From owner-fwtk-users@ex.tis.com Sun Apr 2 21:04 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA24378 Sun, 2 Apr 2000 21:04:08 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA26162; Sun, 2 Apr 2000 18:08:53 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 2 Apr 2000 16:44:33 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA23574 for fwtk-users-outgoing; Sun, 2 Apr 2000 16:44:23 -0700 (PDT) Message-ID: <38E7D945.1110ACE5@mts.co.uk> Date: Mon, 03 Apr 2000 00:35:33 +0100 From: Derek Smith Organization: Millennium Travel Systems Ltd. X-Mailer: Mozilla 4.61 [en] (Win98; I) X-Accept-Language: en MIME-Version: 1.0 To: Donald J Smith CC: fwtk-users@lists.nai.com Subject: Re: http-gw on redhat 6.1 - cgi problem References: <3.0.3.32.20000323101517.0070e474@mail.denver.gd-is.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 3357 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, Sorry about the delay, but I've been trrying all the suggestions from this group, plus a few experiments of my own... As requested here's the output from the script suggested: icmp_destunreach_rate: 100 icmp_echo_ignore_all: 0 icmp_echo_ignore_broadcasts: 0 icmp_echoreply_rate: 0 icmp_ignore_bogus_error_responses: 0 icmp_paramprob_rate: 100 icmp_timeexceed_rate: 100 igmp_max_memberships: 20 ip_always_defrag: 0 ip_autoconfig: 0 ip_default_ttl: 64 ip_dynaddr: 0 ip_forward: 0 ip_local_port_range: 1024 4999 ip_masq_debug: 0 ip_no_pmtu_disc: 0 ipfrag_high_thresh: 262144 ipfrag_low_thresh: 196608 ipfrag_time: 30 tcp_fin_timeout: 180 tcp_keepalive_probes: 9 tcp_keepalive_time: 7200 tcp_max_ka_probes: 5 tcp_max_syn_backlog: 128 tcp_retrans_collapse: 1 tcp_retries1: 7 tcp_retries2: 15 tcp_rfc1337: 0 tcp_sack: 1 tcp_stdurg: 0 tcp_syn_retries: 10 tcp_syncookies: 0 tcp_timestamps: 1 tcp_window_scaling: 1 I tried the same on the redhat 5 machine, but the output was so wildly different that I got no clues - I hope that this is informative. I've tried it with an etherlink Pro 100 and a 3com 3c509 with no difference between the two. Thanks, Derek Donald J Smith wrote: > At 11:10 AM 3/23/00 +0000, Derek Smith wrote: > >[To be removed from this list send the message "unsubscribe fwtk-users" in > the > >BODY of a mail message to majordomo@ex.tis.com.] > > > >Hi, > > > >I've been running tis on redhat 5 for about a year with no real > >problems. When I recently upgraded to 6.1 I found that the http-gw was > >having problems handling sites with cgi scripts, failing with a message > >to the user "connection reset by peer" although the amount of data > >passed as recorded in the logs was the same for both 5 and 6.1. > > > >The problem occurs whether the http-gw is run from inetd, or as a > >daemon. > How about something like a listing of you network configuration try > cd /proc/sys/net/ipv4 > > for i in `ls -1` > do > echo $i >> /tmp/netconfig.out > cat $i >> /tmp/netconfig.out > done > this should provide a better clue as to how your network is configured. > > > > >The same symptoms show with both Netscape and IE. > > > >I haven't been able to find any mention of this problem on redhat sites, > >or tis faq's, so any suggestions / comments would be very welcome. > > > >Thanks, > > > >Derek > > > > > ------------------------------------------------------------------------------ > Don Smith General Dynamics Information Systems > Systems Administrator 8005 South Chester St > EngleWood, Co. 80112 > Phone (303) 649-7554 > FAX (303) 649-7504 donald.j.smith@gd-is.com > Error msgs that I love: > "Keyboard not found press F1 to continue" (pc bios) > "Harddrive controller failure insert new disk and press any key to > continue" (pc bios) > "The disk is write protected Remove the write protect or > use another disk." (nt) > User must change his password before he logs in the first time. (nt) > ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Mon Apr 3 05:15 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA25869 Mon, 3 Apr 2000 05:15:03 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA13584; Mon, 3 Apr 2000 02:20:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 3 Apr 2000 01:24:41 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA09359 for fwtk-users-outgoing; Mon, 3 Apr 2000 01:24:25 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) MIME-Version: 1.0 In-Reply-To: <38E7D945.1110ACE5@mts.co.uk> Date: Mon, 03 Apr 2000 09:23:43 +0100 (BST) From: Tony Gale To: Derek Smith Subject: Re: http-gw on redhat 6.1 - cgi problem Cc: fwtk-users@lists.nai.com, Donald J Smith Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="_=XFMail.1.4.4.Linux:20000403092343:13773=_" Content-Length: 5504 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format --_=XFMail.1.4.4.Linux:20000403092343:13773=_ Content-Type: text/plain; charset=iso-8859-1 Did you try the patch that was sent to you that will solve this problem, which, incidentally, is included in the FAQ? I've included it again. -tony On 02-Apr-2000 Derek Smith wrote: > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi all, > > Sorry about the delay, but I've been trrying all the suggestions > from this group, > plus a few experiments of my own... > > As requested here's the output from the script suggested: > > icmp_destunreach_rate: 100 > icmp_echo_ignore_all: 0 > icmp_echo_ignore_broadcasts: 0 > icmp_echoreply_rate: 0 > icmp_ignore_bogus_error_responses: 0 > icmp_paramprob_rate: 100 > icmp_timeexceed_rate: 100 > igmp_max_memberships: 20 > ip_always_defrag: 0 > ip_autoconfig: 0 > ip_default_ttl: 64 > ip_dynaddr: 0 > ip_forward: 0 > ip_local_port_range: 1024 4999 > ip_masq_debug: 0 > ip_no_pmtu_disc: 0 > ipfrag_high_thresh: 262144 > ipfrag_low_thresh: 196608 > ipfrag_time: 30 > tcp_fin_timeout: 180 > tcp_keepalive_probes: 9 > tcp_keepalive_time: 7200 > tcp_max_ka_probes: 5 > tcp_max_syn_backlog: 128 > tcp_retrans_collapse: 1 > tcp_retries1: 7 > tcp_retries2: 15 > tcp_rfc1337: 0 > tcp_sack: 1 > tcp_stdurg: 0 > tcp_syn_retries: 10 > tcp_syncookies: 0 > tcp_timestamps: 1 > tcp_window_scaling: 1 > > I tried the same on the redhat 5 machine, but the output was so > wildly different > that I got no clues - I hope that this is informative. > > I've tried it with an etherlink Pro 100 and a 3com 3c509 with no > difference > between the two. > > Thanks, > Derek > > Donald J Smith wrote: > >> At 11:10 AM 3/23/00 +0000, Derek Smith wrote: >> >[To be removed from this list send the message "unsubscribe >> >fwtk-users" in >> the >> >BODY of a mail message to majordomo@ex.tis.com.] >> > >> >Hi, >> > >> >I've been running tis on redhat 5 for about a year with no real >> >problems. When I recently upgraded to 6.1 I found that the >> >http-gw was >> >having problems handling sites with cgi scripts, failing with a >> >message >> >to the user "connection reset by peer" although the amount of >> >data >> >passed as recorded in the logs was the same for both 5 and 6.1. >> > >> >The problem occurs whether the http-gw is run from inetd, or as a >> >daemon. >> How about something like a listing of you network configuration >> try >> cd /proc/sys/net/ipv4 >> >> for i in `ls -1` >> do >> echo $i >> /tmp/netconfig.out >> cat $i >> /tmp/netconfig.out >> done >> this should provide a better clue as to how your network is >> configured. >> >> > >> >The same symptoms show with both Netscape and IE. >> > >> >I haven't been able to find any mention of this problem on redhat >> >sites, >> >or tis faq's, so any suggestions / comments would be very >> >welcome. >> > >> >Thanks, >> > >> >Derek >> > >> > >> ------------------------------------------------------------------- >> ----------- >> Don Smith General Dynamics >> Information Systems >> Systems Administrator 8005 South Chester St >> EngleWood, Co. 80112 >> Phone (303) 649-7554 >> FAX (303) 649-7504 donald.j.smith@gd-is.com >> Error msgs that I love: >> "Keyboard not found press F1 to continue" (pc bios) >> "Harddrive controller failure insert new disk and press any key to >> continue" (pc bios) >> "The disk is write protected Remove the write protect or >> use another disk." (nt) >> User must change his password before he logs in the first time. >> (nt) >> ------------------------------------------------------------------- >> ----------- --- E-Mail: Tony Gale index, n.: Alphabetical list of words of no possible interest where an alphabetical list of subjects with references ought to be. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. --_=XFMail.1.4.4.Linux:20000403092343:13773=_ Content-Disposition: attachment; filename="fwtk-ns-post.patch" Content-Transfer-Encoding: base64 Content-Description: fwtk-ns-post.patch Content-Type: application/octet-stream; name=fwtk-ns-post.patch; SizeOnDisk=612 KioqIGh0dHAtZ3cuYy5vcmlnCVR1ZSBBdWcgMTcgMDk6NTQ6MDkgMTk5OQotLS0gaHR0cC1ndy5j CVR1ZSBBdWcgMTcgMDk6NDc6NDQgMTk5OQoqKioqKioqKioqKioqKioKKioqIDEzNjIsMTM2NyAq KioqCi0tLSAxMzYyLDEzODMgLS0tLQogIAkJCQl9ZWxzZQogIAkJCQkJYnJlYWs7CiAgCQkJfQor IAkJCS8qIENoZWNrIGlmIHRoZXJlIGlzIGEgQ1JMRiBsZWZ0IGluIHRoZSBidWZmZXIuCisgCQkJ ICogTmV0c2NhcGUgc2VuZHMgQ1JMRiBvbiB0aGUgZW5kIG9mIFBPU1QgY29tbWFuZHMuCisgCQkJ ICogVFJHIC0gMTk5OTA4MTcKKyAJCQkgKi8KKyAJCQl7CisgCQkJICBjaGFyIHN0clsyXTsKKyAJ CQkgIGludCBjb3VudDsKKyAJCQkgIGlmIChpb2N0bChyZmQsIEZJT05SRUFELCAmY291bnQpID09 IDApIHsKKyAJCQkJaWYgKGNvdW50ID09IDIpIHsKKyAJCQkJCWlmIChyZWN2KHJmZCwgc3RyLCAy LCBNU0dfUEVFSykgPT0gMikgeworIAkJCQkJCWlmICgoc3RyWzBdID09ICdccicpICYmIChzdHJb MV0gPT0gJ1xuJykpCisgCQkJCQkJCXJlYWQocmZkLCBzdHIsIDIpOworIAkJCQkJfQorIAkJCQl9 CisgCQkJICB9CisgCQkJfQogIAkJfQogIAkJcmV0dXJuIDA7CiAgCX0K --_=XFMail.1.4.4.Linux:20000403092343:13773=_-- End of MIME message From owner-fwtk-users@ex.tis.com Mon Apr 3 10:35 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA26924 Mon, 3 Apr 2000 10:35:22 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA10865; Mon, 3 Apr 2000 07:40:21 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 3 Apr 2000 06:41:54 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA01948 for fwtk-users-outgoing; Mon, 3 Apr 2000 06:41:49 -0700 (PDT) X-Authentication-Warning: gateway-intern.westcam.co.at: smap set sender to using -f Message-ID: <112B265D84D5D31191540050042BA66205FDD4@sqlserver.westcam.co.at> From: Stefan Jais To: "'fwtk-users@ex.tis.com'" Cc: Friedrich Neurauter Subject: http-form: Post-method Date: Mon, 3 Apr 2000 15:55:09 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="windows-1252" Content-Length: 564 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I have problems in submitting http-forms which use the "post" method through our tis-firewall. If I save the html-file, modify "post" to "get" and use this modified form, everything works fine. Any suggestions ? Thanks, Stefan Jais ___________________________________________ Stefan Jais, WESTCAM GmbH Eduard-Bodem-Gasse 5, A-6020 Innsbruck Tel: +43-512-364160-0, Fax: +43-512-364160-7 sj@westcam.co.at, http://www.westcam.at From owner-fwtk-users@ex.tis.com Mon Apr 3 10:49 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA26949 Mon, 3 Apr 2000 10:49:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA12574; Mon, 3 Apr 2000 07:54:38 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 3 Apr 2000 07:08:11 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA05183 for fwtk-users-outgoing; Mon, 3 Apr 2000 07:07:45 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.3.1 [p0] on FreeBSD X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: Date: Mon, 03 Apr 2000 10:10:00 +0200 (CEST) Organization: Ovita Nutricia Poland From: Mariusz Potocki To: dw@Netzstation.net Subject: RE: Problem with ICQ-ing Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-2 Content-Length: 1471 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 24-Mar-00 dw@Netzstation.net wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in > the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi @ll, > > I've got a problem with getting ICQ through our FWTK-Firewall. > > I installed udp-relay on our firewall and made the following configuration: > > > relay 192.168.0.* * 4000 icq.mirabilis.com 4000 any > relay 192.168.0.* * 4001 icq.mirabilis.com 4001 any > relay 192.168.0.* * 4002 icq.mirabilis.com 4002 any > relay 192.168.0.* * 4003 icq.mirabilis.com 4003 any > relay 192.168.0.* * 4004 icq.mirabilis.com 4004 any > relay 192.168.0.* * 4005 icq.mirabilis.com 4005 any > relay 192.168.0.* * 4006 icq.mirabilis.com 4006 any > relay icq.mirabilis.com * 4000 192.168.0.* 4000 any > relay icq.mirabilis.com * 4001 192.168.0.* 4001 any > relay icq.mirabilis.com * 4002 192.168.0.* 4002 any > relay icq.mirabilis.com * 4003 192.168.0.* 4003 any > relay icq.mirabilis.com * 4004 192.168.0.* 4004 any > relay icq.mirabilis.com * 4005 192.168.0.* 4005 any > relay icq.mirabilis.com * 4006 192.168.0.* 4006 any Try this one (works for me): relay 192.168.0.0 mask 255.255.255.0 * 4000 icq.mirabilis.com 4000 any -- Mariusz Potocki Microsoft: Where do you want to go today? Linux: Where do you want to go tomorrow? FreeBSD: Are you guys coming or what? From owner-fwtk-users@ex.tis.com Mon Apr 3 12:04 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA27269 Mon, 3 Apr 2000 12:04:39 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA25156; Mon, 3 Apr 2000 09:09:57 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 3 Apr 2000 08:15:57 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA15472 for fwtk-users-outgoing; Mon, 3 Apr 2000 08:15:51 -0700 (PDT) X-Authentication-Warning: gateway-intern.westcam.co.at: smap set sender to using -f Message-ID: <112B265D84D5D31191540050042BA66205FDD9@sqlserver.westcam.co.at> From: Stefan Jais To: "'fwtk-users@ex.tis.com'" Cc: Friedrich Neurauter Subject: RE: http-form: Post-method Date: Mon, 3 Apr 2000 17:28:28 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="windows-1252" Content-Length: 1080 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I did apply the patch for Netscape clients (Although I had the problem with Internet-Explorer) and everything worked fine Stefan > -----Original Message----- > From: Stefan Jais [mailto:sj@westcam.co.at] > Sent: Monday, April 03, 2000 3:55 PM > To: 'fwtk-users@ex.tis.com' > Cc: Friedrich Neurauter > Subject: http-form: Post-method > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > I have problems in submitting http-forms which use the "post" method > through our tis-firewall. > > If I save the html-file, modify "post" to "get" and use this modified > form, everything works fine. > > Any suggestions ? > > Thanks, > Stefan Jais > ___________________________________________ > Stefan Jais, WESTCAM GmbH > Eduard-Bodem-Gasse 5, A-6020 Innsbruck > Tel: +43-512-364160-0, Fax: +43-512-364160-7 > sj@westcam.co.at, http://www.westcam.at > From owner-fwtk-users@ex.tis.com Mon Apr 3 13:27 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA27808 Mon, 3 Apr 2000 13:27:51 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA07762; Mon, 3 Apr 2000 10:32:54 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 3 Apr 2000 09:41:02 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA00575 for fwtk-users-outgoing; Mon, 3 Apr 2000 09:40:45 -0700 (PDT) Message-ID: <38E8C831.76EE4E53@mts.co.uk> Date: Mon, 03 Apr 2000 17:34:58 +0100 From: Derek Smith Organization: Millennium Travel Systems Ltd. X-Mailer: Mozilla 4.61 [en] (Win98; I) X-Accept-Language: en MIME-Version: 1.0 To: Tony Gale CC: fwtk-users@lists.nai.com, Donald J Smith Subject: Re: http-gw on redhat 6.1 - cgi problem References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 5255 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, OK, "It's a fair cop" - I tried the patch on our 6.0 machine which was also exhibiting the same problems, but I hadn't tried it on the 6.1 machine which is our live system - I've now installed it on the live machine and sure enough it's working fine. Apologies for my density in this, and many thanks to Tony & Ko for beating me around the head with the answer until I gave it a proper try! Cheers everybody, Derek Tony Gale wrote: > Did you try the patch that was sent to you that will solve this > problem, which, incidentally, is included in the FAQ? I've included it > again. > > -tony > > On 02-Apr-2000 Derek Smith wrote: > > [To be removed from this list send the message "unsubscribe > > fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > Hi all, > > > > Sorry about the delay, but I've been trrying all the suggestions > > from this group, > > plus a few experiments of my own... > > > > As requested here's the output from the script suggested: > > > > icmp_destunreach_rate: 100 > > icmp_echo_ignore_all: 0 > > icmp_echo_ignore_broadcasts: 0 > > icmp_echoreply_rate: 0 > > icmp_ignore_bogus_error_responses: 0 > > icmp_paramprob_rate: 100 > > icmp_timeexceed_rate: 100 > > igmp_max_memberships: 20 > > ip_always_defrag: 0 > > ip_autoconfig: 0 > > ip_default_ttl: 64 > > ip_dynaddr: 0 > > ip_forward: 0 > > ip_local_port_range: 1024 4999 > > ip_masq_debug: 0 > > ip_no_pmtu_disc: 0 > > ipfrag_high_thresh: 262144 > > ipfrag_low_thresh: 196608 > > ipfrag_time: 30 > > tcp_fin_timeout: 180 > > tcp_keepalive_probes: 9 > > tcp_keepalive_time: 7200 > > tcp_max_ka_probes: 5 > > tcp_max_syn_backlog: 128 > > tcp_retrans_collapse: 1 > > tcp_retries1: 7 > > tcp_retries2: 15 > > tcp_rfc1337: 0 > > tcp_sack: 1 > > tcp_stdurg: 0 > > tcp_syn_retries: 10 > > tcp_syncookies: 0 > > tcp_timestamps: 1 > > tcp_window_scaling: 1 > > > > I tried the same on the redhat 5 machine, but the output was so > > wildly different > > that I got no clues - I hope that this is informative. > > > > I've tried it with an etherlink Pro 100 and a 3com 3c509 with no > > difference > > between the two. > > > > Thanks, > > Derek > > > > Donald J Smith wrote: > > > >> At 11:10 AM 3/23/00 +0000, Derek Smith wrote: > >> >[To be removed from this list send the message "unsubscribe > >> >fwtk-users" in > >> the > >> >BODY of a mail message to majordomo@ex.tis.com.] > >> > > >> >Hi, > >> > > >> >I've been running tis on redhat 5 for about a year with no real > >> >problems. When I recently upgraded to 6.1 I found that the > >> >http-gw was > >> >having problems handling sites with cgi scripts, failing with a > >> >message > >> >to the user "connection reset by peer" although the amount of > >> >data > >> >passed as recorded in the logs was the same for both 5 and 6.1. > >> > > >> >The problem occurs whether the http-gw is run from inetd, or as a > >> >daemon. > >> How about something like a listing of you network configuration > >> try > >> cd /proc/sys/net/ipv4 > >> > >> for i in `ls -1` > >> do > >> echo $i >> /tmp/netconfig.out > >> cat $i >> /tmp/netconfig.out > >> done > >> this should provide a better clue as to how your network is > >> configured. > >> > >> > > >> >The same symptoms show with both Netscape and IE. > >> > > >> >I haven't been able to find any mention of this problem on redhat > >> >sites, > >> >or tis faq's, so any suggestions / comments would be very > >> >welcome. > >> > > >> >Thanks, > >> > > >> >Derek > >> > > >> > > >> ------------------------------------------------------------------- > >> ----------- > >> Don Smith General Dynamics > >> Information Systems > >> Systems Administrator 8005 South Chester St > >> EngleWood, Co. 80112 > >> Phone (303) 649-7554 > >> FAX (303) 649-7504 donald.j.smith@gd-is.com > >> Error msgs that I love: > >> "Keyboard not found press F1 to continue" (pc bios) > >> "Harddrive controller failure insert new disk and press any key to > >> continue" (pc bios) > >> "The disk is write protected Remove the write protect or > >> use another disk." (nt) > >> User must change his password before he logs in the first time. > >> (nt) > >> ------------------------------------------------------------------- > >> ----------- > > --- > E-Mail: Tony Gale > index, n.: > Alphabetical list of words of no possible interest where an > alphabetical list of subjects with references ought to be. > > The views expressed above are entirely those of the writer > and do not represent the views, policy or understanding of > any other person or official body. > > ------------------------------------------------------------------------ > Name: fwtk-ns-post.patch > fwtk-ns-post.patch Type: unspecified type (application/octet-stream) > Encoding: base64 > Description: fwtk-ns-post.patch From owner-fwtk-users@ex.tis.com Mon Apr 3 18:47 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA29088 Mon, 3 Apr 2000 18:47:35 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA13206; Mon, 3 Apr 2000 15:52:49 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 3 Apr 2000 14:57:52 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA08813 for fwtk-users-outgoing; Mon, 3 Apr 2000 14:57:46 -0700 (PDT) Message-ID: <200004040303480650.00B4E749@mail.wol.net.pk> X-Mailer: Calypso Version 3.00.03.02 (3) Date: Tue, 04 Apr 2000 03:03:48 +0500 From: "usman qureshi" To: fwtk-users@lists.nai.com Subject: problem Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="=====_95479942841=_" Content-Length: 1088 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --=====_95479942841=_ Content-Type: text/plain; charset="us-ascii" hi.. I am using BSDI and having problem in compiling fwtk 2.1.. when i write make ...it says Makefile....line 16 need an operator. what does this mean ?????? help me plzzz --=====_95479942841=_ Content-Type: text/html; charset="us-ascii"
hi..
 
I am using BSDI and having problem in compiling fwtk 2.1..
when i write make ...it says
Makefile....line 16 need an operator.
 
what does this mean ??????
 
help me plzzz
--=====_95479942841=_-- From owner-fwtk-users@ex.tis.com Mon Apr 3 21:28 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA29701 Mon, 3 Apr 2000 21:28:22 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA22935; Mon, 3 Apr 2000 18:33:09 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 3 Apr 2000 17:15:51 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA18370 for fwtk-users-outgoing; Mon, 3 Apr 2000 17:15:40 -0700 (PDT) Message-Id: <4.3.1.2.20000403200550.00c39b40@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Mon, 03 Apr 2000 20:06:36 -0400 To: "usman qureshi" , fwtk-users@lists.nai.com From: Rick Murphy Subject: Re: problem In-Reply-To: <200004040303480650.00B4E749@mail.wol.net.pk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 526 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 03:03 AM 4/4/00 +0500, usman qureshi wrote: >hi.. > >I am using BSDI and having problem in compiling fwtk 2.1.. >when i write make ...it says >Makefile....line 16 need an operator. > >what does this mean ?????? use 'fixmake' to convert the makefiles to BSD format before you try to build. (Usually this question happens when someone tries to use fixmake on a non-BSD system). -Rick From owner-fwtk-users@ex.tis.com Tue Apr 4 03:14 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA00728 Tue, 4 Apr 2000 03:14:55 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA05423; Tue, 4 Apr 2000 00:20:03 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 3 Apr 2000 23:24:22 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id XAA01801 for fwtk-users-outgoing; Mon, 3 Apr 2000 23:24:16 -0700 (PDT) Message-ID: <38E98A11.42E79136@legend.com.cn> Date: Tue, 04 Apr 2000 14:22:10 +0800 From: gaohong X-Mailer: Mozilla 4.61 [en] (Win98; I) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: smap is not work! X-MIMETrack: Itemize by SMTP Server on BJ_MS1/Legend(Release 5.0.2a (Intl)|23 November 1999) at 2000-04-04 02:23:10 PM, Serialize by Router on BJ_MS1/Legend(Release 5.0.2a (Intl)|23 November 1999) at 2000-04-04 02:23:11 PM, Serialize complete at 2000-04-04 02:23:11 PM, Itemize by SMTP Server on BJ_IG1/Legend(Release 5.0.2a (Intl)|23 November 1999) at 2000-04-04 02:24:08 PM, Serialize by Router on BJ_IG1/Legend(Release 5.0.2a (Intl)|23 November 1999) at 2000-04-04 02:25:56 PM, Serialize complete at 2000-04-04 02:25:56 PM Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 997 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi list, i am a new user of the FWTK2.0,and I have a question for smap. i have three computers, one is a firewall(eth0:192.168.2.254,eth1:192.168.1.254, DNS), one is a server(eth0:192.168.2.3,mail server), one is a client(eth0:192.168.1.178). My DNS works well,and my mail server works well. My smap & smapd on firewall seem to be configured well, and I have two MX record in named.fw(/var/named): IN MX 1 firewall.linux.fw.mycom. IN MX 10 mail.linux.fw.mycom. ON the client ,smtp server is configured:firewall.linux.fw.mycom But,when I send a mail from the client ,the error show:"netscape was unable to connect to the SMTP server.The server may be down or may be incorrectly configured." the firewall's log file (/var/log/messags) show:smap connect but acceptes QUIT command ,and exit. What is a matter? Any ideas? Best gaohong From owner-fwtk-users@ex.tis.com Tue Apr 4 08:06 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA01993 Tue, 4 Apr 2000 08:06:02 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA23402; Tue, 4 Apr 2000 05:11:36 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 4 Apr 2000 04:17:42 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA20532 for fwtk-users-outgoing; Tue, 4 Apr 2000 04:17:37 -0700 (PDT) Message-ID: <38E9C151.FB994B54@danbbs.dk> Date: Tue, 04 Apr 2000 12:17:53 +0200 From: MONZ Reply-To: monz@danbbs.dk X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.5-15 i586) X-Accept-Language: da,sv,no,de MIME-Version: 1.0 To: fwtk-users Subject: VPN placement, ssh, dmz services Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1431 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Given a typical firewall setup like: ----firewall----dmz-----router-+-------internal servers | +-------adm/economy vpn +-------workstations Wouldn't it be safest to place vpn directly on the firewall, as shown? Vpn could be placed on the router, but if the vpn is compromized, access may be possible to the whole internal net, right? Now, if several depts. must be interconnectet through vpn, I guess more netcards can simply be added to the firewall, or another router can be added there, like: ----firewall----dmz | router-+--vpn +--vpn +--vpn Any experiences with vpn products that works well in a mixed Linux/NT server and Linux/windoze workstation environment are welcome. Ditto with making (different versions of) ssh work in above situations. One more thing: When several public services is placed on the dmz, it should suffice to split the dmz with a hub, or is a switch nessesary here? -- Mogens Valentin WWW: http://www.danbbs.dk/~monz/ mailto:monz@danbbs.dk Web, Programming, Network, Security - Installguides and docs for Linux.. Skaane/Sjaelland Linux User Group (5200++ members) - http://www.sslug.dk Use http://www.linux.org/ for freedom of choice with OpenSource software From owner-fwtk-users@ex.tis.com Tue Apr 4 14:39 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA03926 Tue, 4 Apr 2000 14:39:08 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA05079; Tue, 4 Apr 2000 11:44:29 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 4 Apr 2000 10:47:41 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA27962 for fwtk-users-outgoing; Tue, 4 Apr 2000 10:47:31 -0700 (PDT) Message-ID: <38EA2A31.C590CF1D@v-one.com> Date: Tue, 04 Apr 2000 13:45:21 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.72 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: monz@danbbs.dk CC: fwtk-users Subject: Re: VPN placement, ssh, dmz services References: <38E9C151.FB994B54@danbbs.dk> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1764 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] MONZ wrote: > > Given a typical firewall setup like: > > ----firewall----dmz-----router-+-------internal servers > | +-------adm/economy > vpn +-------workstations > > Wouldn't it be safest to place vpn directly on the firewall, as shown? Yes. That is one method of installation that we do with our VPN product (Gauntlet/Raptor/Progressive + SmartGate VPN = SmartFireWall). It usually works okay... just be wary of things such as CPU load and disk space for logging. > Vpn could be placed on the router, but if the vpn is compromized, access > may be possible to the whole internal net, right? Very true. I wouldn't recommend this at all. > Now, if several depts. must be interconnectet through vpn, I guess more > netcards can simply be added to the firewall, or another router can be > added there, like: > > ----firewall----dmz > | > router-+--vpn > +--vpn > +--vpn > > Any experiences with vpn products that works well in a mixed Linux/NT > server and Linux/windoze workstation environment are welcome. > Ditto with making (different versions of) ssh work in above situations. > > One more thing: When several public services is placed on the dmz, it > should suffice to split the dmz with a hub, or is a switch nessesary > here? Depends. If you have a fairly high amount of traffic on that net, a switch would be a better solution. However, note that sniffing traffic or intrusion detection systems won't work well on a switch. -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Tue Apr 4 17:02 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA04461 Tue, 4 Apr 2000 17:02:16 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA24368; Tue, 4 Apr 2000 14:07:54 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 4 Apr 2000 13:14:42 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA17539 for fwtk-users-outgoing; Tue, 4 Apr 2000 13:14:36 -0700 (PDT) Message-ID: <200004050120200040.0070B2F5@mail.wol.net.pk> X-Mailer: Calypso Version 3.00.03.02 (3) Date: Wed, 05 Apr 2000 01:20:20 +0500 From: "usman qureshi" To: fwtk-users@lists.nai.com Subject: transparent ftp Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="=====_95487962041=_" Content-Length: 1069 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --=====_95487962041=_ Content-Type: text/plain; charset="us-ascii" Hi... I am using BSDI and ip-filter 3.3.12 with FWTK2.1 to make transparent ftp. Have any one done it before ??? Any help regarding this ...Plzzz Regards, xcelent --=====_95487962041=_ Content-Type: text/html; charset="us-ascii"
Hi...
 
I am using BSDI and ip-filter 3.3.12 with FWTK2.1 to make transparent ftp.
Have any one done it before ???
 
Any help regarding this ...Plzzz
 
Regards,
xcelent
--=====_95487962041=_-- From owner-fwtk-users@ex.tis.com Tue Apr 4 17:31 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA04554 Tue, 4 Apr 2000 17:31:01 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA27989; Tue, 4 Apr 2000 14:36:38 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 4 Apr 2000 13:50:22 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA21230 for fwtk-users-outgoing; Tue, 4 Apr 2000 13:50:15 -0700 (PDT) Message-ID: <38EA4774.56958843@danbbs.dk> Date: Tue, 04 Apr 2000 21:50:12 +0200 From: MONZ Reply-To: monz@danbbs.dk X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.5-15 i586) X-Accept-Language: da,sv,no,de MIME-Version: 1.0 To: fwtk-users Subject: Re: VPN placement, ssh, dmz services References: <38E9C151.FB994B54@danbbs.dk> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1174 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] MONZ wrote: > > Given a typical firewall setup like: > > ----firewall----dmz-----router-+-------internal servers > | +-------adm/economy > vpn +-------workstations > > Wouldn't it be safest to place vpn directly on the firewall, as shown? Can't locate the source where I (at least) believe I saw the above setup. Further reading clearified that vpn is most often established as a pure software solution on the firewall using one and same internet connection. But does situations exist where one would choose a separate connection? I find it amazing that so few are working with vpn; by now I should've been corrected here, like on three other security/firewall maillist/newsgroups. -- Mogens Valentin WWW: http://www.danbbs.dk/~monz/ mailto:monz@danbbs.dk Web, Programming, Network, Security - Installguides and docs for Linux.. Skaane/Sjaelland Linux User Group (5200++ members) - http://www.sslug.dk Use http://www.linux.org/ for freedom of choice with OpenSource software From owner-fwtk-users@ex.tis.com Wed Apr 5 04:46 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA06808 Wed, 5 Apr 2000 04:46:38 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA01163; Wed, 5 Apr 2000 01:52:12 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 5 Apr 2000 00:28:16 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA26460 for fwtk-users-outgoing; Wed, 5 Apr 2000 00:28:05 -0700 (PDT) Message-ID: <38EADB3E.F46328B9@ordix.de> Date: Wed, 05 Apr 2000 08:20:46 +0200 From: Markus Schreier X-Mailer: Mozilla 4.61 [en] (WinNT; I) X-Accept-Language: en MIME-Version: 1.0 To: monz@danbbs.dk CC: fwtk-users Subject: Re: VPN placement, ssh, dmz services References: <38E9C151.FB994B54@danbbs.dk> <38EA4774.56958843@danbbs.dk> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1855 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, sorry, to understand this thread: SOme theoretical things about the questions: vpn is as fare as i know virtual private network. It is a possibility to connect some far away places through the internet by ip-tunneling. The IP-traffic is cipherd and packed into other ip-packets. Being at the destination place the original data is decoded. If i understand you correctly, the question is, where to encode / decode the packets? If this is misleading, please correct me. Markus MONZ wrote: > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > MONZ wrote: > > > > Given a typical firewall setup like: > > > > ----firewall----dmz-----router-+-------internal servers > > | +-------adm/economy > > vpn +-------workstations > > > > Wouldn't it be safest to place vpn directly on the firewall, as shown? > > Can't locate the source where I (at least) believe I saw the above > setup. > Further reading clearified that vpn is most often established as a pure > software solution on the firewall using one and same internet > connection. > But does situations exist where one would choose a separate connection? > > I find it amazing that so few are working with vpn; by now I should've > been corrected here, like on three other security/firewall > maillist/newsgroups. > -- > Mogens Valentin WWW: http://www.danbbs.dk/~monz/ mailto:monz@danbbs.dk > Web, Programming, Network, Security - Installguides and docs for Linux.. > Skaane/Sjaelland Linux User Group (5200++ members) - http://www.sslug.dk > Use http://www.linux.org/ for freedom of choice with OpenSource software From owner-fwtk-users@ex.tis.com Wed Apr 5 09:39 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA08321 Wed, 5 Apr 2000 09:39:34 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA21830; Wed, 5 Apr 2000 06:45:12 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 5 Apr 2000 05:48:44 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA14394 for fwtk-users-outgoing; Wed, 5 Apr 2000 05:48:28 -0700 (PDT) Message-ID: <38EADF95.509DE62C@intstar.com> Date: Wed, 05 Apr 2000 07:39:18 +0100 From: Gareth Bromley X-Mailer: Mozilla 4.7 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users Subject: Re: VPN placement, ssh, dmz services References: <38E9C151.FB994B54@danbbs.dk> <38EA2A31.C590CF1D@v-one.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1529 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Keith Young wrote: > > Given a typical firewall setup like: > > > > ----firewall----dmz-----router-+-------internal servers > > | +-------adm/economy > > vpn +-------workstations > > > > Wouldn't it be safest to place vpn directly on the firewall, as shown? > > Vpn could be placed on the router, but if the vpn is compromized, access > > may be possible to the whole internal net, right? > Very true. I wouldn't recommend this at all. I find it quite strange that the firewall administrator doesn't have direct control of the external router to implement initial network filtering (Increase security, reduce traffic hitting the firewall). e.g. Ext network----Ext Router----firewall----dmz----Internal Router----..... In the above case using an external router, this could be used as the VPN end point, as with have done over a number of technologies. A caveat however, the router vendors have been quite slow deploying fully IPSEC compliant solutions, and in some cases require a mix of part IPSEC + proprietary to make VPNs (This normally makes these solutions less friendly ;) ) It really depends on the type of client connecting I guess, remote site or remote user. I like Keiths SmartGate for users (especially with SmartCards), external router based solution for sites. Horses for courses I guess, Just my 2p worth, --Gareth From owner-fwtk-users@ex.tis.com Wed Apr 5 12:08 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA08938 Wed, 5 Apr 2000 12:08:11 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA12816; Wed, 5 Apr 2000 09:13:45 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 5 Apr 2000 08:20:48 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA05293 for fwtk-users-outgoing; Wed, 5 Apr 2000 08:20:42 -0700 (PDT) Message-ID: <38EB58EB.79EB9B2F@yahoo.com> Date: Wed, 05 Apr 2000 20:46:59 +0530 From: Naresh Narang X-Mailer: Mozilla 4.61 [en] (Win95; I) X-Accept-Language: en MIME-Version: 1.0 To: "fwtk-users@ex.tis.com" Subject: CROND Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 224 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello Please tell me how safe it is to run CROND on the firewall machine. Thanks N.K.Narang From owner-fwtk-users@ex.tis.com Wed Apr 5 13:28 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA09260 Wed, 5 Apr 2000 13:28:15 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA24304; Wed, 5 Apr 2000 10:33:49 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 5 Apr 2000 09:42:41 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA16472 for fwtk-users-outgoing; Wed, 5 Apr 2000 09:42:30 -0700 (PDT) Message-ID: <38EB5EF7.83DF9066@danbbs.dk> Date: Wed, 05 Apr 2000 17:42:47 +0200 From: MONZ Reply-To: monz@danbbs.dk X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.5-15 i586) X-Accept-Language: da,sv,no,de MIME-Version: 1.0 To: fwtk-users Subject: Re: VPN placement, ssh, dmz services References: <38E9C151.FB994B54@danbbs.dk> <38EA2A31.C590CF1D@v-one.com> <38EADF95.509DE62C@intstar.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2504 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Gareth Bromley wrote: > Keith Young wrote: > > > > Given a typical firewall setup like: > > > > > > ----firewall----dmz-----router-+-------internal servers > > > | +-------adm/economy > > > vpn +-------workstations > > > > > > Wouldn't it be safest to place vpn directly on the firewall, as > > > shown? > > > Vpn could be placed on the router, but if the vpn is compromized, > > > access may be possible to the whole internal net, right? > > Very true. I wouldn't recommend this at all. > > I find it quite strange that the firewall administrator doesn't have > direct control of the external router to implement initial network > filtering (Increase security, reduce traffic hitting the firewall). e.g. > > Ext network----Ext Router----firewall----dmz----Internal Router----..... > > In the above case using an external router, this could be used as the VPN > end point, as with have done over a number of technologies. A caveat > however, the router vendors have been quite slow deploying fully IPSEC > compliant solutions, and in some cases require a mix of part IPSEC + > proprietary to make VPNs (This normally makes these solutions less > friendly ;) ) > > It really depends on the type of client connecting I guess, remote site > or remote user. I like Keiths SmartGate for users (especially with > SmartCards), external router based solution for sites. You're right. The institution for whom I'm looking at this, does have a Cisco1600 as frontend, but it's been set up by the ISP who still controls it, and no info is available. They are somewhat dissatified with the ISP and are shopping for another ;- I'll have to find out more about the Cisco. The problem is that possibly several institutions will be linked on a vpn, but may choose different external routers and firewalls. Fortunately, some of them are not yet on the internet, so I'm hoping to lay out a uniform structure the rest will adhere to. Which relates to your remark on friendliness... Links to relevant info are more than welcome. -- Mogens Valentin WWW: http://www.danbbs.dk/~monz/ mailto:monz@danbbs.dk Web, Programming, Network, Security - Installguides and docs for Linux.. Skaane/Sjaelland Linux User Group (5200++ members) - http://www.sslug.dk Use http://www.linux.org/ for freedom of choice with OpenSource software From owner-fwtk-users@ex.tis.com Wed Apr 5 13:28 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA09259 Wed, 5 Apr 2000 13:28:15 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA24300; Wed, 5 Apr 2000 10:33:49 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 5 Apr 2000 09:42:36 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA16471 for fwtk-users-outgoing; Wed, 5 Apr 2000 09:42:29 -0700 (PDT) Message-ID: <38EB5EF6.D1086C1@danbbs.dk> Date: Wed, 05 Apr 2000 17:42:46 +0200 From: MONZ Reply-To: monz@danbbs.dk X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.5-15 i586) X-Accept-Language: da,sv,no,de MIME-Version: 1.0 To: fwtk-users Subject: Re: VPN placement, ssh, dmz services References: <38E9C151.FB994B54@danbbs.dk> <38EA4774.56958843@danbbs.dk> <38EADB3E.F46328B9@ordix.de> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1553 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Markus Schreier wrote: > sorry, to understand this thread: > SOme theoretical things about the questions: > vpn is as fare as i know virtual private network. > It is a possibility to connect some far away places through the internet > by ip-tunneling. > The IP-traffic is cipherd and packed into other ip-packets. Being at the > destination place the original data is decoded. > If i understand you correctly, the question is, where to encode / decode > the packets? > If this is misleading, please correct me. It's not. If you saw my second selvcorrecting posting, you'd see I found out I initially had an abnormal view on vpn :- I thought vpn was always setup on a separate internet connection, which is clearly not the case. What can I say? Vpn is new to me... I need to have another topic clarified: What's the security difference between a multi-nic'ed firewall/router and a firewall-dmz-router solution? Of course the router can do nat, thus providing an extra layer of security, but so can the firewall/router, though I understand that a compromized firewall/router may give more direct access to the internal network. -- Mogens Valentin WWW: http://www.danbbs.dk/~monz/ mailto:monz@danbbs.dk Web, Programming, Network, Security - Installguides and docs for Linux.. Skaane/Sjaelland Linux User Group (5200++ members) - http://www.sslug.dk Use http://www.linux.org/ for freedom of choice with OpenSource software From owner-fwtk-users@ex.tis.com Wed Apr 5 23:57 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA11949 Wed, 5 Apr 2000 23:57:45 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id VAA12533; Wed, 5 Apr 2000 21:03:04 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 5 Apr 2000 20:05:50 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id UAA10501 for fwtk-users-outgoing; Wed, 5 Apr 2000 20:05:39 -0700 (PDT) Message-Id: <4.3.1.2.20000405230012.00bff960@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Wed, 05 Apr 2000 23:04:50 -0400 To: Naresh Narang , "fwtk-users@ex.tis.com" From: Rick Murphy Subject: Re: CROND In-Reply-To: <38EB58EB.79EB9B2F@yahoo.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 456 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 08:46 PM 4/5/00 +0530, Naresh Narang wrote: >Please tell me how safe it is to run CROND on the firewall machine. cron on it's own isn't a big problem. Check what the cron jobs run to make sure they don't open any vulnerabilities; have no user accounts on the firewall that can add their own bad cron jobs. -Rick From owner-fwtk-users@ex.tis.com Thu Apr 6 04:16 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA12794 Thu, 6 Apr 2000 04:16:28 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA22203; Thu, 6 Apr 2000 01:21:56 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 00:27:29 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA19088 for fwtk-users-outgoing; Thu, 6 Apr 2000 00:27:23 -0700 (PDT) Message-Id: <200004060723.PAA05310@servertwo.qdhaixin.com.cn> X-Authentication-Warning: servertwo.qdhaixin.com.cn: nobody set sender to using -f Date: Thu, 6 Apr 2000 15:28:48 +0800 From: wen Reply-To: wen@hisense.qd.sd.cn To: "fwtk-users@lists.nai.com" Subject: read ftp-gw source code X-mailer: FoxMail 3.0 beta 2 [cn] Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 332 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hello all: now I am reading ftp-gw source code. please help me or give some advice. I confused when and where do "rladdr" and "riaddr" get their value? thanks in advance. wen wen@hisense.qd.sd.cn From owner-fwtk-users@ex.tis.com Thu Apr 6 08:46 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA13766 Thu, 6 Apr 2000 08:46:51 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA07631; Thu, 6 Apr 2000 05:52:08 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 04:32:23 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA01395 for fwtk-users-outgoing; Thu, 6 Apr 2000 04:32:17 -0700 (PDT) Message-Id: <4.3.2.20000406072637.00ae5100@shadow> X-Sender: (Unverified) X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Thu, 06 Apr 2000 07:31:58 -0400 To: fwtk-users@tis.com From: Jon Earle Subject: Problem with accessing one ftp site through http-gw Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 834 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I've a fwtk2.1 box, patched with ipbind 1.2, and the relevant patches for http-gw from the fwtk.org site. I even patched it with the old (but still useful) ftp continuation line patch, which is no longer on the main fwtk patch list. If I try to access ftp.novatel.com, I get Error 501. The site works fine if I ftp to it through ftp-gw, but fails through http-gw. Other ftp sites work properly through http-gw. The site works properly without an http-gw proxy in the way. I've confirmed this at three different locations, one running an older version of ipbind, one running the current, and one not running it at all. All have the other http-gw patches. Any thoughts? Cheers! Jon From owner-fwtk-users@ex.tis.com Thu Apr 6 08:47 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA13770 Thu, 6 Apr 2000 08:47:01 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA07641; Thu, 6 Apr 2000 05:52:11 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 04:37:03 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA01618 for fwtk-users-outgoing; Thu, 6 Apr 2000 04:36:52 -0700 (PDT) From: ark@eltex.ru Date: Thu, 6 Apr 2000 15:31:57 +0400 Message-Id: <200004061131.PAA31543@paranoid.eltex.spb.ru> In-Reply-To: <200004060723.PAA05310@servertwo.qdhaixin.com.cn> from "wen " Organization: "Klingon Imperial Intelligence Service" Subject: Re: read ftp-gw source code To: wen@hisense.qd.sd.cn Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1064 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, The same way other fwtk proxies do, calling peername() function from libfwall.a wen said : > now I am reading ftp-gw source code. please help me or give some advice. > > I confused when and where do "rladdr" and "riaddr" get their value? > > thanks in advance. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOOx1q6H/mIJW9LeBAQGqKwP/a7K9YaGUKoRfS6VT92cttvuNLvt+WeQw FActPqQt+RFWYpCQlEd5AWwvoEE05aeGBE5+RZisAoiEtFjyeBcoaYUfklbuO1/F lA3qb2wmxlI22qCl2FYpoaZUSgKez8GhJqgim2X8Hv20tbnjFDfjuE63bzxm6JPX d/aZAkR5sGQ= =S8k/ -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Thu Apr 6 08:55 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA13778 Thu, 6 Apr 2000 08:55:50 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA08595; Thu, 6 Apr 2000 06:01:09 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 05:16:58 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA04390 for fwtk-users-outgoing; Thu, 6 Apr 2000 05:16:42 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) MIME-Version: 1.0 In-Reply-To: <4.3.2.20000406072637.00ae5100@shadow> Date: Thu, 06 Apr 2000 13:11:53 +0100 (BST) From: Tony Gale To: Jon Earle Subject: RE: Problem with accessing one ftp site through http-gw Cc: avenger@erols.com, fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="_=XFMail.1.4.4.Linux:20000406131153:1886=_" Content-Length: 2786 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format --_=XFMail.1.4.4.Linux:20000406131153:1886=_ Content-Type: text/plain; charset=iso-8859-1 Apply the enclosed patch. (avenger, would you *please* add this to the web site). -tony On 06-Apr-2000 Jon Earle wrote: > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello, > > I've a fwtk2.1 box, patched with ipbind 1.2, and the relevant > patches for > http-gw from the fwtk.org site. I even patched it with the old > (but still > useful) ftp continuation line patch, which is no longer on the main > fwtk > patch list. > > If I try to access ftp.novatel.com, I get Error 501. The site works > fine if > I ftp to it through ftp-gw, but fails through http-gw. Other ftp > sites > work properly through http-gw. The site works properly without an > http-gw > proxy in the way. I've confirmed this at three different > locations, one > running an older version of ipbind, one running the current, and > one not > running it at all. All have the other http-gw patches. > > Any thoughts? > > Cheers! > Jon --- E-Mail: Tony Gale Harrison's Postulate: For every action, there is an equal and opposite criticism. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. --_=XFMail.1.4.4.Linux:20000406131153:1886=_ Content-Disposition: attachment; filename="fwtk-broken-ftp-svr.patch" Content-Transfer-Encoding: base64 Content-Description: fwtk-broken-ftp-svr.patch Content-Type: application/octet-stream; name=fwtk-broken-ftp-svr.patch; SizeOnDisk=646 KioqIGZ3dGsvaHR0cC1ndy9obWFpbi5jLmRpc3QJTW9uIEZlYiAyOCAxNDoyMzoxOCAyMDAwCi0t LSBmd3RrL2h0dHAtZ3cvaG1haW4uYwlNb24gRmViIDI4IDE0OjI4OjI2IDIwMDAKKioqKioqKioq KioqKioqCioqKiA5NDUsOTUzICoqKioKICBjaGFyCSpzOwogIGludAluOwogIHsKISAJaWYobmV0 X3dyaXRlKGZkLHMsbikgIT0gbikKICAJCXJldHVybigxKTsKISAJcmV0dXJuKG5ldF93cml0ZShm ZCwiXHJcbiIsMikgIT0gMik7CiAgfQogIAogIAotLS0gOTQ1LDk2NSAtLS0tCiAgY2hhcgkqczsK ICBpbnQJbjsKICB7CiEgCWNoYXIgKmJ1ZmY7CiEgCWludCByZXR2YWw7CiEgCiEgCS8qIFNvbWUg RlRQIHNlcnZlcnMgZG9uJ3QgbGlrZSByZWNlaXZpbmcgY29tbWFuZHMKISAJICogc3BsaXQgb3Zl ciBtdWx0aXBsZSBwYWNrZXRzLgohIAkgKiBUUkcgLSAyMDAwMDIyOAohIAkgKi8KISAJaWYgKCAo YnVmZiA9IG1hbGxvYyhuKzIpKSA9PSBOVUxMKQogIAkJcmV0dXJuKDEpOwohIAltZW1jcHkoYnVm Ziwgcywgbik7CiEgCWJ1ZmZbbl09J1xyJzsKISAJYnVmZltuKzFdPSdcbic7CiEgCXJldHZhbCA9 IG5ldF93cml0ZShmZCxidWZmLG4rMik7CiEgCWZyZWUoYnVmZik7CiEgCXJldHVybihyZXR2YWwg IT0gbisyKTsKICB9CiAgCiAgCg== --_=XFMail.1.4.4.Linux:20000406131153:1886=_-- End of MIME message From owner-fwtk-users@ex.tis.com Thu Apr 6 09:59 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA14146 Thu, 6 Apr 2000 09:59:56 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA18240; Thu, 6 Apr 2000 07:04:48 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 06:15:55 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA10320 for fwtk-users-outgoing; Thu, 6 Apr 2000 06:15:49 -0700 (PDT) Message-ID: <20000405150001.19207.qmail@web1902.mail.yahoo.com> Date: Wed, 5 Apr 2000 08:00:00 -0700 (PDT) From: Rich Wilson Subject: Outlook client reaching Exchange server To: fwtk-users@lists.nai.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1042 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have an internal Exchange Server which users are trying to reach with Outlook client. I'm plugging port 135 (rpc) which Outlook uses. On the proxy (using iptrace, it's an AIX box) I can see traffic between both the user Outlook client, and the proxy, and also the proxy and the Exchange server. It seems to set up a connection just fine, and then one side seems to drop it. I suspect the problem is that the client/server addresses are imbeded in the data, which of course plug doesn't look at, and that's being used for authentication. Can anyone confirm this? Anyone know of an intelligent proxy for Exchange data? Anyone got a million bucks they want to give away? ===== : __o "Live simply, that others may simply live." : -\<, -Mohandis Gandhi : 0/ 0 __________________________________________________ Do You Yahoo!? Talk to your friends online with Yahoo! Messenger. http://im.yahoo.com From owner-fwtk-users@ex.tis.com Thu Apr 6 09:59 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA14150 Thu, 6 Apr 2000 09:59:58 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA18234; Thu, 6 Apr 2000 07:04:47 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 06:13:54 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA10035 for fwtk-users-outgoing; Thu, 6 Apr 2000 06:13:48 -0700 (PDT) Message-ID: <38EC221F.42A2B1E1@air.org.in> Date: Thu, 06 Apr 2000 11:05:27 +0530 From: Naresh Narang X-Mailer: Mozilla 4.7 [en] (Win95; I) X-Accept-Language: en MIME-Version: 1.0 To: "fwtk-users@ex.tis.com" Subject: Mail problem Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1052 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello Smap is working perfectly all right and the mail is delivered to Internal and external sites and it has been working for last about 2 months. Now the problem is that recently the mail to any username@yahoo.com is not being delivered. smapd hands over the mail to sendmail and ps shows: mx2.mail.yahoo.com. : user open and it stays that way for long time. In the maillog it shows: stat=Deferred: Connection reset by mx2.mail.yahoo.com. OR timeout waiting for input from mx2.mail.yahoo.com. during client greeting Now these deferred mails (all destined for yahoo.com) are being collected in the mailq and since sendmail runs only via smapd; I have to run sendmail -q from cron. But still the problem remains. Not being able to send mail to any user @yahoo.com. DNS is working all right and mail to all other sites can be sent without any problem. Could anyone please tell me what I should do? N.K.Narang From owner-fwtk-users@ex.tis.com Thu Apr 6 10:00 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA14153 Thu, 6 Apr 2000 10:00:00 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA18244; Thu, 6 Apr 2000 07:04:49 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 06:12:53 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA09931 for fwtk-users-outgoing; Thu, 6 Apr 2000 06:12:47 -0700 (PDT) Message-ID: <38ECC240.7E278C26@peers.za.net> Date: Thu, 06 Apr 2000 18:58:40 +0200 From: Jonathan Peers Reply-To: jonathan@peers.za.net Organization: Private X-Mailer: Mozilla 4.61 [en] (X11; I; Linux 2.2.10 i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@tis.com, fwtk-support@tis.com Subject: Can you please help Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="------------0BB05B64C96DC9B2B859BA8D" Content-Length: 6181 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. --------------0BB05B64C96DC9B2B859BA8D Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit I type make and it comes back with the below ..... I have att my Makefile.config Thank you jonathan make[1]: Entering directory `/home/jonathanp/fwtk/smapd' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jonathanp/fwtk/smapd' all: /home/jonathanp/fwtk/netacl make[1]: Entering directory `/home/jonathanp/fwtk/netacl' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jonathanp/fwtk/netacl' all: /home/jonathanp/fwtk/plug-gw make[1]: Entering directory `/home/jonathanp/fwtk/plug-gw' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jonathanp/fwtk/plug-gw' all: /home/jonathanp/fwtk/ftp-gw make[1]: Entering directory `/home/jonathanp/fwtk/ftp-gw' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jonathanp/fwtk/ftp-gw' all: /home/jonathanp/fwtk/tn-gw make[1]: Entering directory `/home/jonathanp/fwtk/tn-gw' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jonathanp/fwtk/tn-gw' all: /home/jonathanp/fwtk/rlogin-gw make[1]: Entering directory `/home/jonathanp/fwtk/rlogin-gw' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jonathanp/fwtk/rlogin-gw' all: /home/jonathanp/fwtk/http-gw make[1]: Entering directory `/home/jonathanp/fwtk/http-gw' make[1]: Nothing to be done for `all'. make[1]: Leaving directory `/home/jonathanp/fwtk/http-gw' all: /home/jonathanp/fwtk/x-gw make[1]: Entering directory `/home/jonathanp/fwtk/x-gw' cc -I.. -g -DLINUX -I/usr/X11/include -c dialog.c -o dialog.o In file included from dialog.c:12: ulib.h:26: X11/Intrinsic.h: No such file or directory dialog.c:14: X11/Xlib.h: No such file or directory dialog.c:15: X11/Xatom.h: No such file or directory dialog.c:16: X11/StringDefs.h: No such file or directory dialog.c:19: X11/Xaw/Cardinals.h: No such file or directory dialog.c:20: X11/Xaw/Paned.h: No such file or directory dialog.c:21: X11/Xaw/Label.h: No such file or directory dialog.c:22: X11/Xaw/Box.h: No such file or directory dialog.c:23: X11/Xaw/Command.h: No such file or directory make[1]: *** [dialog.o] Error 1 make[1]: Leaving directory `/home/jonathanp/fwtk/x-gw' make: *** [all] Error 2 root@beta:/home/jonathanp/fwtk > -- Definition of Windows 95 : A 32 bit GUI, running on a 16 bit shell, running ontop of an 8 bit OS, running on a 4 bit CPU, written by 2 bit Company, who can't stand 1 bit competition. -- Definition of Windows 95 : A 32 bit GUI, running on a 16 bit shell, running ontop of an 8 bit OS, running on a 4 bit CPU, written by 2 bit Company, who can't stand 1 bit competition. --------------0BB05B64C96DC9B2B859BA8D Content-Type: text/plain; charset=us-ascii; name="Makefile.config" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="Makefile.config" # # Copyright (c) 1993, Trusted Information Systems, Incorporated # All rights reserved. # # Redistribution and use are governed by the terms detailed in the # license document ("LICENSE") included with the toolkit. # # # Author: Marcus J. Ranum, Trusted Information Systems, Inc. # # RcsId: "$Header: /home/rmurphy/fwtk/fwtk/RCS/Makefile.config.linux,v 1.2 1998/01/13 23:50:46 rmurphy Exp $" # Your C compiler (eg, "cc" or "gcc") CC= cc # program to use for installation -- this may or may not preserve # old versions (or whatever). assumes that it takes parameters: # copy source dest CP= cp # Defines for your operating system # DEFINES=-DLINUX #DEFINES=-DSYSV -DSOLARIS # Options for your compiler (eg, "-g" for debugging, "-O" for # optimizing, or "-g -O" for both under GCC) #COPT= -g -traditional $(DEFINES) COPT= -g $(DEFINES) #COPT= -O $(DEFINES) # Version of "make" you want to use #MAKE= gnumake MAKE= make # Your ranlib utility (use "touch" if you don't have ranlib) RANLIB= ranlib #RANLIB= touch # Destination directory for installation of binaries DEST= /usr/local/etc # Destination directory for installation of man pages #DESTMAN= $(DEST)/../man # Names of any auxiliary libraries your system may require (e.g., -lsocket) # If you want to link against a resolver library, specify it here. AUXLIB= #AUXLIB= -lsocket # Some versions of Linux have broken the crypt() function out into a # separate library - uncomment the following line if authsrv fails to build. AUXLIB= -lcrypt # For Solaris: #AUXLIB= -lresolv -lsocket -lnsl # DBM library should be specified if it is an external library or # you with to use a different one than what is included in libc #DBMLIB= -lndbm # for Linux: DBMLIB=-lgdbm # "Linux" is such a ephemeral concept. Unfortunately, one of the # significant incompatibilities between distributions and versions # is where the DBM libraries end up. "-ldbm", "-ldb", or "-lgdbm" could # work for you. "-lgdbm" works for me (Slackware Linux 2.3). # for BSD: #DBMLIB= # Flags to pass to the linker (eg, -static for static binaries under GCC, # or -Bstatic for static binaries under SunOS 4.1.x) #LDFL= -Bstatic #LDFL= LDFL= -g -static # Flags for X gateway link - usually the same as LDFL XLDFL=-g # Location of the fwtk sources [For #include by any external tools needing it] FWTKSRCDIR=/u/b/mjr/firewall/fwtk #FWTKSRCDIR=/usr/local/src/fwtk # Location of X libraries for X-gw XLIBDIR=/usr/X11/lib #XLIBDIR=/usr/local/X11R5/lib # X Libraries # For BSD: #XLIBS= -L$(XLIBDIR) -lXaw -lXmu -lXt -lXext -lX11 -lSM -lICE -lipc #XLIBS = -L$(XLIBDIR) -lXaw -lXmu -lXt -lXext -lX11 # for Linux: XLIBS = -L$(XLIBDIR) -lXaw -lXmu -lXt -lXext -lX11 -lc # for BSD/OS 2.0: #XLIBS = -L$(XLIBDIR) -lXaw -lXmu -lXt -lXext -lX11 -lSM -lICE -lXext # For SunOS: #XLIBS = -L$(XLIBDIR) -lXaw -lXmu -lXt -lXext -lX11 # Location of X include files #XINCLUDE=/usr/X11R6/include/X11/Xaw3d XINCLUDE=/usr/X11/include #XINCLUDE=/usr/local/X11R5/include # Objects to include in libfwall for SYSV SYSVOBJ= signal.o --------------0BB05B64C96DC9B2B859BA8D-- From owner-fwtk-users@ex.tis.com Thu Apr 6 11:05 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA14466 Thu, 6 Apr 2000 11:05:46 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA00217; Thu, 6 Apr 2000 08:11:27 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 07:18:24 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA20804 for fwtk-users-outgoing; Thu, 6 Apr 2000 07:18:13 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <38ECC240.7E278C26@peers.za.net> Date: Thu, 06 Apr 2000 15:17:19 +0100 (BST) From: Tony Gale To: Jonathan Peers Subject: RE: Can you please help Cc: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 3335 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Looks like you didn't install the X11 development packages. Either that or the header files aren't under /usr/X11/include which is where you've set them to be. -tony On 06-Apr-2000 Jonathan Peers wrote: > I type make and it comes back with the below ..... I have att my > Makefile.config > > Thank you > jonathan > > make[1]: Entering directory `/home/jonathanp/fwtk/smapd' > make[1]: Nothing to be done for `all'. > make[1]: Leaving directory `/home/jonathanp/fwtk/smapd' > all: /home/jonathanp/fwtk/netacl > make[1]: Entering directory `/home/jonathanp/fwtk/netacl' > make[1]: Nothing to be done for `all'. > make[1]: Leaving directory `/home/jonathanp/fwtk/netacl' > all: /home/jonathanp/fwtk/plug-gw > make[1]: Entering directory `/home/jonathanp/fwtk/plug-gw' > make[1]: Nothing to be done for `all'. > make[1]: Leaving directory `/home/jonathanp/fwtk/plug-gw' > all: /home/jonathanp/fwtk/ftp-gw > make[1]: Entering directory `/home/jonathanp/fwtk/ftp-gw' > make[1]: Nothing to be done for `all'. > make[1]: Leaving directory `/home/jonathanp/fwtk/ftp-gw' > all: /home/jonathanp/fwtk/tn-gw > make[1]: Entering directory `/home/jonathanp/fwtk/tn-gw' > make[1]: Nothing to be done for `all'. > make[1]: Leaving directory `/home/jonathanp/fwtk/tn-gw' > all: /home/jonathanp/fwtk/rlogin-gw > make[1]: Entering directory `/home/jonathanp/fwtk/rlogin-gw' > make[1]: Nothing to be done for `all'. > make[1]: Leaving directory `/home/jonathanp/fwtk/rlogin-gw' > all: /home/jonathanp/fwtk/http-gw > make[1]: Entering directory `/home/jonathanp/fwtk/http-gw' > make[1]: Nothing to be done for `all'. > make[1]: Leaving directory `/home/jonathanp/fwtk/http-gw' > all: /home/jonathanp/fwtk/x-gw > make[1]: Entering directory `/home/jonathanp/fwtk/x-gw' > cc -I.. -g -DLINUX -I/usr/X11/include -c dialog.c -o dialog.o > In file included from dialog.c:12: > ulib.h:26: X11/Intrinsic.h: No such file or directory > dialog.c:14: X11/Xlib.h: No such file or directory > dialog.c:15: X11/Xatom.h: No such file or directory > dialog.c:16: X11/StringDefs.h: No such file or directory > dialog.c:19: X11/Xaw/Cardinals.h: No such file or directory > dialog.c:20: X11/Xaw/Paned.h: No such file or directory > dialog.c:21: X11/Xaw/Label.h: No such file or directory > dialog.c:22: X11/Xaw/Box.h: No such file or directory > dialog.c:23: X11/Xaw/Command.h: No such file or directory > make[1]: *** [dialog.o] Error 1 > make[1]: Leaving directory `/home/jonathanp/fwtk/x-gw' > make: *** [all] Error 2 > root@beta:/home/jonathanp/fwtk > > > > > -- > Definition of Windows 95 : > A 32 bit GUI, running on a 16 bit shell, running ontop of an 8 bit > OS, > running on a 4 bit CPU, written by 2 bit Company, who can't stand 1 > bit > competition. > > > > > -- > Definition of Windows 95 : > A 32 bit GUI, running on a 16 bit shell, running ontop of an 8 bit > OS, > running on a 4 bit CPU, written by 2 bit Company, who can't stand 1 > bit > competition. --- E-Mail: Tony Gale QOTD: "Who? Me? No, no, NO!! But I do sell rugs." The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Thu Apr 6 11:13 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA14524 Thu, 6 Apr 2000 11:13:00 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA01149; Thu, 6 Apr 2000 08:18:08 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 07:33:43 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA23927 for fwtk-users-outgoing; Thu, 6 Apr 2000 07:33:32 -0700 (PDT) Message-ID: <38EC9014.ADC32D0D@ordix.de> Date: Thu, 06 Apr 2000 15:24:36 +0200 From: Markus Schreier X-Mailer: Mozilla 4.61 [en] (WinNT; I) X-Accept-Language: en MIME-Version: 1.0 To: Naresh Narang CC: fwtk-users@ex.tis.com Subject: Re: Mail problem References: <38EC221F.42A2B1E1@air.org.in> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1415 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Naresh, we have the same problems sending mail to yahoo as well. I tend to belive it is a yahoo-problem. Greetings from Wiesbaden, Germany Markus Naresh Narang wrote: > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello > > Smap is working perfectly all right and the mail is delivered to > Internal and external sites and it has been working for last about 2 > months. Now the problem is that recently the mail to any > username@yahoo.com is not being delivered. smapd hands over the mail to > sendmail and ps shows: > > mx2.mail.yahoo.com. : user open > > and it stays that way for long time. In the maillog it shows: > > stat=Deferred: Connection reset by mx2.mail.yahoo.com. > OR > timeout waiting for input from mx2.mail.yahoo.com. during client > greeting > > Now these deferred mails (all destined for yahoo.com) are being > collected in the mailq and since sendmail runs only via smapd; I have to > run sendmail -q from cron. But still the problem remains. Not being able > to send mail to any user @yahoo.com. DNS is working all right and mail > to all other sites can be sent without any problem. > > Could anyone please tell me what I should do? > > N.K.Narang From owner-fwtk-users@ex.tis.com Thu Apr 6 14:07 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA15373 Thu, 6 Apr 2000 14:07:18 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA28538; Thu, 6 Apr 2000 11:12:43 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 10:19:08 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA22070 for fwtk-users-outgoing; Thu, 6 Apr 2000 10:18:57 -0700 (PDT) Message-Id: <3.0.3.32.20000406105349.0074cf64@mail.denver.gd-is.com> X-Sender: dsmith@mail.denver.gd-is.com X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) Date: Thu, 06 Apr 2000 10:53:49 -0600 To: jonathan@peers.za.net, fwtk-support@tis.com, fwtk-users@tis.com From: Donald J Smith Subject: Re: Can you please help In-Reply-To: <38ECC240.7E278C26@peers.za.net> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 6631 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 06:58 PM 4/6/00 +0200, Jonathan Peers wrote: >I type make and it comes back with the below ..... I have att my >Makefile.config > >Thank you >jonathan > >make[1]: Entering directory `/home/jonathanp/fwtk/smapd' >make[1]: Nothing to be done for `all'. >make[1]: Leaving directory `/home/jonathanp/fwtk/smapd' >all: /home/jonathanp/fwtk/netacl CUT several lines of the same make "errors" >make[1]: Leaving directory `/home/jonathanp/fwtk/http-gw' >all: /home/jonathanp/fwtk/x-gw >make[1]: Entering directory `/home/jonathanp/fwtk/x-gw' Heres where your real errors begin the other errors simply say that the required files are all uptodate. >cc -I.. -g -DLINUX -I/usr/X11/include -c dialog.c -o dialog.o >In file included from dialog.c:12: >ulib.h:26: X11/Intrinsic.h: No such file or directory >dialog.c:14: X11/Xlib.h: No such file or directory >dialog.c:15: X11/Xatom.h: No such file or directory >dialog.c:16: X11/StringDefs.h: No such file or directory >dialog.c:19: X11/Xaw/Cardinals.h: No such file or directory >dialog.c:20: X11/Xaw/Paned.h: No such file or directory >dialog.c:21: X11/Xaw/Label.h: No such file or directory >dialog.c:22: X11/Xaw/Box.h: No such file or directory >dialog.c:23: X11/Xaw/Command.h: No such file or directory This clearly says that your /usr/lib/X11/Xaw/ is missing files (or the whole directory is missing either) When I install the fwtk I NEVER add the X stuff to my os. But I will ALWAYS get errors from the make unless I comment out the x-gw stuff. Since I don't gateway X in or out of my firewall this is acceptable to me. In fact sometimes I comment out all but ftp and smap stuff cause those are the two I ALWAYS use. I removed most of the rest of this message but will made a few comments to hopefully help you. Look for ######################### ># Copyright (c) 1993, Trusted Information Systems, Incorporated ># All rights reserved. ># ># Redistribution and use are governed by the terms detailed in the ># license document ("LICENSE") included with the toolkit. ># > ># ># Author: Marcus J. Ranum, Trusted Information Systems, Inc. ># ># RcsId: "$Header: /home/rmurphy/fwtk/fwtk/RCS/Makefile.config.linux,v 1.2 1998/01/13 23:50:46 rmurphy Exp $" > > ># Your C compiler (eg, "cc" or "gcc") >CC= cc > > ># program to use for installation -- this may or may not preserve ># old versions (or whatever). assumes that it takes parameters: ># copy source dest >CP= cp > > ># Defines for your operating system ># >DEFINES=-DLINUX >#DEFINES=-DSYSV -DSOLARIS > ># Options for your compiler (eg, "-g" for debugging, "-O" for ># optimizing, or "-g -O" for both under GCC) >#COPT= -g -traditional $(DEFINES) >COPT= -g $(DEFINES) >#COPT= -O $(DEFINES) > ># Version of "make" you want to use >#MAKE= gnumake >MAKE= make > > ># Your ranlib utility (use "touch" if you don't have ranlib) >RANLIB= ranlib >#RANLIB= touch > > ># Destination directory for installation of binaries >DEST= /usr/local/etc > > ># Destination directory for installation of man pages >#DESTMAN= $(DEST)/../man > > ># Names of any auxiliary libraries your system may require (e.g., -lsocket) ># If you want to link against a resolver library, specify it here. >AUXLIB= >#AUXLIB= -lsocket ># Some versions of Linux have broken the crypt() function out into a ># separate library - uncomment the following line if authsrv fails to build. >AUXLIB= -lcrypt > ># For Solaris: >#AUXLIB= -lresolv -lsocket -lnsl > > ># DBM library should be specified if it is an external library or ># you with to use a different one than what is included in libc >#DBMLIB= -lndbm ># for Linux: >DBMLIB=-lgdbm ># "Linux" is such a ephemeral concept. Unfortunately, one of the ># significant incompatibilities between distributions and versions ># is where the DBM libraries end up. "-ldbm", "-ldb", or "-lgdbm" could ># work for you. "-lgdbm" works for me (Slackware Linux 2.3). ># for BSD: >#DBMLIB= > ># Flags to pass to the linker (eg, -static for static binaries under GCC, ># or -Bstatic for static binaries under SunOS 4.1.x) >#LDFL= -Bstatic >#LDFL= >LDFL= -g -static ># Flags for X gateway link - usually the same as LDFL >XLDFL=-g > > ># Location of the fwtk sources [For #include by any external tools needing it] ############################################################################ ############# THIS is WRONG. It is MarcusRathum's home directory. Your version of fwtk resides in /home/jonathanp/fwtk/smapd. djs ############################################################################ ############# >FWTKSRCDIR=/u/b/mjr/firewall/fwtk >#FWTKSRCDIR=/usr/local/src/fwtk > > ># Location of X libraries for X-gw ############################################################################ ############### This maybe wrong or you may not have loaded Xlibs at all. djs ############################################################################ ############### >XLIBDIR=/usr/X11/lib >#XLIBDIR=/usr/local/X11R5/lib > ># X Libraries ># For BSD: >#XLIBS= -L$(XLIBDIR) -lXaw -lXmu -lXt -lXext -lX11 -lSM -lICE -lipc >#XLIBS = -L$(XLIBDIR) -lXaw -lXmu -lXt -lXext -lX11 ># for Linux: >XLIBS = -L$(XLIBDIR) -lXaw -lXmu -lXt -lXext -lX11 -lc ># for BSD/OS 2.0: >#XLIBS = -L$(XLIBDIR) -lXaw -lXmu -lXt -lXext -lX11 -lSM -lICE -lXext ># For SunOS: >#XLIBS = -L$(XLIBDIR) -lXaw -lXmu -lXt -lXext -lX11 > ># Location of X include files ############################################################################ ############### This maybe wrong or you may not have loaded Xlibs at all. djs ############################################################################ ############### >#XINCLUDE=/usr/X11R6/include/X11/Xaw3d >XINCLUDE=/usr/X11/include >#XINCLUDE=/usr/local/X11R5/include > ># Objects to include in libfwall for SYSV >SYSVOBJ= signal.o > ------------------------------------------------------------------------------ Don Smith General Dynamics Information Systems Systems Administrator 8005 South Chester St EngleWood, Co. 80112 Phone (303) 649-7554 FAX (303) 649-7504 donald.j.smith@gd-is.com Error msgs that I love: "Keyboard not found press F1 to continue" (pc bios) "Harddrive controller failure insert new disk and press any key to continue" (pc bios) "The disk is write protected Remove the write protect or use another disk." (nt) User must change his password before he logs in the first time. (nt) ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Thu Apr 6 16:03 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA15759 Thu, 6 Apr 2000 16:03:42 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA12187; Thu, 6 Apr 2000 13:05:57 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 12:15:18 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA05690 for fwtk-users-outgoing; Thu, 6 Apr 2000 12:15:12 -0700 (PDT) X-Server-Uuid: b0832e76-507b-11d1-9cee-00e0290993bc Message-ID: <38ECE1CB.1CF2@tfn.com> Date: Thu, 06 Apr 2000 15:13:15 -0400 From: "Mike Q. Hiller" Organization: Thomson Financial Services X-Mailer: Mozilla 3.04 (X11; I; SunOS 5.6 sun4u) MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: ftp-gw 2.1 leaves data sockets in TIME_WAIT on Solaris 2.6 X-WSS-ID: 14F23E4622893-01-01 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 357 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I have a Sun Ultra-1 running ftp-gw from TIS 2.1. Unfortunatly whenever I connect to it from Solaris FTP client (or from perl Net::FTP method), ftp data sockets are left on the gateway. Anybody seen this before? mqh From owner-fwtk-users@ex.tis.com Thu Apr 6 16:30 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA15852 Thu, 6 Apr 2000 16:30:42 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA15454; Thu, 6 Apr 2000 13:35:42 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 12:50:59 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA10147 for fwtk-users-outgoing; Thu, 6 Apr 2000 12:50:48 -0700 (PDT) MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Message-ID: <14572.59981.944143.765928@taltos.tla.org> Date: Thu, 6 Apr 2000 15:49:33 -0400 (EDT) From: carson@tla.org To: "Mike Q. Hiller" Cc: fwtk-users@lists.nai.com Subject: Re: ftp-gw 2.1 leaves data sockets in TIME_WAIT on Solaris 2.6 In-Reply-To: <38ECE1CB.1CF2@tfn.com> References: <38ECE1CB.1CF2@tfn.com> X-Mailer: VM 6.62 under 20.0 XEmacs Lucid (beta28) Reply-To: carson@tla.org Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 820 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] >>>>> "Mike" == Mike Q Hiller writes: Mike> I have a Sun Ultra-1 running ftp-gw from TIS 2.1. Mike> Unfortunatly whenever I connect to it from Solaris Mike> FTP client (or from perl Net::FTP method), ftp data Mike> sockets are left on the gateway. Anybody seen this before? TIME_WAIT is normal. All sockets are left in TIME_WAIT after they're closed. If you want to shorten the amount of time, use ndd to tune tcp_close_wait_interval (or whatever it's called on your version of solaris - I think they renamed it in 8). -- Carson Gaspar -- carson@tla.org carson@cs.columbia.edu carson@cugc.org http://www.cs.columbia.edu/~carson/home.html Queen Trapped in a Butch Body From owner-fwtk-users@ex.tis.com Thu Apr 6 21:22 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA16813 Thu, 6 Apr 2000 21:22:45 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA18756; Thu, 6 Apr 2000 18:28:14 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 17:37:26 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA15732 for fwtk-users-outgoing; Thu, 6 Apr 2000 17:37:20 -0700 (PDT) X-Lotus-FromDomain: QANTAS From: "Marcus MNA31 Nand" To: fwtk-users@ex.tis.com Message-ID: <4A2568BA.0002F6BB.00@sydqabnt13-ns.qantas.com.au> Date: Fri, 7 Apr 2000 10:32:21 +1000 Subject: Turning logging off in Gauntlet 5.0 Mime-Version: 1.0 Content-Disposition: inline Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 914 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi I would like to turn of logging for specific traffic on our Gauntlet firewall 5.0, by default extensive logging is turned on, is there a way of turning logging off, let say for http traffic. Thanks in advance Marcus *******************Confidentiality and Privilege Notice******************* This email is intended only to be read or used by the addressee. It is confidential and may contain legally privileged information. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone, and you should destroy this message and kindly notify the sender by reply email. Confidentiality and legal privilege are not waived or lost by reason of mistaken delivery to you. From owner-fwtk-users@ex.tis.com Thu Apr 6 21:49 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA16839 Thu, 6 Apr 2000 21:49:47 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA21264; Thu, 6 Apr 2000 18:55:17 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 18:12:17 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA17652 for fwtk-users-outgoing; Thu, 6 Apr 2000 18:12:12 -0700 (PDT) Message-Id: <200004070108.JAA00806@servertwo.qdhaixin.com.cn> X-Authentication-Warning: servertwo.qdhaixin.com.cn: nobody set sender to using -f Date: Fri, 7 Apr 2000 9:13:57 +0800 From: wen Reply-To: wen@hisense.qd.sd.cn To: "fwtk-users@lists.nai.com" Subject: test fwtk to get maximal connection number that fwtk can support X-mailer: FoxMail 3.0 beta 2 [cn] Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 324 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hello all: now I want to test fwtk performance to get maximal connection number that fwtk can support. what is the maximal connection numbe that fwtk can support? how to test? thanks. wen From owner-fwtk-users@ex.tis.com Thu Apr 6 22:15 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA16928 Thu, 6 Apr 2000 22:15:39 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA23355; Thu, 6 Apr 2000 19:20:55 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 18:36:36 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA19242 for fwtk-users-outgoing; Thu, 6 Apr 2000 18:36:25 -0700 (PDT) Message-ID: <38ED3BB5.C1637027@citec.qld.gov.au> Date: Fri, 07 Apr 2000 11:36:53 +1000 From: Ken Blinco Organization: http://www.citec.com.au X-Mailer: Mozilla 4.61 [en] (X11; I; Linux 2.2.12-20 i686) X-Accept-Language: en MIME-Version: 1.0 To: Naresh Narang , fwtk-users@ex.tis.com Subject: Re: Mail problem References: <38EC221F.42A2B1E1@air.org.in> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2207 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, we are also experiencing problems with yahoo and have been for the past week. Not sure what they are up to over there. We handle a very large amount of email and have setup a number of seperate mail queues. Any mail not delivered after an hour gets moved to an hourly queue, any mail in that queue which is not delivered after 6 hours gets moved to a 6 hourly queue etc. We run sendmail in queue mode over these other queues from cron at regular, but less frequent intervals to reduce the load on our machine. The primary queue is of course still looked after by gauntlet's mqueue process. This will help separate the processing of your yahoo mail from your normal mail functional mail delivery. Ken Naresh Narang wrote: > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello > > Smap is working perfectly all right and the mail is delivered to > Internal and external sites and it has been working for last about 2 > months. Now the problem is that recently the mail to any > username@yahoo.com is not being delivered. smapd hands over the mail to > sendmail and ps shows: > > mx2.mail.yahoo.com. : user open > > and it stays that way for long time. In the maillog it shows: > > stat=Deferred: Connection reset by mx2.mail.yahoo.com. > OR > timeout waiting for input from mx2.mail.yahoo.com. during client > greeting > > Now these deferred mails (all destined for yahoo.com) are being > collected in the mailq and since sendmail runs only via smapd; I have to > run sendmail -q from cron. But still the problem remains. Not being able > to send mail to any user @yahoo.com. DNS is working all right and mail > to all other sites can be sent without any problem. > > Could anyone please tell me what I should do? > > N.K.Narang -- ----------------------------------------------------------- Ken Blinco E-Mail: Ken.Blinco@citec.com.au Unix Support Group Phone: +61 7 322 76970 CITEC, GPO Box 297 Brisbane, Queensland 4001 Australia From owner-fwtk-users@ex.tis.com Fri Apr 7 01:50 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id BAA17521 Fri, 7 Apr 2000 01:50:46 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id WAA00344; Thu, 6 Apr 2000 22:56:16 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 6 Apr 2000 22:04:58 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id WAA27611 for fwtk-users-outgoing; Thu, 6 Apr 2000 22:04:52 -0700 (PDT) Message-Id: <200004070501.NAA12285@servertwo.qdhaixin.com.cn> X-Authentication-Warning: servertwo.qdhaixin.com.cn: nobody set sender to using -f Date: Fri, 7 Apr 2000 13:6:15 +0800 From: wen Reply-To: wen@hisense.qd.sd.cn To: "fwtk-users@lists.nai.com" Subject: VPN in fwtk X-mailer: FoxMail 3.0 beta 2 [cn] Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 204 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hello all: now does fwtk support VPN? how to config? thanks. wen From owner-fwtk-users@ex.tis.com Fri Apr 7 05:56 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA18747 Fri, 7 Apr 2000 05:56:09 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA00202; Fri, 7 Apr 2000 03:01:35 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 7 Apr 2000 01:58:58 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA17916 for fwtk-users-outgoing; Fri, 7 Apr 2000 01:58:51 -0700 (PDT) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <38EDA31A.7BB01448@usrconsult.be> Date: Fri, 07 Apr 2000 10:58:02 +0200 From: Michel Bardiaux Organization: UsrConsult SPRL X-Mailer: Mozilla 4.5 [en] (X11; I; IRIX64 6.5 IP27) X-Accept-Language: en MIME-Version: 1.0 To: "fwtk-users@lists.nai.com" Subject: Re: VPN in fwtk References: <200004070501.NAA12285@servertwo.qdhaixin.com.cn> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1461 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] wen wrote: > > hello all: > now does fwtk support VPN? how to config? > > thanks. > > wen Just my 2 cents: We looked into that here (admittedly more than 2 years ago!) and came to a few conclusions: (1) PPTP : uses a special IP protocol number, so filtering rules have to be set up at kernel level; much harder than configuring plug-gw! Moreover, we could not find an Open Source implementation supporting encryption. (2) SSH : we use SSH (version 1) to tunnel through our firewall, with the Open Source client for Linux, and the Datafellows F-Secure proprietary client for WindowsNT (the latter not working very well...); plug-gw on the firewall, additional authentication via the ISDN phone number in the ISDN router, and the Open Source server on our internal server, which is an SGI running IRIX. Drawbacks: FTP does not work over SSH (admittedly we use a rather old release of SSH, maybe this changed?), nor AFAIK any UDP protocols. Although it is theoretically possible to use PPP-over-SSH as a VPN, many say that is prone to 'cascade failure', i.e. TCP packets being re-transmitted on *both* the real and the virtual link, causing *more* transmission failures, causing more retransmission, etc... We did not try so I don't *know*. -- Michel Bardiaux From owner-fwtk-users@ex.tis.com Fri Apr 7 08:57 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA19850 Fri, 7 Apr 2000 08:57:45 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA10437; Fri, 7 Apr 2000 06:03:00 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 7 Apr 2000 04:48:20 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA04845 for fwtk-users-outgoing; Fri, 7 Apr 2000 04:48:14 -0700 (PDT) Message-ID: <200004071630330280.01ADE8A9@mail.wol.net.pk> X-Mailer: Calypso Version 3.00.03.02 (3) Date: Fri, 07 Apr 2000 16:30:33 +0500 From: "}{ce||enT" To: fwtk-support@tis.com, fwtk-users@tis.com Subject: any help in running FWTK Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="=====_95510703318467=_" Content-Length: 1186 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --=====_95510703318467=_ Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable Hi.. I have installen FWTK on BSDI and have configure the netperm-table as= required but dont know how to run it OR how i use FTP-GW ... What should I do next ??????? any help Regards. xcelent --=====_95510703318467=_ Content-Type: text/html; charset="us-ascii"
Hi..
 
I have installen FWTK on BSDI and have configure the netperm-table as required but dont know how to run it OR how i use FTP-GW ...
 
What should I do next ???????
any help
 
Regards.
xcelent
--=====_95510703318467=_-- From owner-fwtk-users@ex.tis.com Fri Apr 7 10:35 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA20368 Fri, 7 Apr 2000 10:35:11 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA21034; Fri, 7 Apr 2000 07:40:37 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 7 Apr 2000 06:48:19 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA15112 for fwtk-users-outgoing; Fri, 7 Apr 2000 06:48:08 -0700 (PDT) Message-Id: <3.0.3.32.20000407044448.00714d40@mail.denver.gd-is.com> X-Sender: dsmith@mail.denver.gd-is.com X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) Date: Fri, 07 Apr 2000 04:44:48 -0600 To: wen@hisense.qd.sd.cn, "fwtk-users@lists.nai.com" From: Donald J Smith Subject: Re: test fwtk to get maximal connection number that fwtk can support In-Reply-To: <200004070108.JAA00806@servertwo.qdhaixin.com.cn> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 1958 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 09:13 AM 4/7/00 +0800, wen wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >hello all: > >now I want to test fwtk performance to get maximal connection number that fwtk can support. what is the maximal connection numbe that fwtk can support? how to test? The first question can be answered with "it depends". It depends on what os, hardware etc you are useing for the fwtk host. It also depends on which of the gateways you are using and what else is going on on the machine. To test a specific implementation of fwtk you need to understand what you will be running. IE will you be using the x-gw and smapd and ftp-gw or what. Will you be logging everything or nothing? ... See what I mean. One of the best features of fwtk is that it is a sourcecode toolkit. It is a crystal box implementation of a firewall. You get to choose what you will use, how you will use it and if any piece of it appears too slow you have the source and can make changes to speed it up. > >thanks. > >wen > > > ------------------------------------------------------------------------------ Don Smith General Dynamics Information Systems Systems Administrator 8005 South Chester St EngleWood, Co. 80112 Phone (303) 649-7554 FAX (303) 649-7504 donald.j.smith@gd-is.com Error msgs that I love: "Keyboard not found press F1 to continue" (pc bios) "Harddrive controller failure insert new disk and press any key to continue" (pc bios) "The disk is write protected Remove the write protect or use another disk." (nt) User must change his password before he logs in the first time. (nt) ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Fri Apr 7 14:19 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA21263 Fri, 7 Apr 2000 14:19:43 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA19447; Fri, 7 Apr 2000 11:24:48 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 7 Apr 2000 10:32:33 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA12193 for fwtk-users-outgoing; Fri, 7 Apr 2000 10:32:22 -0700 (PDT) Message-ID: <38EE1B0E.90E6632D@v-one.com> Date: Fri, 07 Apr 2000 13:29:50 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.72 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Gareth Bromley CC: fwtk-users Subject: Re: VPN placement.... References: <38E9C151.FB994B54@danbbs.dk> <38EA2A31.C590CF1D@v-one.com> <38EADF95.509DE62C@intstar.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2350 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > > > Wouldn't it be safest to place vpn directly on the firewall, as shown? > > > Vpn could be placed on the router, but if the vpn is compromized, access > > > may be possible to the whole internal net, right? > > > > Very true. I wouldn't recommend this at all. > > I find it quite strange that the firewall administrator doesn't have direct > control of the external router to implement initial network filtering (Increase > security, reduce traffic hitting the firewall). e.g. > > Ext network----Ext Router----firewall----dmz----Internal Router----..... > > In the above case using an external router, this could be used as the VPN end > point, as with have done over a number of technologies. A caveat however, the > router vendors have been quite slow deploying fully IPSEC compliant solutions, and > in some cases require a mix of part IPSEC + proprietary to make VPNs (This > normally makes these solutions less friendly ;) ) I just wouldn't allow unencrypted traffic from the external router to be outside the firewall. I personally like encrypting traffic as close to the end point (or trusted network) that I can.... Plus, your security rules on your firewall are either going to be too broad ("allow src router.ip dst any port any" if router is doing VPN natting... eeek!) or too restrictive ("allow src router.ip dst intranet.web port 80" for each service via router VPN). Unless, of course, if your internal router supports VPN traffic and you forward it from the outside through your firewall ("allow src any dst internal.router protocol 50,51") which I don't recommend either... > It really depends on the type of client connecting I guess, remote site or remote > user. I like Keiths SmartGate for users (especially with SmartCards), external > router based solution for sites. Horses for courses I guess, I like SmartGate too :-). We have actually done a similiar config for a high security law enforcement group. SmartPass for client-to-server and Gauntlet tunnels between sites for server replication. They think it works great. Anyway, I'll shut up now and stop changing the topic from the FWTK... :-) -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Fri Apr 7 14:34 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA21349 Fri, 7 Apr 2000 14:34:04 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA21227; Fri, 7 Apr 2000 11:39:09 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 7 Apr 2000 10:56:28 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA15643 for fwtk-users-outgoing; Fri, 7 Apr 2000 10:56:12 -0700 (PDT) Message-ID: <38EE20B7.202139B8@v-one.com> Date: Fri, 07 Apr 2000 13:53:59 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.72 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Tony Gale CC: Jon Earle , fwtk-users@ex.tis.com Subject: Re: Problem with accessing one ftp site through http-gw References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 542 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Tony Gale wrote: > > Apply the enclosed patch. > > (avenger, would you *please* add this to the web site). > > -tony Sorry about that... I've been busy with business travelling and purchasing a house. I'll have the FAQ updated (along with removing the mirror sites which didn't apply the mirror.pl fix) tomorrow afternoon. -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Fri Apr 7 15:17 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA21552 Fri, 7 Apr 2000 15:17:27 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA26580; Fri, 7 Apr 2000 12:22:36 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 7 Apr 2000 11:37:09 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA20964 for fwtk-users-outgoing; Fri, 7 Apr 2000 11:36:57 -0700 (PDT) Message-ID: <38EE2A3E.73886AAF@v-one.com> Date: Fri, 07 Apr 2000 14:34:38 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.72 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Marcus MNA31 Nand CC: fwtk-users@ex.tis.com Subject: Re: Turning logging off in Gauntlet 5.0 References: <4A2568BA.0002F6BB.00@sydqabnt13-ns.qantas.com.au> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 717 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Marcus MNA31 Nand wrote: > > I would like to turn of logging for specific traffic on our Gauntlet firewall > 5.0, by default extensive logging is turned on, is there a way of turning > logging off, let say for http traffic. First, this list is for the FWTK, which != Gauntlet. The Gauntlet mailing list instructions can be found at: http://www.securityfocus.com/templates/mlist.html?list=87 Second, to answer your question: No, you cannot do it in 5.0. However, it is a new feature in Gauntlet 5.5. -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Sat Apr 8 07:37 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA23721 Sat, 8 Apr 2000 07:37:48 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA06909; Sat, 8 Apr 2000 04:42:57 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 8 Apr 2000 03:46:29 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA05823 for fwtk-users-outgoing; Sat, 8 Apr 2000 03:46:23 -0700 (PDT) Message-ID: <200004081546100930.03CBB828@mail.wol.net.pk> X-Mailer: Calypso Version 3.00.03.02 (3) Date: Sat, 08 Apr 2000 15:46:10 +0500 From: "}{ce||enT" To: fwtk-users@lists.nai.com Subject: FTP using browser Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="=====_95519077041=_" Content-Length: 1228 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --=====_95519077041=_ Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable Hi.. I have FWTK 2.1 on BSDI ..... When i do FTP from command promt it works= fine but with browsers it just couldnt do ... What should I do to make it running with browsers ??????? Any help Regards, xcelent --=====_95519077041=_ Content-Type: text/html; charset="us-ascii"
Hi..
 
I have FWTK 2.1 on  BSDI .....  When i do FTP from command promt it works fine but with browsers  it just couldnt do ...
What should I do to make it running with browsers ???????
 
Any help
 
Regards,
xcelent
--=====_95519077041=_-- From owner-fwtk-users@ex.tis.com Sat Apr 8 08:31 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA23867 Sat, 8 Apr 2000 08:31:42 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA09618; Sat, 8 Apr 2000 05:36:55 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 8 Apr 2000 04:49:13 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA07042 for fwtk-users-outgoing; Sat, 8 Apr 2000 04:49:07 -0700 (PDT) Message-ID: <200004081648410020.0404F32B@mail.wol.net.pk> X-Mailer: Calypso Version 3.00.03.02 (3) Date: Sat, 08 Apr 2000 16:48:41 +0500 From: "}{ce||enT" To: fwtk-users@lists.nai.com Subject: ftpproxy Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="=====_9551945216334=_" Content-Length: 1072 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --=====_9551945216334=_ Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable Hi.. Is there any one running FTP-GW in passive mode (that support ftp with web= browsers ) ????????? Any one ??? please help me ??????? Regards, xcelent --=====_9551945216334=_ Content-Type: text/html; charset="us-ascii"
Hi..
 
Is there any one running FTP-GW in passive mode (that support ftp with web browsers ) ?????????
 
Any one ??? please help me ???????
 
Regards,
xcelent
--=====_9551945216334=_-- From owner-fwtk-users@ex.tis.com Sat Apr 8 09:01 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA23932 Sat, 8 Apr 2000 09:01:24 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA11701; Sat, 8 Apr 2000 06:06:29 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 8 Apr 2000 05:04:28 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA07480 for fwtk-users-outgoing; Sat, 8 Apr 2000 05:04:22 -0700 (PDT) Message-ID: <200004081704020180.04130210@mail.wol.net.pk> X-Mailer: Calypso Version 3.00.03.02 (3) Date: Sat, 08 Apr 2000 17:04:02 +0500 From: "}{ce||enT" To: fwtk-users@lists.nai.com Subject: passive mode doesn't work. Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="=====_95519544226500=_" Content-Length: 1009 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --=====_95519544226500=_ Content-Type: text/plain; charset="us-ascii" Hi.. normal ftp clients work, but netscape Or explorer ftp's fail ......... Any help regarding this ??????? regards, xcelent --=====_95519544226500=_ Content-Type: text/html; charset="us-ascii"
Hi..
 
normal ftp clients work, but netscape Or explorer ftp's fail .........
 
Any help regarding this ???????
 
regards,
xcelent
 
--=====_95519544226500=_-- From owner-fwtk-users@ex.tis.com Sat Apr 8 09:01 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA23935 Sat, 8 Apr 2000 09:01:30 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA11709; Sat, 8 Apr 2000 06:06:30 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 8 Apr 2000 05:15:22 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA08093 for fwtk-users-outgoing; Sat, 8 Apr 2000 05:15:11 -0700 (PDT) Message-Id: <4.3.1.2.20000408080552.00c17c20@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Sat, 08 Apr 2000 08:06:40 -0400 To: "}{ce||enT" , fwtk-support@tis.com, fwtk-users@tis.com From: Rick Murphy Subject: Re: any help in running FWTK In-Reply-To: <200004071630330280.01ADE8A9@mail.wol.net.pk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 519 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 04:30 PM 4/7/00 +0500, }{ce||enT wrote: >I have installen FWTK on BSDI and have configure the netperm-table as >required but dont know how to run it OR how i use FTP-GW ... > >What should I do next ??????? You either run the proxies in daemon mode when your firewall starts, or you add entries to your inetd.conf to invoke the ftp-gw when you connect to the firewall. -Rick From owner-fwtk-users@ex.tis.com Sat Apr 8 09:01 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA23936 Sat, 8 Apr 2000 09:01:30 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA11705; Sat, 8 Apr 2000 06:06:31 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 8 Apr 2000 05:15:16 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA08076 for fwtk-users-outgoing; Sat, 8 Apr 2000 05:15:04 -0700 (PDT) Message-Id: <4.3.1.2.20000408080417.00b21210@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Sat, 08 Apr 2000 08:05:35 -0400 To: "}{ce||enT" , fwtk-users@lists.nai.com From: Rick Murphy Subject: Re: FTP using browser In-Reply-To: <200004081546100930.03CBB828@mail.wol.net.pk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 567 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 03:46 PM 4/8/00 +0500, }{ce||enT wrote: >I have FWTK 2.1 on BSDI ..... When i do FTP from command promt it works >fine but with browsers it just couldnt do ... >What should I do to make it running with browsers ??????? This is covered in the FAQ. Please read it. (You need to configure your browser to use the http-gw on the same port that you're using as the HTTP proxy as your FTP proxy.) -Rick From owner-fwtk-users@ex.tis.com Sat Apr 8 09:12 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA23952 Sat, 8 Apr 2000 09:12:14 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA12518; Sat, 8 Apr 2000 06:17:25 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 8 Apr 2000 05:35:05 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA09456 for fwtk-users-outgoing; Sat, 8 Apr 2000 05:34:55 -0700 (PDT) Message-Id: <4.3.2.20000408082832.00afd4c0@shadow> X-Sender: (Unverified) X-Mailer: QUALCOMM Windows Eudora Version 4.3 Date: Sat, 08 Apr 2000 08:34:25 -0400 To: "}{ce||enT" , fwtk-users@lists.nai.com From: Jon Earle Subject: Re: ftpproxy In-Reply-To: <200004081648410020.0404F32B@mail.wol.net.pk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 848 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 07:48 AM 04/08/00, }{ce||enT wrote: >Hi.. > >Is there any one running FTP-GW in passive mode (that support ftp with web >browsers ) ????????? > >Any one ??? please help me ??????? FTP through a browser is accomplished through the http-gw, not the ftp-gw as you'd expect. Do you have http-gw installed, configured and working? If so, then simply copy the setting (server and port) in your browser's proxy configuration to the ftp proxy entry. Actually, unless you've removed the support when you built the toolkit, the proxy settings for http, gopher, ftp and security (https) should all be the same in your browser's proxy config. The socks entry is the only one you need not worry about. Cheers! Jon From owner-fwtk-users@ex.tis.com Sat Apr 8 09:46 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA24313 Sat, 8 Apr 2000 09:46:26 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA14970; Sat, 8 Apr 2000 06:51:43 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 8 Apr 2000 06:05:54 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA11645 for fwtk-users-outgoing; Sat, 8 Apr 2000 06:05:48 -0700 (PDT) Message-ID: <200004081805180070.044B1B31@mail.wol.net.pk> X-Mailer: Calypso Version 3.00.03.02 (3) Date: Sat, 08 Apr 2000 18:05:18 +0500 From: "}{ce||enT" To: fwtk-users@lists.nai.com Subject: still problem Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="=====_95519911819169=_" Content-Length: 1837 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --=====_95519911819169=_ Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable Hi... Actually what is happening ..I am runnig transparent proxy for http (= squid) on other machine ...Router sends all port 80 requests to this= machine even when i do FTP from browser ...router sends it to Squid= machine...The problem is here ??? Is there any way that i can tell my router to send http based ftp request= to my FWTK machine. On the other hand if i do simple ftp i.e from command prompt then router= sends this port 21 request to this FWTK machine... Any help ?????? Regards, xcelent --=====_95519911819169=_ Content-Type: text/html; charset="us-ascii"
  Hi...
 
Actually what is happening ..I am runnig transparent proxy for http ( squid) on other machine ...Router sends all port 80 requests to this machine even when i do FTP from browser ...router sends it to Squid machine...The problem is here ???
 
Is there any way that i can tell my router to send http based ftp request to my FWTK machine.
On the other hand if i do simple ftp i.e from command prompt then router sends this port 21 request to this FWTK machine...
 
 
Any help ??????

Regards,
xcelent
--=====_95519911819169=_-- From owner-fwtk-users@ex.tis.com Mon Apr 10 05:42 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA29319 Mon, 10 Apr 2000 05:42:36 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA01281; Mon, 10 Apr 2000 02:47:24 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 10 Apr 2000 01:23:38 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA24421 for fwtk-users-outgoing; Mon, 10 Apr 2000 01:23:27 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <38EE20B7.202139B8@v-one.com> Date: Mon, 10 Apr 2000 09:22:33 +0100 (BST) From: Tony Gale To: Keith Young Subject: Re: Problem with accessing one ftp site through http-gw Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 1765 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 07-Apr-2000 Keith Young wrote: > I'll have the FAQ updated (along with removing the mirror sites > which > didn't apply the mirror.pl fix) tomorrow afternoon. Thanks Keith. For patch 1.9 the error can also be Error 501 I'll try and get my other unpublished patch or two into an acceptable state in the near future. I personally prefer the following patch from Jean-Christophe Touvet for the problem in 1.8: *** hmain.c-orig Sat Feb 7 00:32:16 1998 --- hmain.c Wed Sep 23 17:13:42 1998 *************** *** 857,869 **** if(html_read(fd,(char *)&buf[x],1) != 1) goto done; ! /* get \r\n - read a char and throw it away */ ! if(buf[x] == '\r') { if(html_read(fd,(char *)&buf[x],1) != 1) goto done; - buf[x] = '\0'; - ret = x; - goto done; } if(buf[x] == '\n') { --- 857,866 ---- if(html_read(fd,(char *)&buf[x],1) != 1) goto done; ! /* eat all \r from the stream */ ! while(buf[x] == '\r') { if(html_read(fd,(char *)&buf[x],1) != 1) goto done; } if(buf[x] == '\n') { --- E-Mail: Tony Gale The only thing better than love is milk. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Mon Apr 10 13:14 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA01002 Mon, 10 Apr 2000 13:14:46 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA27152; Mon, 10 Apr 2000 10:20:02 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 10 Apr 2000 09:28:56 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA26353 for fwtk-users-outgoing; Mon, 10 Apr 2000 09:28:49 -0700 (PDT) Message-Id: <3.0.6.32.20000410172437.00975210@192.168.2.2> X-Sender: john@192.168.2.2 X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.6 (32) Date: Mon, 10 Apr 2000 17:24:37 +0100 To: fwtk-users@ex.tis.com From: John Armstrong Subject: Re: smap in anti-relay mode Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 1794 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I've managed to patch my smap.c with the yao-smap.pch changes and recompiled. I modified netperm-table with what I thought were the neccesary additions (appended below) and it all seems to work - except that it is still wide open to relaying! I didn't add any compilation options so I'm using just the defaults. Is that wrong - should I include them? (But where do they go in Makefile.config?) Have I missed the plot somewhere or am I just being (more than normally) dumb here? BTW am I correct in thinking that the patched smap should block relaying on its own, even if I haven't yet beefed up sendmail? Thanks John ====================================================================== # smap (email) rules: # ------------------- #smap, smapd: userid 8 smap, smapd: directory /var/spool/smap smapd: executable /usr/local/etc/smapd smapd: sendmail /usr/sbin/sendmail smapd: wakeup 60 smap: postmaster smap: maxrecip 400 smap: timeout 120 smap: domains lrf.leeds.ac.uk *.lrf.leeds.ac.uk smap: hosts 192.168.2.9 192.168.2.2 smap: check-from-address 1 smap: check-user-too 1 __________________________________________________________________________ John Armstrong Computer System Adminstrator Health & Safety Officer john@lrf.leeds.ac.uk j.d.c.armstrong@leeds.ac.uk LRF Centre at Leeds University 30 Hyde Terrace 0113 233 3912 (phone) Leeds LS2 9LN 0113 245 9806 (fax) From owner-fwtk-users@ex.tis.com Mon Apr 10 15:33 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA01345 Mon, 10 Apr 2000 15:33:56 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA00249; Mon, 10 Apr 2000 12:39:32 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 10 Apr 2000 11:39:11 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA11323 for fwtk-users-outgoing; Mon, 10 Apr 2000 11:39:03 -0700 (PDT) Message-Id: <200004101501.LAA31223@voyager.eagletrim.com> From: "Wes Szumera" Organization: Eagle Trim Inc. To: fwtk-users@ex.tis.com Date: Mon, 10 Apr 2000 14:38:07 -0400 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: Re: smap in anti-relay mode In-reply-to: <3.0.6.32.20000410172437.00975210@192.168.2.2> X-mailer: Pegasus Mail for Win32 (v3.01d) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 2481 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Date sent: Mon, 10 Apr 2000 17:24:37 +0100 To: fwtk-users@ex.tis.com From: John Armstrong Subject: Re: smap in anti-relay mode You know, I fought with this yesterday trying to get it to run after I compiled the patches. Finally, I figured out that I never copied the new executeable to where it runs at /usr/local/etc . Could you be having the same problem? Wes Szumera > I've managed to patch my smap.c with the yao-smap.pch changes and > recompiled. I modified netperm-table with what I thought were the > neccesary additions (appended below) and it all seems to work - except > that it is still wide open to relaying! > > I didn't add any compilation options so I'm using just the defaults. > Is that wrong - should I include them? (But where do they go in > Makefile.config?) Have I missed the plot somewhere or am I just > being (more than normally) dumb here? > > BTW am I correct in thinking that the patched smap should block > relaying on its own, even if I haven't yet beefed up sendmail? > > Thanks > > John > ====================================================================== > # smap (email) rules: > # ------------------- > #smap, smapd: userid 8 > smap, smapd: directory /var/spool/smap > smapd: executable /usr/local/etc/smapd > smapd: sendmail /usr/sbin/sendmail > smapd: wakeup 60 > smap: postmaster > smap: maxrecip 400 > smap: timeout 120 > smap: domains lrf.leeds.ac.uk *.lrf.leeds.ac.uk > smap: hosts 192.168.2.9 192.168.2.2 > smap: check-from-address 1 > smap: check-user-too 1 > __________________________________________________________________________ > John Armstrong Computer System Adminstrator > Health & Safety Officer > john@lrf.leeds.ac.uk > j.d.c.armstrong@leeds.ac.uk LRF Centre at Leeds University > 30 Hyde Terrace > 0113 233 3912 (phone) Leeds LS2 9LN > 0113 245 9806 (fax) > Wes Szumera Plant Engineer Eagle Trim Inc. 0829 US 131 NW Kalkaska, MI 49646-0460 voice 231 258 4150 ext 3024 fax 231 258 4153 From owner-fwtk-users@ex.tis.com Mon Apr 10 16:42 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA01578 Mon, 10 Apr 2000 16:42:21 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA17955; Mon, 10 Apr 2000 13:47:51 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 10 Apr 2000 12:57:34 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA05690 for fwtk-users-outgoing; Mon, 10 Apr 2000 12:57:22 -0700 (PDT) Message-ID: <20000410150001.C3008@wizard.deepthought.com> Date: Mon, 10 Apr 2000 15:00:01 -0500 From: Frank Pittel To: Wes Szumera , fwtk-users@ex.tis.com Subject: Re: smap in anti-relay mode References: <3.0.6.32.20000410172437.00975210@192.168.2.2> <200004101501.LAA31223@voyager.eagletrim.com> Mime-Version: 1.0 X-Mailer: Mutt 0.93.2 In-Reply-To: <200004101501.LAA31223@voyager.eagletrim.com>; from Wes Szumera on Mon, Apr 10, 2000 at 02:38:07PM -0400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 3041 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I know this sounds silly but is there anyway you could mail me the ource for smap patched with the yao-smap patches? If that's out of line how did you install the patches? Everytime I try the patch installation fails. Thnx Frank On Mon, Apr 10, 2000 at 02:38:07PM -0400, Wes Szumera wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Date sent: Mon, 10 Apr 2000 17:24:37 +0100 > To: fwtk-users@ex.tis.com > From: John Armstrong > Subject: Re: smap in anti-relay mode > > You know, I fought with this yesterday trying to get it to run after I > compiled the patches. Finally, I figured out that I never copied the > new executeable to where it runs at /usr/local/etc . > > Could you be having the same problem? > > Wes Szumera > > > I've managed to patch my smap.c with the yao-smap.pch changes and > > recompiled. I modified netperm-table with what I thought were the > > neccesary additions (appended below) and it all seems to work - except > > that it is still wide open to relaying! > > > > I didn't add any compilation options so I'm using just the defaults. > > Is that wrong - should I include them? (But where do they go in > > Makefile.config?) Have I missed the plot somewhere or am I just > > being (more than normally) dumb here? > > > > BTW am I correct in thinking that the patched smap should block > > relaying on its own, even if I haven't yet beefed up sendmail? > > > > Thanks > > > > John > > ====================================================================== > > # smap (email) rules: > > # ------------------- > > #smap, smapd: userid 8 > > smap, smapd: directory /var/spool/smap > > smapd: executable /usr/local/etc/smapd > > smapd: sendmail /usr/sbin/sendmail > > smapd: wakeup 60 > > smap: postmaster > > smap: maxrecip 400 > > smap: timeout 120 > > smap: domains lrf.leeds.ac.uk *.lrf.leeds.ac.uk > > smap: hosts 192.168.2.9 192.168.2.2 > > smap: check-from-address 1 > > smap: check-user-too 1 > > __________________________________________________________________________ > > John Armstrong Computer System Adminstrator > > Health & Safety Officer > > john@lrf.leeds.ac.uk > > j.d.c.armstrong@leeds.ac.uk LRF Centre at Leeds University > > 30 Hyde Terrace > > 0113 233 3912 (phone) Leeds LS2 9LN > > 0113 245 9806 (fax) > > > > > > > Wes Szumera > > Plant Engineer > Eagle Trim Inc. > 0829 US 131 NW > Kalkaska, MI 49646-0460 > > voice 231 258 4150 ext 3024 > fax 231 258 4153 From owner-fwtk-users@ex.tis.com Mon Apr 10 20:06 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA02136 Mon, 10 Apr 2000 20:06:13 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA09598; Mon, 10 Apr 2000 17:10:47 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 10 Apr 2000 16:18:19 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA04606 for fwtk-users-outgoing; Mon, 10 Apr 2000 16:18:12 -0700 (PDT) Date: Tue, 11 Apr 2000 01:16:22 +0200 From: Michael Thies To: fwtk-users@lists.nai.com Subject: ssh-gw? Message-ID: <20000411011621.G7066@thies.org> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit User-Agent: Mutt/1.0.1i Organization: IT Services - Thies X-URL: http://its-thies.net/ X-Address: Pallaswiesenstrasse 42, D-64293 Darmstadt X-Phone: +49 6151 177987 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 672 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi You all, is it possible, to leave a network protected by a tis-fw using ssh? In our company only a telnet-gw and a ftp-gw is installed. .-( And on the website http://www.tis.com/research/software/ I also didn't found anything about ssh. Maybe one of You has a solution? TiA -- \o/ Michael Thies --- michael@thies.org Das Englische ist eine einfache, aber schwere Sprache. Es besteht aus lauter Fremdwörtern, die falsch ausgesprochen werden. Peter Panter From owner-fwtk-users@ex.tis.com Mon Apr 10 22:16 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA02564 Mon, 10 Apr 2000 22:16:15 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA19038; Mon, 10 Apr 2000 19:21:31 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 10 Apr 2000 18:33:43 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA15836 for fwtk-users-outgoing; Mon, 10 Apr 2000 18:33:32 -0700 (PDT) Date: Mon, 10 Apr 2000 18:31:27 -0700 (PDT) From: Jon Christopherson To: John Armstrong cc: fwtk-users@ex.tis.com Subject: Re: smap in anti-relay mode In-Reply-To: <3.0.6.32.20000410172437.00975210@192.168.2.2> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2702 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Try adding the follwing directives to your net-perm file: smap: relay-domain foo.com *.foo.com smap: relay-domain foo1.com *.foo1.com these examples allow the smap daemon to accept email for emails in the foo.com domain, and allow users in that domain to relay. same goes for foo2. Just enter in the domains and hosts you wish to allow to relay, and wala ,, after a succesful setup you will see something like this in messages: Apr 10 18:26:41 carmen smap[284]: relay denied: to= from= host=jons.org/63.202.4.50 Hope this helps. Jon Christopherson Unix Administrator Broderbund Software jon@broder.com On Mon, 10 Apr 2000, John Armstrong wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I've managed to patch my smap.c with the yao-smap.pch changes and > recompiled. I modified netperm-table with what I thought were the > neccesary additions (appended below) and it all seems to work - except > that it is still wide open to relaying! > > I didn't add any compilation options so I'm using just the defaults. > Is that wrong - should I include them? (But where do they go in > Makefile.config?) Have I missed the plot somewhere or am I just > being (more than normally) dumb here? > > BTW am I correct in thinking that the patched smap should block > relaying on its own, even if I haven't yet beefed up sendmail? > > Thanks > > John > ====================================================================== > # smap (email) rules: > # ------------------- > #smap, smapd: userid 8 > smap, smapd: directory /var/spool/smap > smapd: executable /usr/local/etc/smapd > smapd: sendmail /usr/sbin/sendmail > smapd: wakeup 60 > smap: postmaster > smap: maxrecip 400 > smap: timeout 120 > smap: domains lrf.leeds.ac.uk *.lrf.leeds.ac.uk > smap: hosts 192.168.2.9 192.168.2.2 > smap: check-from-address 1 > smap: check-user-too 1 > __________________________________________________________________________ > John Armstrong Computer System Adminstrator > Health & Safety Officer > john@lrf.leeds.ac.uk > j.d.c.armstrong@leeds.ac.uk LRF Centre at Leeds University > 30 Hyde Terrace > 0113 233 3912 (phone) Leeds LS2 9LN > 0113 245 9806 (fax) > > > From owner-fwtk-users@ex.tis.com Mon Apr 10 22:22 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA02581 Mon, 10 Apr 2000 22:22:40 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA19375; Mon, 10 Apr 2000 19:27:56 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 10 Apr 2000 18:47:16 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA16976 for fwtk-users-outgoing; Mon, 10 Apr 2000 18:47:04 -0700 (PDT) Date: Mon, 10 Apr 2000 18:45:56 -0700 (PDT) From: Jon Christopherson To: John Armstrong cc: fwtk-users@ex.tis.com Subject: Re: smap in anti-relay mode In-Reply-To: <3.0.6.32.20000410172437.00975210@192.168.2.2> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2710 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Try adding the follwing directives to your net-perm file: smap: relay-domain foo.com *.foo.com smap: relay-domain foo1.com *.foo1.com these examples allow the smap daemon to accept email for emails in the foo.com domain, and allow users in that domain to relay. same goes for foo2. Just enter in the domains and hosts you wish to allow to relay, and wala ,, after a succesful setup you will see something like this in messages: Apr 10 18:26:41 carmen smap[284]: relay denied: to= from= host=jons.org/63.202.4.50 Hope this helps. Jon Christopherson Unix Administrator Broderbund Software jon@broder.com On Mon, 10 Apr 2000, John Armstrong wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I've managed to patch my smap.c with the yao-smap.pch changes and > recompiled. I modified netperm-table with what I thought were the > neccesary additions (appended below) and it all seems to work - except > that it is still wide open to relaying! > > I didn't add any compilation options so I'm using just the defaults. > Is that wrong - should I include them? (But where do they go in > Makefile.config?) Have I missed the plot somewhere or am I just > being (more than normally) dumb here? > > BTW am I correct in thinking that the patched smap should block > relaying on its own, even if I haven't yet beefed up sendmail? > > Thanks > > John > ====================================================================== > # smap (email) rules: > # ------------------- > #smap, smapd: userid 8 > smap, smapd: directory /var/spool/smap > smapd: executable /usr/local/etc/smapd > smapd: sendmail /usr/sbin/sendmail > smapd: wakeup 60 > smap: postmaster > smap: maxrecip 400 > smap: timeout 120 > smap: domains lrf.leeds.ac.uk *.lrf.leeds.ac.uk > smap: hosts 192.168.2.9 192.168.2.2 > smap: check-from-address 1 > smap: check-user-too 1 > __________________________________________________________________________ > John Armstrong Computer System Adminstrator > Health & Safety Officer > john@lrf.leeds.ac.uk > j.d.c.armstrong@leeds.ac.uk LRF Centre at Leeds University > 30 Hyde Terrace > 0113 233 3912 (phone) Leeds LS2 9LN > 0113 245 9806 (fax) > > > From owner-fwtk-users@ex.tis.com Mon Apr 10 23:19 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA02685 Mon, 10 Apr 2000 23:19:20 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA23642; Mon, 10 Apr 2000 20:24:40 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 10 Apr 2000 19:38:01 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA19883 for fwtk-users-outgoing; Mon, 10 Apr 2000 19:37:55 -0700 (PDT) Message-Id: <200004110234.KAA05099@servertwo.qdhaixin.com.cn> X-Authentication-Warning: servertwo.qdhaixin.com.cn: nobody set sender to using -f Date: Tue, 11 Apr 2000 10:39:20 +0800 From: wen Reply-To: wen@hisense.qd.sd.cn To: "fwtk-users@lists.nai.com" Subject: ftp-gw problem X-mailer: FoxMail 3.0 beta 2 [cn] Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 870 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hello all: I am reading ftp-gw source code.now I have some problems.please help me. when I "FTP xx.xx.xx.xx" in client machine,the prompt is "User (xx.xx.xx.xx none):". what function does the FWTK call to show the prompt? I think the FWTK call cmd_user().but I don't find this prompt. in netperm-table file I config -authall option for ftp-gw,I know when ftp-gw run,ftp-gw first call usercmd() function,then usercmd() call cmd_user() funtion,then cmd_user() call authorize() function,then authorize() call cmd_response() function. authorize() function get authname,cmd_response return response auth result.but which function shows "PASSWORD:" prompt? now I confuse the main loop of ftp-gw,plese analyze in detail. thanks. wen From owner-fwtk-users@ex.tis.com Mon Apr 10 23:32 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA02725 Mon, 10 Apr 2000 23:32:49 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA24732; Mon, 10 Apr 2000 20:38:09 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 10 Apr 2000 19:55:58 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA21205 for fwtk-users-outgoing; Mon, 10 Apr 2000 19:55:52 -0700 (PDT) Message-Id: <200004110252.KAA05292@servertwo.qdhaixin.com.cn> X-Authentication-Warning: servertwo.qdhaixin.com.cn: nobody set sender to using -f Date: Tue, 11 Apr 2000 10:57:30 +0800 From: wen Reply-To: wen@hisense.qd.sd.cn To: "fwtk-users@lists.nai.com" Subject: ftp-gw option or command X-mailer: FoxMail 3.0 beta 2 [cn] Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 645 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hello all: in ftp-gw.c,there is struct FtpOp ops[]= { "port",OP_CONN,cmd_port, "user",OP_AOK|OP_WCON,cmd_user, "retr",OP_CONN|OP_XTND,0, "stor",OP_CONN|OP_XTND,0, "pass",OP_AOK|OP_WCON,cmd_response, "cwd",OP_CONN,0, "pwd",OP_CONN,0, ; ; ; ; 0, 0, 0 }; the left line(eg:port,pass etc) is ftp-gw command or ftp-gw configure option for netperm-table? if these is ftp-gw command,why not to run after "ftp>" prompt? thanks. wen From owner-fwtk-users@ex.tis.com Mon Apr 10 23:46 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA02772 Mon, 10 Apr 2000 23:46:13 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA25719; Mon, 10 Apr 2000 20:51:34 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 10 Apr 2000 20:09:58 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id UAA22346 for fwtk-users-outgoing; Mon, 10 Apr 2000 20:09:52 -0700 (PDT) Message-Id: <200004110305.LAA05421@servertwo.qdhaixin.com.cn> X-Authentication-Warning: servertwo.qdhaixin.com.cn: nobody set sender to using -f Date: Tue, 11 Apr 2000 11:11:4 +0800 From: wen Reply-To: wen@hisense.qd.sd.cn To: "fwtk-users@lists.nai.com" Subject: ftp-gw flag X-mailer: FoxMail 3.0 beta 2 [cn] Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 286 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hello all: I don't understand OP_WCON and OP_XTND flag. what meaning are these? only "user" and "pass" command held this flag. why? thanks. wen From owner-fwtk-users@ex.tis.com Tue Apr 11 05:19 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA03815 Tue, 11 Apr 2000 05:19:53 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA08889; Tue, 11 Apr 2000 02:25:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 01:25:32 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA05478 for fwtk-users-outgoing; Tue, 11 Apr 2000 01:25:26 -0700 (PDT) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <38F2E13C.CBBD5A21@usrconsult.be> Date: Tue, 11 Apr 2000 10:24:28 +0200 From: Michel Bardiaux Organization: UsrConsult SPRL X-Mailer: Mozilla 4.5 [en] (X11; I; IRIX64 6.5 IP27) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: Re: ssh-gw? References: <20000411011621.G7066@thies.org> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2250 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Michael Thies wrote: > > > is it possible, to leave a network protected by a tis-fw using ssh? > In our company only a telnet-gw and a ftp-gw is installed. .-( > And on the website http://www.tis.com/research/software/ I also didn't > found anything about ssh. > > Maybe one of You has a solution? > * INCOMING SSH: We simply pass SSH through the FW with plug-gw, e.g.: [/etc/services] ssh 22/tcp # SSH Remote Login Protocol [/etc/inetd.conf] ssh stream tcp nowait root /usr/local/fwtk/etc/netacl ssh [/usr/local/fwtk/etc/netperm-table] netacl-ssh: permit-hosts * -exec /usr/local/fwtk/etc/plug-gw ssh plug-gw: port ssh * -plug-to aa.bb.cc.1 -port 22 (aa.bb.cc.1 is the IP address of the SSHD server on the internal net) You also have to allow SSH through whatever filtering system is used on the machine at the DMZ/intranet boundary, but that's outside FWTK. Of course, since you tunnel *any* SSH in, your SSH setup better be 'military' grade: large keys, and strict rules for public key management: long passphrase, public keys have to be carried on floppy and personnally handed to the system manager, etc... Basically, outside hosts become part of the internal net, and security policies for internal hosts must be applied to them. Even stronger policies, actually, since the outside hosts might *not* be protected by an FW. Something still worries me in that setup: what are the risks of DoS attacks on the internal net? Ideas anybody? * OUTGOING SSH We have created an extra service on the FW for every destination (including the DMZ machines). The netperm-table rules read like: netacl-ssh-XX: permit-hosts aa.bb.cc.* -exec /usr/local/fwtk/etc/plug-gw ssh-XX plug-gw: port ssh-XX aa.bb.cc.129 -privport -plug-to XX.XX.XX.XX -port PPPP (aa.bb.cc is our assigned Class-C, 129 is the IP address of the Intranet/DMZ boundary NIC) All this is IMHO, of course. Critiques welcome! Greetings. -- Michel Bardiaux From owner-fwtk-users@ex.tis.com Tue Apr 11 06:50 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA04206 Tue, 11 Apr 2000 06:50:32 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA16723; Tue, 11 Apr 2000 03:55:41 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 02:51:27 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA11066 for fwtk-users-outgoing; Tue, 11 Apr 2000 02:51:21 -0700 (PDT) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC9EA@mailserver.isolaandisola.com> From: William Jackson To: "'fwtk-users@lists.nai.com'" Subject: smap and yao antispam patch Date: Tue, 11 Apr 2000 11:52:00 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 387 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have the smap.c and yao.pdch files in the same dir using patch 2.5.4 I do: smap# patch smap.c yao-smap.pch patching file smap.c Hunk #14 FAILED at 1149. 1 out of 40 hunks FAILED -- saving rejects to file smap.c.rej any ideas?? thanks William Jackson From owner-fwtk-users@ex.tis.com Tue Apr 11 07:00 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA04269 Tue, 11 Apr 2000 07:00:57 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA18116; Tue, 11 Apr 2000 04:06:12 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 03:23:48 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA13741 for fwtk-users-outgoing; Tue, 11 Apr 2000 03:23:34 -0700 (PDT) Message-Id: <4.3.1.2.20000411061318.00c0fc90@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Tue, 11 Apr 2000 06:14:41 -0400 To: wen@hisense.qd.sd.cn, "fwtk-users@lists.nai.com" From: Rick Murphy Subject: Re: ftp-gw problem In-Reply-To: <200004110234.KAA05099@servertwo.qdhaixin.com.cn> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 506 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:39 AM 4/11/00 +0800, wen wrote: >when I "FTP xx.xx.xx.xx" in client machine,the prompt is "User >(xx.xx.xx.xx none):". > what function does the FWTK call to show the prompt? I think the FWTK > call cmd_user().but I don't find this prompt. That prompt is being issued by your ftp server (the site you're connecting to) and the ftp-gw is echoing it. -Rick From owner-fwtk-users@ex.tis.com Tue Apr 11 07:01 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA04272 Tue, 11 Apr 2000 07:01:09 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA18130; Tue, 11 Apr 2000 04:06:21 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 03:23:40 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA13730 for fwtk-users-outgoing; Tue, 11 Apr 2000 03:23:29 -0700 (PDT) Message-Id: <4.3.1.2.20000411061445.00c18640@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Tue, 11 Apr 2000 06:18:22 -0400 To: wen@hisense.qd.sd.cn, "fwtk-users@lists.nai.com" From: Rick Murphy Subject: Re: ftp-gw option or command In-Reply-To: <200004110252.KAA05292@servertwo.qdhaixin.com.cn> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 921 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:57 AM 4/11/00 +0800, wen wrote: > in ftp-gw.c,there is struct FtpOp ops[]= { >"port",OP_CONN,cmd_port, > >the left line(eg:port,pass etc) is ftp-gw command or ftp-gw configure >option for netperm-table? >if these is ftp-gw command,why not to run after "ftp>" prompt? They're FTP commands - commands that are part of the FTP protocol. They're not the same as the user commands. For example, with normal ftp if you give the 'GET a.a' command, the ftp user agent sends RETR then PORT. (I may be misremembering the order.) The options modify the requirements for a command. You've got to have a connection to an FTP server to use RETR; USER doesn't require a connection (OP_WCONN). Commands subject to extended permissions (time of day, etc.) have OP_XTND set. -Rick From owner-fwtk-users@ex.tis.com Tue Apr 11 07:07 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA04300 Tue, 11 Apr 2000 07:07:36 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA18908; Tue, 11 Apr 2000 04:12:56 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 03:31:21 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA14388 for fwtk-users-outgoing; Tue, 11 Apr 2000 03:31:16 -0700 (PDT) Message-ID: <51F024FC46C7D211880A00201888E0BA1AC9EB@mailserver.isolaandisola.com> From: William Jackson To: "'fwtk-users@lists.nai.com'" Subject: smap and yao antismap patch Date: Tue, 11 Apr 2000 12:31:53 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1371 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] sorry I fixed the last problem of patching the file as I had to use a fresh copy of smap.c but the problem at the moment is that when it tries to link the exe I get the following: smap# make cc -I.. -g -DLINUX -c smap.c -o smap.o cc -I.. -g -DLINUX -c arpadate.c -o arpadate.o cc -g -static -o smap smap.o arpadate.o ../libfwall.a smap.o: In function `from_address_ok': /usr/src/fwtk/fwtk/smap/smap.c:2015: undefined reference to `res_query' /usr/src/fwtk/fwtk/smap/smap.c:2015: undefined reference to `res_query' collect2: ld returned 1 exit status make: *** [smap] Error 1 www1:/usr/src/fwtk/fwtk/smap# I have used a fresh install of the fwtk2.1 to get this far and cannot find the functions res_query in any of the files? William Jackson MCP Technical Director Isola & Isola Email: wj@isolaandisola.com CONFIDENTIALITY NOTICE This E-mail and/or the documents accompanying are privileged and contain confidential information. If the recipient is not the addressee or the employee or agent of the addressee any unauthorised use, disclosure, copying, distribution or dissemination is strictly prohibited and in any such event please immediately notify us by telephone on 76651 and return this E-mail and destroy any copies. From owner-fwtk-users@ex.tis.com Tue Apr 11 07:26 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA04372 Tue, 11 Apr 2000 07:26:34 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA21335; Tue, 11 Apr 2000 04:31:50 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 03:48:15 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA15932 for fwtk-users-outgoing; Tue, 11 Apr 2000 03:48:03 -0700 (PDT) From: ark@eltex.ru Date: Tue, 11 Apr 2000 14:45:36 +0400 Message-Id: <200004111045.OAA04228@paranoid.eltex.spb.ru> In-Reply-To: <200004110234.KAA05099@servertwo.qdhaixin.com.cn> from "wen " Organization: "Klingon Imperial Intelligence Service" Subject: Re: ftp-gw problem To: wen@hisense.qd.sd.cn Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1677 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, wen said : > hello all: > I am reading ftp-gw source code.now I have some problems.please help me. > > when I "FTP xx.xx.xx.xx" in client machine,the prompt is "User (xx.xx.xx.xx none):". > what function does the FWTK call to show the prompt? I think the FWTK call cmd_user().but I don't find this prompt. None. This prompt is shown by ftp command. See the rfc for ftp protocol. > in netperm-table file I config -authall option for ftp-gw,I know when ftp-gw run,ftp-gw first call usercmd() function,then usercmd() call cmd_user() funtion,then cmd_user() call authorize() function,then authorize() call cmd_response() function. authorize() function get authname,cmd_response return response auth result.but which function shows "PASSWORD:" prompt? > > > now I confuse the main loop of ftp-gw,plese analyze in detail. cmd_authorize, see the "331" message being formed. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOPMCTqH/mIJW9LeBAQHZ8AP/TezFI7Z42SRLAtZwzOol4eVu4F5llEfA HoVS6H+ISQ45UMfoeA+dOVR1FxE9HzmgV5BrNN4ZPqU5Snu1NdIUIleTJ+jCbLtb QcI9C2N3wXGdnme+qnFJZNiLueF2Tcc6U5lhUCMAfMuyCY4e4X/T+4aGXfS9d0iT fpefyrk9IjA= =b6eH -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Apr 11 07:32 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA04431 Tue, 11 Apr 2000 07:32:52 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA22295; Tue, 11 Apr 2000 04:38:08 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 03:55:26 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA16681 for fwtk-users-outgoing; Tue, 11 Apr 2000 03:55:15 -0700 (PDT) From: ark@eltex.ru Date: Tue, 11 Apr 2000 14:52:36 +0400 Message-Id: <200004111052.OAA04245@paranoid.eltex.spb.ru> In-Reply-To: <200004110305.LAA05421@servertwo.qdhaixin.com.cn> from "wen " Organization: "Klingon Imperial Intelligence Service" Subject: Re: ftp-gw flag To: wen@hisense.qd.sd.cn Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1305 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, OP_WCON means there is no internal processing for this command, it is just being sent to server "as is". OP_XTND means the command is checked by authsrv for extended permission information if you enable -extnd flag. wen said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > hello all: > I don't understand OP_WCON and OP_XTND flag. what meaning are these? > only "user" and "pass" command held this flag. why? _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOPMD86H/mIJW9LeBAQGaxAP/ZlkJbeta+cDMGJkelBSmeiaJCgnAtmfw INEVlU1JuH6WoWWBQyyNAohYysz2MGXJ46Lv3cZdNaIXLD8tla1hIQP1h5g2tG7p 3W20wq/VupRrNe9VJ3eSG4N+nDIA2TMBbKW3vd/nstRt2bFYtRyWufSQx6ryWVLW G9e7xUJinlY= =uuJm -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Apr 11 07:59 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA04548 Tue, 11 Apr 2000 07:59:02 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA25874; Tue, 11 Apr 2000 05:04:11 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 04:18:00 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA19505 for fwtk-users-outgoing; Tue, 11 Apr 2000 04:17:48 -0700 (PDT) From: ark@eltex.ru Date: Tue, 11 Apr 2000 15:16:43 +0400 Message-Id: <200004111116.PAA04316@paranoid.eltex.spb.ru> In-Reply-To: <20000411011621.G7066@thies.org> from "Michael Thies " Organization: "Klingon Imperial Intelligence Service" Subject: Re: ssh-gw? To: thies@argh.org Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1303 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Michael Thies said : > is it possible, to leave a network protected by a tis-fw using ssh? > In our company only a telnet-gw and a ftp-gw is installed. .-( > And on the website http://www.tis.com/research/software/ I also didn't > found anything about ssh. > > Maybe one of You has a solution? There are several ones. I am thinking about writing new ssh-gw (my old one is damn ugly hack) but i don't have time for it now :( BTW fwtk/gauntlet comparison from the page above is long out of date in both parts.. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOPMJmaH/mIJW9LeBAQHsiwQAsPlCnoPXa7UXrncMXuqY7bLFCr8GXa85 1XAxoLM18RIDafGhCoIHgJoeLbev7H5CKrbxzqkgcEfMijHy92ee7waxRTDhWgFh qXATgGleqyucE9ZhoAp3oGo/4CQ1UM2A3fhxCnulj7wUZ2iETP8ezaMdhPU0x+vY TSDEuFZvv88= =O0YU -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Apr 11 08:08 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA04612 Tue, 11 Apr 2000 08:08:37 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA27367; Tue, 11 Apr 2000 05:13:58 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 04:30:34 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA21147 for fwtk-users-outgoing; Tue, 11 Apr 2000 04:30:27 -0700 (PDT) From: "Jean-Michel DOS SANTOS" To: Subject: How can i download FWTK ? Date: Tue, 11 Apr 2000 13:29:05 +0200 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 328 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] FTP Error Could not login to FTP server This FTP server requires the ability to perform reverse DNS lookups on all addresses connecting to it. We cannot perform this on the current connection. From owner-fwtk-users@ex.tis.com Tue Apr 11 09:14 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA04887 Tue, 11 Apr 2000 09:14:58 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA08871; Tue, 11 Apr 2000 06:20:12 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 05:34:50 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA29347 for fwtk-users-outgoing; Tue, 11 Apr 2000 05:34:44 -0700 (PDT) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <38F31B9B.6D517941@usrconsult.be> Date: Tue, 11 Apr 2000 14:33:31 +0200 From: Michel Bardiaux Organization: UsrConsult SPRL X-Mailer: Mozilla 4.5 [en] (X11; I; IRIX64 6.5 IP27) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: Re: ssh-gw? References: <200004111116.PAA04316@paranoid.eltex.spb.ru> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1265 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] ark@eltex.ru wrote: > > nuqneH, > > Michael Thies said : > > > is it possible, to leave a network protected by a tis-fw using ssh? > > In our company only a telnet-gw and a ftp-gw is installed. .-( > > And on the website http://www.tis.com/research/software/ I also didn't > > found anything about ssh. > > > > Maybe one of You has a solution? > > There are several ones. I am thinking about writing new ssh-gw (my old > one is damn ugly hack) but i don't have time for it now :( > > BTW fwtk/gauntlet comparison from the page above is long out of date in > both parts.. > As you can see from my own reply to the OPs query, we use SSH a lot, so I'm quite interested. So lotsa questions... - I thought an ssh-gw was in principle impossible since the session is supposed to be encrypted so totally opaque. - What are the advantages of an ssh-gw over plain good old plug-gw? - Can you give me an URL for the code, or mail it to me? - Any critiques on my previous reply to the OP? TIA. -- Michel Bardiaux UsrConsult S.P.R.L. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 From owner-fwtk-users@ex.tis.com Tue Apr 11 09:15 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA04891 Tue, 11 Apr 2000 09:15:01 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA08885; Tue, 11 Apr 2000 06:20:11 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 05:30:08 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA28943 for fwtk-users-outgoing; Tue, 11 Apr 2000 05:29:57 -0700 (PDT) From: ark@eltex.ru Date: Tue, 11 Apr 2000 16:28:42 +0400 Message-Id: <200004111228.QAA04499@paranoid.eltex.spb.ru> In-Reply-To: <4.3.1.2.20000411061318.00c0fc90@mail.itm-inst.com> from "Rick Murphy " Organization: "Klingon Imperial Intelligence Service" Subject: Re: ftp-gw problem To: rmurphy@itm-inst.com Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1290 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Nope ;) Server just gives 220 greeting message, the username prompt is generated by ftp client. Rick Murphy said : > At 10:39 AM 4/11/00 +0800, wen wrote: > >when I "FTP xx.xx.xx.xx" in client machine,the prompt is "User > >(xx.xx.xx.xx none):". > > what function does the FWTK call to show the prompt? I think the FWTK > > call cmd_user().but I don't find this prompt. > > That prompt is being issued by your ftp server (the site you're connecting > to) and the ftp-gw is echoing it. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOPMaeKH/mIJW9LeBAQFwUgP9EdCQhD+5RyfvFub3TFM0n/AV1Mri0QRW xwbCbS4OjVudr8k4lbOOdtDxHrvFkv3/bxsS4J/vsYjBPuYTJXdPbgPhTRUelR4Z LD6sjqcCkn7EgIs4cbaUgZXGiTpHiqsHzhwAju4FP7M4VIx7WFG6VSFj47L41Nu2 CgH3pmYlwZY= =Bxnz -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Apr 11 09:15 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA04896 Tue, 11 Apr 2000 09:15:03 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA08877; Tue, 11 Apr 2000 06:20:12 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 05:35:35 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA29457 for fwtk-users-outgoing; Tue, 11 Apr 2000 05:35:19 -0700 (PDT) Message-ID: <38F2B482.B37E0496@yahoo.com> Date: Tue, 11 Apr 2000 10:43:38 +0530 From: Naresh Narang X-Mailer: Mozilla 4.61 [en] (Win95; I) X-Accept-Language: en MIME-Version: 1.0 To: John Armstrong , "fwtk-users@ex.tis.com" Subject: Re: smap in anti-relay mode References: <3.0.6.32.20000410172437.00975210@192.168.2.2> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2118 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] If I remember correctly, I believe the line should be: smap: relay-domain domain.com NKN John Armstrong wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I've managed to patch my smap.c with the yao-smap.pch changes and > recompiled. I modified netperm-table with what I thought were the > neccesary additions (appended below) and it all seems to work - except > that it is still wide open to relaying! > > I didn't add any compilation options so I'm using just the defaults. > Is that wrong - should I include them? (But where do they go in > Makefile.config?) Have I missed the plot somewhere or am I just > being (more than normally) dumb here? > > BTW am I correct in thinking that the patched smap should block > relaying on its own, even if I haven't yet beefed up sendmail? > > Thanks > > John > ====================================================================== > # smap (email) rules: > # ------------------- > #smap, smapd: userid 8 > smap, smapd: directory /var/spool/smap > smapd: executable /usr/local/etc/smapd > smapd: sendmail /usr/sbin/sendmail > smapd: wakeup 60 > smap: postmaster > smap: maxrecip 400 > smap: timeout 120 > smap: domains lrf.leeds.ac.uk *.lrf.leeds.ac.uk > smap: hosts 192.168.2.9 192.168.2.2 > smap: check-from-address 1 > smap: check-user-too 1 > __________________________________________________________________________ > John Armstrong Computer System Adminstrator > Health & Safety Officer > john@lrf.leeds.ac.uk > j.d.c.armstrong@leeds.ac.uk LRF Centre at Leeds University > 30 Hyde Terrace > 0113 233 3912 (phone) Leeds LS2 9LN > 0113 245 9806 (fax) -- - Naresh Narang From owner-fwtk-users@ex.tis.com Tue Apr 11 09:15 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA04902 Tue, 11 Apr 2000 09:15:06 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA08883; Tue, 11 Apr 2000 06:20:11 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 05:36:34 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA29629 for fwtk-users-outgoing; Tue, 11 Apr 2000 05:36:22 -0700 (PDT) From: ark@eltex.ru Date: Tue, 11 Apr 2000 14:47:09 +0400 Message-Id: <200004111047.OAA04232@paranoid.eltex.spb.ru> In-Reply-To: <200004110252.KAA05292@servertwo.qdhaixin.com.cn> from "wen " Organization: "Klingon Imperial Intelligence Service" Subject: Re: ftp-gw option or command To: wen@hisense.qd.sd.cn Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1559 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, wen said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > hello all: > in ftp-gw.c,there is struct FtpOp ops[]= { > "port",OP_CONN,cmd_port, > "user",OP_AOK|OP_WCON,cmd_user, > "retr",OP_CONN|OP_XTND,0, > "stor",OP_CONN|OP_XTND,0, > "pass",OP_AOK|OP_WCON,cmd_response, > "cwd",OP_CONN,0, > "pwd",OP_CONN,0, > > ; > ; > ; > ; > 0, 0, 0 > }; > > the left line(eg:port,pass etc) is ftp-gw command or ftp-gw configure option for netperm-table? ftp-gw command. > if these is ftp-gw command,why not to run after "ftp>" prompt? ? it is the command ftp client sends to a server or ftp-gw. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOPMCraH/mIJW9LeBAQHw8QP5AUGac8Krgm6QE1VN/tsN4kup5lXKmVBb taos3OS4kio1pCvsJI5IgYW5x0QjrNlWj4EWtl+a1OUgTS9c6T5ToiOHc4e2avDR lcBfvFzQ0TKRK+vxTjlBXAu7jCtr8m6sLq2wcmDk4iWrMdmRyLo5+WHgnO1Oib0p c+HsNazgrsU= =IFcU -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Apr 11 11:24 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA05436 Tue, 11 Apr 2000 11:24:20 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA02198; Tue, 11 Apr 2000 08:30:06 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 07:46:37 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA24316 for fwtk-users-outgoing; Tue, 11 Apr 2000 07:46:25 -0700 (PDT) From: ark@eltex.ru Date: Tue, 11 Apr 2000 18:44:38 +0400 Message-Id: <200004111444.SAA04885@paranoid.eltex.spb.ru> In-Reply-To: <38F31B9B.6D517941@usrconsult.be> from "Michel Bardiaux " Organization: "Klingon Imperial Intelligence Service" Subject: Re: ssh-gw? To: mbardiaux@usrconsult.be Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 2334 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Michel Bardiaux said : > > Michael Thies said : > > > > > is it possible, to leave a network protected by a tis-fw using ssh? > > > In our company only a telnet-gw and a ftp-gw is installed. .-( > > > And on the website http://www.tis.com/research/software/ I also didn't > > > found anything about ssh. > > > > > > Maybe one of You has a solution? > > > > There are several ones. I am thinking about writing new ssh-gw (my old > > one is damn ugly hack) but i don't have time for it now :( > > > > BTW fwtk/gauntlet comparison from the page above is long out of date in > > both parts.. > > > As you can see from my own reply to the OPs query, we use SSH a lot, so > I'm > quite interested. So lotsa questions... > > - I thought an ssh-gw was in principle impossible since the session is > supposed > to be encrypted so totally opaque. So firewall has to know how to decrypt both ends and perform some kind of key spoofing. Some people consider that as bad idea, but it is useful sometimes. > - What are the advantages of an ssh-gw over plain good old > plug-gw? More flexibility and ease of use. plug-gw has fixed end-to-end configuration, that means you can ssh to just one server outside and to just one server inside or play with port numbers. > - Can you give me an URL for the code, or mail it to me? The hack i was talking about was created to accept incoming ssh connections and pass them via telnet to a trusted LAN. There was a thing that looked more like ssh proxy, posted here on the list. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOPM6VKH/mIJW9LeBAQFUVQP/QPwGyUKFVZhLA5NtDaUzkP0dn8fzhDjE gza3nvynSEOvC+fCOMdxEZCI6ULQjL93QGWUWFK13Pett+gacY6zW532zniOYlAP 4DR6t6Y+K6z+1ino8kr9novFJxOjcfVgGoAZ7od16RR2b5LpChyjVUPH9DqgneU+ yAEvEACqLYU= =KtNt -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Apr 11 11:24 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA05437 Tue, 11 Apr 2000 11:24:25 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA02204; Tue, 11 Apr 2000 08:30:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 07:38:20 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA23115 for fwtk-users-outgoing; Tue, 11 Apr 2000 07:38:09 -0700 (PDT) Message-Id: <3.0.3.32.20000411083120.007138e4@mail.denver.gd-is.com> X-Sender: dsmith@mail.denver.gd-is.com X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) Date: Tue, 11 Apr 2000 08:31:20 -0600 To: wen@hisense.qd.sd.cn From: Donald J Smith Subject: Re: Re: test fwtk to get maximal connection number that fwtk can support Cc: fwtk-users@lists.nai.com In-Reply-To: <200004090050.IAA01044@servertwo.qdhaixin.com.cn> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 1816 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 08:55 AM 4/9/00 +0800, wen wrote: >Donald J Smith: > thanks for your answer. > connection that I said is : when some people use IE to browser internet at the same time,maybe one opens two or more IE widow,I think a IE window is a internet connection.if I take ftp or smtp connection into account consider. how many connection can the FWTK support? > now my OS is redhat6.1.hardware is :PII400,64M RAM.how to test to get maxize connection number? please in detail. try top -p pid_of_http_gw this will moniter the http_gw and it's children. Then run 5 - 10 (or 100;-) IE's and see how of a load each process adds. I have run more than 100 http gets thru a much weaker box. It had the same amount of memory but only a P5-166MHZ. The users weren't bogged down until we saturated the T1 NOT THE FIREWALL. Filling the T1 required only about 10 users all trying to get a 100MB software upgrade at the same time (more or less). > > thanks. > > ------------------------------------------------------------------------------ Don Smith General Dynamics Information Systems Systems Administrator 8005 South Chester St EngleWood, Co. 80112 Phone (303) 649-7554 FAX (303) 649-7504 donald.j.smith@gd-is.com Error msgs that I love: "Keyboard not found press F1 to continue" (pc bios) "Harddrive controller failure insert new disk and press any key to continue" (pc bios) "The disk is write protected Remove the write protect or use another disk." (nt) User must change his password before he logs in the first time. (nt) ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Tue Apr 11 11:31 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA05461 Tue, 11 Apr 2000 11:31:32 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA03329; Tue, 11 Apr 2000 08:37:20 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 07:54:12 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA25397 for fwtk-users-outgoing; Tue, 11 Apr 2000 07:53:59 -0700 (PDT) Date: Tue, 11 Apr 2000 10:53:25 -0400 From: Joseph S D Yao To: William Jackson Cc: "'fwtk-users@lists.nai.com'" Subject: Re: smap and yao antismap patch Message-Id: <20000411105325.E2966@washington.cospo.osis.gov> Mail-Followup-To: William Jackson , "'fwtk-users@lists.nai.com'" References: <51F024FC46C7D211880A00201888E0BA1AC9EB@mailserver.isolaandisola.com> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <51F024FC46C7D211880A00201888E0BA1AC9EB@mailserver.isolaandisola.com>; from wj@isolaandisola.com on Tue, Apr 11, 2000 at 12:31:53PM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 380 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -lres [resolver library] -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Tue Apr 11 14:22 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA06073 Tue, 11 Apr 2000 14:22:05 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA28326; Tue, 11 Apr 2000 11:27:53 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 10:37:40 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA21255 for fwtk-users-outgoing; Tue, 11 Apr 2000 10:37:28 -0700 (PDT) Date: Mon, 10 Apr 2000 10:13:19 -0700 From: Bill Kocik Subject: Re: How can i download FWTK ? To: Jean-Michel DOS SANTOS Cc: fwtk-users@lists.nai.com Message-id: <38F20BAF.6D8CF509@velocityhsi.com> MIME-version: 1.0 X-Mailer: Mozilla 4.7 [en] (X11; I; Linux 2.2.14 i586) Content-transfer-encoding: 7bit X-Accept-Language: en References: Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 673 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > This FTP server requires the ability to perform reverse DNS lookups on all > addresses connecting to it. We cannot perform this on the current > connection. TIS doesn't allow logins to the FTP server from IP addresses that it cannot look up. You're going to have to use a connection from an IP address that can be resolved to a hostname via DNS in order to download FWTK. If you have a Systems Administrator, try asking him/her about it. -- Bill Kocik Taos Mountain - "The Sys Admin Company" Santa Clara, California http://www.taos.com From owner-fwtk-users@ex.tis.com Tue Apr 11 14:26 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA06083 Tue, 11 Apr 2000 14:26:36 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA28875; Tue, 11 Apr 2000 11:32:25 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 10:50:36 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA23081 for fwtk-users-outgoing; Tue, 11 Apr 2000 10:50:30 -0700 (PDT) Message-ID: <38F365B5.A8BBA87F@lynx.com> Date: Tue, 11 Apr 2000 10:49:41 -0700 From: "H.T. Sun" Organization: Lynx Real-Time Systems, Inc. X-Mailer: Mozilla 4.7 [en] (X11; U; Linux 2.2.12-20 i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: problem with authsrv Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=big5 Content-Length: 358 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I have successfully compiled authsrv on linux. But when I tried to use authsrv by typing "authsrv" at the prompt, it spits out this error message: Database not configured What did I do wrong ? Thanks a lot From owner-fwtk-users@ex.tis.com Tue Apr 11 16:11 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA06456 Tue, 11 Apr 2000 16:11:34 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA12099; Tue, 11 Apr 2000 13:17:23 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 12:28:30 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA06448 for fwtk-users-outgoing; Tue, 11 Apr 2000 12:28:24 -0700 (PDT) Message-Id: <4.2.0.58.20000411152117.009952c0@192.48.2.254> X-Sender: crsfajmg@192.48.2.254 X-Mailer: QUALCOMM Windows Eudora Pro Version 4.2.0.58 Date: Tue, 11 Apr 2000 15:25:52 -0400 To: fwtk-users@lists.nai.com From: Jean-Martin Guay Subject: What if i change eth1 ip Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 494 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi everyopne, Can you tell me if i need to recompile the toolkit if i change the ip adress of the in side of my FW ( eth1) I'm guessing yes, or maybe i could just change some switches. I tried it and the http-gw that worked fine with the old ip stoped working with the new ip. Naturally i took care of chaging the settings in netperm-table. AtDhVaAnNkCsE JM From owner-fwtk-users@ex.tis.com Tue Apr 11 18:53 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA06779 Tue, 11 Apr 2000 18:53:41 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA05540; Tue, 11 Apr 2000 15:59:31 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 15:07:12 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA00450 for fwtk-users-outgoing; Tue, 11 Apr 2000 15:07:01 -0700 (PDT) Date: Tue, 11 Apr 2000 18:05:51 -0400 From: Joseph S D Yao To: Naresh Narang Cc: "fwtk-users@ex.tis.com" Subject: Re: Yao Patch Message-Id: <20000411180550.W2966@washington.cospo.osis.gov> Mail-Followup-To: Naresh Narang , "fwtk-users@ex.tis.com" References: <38BF50F1.CDCEB030@air.org.in> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <38BF50F1.CDCEB030@air.org.in>; from nkn@air.org.in on Fri, Mar 03, 2000 at 11:13:13AM +0530 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 824 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Mar 03, 2000 at 11:13:13AM +0530, Naresh Narang wrote: > Where from can I get yao patch for smap to stop spam? > > Thanks > N. K. narang I hope that you have already been told to go to . I should make it clear that I gathered together existing patches, debugged them, and commented them. I did not do all of the massive work in those patches! But at least the comments now tell you what they're for and how to use them. ;-) -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Tue Apr 11 18:53 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA06780 Tue, 11 Apr 2000 18:53:44 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA05544; Tue, 11 Apr 2000 15:59:34 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 11 Apr 2000 15:16:17 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA01197 for fwtk-users-outgoing; Tue, 11 Apr 2000 15:16:07 -0700 (PDT) Message-ID: <38F3A3B7.E823691A@v-one.com> Date: Tue, 11 Apr 2000 18:14:15 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.72 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Jean-Martin Guay CC: fwtk-users@lists.nai.com Subject: Re: What if i change eth1 ip References: <4.2.0.58.20000411152117.009952c0@192.48.2.254> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 536 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Jean-Martin Guay wrote: > > Hi everyopne, > > Can you tell me if i need to recompile the toolkit if i change the ip > adress of the in side of my FW ( > eth1) Nope. Since FWTK is just a simple application, you can use any IP address that you want. Just make sure that you change your firewall rules, DNS, and routing. -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Wed Apr 12 10:09 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA10195 Wed, 12 Apr 2000 10:09:11 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA28250; Wed, 12 Apr 2000 07:14:51 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 12 Apr 2000 05:53:54 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA18514 for fwtk-users-outgoing; Wed, 12 Apr 2000 05:53:48 -0700 (PDT) Message-ID: <20000411214005.27851.qmail@web3002.mail.yahoo.com> Date: Tue, 11 Apr 2000 16:40:05 -0500 (CDT) From: =?iso-8859-1?q?sergio=20jimenez?= Subject: x-gw To: fwtk-users@ex.tis.com MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 365 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, how I configureted my x-gw or where is documentation on this, thanks. _________________________________________________________ Do You Yahoo!? Obtenga su direcciÛn de correo-e gratis @yahoo.com en http://correo.espanol.yahoo.com From owner-fwtk-users@ex.tis.com Wed Apr 12 10:09 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA10196 Wed, 12 Apr 2000 10:09:13 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA28246; Wed, 12 Apr 2000 07:14:50 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 12 Apr 2000 05:54:54 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA18636 for fwtk-users-outgoing; Wed, 12 Apr 2000 05:54:48 -0700 (PDT) From: "tuxiaokun" To: Subject: How can I integrate fwtk with ipsec? Date: Wed, 12 Apr 2000 18:37:33 +0800 Message-ID: MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by relay2.nai.com id DAA12717 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="gb2312" Content-Length: 421 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I'm thinking about integrate fwtk with ipsec.But from the document I get ,the ipsec (FreeS/WAN) must set the pocket foward on.And the ipsec uses UDP 500 ,ESP 50,AH 51 to communicate.If I set pocket foward on,would this compromise the security of fwtk ? Any help will be appreciated. From owner-fwtk-users@ex.tis.com Thu Apr 13 19:09 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA17487 Thu, 13 Apr 2000 19:09:01 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA18187; Thu, 13 Apr 2000 16:14:47 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 13 Apr 2000 14:50:59 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA09610 for fwtk-users-outgoing; Thu, 13 Apr 2000 14:50:48 -0700 (PDT) Date: Thu, 13 Apr 2000 17:49:51 -0400 From: Joseph S D Yao To: "Ronald J. Yacketta" Cc: "Firewall Toolkit (M-list)" Subject: Re: ftp-gw + ncftpd Message-Id: <20000413174951.P21468@washington.cospo.osis.gov> Mail-Followup-To: "Ronald J. Yacketta" , "Firewall Toolkit (M-list)" References: <38C32472.878C6AA4@rochester.rr.com> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <38C32472.878C6AA4@rochester.rr.com>; from ryacket1@rochester.rr.com on Sun, Mar 05, 2000 at 10:22:26PM -0500 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 803 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] You shouldn't run the FTP daemon and the FTP gateway on the same machine. It doesn't make sense, anyway. How can the daemon be "behind" the gateway if it's on the same machine? Even if you change ports, which would allow this configuration, intruders can access those ports. So you switch to TCP wrappers, and they spoof an address, and ... Better to have your services truly behind the gateway on a separate machine than out on the Internet. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Thu Apr 13 19:26 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA17532 Thu, 13 Apr 2000 19:25:49 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA19622; Thu, 13 Apr 2000 16:31:40 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 13 Apr 2000 15:48:07 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA15846 for fwtk-users-outgoing; Thu, 13 Apr 2000 15:47:51 -0700 (PDT) MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Message-ID: <14582.20034.485685.389875@taltos.tla.org> Date: Thu, 13 Apr 2000 18:46:26 -0400 (EDT) From: carson@tla.org To: Joseph S D Yao Cc: "Ronald J. Yacketta" , "Firewall Toolkit (M-list)" Subject: Re: ftp-gw + ncftpd In-Reply-To: <20000413174951.P21468@washington.cospo.osis.gov> References: <38C32472.878C6AA4@rochester.rr.com> <20000413174951.P21468@washington.cospo.osis.gov> X-Mailer: VM 6.62 under 20.0 XEmacs Lucid (beta28) Reply-To: carson@tla.org Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1932 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] >>>>> "Joseph" == Joseph S D Yao writes: Joseph> You shouldn't run the FTP daemon and the FTP gateway on the same Joseph> machine. It doesn't make sense, anyway. How can the daemon be Joseph> "behind" the gateway if it's on the same machine? Even if you change Joseph> ports, which would allow this configuration, intruders can access those Joseph> ports. So you switch to TCP wrappers, and they spoof an address, and Joseph> ... Better to have your services truly behind the gateway on a Joseph> separate machine than out on the Internet. While I agree that having it on a separate machine is "better" in some environments, you _can_ have them on the same box. A simple example: Server has 1 physical interface: hme0: 10.1.1.1 ftpd is configured to only listen on the loopback interface (127.0.0.1). ftp-gw is configured to only listen on 10.1.1.1:21, and hand off all connections to 127.0.0.1:21. Th box is running a packet filter to be extra sure that nobody off the box can talk to 127.0.0.1. You now have your FTP server protected by ftp-gw. This is a good thing, even for your internal FTP servers. Hmmm... connection hand-off is in the toolkit ftp-gw, isn't it? I've been staring at Gauntlet source so much lately, I forget. If not, it's trivial to add. If you also need to do proxying to other machines on the same box, the easiest way is to have a second ftp-gw on a virtual address. I'm not sure how the toolkit transparancy patches work - it should be a trivial source modification to do handoff for a local dest IP, and normal proxying for everything else, if such functionality doesn't already exist. -- Carson Gaspar -- carson@tla.org carson@cs.columbia.edu carson@cugc.org http://www.cs.columbia.edu/~carson/home.html Queen Trapped in a Butch Body From owner-fwtk-users@ex.tis.com Thu Apr 13 19:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA17560 Thu, 13 Apr 2000 19:37:59 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA20929; Thu, 13 Apr 2000 16:43:51 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 13 Apr 2000 16:01:09 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA17003 for fwtk-users-outgoing; Thu, 13 Apr 2000 16:00:52 -0700 (PDT) Date: Thu, 13 Apr 2000 18:59:38 -0400 From: Joseph S D Yao To: carson@tla.org Cc: "Ronald J. Yacketta" , "Firewall Toolkit (M-list)" Subject: Re: ftp-gw + ncftpd Message-Id: <20000413185938.R21468@washington.cospo.osis.gov> Mail-Followup-To: carson@tla.org, "Ronald J. Yacketta" , "Firewall Toolkit (M-list)" References: <38C32472.878C6AA4@rochester.rr.com> <20000413174951.P21468@washington.cospo.osis.gov> <14582.20034.485685.389875@taltos.tla.org> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <14582.20034.485685.389875@taltos.tla.org>; from carson@tla.org on Thu, Apr 13, 2000 at 06:46:26PM -0400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 735 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Thu, Apr 13, 2000 at 06:46:26PM -0400, carson@tla.org wrote: ... > While I agree that having it on a separate machine is "better" in some > environments, you _can_ have them on the same box. A simple example: Of course, true. Which is why I went back and changed "can't" [written in righteous fervor but misinterpretable] to "shouldn't" [clearly also misinterpretable]. ;-) -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Apr 14 05:51 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA19299 Fri, 14 Apr 2000 05:51:20 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA29487; Fri, 14 Apr 2000 02:57:01 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 14 Apr 2000 01:52:13 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA11804 for fwtk-users-outgoing; Fri, 14 Apr 2000 01:52:07 -0700 (PDT) Message-ID: <200004141349240410.0011F73B@mail.wol.net.pk> X-Mailer: Calypso Version 3.00.03.02 (3) Date: Fri, 14 Apr 2000 13:49:24 +0500 From: "}{ce||enT" To: fwtk-users@lists.nai.com Subject: FTP from browser Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="=====_95570216441=_" Content-Length: 1395 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --=====_95570216441=_ Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable Hi... I have configured FWTK's FTP-gw and works fine with dos prompt but when i= do FTP from web browser it says U dont have permission to access this= site. Normally when i DO ftp From other machine whose gateway is different , it= works fine ... Can any one tell me what should i do ??? xcelent --=====_95570216441=_ Content-Type: text/html; charset="us-ascii"
Hi...
 
I have configured FWTK's FTP-gw and works fine with dos prompt but when i do FTP from web browser it says U dont have permission to access this site.
 
Normally when i DO ftp From other machine whose gateway is different , it works fine ...
 
Can any one tell me what should i do ???
 
xcelent
--=====_95570216441=_-- From owner-fwtk-users@ex.tis.com Fri Apr 14 11:12 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA20339 Fri, 14 Apr 2000 11:12:27 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA27748; Fri, 14 Apr 2000 08:18:03 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 14 Apr 2000 07:23:17 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA18576 for fwtk-users-outgoing; Fri, 14 Apr 2000 07:23:06 -0700 (PDT) Reply-To: From: "Henry Wong" To: "'}{ce||enT'" , Subject: RE: FTP from browser Date: Fri, 14 Apr 2000 10:22:58 -0400 Message-ID: <000201bfa61c$eebeccc0$0bc810ac@local.hooloo.com> MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2911.0) In-Reply-To: <200004141349240410.0011F73B@mail.wol.net.pk> Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="----=_NextPart_000_0003_01BFA5FB.67AD2CC0" Content-Length: 12767 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. ------=_NextPart_000_0003_01BFA5FB.67AD2CC0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit What browser are you using? Usually, proxy server doesn’t work well with active ftp connection. You have to tell the browser to use passive mode on all ftp connection. On IE 5, go to Internet Options and click Advanced tab. Uncheck Enable folder view for FTP sites and click OK to save it. Restart IE 5 and that should fix it. Other browsers, you have to figure it yourself, sorry. Hope this will help. Good Luck! Henry Wong System Administrator hooloo.com, Inc. hwong@hooloo.com ***************************************** hooloo.com is the largest Internet superstore, offering books, music and other consumer products to global Chinese markets. Please visit our website: www.hooloo.com ****************************************** -----Original Message----- From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On Behalf Of }{ce||enT Sent: Friday, April 14, 2000 4:49 AM To: fwtk-users@lists.nai.com Subject: FTP from browser Hi... I have configured FWTK's FTP-gw and works fine with dos prompt but when i do FTP from web browser it says U dont have permission to access this site. Normally when i DO ftp From other machine whose gateway is different , it works fine ... Can any one tell me what should i do ??? xcelent ------=_NextPart_000_0003_01BFA5FB.67AD2CC0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Wh= at browser are you using?  = Usually, proxy server doesn’t work well with active ftp connection.  You have to tell the browser = to use passive mode on all ftp connection.  On IE 5, go to Internet Options and click Advanced tab.  Uncheck Enable folder view for = FTP sites and click OK to save it.  Restart IE 5 and that should fix it.  Other browsers, you have to figure it yourself, = sorry.

 

Ho= pe this will help.

 

Go= od Luck!

 

Henry = Wong

System = Administrator

hooloo.com, Inc. =

hwong@hooloo.com

 

********************************= *********

hooloo.com is the largest = Internet superstore,

offering books, music and other = consumer products

to global Chinese markets. = Please visit our website:

 

          www.hooloo.com

 

********************************= **********

<= span class=3DEmailStyle15> 

-----Original Message-----
From: = owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On Behalf Of }{ce||enT
Sent: Friday, April 14, = 2000 4:49 AM
To: = fwtk-users@lists.nai.com
Subject: FTP from = browser

 

Hi...

 

I have = configured FWTK's FTP-gw and works fine with dos prompt but when i do FTP from web = browser it says U dont have permission to access this site. =

 

Normally = when i DO ftp From other machine whose gateway is different , it works fine = ...

 

Can any = one tell me what should i do ???

 

xcelent

------=_NextPart_000_0003_01BFA5FB.67AD2CC0-- From owner-fwtk-users@ex.tis.com Fri Apr 14 16:42 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA21021 Fri, 14 Apr 2000 16:42:39 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA14608; Fri, 14 Apr 2000 10:23:04 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 14 Apr 2000 09:30:36 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA07768 for fwtk-users-outgoing; Fri, 14 Apr 2000 09:30:25 -0700 (PDT) Date: Fri, 14 Apr 2000 12:29:51 -0400 From: Joseph S D Yao To: }{ce||enT Cc: fwtk-users@lists.nai.com Subject: Re: FTP from browser Message-Id: <20000414122951.Q29615@washington.cospo.osis.gov> Mail-Followup-To: }{ce||enT , fwtk-users@lists.nai.com References: <200004141349240410.0011F73B@mail.wol.net.pk> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <200004141349240410.0011F73B@mail.wol.net.pk>; from xcelent@wol.net.pk on Fri, Apr 14, 2000 at 01:49:24PM +0500 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 978 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Apr 14, 2000 at 01:49:24PM +0500, }{ce||enT wrote: > Hi... > > I have configured FWTK's FTP-gw and works fine with dos prompt but when i do FTP from web browser it says U dont have permission to access this site. > > Normally when i DO ftp From other machine whose gateway is different , it works fine ... > > Can any one tell me what should i do ??? > > xcelent FTP from a Web browser does NOT use ftp-gw. It uses http-gw. Make sure that you are running http-gw on port 80 on your bastion host. Configure your browser to use your bastion host on port 80 for HTTP, HTTPS ["Security"], FTP, and also Gopher. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Sat Apr 15 12:41 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA23952 Sat, 15 Apr 2000 12:41:49 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA07688; Sat, 15 Apr 2000 09:47:34 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 15 Apr 2000 08:24:13 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA05932 for fwtk-users-outgoing; Sat, 15 Apr 2000 08:24:08 -0700 (PDT) Message-Id: <200004151523.IAA05921@relay2.nai.com> Comments: Authenticated sender is From: "Ronaldo Miranda" Organization: ISP - Internet Solution Provider To: fwtk-users@lists.nai.com Date: Sun, 16 Apr 2000 12:25:13 -3:00 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: linux+fwtk Reply-to: rmiranda@isp.com.br X-mailer: Pegasus Mail for Win32 (v2.42) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 666 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I'm trying to install fwtk on linux Kernel 2.0.36. When I do 'make' I receive the following erro msg. -------- cc -g -o x-gw x-gw.o ulib.a ../libfwall.a -L/usr/X11/lib -lXaw -lXmu -lXt -lXex t -lX11 -lc ld: cannot open -lXaw: No such file or directory make[1]: *** [x-gw] Error 1 -------- any help/comments will be welcome. tia Att, ________________________________________________________________ Ronaldo Miranda DiviNet/ISP - internet Solution Provider rmiranda@isp.com.br www.isp.com.br (37) 222-8870 (37) 9102-6102 From owner-fwtk-users@ex.tis.com Sat Apr 15 13:06 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA24041 Sat, 15 Apr 2000 13:06:20 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA08440; Sat, 15 Apr 2000 10:12:14 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 15 Apr 2000 09:30:06 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA07111 for fwtk-users-outgoing; Sat, 15 Apr 2000 09:29:55 -0700 (PDT) Date: Sat, 15 Apr 2000 12:28:38 -0400 (EDT) From: Ted Keller To: Ronaldo Miranda cc: fwtk-users@lists.nai.com Subject: Re: linux+fwtk In-Reply-To: <200004151523.IAA05921@relay2.nai.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1030 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Ronaldo, Looks like it can't find the X libraries. If you don't plan on running x-gw, you can remove it from the make file. ted keller On Sun, 16 Apr 2000, Ronaldo Miranda wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > I'm trying to install fwtk on linux Kernel 2.0.36. When I do 'make' I > receive the following erro msg. > -------- > cc -g -o x-gw x-gw.o ulib.a ../libfwall.a -L/usr/X11/lib -lXaw -lXmu > -lXt -lXex t -lX11 -lc ld: cannot open -lXaw: No such file or > directory make[1]: *** [x-gw] Error 1 > -------- > > any help/comments will be welcome. > > tia > Att, > > ________________________________________________________________ > Ronaldo Miranda > DiviNet/ISP - internet Solution Provider > rmiranda@isp.com.br www.isp.com.br > (37) 222-8870 (37) 9102-6102 > From owner-fwtk-users@ex.tis.com Sun Apr 16 21:28 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA28575 Sun, 16 Apr 2000 21:28:35 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA29932; Sun, 16 Apr 2000 18:34:12 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 16 Apr 2000 17:10:44 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA27055 for fwtk-users-outgoing; Sun, 16 Apr 2000 17:10:39 -0700 (PDT) Message-ID: From: Barganski Peter To: "'fwtk-users@lists.nai.com'" Subject: FWTK To Hard to Compile if your not a Programmer!! Date: Mon, 17 Apr 2000 10:09:26 +1000 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.10) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 777 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am running a RedHat Linux 6.1 server and get the following error upon compile of fwtk:- Makefile: 16: *** missing separator. Stop. Does anyone know what this means? It would be great if there was a configure script which took care of all the system dependant configurations with in the Makefile and others configs. I found a lot of this stuff very confusing as I'm not a programmer and don't have the resources or time to learn about it. I just want to install fwtk. Can anyone help? Peter Barganski Systems Engineer/Consultant Nuance Global Traders Australia email: pbarganski@nuancegt.com From owner-fwtk-users@ex.tis.com Sun Apr 16 23:04 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA28817 Sun, 16 Apr 2000 23:04:43 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA04022; Sun, 16 Apr 2000 20:10:40 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 16 Apr 2000 19:23:57 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA01613 for fwtk-users-outgoing; Sun, 16 Apr 2000 19:23:46 -0700 (PDT) Message-Id: <4.3.1.2.20000416220405.00c0def0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Sun, 16 Apr 2000 22:09:49 -0400 To: Barganski Peter , "'fwtk-users@lists.nai.com'" From: Rick Murphy Subject: Re: FWTK To Hard to Compile if your not a Programmer!! In-Reply-To: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 727 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:09 AM 4/17/00 +1000, Barganski Peter wrote: >Makefile: 16: *** missing separator. Stop. > >Does anyone know what this means? You probably ran fixmake; that probably means you either didn't read the README, or you don't know that Linux is not BSD. Use 'fixmake unfix' to undo the damage. Yes, FWTK requires a knowledgeable UNIX system administrator to install (see the README) because by itself it's not enough to be a complete firewall. You can too easily misconfigure things if you don't understand what protections FWTK provides and what you're expected to provide. -Rick From owner-fwtk-users@ex.tis.com Sun Apr 16 23:08 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA28821 Sun, 16 Apr 2000 23:08:20 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA04246; Sun, 16 Apr 2000 20:14:17 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 16 Apr 2000 19:33:17 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA02010 for fwtk-users-outgoing; Sun, 16 Apr 2000 19:33:06 -0700 (PDT) Message-ID: From: Barganski Peter To: "'Rick Murphy'" , "'fwtk-users@lists.nai.com'" Subject: RE: FWTK To Hard to Compile if your not a Programmer!! Date: Mon, 17 Apr 2000 12:31:56 +1000 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.10) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1620 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Thanks for the tip Rick. Firewalling is not new to me though and nor is UNIX administration, however, compiling code and Makfile configs, is. I beleive It shouldn't be so time consuming to do all of this. I'm a Systems Administrator not a Programming Guru. As a Sys Admin, I'm a serious user of all sorts of systems. Currently we're using Check Point Firewall-1 and we wanted to evaluated what the Open Source community has to offer in this area. If its too hard just to install it, it will never get as wide a distribution as it might deserve. Anyway, that's just my optnion! Regards, Peter Barganski Systems Engineer/Consultant Nuance Global Traders Australia -----Original Message----- From: Rick Murphy [mailto:rmurphy@itm-inst.com] Sent: Monday, 17 April 2000 12:10 To: Barganski Peter; 'fwtk-users@lists.nai.com' Subject: Re: FWTK To Hard to Compile if your not a Programmer!! At 10:09 AM 4/17/00 +1000, Barganski Peter wrote: >Makefile: 16: *** missing separator. Stop. > >Does anyone know what this means? You probably ran fixmake; that probably means you either didn't read the README, or you don't know that Linux is not BSD. Use 'fixmake unfix' to undo the damage. Yes, FWTK requires a knowledgeable UNIX system administrator to install (see the README) because by itself it's not enough to be a complete firewall. You can too easily misconfigure things if you don't understand what protections FWTK provides and what you're expected to provide. -Rick From owner-fwtk-users@ex.tis.com Sun Apr 16 23:46 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA28872 Sun, 16 Apr 2000 23:46:21 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA06465; Sun, 16 Apr 2000 20:52:17 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 16 Apr 2000 20:08:56 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id UAA03905 for fwtk-users-outgoing; Sun, 16 Apr 2000 20:08:45 -0700 (PDT) Message-Id: <4.3.1.2.20000416224902.00c04cf0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Sun, 16 Apr 2000 22:55:01 -0400 To: Barganski Peter , "'fwtk-users@lists.nai.com'" From: Rick Murphy Subject: RE: FWTK To Hard to Compile if your not a Programmer!! In-Reply-To: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1601 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 12:31 PM 4/17/00 +1000, Barganski Peter wrote: >Thanks for the tip Rick. > >Firewalling is not new to me though and nor is UNIX administration, however, >compiling code and Makfile configs, is. I beleive It shouldn't be so time >consuming to do all of this. I'm a Systems Administrator not a Programming >Guru. As a Sys Admin, I'm a serious user of all sorts of systems. FWTK isn't all that hard to get compiled - the major problem is the two makefile formats (BSD and everyone else); the fixmake script fixes it for that one platform but has the side effect of breaking it everywhere else so you're just hitting one of the really frequently asked questions. (See the FAQ at for lots of tips). >Currently we're using Check Point Firewall-1 and we wanted to evaluated what >the Open Source community has to offer in this area. I understand you looking elsewhere given the known FTP security holes in FW-1. I'm about to suggest installing smap to replace the Firewall-1 security server at one site for SMTP - the Checkpoint SMTP server isn't usable (there's mail it'll never deliver; it can't protect you from being a Spam relay.) >If its too hard just to install it, it will never get as wide a distribution >as it might deserve. >Anyway, that's just my optnion! Hopefully it's not so hard - let us know what kind of system you're building on, make sure you get the right format makefiles, and we'll be happy to help -Rick From owner-fwtk-users@ex.tis.com Mon Apr 17 05:29 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA29742 Mon, 17 Apr 2000 05:29:58 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA15205; Mon, 17 Apr 2000 02:34:58 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 17 Apr 2000 01:44:11 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA13632 for fwtk-users-outgoing; Mon, 17 Apr 2000 01:44:05 -0700 (PDT) Message-Id: <200004170832.QAA11047@servertwo.qdhaixin.com.cn> X-Authentication-Warning: servertwo.qdhaixin.com.cn: nobody set sender to using -f Date: Mon, 17 Apr 2000 16:37:48 +0800 From: wen Reply-To: wen@hisense.qd.sd.cn To: "fwtk-users@lists.nai.com" Subject: test fwtk X-mailer: FoxMail 3.0 beta 2 [cn] Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 212 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hello all: how to test fwtk? please everyone give your advice. thanks. From owner-fwtk-users@ex.tis.com Mon Apr 17 09:27 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA00858 Mon, 17 Apr 2000 09:27:17 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA23356; Mon, 17 Apr 2000 06:32:43 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 17 Apr 2000 05:41:42 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA20010 for fwtk-users-outgoing; Mon, 17 Apr 2000 05:41:26 -0700 (PDT) X-Authentication-Warning: gateway-intern.westcam.co.at: smap set sender to using -f Message-ID: <112B265D84D5D31191540050042BA662016614@sqlserver.westcam.co.at> From: Friedrich Neurauter To: "'fwtk-users@ex.tis.com'" Subject: Plug-gw Date: Fri, 14 Apr 2000 11:28:08 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id CAA22561 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 638 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I have some problems setting up a news plug-gw on my firewall. I¥m quite sure that my configuration files are ok. Anyway, here is an excerpt of my inetd.conf and netperm-table: inetd.conf: nntp stream tcp nowait root /usr/local/etc/plug-gw plug-gw nntp netperm-table: plug-gw: timeout 1200 plug-gw: port nntp * -plug-to news.austria.eu.net -port nntp Trying to connect to the news port, plug-gw reports a "deny host" message in syslog. Any help would be appreciated! Thanks, Friedrich Neurauter From owner-fwtk-users@ex.tis.com Mon Apr 17 09:39 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA00934 Mon, 17 Apr 2000 09:39:00 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA24548; Mon, 17 Apr 2000 06:44:26 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 17 Apr 2000 06:02:22 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA20935 for fwtk-users-outgoing; Mon, 17 Apr 2000 06:02:16 -0700 (PDT) From: "Tom Krotchko" To: Subject: RE: FWTK To Hard to Compile if your not a Programmer!! Date: Mon, 17 Apr 2000 09:01:49 -0400 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) In-Reply-To: Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 729 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] >Firewalling is not new to me though and nor is UNIX administration, however, >compiling code and Makfile configs, is. I beleive It shouldn't be so time >consuming to do all of this. I'm a Systems Administrator not a Programming >Guru. As a Sys Admin, I'm a serious user of all sorts of systems. One option is to return it and get your money back . But seriously, the price of admission with FWTK is doing the research. You don't use FWTK because its "free"; you use it because you get the source code. Finally, FWTK is not "open source" in the GNU sense. It has a very restrictive license. From owner-fwtk-users@ex.tis.com Mon Apr 17 11:12 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA01413 Mon, 17 Apr 2000 11:12:38 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA05683; Mon, 17 Apr 2000 08:17:58 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 17 Apr 2000 07:30:56 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA00048 for fwtk-users-outgoing; Mon, 17 Apr 2000 07:30:40 -0700 (PDT) Message-ID: <38FB1FAC.C991DF0A@v-one.com> Date: Mon, 17 Apr 2000 10:29:00 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.72 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Rick Murphy CC: Barganski Peter , "'fwtk-users@lists.nai.com'" Subject: Re: using smap in FW-1 (was:FWTK Hard to Compile) References: <4.3.1.2.20000416224902.00c04cf0@mail.itm-inst.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 843 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Rick Murphy wrote: > I understand you looking elsewhere given the known FTP security holes in > FW-1. I'm about to suggest installing smap to replace the Firewall-1 > security server at one site for SMTP - the Checkpoint SMTP server isn't > usable (there's mail it'll never deliver; it can't protect you from being a > Spam relay.) Not only that, but when I played with FW-1, it wouldn't even use lower preference MX records... it would just keep sending to the first... yeech.... Anyway, I don't know if you've tried it, but smap works great on FW-1 (and so does tn-gw and ftp-gw to replace their other security "proxies"). -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Mon Apr 17 11:52 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA01461 Mon, 17 Apr 2000 11:52:18 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA11552; Mon, 17 Apr 2000 08:57:49 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 17 Apr 2000 08:12:19 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA04821 for fwtk-users-outgoing; Mon, 17 Apr 2000 08:12:13 -0700 (PDT) Mime-Version: 1.0 X-Sender: christianr@ntmail.signalgene.com Message-Id: Date: Mon, 17 Apr 2000 11:15:06 -0400 To: fwtk-users@lists.nai.com From: Christian Raymond Subject: FWTK license Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 502 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 9:01 AM -0400 17/04/00, Tom Krotchko wrote: >Finally, FWTK is not "open source" in the GNU sense. It has a very >restrictive >license. Speaking off which, who is entitled to use FWTK? my question is : can i use it not for profit in my organisation, or can i use it in my not-for-profit-organisation? the license (in my sense) is not clear on this point. Chris From owner-fwtk-users@ex.tis.com Mon Apr 17 12:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA01737 Mon, 17 Apr 2000 12:38:42 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA18013; Mon, 17 Apr 2000 09:42:41 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 17 Apr 2000 08:54:33 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA10867 for fwtk-users-outgoing; Mon, 17 Apr 2000 08:54:12 -0700 (PDT) From: "Tom Krotchko" To: "Keith Young" , "Rick Murphy" Cc: "Barganski Peter" , Subject: RE: using smap in FW-1 (was:FWTK Hard to Compile) Date: Mon, 17 Apr 2000 11:53:05 -0400 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal In-Reply-To: <38FB1FAC.C991DF0A@v-one.com> X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1548 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I like FW-1 better when I'm protecting web servers with NAT. FW-1 has been doing this longer, and the setup is easier. On the other hand, Gauntlet/FWTK works better in situations where you want an obvious proxy. SMAP/sendmail works very well and is highly configurable. Just my opinion. -----Original Message----- From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On Behalf Of Keith Young Sent: Monday, April 17, 2000 10:29 AM To: Rick Murphy Cc: Barganski Peter; 'fwtk-users@lists.nai.com' Subject: Re: using smap in FW-1 (was:FWTK Hard to Compile) [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Rick Murphy wrote: > I understand you looking elsewhere given the known FTP security holes in > FW-1. I'm about to suggest installing smap to replace the Firewall-1 > security server at one site for SMTP - the Checkpoint SMTP server isn't > usable (there's mail it'll never deliver; it can't protect you from being a > Spam relay.) Not only that, but when I played with FW-1, it wouldn't even use lower preference MX records... it would just keep sending to the first... yeech.... Anyway, I don't know if you've tried it, but smap works great on FW-1 (and so does tn-gw and ftp-gw to replace their other security "proxies"). -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Mon Apr 17 14:08 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA02102 Mon, 17 Apr 2000 14:08:33 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA28517; Mon, 17 Apr 2000 11:13:51 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 17 Apr 2000 10:23:50 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA22414 for fwtk-users-outgoing; Mon, 17 Apr 2000 10:23:39 -0700 (PDT) Message-ID: <38FB483C.F14EAEE6@v-one.com> Date: Mon, 17 Apr 2000 13:22:04 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.72 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Christian Raymond CC: fwtk-users@lists.nai.com Subject: Re: FWTK license References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1058 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Christian Raymond wrote: > >Finally, FWTK is not "open source" in the GNU sense. It has a very > >restrictive > >license. > > Speaking off which, who is entitled to use FWTK? > > my question is : > can i use it not for profit in my organisation, Yes. > can i use it in my not-for-profit-organisation? Yes. > the license (in my sense) is not clear on this point. Basically, the 2 major restrictions that I know of are: 1) You cannot redistribute the software, either via CD-ROM or a web site. 2) You cannot specifically sell "FWTK support", "FWTK installation", or "FWTK server software". You can, however, install the software as part of a network support contract. At least, those were the things that I was told by John Kelley @ NAI. Of course, I am not legal counsel so you should seek better advice if you are not sure... :-) -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Mon Apr 17 14:08 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA02106 Mon, 17 Apr 2000 14:08:41 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA28521; Mon, 17 Apr 2000 11:13:51 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 17 Apr 2000 10:27:18 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA22810 for fwtk-users-outgoing; Mon, 17 Apr 2000 10:26:58 -0700 (PDT) Message-ID: <38FB48F8.12C55CAA@v-one.com> Date: Mon, 17 Apr 2000 13:25:12 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.72 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Todd_Joseph@groove.net CC: Rick Murphy , Barganski Peter , "'fwtk-users@lists.nai.com'" Subject: Re: using smap in FW-1 (was:FWTK Hard to Compile) References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 450 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Todd_Joseph@groove.net wrote: > > Ever used Smap/Smapd on NT4? Please be kind. I need to run a mail gateway > on NT... :-( Then you probably won't be using the FWTK then... Look at Gauntlet 5.5 NT. It has what you are looking for. -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Mon Apr 17 15:11 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA02714 Mon, 17 Apr 2000 15:11:08 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA07291; Mon, 17 Apr 2000 12:16:17 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 17 Apr 2000 11:28:12 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA00541 for fwtk-users-outgoing; Mon, 17 Apr 2000 11:27:50 -0700 (PDT) From: Todd_Joseph@groove.net Subject: Re: using smap in FW-1 (was:FWTK Hard to Compile) To: Keith Young Cc: Rick Murphy , Barganski Peter , "'fwtk-users@lists.nai.com'" X-Mailer: Lotus Notes Release 5.0.2 November 4, 1999 Message-ID: Date: Mon, 17 Apr 2000 12:11:25 -0400 X-MIMETrack: Serialize by Router on Rich/Groove(Release 5.0.3 |March 21, 2000) at 04/17/2000 12:11:34 PM MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1393 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Ever used Smap/Smapd on NT4? Please be kind. I need to run a mail gateway on NT... :-( Todd Keith Young @ex.tis.com on 04/17/2000 10:29:00 AM Sent by: owner-fwtk-users@ex.tis.com To: Rick Murphy cc: Barganski Peter , "'fwtk-users@lists.nai.com'" Subject: Re: using smap in FW-1 (was:FWTK Hard to Compile) [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Rick Murphy wrote: > I understand you looking elsewhere given the known FTP security holes in > FW-1. I'm about to suggest installing smap to replace the Firewall-1 > security server at one site for SMTP - the Checkpoint SMTP server isn't > usable (there's mail it'll never deliver; it can't protect you from being a > Spam relay.) Not only that, but when I played with FW-1, it wouldn't even use lower preference MX records... it would just keep sending to the first... yeech.... Anyway, I don't know if you've tried it, but smap works great on FW-1 (and so does tn-gw and ftp-gw to replace their other security "proxies"). -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Tue Apr 18 12:52 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA09846 Tue, 18 Apr 2000 12:52:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA21369; Tue, 18 Apr 2000 09:57:44 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 18 Apr 2000 08:37:23 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA12563 for fwtk-users-outgoing; Tue, 18 Apr 2000 08:37:08 -0700 (PDT) Date: Tue, 18 Apr 2000 11:36:06 -0400 From: Joseph S D Yao To: Barganski Peter Cc: "'Rick Murphy'" , "'fwtk-users@lists.nai.com'" Subject: Re: FWTK To Hard to Compile if your not a Programmer!! Message-Id: <20000418113606.F28224@washington.cospo.osis.gov> Mail-Followup-To: Barganski Peter , 'Rick Murphy' , "'fwtk-users@lists.nai.com'" References: Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from PBarganski@nuance.com.au on Mon, Apr 17, 2000 at 12:31:56PM +1000 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1181 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Mon, Apr 17, 2000 at 12:31:56PM +1000, Barganski Peter wrote: ... > Currently we're using Check Point Firewall-1 and we wanted to evaluated what > the Open Source community has to offer in this area. Then go to and look for more recent "firewall" code there. Just be aware that not everything labelled a "firewall" is. FWTK is one of the first. There is something recent called T.REX, but I haven't had time to evaluate it yet - Rick has, and if I understood correctly thinks that it is about equivalent to an earlier version of FWTK. [I know I have oversimplified, Rick.] Be wary of things labeled firewall that are mere packet filters. They have their place, but you have to evaluate your security need. Then again, you're using Firewall-1, so you may be willing to accept those. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Tue Apr 18 13:58 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA10069 Tue, 18 Apr 2000 13:58:34 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA29363; Tue, 18 Apr 2000 11:04:32 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 18 Apr 2000 10:16:10 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA23357 for fwtk-users-outgoing; Tue, 18 Apr 2000 10:16:03 -0700 (PDT) From: David Hamm Reply-To: dhamm@itrepro.com Organization: Imaging Technologies Services To: fwtk-users@lists.nai.com Subject: smap & smapd filters Date: Tue, 18 Apr 2000 13:12:48 -0400 X-Mailer: KMail [version 1.0.20] MIME-Version: 1.0 Message-Id: <00041813145909.02729@workbox.atlanta.itserve.com> Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 508 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Is there any facility to add filters to smap and smapd? With email viruses being as popular as they are seems like some type of filters to use with smap and smapd would be helpful in fending them off. --------------------------------- David Hamm Systems Analyst Imaging Technologies Services Inc. email: dhamm@itrepro.com voice: 404-870-6663 --------------------------------- From owner-fwtk-users@ex.tis.com Tue Apr 18 17:16 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA10804 Tue, 18 Apr 2000 17:16:24 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA26037; Tue, 18 Apr 2000 14:22:06 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 18 Apr 2000 13:28:44 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA18259 for fwtk-users-outgoing; Tue, 18 Apr 2000 13:28:33 -0700 (PDT) Date: Tue, 18 Apr 2000 16:26:50 -0400 (EDT) From: Ted Keller To: David Hamm cc: fwtk-users@lists.nai.com Subject: Re: smap & smapd filters In-Reply-To: <00041813145909.02729@workbox.atlanta.itserve.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1220 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] David, I have implemented filters looking at the message header contents. It does not yet look at the content - but could be made to do so very easily. I use this as a way of getting rid of a lot of spam messages - not doing virus type checking. Suspect this would be done better on an internal mail system with one of the commercial virus scan products. Your welcome to what I've done if it is of interest. Key things .... Checks on: >From Address To: address Subject Line Header contents. ted keller On Tue, 18 Apr 2000, David Hamm wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Is there any facility to add filters to smap and smapd? With email viruses > being as popular as they are seems like some type of filters to use with smap > and smapd would be helpful in fending them off. > > --------------------------------- > David Hamm > Systems Analyst > Imaging Technologies Services Inc. > email: dhamm@itrepro.com > voice: 404-870-6663 > --------------------------------- > From owner-fwtk-users@ex.tis.com Tue Apr 18 19:19 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA11411 Tue, 18 Apr 2000 19:19:47 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA06583; Tue, 18 Apr 2000 16:25:23 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 18 Apr 2000 15:34:07 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA03314 for fwtk-users-outgoing; Tue, 18 Apr 2000 15:33:51 -0700 (PDT) Message-Id: <4.3.1.2.20000418181118.00c57ed0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Tue, 18 Apr 2000 18:22:51 -0400 To: Joseph S D Yao , Barganski Peter From: Rick Murphy Subject: Re: FWTK To Hard to Compile if your not a Programmer!! Cc: "'fwtk-users@lists.nai.com'" In-Reply-To: <20000418113606.F28224@washington.cospo.osis.gov> References: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 691 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 11:36 AM 4/18/00 -0400, Joseph S D Yao wrote: >Just be aware that not everything labelled a "firewall" is. FWTK is >one of the first. There is something recent called T.REX, but I haven't >had time to evaluate it yet - Rick has, and if I understood correctly >thinks that it is about equivalent to an earlier version of FWTK. [I >know I have oversimplified, Rick.] T.Rex uses smap/smapd, ftp-gw, and tn-gw from Firewall Toolkit 1.3 or so. They've been mildly hacked to change the way they're managed. It also uses squid as an http proxy. -Rick From owner-fwtk-users@ex.tis.com Wed Apr 19 07:57 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA13725 Wed, 19 Apr 2000 07:57:02 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA23932; Wed, 19 Apr 2000 05:02:58 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 19 Apr 2000 04:08:04 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA22764 for fwtk-users-outgoing; Wed, 19 Apr 2000 04:07:58 -0700 (PDT) To: fwtk-users@lists.nai.com Subject: Re: FWTK To Hard to Compile if your not a Programmer!! X-Sun-Charset: US-ASCII Message-Id: <20000419110723.920062C15B@skynet.medar.com> Date: Wed, 19 Apr 2000 07:07:23 -0400 (EDT) From: jseymour@medar.com (James Seymour) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1036 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > Message-Id: <4.3.1.2.20000418181118.00c57ed0@mail.itm-inst.com> > Date: Tue, 18 Apr 2000 18:22:51 -0400 > From: Rick Murphy > Subject: Re: FWTK To Hard to Compile if your not a Programmer!! > [snip] > T.Rex uses smap/smapd, ftp-gw, and tn-gw from Firewall Toolkit 1.3 or so. > They've been mildly hacked to change the way they're managed. It also uses > squid as an http proxy. Apache, actually. Or at least 1.0 did. (The config files are in /etc/apache. The build directory is "apache". It walks and quacks like Apache. I think it's Apache :-).) I don't see anything in the 1.0.1 readme to indicate they've changed that. Regards, Jim -- Jim Seymour | Medar, Inc. jseymour@medar.com | 24775 Crestview Ct. Systems & Network Administrator | Farmington Hills, MI. 48335 | FAX: (248)477-8897 From owner-fwtk-users@ex.tis.com Wed Apr 19 09:13 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA13922 Wed, 19 Apr 2000 09:13:21 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA27384; Wed, 19 Apr 2000 06:18:59 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 19 Apr 2000 05:32:04 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA24981 for fwtk-users-outgoing; Wed, 19 Apr 2000 05:31:42 -0700 (PDT) From: ark@eltex.ru Date: Wed, 19 Apr 2000 14:46:26 +0400 Message-Id: <200004191046.OAA30910@paranoid.eltex.spb.ru> In-Reply-To: <4.3.1.2.20000418181118.00c57ed0@mail.itm-inst.com> from "Rick Murphy " Organization: "Klingon Imperial Intelligence Service" Subject: Re: FWTK To Hard to Compile if your not a Programmer!! To: rmurphy@itm-inst.com Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1559 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Oh. Really. What does NAI think about it? Rick Murphy said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > At 11:36 AM 4/18/00 -0400, Joseph S D Yao wrote: > >Just be aware that not everything labelled a "firewall" is. FWTK is > >one of the first. There is something recent called T.REX, but I haven't > >had time to evaluate it yet - Rick has, and if I understood correctly > >thinks that it is about equivalent to an earlier version of FWTK. [I > >know I have oversimplified, Rick.] > T.Rex uses smap/smapd, ftp-gw, and tn-gw from Firewall Toolkit 1.3 or so. > They've been mildly hacked to change the way they're managed. It also uses > squid as an http proxy. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOP2OfqH/mIJW9LeBAQGKngP/cVh9bLBzg0hLkOJxEkz8CBagsi6zEGeX FVsitWZDmWlFwSNj21dX1u+456psqJys7HFE7HMlp3sDa/SpOMsypM2iV4g5ffWa MHo91VLhhlN7kWT730DlIXcH35oR8QX8PsQL888RZWVvw7rxgynGFrsp5PmuHXeQ XbnX8ZxTla0= =daz0 -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Wed Apr 19 11:04 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA14417 Wed, 19 Apr 2000 11:04:33 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA08664; Wed, 19 Apr 2000 08:09:57 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 19 Apr 2000 07:20:02 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA02844 for fwtk-users-outgoing; Wed, 19 Apr 2000 07:19:56 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.3 [p0] on FreeBSD X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <200004191046.OAA30910@paranoid.eltex.spb.ru> Date: Wed, 19 Apr 2000 16:19:24 +0200 (MET DST) Reply-To: mm@i.cz From: Martin Machacek To: fwtk-users@lists.nai.com Subject: Re: FWTK To Hard to Compile if your not a Programmer!! Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-2 Content-Length: 396 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 19-Apr-00 ark@eltex.ru wrote: > Oh. Really. What does NAI think about it? Their lawyers are about to "have a word" with them (Freemont Avenue Software) about it. Peter Churchyard from NAI told me this in private mail. Martin --- [PGP KeyID F3F409C4] From owner-fwtk-users@ex.tis.com Wed Apr 19 14:03 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA15026 Wed, 19 Apr 2000 14:03:31 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA23447; Wed, 19 Apr 2000 11:09:19 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 19 Apr 2000 09:54:08 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA18045 for fwtk-users-outgoing; Wed, 19 Apr 2000 09:53:57 -0700 (PDT) Date: Wed, 19 Apr 2000 12:53:05 -0400 From: Joseph S D Yao To: "Daniel R. Houle" Cc: fwtk-users@tis.com Subject: Re: Random number generator in authsvr Message-Id: <20000419125305.G8557@washington.cospo.osis.gov> Mail-Followup-To: "Daniel R. Houle" , fwtk-users@tis.com References: <38C7C8EB.2619A6B6@nataskasoftware.on.ca> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <38C7C8EB.2619A6B6@nataskasoftware.on.ca>; from drhoule@nataskasoftware.on.ca on Thu, Mar 09, 2000 at 10:53:15AM -0500 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1402 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Thu, Mar 09, 2000 at 10:53:15AM -0500, Daniel R. Houle wrote: > I've been looking at the authsvr and it's security issue about the > random (or not so-) number generator. Apparently there is a way to fix > that by changing the rand() and srand() functions. Anybody done this > already? Anybody know what I should change these functions to? Should > I create new ones myself? I don't know how far you've gotten on this yet, but please consult Knuth before rolling your own random number generator. As he says, most randomly generated random number generators ... aren't. If the problem is a non-random seed, Marcus Ranum suggested for a similar problem [and referring to FWTK]: > ... I also included a utility for generating > keys but it didn't use very good randomness. If you want to generate > keys nowadays, why don't you just take a bunch of output from /dev/random > and run it through od and a sed script? If you haven't got /dev/random > just run a bunch of ps, uptime, netstat -a, df -i, ls -l /var/log > piped through sha. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Wed Apr 19 16:25 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA15624 Wed, 19 Apr 2000 16:25:40 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA05697; Wed, 19 Apr 2000 13:31:40 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 19 Apr 2000 12:41:14 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA00723 for fwtk-users-outgoing; Wed, 19 Apr 2000 12:41:02 -0700 (PDT) Date: Wed, 19 Apr 2000 15:40:23 -0400 From: Joseph S D Yao To: Daniel Lutan Cc: fwtk-users@lists.nai.com Subject: Re: make Message-Id: <20000419154023.N8557@washington.cospo.osis.gov> Mail-Followup-To: Daniel Lutan , fwtk-users@lists.nai.com References: Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from ccldc@mailcity.com on Fri, Mar 10, 2000 at 03:48:15AM -0800 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1941 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Mar 10, 2000 at 03:48:15AM -0800, Daniel Lutan wrote: > Hello! My name is Daniel and i'm a student and a beginer in working with TIS. I'm dowloading TIS and I'm starting to compile with make comand but i have an error and i need your help. The error sound like that ( word by word ): > > : No such file or directoryg > '. Stop. No rule to make target ' Makefile.config. > > I'm running a Suse Linux 6.3 and i rename the file Makefile.config.linux in Makefile.config and the old Makefile.config in Makefile.config1. > > I hope i make my self clear and please send my a response. > > Thank's anyway! > > Daniel. > > MailCity. Secure Email Anywhere, Anytime! > http://www.mailcity.com If you are giving the above literally, then you may have a carriage return character in your Makefile. If it is appended to a target name, and you have a version of 'make' which does not interpret a CR as white space [which is apparently the case under Linux], then the 'make' program is trying to find a target whose name has the CR appended! I have seen this kind of thing happen when somebody copies a file to their Micro$oft PC to edit, and then copies it back. Alternately: 'make' is being called from a shell command file which has been so modified, and the target name has a CR at the end. Alternately: you are calling 'make' from the command line, but somehow have the CRLF settings wrong [although I can't think of anything that would simultaneously send a CR and give you an end-of-line]. The 'pico' editor is easy to learn on Linux, although 'vi' is known by more people. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Wed Apr 19 16:35 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA15650 Wed, 19 Apr 2000 16:35:34 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA07071; Wed, 19 Apr 2000 13:41:35 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 19 Apr 2000 12:59:48 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA02179 for fwtk-users-outgoing; Wed, 19 Apr 2000 12:59:42 -0700 (PDT) Mime-Version: 1.0 X-Sender: blair.lowe@mail.millwoods.compeng.net (Unverified) Message-Id: In-Reply-To: References: Date: Wed, 19 Apr 2000 13:56:54 -0600 To: fwtk-users@lists.nai.com From: Blair Lowe Subject: Re: FWTK To Hard to Compile if your not a Programmer!! Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" ; format="flowed" Content-Length: 1879 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi all, We have a nosource rpm that could make life easier for people. We are not sure about legal ramifications, though. The rpm contains no fwtk source, only the patches at ark's site, and my own patches to make stuff compile, so we suppose that it would not violate any part of the agreement. This is currently a private internal rpm that has not been distributed anywhere. We are an open-source/gnu type shop, and would love to share our stuff, though. The current rpm is only for x86 redhat 6.1, so we believe that others could streamline if for other LINUX distributions, architectures, and even other proprietary operating systems that can use rpm. If anyone who is in contact with NAI could ask them to contact us to authorise us to release my code, we could proceed, and make newbie's lives easier. Otherwise, we shall keep our code to ourselves. We'd love to avoid any legal stuff: it is in that spirit that we are sending this email. Thanks, Blair. At 16:19 +0200 2000/04/19, Martin Machacek wrote: >On 19-Apr-00 ark@eltex.ru wrote: > > Oh. Really. What does NAI think about it? > >Their lawyers are about to "have a word" with them (Freemont Avenue >Software) >about it. Peter Churchyard from NAI told me this in private mail. - --- [PGP KeyID F3F409C4] -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.5.2 for non-commercial use iQA/AwUBOP4O4o9i5eAEQGaJEQKqCACbBiSWZcl7g6u7j2LYuMTlNeGnEj4AoN2K xY9UwQ/61ygNt2crKf7BNovg =yuHE -----END PGP SIGNATURE----- Computer Engineering Inc. http://www.compeng.net Phone: 780 499 5687 (9 - 5 MST) Fax: 780 435 0693 (24 Hours) All email advice that is provided for free is without warrantee: use at your own risk. From owner-fwtk-users@ex.tis.com Wed Apr 19 17:22 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA15737 Wed, 19 Apr 2000 17:22:19 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA13050; Wed, 19 Apr 2000 14:28:19 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 19 Apr 2000 13:42:31 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA07121 for fwtk-users-outgoing; Wed, 19 Apr 2000 13:42:20 -0700 (PDT) Message-Id: <4.3.1.2.20000419162859.00c31bd0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Wed, 19 Apr 2000 16:31:52 -0400 To: jseymour@medar.com (James Seymour), fwtk-users@lists.nai.com From: Rick Murphy Subject: Re: FWTK To Hard to Compile if your not a Programmer!! In-Reply-To: <20000419110723.920062C15B@skynet.medar.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 520 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 07:07 AM 4/19/00 -0400, James Seymour wrote: > > From: Rick Murphy > > It also uses squid as an http proxy. > >Apache, actually. Yup. That's what I get for trying to answer without verifying my memory. I didn't want to let people think that T.Rex was "just FWTK" - it's more than that, with some real improvements in authentication, for example. -Rick From owner-fwtk-users@ex.tis.com Wed Apr 19 17:22 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA15738 Wed, 19 Apr 2000 17:22:25 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA13065; Wed, 19 Apr 2000 14:28:25 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 19 Apr 2000 13:43:30 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA07317 for fwtk-users-outgoing; Wed, 19 Apr 2000 13:43:14 -0700 (PDT) Message-Id: <4.3.1.2.20000419163223.00c34330@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Wed, 19 Apr 2000 16:33:53 -0400 To: Joseph S D Yao , "Daniel R. Houle" From: Rick Murphy Subject: Re: Random number generator in authsvr Cc: fwtk-users@tis.com In-Reply-To: <20000419125305.G8557@washington.cospo.osis.gov> References: <38C7C8EB.2619A6B6@nataskasoftware.on.ca> <38C7C8EB.2619A6B6@nataskasoftware.on.ca> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 503 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 12:53 PM 4/19/00 -0400, Joseph S D Yao wrote: >If the problem is a non-random seed, Marcus Ranum suggested for a >similar problem [and referring to FWTK]: That's precisely the problem. If you've got a /dev/random lying around, use that. The range of random seed values that the FWTK random number generator creates is small enough to be quite worrying. -Rick From owner-fwtk-users@ex.tis.com Thu Apr 20 01:46 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id BAA17070 Thu, 20 Apr 2000 01:46:02 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id WAA06104; Wed, 19 Apr 2000 22:52:03 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 19 Apr 2000 21:58:06 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA04507 for fwtk-users-outgoing; Wed, 19 Apr 2000 21:57:55 -0700 (PDT) Message-ID: <384365245.956206631254.JavaMail.root@web304-mc.mail.com> Date: Thu, 20 Apr 2000 00:57:11 -0400 (EDT) From: Nagaraj Gang To: Daniel Lutan Subject: authentication problem CC: fwtk-users@lists.nai.com Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: mail.com X-Originating-IP: 203.197.139.80 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 607 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello Mr. Daniel My Name is Nagaraj ,i successfully configred TIS on redhat 6.1. I created database for user using authsrv.the problem is whenever i trying do ftp or telnet through firewall server from client,its not recognising the user in database and is giving erorr like user=unauth.will you please give me a solution. Thanks nags@engineer.com ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup From owner-fwtk-users@ex.tis.com Thu Apr 20 10:32 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA18865 Thu, 20 Apr 2000 10:32:02 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA09936; Thu, 20 Apr 2000 07:38:03 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 20 Apr 2000 06:45:13 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA04847 for fwtk-users-outgoing; Thu, 20 Apr 2000 06:45:07 -0700 (PDT) From: th@Netzstation.net Subject: Disabling EXPN and VRFY and smap, how To: fwtk-users@lists.nai.com X-Mailer: Lotus Notes Version 5.0.1 (Intl) 11. August 1999 Message-ID: Date: Thu, 20 Apr 2000 15:42:40 +0200 X-MIMETrack: Serialize by Router on Domino01/Netzstation/DE(Version 5.0.2c (Intl)|08 Februar 2000) at 20.04.2000 15:42:42 MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 950 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello FWTK users, There is a nice tool on http://jenny.tti.co.jp/cgi-bin/checkmail/nph-expntest.cgi which checks vor EXPN and VRFY vulnerability. Our (and not only our) FWTK 2.1 smap seems to be vulnerable. This is clearly not, what rfc2505: anti-spam recommendations meen. How can we fix this ? btw. we are using the sabernet anti-spam-patches with MAPS-RBL checking for smap Mit freundlichem Gruss / Best Regards ------------------------------------------------------------------------- - Dr. Thomas Hildenbrandt - Netzstation Informationstechnik GmbH Panoramastr. 17; 74417 Gschwend Tel: +49 7972 936770 Fax: +49 7972 936790 e-mail: th@netzstation.net From owner-fwtk-users@ex.tis.com Thu Apr 20 12:02 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA19190 Thu, 20 Apr 2000 12:01:34 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA20283; Thu, 20 Apr 2000 09:07:36 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 20 Apr 2000 08:18:40 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA14277 for fwtk-users-outgoing; Thu, 20 Apr 2000 08:18:14 -0700 (PDT) Message-Id: <4.3.0.20000420101041.00b418c0@lsli.com> Date: Thu, 20 Apr 2000 10:15:20 -0500 To: From: Charles Manick Livermore Subject: Re: FWTK To Hard to Compile if your not a Programmer!! Cc: , , , Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1413 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] T.Rex is not a FWTK derivative nor does it use squid as the http proxy. It is clearly stated in the documentation that the httpd proxy is a derivative of the Apache web server. Check out the web site and you will see that the contributors to the T.Rex security suite are documented. Each T.Rex proxy has significantly more function and three to five times as much code code as any of the FWTK proxies. > At 11:36 AM 4/18/00 -0400, Joseph S D Yao wrote: > >Just be aware that not everything labelled a "firewall" is. FWTK is > >one of the first. There is something recent called T.REX, but I haven't > >had time to evaluate it yet - Rick has, and if I understood correctly > >thinks that it is about equivalent to an earlier version of FWTK. [I > >know I have oversimplified, Rick.] > T.Rex uses smap/smapd, ftp-gw, and tn-gw from Firewall Toolkit 1.3 or so. > They've been mildly hacked to change the way they're managed. It also uses > squid as an http proxy. __________________________________________________________________ Charles Manick Livermore Livermore Software Laboratories div of Freemont Avenue Software, Inc. 1830 S. Kirkwood, Suite 205 Houston, TX 77077 vox: 281-759-3274 or 800-240-5754 fax: 281-759-8558 www.lsli.com www.opensourcefirewall.com From owner-fwtk-users@ex.tis.com Thu Apr 20 12:31 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA19297 Thu, 20 Apr 2000 12:31:17 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA25039; Thu, 20 Apr 2000 09:37:19 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 20 Apr 2000 08:53:32 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA17781 for fwtk-users-outgoing; Thu, 20 Apr 2000 08:53:21 -0700 (PDT) From: ark@eltex.ru Date: Thu, 20 Apr 2000 19:51:32 +0400 Message-Id: <200004201551.TAA02545@paranoid.eltex.spb.ru> In-Reply-To: from "th@Netzstation.net" Organization: "Klingon Imperial Intelligence Service" Subject: Re: Disabling EXPN and VRFY and smap, how To: th@Netzstation.net Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1058 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] nuqneH, Don't believe security scanner programs, period. th@Netzstation.net said : > There is a nice tool on > http://jenny.tti.co.jp/cgi-bin/checkmail/nph-expntest.cgi > which checks vor EXPN and VRFY vulnerability. Our (and not only our) FWTK > 2.1 smap seems to be vulnerable. > This is clearly not, what > > rfc2505: anti-spam recommendations meen. > > > > How can we fix this ? > > btw. we are using the sabernet anti-spam-patches with MAPS-RBL checking for > smap _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! From owner-fwtk-users@ex.tis.com Thu Apr 20 12:33 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA19301 Thu, 20 Apr 2000 12:32:52 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA25211; Thu, 20 Apr 2000 09:38:54 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 20 Apr 2000 08:57:09 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA18284 for fwtk-users-outgoing; Thu, 20 Apr 2000 08:56:58 -0700 (PDT) Date: Thu, 20 Apr 2000 11:56:24 -0400 From: Joseph S D Yao To: th@netzstation.net Cc: fwtk-users@lists.nai.com Subject: Re: Disabling EXPN and VRFY and smap, how Message-Id: <20000420115624.I18899@washington.cospo.osis.gov> Mail-Followup-To: th@netzstation.net, fwtk-users@lists.nai.com References: Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from th@netzstation.net on Thu, Apr 20, 2000 at 03:42:40PM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2237 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Thu, Apr 20, 2000 at 03:42:40PM +0200, th@netzstation.net wrote: > There is a nice tool on > http://jenny.tti.co.jp/cgi-bin/checkmail/nph-expntest.cgi > which checks vor EXPN and VRFY vulnerability. Our (and not only our) FWTK > 2.1 smap seems to be vulnerable. > This is clearly not, what > > rfc2505: anti-spam recommendations meen. > > How can we fix this ? > > btw. we are using the sabernet anti-spam-patches with MAPS-RBL checking for > smap I have no idea how those patches affect things. But there should be NO e-mail accounts on the machine on which 'smap' runs; therefore, there should be no meaningful responses to EXPN and VRFY. All true e-mail accounts should be on your real e-mail server, buried deep within your private network. In fact, the original comments in smap 2.1 include: * Unimplemented commands now return appropriate message instead * on an incorrect answer - particularly EXPN and VRFY no longer * return "User unknown". and my comments in my compilation of patches include: ** never used, this is a no-op.] VRFY and EXPN have been changed ** in 2.1 to echo any argument. The rest, except for EHLO, just ** respond in some random way. ** ** jsdy CRITIQUE: I don't like the change in VRFY and EXPN, ** because it doesn't "say what you mean", and because it may ** encourage cracker kiddies to keep boring in; but it's now 2.1 ** "standard behavior." In other words, if you say "vrfy santaclaus" it will say "santaclaus", no matter whether or not there is such an account. This probably APPEARS vulnerable to the test you mention above, while not really being so. If you don't like this, there is an 'if ... else ...' clause which sometimes says "User unknown" but usually echoes the input. Take out the "if", "else", and echo of the input. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Thu Apr 20 13:05 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA19460 Thu, 20 Apr 2000 13:05:03 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA29637; Thu, 20 Apr 2000 10:10:44 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 20 Apr 2000 09:22:40 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA22765 for fwtk-users-outgoing; Thu, 20 Apr 2000 09:22:34 -0700 (PDT) Message-Id: <200004201622.KAA06689@lectrosonics.com> From: "Ken Long" Organization: Lectrosonics, Inc. To: fwtk-users@lists.nai.com Date: Thu, 20 Apr 2000 10:21:46 -0600 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: Re: Disabling EXPN and VRFY and smap, how In-reply-to: X-mailer: Pegasus Mail for Win32 (v3.12a) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 595 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I discussed this apparent vulnerability with our resident FWTK expert and his exact words were: "smap only pretends to answer those requests. No security information is actually compromised." I feel safer. Ken On 20 Apr 00, at 15:42, th@Netzstation.net wrote: > There is a nice tool on > http://jenny.tti.co.jp/cgi-bin/checkmail/nph-expntest.cgi > which checks vor EXPN and VRFY vulnerability. Our (and not only our) FWTK 2.1 > smap seems to be vulnerable. From owner-fwtk-users@ex.tis.com Thu Apr 20 15:17 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA20053 Thu, 20 Apr 2000 15:17:37 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA18093; Thu, 20 Apr 2000 12:21:16 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 20 Apr 2000 11:07:13 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA07226 for fwtk-users-outgoing; Thu, 20 Apr 2000 11:06:56 -0700 (PDT) Date: Thu, 20 Apr 2000 14:04:33 -0400 (EDT) From: Ted Keller To: Nagaraj Gang cc: Daniel Lutan , fwtk-users@lists.nai.com Subject: Re: authentication problem In-Reply-To: <384365245.956206631254.JavaMail.root@web304-mc.mail.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 994 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Nagaraj, Are you seeing the tn-gw username prompt when you connect to the firewall? Also, what are your logs indicating. They should be telling you why it failed. ted keller On Thu, 20 Apr 2000, Nagaraj Gang wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello Mr. Daniel > > My Name is Nagaraj ,i successfully configred TIS on redhat 6.1. > I created database for user using authsrv.the problem is whenever i trying > do ftp or telnet through firewall server from client,its not recognising > the user in database and is giving erorr like user=unauth.will you please > give me a solution. > > Thanks > nags@engineer.com > > ______________________________________________ > FREE Personalized Email at Mail.com > Sign up at http://www.mail.com/?sr=signup > From owner-fwtk-users@ex.tis.com Fri Apr 21 04:54 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA22028 Fri, 21 Apr 2000 04:54:57 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA27704; Fri, 21 Apr 2000 02:00:26 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 21 Apr 2000 01:04:17 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA26471 for fwtk-users-outgoing; Fri, 21 Apr 2000 01:04:11 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.3 [p0] on FreeBSD X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <4.3.0.20000420101041.00b418c0@lsli.com> Date: Fri, 21 Apr 2000 10:03:37 +0200 (MET DST) Reply-To: mm@i.cz From: Martin Machacek To: fwtk-users@lists.nai.com Subject: Re: FWTK To Hard to Compile if your not a Programmer!! Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-2 Content-Length: 1185 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 20-Apr-00 Charles Manick Livermore wrote: > T.Rex is not a FWTK derivative nor does it use squid as the http proxy. I've quickly checked only ftproxy versus ftp-gw. Whether you call T.REX's ftproxy a derivative of FWTK's ftp-gw or not depends on your definition of what "derivative" means. They are not completely identical, neither in functionality nor in implementation. However quite large portions of ftproxy.c are almost identical to portions of ftp-gw.c. It's OK with me but I'm afraid that NAI's lawyers may think otherwise . What's wrong in my opinion is that I've not found any credit given to FWTK authors in any of ftproxy source files. Or was it just pure coindence that portions of the code look almost identical including variable names, order of declarations, indentation etc. ? > Each T.Rex proxy has significantly more function and three to five times as > much code code as any of the FWTK proxies. So you basically admit that you've reused parts of original FWTK code, is that correct? Martin --- [PGP KeyID F3F409C4] From owner-fwtk-users@ex.tis.com Fri Apr 21 06:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA22271 Fri, 21 Apr 2000 06:38:39 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA29938; Fri, 21 Apr 2000 03:43:57 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 21 Apr 2000 02:57:47 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA28899 for fwtk-users-outgoing; Fri, 21 Apr 2000 02:57:36 -0700 (PDT) X-Authentication-Warning: gatekeeper.dmz.nexus: nobody set sender to using -f Date: Fri, 21 Apr 2000 10:53:13 +0100 (GMT) From: "A.S.Johnson" X-Sender: asj@bastion.mil.nexus To: Charles Manick Livermore cc: fwtk-users@lists.nai.com Subject: Re: FWTK To Hard to Compile if your not a Programmer!! In-Reply-To: <4.3.0.20000420101041.00b418c0@lsli.com> Message-ID: MIME-Version: 1.0 X-BadReturnPath: asj@bastion.dmz.nexus rewritten as asj@tgfslp.freeserve.co.uk using "From" header Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII using "From" header Content-Length: 1868 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] More does not mean better! So three times more code does not mean it is better than FWTK, as they say, "One does not get diamonds as big as bricks!" Andrew --- A.S.Johnson System Security tgfslp On Thu, 20 Apr 2000, Charles Manick Livermore wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > T.Rex is not a FWTK derivative nor does it use squid as the http proxy. > It is clearly stated in the documentation that the httpd proxy is a > derivative of the Apache web server. > Check out the web site and you will see that the contributors to the T.Rex > security suite are documented. > > Each T.Rex proxy has significantly more function and three to five times as > much code code as any of the FWTK proxies. > > > At 11:36 AM 4/18/00 -0400, Joseph S D Yao wrote: > > >Just be aware that not everything labelled a "firewall" is. FWTK is > > >one of the first. There is something recent called T.REX, but I haven't > > >had time to evaluate it yet - Rick has, and if I understood correctly > > >thinks that it is about equivalent to an earlier version of FWTK. [I > > >know I have oversimplified, Rick.] > > T.Rex uses smap/smapd, ftp-gw, and tn-gw from Firewall Toolkit 1.3 or so. > > They've been mildly hacked to change the way they're managed. It also uses > > squid as an http proxy. > > __________________________________________________________________ > Charles Manick Livermore > Livermore Software Laboratories > div of Freemont Avenue Software, Inc. > 1830 S. Kirkwood, Suite 205 > Houston, TX 77077 > vox: 281-759-3274 or 800-240-5754 > fax: 281-759-8558 > www.lsli.com > www.opensourcefirewall.com > > From owner-fwtk-users@ex.tis.com Fri Apr 21 12:29 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA22985 Fri, 21 Apr 2000 12:29:01 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA07433; Fri, 21 Apr 2000 09:34:28 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 21 Apr 2000 08:40:18 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA05438 for fwtk-users-outgoing; Fri, 21 Apr 2000 08:40:01 -0700 (PDT) From: dreamwvr Reply-To: dreamwvr@dreamwvr.com Organization: dreamwvr.com To: "A.S.Johnson" , Charles Manick Livermore Subject: less is MORE ;-)) Date: Fri, 21 Apr 2000 09:23:25 -0600 X-Mailer: KMail [version 1.0.28] Cc: fwtk-users@lists.nai.com References: In-Reply-To: MIME-Version: 1.0 Message-Id: <00042109384206.00884@loki.dyn.ez-ip.net> Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 2325 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi Andrew, i agree with you entirely. reason being is that a firewall by nature of the beast 'should' be as minimalistic a system as possible. the code needs to be clear and self explanatory. Marcus Ranum who did write the FWTK mentioned that it did have some inadequacies... but do not see where the sheer amount of code is a good thing. for instance one of the reasons i like linux so much is that i do not have to lug around a laptop to get connected at any time. (the equivalent in nt world i would need a suitcase and a large shovel;-)) i simply reach into my shirt pocket and plug in a floppy and voila have enough tools 'in a pinch to get the job done' another insight that i have noticed since coding for o.. about 50 k hours or so.. in various languages (9) is that i am a intermediate coder at best:-{ Why? because i have noticed so many times when someone else i knew wrote code that i did 10 lines more simply in 2. :-/ now that is a very admirable trait IMHO which is why i say .. "less is MORE" On Fri, 21 Apr 2000, A.S.Johnson wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > > More does not mean better! So three times more code does not mean it is > better than FWTK, as they say, "One does not get diamonds as big as > bricks!" > > Andrew > --- > A.S.Johnson > System Security tgfslp > _______________________________________________________________________ ************** DREAMWVR.COM - TOTAL INTERNET SERVICES **************** TOTAL DESIGN - DEVELOPMENT - INTEGRATION - SECURITY - Click Here.. DREAMWVR.COM - The Console of Many... 90 Topics Covered ->> LINUX-MANDRAKE Solution Provider and North American Distributor <<- PRODUCT OF THE YEAR! "===0 PGP Key Available *************** "As Unique as the Company You Keep." ***************** "If anyone speaks from DREAMWVR.COM its certainly not me:-)" ________________________________________________________________________ From owner-fwtk-users@ex.tis.com Fri Apr 21 14:41 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA23348 Fri, 21 Apr 2000 14:41:44 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA12841; Fri, 21 Apr 2000 11:47:36 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 21 Apr 2000 11:06:37 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA10642 for fwtk-users-outgoing; Fri, 21 Apr 2000 11:06:31 -0700 (PDT) Message-ID: <39008AE1.2D3355DC@danbbs.dk> Date: Fri, 21 Apr 2000 19:07:45 +0200 From: MONZ Reply-To: monz@danbbs.dk X-Mailer: Mozilla 4.72 [en] (X11; I; Linux 2.2.5-15 i586) X-Accept-Language: da,sv,no,de MIME-Version: 1.0 To: fwtk-users Subject: ICQ in/out of firewall Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 836 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am more or less forced to enable ICQ from the inside of our firewall, just not sure how to handle it. Don't have much experience with ICQ, and I don't like the idea of merely allowing access though normal ports (4000). How about setting up a private ICQ server on the private net and let it handle connections. Ideas and product hints more than welcome. We are using both Linux and Windoze9x/2k workstations. -- Mogens Valentin WWW: http://www.danbbs.dk/~monz/ mailto:monz@danbbs.dk Web, Programming, Network, Security - Installguides and docs for Linux.. Skaane/Sjaelland Linux User Group (5300++ members) - http://www.sslug.dk Use http://www.linux.org/ for freedom of choice with OpenSource software From owner-fwtk-users@ex.tis.com Fri Apr 21 14:41 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA23351 Fri, 21 Apr 2000 14:41:53 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA12837; Fri, 21 Apr 2000 11:47:27 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 21 Apr 2000 10:58:03 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA10309 for fwtk-users-outgoing; Fri, 21 Apr 2000 10:57:42 -0700 (PDT) Date: Fri, 21 Apr 2000 13:56:56 -0400 From: Joseph S D Yao To: "A.S.Johnson" Cc: Charles Manick Livermore , fwtk-users@lists.nai.com, firewall-wizards@nfr.net Subject: Re: T.Rex, ctd. Message-Id: <20000421135656.G28213@washington.cospo.osis.gov> Mail-Followup-To: "A.S.Johnson" , Charles Manick Livermore , fwtk-users@lists.nai.com, firewall-wizards@nfr.net References: <4.3.0.20000420101041.00b418c0@lsli.com> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from asj@tgfslp.freeserve.co.uk on Fri, Apr 21, 2000 at 10:53:13AM +0100 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 910 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Apr 21, 2000 at 10:53:13AM +0100, A.S.Johnson wrote: > More does not mean better! So three times more code does not mean it is > better than FWTK, as they say, "One does not get diamonds as big as > bricks!" > > Andrew > --- > A.S.Johnson > System Security tgfslp True. One of the original virtues of FWTK was that the proxies were written with as little code as possible. Unfortunately, TIS thought that they were then self-documenting. ;-) More code does not n e c e s s a r i l y mean worse, either. But more opportunitiess for bugs. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Apr 21 15:34 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA23530 Fri, 21 Apr 2000 15:34:47 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA16615; Fri, 21 Apr 2000 12:40:25 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 21 Apr 2000 11:33:23 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA12024 for fwtk-users-outgoing; Fri, 21 Apr 2000 11:33:01 -0700 (PDT) Date: Fri, 21 Apr 2000 14:32:17 -0400 From: Joseph S D Yao To: dreamwvr Cc: "A.S.Johnson" , Charles Manick Livermore , fwtk-users@lists.nai.com Subject: Re: less is MORE ;-)) Message-Id: <20000421143217.M28213@washington.cospo.osis.gov> Mail-Followup-To: dreamwvr , "A.S.Johnson" , Charles Manick Livermore , fwtk-users@lists.nai.com References: <00042109384206.00884@loki.dyn.ez-ip.net> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <00042109384206.00884@loki.dyn.ez-ip.net>; from dreamwvr@dreamwvr.com on Fri, Apr 21, 2000 at 09:23:25AM -0600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 902 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Apr 21, 2000 at 09:23:25AM -0600, dreamwvr wrote: > intermediate coder at best:-{ Why? because i have noticed so many times > when someone else i knew wrote code that i did 10 lines more simply in > 2. :-/ now that is a very admirable trait IMHO which is why i say .. > "less is MORE" ;-) Hey, Weaver. Not necessarily. I would much rather have 10 simple line that follow Joe's First Rule of Software Engineering - "Say What You Mean" - than 2 lines that could be entered into the Obfuscated C contest or an APL beauty contest. ;-) -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Apr 21 15:45 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA23583 Fri, 21 Apr 2000 15:45:39 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA17259; Fri, 21 Apr 2000 12:51:17 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 21 Apr 2000 12:03:30 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA13743 for fwtk-users-outgoing; Fri, 21 Apr 2000 12:03:09 -0700 (PDT) From: dreamwvr Reply-To: dreamwvr@dreamwvr.com Organization: dreamwvr.com To: Joseph S D Yao Subject: Re: less is MORE ;-)) Date: Fri, 21 Apr 2000 12:54:11 -0600 X-Mailer: KMail [version 1.0.28] Cc: "A.S.Johnson" , Charles Manick Livermore , fwtk-users@lists.nai.com References: <00042109384206.00884@loki.dyn.ez-ip.net> <20000421143217.M28213@washington.cospo.osis.gov> In-Reply-To: <20000421143217.M28213@washington.cospo.osis.gov> MIME-Version: 1.0 Message-Id: <0004211301330C.00884@loki.dyn.ez-ip.net> Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Charles Manick Livermore , fwtk-users@lists.nai.com Content-Length: 2302 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi Joe, ..never thought of that.. often admire as mentioned below.. but really like heavy..heavy.. commenting when code is one liner that makes my brain hurt. that way i can follow and learn perhaps about optimized coding. then i can try it out and maybe tighten my code considerably.. sure is amazing to see those that can do in 2 lines what takes huge effort on my part lucky doing in 10. mind you your correct about it getting obfuscated. but then again 'usually' most that can do that simply no longer use English IYKWIM. they are communicating on a plane that only when i zone i ever get to.. which although it happens is the exception;-{) rather than the rule:-)) Best Regards, dreamwvr@dreamwvr.com > On Fri, Apr 21, 2000 at 09:23:25AM -0600, dreamwvr wrote: > > intermediate coder at best:-{ Why? because i have noticed so many times > > when someone else i knew wrote code that i did 10 lines more simply in > > 2. :-/ now that is a very admirable trait IMHO which is why i say .. > > "less is MORE" > > ;-) > > Hey, Weaver. > > Not necessarily. I would much rather have 10 simple line that follow > Joe's First Rule of Software Engineering - "Say What You Mean" - than 2 > lines that could be entered into the Obfuscated C contest or an APL > beauty contest. ;-) > > -- > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao > COSPO/OSIS Computer Support EMT-B _______________________________________________________________________ ************** DREAMWVR.COM - TOTAL INTERNET SERVICES **************** TOTAL DESIGN - DEVELOPMENT - INTEGRATION - SECURITY - Click Here.. DREAMWVR.COM - The Console of Many... 90 Topics Covered ->> LINUX-MANDRAKE Solution Provider and North American Distributor <<- PRODUCT OF THE YEAR! "===0 PGP Key Available *************** "As Unique as the Company You Keep." ***************** "If anyone speaks from DREAMWVR.COM its certainly not me:-)" ________________________________________________________________________ From owner-fwtk-users@ex.tis.com Fri Apr 21 15:45 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA23588 Fri, 21 Apr 2000 15:45:41 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA17265; Fri, 21 Apr 2000 12:51:19 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 21 Apr 2000 12:09:08 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA14110 for fwtk-users-outgoing; Fri, 21 Apr 2000 12:08:47 -0700 (PDT) Date: Fri, 21 Apr 2000 15:07:59 -0400 From: Joseph S D Yao To: dreamwvr Cc: Joseph S D Yao , "A.S.Johnson" , Charles Manick Livermore , fwtk-users@lists.nai.com Subject: Re: less is MORE ;-)) Message-Id: <20000421150759.X28213@washington.cospo.osis.gov> Mail-Followup-To: dreamwvr , Joseph S D Yao , "A.S.Johnson" , Charles Manick Livermore , fwtk-users@lists.nai.com References: <00042109384206.00884@loki.dyn.ez-ip.net> <20000421143217.M28213@washington.cospo.osis.gov> <0004211301330C.00884@loki.dyn.ez-ip.net> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <0004211301330C.00884@loki.dyn.ez-ip.net>; from dreamwvr@dreamwvr.com on Fri, Apr 21, 2000 at 12:54:11PM -0600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1663 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Apr 21, 2000 at 12:54:11PM -0600, dreamwvr wrote: > hi Joe, > ..never thought of that.. often admire as mentioned below.. but really > like heavy..heavy.. commenting when code is one liner that makes my brain > hurt. that way i can follow and learn perhaps about optimized coding. then i can > try it out and maybe tighten my code considerably.. sure is amazing to see > those that can do in 2 lines what takes huge effort on my part lucky doing in > 10. mind you your correct about it getting obfuscated. but then again 'usually' > most that can do that simply no longer use English IYKWIM. they are > communicating on a plane that only when i zone i ever get to.. which although > it happens is the exception;-{) rather than the rule:-)) > Best Regards, > dreamwvr@dreamwvr.com One of the rules of good coding is: let the optimizer optimize. Let the human just get it right. To which end, the First Law. If you follow the First Law the way Joe intended it, the code will be about as optimal as it needs to be, anyway. ;-) Once you've got it right, if you instrument the code and find that all the work is being done in one place, THEN you may want to try optimizing that one place. but don't be surprised if your first attempts either break the code or slow it down. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Sun Apr 23 15:02 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA29119 Sun, 23 Apr 2000 15:02:36 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA21565; Sun, 23 Apr 2000 12:07:44 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 23 Apr 2000 10:41:14 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA19993 for fwtk-users-outgoing; Sun, 23 Apr 2000 10:41:02 -0700 (PDT) Message-Id: X-Sender: neuro@it-world.nu@192.168.2.1 X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0 Date: Sun, 23 Apr 2000 13:38:48 +0200 To: monz@danbbs.dk From: Robban Subject: Re: ICQ in/out of firewall Cc: fwtk-users@lists.nai.com In-Reply-To: <39008AE1.2D3355DC@danbbs.dk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 1950 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Mogens, I'm running ICQ behind FWTK home. What I did to make it work? ;p First i downloaded UDPRELAY (after a while I discoverd the standard version of udprelay didn't work under linux... but there's a version of it to linux) and in the /etc/udprelay.conf, i just added: relay 192.168.2.0 mask 255.255.255.0 * 4000 icq.mirabilis.com 4000 any And configured the icq-client to connect to the firewall @ port 4000... But (yes... there allways a but...) You can't etablish a direct contakt with anyone =(, so if you don't check the box: "auto-send trough server" an "error box" will apear on the screen and tell you that... and you can't send or recive files... I don't know how it works with an internal icq-server (mirabilis haven't released one to linux...yet...)... There is noway to get filetransfers to work with udprelay... I know there wasn't to much help, but i hope you solve the problem... Best Regards //Robban At 19:07 2000-04-21 +0200, you wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >I am more or less forced to enable ICQ from the inside of our firewall, >just not sure how to handle it. Don't have much experience with ICQ, and >I don't like the idea of merely allowing access though normal ports >(4000). How about setting up a private ICQ server on the private net and >let it handle connections. >Ideas and product hints more than welcome. We are using both Linux and >Windoze9x/2k workstations. >-- >Mogens Valentin WWW: http://www.danbbs.dk/~monz/ mailto:monz@danbbs.dk >Web, Programming, Network, Security - Installguides and docs for Linux.. >Skaane/Sjaelland Linux User Group (5300++ members) - http://www.sslug.dk >Use http://www.linux.org/ for freedom of choice with OpenSource software > From owner-fwtk-users@ex.tis.com Sun Apr 23 17:50 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA29424 Sun, 23 Apr 2000 17:50:46 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA24743; Sun, 23 Apr 2000 14:56:25 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 23 Apr 2000 14:06:14 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA23634 for fwtk-users-outgoing; Sun, 23 Apr 2000 14:06:08 -0700 (PDT) X-Sender: neuro@it-world.nu@192.168.2.1 X-Mailer: QUALCOMM Windows Eudora Pro Version 4.0 Date: Sun, 23 Apr 2000 22:45:04 +0200 To: fwtk-users@lists.nai.com From: Robban Subject: Forwarding to internal host... Mime-Version: 1.0 Message-Id: <200004232244626.SM01120@neuro> Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 554 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello all! I wounder how I should do, i'm trying to let the outside world get access to my http-server. HTTP FWTK INET 192.168.2.5 192.168.2.1 193.150.240.142 Should I use the "forward" option in http-gw, or plug-gw? I don't know how i should set plug-gw up, so if you rekomend it maybe you can give me an example on it??? Regards Robert Olsson (Excuse my bad english...) From owner-fwtk-users@ex.tis.com Mon Apr 24 06:45 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA01312 Mon, 24 Apr 2000 06:45:27 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA16546; Mon, 24 Apr 2000 03:51:09 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 24 Apr 2000 02:55:58 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA14205 for fwtk-users-outgoing; Mon, 24 Apr 2000 02:55:52 -0700 (PDT) Date: Mon, 24 Apr 2000 11:54:50 +0200 (MET DST) From: =?ISO-8859-2?Q?Marcin_CIE=A6LAK?= To: fwtk-users@lists.nai.com Subject: http-gw: A new patch for JavaScript quoting Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 8BIT Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=ISO-8859-2 Content-Length: 1959 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have developed a bit better solution for JavaScript quoting in http-gw. Apparently, the http-gw seemed to remove the final quote in situations like: The patch enclosed postpones a write of the final quote, _not_ removing the final quote from the attribute's value. The patch should be applied to the original source. -- << Marcin Cie¶lak // saper@sgh.waw.pl >> --- http-gw.c_orig Sun Apr 23 22:38:59 2000 +++ http-gw.c Mon Apr 24 11:49:51 2000 @@ -1935,6 +1935,7 @@ static char value[1028]; /* attribute value */ char *p; /* march thru above fields with this */ int quoted = 0; /* current quote character or 0 */ + int last_quoted = 0; /* last character is final quote, skip */ int in_blocked = 0; /* 1 if we are blocking part of HTML */ int got_close; /* 1 if found a slash so match is close */ int check_now = 0; /* 1 if done with field, time to check */ @@ -2237,6 +2238,7 @@ if ((p - value) > 1026) p--; if (ch == quoted) { quoted = 0; + last_quoted = 1; /* avoid double write */ state = IN_WS_1; check_now = 1; } @@ -2284,10 +2286,6 @@ (!strcasecmp(attribute,"content"))) seek_and_destroy(value); - /* Quote at end removed to avoid double write*/ - p = value + strlen(value) - 1; - if ((*p == '"') || (*p == '\'')) *p = 0; - /* write out the saved (or rewritten) field now */ if (!in_blocked) net_write(sockfd,value,strlen(value)); @@ -2360,9 +2358,12 @@ && (state != IN_ATTRIBUTE) && - (state != IN_VALUE))) { + (state != IN_VALUE) + && + (!last_quoted))) { write(sockfd, buf, 1); } + last_quoted = 0; prev = ch; } /* if we ended due to EOF or content_length but were building up From owner-fwtk-users@ex.tis.com Mon Apr 24 11:30 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA02322 Mon, 24 Apr 2000 11:30:53 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA05636; Mon, 24 Apr 2000 08:35:29 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 24 Apr 2000 07:50:22 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA00136 for fwtk-users-outgoing; Mon, 24 Apr 2000 07:50:16 -0700 (PDT) From: "Ken Long" Organization: Lectrosonics, Inc. To: fwtk-users Date: Mon, 24 Apr 2000 08:49:28 -0600 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: Re: ICQ in/out of firewall Message-ID: <39040A99.22443.6B2F74@localhost> In-reply-to: <39008AE1.2D3355DC@danbbs.dk> X-mailer: Pegasus Mail for Win32 (v3.12c) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 1155 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Settting up an internal ICQ server would be a good solution security-wise as long as you don't need outside ICQ connections. If you do need connections to the outside, the best ICQ functionally is through a Socks5 proxy. NEC has one at http://www.socks.nec.com/socks5.html, though I understand there are security implications with Socks5. I've also been quite successful with using ICQ for chatting and file transfers through IPCHAINS/IPMASQ on Linux. Regards, Ken Long On 21 Apr 2000, at 19:07, MONZ wrote: > I am more or less forced to enable ICQ from the inside of our firewall, > just not sure how to handle it. Don't have much experience with ICQ, and > I don't like the idea of merely allowing access though normal ports > (4000). How about setting up a private ICQ server on the private net and > let it handle connections. > Ideas and product hints more than welcome. We are using both Linux and > Windoze9x/2k workstations. > -- > Mogens Valentin WWW: http://www.danbbs.dk/~monz/ mailto:monz@danbbs.dk From owner-fwtk-users@ex.tis.com Mon Apr 24 11:30 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA02323 Mon, 24 Apr 2000 11:30:53 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA05640; Mon, 24 Apr 2000 08:35:30 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 24 Apr 2000 07:44:28 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA29487 for fwtk-users-outgoing; Mon, 24 Apr 2000 07:44:07 -0700 (PDT) Message-Id: <3.0.3.32.20000421140136.007517a4@mail.denver.gd-is.com> X-Sender: dsmith@mail.denver.gd-is.com X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.3 (32) Date: Fri, 21 Apr 2000 14:01:36 -0600 To: "A.S.Johnson" , Charles Manick Livermore From: Donald J Smith Subject: Re: FWTK To Hard to Compile if your not a Programmer!! Cc: fwtk-users@lists.nai.com In-Reply-To: References: <4.3.0.20000420101041.00b418c0@lsli.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 2160 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:53 AM 4/21/00 +0100, A.S.Johnson wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > > > >More does not mean better! So three times more code does not mean it is >better than FWTK, as they say, "One does not get diamonds as big as >bricks!" The reason FWTK is small was so it could be easily evalutated. Every bit of the code has been looked at (by thousands of programmers!!) to insure it doesn't have any know security problems. Lots of minor mistakes were found. Lots of changes have been done to eliminate possible buffer overflows etc... I have no knowledge about this other product. I have been working with FWTK since the very begining. FWTK is a FIREWALL TOOL KIT. It is intended for COMPUTER SECURITY PROFESSIONALS with a fair amount of programming background. It is not intended for people who will not/ can not read the manuals. You want an easy to use, precompiled, GUI configured, Firewall with Fulltime support buy one. Sorry to rage but nearly half of the problems reported via this list now are well known problems or can be solved by READING the instructions. Maybe it's time to include the full documentation with the fwtk. Last time i looked it was a seperate download;-) ------------------------------------------------------------------------------ Don Smith General Dynamics Information Systems Systems Administrator 8005 South Chester St EngleWood, Co. 80112 Phone (303) 649-7554 FAX (303) 649-7504 donald.j.smith@gd-is.com Error msgs that I love: "Keyboard not found press F1 to continue" (pc bios) "Harddrive controller failure insert new disk and press any key to continue" (pc bios) "The disk is write protected Remove the write protect or use another disk." (nt) User must change his password before he logs in the first time. (nt) ------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Tue Apr 25 12:17 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA07751 Tue, 25 Apr 2000 12:17:30 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA17710; Tue, 25 Apr 2000 09:23:18 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 25 Apr 2000 08:24:29 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA09339 for fwtk-users-outgoing; Tue, 25 Apr 2000 08:24:23 -0700 (PDT) From: "Ken Long" Organization: Lectrosonics, Inc. To: fwtk-users@ex.tis.com Date: Tue, 25 Apr 2000 09:23:21 -0600 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: Re: ICQ in/out of firewall Message-ID: <39056408.14827.880C6F@localhost> In-reply-to: <200004251500.TAA18699@paranoid.eltex.spb.ru> References: <39040A99.22443.6B2F74@localhost> from ""Ken Long" " X-mailer: Pegasus Mail for Win32 (v3.12c) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 3390 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On a scale from best functionality to best security the choices for ICQ are: 1. Direct connection with a dedicated ip address 2. Socks5 proxy 3. Ipchains/Ipmasq with the icq module 4. Ip As we all know, there are always trade-offs between program functionality and security. The most secure method is to remove the power plug from the wall. At the other end of the spectrum, the best functionality is achieved with a direct connection to the Internet and individual public ip addresses. Most of us will fall somewhere between those two extremes. If allowing ICQ has already been decided then we as administrators need to show what options and consequences are available. Flexibility is key here in order to support the business. Sometimes we have to strongly insist that certain functions not be allowed but we have to have our facts in order and not rely on a simple "it's against our security policy" argument. Once in a while we find ourselves on the losing end of the argument. It's important to implement the new function with as much security as possible and maybe even do a little cya in the process. If it was easy, anybody could do it. Ken On 25 Apr 2000, at 19:00, ark@eltex.ru wrote: > nuqneH, > > It depends on what you call "best". > I think it is "best" not to allow icq direct connections because of > security, control and monitoring reasons (not to speak about socks security > implications in general i already wrote about some months ago) > > "Ken Long" said : > > > > Settting up an internal ICQ server would be a good solution security-wise as > > long as you don't need outside ICQ connections. If you do need connections > > to the outside, the best ICQ functionally is through a Socks5 proxy. NEC > > has one at http://www.socks.nec.com/socks5.html, though I understand there > > are security implications with Socks5. I've also been quite successful with > > using ICQ for chatting and file transfers through IPCHAINS/IPMASQ on Linux. > > > > Regards, > > Ken Long > > > > On 21 Apr 2000, at 19:07, MONZ wrote: > > > > > I am more or less forced to enable ICQ from the inside of our firewall, > > > just not sure how to handle it. Don't have much experience with ICQ, and I > > > don't like the idea of merely allowing access though normal ports (4000). > > > How about setting up a private ICQ server on the private net and let it > > > handle connections. Ideas and product hints more than welcome. We are > > > using both Linux and Windoze9x/2k workstations. -- Mogens Valentin WWW: > > > http://www.danbbs.dk/~monz/ mailto:monz@danbbs.dk > > > > _ _ _ _ _ _ _ > {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ > (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| > [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! > > -----BEGIN PGP SIGNATURE----- > Version: 2.6.3i > Charset: noconv > > iQCVAwUBOQWy9KH/mIJW9LeBAQFxqAP6A0Maxig6p9o7kOwMnaFWzQ1DH/Zgktlr > iTu+JBBJd6qEJaAqESlY9jqvVCTrE883cjYG/9zEoSVckUYIOVAOX3QPohBuP3gV > 6dcFjchJu3E4sXir0gqs/MlpRhziuRIFetVmKT42JHitx/qVqS3v2Lp8bBccimxP > 4nRIk69KWeI= > =RyiN > -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Apr 25 12:17 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA07754 Tue, 25 Apr 2000 12:17:38 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA17716; Tue, 25 Apr 2000 09:23:21 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 25 Apr 2000 08:02:26 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA07010 for fwtk-users-outgoing; Tue, 25 Apr 2000 08:02:14 -0700 (PDT) From: ark@eltex.ru Date: Tue, 25 Apr 2000 19:00:05 +0400 Message-Id: <200004251500.TAA18699@paranoid.eltex.spb.ru> In-Reply-To: <39040A99.22443.6B2F74@localhost> from ""Ken Long" " Organization: "Klingon Imperial Intelligence Service" Subject: Re: ICQ in/out of firewall To: ken@lectrosonics.com Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 2264 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, It depends on what you call "best". I think it is "best" not to allow icq direct connections because of security, control and monitoring reasons (not to speak about socks security implications in general i already wrote about some months ago) "Ken Long" said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Settting up an internal ICQ server would be a good solution security-wise as > long as you don't need outside ICQ connections. If you do need connections > to the outside, the best ICQ functionally is through a Socks5 proxy. NEC has > one at http://www.socks.nec.com/socks5.html, though I understand there are > security implications with Socks5. I've also been quite successful with > using ICQ for chatting and file transfers through IPCHAINS/IPMASQ on Linux. > > Regards, > Ken Long > > On 21 Apr 2000, at 19:07, MONZ wrote: > > > I am more or less forced to enable ICQ from the inside of our firewall, > > just not sure how to handle it. Don't have much experience with ICQ, and > > I don't like the idea of merely allowing access though normal ports > > (4000). How about setting up a private ICQ server on the private net and > > let it handle connections. > > Ideas and product hints more than welcome. We are using both Linux and > > Windoze9x/2k workstations. > > -- > > Mogens Valentin WWW: http://www.danbbs.dk/~monz/ mailto:monz@danbbs.dk > _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBOQWy9KH/mIJW9LeBAQFxqAP6A0Maxig6p9o7kOwMnaFWzQ1DH/Zgktlr iTu+JBBJd6qEJaAqESlY9jqvVCTrE883cjYG/9zEoSVckUYIOVAOX3QPohBuP3gV 6dcFjchJu3E4sXir0gqs/MlpRhziuRIFetVmKT42JHitx/qVqS3v2Lp8bBccimxP 4nRIk69KWeI= =RyiN -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Apr 25 12:19 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA07758 Tue, 25 Apr 2000 12:19:28 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA17898; Tue, 25 Apr 2000 09:25:26 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 25 Apr 2000 08:43:56 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA11798 for fwtk-users-outgoing; Tue, 25 Apr 2000 08:43:51 -0700 (PDT) X-Authentication-Warning: alfa.intrak.tuke.sk: Host tiger.intrak.tuke.sk [172.16.2.31] claimed to be tiger Message-ID: <01BFAEDD.A76542E0.vitek@intrak.tuke.sk> From: Lubos Vitek Reply-To: "vitek@intrak.tuke.sk" To: "fwtk-users@ex.tis.com" Subject: Smap relaying Date: Tue, 25 Apr 2000 17:42:39 +0200 X-Mailer: Microsoft Internet E-mail/MAPI - 8.0.0.4211 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 626 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, i have one question about smap. I installed smap with anti-relay patch. It is working good, but I need that smap work as follows: When someone sends an email to my server with "From: @xxxx.yy", smap send a "relay denied" message to the sender. But I want to allow such messages with sender set to @xxxx.yy (and not only from one site xxxx.yy ...). Is there any possibility to make this with configuration options in netperm-table ? Thank you for any suggestions... Fanatik. From owner-fwtk-users@ex.tis.com Wed Apr 26 06:41 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA13087 Wed, 26 Apr 2000 06:41:53 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA26963; Wed, 26 Apr 2000 03:47:36 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 26 Apr 2000 02:49:11 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA25574 for fwtk-users-outgoing; Wed, 26 Apr 2000 02:49:05 -0700 (PDT) Message-ID: <384277145.956742510283.JavaMail.root@web303-mc.mail.com> Date: Wed, 26 Apr 2000 05:48:30 -0400 (EDT) From: Nagaraj Gang To: fwtk-users@lists.nai.com Subject: netacl problem Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: mail.com X-Originating-IP: 203.197.139.80 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 376 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Could any body tell me.how can i Configure both ftpd and ftp-gw on my firewall machines. Thank in advance. Nagaraj ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup From owner-fwtk-users@ex.tis.com Thu Apr 27 09:04 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA18862 Thu, 27 Apr 2000 09:04:54 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA25635; Thu, 27 Apr 2000 06:10:39 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 27 Apr 2000 04:42:11 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA21719 for fwtk-users-outgoing; Thu, 27 Apr 2000 04:42:05 -0700 (PDT) From: =?iso-8859-1?Q?Roland_Kr=FCppel?= To: Subject: RE: netacl problem Date: Thu, 27 Apr 2000 13:40:35 +0200 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal In-Reply-To: <384277145.956742510283.JavaMail.root@web303-mc.mail.com> X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1262 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I did it that way (don't know if it's the best solution, but it works) inetd.conf ftp stream tcp nowait root /usr/local/etc/netacl wu.ftpd netperm-table netacl-wu.ftpd: permit-hosts 127.0.0.1 -exec /usr/sbin/wu.ftpd netacl-wu.ftpd: permit-hosts 192.168.0.* -exec /usr/local/etc/ftp-gw ftp-gw: permit-hosts 192.168.0.* To access wu-ftpd you have to provide e.g. anonymous@localhost as your username to the ftp-gw. Roland Krüppel Jr. System-Administrator Quirinus-Gymnasium Neuss > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Nagaraj Gang > Sent: Wednesday, April 26, 2000 11:49 AM > To: fwtk-users@lists.nai.com > Subject: netacl problem > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi > > Could any body tell me.how can i Configure both ftpd and ftp-gw on my > firewall machines. > > Thank in advance. > Nagaraj > > ______________________________________________ > FREE Personalized Email at Mail.com > Sign up at http://www.mail.com/?sr=signup > From owner-fwtk-users@ex.tis.com Thu Apr 27 11:08 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA19275 Thu, 27 Apr 2000 11:07:55 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA08605; Thu, 27 Apr 2000 08:14:04 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 27 Apr 2000 07:24:48 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA02206 for fwtk-users-outgoing; Thu, 27 Apr 2000 07:24:42 -0700 (PDT) From: "Dima Golubev" Reply-to: seca@iname.ru To: fwtk-users@ex.tis.com Date: Thu, 27 Apr 2000 14:23:15 +0000 (GMT) Subject: reverse proxying with ftp-gw Message-id: <39084d53.45c5.0@iname.ru> X-User-Info: 193.233.43.46 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="koi8-r" Content-Length: 1251 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi folks, I`m using ip filter and installed ftp-gw with appropriate patches in hopes of gaining more security for my servers doing ftp. Well, now I don`t need to open up even relatively small port ranges of several thousands ports for them and easily have centralised logging/blocking of ftp commands. OTOH I understand that ftp-gw was not designed for this kind of usage and so can have flaws from this POV. One of them is obvious to me - a yahoo can connect to ftp-gw directly and then jump to any ftp capable host inside my internal network. I deal with it passing ftp connections from my ip filter box only to the restricted number of ftp servers ("-dest" ftp-gw option doesn`t seem to work - "SIOCGNATL failed - No such process"). My questions follow: What do you think of this setup? Didn`t I lose security somewhere? Can ftp-gw be used for at least primitive ftp daemons exploitation protection? If yes are any modifications required? Your opinions are very appreciated. -- Dima ______________________________________________________________ iName - your free web-based mail service (http://www.iname.ru) From owner-fwtk-users@ex.tis.com Thu Apr 27 16:51 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA20521 Thu, 27 Apr 2000 16:51:55 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA17741; Thu, 27 Apr 2000 13:57:55 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 27 Apr 2000 13:02:22 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA07395 for fwtk-users-outgoing; Thu, 27 Apr 2000 13:02:16 -0700 (PDT) Message-ID: From: "Nixon, Anthony" To: "'fwtk-users@ex.tis.com'" Subject: Compiling 2.1 on RH 6.2 Date: Thu, 27 Apr 2000 16:01:29 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 706 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am presently having problems compiling the auth module of FWTK 2.1 on RH 6.2 (Intel). The error I get states: cc -I.. -g -DLINUX -c -o db.o db.c db.c:16: ndbm.h: No such file or directory Make[1]: *** [db.o] Error 1 I am assuming this pertains to issue 1.3.1: "fwtk/auth/db.c:66: undefined reference to `dbm_open'" errors in the FWTK FAQ. I have confirmed that gdbm and gdbm-development rpms are installed and the library file (per the FAQ) /usr/lib/libgdbm.a is present. I have also recompiled gdbm and still no luck. Any and all help would be greatly appreciated. Shon From owner-fwtk-users@ex.tis.com Thu Apr 27 18:17 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA20932 Thu, 27 Apr 2000 18:17:29 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA00731; Thu, 27 Apr 2000 15:23:26 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 27 Apr 2000 14:34:56 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA25049 for fwtk-users-outgoing; Thu, 27 Apr 2000 14:34:44 -0700 (PDT) Date: Thu, 27 Apr 2000 13:34:39 -0700 (PDT) From: Bill Faust X-Sender: bill@worf.ljr.com To: "Nixon, Anthony" cc: "'fwtk-users@ex.tis.com'" Subject: Re: Compiling 2.1 on RH 6.2 In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1720 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Just went through this last week. Attached below are the patches I made to enable it to find ndbm.h on my RedHat 6.2 system. Simply add 'gdbm/' to the includes in the three files authdum.c authload.c db.c. There are a few threads in this mailing list discussing this issue. Hope this is helpful. -- Bill Faust Optim Microwave 818-865-8157 ----------------------------- patches/authdump.c.diff ----------------------------- 16c16 < #include --- > #include ----------------------------- patches/authload.c.diff ----------------------------- 16c16 < #include --- > #include ----------------------------- patches/db.c.diff ----------------------------- 16c16 < #include --- > #include On Thu, 27 Apr 2000, Nixon, Anthony wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I am presently having problems compiling the auth module of FWTK 2.1 on RH > 6.2 (Intel). The error I get states: > > cc -I.. -g -DLINUX -c -o db.o db.c > db.c:16: ndbm.h: No such file or directory > Make[1]: *** [db.o] Error 1 > > I am assuming this pertains to issue 1.3.1: "fwtk/auth/db.c:66: undefined > reference to `dbm_open'" errors in the FWTK FAQ. I have confirmed that gdbm > and gdbm-development rpms are installed and the library file (per the FAQ) > /usr/lib/libgdbm.a is present. I have also recompiled gdbm and still no > luck. Any and all help would be greatly appreciated. > > Shon > > From owner-fwtk-users@ex.tis.com Sun Apr 30 20:48 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA01250 Sun, 30 Apr 2000 20:48:12 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA05256; Sun, 30 Apr 2000 17:53:37 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 30 Apr 2000 16:26:55 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA03256 for fwtk-users-outgoing; Sun, 30 Apr 2000 16:26:49 -0700 (PDT) Message-ID: <20000430232551.23732.qmail@hotmail.com> X-Originating-IP: [12.77.220.237] From: "Terry Witherspoon" To: fwtk-users@lists.nai.com Subject: FWTK & IPSEC. Date: Sun, 30 Apr 2000 19:25:51 EDT Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; format=flowed Content-Length: 490 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I've some client PCs inside a fwtk firewall needing to use Nortel's Extranet Access Client to talk to a Contivity switch at another location. Is it possible to Proxy ipsec with fwtk? Any info welcome. TW ________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com From owner-fwtk-users@ex.tis.com Sun Apr 30 22:15 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA01376 Sun, 30 Apr 2000 22:15:09 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA08050; Sun, 30 Apr 2000 19:21:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 30 Apr 2000 18:33:58 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA06295 for fwtk-users-outgoing; Sun, 30 Apr 2000 18:33:47 -0700 (PDT) Message-Id: <4.3.1.2.20000430211917.00c10a10@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.1 Date: Sun, 30 Apr 2000 21:21:23 -0400 To: "Terry Witherspoon" , fwtk-users@lists.nai.com From: Rick Murphy Subject: Re: FWTK & IPSEC. In-Reply-To: <20000430232551.23732.qmail@hotmail.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 415 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 07:25 PM 4/30/00 -0400, Terry Witherspoon wrote: >Is it possible to Proxy ipsec with fwtk? Any info welcome. Nope. IPsec uses some non-TCP protocols. About all you can do is to use packet filtering rules to permit AH/ESP through (and probably IKE, which uses UDP). -Rick