw[28907]: failed to connect to http server 207.44.18.200 (554) Mar 2 13:19:02 firewall http-gw[28907]: exit host=pc.local.net/192.168.0.1 cmds=1 in=0 out=0 user=unauth duration=0 Mar 2 13:19:02 firewall http-gw[15012]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:19:02 firewall http-gw[15012]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl Mar 2 13:19:02 firewall http-gw[11719]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:19:02 firewall http-gw[11719]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/SmpDsBhgRl56d97a69-f066-11d3-816a-0050bab00869 Mar 2 13:19:04 firewall http-gw[11719]: content-type= audio/x-pn-realaudio Mar 2 13:19:04 firewall http-gw[11719]: exit host=pc.local.net/192.168.0.1 cmds=1 in=4 out=0 user=unauth duration=2 Mar 2 13:19:05 firewall http-gw[15012]: Network error: net_flags[4] set (read) Mar 2 13:19:05 firewall http-gw[15012]: exit host=pc.local.net/192.168.0.1 code=1 Mar 2 13:19:05 firewall http-gw[31415]: permit host=pc.local.net/192.168.0.1 use of gateway (V2.1) Mar 2 13:19:05 firewall http-gw[31415]: log host=pc.local.net/192.168.0.1 protocol=HTTP cmd=get dest=207.44.18.200 path=/97live.ra Mar 2 13:19:05 firewall http-gw[31415]: content-type= text/html Mar 2 13:19:05 firewall http-gw[31415]: exit host=pc.local.net/192.168.0.1 cmds=1 in=148 out=0 user=unauth duration=0 Thanks in advance for any help, Larry From owner-fwtk-users@ex.tis.com Thu Mar 2 23:05 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA03252 Thu, 2 Mar 2000 23:05:56 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA18034; Thu, 2 Mar 2000 20:11:45 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 20:09:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id UAA17344 for fwtk-users-outgoing; Thu, 2 Mar 2000 20:09:37 -0800 (PST) Date: Thu, 2 Mar 2000 23:07:59 -0500 (EST) From: Ted Keller To: "Dirk.Nerling" cc: "Firewall (M-list)" , "Firewall Toolkit (M-list)" Subject: Re: UPDATE for: got relayed - need your help! In-Reply-To: <6CC81B07CB44D311A1D20001FA7E9956115059@exchange.pdv.de> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1756 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Dirk, On some of the ~700 e-mails you received, you should be able to trace a header to the originating machine (via ip number at least). From there, you should be able to contact the postmaster at that domain and lodge your complaint. ted keller On Thu, 2 Mar 2000, Dirk.Nerling wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello, > > I now had a more quailified look at my logfiles and it seems as my machine > wasn't used as a relay host because I cant find any outgoing message > from= only a lot of to=. > How could I prove this??? > > ( The logfile in my former email is from an another relayed host, I used > this to show a from= and to= > in one logfile. How could I prove this??? Does annybody know the program or > spamer which normaly create ancq3f1nkrz5xza? > > Is it possible/normal that somebody relayed at one machine/domain at the > net but used a different domain and faked an email account? Why? Should the > relaying domain not get the error mails? How could I prevent this in > future??? > > best regards and thanks for any hint! > Dirk Nerling > -- > Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: > ++49-361-4407144 > PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 > CC83 > http://www.pdv.de > > - > [To unsubscribe, send mail to majordomo@lists.gnac.net with > "unsubscribe firewalls" in the body of the message.] > From owner-fwtk-users@ex.tis.com Thu Mar 2 23:10 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA03283 Thu, 2 Mar 2000 23:10:54 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA19528; Thu, 2 Mar 2000 20:16:46 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 20:12:06 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id UAA18115 for fwtk-users-outgoing; Thu, 2 Mar 2000 20:12:01 -0800 (PST) Date: Thu, 2 Mar 2000 23:11:43 -0500 (EST) From: Ted Keller To: Larry Jackson cc: FWTK List Subject: Re: [FWTK] - RealPlayer problems In-Reply-To: <005301bf84c3$a2e885e0$fc00a8c0@k62350> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 14107 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Larry, I've had reasonably good success in running real player through a socks5 daemon. For proxies, I use both the rtspd and the pna proxy - properly socksified, running on internal hosts. It also works well by running real player unser sockscap/32. Both of the proxies are available from real.com. Both can be sockified pretty easily. Neather appear secure enough to run naked on your firewall. ted keller On Thu, 2 Mar 2000, Larry Jackson wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I am having some problems using RealPlayer via my OpenBSD v2.6 firewall > running ipf and FWTK v2.1 on my cable modem. > > I am forcing RealPlayer to use the HTTP proxy and have blocked incoming > packets on the standard Real ports. > > Is this the best way to handle streaming media or are there any GOOD proxies > available? > > The problem I'm having is that MOST media streams do not play. > Realplayer seems to want to try to use its standard ports even though I told > it to only use HTTP. > Its not even working with ipf disabled. > > I heard a rumor there is a bug with Realplayer and proxies and some > workaround modifying its registry settings. Anyone know the details? > > > EXAMPLES: > One such example is > http://stations.real.com/play_stations.rxml?index=21&odata=skutu > Realplayer reports the following error: > Unable to establish a connection with the server > rtsp://realg2.mp.intervu.net/farm/*/encoder/nr_hits.rt > and the firewall reports pretty much the same as the next example, but on a > different port and server. > > Another more indepth example is http://fm97.com/97.ram . > This consists of two .ra files the first is an add that works fine the > second clip is the live radio feed from this station. It always fails and > RealPlayer reports: > Requested file does not found. > pnm://207.44.18.200:7070/97live.ra > and my firewall reports: > Mar 2 13:18:49 firewall http-gw[32108]: Network error: net_flags[0] set > (write) > ... > Mar 2 13:18:50 firewall http-gw[21019]: failed to connect to http server > 207.44.18.200 (8080) > Mar 2 13:18:50 firewall http-gw[2343]: failed to connect to http server > 207.44.18.200 (554) > ... > Mar 2 13:18:52 firewall http-gw[4501]: Network error: net_flags[4] set > (read) > ... > Mar 2 13:18:59 firewall http-gw[21941]: Network connection closed during > write > > > A Full log follows (sorry for the long logfile but I'm not sure what might > be important): > > Mar 2 13:18:39 firewall http-gw[16160]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:39 firewall http-gw[16160]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=fm97.com path=/97.ram > Mar 2 13:18:40 firewall http-gw[16160]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=0 out=0 user=unauth duration=2 > Mar 2 13:18:48 firewall http-gw[32108]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:48 firewall http-gw[32108]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:18:48 firewall http-gw[1829]: permit host=pc.local.net/192.168.0.1 > use of gateway (V2.1) > Mar 2 13:18:48 firewall http-gw[1829]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 > path=/SmpDsBhgRl56d97a60-f066-11d3-816a-0050bab00869 > Mar 2 13:18:49 firewall http-gw[1829]: content-type= text/html > Mar 2 13:18:49 firewall http-gw[1829]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=148 out=0 user=unauth duration=1 > Mar 2 13:18:49 firewall http-gw[32108]: Network error: net_flags[0] set > (write) > Mar 2 13:18:49 firewall http-gw[32108]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:18:49 firewall http-gw[150]: permit host=pc.local.net/192.168.0.1 > use of gateway (V2.1) > Mar 2 13:18:49 firewall http-gw[150]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 > path=/SmpDsBhgRl56d97a61-f066-11d3-816a-0050bab00869 > Mar 2 13:18:49 firewall http-gw[27163]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:49 firewall http-gw[27163]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:18:50 firewall http-gw[150]: content-type= text/html > Mar 2 13:18:50 firewall http-gw[150]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=148 out=0 user=unauth duration=1 > Mar 2 13:18:50 firewall http-gw[21019]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:50 firewall http-gw[21019]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 > path=/SmpDsBhgRl56d97a62-f066-11d3-816a-0050bab00869 > Mar 2 13:18:50 firewall http-gw[27163]: Network error: net_flags[0] set > (write) > Mar 2 13:18:50 firewall http-gw[27163]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:18:50 firewall http-gw[13467]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:50 firewall http-gw[13467]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:18:50 firewall http-gw[21019]: failed to connect to http server > 207.44.18.200 (8080) > Mar 2 13:18:50 firewall http-gw[21019]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=0 out=0 user=unauth duration=0 > Mar 2 13:18:50 firewall http-gw[13467]: failed to connect to http server > 207.44.18.200 (8080) > Mar 2 13:18:50 firewall http-gw[13467]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=0 out=0 user=unauth duration=0 > Mar 2 13:18:50 firewall http-gw[2343]: permit host=pc.local.net/192.168.0.1 > use of gateway (V2.1) > Mar 2 13:18:50 firewall http-gw[2343]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:18:50 firewall http-gw[12005]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:50 firewall http-gw[2343]: failed to connect to http server > 207.44.18.200 (554) > Mar 2 13:18:50 firewall http-gw[12005]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 > path=/SmpDsBhgRl56d97a63-f066-11d3-816a-0050bab00869 > Mar 2 13:18:50 firewall http-gw[2343]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=0 out=0 user=unauth duration=0 > Mar 2 13:18:50 firewall http-gw[12005]: failed to connect to http server > 207.44.18.200 (554) > Mar 2 13:18:50 firewall http-gw[12005]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=0 out=0 user=unauth duration=0 > Mar 2 13:18:50 firewall http-gw[21941]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:50 firewall http-gw[21941]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 > path=/SmpDsBhgRl56d97a64-f066-11d3-816a-0050bab00869 > Mar 2 13:18:50 firewall http-gw[4501]: permit host=pc.local.net/192.168.0.1 > use of gateway (V2.1) > Mar 2 13:18:50 firewall http-gw[4501]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:18:51 firewall http-gw[21941]: content-type= audio/x-pn-realaudio > Mar 2 13:18:51 firewall http-gw[20903]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:51 firewall http-gw[20903]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:18:52 firewall http-gw[4501]: Network error: net_flags[4] set > (read) > Mar 2 13:18:52 firewall http-gw[4501]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:18:52 firewall http-gw[19046]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:52 firewall http-gw[19046]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:18:53 firewall http-gw[21732]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:53 firewall http-gw[21732]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:18:53 firewall http-gw[20903]: Network error: net_flags[4] set > (read) > Mar 2 13:18:53 firewall http-gw[20903]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:18:53 firewall http-gw[19046]: Network error: net_flags[4] set > (read) > Mar 2 13:18:53 firewall http-gw[19046]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:18:59 firewall http-gw[21941]: Network connection closed during > write > Mar 2 13:18:59 firewall http-gw[21941]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:18:59 firewall http-gw[17247]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:59 firewall http-gw[17247]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 > path=/SmpDsBhgRl56d97a65-f066-11d3-816a-0050bab00869 > Mar 2 13:18:59 firewall http-gw[21732]: Network error: net_flags[4] set > (read) > Mar 2 13:18:59 firewall http-gw[21732]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:18:59 firewall http-gw[6736]: permit host=pc.local.net/192.168.0.1 > use of gateway (V2.1) > Mar 2 13:18:59 firewall http-gw[6736]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=0 out=0 user=unauth duration=0 > Mar 2 13:18:59 firewall http-gw[10933]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:18:59 firewall http-gw[10933]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:19:00 firewall http-gw[17247]: content-type= text/html > Mar 2 13:19:00 firewall http-gw[17247]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=148 out=0 user=unauth duration=1 > Mar 2 13:19:00 firewall http-gw[10933]: Network error: net_flags[0] set > (write) > Mar 2 13:19:00 firewall http-gw[10933]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:19:00 firewall http-gw[19218]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:19:00 firewall http-gw[21001]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:19:00 firewall http-gw[19218]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:19:00 firewall http-gw[21001]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 > path=/SmpDsBhgRl56d97a66-f066-11d3-816a-0050bab00869 > Mar 2 13:19:01 firewall http-gw[21001]: content-type= text/html > Mar 2 13:19:01 firewall http-gw[21001]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=148 out=0 user=unauth duration=1 > Mar 2 13:19:01 firewall http-gw[1915]: permit host=pc.local.net/192.168.0.1 > use of gateway (V2.1) > Mar 2 13:19:01 firewall http-gw[1915]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 > path=/SmpDsBhgRl56d97a67-f066-11d3-816a-0050bab00869 > Mar 2 13:19:01 firewall http-gw[19218]: Network error: net_flags[0] set > (write) > Mar 2 13:19:01 firewall http-gw[19218]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:19:01 firewall http-gw[25769]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:19:01 firewall http-gw[25769]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:19:02 firewall http-gw[1915]: failed to connect to http server > 207.44.18.200 (8080) > Mar 2 13:19:02 firewall http-gw[1915]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=0 out=0 user=unauth duration=1 > Mar 2 13:19:02 firewall http-gw[25769]: Network connection closed during > write > Mar 2 13:19:02 firewall http-gw[25769]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:19:02 firewall http-gw[13011]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:19:02 firewall http-gw[13011]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 > path=/SmpDsBhgRl56d97a68-f066-11d3-816a-0050bab00869 > Mar 2 13:19:02 firewall http-gw[28907]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:19:02 firewall http-gw[13011]: failed to connect to http server > 207.44.18.200 (554) > Mar 2 13:19:02 firewall http-gw[28907]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:19:02 firewall http-gw[13011]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=0 out=0 user=unauth duration=0 > Mar 2 13:19:02 firewall http-gw[28907]: failed to connect to http server > 207.44.18.200 (554) > Mar 2 13:19:02 firewall http-gw[28907]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=0 out=0 user=unauth duration=0 > Mar 2 13:19:02 firewall http-gw[15012]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:19:02 firewall http-gw[15012]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=put dest=207.44.18.200 path=/SmpDsBhgRl > Mar 2 13:19:02 firewall http-gw[11719]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:19:02 firewall http-gw[11719]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 > path=/SmpDsBhgRl56d97a69-f066-11d3-816a-0050bab00869 > Mar 2 13:19:04 firewall http-gw[11719]: content-type= audio/x-pn-realaudio > Mar 2 13:19:04 firewall http-gw[11719]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=4 out=0 user=unauth duration=2 > Mar 2 13:19:05 firewall http-gw[15012]: Network error: net_flags[4] set > (read) > Mar 2 13:19:05 firewall http-gw[15012]: exit host=pc.local.net/192.168.0.1 > code=1 > Mar 2 13:19:05 firewall http-gw[31415]: permit > host=pc.local.net/192.168.0.1 use of gateway (V2.1) > Mar 2 13:19:05 firewall http-gw[31415]: log host=pc.local.net/192.168.0.1 > protocol=HTTP cmd=get dest=207.44.18.200 path=/97live.ra > Mar 2 13:19:05 firewall http-gw[31415]: content-type= text/html > Mar 2 13:19:05 firewall http-gw[31415]: exit host=pc.local.net/192.168.0.1 > cmds=1 in=148 out=0 user=unauth duration=0 > > Thanks in advance for any help, > Larry > From owner-fwtk-users@ex.tis.com Fri Mar 3 01:27 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id BAA03697 Fri, 3 Mar 2000 01:27:48 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id WAA25529; Thu, 2 Mar 2000 22:33:39 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Mar 2000 22:30:44 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id WAA24797 for fwtk-users-outgoing; Thu, 2 Mar 2000 22:30:43 -0800 (PST) X-Authentication-Warning: aeria.eic.at: nobody set sender to using -f Message-ID: <38BF5BCE.685217AD@eic.at> Date: Fri, 03 Mar 2000 07:29:34 +0100 From: "Johann G. Hautzinger" Organization: Erste Bank AG X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.13 i686) X-Accept-Language: en MIME-Version: 1.0 To: "Firewall Toolkit (M-list)" Subject: Re: got relayed - need your help! References: <4.2.2.20000302173258.00b6db20@mail.itm-inst.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1016 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Rick Murphy wrote: [...] > Basically, you're the victim, not the source. If you have any usable > "Received" lines that say where the spew was injected in any of those > messages, you might be able to track down the chickenboner that sent them; > there's no way to stop this from happening again, unfortunately. just a little remark: i stopped relaying at home, now (i think as a little "revenge" from spammers) _I_ am being spammed ... 5 - 10 "earn more money"'n stuff per day ... as i dont know anybody having a *.msn.com or *.hotmail.com it is quite easy for me ... denying sendmail to that domains (550 Nobody here is interested in your spam) ... *greetz* from vienna Hannes -- Johann Georg Hautzinger, email: trema@eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at From owner-fwtk-users@ex.tis.com Fri Mar 3 08:54 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA05155 Fri, 3 Mar 2000 08:54:55 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA20956; Fri, 3 Mar 2000 06:00:40 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 3 Mar 2000 05:41:22 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA14025 for fwtk-users-outgoing; Fri, 3 Mar 2000 05:41:06 -0800 (PST) Message-ID: <20000303002728.N450@wizard.deepthought.com> Date: Fri, 3 Mar 2000 00:27:28 -0600 From: Frank Pittel To: fwtk-users@ex.tis.com Subject: Re: Stopping relaying References: <20000302182604.K450@wizard.deepthought.com> <4.3.2.20000302195745.00b66e30@mail.itm-inst.com> Mime-Version: 1.0 X-Mailer: Mutt 0.93.2 In-Reply-To: <4.3.2.20000302195745.00b66e30@mail.itm-inst.com>; from Rick Murphy on Thu, Mar 02, 2000 at 08:00:07PM -0500 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1491 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Thu, Mar 02, 2000 at 08:00:07PM -0500, Rick Murphy wrote: > At 06:26 PM 3/2/00 -0600, Frank Pittel wrote: > >[To be removed from this list send the message "unsubscribe fwtk-users" in the > >BODY of a mail message to majordomo@ex.tis.com.] > > > >I am in the process of trying to prevent my site from being used as a > >mail relay. I installed the "yao" patches and recompiled smap. In my > >netperm-table I added the line "smap: domain deepthought.com". > > > >While this allows me to send mail from my internal machines to > >external machines. All incoming connections are blocked. While I can > >do without the spam blocking I would really like to stop the relaying. > >Anyone know what I'm missing?? > > What I have: > smap: domains itm-inst.com *.itm-inst.com > smap: localhosts *.itm-inst.com > smap: scrub-spam 1 > smap: broken-from <> > > You show 'domain' vs. 'domains'; check that. You need the 'localhosts' line > to define who is permitted to relay through your server. > -Rick Looks like I wasn't seeing or thinking to clearly. The line I added to my netperm-table was "smap domains deepthought.com". I also wasn't able to connect from internal machines. When ever I try to connect to port 25 on the firewall box is "telnet: Unable to connect to remote host: Connection refused". It's as if smap isn't attaching to port 25. Frank From owner-fwtk-users@ex.tis.com Fri Mar 3 08:54 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA05153 Fri, 3 Mar 2000 08:54:54 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA20982; Fri, 3 Mar 2000 06:00:43 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 3 Mar 2000 05:41:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA14042 for fwtk-users-outgoing; Fri, 3 Mar 2000 05:41:30 -0800 (PST) Message-ID: <38BF50F1.CDCEB030@air.org.in> Date: Fri, 03 Mar 2000 11:13:13 +0530 From: Naresh Narang X-Mailer: Mozilla 4.7 [en] (Win95; I) X-Accept-Language: en MIME-Version: 1.0 To: "fwtk-users@ex.tis.com" Subject: Yao Patch Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 219 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello Where from can I get yao patch for smap to stop spam? Thanks N. K. narang From owner-fwtk-users@ex.tis.com Fri Mar 3 08:54 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA05161 Fri, 3 Mar 2000 08:54:58 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA21002; Fri, 3 Mar 2000 06:00:47 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 3 Mar 2000 05:42:30 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA13735 for fwtk-users-outgoing; Fri, 3 Mar 2000 05:42:25 -0800 (PST) Message-Id: <4.3.2.20000302195745.00b66e30@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Thu, 02 Mar 2000 20:00:07 -0500 To: Frank Pittel , fwtk-users@ex.tis.com From: Rick Murphy Subject: Re: Stopping relaying In-Reply-To: <20000302182604.K450@wizard.deepthought.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1033 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 06:26 PM 3/2/00 -0600, Frank Pittel wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >I am in the process of trying to prevent my site from being used as a >mail relay. I installed the "yao" patches and recompiled smap. In my >netperm-table I added the line "smap: domain deepthought.com". > >While this allows me to send mail from my internal machines to >external machines. All incoming connections are blocked. While I can >do without the spam blocking I would really like to stop the relaying. >Anyone know what I'm missing?? What I have: smap: domains itm-inst.com *.itm-inst.com smap: localhosts *.itm-inst.com smap: scrub-spam 1 smap: broken-from <> You show 'domain' vs. 'domains'; check that. You need the 'localhosts' line to define who is permitted to relay through your server. -Rick From owner-fwtk-users@ex.tis.com Fri Mar 3 08:55 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA05165 Fri, 3 Mar 2000 08:55:00 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA20986; Fri, 3 Mar 2000 06:00:47 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 3 Mar 2000 05:40:14 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA13723 for fwtk-users-outgoing; Fri, 3 Mar 2000 05:40:09 -0800 (PST) X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E9956115054@exchange.pdv.de> From: "Dirk.Nerling" To: "Firewall \(M-list\)" , "Firewall Toolkit \(M-list\)" Subject: got relayed - need your help! Date: Thu, 2 Mar 2000 18:15:20 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="---- =_NextPart_000_01BF846A.E37602A8" Content-Length: 28600 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------ =_NextPart_000_01BF846A.E37602A8 Content-Type: text/plain Hello all, I'm using fwtk 2.1 and the yao patch to disable relaying. The tests from abuse.net and orbs.com think that we couldn't used as a relay host. But there is another strange (?) thing. The facts: someone seems to send email from my email server, but I couldn't found this in my logs. They sent the email as "ancq3f1nkrz5xza@pdv.de" and I (as postmaster) got the "user unknown" spam mails which doesn't receivied the users, because of a wrong address or so on. I inlcude one of this emails here (I got ~700). Because of my logs I found domain near ours, which also was used as a realay I contacted the admin and got some logs. The logs show the ancq3f1nkrz5xza was used at other hosts to. AND what I don't understand they have TO ancq3f1nkrz5xza@relay and FROM ancq3f1nkrz5xza@relay mails. Jan 1 05:07:17 wall sendmail[2545]: FAA02545: from=, size=10768, class=0, pri=640768, nrcpts=21, msgid=<199701010407.FAA02545@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) Jan 1 05:07:18 wall sendmail[2547]: FAA02547: from=, size=10834, class=0, pri=640834, nrcpts=21, msgid=<199701010407.FAA02547@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) Jan 1 05:07:19 wall sendmail[2546]: FAA02546: from=, size=11048, class=0, pri=641048, nrcpts=21, msgid=<199701010407.FAA02546@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) Jan 1 05:07:25 wall sendmail[2544]: FAA02544: from=, size=10911, class=0, pri=640911, nrcpts=21, msgid=<199701010407.FAA02544@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) Jan 1 05:07:25 wall sendmail[2559]: FAA02559: from=, size=10834, class=0, pri=100834, nrcpts=3, msgid=<199701010407.FAA02559@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) Jan 1 05:07:26 wall sendmail[2562]: FAA02562: from=, size=11048, class=0, pri=101048, nrcpts=3, msgid=<199701010407.FAA02562@wall.stadtwerke-bielefeld.de>, proto=SMTP, relay=[216.1.23.9] (may be forged) ********* schnipp: ********* Why do they sent the mails to us again???? Jan 1 05:07:56 wall sendmail[2557]: FAA02557: to=, delay=00:00:08, xdelay=00:00:08, mailer=esmtp, relay=ns.pdv.de. [194.139.111.2], stat=Sent (Mail accepted) Jan 1 05:07:57 wall sendmail[2561]: FAA02561: to=, delay=00:00:11, xdelay=00:00:10, mailer=esmtp, relay=monday.dk. [195.184.47.130], stat=Sent (2.5.0 OK.) Does anybody has an idea? How could I prevent this? Whats is going on here???? best reagrds Dirk <> <> -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de ------ =_NextPart_000_01BF846A.E37602A8 Content-Type: message/rfc822 Content-Description: Postmaster notify: User unknown Message-ID: <200002292219.XAB25698@wall.pdv.de> From: Mail Delivery Subsystem To: postmaster@wall.pdv.de Subject: Postmaster notify: User unknown Date: Tue, 29 Feb 2000 23:19:07 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_002_01BF846A.E37602A8" ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 23:19:06 +0100 (CET) from mail@localhost ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- 550 ... User unknown 554 /no/such/directory/dead.letter... cannot open /no/such/directory/dead.letter: No such file or directory ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: application/octet-stream; name="ATT06553.TXT" Content-Disposition: attachment; filename="ATT06553.TXT" Reporting-MTA: dns; wall.pdv.de Arrival-Date: Tue, 29 Feb 2000 23:19:06 +0100 (CET) Final-Recipient: RFC822; Action: failed Status: 5.1.1 Last-Attempt-Date: Tue, 29 Feb 2000 23:19:07 +0100 (CET) ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: message/rfc822 Message-ID: <200002292217.XAA07964@pandora.etos.com.pl> To: ancq3f1nkrz5xza@pdv.de Subject: Returned mail: User unknown Date: Tue, 29 Feb 2000 23:17:38 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_004_01BF846A.E37602A8" ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 23:17:32 +0100 (GMT+0100) from [216.1.23.9] ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- .. while talking to grebe.prod.itd.earthlink.net.: >>> RCPT To: <<< 550 ... User unknown 550 ... User unknown ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: application/octet-stream; name="ATT06556.TXT" Content-Disposition: attachment; filename="ATT06556.TXT" Reporting-MTA: dns; pandora.etos.com.pl Received-From-MTA: dns; [216.1.23.9] Arrival-Date: Tue, 29 Feb 2000 23:17:32 +0100 (GMT+0100) Final-Recipient: rfc822; gambrel@earthlink.net Action: failed Status: 5.1.1 Remote-MTA: dns; grebe.prod.itd.earthlink.net Diagnostic-Code: smtp; 550 ... User unknown Last-Attempt-Date: Tue, 29 Feb 2000 23:17:37 +0100 (GMT+0100) ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: message/rfc822 Message-ID: <200002292217.XAA07959@pandora.etos.com.pl> To: worsing@earthlink.net Subject: Special Report: E-Marketing - Reach Thousands of Prospects Date: Tue, 29 Feb 2000 18:10:43 +0100 Importance: high X-Priority: 1 Sensitivity: Company-Confidential MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: text/plain; charset="iso-8859-1" _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ S P E C I A L R E P O R T - How To Reach Thousands Of Prospects Every Month _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ Our research has found that many people have tried one or more of the following... Free Classifieds? (They just don't work anymore) Web Site? (Takes thousands of surfers) Banners? (Expensive and losing their punch) E-Zine? (Hope they have a -huge- subscriber list) Search Engines? (Forget it, unless you're in the top 20) S O W H A T D O E S W O R K ? Although often misunderstood, there is one method that has proven to succeed time-after-time. E - M A I L M A R K E T I N G ! ! IT'S A FACT... It if you're not using your computer to generate income, GOOD income, you're leaving money on the table. Here's what the experts have to say about E-Mail Marketing: "A gold mine for those who can take advantage of bulk e-mail programs" - The New York Times "E-mail is an incredible lead generation tool" -Crains Magazine "Blows away traditional Mailing" - Advertising Age Here's a potential earnings example: Let's say you have a product or service that can bring a profit of around $30. Remember, on the Internet, you can make money 7 days a week, 24 hours a day... even while you sleep, orders come from all over the world! Orders Per Day Weekly Monthly Yearly 1 $ 210 $ 840 $ 10,080 2 420 1,680 20,160 3 630 2,520 30,240 5 1,050 4,200 50,400 10 2,100 8,400 100,000 15 3,150 12,600 151,200 The way to reach thousands of people, generate orders and build wealth is person-to-person direct. 1. How do you find the millions of people on the Internet? 2. What are you going to tell them when you do reach them? HERE'S THE ANSWER TO QUESTION #1 M I L L I O N S V O L U M E 9 ***New - 10 Million addresses - Just Released*** The cleanest, most comprehensive e-mail address list in the world, BAR NONE! We're proud to offer it. O N E O F A K I N D This is a first. No one has gone to the work it takes to produce an e-mail address list of this quality. Here's how we prepare our e-mail lists: 1. We clean and eliminate all duplicates. 2. Next, we use a filter list of 400+ words/phrases to clean even more. No address with inappropriate or profane wording survive! 3. Then we used our private database of thousands of known "extremists", opposed to commercial e-mail, and kicked off every one we could find. 4. And finally, we sorted the list into easy-to-manage packets of 20,000 addresses in a simple text (.txt) format. 5. All domains have been verified as valid. WHAT DID WE END UP WITH? Volume 9... 10 Million Addresses Strong! An address list so clean you'll want to start mailing today! N O B R A G - J U S T F A C T With our super clean e-mail address lists you'll send less...and get better results... * Y O U G E T W H A T Y O U P A Y F O R * Our NEW 10 Million, Volume 9, address list CD will result in: * Higher Response Rates * Higher Sales Conversion Ratios * More Receptive prospects; Less Flames & Non-Buyers. * Less Contact With Anti-Commerce Radicals & Extremists. Remember that potential income chart at the beginning of this message? Can you imagine the kind of money you could make if you mailed one million pieces and sold only one tenth (.01%) of one percent? You do the math, you'll be amazed! We've been in the list brokerage business for over 5 years and we've never compromised on quality. We won't release any address list until it passes our "high standards" test. This is not a rental list that is restricted to a one-time mailing. You are purchasing an e-mail address list for your own personal mailings and may use it over-and-over. DON'T HESITATE on this offer or you will miss out on the least expensive, legal and most effective way to market... PERIOD! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ F R E E B O N U S E S Order within 72 hours and we'll include the following FREE Bonuses... we call this our "BUSINESS ON A CD" bonus. 1. To help you get started we include basic proven Professional Mailing Software. This software has sold for as high as $499.00 in the past. No demo, but a full working version (SORRY, SINCE THE SOFTWARE IS FREE WE CANNOT OFFER ANY TECHNICAL SUPPORT, however set-up instructions are included). 2. Every survey has always indicated that the most profitable product to sell on the Internet is INFORMATION! Our "BUSINESS ON A CD" gives you 650 reports/manuals/books that are yours to use and sell. With these "Special Reports" you may instantly start your "Information Product" business... plus a sample SALES LETTER is included to help you GET STARTED FAST! 3. "THE BULK E-MAIL SURVIVAL GUIDE" A manual/guide that addresses the Bulk E-Mail business. Especially useful for beginners. "THE BULK E-MAIL SURVIVAL GUIDE" will answer most of your questions and concerns about Bulk E-Mail. An exclusive for our customers... INCLUDED FREE. 4. "LISTMATE" - This is the software the Pro's use to manage their mailing lists. We've included two versions, both are fully functional demo's, the only limit is the file size. 5. "SCIENTIFIC ADVERTISING"! This is the book that is responsible for untold millions of dollars in sales and profits. Many of today's Internet "gurus" have used this powerful book as the foundation for marketing courses that they have written and sold for as much as $495. Marketeer's that have studied this book have been so deeply inspired, that it has changed their entire way of doing business, and they've gone on to make fortunes -- it's yours FREE with your order! This "BUSINESS ON A CD" bonus is yours absolutely FREE if you order within the next 72 hours --- After that... Poof!... it's gone! ***SPECIAL BONUS*** Order within the next 72 hours and receive an additional 972,565 e-mail addresses as a prompt ordering bonus. Order Now! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ D O N ' T H E S I T A T E E-Marketing is the most effective and fastest way to market anywhere... PERIOD! O R D E R N O W . . . SAME DAY SERVICE (M-F) if your order is received before 2pm Pacific. 24hour fax service, just fax to: 1-801-760-8911 To order, via credit card simply cut/paste and print out the EZ ORDER FORM below and fax to our office today. ***** MILLIONS CD - Volume 9 ***** ***** NOW ONLY $247! ***** This "Special Price" is in effect for the next 72 hours, after that we go back to our regular price of $299.00 ... Don't delay... you can be in business tomorrow! We accept Visa, Mastercard, Amex and Checks by Fax. Fax your order to: 1-500-677-4016 or 1-801-760-8911 ----------------------Cut & Paste---------------------- ---------------------EZ Order Form--------------------- _____Yes! I want everything! I am ordering within 72 hours. Include my FREE "Business On A CD" bonus along with your 10 Million Vol. 9 E-Mail address CD (plus 972,565 bonus addresses) for the special price of only $247.00 + shipping as indicated below. _____Oop's I missed the 72 hour "special". I am ordering Vol. 9 at the regular price of $299.00 + shipping. ***PLEASE SELECT YOUR SHIPPING OPTION*** ____I would like to receive my package FedEx OVERNIGHT. I am including $15 for shipping. (Hawaii & Alaska $20 - Canada $25, all other International add an *additional* $25 [$40 total] for shipping) ____I would like to receive my package FedEx 2nd Day delivery. I'm including $10 for shipping. (Sorry FedEx 2nd Day is NOT AVAILABLE for shipments to Alaska, Hawaii, Canada or any International destination - Continental U.S. shipping addresses only). ***Please Print Carefully*** NOTE: Orders cannot be shipped without complete information including your signature. No exceptions! NAME____________________________________________________ COMPANY NAME____________________________________________ ADDRESS_________________________________________________ (FedEx can only ship to street addresses - no P.O. boxes) CITY, STATE, ZIP________________________________________ PHONE NUMBER____________________________________________ (required for shipping & tracking) EMAIL ADDRESS___________________________________________ (Print Carefully - required in case we have a question and to send you a confirmation that your order has been shipped) TYPE OF CREDIT CARD: ______VISA _____MASTERCARD _____AMEX CREDIT CARD# __________________________________________ EXPIRATION DATE________________________________________ NAME ON CARD___________________________________________ TOTAL AMOUNT (Including Shipping): $___________________ DATE:x__________________ (Required) SIGNATURE:x_________________________________ I understand that I am purchasing the Millions Vol. 9 e-mail address CD, the addresses are not rented, but are mine to use for my own mailing, over-and-over. Free bonuses are included, but cannot be considered part of the financial transaction. I understand that it is my responsibility to comply with any laws applicable to my local area. As with all software, once opened the CD may not be returned, however, if found defective it will be replaced with like product at no charge. You may fax your order to us at: 1-500-677-4016 or 1-801-760-8911 CHECK BY FAX SERVICES! Please Note: Sorry, we can only accept checks drawn on U.S. banks. If you would like to fax a check, tape your check below and fax it to our office along with the EZ Order Form to: 1-500-677-4016 or 1-801-760-8911 ***************************************************************** ***24 HOUR FAX SERVICES*** PLEASE PASTE YOUR CHECK HERE AND FAX IT TO US AT 1-500-677-4016 or 1-801-760-8911 ***************************************************************** If You fax a check, there is no need for you to mail the original. We will prepare a one-time draft, with the exact information on your original check. All checks will be held for bank clearance. (7-10 days) Make payable to: "CD-Marketing" ******************************************************** Do not reply to this message - ******************************************************** To register your e-mail address for removal from unsolicited mailings, visit: http://www.OptList.com ******************************************************** ------ =_NextPart_004_01BF846A.E37602A8-- ------ =_NextPart_002_01BF846A.E37602A8-- ------ =_NextPart_000_01BF846A.E37602A8 Content-Type: message/rfc822 Content-Description: Postmaster notify: Host unknown (Name server: ip130.lth2.k12.il.us: host not found) Message-ID: <200002292218.XAC25678@wall.pdv.de> From: Mail Delivery Subsystem To: postmaster@wall.pdv.de Subject: Postmaster notify: Host unknown (Name server: ip130.lth2.k12.il.u s: host not found) Date: Tue, 29 Feb 2000 23:18:37 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_002_01BF846A.E37602A8" ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 23:18:37 +0100 (CET) from localhost ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- 550 ... Host unknown (Name server: ip130.lth2.k12.il.us: host not found) ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: application/octet-stream; name="ATT06529.TXT" Content-Disposition: attachment; filename="ATT06529.TXT" Reporting-MTA: dns; wall.pdv.de Arrival-Date: Tue, 29 Feb 2000 23:18:37 +0100 (CET) Final-Recipient: RFC822; Postmaster@ip130.lth2.k12.il.us Action: failed Status: 5.1.2 Remote-MTA: DNS; ip130.lth2.k12.il.us Last-Attempt-Date: Tue, 29 Feb 2000 23:18:37 +0100 (CET) ------ =_NextPart_002_01BF846A.E37602A8 Content-Type: message/rfc822 Message-ID: <200002292218.XAB25678@wall.pdv.de> From: Mail Delivery Subsystem To: Postmaster@ip130.lth2.k12.il.us Subject: Returned mail: User unknown Date: Tue, 29 Feb 2000 23:18:37 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: multipart/mixed; boundary="---- =_NextPart_004_01BF846A.E37602A8" ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: text/plain The original message was received at Tue, 29 Feb 2000 23:18:36 +0100 (CET) from mail@localhost ----- The following addresses had permanent fatal errors ----- ----- Transcript of session follows ----- 550 ... User unknown ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: application/octet-stream; name="ATT06532.TXT" Content-Disposition: attachment; filename="ATT06532.TXT" Reporting-MTA: dns; wall.pdv.de Arrival-Date: Tue, 29 Feb 2000 23:18:36 +0100 (CET) Final-Recipient: RFC822; Action: failed Status: 5.1.1 Last-Attempt-Date: Tue, 29 Feb 2000 23:18:37 +0100 (CET) ------ =_NextPart_004_01BF846A.E37602A8 Content-Type: message/rfc822 Message-ID: <200002292218.XAA25678@wall.pdv.de> From: Postmaster To: ancq3f1nkrz5xza@pdv.de Subject: Non-Delivery Report Date: Tue, 29 Feb 2000 23:18:29 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Content-Type: text/plain; charset="iso-8859-1" Could not deliver message (ID=77882) to remote account 'spettee@earthlink.net'. Remote server returned error: 550 Mailbox not found (user unknown). The first portion of the original message text follows: ------------------------------------------------------- Received: from localhost by ip130.lth2.k12.il.us (AppleShare IP Mail Server 6.1) id 77882 via TCP with SMTP; Tue, 29 Feb 2000 16:18:21 -0600 MessageID: Content-Type: text/plain Subject: How To Reach Thousands Of Prospects Every Month? X-References: 052E1F1ED, 01E9871A6 From: MIME-Version: 1.0 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3110.3 To: Sensitivity: Public Date: Tue, 29 Feb 2000 17:09:54 References: 032D542C8 X-See-Also: 0F8CC5442 X-Mailer: Microsoft Outlook Express 4.72.3110.6 _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ S P E C I A L R E P O R T - How To Reach Thousands Of Prospects Every Month _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ Our research has found that many people have tried one or more of the following... Free Classifieds? (They just don't work anymore) Web Site? (Takes thousands of surfers) Banners? (Expensive and losing their punch) E-Zine? (Hope they have a -huge- subscriber list) Search Engines? (Forget it, unless you're in the top 20) S O W H A T D O E S W O R K ? Although often misunderstood, there is one method that has proven to succeed time-after-time. E - M A I L M A R K E T I N G ! ! IT'S A FACT... It if you're not using your computer to generate income, GOOD income, you're leaving money on the table. Here's what the experts have to say about E-Mail Marketing: "A gold mine for those who can take advantage of bulk e-mail programs" - The New York Times "E-mail is an incredible lead generation tool" -Crains Magazine "Blows away traditional Mailing" - Advertising Age Here's a potential earnings example: Let's say you have a product or service that can bring a profit of around $30. Remember, on the Internet, you can make money 7 days a week, 24 hours a day... even while you sleep, orders come from all over the world! Orders Per Day Weekly Monthly Yearly 1 $ 210 $ 840 $ 10,080 2 420 1,680 20,160 3 630 2,520 30,240 5 1,050 4,200 50,400 10 2,100 8,400 100,000 15 3,150 12,600 151,200 The way to reach thousands of people, generate orders and build wealth is person-to-person direct. 1. How do you find the millions of people on the Internet? 2. What are you going to tell them when you do reach them? HERE'S THE ANSWER TO QUESTION #1 M I L L I O N S V O L U M E 9 ***New - 10 Million addresses - Just Released*** The cleanest, most comprehensive e-mail address list in the world, BAR NONE! We're proud to offer it. O N E O F A K I N D This is a first. No one has gone to the work it takes to produce an e-mail address list of this quality. Here's how we prepare our e-mail lists: 1. We clean and eliminate all duplicates. 2. Next, we use a filter list of 400+ words/phrases to clean even more. No address with inappropriate or profane wording survive! 3. Then we used our private database of thousands of known "extremists", opposed to commercial e-mail, and kicked off every one we could find. 4. And finally, we sorted the list into easy-to-manage packets of 20,000 addresses in a simple text (.txt) format. 5. All domains have been verified as valid. WHAT DID WE END UP WITH? Volume 9... 10 Million Addresses Strong! An address list so clean you'll want to start mailing today! N O B R A G - J U S T F A C T With our super clean e-mail address lists you'll send less...and get better results... * Y O U G E T W H A T Y O U P A Y F O R * Our NEW 10 Million, Volume 9, address list CD will result in: * Higher Response Rates * Higher Sales Conversion Ratios * More Receptive prospects; Less Flames & Non-Buyers. * Less Contact With Anti-Commerce Radicals & Extremists. Remember that potential income chart at the beginning of this message? Can you imagine the kind of money you could make if you mailed one million pieces and sold only one tenth (.01%) of one percent? You do the math, you'll be amazed! We've been in the list brokerage business for over 5 years and we've never compromised on quality. We won't release any address list until it passes our "high standards" test. This is not a rental list that is restricted to a one-time mailing. You are purchasing an e-mail address list for your own personal mailings and may use it over-and-over. DON'T HESITATE on this offer or you will miss out on the least expensive, legal and most effective way to market... PERIOD! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ F R E E B O N U S E S Order within 72 hours and we'll include the following FREE Bonuses... we call this our "BUSINESS ON A CD" bonus. 1. To help you get started we include basic proven Professional Mailing Software. This software has sold for as high as $499.00 in the past. No demo, but a full working version (SORRY, SINCE THE SOFTWARE IS FREE WE CANNOT OFFER ANY TECHNICAL SUPPORT, however set-up instructions are included). 2. Every survey has always indicated that the most profitable product to sell on the Internet is INFORMATION! Our "BUSINESS ON A CD" gives you 650 reports/manuals/books that are yours to use and sell. With these "Special Reports" you may instantly start your "Information Product" business... plus a sample SALES LETTER is included to help you GET STARTED FAST! 3. "THE BULK E-MAIL SURVIVAL GUIDE" A manual/guide that addresses the Bulk E-Mail business. Especially useful for beginners. "THE BULK E-MAIL SURVIVAL GUIDE" will answer most of your questions and concerns about Bulk E-Mail. An exclusive for our customers... INCLUDED FREE. 4. "LISTMATE" - This is the software the Pro's use to manage their mailing lists. We've included two versions, both are fully functional demo's, the only limit is the file size. 5. "SCIENTIFIC ADVERTISING"! This is the book that is responsible for untold millions of dollars in sales and profits. Many of today's Internet "gurus" have used this powerful book as the foundation for marketing courses that they have written and sold for as much as $495. Marketeer's that have studied this book have been so deeply inspired, that it has changed their entire way of doing business, and they've gone on to make fortunes -- it's yours FREE with your order! This "BUSINESS ON A CD" bonus is yours absolutely FREE if you order within the next 72 hours --- After that... Poof!... it's gone! ***SPECIAL BONUS*** Order within the next 72 hours and receive an additional 972,565 e-mail addresses as a prompt ordering bonus. Order Now! _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ _/ D O N ' T H E S I T A T E E-Marketing is the most effective and fastest way to market anywhere... PERIOD! O R D E R N O W . . . SAME DAY SERVICE (M-F) if your order is received before 2pm Pacific. 24hour fax service, just fax to: 1-801-760-8911 To order, via credit card simply cut/paste and print out the EZ ORDER FORM below and fax to our office today. ***** MILLIONS CD - Volume 9 ***** ***** NOW ONLY $247! ***** This "Special Price" is in effect for the next 72 hours, after that we go back to our regular price of $299.00 ... Don't delay... you can be in business tomorrow! We accept Visa, Mastercard, Amex and Checks by Fax. Fax your order to: 1-500-677-4016 or 1-801-760-8911 ----------------------Cut & Paste---------------------- ---------------------EZ Order Form--------------------- _____Yes! I want everything! I am ordering within 72 hours. Include my FREE "Business On A CD" bonus along with your 10 Million Vol. 9 E-Mail address CD (plus 972,565 bonus addresses) for the special price of only $247.00 + shipping as indicated below. _____Oop's I missed the 72 hour "special". I am ordering Vol. 9 at the regular price of $299.00 + shipping. ***PLEASE SELECT YOUR SHIPPING OPTION*** ____I would like to receive my packa ------ =_NextPart_004_01BF846A.E37602A8-- ------ =_NextPart_002_01BF846A.E37602A8-- ------ =_NextPart_000_01BF846A.E37602A8-- From owner-fwtk-users@ex.tis.com Fri Mar 3 09:02 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA05173 Fri, 3 Mar 2000 09:02:25 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA23863; Fri, 3 Mar 2000 06:08:13 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 3 Mar 2000 05:54:07 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA18559 for fwtk-users-outgoing; Fri, 3 Mar 2000 05:54:02 -0800 (PST) Date: Fri, 3 Mar 2000 08:30:37 -0500 (EST) From: Ted Keller To: "Johann G. Hautzinger" cc: "Firewall Toolkit (M-list)" Subject: Re: got relayed - need your help! In-Reply-To: <38BF5BCE.685217AD@eic.at> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1756 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I'm blocking these spams by checking the content on the way in (really the header part of the message). Based on a filter list, if I get a match - I assume it is spam and reject it. That helps a lot on cutting inbound spam. It doesn't do any good for the situation where someone else uses my address as the from line and floods others.... I agree with Rick - there's really no way that I know to stop it short of finding the original host and seeing if you can get the admin to stop it. ted keller On Fri, 3 Mar 2000, Johann G. Hautzinger wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Rick Murphy wrote: > [...] > > > Basically, you're the victim, not the source. If you have any usable > > "Received" lines that say where the spew was injected in any of those > > messages, you might be able to track down the chickenboner that sent them; > > there's no way to stop this from happening again, unfortunately. > > just a little remark: i stopped relaying at home, now (i think as a > little "revenge" from spammers) _I_ am being spammed ... 5 - 10 "earn > more money"'n stuff per day ... as i dont know anybody having a > *.msn.com or *.hotmail.com it is quite easy for me ... denying sendmail > to that domains (550 Nobody here is interested in your spam) ... > > *greetz* from vienna > > Hannes > > > -- > Johann Georg Hautzinger, email: trema@eic.at, Tel.: 531 00 1907 > Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier > Boersegasse 14, 1010 Wien http://treasury.erstebank.at > From owner-fwtk-users@ex.tis.com Sat Mar 4 09:13 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA08950 Sat, 4 Mar 2000 09:13:51 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA14456; Sat, 4 Mar 2000 06:19:43 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 4 Mar 2000 06:08:08 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA13739 for fwtk-users-outgoing; Sat, 4 Mar 2000 06:08:06 -0800 (PST) Message-ID: <38C11895.8C369BAF@rossi.net> Date: Sat, 04 Mar 2000 15:07:17 +0100 From: Cybersystems@t-online.de (Guido =?iso-8859-1?Q?Rossm=FCller?=) X-Mailer: Mozilla 4.6 [de]C-CCK-MCD QXW0321g (Win98; I) X-Accept-Language: de,en MIME-Version: 1.0 To: FWTK List Subject: newbie transparent proxy Content-Transfer-Encoding: 7bit X-Sender: 02066380720-0001@t-dialin.net Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 182 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hallo Can I use the TIS FWTK as Transparent Proxy From owner-fwtk-users@ex.tis.com Sat Mar 4 10:11 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA09053 Sat, 4 Mar 2000 10:11:07 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA16469; Sat, 4 Mar 2000 07:16:59 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 4 Mar 2000 07:10:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA15772 for fwtk-users-outgoing; Sat, 4 Mar 2000 07:10:41 -0800 (PST) X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E9956115078@exchange.pdv.de> From: "Dirk.Nerling" To: "Firewall Toolkit (M-list)" Subject: what mean smap with "security: to-address=" Date: Sat, 4 Mar 2000 14:35:48 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1604 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, the spamers make me crazy - now I got emails which should bounce themselfs back. I couldn't find outgoing messages in my maillog, seems as smap discarded them. Right? Mar 4 00:41:14 wall smap[2740]: host=gsc-research.de/212.227.89.198 bytes=921 from= to= xma002740 Mar 4 00:41:26 wall smap[2745]: security: to-address= Mar 4 00:56:27 wall smap[2778]: security: to-address= Mar 4 01:26:58 wall smap[2874]: security: to-address= Mar 4 01:29:07 wall smap[2876]: host=p3e9ba966.dip0.t-ipconnect.de/62.155.169.102 bytes=961 from= to= xma002876 Mar 4 01:29:27 wall smap[2881]: security: to-address= Mar 4 01:44:28 wall smap[2909]: security: to-address= Mar 4 02:14:29 wall smap[3096]: security: to-address= Mar 4 02:27:00 wall smap[3133]: security: to-address= Mar 4 03:14:31 wall smap[3262]: security: to-address= Mar 4 08:37:17 wall smap[5522]: host=gsc-research.de/212.227.89.198 bytes=912 best regards Dirk -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de From owner-fwtk-users@ex.tis.com Sat Mar 4 22:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA10378 Sat, 4 Mar 2000 22:45:18 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA02736; Sat, 4 Mar 2000 19:51:10 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 4 Mar 2000 19:48:12 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA02082 for fwtk-users-outgoing; Sat, 4 Mar 2000 19:48:10 -0800 (PST) Message-ID: <000701bf8654$f668c760$fc00a8c0@k62350> From: "Larry Jackson" To: "FWTK List" Subject: [fwtk] Configuring firewall + UDPrelay for internet phone calls. Date: Sat, 4 Mar 2000 22:43:24 -0500 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1125 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I'm trying to properly configure my firewall to use an internet phone call program called dialpad.com According to their FAQ: Our server cannot penetrate firewall and send you multimedia packets. To use Dialpad.com service behind firewall, try to open UDP ports 51200, 51201, and TCP port 51210. In case you want to allow the ports only for Dialpad. Open them for the 4.2.40.XX, 4.2.42.XX, 4.2.46.XX, 4.2.47.XX, 4.2.54.XX, 4.2.64.XX, 4.2.68.XX, 4.2.74.XX, 63.74.89.XX and 216.52.249.XX subnet. Please check back once in a while for changes or additions to the list of subnets. If you need a trigger for them, use TCP: 7175 (outgoing) So I figured I'd use plug-gw for TCP on 51210 (and possibly 7175, Since it triggers on this port), and udprelay for 51200 & 51201. I'm a firewall newbie so I'd appreciate any help in properly configuring plug-gw and udprelay. Also, are there any security issues to allowing this service and if so what can be done to limit them. Thanks in advance, Larry From owner-fwtk-users@ex.tis.com Sun Mar 5 05:39 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA10923 Sun, 5 Mar 2000 05:39:20 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA08320; Sun, 5 Mar 2000 02:45:12 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 5 Mar 2000 02:42:23 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA07658 for fwtk-users-outgoing; Sun, 5 Mar 2000 02:42:22 -0800 (PST) X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E995611507A@exchange.pdv.de> From: "Dirk.Nerling" To: "Firewall Toolkit (M-list)" , "'keller@bfg.com'" Subject: think - I'm attacked - what do YOU mean ???? Date: Sun, 5 Mar 2000 11:41:11 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 2402 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I found this in my logfiles, some tried to use nntp, ftp and telnet - not unusal - I find often some of these kids how are searching for a free news server. But why do I get "Socket is not connected" and "cannot get peername" from TIS? What should I do???? best regards Dirk Mar 5 07:55:48 wall /kernel: ipfw: 500 Accept ICMP:8.0 216.210.30.47 194.139.111.2 in via de1 Mar 5 07:55:48 wall /kernel: ipfw: 500 Accept ICMP:0.0 194.139.111.2 216.210.30.47 out via de1 Mar 5 07:55:50 wall smap[9460]: getpeername failed: Socket is not connected Mar 5 07:55:50 wall smap[9460]: cannot get remote host Mar 5 07:55:56 wall plug-gw[9461]: deny host=ppp-5800-01a-3047.mtl.total.net/216.210.30.47 service=nntp Mar 5 07:55:58 wall netacl[9462]: getpeername failed: Socket is not connected Mar 5 07:55:58 wall netacl[9462]: fwtksyserr: in.ftpd exiting - cannot get peername Mar 5 07:56:01 wall netacl[9463]: getpeername failed: Socket is not connected Mar 5 07:56:01 wall netacl[9463]: fwtksyserr: in.teln exiting - cannot get peername Mar 5 07:56:15 wall /kernel: ipfw: 500 Accept ICMP:3.3 194.139.111.2 216.210.30.47 out via de1 Mar 5 08:07:23 wall /kernel: ipfw: 500 Accept ICMP:8.0 216.210.30.47 194.139.111.2 in via de1 Mar 5 08:07:23 wall /kernel: ipfw: 500 Accept ICMP:0.0 194.139.111.2 216.210.30.47 out via de1 Mar 5 08:07:31 wall netacl[9486]: getpeername failed: Socket is not connected Mar 5 08:07:31 wall netacl[9486]: fwtksyserr: in.teln exiting - cannot get peername Mar 5 08:07:34 wall plug-gw[9487]: getpeername failed: Socket is not connected Mar 5 08:07:34 wall plug-gw[9487]: cannot get remote host: Socket is not connected Mar 5 08:07:40 wall netacl[9488]: getpeername failed: Socket is not connected Mar 5 08:07:40 wall netacl[9488]: fwtksyserr: in.ftpd exiting - cannot get peername Mar 5 08:07:46 wall smap[9489]: getpeername failed: Socket is not connected Mar 5 08:07:46 wall smap[9489]: cannot get remote host Mar 5 08:07:51 wall /kernel: ipfw: 500 Accept ICMP:3.3 194.139.111.2 216.210.30.47 out via de1 -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de From owner-fwtk-users@ex.tis.com Sun Mar 5 08:14 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA11124 Sun, 5 Mar 2000 08:14:17 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA10939; Sun, 5 Mar 2000 05:20:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 5 Mar 2000 05:17:08 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA10265 for fwtk-users-outgoing; Sun, 5 Mar 2000 05:17:07 -0800 (PST) Message-Id: <4.3.2.20000305080023.00b6dca0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Sun, 05 Mar 2000 08:03:41 -0500 To: "Dirk.Nerling" , "Firewall Toolkit (M-list)" From: Rick Murphy Subject: Re: think - I'm attacked - what do YOU mean ???? In-Reply-To: <6CC81B07CB44D311A1D20001FA7E995611507A@exchange.pdv.de> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 783 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 11:41 AM 3/5/00 +0100, Dirk.Nerling wrote: >I found this in my logfiles, some tried to use nntp, ftp and telnet - not >unusal - I find often some of these kids how are searching for a free news >server. But why do I get "Socket is not connected" and "cannot get >peername" from TIS? That almost always means someone has initiated a connection to a port then immediately disconnected it. Having several of these happen in a short timespan is a signature of a port scan. >What should I do???? Nothing bad happpened, so you don't need to panic. Keep track of the source IP and if they come back repeatedly, complain to their isp. -Rick From owner-fwtk-users@ex.tis.com Sun Mar 5 14:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA11834 Sun, 5 Mar 2000 14:26:49 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA16950; Sun, 5 Mar 2000 11:32:38 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 5 Mar 2000 11:25:23 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA16242 for fwtk-users-outgoing; Sun, 5 Mar 2000 11:25:22 -0800 (PST) From: "Joseph Judge" To: "Dirk.Nerling" , "Firewall Toolkit (M-list)" , Subject: RE: think - I'm attacked - what do YOU mean ???? Date: Sun, 5 Mar 2000 14:24:29 -0500 Message-ID: <000201bf86d8$6d642200$0601a8c0@poopy.intrusion.org> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0 In-Reply-To: <6CC81B07CB44D311A1D20001FA7E995611507A@exchange.pdv.de> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3155.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 3182 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Looks like some nosy bastard. This happens often throughout a connected year. Its when there are a _LOT_ of these streaming in your log files that would indicate someone more intent on pounding you (DoS) than just checking you out. -joe > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Dirk.Nerling > Sent: Sunday, March 05, 2000 5:41 AM > To: Firewall Toolkit (M-list); 'keller@bfg.com' > Subject: think - I'm attacked - what do YOU mean ???? > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello, > > I found this in my logfiles, some tried to use nntp, ftp and telnet - not > unusal - I find often some of these kids how are searching for a free news > server. But why do I get "Socket is not connected" and "cannot get > peername" from TIS? > What should I do???? > > best regards Dirk > > > Mar 5 07:55:48 wall /kernel: ipfw: 500 Accept ICMP:8.0 216.210.30.47 > 194.139.111.2 in via de1 > Mar 5 07:55:48 wall /kernel: ipfw: 500 Accept ICMP:0.0 194.139.111.2 > 216.210.30.47 out via de1 > Mar 5 07:55:50 wall smap[9460]: getpeername failed: Socket is > not connected > Mar 5 07:55:50 wall smap[9460]: cannot get remote host > Mar 5 07:55:56 wall plug-gw[9461]: deny > host=ppp-5800-01a-3047.mtl.total.net/216.210.30.47 service=nntp > Mar 5 07:55:58 wall netacl[9462]: getpeername failed: Socket is not > connected > Mar 5 07:55:58 wall netacl[9462]: fwtksyserr: in.ftpd exiting - > cannot get > peername > Mar 5 07:56:01 wall netacl[9463]: getpeername failed: Socket is not > connected > Mar 5 07:56:01 wall netacl[9463]: fwtksyserr: in.teln exiting - > cannot get > peername > Mar 5 07:56:15 wall /kernel: ipfw: 500 Accept ICMP:3.3 194.139.111.2 > 216.210.30.47 out via de1 > > > Mar 5 08:07:23 wall /kernel: ipfw: 500 Accept ICMP:8.0 216.210.30.47 > 194.139.111.2 in via de1 > Mar 5 08:07:23 wall /kernel: ipfw: 500 Accept ICMP:0.0 194.139.111.2 > 216.210.30.47 out via de1 > Mar 5 08:07:31 wall netacl[9486]: getpeername failed: Socket is not > connected > Mar 5 08:07:31 wall netacl[9486]: fwtksyserr: in.teln exiting - > cannot get > peername > Mar 5 08:07:34 wall plug-gw[9487]: getpeername failed: Socket is not > connected > Mar 5 08:07:34 wall plug-gw[9487]: cannot get remote host: Socket is not > connected > Mar 5 08:07:40 wall netacl[9488]: getpeername failed: Socket is not > connected > Mar 5 08:07:40 wall netacl[9488]: fwtksyserr: in.ftpd exiting - > cannot get > peername > Mar 5 08:07:46 wall smap[9489]: getpeername failed: Socket is > not connected > Mar 5 08:07:46 wall smap[9489]: cannot get remote host > Mar 5 08:07:51 wall /kernel: ipfw: 500 Accept ICMP:3.3 194.139.111.2 > 216.210.30.47 out via de1 > > > > -- > Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: > ++49-361-4407144 > PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 > CC83 > http://www.pdv.de > From owner-fwtk-users@ex.tis.com Sun Mar 5 16:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA12041 Sun, 5 Mar 2000 16:38:49 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA20191; Sun, 5 Mar 2000 13:44:44 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 5 Mar 2000 13:41:00 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA19496 for fwtk-users-outgoing; Sun, 5 Mar 2000 13:40:59 -0800 (PST) From: "Tom Krotchko" To: "Joseph Judge" , "Dirk.Nerling" , "Firewall Toolkit \(M-list\)" , Subject: RE: think - I'm attacked - what do YOU mean ???? Date: Sun, 5 Mar 2000 16:40:09 -0500 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <000201bf86d8$6d642200$0601a8c0@poopy.intrusion.org> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 909 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] It seems to me ever since the week of the DDoS attacks, I'm getting a lot of probes on all my firewalls with UDP_ECHO packets. I swear kids today have no imagination when it comes to hacking . Something for everyone to consider; you have to have some "known" entries to your organization. Typically this would be your mail gateway and public web sites (and even there, I think it might be worthwhile to set it up outside your organization whether in a DMZ or completely outsourced). However, for large organization that have multiple entry paths, I think you're crazy for advertising your other pathways with (a) DNS records (b) Reverse DNS records. For Fortune 1000's; its practically waving a red flag in front of a bull. First rule of being ignored: Be invisible. From owner-fwtk-users@ex.tis.com Sun Mar 5 21:08 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA12575 Sun, 5 Mar 2000 21:08:19 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA29103; Sun, 5 Mar 2000 18:14:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 5 Mar 2000 18:08:23 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA28096 for fwtk-users-outgoing; Sun, 5 Mar 2000 18:08:21 -0800 (PST) From: "Joseph Judge" To: "Tom Krotchko" , "Dirk.Nerling" , "Firewall Toolkit (M-list)" , Subject: RE: think - I'm attacked - what do YOU mean ???? Date: Sun, 5 Mar 2000 21:05:14 -0500 Message-ID: <000c01bf8710$69232280$0601a8c0@poopy.intrusion.org> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0 In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3155.0 Importance: Normal Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1625 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is what auditors call "enticement risk" -- and, at a smaller level, why folks should turn off finger, rwho, rusers, EXPN on their email gateway, not place the corporate directory in a public LDAP server, etc, etc. - joe > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Tom Krotchko > Sent: Sunday, March 05, 2000 4:40 PM > To: Joseph Judge; Dirk.Nerling; Firewall Toolkit (M-list); > keller@bfg.com > Subject: RE: think - I'm attacked - what do YOU mean ???? > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > It seems to me ever since the week of the DDoS attacks, I'm getting > a lot of probes on all my firewalls with UDP_ECHO packets. > > I swear kids today have no imagination when it comes to hacking . > > Something for everyone to consider; you have to have some "known" > entries to your organization. Typically this would be your mail > gateway and public web sites (and even there, I think it might be > worthwhile to set it up outside your organization whether in a DMZ > or completely outsourced). > > However, for large organization that have multiple entry paths, I > think you're crazy for advertising your other pathways with > (a) DNS records (b) Reverse DNS records. For Fortune 1000's; > its practically waving a red flag in front of a bull. > > First rule of being ignored: Be invisible. > From owner-fwtk-users@ex.tis.com Sun Mar 5 22:20 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA12690 Sun, 5 Mar 2000 22:20:59 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA04717; Sun, 5 Mar 2000 19:26:53 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 5 Mar 2000 19:23:10 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA04019 for fwtk-users-outgoing; Sun, 5 Mar 2000 19:23:08 -0800 (PST) Message-ID: <38C32472.878C6AA4@rochester.rr.com> Date: Sun, 05 Mar 2000 22:22:26 -0500 From: "Ronald J. Yacketta" X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.14-15mdk i586) X-Accept-Language: en MIME-Version: 1.0 To: "Firewall Toolkit (M-list)" Subject: ftp-gw + ncftpd Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 895 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello all! Looking for some assistance with useing the ftp-gw with ncftpd. I currently have the following setup (probably not recommended, but works) /etc/inetd.conf: ftp stream tcp nowait root /usr/local/bin/netacl ftpd /usr/local/etc/netperm-table (first three lines are all on one line in the file): netacl-ftpd: permit-hosts 63.15.72.* 10.100.100.* 127.0.0.1 \ -exec /usr/local/bin/ncftpd -q \ /usr/local/etc/ncftpd/general.cf /usr/local/etc/ncftpd/domain.cf netacl-ftpd: deny-hosts * I get a bind error, socket in use. this is my previous netperm-table entry that worked like a champ! netacl-ftpd: permit-hosts 63.15.72.* 10.100.100.* 127.0.0.1 -exec /usr/sbin/in.ftpd -L I would like to use ncftpd like I have been useing in.ftpd Regards, Ron From owner-fwtk-users@ex.tis.com Mon Mar 6 01:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id BAA13285 Mon, 6 Mar 2000 01:45:08 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id WAA12671; Sun, 5 Mar 2000 22:50:53 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 5 Mar 2000 22:45:37 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id WAA11970 for fwtk-users-outgoing; Sun, 5 Mar 2000 22:45:36 -0800 (PST) Message-ID: <38C345CB.4FD28031@gte.net> Date: Sun, 05 Mar 2000 21:44:43 -0800 From: Chris Chavez <5chavez@gte.net> Reply-To: 5chavez@gte.net X-Mailer: Mozilla 4.7 [en] (X11; U; Linux 2.2.5-15 i686) X-Accept-Language: en MIME-Version: 1.0 CC: "Firewall Toolkit (M-list)" Subject: Re: think - I'm attacked - what do YOU mean ???? References: Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms870944C3174BDBDFDCC8568C" Content-Length: 5167 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a cryptographically signed message in MIME format. --------------ms870944C3174BDBDFDCC8568C Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hello, With this thought (being invisible) in mind. Is there a way to disable ICMP echo replys? Chris Chavez Tom Krotchko wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > It seems to me ever since the week of the DDoS attacks, I'm getting > a lot of probes on all my firewalls with UDP_ECHO packets. > > I swear kids today have no imagination when it comes to hacking . > > Something for everyone to consider; you have to have some "known" > entries to your organization. Typically this would be your mail > gateway and public web sites (and even there, I think it might be > worthwhile to set it up outside your organization whether in a DMZ > or completely outsourced). > > However, for large organization that have multiple entry paths, I > think you're crazy for advertising your other pathways with > (a) DNS records (b) Reverse DNS records. For Fortune 1000's; > its practically waving a red flag in front of a bull. > > First rule of being ignored: Be invisible. --------------ms870944C3174BDBDFDCC8568C Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIKFAYJKoZIhvcNAQcCoIIKBTCCCgECAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC B6AwggRqMIID06ADAgECAhAfEvwYcvpjhUlYwQH7A1liMA0GCSqGSIb3DQEBBAUAMIHMMRcw FQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29y azFGMEQGA1UECxM9d3d3LnZlcmlzaWduLmNvbS9yZXBvc2l0b3J5L1JQQSBJbmNvcnAuIEJ5 IFJlZi4sTElBQi5MVEQoYyk5ODFIMEYGA1UEAxM/VmVyaVNpZ24gQ2xhc3MgMSBDQSBJbmRp dmlkdWFsIFN1YnNjcmliZXItUGVyc29uYSBOb3QgVmFsaWRhdGVkMB4XDTk5MTIwMzAwMDAw MFoXDTAwMTIwMjIzNTk1OVowggEOMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEfMB0GA1UE CxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazFGMEQGA1UECxM9d3d3LnZlcmlzaWduLmNvbS9y ZXBvc2l0b3J5L1JQQSBJbmNvcnAuIGJ5IFJlZi4sTElBQi5MVEQoYyk5ODEeMBwGA1UECxMV UGVyc29uYSBOb3QgVmFsaWRhdGVkMTMwMQYDVQQLEypEaWdpdGFsIElEIENsYXNzIDEgLSBO ZXRzY2FwZSBGdWxsIFNlcnZpY2UxFTATBgNVBAMUDENocmlzIENoYXZlejEeMBwGCSqGSIb3 DQEJARYPNWNoYXZlekBndGUubmV0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3hHiN X1Re3RH5nr1bEGmIxNjoht2+DHkbAYG/NvFlqNymtNiagxZN9fYereizRZMZ+gcb65V6g5AV +IL7jljBVmSAcFsQO58HSlF72ERMZX+Ej6Sx8N1JbjoTeYrY1Jxh431huS6uIOKH47semSzt 6GG51N2V2v3FHuBLJNoMlQIDAQABo4IBBjCCAQIwCQYDVR0TBAIwADCBrAYDVR0gBIGkMIGh MIGeBgtghkgBhvhFAQcBATCBjjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cudmVyaXNpZ24u Y29tL0NQUzBiBggrBgEFBQcCAjBWMBUWDlZlcmlTaWduLCBJbmMuMAMCAQEaPVZlcmlTaWdu J3MgQ1BTIGluY29ycC4gYnkgcmVmZXJlbmNlIGxpYWIuIGx0ZC4gKGMpOTcgVmVyaVNpZ24w EQYJYIZIAYb4QgEBBAQDAgeAMDMGA1UdHwQsMCowKKAmoCSGImh0dHA6Ly9jcmwudmVyaXNp Z24uY29tL2NsYXNzMS5jcmwwDQYJKoZIhvcNAQEEBQADgYEAobCdtDU5ZTRjR9wk7d4/ERIS tmzMK/HSedQYG40t8sAooIHftAF9T4huQKWI+C6Uy3Hb+Qh8rPHUTnFnjgyK5F7wufNswL/c WOOVuX1R8eBd6gA17svL1cKagce35D5KxigsTNv9CTwLD+VuxkG88wA32yoiQEImU7NYi8NC 2TEwggMuMIICl6ADAgECAhEA0nYujRQMPX2yqCVdr+4NdTANBgkqhkiG9w0BAQIFADBfMQsw CQYDVQQGEwJVUzEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xNzA1BgNVBAsTLkNsYXNzIDEg UHVibGljIFByaW1hcnkgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNOTgwNTEyMDAwMDAw WhcNMDgwNTEyMjM1OTU5WjCBzDEXMBUGA1UEChMOVmVyaVNpZ24sIEluYy4xHzAdBgNVBAsT FlZlcmlTaWduIFRydXN0IE5ldHdvcmsxRjBEBgNVBAsTPXd3dy52ZXJpc2lnbi5jb20vcmVw b3NpdG9yeS9SUEEgSW5jb3JwLiBCeSBSZWYuLExJQUIuTFREKGMpOTgxSDBGBgNVBAMTP1Zl cmlTaWduIENsYXNzIDEgQ0EgSW5kaXZpZHVhbCBTdWJzY3JpYmVyLVBlcnNvbmEgTm90IFZh bGlkYXRlZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAu1pEigQWu1X9A3qKLZRPFXg2 uA1Ksm+cVL+86HcqnbnwaLuV2TFBcHqBS7lIE1YtxwjhhEKrwKKSq0RcqkLwgg4C6S/7wju7 vsknCl22sDZCM7VuVIhPh0q/Gdr5FegPh7Yc48zGmo5/aiSS4/zgZbqnsX7vyds3ashKyAkG 5JkCAwEAAaN8MHowEQYJYIZIAYb4QgEBBAQDAgEGMEcGA1UdIARAMD4wPAYLYIZIAYb4RQEH AQEwLTArBggrBgEFBQcCARYfd3d3LnZlcmlzaWduLmNvbS9yZXBvc2l0b3J5L1JQQTAPBgNV HRMECDAGAQH/AgEAMAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQIFAAOBgQCIuDc73dqUNwCt qp/hgQFxHpJqbS/28Z3TymQ43BuYDAeGW4UVag+5SYWklfEXfWe0fy0s3ZpCnsM+tI6q5QsG 3vJWKvozx74Z11NMw73I4xe1pElCY+zCphcPXVgaSTyQXFWjZSAA/Rgg5V+CprGoksVYasGN Azzrw80FopCubjGCAjwwggI4AgEBMIHhMIHMMRcwFQYDVQQKEw5WZXJpU2lnbiwgSW5jLjEf MB0GA1UECxMWVmVyaVNpZ24gVHJ1c3QgTmV0d29yazFGMEQGA1UECxM9d3d3LnZlcmlzaWdu LmNvbS9yZXBvc2l0b3J5L1JQQSBJbmNvcnAuIEJ5IFJlZi4sTElBQi5MVEQoYyk5ODFIMEYG A1UEAxM/VmVyaVNpZ24gQ2xhc3MgMSBDQSBJbmRpdmlkdWFsIFN1YnNjcmliZXItUGVyc29u YSBOb3QgVmFsaWRhdGVkAhAfEvwYcvpjhUlYwQH7A1liMAkGBSsOAwIaBQCggbEwGAYJKoZI hvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDAwMzA2MDU0NDQzWjAjBgkq hkiG9w0BCQQxFgQUOZY1RHHo7ZHg9q+VrrwVqmrheEEwUgYJKoZIhvcNAQkPMUUwQzAKBggq hkiG9w0DBzAOBggqhkiG9w0DAgICAIAwBwYFKw4DAgcwDQYIKoZIhvcNAwICAUAwDQYIKoZI hvcNAwICASgwDQYJKoZIhvcNAQEBBQAEgYCxBj5hCvm0/AXLy+H0AiZhy3DaEH7Xa2dRJ2G/ 5Fe9BLLJvJe0PDLM3Ax7pJ1G6IkyYMS6T5m/sizov/uUov73brReh8wW8TdR0nE9uM49JQrB xsPwiFgan3EAaJhi+pf54CHKYB3jICoYNVf2ndE0lzeSeqtGYLcBXDdMRx3aoA== --------------ms870944C3174BDBDFDCC8568C-- From owner-fwtk-users@ex.tis.com Mon Mar 6 03:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA13649 Mon, 6 Mar 2000 03:21:59 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA17595; Mon, 6 Mar 2000 00:27:54 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 6 Mar 2000 00:25:11 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA16884 for fwtk-users-outgoing; Mon, 6 Mar 2000 00:25:09 -0800 (PST) Message-ID: <000a01bf8744$b57f2dc0$fc00a8c0@k62350> From: "Larry Jackson" To: <5chavez@gte.net> Cc: "Firewall Toolkit (M-list)" References: <38C345CB.4FD28031@gte.net> Subject: Re: Is there a way to disable ICMP echo replys? Date: Mon, 6 Mar 2000 03:19:35 -0500 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 761 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I use ipf and setup a rule like: block in on $EXT_IF proto icmp all or to only allow the firewall to ping out I added: pass in log on $EXT_IF proto icmp from any to any icmp-type echo pass in log on $EXT_IF proto icmp from any to any icmp-type echorep pass out on $EXT_IF proto icmp from any to any Larry ----- Original Message ----- From: Chris Chavez <5chavez@gte.net> Cc: Firewall Toolkit (M-list) Sent: Monday, March 06, 2000 12:44 AM Subject: Re: think - I'm attacked - what do YOU mean ???? > Hello, > > With this thought (being invisible) in mind. Is there a way to disable ICMP echo > replys? From owner-fwtk-users@ex.tis.com Mon Mar 6 07:42 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA14526 Mon, 6 Mar 2000 07:42:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA00969; Mon, 6 Mar 2000 04:46:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 6 Mar 2000 04:43:59 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA00124 for fwtk-users-outgoing; Mon, 6 Mar 2000 04:43:58 -0800 (PST) Subject: Re: AppleTalk Date: Mon, 6 Mar 00 12:49:10 +0000 x-sender: hjc-consultants@mail.u-net.com x-mailer: Claris Emailer 1.1 From: Hillary Corney To: "Keith Young" , "Stefan Heim, Dipl.-Ing." cc: Mime-Version: 1.0 Message-Id: Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="US-ASCII" Content-Length: 1241 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, Apple Open transport TCP/IP Stack supports appletalk over tcp/ip. This works very well and provides all the usual functionality. I am sure that this could be made to pass through fwtk securely. To support AppleTalk via TCP/IP on SunOS download Netatalk with the asun patches. Cant remember the url but an internet search will quickly find it. Using Netatalk and Samba on the same Box gives you a server which can transparently serve the same directory to both MacOS and Win95/98 users great in a mixed envireonment. Hillary >"Stefan Heim, Dipl.-Ing." wrote: >> >> Have anyone a suggested methodology for running AppleTalk >> through SunOS 4 running FWTK ? > >Impossible using SunOS and the FWTK. The FWTK only supports TCP/IP. > >I don't even know of a kernel mod for SunOS 4.x which allows AppleTalk. > >Have you looked at using TCP/IP between your Apple PCs instead of >AppleTalk? > >-- >--Keith Young >-Director of Customer Care/Support, V-ONE Corp. >-kyoung@v-one.com ---------------------- H. J. Corney Tel 01705 430263 or 01705 591925 Fax 01705 591958 e.mail hjc@consultants.u-net.com From owner-fwtk-users@ex.tis.com Mon Mar 6 08:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA14679 Mon, 6 Mar 2000 08:26:16 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA03963; Mon, 6 Mar 2000 05:32:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 6 Mar 2000 05:29:58 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA03268 for fwtk-users-outgoing; Mon, 6 Mar 2000 05:29:56 -0800 (PST) Message-ID: X-Mailer: XFMail 1.3.1 [p0] on FreeBSD X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <000701bf8654$f668c760$fc00a8c0@k62350> Date: Mon, 06 Mar 2000 08:52:19 +0100 (CET) Organization: Ovita Nutricia Poland From: Mariusz Potocki To: Larry Jackson Subject: RE: [fwtk] Configuring firewall + UDPrelay for internet phone ca Cc: FWTK List Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-2 Content-Length: 753 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 05-Mar-00 Larry Jackson wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in > the > BODY of a mail message to majordomo@ex.tis.com.] > > I'm trying to properly configure my firewall to use an internet phone call > program called dialpad.com > Hi, I don't know what's dialpad.com, but I successfully installed proxy for Netmeeting and other netconferencing software. Check out PhonePatch at http://www.equival.com and http://www.openh323.org -- Mariusz Potocki Microsoft: Where do you want to go today? Linux: Where do you want to go tomorrow? FreeBSD: Are you guys coming or what? From owner-fwtk-users@ex.tis.com Mon Mar 6 15:17 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA16468 Mon, 6 Mar 2000 15:17:10 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA25318; Mon, 6 Mar 2000 12:22:23 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 6 Mar 2000 12:05:46 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA22411 for fwtk-users-outgoing; Mon, 6 Mar 2000 12:05:44 -0800 (PST) Message-ID: <20000306140745.A12400@wizard.deepthought.com> Date: Mon, 6 Mar 2000 14:07:45 -0600 From: Frank Pittel To: Rick Murphy , Frank Pittel , fwtk-users@ex.tis.com Subject: Re: Stopping relaying References: <20000302182604.K450@wizard.deepthought.com> <4.3.2.20000302195745.00b66e30@mail.itm-inst.com> Mime-Version: 1.0 X-Mailer: Mutt 0.93.2 In-Reply-To: <4.3.2.20000302195745.00b66e30@mail.itm-inst.com>; from Rick Murphy on Thu, Mar 02, 2000 at 08:00:07PM -0500 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1856 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] After wasting uncounted hours trying to get samp to work with the "yao" patches. I conceded defeat and tried to install the smapx patches. I had more luck with the "yao" patches since the smapx patch install failed completely. I am using redhat linux 5.2 with fwtk2.1. Has anyone had any luck with either the "yao" or "smapx" patches with linux? If so what do I need to do when patching smap or compiling the fwtk? I'm getting close to giving up on smap and going back to sendmail. I know it's not as secure as smap, but I know how to get it to stop relaying mail. L8R Frank On Thu, Mar 02, 2000 at 08:00:07PM -0500, Rick Murphy wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > At 06:26 PM 3/2/00 -0600, Frank Pittel wrote: > >[To be removed from this list send the message "unsubscribe fwtk-users" in the > >BODY of a mail message to majordomo@ex.tis.com.] > > > >I am in the process of trying to prevent my site from being used as a > >mail relay. I installed the "yao" patches and recompiled smap. In my > >netperm-table I added the line "smap: domain deepthought.com". > > > >While this allows me to send mail from my internal machines to > >external machines. All incoming connections are blocked. While I can > >do without the spam blocking I would really like to stop the relaying. > >Anyone know what I'm missing?? > > What I have: > smap: domains itm-inst.com *.itm-inst.com > smap: localhosts *.itm-inst.com > smap: scrub-spam 1 > smap: broken-from <> > > You show 'domain' vs. 'domains'; check that. You need the 'localhosts' line > to define who is permitted to relay through your server. > -Rick > > From owner-fwtk-users@ex.tis.com Mon Mar 6 16:53 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA16797 Mon, 6 Mar 2000 16:53:35 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA18492; Mon, 6 Mar 2000 13:59:31 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 6 Mar 2000 13:56:36 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA17580 for fwtk-users-outgoing; Mon, 6 Mar 2000 13:56:34 -0800 (PST) Date: Tue, 7 Mar 2000 08:54:53 +1100 (EST) From: Pauline van Winsen Message-ID: <200003062154.IAA13335@basil.uniq.com.au> To: fwtk-users@ex.tis.com, fwp@deepthought.com Subject: Re: Stopping relaying Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Content-MD5: eErM36+SIHXvNn4N8TSmwA== Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 917 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > I'm getting close to giving up on smap and going back to sendmail. I > know it's not as secure as smap, but I know how to get it to stop > relaying mail. try smtpd... http://www.obtuse.com/smtpd.html it's a replacement for smap/smapd & it has excellent anti-spam features. i've been running it for many years. cheers, pauline Pauline van Winsen, Senior Technical Consultant pauline@eserv.com.au eServ Pty Ltd http://www.eserv.com.au/people/pauline.html "Another matter which must be left to your escort in restaurant dining is any communication with the waiter. If you want something that is not on the table you never ask the waiter direct, but ask your escort if he will ask the waiter for it." Dining Out - Book 3, Woman's World, circa 1964. From owner-fwtk-users@ex.tis.com Mon Mar 6 17:18 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA16870 Mon, 6 Mar 2000 17:18:52 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA23091; Mon, 6 Mar 2000 14:24:46 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 6 Mar 2000 14:22:22 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA22182 for fwtk-users-outgoing; Mon, 6 Mar 2000 14:22:20 -0800 (PST) From: thiel@zeus.univ-metz.fr Message-Id: <200003062219.XAA01133@zeus.lettres.univ-metz.fr> To: FWTK List Date: Mon, 6 Mar 2000 23:23:58 +0100 MIME-Version: 1.0 Subject: fwtk on alpha X-mailer: Pegasus Mail for Win32 (v3.01d) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from Quoted-printable to 8bit by relay2.nai.com id OAA22169 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=ISO-8859-1 Content-Length: 426 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hello, I'am currently running linux on an alpha platform. Does fwtk run on that platform ? Are there some know bugs ? Thanks Robert Robert Thiel Ufr lettres et Sciences Humaines Administrateur réseau tel : +33 3 87 31 59 61 tel : +33 6 60 83 61 95 e_mail : thiel@zeus.lettres.univ-metz.fr From owner-fwtk-users@ex.tis.com Mon Mar 6 17:33 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA16912 Mon, 6 Mar 2000 17:33:54 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA25730; Mon, 6 Mar 2000 14:39:50 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 6 Mar 2000 14:37:05 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA24853 for fwtk-users-outgoing; Mon, 6 Mar 2000 14:37:03 -0800 (PST) Message-Id: <4.3.2.20000306172234.00b72d70@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Mon, 06 Mar 2000 17:23:31 -0500 To: Frank Pittel , Frank Pittel , fwtk-users@ex.tis.com From: Rick Murphy Subject: Re: Stopping relaying In-Reply-To: <20000306140745.A12400@wizard.deepthought.com> References: <4.3.2.20000302195745.00b66e30@mail.itm-inst.com> <20000302182604.K450@wizard.deepthought.com> <4.3.2.20000302195745.00b66e30@mail.itm-inst.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 539 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 02:07 PM 3/6/00 -0600, Frank Pittel wrote: >After wasting uncounted hours trying to get samp to work with the >"yao" patches. I conceded defeat and tried to install the smapx >patches. I had more luck with the "yao" patches since the smapx patch >install failed completely. What problem are you having with Joe's patches? Failure to build, or failure to work? What symptoms are you seeing? -Rick From owner-fwtk-users@ex.tis.com Mon Mar 6 23:47 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA18237 Mon, 6 Mar 2000 23:47:43 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA20288; Mon, 6 Mar 2000 20:53:39 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 6 Mar 2000 20:50:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id UAA19503 for fwtk-users-outgoing; Mon, 6 Mar 2000 20:50:37 -0800 (PST) Message-ID: <38C48A83.41A1425F@yahoo.com> Date: Tue, 07 Mar 2000 10:20:11 +0530 From: Naresh Narang X-Mailer: Mozilla 4.7 [en] (Win95; I) X-Accept-Language: en MIME-Version: 1.0 To: "fwtk-users@ex.tis.com" Subject: Attacks and Role of FWTK Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1415 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I got following messages in my /var/log/messages: portmap[447]: connect from 212.171.166.222 to dump(): request from unauthorized host Mar 6 00:00:46 portmap[448]: connect from 212.171.166.222 to getport(mountd): request from unauthorized host Lame server on '38.220.67.206.in-addr.arpa' (in '220.67.206.in-addr.arpa'?): [198.6.1.83].53 'AUTH03.NS.UU.NET' Mar 6 14:12:26 named[311]: bad referral (. !< timesindia.COM) ns_forw: query(6.241.123.131.in-addr.arpa) A RR negative cache entry (KSUVXA.KENT.EDU:) Mar 6 14:33:21 identd[887]: from: 131.123.241.6 ( mars.internet2.kent.edu ) for: 8986, 80 Mar 6 14:33:21 identd[887]: Returned: 8986 , 80 : NO-USER Mar 6 14:33:29 named[311]: Lame server on 'dune.mcs.kent.edu' (in 'MCS.KENT.EDU'?): [131.123.1.1].53 'ns.net.kent.edu' Mar 6 14:33:59 identd[889]: from: 131.123.241.2 ( dune.internet2.kent.edu ) for: 9063, 80 Mar 6 14:33:59 identd[889]: Returned: 9063 , 80 : NO-USER Mar 6 14:33:59 identd[888]: from: 131.123.241.2 ( dune.internet2.kent.edu ) for: 9140, 80 Mar 6 14:34:00 identd[888]: Returned: 9140 , 80 : NO-USER Please tell me: What type of attacks are these. Is any proxy required for portmapper. What is the intension of the attacker and how to prevent it. Thank You, Naresh Narang From owner-fwtk-users@ex.tis.com Tue Mar 7 00:10 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id AAA18269 Tue, 7 Mar 2000 00:10:37 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id VAA22368; Mon, 6 Mar 2000 21:16:34 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 6 Mar 2000 21:14:33 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA21698 for fwtk-users-outgoing; Mon, 6 Mar 2000 21:14:32 -0800 (PST) Date: Mon, 6 Mar 2000 21:12:05 -0800 From: Dave Diemer To: Naresh Narang cc: "fwtk-users@ex.tis.com" Subject: Re: Attacks and Role of FWTK In-Reply-To: <38C48A83.41A1425F@yahoo.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2145 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] How do you have your DNS setup? These are mostly DNS errors. It appears you have a setup for only known hosts but I could be wrong... Remember: portmap is a server that converts RPC program numbers into TCP or UDP protocol port numbers. It must be running in order to make RPC calls. I belive "DNS calls" fall under this procedure. Dave- On Tue, 7 Mar 2000, Naresh Narang wrote: |Date: Tue, 07 Mar 2000 10:20:11 +0530 |From: Naresh Narang |To: "fwtk-users@ex.tis.com" |Subject: Attacks and Role of FWTK | |[To be removed from this list send the message "unsubscribe fwtk-users" in the |BODY of a mail message to majordomo@ex.tis.com.] | |Hello, | | I got following messages in my /var/log/messages: | | |portmap[447]: connect from 212.171.166.222 to dump(): request from |unauthorized host |Mar 6 00:00:46 portmap[448]: connect from 212.171.166.222 to |getport(mountd): request from unauthorized host | | |Lame server on '38.220.67.206.in-addr.arpa' (in |'220.67.206.in-addr.arpa'?): [198.6.1.83].53 'AUTH03.NS.UU.NET' |Mar 6 14:12:26 named[311]: bad referral (. !< timesindia.COM) | | |ns_forw: query(6.241.123.131.in-addr.arpa) A RR negative cache entry |(KSUVXA.KENT.EDU:) |Mar 6 14:33:21 identd[887]: from: 131.123.241.6 ( |mars.internet2.kent.edu ) for: 8986, 80 |Mar 6 14:33:21 identd[887]: Returned: 8986 , 80 : NO-USER |Mar 6 14:33:29 named[311]: Lame server on 'dune.mcs.kent.edu' (in |'MCS.KENT.EDU'?): [131.123.1.1].53 'ns.net.kent.edu' |Mar 6 14:33:59 identd[889]: from: 131.123.241.2 ( |dune.internet2.kent.edu ) for: 9063, 80 |Mar 6 14:33:59 identd[889]: Returned: 9063 , 80 : NO-USER |Mar 6 14:33:59 identd[888]: from: 131.123.241.2 ( |dune.internet2.kent.edu ) for: 9140, 80 |Mar 6 14:34:00 identd[888]: Returned: 9140 , 80 : NO-USER | | |Please tell me: What type of attacks are these. Is any proxy required |for portmapper. What is the intension of the attacker and how to prevent |it. | |Thank You, |Naresh Narang | From owner-fwtk-users@ex.tis.com Tue Mar 7 00:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id AAA18327 Tue, 7 Mar 2000 00:38:05 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id VAA24528; Mon, 6 Mar 2000 21:44:01 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 6 Mar 2000 21:41:58 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA23853 for fwtk-users-outgoing; Mon, 6 Mar 2000 21:41:57 -0800 (PST) Message-ID: <38C4965F.E6E3504@yahoo.com> Date: Tue, 07 Mar 2000 11:10:47 +0530 From: Naresh Narang X-Mailer: Mozilla 4.7 [en] (Win95; I) X-Accept-Language: en MIME-Version: 1.0 To: Dave Diemer , "fwtk-users@ex.tis.com" Subject: Re: Attacks References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1609 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] The DNS is having entry for the only known host and that is firewall host. There are no Internal ip addresses on this host. Internal DNS is forwarder to the firewall host. Someone from "Outside" is trying for a "dump" and for "getport(mountd)". What it could be? Thank You Naresh Narang Dave Diemer wrote: > How do you have your DNS setup? These are mostly > DNS errors. It appears you have a setup for only > known hosts but I could be wrong... > > Remember: > > portmap is a server that converts RPC program numbers into TCP or UDP > protocol port numbers. It must be running in order to make RPC calls. > > I belive "DNS calls" fall under this procedure. > > Dave- > > |portmap[447]: connect from 212.171.166.222 to dump(): request from > |unauthorized host > |Mar 6 00:00:46 portmap[448]: connect from 212.171.166.222 to > |getport(mountd): request from unauthorized host > | > | > |Lame server on '38.220.67.206.in-addr.arpa' (in > |'220.67.206.in-addr.arpa'?): [198.6.1.83].53 'AUTH03.NS.UU.NET' > |Mar 6 14:12:26 named[311]: bad referral (. !< timesindia.COM) > | > | > |ns_forw: query(6.241.123.131.in-addr.arpa) A RR negative cache entry > |(KSUVXA.KENT.EDU:) > |Mar 6 14:33:21 identd[887]: from: 131.123.241.6 ( > |mars.internet2.kent.edu ) for: 8986, 80 > | > | > |Please tell me: What type of attacks are these. Is any proxy required > |for portmapper. What is the intension of the attacker and how to prevent > |it. > | > |Thank You, > |Naresh Narang > | From owner-fwtk-users@ex.tis.com Tue Mar 7 07:04 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA21147 Tue, 7 Mar 2000 07:04:47 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA12244; Tue, 7 Mar 2000 04:10:45 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 04:06:10 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA10786 for fwtk-users-outgoing; Tue, 7 Mar 2000 04:06:07 -0800 (PST) Message-Id: <4.3.2.20000307070018.00b69610@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Tue, 07 Mar 2000 07:00:48 -0500 To: Dave Diemer , Naresh Narang From: Rick Murphy Subject: Re: Attacks and Role of FWTK Cc: "fwtk-users@ex.tis.com" In-Reply-To: References: <38C48A83.41A1425F@yahoo.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 458 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 09:12 PM 3/6/00 -0800, Dave Diemer wrote: >portmap is a server that converts RPC program numbers into TCP or UDP >protocol port numbers. It must be running in order to make RPC calls. > >I belive "DNS calls" fall under this procedure. I think you meant "NFS calls" (network file system). DNS doesn't use RPC. -Rick From owner-fwtk-users@ex.tis.com Tue Mar 7 07:05 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA21153 Tue, 7 Mar 2000 07:04:59 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA12248; Tue, 7 Mar 2000 04:10:45 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 04:06:09 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA10785 for fwtk-users-outgoing; Tue, 7 Mar 2000 04:06:06 -0800 (PST) Message-Id: <4.3.2.20000307065106.00b6ae00@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Tue, 07 Mar 2000 07:00:14 -0500 To: Naresh Narang , "fwtk-users@ex.tis.com" From: Rick Murphy Subject: Re: Attacks and Role of FWTK In-Reply-To: <38C48A83.41A1425F@yahoo.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 2480 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:20 AM 3/7/00 +0530, Naresh Narang wrote: >portmap[447]: connect from 212.171.166.222 to dump(): request from >unauthorized host Portmap is used to locate RPC endpoints. The 'dump' request to the portmapper asks it to provide a list of all the RPC services running on your machine. You obviously have portmap wrapped so it rejected the request. An attempt on your portmapper is often the first step of a Script Kiddie attack. >Mar 6 00:00:46 portmap[448]: connect from 212.171.166.222 to >getport(mountd): request from unauthorized host Yup, it's an attack. Next, they try to connect to your NFS (network file system) mount daemon. There's a nasty set of buffer overflows here as well that the kids use. >Lame server on '38.220.67.206.in-addr.arpa' (in >'220.67.206.in-addr.arpa'?): [198.6.1.83].53 'AUTH03.NS.UU.NET' >Mar 6 14:12:26 named[311]: bad referral (. !< timesindia.COM) Someone doesn't have their DNS set up right. This isn't an indication of an attack. >ns_forw: query(6.241.123.131.in-addr.arpa) A RR negative cache entry >(KSUVXA.KENT.EDU:) Similar to the above (I think - I've never seen that one..) >Mar 6 14:33:21 identd[887]: from: 131.123.241.6 ( >mars.internet2.kent.edu ) for: 8986, 80 >Mar 6 14:33:21 identd[887]: Returned: 8986 , 80 : NO-USER If someone just browsed the kent.edu web site, this could be legit. >Mar 6 14:33:29 named[311]: Lame server on 'dune.mcs.kent.edu' (in >'MCS.KENT.EDU'?): [131.123.1.1].53 'ns.net.kent.edu' >Mar 6 14:33:59 identd[889]: from: 131.123.241.2 ( >dune.internet2.kent.edu ) for: 9063, 80 >Mar 6 14:33:59 identd[889]: Returned: 9063 , 80 : NO-USER >Mar 6 14:33:59 identd[888]: from: 131.123.241.2 ( >dune.internet2.kent.edu ) for: 9140, 80 >Mar 6 14:34:00 identd[888]: Returned: 9140 , 80 : NO-USER Ditto. >Please tell me: What type of attacks are these. Is any proxy required >for portmapper. What is the intension of the attacker and how to prevent >it. You shouldn't be running portmapper on your firewall. However, you appear to be running it wrapped to deny external access (that's the default on current versions of RedHat.) Your system was probed in the first case, but it turned the attack away. Nothing to get worried about; if it's a single instance, it's not worth reporting IMHO - repeated attempts are another case. -Rick From owner-fwtk-users@ex.tis.com Tue Mar 7 07:13 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA21197 Tue, 7 Mar 2000 07:13:25 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA14520; Tue, 7 Mar 2000 04:19:24 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 04:17:14 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA13688 for fwtk-users-outgoing; Tue, 7 Mar 2000 04:17:13 -0800 (PST) Message-Id: Mime-Version: 1.0 Date: Tue, 7 Mar 2000 12:36:35 -0800 To: fwtk-users@lists.nai.com From: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.) Subject: Problem with inetd Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 773 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] "inetd" writes the following error message to "var/adm/messages": xxxxx inetd[411] : accept: Too many open files xxxxx inetd[411] : last message repeated 153693 times and FWTK not works just after the server(Sparc 2 under SunOS 4.1.2) was rebooted. What ist to do ? Thanks! /--------------------------------o00-----00o-------------------------\ Stefan Heim Uni Ulm Sektion Informatik in der Psychotherapie Am Hochstraess 8 89081 Ulm Germany E-Mail: heim@sip.Medizin.Uni-Ulm.de http://sip.medizin.uni-ulm.de Tel: +49-(0)731-50-25702 Fax: +49-(0)731-50-25662 \-------------------------------ooo0-----0ooOo---------------------/ From owner-fwtk-users@ex.tis.com Tue Mar 7 07:20 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA21218 Tue, 7 Mar 2000 07:20:16 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA16008; Tue, 7 Mar 2000 04:26:15 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 04:24:21 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA15329 for fwtk-users-outgoing; Tue, 7 Mar 2000 04:24:20 -0800 (PST) To: fwtk-users@ex.tis.com Subject: Re: Stopping relaying Cc: fwp@deepthought.com X-Sun-Charset: US-ASCII Message-Id: <20000307122340.B42FC2C15B@skynet.medar.com> Date: Tue, 7 Mar 2000 07:23:40 -0500 (EST) From: jseymour@medar.com (James Seymour) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1762 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Message-ID: <20000306140745.A12400@wizard.deepthought.com> > Date: Mon, 6 Mar 2000 14:07:45 -0600 > From: Frank Pittel > Subject: Re: Stopping relaying > > After wasting uncounted hours trying to get samp to work with ... [snip] > [I'm beginning to feel like a broken record :-)] I didn't like smap/smapd/sendmail even on the commercial Gauntlet firewall I run, so I replaced 'em with Postfix (http://www.postfix.org). Works like a champ. And spam is reduced greatly. Postfix uses an architecture similar to the smap/smapd/sendmail combination used by Gauntlet/FWTK. (If you're really paranoid, even supports chroot'ing for most of its components.) But it is a complete "from-scratch" project with its emphasis being the creation of a secure e-mail MTA. Its creator is Wietse Venema. (Author of TCP wrappers and other tools. Co-author of SATAN.) One of Postfix's best features, IMO, is that its configuration files don't look like line noise :-). Remember: FWTK is a *toolkit*. You don't have to use all of *its* components. It's perfectly all right to replace some components with others, add components, not run certain components entirely, etc. That's one of its advantages over monolithic/closed solutions. (Just as long as you: a) know what you're doing and b) are careful, so you don't compromise the firewall or what it's protecting.) Regards, Jim -- Jim Seymour | Medar, Inc. jseymour@medar.com | 24775 Crestview Ct. Systems & Network Administrator | Farmington Hills, MI. 48335 | FAX: (248)477-8897 From owner-fwtk-users@ex.tis.com Tue Mar 7 08:36 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA21584 Tue, 7 Mar 2000 08:36:40 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA21362; Tue, 7 Mar 2000 05:42:39 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 05:38:41 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA20405 for fwtk-users-outgoing; Tue, 7 Mar 2000 05:38:39 -0800 (PST) Date: Tue, 7 Mar 2000 08:36:47 -0500 (EST) From: Ted Keller To: Naresh Narang cc: "fwtk-users@ex.tis.com" Subject: Re: Attacks and Role of FWTK In-Reply-To: <38C48A83.41A1425F@yahoo.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1858 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Naresh, Why do you have port map running on a firewall. RPC calls are always a source of vulnerabilities. If at all possible, remove all portmapper and all rpc services... ted keller On Tue, 7 Mar 2000, Naresh Narang wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello, > > I got following messages in my /var/log/messages: > > > portmap[447]: connect from 212.171.166.222 to dump(): request from > unauthorized host > Mar 6 00:00:46 portmap[448]: connect from 212.171.166.222 to > getport(mountd): request from unauthorized host > > > Lame server on '38.220.67.206.in-addr.arpa' (in > '220.67.206.in-addr.arpa'?): [198.6.1.83].53 'AUTH03.NS.UU.NET' > Mar 6 14:12:26 named[311]: bad referral (. !< timesindia.COM) > > > ns_forw: query(6.241.123.131.in-addr.arpa) A RR negative cache entry > (KSUVXA.KENT.EDU:) > Mar 6 14:33:21 identd[887]: from: 131.123.241.6 ( > mars.internet2.kent.edu ) for: 8986, 80 > Mar 6 14:33:21 identd[887]: Returned: 8986 , 80 : NO-USER > Mar 6 14:33:29 named[311]: Lame server on 'dune.mcs.kent.edu' (in > 'MCS.KENT.EDU'?): [131.123.1.1].53 'ns.net.kent.edu' > Mar 6 14:33:59 identd[889]: from: 131.123.241.2 ( > dune.internet2.kent.edu ) for: 9063, 80 > Mar 6 14:33:59 identd[889]: Returned: 9063 , 80 : NO-USER > Mar 6 14:33:59 identd[888]: from: 131.123.241.2 ( > dune.internet2.kent.edu ) for: 9140, 80 > Mar 6 14:34:00 identd[888]: Returned: 9140 , 80 : NO-USER > > > Please tell me: What type of attacks are these. Is any proxy required > for portmapper. What is the intension of the attacker and how to prevent > it. > > Thank You, > Naresh Narang > From owner-fwtk-users@ex.tis.com Tue Mar 7 09:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA21958 Tue, 7 Mar 2000 09:45:58 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA00468; Tue, 7 Mar 2000 06:51:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 06:48:29 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA29355 for fwtk-users-outgoing; Tue, 7 Mar 2000 06:48:28 -0800 (PST) X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E99561150A3@exchange.pdv.de> From: "Dirk.Nerling" To: "Firewall Toolkit (M-list)" Subject: plan a Firewall with fwtk and a DMZ Date: Tue, 7 Mar 2000 15:47:38 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 3267 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello all, I'm running fwtk for years now and I'm quite happy with this. I did it in the normal dual homed configuration but now I plan to install a DMZ. I read all I found about a DMZ but unfortunately I still have some questions. The firewall (FreeBSD 3.4) could be a 600Mhz, PIII with 256 MB and 3 x 100MB NIC. Here is the setup I plan: Internet / ISP with squid and NNTP Server | | speed: some more than a T1 (2MB) | cisco (normal without firewall ios) | | FW NIC1 with offical ip H -- www server with ~5 virtuell domains, plans to install a shop system and portal (I'm afraid a lot of traffic) (external DNS) | FWTK , smap, http-gw U -- one anonymous ftp server and some private ftp servers (not too much traffic) | FW NIC2 with rfc 1918 ip -------DMZ -------- B -- squid for providing web cache for my internal users (a lot of traffic) sendmail, http-gw, ftp-gw, plug-gw for nntp to our isp FW NIC3 with other rfc 1988 ip | |------------------ internal net with clients, internal dns, internal mail server with subdomains ... now my questions: 1. Gernell: 1.1 Will the firewall with FreeBSD and TIS have the power to serve all requests (external: www with portal, webbrowsing from the internal net and so on) 1.2. Should I run the external DNS really at the firewall, if so I'd like to use chroot - or should/could I put them in the DMZ? 1.3 I often hear that people put thier mailserver in the DMZ, why? Isn't it easier and more secure, to use smap external save the mail to disk and deliever internal with sendmail? 1.3 I need to route mail for the virtuell domains also through the firewall, do I need a sendmail.cf for each virtuell domain? 2. W3 related: 2.1. How do I setup virtuell webdomains, if the webserver have rfc 1918 ip's (put all virtuell ip's on the FW NIC 1?) 2.2. Could http-gw work with virtuell domains or could/should I use plug-gw? 2.3. Will http-gw be stable and quick enough to serve squid and my virtuell domains and will this combination do what I want? 2.4. I also use the squid of my isp as a second cache - and I afraid this wont work any longer because they need udp - right? 2.5 Is running squid at the firewall a problem - do I need to put them in the DMZ? 3. ftp related: 3.1. I could use plug-gw to stream the external ftp connects to my internal anonymous ftp server, but who about virtuell domains? Sorry to ask such dumb questions but I can't find answers at www.fwtk.org nor at previous postings of the fwtk mailling list. Hope we could discuss the problem and perhaps I'm able to write a DMZ part of the FAQ. best regards and MANY thanks in advance! Dirk Nerling -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de From owner-fwtk-users@ex.tis.com Tue Mar 7 11:29 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA22647 Tue, 7 Mar 2000 11:29:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA17055; Tue, 7 Mar 2000 08:35:31 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 08:31:34 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA15779 for fwtk-users-outgoing; Tue, 7 Mar 2000 08:31:32 -0800 (PST) Message-Id: <200003071240.HAA00462@voyager.eagletrim.com> From: "Wes Szumera" Organization: Eagle Trim Inc. To: fwtk-users@ex.tis.com Date: Tue, 7 Mar 2000 11:30:41 -0500 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: problem with Chrysler and plug-gw In-reply-to: <6CC81B07CB44D311A1D20001FA7E99561150A3@exchange.pdv.de> X-mailer: Pegasus Mail for Win32 (v3.01d) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 776 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Is anyone having a problem connecting to Daimler-Chrysler's spin system? I had things working great until yesterday when they changed addresses. Thanks, Wes Szumera Netperm-table tn3270: port tn3270 10.31.14.* 10.31.11.* -plug-to 208.154.80.148 -port tn3270 C:\windows\hosts 10.31.11.49 wc3270.extra.daimlerchrysler.com #10.31.11.49 address of proxy server internal interface inetd.conf tn3270 stream tcp nowait root /usr/local/etc/plug-gw plug-gw tn3270 Wes Szumera Plant Engineer Eagle Trim Inc. 0829 US 131 NW Kalkaska, MI 49646-0460 voice 231 258 4150 ext 3024 fax 231 258 4153 From owner-fwtk-users@ex.tis.com Tue Mar 7 13:46 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA25052 Tue, 7 Mar 2000 13:46:37 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA08212; Tue, 7 Mar 2000 10:52:35 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 10:48:54 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA07053 for fwtk-users-outgoing; Tue, 7 Mar 2000 10:48:50 -0800 (PST) Message-ID: <38C54E2E.1BE53C63@highlander.com> Date: Tue, 07 Mar 2000 13:45:02 -0500 From: Johnny Hall Organization: Highlander Engineering X-Mailer: Mozilla 4.7 [en] (X11; I; SunOS 5.7 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: "Toolkit, Firewall" Subject: Performance Issue Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="------------BD5CF572882C5397D9C3A370" Content-Length: 2187 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. --------------BD5CF572882C5397D9C3A370 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sorry if this is a newbie question, but I am new to firewalls. ;) We are running FWTK on a Sparc 5 w/Solaris 7. We only have ftp-gw and http-gw setup. We have recently been having serious performance issues. I have checked the system out and even forced our hme card to 100mb/fd but the problem persists. If anyone has any ideas on what to check I'd be greatly in your debt. The only thing I see being logged is in /var/adm/messages and it looks like everytime an http request is sent. Here is a tail of /var/adm/messages. Mar 7 13:45:25 nameserv http-gw[6872]: 208.208.208.100 host address lookup failed Mar 7 13:45:25 nameserv http-gw[6873]: 208.208.208.100 host address lookup failed Mar 7 13:45:27 nameserv http-gw[6874]: 208.208.208.100 host address lookup failed Mar 7 13:45:28 nameserv http-gw[6875]: 208.208.208.100 host address lookup failed Mar 7 13:48:04 nameserv http-gw[1306]: Timeout during read after 7200 seconds Mar 7 13:48:37 nameserv http-gw[6892]: 208.208.208.100 host address lookup failed Mar 7 13:49:11 nameserv http-gw[6874]: Network connection closed during write Mar 7 13:49:13 nameserv http-gw[6875]: Network connection closed during write Thanks, Johnny -- "Nothing is more difficult than the art of maneuvering for advantageous positions." - Sun Tzu --------------BD5CF572882C5397D9C3A370 Content-Type: text/x-vcard; charset=us-ascii; name="johnny.vcf" Content-Transfer-Encoding: 7bit Content-Description: Card for Johnny Hall Content-Disposition: attachment; filename="johnny.vcf" begin:vcard n:Hall;Johnny tel;fax:863-687-7767 tel;work:863-687-7767 x-mozilla-html:FALSE url:http://www.highlander.com org:Highlander Engineering adr:;;208 East Pine Street;Lakeland;Fl;33801;USA version:2.1 email;internet:johnny@highlander.com title:Systems Administrator x-mozilla-cpt:;0 fn:Johnny Hall end:vcard --------------BD5CF572882C5397D9C3A370-- From owner-fwtk-users@ex.tis.com Tue Mar 7 19:47 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA26443 Tue, 7 Mar 2000 19:47:56 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA27007; Tue, 7 Mar 2000 16:53:44 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 16:48:00 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA26053 for fwtk-users-outgoing; Tue, 7 Mar 2000 16:47:57 -0800 (PST) From: "Luis Fernando Barrera" To: Subject: Remote access to the Firewall Date: Tue, 7 Mar 2000 18:29:24 -0600 Message-ID: Mime-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id QAA26032 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 468 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi All, Does anyone know about a secure way to make a telnet to the firewall server? Maybe like using a telnet server which only binds to the internal interface? I know that the tn-gw can bind to certain interfaces... Is there a way to do the same with the normal telnet? Thanks in advance Luis Fernando Barrera luba@assist.com.gt From owner-fwtk-users@ex.tis.com Tue Mar 7 21:15 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA26792 Tue, 7 Mar 2000 21:15:26 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA04391; Tue, 7 Mar 2000 18:21:25 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 18:18:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA03551 for fwtk-users-outgoing; Tue, 7 Mar 2000 18:18:37 -0800 (PST) Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: References: Date: Tue, 7 Mar 2000 19:14:28 -0700 To: Ted Keller , Naresh Narang From: Blair Lowe Subject: Re: Attacks and Role of FWTK Cc: "fwtk-users@ex.tis.com" Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 2926 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Naresh, I am assuming that you are running UNIX: You should look at your inetd.conf file, and comment out any services that you don't need, or are insecure. portmap and NFS are definitely a no no on a firewall, but that is a stand alone daemon (ie. not part of inetd services). NIS and SMB (SAMBA or Microsoft type file services) also a risk on a firewall. If you need these services, then you should create an encrypted link (eg. IPsec, or CIPE) between your firewall, and the firewall of the LAN that you would like to connect to. There is nothing wrong with running networking programs out of the inetd realm, but they must be ones that are known to be secure. Hope this helps, Blair. At 08:36 -0500 2000/03/07, Ted Keller wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >Naresh, > >Why do you have port map running on a firewall. RPC calls are always a >source of vulnerabilities. If at all possible, remove all portmapper and >all rpc services... > >ted keller > > >On Tue, 7 Mar 2000, Naresh Narang wrote: > >> [To be removed from this list send the message "unsubscribe >>fwtk-users" in the >> BODY of a mail message to majordomo@ex.tis.com.] >> >> Hello, >> >> I got following messages in my /var/log/messages: >> >> >> portmap[447]: connect from 212.171.166.222 to dump(): request from >> unauthorized host >> Mar 6 00:00:46 portmap[448]: connect from 212.171.166.222 to >> getport(mountd): request from unauthorized host >> >> >> Lame server on '38.220.67.206.in-addr.arpa' (in >> '220.67.206.in-addr.arpa'?): [198.6.1.83].53 'AUTH03.NS.UU.NET' >> Mar 6 14:12:26 named[311]: bad referral (. !< timesindia.COM) >> >> >> ns_forw: query(6.241.123.131.in-addr.arpa) A RR negative cache entry >> (KSUVXA.KENT.EDU:) >> Mar 6 14:33:21 identd[887]: from: 131.123.241.6 ( >> mars.internet2.kent.edu ) for: 8986, 80 >> Mar 6 14:33:21 identd[887]: Returned: 8986 , 80 : NO-USER >> Mar 6 14:33:29 named[311]: Lame server on 'dune.mcs.kent.edu' (in >> 'MCS.KENT.EDU'?): [131.123.1.1].53 'ns.net.kent.edu' >> Mar 6 14:33:59 identd[889]: from: 131.123.241.2 ( >> dune.internet2.kent.edu ) for: 9063, 80 >> Mar 6 14:33:59 identd[889]: Returned: 9063 , 80 : NO-USER >> Mar 6 14:33:59 identd[888]: from: 131.123.241.2 ( >> dune.internet2.kent.edu ) for: 9140, 80 >> Mar 6 14:34:00 identd[888]: Returned: 9140 , 80 : NO-USER >> >> >> Please tell me: What type of attacks are these. Is any proxy required >> for portmapper. What is the intension of the attacker and how to prevent >> it. >> >> Thank You, >> Naresh Narang >> > Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) From owner-fwtk-users@ex.tis.com Tue Mar 7 21:20 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA26814 Tue, 7 Mar 2000 21:20:26 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA05893; Tue, 7 Mar 2000 18:26:24 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 18:23:59 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA05045 for fwtk-users-outgoing; Tue, 7 Mar 2000 18:23:58 -0800 (PST) Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: References: Date: Tue, 7 Mar 2000 19:20:09 -0700 To: "Luis Fernando Barrera" , From: Blair Lowe Subject: Re: Remote access to the Firewall Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 1054 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I know this is not an answer to your question, but you should be using ssh, not telnet for secure sessions from the Internet. Everything is encrypted. telnet has a few security problems on its own (like plain text passwords, and session hijacking for starters). Blair. At 18:29 -0600 2000/03/07, Luis Fernando Barrera wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >Hi All, > >Does anyone know about a secure way to make a telnet >to the firewall server? >Maybe like using a telnet server which only binds to the internal interface? > >I know that the tn-gw can bind to certain interfaces... Is there a way >to do the same with the normal telnet? > >Thanks in advance > >Luis Fernando Barrera >luba@assist.com.gt Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) From owner-fwtk-users@ex.tis.com Tue Mar 7 22:33 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA27054 Tue, 7 Mar 2000 22:33:49 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA13378; Tue, 7 Mar 2000 19:39:44 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Mar 2000 19:37:06 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA12513 for fwtk-users-outgoing; Tue, 7 Mar 2000 19:37:03 -0800 (PST) Message-Id: <4.3.2.20000307222040.00b73850@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Tue, 07 Mar 2000 22:21:18 -0500 To: "Luis Fernando Barrera" , From: Rick Murphy Subject: Re: Remote access to the Firewall In-Reply-To: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 438 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 06:29 PM 3/7/00 -0600, Luis Fernando Barrera wrote: >I know that the tn-gw can bind to certain interfaces... Is there a way >to do the same with the normal telnet? That's what netacl is for - to permit you to bind a program (like telnetd) to specific addresses without having to modify it. -Rick From owner-fwtk-users@ex.tis.com Wed Mar 8 07:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA29168 Wed, 8 Mar 2000 07:26:18 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA00459; Wed, 8 Mar 2000 04:32:16 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 04:27:31 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA28707 for fwtk-users-outgoing; Wed, 8 Mar 2000 04:27:30 -0800 (PST) Message-ID: <38C64697.DC2E828E@jamedia.com> Date: Wed, 08 Mar 2000 07:24:55 -0500 From: Scott McEachern X-Mailer: Mozilla 4.7 [en] (X11; U; Linux 2.2.14 i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk users Subject: DNS and NTP Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 878 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I hope this isn't too much of a bone-head question, but I'm setting up my first firewall with fwtk2.1 and could use a little help. (My ultimate goal out of this exercise is to get mail flowing properly through my firewall.) I will be running two name servers behind my firewall, serving public (192.168) IPs, but I also need them to resolve real names. How do I get the fwtk to allow name queries, and their replies? I really don't want to have the firewall acting as a name server. Another question, similar to the above, is the same but for network time (NTP.) Can anyone help me out here? I'm running fwtk2.1, on OpenBSD 2.6. Thank-you in advance! -- R. Scott McEachern Network Administrator J&A Media Services, Inc. From owner-fwtk-users@ex.tis.com Wed Mar 8 08:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA29501 Wed, 8 Mar 2000 08:38:31 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA10454; Wed, 8 Mar 2000 05:44:27 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 05:37:18 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA08432 for fwtk-users-outgoing; Wed, 8 Mar 2000 05:37:12 -0800 (PST) From: "Matthew P. Barnson" Reply-To: barnboy@imall.com Organization: Excite@Home E-Business Services To: fwtk-users@lists.nai.com Subject: Re: newbie pop3 and DNS Date: Tue, 7 Mar 2000 21:11:08 -0700 X-Mailer: KMail [version 1.0.28] References: <200003011714.UAA14805@paranoid.eltex.spb.ru> In-Reply-To: <200003011714.UAA14805@paranoid.eltex.spb.ru> MIME-Version: 1.0 Message-Id: <00030721154100.01555@bossnass> Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1076 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] It is extremely common for ISP's to use tcp_wrappers to secure POP3 connections. We use it here, and it's pretty effective. One of the most effective solutions we've found to passing passwords in cleartext across the Internet involves either the use of a hardware VPN solution, or SSH to tunnel the connection, like this: ssh -C -L 4110:localhost:110 remote.host.domain.com Then you set up your plug to POP the mail through "localhost:4110" and voila! you're running your POP3 requests over an encrypted tunnel. This is, of course, assuming the host from whom you're popping the mail allows you to connect via SSH. If they don't, encourage them to. SSH port forwarding is a complicated subject, but once you've mastered how it works it's an extremely powerful tool for encrypting what you'd rather not have in the clear. -- Matthew P. Barnson mbarnson@excitehome.net Mgr,Systems Administration Excite@Home E-business Services From owner-fwtk-users@ex.tis.com Wed Mar 8 08:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA29497 Wed, 8 Mar 2000 08:38:30 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA10442; Wed, 8 Mar 2000 05:44:26 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 05:37:04 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA08399 for fwtk-users-outgoing; Wed, 8 Mar 2000 05:36:56 -0800 (PST) From: "Matthew P. Barnson" Reply-To: barnboy@imall.com Organization: Excite@Home E-Business Services To: fwtk-users@lists.nai.com Subject: Re: newbie transparent proxy Date: Tue, 7 Mar 2000 21:15:49 -0700 X-Mailer: KMail [version 1.0.28] References: <38C11895.8C369BAF@rossi.net> In-Reply-To: <38C11895.8C369BAF@rossi.net> MIME-Version: 1.0 Message-Id: <00030721211301.01555@bossnass> Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 772 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Remember to distinguish the FWTK, a set of proxies used for firewalling, from the underlying routing/IPMasq/NAT structure. Yes, you can transparently proxy using the FWTK, but you need intelligent rules that will allow transparency. The basic concept is to intercept any outbound port 80 traffic and redirect it to http-gw. You may want to check the excellent FAQ that answers this question at http://www.squid-cache.org . You scratched this in the dirt on Sat, 04 Mar 2000: > Can I use the TIS FWTK as Transparent Proxy -- Matthew P. Barnson mbarnson@excitehome.net Mgr,Systems Administration Excite@Home E-business Services From owner-fwtk-users@ex.tis.com Wed Mar 8 11:08 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA00265 Wed, 8 Mar 2000 11:08:01 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA06119; Wed, 8 Mar 2000 08:13:59 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 08:10:28 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA04987 for fwtk-users-outgoing; Wed, 8 Mar 2000 08:10:25 -0800 (PST) Message-ID: From: "Lidgate, Chris A" To: "'Scott McEachern'" Cc: "'fwtk-users@ex.tis.com'" Subject: RE: DNS and NTP Date: Wed, 8 Mar 2000 09:20:13 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 3117 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > ---------- > From: Scott McEachern[SMTP:smceachern@jamedia.com] > Sent: 08 March 2000 14:23 > To: Lidgate, Chris A > Subject: Re: DNS and NTP > > "Lidgate, Chris A" wrote: > > > The standard way of doing this is to run a named process > > on your fwtk firewall just as if it was a secondary dns > > server for your *external* domain. You then set up your > > *internal* dns servers to use the forward keyword, such > > that they will query the fwtk dns server (usually) *before* > > they try and resolve the hostname queries themselves. > > This is the standard? (Like I said, I'm new ;-) I work on the policy of > using as few services/ports as possible. > As to wether it's standard or not - I got my info from the mailing list ~ 2 years ago as I remember. I actually thought that there might be a topic about this in the ftwk faq, but there doesn't seem to be - odd. There is the following http://www.fwtk.org/fwtk/docs/documentation.html#3.1 But notice that this goes some way BEYOND what you described (ie if you follow this note, your *firewall* can resolve your *internal* names, as well as allowing your internal machines to resolve external names). I certainly agree with you in principle tho' that it's best to close down the firewall as much as possible. > Also, the vast majority of my lookups will be internal, so I figure I'll > look internally first. > This was very much my reasoning. It actually took me sometime to get it working, but now that it is, it is the business! If you need any pointers get back to me, this is exactly how I set up our stuff. I found that the dns newsgroup (comp.protocols.bind ?? - something like that anyway) was very good, combined with deja news. > > There are some clever games you can play with "forward only" > > keyword on the internal dns server, such that instead of the > > default behavoiur, the queries are only forwarded to the > > fwtk dns server *iff* the domain is not part of your internal > > dns, but these are implememtation details. > > I will fiddle with that today (ok, until I succeed ;-) > > > Of course this goes against your assertion that "I really > > don't want to have the firewall acting as a name server". > > > > Why ? Is this just for security ? or do you you have some > > other reason ? > > Security is the only reason. I use bind v8.2.2 p5, the latest version. > That's what we use. > > > Another question, similar to the above, is the same but for > network > > > time (NTP.) > > > > > The answer here is much the same, run the xntpd deamon on > > your firewall box, and allow internal machines to access it. > > > > xntpd allows some fairly sophisticated settings for access > > controls, set them up so that your xntpd is only allowed to > > access the higher stratum servers for it's own time > > adjustments, but is allowed to serve time to your local net. > > I'll go about setting that up too, today. > > Thanks very much for your help, it is appreciated! > From owner-fwtk-users@ex.tis.com Wed Mar 8 12:28 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA00605 Wed, 8 Mar 2000 12:28:00 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA25530; Wed, 8 Mar 2000 09:33:57 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 09:30:36 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA24296 for fwtk-users-outgoing; Wed, 8 Mar 2000 09:30:34 -0800 (PST) From: "Jawwad Ahmed Shamsi" To: fwtk-users@tis.com Cc: fwtk-support@tis.com Subject: configuring firewall tool kit X-Mailer: Netscape Messenger Express 3.5.2 [Mozilla/4.61 [en] (X11; U; Linux 2.2.12-20 i686)] Date: Wed, 8 Mar 2000 11:37:55 -0500 Message-ID: <77360C60EAB.AAA4C58@mercury.its.umd.umich.edu> Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 648 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello ! I am working on a research project at University of Michigan-Dearborn. I have a subnet with a Red Hat 6.1 Linux router. I am trying to confogure TIS firewall tool kit on the router. The problem is that how can I restrict, the clients inside the subnet that they can only telnet, ftp or http to the outside world through the proxy service on the router and not beside that. Do i have to configure IPCAHINING for that. Any type of help or guidance will be highly appreciated. Thanks Jawwaad Shamsi From owner-fwtk-users@ex.tis.com Wed Mar 8 13:19 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA00791 Wed, 8 Mar 2000 13:19:09 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA06648; Wed, 8 Mar 2000 10:25:05 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 10:20:46 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA04989 for fwtk-users-outgoing; Wed, 8 Mar 2000 10:20:45 -0800 (PST) X-Authentication-Warning: castle.entridia.com: mail set sender to using -f Message-ID: <38C69A7A.97A4F823@entridia.com> Date: Wed, 08 Mar 2000 10:22:50 -0800 From: Dennis Chandler Organization: Entridia Corp. X-Mailer: Mozilla 4.5 [en] (X11; I; SunOS 5.5.1 sun4u) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: x-gw segmentation fault Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1752 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I've been able to build the 2.1 tookkit on RH Linux 5.2, but cannot seem to get x-gw to run without segmentation fault. Compilation and linking are without errors. A few printf's x-gw's sws.c module reveals that line 58 is where the trouble starts. i=(*argv[0]=='-')?0:1 seems to be the problem. Any advice would be apprecieated. I've been through the users-archive and docs extensively. Sidebar: When I compile fwtk on RH6.1 it all of the binaries compile OK, but seg. fault when executed. Here's my dev environment: RH5.2 (out of the box) gcc = 2.7.2.3 XFree86-3.3.2.3-25 XFree86-devel-3.3.2.3-25 XFree86-lib-3.3.2.3-25 Xaw3d-1.3-17 Xaw3d-devel-1.3-17 Here's a snippet from sws.c > 58 for(i=(*argv[0]=='-')?0:1;ikey) { 60 if(argv[i][0]=='-' && i<=n && 61 !strncmp(&(argv[i][1]),psws->key,strlen(psws->key)) ){ 62 i++; pswsl->cnt++; /* got matched inputs */ 63 if( !argv[i] || argv[i][0] == '-') { 64 z=0; i--; /* no arg followed by */ 65 } else z=strlen(argv[i]); 66 psws->arg=strsave(argv[i],z); 67 goto next; 68 } psws++; 69 } 70 unmatch: freesws(pswsl); return NULL; /* Ooops, input not match */ 71 next: psws=pswsl->sws; 72 } Dennis Chandler Entridia From owner-fwtk-users@ex.tis.com Wed Mar 8 13:29 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA00846 Wed, 8 Mar 2000 13:29:09 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA09798; Wed, 8 Mar 2000 10:34:52 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 10:30:48 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA08341 for fwtk-users-outgoing; Wed, 8 Mar 2000 10:30:47 -0800 (PST) <00030721154100.01555@bossnass> Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: <00030721154100.01555@bossnass> References: <200003011714.UAA14805@paranoid.eltex.spb.ru> <00030721154100.01555@bossnass> Date: Wed, 8 Mar 2000 11:25:38 -0700 To: barnboy@imall.com, fwtk-users@lists.nai.com From: Blair Lowe Subject: Re: newbie pop3 and DNS Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 1756 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Sounds cool. But I am not sure I understand the meaning of: >"assuming the host from whom >you're popping the mail allows you to connect via >SSH" host do you refer to? the ISP client's host? If so does a pop client need a special MUA (Mail user agent) to read his email? I suppose an ASCII diagram of a typical set-up would make things clearer to me. Blair At 21:11 -0700 2000/03/07, Matthew P. Barnson wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >It is extremely common for ISP's to use tcp_wrappers to secure POP3 >connections. We use it here, and it's pretty effective. >One of the most effective solutions we've found to passing passwords in >cleartext across the Internet involves either the use of a hardware VPN >solution, or SSH to tunnel the connection, like this: >ssh -C -L 4110:localhost:110 remote.host.domain.com >Then you set up your plug to POP the mail through "localhost:4110" and voila! >you're running your POP3 requests over an encrypted tunnel. This >is, of course, >assuming the host from whom you're popping the mail allows you to connect via >SSH. If they don't, encourage them to. > >SSH port forwarding is a complicated subject, but once you've mastered how it >works it's an extremely powerful tool for encrypting what you'd >rather not have >in the clear. > > >-- > >Matthew P. Barnson mbarnson@excitehome.net >Mgr,Systems Administration Excite@Home E-business Services Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) From owner-fwtk-users@ex.tis.com Wed Mar 8 13:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA00903 Wed, 8 Mar 2000 13:38:00 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA13263; Wed, 8 Mar 2000 10:43:59 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 10:36:37 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA10393 for fwtk-users-outgoing; Wed, 8 Mar 2000 10:36:33 -0800 (PST) Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: References: Date: Wed, 8 Mar 2000 11:31:28 -0700 To: "Luis Fernando Barrera" , From: Blair Lowe Subject: Re: Remote access to the Firewall Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 598 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] ... At 19:20 -0700 2000/03/07, Blair Lowe wrote: >Everything is encrypted. My stupid MUA (eudora) regularly cuts off my typing, so please forgive my poor grammar as a result of this: What I meant there is that everything transmitted through ssh is encrypted. Blair. Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) All email advice provided for free is without warantee, and "use at your own risk" From owner-fwtk-users@ex.tis.com Wed Mar 8 14:23 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA01119 Wed, 8 Mar 2000 14:23:28 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA24521; Wed, 8 Mar 2000 11:29:17 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 11:26:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA23451 for fwtk-users-outgoing; Wed, 8 Mar 2000 11:26:14 -0800 (PST) Mime-Version: 1.0 X-Sender: christianr@ntmail.signalgene.com Message-Id: Date: Wed, 8 Mar 2000 14:28:14 -0500 To: fwtk-users@tis.com From: Christian Raymond Subject: HTTP-gw halts Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 1169 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi All I have almost finish my update from fwtk 1.3 to fwtk 2.1. However, I have a problem with http-gw: it looks like it halts from time to time, and I dont know why. the client ask for a web page, the page begins to apear on the browser, but then the browser says "connecting to 192.168.1.1" and dies there. restarting inetd seems to resolve the prob. here is a summary of my setup ; RedHat 6.1 and fwtk 2.1 I do not use the auth gateway. here is a snip from netperm-table: http-gw: denial-msg /usr/local/etc/http-deny.txt http-gw: welcome-msg /usr/local/etc/http-welcome.txt http-gw: help-msg /usr/local/etc/http-help.txt http-gw: timeout 960 http-gw: ftp-proxy 192.168.1.1 http-gw: permit-hosts 192.168.1.* ssl-gw: port ssl 192.168.1.* -port ssl here is a snip from /etc/hosts.allow: http-gw, tn-gw, ftp-gw, plug-gw : 192.168.1. telnet and ftp seems ok. plug for the news is fine too. (I also have some probs with pop, but that is another post...) Any help ? chris From owner-fwtk-users@ex.tis.com Wed Mar 8 14:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA01157 Wed, 8 Mar 2000 14:32:43 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA27642; Wed, 8 Mar 2000 11:38:39 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 11:33:43 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA25989 for fwtk-users-outgoing; Wed, 8 Mar 2000 11:33:42 -0800 (PST) Message-ID: <38C6AA84.4D75E7C4@v-one.com> Date: Wed, 08 Mar 2000 14:31:16 -0500 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.72 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Christian Raymond CC: fwtk-users@tis.com Subject: Re: HTTP-gw halts References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 766 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Christian Raymond wrote: > > I have almost finish my update from fwtk 1.3 to fwtk 2.1. However, I > have a problem with http-gw: it looks like it halts from time to > time, and I dont know why. > > the client ask for a web page, the page begins to apear on the > browser, but then the browser says "connecting to 192.168.1.1" and > dies there. restarting inetd seems to resolve the prob. Chris, This is a FAQ: 2.4.1 My http-gw keeps hanging; Why is http-gw freezing, but the server responds to pings? http://www.fwtk.org/fwtk/faq/faq.html#2.4.1 -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Wed Mar 8 16:28 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA01752 Wed, 8 Mar 2000 16:28:50 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA16062; Wed, 8 Mar 2000 13:33:31 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 13:27:57 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA14243 for fwtk-users-outgoing; Wed, 8 Mar 2000 13:27:53 -0800 (PST) Date: Wed, 8 Mar 2000 13:36:38 -0500 From: Joseph S D Yao To: Ted Keller Cc: Blair Lowe , fwtk-users@ex.tis.com Subject: Re: idle ports Message-Id: <20000308133638.M15512@washington.cospo.osis.gov> Mail-Followup-To: Ted Keller , Blair Lowe , fwtk-users@ex.tis.com References: Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from keller@bfg.com on Thu, Feb 17, 2000 at 06:53:14PM -0500 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1518 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Thu, Feb 17, 2000 at 06:53:14PM -0500, Ted Keller wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Blair, > > Idle ports should be closed when the proxy exits. This normally occurs > when the timeout values have been reached. > > ted keller [Catching up on old unread e-mail.] Clarification, just because I find the original question ambiguous: The system on which FWTK is running should originally be configured so as not to open any ports on which proxies are not running. Thus there are no "idle" ports in that sense. [If you use ipchains or socks or something else that puts holes in the bastion host, that's your worry.] The 'inetd' or proxy daemon will keep open ports on which incoming services are to be run, and pass off requests to separate processes for each request, each of which is reading its own socket port. The open ports may be viewed as "idle", but they are necessary. If the port of a running proxy becomes idle, the action depends on the individual proxy. Most proxies that come with the original proxy seem to have timeouts set. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Wed Mar 8 16:28 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA01753 Wed, 8 Mar 2000 16:28:50 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA16070; Wed, 8 Mar 2000 13:33:34 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 13:28:02 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA14272 for fwtk-users-outgoing; Wed, 8 Mar 2000 13:28:00 -0800 (PST) Date: Wed, 8 Mar 2000 10:33:01 -0800 (PST) From: Scott Campbell To: fwtk-users@ex.tis.com Subject: Spoof/smap question Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1301 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I'm running fwtk 2.1 with the yao patch on a FreeBSD 3.2 box. I get the following entries in my messages file. Mar 8 10:06:09 paperbox smap[91130]: securityalert: possible spoof mx2-w.mail.home.com/24.0.0.206 != 24.0.0.52 name lookup mismatch Mar 8 10:06:09 paperbox smap[91130]: connect host=unknown/24.0.0.206 Mar 8 10:06:09 paperbox /kernel: pid 91130 (smap), uid 1: exited on signal 11 Third line exit process only happens when smap thinks that the host is spoofed. If it can't reverse lookup the name then it accepts the mail fine with "host=unknown/some.dot.host.ip" I was looking through the smap source for a variation on spoof unknown hosts and plain unknown hosts (c isn't my strong point). Is this suppose to happen to a possible spoof mail host? (Drop session) Is there anyone else set up with FreeBSD who got around this problem? Would any of the netperm-table entries create/remove this problem? (I tryed setting "smap: unknown-host 1" without any change in the pattern.) Thanks in advance Scott E. Campbell _______________________________ Computer Operations Greater Victoria Public Library Victoria BC CANADA scampbel@gvpl.victoria.bc.ca From owner-fwtk-users@ex.tis.com Wed Mar 8 20:56 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA02792 Wed, 8 Mar 2000 20:56:55 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA16526; Wed, 8 Mar 2000 18:02:52 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 17:56:48 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA15638 for fwtk-users-outgoing; Wed, 8 Mar 2000 17:56:47 -0800 (PST) Message-ID: <20000309015623.22334.qmail@web1805.mail.yahoo.com> Date: Wed, 8 Mar 2000 17:56:23 -0800 (PST) From: =?gb2312?q?jungu=20zhan?= Subject: a problem in analysing the source To: fwtk-users@tis.com MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=gb2312 Content-Length: 589 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] HI: I got a problem in analysing the source code of fwtk_v1.3. In "http-gw.c",line 726,there are "if(buf[x] == IAC)". "IAC" also appears many times in other files, such as "http-gw.c", "tn-gw.c", but I can't find the definition of "IAC" in all the source files. I'm puzzled. Can anyone provide a answer? Thanks a lot. __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com From owner-fwtk-users@ex.tis.com Wed Mar 8 21:34 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA02897 Wed, 8 Mar 2000 21:34:49 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA19244; Wed, 8 Mar 2000 18:40:49 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 18:38:44 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA18515 for fwtk-users-outgoing; Wed, 8 Mar 2000 18:38:43 -0800 (PST) From: "Joseph Judge" To: "jungu zhan" , Subject: RE: a problem in analysing the source Date: Wed, 8 Mar 2000 21:38:14 -0500 Message-ID: <000501bf8970$847d2640$0601a8c0@poopy.intrusion.org> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0 In-Reply-To: <20000309015623.22334.qmail@web1805.mail.yahoo.com> X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3155.0 Importance: Normal Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="gb2312" Content-Length: 1575 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Should be a system include file /usr/include/arpa/telnet.h (or something). IAC = "interpret as command" -- part of the telnet protocol that allows the communications channel to be used for sending 'control' info back and forth. This way, telnet -- at first connect -- can send a "IAC I-will handle-echoing" and the other end can say "IAC I-won't echo" -- so client/server can negotiate. Interesting note --- if you are a mail transport (e.g. sendmail) and see "IAC", then someone it using telnet to connect to your service socket :-) -joe > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of jungu zhan > Sent: Wednesday, March 08, 2000 8:56 PM > To: fwtk-users@tis.com > Subject: a problem in analysing the source > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > HI: > I got a problem in analysing the source code of > fwtk_v1.3. > > In "http-gw.c",line 726,there are "if(buf[x] == IAC)". > "IAC" also appears many times in other files, such as > "http-gw.c", "tn-gw.c", but I can't find the > definition of "IAC" in all the source files. I'm > puzzled. > > Can anyone provide a answer? > Thanks a lot. > > > > __________________________________________________ > Do You Yahoo!? > Talk to your friends online with Yahoo! Messenger. > http://im.yahoo.com > From owner-fwtk-users@ex.tis.com Thu Mar 9 02:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA03675 Thu, 9 Mar 2000 02:32:10 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id XAA02236; Wed, 8 Mar 2000 23:38:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Mar 2000 23:35:43 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id XAA01525 for fwtk-users-outgoing; Wed, 8 Mar 2000 23:35:42 -0800 (PST) Message-ID: <38C752EC.FA7D829A@ordix.de> Date: Thu, 09 Mar 2000 08:29:48 +0100 From: Markus Schreier Organization: Ordix AG X-Mailer: Mozilla 4.61 [en] (WinNT; I) X-Accept-Language: en,de MIME-Version: 1.0 To: Jawwad Ahmed Shamsi CC: fwtk-users@tis.com, fwtk-support@tis.com Subject: Re: configuring firewall tool kit References: <77360C60EAB.AAA4C58@mercury.its.umd.umich.edu> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1401 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Jawwad, if you type echo "0" > /proc/sys/ipv4/ip_forward you disable the forwarding of ip-traffic. Direct connections from one side to the other are disabled and users have to use the proxy to get through. You con make your system default to that by using linuxconf. Or you examin your start scripts to find out which file sets forwarding. You would need a proxy for every service. (Also named-lookups and so on won't get through without configuration) A combination of fwtk for sone and ipchains fore other services is (as far as i know) depreceated! Markus Jawwad Ahmed Shamsi wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello ! > > I am working on a research project at University of Michigan-Dearborn. > > I have a subnet with a Red Hat 6.1 Linux router. > I am trying to confogure TIS firewall tool kit on the router. > > The problem is that how can I restrict, the clients inside the > subnet that they can only telnet, ftp or http to the outside > world through the proxy > service on the router and not beside that. > Do i have to configure IPCAHINING for that. > > Any type of help or guidance will be highly appreciated. > > Thanks > > Jawwaad Shamsi From owner-fwtk-users@ex.tis.com Thu Mar 9 07:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA04800 Thu, 9 Mar 2000 07:22:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA14941; Thu, 9 Mar 2000 04:28:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Mar 2000 04:25:25 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA14165 for fwtk-users-outgoing; Thu, 9 Mar 2000 04:25:24 -0800 (PST) To: fwtk-users@ex.tis.com Subject: Re: Spoof/smap question X-Sun-Charset: US-ASCII Message-Id: <20000309122444.ADA512C15B@skynet.medar.com> Date: Thu, 9 Mar 2000 07:24:44 -0500 (EST) From: jseymour@medar.com (James Seymour) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1227 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Date: Wed, 8 Mar 2000 10:33:01 -0800 (PST) > From: Scott Campbell > Subject: Spoof/smap question > Message-ID: > [snip] > Mar 8 10:06:09 paperbox /kernel: pid 91130 (smap), uid 1: exited on > signal 11 > [snip] > > Is this suppose to happen to a possible spoof mail host? (Drop session) Unlikely. That's a SIGSEV - a signal resulting from a segment violation. Smap tried to access memory that didn't belong to it. > [snip] > > Would any of the netperm-table entries create/remove this problem? (I > tryed setting "smap: unknown-host 1" without any change in the pattern.) [snip] > You've run into a bug in the code, one of the libraries it uses, your compiler, or some combination of these. Code is not *supposed* to SIGSEV. Ever. Regards, Jim -- Jim Seymour | Medar, Inc. jseymour@medar.com | 24775 Crestview Ct. Systems & Network Administrator | Farmington Hills, MI. 48335 | FAX: (248)477-8897 From owner-fwtk-users@ex.tis.com Thu Mar 9 08:29 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA05059 Thu, 9 Mar 2000 08:29:47 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA19199; Thu, 9 Mar 2000 05:35:47 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Mar 2000 05:33:25 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA18437 for fwtk-users-outgoing; Thu, 9 Mar 2000 05:33:24 -0800 (PST) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC94C@mailserver.isolaandisola.com> From: William Jackson To: "'fwtk-users@tis.com'" Subject: nntp-gw question Date: Thu, 9 Mar 2000 14:34:40 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 971 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Is the following correct I set up my nntp-gw to point to the external news server and limit it to accept connection from my internal host X1 on my internal host X1 I configure my news reader to use my nntp-gw host machine as the news server and then the nntp-gw routes all news traffic to the real news server on the internet? William Jackson MCP Technical Director Isola & Isola Email: wj@isolaandisola.com CONFIDENTIALITY NOTICE This E-mail and/or the documents accompanying are privileged and contain confidential information. If the recipient is not the addressee or the employee or agent of the addressee any unauthorised use, disclosure, copying, distribution or dissemination is strictly prohibited and in any such event please immediately notify us by telephone on 76651 and return this E-mail and destroy any copies. From owner-fwtk-users@ex.tis.com Thu Mar 9 09:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA05331 Thu, 9 Mar 2000 09:22:04 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA24247; Thu, 9 Mar 2000 06:28:02 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Mar 2000 06:22:50 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA22195 for fwtk-users-outgoing; Thu, 9 Mar 2000 06:22:48 -0800 (PST) Message-Id: <4.3.2.20000308210646.00bc3dc0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Wed, 08 Mar 2000 21:09:58 -0500 To: =?gb2312?q?jungu=20zhan?= , fwtk-users@tis.com From: Rick Murphy Subject: Re: a problem in analysing the source In-Reply-To: <20000309015623.22334.qmail@web1805.mail.yahoo.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1096 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 05:56 PM 3/8/00 -0800, =?gb2312?q?jungu=20zhan?= wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >HI: >I got a problem in analysing the source code of >fwtk_v1.3. FWTK 1.3 is ancient. Chances are wherever you copied the kit from has an unauthorized copy. Please ask the archive site to remove it, then get a copy of FWTK 2.1. That won't necessarily help your problem, though: >In "http-gw.c",line 726,there are "if(buf[x] == IAC)". >"IAC" also appears many times in other files, such as >"http-gw.c", "tn-gw.c", but I can't find the >definition of "IAC" in all the source files. I'm >puzzled. IAC is the TELNET command introducer character. Usually defined in /usr/include/arpa/telnet.h - whatever OS you're using may not include telnet.h automatically; adding "#include " to the end of the includes in the two sources may help. -Rick From owner-fwtk-users@ex.tis.com Thu Mar 9 10:29 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA00264 Thu, 9 Mar 2000 10:29:52 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA02835; Thu, 9 Mar 2000 07:20:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Mar 2000 07:17:19 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA01119 for fwtk-users-outgoing; Thu, 9 Mar 2000 07:17:17 -0800 (PST) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC94F@mailserver.isolaandisola.com> From: William Jackson To: "'fwtk-users@tis.com'" Subject: smap problem Date: Thu, 9 Mar 2000 16:18:47 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 675 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have found the problem thanks anyway William Jackson MCP Technical Director Isola & Isola Email: wj@isolaandisola.com CONFIDENTIALITY NOTICE This E-mail and/or the documents accompanying are privileged and contain confidential information. If the recipient is not the addressee or the employee or agent of the addressee any unauthorised use, disclosure, copying, distribution or dissemination is strictly prohibited and in any such event please immediately notify us by telephone on 76651 and return this E-mail and destroy any copies. From owner-fwtk-users@ex.tis.com Thu Mar 9 10:29 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA00267 Thu, 9 Mar 2000 10:29:53 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA01669; Thu, 9 Mar 2000 07:18:24 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Mar 2000 07:14:49 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA00124 for fwtk-users-outgoing; Thu, 9 Mar 2000 07:14:48 -0800 (PST) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC94E@mailserver.isolaandisola.com> From: William Jackson To: "'fwtk-users@tis.com'" Subject: smap problem Date: Thu, 9 Mar 2000 16:16:08 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 967 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am having a little problem I am testing the smap, smapd and sendmail locally they start ok and give no errors I do a # telnet localhost 25 I get to this stage RCPT TO: 250 OK DATA Connection closed by foreign host. why is it closing the connection at the DATA stage, I thought this was an OK command? William Jackson MCP Technical Director Isola & Isola Email: wj@isolaandisola.com CONFIDENTIALITY NOTICE This E-mail and/or the documents accompanying are privileged and contain confidential information. If the recipient is not the addressee or the employee or agent of the addressee any unauthorised use, disclosure, copying, distribution or dissemination is strictly prohibited and in any such event please immediately notify us by telephone on 76651 and return this E-mail and destroy any copies. From owner-fwtk-users@ex.tis.com Thu Mar 9 10:49 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA00372 Thu, 9 Mar 2000 10:49:44 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA09302; Thu, 9 Mar 2000 07:55:46 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Mar 2000 07:53:39 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA08479 for fwtk-users-outgoing; Thu, 9 Mar 2000 07:53:37 -0800 (PST) Message-ID: <38C7C8EB.2619A6B6@nataskasoftware.on.ca> Date: Thu, 09 Mar 2000 10:53:15 -0500 From: "Daniel R. Houle" Reply-To: drhoule@nataskasoftware.on.ca Organization: Nataska Software X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.12-20 i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@tis.com Subject: Random number generator in authsvr Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 457 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I've been looking at the authsvr and it's security issue about the random (or not so-) number generator. Apparently there is a way to fix that by changing the rand() and srand() functions. Anybody done this already? Anybody know what I should change these functions to? Should I create new ones myself? Thanks, Dan Houle From owner-fwtk-users@ex.tis.com Thu Mar 9 11:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA00647 Thu, 9 Mar 2000 11:26:15 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA15263; Thu, 9 Mar 2000 08:32:15 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Mar 2000 08:29:19 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA14238 for fwtk-users-outgoing; Thu, 9 Mar 2000 08:29:18 -0800 (PST) Message-ID: <38C7D025.4A88C4AB@ordix.de> Date: Thu, 09 Mar 2000 17:24:05 +0100 From: Markus Schreier Organization: Ordix AG X-Mailer: Mozilla 4.61 [en] (WinNT; I) X-Accept-Language: en,de MIME-Version: 1.0 To: "'fwtk-users@tis.com'" Subject: can't get smap starting References: <51F024FC46C7D211880A00201888E0BA1AC94F@mailserver.isolaandisola.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 606 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, i'm trying to get smap form fwtk 2.1 running. Starting smap like this: /usr/local/etc/smap -deamon 25 gives the following output to the messages: Mar 9 17:22:34 localhost smap[12628]: getpeername failed: Socket-Operation an einem nicht-Socket Mar 9 17:22:34 localhost smap[12628]: cannot get remote host The daemon isn't started and there is no other daemon listening on port 25. What have i missed? Thanks for any help form Wiesbaden, Germany Markus Schreier From owner-fwtk-users@ex.tis.com Thu Mar 9 18:05 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA02570 Thu, 9 Mar 2000 18:05:47 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA14718; Thu, 9 Mar 2000 15:11:50 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Mar 2000 15:07:37 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA13682 for fwtk-users-outgoing; Thu, 9 Mar 2000 15:07:36 -0800 (PST) Date: Thu, 9 Mar 2000 16:08:47 -0700 (MST) From: Stefan Chakerian Reply-To: schake@cs.sandia.gov To: "Ronald J. Yacketta" cc: "Firewall Toolkit (M-list)" Subject: Re: ftp-gw + ncftpd In-Reply-To: <38C32472.878C6AA4@rochester.rr.com> Message-ID: X-Disclaimer: Opinions expressed below do not represent Sandia National Labs. MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 760 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Sun, 5 Mar 2000, Ronald J. Yacketta wrote: > ftp stream tcp nowait root /usr/local/bin/netacl ftpd > netacl-ftpd: permit-hosts ... -exec /usr/local/bin/ncftpd -q I don't have ncftpd docs handy, but does the -q tell ncftpd to run using stdin/stdout (i.e. via inetd)? You'll definitely get a bind error if ncftpd is trying to run standalone and doesn't know it's supposed to be dealing with inetd, since inetd is listening on that socket. stef Stefan Chakerian Sandia National Labs, Albuquerque schake%cs.sandia.gov I do not speak for my employer Don't anthropomorphize computers. They don't like it. From owner-fwtk-users@ex.tis.com Thu Mar 9 19:08 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA02735 Thu, 9 Mar 2000 19:08:06 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA23800; Thu, 9 Mar 2000 16:14:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Mar 2000 16:11:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA22881 for fwtk-users-outgoing; Thu, 9 Mar 2000 16:11:36 -0800 (PST) Message-Id: <4.3.2.20000309185930.00b7ca50@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Thu, 09 Mar 2000 19:00:04 -0500 To: Markus Schreier , "'fwtk-users@tis.com'" From: Rick Murphy Subject: Re: can't get smap starting In-Reply-To: <38C7D025.4A88C4AB@ordix.de> References: <51F024FC46C7D211880A00201888E0BA1AC94F@mailserver.isolaandisola.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 272 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 05:24 PM 3/9/00 +0100, Markus Schreier wrote: >Starting smap like this: >/usr/local/etc/smap -deamon 25 Try '-daemon'. :-) -Rick From owner-fwtk-users@ex.tis.com Thu Mar 9 19:23 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA02790 Thu, 9 Mar 2000 19:23:08 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA26666; Thu, 9 Mar 2000 16:29:10 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Mar 2000 16:27:05 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA25867 for fwtk-users-outgoing; Thu, 9 Mar 2000 16:27:02 -0800 (PST) Message-Id: <4.3.2.20000309190011.00bb5af0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Thu, 09 Mar 2000 19:13:00 -0500 To: drhoule@nataskasoftware.on.ca, fwtk-users@tis.com From: Rick Murphy Subject: Re: Random number generator in authsvr In-Reply-To: <38C7C8EB.2619A6B6@nataskasoftware.on.ca> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 744 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:53 AM 3/9/00 -0500, Daniel R. Houle wrote: >Apparently there is a way to fix that by changing the rand() and srand() >functions. Anybody done this already? Anybody know what I should change >these functions to? Should I create new ones myself? That depends somewhat on what OS you're using. If it's got a random number device (/dev/random) you're far better off using that instead of srand()/rand(). Don't use rand/srand - use random/srandom. (Define USE_RANDOM). The seed used is very poor and tends to have a small range. Does anyone have an improved seed calculation to recommend? -Rick From owner-fwtk-users@ex.tis.com Fri Mar 10 06:02 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA04765 Fri, 10 Mar 2000 06:02:07 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA24245; Fri, 10 Mar 2000 03:07:47 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Mar 2000 03:01:28 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA22510 for fwtk-users-outgoing; Fri, 10 Mar 2000 03:01:27 -0800 (PST) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC953@mailserver.isolaandisola.com> From: William Jackson To: "'fwtk-users@tis.com'" Subject: ftp hell Date: Fri, 10 Mar 2000 12:02:25 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1340 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am just cannot my proftpd to be chroot first by netacl I have the following: in my inetd I do not have the proftd files in the /usr/local/etc directory like they normally are ftp stream tcp nowait root /usr/local/etc/ftp-gw proftpd netstat shows me that the port is being listened on my netperm table has the following: netacl-proftpd: permit-hosts * -chroot /export/ftp -exec /bin/proftpd where the executable and conf files are set relative to the chrooted dir I do a # ftp localhost Connected to localhost. 421 Service not available, remote server has closed connection ftp> and this is what I get nothing in the syslog or message files? any ideas on what to look at? William Jackson MCP Technical Director Isola & Isola Email: wj@isolaandisola.com CONFIDENTIALITY NOTICE This E-mail and/or the documents accompanying are privileged and contain confidential information. If the recipient is not the addressee or the employee or agent of the addressee any unauthorised use, disclosure, copying, distribution or dissemination is strictly prohibited and in any such event please immediately notify us by telephone on 76651 and return this E-mail and destroy any copies. From owner-fwtk-users@ex.tis.com Fri Mar 10 06:47 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA05044 Fri, 10 Mar 2000 06:47:05 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA04616; Fri, 10 Mar 2000 03:53:06 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Mar 2000 03:49:28 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA03207 for fwtk-users-outgoing; Fri, 10 Mar 2000 03:49:27 -0800 (PST) To: fwtk-users@lists.nai.com Date: Fri, 10 Mar 2000 03:48:15 -0800 From: "Daniel Lutan" Message-ID: Mime-Version: 1.0 X-Sent-Mail: off Reply-To: ccldc@mailcity.com X-Expiredinmiddle: true X-Mailer: MailCity Service Subject: make X-Sender-Ip: 193.231.21.231 Organization: MailCity (http://www.mailcity.lycos.com:80) Content-Language: en Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 735 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello! My name is Daniel and i'm a student and a beginer in working with TIS. I'm dowloading TIS and I'm starting to compile with make comand but i have an error and i need your help. The error sound like that ( word by word ): : No such file or directoryg '. Stop. No rule to make target ' Makefile.config. I'm running a Suse Linux 6.3 and i rename the file Makefile.config.linux in Makefile.config and the old Makefile.config in Makefile.config1. I hope i make my self clear and please send my a response. Thank's anyway! Daniel. MailCity. Secure Email Anywhere, Anytime! http://www.mailcity.com From owner-fwtk-users@ex.tis.com Fri Mar 10 08:39 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA05529 Fri, 10 Mar 2000 08:39:48 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA22540; Fri, 10 Mar 2000 05:45:51 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Mar 2000 05:42:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA21615 for fwtk-users-outgoing; Fri, 10 Mar 2000 05:42:36 -0800 (PST) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC952@mailserver.isolaandisola.com> From: William Jackson To: "'fwtk-users@tis.com'" Subject: help needed please Date: Fri, 10 Mar 2000 10:29:26 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 553 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am getting started with the toolikit and need a bit of hand holding I have everything I want running ok apart from one item I want to use the proftpd ftp server I want this to be invoked via netacl and chroot from inetd in my inetd.conf I have: ftp stream tcp nowait root /usr/local/etc/netacl proftpd and in my netperm-table I have netacl-proftpd: permit-hosts X.X Is this the correct way to do it?? thanks From owner-fwtk-users@ex.tis.com Fri Mar 10 08:53 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA05567 Fri, 10 Mar 2000 08:53:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA25596; Fri, 10 Mar 2000 05:59:35 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Mar 2000 05:57:13 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA24670 for fwtk-users-outgoing; Fri, 10 Mar 2000 05:57:12 -0800 (PST) To: fwtk-users@tis.com Subject: Re: help needed please X-Sun-Charset: US-ASCII Message-Id: <20000310135635.957D92C15B@skynet.medar.com> Date: Fri, 10 Mar 2000 08:56:35 -0500 (EST) From: jseymour@medar.com (James Seymour) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 788 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Message-ID: <51F024FC46C7D211880A00201888E0BA1AC952@mailserver.isolaandisola.com> > From: William Jackson > Subject: help needed please > Date: Fri, 10 Mar 2000 10:29:26 +0100 > [snip] > > I have everything I want running ok apart from one item > > I want to use the proftpd ftp server > [snip] > On the firewall??? Not a good idea. Not if what you want is really a firewall. Regards, Jim -- Jim Seymour | Medar, Inc. jseymour@medar.com | 24775 Crestview Ct. Systems & Network Administrator | Farmington Hills, MI. 48335 | FAX: (248)477-8897 From owner-fwtk-users@ex.tis.com Fri Mar 10 17:06 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA07490 Fri, 10 Mar 2000 17:06:50 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA27206; Fri, 10 Mar 2000 14:12:52 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Mar 2000 14:08:58 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA25860 for fwtk-users-outgoing; Fri, 10 Mar 2000 14:08:57 -0800 (PST) Message-Id: <4.3.2.20000310165916.00b774a0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Fri, 10 Mar 2000 17:00:03 -0500 To: William Jackson , "'fwtk-users@tis.com'" From: Rick Murphy Subject: Re: ftp hell In-Reply-To: <51F024FC46C7D211880A00201888E0BA1AC953@mailserver.isolaand isola.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 344 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 12:02 PM 3/10/00 +0100, William Jackson wrote: >ftp stream tcp nowait root /usr/local/etc/ftp-gw proftpd Shouldn't this be /usr/local/etc/netacl proftpd ? i.e. netacl, not ftp-gw.. -Rick From owner-fwtk-users@ex.tis.com Fri Mar 10 20:44 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA08336 Fri, 10 Mar 2000 20:44:15 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA00346; Fri, 10 Mar 2000 17:50:18 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Mar 2000 17:47:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA29553 for fwtk-users-outgoing; Fri, 10 Mar 2000 17:47:15 -0800 (PST) Message-ID: <20000311014635.1933.qmail@web506.mail.yahoo.com> Date: Fri, 10 Mar 2000 17:46:35 -0800 (PST) From: po llito Subject: Web proxy with http-gw - help please To: fwtk-users@tis.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1629 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have a machine that I am trying to configure as an http proxy server so that machines connecting through it can be allowed to reach IP restricted services on our campus. outisde world -----> proxy server -----> IP restricted sites (dissallowed IP) (allowed IP address) (allows proxy connections) | disallowed IP <------ proxy <-------return results(displays restricted web content) At this point, I'm not yet concerned with user authentication and IP restriction for who can reach the proxy server. All I'm interested in is finding out how an unknown IP address can connect through the proxy server and the proxy server can request the IP restricted http resource on behalf of the unknown IP address and return the results to the unknown address. Can I use an automatic proxy configuration file from a web browser (*.pac) so that only sites in the javascript function are proxied? i.e.: if (dnsDomainIs(host,"restricted.site")){ return "PROXY campus.proxy:80"; } Do I need to use http-gw in combination with Apache's mod_proxy to achieve the above effect? Any examples of ntperm-table or httpd-conf that you can provide would be helpful on how I can achieve this using only http-gw (2.1) and Apache 1.3 on Debian Linux 2.1. Thanks, Ed U. __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com From owner-fwtk-users@ex.tis.com Mon Mar 13 12:35 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA17241 Mon, 13 Mar 2000 12:35:43 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA02832; Mon, 13 Mar 2000 09:41:45 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Mar 2000 09:29:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA27860 for fwtk-users-outgoing; Mon, 13 Mar 2000 09:29:13 -0800 (PST) Message-ID: <20000311004602.6572.qmail@web501.mail.yahoo.com> Date: Fri, 10 Mar 2000 16:46:02 -0800 (PST) From: po llito Subject: Configuring a proxy with http-gw To: fwtk-users@tis.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1487 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Please excuse the question if it is too basic in nature, but any input into the following situation would be greatly appreciated: I have a machine that I am trying to configure as an http proxy server so that machines connecting through it can be allowed to reach IP restricted services on our campus. At this point, I'm not yet concerned with user authentication and IP restriction for who can reach the proxy server. All I'm interested in is finding out how an unknown IP address can connect through the proxy server (which has an allowed IP) and can request the IP restricted http resource on behalf of the unknown IP address and return the results to the unknown address. Can I use an automatic proxy configuration file for this (proxy.pac) with a Javascript function that can make the requests come from the proxy IP? Do I need to use http-gw in combination with Apache's mod_proxy to achieve the above effect? Any examples of ntperm-table or httpd-conf that you can provide would be helpful. I appreciate any input or pointers you can provide into this situation. I would like to achieve the above just using http-gw and Apache. -Eddie __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com From owner-fwtk-users@ex.tis.com Mon Mar 13 12:35 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA17242 Mon, 13 Mar 2000 12:35:43 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA02842; Mon, 13 Mar 2000 09:41:47 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Mar 2000 09:29:17 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA27861 for fwtk-users-outgoing; Mon, 13 Mar 2000 09:29:14 -0800 (PST) Message-ID: <20000313093217.92168.qmail@hotmail.com> X-Originating-IP: [202.188.154.237] From: "screened host firewall" To: fwtk-users@ex.tis.com Date: Mon, 13 Mar 2000 17:32:17 MYT Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; format=flowed Content-Length: 433 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] 1. Do FWTK support the security of WWW ? 2. Do FWTK are programming-based just like Microsoft C++ or C ? 3. Can I use FWTK as the software for "screened host firewall" ? Thank You. -ANnIE- ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com From owner-fwtk-users@ex.tis.com Mon Mar 13 12:35 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA17244 Mon, 13 Mar 2000 12:35:44 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA02846; Mon, 13 Mar 2000 09:41:47 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Mar 2000 09:30:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA28330 for fwtk-users-outgoing; Mon, 13 Mar 2000 09:30:13 -0800 (PST) Message-ID: <20000311005342.5639.qmail@web503.mail.yahoo.com> Date: Fri, 10 Mar 2000 16:53:42 -0800 (PST) From: po llito Subject: Configuring http-gw proxy To: fwtk-users@tis.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 415 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Forgot to mention that I am using Debian 2.1 with kernel 2.2.14 and Apache 1.3.3 I was able to compile the entire FWTK tookit correctly. -ed __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com From owner-fwtk-users@ex.tis.com Mon Mar 13 12:35 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA17252 Mon, 13 Mar 2000 12:35:45 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA02767; Mon, 13 Mar 2000 09:41:31 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Mar 2000 09:27:12 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA27085 for fwtk-users-outgoing; Mon, 13 Mar 2000 09:27:09 -0800 (PST) From: "Mike and Emily Jones" To: Subject: Make error Date: Sat, 11 Mar 2000 03:08:52 -0600 Message-ID: <000001bf8b39$754b2940$0200000a@domain1.test.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 582 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I follow what the readme files say and when I type Make it says Stop. No rule to make target. "Makefile.config I am running RH 6.1 and I replaced the Makefile.config with Makefile.config.linux as instructed. Also if I try to run the fixmake program it tells me there is no such file. Any help would be greatly appreciated before I throw the computer out the window. Just kidding I woulddn't do that, but I am frustrated. Thanks in advance. From owner-fwtk-users@ex.tis.com Mon Mar 13 12:52 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA17330 Mon, 13 Mar 2000 12:52:53 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA09708; Mon, 13 Mar 2000 09:58:38 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Mar 2000 09:47:03 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA04873 for fwtk-users-outgoing; Mon, 13 Mar 2000 09:46:58 -0800 (PST) Message-ID: From: "Mueller, Steve" To: "'fwtk-users@tis.com'" Subject: passive FTP? Date: Mon, 13 Mar 2000 11:47:11 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 462 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have fwtk in my dmz and would like to be able to filter TCP ports above 1023. Does fwtk allow for passive FTP through its proxy server? Thanks in advance. ------ ******************************************** Steve Mueller Network Services Manager American TV smueller@americantv.com ******************************************** From owner-fwtk-users@ex.tis.com Mon Mar 13 18:17 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA18776 Mon, 13 Mar 2000 18:17:32 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA16234; Mon, 13 Mar 2000 15:23:41 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Mar 2000 15:19:48 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA14783 for fwtk-users-outgoing; Mon, 13 Mar 2000 15:19:45 -0800 (PST) Date: Mon, 13 Mar 2000 18:19:25 -0500 From: Joseph S D Yao To: Mariusz Potocki Cc: fwtk-users@lists.nai.com Subject: Re: Netmeeting proxy Message-Id: <20000313181925.A27520@washington.cospo.osis.gov> Mail-Followup-To: Mariusz Potocki , fwtk-users@lists.nai.com References: <038001bf7c6c$0e09d1e0$b400000a@k-180.nutricia.com.pl> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <038001bf7c6c$0e09d1e0$b400000a@k-180.nutricia.com.pl>; from Mariusz.Potocki@nutricia.com.pl on Mon, Feb 21, 2000 at 02:03:32PM +0100 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 635 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Mon, Feb 21, 2000 at 02:03:32PM +0100, Mariusz Potocki wrote: > Anyone already configured proxy for this program? > > -- > Mariusz Potocki To run NetMeeting through a firewall, I am told, you have to open more ports than Swiss cheese has holes. Result: not a good firewall. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Tue Mar 14 08:49 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA21339 Tue, 14 Mar 2000 08:49:05 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA18504; Tue, 14 Mar 2000 05:55:09 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Mar 2000 05:51:36 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA17489 for fwtk-users-outgoing; Tue, 14 Mar 2000 05:51:35 -0800 (PST) Message-Id: <4.3.2.20000313170714.00b7dbc0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Mon, 13 Mar 2000 17:10:38 -0500 To: "Mike and Emily Jones" , From: Rick Murphy Subject: Re: Make error In-Reply-To: <000001bf8b39$754b2940$0200000a@domain1.test.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 743 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 03:08 AM 3/11/00 -0600, Mike and Emily Jones wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >I follow what the readme files say and when I type Make it says Stop. No >rule to make target. "Makefile.config Makefile.config isn't a target, it's a source file. What does the line in your Makefile that references Makefile.config say? >Also if I try to run the fixmake program it tells me there is no such file. Fixmake is ONLY used on BSD systems. You can correct the damage by using "fixmake unfix". -Rick From owner-fwtk-users@ex.tis.com Tue Mar 14 10:25 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA21748 Tue, 14 Mar 2000 10:24:59 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA01799; Tue, 14 Mar 2000 07:30:41 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Mar 2000 07:27:30 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA00790 for fwtk-users-outgoing; Tue, 14 Mar 2000 07:27:28 -0800 (PST) From: dw@Netzstation.net Subject: Windows-Shares through Fwtk To: fwtk-users@lists.nai.com X-Mailer: Lotus Notes Version 5.0.1 (Intl) 11. August 1999 Message-ID: Date: Tue, 14 Mar 2000 16:25:13 +0100 X-Priority: 3 (Normal) X-MIMETrack: Serialize by Router on Domino01/Netzstation/DE(Version 5.0.1 (Intl)| 11. August 1999) at 14.03.2000 16:25:29 MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 811 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi ! I've got a problem with getting Windows shares through our FWTK Firewall. The only thing I need is the possibility to get shares through the Firewall. I heard something about udprelay, installed it, but it doesn't seem to work as needed. Do I really need UDP relay? What other configurations need to be done? I would be glad if you anyone could tell me which way to go. :-) My Configuration is as follows: Internal Net 0 ------ Firewall ------- Internal Net 1 PC1 : 192.168.0.99 Which has the Shares PC2 : 196.195.0.88 Which needs the Shares Firewall: 192.168.0.3 and 196.195.0.10 If I need a plug-gw, where must I plug PC2 to ? Thanks. :-)) CU dw. From owner-fwtk-users@ex.tis.com Tue Mar 14 12:59 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA22777 Tue, 14 Mar 2000 12:59:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA25789; Tue, 14 Mar 2000 10:05:10 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Mar 2000 09:56:39 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA23741 for fwtk-users-outgoing; Tue, 14 Mar 2000 09:56:38 -0800 (PST) Mime-Version: 1.0 X-Sender: farone@mail.gvillesun.com Message-Id: In-Reply-To: <38C64697.DC2E828E@jamedia.com> References: <38C64697.DC2E828E@jamedia.com> Date: Tue, 14 Mar 2000 12:50:15 -0500 To: fwtk users From: Mark C Farone Subject: routing behind proxy Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 1024 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Currently, I have a fwtk proxy where the internal interface is within the subnet of the internal hosts it supports (10.1.1.0/24). At the moment, I'm simply doing default routing for all packets out the external interface to the external router. The proxy can find the hosts on the internal net because they are all on the same internal subnet. Now, I want to allow internal users on different subnets (e.g., 10.1.2.0/24) to be able to utilize the proxy services. What's the recommended way to route traffic from the proxy's internal interface to my internal router? Any security issues arise from simply adding a new route to the proxy's route table for the internal networks? This is a linux 2.0.36 box although I'm planning to move to a 2.2.x kernel soon. -- Mark C. Farone In the future, Systems Analyst, Gainesville Sun everything will work. From owner-fwtk-users@ex.tis.com Tue Mar 14 13:02 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA22794 Tue, 14 Mar 2000 13:02:54 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA27276; Tue, 14 Mar 2000 10:08:57 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Mar 2000 10:05:30 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA25859 for fwtk-users-outgoing; Tue, 14 Mar 2000 10:05:28 -0800 (PST) Date: Tue, 14 Mar 2000 13:04:46 -0500 From: Joseph S D Yao To: Blair Lowe Cc: Rick Murphy , fwtk-users@ex.tis.com Subject: Re: tis on rh linux 6.1 Message-Id: <20000314130446.N3308@washington.cospo.osis.gov> Mail-Followup-To: Blair Lowe , Rick Murphy , fwtk-users@ex.tis.com References: < <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from Blair.Lowe@compeng.net on Mon, Feb 21, 2000 at 01:55:37PM -0700 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1311 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Mon, Feb 21, 2000 at 01:55:37PM -0700, Blair Lowe wrote: > router[ipchains]/firewall[fwtk] config. I thought that this was a > standard configuration? The LINUX Firewall HOWTO recommends it in > fact. > > I suppose you could screw up your netperm-table config too, so what's > the difference? FWTK is a pure TCP proxy firewall kit. It contains absolutely nothing that allows IP through. Thus any attacks [which I shall not detail] that rely on getting specific IP packets to internal hosts are blocked. In addition, good proxies can screen the content, which they cannot if some IP forwarding software "end-runs" them. Some people who care more about access than this particular form of security will open UDP or unproxied TCP ports via an IP filter of some sort. If that is your priority, then fine. If you are doing it for someone else, make sure that they understand the vulnerability tradeoffs. And watch those configurations, of course! -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Tue Mar 14 17:09 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA23953 Tue, 14 Mar 2000 17:09:40 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA05961; Tue, 14 Mar 2000 14:12:44 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Mar 2000 14:09:36 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA05047 for fwtk-users-outgoing; Tue, 14 Mar 2000 14:09:35 -0800 (PST) Message-Id: <4.3.2.20000314165113.00b7d1d0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Tue, 14 Mar 2000 16:56:00 -0500 To: dw@Netzstation.net, fwtk-users@lists.nai.com From: Rick Murphy Subject: Re: Windows-Shares through Fwtk In-Reply-To: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 902 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 04:25 PM 3/14/00 +0100, dw@Netzstation.net wrote: >I've got a problem with getting Windows shares >through our FWTK Firewall. Good! That means it's working as intended :-) >The only thing I need is the possibility to get shares through >the Firewall. NetBIOS uses ports 137 UDP (nbname), 138 UDP (nbdatagram) and 139 TCP (nbsession). The only one that you can do anything with using just FWTK stuff is the session service, 139 TCP. Ports 137 and 138 must go through packet filtered or some other way; the addresses must be exposed on both since the data requests (nbdatagram) have the address to respond to embedded in the data portion. Bottom line: use scp or something else to shuffle your data through the firewall. You can't secure NetBIOS. -Rick From owner-fwtk-users@ex.tis.com Wed Mar 15 05:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA25944 Wed, 15 Mar 2000 05:45:15 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA07114; Wed, 15 Mar 2000 02:51:24 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 15 Mar 2000 02:46:56 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA05763 for fwtk-users-outgoing; Wed, 15 Mar 2000 02:46:53 -0800 (PST) MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Message-ID: <14543.27129.917475.77305@taltos.tla.org> Date: Wed, 15 Mar 2000 05:46:17 -0500 (EST) From: carson@tla.org To: Rick Murphy Cc: dw@Netzstation.net, fwtk-users@lists.nai.com Subject: Re: Windows-Shares through Fwtk In-Reply-To: <4.3.2.20000314165113.00b7d1d0@mail.itm-inst.com> References: <4.3.2.20000314165113.00b7d1d0@mail.itm-inst.com> X-Mailer: VM 6.62 under 20.0 XEmacs Lucid (beta28) Reply-To: carson@tla.org Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1652 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] >>>>> "Rick" == Rick Murphy writes: Rick> At 04:25 PM 3/14/00 +0100, dw@Netzstation.net wrote: >> The only thing I need is the possibility to get shares through >> the Firewall. Rick> NetBIOS uses ports 137 UDP (nbname), 138 UDP (nbdatagram) and 139 TCP Rick> (nbsession). Rick> The only one that you can do anything with using just FWTK stuff is the Rick> session service, 139 TCP. Ports 137 and 138 must go through packet filtered Rick> or some other way; the addresses must be exposed on both since the data Rick> requests (nbdatagram) have the address to respond to embedded in the data Rick> portion. Rick> Bottom line: use scp or something else to shuffle your data through the Rick> firewall. You can't secure NetBIOS. Now, now - the above is not _strictly_ true. If you plug port 139/tcp from the bastion to your file server, and add the bastion's IP address as the server's in the client's LMHOSTS file, you can successfully mount a CIFS share. Of course, if you want more than one server, you'll either have to implement transparancy, or use virtual IP addresses, as the port must be 139 (at least via the GUI - anyone know if you can NET USE a share on an alternate port? I don't think so, but I could be wrong.) Of course, the security (or lack thereof) of the above-mentioned config is a definite issue. But it _is_ possible. -- Carson Gaspar -- carson@tla.org carson@cs.columbia.edu carson@cugc.org http://www.cs.columbia.edu/~carson/home.html Queen Trapped in a Butch Body From owner-fwtk-users@ex.tis.com Fri Mar 17 06:43 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA06100 Fri, 17 Mar 2000 06:43:06 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA14930; Fri, 17 Mar 2000 03:48:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 17 Mar 2000 02:25:49 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA10445 for fwtk-users-outgoing; Fri, 17 Mar 2000 02:25:38 -0800 (PST) From: dw@Netzstation.net Subject: How to dump... To: fwtk-users@lists.nai.com X-Mailer: Lotus Notes Version 5.0.1 (Intl) 11. August 1999 Message-ID: Date: Fri, 17 Mar 2000 11:22:59 +0100 X-Priority: 3 (Normal) X-MIMETrack: Serialize by Router on Domino01/Netzstation/DE(Version 5.0.1 (Intl)| 11. August 1999) at 17.03.2000 11:22:57 MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 691 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi ! Thanks for your help with sharing that Windows directories through FWTK, I will test it as soon as possible, but I'm sure it will work, I've got another question. It has nothing to do with FWTK. I need a diskimage of a bootable DOS-disk I have. I want to use "dd" to create an image, but I think I've got a problem with the Syntax, It is necessary, that the disk dump, which should be created in a File, is a 100% Clone of the original (BootSector etc.) (I want to use rawrite under Win to restore it) Do you know how to do this? Thanks @ll :-) -dw From owner-fwtk-users@ex.tis.com Fri Mar 17 16:06 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA08276 Fri, 17 Mar 2000 16:06:31 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA04615; Fri, 17 Mar 2000 13:11:12 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 17 Mar 2000 12:17:41 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA27206 for fwtk-users-outgoing; Fri, 17 Mar 2000 12:17:25 -0800 (PST) <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> <20000314130446.N3308@washington.cospo.osis.gov> Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: <20000314130446.N3308@washington.cospo.osis.gov> References: < <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> <20000314130446.N3308@washington.cospo.osis.gov> Date: Fri, 17 Mar 2000 13:14:49 -0700 To: Joseph S D Yao From: Blair Lowe Subject: Re: tis on rh linux 6.1 Cc: Rick Murphy , fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 3299 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Joseph, Thanks for your reply (and your smap patch). I see what you mean with respect to the advantages of not allowing packets to be forwarded at all. Having said that, though, internal users usually should have transparent access to the outside, and running auth, and GW programs on a gateway machine means that there is alot of extra training, maintenance, and time spent authenticating on the firewall where it may not be necessary. As far as I know, the Linux's ip_forward code just allows the kernel to scan packets before any other programs get a hold of them (by using ipchains), and it is essential for LINUX IP address translations (or IP Masquerading). When I refer to turning on ip_forwarding, I am not meaning that I want to port forward packets to another box. That is done by a separate kernel module, and a program called ipmasqadm. I don't see how using ipchains is vulnerable. If anything it is more robust since one is physically denying not only suspect TCP packets, but also icmp, and UDP packets as well. With some pinning down of the ftp connection ports as is done with some ftp-gw patches, and by running the LINUX spoof protection kernel module one should be able to run a VERY tight ship. The only vulnerability is by setting up a poor packet filter or by forgetting to turn on spoof protection. The point is that if the packet filtering is done at the kernel level, then it acts as if it is a distinct router, and that turning on "ip_forward" in linux does not mean that you are opening anything up unless you have set up a poor router system with ipchains. So running ipchains AND fwtk is a wicked combination that gives internal users absolute freedom, while external services are clamped down. Flames and furthur discussion are encouraged:) Blair. At 13:04 -0500 2000/03/14, Joseph S D Yao wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >On Mon, Feb 21, 2000 at 01:55:37PM -0700, Blair Lowe wrote: >> router[ipchains]/firewall[fwtk] config. I thought that this was a >> standard configuration? The LINUX Firewall HOWTO recommends it in >> fact. >> >> I suppose you could screw up your netperm-table config too, so what's >> the difference? > >FWTK is a pure TCP proxy firewall kit. It contains absolutely nothing >that allows IP through. Thus any attacks [which I shall not detail] >that rely on getting specific IP packets to internal hosts are blocked. >In addition, good proxies can screen the content, which they cannot if >some IP forwarding software "end-runs" them. > >Some people who care more about access than this particular form of >security will open UDP or unproxied TCP ports via an IP filter of some >sort. If that is your priority, then fine. If you are doing it for >someone else, make sure that they understand the vulnerability >tradeoffs. And watch those configurations, of course! Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) All email advice that is provided for free is without warrantee: use at your own risk. From owner-fwtk-users@ex.tis.com Fri Mar 17 19:13 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA08925 Fri, 17 Mar 2000 19:13:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA24173; Fri, 17 Mar 2000 16:17:47 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 17 Mar 2000 15:25:26 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA19559 for fwtk-users-outgoing; Fri, 17 Mar 2000 15:25:15 -0800 (PST) From: "Joseph Judge" To: "Dirk.Nerling" , "Firewall Toolkit (M-list)" Subject: RE: plan a Firewall with fwtk and a DMZ Date: Fri, 17 Mar 2000 18:24:19 -0500 Message-ID: <004d01bf9067$eb2eb040$0601a8c0@poopy.intrusion.org> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2377.0 In-Reply-To: <6CC81B07CB44D311A1D20001FA7E99561150A3@exchange.pdv.de> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V4.72.3155.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 7324 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] All - I've never run the FWTK with a 3rd "DMZ" LAN off of the firewall/gateway. So, I'm pulling most of this from just "gut feel" Jump in and correct me where I'm wrong. (read on ... comments in the original email message below) > > I'm running fwtk for years now and I'm quite happy with this. I did it in > the normal dual homed configuration but now I plan to install a > DMZ. I read > all I found about a DMZ but unfortunately I still have some questions. The > firewall (FreeBSD 3.4) could be a 600Mhz, PIII with 256 MB and 3 x 100MB > NIC. A 600 MHz machine is quite zippy -- so I cannot imagine performance problems (in terms of CPU processing). If you have a lot of connections through an application proxy you have to consider the performance hit that will happen -- because the connection is being handled up at a higher level and because of the fork/exec overhead. If you are running a plug-gw or http-gw in daemon mode -- then the fork/exec issue is less of or not a problem. I often run a packet filtering device in front of my DMZs now. My web server/ftp server/dns servers are all on hardened machines -- and the packet filter screens out most packet-levle scariness. My main risks are now simply the services I let through (apache, netscape, bind, sshd) > Here is the setup I plan: > > > Internet / ISP with squid and NNTP Server > | > | speed: some more than a T1 (2MB) > | > cisco (normal without firewall ios) > | > | > FW NIC1 with offical ip H -- www server with > ~5 virtuell domains, plans to install a shop system and portal > (I'm afraid a > lot of traffic) > (external DNS) | > FWTK , smap, http-gw U -- one anonymous ftp > server and some private ftp servers (not too much traffic) > | > FW NIC2 with rfc 1918 ip -------DMZ -------- B -- squid for providing web > cache for my internal users (a lot of traffic) > > sendmail, http-gw, ftp-gw, plug-gw for nntp to our isp > FW NIC3 with other rfc 1988 ip > > | > |------------------ internal net with clients, internal dns, > internal mail server with subdomains ... > > now my questions: > > 1. Gernell: > 1.1 Will the firewall with FreeBSD and TIS have the power to serve all > requests (external: www with portal, webbrowsing from the internal net and > so on) I would think so ... you have enough horsepower for more than the bandwidth you are serving. > 1.2. Should I run the external DNS really at the firewall, if so > I'd like to > use chroot - or should/could I put them in the DMZ? Good idea to chroot() it -- most folks don't. I still run my DNS on the firewall ... but I really think I should have moved it over to a DMZ system by now. I've not done either -- should do one, or the other, or both. > 1.3 I often hear that people put thier mailserver in the DMZ, > why? Isn't it > easier and more secure, to use smap external save the mail to disk and > deliever internal with sendmail? Folks come from different backgrounds. I've run into folks that use FW-1 ... and _never_ heard of a firewall able to handle email transport (SMTP) !!! They were shocked when I argued that feature _has_ to be in the FW-1 somewhere ... and they found it. Politics: run smap/sendmail on the firewall, keep the internal IT folks (who like exchange) away from this sensitive function. Performance: high email load, you may wish to move it off to some DMZ mail-specific machine. This is especially true if you desire to add virus scanning to the function. Risk: sendmail is often a risk. Run qmail ... or run smap and only use sendmail as a transport off of the machine. Both reduce the risk significantly. Same issue as DNS = if you run it on the firewall, you _are_ opening some amount of risk, so reduce it somehow (chroot bind, smap senmail). > 1.3 I need to route mail for the virtuell domains also through the > firewall, do I need a sendmail.cf for each virtuell domain? I don't remember the smap/smapd code now ... used to be able to configure it (with spam filters) to reject bad domains, etc. To do this, it required knowledge of "OK" domains. Also, newer sendmail versions all support configuration of the mail sendmail.cf -- that support multiple domains, masquerading, etc. Years ago, I had a "map" file for sendmail. This said that "foo.com esmtp:insidemailserver.foo.com" and had mappings for other servers inside. > 2. W3 related: > 2.1. How do I setup virtuell webdomains, if the webserver have > rfc 1918 ip's > (put all virtuell ip's on the FW NIC 1?) Put all virtual IPs on the front of the firewall ... pass through the connections to the web servers. There were patches to plug-gw that would bind to specific IP addresses so that you could do this. Dunno the code anymore, assume its in there somewhere. (maybe http-gw?) > 2.2. Could http-gw work with virtuell domains or could/should I use > plug-gw? Check above -- the trick you are looking for is the ability to have the proxy bind to a specific address. > 2.3. Will http-gw be stable and quick enough to serve squid and > my virtuell > domains and will this combination do what I want? I always used plug-gw ... never used http-gw to front a web server. > 2.4. I also use the squid of my isp as a second cache - and I afraid this > wont work any longer because they need udp - right? I don't know what you mean ... why would they need UDP? I assume the ISP cache is transparent ... so nothing you do at your end would bother it. > 2.5 Is running squid at the firewall a problem - do I need to put them in > the DMZ? As long as squid does not answer on the "outside" of the firewall, then I would worry less about the external risk. If the squid is maintained and system is watched, then I'd not worry - as much - about the inside risk. I would worry about performance of heavy web usage slamming the gateway (it could). > 3. ftp related: > 3.1. I could use plug-gw to stream the external ftp connects to > my internal > anonymous ftp server, but who about virtuell domains? FTP control channel could be plug'ed -- but the data channel would not be -- so you'd be stuck with no ability to list directories and transfer files. You _have_ to use an FTP proxy that is default forwarded to the real ftp site. Folks hit the firewall, login as "anonymous" and the ftp-proxy sends them to the right place. If you have it bind to specific IP addresses on the firewall, then you can run different ftp-gw's - one for each one behind the gateway. > > > Sorry to ask such dumb questions but I can't find answers at www.fwtk.org > nor at previous postings of the fwtk mailling list. Hope we could discuss > the problem and perhaps I'm able to write a DMZ part of the FAQ. > > best regards and MANY thanks in advance! > Dirk Nerling > -- > Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: > ++49-361-4407144 > PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 > CC83 > http://www.pdv.de > From owner-fwtk-users@ex.tis.com Mon Mar 20 16:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA18350 Mon, 20 Mar 2000 16:26:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA10772; Mon, 20 Mar 2000 13:31:16 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Mar 2000 12:04:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA28180 for fwtk-users-outgoing; Mon, 20 Mar 2000 12:04:37 -0800 (PST) Message-ID: <000b01bf92a8$6cac1080$3702040a@healtheon.com> From: "Bill Kocik" To: References: <<4.2.2.20000221141405.00b29ba0@mail.itm-inst.com><20000314130446.N3308@washington.cospo.osis.gov> Subject: Re: tis on rh linux 6.1 Date: Mon, 20 Mar 2000 12:11:06 -0800 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6600 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 4147 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Thanks for your reply (and your smap patch). > > I see what you mean with respect to the advantages of not allowing > packets to be forwarded at all. Having said that, though, internal > users usually should have transparent access to the outside, and > running auth, and GW programs on a gateway machine means that there > is alot of extra training, maintenance, and time spent authenticating > on the firewall where it may not be necessary. This is a big problem with non-transparent proxies. You end up in a mode where you must insist that users use Product X for FTP and Product Y for Telnet and such, because they're the only ones that support your proxy configuration. It can be quite a pain. > As far as I know, the Linux's ip_forward code just allows the kernel > to scan packets before any other programs get a hold of them (by > using ipchains), and it is essential for LINUX IP address > translations (or IP Masquerading). Well, it's IP Firewalling code does that. And it doesn't really scan the packets, it just looks at the source and destination ports and addresses. It's just a packet filter. Forwarding allows a machine to transfer incoming packets on one interface to outgoing packets on another. > When I refer to turning on ip_forwarding, I am not meaning that I > want to port forward packets to another box. That is done by a > separate kernel module, and a program called ipmasqadm. > > I don't see how using ipchains is vulnerable. If anything it is more > robust since one is physically denying not only suspect TCP packets, > but also icmp, and UDP packets as well. With some pinning down of the > ftp connection ports as is done with some ftp-gw patches, and by > running the LINUX spoof protection kernel module one should be able > to run a VERY tight ship. This is a double-edged sword. On one hand, you do get the ability to consciously deny/reject/accept/log/whatever incoming packets that don't come in on a port a proxy is listening on, rather than just hoping nothing's listening on that port (as would be the case if you were using proxies only). On the other hand, by turning on forwarding you've built a bridge that an attacker can cross to get into your protected network. It's my opinion that there are actually three main types of firewalls, the two most commonly known: "That which is not expressly prohibited is permitted" "That which is not expressly permitted is prohibited" ...and a third type, which is how I view proxy only firewalls: "That which is neither expressly prohibited nor expressly permitted will go right over my head" In the third case, you leave the operating system to deal with all packets that the proxies don't see, and you'd better hope everything's turned off. At the very least, you're probably leaving yourself open to attack the next time someone discovers that sending Packet X to Port Y causes the tcp/ip stack of Operating System Z to go ass over teakettle. > The point is that if the packet filtering is done at the kernel > level, then it acts as if it is a distinct router, and that turning > on "ip_forward" in linux does not mean that you are opening anything > up unless you have set up a poor router system with ipchains. So > running ipchains AND fwtk is a wicked combination that gives internal > users absolute freedom, while external services are clamped down. I agree. A proxy server plus a packet filter or stateful inspection system plus something like PortSentry configured properly can make for a very formidable firewall, where each of these by themselves would fall short in some way. The most secure would be to use a filter in this scenario without forwarding on, the most transparent would be the same configuration with forwarding/masquerading/nat on. Proxy what you can, and forward stuff the proxies can't deal with. Just my .02 Bill Kocik Taos Mountain - "The Sys Admin Company" Santa Clara, California http://www.taos.com "Logic is a systematic method of coming to the wrong conclusion with confidence." From owner-fwtk-users@ex.tis.com Mon Mar 20 18:24 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA19099 Mon, 20 Mar 2000 18:23:54 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA28382; Mon, 20 Mar 2000 15:29:07 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Mar 2000 14:39:55 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA22010 for fwtk-users-outgoing; Mon, 20 Mar 2000 14:39:44 -0800 (PST) Message-ID: <001e01bf92be$1ccfdf90$3702040a@healtheon.com> From: "Bill Kocik" To: , "Donald J Smith" References: <<4.2.2.20000221141405.00b29ba0@mail.itm-inst.com><20000314130446.N3308@washington.cospo.osis.gov> <3.0.3.32.20000320144007.007778b4@mail.denver.gd-is.com> Subject: Re: tis on rh linux 6.1 Date: Mon, 20 Mar 2000 14:46:21 -0800 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6600 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 4397 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > >In the third case, you leave the operating system to deal with all packets > >that the proxies don't see, and you'd better hope everything's turned off. > HOPE!! You should have configured it that way and had better be testing to > ensure it > stays that way. Anyone who configures a firewall and doesn't test it gets > what every they get. Hope, check, ensure, guarantee, it's all semantics. You can plainly see what my point was. Maybe it would have been clearer/more accurate if I'd said that the philosophy of proxy-only firewalls assumes that the OS has been locked down, not necessarily that the admin is left to hope this is the case. I prefer to do everything in my power leave *nothing* to human error, even if I'm the human in question. I trust myself, but I'm not perfect. > >At the very least, you're probably leaving yourself open to attack the next > >time someone discovers that sending Packet X to Port Y causes the tcp/ip > >stack of Operating System Z to go ass over teakettle. > Nope no such beast. Wrong. There are many well-known instances in which this has been the case. The infamous Windows nukes/teardrops/bonks are one such example (not that Windows is anything better than laughable as a firewall platform anyways). For a while, the Linux kernel was also subject to similar attacks in the 2.0 series (Note: That's the *kernel*, not an application) before it was fixed. I'm sure these are not the only cases, either. The biggest problem I see with this is that a popular philosophy concerning firewalls is that it's far more important to protect your local network than it is to protect your firewall itself, and if you're using proxies only than theoretically noone should be able to bypass the firewall to get into the local LAN, even if the firewall itself is compromised as a sacrificial lamb. The fatal flaw I see in this thinking is that if someone compromises the firewall, what's to stop them from turning on port forwarding in the OS and using it as a jumping off point to get to the rest of the network? No, I don't personally know how this could be done, but it's theoretically possible and that's enough for me. > There were only a few things that too many IP stack writers (Such > as noone would send sync with ack...) > took for granted and if you on an os that doesn't deal with all > possibilities then thats a > cruddy os to use for a firewall. Cruddy or not, there is always the chance that any operating system is vulnerable to something along these lines, whether someone has figured it out yet or not (Note: I said "chance", not "guarantee"). The worst exploits are the ones that we don't know about yet. And even if this can't happen, it's _still_ hard to argue that setting up a packet filter in addition to your proxy isn't better security than a proxy alone. You say above that anyone who doesn't ensure their operating system is locked down tightly by testing their firewall deserves whatever they get (paraphrasing). My question is, what are you testing for exactly? Known vulnerabilities? What about as-yet-undiscovered vulnerabilities? How do you test for those? I can just as easily say that anyone who puts all their faith in the belief that their OS has been made impenetrable (because nmap said so or something) and chooses not to set up a filter also deserves whatever they get. What's the difference? Whether you necessarily agree with my arguments or not, I believe the point I was going for is hard to argue against: Proxying plus filtering is inherently safer than proxying alone (unless, of course, your filtering software itself introduces a vulnerability....but that's a whole other discussion ;-). > now our it's worth .03 ;-) > -------------------------------------------------------------------------- ---- > Don Smith General Dynamics Information Systems General Dynamics, eh? I nearly took a job with a firm that wanted to place me there once in their Michigan location. Neat company (GD, that is). Things didn't work out between myself and the placement firm, though. Bill Kocik Taos Mountain - "The Sys Admin Company" Santa Clara, California http://www.taos.com "Logic is a systematic method of coming to the wrong conclusion with confidence." From owner-fwtk-users@ex.tis.com Mon Mar 20 20:59 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA19593 Mon, 20 Mar 2000 20:59:53 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA10756; Mon, 20 Mar 2000 18:05:07 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Mar 2000 17:12:46 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA07667 for fwtk-users-outgoing; Mon, 20 Mar 2000 17:12:40 -0800 (PST) Message-ID: <20000321011205.2236.qmail@web505.mail.yahoo.com> Date: Mon, 20 Mar 2000 17:12:05 -0800 (PST) From: po llito Subject: Using http-gw & apache for web proxy To: fwtk-users@tis.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1029 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, perhaps my initial questions was a bit loaded. If anyone can provide any input/examples on the following, I would greatly appreciate it: I'm interested in finding out how an disallowed IP address can connect through the proxy server (allowed IP address) and the proxy server can request the IP restricted http resource on behalf of the disallowed IP address and return the results to the disallowed address (netperm-table examples?) Can I use an automatic proxy configuration file from a web browser (*.pac) so that only sites in the javascript function are proxied? i.e.: if (dnsDomainIs(host,"IPrestricted.site")) { return "PROXY proxy.IPallowed:80"; } How do I dot the above using only http-gw and apache? Any ideas are greatly appreciated. ed. __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com From owner-fwtk-users@ex.tis.com Mon Mar 20 22:00 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA19685 Mon, 20 Mar 2000 21:59:52 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA24991; Mon, 20 Mar 2000 19:04:58 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Mar 2000 18:12:59 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA11178 for fwtk-users-outgoing; Mon, 20 Mar 2000 18:12:44 -0800 (PST) From: "Luis Fernando Barrera" To: "Bill Kocik" , , "Donald J Smith" Subject: RE: tis on rh linux 6.1 (NAT versus Proxies) Date: Mon, 20 Mar 2000 19:31:14 -0600 Message-ID: Mime-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Importance: Normal In-Reply-To: <001e01bf92be$1ccfdf90$3702040a@healtheon.com> Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id SAA11156 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2485 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, These arguments were very interesting. So... 1) A firewall made of proxies + packet filtering is the most secure version. However the IP forwarding option must be turned off, right? Something is not clear to me... If you use IP Masquerading (i.e. NAT), you need to turn on the IP forwarding option, right? So, the mere posibility that someone could use your FW as a bridge, it's a tragedy! I understand that if you have an IP network with public addresses and a machine that is acting like a router (i.e. IP forwarding ON), is the biggest risk. However if you're using IP Masquerading (in Linux), that means you have an internal network, with private addresses, and the FW box maps those addresses...So, * how can anyone use the firewall as a bridge? * Maybe this is the point...It doesn't matter if you can make a hell of a packet filter (with spoof protecion), if someone (even in theory) can take advantage of the forwarding option of the firewall , and make the entry in your network... Maybe someone can make a conclusion out of this... Luis Fernando Barrera luba@assist.com.gt Assist Software Development > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Bill Kocik > Sent: Lunes 20 de Marzo de 2000 04:46 PM > To: fwtk-users@ex.tis.com; Donald J Smith > Subject: Re: tis on rh linux 6.1 > > > > >In the third case, you leave the operating system to deal with all > packets > > >that the proxies don't see, and you'd better hope everything's turned > off. > > > HOPE!! You should have configured it that way and had better be > testing to > > ensure it > > stays that way. Anyone who configures a firewall and doesn't > test it gets > > what every they get. > > > What's the difference? > > Whether you necessarily agree with my arguments or not, I believe > the point > I was going for is hard to argue against: Proxying plus filtering is > inherently safer than proxying alone (unless, of course, your filtering > software itself introduces a vulnerability....but that's a whole other > discussion ;-). > > > now our it's worth .03 ;-) > > > -------------------------------------------------------------------------- > ---- > > Don Smith General Dynamics Information > Systems > From owner-fwtk-users@ex.tis.com Tue Mar 21 02:13 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA20194 Tue, 21 Mar 2000 02:13:07 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id XAA07975; Mon, 20 Mar 2000 23:18:23 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Mar 2000 22:26:29 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id WAA05928 for fwtk-users-outgoing; Mon, 20 Mar 2000 22:26:14 -0800 (PST) Message-ID: <38D7149E.2CB75491@velocityhsi.com> Date: Mon, 20 Mar 2000 22:20:14 -0800 From: Bill Kocik X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.14 i586) X-Accept-Language: en MIME-Version: 1.0 To: Luis Fernando Barrera Cc: fwtk-users@ex.tis.com, Donald J Smith Subject: Re: tis on rh linux 6.1 (NAT versus Proxies) References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2503 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > 1) A firewall made of proxies + packet filtering is the most secure version. However > the IP forwarding option must be turned off, right? For utmost security, yes, it's best to have forwarding turned off. > > Something is not clear to me... If you use IP Masquerading (i.e. NAT), you need > to turn on the IP forwarding option, right? > So, the mere posibility that someone could use your FW as a bridge, it's a tragedy! Yes, that's true. But in configuring any firewall system one must find a balance between security and usability that fits their particular needs. If you need forwarding, you turn it on. If you can't live with the risk, you don't. > I understand that if you have an IP network with public addresses and a machine that is > acting like a router (i.e. IP forwarding ON), is the biggest risk. > However if you're using IP Masquerading (in Linux), that means you have an internal network, with > private addresses, and the FW box maps those addresses...So, * how can anyone use the firewall as a bridge? * The one way that immediately pops into my head is by using source routed frames (which any TCP/IP stack worth it's salt will drop like a hot rock...heck, even NT does this). There may be other ways, though, but the fact that I cannot think of more is irrelevant. By definition, if your firewall is capable of and willing to pass a packet from one interface to another to facilitate communication between an external and internal host (without proxying for it) in either direction, there's a risk. Even if it's only a theoretical risk, it's a risk. Oh yeah, another way just came to mind: spoofing. It's simple enough to guard against this, but it seems every time someone thinks they've created a secure OS/application/network, someone else comes along and proves them wrong. > Maybe this is the point...It doesn't matter if you can make a hell of a packet filter (with spoof protecion), > if someone (even in theory) can take advantage of the forwarding option of the firewall , and make > the entry in your network... That's exactly it. I've just never been very good at brevity. > Maybe someone can make a conclusion out of this... There are no conclusions, only preludes to further discussions. :-) -- Bill Kocik Taos Mountain - "The Sys Admin Company" Santa Clara, California http://www.taos.com From owner-fwtk-users@ex.tis.com Tue Mar 21 02:56 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA20315 Tue, 21 Mar 2000 02:56:20 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA10756; Tue, 21 Mar 2000 00:01:34 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Mar 2000 23:18:06 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id XAA07947 for fwtk-users-outgoing; Mon, 20 Mar 2000 23:17:59 -0800 (PST) X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E99561349E9@exchange.pdv.de> From: "Dirk.Nerling" To: "Firewall Toolkit (M-list)" Subject: smap: what does EXPN root mean ??? Date: Tue, 21 Mar 2000 08:16:45 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 2042 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello all, somebody tried to access my firewall. As far as I see there is nothing to worry about. But what does "EXPN root" mean? Mar 20 23:46:47 wall /kernel: ipfw: 500 Accept ICMP:8.0 212.159.70.114 194.139.111.2 in via de1 Mar 20 23:46:47 wall /kernel: ipfw: 500 Accept ICMP:0.0 194.139.111.2 212.159.70.114 out via de1 Mar 20 23:46:47 wall /kernel: ipfw: 500 Accept ICMP:13.0 212.159.70.114 194.139.111.2 in via de1 Mar 20 23:46:47 wall /kernel: ipfw: 500 Accept ICMP:14.0 194.139.111.2 212.159.70.114 out via de1 Mar 20 23:46:47 wall /kernel: ipfw: 500 Accept ICMP:17.0 212.159.70.114 194.139.111.2 in via de1 Mar 20 23:46:48 wall /kernel: ipfw: 500 Accept ICMP:3.3 194.139.111.2 212.159.70.114 out via de1 Mar 21 05:38:35 wall /kernel: ipfw: 500 Accept ICMP:8.0 212.159.70.114 194.139.111.2 in via de1 Mar 21 05:38:35 wall /kernel: ipfw: 500 Accept ICMP:0.0 194.139.111.2 212.159.70.114 out via de1 Mar 21 05:38:35 wall /kernel: ipfw: 500 Accept ICMP:13.0 212.159.70.114 194.139.111.2 in via de1 Mar 21 05:38:35 wall /kernel: ipfw: 500 Accept ICMP:14.0 194.139.111.2 212.159.70.114 out via de1 Mar 21 05:38:35 wall /kernel: ipfw: 500 Accept ICMP:17.0 212.159.70.114 194.139.111.2 in via de1 Mar 21 05:38:37 wall netacl[17972]: deny host=114.03-02.quay.dial.plus.net.uk/212.159.70.114s service=in.ftpd Mar 21 05:38:37 wall smap[17974]: connect host=114.03-02.quay.dial.plus.net.uk/212.159.70.114 Mar 21 05:38:43 wall smap[17974]: EXPN root (114.03-02.quay.dial.plus.net.uk/212.159.70.114) Mar 21 05:38:46 wall smap[17974]: deny host=114.03-02.quay.dial.plus.net.uk/212.159.70.114 use of gateway Mar 21 05:39:32 wall /kernel: ipfw: 500 Accept ICMP:3.3 194.139.111.2 212.159.70.114 out via de1 best regards Dirk -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de From owner-fwtk-users@ex.tis.com Tue Mar 21 08:44 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA21626 Tue, 21 Mar 2000 08:44:29 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA29703; Tue, 21 Mar 2000 05:48:58 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 04:54:46 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA26285 for fwtk-users-outgoing; Tue, 21 Mar 2000 04:54:41 -0800 (PST) X-Authentication-Warning: wall.pdv.de: mail set sender to using -f Message-ID: <6CC81B07CB44D311A1D20001FA7E99561349F1@exchange.pdv.de> From: "Dirk.Nerling" To: "Firewall Toolkit (M-list)" Subject: how to configure ipfw for use with ftp-gw ??? Date: Tue, 21 Mar 2000 13:53:18 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.0.1460.8) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1397 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, does anybody has an idea? I allowed connects to my ftp-gw port but because, so the connection establishes well. But because ftp opens some other (random) ports for "ls" and so on - the client hangs. I then have the ipfw entries in my log file: Mar 21 13:44:46 wall /kernel: ipfw: 2910 Deny TCP 192.76.144.75:20 194.139.111.2:1478 in via de1 Mar 21 13:44:50 wall /kernel: ipfw: 2910 Deny TCP 192.76.144.75:20 194.139.111.2:1478 in via de1 Mar 21 13:44:56 wall /kernel: ipfw: 2910 Deny TCP 192.76.144.75:20 194.139.111.2:1478 in via de1 Mar 21 13:45:09 wall /kernel: ipfw: 2910 Deny TCP 192.76.144.75:20 194.139.111.2:1478 in via de1 Mar 21 13:45:35 wall /kernel: ipfw: 2910 Deny TCP 192.76.144.75:20 194.139.111.2:1478 in via de1 Mar 21 13:46:04 wall /kernel: ipfw: 2910 Deny TCP 192.76.144.75:20 194.139.111.2:1625 in via de1 Mar 21 13:46:08 wall /kernel: ipfw: 2910 Deny TCP 192.76.144.75:20 194.139.111.2:1625 in via de1 Mar 21 13:46:14 wall /kernel: ipfw: 2910 Deny TCP 192.76.144.75:20 194.139.111.2:1625 in via de1 Has anybody an idea??? best regards Dirk -- Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone: ++49-361-4407144 PGP Fingerprint: C559 FF0E BAD0 9E09 F720 20F3 683E 357F 69B5 CC83 http://www.pdv.de From owner-fwtk-users@ex.tis.com Tue Mar 21 09:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA21863 Tue, 21 Mar 2000 09:38:32 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA06452; Tue, 21 Mar 2000 06:43:03 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 05:59:41 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA00515 for fwtk-users-outgoing; Tue, 21 Mar 2000 05:59:16 -0800 (PST) From: ark@eltex.ru Date: Tue, 21 Mar 2000 13:45:55 +0300 Message-Id: <200003211045.NAA03789@paranoid.eltex.spb.ru> In-Reply-To: <000b01bf92a8$6cac1080$3702040a@healtheon.com> from ""Bill Kocik" " Organization: "Klingon Imperial Intelligence Service" Subject: Re: tis on rh linux 6.1 To: bkocik@velocityhsi.com Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 2122 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, "Bill Kocik" said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > Thanks for your reply (and your smap patch). > > > > I see what you mean with respect to the advantages of not allowing > > packets to be forwarded at all. Having said that, though, internal > > users usually should have transparent access to the outside, and > > running auth, and GW programs on a gateway machine means that there > > is alot of extra training, maintenance, and time spent authenticating > > on the firewall where it may not be necessary. > > This is a big problem with non-transparent proxies. You end up in a mode > where you must insist that users use Product X for FTP and Product Y for > Telnet and such, because they're the only ones that support your proxy > configuration. It can be quite a pain. Not at all. You just say: i suggest using X,Y or Z for ftp or A,B or C for telnet and you can get instructions . If you use another program, it is your problem to configure it. It is generally not a good idea to use random software in corporate environment anyways. Sometimes it is even a good idea to strictly prohibit usage of things not checked by IT security. (I'd say most of times, but some people think i am too paranoid). _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBONdS4aH/mIJW9LeBAQEa6AP/dPHl7pWbswEGQoHV0ruVuS7eRpt6sRuY QRkIgIELfpihxyNCxVhsM6k+foEi3slYTENBQzni531l0FGU+CelUS5edRJrjej1 oXvQ2lhPSSKKlRke1xexgyTgA7om3Dv0/emsoNYXNrIIrAlw55z0WBlEL3iioCnv U5+tBNjwTog= =+lCs -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Mar 21 09:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA21868 Tue, 21 Mar 2000 09:38:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA06468; Tue, 21 Mar 2000 06:43:12 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 05:58:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA00398 for fwtk-users-outgoing; Tue, 21 Mar 2000 05:58:04 -0800 (PST) Message-Id: <3.0.3.32.20000320144007.007778b4@mail.denver.gd-is.com> X-Sender: dsmith@mail.denver.gd-is.com X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) Date: Mon, 20 Mar 2000 14:40:07 -0700 To: "Bill Kocik" , From: Donald J Smith Subject: Re: tis on rh linux 6.1 In-Reply-To: <000b01bf92a8$6cac1080$3702040a@healtheon.com> References: < <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> <20000314130446.N3308@washington.cospo.osis.gov> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 3917 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 12:11 PM 3/20/00 -0800, Bill Kocik wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >> Thanks for your reply (and your smap patch). >> cut above >This is a double-edged sword. On one hand, you do get the ability to >consciously deny/reject/accept/log/whatever incoming packets that don't come >in on a port a proxy is listening on, rather than just hoping nothing's >listening on that port (as would be the case if you were using proxies >only). On the other hand, by turning on forwarding you've built a bridge >that an attacker can cross to get into your protected network. It's my >opinion that there are actually three main types of firewalls, the two most >commonly known: >"That which is not expressly prohibited is permitted" >"That which is not expressly permitted is prohibited" >...and a third type, which is how I view proxy only firewalls: >"That which is neither expressly prohibited nor expressly permitted will go >right over my head" >In the third case, you leave the operating system to deal with all packets >that the proxies don't see, and you'd better hope everything's turned off. HOPE!! You should have configured it that way and had better be testing to ensure it stays that way. Anyone who configures a firewall and doesn't test it gets what every they get. >At the very least, you're probably leaving yourself open to attack the next >time someone discovers that sending Packet X to Port Y causes the tcp/ip >stack of Operating System Z to go ass over teakettle. Nope no such beast. It is almost always not the tcp/ip stack but rather a application problem. There were only a few things that too many IP stack writers (Such as noone would send sync with ack...) took for granted and if you on an os that doesn't deal with all possibilities then thats a cruddy os to use for a firewall. > >> The point is that if the packet filtering is done at the kernel >> level, then it acts as if it is a distinct router, and that turning >> on "ip_forward" in linux does not mean that you are opening anything >> up unless you have set up a poor router system with ipchains. So >> running ipchains AND fwtk is a wicked combination that gives internal >> users absolute freedom, while external services are clamped down. > >I agree. A proxy server plus a packet filter or stateful inspection system >plus something like PortSentry configured properly can make for a very >formidable firewall, where each of these by themselves would fall short in >some way. The most secure would be to use a filter in this scenario without >forwarding on, the most transparent would be the same configuration with >forwarding/masquerading/nat on. Proxy what you can, and forward stuff the >proxies can't deal with. > >Just my .02 now our it's worth .03 ;-) > >Bill Kocik >Taos Mountain - "The Sys Admin Company" >Santa Clara, California >http://www.taos.com > >"Logic is a systematic method of coming to the wrong conclusion with >confidence." > > > > ------------------------------------------------------------------------------ Don Smith General Dynamics Information Systems Systems Administrator 8005 South Chester St EngleWood, Co. 80112 Phone (303) 649-7554 FAX (303) 649-7504 donald.j.smith@gd-is.com Error msgs that I love: "Keyboard not found press F1 to continue" (pc bios) "Harddrive controller failure insert new disk and press any key to continue" (pc bios) "The disk is write protected Remove the write protect or use another disk." (nt) User must change his password before he logs in the first time. (nt) ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Tue Mar 21 09:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA21862 Tue, 21 Mar 2000 09:38:31 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA06464; Tue, 21 Mar 2000 06:43:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 05:59:44 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA00514 for fwtk-users-outgoing; Tue, 21 Mar 2000 05:59:15 -0800 (PST) Message-ID: X-Mailer: XFMail 1.3 [p0] on FreeBSD X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <6CC81B07CB44D311A1D20001FA7E99561349E9@exchange.pdv.de> Date: Tue, 21 Mar 2000 11:03:39 +0100 (MET) Reply-To: mm@i.cz From: Martin Machacek To: fwtk-users@ex.tis.com Subject: RE: smap: what does EXPN root mean ??? Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-2 Content-Length: 1209 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 21-Mar-00 Dirk.Nerling wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in > the > BODY of a mail message to majordomo@ex.tis.com.] > > somebody tried to access my firewall. As far as I see there is nothing to > worry about. But what does "EXPN root" mean? User from address 212.159.70.114 (114.03-02.quay.dial.plus.net.uk - apparently some dial-up account) connected to your SMTP port (serviced by smap) and issued SMTP command EXPN root. EXPN command if implemented by the server (bad idea) could be used to expand local aliases, i.e. get the real address where mail for will be forwarded. EXPN command is not neccessary for normal operation of SMTP server and on the other hand could cause unpleasent information leak. So, it is not supported by smap. > Mar 21 05:38:37 wall smap[17974]: connect > host=114.03-02.quay.dial.plus.net.uk/212.159.70.114 > Mar 21 05:38:43 wall smap[17974]: EXPN root > (114.03-02.quay.dial.plus.net.uk/212.159.70.114) Martin --- [PGP KeyID F3F409C4] From owner-fwtk-users@ex.tis.com Tue Mar 21 09:50 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA21932 Tue, 21 Mar 2000 09:50:55 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA07969; Tue, 21 Mar 2000 06:55:37 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 06:10:10 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA01798 for fwtk-users-outgoing; Tue, 21 Mar 2000 06:09:59 -0800 (PST) Message-Id: <3.0.3.32.20000321063020.00777bc4@mail.denver.gd-is.com> X-Sender: dsmith@mail.denver.gd-is.com X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) Date: Tue, 21 Mar 2000 06:30:20 -0700 To: "Dirk.Nerling" , "Firewall Toolkit (M-list)" From: Donald J Smith Subject: Re: smap: what does EXPN root mean ??? In-Reply-To: <6CC81B07CB44D311A1D20001FA7E99561349E9@exchange.pdv.de> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 1483 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 08:16 AM 3/21/00 +0100, Dirk.Nerling wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >Hello all, > >somebody tried to access my firewall. As far as I see there is nothing to >worry about. But what does "EXPN root" mean? The "cracker" was trying to find out who the root account mapped to. You have EXPN turned off so nothing was discovered that way (except that you've running smap and EXPN is turned off;-) You might be more concerned with the ICMP but I really can't help you there. You were definetly scanned. ------------------------------------------------------------------------------ Don Smith General Dynamics Information Systems Systems Administrator 8005 South Chester St EngleWood, Co. 80112 Phone (303) 649-7554 FAX (303) 649-7504 donald.j.smith@gd-is.com Error msgs that I love: "Keyboard not found press F1 to continue" (pc bios) "Harddrive controller failure insert new disk and press any key to continue" (pc bios) "The disk is write protected Remove the write protect or use another disk." (nt) User must change his password before he logs in the first time. (nt) ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Tue Mar 21 14:11 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA22905 Tue, 21 Mar 2000 14:11:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA07665; Tue, 21 Mar 2000 11:15:23 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 10:23:58 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA00598 for fwtk-users-outgoing; Tue, 21 Mar 2000 10:23:37 -0800 (PST) From: vchakra@us.ibm.com X-Lotus-FromDomain: IBMUS To: Bill Kocik cc: Luis Fernando Barrera , fwtk-users@ex.tis.com, Donald J Smith Message-ID: <852568A9.0064E498.00@D51MTA03.pok.ibm.com> Date: Tue, 21 Mar 2000 13:22:03 -0500 Subject: Need some info Mime-Version: 1.0 Content-Disposition: inline Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1653 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I need your help and some information on the following system we are trying to implement. We are planning to implement a staging FTP server which acts as an intermediate tier running some kind of a firewall and communicates with the client and the actual web server for transfer of data to and fro. This is decided so as to give more security and hence only the FTP staging server is to be in the opennet. So the client can ftp into this staging server and whatever ftp commands he gives needs to be communicated to the actual webserver holding the data. So for instance the user ftps into the intermediate server and executes 'ls' ( we have a aix system ) it has to communicate that command to the webserver and return the result to the client, this is so for all the commands. My question is can we use this Firewall Toolkit to do this job by having a firewall run on the staging server and the configuration mapped internally to the webserver so that the staging server<->client part is in opennet and the staging server<->web server is in intranet? Please explain to me how can this be done or configured. I also heard that another product called Gauntlet Firewall from NAI has similar features. If this is possible is there a version for AIX for us to use or any beta versions to work together with? Please let me know.Thanks!! Regards, Vik Vikram Chakravarthy, IBM E-Business Solutions T/L 348-2770 Phone (847)-706-2770 Fax (847)-240-8395 Email: vchakra@us.ibm.com From owner-fwtk-users@ex.tis.com Tue Mar 21 15:17 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA23160 Tue, 21 Mar 2000 15:17:47 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA17197; Tue, 21 Mar 2000 12:19:21 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 11:29:09 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA09509 for fwtk-users-outgoing; Tue, 21 Mar 2000 11:28:43 -0800 (PST) Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: <200003211045.NAA03789@paranoid.eltex.spb.ru> References: <200003211045.NAA03789@paranoid.eltex.spb.ru> Date: Tue, 21 Mar 2000 10:24:10 -0700 To: ark@eltex.ru, bkocik@velocityhsi.com From: Blair Lowe Subject: Product X Y Z (formerly Re: tis on rh linux 6.1) Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 2511 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 13:45 +0300 2000/03/21, ark@eltex.ru wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >-----BEGIN PGP SIGNED MESSAGE----- > >nuqneH, > >"Bill Kocik" said : > >> [To be removed from this list send the message "unsubscribe >>fwtk-users" in the >> BODY of a mail message to majordomo@ex.tis.com.] >> >> > Thanks for your reply (and your smap patch). >> > >> > I see what you mean with respect to the advantages of not allowing >> > packets to be forwarded at all. Having said that, though, internal >> > users usually should have transparent access to the outside, and >> > running auth, and GW programs on a gateway machine means that there >> > is alot of extra training, maintenance, and time spent authenticating >> > on the firewall where it may not be necessary. >> >> This is a big problem with non-transparent proxies. You end up in a mode >> where you must insist that users use Product X for FTP and Product Y for >> Telnet and such, because they're the only ones that support your proxy >> configuration. It can be quite a pain. > >Not at all. You just say: i suggest using X,Y or Z for ftp or A,B or C >for telnet and you can get instructions . If you use another >program, it is your problem to configure it. > >It is generally not a good idea to use random software in corporate >environment anyways. Sometimes it is even a good idea to strictly prohibit >usage of things not checked by IT security. (I'd say most of >times, but some people think i am too paranoid). I suppose there are different degrees of how paranoid you should be depending on what's at stake. The main problem I have found in setting up a firewall IS the ftp product. The problem is that it has a totally stupid way of maintaining a session (new SYN packets in the middle of a session ???), and there are hundreds of proprietary canned packages out there for Windows and Mac that we CAN'T configure, and that are essential for some people's business (eg. the guy whose website is on your machine has webbuilder1-2-3 that has ftp built in). Blair. Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) All email advice that is provided for free is without warrantee: use at your own risk. From owner-fwtk-users@ex.tis.com Tue Mar 21 15:17 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA23159 Tue, 21 Mar 2000 15:17:47 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA17203; Tue, 21 Mar 2000 12:19:23 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 11:28:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA09473 for fwtk-users-outgoing; Tue, 21 Mar 2000 11:28:31 -0800 (PST) Message-Id: <3.0.3.32.20000321122338.0070f18c@mail.denver.gd-is.com> X-Sender: dsmith@mail.denver.gd-is.com X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) Date: Tue, 21 Mar 2000 12:23:38 -0700 To: "Bill Kocik" From: Donald J Smith Subject: Re: tis on rh linux 6.1 Cc: fwtk-users@ex.tis.com In-Reply-To: <001e01bf92be$1ccfdf90$3702040a@healtheon.com> References: < <4.2.2.20000221141405.00b29ba0@mail.itm-inst.com> <20000314130446.N3308@washington.cospo.osis.gov> <3.0.3.32.20000320144007.007778b4@mail.denver.gd-is.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 7098 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 02:46 PM 3/20/00 -0800, you wrote: >> >In the third case, you leave the operating system to deal with all >packets >> >that the proxies don't see, and you'd better hope everything's turned >off. > >> HOPE!! You should have configured it that way and had better be testing to >> ensure it >> stays that way. Anyone who configures a firewall and doesn't test it gets >> what every they get. > >Hope, check, ensure, guarantee, it's all semantics. You can plainly see what >my point was. Maybe it would have been clearer/more accurate if I'd said >that the philosophy of proxy-only firewalls assumes that the OS has been >locked down, not necessarily that the admin is left to hope this is the >case. I prefer to do everything in my power leave *nothing* to human error, >even if I'm the human in question. I trust myself, but I'm not perfect. OK I didn't mean to get into semantics. My point was test your firewall no matter what type of firewall it it. > >> >At the very least, you're probably leaving yourself open to attack the >next >> >time someone discovers that sending Packet X to Port Y causes the tcp/ip >> >stack of Operating System Z to go ass over teakettle. > >> Nope no such beast. > >Wrong. There are many well-known instances in which this has been the case. >The infamous Windows nukes/teardrops/bonks are one such example (not that >Windows is anything better than laughable as a firewall platform anyways). >For a while, the Linux kernel was also subject to similar attacks in the 2.0 >series (Note: That's the *kernel*, not an application) before it was fixed. >I'm sure these are not the only cases, either. > >The biggest problem I see with this is that a popular philosophy concerning >firewalls is that it's far more important to protect your local network than >it is to protect your firewall itself, and if you're using proxies only than >theoretically noone should be able to bypass the firewall to get into the >local LAN, even if the firewall itself is compromised as a sacrificial lamb. >The fatal flaw I see in this thinking is that if someone compromises the >firewall, what's to stop them from turning on port forwarding in the OS and >using it as a jumping off point to get to the rest of the network? No, I echo 1 > /dev/proc/kernal.stuff/foward_tcpip_packets or something like that in RH6.0. >don't personally know how this could be done, but it's theoretically >possible and that's enough for me. > >> There were only a few things that too many IP stack writers (Such >> as noone would send sync with ack...) >> took for granted and if you on an os that doesn't deal with all >> possibilities then thats a >> cruddy os to use for a firewall. The main thing these tcp/ip stack attacks took advantage of was the fact that OS tcp/ip stack programers were not taking into account all the possible TCP/IP flags combinations. They were programming for all the reasonable combinations not all POSSIBLE combinations. This flag field is only 6 bits long and I believe most of the stack programers are covering every combination in their current implementation. An else at the end of a case statement to handle (throw away) any weird combinations is all that should be required. > >Cruddy or not, there is always the chance that any operating system is >vulnerable to something along these lines, whether someone has figured it >out yet or not (Note: I said "chance", not "guarantee"). The worst exploits With the above implementation there is no reason a guarentee couldn't be given. The tcp/ip data structor is well known. Any programers that aren't accounting for all possible combinations shouldn't be programing the tcp/ip stack of any os. >are the ones that we don't know about yet. And even if this can't happen, >it's _still_ hard to argue that setting up a packet filter in addition to >your proxy isn't better security than a proxy alone. You say above that >anyone who doesn't ensure their operating system is locked down tightly by >testing their firewall deserves whatever they get (paraphrasing). My >question is, what are you testing for exactly? Known vulnerabilities? What >about as-yet-undiscovered vulnerabilities? How do you test for those? I can >just as easily say that anyone who puts all their faith in the belief that >their OS has been made impenetrable (because nmap said so or something) and >chooses not to set up a filter also deserves whatever they get. > >What's the difference? > >Whether you necessarily agree with my arguments or not, I believe the point >I was going for is hard to argue against: Proxying plus filtering is >inherently safer than proxying alone (unless, of course, your filtering >software itself introduces a vulnerability....but that's a whole other >discussion ;-). No it is not a different discussion. By opening your firewall to include filtering you must add code to the kernal(potentially bad) and allow packets (potentially bad) thru your firewall directly. A proxy doesn't allow any direct ip packets thru it works at the application level. Now if you suggest a indepth approach with one box as the application gateway (proxy) and another as the packet filtering (outside the proxy) then I would agree whole heartly with you. You have added to the security without risking the proxy firewall. But adding anything to the proxy firewall adds to the risk. I happen to like linux's ipchains/packet filtering stuff and will use it on a proxy firewall when I believe it adds to the security but thats only when I don't have a GOOD proxy app for something that needs to pass thru the proxy firewall. (example upd-relay ) > >> now our it's worth .03 ;-) >> -------------------------------------------------------------------------- >---- >> Don Smith General Dynamics Information >Systems > >General Dynamics, eh? I nearly took a job with a firm that wanted to place >me there once in their Michigan location. Neat company (GD, that is). Things >didn't work out between myself and the placement firm, though. > >Bill Kocik >Taos Mountain - "The Sys Admin Company" >Santa Clara, California >http://www.taos.com > >"Logic is a systematic method of coming to the wrong conclusion with >confidence." > > > ------------------------------------------------------------------------------ Don Smith General Dynamics Information Systems Systems Administrator 8005 South Chester St EngleWood, Co. 80112 Phone (303) 649-7554 FAX (303) 649-7504 donald.j.smith@gd-is.com Error msgs that I love: "Keyboard not found press F1 to continue" (pc bios) "Harddrive controller failure insert new disk and press any key to continue" (pc bios) "The disk is write protected Remove the write protect or use another disk." (nt) User must change his password before he logs in the first time. (nt) ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Tue Mar 21 15:41 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA23202 Tue, 21 Mar 2000 15:40:48 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA20714; Tue, 21 Mar 2000 12:46:04 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 12:03:37 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA14775 for fwtk-users-outgoing; Tue, 21 Mar 2000 12:03:16 -0800 (PST) Message-ID: <000701bf9371$62097e00$3702040a@healtheon.com> From: "Bill Kocik" To: Cc: "Luis Fernando Barrera" , , "Donald J Smith" References: <852568A9.0064E498.00@D51MTA03.pok.ibm.com> Subject: Re: Need some info Date: Tue, 21 Mar 2000 12:09:37 -0800 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6600 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 3405 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] The solution that comes to my mind is T.Rex (www.opensourcefirewall.com). It's FTP proxy can be configured to act as a transparent bastion to an FTP server sitting behind it (which would be your web server...it'll need to run an FTP server as well, obviously). The only trouble is this only works well if you're only using anonymous FTP. T.Rex doesn't allow authenticated FTP without something like a CryptoCard or SecureCard. It's available for AIX. You can download source and compile (I've done this...it's a major PITA on Solaris 7 (but they're aware of the problems and are fixing it), easier on Linux, haven't tried any other platforms), or buy one of their binary CD's which aren't expensive. I suppose this could also be done with the plug-gw portion of FWTK, though you won't have control over which commands any user can or cannot execute. If anyone would like to step up and point out that the FWTK FTP proxy can also do this, please do so. I'm not sure, myself. Gauntlet can also do it, as can FW1 I'm sure, but I don't personally know if either of those are available for AIX. Bill Kocik Taos Mountain - "The Sys Admin Company" Santa Clara, California http://www.taos.com "Logic is a systematic method of coming to the wrong conclusion with confidence." ----- Original Message ----- From: To: "Bill Kocik" Cc: "Luis Fernando Barrera" ; ; "Donald J Smith" Sent: Tuesday, March 21, 2000 10:22 AM Subject: Need some info > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > Hello, > I need your help and some information on the following system we are > trying to implement. > We are planning to implement a staging FTP server which acts as an > intermediate tier running some kind of a firewall and communicates with the > client and the actual web server for transfer of data to and fro. This is > decided so as to give more security and hence only the FTP staging server > is to be in the opennet. So the client can ftp into this staging server and > whatever ftp commands he gives needs to be communicated to the actual > webserver holding the data. So for instance the user ftps into the > intermediate server and executes 'ls' ( we have a aix system ) it has to > communicate that command to the webserver and return the result to the > client, this is so for all the commands. My question is can we use this > Firewall Toolkit to do this job by having a firewall run on the staging > server and the configuration mapped internally to the webserver so that the > staging server<->client part is in opennet and the staging server<->web > server is in intranet? Please explain to me how can this be done or > configured. I also heard that another product called Gauntlet Firewall from > NAI has similar features. If this is possible is there a version for AIX > for us to use or any beta versions to work together with? Please let me > know.Thanks!! > > Regards, > Vik > Vikram Chakravarthy, > IBM E-Business Solutions > > > T/L 348-2770 > Phone (847)-706-2770 > Fax (847)-240-8395 > Email: vchakra@us.ibm.com > > From owner-fwtk-users@ex.tis.com Tue Mar 21 16:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA23362 Tue, 21 Mar 2000 16:45:01 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA00983; Tue, 21 Mar 2000 13:50:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 12:36:52 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA19434 for fwtk-users-outgoing; Tue, 21 Mar 2000 12:36:41 -0800 (PST) Message-ID: <001801bf9376$16bbe5a0$3702040a@healtheon.com> From: "Bill Kocik" To: "Donald J Smith" Cc: References: <<4.2.2.20000221141405.00b29ba0@mail.itm-inst.com><20000314130446.N3308@washington.cospo.osis.gov><3.0.3.32.20000320144007.007778b4@mail.denver.gd-is.com> <3.0.3.32.20000321122338.0070f18c@mail.denver.gd-is.com> Subject: Re: tis on rh linux 6.1 Date: Tue, 21 Mar 2000 12:43:18 -0800 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6600 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 3929 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > OK I didn't mean to get into semantics. My point was test your firewall no > matter what type of firewall it it. I won't disagree with you there. > The main thing these tcp/ip stack attacks took advantage of was the fact that > OS tcp/ip stack programers were not taking into account all the possible > TCP/IP flags combinations. They were programming for all the reasonable > combinations > not all POSSIBLE combinations. This flag field is only 6 bits long and I > believe > most of the stack programers are covering every combination in their current > implementation. An else at the end of a case statement to handle (throw > away) any weird > combinations is all that should be required. That's fine. But whatever the reasons were, there have been in the past attacks that resemble sending Packet X to Port Y to crash Operating System Z. That's all I was saying. I never discussed the reasons for these vulnerabilities, only that they have existed in the past and that they could crop up again in the future, and a proxying only firewall will not defend (itself) against them (that is...the internal network would be safe). > With the above implementation there is no reason a guarentee couldn't be > given. > The tcp/ip data structor is well known. Any programers that aren't > accounting for > all possible combinations shouldn't be programing the tcp/ip stack of any os. You missed what I was saying. I was saying that I don't guarantee that any particular OS is vulnerable to one of these attacks, only that there was a chance that any of them might be. I wasn't talking about guaranteed security. > No it is not a different discussion. That was a figure of speech. Are you always like this? > By opening your firewall to include > filtering you must > add code to the kernal(potentially bad) and allow packets (potentially bad) > thru your firewall directly. Yes. > A proxy doesn't allow any direct ip packets thru it works at the > application level. Right. > Now if you suggest a indepth approach with one box as the application > gateway (proxy) > and another as the packet filtering (outside the proxy) then I would agree > whole heartly with you. > You have added to the security without risking the proxy firewall. > But adding anything to the proxy firewall adds to the risk. Even the proxies? I mean, come on, can you honestly say that you're better off *not* adding firewall software to your firewall? "Yes sir, we feel the naked operating system is pretty secure, and we're afraid that adding Firewall 1 might introduce unknown vulnerabilities." See how that sounds? But, I do see your point, to a degree. I just personally feel that the benefits of the packet filter far outweigh the considerably small risk that they themselves are vulnerable. I can't swallow that you're safer not filtering than using a filter that could theoretically be exploitable. I suppose putting them on a seperate machine would be the safest possible way to use them, though. I think at this point you and I are almost totally in agreement on the technical issues, with perhaps some differences in philosophy. :-) > I happen to like linux's ipchains/packet filtering stuff and will use it on > a proxy firewall when I believe it > adds to the security but thats only when I don't have a GOOD proxy app for > something that needs to pass thru the > proxy firewall. (example upd-relay ) I like it, too. Currently I'm using Solaris (with parts of FWTK and parts of T.Rex) as my firewall, and have been arguing for weeks with ipfilter about outbound FTP. I never had this much of a problem with IP Chains. Bill Kocik Taos Mountain - "The Sys Admin Company" Santa Clara, California http://www.taos.com "Logic is a systematic method of coming to the wrong conclusion with confidence." From owner-fwtk-users@ex.tis.com Tue Mar 21 16:45 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA23360 Tue, 21 Mar 2000 16:44:59 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA00989; Tue, 21 Mar 2000 13:50:10 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 12:41:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA19978 for fwtk-users-outgoing; Tue, 21 Mar 2000 12:41:24 -0800 (PST) Message-Id: <200003212040.RAA01843@racing.mecon.ar> From: "Alejandro Rusell" To: Bill Kocik , vchakra@us.ibm.com Date: Tue, 21 Mar 2000 17:40:55 -0300 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: Re: Need some info Reply-to: arusel@mecon.ar CC: fwtk-users@ex.tis.com In-reply-to: <852568A9.0064E498.00@D51MTA03.pok.ibm.com> X-mailer: Pegasus Mail for Win32 (v3.01b) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 2283 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Hello, Hi, I understand from your mail that what you want to implement is outside access to an internal server (ftp, http?), minimizing the security risk. Am I right? To do this, you should implement a DMZ, with a firewall with three interfaces, one internal, one external and one in the DMZ. Also, you should put application gateways/proxies in the firewall to grant the allowed access (internal and external) to the server. This can be acomplished using FWTK (free product, should get from NAI), and if you need access to a web server, definitively should use squid (http://squid.nlanr.net/Squid). Hope that it helps. Regards, Alejandro Rusell > We are planning to implement a staging FTP server which acts as an > intermediate tier running some kind of a firewall and communicates with > the client and the actual web server for transfer of data to and fro. This > is decided so as to give more security and hence only the FTP staging > server is to be in the opennet. So the client can ftp into this staging > server and whatever ftp commands he gives needs to be communicated to the > actual webserver holding the data. So for instance the user ftps into the > intermediate server and executes 'ls' ( we have a aix system ) it has to > communicate that command to the webserver and return the result to the > client, this is so for all the commands. My question is can we use this > Firewall Toolkit to do this job by having a firewall run on the staging > server and the configuration mapped internally to the webserver so that > the staging server<->client part is in opennet and the staging > server<->web server is in intranet? Please explain to me how can this be > done or configured. I also heard that another product called Gauntlet > Firewall from NAI has similar features. If this is possible is there a > version for AIX for us to use or any beta versions to work together with? > Please let me know.Thanks!! > > Regards, > Vik > Vikram Chakravarthy, > IBM E-Business Solutions > > > T/L 348-2770 > Phone (847)-706-2770 > Fax (847)-240-8395 > Email: vchakra@us.ibm.com > > > From owner-fwtk-users@ex.tis.com Tue Mar 21 19:57 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA23999 Tue, 21 Mar 2000 19:57:07 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA24369; Tue, 21 Mar 2000 17:01:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 16:12:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA19556 for fwtk-users-outgoing; Tue, 21 Mar 2000 16:12:34 -0800 (PST) Message-ID: <38D8103B.B25DF5CF@mobinfo.com> Date: Tue, 21 Mar 2000 16:13:47 -0800 From: Walter Yee Organization: Mobile Information Systems X-Mailer: Mozilla 4.7 [en] (X11; U; Linux 2.2.5-15smp i686) X-Accept-Language: en MIME-Version: 1.0 To: firewall Subject: ntperm-table Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 232 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello all, Does any have a good working ntperm-table sample I can look at. Much Thanks! -- -Walter From owner-fwtk-users@ex.tis.com Wed Mar 22 02:43 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA25351 Wed, 22 Mar 2000 02:43:19 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id XAA18173; Tue, 21 Mar 2000 23:48:24 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Mar 2000 22:53:14 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id WAA16154 for fwtk-users-outgoing; Tue, 21 Mar 2000 22:53:08 -0800 (PST) Message-ID: <38D86D9A.9D41A70@ior.com> Date: Tue, 21 Mar 2000 22:52:10 -0800 From: Darren Ehmke X-Mailer: Mozilla 4.51 [en] (Win95; I) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: POP3/pop3-gw/plug-gw/pop-gw Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 3430 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, Have been using the fwtk for about a year now, which works like a champ. We had not enabled mail to go through the fwtk, but recently decided that it would help what we were doing. Anyway, I have not found good answers to the questions and problems we have encountered in setting up pop mail. (some of these questions are here for others to read so as to answer other peoples questions as well.) question #1. Does fwtk support pop mail, obvious answer is yes. question #2. Does the fwtk have the ability to use the fwtk as as a gateway to an outside POP server? I think so, although I have not read anything that says so. question #3. Can the fwtk be used to only work as a gateway to an outside pop server? As in, can it easily be configured and maintained to allow on a port to outside pop server to send and use the outside pop server, so as to not use a mail server on the fwtk. The same for receiving pop mail. As in, the ability to receive pop mail where the fwtk computer is not used to as a temporary location and then sent. question #4. There seems to be 3 different ways to possibly set this up. a. pop3-gw (appears that docs say only outbound, does this mean you can not receive?) b. pop-gw (only used for internal pop server?) c. plug-gw (??) I have taken approached (a) and (c) to try to configure the system to appropriately receive and send pop mail. At one time it did work for receiving pop mail with approach (a). But, after I tried to send pop mail out, it failed completely and miserably. Where I keep receiving deny messages with the /var/log/messages file. Here is the configuration of how I set it up. Before going there, md5 needed to be compiled in. I had found the libmd5, but it did not work. So, I did find the md5 that libmd5 had referred to, where the md5.c and md5.h were available. Hacking the pop3-gw.c program and the Makefile to include "md5.h" instead of and putting this in its current directory and changing the Makefile to include md5.o within the compiling. Now for the configuration. SERVER CONFIGURATION /etc/inetd.conf pop3 stream tcp nowait root /usr/local/etc/pop3-gw pop3-gw pop3 /etc/services did not modify anything pop3 110/tcp pop3 110/udp /usr/local/etc/netperm-table pop3-gw: timeout 300 pop3-gw: port pop3 permit-hosts 10.* -plug-to mail.location.com -port pop3 Within Netscape on a client system, the following was done. CLIENT CONFIGURATION Edit->Preferences->Identity Email Address: me@mail.location.com Edit->Preferences->Mail Servers Incoming Mail Servers Server Name: fwtkcomputer.domainname.com User Name: me@mail.location.com 110 Outgoing Mail (SMTP) Server: fwtkcomputer.domainname.com Outgoing Mail Server user name: me@mail.location.com 110 ERROR MESSAGES In /var/log/messages Mar 21 10:53:22 phaze pop3-gw[5138]: deny host=sam/10.60.1.120 service=110 On Netscape An error occurred with the pop3 server. You should contact the administrator for this server or try again later. Any suggestions, comments and other would be very greatly appreciated. Thanks Darren From owner-fwtk-users@ex.tis.com Wed Mar 22 07:20 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA26172 Wed, 22 Mar 2000 07:20:48 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA01629; Wed, 22 Mar 2000 04:26:03 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 03:35:29 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA28014 for fwtk-users-outgoing; Wed, 22 Mar 2000 03:35:18 -0800 (PST) From: ark@eltex.ru Date: Wed, 22 Mar 2000 14:32:07 +0300 Message-Id: <200003221132.OAA09928@paranoid.eltex.spb.ru> In-Reply-To: <38D86D9A.9D41A70@ior.com> from "Darren Ehmke " Organization: "Klingon Imperial Intelligence Service" Subject: Re: POP3/pop3-gw/plug-gw/pop-gw To: rsd@ior.com Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 3917 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Darren Ehmke said : > question #4. There seems to be 3 different ways to possibly set > this up. > a. pop3-gw (appears that docs say only outbound, > does this mean you can not receive?) Outbound means it is not recommended for serving requests from untrusted networks. > b. pop-gw (only used for internal pop server?) > c. plug-gw (??) > > > I have taken approached (a) and (c) to try to configure the > system to appropriately receive and send pop mail. At one time > it did work for receiving pop mail with approach (a). But, > after I tried to send pop mail out, it failed completely and > miserably. You cannot _send_ pop mail out. pop3 is protocol to _receive_ mail. You shound use SMTP for it. > Where I keep receiving deny messages with the /var/log/messages > file. > > Here is the configuration of how I set it up. > > Before going there, md5 needed to be compiled in. I had found > the libmd5, but it did not work. So, I did find the md5 > that libmd5 had referred to, where the md5.c and md5.h were > available. Hacking the pop3-gw.c program and the Makefile > to include "md5.h" instead of and putting this in > its current directory and changing the Makefile to include > md5.o within the compiling. I assume you are running Linux ;)? Ok, looks like you did that right way. > Now for the configuration. > > SERVER CONFIGURATION > > /etc/inetd.conf > pop3 stream tcp nowait root /usr/local/etc/pop3-gw pop3-gw pop3 extra "pop3" is not needed. you should not use plug-gw syntax here. > /etc/services > did not modify anything > pop3 110/tcp > pop3 110/udp Ok. > /usr/local/etc/netperm-table > pop3-gw: timeout 300 > pop3-gw: port pop3 permit-hosts 10.* -plug-to mail.location.com -port pop3 RTFM. You should not use plug-gw syntax here. pop3-gw does not find configuration tag "hosts" (you have "port" instead) and assumes everything is denied. > Within Netscape on a client system, the following was done. > > CLIENT CONFIGURATION > > Edit->Preferences->Identity > Email Address: me@mail.location.com > > > Edit->Preferences->Mail Servers > Incoming Mail Servers > Server Name: fwtkcomputer.domainname.com > User Name: me@mail.location.com 110 RTFM. a) you should use plug-to or user@host syntax, using both of them is pure nonsense. b) it may do not affect you for this configuration because of netscape mail client misfeature/bug (see -separator option). Remove "110", it is not required and you used incorrect syntax anyways. > Outgoing Mail (SMTP) Server: fwtkcomputer.domainname.com > Outgoing Mail Server user name: me@mail.location.com 110 110 has nothing to do with SMTP stuff, nor pop3-gw does. > ERROR MESSAGES > > In /var/log/messages > > Mar 21 10:53:22 phaze pop3-gw[5138]: deny host=sam/10.60.1.120 > service=110 > > On Netscape > > An error occurred with the pop3 server. You > should contact the administrator for this > server or try again later. > > Any suggestions, comments and other would be very greatly > appreciated. > > Thanks > > Darren > _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBONivNqH/mIJW9LeBAQGxNgP/UtMUW3nKRwyALjv4qEGyjdmrFo/J4ncS PKtwDpdswo1kff8zUAt4/4T8EIslt/dDri1NJ/XEd+Jrxum8HqqKETV2Pt12EeA1 4CchzNaIocYpKdL78RqzrsxZMJRIHMDjKG4bDGO0QjWn5NjH+TOmOHUJ3VUAqbfv shtitRVYv20= =r6ez -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Wed Mar 22 07:21 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA26171 Wed, 22 Mar 2000 07:20:48 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA01625; Wed, 22 Mar 2000 04:26:03 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 03:41:43 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA28502 for fwtk-users-outgoing; Wed, 22 Mar 2000 03:41:27 -0800 (PST) From: ark@eltex.ru Date: Wed, 22 Mar 2000 14:37:32 +0300 Message-Id: <200003221137.OAA09945@paranoid.eltex.spb.ru> In-Reply-To: from "Blair Lowe " Organization: "Klingon Imperial Intelligence Service" Subject: Re: Product X Y Z (formerly Re: tis on rh linux 6.1) To: Blair.Lowe@compeng.net Cc: ark@eltex.ru, bkocik@velocityhsi.com, fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 2385 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, I just don't believe. I've never seen ftp programs that had username/server name hardcoded that way so one can not set it up to use user@host syntax. Haven't seen webbuilder, though, but i think it's unlikely to expect such a strange behavior. Blair Lowe said : > >> This is a big problem with non-transparent proxies. You end up in a mode > >> where you must insist that users use Product X for FTP and Product Y for > >> Telnet and such, because they're the only ones that support your proxy > >> configuration. It can be quite a pain. > > > >Not at all. You just say: i suggest using X,Y or Z for ftp or A,B or C > >for telnet and you can get instructions . If you use another > >program, it is your problem to configure it. > > > >It is generally not a good idea to use random software in corporate > >environment anyways. Sometimes it is even a good idea to strictly prohibit > >usage of things not checked by IT security. (I'd say most of > >times, but some people think i am too paranoid). > > I suppose there are different degrees of how paranoid you should be > depending on what's at stake. > > The main problem I have found in setting up a firewall IS the ftp > product. The problem is that it has a totally stupid way of > maintaining a session (new SYN packets in the middle of a session > ???), and there are hundreds of proprietary canned packages out there > for Windows and Mac that we CAN'T configure, and that are essential > for some people's business (eg. the guy whose website is on your > machine has webbuilder1-2-3 that has ftp built in). _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBONiwe6H/mIJW9LeBAQGQ5QQAkqocvgJMInYCs223HTNhs6JnCEDsdux1 zB3nfW2gAnlbhZ4o1rPw4zZiTnD+B20X4Y1aU0nYeNxgaSpwKYTqtqTPnZibzIs3 IzQeX0O0aEjnjO20vAqpSHNBbQR9e0waj1ltj0Cvy3lPeEqbLQ3mPLkVF3MtD7y/ 45URwRBhyGE= =Z1oN -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Wed Mar 22 08:28 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA26479 Wed, 22 Mar 2000 08:28:48 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA07041; Wed, 22 Mar 2000 05:34:05 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 04:45:27 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA02904 for fwtk-users-outgoing; Wed, 22 Mar 2000 04:45:21 -0800 (PST) Message-Id: Mime-Version: 1.0 Date: Wed, 22 Mar 2000 13:37:08 -0800 To: fwtk-users@lists.nai.com From: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.) Subject: http-gw problem (looping) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 384 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, sometimes fails the http-gw connection with the messages in /var/adm/messages: Network connection closed during write exit host=............. inetd[..] : http-gw/tcp server failing (looping), service terminated ? What can the cause be? Thanks! From owner-fwtk-users@ex.tis.com Wed Mar 22 09:37 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA27010 Wed, 22 Mar 2000 09:37:18 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA13009; Wed, 22 Mar 2000 06:42:03 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 05:52:09 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA08277 for fwtk-users-outgoing; Wed, 22 Mar 2000 05:52:03 -0800 (PST) Message-ID: <38D8CCF9.C841FA68@voicenet.com> Date: Wed, 22 Mar 2000 08:39:05 -0500 From: Uncle George Organization: GatWorks X-Mailer: Mozilla 4.07 [en] (X11; I; Linux 2.0.36 i686) MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: Re: POP3/pop3-gw/plug-gw/pop-gw References: <200003221132.OAA09928@paranoid.eltex.spb.ru> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 259 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Where is pop3-gw. I thought I have gotten the latest FWTK 2.0+ ( from the file CHANGES ), for which pop3-gw doesn't exist! gat From owner-fwtk-users@ex.tis.com Wed Mar 22 11:11 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA27455 Wed, 22 Mar 2000 11:11:16 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA21632; Wed, 22 Mar 2000 08:16:18 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 07:28:21 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA17352 for fwtk-users-outgoing; Wed, 22 Mar 2000 07:28:10 -0800 (PST) Message-ID: <38D8D136.5D9A0E2F@voicenet.com> Date: Wed, 22 Mar 2000 08:57:10 -0500 From: Uncle George Organization: GatWorks X-Mailer: Mozilla 4.07 [en] (X11; I; Linux 2.0.36 i686) MIME-Version: 1.0 To: "Stefan Heim, Dipl.-Ing." CC: fwtk-users@lists.nai.com Subject: Re: http-gw problem (looping) References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 775 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Inetd is peeved. http requests are commining in at more than 60/min and it thinks its in a loop ( maybe attack ). U need to increase the allowable INETD limit ( maybe to 1000/min ) This info is FAQ'd gat Stefan Heim, Dipl.-Ing. wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > sometimes fails the http-gw connection with the messages in > /var/adm/messages: > > Network connection closed during write > exit host=............. > inetd[..] : http-gw/tcp server failing (looping), service terminated ? > > What can the cause be? > > Thanks! From owner-fwtk-users@ex.tis.com Wed Mar 22 11:44 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA27586 Wed, 22 Mar 2000 11:44:06 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA25431; Wed, 22 Mar 2000 08:49:22 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 08:04:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA20496 for fwtk-users-outgoing; Wed, 22 Mar 2000 08:04:36 -0800 (PST) Message-ID: <38D8EF5B.E64D7CC8@mobinfo.com> Date: Wed, 22 Mar 2000 08:05:47 -0800 From: Walter Yee Organization: Mobile Information Systems X-Mailer: Mozilla 4.7 [en] (X11; U; Linux 2.2.5-15smp i686) X-Accept-Language: en MIME-Version: 1.0 To: firewall Subject: http-gw problem Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 476 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, I'm running Redhat 6.0 with kernel 2.2.13 I'm running a internal web server and would like the outside world to get access it. And I did so with http-gw on the default port 80. Now my question is there a way where I can specify another port "9000" for people to access the internal web server through the Linux box. Thanks in advance. From owner-fwtk-users@ex.tis.com Wed Mar 22 12:04 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA27754 Wed, 22 Mar 2000 12:04:50 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA26640; Wed, 22 Mar 2000 09:10:06 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 08:27:51 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA22548 for fwtk-users-outgoing; Wed, 22 Mar 2000 08:27:46 -0800 (PST) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <38D8F45B.5885F479@usrconsult.be> Date: Wed, 22 Mar 2000 17:27:07 +0100 From: Michel Bardiaux Organization: UsrConsult SPRL X-Mailer: Mozilla 4.5 [en] (X11; I; IRIX64 6.5 IP27) X-Accept-Language: en MIME-Version: 1.0 To: firewall Subject: Re: http-gw problem References: <38D8EF5B.E64D7CC8@mobinfo.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 669 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Walter Yee wrote: > Hi all, > > I'm running Redhat 6.0 with kernel 2.2.13 I'm running a internal web > server and would like the outside world to get access it. And I did so > with http-gw on the default port 80. This is definitely *not* recommended... > Now my question is there a way > where I can specify another port "9000" for people to access the > internal web server through the Linux box. What you wish to accomplish is unclear. What will be the difference between access via port 80 and 9000? Greetings. -- Michel Bardiaux From owner-fwtk-users@ex.tis.com Wed Mar 22 14:41 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA28434 Wed, 22 Mar 2000 14:41:01 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA08749; Wed, 22 Mar 2000 11:46:05 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 10:47:58 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA28569 for fwtk-users-outgoing; Wed, 22 Mar 2000 10:47:42 -0800 (PST) From: "Luis Fernando Barrera" To: "Bill Kocik" , "Donald J Smith" Cc: Subject: RE: tis on rh linux 6.1 Date: Wed, 22 Mar 2000 12:20:52 -0600 Message-ID: Mime-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal In-Reply-To: <001801bf9376$16bbe5a0$3702040a@healtheon.com> X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id KAA28566 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2682 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > > OK I didn't mean to get into semantics. My point was test your > firewall no > > matter what type of firewall it it. > > I won't disagree with you there. > > > The main thing these tcp/ip stack attacks took advantage of was the fact > that > > OS tcp/ip stack programers were not taking into account all the possible > > TCP/IP flags combinations. They were programming for all the reasonable > > combinations > > not all POSSIBLE combinations. This flag field is only 6 bits > long and I > > believe > > most of the stack programers are covering every combination in their > current > > implementation. An else at the end of a case statement to handle (throw > > away) any weird > > combinations is all that should be required. > > That's fine. But whatever the reasons were, there have been in the past > attacks that resemble sending Packet X to Port Y to crash Operating System > Z. That's all I was saying. I never discussed the reasons for these > vulnerabilities, only that they have existed in the past and that > they could > crop up again in the future, and a proxying only firewall will not defend > (itself) against them (that is...the internal network would be safe). > > > With the above implementation there is no reason a guarentee couldn't be > > given. > > The tcp/ip data structor is well known. Any programers that aren't > > accounting for > > all possible combinations shouldn't be programing the tcp/ip > stack of any > os. > Everything above is correct, no programmer should be doing systems if he/she is not accouting for all the possible combinations... However, the programmers are humans, so * always * will be a chance that exists a security hole. If you are security aware, it's better not to put a door in front of your house, than putting a door with a lot of locks, even if they're the most secure locks in the world... Of course in that case you would't be able to leave/enter your house, that's the tradeoff! > > I happen to like linux's ipchains/packet filtering stuff and will use it > on > > a proxy firewall when I believe it > > adds to the security but thats only when I don't have a GOOD > proxy app for > > something that needs to pass thru the > > proxy firewall. (example upd-relay ) The point again is that with packet filtering you have to turn on the IP forwarding option in the firewall, which is a bad idea...right? Sorry if my comments were a little behind the conversation... but I think parts of it are private an others are not... Luis Fernando Barrera luba@assist.com.gt From owner-fwtk-users@ex.tis.com Wed Mar 22 16:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA28748 Wed, 22 Mar 2000 16:21:45 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA01143; Wed, 22 Mar 2000 13:26:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 11:48:03 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA09043 for fwtk-users-outgoing; Wed, 22 Mar 2000 11:47:41 -0800 (PST) Message-Id: <3.0.3.32.20000322124117.0071b154@mail.denver.gd-is.com> X-Sender: dsmith@mail.denver.gd-is.com X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) Date: Wed, 22 Mar 2000 12:41:17 -0700 To: "Luis Fernando Barrera" , djs3wn39@mailhub.gd-is.com, "Bill Kocik" From: Donald J Smith Subject: RE: tis on rh linux 6.1 Cc: In-Reply-To: References: <001801bf9376$16bbe5a0$3702040a@healtheon.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 4135 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 12:20 PM 3/22/00 -0600, Luis Fernando Barrera wrote: >> > OK I didn't mean to get into semantics. My point was test your >> firewall no >> > matter what type of firewall it it. >> >> I won't disagree with you there. >> >> > The main thing these tcp/ip stack attacks took advantage of was the fact >> that >> > OS tcp/ip stack programers were not taking into account all the possible >> > TCP/IP flags combinations. They were programming for all the reasonable >> > combinations >> > not all POSSIBLE combinations. This flag field is only 6 bits >> long and I >> > believe >> > most of the stack programers are covering every combination in their >> current >> > implementation. An else at the end of a case statement to handle (throw >> > away) any weird >> > combinations is all that should be required. >> >> That's fine. But whatever the reasons were, there have been in the past >> attacks that resemble sending Packet X to Port Y to crash Operating System >> Z. That's all I was saying. I never discussed the reasons for these >> vulnerabilities, only that they have existed in the past and that >> they could >> crop up again in the future, and a proxying only firewall will not defend >> (itself) against them (that is...the internal network would be safe). >> >> > With the above implementation there is no reason a guarentee couldn't be >> > given. >> > The tcp/ip data structor is well known. Any programers that aren't >> > accounting for >> > all possible combinations shouldn't be programing the tcp/ip >> stack of any >> os. >> > >Everything above is correct, no programmer should be doing systems >if he/she is not accouting for all the possible combinations... However, the programmers >are humans, so * always * will be a chance that exists a security hole. >If you are security aware, it's better not to put a door in front of your house, than >putting a door with a lot of locks, even if they're the most secure locks in the world... >Of course in that case you would't be able to leave/enter your house, that's the tradeoff! Ok using your analogy we have a door now do we add an alarm (by drilling a hole in the door) or do we believe door is better without the hole. In the linux-bastille code the programers have added ipfw/ipfilter to get a simple network intrustion audit capability. Since this is a host based security configuration application this seems like a good ideal. In some firewalls I've built I only load a couple of the proxies. So I guess my point is that it reallys depends on what your trying to implement as to weather adding a packetfilter ON your firewall adds to the security or not. > > >> > I happen to like linux's ipchains/packet filtering stuff and will use it >> on >> > a proxy firewall when I believe it >> > adds to the security but thats only when I don't have a GOOD >> proxy app for >> > something that needs to pass thru the >> > proxy firewall. (example upd-relay ) > >The point again is that with packet filtering you have to turn on the IP >forwarding option in the firewall, which is a bad idea...right? > > >Sorry if my comments were a little behind the conversation... but I think >parts of it are private an others are not... > > >Luis Fernando Barrera >luba@assist.com.gt > > ------------------------------------------------------------------------------ Don Smith General Dynamics Information Systems Systems Administrator 8005 South Chester St EngleWood, Co. 80112 Phone (303) 649-7554 FAX (303) 649-7504 donald.j.smith@gd-is.com Error msgs that I love: "Keyboard not found press F1 to continue" (pc bios) "Harddrive controller failure insert new disk and press any key to continue" (pc bios) "The disk is write protected Remove the write protect or use another disk." (nt) User must change his password before he logs in the first time. (nt) ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Wed Mar 22 16:55 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA28846 Wed, 22 Mar 2000 16:55:46 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA11361; Wed, 22 Mar 2000 14:00:50 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 12:06:37 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA12327 for fwtk-users-outgoing; Wed, 22 Mar 2000 12:06:25 -0800 (PST) Date: Wed, 22 Mar 2000 15:03:52 -0500 (EST) From: Ted Keller To: Walter Yee cc: firewall Subject: Re: http-gw problem In-Reply-To: <38D8EF5B.E64D7CC8@mobinfo.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1069 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Walter, If you Must - and try not to - place the interal web server on a dedicated DMZ zone controlled by your firewall. That way you can "plug" connections from the external world to your DMZ web server. Note - web servers are inherently not secure. You have to treat it as if it could be compromised - firewall or not. Setting it on the DMZ allows you to contain any damage. ted keller On Wed, 22 Mar 2000, Walter Yee wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi all, > > I'm running Redhat 6.0 with kernel 2.2.13 I'm running a internal web > server and would like the outside world to get access it. And I did so > with http-gw on the default port 80. Now my question is there a way > where I can specify another port "9000" for people to access the > internal web server through the Linux box. > > Thanks in advance. > From owner-fwtk-users@ex.tis.com Wed Mar 22 18:31 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA29037 Wed, 22 Mar 2000 18:31:20 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA28526; Wed, 22 Mar 2000 15:36:19 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Mar 2000 14:44:57 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA20805 for fwtk-users-outgoing; Wed, 22 Mar 2000 14:44:51 -0800 (PST) Message-Id: <4.3.2.20000322173841.00b4a5e0@shadow> X-Sender: (Unverified) X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Wed, 22 Mar 2000 17:40:23 -0500 To: fwtk-users@tis.com From: Jon Earle Subject: Re: tis on rh linux 6.1 Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 2548 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 03:43 PM 03/21/00, you wrote: > > Now if you suggest a indepth approach with one box as the application > > gateway (proxy) > > and another as the packet filtering (outside the proxy) then I would agree > > whole heartly with you. > > You have added to the security without risking the proxy firewall. > > But adding anything to the proxy firewall adds to the risk. > >Even the proxies? I mean, come on, can you honestly say that you're better >off *not* adding firewall software to your firewall? "Yes sir, we feel the >naked operating system is pretty secure, and we're afraid that adding Agreed. If the point it utter and complete security, then the network the firewall is protecting shouldn't be anywhere close to the internet to start with. My philosophy is to make is as difficult as possible for someone to enter without my permission. Now, given that no solution other that cutting the wire is 100% secure, the best we can hope for is a darned good approximation. For clients, I use TIS proxies, and although they do nothing except pass allowed packets back and forth (and make the users enter proxy settings in their software), at least there is a well scrutinized and tested piece of code sitting between each interface. I can accept that. I also employ filters on the same box to scrutinize all packets entering _and_ leaving the box, _before_ they even get near the proxies. If the filters don't like the look of the packets, the proxies don't deal with them. Security in layers. Now, another solution which works well for me and freinds at home, is a tight set of ipfwadm/ipchains rules wrapped around masquerading. If masquerading (NAT) is employed vs proxies, both accomplish the same thing in the end (a packet gets transferred from one interface to the other), and NAT allows you to seamlessly access the internet without having to configure all your client software. It is much cleaner, and given that most people don't do anything with TIS proxies other than install them, the ends offered by NAT (transparent access) are much more desirable and IMHO justify the means. Given a good set of filters to allow/deny access to prescribed services, and a good policy for determining who can access what, and where public services should reside (dmz vs internal lan vs outside), the resulting box _should_ be as secure as anything else on the market. Thoughts? Jon From owner-fwtk-users@ex.tis.com Thu Mar 23 07:14 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA01622 Thu, 23 Mar 2000 07:14:37 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA26577; Thu, 23 Mar 2000 04:19:56 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 23 Mar 2000 03:16:30 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA25796 for fwtk-users-outgoing; Thu, 23 Mar 2000 03:16:24 -0800 (PST) Message-ID: <38D9FBB7.B76F1424@mts.co.uk> Date: Thu, 23 Mar 2000 11:10:47 +0000 From: Derek Smith Organization: Millennium Travel Systems Ltd. X-Mailer: Mozilla 4.61 [en] (Win98; I) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: http-gw on redhat 6.1 - cgi problem Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 757 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I've been running tis on redhat 5 for about a year with no real problems. When I recently upgraded to 6.1 I found that the http-gw was having problems handling sites with cgi scripts, failing with a message to the user "connection reset by peer" although the amount of data passed as recorded in the logs was the same for both 5 and 6.1. The problem occurs whether the http-gw is run from inetd, or as a daemon. The same symptoms show with both Netscape and IE. I haven't been able to find any mention of this problem on redhat sites, or tis faq's, so any suggestions / comments would be very welcome. Thanks, Derek From owner-fwtk-users@ex.tis.com Thu Mar 23 14:02 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA00278 Thu, 23 Mar 2000 14:02:15 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA12036; Thu, 23 Mar 2000 10:42:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 23 Mar 2000 09:49:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA05626 for fwtk-users-outgoing; Thu, 23 Mar 2000 09:49:05 -0800 (PST) Date: Thu, 23 Mar 2000 12:47:54 -0500 From: Joseph S D Yao To: Ken Blinco Cc: FWTK Mailing List Subject: Re: smap problems Message-Id: <20000323124754.H17473@washington.cospo.osis.gov> Mail-Followup-To: Ken Blinco , FWTK Mailing List References: <38B3252E.1902F75A@citec.qld.gov.au> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <38B3252E.1902F75A@citec.qld.gov.au>; from citeckeb@citec.qld.gov.au on Wed, Feb 23, 2000 at 10:09:18AM +1000 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2425 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Apologies for late response ... On Wed, Feb 23, 2000 at 10:09:18AM +1000, Ken Blinco wrote: > We've been experiencing intermittant problems with smap. When a client > makes a connection to smap and begins sending data, at some stage smap > decides that the client has gone away and sends the client a > "550 you could say goodbye" error and then closes the connection. > > smap logs a "SMTP QUIT with no message" to syslog. > > This seems to happen more often when the client is sending large emails > > 2Meg. (we do not have a limit on size) > > We are presuming that we are looking at intermittent network problems > here and that data is simply not arriving at the socket correctly (we > put in some debug statements in smap.c and found that we were getting > read errors periodically). > > This machine on which smap is running is quite busy which may be another > factor. > > I'm posting this just to see if anyone else out there has had similar > problems, and if so, what did they do to fix the problem. We had a similar problem inside the firewall, with a different piece of equipment. Details are perhaps not relevant, except that the receiving mail servers that timed out were usually MSW-NT/MS Exchange machines. The basic problem was only with larger messages. It turned out that one piece of equipment on one side was ignoring all ICMP, and in particular ICMP "fragment" messages. Larger messages went into packets that didn't fit through tunnels ["virtual circuits"] between places. Enabling ICMP fixed this. This has been a problem in several parts of our network configuration. There is a myth out there that ICMP is evil and must be blocked. ICMP is a crucial part of IP. If IP is going from one place to another, then ICMP must be allowed to go through the same way - or, at least, those parts of ICMP that are used to keep the IP flowing. Note that this does not apply to access THROUGH the FWTK. IP stops dead at FWTK proxies, and never goes through - unless someone has damaged it by adding an IP packet filter of some sort. ;-) -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Mar 24 05:09 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA03141 Fri, 24 Mar 2000 05:09:28 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA18687; Fri, 24 Mar 2000 02:14:23 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 24 Mar 2000 01:02:57 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA14261 for fwtk-users-outgoing; Fri, 24 Mar 2000 01:02:51 -0800 (PST) From: dw@Netzstation.net Subject: Problem with ICQ-ing To: fwtk-users@lists.nai.com X-Mailer: Lotus Notes Version 5.0.1 (Intl) 11. August 1999 Message-ID: Date: Fri, 24 Mar 2000 10:01:15 +0100 X-Priority: 3 (Normal) X-MIMETrack: Serialize by Router on Domino01/Netzstation/DE(Version 5.0.1 (Intl)| 11. August 1999) at 24.03.2000 10:00:19 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id BAA14245 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 1509 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi @ll, I've got a problem with getting ICQ through our FWTK-Firewall. I installed udp-relay on our firewall and made the following configuration: relay 192.168.0.* * 4000 icq.mirabilis.com 4000 any relay 192.168.0.* * 4001 icq.mirabilis.com 4001 any relay 192.168.0.* * 4002 icq.mirabilis.com 4002 any relay 192.168.0.* * 4003 icq.mirabilis.com 4003 any relay 192.168.0.* * 4004 icq.mirabilis.com 4004 any relay 192.168.0.* * 4005 icq.mirabilis.com 4005 any relay 192.168.0.* * 4006 icq.mirabilis.com 4006 any relay icq.mirabilis.com * 4000 192.168.0.* 4000 any relay icq.mirabilis.com * 4001 192.168.0.* 4001 any relay icq.mirabilis.com * 4002 192.168.0.* 4002 any relay icq.mirabilis.com * 4003 192.168.0.* 4003 any relay icq.mirabilis.com * 4004 192.168.0.* 4004 any relay icq.mirabilis.com * 4005 192.168.0.* 4005 any relay icq.mirabilis.com * 4006 192.168.0.* 4006 any I pointed my Clients to the Firewall. They are able to register on the ICQ-Network but they never get messages from another. Does every Client have to use another Port? Must I plug those udp-ports for every Client explicitly? Mit freundlichem Gruss / Best Regards ------------------------------------------------------------------------- - Dieter Windmüller - Netzstation Informationstechnik GmbH Panoramastr. 17; 74417 Gschwend Tel: +49 7972 936770 Fax: +49 7972 936790 e-mail: dw@netzstation.net From owner-fwtk-users@ex.tis.com Fri Mar 24 11:12 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA04563 Fri, 24 Mar 2000 11:12:59 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA04716; Fri, 24 Mar 2000 08:18:03 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 24 Mar 2000 07:17:56 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA26429 for fwtk-users-outgoing; Fri, 24 Mar 2000 07:17:40 -0800 (PST) Message-Id: <3.0.3.32.20000323101517.0070e474@mail.denver.gd-is.com> X-Sender: dsmith@mail.denver.gd-is.com X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) Date: Thu, 23 Mar 2000 10:15:17 -0700 To: Derek Smith , fwtk-users@lists.nai.com From: Donald J Smith Subject: Re: http-gw on redhat 6.1 - cgi problem In-Reply-To: <38D9FBB7.B76F1424@mts.co.uk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 1959 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 11:10 AM 3/23/00 +0000, Derek Smith wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >Hi, > >I've been running tis on redhat 5 for about a year with no real >problems. When I recently upgraded to 6.1 I found that the http-gw was >having problems handling sites with cgi scripts, failing with a message >to the user "connection reset by peer" although the amount of data >passed as recorded in the logs was the same for both 5 and 6.1. > >The problem occurs whether the http-gw is run from inetd, or as a >daemon. How about something like a listing of you network configuration try cd /proc/sys/net/ipv4 for i in `ls -1` do echo $i >> /tmp/netconfig.out cat $i >> /tmp/netconfig.out done this should provide a better clue as to how your network is configured. > >The same symptoms show with both Netscape and IE. > >I haven't been able to find any mention of this problem on redhat sites, >or tis faq's, so any suggestions / comments would be very welcome. > >Thanks, > >Derek > > ------------------------------------------------------------------------------ Don Smith General Dynamics Information Systems Systems Administrator 8005 South Chester St EngleWood, Co. 80112 Phone (303) 649-7554 FAX (303) 649-7504 donald.j.smith@gd-is.com Error msgs that I love: "Keyboard not found press F1 to continue" (pc bios) "Harddrive controller failure insert new disk and press any key to continue" (pc bios) "The disk is write protected Remove the write protect or use another disk." (nt) User must change his password before he logs in the first time. (nt) ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Fri Mar 24 12:18 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA09086 Fri, 24 Mar 2000 12:18:20 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA18601; Fri, 24 Mar 2000 09:23:40 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 24 Mar 2000 08:35:41 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA07953 for fwtk-users-outgoing; Fri, 24 Mar 2000 08:35:34 -0800 (PST) X-Authentication-Warning: the-wall.ues-software.com: mail set sender to using -f From: "Y. W. Ko" To: Subject: RE: http-gw on redhat 6.1 - cgi problem Date: Fri, 24 Mar 2000 11:30:19 -0500 Message-ID: <000801bf95ae$3ea322b0$104262c7@uessoftware.com> MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 In-reply-to: <38D9FBB7.B76F1424@mts.co.uk> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="----=_NextPart_000_0009_01BF9584.55CD1AB0" Content-Length: 4537 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. ------=_NextPart_000_0009_01BF9584.55CD1AB0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Oops.... I forgot the attachment in the previous post - here it is.. --------------------------------------------------------------------------- UES Software Inc. Tel: (410) 573-2037 175 Admiral Cochrane Drive, Suite 110 Fax: (410) 573-2041 Annapolis, MD 21401. E-mail: ko@ues-software.com > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Derek Smith > Sent: Thursday, March 23, 2000 6:11 AM > To: fwtk-users@lists.nai.com > Subject: http-gw on redhat 6.1 - cgi problem > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > I've been running tis on redhat 5 for about a year with no real > problems. When I recently upgraded to 6.1 I found that the http-gw was > having problems handling sites with cgi scripts, failing with a message > to the user "connection reset by peer" although the amount of data > passed as recorded in the logs was the same for both 5 and 6.1. > > The problem occurs whether the http-gw is run from inetd, or as a > daemon. > > The same symptoms show with both Netscape and IE. > > I haven't been able to find any mention of this problem on redhat sites, > or tis faq's, so any suggestions / comments would be very welcome. > > Thanks, > > Derek > ------=_NextPart_000_0009_01BF9584.55CD1AB0 Content-Type: message/rfc822 Content-Transfer-Encoding: 7bit Content-Disposition: attachment From: "Tony Gale" Sender: To: "Mario Cosenza" Cc: , , =?iso-8859-1?Q?Mattias_Sandstr=F6m?= Subject: [PATCH] POSTs (was Re:FWTK + RH Linux 6.0 + Netscape = No good?) Date: Tue, 17 Aug 1999 04:05:02 -0500 Message-ID: MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0005_01BF9584.55C26C50" X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: XFMail 1.3 [p0] on Linux In-reply-to: Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 X-UIDL: 8efce6aaa9ed15342cd83aec99756d98 This is a multi-part message in MIME format. ------=_NextPart_000_0005_01BF9584.55C26C50 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Here's a patch for the 'Connection reset by peer' problem. This should be pretty safe and should also be pretty portable. I've only tested it on Linux though. Rick: I re-read the RFC, and you are correct, this is a Netscape bug. As usual, you get no warranty, guarantee or anything else with this patch; use at your own risk. I don't claim it is fit for any purpose whatsoever. Have fun, -tony --- E-Mail: Tony Gale Innovation is hard to schedule. -- Dan Fylstra The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. ------=_NextPart_000_0005_01BF9584.55C26C50 Content-Type: application/octet-stream; name="fwtk-ns-post.patch" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="fwtk-ns-post.patch" *** http-gw.c.orig Tue Aug 17 09:54:09 1999=0A= --- http-gw.c Tue Aug 17 09:47:44 1999=0A= ***************=0A= *** 1362,1367 ****=0A= --- 1362,1383 ----=0A= }else=0A= break;=0A= }=0A= + /* Check if there is a CRLF left in the buffer.=0A= + * Netscape sends CRLF on the end of POST commands.=0A= + * TRG - 19990817=0A= + */=0A= + {=0A= + char str[2];=0A= + int count;=0A= + if (ioctl(rfd, FIONREAD, &count) =3D=3D 0) {=0A= + if (count =3D=3D 2) {=0A= + if (recv(rfd, str, 2, MSG_PEEK) =3D=3D 2) {=0A= + if ((str[0] =3D=3D '\r') && (str[1] =3D=3D '\n'))=0A= + read(rfd, str, 2);=0A= + }=0A= + }=0A= + }=0A= + }=0A= }=0A= return 0;=0A= }=0A= ------=_NextPart_000_0005_01BF9584.55C26C50-- ------=_NextPart_000_0009_01BF9584.55CD1AB0-- From owner-fwtk-users@ex.tis.com Fri Mar 24 12:18 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA09087 Fri, 24 Mar 2000 12:18:22 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA18613; Fri, 24 Mar 2000 09:23:42 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 24 Mar 2000 08:33:17 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA07619 for fwtk-users-outgoing; Fri, 24 Mar 2000 08:33:10 -0800 (PST) X-Authentication-Warning: the-wall.ues-software.com: mail set sender to using -f From: "Y. W. Ko" To: Subject: RE: http-gw on redhat 6.1 - cgi problem Date: Fri, 24 Mar 2000 11:27:42 -0500 Message-ID: <000401bf95ad$e0da0a90$104262c7@uessoftware.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 In-reply-to: <38D9FBB7.B76F1424@mts.co.uk> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1651 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Derek, A patch was posted some time ago that fixed a "connection reset by peer" problem that I was having. I hope it fixes yours as well - please see attachment. Cheers, Ko --------------------------------------------------------------------------- UES Software Inc. Tel: (410) 573-2037 175 Admiral Cochrane Drive, Suite 110 Fax: (410) 573-2041 Annapolis, MD 21401. E-mail: ko@ues-software.com > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Derek Smith > Sent: Thursday, March 23, 2000 6:11 AM > To: fwtk-users@lists.nai.com > Subject: http-gw on redhat 6.1 - cgi problem > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > I've been running tis on redhat 5 for about a year with no real > problems. When I recently upgraded to 6.1 I found that the http-gw was > having problems handling sites with cgi scripts, failing with a message > to the user "connection reset by peer" although the amount of data > passed as recorded in the logs was the same for both 5 and 6.1. > > The problem occurs whether the http-gw is run from inetd, or as a > daemon. > > The same symptoms show with both Netscape and IE. > > I haven't been able to find any mention of this problem on redhat sites, > or tis faq's, so any suggestions / comments would be very welcome. > > Thanks, > > Derek > From owner-fwtk-users@ex.tis.com Sun Mar 26 02:05 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA17673 Sun, 26 Mar 2000 02:05:35 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id XAA04370; Sat, 25 Mar 2000 23:10:15 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 25 Mar 2000 21:47:23 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA03064 for fwtk-users-outgoing; Sat, 25 Mar 2000 21:47:12 -0800 (PST) Message-ID: <38DDA40F.2221DCAC@ior.com> Date: Sat, 25 Mar 2000 21:45:51 -0800 From: Darren Ehmke X-Mailer: Mozilla 4.51 [en] (Win95; I) X-Accept-Language: en MIME-Version: 1.0 To: ark@eltex.ru, fwtk-users@lists.nai.com Subject: Re: POP3/pop3-gw/plug-gw/pop-gw References: <200003221132.OAA09928@paranoid.eltex.spb.ru> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 5110 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, Thanks for the info, but still having some problems. I have changed the configuration pieces to try to correctly setup the client and proxy. The error that results in the /var/log/messages file is something like "authentication failure to host", which lists the mail server on the outside. From what the manual says, it should correctly work. It appears that it is trying, but keeps asking for a password to be typed in to verify. Below lists the changes. ark@eltex.ru wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > nuqneH, > > Darren Ehmke said : > > > question #4. There seems to be 3 different ways to possibly set > > this up. > > a. pop3-gw (appears that docs say only outbound, > > does this mean you can not receive?) > > Outbound means it is not recommended for serving requests from > untrusted networks. > > > b. pop-gw (only used for internal pop server?) > > c. plug-gw (??) > > > > > > I have taken approached (a) and (c) to try to configure the > > system to appropriately receive and send pop mail. At one time > > it did work for receiving pop mail with approach (a). But, > > after I tried to send pop mail out, it failed completely and > > miserably. > > You cannot _send_ pop mail out. pop3 is protocol to _receive_ mail. > You shound use SMTP for it. > > > Where I keep receiving deny messages with the /var/log/messages > > file. > > > > Here is the configuration of how I set it up. > > > > Before going there, md5 needed to be compiled in. I had found > > the libmd5, but it did not work. So, I did find the md5 > > that libmd5 had referred to, where the md5.c and md5.h were > > available. Hacking the pop3-gw.c program and the Makefile > > to include "md5.h" instead of and putting this in > > its current directory and changing the Makefile to include > > md5.o within the compiling. > > I assume you are running Linux ;)? Ok, looks like you did that right way. > > > Now for the configuration. > > > > SERVER CONFIGURATION > > > > /etc/inetd.conf > > pop3 stream tcp nowait root /usr/local/etc/pop3-gw pop3-gw pop3 > > extra "pop3" is not needed. you should not use plug-gw syntax here. > Removed the pop3, so now reads. Should the second pop3-gw be there? /etc/inetd.conf pop3 stream tcp nowait root /usr/local/etc/pop3-gw pop3-gw > > /etc/services > > did not modify anything > > pop3 110/tcp > > pop3 110/udp > > Ok. > > > /usr/local/etc/netperm-table > > pop3-gw: timeout 300 > > pop3-gw: port pop3 permit-hosts 10.* -plug-to mail.location.com -port pop3 > > RTFM. You should not use plug-gw syntax here. pop3-gw does not find > configuration tag "hosts" (you have "port" instead) and assumes everything > is denied. RTM, this is what is now there. /usr/local/etc/netperm-table pop3-gw: timeout 300 pop3-gw: permit-hosts 10.* -plug-to mail.location.com > > > Within Netscape on a client system, the following was done. > > > > CLIENT CONFIGURATION > > > > Edit->Preferences->Identity > > Email Address: me@mail.location.com > > > > > > Edit->Preferences->Mail Servers > > Incoming Mail Servers > > Server Name: fwtkcomputer.domainname.com > > User Name: me@mail.location.com 110 > > RTFM. a) you should use plug-to or user@host syntax, using both of them > is pure nonsense. b) it may do not affect you for this configuration > because of netscape mail client misfeature/bug (see -separator option). > Remove "110", it is not required and you used incorrect syntax anyways. > Removed the 110 port, so that only me@mail.location.com is present. The fwtkcomputer.domain.com is the same. > > Outgoing Mail (SMTP) Server: fwtkcomputer.domainname.com > > Outgoing Mail Server user name: me@mail.location.com 110 > > 110 has nothing to do with SMTP stuff, nor pop3-gw does. > > > > ERROR MESSAGES > > > > In /var/log/messages > > > > Mar 21 10:53:22 phaze pop3-gw[5138]: deny host=sam/10.60.1.120 > > service=110 > > > > On Netscape > > > > An error occurred with the pop3 server. You > > should contact the administrator for this > > server or try again later. > > > > Any suggestions, comments and other would be very greatly > > appreciated. > > > > Thanks > > > > Darren > > > > _ _ _ _ _ _ _ > {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ > (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| > [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.3i > Charset: noconv > > iQCVAwUBONivNqH/mIJW9LeBAQGxNgP/UtMUW3nKRwyALjv4qEGyjdmrFo/J4ncS > PKtwDpdswo1kff8zUAt4/4T8EIslt/dDri1NJ/XEd+Jrxum8HqqKETV2Pt12EeA1 > 4CchzNaIocYpKdL78RqzrsxZMJRIHMDjKG4bDGO0QjWn5NjH+TOmOHUJ3VUAqbfv > shtitRVYv20= > =r6ez > -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Sun Mar 26 10:58 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA18663 Sun, 26 Mar 2000 10:58:52 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA14507; Sun, 26 Mar 2000 08:03:28 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 26 Mar 2000 07:12:52 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA13242 for fwtk-users-outgoing; Sun, 26 Mar 2000 07:12:46 -0800 (PST) Message-Id: <200003261512.HAA13227@relay2.nai.com> Date: Sun, 26 Mar 2000 08:09:50 -0700 From: "Dave Fennell" To: fwtk-users@lists.nai.com Subject: Re: POP3/pop3-gw/plug-gw/pop-gw X-Mailer: WorldClient Standard 1.1 X-MDaemon-Deliver-To: fwtk-users@lists.nai.com X-Return-Path: dfennell@cell-loc.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1461 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have been using pop3-gw for some time now quite successfully. I think your configuration is okay. I had a similar problem to yours, and I had to make one slight change to the source code for it. I am using POP and not APOP on our servers. The mail clients I use appear to insert a carriage return/linefeed in the buffer with the password that gets passed to the proxy. The proxy also inserts a carriage return/linefeed. This gets the server confused, and you may receive a message similar to what you are seeing. To make it work, change the line in the subroutine do_server_pauth from sprintf(buf,"PASS %s\r\n",password); to sprintf(buf,"PASS %s",password); This eliminates the double cr/lf. It works for me. This problem may well exist in the apop routines as well, but I don't have an apop server to test it against. Regards Dave > Hi, > > Thanks for the info, but still having some problems. I have changed > the configuration pieces to try to correctly setup the client and > proxy. The error that results in the /var/log/messages file is > something like "authentication failure to host", > which lists the mail server on the outside. From what the manual > says, it should correctly work. It appears that it is trying, but > keeps asking for a password to be typed in to verify. Below lists > the changes. > From owner-fwtk-users@ex.tis.com Mon Mar 27 03:44 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA21297 Mon, 27 Mar 2000 03:44:33 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA07613; Mon, 27 Mar 2000 00:48:59 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 26 Mar 2000 23:28:49 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id XAA02851 for fwtk-users-outgoing; Sun, 26 Mar 2000 23:28:43 -0800 (PST) Message-ID: <38DF0895.6F6F5C4A@linux-homenet.de> Date: Mon, 27 Mar 2000 09:07:01 +0200 From: Joerg Schubert X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.14 i586) X-Accept-Language: de-DE, en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: Apache-Authorisation Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 287 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, i have fwtk V2.1 on my Firewall. Now i will install a Apache-WWW-Server on the same machine. Is a auth-module for Apache over identsrv available? Joerg From owner-fwtk-users@ex.tis.com Mon Mar 27 11:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA23777 Mon, 27 Mar 2000 11:32:32 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA22021; Mon, 27 Mar 2000 08:37:53 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 27 Mar 2000 07:46:21 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA13408 for fwtk-users-outgoing; Mon, 27 Mar 2000 07:46:10 -0800 (PST) Message-ID: <002901bf9802$88877b00$fc00a8c0@k62350> From: "Larry Jackson" To: "Joerg Schubert" , References: <38DF0895.6F6F5C4A@linux-homenet.de> Subject: Re: Apache-Authorisation Date: Mon, 27 Mar 2000 10:38:38 -0500 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2314.1300 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 808 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Joerg Schubert asked: > > i have fwtk V2.1 on my Firewall. Now i will install a Apache-WWW-Server > on the same machine. Is a auth-module for Apache over identsrv > available? > The short answer is DON'T install a WWW server on your firewall. WWW Servers have many known security holes and it isn't a good idea to put them on your firewall. If you really need one put it on a different machine in a DMZ or outside your firewall. That way when they break out of your WWW server they can't get to anything important. As far as identsrv, I don't know, but I still would not trust it. I NEVER run servers on my firewall. LarryJackson@iName.com From owner-fwtk-users@ex.tis.com Tue Mar 28 11:25 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA29093 Tue, 28 Mar 2000 11:25:27 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA22484; Tue, 28 Mar 2000 08:30:49 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 28 Mar 2000 07:05:24 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA13522 for fwtk-users-outgoing; Tue, 28 Mar 2000 07:05:18 -0800 (PST) Message-ID: <38E0C44D.153A0044@linux-homenet.de> Date: Tue, 28 Mar 2000 16:40:13 +0200 From: Joerg Schubert X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.14 i586) X-Accept-Language: de-DE, en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: syslogd from fwtk Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 667 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, i have fwtk2.1 and linux 2.2.14 on my firewall. Now i will compile the syslogd with extension for regular expressions from tools/server/syslogd. I become the following messages from the compiler: cc -g -c syslogd.c -o syslogd.o syslogd.c:80: sys/msgbuf.h: No such file or directory In file included from syslogd.c:100: pathnames.h:56: warning: `_PATH_KLOG' redefined /usr/include/paths.h:51: warning: this is the location of the previous definition make: *** [syslogd.o] Error 1 What can i do? joerg.schubert@linux-homenet.de From owner-fwtk-users@ex.tis.com Tue Mar 28 12:49 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA29887 Tue, 28 Mar 2000 12:49:48 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA04436; Tue, 28 Mar 2000 09:54:56 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 28 Mar 2000 09:14:29 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA28204 for fwtk-users-outgoing; Tue, 28 Mar 2000 09:14:18 -0800 (PST) Message-ID: <38E0E7FA.FDAD68D8@v-one.com> Date: Tue, 28 Mar 2000 12:12:26 -0500 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.72 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Joerg Schubert CC: fwtk-users@lists.nai.com Subject: Re: syslogd from fwtk References: <38E0C44D.153A0044@linux-homenet.de> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 827 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Joerg Schubert wrote: > > i have fwtk2.1 and linux 2.2.14 on my firewall. Now i will compile the > syslogd with extension for regular expressions from > tools/server/syslogd. I become the following messages from the compiler: > > cc -g -c syslogd.c -o syslogd.o > syslogd.c:80: sys/msgbuf.h: No such file or directory Try removing the include from your syslogd.c file. > In file included from syslogd.c:100: > pathnames.h:56: warning: `_PATH_KLOG' redefined > /usr/include/paths.h:51: warning: this is the location of the previous > definition This is a FAQ: http://www.fwtk.org/fwtk/faq/faq.html#2.8.3 -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Tue Mar 28 14:19 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA00398 Tue, 28 Mar 2000 14:19:00 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA19206; Tue, 28 Mar 2000 11:24:27 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 28 Mar 2000 10:35:21 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA11598 for fwtk-users-outgoing; Tue, 28 Mar 2000 10:35:06 -0800 (PST) Mime-Version: 1.0 X-Sender: blair.lowe@mail.pleasantview.compeng.net (Unverified) Message-Id: In-Reply-To: <3.0.6.32.20000328173949.009b72e0@192.168.2.2> References: <3.0.6.32.20000328173949.009b72e0@192.168.2.2> Date: Tue, 28 Mar 2000 11:32:59 -0700 To: John Armstrong , fwtk-users@ex.tis.com From: Blair Lowe Subject: Re: smap in anti-relay mode Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 1983 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Two possible problems: 1. get the patch file as text in your ftp transfer. 2. you must have a virgin untouched smap.c file. I used RCS to try to preserve it, but it changed the file so that the patch would not work. Hope this helps, Blair. At 17:39 +0100 2000/03/28, John Armstrong wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >I've been trying to patch my smap code with the yao-smap.pch patch >so that it cuts out relaying. I'm currently running FWTK 2.1 on a >RedHat 5.1 host (Yes I know I should update it - I will be when I get >time to finish building a new RH 6.1 firewall sometime next month!) > >When I use patch < yao-smap.pch on my smap.c file, all 40 hunks fail. >I tried updating patch from 2.5-2 to 2.5-4, but found it needs lib.so.6 >which in turn produced more confusion and time mis-spent. I've also >tried hand-editing smap.c from the patch file, but the more I do the >less confident become that it will work! > >Has anyone else had similar problems? Can anyone provide me with a >suitably-patched version of smap.c so I don't have to waste another >couple of days! > >TIA > >John >__________________________________________________________________________ > John Armstrong Computer System Adminstrator > Health & Safety Officer > john@lrf.leeds.ac.uk > j.d.c.armstrong@leeds.ac.uk LRF Centre at Leeds University > 30 Hyde Terrace > 0113 233 3912 (phone) Leeds LS2 9LN > 0113 245 9806 (fax) Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) All email advice that is provided for free is without warrantee: use at your own risk. From owner-fwtk-users@ex.tis.com Wed Mar 29 04:42 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA03314 Wed, 29 Mar 2000 04:42:43 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA26266; Wed, 29 Mar 2000 01:48:10 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 29 Mar 2000 00:53:51 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA23839 for fwtk-users-outgoing; Wed, 29 Mar 2000 00:53:44 -0800 (PST) X-Authentication-Warning: aeria.eic.at: nobody set sender to using -f Message-ID: <38E1C450.493A3019@eic.at> Date: Wed, 29 Mar 2000 10:52:32 +0200 From: "Johann G. Hautzinger" Organization: Erste Bank AG X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.13 i686) X-Accept-Language: en MIME-Version: 1.0 To: TIS Mailing List Subject: problems with smap? Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1176 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi list, i am using smap (V2.1/2.1+anti-relay+anti-spam) - with _one_ site there is a problem (which makes me think it is their fault ... but we'll see): "small" mails (i.e. several lines) get through without a problem, "big" mails (everything bigger than 2kb is considered to be "big") get rejected (I/O Error) i am in contact with the other servers admin and we found out the following: when a big mail gets sent, a timeout seems to occur in the following way: "DATA" is sent ... and afterwards _nothing_ is sent for up to a minute (mimeheaders ...) after a minute the other server closes the connection. small mails have their mimeheaders and everything else sent in a glance - so the problem _might_ be this timeout any ideas? *greetz* from Vienna Hannes ps. i need those ideas rather urgent as i will be on a new job on monday :-) -- Johann Georg Hautzinger, email: trema@eic.at, Tel.: 531 00 1907 Erste Bank AG - OE 0423 - Orga./Entw. Treasury u. Orga.Wertpapier Boersegasse 14, 1010 Wien http://treasury.erstebank.at From owner-fwtk-users@ex.tis.com Wed Mar 29 07:12 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA03894 Wed, 29 Mar 2000 07:12:27 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA04949; Wed, 29 Mar 2000 04:17:37 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 29 Mar 2000 03:29:44 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA01976 for fwtk-users-outgoing; Wed, 29 Mar 2000 03:29:33 -0800 (PST) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC9A9@mailserver.isolaandisola.com> From: William Jackson To: "'squid-users@ircache.net'" , "'fwtk-users@lists.nai.com'" Subject: squid and fwtk's squid-gw Date: Wed, 29 Mar 2000 13:30:18 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="----_=_NextPart_000_01BF9972.2968E130" Content-Length: 15625 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_000_01BF9972.2968E130 Content-Type: text/plain; charset="iso-8859-1" I have setup my internal squid so that it relays any non local web requests to my squid-gw in the DMZ this is working apart from a small problem! When I look at any web pages they appear on my browser except there are no images, hyperlinks etc. only plain text and tables etc see attached image: I have included a copy of my squid-gw anybody have any ideas? I think it must be something with the filtering but havent yet worked out what thanks <> squid-gw: userid squiduser squid-gw: groupid squidgroup squid-gw: permit-hosts x.x.x.x squid-gw: deny-browsers no-user-agent no-connect-user-agent squid-gw: permit-browsers "*" squid-gw: permit-connect "*" squid-gw: deny-destinations *:*sex* -message "Naughty Naughty!" squid-gw: auto-html-limit 210 squid-gw: cookies netscape squid-gw: server-timeout 3600 squid-gw: server proxy.isp.com 8080 squid-gw: client-timeout 600 squid-gw: http-fields dangerous:drop/log unknown:drop/log squid-gw: html-tags dangerous:comment/log unknown:comment/log squid-gw: html-references unknown:escape/log squid-gw: html-attributes dangerous:drop unknown:drop on:drop/log William ------_=_NextPart_000_01BF9972.2968E130 Content-Type: application/octet-stream; name="noweb.png" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="noweb.png" iVBORw0KGgoAAAANSUhEUgAAAX0AAAFwCAIAAADbhTzYAAAABGdBTUEAAFjH/EfgAgAAACBjSFJN AAB6JQAAgIMAAPn/AACA5gAAdS4AAOpfAAA6lwAAF29p5MQrAAAnZUlEQVR4nGL4PwpGwSgYBfQF AAHEMNAOGAWjYBSMOAAQQKPlzigYBaOA3gAggEbLnVEwCkYBvQFAAI2WO6NgFIwCegOAABotd0bB KBgF9AYAATRa7oyCUTAK6A0AAmi03BkFo2AU0BsABNBouTMKRsEooDcACKDRcmcUjIJRQG8AEECj 5c4oGAWjgN4AIIBGy51RMApGAb0BQACNljujYBSMAnoDgAAaLXdGwSgYBfQGAAE0Wu6MglEwCugN AAJoUJc7/qm1o2gUjaLhhwACaLCXOwPthFEwCkYB9QFAAI2WO6NgFIwCegOAABotd0bBKBgF9AYA ATRa7oyCUTAK6A0AAmi03BkFo2AU0BsABNBouTMKRsEooDcACKChV+40EA3o7+BRMApGATEAIICG ZLlDUOOBAwcYGAa110bBKBjJACCABnXmxFPu4G/a4Cl3MMWJV0kMIGg+nIssjtUuShxGLcePglFA CwAQQIM6neEvd4C5BIIwc8vQKnfwFDoklUekqqGWrlEwCkgFAAE0qNMZLcqd/0Q0NAhK4QGkljv4 S73RcmcUDEsAEECDOp3RqNz5jyNXM8AAmhq0cgq/CEnlDjGOxCOOZi9WZ5DkqdFyZxTQBwAE0KBO Z/jLHbTcgjzWQ8y4MsGWDtbsiqkGjwhWi6hb7mCqxO8MYjw1CkYBrQFAAA3qdEb8fBaoGAIWRBDE wEBeuYNWkJFaypBR7mBVjymL3wQ0l6NpIcNTo2AU0BoABNCgTmf0LHcoL2XIK3ewasEvS4wJlHhh FIwCWgOAABrU6YyYcgfR7Roc5Q7xFuHXS3a5g6uhNFrujILBAwACaFCnM4LlDniUB2XkAsKmUT8L zRasIrgaL1g1EuMePCqJcQZJnhotd0YBfQBAAA3qdIa/3IEVOv/hRQ8cjK5XHgWjYDADgAAa1JmT 0HzWf1SE8MtouTMKRsFgBgABNKgzJ55yhwEbgKsZLXdGwSgYzAAggAZ15sRV7hwgAoyWO6NgFAxa ABBAgzpzYi13sLZ08Dd/RsEoGAWDCgAE0KDOnKPnfo2CUTAsAUAAjZY7o2AUjAJ6A4AAGi13RsEo GAX0BgABNFrujIJRMAroDQACaLTcGQWjYBTQGwAE0Gi5MwpGwSigNwAIoNFyZxSMglFAbwAQQKPl zigYBaOA3gAggEbLnVEwCkYBvQFAAI2WO6NgFIwCegOAABotd0bBKBgF9AYAATRa7oyCUTAK6A0A Ami03BkFo2AU0BsABNBouTMKRsEooDcACKDRcmcUjIJRQG8AEECj5c4oGAWjgN4AIIBGy51RMApG Ab0BQACNljujYBSMAnoDgAAaLXdGwSgYBfQGAAE0Wu6MglEwCugNAAJotNwZBaNgFNAbAATQaLkz CkbBKKA3AAig0XJnFIyCUUBvABBAo+XOKBgFo4DeACCARsudUTAKRgG9AUAAjZY7o2AUjAJ6A4AA Gi13RsEoGAX0BgABNFrujIJRMAroDQACaLTcGQWjYBTQGwAE0Gi5MwpGwSigNwAIoNFyZxSMglFA bwAQQKPlzigYBaOA3gAggEbLnVEwCkYBvQFAAI2WO6NgFIwCegOAABrU5U7zzI2jaBSNouGHAAJo UJc7o2AUjIJhCQACaLTcGQWjYBTQGwAE0Gi5MwpGwSigNwAIoNFyZxSMglFAbwAQQKPlzigYBaOA 3gAggEbLnVEwCkYBvQFAAI2WO6NgFIwCegOAABotd0bBKBgF9AYAATTEyh0GVIAmSFAXtRxApCPh XCLdQJI7/VNrqYuaZ24kLgxGwSigFAAE0BArd/7jyPlElgU0sh2XLNbykVrupPomktFyZxTQDQAE 0NArd/5jy96kaqGW1QRlR8udUTAKMAFAAI2WOxRZTYzUaLkzCkYBGgAIoCFZ7vxHyp9Y+1yYAyXI 6rE2SYgUJ6PcweUGTDaapfjdM1rujIKhCwACaLiVO5h5GJmNWfSQysa0EavVBBVQyP4/Wu6MgqEM AAJoqJY7/+mbzwdJuYNs/mi5MwqGLgAIoGFY7jCgAkzFQ7Hc+Y9R9IyWO6Ng6AKAABpu5Q4tyhqC BQpBJ1HLXuSiZ7TcGQVDFwAE0Gi5Q80yCGtJQS23oQmOljujYOgCgAAakuUOAwbAL4umEk0XMeag CRLvPDyCuNyG6UKs2mlx+iRp0TAKRgG5ACCAhmS5MwpGwSgY0gAggEbLnVEwCkYBvQFAAI2WO6Ng FIwCegOAABotd0bBKBgF9AYAATRa7oyCUTAK6A0AAmi03BkFo2AU0BsABNBouTMKRsEooDcACKDR cmcUjIJRQG8AEECj5c4oGAWjgN4AIIBGy51RMApGAb0BQAAN4XIH1zYIglr+492IQLYz/hN38iFN AfFeIM+zo2AUUAUABNDQTnmkbp7C3B6FxzRSHTAYcjJmgBCpchSMAnoCgAAa2imP1HIHj15SteMy gXjtdACj5c4oGJwAIICGdsrD1dxA6/tg7VthVY+ZFfH0v/BkXax2YXUPJbIEBdEAVvNHwSigPwAI oKGd8rBmLWSp/4TKJlwq8RiCKYtLHNM6XA4mRha/gXg8iGYCsjsJB/EoGAU0AAABNLRTHq6y5j+V yh1cFuERJGg1VWRJ8uD/0XJnFAwyABBAQzvl0aHcYUAC+G3HFB885Q4e146CUUB/ABBAQzsh0rrc wV8kYXUAQasHSbkzWgyNggEEAAE0hFMeAzZAUAFWLcQbgt8ZmIKYXFyW4pLF7xc84YDVVWguJD/0 R8EooAAABNBoyhspYLSUGQWDBwAE0GhaHP4A3vwZaIeMglEABQABNJoWhz8Y7VKNgsEGAAJoNDmO glEwCugNAAJotNwZBaNgFNAbAATQaLkzCkbBKKA3AAig0XJnFIyCUUBvABBAo+XOKBgFo4DeACCA RsudUTAKRgG9AUAAjZY7o2AUjAJ6A4AAGi13RsEoGAX0BgABNFrujIJRMAroDQACaLTcGQWjYBTQ CRw8cxOCAAJotNwZBaNgFNAJAEuc5pkbgQgggEbLneEA/FNrR9EoGoQIWNAgJ1R4uQMQQKPlznAA wAjGdUDPKBgFAwWA5QuucgcggEbLneEAIOXOQLtiFIwCFICn3AEIoNHEOhzAaLkzCgYhwFPuAATQ aGIdDmC03BkFgxDgKXcAAmg0sQ4HMFrujIJBCPCUOwABNJpYhwMYLXdGwSAEeModgAAaTazDAYyW O6NgEAI85Q5AAI0m1uEARsudUTAIAZ5yByCARhPrcACj5c4oGIQAT7kDEECjiXU4gNFyZxQMQoCn 3AEIoNHEOhzAaLkzCgYhwFPuAATQaGIdDmC03BkFgxDgKXcAAmg0sQ4HMFrujIJBCPCUOwABNJpY hwMYLXdGwSAEeModgAAaTazDAYyWO6NgEAI85Q5AAI0m1uEARsudUTAIAZ5yByCARhPrcACj5c4o GIQAT7kDEECjiXU4gNFyZxQMQoCn3AEIoNHEOhzAaLkzCgYhwFPuAATQaGIdDgBY7kCicxSNokGF MMsdyLnLAAE0Wu4MBwC/HmQUjaLBhpATKvzoZYAAGi13RsEoGAX0BgABNFrujIJRMAroDQACaLTc GQWjYBTQGwAE0Gi5MwpGwSigNwAIoNFyZxSMglFAbwAQQKPlzigYBVQGyBf1DrRbBikACKDRcmdI ArQLYdEEB9ZtAwXweJ9uwQJdnIIESC19cLkfjyx+0zD9jifl4DGfWgEIMQcggEZoGh0GAGsqGbGF DgQMbLkDL3EwrUZbxoIHYI1TaF4l0RfIigkmFfwmUzEAIeYABNCITqZDHaClhhFe6PynY7sGK8C1 WwVz2S4uAC9fsIpjlSJoGjGyxBhL3XIHIIBGekod0mC03EEDA1juoBU6aC4hsuihZ7lDqrHULXcA Amikp9ShDpAb4VilsHbj0di4jMWvF5dKYkzDo5ESq/Erw2MUpoF4lGEFyOUOpsPoUO4QGbzEWPcf W/LAExq4bMGlGEgCBNBouTO0AXL2wCpOJJt4vcjWkWEaec7DYzUeZcQYRXYooQHKyx1kWzBjE6s4 fgXEOBtXlGE1Gb8tRLoZwgUIoNFyZ8gDrBmDWjkKv3piTEPLgaRqJMZqglooYRMJKO9nkV3ukFpI 4dGLKUvFsgaZDRBAo+XOkAe0KHcYUAEu9QwYAL9pxGgkyWoKfU1GyOABFI4r4wlJBhz5GasgfsX4 9aI5BpdpuKwgKA5nAwTQaLkz5AFVciCpevGbgMtMWltNYfmCK9sTCeCnICELYj2GBhNg9Qsmmz7l DkGrKS93AAJotNwZ8mDwlDv4EzH+DE+J1WSXNVgNwRMaBAHkxBm0g6+IH1HGJUKMI/HoIsne/7jD kyS34XczQACNljtDGDBgAFyyxOvCpYZUW0hyBoVWYzUQvzloavAECx6v4QK4Tr0iPnyIDwQ0LfiN xWUvA+6AxR9oWK3GLw4RAQig0XJnFIwCECA+h48CygFAAI2G7CgYBSCAq2YeBbQAAAE0GrKjYBRA wWhjh24AIIBGA3cUjIJRQG8AEECj5c4oGAWjgN4AIIBGy51RMApGAb0BQACNljujYBSMAnoDgAAa LXdGwSgYBfQGAAE0Wu6MglEwCugNAAJotNwZBaNgFNAbAATQaLkzCkbBKKA3AAig0XJnFIyCUUBv ABBAo+XOKBgFo4DeACCARsudUTAKRgG9AUAAjZY7o2AUjAJ6A4AAGi13RsEoGAX0BgABNFLKHaxb jQnuPKbi1mQiLYIfrURd28lzFS3sQg58+tj7H0fwDjjAeuIP3aKePEAthwEE0KDzGO0A1vAiGIJ0 KHfQpDBLRsptJ8NVtLOFzpkKT/AOLMAay3SLerIBVRwGEECD0WO0A5hJkFQt1LIav9TgT3wkAawe pLq/yAhePLroAEZyuQMQQIPRY7QDg7ncweqwQZv4iAe4vEBdfw3p4MXqjEHiNkxAFYcBBGCuXFIA AEEg2v1P3c7NfAuCXIUMPkeFfjT2NGZqatN4o6Onn3aZ99uidU7pC6LM07dieSPKWhQgWuGiQY9Q pmLx6/ZiUDGF9k0uuL2YVE7NuBq/FLQF0Gi5gy6OlY0ZGaSyMW3E6jBckU2h7cSzibeLSECMFjSr KfQIQStwuY3IkCHeSfh9jcsZWC2lVhST5FPyDMflNWQ2QACNuHLnP9FplLrs/0QkRORYp51LqOgj YgCmFgYkgF8NfktJdRj+4MVjIPHOw7SCGIBVC3WjDI+TBsRwgAAaLXfQxdGCklrs/7jLHQaMpE91 22nkI8xww+o7XFrwqGHAALik8NgCl8LUS9AZ+A0nxnlYHYPLhfiDiBI2LicRDEZKDCfoC4AAGi13 sAjSgo3fPfR0CSVpixjvYPUgHj8SowCrOJFBTWTwkmQ4/qAgNaywKqZi9GE6iaaGE+MLgAAaLXew CNKajd899HQJkWysziYe4EqpJCkg0sH4Yxa/LuLjDo/ziNGO34VE+pR4NtUNxG84Mb4ACEBOtWMB AIKg7n/qmkU+uubUUxBw6K9/50DpaUEWVrKnNJmrlrVQZ+nafpi0BSwq8WbPKPwwb5gCtwnRkT3R TG7CRBeWkGvBuahdrg/1HlcAjaxyZ9gDXCkAf8ogxkzMNDcKRgHZACCARhPQsAI0KncIioyCUUAS AAig0QQ0fAAxLWrKTR4tdEYB5QAggEbT0CgYBaOA3gAggEbLnVEwCkYBvQFAAI2WO6NgFIwCegOA ABotd0bBKBgF9AYAATRa7oyCUTAK6A0AAmi03BkFo2AU0BsABNBouTMKRsEooDcACKDRcmcUjIJR QG8AEECj5c4oGAWjgN4AIIBGy51RMApGAb0BQACNljujYBSMAnoDgAAaLXdGwSgYBfQGAAE0iMod 7Od00HgjIq4THgbJ7kdkV9HHSbjCnPi4ICkSKfQUkdrRgpGKyYy6kUKL/bekRhkVfYTHKIAAGhS5 Cw4wQ5wOmY3O1hEP0BxGnyyKyy6SHICmEk+hQ09PEc8l0igqlg5YXUK54cS4kLrJjEijAAJoEGWz /ziOm6SPpYMQUJI3CJpGUCVmBiA7c1LFVRRqp0W5Q6rGATGcpHKHWpYSNAogALNVjgMADIL+/+q2 MyCiUzsZYyx4/9VyvEnkMcwyC/nklh0CSvYm77LKbL1SpPHor7MNiJk7VS68E8ko52II5qQqOgYh aADDtDwWOD2qNphJ7eV6zysMzntXAGrKGAcAEISB/3+1roZCe8bJzRBsD2z8498pKZ8OSyICTXVf p5oKtpuNbe2BExZaI+ipiN0kWCpGWa+0tHAWUoRzKZtXjni38YiQ2v/y3Dx73JQ7TqZbAA3Scuc/ jkoVTQSN8Z/EOEazlPjkjmkRkbkCa6qinTtxOZ4ki0j1I34bSQ03sm3H5R5cvkNzHqlxjWYyHi3E OBJTkPJwIzLt4VdPZFAQlAUIwEy5JAEAgiD0/qeufcKT0U3bKPnY8G/vHFUuISrzdaG7TVdU7jK5 xlwgeCCpPWTS+tzZeVBpiifvveSmnB3OPNfcqgp18m/MeVk2DE9c7HvnCqChV+4gM4iRJdVSTHPw CJKtjBi3oXkBq9dIzatE2otVyyAsd0gFlJQyWIOFjORBkguJMZDIhIEnHslOvcSXdGiWAgRgrtqV AABB0P//dVMLL3Gz0RCQ7uzQ3vkfgN2+HJDcO5JnKwqHkYwJMCYvvbnBA7NLrNTlLlmH25GH62W8 mbNM0uFle9CF5Ef/OQonvXUF4wRp9yJOOkchDUhpRj4BNIjKnVFAJCAmBdMHDB6XjIL/Qyo6AAJo yDh0FMDBIEleg8QZowAOhlCMAATQkHHoKIAA4hvtw9sNowANDK1IAQigoeHKUTAKRsFwAgABNFru jIJRMAroDQACaLTcGQWjYBTQGwAEEL3LHVwzcIMQEONIankBbdKRKmZiNZ8qIU8V05AnXPHbgsnF I0XQHDyyZPgLvyPxayHSfDQG5QCrA6iVNogEAAE0ADkfzbf0sYgWJlArkjCjn3IzCdoySEzD7180 KVyWEmMCkbaQ4S9cjsSqHY+PsCqmXWLAVe7QwjpMABBAo+UORSbQwgo6lDuDyjQKyx2CWZdINcSY RtAE/EYRUxKRJEs2GPByByAAc1WSBAAIgvr/q705jgFipzwVNUC0/fLutPMBc0m8sbFpOcTaK6sP rhyV1Y83puQIjYTCgMkGbztcC6OCiHDOqoqyuLQrp9h6hRBTNFPyd0obrs51VqfUiNzdhocAxJTB DgAgCEL//6vrSmJPtg7daCoouv78O2O7mgwJ7TKAx/HYKuOkq1ziFgpNGIVC2xMJZlMAs+QO+LOo w8hACLT5kSwZirVAnXdRjH08uZbWVVrgyVC+Tj81ugUgpoxxAABBGPj/X7saasvB4qaVtEdU/syd LD7XTnQ3QXxGqFOqRcTzNHS36yU0pXFFgW4BONe4FJLVEraVkIqgQsUlBnj4EQjtPQvKthiqeVD0 CeniCEBNueMAAIIw9P6nVsdG4FHZ3AifttbA93fHxFlibhyprJipUtiWCJ7gbI7Jks6y/mrEQZsF LUv7HdBssnAb4DjumaalyddFYM3xLmgM63CVNFMRxeoJtgAaSuUOqYkY7mGsXGIcSYyr8AiSZBep BlJiC6nWEcxCWIOaVAZBN+MpIPCkeJL8QtBYIp1KpDIyop66SY5guYMZs3hEsLoHTRZCAgTgpdxx AIZBGHr/U6crwfZrqKowRcjfDNy+O/VAwtJu1t6tIi3Lgkc5/wp/aAeOdT64jJIr5jVVU9NH6tJY kFxzWmXgcpfU62SSO4NTI/4ohVWFaVprmsR5Aywt9QigAWjvkAeIDFM6GDIKRsEoIBtAih2AABoy +ZDyImO00BkFo2DAASQbAgTQ0MiKFLbOhlzjbhSMgmEMgDkRIIBGs+IoGAWjgN4AIIBGy51RMApG Ab0BQACNljujYBSMAnoDgAAaLXdGwSgYBfQGAAE0Wu6MglEwCugNAAJoUJc7aTPPjKJRNIqGHwII oNFyZxSNolFEbwQQQKPlzigaRaOI3ggggEbLnVE0ikYRvRFAAA3qcmcUjIJRMCwBQACNljujYBSM AnoDgAAaLXdGwSgYBfQGAAE0Wu6MglEwCugNAAJotNwZBaNgFNAbAATQaLkzCkbBKKA3AAig0XJn FIyCUUBvABBAo+XOKBgFo4DeACCARsudUTAKRgG9AUAAjZY7o2AUjAJ6A4AAGi13RsEoGAX0BgAB NFrujIJRMAroDQACaLTcGQWjYBTQGwAE0Gi5MwpGwSigNwAIoNFyZxSMglFAbwAQQKPlzigYBaOA 3gAggIZeuUPS5Z+UXzFK0C5cCgbVDaVojkFjDx53DjYwCCOX1JSJqYaS63ORNVISCAABNPQSHPGh RmHgEhnBgzBpYgI8yWVQuXOwAfxZdwDdQ3zKHJzlDkAADbEEB/cqMX6mSuASNGdIlDvIYNA6bBAC XNl7YMsdIp2B1fHEFFjEO4BsABBAQyz94Sl30KTQALIaguFO9XIHf8LFdDmaazE14kpP//GmNqza 8ViB1UcEQ284AVz+JSbQsHJxKSAybPFbQYzj8fsIq2m4UgsekwkmD4AA3JIxFgAgCELvf+saeeZH GsutMATssd/T+leIihr8oCREvy3qOdFRv7eQPGx9FW1k3JB/XD6lcqTMSw+Rh9nmK1B+vQz1txAZ vLKwawmgoZR0cEUbMpegAlxcrHYRDL7/hEoNXHZhjTM8XIJewO99kgwhVWoYA2LCkKRgJ9UEXE4i JvzhavAwiHE/1b0ABAABNJSSDn6/YXoVqwLyIuw/aqWBqRgXIMZtpPoLq1+ItwKP+QS9QEzoDSdA TBgSE+94GP9pnDJJsh2X+wkGCJoCgn4BCKChlIbwBNB/QmGE1QQ8tqCpx2oaLltwmUOkLDFcSpII HvOJCWH8oTfMAK6wIjLQMNVjNQHTEIKOQVaJSwuRthPjfjxuwOUFXL6AAIAAGjKpB2voEB9GuIzC JUukYoK2EOM2rDbiUYlVI/FWEDQfqzfR1BOjchgAXKFKZKDBpfAw8BuOxzEEI4LslEPQ+ySZjxUA BNCQSTp44gmXAqzxhN9APOYQr56g2/BHEh4u8VJ4ZAkaQqquYQyISQzExCYxIngsJd4xuNQTjFni paiSPAACcEvGSgCAIAjt/3+6Bpcu4em1FWOHKNAzX0c6AecztTIUYJdD5zB5m5Pizkodts8ibl02 24niP0DjndCY7MYhW8l0I/vjwbm4PxOkfmkhsATgpoxxAABhEPj/V9fVpHCwajcTWutBfCM60Qmn kaQqLkomW9wosHb8p1Ae95y9RryCGwFmpPdNleZOAY2VPVspa5aEUMH+49Pi3uVyddcRQCMi9YyC UTAKBhUACKDRcmcUjIJRQG8AEECj5c4oGAWjgN4AIIBGy51RMApGAb0BQACNljujYBSMAnoDgAAa LXdGwSgYBfQGAAE0Wu6MglEwCugNAAJoaJQ7eBZHDIh78ABcCzEGp1MH2gmDGjBgAPyK0RhYjcKl YDAAXOtxaGEXQAAN0iDABETGOtVNptBAYtZQ0do9uGwZtBlg8AAiaw78i+XwL9gbVABzMSGNLAII oMEbBGhgSJc7JNlCt3Q5mDPAIAFkxBrBrDuYg51ujXSAAOSaMQ7AMAgD//9quhLORzpWKluIQ2xA EUO+m4JhNr6Wf0UnjLtjADaMHb9SZRD2pfExT3d28gvJeLuptqz+0Pia7E1SZ/W5ZPyX+bfaxd1K HRJhUe+ihaHI2aR1wCOAhkyqwgwvrLH+HyPUsPofKwMrm6B2rE5F04XLtXicTZIC/I7EI0t8aIxM gCsqMdl48ioew/GYg8dw8pI0kUkXzSJizCHIwHQwQAANmYSFNbBwBTSuiEFTgFUvqYaT6lQ8JpPn HrL9SHbqHDmAjEihsNyBs6mepElKuiS5AZdiPJ4FCKAhk7ZIKnfw6MWfUEgqCMhzKkGTCbrnP0Y6 I2gUGRaNljv/yYpKguUOGeFPapL+TyiF4AJ4yg5cboArw6oAl9sAAmjIpC2s0Ym1xCU11+HSizVA cSUvPE4lxg0E3UPQaoJ+JLXAHS13/hNR22EmEiLLCDxsPFySkjQeZ2PKEnQG8XUYLichswECcFMF OQCAIKj/f5puzQmo61aemgHSZL2RrUUF2rr7qiOM1QouT3Hi0qprJkCt3/qvTcq3tJYwixF+L7nK eAUKiaNc9N1EyXJ5kDA+F7LOQwIMpU5zC6Dhn3poDeifA3HFPfFaqK5+FAwqQGQKoWcso9kFEECj yYsiMCD5k9blzmihM9QBMSmEzrGMZh1AAI2msCEJ8DTp8SimospRMMgBSSmEbo6BiwAE0MC7aRSM glEw0gBAAI2WO6NgFIwCegOAABotd0bBKBgF9AYAATRa7oyCUTAK6A0AAmi03BkFo2AU0BsABNBo uTMKRsEooDcACKDRcmcUjIJRQG8AEECj5c4oGAWjgN4AIIBGy51RMApGAb0BQACNljujYBSMAnoD gAAaLXdGwSgYBfQGAAE0Wu6MglEwCugNAAJotNwZBaNgFNAbAATQaLkzCkbBKKA3AAig0XJnFIyC UUBvABBAo+XOKBgFo4DeACCARsudUTAKRgG9AUAAjZY7o2AUjAJ6A4AAGi13RsEoGAX0BgABNFru jIJRMAroDQACaLTcGQWjYBTQGwAE0Gi5MwpGwSigNwAIoCFT7jDgAFQ0nCpGUQ6I9yCuMBk8fhnq YEgELwPqtZw0ch6pIYBfPUAADa4QxANomscGT2IiyYOj5Q6tweAPYTTH0MhtpIYAQfUAATRYgo8g wOrVQZUCqAJISkbDz/uDDeBJdYMk5OnjEgqTJWaIAQTQoAg7YgAx5Q4uD6NxsYQCEhfOxlO0ExTH E/QkxRlVyh1iPIIr3KiiF009HscT6SO6AVzuwRO/uBTjilms4vhDGzNIcZmGy3ZMB+APeVyOJ0Yx piCQARCAmTLYAQAEQWj//9PVWfHJVmt5VEJQ10c75nDOFIY705JyCWC5S5s3W1dOW1g1E2Zjwezl 8G0AS/GOo5cBIsGyBIeqn5QkI30ZcqpV94pz3DtLgO38EkCDKI7xA2KCCb8I1nDHxSZGJVWk8PsU b5AQHn3AysUjRVIgUMIlI1gGBBAM4f9ExDsx4U+MOeRJEcnFNApPUOAJMUzFmFqAXIAAGlzRjAeQ kQL+44gGzIDDE5F4DMEVkbjMJybO4GrQTCYvTPDYSIw3qSKLh4tf5WAAeMKWGDVkhD/xdmE1h1qR iMu1aCZgVYzLR8jiAAE0uKIZD8AfDbjUYI0V7AFBcbmDx3z8UvgtwuV3POLEKCDGm1SRJZJL0C8D AnDFL6YarPFLRvjjSidEWkGtSMSvi9Qow3QzQAANupjGBYgPFIK68EceqbGFy0lEWo3HtfgVE+MY kvRSEgh4ZInkEhOw9Ae4fIrHR/i1EzQZj2KsIYzHMZREIh5x8pIlmtUAATToYhoXICZQcAUQHlmC hmCVpTAFEBnB/wnFMZ64J9K1xPiLQr3EcPH4cWABVlfh8gKmLEEpTGOJUUySFHlRjF8cf5RhSmFa DRBAgy6mcQEG3ICgGjyyyFKYbKwiJNlOUIp4b2JqIUYlJVLEBwIevUSajCtABhbgD3ZMETy+Q5PF bzLB0GbAlrQwjSU+mnA5CY8DsPqXoIMhsgABmCODJABAEAT+/9V1axyVDW96KoYkYGPZ7ZieRzUk vJ4ZYXX1RFWlLDzQzwSkHa1pCMzk69Fhbhj1sbagL5lz4D1pSeQoHNSB2aSALhx+FboCaDBG9igY UWDQFjqjgEYAGN0AATQa36NgwACu+nAUDG8AjG6AABqN71EwYGC00BmZABjjAAE0GuWjYBSMAnoD gAAaLXdGwSgYBfQGAAE0Wu6MglEwCugNAAJotNwZBaNgFNAbAATQUCp30NYpDIgDKNE7LMdQGbCB gXYU1QA9kxxVApCejqTEtQABNGSSCAMRa64GOaCdm6lrMkmmMSCtXqOFYwYQUDfJ4deOubKODNPo kC+oFd0AATQ0kgim34Zi4h6W5Q6N3DAYAKllAUmmEZQiqZwiUhcVAYUWAQSgtspxAABB2P9frYOJ Qy+6GZ1MwEoLCn/UypgD+OnvYMwTMpgAJLvlBjiOnRkfRno2ubvY2XFvaEoxm0bqHg+z6Kk9XzKS XEJO3kDKSbeigJwjgJKXhiDDqSZmicOYZ7MF0KCIXYIATyjgieb/GPGBFqa4GFiVEaORSKcSdAaR VmBl4PI7kd4k6AyCviPoBQqDkf4AVxb6jzfQcKnEaj4eQYLRgeY2knQR4x1i3ExkzoKzAQJoEMUu HkBknJGaoNHDguhoY0ACyCLE+wI/G6vD8NhFfCCQ5E0i/YWpC9PxuJxKRjAOFCA1S+MSxGMyhdZR xZFkRzdmmsQa9RASIIAGaRyjATyeJD7LkaeeoCyaq4hMXiSVOwTtIsNTxGjEahcuQGocYdVCvHV0 AJgZCVN8mJU7cBFKohu/jRASIIAGPnaJBMRnWoIMWhRPBIskIr2Ah0uQgVZmUehNXKYR4zti3Em8 wwYKoGU/IpMQfkE8RS0uLpq9mLGDRwF5jsTjTlwOJtIcOBcgAHFkkANACMLA/79abwZsO3oxcmIJ W9vh/3Xvq2KF+UZfm/qpIrXsvO6zh2Qy9WvTBgQOoLz9zqDSPuRKlhJV8MM0tHldfCDNa1lp0iPD hHF0CMptdDhW7cZkegWUYWKvOQXQUCp3qALonGqHHxiu/iIeUB4CQygMaeRUgAAaMv6nFqBPlA+h hEUSGK7+IglQGAhDKAxp51SAABoyQUAVgKsdOwpGAZFgNAlRBQAE0GjwjYJRMAroDQACaLTcGQWj YBTQGwAE0Gi5MwpGwSigNwAIoNFyZxSMglFAbwAQQKPlzigYBaOA3gAggEbLnVEwCkYBvQFAAI2W O6NgFIwCegOAABotd0bBKBgF9AYAATRa7oyCUTAK6A0AAmi03BkFo2AU0BsABNBouTMKRsEooDcA CKDRcmcUjIJRQG8AEECj5c4oGAWjgN4AIIBGy51RMApGAb0BQACNljujYBSMAnoDgAAaLXdGwSgY BfQGAAE0Wu6MglEwCugNAAJotNwZBaNgFNAbAATQaLkzCkbBKKA3AAig0XJnFIyCUUBvABBAo+XO KBgFo4DeACCARsudUTAKRgG9AUAADb1yhwEVDLRzsAC6XdFFZDiQFFADEqSDMx7/47hFliTXDvK0 OlAAIICGUlhQngjoAOjjJJLCgXgnDUh4DsJIhANcSY6k8BycCXVgAUAADaWwwIy8QRij9Cx3iLR0 tNwhG2B1G/GpbjB7bWABQABqyiAHABCEYf9/tT5grOkJI+c6xyB8E0obIazFeKRO7E3CjWxOkh8F +VWa96fEw6NV/lqaB2WQkv2+quaqBWJak3l6mKM2U9ivK8AAO9EDbWmHvrwAAAAASUVORK5CYII= ------_=_NextPart_000_01BF9972.2968E130-- From owner-fwtk-users@ex.tis.com Wed Mar 29 08:44 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA04802 Wed, 29 Mar 2000 08:44:27 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA11340; Wed, 29 Mar 2000 05:49:44 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 29 Mar 2000 05:02:12 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA08006 for fwtk-users-outgoing; Wed, 29 Mar 2000 05:02:06 -0800 (PST) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC9AC@mailserver.isolaandisola.com> From: William Jackson To: "'fwtk-users@ex.tis.com'" Subject: nntp-gw Date: Wed, 29 Mar 2000 15:02:49 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 449 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have free agent pointing at my nntp gateway machine the nntp-gw machine is the set to go to the real nntp server the real server requires authorisation but when I run free agent it connects but complains about Mar 29 14:27:46 www1 nntp-gw[267]: unknown command: AUTHINFO USER xxx any ideas to work around this?? From owner-fwtk-users@ex.tis.com Wed Mar 29 12:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA05890 Wed, 29 Mar 2000 12:26:16 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA04231; Wed, 29 Mar 2000 09:31:04 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 29 Mar 2000 08:16:47 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA26031 for fwtk-users-outgoing; Wed, 29 Mar 2000 08:16:41 -0800 (PST) From: "Jennifer Tippens" To: Date: Wed, 29 Mar 2000 16:15:45 +0000 (GMT) Organization: Surfari.com X-Mailer: ObsidianSystems-OcsEmail1-0-32 brewed at www.obsidian.co.za Reply-To: jennifer@surfari.com Message-ID: <95434654522593-29101522593jennifer@surfari.com> Subject: ftp-gw Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1130 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I have a user who has a problem that I'm not sure is really a problem, but as I couldn't find anything in the documentation about it, I thought I'd ask you guys. The situation is this: He is trying to connect to another ftp server who is running some kind of firewalling software that requires incoming ftp connections to be in passive mode. My supervisor said that our firewall must be misconfigured (ack). How would my user use our ftp-gw to connect to the other site and initiate the ftp in passive mode? I thought that once he was connected, he could just issue a "passive" command but he does not like that answer (neither does my supervisor). Does the ftp-gw simply act as a pass-through (what I thought)? Should he issue a "ftp -p firewall-machine.int"? This seems to work for me. Any clarification anyone could give me would be greatly appreciated. I'm a bit confused as to what problem he was having and whether it is a problem *shrug* :} Thanks for the help, Jennifer From owner-fwtk-users@ex.tis.com Thu Mar 30 04:51 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA09490 Thu, 30 Mar 2000 04:51:36 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA03199; Thu, 30 Mar 2000 01:56:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 30 Mar 2000 01:00:22 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA27844 for fwtk-users-outgoing; Thu, 30 Mar 2000 01:00:16 -0800 (PST) X-Authentication-Warning: aeria.eic.at: nobody set sender to using -f Message-ID: <55B025.B66AF8CA@eic.at> Date: Sat, 07 Mar 1970 00:54:13 +0100 From: "Johann G. Hautzinger" Organization: Erste Bank AG X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.13 i686) X-Accept-Language: en MIME-Version: 1.0 To: TIS Mailing List Subject: [Fwd: smap is not work!] Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1226 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] username/password on the mailserver? access permissions on the mailserver? no pop on the mailserver? -------- Original Message -------- Subject: smap is not work! Date: Thu, 30 Mar 2000 15:19:39 +0800 From: gaohong To: trema@eic.at Hi Johann G.Hautzinger, I am a new user of the FWTK2.0,and I have a question for smap. I have three computers,one is a firewall(eth0:192.168.2.254,eth1:192.168.1.254, DNS), one is a server(eth0:192.168.2.3,mail server),one is a client(eth0:192.168.1.178). My DNS works well,and my mail server works well. My smap & smapd on firewall seem to be configured well, and I have two MX record in named.fw: IN MX 1 firewall.linux.fw.mycom. IN MX 10 mail.linux.fw.mycom. ON the client ,smtp server is :firewall.linux.fw.mycom But,when I send a mail from the client ,the error show:"netscape was unable to connect to the SMTP server.The server may be down or may be incorrectly configured." the firewall's log file (/var/log/messags) show:smap connect but acceptes QUIT ,and exit. What is a matter? Any ideas? Best gaohong From owner-fwtk-users@ex.tis.com Fri Mar 31 03:12 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA14846 Fri, 31 Mar 2000 03:12:28 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA06289; Fri, 31 Mar 2000 00:17:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 30 Mar 2000 22:53:29 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id WAA24832 for fwtk-users-outgoing; Thu, 30 Mar 2000 22:53:22 -0800 (PST) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC9B9@mailserver.isolaandisola.com> From: William Jackson To: "'fwtk-users@ex.tis.com'" Subject: squid-gw and http-gw Date: Fri, 31 Mar 2000 08:53:58 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2698 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] this is the story so far from what I can find out the squid-gw only lets you connect directly to another cache and the cache at my ISP is crap. so that and apart from the other problems I was having I left it and started to take a look at http-gw and now I have problems with that! my internal squid forwards all non-local traffic to the dmz http-gw by sniffing on the router I see tcp data go back and forth between the two so thats working I then sniffed the exterior router and there was no data going around so then I sniffed on the machine that hosts the http-gw and I only saw information from the internal squid Do you know why the http-gw is not forwarding the requests here are my configs and an example of what I mean: netperm: #rules for http-gw http-gw: userid httpgwuser http-gw: groupid httpgwgroup http-gw: directory /export/http-gw http-gw: timeout 960 http-gw: default-httpd www.gibnet.gi http-gw: permit-hosts 172.20.2.* inetd: http-gw stream tcp nowait.1000 root /usr/local/etc/http-gw http-gw data I get in /var/adm/messages after I try to connect: Mar 31 08:19:46 www1 http-gw[3556]: permit host=me.com/172.20.2.7 use of gateway (V2.1) Mar 31 08:19:46 www1 http-gw[3556]: log host=me.com/172.20.2.7 protocol=HTTP cmd=get de st=www.gibnet.gi path=/members/portfolio.html Mar 31 08:19:46 www1 http-gw[3556]: failed to connect to http server www.gibnet.gi (80) Mar 31 08:19:46 www1 http-gw[3556]: exit host=me.com/172.20.2.7 cmds=1 in=0 out=0 user= unauth duration=0 as it says above it cant connect and to dispell any DNS or access-list blunders: www1:/etc# telnet www.gibnet.gi 80 Trying 195.166.192.1... Connected to root.gibnet.gi. Escape character is '^]'. its got me stumped any ideas? thanks -----Original Message----- From: Eberhard Mattes [mailto:mattes@windhager.de] Sent: 30 March 2000 20:53 To: wj@isolaandisola.com Subject: Re: squid-gw > Hi I am trying to use the squid-gw in my dmz to relay all my internal cache > traffic outside What's your setup, exactly? squid-gw requires the cache to be outside or in the DMZ. > its working except that all my webpages dont have pictures or hyperlinks *your* webpages? Sample HREF attribute? > squid-gw: permit-hosts x.x.x.x You should use the IP addresses of your internal machines instead of "x.x.x.x". > squid-gw: deny-destinations *:*sex* -message "Naughty Naughty!" Well, essex.route66.com is not naughty... -- Eberhard Mattes From owner-fwtk-users@ex.tis.com Fri Mar 31 08:39 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA15669 Fri, 31 Mar 2000 08:39:38 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA03968; Fri, 31 Mar 2000 05:45:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 31 Mar 2000 04:51:15 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA28304 for fwtk-users-outgoing; Fri, 31 Mar 2000 04:51:09 -0800 (PST) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC9BF@mailserver.isolaandisola.com> From: William Jackson To: "'fwtk-users@ex.tis.com'" Subject: does anybody actually read this list? Date: Fri, 31 Mar 2000 14:52:03 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 187 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] as I got absolutely bombarded by replies to my last post! From owner-fwtk-users@ex.tis.com Fri Mar 31 15:48 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA17034 Fri, 31 Mar 2000 15:48:41 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA05382; Fri, 31 Mar 2000 12:54:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 31 Mar 2000 11:57:08 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA25872 for fwtk-users-outgoing; Fri, 31 Mar 2000 11:56:57 -0800 (PST) Date: Fri, 31 Mar 2000 14:56:02 -0500 From: Joseph S D Yao To: William Jackson Cc: "'fwtk-users@ex.tis.com'" Subject: Re: does anybody actually read this list? Message-Id: <20000331145602.B16509@washington.cospo.osis.gov> Mail-Followup-To: William Jackson , "'fwtk-users@ex.tis.com'" References: <51F024FC46C7D211880A00201888E0BA1AC9BF@mailserver.isolaandisola.com> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <51F024FC46C7D211880A00201888E0BA1AC9BF@mailserver.isolaandisola.com>; from wj@isolaandisola.com on Fri, Mar 31, 2000 at 02:52:03PM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 501 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Mar 31, 2000 at 02:52:03PM +0200, William Jackson wrote: > as I got absolutely bombarded by replies to my last post! Of course not. ;-? -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies.