From owner-fwtk-users@ex.tis.com Mon Oct 2 11:30 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA07612 Mon, 2 Oct 2000 11:30:26 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA07235; Mon, 2 Oct 2000 08:39:47 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Oct 2000 06:43:40 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA24285 for fwtk-users-outgoing; Mon, 2 Oct 2000 06:43:29 -0700 (PDT) Message-ID: From: "Nixon, Anthony" To: fwtk-users@ex.tis.com Subject: Ipbind and multiple websites on DMZ web server Date: Mon, 2 Oct 2000 09:42:49 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 629 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have a system with 3 nics and have patched the FWTK with the ipbind patch. All is OK, but was wondering if I could host multiple websites off of the DMZ nic? Could virtual addresses be applied to the external nic and then those addresses be pluged to the DMZ nic with multiple binded plug-to's? Would this work? Anyone tried this before? I have 5 company websites (a parent and its 4 subsidiaries) that I need to host in-house. Shon Nixon Chief - Information Technology Midrex Enterprises, Inc. From owner-fwtk-users@ex.tis.com Mon Oct 2 11:30 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA07611 Mon, 2 Oct 2000 11:30:25 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA07231; Mon, 2 Oct 2000 08:39:47 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Oct 2000 06:20:46 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA22487 for fwtk-users-outgoing; Mon, 2 Oct 2000 06:20:05 -0700 (PDT) Message-Id: <4.3.2.7.2.20000929191625.00ad6220@mail.clark.net> X-Sender: avolio@mail.clark.net X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Fri, 29 Sep 2000 19:32:56 -0400 To: "Luis Fernando Barrera" , From: Frederick M Avolio Subject: Re: pop-gw encrypted? In-Reply-To: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1373 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 02:51 PM 9/29/00 -0600, Luis Fernando Barrera wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >Hi, > >Is there a way to encrypt the connection between some external user >and the pop-gw of the FWTK? Thus, not sending the user/password >of the outlook client (for example) in clear text... > >I've seen an option of the pop-gw called APOP, but I understant that its >purpose is not to encrypt the user/password. >As far as I know the POP3 protocol itself sends the user/password in clear >text... APOP does not send the password in the clear. Instead, it sends a random string of data in the clear. The client side, catenates the random string onto the password, makes an MD5 cryptographic hash of it, and sends that hash value in the clear. The server has the user's password and does the same. If the hash values match, the password was correct. This is not directly susceptible to an eavesdropping attack, but is to a brute force attack or a poorly chosen password. Fred Avolio Consulting, Inc. 16228 Frederick Road, PO Box 609, Lisbon, MD 21765, US +1 410-309-6910 (voice) +1 410-309-6911 (fax) http://www.avolio.com/ From owner-fwtk-users@ex.tis.com Mon Oct 2 13:02 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA07910 Mon, 2 Oct 2000 13:02:51 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA19448; Mon, 2 Oct 2000 10:11:41 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Oct 2000 08:44:27 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA07624 for fwtk-users-outgoing; Mon, 2 Oct 2000 08:43:56 -0700 (PDT) Date: Mon, 2 Oct 2000 11:43:11 -0400 From: Joseph S D Yao To: Rick Murphy Cc: Luis Fernando Barrera , fwtk-users@tis.com Subject: Re: pop-gw encrypted? Message-Id: <20001002114311.D16056@washington.cospo.osis.gov> Mail-Followup-To: Rick Murphy , Luis Fernando Barrera , fwtk-users@tis.com References: <4.3.2.7.2.20000929210413.00b99ac0@mail.itm-inst.com> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <4.3.2.7.2.20000929210413.00b99ac0@mail.itm-inst.com>; from rmurphy@itm-inst.com on Fri, Sep 29, 2000 at 09:10:45PM -0400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1593 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Sep 29, 2000 at 09:10:45PM -0400, Rick Murphy wrote: ... > At 02:51 PM 9/29/00 -0600, Luis Fernando Barrera wrote: > >Is there a way to encrypt the connection between some external user > >and the pop-gw of the FWTK? Thus, not sending the user/password > >of the outlook client (for example) in clear text... > > You would need to have a mail client that knows how to encrypt the > connection (as well as an encrypting POP server). I seem to remember that > there's some mail readers that can use POP-over-SSL to encrypt the > connection; that's probably worth investigating. I wasn't sure whether I remembered that or not ... but if there is, it's probably Eudora. > >I've seen an option of the pop-gw called APOP, but I understant that its > >purpose is not to encrypt the user/password. > > APOP replaces the password authentication with a challenge-response > mechanism. Thus, the password isn't sent over the wire - it's used to hash > a challenge. APOP is far better than standard POP because the password > isn't sent in the clear; it's still subject to a dictionary attack against > the password (if you can sniff the challenge and the response, you can > brute-force the password). But it's pretty hard, no? -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Mon Oct 2 13:03 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA07926 Mon, 2 Oct 2000 13:03:52 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA19693; Mon, 2 Oct 2000 10:13:06 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Oct 2000 08:58:47 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA09264 for fwtk-users-outgoing; Mon, 2 Oct 2000 08:58:26 -0700 (PDT) Date: Mon, 2 Oct 2000 11:35:52 -0400 From: Joseph S D Yao To: Luis Fernando Barrera Cc: fwtk-users@tis.com Subject: Re: pop-gw encrypted? Message-Id: <20001002113552.C16056@washington.cospo.osis.gov> Mail-Followup-To: Luis Fernando Barrera , fwtk-users@tis.com References: Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from luba@assist.com.gt on Fri, Sep 29, 2000 at 02:51:42PM -0600 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1166 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Sep 29, 2000 at 02:51:42PM -0600, Luis Fernando Barrera wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > Is there a way to encrypt the connection between some external user > and the pop-gw of the FWTK? Thus, not sending the user/password > of the outlook client (for example) in clear text... > > I've seen an option of the pop-gw called APOP, but I understant that its > purpose is not to encrypt the user/password. > As far as I know the POP3 protocol itself sends the user/password in clear text... > > Luis Fernando Barrera > luba@assist.com.gt This has been discussed on the qpopper mailing list. I believe that the best suggestion was to use ssh between client and host. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Mon Oct 2 13:18 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA07998 Mon, 2 Oct 2000 13:18:15 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA21809; Mon, 2 Oct 2000 10:27:29 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Oct 2000 09:11:43 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA10897 for fwtk-users-outgoing; Mon, 2 Oct 2000 09:11:22 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: Date: Fri, 29 Sep 2000 09:43:32 +0100 (BST) From: Tony Gale To: Luis Fernando Barrera Subject: RE: squid, http-gw and squid-gw Cc: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 2961 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 29-Sep-2000 Luis Fernando Barrera wrote: > > I recently asked whether squid versus http-gw versus squid-gw.... > Somebody > "gracefully" sent me to the list archive... So I did it... > > However some questions still bother me, maybe the guys who already > passed for this info nightmare can give me a hand... > > 1) http-gw is the same as squid-gw? > > I read that they are almost the same with a little advantage of > squid-gw above http-gw? http-gw and squid-gw are designed to be used as a component of a firewall system - i.e. their goal is to enforce a security policy. What they have in common is that they both act as an http proxy. So, which one you use will depend largely on your security policy - which you have already written, right? Security professionals would probably give a higher confidence score to http-gw, but that is not to say that squid-gw is not secure. > > 2) It is not recommended to put squid in the firewall box, right? > I saw several messages that squid alone and squid-gw (http-gw) > are the same in terms of security... It is never recommended to have a firewall with a "mix" of software systems. And, no two pieces of software are the same in terms of security - functionality maybe. > > 3) You can put the squid software in an internal host and then all > the http > requests from the internal users, go "relayed" to the squid-gw? Yes. > > 4) If you want to put a public web server, it is not a good idea to > put it > behind the firewall, even with the "accelerated options" of > squid > or another trick from squid-gw, right? Correct. > > 5) You can put the web server in a third network segment, using a 3 > nic in the > firewall, and configure the squid-gw to ONLY permite http > traffic from > the web server to the internet and viceversa? You have to be *really* careful here. The FWTK is not designed to operate in this way. I would not recommend it. It would be better to have a separate parallel box to handle incoming connections and have the internet web server behind that (not connected to your internal network). For example, ou have to pay attention to CONNECT handling on incoming connections. It would be better to buy a commercial firewall that is designed to do what you want. > > How am I doing? My head is a little mixed up, maybe some > definitions > of the products and their intentions could help... Anybody know > these definitions? For some good text try: http://cs-www.ncsl.nist.gov/nistpubs/800-10/main.html -tony --- E-Mail: Tony Gale There are only two kinds of tequila. Good and better. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Mon Oct 2 13:58 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA08113 Mon, 2 Oct 2000 13:58:20 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA27268; Mon, 2 Oct 2000 11:06:16 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Oct 2000 09:45:52 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA15557 for fwtk-users-outgoing; Mon, 2 Oct 2000 09:45:21 -0700 (PDT) Message-ID: <6084E7846673D311AC87009027AA6AA703294DC6@tx-exchange2.nai.com> From: "Jensen, Greg" To: ark@eltex.ru, Phil_Udel@salemleasing.com Cc: fwtk-users@ex.tis.com, firewall-wizards@nfr.net Subject: RE: [fw-wiz] Re: FWTK Lic Questions Date: Mon, 2 Oct 2000 09:37:55 -0700 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 3898 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] To respond to all the talk about how you can/can't use FWTK. Let me clarify. The license that one agrees to when downloading FWTK indicates that it cannot be used in a "re-sell" enviorment. This means that an organization or an individual cannot take FWTK, modify the code, and resell the product to a third party. FWTK is free for all, and free for use on Commercial networks if one chooses to. This is a "not for profit" firewall package that has no support from TIS, NAI or PGP. It has always been the policy of TIS, Network Associates and PGP Security that FWTK can be used in a commercial enviorment without having to pay royalties or license fees of any form to Network Associates or PGP Security, if used and implemented in the manor described above. If one wishes to upgrade to a full blown version of the Gauntlet VPN Firewall, that is thier choice, but not mandatory if one wishes to use FWTK in thier company. Thank you! -GJ "cheat sheet" Can: You can download and use for free in your organization or corporation Can't: You cannot re-sell FWTK or modify the code and re-sell. This is a "not for profit" firewall. -----Original Message----- From: ark@eltex.ru [mailto:ark@eltex.ru] Sent: Thursday, September 28, 2000 4:42 AM To: Phil_Udel@salemleasing.com Cc: fwtk-users@ex.tis.com; firewall-wizards@nfr.net Subject: [fw-wiz] Re: FWTK Lic Questions -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Sounds damn strange. The license is clear enough. Could you please provide us the name of that asshole? Hope NAI will fsck him for spreading bullshit. That looks quite bad, though. Not because they will send software cops to you - just because NAI is too big to control itself and it is bad for fwtk. Speaking on licensing and development, looks like they simply can not find a person inside the company who is responsible for fwtk and has the power to make decisions on it. I am cc'ing to firewall-wizards. BTW if you don't know that, t.rex contains some fwtk code too. "Phil Udel" said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > HI > I just started at a new company that ran the FWTC. It Looks like a nice= > product. I called PNP to see what the current version of the FWTC was,= You mean PGP? > and to see what gauntlet cost. Well, When the salesman found out we ran= > the FWTC at a company he said I need to pay him 12k or stop using the= > product. I told him No Way and that I would replace the product with= > t.rex ASAP. The salesman said he was going to send software cops to make= > sure I did. I don't know the history of this product or the company, so= > here are my questions. Question 1:Has the FWTC always been a non-profit= > product? Question Two: has anyone else had to pay for the FWTK. Question= > Three: If so How much did you pay? > Thanks > Phillip Udel > Admin@SalemLeasing.com > (800) 877-2536 Ext 212 _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBOdMSbqH/mIJW9LeBAQF5YAQAsh+LHvEBvtKowACwW+caq8jfCTjJkkRW 9vPb27A7SIMC2/tRVJZ4kF4w2e4q3ZXvhtckaONz03WaV+8WHQMHbMRyyTq9p5A1 XHdBpsTHlmyHGni+EgLpwVfxGC40d2I0jcFPZvbg9EZyhfhdPrvEctgATz1Mbhbr oh2M4GSVbPM= =ZNC4 -----END PGP SIGNATURE----- _______________________________________________ Firewall-wizards mailing list Firewall-wizards@nfr.net http://www.nfr.net/mailman/listinfo/firewall-wizards From owner-fwtk-users@ex.tis.com Mon Oct 2 14:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA08320 Mon, 2 Oct 2000 14:38:42 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA03376; Mon, 2 Oct 2000 11:47:25 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Oct 2000 10:25:12 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA21368 for fwtk-users-outgoing; Mon, 2 Oct 2000 10:24:30 -0700 (PDT) From: dreamwvr To: Joseph S D Yao , Rick Murphy Subject: Re: pop-gw encrypted? Date: Mon, 2 Oct 2000 11:52:13 -0600 X-Mailer: KMail [version 1.0.29] Cc: Luis Fernando Barrera , fwtk-users@tis.com References: <4.3.2.7.2.20000929210413.00b99ac0@mail.itm-inst.com> <20001002114311.D16056@washington.cospo.osis.gov> In-Reply-To: <20001002114311.D16056@washington.cospo.osis.gov> MIME-Version: 1.0 Message-Id: <0010021154281R.00774@tyr> Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 470 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi, yes eudora but make sure it is a patched version as there was a nasty bug some time ago.. as well layer it with stunnel that way there are 2 crypt factors to overcome.. on the connection besides good passwords. as we all know well if the passwords are no good well then it is all mute.. Best Regards, dreamwvr@dreamwvr.com From owner-fwtk-users@ex.tis.com Mon Oct 2 14:48 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA08331 Mon, 2 Oct 2000 14:48:03 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA04611; Mon, 2 Oct 2000 11:57:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Oct 2000 10:42:01 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA23678 for fwtk-users-outgoing; Mon, 2 Oct 2000 10:41:30 -0700 (PDT) From: "C. Regis Wilson" To: "Tony Gale" , "Luis Fernando Barrera" Cc: Subject: RE: squid, http-gw and squid-gw Date: Mon, 2 Oct 2000 10:39:59 -0700 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200 In-Reply-To: Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 534 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > > How am I doing? My head is a little mixed up, maybe some > > definitions > > of the products and their intentions could help... Anybody know > > these definitions? > > For some good text try: > > http://cs-www.ncsl.nist.gov/nistpubs/800-10/main.html > I like the link, but the graphic on the top of the page shows a castle with walls, a moat, and guards, but the drawbridge is down!! :) --Regis From owner-fwtk-users@ex.tis.com Mon Oct 2 17:27 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA08681 Mon, 2 Oct 2000 17:27:15 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA24863; Mon, 2 Oct 2000 14:36:19 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Oct 2000 13:06:41 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA14510 for fwtk-users-outgoing; Mon, 2 Oct 2000 13:06:10 -0700 (PDT) Date: Mon, 2 Oct 2000 16:05:24 -0400 From: Joseph S D Yao To: Tony Gale Cc: Luis Fernando Barrera , fwtk-users@tis.com Subject: Re: squid, http-gw and squid-gw Message-Id: <20001002160524.A16056@washington.cospo.osis.gov> Mail-Followup-To: Tony Gale , Luis Fernando Barrera , fwtk-users@tis.com References: Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from gale@syntax.dera.gov.uk on Fri, Sep 29, 2000 at 09:43:32AM +0100 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 953 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Sep 29, 2000 at 09:43:32AM +0100, Tony Gale wrote: ... > > 5) You can put the web server in a third network segment, using a 3 > > nic in the > > firewall, and configure the squid-gw to ONLY permite http > > traffic from > > the web server to the internet and viceversa? > > You have to be *really* careful here. The FWTK is not designed to > operate in this way. I would not recommend it. Odd. ISTM that it is quite usable in this way, and that many people are doing so. So, if it was not designed in, that was pretty lucky. Can you tell me on what basis you say this? Thanks. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Mon Oct 2 20:17 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA09286 Mon, 2 Oct 2000 20:16:42 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA11887; Mon, 2 Oct 2000 17:26:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Oct 2000 15:55:36 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA05150 for fwtk-users-outgoing; Mon, 2 Oct 2000 15:55:05 -0700 (PDT) Message-Id: <4.3.2.7.2.20001002162505.00bb3ba0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Mon, 02 Oct 2000 18:41:24 -0400 To: Joseph S D Yao From: Rick Murphy Subject: Re: pop-gw encrypted? Cc: Luis Fernando Barrera , fwtk-users@tis.com In-Reply-To: <20001002114311.D16056@washington.cospo.osis.gov> References: <4.3.2.7.2.20000929210413.00b99ac0@mail.itm-inst.com> <4.3.2.7.2.20000929210413.00b99ac0@mail.itm-inst.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 771 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 11:43 AM 10/2/00 -0400, Joseph S D Yao wrote: >On Fri, Sep 29, 2000 at 09:10:45PM -0400, Rick Murphy wrote: > > APOP is far better than standard POP because the password > > isn't sent in the clear; it's still subject to a dictionary attack against > > the password (if you can sniff the challenge and the response, you can > > brute-force the password). > >But it's pretty hard, no? Hard in that a true brute-force is going to take a lot of CPU cycles. Pretty easy to code; given targeted guesses and/or bad password choices it could be a very quick crack. Don't get me wrong - APOP is far better than clear-text auth. -Rick From owner-fwtk-users@ex.tis.com Tue Oct 3 06:27 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA10383 Tue, 3 Oct 2000 06:27:38 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA03053; Tue, 3 Oct 2000 03:37:00 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 3 Oct 2000 01:57:20 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA29910 for fwtk-users-outgoing; Tue, 3 Oct 2000 01:56:59 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <20001002160524.A16056@washington.cospo.osis.gov> Date: Tue, 03 Oct 2000 09:56:14 +0100 (BST) From: Tony Gale To: Joseph S D Yao Subject: Re: squid, http-gw and squid-gw Cc: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 1933 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 02-Oct-2000 Joseph S D Yao wrote: > On Fri, Sep 29, 2000 at 09:43:32AM +0100, Tony Gale wrote: > ... >> > 5) You can put the web server in a third network segment, using >> > a 3 >> > nic in the >> > firewall, and configure the squid-gw to ONLY permite http >> > traffic from >> > the web server to the internet and viceversa? >> >> You have to be *really* careful here. The FWTK is not designed to >> operate in this way. I would not recommend it. > > Odd. ISTM that it is quite usable in this way, and that many > people > are doing so. So, if it was not designed in, that was pretty > lucky. > > Can you tell me on what basis you say this? > The FWTK is designed to provide proxy services for internal users to access an external network. It is not designed to handle systems with lots of interfaces. You'll note the lack of interface binding facilities. squid-gw can bind to a specific interface (though it's not fully documented). But now you have software that does, and software that doesn't. Have you considered all possible interactions? As usual, you have to pay special attention to CONNECT handling. The squid-gw documentation isn't even consistent in it's description of it's CONNECT handling. What if someone breaks into the web-server on the third segment. Is your internal network still protected? Have you inspected the squid-gw code? It certainly hasn't had as much review as the FWTK components. As I said, you have to be *really* careful. I didn't say it wasn't possible. -tony --- E-Mail: Tony Gale "And remember: Evil will always prevail, because Good is dumb." -- Spaceballs The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Tue Oct 3 08:02 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA10664 Tue, 3 Oct 2000 08:01:52 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA07552; Tue, 3 Oct 2000 05:11:39 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 3 Oct 2000 03:46:41 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA03331 for fwtk-users-outgoing; Tue, 3 Oct 2000 03:46:20 -0700 (PDT) From: ark@eltex.ru Date: Tue, 3 Oct 2000 14:40:05 +0400 Message-Id: <200010031040.OAA26575@paranoid.alpha.int> In-Reply-To: <20001002160524.A16056@washington.cospo.osis.gov> from "Joseph S D Yao " Organization: "Klingon Imperial Intelligence Service" Subject: Re: squid, http-gw and squid-gw To: jsdy@cospo.osis.gov Cc: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 2057 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, It is definitrly not designed to operate that way. fwtk proxies are targeted on preventing client side from being attacked and can do little to prevent data-driven attacks to _servers_. (nearly all firewalls including commercial ones suffer from the same problem, though) Just get a buch of recent bugtaq server exploits and see if fwtk can help with it any way. I'd be happy to see a set of patches to solve^H^H^H^H^Hworkaround that issue. Looking into what zorp does can provide a good start. Joseph S D Yao said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > On Fri, Sep 29, 2000 at 09:43:32AM +0100, Tony Gale wrote: > .. > > > 5) You can put the web server in a third network segment, using a 3 > > > nic in the > > > firewall, and configure the squid-gw to ONLY permite http > > > traffic from > > > the web server to the internet and viceversa? > > > > You have to be *really* careful here. The FWTK is not designed to > > operate in this way. I would not recommend it. > > Odd. ISTM that it is quite usable in this way, and that many people > are doing so. So, if it was not designed in, that was pretty lucky. > > Can you tell me on what basis you say this? _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBOdm3haH/mIJW9LeBAQHtKgP+JnEyBOD1HokIp49T7sdRv5qQiZSxVJXY 3gpj3mq/DGu+ZQqpavVfHd5SW6YXOTDnjPvSdgKDcqatmKw3BB21oXfOpWRohGL3 uyO2q1M5X2p8Bv8QztPXWuZKBfJbNMDR0zYRZM3TI64F9I4/WEF6W2DdmtydPFzA bn6eLwqKj0I= =ArL4 -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Oct 3 09:53 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA11064 Tue, 3 Oct 2000 09:53:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA16779; Tue, 3 Oct 2000 07:02:48 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 3 Oct 2000 05:33:45 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA08523 for fwtk-users-outgoing; Tue, 3 Oct 2000 05:33:15 -0700 (PDT) From: ark@eltex.ru Date: Tue, 3 Oct 2000 16:26:41 +0400 Message-Id: <200010031226.QAA26931@paranoid.alpha.int> In-Reply-To: from "Tony Gale " Organization: "Klingon Imperial Intelligence Service" Subject: Re: squid, http-gw and squid-gw To: gale@syntax.dera.gov.uk Cc: jsdy@cospo.osis.gov, fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 2863 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Tony Gale said : > >> > 5) You can put the web server in a third network segment, using > >> > a 3 > >> > nic in the > >> > firewall, and configure the squid-gw to ONLY permite http > >> > traffic from > >> > the web server to the internet and viceversa? > >> > >> You have to be *really* careful here. The FWTK is not designed to > >> operate in this way. I would not recommend it. > > > > Odd. ISTM that it is quite usable in this way, and that many > > people > > are doing so. So, if it was not designed in, that was pretty > > lucky. > > > > Can you tell me on what basis you say this? > > > > The FWTK is designed to provide proxy services for internal users to > access an external network. > > It is not designed to handle systems with lots of interfaces. You'll > note the lack of interface binding facilities. > > squid-gw can bind to a specific interface (though it's not fully > documented). But now you have software that does, and software that > doesn't. Have you considered all possible interactions? You can achieve that by using ipbind patch and inetd binding features. The problem lies in another place. > As usual, you have to pay special attention to CONNECT handling. The > squid-gw documentation isn't even consistent in it's description of > it's CONNECT handling. Where? it is documented quite well. > What if someone breaks into the web-server on the third segment. Is > your internal network still protected? It depends on your setup. In general - if you do not grant additional rights to your third segment, the answer is yes. > Have you inspected the squid-gw code? It certainly hasn't had as much > review as the FWTK components. I did, and my general impression was that it is one of the safest part of code except maybe some mjr written by his own ;) Though it is not designed to pass requests to the service network. Hope http-in will get some development. > As I said, you have to be *really* careful. I didn't say it wasn't > possible. You always have to. There is no such thing as paranoia, that's all true ;). _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBOdnQgKH/mIJW9LeBAQEhFQP/fZ1ovUgGgp+QVupze++kYsDpwRBg9qdf DaMovi5rEYwyDFhPzY1WNAgwMBRkz5sqHn3Bzgg7n2L1s0lzWTC9JKLdqGqOSY6I 1u6rk3tiBpcQbw91JCnFftbTz4HagjaZpY2tMCtCmN0T0TXfmexdCfI8Oy52y72+ FG1Ob7nwL9I= =eP8i -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Oct 3 10:11 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA11083 Tue, 3 Oct 2000 10:10:26 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA19056; Tue, 3 Oct 2000 07:20:13 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 3 Oct 2000 06:03:48 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA10764 for fwtk-users-outgoing; Tue, 3 Oct 2000 06:03:18 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <200010031226.QAA26931@paranoid.alpha.int> Date: Tue, 03 Oct 2000 14:02:20 +0100 (BST) From: Tony Gale To: ark@eltex.ru Subject: Re: squid, http-gw and squid-gw Cc: fwtk-users@tis.com, jsdy@cospo.osis.gov Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 3108 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 03-Oct-2000 ark@eltex.ru wrote: > > Tony Gale said : > >> squid-gw can bind to a specific interface (though it's not fully >> documented). But now you have software that does, and software >> that >> doesn't. Have you considered all possible interactions? > > You can achieve that by using ipbind patch and inetd binding > features. > The problem lies in another place. Merely pointing out potential problems, not giving a definitive list. > >> As usual, you have to pay special attention to CONNECT handling. >> The >> squid-gw documentation isn't even consistent in it's description >> of >> it's CONNECT handling. > > Where? it is documented quite well. ---------------------------------- Bad request: unknown method squid-gw currently supports only the GET, HEAD, and POST request methods. Unsupported request methods include PUT and CONNECT. ---------------------------------- connect [:]... [ -ipaddr ... ] [ -delay ] [ -message ] [ -hosts ... ] Specify access permissions for https (SSL) based on the destination, that is, on the destination host.... ---------------------------------- > >> What if someone breaks into the web-server on the third segment. >> Is >> your internal network still protected? > > It depends on your setup. In general - if you do not grant > additional > rights to your third segment, the answer is yes. Again, I wasn't trying to point out every potential problem area, just some as examples. > >> Have you inspected the squid-gw code? It certainly hasn't had as >> much >> review as the FWTK components. > > I did, and my general impression was that it is one of the safest > part > of code except maybe some mjr written by his own ;) > > Though it is not designed to pass requests to the service network. > Hope http-in will get some development. Yes - the standard of coding in the FWTK can be, err... variable. But really, servers shouldn't require a "http-in" if the network design is right, with appropriate packet filtering and separation. Server software should be security hardened anyway. If it isn't then you've probably lost the battle already. I don't think an "http-in" would save you from most (any) of the server related bugs which have been reported. Most are due to bad cgi programming. > >> As I said, you have to be *really* careful. I didn't say it wasn't >> possible. > > You always have to. There is no such thing as paranoia, that's all > true ;). > Just because you're being paranoid doesn't mean people aren't out to get you. -tony --- E-Mail: Tony Gale The Kennedy Constant: Don't get mad -- get even. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Tue Oct 3 15:24 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA12606 Tue, 3 Oct 2000 15:24:49 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA04251; Tue, 3 Oct 2000 12:33:34 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 3 Oct 2000 10:26:13 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA14126 for fwtk-users-outgoing; Tue, 3 Oct 2000 10:25:04 -0700 (PDT) Message-ID: <39D9EDD0.5E597FC5@cclinf.polito.it> Date: Tue, 03 Oct 2000 16:31:44 +0200 From: Antonio Bonavita Organization: Politecnico X-Mailer: Mozilla 4.72 [en] (X11; I; Linux 2.2.15 i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@tis.com Subject: Installing smap/smapd sendmail wrapper Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 295 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Good morning, I am working under Linux (the last Debian or Redhat 6.2), is there a package (.rpm or .deb) including smap/smapd sendmail wrapper? Thank you A.B. From owner-fwtk-users@ex.tis.com Tue Oct 3 15:25 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA12610 Tue, 3 Oct 2000 15:25:02 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA04259; Tue, 3 Oct 2000 12:33:37 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 3 Oct 2000 10:26:08 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA14147 for fwtk-users-outgoing; Tue, 3 Oct 2000 10:25:45 -0700 (PDT) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <39D99E28.B1411494@peaktime.be> Date: Tue, 03 Oct 2000 10:51:52 +0200 From: Michel Bardiaux Organization: Peaktime Belgium S.A. X-Mailer: Mozilla 4.73 [en] (WinNT; I) X-Accept-Language: en,fr MIME-Version: 1.0 To: fwtk-users@ex.tis.com, firewall-wizards@nfr.net Subject: Re: [fw-wiz] Re: FWTK Lic Questions References: <6084E7846673D311AC87009027AA6AA703294DC6@tx-exchange2.nai.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2493 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] "Jensen, Greg" wrote: > > To respond to all the talk about how you can/can't use FWTK. Let me > clarify. > > The license that one agrees to when downloading FWTK indicates that it > cannot be used in a "re-sell" enviorment. This means that an organization or > an individual cannot take FWTK, modify the code, and resell the product to a > third party. FWTK is free for all, and free for use on Commercial networks > if one chooses to. This is a "not for profit" firewall package that has no > support from TIS, NAI or PGP. > > It has always been the policy of TIS, Network Associates and PGP Security > that FWTK can be used in a commercial enviorment without having to pay > royalties or license fees of any form to Network Associates or PGP Security, > if used and implemented in the manor described above. If one wishes to > upgrade to a full blown version of the Gauntlet VPN Firewall, that is thier > choice, but not mandatory if one wishes to use FWTK in thier company. > > Thank you! > > -GJ > > "cheat sheet" > > Can: > You can download and use for free in your organization or corporation > > Can't: > You cannot re-sell FWTK or modify the code and re-sell. This is a "not for > profit" firewall. > Both have always been very clear. What is *not* clear is all the in-between area, particularly whether it is legal to sell *consulting* about FWTK. Example: company X has 'signed' the license and DLed the FWTK; now they ask me for help configuring their inetd.conf and rc scripts and netperm table; may I ask a fee? And what if they ask me to get and apply the nospam patches? And what if they ask me to modify plug-gw to support encryption? And if I write patches for FWTK, what will be their status? Do I have to 'open source' them, under what terms, may I sell them, etc... Some months ago, I went to the SANE2000 conference in Maastricht (Netherlands). There was a one-day tutorial on Linux firewalls, and FWTK was mentionned. It got high marks for functionality and robustness, but then the speaker went on to say he did *not* recommend it because the license was overly restrictive. Whan asked to elaborate, it seemed *his* reading was that for-fee consulting about FWTK was not allowed. Another point: GJ's answer is conspicuously silent about that anonymous salesman and his heavy-handed tactics... Greetings. -- Michel Bardiaux From owner-fwtk-users@ex.tis.com Tue Oct 3 15:25 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA12609 Tue, 3 Oct 2000 15:24:55 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA04339; Tue, 3 Oct 2000 12:34:22 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 3 Oct 2000 10:13:59 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA12593 for fwtk-users-outgoing; Tue, 3 Oct 2000 10:13:28 -0700 (PDT) Message-ID: <3D6CFAEE245FD411938A00508BE3714806D2C5@exchnj01.sbi.com> From: "Barreira, Fernando [IT]" To: "'fwtk-support@tis.com'" Cc: "'fwtk-users@tis.com'" Subject: ftp-gw problem Date: Mon, 2 Oct 2000 15:28:23 -0400 Importance: high X-Priority: 1 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1250 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi there, i have the following situation (the ftp proxy works for all destinations except this one particular site ftp.bfm.com), here is what i have observed: 1. when i try an ftp session from the ftpproxy server itself (ftpproxy1) to ftp.bfm.com, it works. 2. when i try using the machine (ftpproxy1) as a ftp proxy, it fails, here is what i get: ws1% ftp ftpproxy1 Connected to ftpproxy1.ppi.com. 220-********************************************************************** 220-********************************************************************** 220-if you encounter any problems, please contact the firewall 220-support group at : *fwsupport 220- 220- 220-********************************************************************** 220-********************************************************************** 220 Name (ftpproxy1:ftpuser): ftpuser@ftp.bfm.com ----GATEWAY CONNECTED TO ftp.bfm.com---- Login failed. ftp> what could be wrong? i contacted the remote location and it seems that at the remote end, the ftp session stays up until it times out and they say their machines never gets the username. thanks. From owner-fwtk-users@ex.tis.com Tue Oct 3 15:25 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA12615 Tue, 3 Oct 2000 15:25:17 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA04245; Tue, 3 Oct 2000 12:33:32 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 3 Oct 2000 10:25:58 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA13695 for fwtk-users-outgoing; Tue, 3 Oct 2000 10:24:54 -0700 (PDT) Reply-To: From: "Laura Taylor" To: , Cc: , Subject: RE: [fw-wiz] Re: FWTK Lic Questions Date: Tue, 3 Oct 2000 06:42:40 -0400 Message-ID: <000701c02d27$00d4e2a0$2702020a@tech.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 In-Reply-To: <200009280942.NAA30707@paranoid.alpha.int> Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 405 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is an astute observation. Many members of Sr. Management team at PGP, Inc. have departed. Speaking on licensing and development, looks like they [NAI] simply can not find a person inside the company who is responsible for fwtk and has the power to make decisions on it. From owner-fwtk-users@ex.tis.com Tue Oct 3 20:02 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA13378 Tue, 3 Oct 2000 20:02:27 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA07307; Tue, 3 Oct 2000 17:11:44 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 3 Oct 2000 15:41:40 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA29638 for fwtk-users-outgoing; Tue, 3 Oct 2000 15:41:20 -0700 (PDT) Date: Tue, 3 Oct 2000 18:39:37 -0400 (EDT) From: Ted Keller To: "Barreira, Fernando [IT]" cc: "'fwtk-support@tis.com'" , "'fwtk-users@tis.com'" Subject: Re: ftp-gw problem In-Reply-To: <3D6CFAEE245FD411938A00508BE3714806D2C5@exchnj01.sbi.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1914 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Some ideas.... If one or both of your are behind a packet filtering firewall/router, you may be seeing the ident packett which a lot of systems use, drop - thus getting you into timeout situations. This may they be followed by a reverse DNS lookup from the remote side that can't be resolved. You may want to snoop for the packetts going to/from that host and see where the delays occur. ted keller On Mon, 2 Oct 2000, Barreira, Fernando [IT] wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > hi there, > > i have the following situation (the ftp proxy works for all destinations > except this one particular site ftp.bfm.com), > here is what i have observed: > > 1. when i try an ftp session from the ftpproxy server itself (ftpproxy1) to > ftp.bfm.com, it works. > > 2. when i try using the machine (ftpproxy1) as a ftp proxy, it fails, here > is what i get: > > ws1% ftp ftpproxy1 > Connected to ftpproxy1.ppi.com. > 220-********************************************************************** > 220-********************************************************************** > 220-if you encounter any problems, please contact the firewall > 220-support group at : *fwsupport > 220- > 220- > 220-********************************************************************** > 220-********************************************************************** > 220 > Name (ftpproxy1:ftpuser): ftpuser@ftp.bfm.com > ----GATEWAY CONNECTED TO ftp.bfm.com---- > Login failed. > ftp> > > > what could be wrong? i contacted the remote location and it seems that at > the remote end, the ftp session stays up until it times out and they say > their machines never gets the username. > > thanks. > From owner-fwtk-users@ex.tis.com Wed Oct 4 06:10 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA14693 Wed, 4 Oct 2000 06:10:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA24069; Wed, 4 Oct 2000 03:19:36 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 4 Oct 2000 01:25:17 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA00866 for fwtk-users-outgoing; Wed, 4 Oct 2000 01:24:56 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <3D6CFAEE245FD411938A00508BE3714806D2C5@exchnj01.sbi.com> Date: Wed, 04 Oct 2000 09:24:00 +0100 (BST) From: Tony Gale To: "Barreira, Fernando [IT]" Subject: RE: ftp-gw problem Cc: "fwtk-users@tis.com" Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 1871 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I can login anonymously through ftp-gw to that system. A packet dump may tell you what is going wrong. What platform/kernel version/FWTK version are you using? -tony On 02-Oct-2000 Barreira, Fernando [IT] wrote: > hi there, > > i have the following situation (the ftp proxy works for all > destinations > except this one particular site ftp.bfm.com), > here is what i have observed: > > 1. when i try an ftp session from the ftpproxy server itself > (ftpproxy1) to > ftp.bfm.com, it works. > > 2. when i try using the machine (ftpproxy1) as a ftp proxy, it > fails, here > is what i get: > > ws1% ftp ftpproxy1 > Connected to ftpproxy1.ppi.com. > 220-**************************************************************** > ****** > 220-**************************************************************** > ****** > 220-if you encounter any problems, please contact the firewall > 220-support group at : *fwsupport > 220- > 220- > 220-**************************************************************** > ****** > 220-**************************************************************** > ****** > 220 > Name (ftpproxy1:ftpuser): ftpuser@ftp.bfm.com > ----GATEWAY CONNECTED TO ftp.bfm.com---- > Login failed. > ftp> > > > what could be wrong? i contacted the remote location and it seems > that at > the remote end, the ftp session stays up until it times out and > they say > their machines never gets the username. > > thanks. --- E-Mail: Tony Gale Decision maker, n.: The person in your office who was unable to form a task force before the music stopped. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Wed Oct 4 07:07 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA14769 Wed, 4 Oct 2000 07:07:48 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA08119; Wed, 4 Oct 2000 04:17:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 4 Oct 2000 02:24:19 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA02919 for fwtk-users-outgoing; Wed, 4 Oct 2000 02:23:58 -0700 (PDT) Message-ID: <39DAF70A.6D02DCEB@jamedia.com> Date: Wed, 04 Oct 2000 05:23:23 -0400 From: Scott McEachern X-Mailer: Mozilla 4.73 [en] (X11; U; FreeBSD 4.0-RELEASE i386) X-Accept-Language: en MIME-Version: 1.0 To: "Nixon, Anthony" CC: fwtk-users@ex.tis.com Subject: Re: Ipbind and multiple websites on DMZ web server References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1982 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] "Nixon, Anthony" wrote: > I have a system with 3 nics and have patched the FWTK with the ipbind patch. > All is OK, but was wondering if I could host multiple websites off of the > DMZ nic? Could virtual addresses be applied to the external nic and then > those addresses be pluged to the DMZ nic with multiple binded plug-to's? > Would this work? Anyone tried this before? I have 5 company websites (a > parent and its 4 subsidiaries) that I need to host in-house. > I had a similar problem a couple days ago. I normally had only one web server on the inside of my firewall. I have plug-gw watching on my regular external IP on port 80 (defined as www in /etc/services), but recently installed a second web server (physically) that has another purpose. This machine needed to be seen from the outside world, so this was my solution: 1) In /etc/services, I cloned the www tcp/udp stuff and called it www2. 2) I created an alias for my external NIC to a 2nd IP address (basically the original +1) Don't forget to make this change to your startup scripts so if a reboot ever happened you'd still have your alias. 3) I added a new name for this 2nd IP address to my DNS. Now you should resolve www.company.com to one IP addy and whatever.company.com to the other IP addy. 4) Add a rule to your netperm-table similar to the www: stuff, only called it www2: and plug-to the name or IP of the second web server. 5) Spark up a second plug-to process, bound specifically to the 2nd IP address (the alias.) Again, don't forget to add this process to your boot-up stuff. I forgot and just added mine now...(oop) It worked for me. Hope this helps! -- R. Scott McEachern, Network Administrator J&A Media Services, Inc. 300 John St., Suite 500, Thornhill, ON, CA L3T 5W4 tel:905-881-6902 fax:905-881-6945 From owner-fwtk-users@ex.tis.com Wed Oct 4 11:40 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA15871 Wed, 4 Oct 2000 11:40:20 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA29315; Wed, 4 Oct 2000 08:49:23 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 4 Oct 2000 07:15:14 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA18450 for fwtk-users-outgoing; Wed, 4 Oct 2000 07:14:53 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <3D6CFAEE245FD411938A00508BE3714806D2C5@exchnj01.sbi.com> Date: Wed, 04 Oct 2000 15:14:18 +0100 (BST) From: Tony Gale To: "Barreira, Fernando [IT]" Subject: RE: ftp-gw problem Cc: "fwtk-users@tis.com" Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 1188 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] [Fernando is using 2.0] There's a change in FWTK 2.1 that sends the USER command in one packet instead of two. This solves a problem with some broken servers. So, best thing to do is upgrade to version 2.1. Or, change the sayn() function in ftp-gw/ftp-gw.c to send one packet, similar to this patch, which is for http-gw: http://www.fwtk.org/fwtk/patches/patches.html#1.9 -tony On 02-Oct-2000 Barreira, Fernando [IT] wrote: > i have the following situation (the ftp proxy works for all > destinations > except this one particular site ftp.bfm.com), > here is what i have observed: > > 1. when i try an ftp session from the ftpproxy server itself > (ftpproxy1) to > ftp.bfm.com, it works. > > 2. when i try using the machine (ftpproxy1) as a ftp proxy, it > fails, here > is what i get: --- E-Mail: Tony Gale System going down at 1:45 this afternoon for disk crashing. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Wed Oct 4 12:52 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA16261 Wed, 4 Oct 2000 12:52:27 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA07723; Wed, 4 Oct 2000 10:00:24 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 4 Oct 2000 08:34:43 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA27201 for fwtk-users-outgoing; Wed, 4 Oct 2000 08:34:22 -0700 (PDT) Date: Tue, 3 Oct 2000 17:37:29 -0400 From: Joseph S D Yao To: Antonio Bonavita Cc: fwtk-users@tis.com Subject: Re: Installing smap/smapd sendmail wrapper Message-Id: <20001003173729.L24791@washington.cospo.osis.gov> Mail-Followup-To: Antonio Bonavita , fwtk-users@tis.com References: <39D9EDD0.5E597FC5@cclinf.polito.it> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <39D9EDD0.5E597FC5@cclinf.polito.it>; from s73538@cclix6.polito.it on Tue, Oct 03, 2000 at 04:31:44PM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 863 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Tue, Oct 03, 2000 at 04:31:44PM +0200, Antonio Bonavita wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Good morning, > I am working under Linux (the last Debian or Redhat 6.2), is there a > package (.rpm or .deb) including smap/smapd sendmail wrapper? > > Thank you > > A.B. This is not possible due to the licensing considerations. Please see www.fwtk.org to see how to get the FWTK software tools. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Thu Oct 5 11:49 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA20420 Thu, 5 Oct 2000 11:48:46 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA18962; Thu, 5 Oct 2000 08:58:09 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 5 Oct 2000 06:41:31 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA04751 for fwtk-users-outgoing; Thu, 5 Oct 2000 06:41:20 -0700 (PDT) Message-ID: <20001005041018.25560.qmail@web10108.mail.yahoo.com> Date: Wed, 4 Oct 2000 21:10:18 -0700 (PDT) From: Joe To: fwtk-users@tis.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1183 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi everybody, I'm just subscribe to this mailing list and in the help command there is an "index" to retrive index documents of this mailing list. Because I'm a newbie here and want to know what have been discussed. I tried but got error message !! what wrong ? could anybody help me. I already install fwtk 2.1 version in my machine which running freebsd 3.2, but i got a problem to understan smap/smapd work ! How my internal hosts could receive/transmit pop3 email pass through the firewall to connect the outside (external) pop3 email servers (ex: mail.example.net). Here is my netperm-table setting for smap/smapd: smap, smapd: userid 6 smap, smapd: directory /var/spool/smap smapd: executable /usr/local/etc/smapd smapd: sendmail /usr/sbin/sendmail smap: timeout 3600 and about this rule: smap, smapd: directory /var/spool/smap Should i create this directory ? what purpose ? Thanks for help __________________________________________________ Do You Yahoo!? Yahoo! Photos - 35mm Quality Prints, Now Get 15 Free! http://photos.yahoo.com/ From owner-fwtk-users@ex.tis.com Thu Oct 5 14:11 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA20880 Thu, 5 Oct 2000 14:11:37 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA06047; Thu, 5 Oct 2000 11:21:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 5 Oct 2000 09:53:54 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA25083 for fwtk-users-outgoing; Thu, 5 Oct 2000 09:53:33 -0700 (PDT) Message-ID: <008701c02eec$6a521e20$fc00a8c0@k62350> From: "Larry Jackson" To: Cc: References: <20001005041018.25560.qmail@web10108.mail.yahoo.com> Subject: Re: New User Questions Date: Thu, 5 Oct 2000 12:50:48 -0400 Organization: Falun Technical Service, Inc. MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1701 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Check out http://www.fwtk.org/ for FAQs, patches, instructions, etc Also, there is a searchable archive of this list at http://marc.theaimsgroup.com/?l=fwtk-users&r=1&w=2 LarryJackson@iName.com ----- Original Message ----- From: "Joe" To: Sent: Thursday, October 05, 2000 12:10 AM > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi everybody, > > I'm just subscribe to this mailing list and in the > help command there is an "index" to retrive index > documents of this mailing list. Because I'm a newbie > here and want to know what have been discussed. I > tried but got error message !! what wrong ? could > anybody help me. > > I already install fwtk 2.1 version in my machine which > running freebsd 3.2, but i got a problem to understan > smap/smapd work ! How my internal hosts could > receive/transmit pop3 email pass through the firewall > to connect the outside (external) pop3 email servers > (ex: mail.example.net). Here is my netperm-table > setting for smap/smapd: > smap, smapd: userid 6 > smap, smapd: directory /var/spool/smap > smapd: executable /usr/local/etc/smapd > smapd: sendmail /usr/sbin/sendmail > smap: timeout 3600 > > and about this rule: > smap, smapd: directory /var/spool/smap > Should i create this directory ? what purpose ? > > Thanks for help > > __________________________________________________ > Do You Yahoo!? > Yahoo! Photos - 35mm Quality Prints, Now Get 15 Free! > http://photos.yahoo.com/ > From owner-fwtk-users@ex.tis.com Thu Oct 5 14:45 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA20954 Thu, 5 Oct 2000 14:45:27 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA10478; Thu, 5 Oct 2000 11:55:17 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 5 Oct 2000 10:36:37 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA00169 for fwtk-users-outgoing; Thu, 5 Oct 2000 10:36:26 -0700 (PDT) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <39DC9E17.BFC06337@peaktime.be> Date: Thu, 05 Oct 2000 17:28:23 +0200 From: Michel Bardiaux Organization: Peaktime Belgium S.A. X-Mailer: Mozilla 4.73 [en] (WinNT; I) X-Accept-Language: en,fr MIME-Version: 1.0 To: fwtk-users@tis.com Subject: Re: Joe's References: <20001005041018.25560.qmail@web10108.mail.yahoo.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1282 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Joe wrote: > > Hi everybody, > [snip] > I already install fwtk 2.1 version in my machine which > running freebsd 3.2, but i got a problem to understan > smap/smapd work ! How my internal hosts could > receive/transmit pop3 email pass through the firewall > to connect the outside (external) pop3 email servers > (ex: mail.example.net). Here is my netperm-table > setting for smap/smapd: > smap, smapd: userid 6 > smap, smapd: directory /var/spool/smap > smapd: executable /usr/local/etc/smapd > smapd: sendmail /usr/sbin/sendmail > smap: timeout 3600 > > and about this rule: > smap, smapd: directory /var/spool/smap > Should i create this directory ? what purpose ? > > Thanks for help If you are using *external* POP3 mail servers, then you do not need to (and for security *should not*) run any mail transfer agent on the firewall. Rather, use plug-gw (in FWTK) or pop3-gw (look for it on http://www.fwtk.org/fwtk/patches/patches.html) to connect through the firewall. Greetings. -- Michel Bardiaux Peaktime Belgium S.A. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 From owner-fwtk-users@ex.tis.com Fri Oct 6 09:46 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA23892 Fri, 6 Oct 2000 09:46:45 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA21607; Fri, 6 Oct 2000 06:56:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 6 Oct 2000 05:18:17 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA14863 for fwtk-users-outgoing; Fri, 6 Oct 2000 05:18:06 -0700 (PDT) From: ark@eltex.ru Date: Fri, 6 Oct 2000 16:11:43 +0400 Message-Id: <200010061211.QAA09575@paranoid.alpha.int> Organization: "Klingon Imperial Intelligence Service" Subject: licensing and other To: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 15929 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Ok, we have major troubles with TIS license. It discourages developers and is definitely evil ;) So why don't just rewrite the code under BSD license? The best way for me is "soft" migration - re-creating API and configuration functionality to let us use all fwtk add-ons we already have written. The proxies itself are not a major problem - there are many programs with similar functionality floating on the net and the code is relatively small - we can do security audit on it and bring the API we have in to be compatible. Anyways - if you don't support that, some of people on the list will probably get use of what i did: documented the API (current one) and wrote some style guides drafts. It will ease writing fwtk proxies for people no very familliar with the code. It is worth putting on the fwtk.org site ;) It would be nice if someone converts it to html, man pages, whatever else format with fancy fonts and formatting you do prefer. ************************************************************************* fwtk API functions reference manual, revision 0 - original TIS unchanged. ************************************************************************* authentication-related functions are not described here because TIS already provided detailed description in fwtk package - ------------------------------------------------------------------------- isalldigits() - a frontend to isdigit() function for a string int isalldigits(char *s) description: returns 0 if the string is empty or not consisting of digits, non-zero otherwise. - ------------------------------------------------------------------------- str_to_port() - a getservbyname frontend int str_to_port(char *portstr) description: returns atoi of portstr if it is all-digit, tcp port number from getservbyname if it is not, and exits with fwtkcfgerr if the service is unknown. - ------------------------------------------------------------------------- mapgid() - getgrnam frontend int mapgid(char *gnam) description: returns atoi of gnam if it is all-digit, group id if it is not and -1 if group does not exist. - ------------------------------------------------------------------------- mapuid() - getpwnam frontend int mapuid(char *user) description: returns atoi of user if it is all-digit, uid if it is not and -1 if uid does not exist. - ------------------------------------------------------------------------- randomnumber() - get a number from PRNG long randomnumber() description: obvious - ------------------------------------------------------------------------- getpassword() - get password from stdin tty with no echo char* getpassword(char *prompt) description: obvious - ------------------------------------------------------------------------- peername() - an advanced frontend to unix getpeername() function int peername(int fd,char *lname,char *sname,int z) description: the peername() function performs peer address and dns lookups for given socket (fd), performs sanity and security checks to detect possibly dangerous connections and dns-driven attacks, and writes first z characters of text representation of the resulting ip address and lowercased host fqdn to strings pointed by lname (fqdn) and sname (address). If the name lookup fails or seems to be unreliable, "unknown" is returned to lname. the function return value is 0 unless getpeername() failed security conditions: ip options are set on socket, action: lname is "unknown", "Connection received using ip options (ignored)" securityalert is generated, options are being reset. host name lookup failed, action: lname is "unknown", a log warning message is generated address entry returned by name server after performing reverse lookup and then forward lookup again exceeds sizeof appropriate structure, action: lname is "unknown", "invalid host address length" securityalert is generated. hostname returned by reverse lookup does not resolve to ip address, action: lname is "unknown", a log warning message is generated no ip addresses of hostname returned by reverse lookup match peer, action: lname is "unknown", a "possible spoof" securityalert is generated - ------------------------------------------------------------------------- hostmatch() - see if given host matches netperm-table host entry (see netperm-table manual for pattern syntax) int hostmatch(char *pattern,char *name) description: it is generic host pattern match function used when determining if source or destination addresses match vaules configured in netperm-table. name can be fqdn or dot-delimited ip as text string. if the name is dot-delimited ip and the pattern is fqdn-based, a reverse lookup and attempt to resolve returned name are performed. if some of those fail, "unknown" is assumed for matching function as name. the function returns 0 if host does not match (incuding all error conditions, unresolvable name and so on) or 1 if it does. security conditions: name or pattern too long (exceed builtin limit, currently 512 characters), action: fwtkcfgerr is generated, 0 returned full host name (after performing lookups) is too long, action: fwtkcfgerr is generated, 0 returned address entry returned by name lookup exceeds sizeof appropriate structure, action: "invalid host address length" securityalert is generated, 0 returned no ip addresses or hostnames returned by lookups match name initially specified, action: match as "unknown" is performed, a "possible spoof" securityalert is generated - ------------------------------------------------------------------------- conn_server() - connect to a server by name and port int conn_server(char *srv,int portnum,int priv,char *rbuf) description: the functions connects to server srv port portnum, using highest privileged source port if priv is non-zero, and any one as regular tcp connection does if it is zero. A socket is returned as function return value or a negative value if something fails (-1 if server name does not resolve or invalid, -2 if socket failed to create and -3 if connect failed). A failure reason is written into string pointed by rbuf, if it is specified. security conditions: address entry returned by name lookup exceeds sizeof appropriate structure, action: "invalid host address length" securityalert is generated, -1 returned. - ------------------------------------------------------------------------- maphostname() - inet_ntoa() frontend char* maphostname(char *name) description: If the name is ip address or unresolvable, the pointer to it is returned. Otherwise an address lookup is done and the returned pointer is inet_ntoa function result. security conditions: address entry returned by name lookup exceeds sizeof appropriate structure, action: "invalid host address length" securityalert is generated, "invalid" is returned. - ------------------------------------------------------------------------- lock_fd(),lockun_fd(),locktest_fd() - flock/lockf frontend int lock_fd(int f) int lockun_fd(int f) int locktest_fd(int f) description: lock_fd returns flock(f,LOCK_EX) lockun_fd returns flock(f,LOCK_UN) locktest_fd returns flock(f,LOCK_EX|LOCK_NB) - ------------------------------------------------------------------------- set_oob_notification() - enable OOB signaling on given socket int set_oob_notification(int fd) description: ensures that we can receive OOB signaling and turns it on for a socket. returns 0 if ok, non-0 if something fails. - ------------------------------------------------------------------------- do_daemon() - start acting as daemon on given port int do_daemon(int port) description: performs the following algorithm: 1. fork, parent exits 2. child binds to the port and 3. waits for connection 4. after a connection is received, fork and make child fd's 1,2,3 pointing to the connection socket as inetd does 5. parent returns to 3, child exits function - ------------------------------------------------------------------------- waitwaitwait() - dummy function to read child status change description: signal(SIGCHLD,waitwaitwait) is useful sometimes if you fork and don't want to be annoyed by SIGCHLD. - ------------------------------------------------------------------------- cfg_read() - read netperm-table rules matching tag (application) name into Cfg type chain. Cfg* cfg_read(char *app) description: configuration returned is a chain of Cfg type entries, described as following structure: typedef struct cfgrec { int flags; /* see below */ int ln; /* line# in config file */ char *op; /* facility name */ int argc; /* number of arguments */ char **argv; /* vector */ struct cfgrec *next; } Cfg; flags are: #define PERM_ALLOW 01 #define PERM_DENY 02 the chain ends with next = (Cfg *) 0. netperm-table syntax is described in the appropriate man page. if a syntax error, too long or malformed line is found, a fwtkcfgerror is generated. if a fatal error occurs, fwtksyserr is generated and (Cfg *)-1 is returned. The chain is to be processed later by cfg_get() function. - -------------------------------------------------------------------------- cfg_get() - get configuration entries by keyword Cfg* cfg_get(char *fac,Cfg *cp) description: this function gets an entry matching keyword fac from Cfg chain cp. If cp == (Cfg *) 0, a next entry matching keyword from the same chain is returned. If no more matches, cfg_get returns (Cfg *) 0. - -------------------------------------------------------------------------- cfg_free() - destroy Cfg chain void cfg_free(Cfg *cp) description: cfg_free() frees up memory allocated by cfg_read - -------------------------------------------------------------------------- enargv() - convert a string of space-delimited tokens to argv-type array int enargv(char *buf,char **av,int avsiz,char *tobuf,int bsiz) description: convert buf string to tokens in array av, using tobuf as actual storage, not exceeding the buffer size bsiz and token counter avsiz - -------------------------------------------------------------------------- auth_perm() - request extended permissions from authorization server int auth_perm(Cfg *confp,char *name,char *oper,char *host,char **op) description: request if authorization server specified in confp grants right to user of application (originated communication from ) to perform operations . op usually points to command or operation name in op[0] and null-terminated list of parameters in the rest of array. the function returns 1 if an error occured or permission is denied, -1 if authorization table does not contain corresponding vaule (which should be interpreted as deny too) and 0 if permission is granted. - -------------------------------------------------------------------------- ************************************************************************* fwtk proxies command line options style guide ************************************************************************* - -daemon should run the proxy as daemon on given port - -version should dump current version info to stdout - -as should force the proxy to read configuration from netperm-table instead of one belonging to its own name (if it is not available, revert to original config name) ************************************************************************* netperm-table configuration style guide ************************************************************************* the netperm-table syntax is already described in man page general option keywords: welcome-msg specify the path to welcome banner file denial-msg specify the path to a file proxy displays when it denies access to gateway denydest-msg specify the path to a file proxy displays when it denies access to some destination or denies some operation that is subject of additional control help-msg specify the path to a help file if any of those are omitted in netperm-table but supported by proxy, a builtin banners should appear. timeout set the network inactivity timeout value userid specify userid to setuid to (name or number) groupid specify groupid to setgid to (name or number) directory specify chroot path or working directory permit-hosts parameters: - -auth authentication is required - -authuser treat connection as if had pre-authenticated (useful for extended permissions) - -dest specify list of allowed destination - -dest { ..} (pattern can be negated by preceding "!") - -users specify list of users allowed to use proxy - -users { ..} (pattern can be negated by preceding "!") note: this usually refers to in-protocol user information, not to users as subject of firewall authentication - -transparent a system-dependant transparency engine is used to find connection destination - -plug-to plug the proxy to a server - -handoff synonym to plug-to - -client-encrypt enable connection encryption on client side - -server-encrypt enable connection encryption on server side - -client--key - generate shared secret for cleint side using passphrase and hash algorithm - -server--key - generate shared secret for server side using passphrase and hash algorithm ************************************************************************* statistics gathering and logging style guide ************************************************************************* a proxy should log at least: all client connections, using the following syntax: permit host=host.fqdn/1.2.3.4 use of gateway deny host=host.fqdn/1.2.3.4 use of gateway all connections originated by proxy or requested by clinet, using the following syntax: permit host=host.fqdn/1.2.3.4 connect to server/port deny host=host.fqdn/1.2.3.4 connect to server/port for ip-based authorization and permit host=host.fqdn/1.2.3.4 connect to server/port user=authuser deny host=host.fqdn/1.2.3.4 connect to server/port user=authuser for authorization based on extended permissions, all user authentications, using the following syntax: authenticate user=name all system-level failures, using "fwtksyserr:" prefix, all configuration errors, using "fwtkcfgerr:" prefix, all suspicious conditions, using "securityalert:" prefix, time online (seconds), destination, bytes transferred in and out on exit, using the following syntax: exit host=host.fqdn/1.2.3.4 destination=dest in=1234 out=1234 duration=12 (extra information like user name or something else may contain in this line) that's all this time. - ---- _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBOd3BfqH/mIJW9LeBAQEj4QP+Opx9U3vl1PO3B92mcfvftkRGBm3V64xo qAJI9w+qIQ9pqzB05NnipqXc0mUJuuNvC0A1WPSOiD/ypvQl+3mNZrPz7FDnSrAD JoClZrbLLQPNo0UDLogVJswXH5NGPdTNo5prsRrZb44a2g4gH8fhGumzjyNi/9WX GDSD96dX7Mc= =p+2C -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Fri Oct 6 10:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA24012 Fri, 6 Oct 2000 10:37:49 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA02405; Fri, 6 Oct 2000 07:47:40 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 6 Oct 2000 06:25:48 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA18428 for fwtk-users-outgoing; Fri, 6 Oct 2000 06:25:37 -0700 (PDT) Message-Id: <4.3.2.7.0.20001006092032.00b6e200@mailhost.research.ryerson.ca> X-Sender: pdunphy@mailhost.research.ryerson.ca X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Fri, 06 Oct 2000 09:26:44 -0400 To: fwtk-users@lists.nai.com From: Paul Dunphy Subject: Bug in the Yao smap patch - SPECIALDOMAIN section Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 3016 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] FYI, there is a bug in the SPECIALDOMAIN section Joe Yao's smap patch (i.e. it only shows up if you define SPECIALDOMAIN when you compile the patched version of smap). Although Mr. Yao does not recommend using this feature (see below), I thought I would mention it in case anyone else experiences problems with it. Please see the message below for details. Cheers... Paul >Date: Thu, 5 Oct 2000 19:54:37 -0400 >From: Joseph S D Yao >To: Paul Dunphy >Cc: Joseph S D Yao >Subject: Re: Bug in the smap patch? >X-Mailer: Mutt 1.0i > >On Thu, Oct 05, 2000 at 04:14:10PM -0400, Paul Dunphy wrote: > > Dear Mr. Yao, > > > > I've just applied both of your smap patches to smap V2.1 (i.e. the > > "regular" and EHLO patches). The patches applied OK, and I was able to > > re-compile smap (after adding an -lresolv to Makefile.config), but > whenever > > I tried to send it mail, it would simply close the connection immediately > > after the RCPT TO: line was received. > > > > I did some digging, and found what I think is a bug in the code: line 1469 > > of my patched smap code read > > if(!checkvalid(q)) { > > > > It appears, however, that checkvalid should have been called with two > > arguments, namely > > if(!checkvalid(q, cfp)) { > > > > Once I made this change, everything worked correctly. > > > > I just thought I would mention this in case anyone else is having the same > > problem. FYI, I downloaded my patch from > > http://www.fwtk.org/fwtk/patches/yao-smap.pch, and the system on which > I am > > running smap is a Red Hat 6.2 Linux box with kernel 2.2.16-3. > > > > Hope this information is helpful, > > Paul > > > > (P.S. Otherwise an excellent patch, and very well-documented - many thanks > > for your efforts!) > > >Good point. If you send that to the list, I would hope that it would >appear in the patch list or FAQ! It was hard to fix this already- >highly-patched code, with all the #ifdef's. That particular line is in >a section that I highly recommend to everyone that they NOT use: ifdef >SPECIALDOMAIN. Instead, use the host/domain features. (I may have >been intending to remove the SPECIALDOMAIN section.) > >You may include this note if you wish. > >-- >Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao >COSPO/OSIS Computer Support EMT-B >----------------------------------------------------------------------- >This message is not an official statement of COSPO policies. --------------------------------------------------------------------- Paul T. Dunphy, P.Eng. Systems Administrator/Research Engineer Centre for the Study of Commercial Activity Ryerson Polytechnic University Toronto, Ontario, CANADA Phone: (416) 979-5000 ext. 7537 Fax: (416) 979-5378 E-mail: pdunphy@research.ryerson.ca From owner-fwtk-users@ex.tis.com Fri Oct 6 12:29 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA24337 Fri, 6 Oct 2000 12:29:58 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA25940; Fri, 6 Oct 2000 09:33:11 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 6 Oct 2000 07:22:40 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA26539 for fwtk-users-outgoing; Fri, 6 Oct 2000 07:22:18 -0700 (PDT) Message-ID: <39DDE04A.9E24E6AA@v-one.com> Date: Fri, 06 Oct 2000 10:23:07 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: ark@eltex.ru CC: fwtk-users@tis.com Subject: Re: licensing and other References: <200010061211.QAA09575@paranoid.alpha.int> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1024 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] ark@eltex.ru wrote: > > Ok, we have major troubles with TIS license. It discourages developers > and is definitely evil ;) So why don't just rewrite the code under BSD > license? The best way for me is "soft" migration - re-creating API > and configuration functionality to let us use all fwtk add-ons we already > have written. The proxies itself are not a major problem - there are many > programs with similar functionality floating on the net and the code is > relatively small - we can do security audit on it and bring the API we have > in to be compatible. As I mentioned before I'd be willing to host something like this on fwtk.org, including some kind of limited write access CVS system... Since I have my first "little one" on the way, I won't have much time but I'll help whenever I can.... :-) -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Sat Oct 7 23:57 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA28815 Sat, 7 Oct 2000 23:57:09 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id VAA22896; Sat, 7 Oct 2000 21:06:20 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 7 Oct 2000 18:46:27 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA19265 for fwtk-users-outgoing; Sat, 7 Oct 2000 18:46:17 -0700 (PDT) Message-ID: <005201ba9520$570753a0$060189c0@wen> From: "wen" To: Subject: plug-gw Date: Sun, 8 Oct 1995 09:49:33 +0800 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2615.200 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="----=_NextPart_000_004F_01BA9563.5ECFFD60" Content-Length: 2866 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. ------=_NextPart_000_004F_01BA9563.5ECFFD60 Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 aGksdGhlcmU6DQpJIGhhdmUgaW5zdGFsbGVkIGZ3dGsyLjEgYW5kIGluYmluZCBwYXRjaC5teSBz eXN0ZW0gaXMgcmVkaGF0Ni4xLiBidXQgd2hlbiBpIHVzZSBtb3JlIG9uZSBwbHVnLWd3IEkgc3Vm ZmVyZWQgZnJvbSBzb21lIHRyb3VibGU6IG9ubHkgb25lIHBsdWctZ3cgc2VydmljZSB3b3JrLg0K DQpGb3IgZXhhbXBsZSxteSBjb25maWcgZmlsZToNCnJjLmxvY2FsOg0KIC91c3IvbG9jYWwvZXRj L3BsdWctZ3cgLWRhZW1vbiB4LngueC54OjgwIC1uYW1lIGh0dHANCiAvdXNyL2xvY2FsL2V0Yy9w bHVnLWd3IC1kYWVtb24geC54LngueDoyMSAtbmFtZSBmdHANCg0KYW5kIHNvIG9uLi4uDQoNCklu IG5ldHBlcm10YWJsZQ0KDQpodHRwOiBwb3J0IDgwICogLXBsdWctdG8gMTkyLjE2OC4xLjEwIC1w b3J0IDgwIA0KZnRwOiAgcG9ydCAyMSAqIC1wbHVnLXRvIDxpbnRlcm5hbF9pcCBvZiB5b3VyIGZ0 cCBzZXJ2ZXI+IC1wb3J0IDIxDQoNCm9ubHkgaHR0cCBzZXJ2aWNlIHdvcmssd2h5Pw0KDQpteSB0 aG91Z2h0IGlzIGludHJhbmV0IG9mZmVyIGh0dHAsZnRwLHNtdHAgc2VydmljZSB0aHJvdWdoIGJv eCB0aGF0IEkgaGF2ZSBpbnN0YWxsZWQgZnd0ayB0b29sa2l0Lg0Kd2hhdCBzaG91bGQgaSBkbz8N Cg== ------=_NextPart_000_004F_01BA9563.5ECFFD60 Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: base64 PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uYWwv L0VOIj4NCjxIVE1MPjxIRUFEPg0KPE1FVEEgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PWdi MjMxMiIgaHR0cC1lcXVpdj1Db250ZW50LVR5cGU+DQo8TUVUQSBjb250ZW50PSJNU0hUTUwgNS4w MC4yNjE0LjM1MDAiIG5hbWU9R0VORVJBVE9SPg0KPFNUWUxFPjwvU1RZTEU+DQo8L0hFQUQ+DQo8 Qk9EWSBiZ0NvbG9yPSNmZmZmZmY+DQo8RElWPjxGT05UIHNpemU9Mj5oaSx0aGVyZTo8L0ZPTlQ+ PC9ESVY+DQo8RElWPjxGT05UIHNpemU9Mj5JIGhhdmUgaW5zdGFsbGVkIGZ3dGsyLjEgYW5kIGlu YmluZCBwYXRjaC5teSBzeXN0ZW0gaXMgDQpyZWRoYXQ2LjEuIGJ1dCB3aGVuIGkgdXNlIG1vcmUg b25lIHBsdWctZ3cgSSBzdWZmZXJlZCBmcm9tIHNvbWUgdHJvdWJsZTogb25seSANCm9uZSBwbHVn LWd3IHNlcnZpY2Ugd29yay48L0ZPTlQ+PC9ESVY+DQo8RElWPiZuYnNwOzwvRElWPg0KPERJVj48 Rk9OVCBzaXplPTI+Rm9yIGV4YW1wbGUsbXkgY29uZmlnIA0KZmlsZTo8QlI+cmMubG9jYWw6PEJS PiZuYnNwOy91c3IvbG9jYWwvZXRjL3BsdWctZ3cgLWRhZW1vbiB4LngueC54OjgwIC1uYW1lIA0K aHR0cDxCUj4mbmJzcDsvdXNyL2xvY2FsL2V0Yy9wbHVnLWd3IC1kYWVtb24geC54LngueDoyMSAt bmFtZSBmdHA8QlI+PEJSPmFuZCBzbyANCm9uLi4uPEJSPjxCUj5JbiBuZXRwZXJtdGFibGU8QlI+ PEJSPmh0dHA6IHBvcnQgODAgKiAtcGx1Zy10byAxOTIuMTY4LjEuMTAgLXBvcnQgDQo4MCA8QlI+ ZnRwOiZuYnNwOyBwb3J0IDIxICogLXBsdWctdG8gJmx0O2ludGVybmFsX2lwIG9mIHlvdXIgZnRw IHNlcnZlciZndDsgDQotcG9ydCAyMTxCUj48QlI+b25seSBodHRwIHNlcnZpY2Ugd29yayx3aHk/ PC9GT05UPjwvRElWPg0KPERJVj4mbmJzcDs8L0RJVj4NCjxESVY+PEZPTlQgc2l6ZT0yPm15IHRo b3VnaHQgaXMgaW50cmFuZXQgb2ZmZXIgaHR0cCxmdHAsc210cCBzZXJ2aWNlIHRocm91Z2ggYm94 IA0KdGhhdCBJIGhhdmUgaW5zdGFsbGVkIGZ3dGsgdG9vbGtpdC48L0ZPTlQ+PC9ESVY+DQo8RElW PjxGT05UIHNpemU9Mj53aGF0IHNob3VsZCBpIGRvPzwvRk9OVD48L0RJVj48L0JPRFk+PC9IVE1M Pg0K ------=_NextPart_000_004F_01BA9563.5ECFFD60-- From owner-fwtk-users@ex.tis.com Sat Oct 7 23:57 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA28818 Sat, 7 Oct 2000 23:57:11 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id VAA22900; Sat, 7 Oct 2000 21:06:23 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 7 Oct 2000 18:48:53 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA19355 for fwtk-users-outgoing; Sat, 7 Oct 2000 18:48:42 -0700 (PDT) Message-ID: <006501ba9520$a8ce62a0$060189c0@wen> From: "wen" To: Subject: plug-to Date: Sun, 8 Oct 1995 09:51:44 +0800 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2615.200 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="----=_NextPart_000_0062_01BA9563.AD282460" Content-Length: 2910 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. ------=_NextPart_000_0062_01BA9563.AD282460 Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 aGksdGhlcmU6DQpJIGhhdmUgaW5zdGFsbGVkIGZ3dGsyLjEgYW5kIGluYmluZCBwYXRjaC5teSBz eXN0ZW0gaXMgcmVkaGF0Ni4xLiBidXQgd2hlbiBpIHVzZSBtb3JlIG9uZSBwbHVnLWd3IEkgc3Vm ZmVyZWQgZnJvbSBzb21lIHRyb3VibGU6IG9ubHkgb25lIHBsdWctZ3cgc2VydmljZSB3b3JrLg0K DQpGb3IgZXhhbXBsZSxteSBjb25maWcgZmlsZToNCnJjLmxvY2FsOg0KIC91c3IvbG9jYWwvZXRj L3BsdWctZ3cgLWRhZW1vbiB4LngueC54OjgwIC1uYW1lIGh0dHANCiAvdXNyL2xvY2FsL2V0Yy9w bHVnLWd3IC1kYWVtb24geC54LngueDoyMSAtbmFtZSBmdHANCg0KYW5kIHNvIG9uLi4uDQoNCklu IG5ldHBlcm10YWJsZQ0KDQpodHRwOiBwb3J0IDgwICogLXBsdWctdG8gMTkyLjE2OC4xLjEwIC1w b3J0IDgwIA0KZnRwOiAgcG9ydCAyMSAqIC1wbHVnLXRvIDxpbnRlcm5hbF9pcCBvZiB5b3VyIGZ0 cCBzZXJ2ZXI+IC1wb3J0IDIxDQoNCm9ubHkgaHR0cCBzZXJ2aWNlIHdvcmssd2h5Pw0KDQpteSB0 aG91Z2h0IGlzIGludHJhbmV0IG9mZmVyIGh0dHAsZnRwLHNtdHAgc2VydmljZSB0aHJvdWdoIGJv eCB0aGF0IEkgaGF2ZSBpbnN0YWxsZWQgZnd0ayB0b29sa2l0Lg0Kd2hhdCBzaG91bGQgaSBkbz8N Cg== ------=_NextPart_000_0062_01BA9563.AD282460 Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: base64 PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uYWwv L0VOIj4NCjxIVE1MPjxIRUFEPg0KPE1FVEEgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PWdi MjMxMiIgaHR0cC1lcXVpdj1Db250ZW50LVR5cGU+DQo8TUVUQSBjb250ZW50PSJNU0hUTUwgNS4w MC4yNjE0LjM1MDAiIG5hbWU9R0VORVJBVE9SPg0KPFNUWUxFPjwvU1RZTEU+DQo8L0hFQUQ+DQo8 Qk9EWSBiZ0NvbG9yPSNmZmZmZmY+DQo8RElWPjxGT05UIHNpemU9Mj4NCjxESVY+PEZPTlQgc2l6 ZT0yPmhpLHRoZXJlOjwvRk9OVD48L0RJVj4NCjxESVY+PEZPTlQgc2l6ZT0yPkkgaGF2ZSBpbnN0 YWxsZWQgZnd0azIuMSBhbmQgaW5iaW5kIHBhdGNoLm15IHN5c3RlbSBpcyANCnJlZGhhdDYuMS4g YnV0IHdoZW4gaSB1c2UgbW9yZSBvbmUgcGx1Zy1ndyBJIHN1ZmZlcmVkIGZyb20gc29tZSB0cm91 YmxlOiBvbmx5IA0Kb25lIHBsdWctZ3cgc2VydmljZSB3b3JrLjwvRk9OVD48L0RJVj4NCjxESVY+ Jm5ic3A7PC9ESVY+DQo8RElWPjxGT05UIHNpemU9Mj5Gb3IgZXhhbXBsZSxteSBjb25maWcgDQpm aWxlOjxCUj5yYy5sb2NhbDo8QlI+Jm5ic3A7L3Vzci9sb2NhbC9ldGMvcGx1Zy1ndyAtZGFlbW9u IHgueC54Lng6ODAgLW5hbWUgDQpodHRwPEJSPiZuYnNwOy91c3IvbG9jYWwvZXRjL3BsdWctZ3cg LWRhZW1vbiB4LngueC54OjIxIC1uYW1lIGZ0cDxCUj48QlI+YW5kIHNvIA0Kb24uLi48QlI+PEJS PkluIG5ldHBlcm10YWJsZTxCUj48QlI+aHR0cDogcG9ydCA4MCAqIC1wbHVnLXRvIDE5Mi4xNjgu MS4xMCAtcG9ydCANCjgwIDxCUj5mdHA6Jm5ic3A7IHBvcnQgMjEgKiAtcGx1Zy10byAmbHQ7aW50 ZXJuYWxfaXAgb2YgeW91ciBmdHAgc2VydmVyJmd0OyANCi1wb3J0IDIxPEJSPjxCUj5vbmx5IGh0 dHAgc2VydmljZSB3b3JrLHdoeT88L0ZPTlQ+PC9ESVY+DQo8RElWPiZuYnNwOzwvRElWPg0KPERJ Vj48Rk9OVCBzaXplPTI+bXkgdGhvdWdodCBpcyBpbnRyYW5ldCBvZmZlciBodHRwLGZ0cCxzbXRw IHNlcnZpY2UgdGhyb3VnaCBib3ggDQp0aGF0IEkgaGF2ZSBpbnN0YWxsZWQgZnd0ayB0b29sa2l0 LjwvRk9OVD48L0RJVj4NCjxESVY+PEZPTlQgc2l6ZT0yPndoYXQgc2hvdWxkIGkgZG8/PC9GT05U PjwvRElWPjwvRk9OVD48L0RJVj48L0JPRFk+PC9IVE1MPg0K ------=_NextPart_000_0062_01BA9563.AD282460-- From owner-fwtk-users@ex.tis.com Sun Oct 8 01:11 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id BAA28946 Sun, 8 Oct 2000 01:11:29 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id WAA25628; Sat, 7 Oct 2000 22:19:04 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 7 Oct 2000 20:45:28 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id UAA22258 for fwtk-users-outgoing; Sat, 7 Oct 2000 20:45:07 -0700 (PDT) Date: Sat, 7 Oct 2000 23:44:28 -0400 (EDT) From: Ted Keller To: wen cc: fwtk-users@ex.tis.com Subject: Re: plug-gw In-Reply-To: <005201ba9520$570753a0$060189c0@wen> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1057 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Wen, ftp uses two ports - one for the command port and a second one for data transfers. Plug-gw can't support the second data port option (which is connected dynamically). You should investigate the ftp-gw for that application. ted keller On Sun, 8 Oct 1995, wen wrote: > hi,there: > I have installed fwtk2.1 and inbind patch.my system is redhat6.1. but when i use more one plug-gw I suffered from some trouble: only one plug-gw service work. > > For example,my config file: > rc.local: > /usr/local/etc/plug-gw -daemon x.x.x.x:80 -name http > /usr/local/etc/plug-gw -daemon x.x.x.x:21 -name ftp > > and so on... > > In netpermtable > > http: port 80 * -plug-to 192.168.1.10 -port 80 > ftp: port 21 * -plug-to -port 21 > > only http service work,why? > > my thought is intranet offer http,ftp,smtp service through box that I have installed fwtk toolkit. > what should i do? > From owner-fwtk-users@ex.tis.com Mon Oct 9 03:57 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA01851 Mon, 9 Oct 2000 03:57:09 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA03219; Mon, 9 Oct 2000 01:06:09 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 8 Oct 2000 22:42:11 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id WAA29330 for fwtk-users-outgoing; Sun, 8 Oct 2000 22:41:34 -0700 (PDT) Message-ID: <20001009054017.38597.qmail@web10108.mail.yahoo.com> Date: Sun, 8 Oct 2000 22:40:17 -0700 (PDT) From: Yohanes Rahmad Subject: yao-patches To: fwtk-users@ex.tis.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 449 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] It is like a stupid question, where can I download yao-patches ?? I already seach in www.fwtk.org/patches but couldn't found there. Thanks for help in advanced Yohanes R. __________________________________________________ Do You Yahoo!? Yahoo! Photos - 35mm Quality Prints, Now Get 15 Free! http://photos.yahoo.com/ From owner-fwtk-users@ex.tis.com Mon Oct 9 10:28 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA00757 Mon, 9 Oct 2000 10:28:28 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA21347; Mon, 9 Oct 2000 07:37:53 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 9 Oct 2000 06:07:27 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA12202 for fwtk-users-outgoing; Mon, 9 Oct 2000 06:07:06 -0700 (PDT) Message-ID: <39E1C328.4E2249EC@v-one.com> Date: Mon, 09 Oct 2000 09:07:52 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Yohanes Rahmad CC: fwtk-users@ex.tis.com Subject: Re: yao-patches References: <20001009054017.38597.qmail@web10108.mail.yahoo.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 456 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Yohanes Rahmad wrote: > > It is like a stupid question, where can I download > yao-patches ?? > I already seach in www.fwtk.org/patches but couldn't > found there. Look at #2 on this link: http://www.fwtk.org/fwtk/patches/patches.html#2.2 -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Mon Oct 9 16:21 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA02414 Mon, 9 Oct 2000 16:21:51 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA07416; Mon, 9 Oct 2000 13:31:26 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 9 Oct 2000 11:57:07 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA24629 for fwtk-users-outgoing; Mon, 9 Oct 2000 11:56:52 -0700 (PDT) Message-ID: <384141389.971117779115.JavaMail.root@web589-mc> Date: Mon, 9 Oct 2000 14:56:19 -0400 (EDT) From: kemal hajdarevic To: fwtk-users@ex.tis.com Subject: smapd memory problem Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: mail.com X-Originating-IP: 195.222.38.148 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 850 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi people, I have installed FWTK 2.1 on SuSE 6.4 and there is report in messages log file: can not fork smapd, couldn't alocate memory. There are many smapd processes runing if I type ps - ef | grep smapd. So my idea is that forked smapd children eat all memory so other services have problems with this smapd thing. Should I use cron table to kill some of those phantoms or what, I know that it is not possible to use kill comnad to kill smapd by name in cron table. And how should I know pid of some future smapd child. Any solution to this problem would be great. Thans in advance Kemal. ______________________________________________ FREE Personalized Email at Mail.com Sign up at http://www.mail.com/?sr=signup From owner-fwtk-users@ex.tis.com Mon Oct 9 16:23 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA02432 Mon, 9 Oct 2000 16:23:53 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA07622; Mon, 9 Oct 2000 13:33:29 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 9 Oct 2000 12:16:32 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA27065 for fwtk-users-outgoing; Mon, 9 Oct 2000 12:16:21 -0700 (PDT) From: David Hamm Reply-To: dhamm@itrepro.com Organization: Imaging Technologies Services To: fwtk-users@ex.tis.com Subject: Virus filter Date: Mon, 9 Oct 2000 15:12:34 -0400 X-Mailer: KMail [version 1.0.20] MIME-Version: 1.0 Message-Id: <00100915152400.16282@workbox.atlanta.itserve.com> Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 486 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I'm running smap & smapd and am plagued with a number of email viruses on WinX clients. Has anyone done any work on developing email filters that would remove or disarm viruses. --------------------------------- David Hamm Systems Analyst Imaging Technologies Services Inc. email: dhamm@itrepro.com voice: 404-870-6663 --------------------------------- From owner-fwtk-users@ex.tis.com Mon Oct 9 19:32 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA03802 Mon, 9 Oct 2000 19:32:42 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA00397; Mon, 9 Oct 2000 16:42:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 9 Oct 2000 15:14:28 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA22114 for fwtk-users-outgoing; Mon, 9 Oct 2000 15:14:07 -0700 (PDT) Message-Id: <4.3.2.7.2.20001009174832.00bab6a0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Mon, 09 Oct 2000 17:52:13 -0400 To: kemal hajdarevic , fwtk-users@ex.tis.com From: Rick Murphy Subject: Re: smapd memory problem In-Reply-To: <384141389.971117779115.JavaMail.root@web589-mc> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 711 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 02:56 PM 10/9/00 -0400, kemal hajdarevic wrote: >There are many smapd processes runing if I type ps - ef | grep smapd. So my >idea is that forked smapd children eat all memory smapd child processes should have a fairly short lifespan - they hand the mail to sendmail then exit when sendmail finishes. Is mail getting through OK? Are there also lots of sendmail processes running? If not, something is keeping the smapd processes from seeing the sendmail process exiting. If there are a large number of sendmail processes, find out why they're getting stuck. -Rick From owner-fwtk-users@ex.tis.com Mon Oct 9 20:49 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA03993 Mon, 9 Oct 2000 20:49:21 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA05961; Mon, 9 Oct 2000 17:58:47 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 9 Oct 2000 16:35:20 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA29294 for fwtk-users-outgoing; Mon, 9 Oct 2000 16:34:58 -0700 (PDT) Date: Mon, 9 Oct 2000 19:33:57 -0400 (EDT) From: Ted Keller To: David Hamm cc: fwtk-users@ex.tis.com Subject: Re: Virus filter In-Reply-To: <00100915152400.16282@workbox.atlanta.itserve.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1129 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] David, I may have a partial fix... My spam filters can be used to remove simple viruses that have signitures in the subject, header, or text lines. There is also a sendmail add-on which was reported on bugtraq for removing specific type of attachments from e-mail messages. This could be used for removing any .exe and the like. Beyond that, you may need to go into a commercial virus product for further e-mail cleansing. ted keller On Mon, 9 Oct 2000, David Hamm wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I'm running smap & smapd and am plagued with a number of email viruses on WinX > clients. Has anyone done any work on developing email filters that would > remove or disarm viruses. > > --------------------------------- > David Hamm > Systems Analyst > Imaging Technologies Services Inc. > email: dhamm@itrepro.com > voice: 404-870-6663 > --------------------------------- > From owner-fwtk-users@ex.tis.com Mon Oct 9 23:11 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA04393 Mon, 9 Oct 2000 23:11:54 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA12468; Mon, 9 Oct 2000 20:21:18 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 9 Oct 2000 18:54:57 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA08625 for fwtk-users-outgoing; Mon, 9 Oct 2000 18:54:36 -0700 (PDT) From: "Tom Krotchko" To: , Subject: RE: Virus filter Date: Mon, 9 Oct 2000 21:54:17 -0400 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 In-Reply-To: <00100915152400.16282@workbox.atlanta.itserve.com> Importance: Normal Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1229 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Someone posted some perl scripts they had written for this task. Crude, but very effective. You've got to know what you're doing to set them up (understand the basics of RE's, perl, and the startup scripts on your firewall), and it basically won't deliver any message with forbidden strings. I'm at home, and i can't remember the name...something like smapwatch? Check the archives for the source. -----Original Message----- From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On Behalf Of David Hamm Sent: Monday, October 09, 2000 3:13 PM To: fwtk-users@ex.tis.com Subject: Virus filter [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I'm running smap & smapd and am plagued with a number of email viruses on WinX clients. Has anyone done any work on developing email filters that would remove or disarm viruses. --------------------------------- David Hamm Systems Analyst Imaging Technologies Services Inc. email: dhamm@itrepro.com voice: 404-870-6663 --------------------------------- From owner-fwtk-users@ex.tis.com Tue Oct 10 05:21 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA05564 Tue, 10 Oct 2000 05:21:45 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA23415; Tue, 10 Oct 2000 02:30:44 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 10 Oct 2000 00:20:59 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA19335 for fwtk-users-outgoing; Tue, 10 Oct 2000 00:20:38 -0700 (PDT) X-Authentication-Warning: proxy.hundert6.de: mail set sender to using -f Message-ID: <39E2C2F0.CB548866@radio.hundert6.de> Date: Tue, 10 Oct 2000 09:19:12 +0200 From: Jan Muenther Organization: Radio Hundert,6 X-Mailer: Mozilla 4.72 [en] (X11; I; FreeBSD 4.0-RELEASE i386) X-Accept-Language: en MIME-Version: 1.0 To: dhamm@itrepro.com, "'fwtk-users@ex.tis.com'" Subject: Re: Virus filter References: <00100915152400.16282@workbox.atlanta.itserve.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 490 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > I'm running smap & smapd and am plagued with a number of email viruses on WinX > clients. Has anyone done any work on developing email filters that would > remove or disarm viruses. Check out AMaViS at http://www.amavis.org - we use it and it performs quite nicely. Cheers, Jan -- Radio HUNDERT,6 Medien GmbH Berlin - EDV - j.muenther@radio.hundert6.de From owner-fwtk-users@ex.tis.com Tue Oct 10 06:09 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA05708 Tue, 10 Oct 2000 06:09:45 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA25316; Tue, 10 Oct 2000 03:19:21 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 10 Oct 2000 01:58:33 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA22354 for fwtk-users-outgoing; Tue, 10 Oct 2000 01:58:22 -0700 (PDT) X-Authentication-Warning: backup.okfd.com: smap set sender to using -f Message-ID: <013801c03298$3899df80$8017dede@okfd.com> From: "Shawn Fletcher" To: References: <00100915152400.16282@workbox.atlanta.itserve.com> Subject: Re: Virus filter Date: Tue, 10 Oct 2000 10:58:12 +0200 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2615.200 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2615.200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 4791 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I used AmaVis to do this with sendmail. It works with most of the unix/linux anti virus scanners. Unfortuanately it only cleanses incoming mail. I use F-Prot to check for virii I wrote a dirty little script to do this on the firewall. Assuming that smap/smapd use different directories its as follows. (My shell scripting etc is putrid but you should get the idea anyway. The Amavis has better ways of unziping and protection on unziped files. This definately puts more overhead on the firewall) I call this script every 1 minute with sleep 60. Cut Here ######################################################## #!/bin/bash ######################################################## #mail virus scanning # ######################################################## SMAPDIR=/var/spool/smap SMAPDDIR=/var/spool/smapd HOLDINGPOINT=/var/spool/virus SENDMAIL=/usr/sbin/sendmail MM_QUIET=1 MM_SUMMERY="To:" export METAMAIL_TMPDIR="/tmp/metamail" CHECKVIR() { VIRFOUND=0 /usr/local/fsav/fsav --databasedirectory=/usr/local/fsav --dumb --archive /tmp/metamail/* > /tmp/virus.log SCANMAIL=$? if test $SCANMAIL -eq 3 then VIRFOUND=1 fi rm -f /tmp/metamail/* } NOTIFY() { zip -jklov9 $HOLDINGPOINT/$MESSAGE.zip.renameme $HOLDINGPOINT/$MESSAGE receipent=`cat $HOLDINGPOINT/$MESSAGE.headers | grep -s ^To: | sed 's/To://;s/ *//g;s/,/,,,/g;s/,/& =/g;s/,,/ /g'| tr "=" "\n" | sed 's/^/& =/g' | tr "=" "\t" | grep okfd.com ` sender_=`grep 'From:' $HOLDINGPOINT/$MESSAGE.headers | sed '2d;s/From://g'` sender=`echo $sender_ | sed -e 's/^/:/;s/ /tmp/headers } main() { for MESSAGE in `ls -l $SMAPDIR | awk '{print $9}' | grep sma` do GETTO CHECKVIR MAILCONT done } main ########################################################### cut here ----- Original Message ----- From: David Hamm To: Sent: Monday, October 09, 2000 9:12 PM Subject: Virus filter > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I'm running smap & smapd and am plagued with a number of email viruses on WinX > clients. Has anyone done any work on developing email filters that would > remove or disarm viruses. > > --------------------------------- > David Hamm > Systems Analyst > Imaging Technologies Services Inc. > email: dhamm@itrepro.com > voice: 404-870-6663 > --------------------------------- From owner-fwtk-users@ex.tis.com Tue Oct 10 06:56 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA05812 Tue, 10 Oct 2000 06:56:45 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA27064; Tue, 10 Oct 2000 04:06:22 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 10 Oct 2000 02:50:46 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA24065 for fwtk-users-outgoing; Tue, 10 Oct 2000 02:50:35 -0700 (PDT) Reply-To: From: "Roelf Schreurs" To: "Fwtk-Users" Subject: Telnet into server Date: Tue, 10 Oct 2000 11:50:08 +0200 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 554 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I was wondering if there is a safe way to telnet in-to our firewall from the outside (internet not intranet). Will it be able to set it up if somebody dials into a ISP and then try and telnet. I mention the ISP because that means they won't have the same ip address everytime they connect. (That rules VPN's out because they are set up with IP addresses if I understand correctly) Roelf Schreurs Crossroads Distribution IT From owner-fwtk-users@ex.tis.com Tue Oct 10 09:24 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA06336 Tue, 10 Oct 2000 09:24:01 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA05259; Tue, 10 Oct 2000 06:33:30 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 10 Oct 2000 05:07:48 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA29137 for fwtk-users-outgoing; Tue, 10 Oct 2000 05:07:37 -0700 (PDT) Message-ID: From: "Nixon, Anthony" To: fwtk-users@ex.tis.com Subject: smap Date: Tue, 10 Oct 2000 08:06:49 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 600 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am setting up a firewall and have the regular services running such as authsrv, http, ftp, telnet, etc. The only thing left is setting up smap. My question is do I run it as a daemon such as /usr/local/etc/smapd -daemon 25 &? Does smap also need to be called? How does it work exactly? Does it call sendmail when mail arrives at port 25 or does it send the mail itself? Any help would be appreciated. Shon Nixon Chief - Information Technology Midrex Enterprises, Inc. From owner-fwtk-users@ex.tis.com Tue Oct 10 09:28 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA06348 Tue, 10 Oct 2000 09:28:14 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA05580; Tue, 10 Oct 2000 06:37:46 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 10 Oct 2000 05:26:21 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA00202 for fwtk-users-outgoing; Tue, 10 Oct 2000 05:26:10 -0700 (PDT) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <39E30092.623EBF03@peaktime.be> Date: Tue, 10 Oct 2000 13:42:10 +0200 From: Michel Bardiaux Organization: Peaktime Belgium S.A. X-Mailer: Mozilla 4.73 [en] (WinNT; I) X-Accept-Language: en,fr MIME-Version: 1.0 To: Fwtk-Users Subject: Re: Telnet into server References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 968 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Roelf Schreurs wrote: > > I was wondering if there is a safe way to telnet in-to our firewall from the > outside (internet not intranet). Will it be able to set it up if somebody > dials into a ISP and then try and telnet. I mention the ISP because that > means they won't have the same ip address everytime they connect. (That > rules VPN's out because they are set up with IP addresses if I understand > correctly) > Although I don't use them, I know FWTK supports a number of stronger authentication schemes, such as one-time passwords. Or you could use SSH (my preference). Of course, netacl rules restricting access to the range of IPs used by your ISP would do no harm (belt and suspenders :-) -- Michel Bardiaux Peaktime Belgium S.A. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 From owner-fwtk-users@ex.tis.com Tue Oct 10 11:03 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA06652 Tue, 10 Oct 2000 11:03:12 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA17136; Tue, 10 Oct 2000 08:12:38 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 10 Oct 2000 06:48:27 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA06477 for fwtk-users-outgoing; Tue, 10 Oct 2000 06:48:06 -0700 (PDT) X-Authentication-Warning: proxy.hundert6.de: mail set sender to using -f Message-ID: <39E31DAD.2E04C767@radio.hundert6.de> Date: Tue, 10 Oct 2000 15:46:21 +0200 From: Jan Muenther Organization: Radio Hundert,6 X-Mailer: Mozilla 4.72 [en] (X11; I; FreeBSD 4.0-RELEASE i386) X-Accept-Language: en MIME-Version: 1.0 To: roelfs@crossroads.co.za, "'fwtk-users@ex.tis.com'" Subject: Re: Telnet into server References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 865 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi there, > I was wondering if there is a safe way to telnet in-to our firewall from the > outside (internet not intranet). Will it be able to set it up if somebody > dials into a ISP and then try and telnet. I mention the ISP because that > means they won't have the same ip address everytime they connect. (That > rules VPN's out because they are set up with IP addresses if I understand > correctly) Using telnet for remote administration on a non-internal host is not a good idea. telnet is a plain text protocol, thus passwords can be sniffed in case one of the hosts involved in the transmission is compromised. Use ssh, it's easy and safe. Bye, Jan -- Radio HUNDERT,6 Medien GmbH Berlin - EDV - j.muenther@radio.hundert6.de From owner-fwtk-users@ex.tis.com Tue Oct 10 12:36 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA07042 Tue, 10 Oct 2000 12:36:16 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA29779; Tue, 10 Oct 2000 09:45:52 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 10 Oct 2000 08:17:52 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA17724 for fwtk-users-outgoing; Tue, 10 Oct 2000 08:17:41 -0700 (PDT) Message-Id: <200010101516.RAA29252@ise.ch> Date: Tue, 10 Oct 2000 17:16:44 +0200 (MET DST) From: Andreas Bischoff Reply-To: Andreas Bischoff Subject: smap and relaying To: fwtk-users@ex.tis.com Cc: bischoff@ise.ch MIME-Version: 1.0 Content-MD5: QwZNzLiTJFQYFCCm28V0SQ== X-Mailer: dtmail 1.2.1 CDE Version 1.2.1 SunOS 5.6 sun4u sparc Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/plain; charset=us-ascii Content-Length: 1144 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Dear all, on one of our sites in the .com domain the firewall went down due to a broken disk. Temporarily I wanted to route emails through our other site in .ch I changed the Smart Relay host to the firewall in .ch I also edited the netperm-table to allow the mail hub in .com to connect to the firewall. So far so good, BUT: I can telnet to port 25 on the .ch firewall from the .com mail hub and I get the greetings, but in syslog on the .com mailhub I get: Oct 10 08:03:39 basel sendmail[16616]: AAA19996: to=xxx, ctladdr=yyy (10026/134), delay=2+07:32:41, xdelay=00:00:00, mailer=relay, relay=fw.ise.ch., stat=Deferred: Connection timed out with fw.ise.ch. >From the log file on the firewall I get: Oct 10 16:38:38 fw netacl[6901]: permit host=aaa.bbb.com service=smap execute=/usr/local/etc/smap Oct 10 16:38:38 fw smap[6901]: connect host=aaa.bbb.com Does smap read the sendmail.cf file, which of course doesn't permit relaying per default ? Did I miss anything else ? Regards, Andreas From owner-fwtk-users@ex.tis.com Tue Oct 10 12:41 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA07067 Tue, 10 Oct 2000 12:41:20 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA00481; Tue, 10 Oct 2000 09:50:32 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 10 Oct 2000 08:36:46 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA20651 for fwtk-users-outgoing; Tue, 10 Oct 2000 08:36:14 -0700 (PDT) Message-ID: From: Malcolm Tester To: Ted Keller , David Hamm Cc: fwtk-users@ex.tis.com Subject: RE: Virus filter Date: Tue, 10 Oct 2000 09:33:55 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2191 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] David, We use Exchange on the inside, so we have a Norton AV plug-in for email. It works beautifully. If you don't have something like Exchange, many client MUAs can also have a plug-in. Norton and NAI both provide such a program. It does mean spending money, but for the lack of headaches that come with it, it is well worth it. I just purchased some mroe Norton client licenses the other day for about $22.00 each. Not bad. As long as you do the live-update or whatever the program calls the method for updating virus definition files on a regular basis, you'd be fine. Malcolm Tester II -> -----Original Message----- -> From: Ted Keller [mailto:keller@bfg.com] -> Sent: Monday, October 09, 2000 5:34 PM -> To: David Hamm -> Cc: fwtk-users@ex.tis.com -> Subject: Re: Virus filter -> -> -> [To be removed from this list send the message "unsubscribe -> fwtk-users" in the -> BODY of a mail message to majordomo@ex.tis.com.] -> -> David, -> -> I may have a partial fix... My spam filters can be used to -> remove simple -> viruses that have signitures in the subject, header, or text -> lines. There -> is also a sendmail add-on which was reported on bugtraq for removing -> specific type of attachments from e-mail messages. This -> could be used for -> removing any .exe and the like. -> -> Beyond that, you may need to go into a commercial virus product for -> further e-mail cleansing. -> -> ted keller -> -> -> On Mon, 9 Oct 2000, David Hamm wrote: -> -> > [To be removed from this list send the message -> "unsubscribe fwtk-users" in the -> > BODY of a mail message to majordomo@ex.tis.com.] -> > -> > I'm running smap & smapd and am plagued with a number of -> email viruses on WinX -> > clients. Has anyone done any work on developing email -> filters that would -> > remove or disarm viruses. -> > -> > --------------------------------- -> > David Hamm -> > Systems Analyst -> > Imaging Technologies Services Inc. -> > email: dhamm@itrepro.com -> > voice: 404-870-6663 -> > --------------------------------- -> > -> From owner-fwtk-users@ex.tis.com Wed Oct 11 00:10 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id AAA09259 Wed, 11 Oct 2000 00:10:41 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id VAA01905; Tue, 10 Oct 2000 21:19:45 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 10 Oct 2000 19:44:26 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA28384 for fwtk-users-outgoing; Tue, 10 Oct 2000 19:44:02 -0700 (PDT) Date: Tue, 10 Oct 2000 22:43:27 -0400 From: Joseph S D Yao To: Roelf Schreurs Cc: Fwtk-Users Subject: Re: Telnet into server Message-Id: <20001010224327.G2970@washington.cospo.osis.gov> Mail-Followup-To: Roelf Schreurs , Fwtk-Users References: Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from roelfs@crossroads.co.za on Tue, Oct 10, 2000 at 11:50:08AM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1032 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Tue, Oct 10, 2000 at 11:50:08AM +0200, Roelf Schreurs wrote: > I was wondering if there is a safe way to telnet in-to our firewall from the > outside (internet not intranet). Will it be able to set it up if somebody > dials into a ISP and then try and telnet. I mention the ISP because that > means they won't have the same ip address everytime they connect. (That > rules VPN's out because they are set up with IP addresses if I understand > correctly) > > Roelf Schreurs > Crossroads Distribution IT Somewhere in the documentation it describes how you can telnet in, authenticate using S/Key, and have this start up a tn-gw that you can use to telnet into your network. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Wed Oct 11 09:33 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA11273 Wed, 11 Oct 2000 09:33:29 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA26288; Wed, 11 Oct 2000 06:39:42 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Oct 2000 04:59:27 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA20159 for fwtk-users-outgoing; Wed, 11 Oct 2000 04:59:16 -0700 (PDT) Message-ID: From: "Nixon, Anthony" To: "'fwtk-users@ex.tis.com'" Subject: Setting up smap Date: Wed, 11 Oct 2000 07:58:51 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 999 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am setting up a firewall and have the regular services running such as authsrv, http-gw, ftp-gw, tn-gw, etc. The only thing left is setting up smap. I have been able to find several instances of information on how to configure all of the proxies except for smap/smapd. I have read the man pages on both, but they are sort of vague. The man pages don't even speak of running smap in inetd. I had to find that somewhere else. So, I have found bits and pieces, but not a clear explanation of exactly how to set it up and use it. Is there such a document? How does it work exactly and how do I set it up to work with sendmail? Anything special I need to do with sendmail or its config files? If I set up smap to use a chrooted directory, what else needs to be done? Any help will be greatly appreciated. Shon Nixon Chief - Information Technology Midrex Enterprises, Inc. From owner-fwtk-users@ex.tis.com Wed Oct 11 09:33 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA11272 Wed, 11 Oct 2000 09:33:29 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA26282; Wed, 11 Oct 2000 06:39:40 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Oct 2000 04:26:12 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA19057 for fwtk-users-outgoing; Wed, 11 Oct 2000 04:26:00 -0700 (PDT) Message-ID: <39E432FE.592A401E@med.unipi.it> Date: Wed, 11 Oct 2000 11:29:34 +0200 From: Ilaria Tripodi X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14-5.0 i586) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@ex.tis.com Subject: Missing separator Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 841 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello! My name is Ilaria and I'm a student and a beginer in working with TIS. I dowloaded TIS and compiled with make comand but I have an error and I need your help. The error is this ( word by word ): Makefile:16:*** missing separator.Stop. I'm running a Red Hat Linux 6.2 and i rename the file Makefile.config.linux in Makefile.config and the old Makefile.config in Makefile.config1. I read other mails looking at this subject and I tried to use gnumake or fixmake (and fixmake unfix because mine isn't a BSD system!) as writed in that mails. Can anybody explain in detail to me what can I do for installing my firewall? I don't understand very well what the README file says. Thanks in advance. From owner-fwtk-users@ex.tis.com Wed Oct 11 12:55 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA12298 Wed, 11 Oct 2000 12:55:11 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA21609; Wed, 11 Oct 2000 10:04:43 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Oct 2000 08:32:25 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA09067 for fwtk-users-outgoing; Wed, 11 Oct 2000 08:32:14 -0700 (PDT) From: "Mario Misic" To: Subject: 501 unknown ftp problem Date: Wed, 11 Oct 2000 17:21:45 +0200 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-Mimeole: Produced By Microsoft MimeOLE V5.00.2314.1300 Importance: Normal Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 296 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi I know that it is a old problem but do not know if someone makes it work, I cannot reach ftp site ftp://ftp.pc.ibm.com and some other ftp sites! Regards! Mario From owner-fwtk-users@ex.tis.com Wed Oct 11 13:10 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA12347 Wed, 11 Oct 2000 13:10:08 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA23361; Wed, 11 Oct 2000 10:19:57 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Oct 2000 09:03:47 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA13173 for fwtk-users-outgoing; Wed, 11 Oct 2000 09:03:37 -0700 (PDT) Message-ID: <39E48CB3.99B0D9D@cclinf.polito.it> Date: Wed, 11 Oct 2000 17:52:19 +0200 From: root Organization: Politecnico X-Mailer: Mozilla 4.72 [en] (X11; I; Linux 2.2.15 i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@tis.com Subject: getting TIS fw toolkit Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 348 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Good morning, can you tell me where can I obtain the TIS firewall toolkit (I suppose it is fwtk-X.X.tar.Z)? I have done anonymous ftp at ftp.tis.com but I have not found the TIS firewall toolkit.. Thank you AB From owner-fwtk-users@ex.tis.com Wed Oct 11 14:01 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA12522 Wed, 11 Oct 2000 14:00:43 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA29932; Wed, 11 Oct 2000 11:10:14 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Oct 2000 09:46:33 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA19278 for fwtk-users-outgoing; Wed, 11 Oct 2000 09:46:22 -0700 (PDT) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <39E492CA.1BF4D389@peaktime.be> Date: Wed, 11 Oct 2000 18:18:18 +0200 From: Michel Bardiaux Organization: Peaktime Belgium S.A. X-Mailer: Mozilla 4.73 [en] (WinNT; I) X-Accept-Language: en,fr MIME-Version: 1.0 To: fwtk-users@tis.com Subject: Re: getting TIS fw toolkit References: <39E48CB3.99B0D9D@cclinf.polito.it> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 786 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] root wrote: > > Good morning, > can you tell me where can I obtain the TIS firewall toolkit (I > suppose it is fwtk-X.X.tar.Z)? I have done anonymous ftp at ftp.tis.com > but I have not found the TIS firewall toolkit.. > > Thank you > > AB You have to go to http://www.tis.com/research/software/index.html and follow the download instructions. Oh - and when they tell you to read the license, THEY MEAN IT. The FWTK license is nothing like GPL, LGPL, BSD or X licensing, so read it *very* carefully. Greetings. -- Michel Bardiaux Peaktime Belgium S.A. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 From owner-fwtk-users@ex.tis.com Wed Oct 11 14:01 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA12523 Wed, 11 Oct 2000 14:00:45 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA29928; Wed, 11 Oct 2000 11:10:11 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Oct 2000 09:47:44 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA19453 for fwtk-users-outgoing; Wed, 11 Oct 2000 09:47:23 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: Date: Wed, 11 Oct 2000 17:27:14 +0100 (BST) From: Tony Gale To: Mario Misic Subject: RE: 501 unknown ftp problem Cc: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 850 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Apply the patches in the Patches section on www.fwtk.org (esp. 1.9) -tony On 11-Oct-2000 Mario Misic wrote: > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi > > I know that it is a old problem but do not know if someone makes it > work, I > cannot reach ftp site ftp://ftp.pc.ibm.com and some other ftp > sites! > > Regards! > Mario --- E-Mail: Tony Gale "Irrationality is the square root of all evil" -- Douglas Hofstadter The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Wed Oct 11 16:08 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA13022 Wed, 11 Oct 2000 16:07:45 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA16922; Wed, 11 Oct 2000 13:17:23 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Oct 2000 11:49:35 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA04562 for fwtk-users-outgoing; Wed, 11 Oct 2000 11:49:14 -0700 (PDT) Date: Wed, 11 Oct 2000 14:48:36 -0400 From: Joseph S D Yao To: Ilaria Tripodi Cc: fwtk-users@ex.tis.com Subject: Re: Missing separator Message-Id: <20001011144836.Z13802@washington.cospo.osis.gov> Mail-Followup-To: Ilaria Tripodi , fwtk-users@ex.tis.com References: <39E432FE.592A401E@med.unipi.it> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <39E432FE.592A401E@med.unipi.it>; from ilaria@med.unipi.it on Wed, Oct 11, 2000 at 11:29:34AM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1250 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Wed, Oct 11, 2000 at 11:29:34AM +0200, Ilaria Tripodi wrote: > Hello! My name is Ilaria and I'm a student and a beginer in working > with TIS. > I dowloaded TIS and compiled with make comand but I have an error and > I need your help. > The error is this ( word by word ): > Makefile:16:*** missing separator.Stop. > > I'm running a Red Hat Linux 6.2 and i rename the file > Makefile.config.linux in Makefile.config and the old Makefile.config in > Makefile.config1. > I read other mails looking at this subject and I tried to use gnumake > or fixmake (and fixmake unfix because mine isn't a BSD system!) as > writed in that mails. > Can anybody explain in detail to me what can I do for installing my > firewall? > I don't understand very well what the README file says. > Thanks in advance. I suspect that you didn't configure this, first. What does your 'Makefile' look like? -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Wed Oct 11 16:08 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA13023 Wed, 11 Oct 2000 16:07:46 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA16928; Wed, 11 Oct 2000 13:17:24 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Oct 2000 11:53:15 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA05018 for fwtk-users-outgoing; Wed, 11 Oct 2000 11:52:54 -0700 (PDT) Date: Wed, 11 Oct 2000 14:52:18 -0400 From: Joseph S D Yao To: root Cc: fwtk-users@tis.com Subject: Re: getting TIS fw toolkit Message-Id: <20001011145218.A13802@washington.cospo.osis.gov> Mail-Followup-To: root , fwtk-users@tis.com References: <39E48CB3.99B0D9D@cclinf.polito.it> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <39E48CB3.99B0D9D@cclinf.polito.it>; from s73538@cclix6.polito.it on Wed, Oct 11, 2000 at 05:52:19PM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 729 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Wed, Oct 11, 2000 at 05:52:19PM +0200, root wrote: > can you tell me where can I obtain the TIS firewall toolkit (I > suppose it is fwtk-X.X.tar.Z)? I have done anonymous ftp at ftp.tis.com > but I have not found the TIS firewall toolkit.. FAQ: Or find a closer mirror at: . -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Wed Oct 11 20:40 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA13693 Wed, 11 Oct 2000 20:39:53 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA21593; Wed, 11 Oct 2000 17:49:32 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Oct 2000 16:21:38 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA12917 for fwtk-users-outgoing; Wed, 11 Oct 2000 16:21:25 -0700 (PDT) From: "Luis Fernando Barrera" To: Subject: pasv mode ftp-gw patch Date: Wed, 11 Oct 2000 17:19:46 -0600 Message-ID: MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Importance: Normal Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id QAA12860 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 305 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, Does anyone know if the patch for enabling ftp-gw to use passive connections, works with the fwtk 2.1 with the ipbind patches? Luis Fernando Barrera luba@assist.com.gt From owner-fwtk-users@ex.tis.com Wed Oct 11 22:18 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA14039 Wed, 11 Oct 2000 22:18:25 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA26582; Wed, 11 Oct 2000 19:28:03 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Oct 2000 18:02:54 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA22452 for fwtk-users-outgoing; Wed, 11 Oct 2000 18:02:33 -0700 (PDT) Message-Id: <4.3.2.7.2.20001011204332.00ba93c0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Wed, 11 Oct 2000 20:46:26 -0400 To: Ilaria Tripodi , fwtk-users@ex.tis.com From: Rick Murphy Subject: Re: Missing separator In-Reply-To: <39E432FE.592A401E@med.unipi.it> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 811 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 11:29 AM 10/11/00 +0200, Ilaria Tripodi wrote: >The error is this ( word by word ): >Makefile:16:*** missing separator.Stop. PLEASE read the FAQ at http://www.fwtk.org/ You ran "fixmake" on the fwtk makefiles. As the documentation states, you ONLY run fixmake on BSD systems. For some reason, probably because they didn't read the README, some people run "fixmake" all the time. When you do that, fixmake leaves you with unusable makefiles. To correct your error, run "fixmake unfix" and try again. Since you're on Linux, make sure you've copied Makefile.config.linux to Makefile.config. Make sure you've got a Berkeley-compatible DBM library, as well. -Rick From owner-fwtk-users@ex.tis.com Thu Oct 12 13:44 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA16550 Thu, 12 Oct 2000 13:44:35 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA14637; Thu, 12 Oct 2000 10:54:13 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 12 Oct 2000 08:47:30 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA00189 for fwtk-users-outgoing; Thu, 12 Oct 2000 08:47:19 -0700 (PDT) From: "Fred LB" To: Subject: mail not delivered once upgraded to RedHat 7.0 Date: Thu, 12 Oct 2000 17:45:29 +0200 Message-ID: <6305E79D086AD4119FE700508B9A16DF019552@WALLIS> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) X-Mimeole: Produced By Microsoft MimeOLE V5.50.4133.2400 Importance: Normal Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1463 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, We recentely decide to move our strategic gateway (old Pentium 75) to a brand new Compaq server. I installed the new compaq with a redhat 7.0 (was redhat 6.2 on the old P75). I moved all the stuff (FWTK binaires, config files ...) from the old serv to the new one. Everything seems to work fine, except sendmail : when i get an inbound mail, smap handles it correctly, but it looks like sendmail doesn't want to deliver it to my exchange server (my mailhub), but tries to deliver it locally, which of course doesn't work. What did i forget ? I strongly suspect a sendmail misconfiguration, but i haven't got a serious clue ! My maillog follows : Oct 12 16:44:14 firewall sendmail[1503]: e9CEOnI01503: from=flb@nowhere.com, size=167, class=0, nrcpts=0, msgid=<200010121424.e9CEOnI01503@firewall.strathom.com>, relay=nobody@localhost Oct 12 16:44:14 firewall sendmail[1503]: e9CEOnI01503: to=flb@strathom.com, delay=00:02:25, mailer=local, pri=167, dsn=4.4.3, stat=queued Oct 12 16:45:26 firewall sendmail[812]: e9CEOnI01503: e9CEi7700812: DSN: User unknown If anyone has an idea ... i'd be graceful :-) Thanks in advance Fred Frédéric Le Bastard Administrateur système - développement web Tél : 02 40 35 32 32 Fax : 02 40 12 18 74 frederic.lebastard@strathom.com Découvrez notre site web : http://www.strathom.com From owner-fwtk-users@ex.tis.com Thu Oct 12 13:44 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA16549 Thu, 12 Oct 2000 13:44:35 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA14641; Thu, 12 Oct 2000 10:54:13 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 12 Oct 2000 08:40:54 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA29100 for fwtk-users-outgoing; Thu, 12 Oct 2000 08:40:21 -0700 (PDT) Message-ID: <000a01c03438$70950080$9b0a0a0a@cruisenet.net> From: "Jonathan B. Smith" To: Subject: http-gw exploit Date: Thu, 12 Oct 2000 10:37:36 -0000 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 X-SLUIDL: 69BE1A87-92FC11D4-A8280010-5AE061F1 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C03438.70165AA0" Content-Length: 1915 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. ------=_NextPart_000_0007_01C03438.70165AA0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable This is a warning to all of you that are using http-gw packaged with the = FWTK firewall. I recently found that a hacker had gotten into my = firewall and somehow used the http gateway to access the system. The = person(s) then changed the /etc/hosts.allow and /etc/hosts.deny files to = allow access to themselves and deny access to all. Please be aware of = this. It was a slip on my part to allow everyone access to the gateway. = If anyone else has the netperm-table allowing access to all, I strongly = suggest that you change it. =20 Jonathan B. Smith Network Administrator Aston Office US=B2 UNITED SUPPORT SYSTEMS jsmith@ustwo.com ------=_NextPart_000_0007_01C03438.70165AA0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable This is a warning to all of you that = are using=20 http-gw packaged with the FWTK firewall. I recently found that a = hacker=20 had gotten into my firewall and somehow used the http gateway to access = the=20 system. The person(s) then changed the /etc/hosts.allow and=20 /etc/hosts.deny files to allow access to themselves and deny access to=20 all. Please be aware of this. It was a slip on my part to = allow=20 everyone access to the gateway. If anyone else has the = netperm-table=20 allowing access to all, I strongly suggest that you change it. =20 Jonathan B. Smith Network = Administrator Aston=20 Office US=B2 UNITED SUPPORT SYSTEMS <3d.htm>jsmith@ustwo.<3d.htm>com = ------=_NextPart_000_0007_01C03438.70165AA0-- From owner-fwtk-users@ex.tis.com Thu Oct 12 15:06 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA16924 Thu, 12 Oct 2000 15:06:32 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA27180; Thu, 12 Oct 2000 12:16:11 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 12 Oct 2000 10:53:39 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA14497 for fwtk-users-outgoing; Thu, 12 Oct 2000 10:53:27 -0700 (PDT) From: "Luis Fernando Barrera" To: Subject: patched versios of fwtk Date: Thu, 12 Oct 2000 11:52:16 -0600 Message-ID: MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id KAA14473 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 513 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, Recently I needed to apply one of the patches for the ftp-gw to enable passive mode... However I saw the patches apply to a fresh version of fwtk 2.1 and I have a fwtk 2.1 with the specific-ip-port-bind patch... How can I apply a patch to a patched version? Is there a fwtk 2.1.1 or 2.2, with al the patches applied? Greetings. Luis Fernando Barrera luba@assist.com.gt From owner-fwtk-users@ex.tis.com Thu Oct 12 15:06 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA16927 Thu, 12 Oct 2000 15:06:40 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA27158; Thu, 12 Oct 2000 12:16:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 12 Oct 2000 10:59:34 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA15290 for fwtk-users-outgoing; Thu, 12 Oct 2000 10:59:13 -0700 (PDT) Date: Thu, 12 Oct 2000 13:57:06 -0400 (EDT) From: Ted Keller To: Fred LB cc: fwtk-users@tis.com Subject: Re: mail not delivered once upgraded to RedHat 7.0 In-Reply-To: <6305E79D086AD4119FE700508B9A16DF019552@WALLIS> Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by relay2.nai.com id KAA15242 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=X-UNKNOWN Content-Length: 1948 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Fredrick, Did you copy over your mailertable - which relays mail delivered to your firewall to the internal host? Note - there are, of coarse, other ways to accomplish this other than the mailertable method. ted keller On Thu, 12 Oct 2000, Fred LB wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi all, > > We recentely decide to move our strategic gateway (old Pentium 75) to a > brand new Compaq server. > I installed the new compaq with a redhat 7.0 (was redhat 6.2 on the old > P75). > I moved all the stuff (FWTK binaires, config files ...) from the old serv to > the new one. > > Everything seems to work fine, except sendmail : when i get an inbound mail, > smap handles it correctly, but it looks like sendmail doesn't want to > deliver it to my exchange server (my mailhub), but tries to deliver it > locally, which of course doesn't work. > > What did i forget ? I strongly suspect a sendmail misconfiguration, but i > haven't got a serious clue ! > > My maillog follows : > Oct 12 16:44:14 firewall sendmail[1503]: e9CEOnI01503: from=flb@nowhere.com, > size=167, class=0, nrcpts=0, > msgid=<200010121424.e9CEOnI01503@firewall.strathom.com>, > relay=nobody@localhost > Oct 12 16:44:14 firewall sendmail[1503]: e9CEOnI01503: to=flb@strathom.com, > delay=00:02:25, mailer=local, pri=167, dsn=4.4.3, stat=queued > Oct 12 16:45:26 firewall sendmail[812]: e9CEOnI01503: e9CEi7700812: DSN: > User unknown > > > If anyone has an idea ... i'd be graceful :-) > > Thanks in advance > > Fred > > > Frédéric Le Bastard > Administrateur système - développement web > Tél : 02 40 35 32 32 > Fax : 02 40 12 18 74 > frederic.lebastard@strathom.com > Découvrez notre site web : http://www.strathom.com > > > From owner-fwtk-users@ex.tis.com Thu Oct 12 15:33 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA17085 Thu, 12 Oct 2000 15:33:17 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA01119; Thu, 12 Oct 2000 12:42:46 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 12 Oct 2000 11:27:10 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA19447 for fwtk-users-outgoing; Thu, 12 Oct 2000 11:26:49 -0700 (PDT) Message-ID: <20001012182615.19226.qmail@web1806.mail.yahoo.com> Date: Thu, 12 Oct 2000 11:26:15 -0700 (PDT) From: Naresh Narang Subject: Re: http-gw exploit To: "Jonathan B. Smith" , fwtk-users@ex.tis.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1082 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi Jonathan: You got exploited by your own misconfiguration. NKN --- "Jonathan B. Smith" wrote: > This is a warning to all of you that are using > http-gw packaged with the FWTK firewall. I recently > found that a hacker had gotten into my firewall and > somehow used the http gateway to access the system. > The person(s) then changed the /etc/hosts.allow and > /etc/hosts.deny files to allow access to themselves > and deny access to all. Please be aware of this. > It was a slip on my part to allow everyone access to > the gateway. If anyone else has the netperm-table > allowing access to all, I strongly suggest that you > change it. > > > Jonathan B. Smith > Network Administrator > Aston Office > US² UNITED SUPPORT SYSTEMS > jsmith@ustwo.com > ===== -- Naresh __________________________________________________ Do You Yahoo!? Get Yahoo! Mail - Free email you can access from anywhere! http://mail.yahoo.com/ From owner-fwtk-users@ex.tis.com Thu Oct 12 17:15 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA17411 Thu, 12 Oct 2000 17:15:59 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA15314; Thu, 12 Oct 2000 14:25:28 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 12 Oct 2000 12:59:33 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA03491 for fwtk-users-outgoing; Thu, 12 Oct 2000 12:59:12 -0700 (PDT) Date: Thu, 12 Oct 2000 21:56:58 +0200 (CEST) From: Leandro Gelasi To: "Jonathan B. Smith" Cc: fwtk-users@ex.tis.com Subject: Re: http-gw exploit In-Reply-To: <000a01c03438$70950080$9b0a0a0a@cruisenet.net> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 519 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] What do you mean with "open to all"? How was your netpermtable configured? Can you give us more details? LG ********************************************************************* Leandro Gelasi V year Computer Science Engineering student at Siena University gelasi@interfree.it Gilles Villeneuve will live forever ********************************************************************* From owner-fwtk-users@ex.tis.com Thu Oct 12 19:33 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA17780 Thu, 12 Oct 2000 19:33:14 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA00085; Thu, 12 Oct 2000 16:42:44 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 12 Oct 2000 15:17:27 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA22940 for fwtk-users-outgoing; Thu, 12 Oct 2000 15:17:05 -0700 (PDT) Date: Thu, 12 Oct 2000 18:16:29 -0400 From: Joseph S D Yao To: "Jonathan B. Smith" Cc: fwtk-users@ex.tis.com Subject: Re: http-gw exploit Message-Id: <20001012181629.H23629@washington.cospo.osis.gov> Mail-Followup-To: "Jonathan B. Smith" , fwtk-users@ex.tis.com References: <000a01c03438$70950080$9b0a0a0a@cruisenet.net> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailer: Mutt 1.0i In-Reply-To: <000a01c03438$70950080$9b0a0a0a@cruisenet.net>; from jsmith@ustwo.com on Thu, Oct 12, 2000 at 10:37:36AM -0000 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 1721 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Thu, Oct 12, 2000 at 10:37:36AM -0000, Jonathan B. Smith wrote: > This is a warning to all of you that are using http-gw packaged with the FWTK firewall. I recently found that a hacker had gotten into my firewall and somehow used the http gateway to access the system. The person(s) then changed the /etc/hosts.allow and /etc/hosts.deny files to allow access to themselves and deny access to all. Please be aware of this. It was a slip on my part to allow everyone access to the gateway. If anyone else has the netperm-table allowing access to all, I strongly suggest that you change it. > > > Jonathan B. Smith > Network Administrator > Aston Office > US² UNITED SUPPORT SYSTEMS > jsmith@ustwo.com As has been said many times, the http-gw is NOT DESIGNED to let people into your network, and should never be used for that. Nevertheless, they could NOT have gotten into your network the way you describe unless you also have your Web server misconfigured to allow some sort of Web server exploit, and probably your telnet gateway configured to allow too easy access as well. I hope that your Web server is not on the same machine as FWTK. There should be NO other services on the FWTK machine, and no way through the FWTK machine except for through the proxies. Anything else is locking the doors but leaving jagged holes in the sides of the house. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Thu Oct 12 19:33 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA17784 Thu, 12 Oct 2000 19:33:22 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA00097; Thu, 12 Oct 2000 16:42:53 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 12 Oct 2000 15:20:19 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA23373 for fwtk-users-outgoing; Thu, 12 Oct 2000 15:19:58 -0700 (PDT) Date: Thu, 12 Oct 2000 18:19:23 -0400 From: Joseph S D Yao To: Fred LB Cc: fwtk-users@tis.com Subject: Re: mail not delivered once upgraded to RedHat 7.0 Message-Id: <20001012181923.I23629@washington.cospo.osis.gov> Mail-Followup-To: Fred LB , fwtk-users@tis.com References: <6305E79D086AD4119FE700508B9A16DF019552@WALLIS> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailer: Mutt 1.0i In-Reply-To: <6305E79D086AD4119FE700508B9A16DF019552@WALLIS>; from frederic.lebastard@strathom.com on Thu, Oct 12, 2000 at 05:45:29PM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 2103 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Thu, Oct 12, 2000 at 05:45:29PM +0200, Fred LB wrote: > We recentely decide to move our strategic gateway (old Pentium 75) to a > brand new Compaq server. > I installed the new compaq with a redhat 7.0 (was redhat 6.2 on the old > P75). > I moved all the stuff (FWTK binaires, config files ...) from the old serv to > the new one. > > Everything seems to work fine, except sendmail : when i get an inbound mail, > smap handles it correctly, but it looks like sendmail doesn't want to > deliver it to my exchange server (my mailhub), but tries to deliver it > locally, which of course doesn't work. > > What did i forget ? I strongly suspect a sendmail misconfiguration, but i > haven't got a serious clue ! > > My maillog follows : > Oct 12 16:44:14 firewall sendmail[1503]: e9CEOnI01503: from=flb@nowhere.com, > size=167, class=0, nrcpts=0, > msgid=<200010121424.e9CEOnI01503@firewall.strathom.com>, > relay=nobody@localhost > Oct 12 16:44:14 firewall sendmail[1503]: e9CEOnI01503: to=flb@strathom.com, > delay=00:02:25, mailer=local, pri=167, dsn=4.4.3, stat=queued > Oct 12 16:45:26 firewall sendmail[812]: e9CEOnI01503: e9CEi7700812: DSN: > User unknown > > > If anyone has an idea ... i'd be graceful :-) > > Thanks in advance > > Fred > > Frédéric Le Bastard > Administrateur système - développement web > Tél : 02 40 35 32 32 > Fax : 02 40 12 18 74 > frederic.lebastard@strathom.com > Découvrez notre site web : http://www.strathom.com Check your RCS files to see how you modified your sendmail config files on your old gateway. You are right - that is where the problems lie. If you don't use RCS, shame on you. Get out your 6.2 CD and pull off the virgin files, and start doing 'diff's with the versions you had been using. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Oct 13 05:11 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA19492 Fri, 13 Oct 2000 05:11:15 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA08257; Fri, 13 Oct 2000 02:20:43 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 00:45:03 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA04971 for fwtk-users-outgoing; Fri, 13 Oct 2000 00:44:43 -0700 (PDT) From: "Fred LB" To: "'Mike Kercher'" Cc: Subject: RE: mail not delivered once upgraded to RedHat 7.0 Date: Fri, 13 Oct 2000 09:41:36 +0200 Message-ID: <6305E79D086AD4119FE700508B9A16DF019553@WALLIS> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) In-Reply-To: <6305E79D086AD4119FE700508B9A16DF0AF32A@WALLIS> X-Mimeole: Produced By Microsoft MimeOLE V5.50.4133.2400 Importance: Normal Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2674 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, and thank you for you answer. As i explained, i just moved my working config files from a working RH 6.2 box to a new RH 7.0 box. My mailhub is declared in the sendmail.cw file, but not in the sendmail.cf. (but this works on my actual box !) Thanks for your help :) Frédéric Le Bastard Administrateur système - développement web Tél : 02 40 35 32 32 Fax : 02 40 12 18 74 frederic.lebastard@strathom.com Découvrez notre site web : http://www.strathom.com > -----Message d'origine----- > De : Mike Kercher [mailto:mike@CamaroSS.net] > Envoyé : jeudi 12 octobre 2000 19:59 > À : Frederic Le Bastard > Objet : RE: mail not delivered once upgraded to RedHat 7.0 > > > Did you specify your mailhub in /etc/sendmail.cf? > > -----Original Message----- > From: owner-fwtk-users@ex.tis.com > [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Fred LB > Sent: Thursday, October 12, 2000 10:45 AM > To: fwtk-users@tis.com > Subject: mail not delivered once upgraded to RedHat 7.0 > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in > the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi all, > > We recentely decide to move our strategic gateway (old > Pentium 75) to a > brand new Compaq server. > I installed the new compaq with a redhat 7.0 (was redhat 6.2 > on the old > P75). > I moved all the stuff (FWTK binaires, config files ...) from > the old serv to > the new one. > > Everything seems to work fine, except sendmail : when i get > an inbound mail, > smap handles it correctly, but it looks like sendmail doesn't want to > deliver it to my exchange server (my mailhub), but tries to deliver it > locally, which of course doesn't work. > > What did i forget ? I strongly suspect a sendmail > misconfiguration, but i > haven't got a serious clue ! > > My maillog follows : > Oct 12 16:44:14 firewall sendmail[1503]: e9CEOnI01503: > from=flb@nowhere.com, > size=167, class=0, nrcpts=0, > msgid=<200010121424.e9CEOnI01503@firewall.strathom.com>, > relay=nobody@localhost > Oct 12 16:44:14 firewall sendmail[1503]: e9CEOnI01503: > to=flb@strathom.com, > delay=00:02:25, mailer=local, pri=167, dsn=4.4.3, stat=queued > Oct 12 16:45:26 firewall sendmail[812]: e9CEOnI01503: > e9CEi7700812: DSN: > User unknown > > > If anyone has an idea ... i'd be graceful :-) > > Thanks in advance > > Fred > > > Frédéric Le Bastard > Administrateur système - développement web > Tél : 02 40 35 32 32 > Fax : 02 40 12 18 74 > frederic.lebastard@strathom.com > Découvrez notre site web : http://www.strathom.com > > From owner-fwtk-users@ex.tis.com Fri Oct 13 05:40 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA19581 Fri, 13 Oct 2000 05:40:00 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA09289; Fri, 13 Oct 2000 02:49:40 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 01:34:28 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA06355 for fwtk-users-outgoing; Fri, 13 Oct 2000 01:34:17 -0700 (PDT) From: "John Ward" To: Subject: Code for firewall "implementation" on an NT OS Date: Fri, 13 Oct 2000 10:38:24 +0200 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 306 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, Does anyone have info on where i can get to grips with writing code for an NT firewall ?? Thanks in advance ________________________________________________ John Ward From owner-fwtk-users@ex.tis.com Fri Oct 13 05:45 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA19603 Fri, 13 Oct 2000 05:45:00 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA09536; Fri, 13 Oct 2000 02:54:41 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 01:42:23 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA06605 for fwtk-users-outgoing; Fri, 13 Oct 2000 01:42:12 -0700 (PDT) Message-ID: <001401ba9948$3b316d60$060189c0@wen> From: "wen" To: Subject: offer ftp server through box installed fwtk Date: Fri, 13 Oct 1995 16:45:09 +0800 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2615.200 X-Mimeole: Produced By Microsoft MimeOLE V5.00.2615.200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="----=_NextPart_000_0011_01BA998B.4239D460" Content-Length: 1706 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. ------=_NextPart_000_0011_01BA998B.4239D460 Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: base64 aGk6DQogICBpIGhhdmUgc2V0IHVwIGZpcmV3YWxsIGJveCB0aGF0IGluc3RhbGxlZCBmd3RrMi4x IGJldHdlZW4gaW50ZXJuZXQgYW5kIGludHJhbmV0Lm5vdyBpIHdhbnQgdG8gb2ZmZXIgZnRwIHNl cnZpY2UgZm9yIGludGVybmV0IGluIHRoZSBpbnRyYW5ldCBvciBETVouIEkgaGF2ZSB0cmllZCB0 byB1c2UgcGx1Zy1ndyB0byBkbyxidXQgSSBmYWlsZWQgYmVhY3VzZSBmdHAgc2VydmljZSBuZWVk IHR3byBwb3J0czoyMSBhbmQgMjAgYXQgdGhlIHNhbWUgdGltZS53aGF0IHNob3VsZCBpIGRvPw0K ------=_NextPart_000_0011_01BA998B.4239D460 Content-Type: text/html; charset="gb2312" Content-Transfer-Encoding: base64 PCFET0NUWVBFIEhUTUwgUFVCTElDICItLy9XM0MvL0RURCBIVE1MIDQuMCBUcmFuc2l0aW9uYWwv L0VOIj4NCjxIVE1MPjxIRUFEPg0KPE1FVEEgY29udGVudD0idGV4dC9odG1sOyBjaGFyc2V0PWdi MjMxMiIgaHR0cC1lcXVpdj1Db250ZW50LVR5cGU+DQo8TUVUQSBjb250ZW50PSJNU0hUTUwgNS4w MC4yNjE0LjM1MDAiIG5hbWU9R0VORVJBVE9SPg0KPFNUWUxFPjwvU1RZTEU+DQo8L0hFQUQ+DQo8 Qk9EWSBiZ0NvbG9yPSNmZmZmZmY+DQo8RElWPjxGT05UIHNpemU9Mj5oaTo8L0ZPTlQ+PC9ESVY+ DQo8RElWPjxGT05UIHNpemU9Mj4mbmJzcDsmbmJzcDsgaSBoYXZlIHNldCB1cCBmaXJld2FsbCBi b3ggdGhhdCBpbnN0YWxsZWQgZnd0azIuMSANCmJldHdlZW4gaW50ZXJuZXQgYW5kIGludHJhbmV0 Lm5vdyBpIHdhbnQgdG8gb2ZmZXIgZnRwIHNlcnZpY2UgZm9yIGludGVybmV0IGluIA0KdGhlIGlu dHJhbmV0IG9yIERNWi4gSSBoYXZlIHRyaWVkIHRvIHVzZSBwbHVnLWd3IHRvIGRvLGJ1dCBJIGZh aWxlZCBiZWFjdXNlIGZ0cCANCnNlcnZpY2UgbmVlZCB0d28gcG9ydHM6MjEgYW5kIDIwIGF0IHRo ZSBzYW1lIHRpbWUud2hhdCBzaG91bGQgaSANCmRvPzwvRk9OVD48L0RJVj48L0JPRFk+PC9IVE1M Pg0K ------=_NextPart_000_0011_01BA998B.4239D460-- From owner-fwtk-users@ex.tis.com Fri Oct 13 08:34 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA20328 Fri, 13 Oct 2000 08:34:36 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA15911; Fri, 13 Oct 2000 05:44:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 04:16:32 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA12308 for fwtk-users-outgoing; Fri, 13 Oct 2000 04:16:11 -0700 (PDT) From: ark@eltex.ru Date: Fri, 13 Oct 2000 15:09:13 +0400 Message-Id: <200010131109.PAA15079@paranoid.alpha.int> In-Reply-To: from ""John Ward" " Organization: "Klingon Imperial Intelligence Service" Subject: Re: Code for firewall "implementation" on an NT OS To: john@ddsecurity.co.za Cc: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1057 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, What is "NT firewall"? Packet filtering engine? Winsock programming? "John Ward" said : > Does anyone have info on where i can get to grips with writing code for an > NT firewall ?? > > Thanks in advance > ________________________________________________ > John Ward > _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBOebtVKH/mIJW9LeBAQG3DgP/RDdcIQuhxB3KykxPhrEQ9wyRVNxPIwQK yiWpsBjoinoWGFO2h8p7Ag/n8rtbfhW6ZOD00d99wXpwvKpEi/WqNc4eVEUN//H/ +i3KWflHO1EfeAsuEsZIu9d9A9HrEJHDRBdOCKlXoRpHxRP9nZA9LmS2o0l6ygo1 9UiJi88ewUU= =Xxip -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Fri Oct 13 09:47 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA20739 Fri, 13 Oct 2000 09:47:50 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA21411; Fri, 13 Oct 2000 06:57:25 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 05:32:59 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA15380 for fwtk-users-outgoing; Fri, 13 Oct 2000 05:32:34 -0700 (PDT) Message-ID: <39E6D285.AC9AC952@tulaprombank.ru> Date: Fri, 13 Oct 2000 13:14:45 +0400 From: Stroganova X-Mailer: Mozilla 4.72 [en] (X11; U; Linux 2.2.14-5.0 i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: smap/smap/qmail Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 311 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have FWTK 2.1, Linux Redhat 6.2 , mail agent -QMAIL I whant to have smap/smapd process the message and then send it to QMail. Can I smap/smapd running as a wrapper for QMAIL? From owner-fwtk-users@ex.tis.com Fri Oct 13 09:47 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA20738 Fri, 13 Oct 2000 09:47:50 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA21401; Fri, 13 Oct 2000 06:57:23 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 05:35:45 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA15548 for fwtk-users-outgoing; Fri, 13 Oct 2000 05:35:34 -0700 (PDT) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <39E6F917.BC49FC3@peaktime.be> Date: Fri, 13 Oct 2000 13:59:19 +0200 From: Michel Bardiaux Organization: Peaktime Belgium S.A. X-Mailer: Mozilla 4.73 [en] (WinNT; I) X-Accept-Language: en,fr MIME-Version: 1.0 To: fwtk-users@tis.com Subject: Re: Code for firewall "implementation" on an NT OS References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1629 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] John Ward wrote: > > Hello, > > Does anyone have info on where i can get to grips with writing code for an > NT firewall ?? > > Thanks in advance > ________________________________________________ > John Ward If you want to make a packet-filtering FW on NT, that's off-topic for this list and better discussed elsewhere. As for a port of FWTK to NT, there are important issues, listed in (IMHO) decreasing severity: (1) Hardening NT. You need a box that is impenetrable unless the proxies are installed. That means disable NT services or make them unaccessible except from the localhost. Plus, you must make packet-forwarding and source-routing impossible. Plus all the hardening tips you can find, including fixing access rights for a great many files in the system folders. Plus, all the service packs and upgrades to fix known exploits. You will need some good books. I've heard it said that securing NT takes *days* even when you know what you're doing. (2) To port the FWTK code, you don't want to use NT threads for multiprocessing, to keep sessions totally independent. So you need fork(), so you need Cygwin. (3) I don't know whether Cygwin contains an inetd for NT, or daemonization calls; then you will have to patch the FWTK sources to make them run as NT services. (4) There are a number of gotchas in Winsock: the need for startup calls, the fact you can not use read() or write() on sockets (only send() and recv()). Cheers (you'll need them :-) -- Michel Bardiaux From owner-fwtk-users@ex.tis.com Fri Oct 13 11:45 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA21208 Fri, 13 Oct 2000 11:45:47 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA05439; Fri, 13 Oct 2000 08:55:08 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 07:24:40 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA24225 for fwtk-users-outgoing; Fri, 13 Oct 2000 07:24:09 -0700 (PDT) Message-ID: <39E71B2A.19D94F2@v-one.com> Date: Fri, 13 Oct 2000 10:24:42 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Joseph S D Yao CC: "Jonathan B. Smith" , fwtk-users@ex.tis.com Subject: Re: http-gw exploit References: <000a01c03438$70950080$9b0a0a0a@cruisenet.net> <20001012181629.H23629@washington.cospo.osis.gov> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1467 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Joseph S D Yao wrote: > > On Thu, Oct 12, 2000 at 10:37:36AM -0000, Jonathan B. Smith wrote > > This is a warning to all of you that are using http-gw packaged with the FWTK firewall. I recently found that a hacker had gotten into my firewall and somehow used the http gateway to access the system. The person(s) then changed the /etc/hosts.allow and /etc/hosts.deny files to allow access to themselves and deny access to all. Please be aware of this. It was a slip on my part to allow everyone access to the gateway. If anyone else has the netperm-table allowing access to all, I strongly suggest that you change it. > > > > As has been said many times, the http-gw is NOT DESIGNED to let people > into your network, and should never be used for that. > > Nevertheless, they could NOT have gotten into your network the way you > describe unless you also have your Web server misconfigured to allow > some sort of Web server exploit, and probably your telnet gateway > configured to allow too easy access as well. Or, just allowed all access through http-gw. Rick has talked about this many times, and this is in fact documented in the FWTK FAQ: http://www.fwtk.org/fwtk/faq/faq.html#2.4.13 Also, have you upgraded your DNS server recently? -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Fri Oct 13 14:46 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA22095 Fri, 13 Oct 2000 14:46:29 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA00412; Fri, 13 Oct 2000 11:55:41 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 09:51:26 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA15451 for fwtk-users-outgoing; Fri, 13 Oct 2000 09:51:04 -0700 (PDT) Date: Fri, 13 Oct 2000 12:50:29 -0400 From: Joseph S D Yao To: John Ward Cc: fwtk-users@tis.com Subject: Re: Code for firewall "implementation" on an NT OS Message-Id: <20001013125029.I29883@washington.cospo.osis.gov> Mail-Followup-To: John Ward , fwtk-users@tis.com References: Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from john@ddsecurity.co.za on Fri, Oct 13, 2000 at 10:38:24AM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 580 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Oct 13, 2000 at 10:38:24AM +0200, John Ward wrote: > Does anyone have info on where i can get to grips with writing code for an > NT firewall ?? How ccan you write a good firewall on an inherently insecure platform? -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Oct 13 15:13 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA22283 Fri, 13 Oct 2000 15:13:52 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA04746; Fri, 13 Oct 2000 12:23:31 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 11:05:17 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA24293 for fwtk-users-outgoing; Fri, 13 Oct 2000 11:05:04 -0700 (PDT) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <39E7427F.3AC49E76@peaktime.be> Date: Fri, 13 Oct 2000 19:12:31 +0200 From: Michel Bardiaux Organization: Peaktime Belgium S.A. X-Mailer: Mozilla 4.73 [en] (WinNT; I) X-Accept-Language: en,fr MIME-Version: 1.0 To: fwtk-users@tis.com Subject: Re: Code for firewall "implementation" on an NT OS References: <20001013125029.I29883@washington.cospo.osis.gov> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1186 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Joseph S D Yao wrote: > > On Fri, Oct 13, 2000 at 10:38:24AM +0200, John Ward wrote: > > Does anyone have info on where i can get to grips with writing code for an > > NT firewall ?? > > How ccan you write a good firewall on an inherently insecure platform? > > -- > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao > COSPO/OSIS Computer Support EMT-B > ----------------------------------------------------------------------- > This message is not an official statement of COSPO policies. What do you mean by *inherently*? I would say NT is about as stable and secure as UNIX was 15 years ago (I was sysadmin for a bunch of SUN 3 and 4 and SGIs and Convexen by then - so I'm not just guessing). Do you mean that (a lot of bugs, holes and exploits) or is there a basic design characteristic of NT that makes it insecure (apart, of course, from the bloat!) -- Michel Bardiaux Peaktime Belgium S.A. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 From owner-fwtk-users@ex.tis.com Fri Oct 13 16:58 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA22645 Fri, 13 Oct 2000 16:58:54 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA19850; Fri, 13 Oct 2000 14:08:16 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 12:42:34 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA07427 for fwtk-users-outgoing; Fri, 13 Oct 2000 12:42:11 -0700 (PDT) Message-ID: <20001013194105.23435.qmail@web1806.mail.yahoo.com> Date: Fri, 13 Oct 2000 12:41:05 -0700 (PDT) From: Naresh Narang Subject: Re: smap/smap/qmail To: Stroganova , fwtk-users@lists.nai.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 845 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Yes. But I could not get any mailertable type of functionality with qmail or may be I did not research enaugh. Of course it is not necessary to use mailertable. NKN --- Stroganova wrote: > [To be removed from this list send the message > "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I have FWTK 2.1, Linux Redhat 6.2 , mail agent > -QMAIL > I whant to have smap/smapd process the message and > then send it to > QMail. > Can I smap/smapd running as a wrapper for QMAIL? > > ===== -- Naresh __________________________________________________ Do You Yahoo!? Get Yahoo! Mail - Free email you can access from anywhere! http://mail.yahoo.com/ From owner-fwtk-users@ex.tis.com Fri Oct 13 17:34 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA22741 Fri, 13 Oct 2000 17:34:36 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA25370; Fri, 13 Oct 2000 14:43:57 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 13:24:44 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA13221 for fwtk-users-outgoing; Fri, 13 Oct 2000 13:24:13 -0700 (PDT) Message-ID: <20001013194456.24856.qmail@web1802.mail.yahoo.com> Date: Fri, 13 Oct 2000 12:44:56 -0700 (PDT) From: Naresh Narang Subject: RE: mail not delivered once upgraded to RedHat 7.0 To: Fred LB , "'Mike Kercher'" Cc: fwtk-users@tis.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 3437 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Copy your mailertable files also. Make sure your DNS is working. NKN --- Fred LB wrote: > [To be removed from this list send the message > "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, and thank you for you answer. > > As i explained, i just moved my working config files > from a working RH 6.2 > box to a new RH 7.0 box. > > My mailhub is declared in the sendmail.cw file, but > not in the sendmail.cf. > (but this works on my actual box !) > > Thanks for your help :) > > Frédéric Le Bastard > Administrateur système - développement web > Tél : 02 40 35 32 32 > Fax : 02 40 12 18 74 > frederic.lebastard@strathom.com > Découvrez notre site web : http://www.strathom.com > > > > > -----Message d'origine----- > > De : Mike Kercher [mailto:mike@CamaroSS.net] > > Envoyé : jeudi 12 octobre 2000 19:59 > > À : Frederic Le Bastard > > Objet : RE: mail not delivered once upgraded to > RedHat 7.0 > > > > > > Did you specify your mailhub in /etc/sendmail.cf? > > > > -----Original Message----- > > From: owner-fwtk-users@ex.tis.com > > [mailto:owner-fwtk-users@ex.tis.com]On > > Behalf Of Fred LB > > Sent: Thursday, October 12, 2000 10:45 AM > > To: fwtk-users@tis.com > > Subject: mail not delivered once upgraded to > RedHat 7.0 > > > > > > [To be removed from this list send the message > "unsubscribe > > fwtk-users" in > > the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > Hi all, > > > > We recentely decide to move our strategic gateway > (old > > Pentium 75) to a > > brand new Compaq server. > > I installed the new compaq with a redhat 7.0 (was > redhat 6.2 > > on the old > > P75). > > I moved all the stuff (FWTK binaires, config files > ...) from > > the old serv to > > the new one. > > > > Everything seems to work fine, except sendmail : > when i get > > an inbound mail, > > smap handles it correctly, but it looks like > sendmail doesn't want to > > deliver it to my exchange server (my mailhub), but > tries to deliver it > > locally, which of course doesn't work. > > > > What did i forget ? I strongly suspect a sendmail > > misconfiguration, but i > > haven't got a serious clue ! > > > > My maillog follows : > > Oct 12 16:44:14 firewall sendmail[1503]: > e9CEOnI01503: > > from=flb@nowhere.com, > > size=167, class=0, nrcpts=0, > > > msgid=<200010121424.e9CEOnI01503@firewall.strathom.com>, > > relay=nobody@localhost > > Oct 12 16:44:14 firewall sendmail[1503]: > e9CEOnI01503: > > to=flb@strathom.com, > > delay=00:02:25, mailer=local, pri=167, dsn=4.4.3, > stat=queued > > Oct 12 16:45:26 firewall sendmail[812]: > e9CEOnI01503: > > e9CEi7700812: DSN: > > User unknown > > > > > > If anyone has an idea ... i'd be graceful :-) > > > > Thanks in advance > > > > Fred > > > > > > Frédéric Le Bastard > > Administrateur système - développement web > > Tél : 02 40 35 32 32 > > Fax : 02 40 12 18 74 > > frederic.lebastard@strathom.com > > Découvrez notre site web : http://www.strathom.com > > > > > ===== -- Naresh __________________________________________________ Do You Yahoo!? Get Yahoo! Mail - Free email you can access from anywhere! http://mail.yahoo.com/ From owner-fwtk-users@ex.tis.com Fri Oct 13 18:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA22865 Fri, 13 Oct 2000 18:38:18 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA03864; Fri, 13 Oct 2000 15:47:40 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Oct 2000 14:19:34 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA21338 for fwtk-users-outgoing; Fri, 13 Oct 2000 14:19:13 -0700 (PDT) Date: Fri, 13 Oct 2000 17:18:18 -0400 From: Joseph S D Yao To: Michel Bardiaux Cc: fwtk-users@tis.com Subject: Re: Code for firewall "implementation" on an NT OS Message-Id: <20001013171818.W29883@washington.cospo.osis.gov> Mail-Followup-To: Michel Bardiaux , fwtk-users@tis.com References: <20001013125029.I29883@washington.cospo.osis.gov> <39E7427F.3AC49E76@peaktime.be> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <39E7427F.3AC49E76@peaktime.be>; from mbardiaux@peaktime.be on Fri, Oct 13, 2000 at 07:12:31PM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1546 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Oct 13, 2000 at 07:12:31PM +0200, Michel Bardiaux wrote: > What do you mean by *inherently*? I would say NT is about as stable and > secure as UNIX was 15 years ago (I was sysadmin for a bunch of SUN 3 and > 4 and SGIs and Convexen by then - so I'm not just guessing). Do you mean > that (a lot of bugs, holes and exploits) or is there a basic design > characteristic of NT that makes it insecure (apart, of course, from the > bloat!) I probably should have said empirically. I don't share your optimism about NT, even relative to Unix of 25 years ago. I do mean both bugs, holes, exploits, and [but this is my bias] the fact that it is grown from a system whose internal "structure" [chaos] I have seen, and been repulsed by. The code grows 30% or so each release, and it seems that nothing is taken out. There is nobody in the world who knows exactly what goes on in MSW-NT, and I suspect that has been true for every version of MSW-NT since the beginning. [At least I was able to read all of 6th Edition Unix's source code and understand it pretty well.] OK, so I sound biased. But most computer security people will tell you that "hardened MSW-NT" is almost an oxymoron. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Mon Oct 16 17:00 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA07195 Mon, 16 Oct 2000 17:00:31 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA04027; Mon, 16 Oct 2000 14:08:35 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 16 Oct 2000 11:50:04 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA13997 for fwtk-users-outgoing; Mon, 16 Oct 2000 11:49:54 -0700 (PDT) Message-ID: <39EB4D66.D01647A2@algroup.co.uk> Date: Mon, 16 Oct 2000 19:48:07 +0100 From: Adam Laurie Organization: A.L. Group plc X-Mailer: Mozilla 4.72 [en] (Win95; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: code redistribution Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1047 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi, this probably gets asked from time to time, but i couldn't find anything in the archives, so i'll ask again... what is the status of the licence and redistributing the modified source instead of patches? the reason i ask is because we've recently fixed a small bug (-daemon won't bind to an ip address on certain platforms). the way we work internally is to use cvs, so we've put fwtk into a cvs repository. i would like to make it available to the general public (and will add all the other patches as well if that's useful), but only if the licence/owner permits. cheers, Adam -- Adam Laurie Tel: +44 (20) 8742 0755 A.L. Digital Ltd. Fax: +44 (20) 8742 5995 Voysey House http://www.thebunker.net Barley Mow Passage http://www.aldigital.co.uk London W4 4GB mailto:adam@algroup.co.uk UNITED KINGDOM PGP key on keyservers From owner-fwtk-users@ex.tis.com Mon Oct 16 18:55 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA07533 Mon, 16 Oct 2000 18:55:52 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA18627; Mon, 16 Oct 2000 16:05:16 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 16 Oct 2000 14:40:03 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA08263 for fwtk-users-outgoing; Mon, 16 Oct 2000 14:39:42 -0700 (PDT) Message-ID: <39EB75C7.6310BF56@v-one.com> Date: Mon, 16 Oct 2000 17:40:23 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Adam Laurie CC: fwtk-users@lists.nai.com Subject: Re: code redistribution References: <39EB4D66.D01647A2@algroup.co.uk> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1256 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Adam Laurie wrote: > > this probably gets asked from time to time, but i couldn't find anything > in the archives, so i'll ask again... > > what is the status of the licence and redistributing the modified source > instead of patches? > > the reason i ask is because we've recently fixed a small bug (-daemon > won't bind to an ip address on certain platforms). the way we work > internally is to use cvs, so we've put fwtk into a cvs repository. i > would like to make it available to the general public (and will add all > the other patches as well if that's useful), but only if the > licence/owner permits. Adam, Unfortunately, the license still hasn't changed; you still cannot redistribute the source in any form. If you have a patch (or an updated version to one of the patches on fwtk.org) send it to me and I'll upload it on my next update. Its too bad that NAI doesn't at least allow us to update it (even if it isn't completely open source). Hmm, Rick do you still have contacts that would allow you to build a FWTK v2.2? -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Mon Oct 16 22:07 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA08067 Mon, 16 Oct 2000 22:07:33 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA00707; Mon, 16 Oct 2000 19:16:40 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 16 Oct 2000 17:49:51 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA25826 for fwtk-users-outgoing; Mon, 16 Oct 2000 17:49:21 -0700 (PDT) Message-Id: <4.3.2.7.2.20001016203908.00bc72c0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Mon, 16 Oct 2000 20:40:28 -0400 To: Keith Young , Adam Laurie From: Rick Murphy Subject: Re: code redistribution Cc: fwtk-users@lists.nai.com In-Reply-To: <39EB75C7.6310BF56@v-one.com> References: <39EB4D66.D01647A2@algroup.co.uk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 660 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 05:40 PM 10/16/00 -0400, Keith Young wrote: >Unfortunately, the license still hasn't changed; you still cannot >redistribute the source in any form. Keith is right. Having multiple distribution points permits people to get copies of the FWTK without having to agree to the license terms first. >Hmm, Rick do you still have contacts that would allow you to build a >FWTK v2.2? Probably. If we were to put something together, I'm sure the NAI folks (TIS labs, probably) would be willing to put it up for FTP. -Rick From owner-fwtk-users@ex.tis.com Tue Oct 17 06:27 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA09417 Tue, 17 Oct 2000 06:27:05 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA03649; Tue, 17 Oct 2000 03:36:53 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Oct 2000 02:03:16 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA27206 for fwtk-users-outgoing; Tue, 17 Oct 2000 02:03:05 -0700 (PDT) Message-ID: <20001017090210.98576.qmail@web10101.mail.yahoo.com> Date: Tue, 17 Oct 2000 02:02:10 -0700 (PDT) From: Yohanes Rahmad Subject: connecting squid To: fwtk-users@tis.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 858 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] My firewall box (using fwtk 2.1 and run on freebsd) connect to squid proxy server use squid-gw patch which available on www.fwtk.org. int -> firewall(fwtk) -> squid -> internet(http access) When the internal hosts want to connect to web based email (login process), there a error message "Done, but with errors on page" always seen on the browser. And the worse is I cann't pass login page on hotmail.com. This is not happen when internal hosts directly connect the internet via squid server. Anyone have the same experince with this ? Every comment and help will be appreciate. Yohanes __________________________________________________ Do You Yahoo!? Yahoo! Messenger - Talk while you surf! It's FREE. http://im.yahoo.com/ From owner-fwtk-users@ex.tis.com Tue Oct 17 06:35 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA09466 Tue, 17 Oct 2000 06:35:47 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA04178; Tue, 17 Oct 2000 03:45:56 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Oct 2000 02:33:21 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA29435 for fwtk-users-outgoing; Tue, 17 Oct 2000 02:33:10 -0700 (PDT) Date: Tue, 17 Oct 2000 10:17:10 +0100 (BST) From: "Neil A. Hillard" To: fwtk-users@lists.nai.com Subject: Unknown problem causing machine to hang... Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1802 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi folks, sorry to bother everyone, but I'm currently having problems with our web cache which has been working for the past 6 months and now decides to turn up it's toes whenever it feels like it. Our current set up is: RedHat Linux 6.2 Squid 2.3.STABLE4 http-gw from FWTK 2.1 Netscape Directory Server 4.11 The way things work: Squid runs on port 3128, users have their browsers configured to use this as their proxy. Squid hands off authentication to the Netscape Directory Server using the LDAP authenticator. Squid is set up with the http-gw (running on port 8080) as it's parent. All http-gw requests are handed off to the http-gw which is set up to remove Java and Active-X. Symptoms: Every now and again, doesn't appear to be load related as it's happened early in the morning and late at night as well as during the day, the server totally hangs. Nothing is logged to the syslog, I've enabled kernel messages on the console and disabled screen blanking but still nothing. APM is disabled. It's not a hardware problem (as first suspected) as I've rebuilt the machine on completely different hardware, not utilising any of the old hardware and I'm still at a complete loss for ideas. I was just wondering whether any of you guys had seen anything similar or whether you've got any suggestions. Any comments welcome, as I'm getting hassle, and I just haven't got the foggiest. Many thanks in advance, Neil. -- Neil Hillard hillardn@gkn-whl.co.uk GKN Westland Helicopters Ltd. http://www.gkn-whl.co.uk/ Disclaimer: This message does not necessarily reflect the views of GKN Westland Helicopters Ltd. From owner-fwtk-users@ex.tis.com Tue Oct 17 07:19 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA09641 Tue, 17 Oct 2000 07:19:12 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA07735; Tue, 17 Oct 2000 04:29:19 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Oct 2000 03:11:28 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA01810 for fwtk-users-outgoing; Tue, 17 Oct 2000 03:11:17 -0700 (PDT) Date: Tue, 17 Oct 2000 10:55:47 +0100 (BST) From: "Neil A. Hillard" To: fwtk-users@tis.com Subject: Unknown problem causing machine to hang... Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1803 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi folks, sorry to bother everyone, but I'm currently having problems with our web cache which has been working for the past 6 months and now decides to turn up it's toes whenever it feels like it. Our current set up is: RedHat Linux 6.2 Squid 2.3.STABLE4 http-gw from FWTK 2.1 Netscape Directory Server 4.11 The way things work: Squid runs on port 3128, users have their browsers configured to use this as their proxy. Squid hands off authentication to the Netscape Directory Server using the LDAP authenticator. Squid is set up with the http-gw (running on port 8080) as it's parent. All http-gw requests are handed off to the http-gw which is set up to remove Java and Active-X. Symptoms: Every now and again, doesn't appear to be load related as it's happened early in the morning and late at night as well as during the day, the server totally hangs. Nothing is logged to the syslog, I've enabled kernel messages on the console and disabled screen blanking but still nothing. APM is disabled. It's not a hardware problem (as first suspected) as I've rebuilt the machine on completely different hardware, not utilising any of the old hardware and I'm still at a complete loss for ideas. I was just wondering whether any of you guys had seen anything similar or whether you've got any suggestions. Any comments welcome, as I'm getting hassle, and I just haven't got the foggiest. Many thanks in advance, Neil. -- Neil Hillard hillardn@gkn-whl.co.uk GKN Westland Helicopters Ltd. http://www.gkn-whl.co.uk/ Disclaimer: This message does not necessarily reflect the views of GKN Westland Helicopters Ltd. From owner-fwtk-users@ex.tis.com Tue Oct 17 08:12 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA09798 Tue, 17 Oct 2000 08:12:05 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA12354; Tue, 17 Oct 2000 05:21:50 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Oct 2000 04:04:03 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA05427 for fwtk-users-outgoing; Tue, 17 Oct 2000 04:03:43 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: Date: Tue, 17 Oct 2000 12:02:53 +0100 (BST) From: Tony Gale To: "Neil A. Hillard" Subject: RE: Unknown problem causing machine to hang... Cc: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 1039 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] What kernel are you running, and on what hardware? -tony On 17-Oct-2000 Neil A. Hillard wrote: > Symptoms: > > Every now and again, doesn't appear to be load related as it's > happened early in the morning and late at night as well as during > the day, > the server totally hangs. Nothing is logged to the syslog, I've > enabled > kernel messages on the console and disabled screen blanking but > still > nothing. APM is disabled. It's not a hardware problem (as first > suspected) as I've rebuilt the machine on completely different > hardware, > not utilising any of the old hardware and I'm still at a complete > loss for > ideas. > --- E-Mail: Tony Gale People are always available for work in the past tense. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Tue Oct 17 08:31 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA09856 Tue, 17 Oct 2000 08:31:10 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA13883; Tue, 17 Oct 2000 05:41:19 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Oct 2000 04:22:25 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA07093 for fwtk-users-outgoing; Tue, 17 Oct 2000 04:21:44 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <4.3.2.7.2.20001016203908.00bc72c0@mail.itm-inst.com> Date: Tue, 17 Oct 2000 12:20:02 +0100 (BST) From: Tony Gale To: Rick Murphy Subject: Re: code redistribution Cc: fwtk-users@lists.nai.com, Adam Laurie , Keith Young Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 719 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 17-Oct-2000 Rick Murphy wrote: > > Probably. If we were to put something together, I'm sure the NAI > folks (TIS > labs, probably) would be willing to put it up for FTP. > -Rick Sounds like a good idea. I'm willing to put my patch kit forward as a possible staring point. Doesn't cover smap as I don't use it, but that is covered elsewhere. -tony --- E-Mail: Tony Gale Are we on STRIKE yet? The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Tue Oct 17 09:13 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA10070 Tue, 17 Oct 2000 09:13:13 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA17712; Tue, 17 Oct 2000 06:22:58 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Oct 2000 05:04:51 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA10579 for fwtk-users-outgoing; Tue, 17 Oct 2000 05:04:30 -0700 (PDT) Message-ID: <39EC3FED.16EBE9FF@algroup.co.uk> Date: Tue, 17 Oct 2000 13:02:53 +0100 From: Adam Laurie Organization: A.L. Group plc X-Mailer: Mozilla 4.72 [en] (Win95; U) X-Accept-Language: en MIME-Version: 1.0 To: Keith Young CC: fwtk-users@lists.nai.com Subject: Re: code redistribution References: <39EB4D66.D01647A2@algroup.co.uk> <39EB75C7.6310BF56@v-one.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2030 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Keith Young wrote: > > Adam Laurie wrote: > > > > this probably gets asked from time to time, but i couldn't find anything > > in the archives, so i'll ask again... > > > > what is the status of the licence and redistributing the modified source > > instead of patches? > > > > the reason i ask is because we've recently fixed a small bug (-daemon > > won't bind to an ip address on certain platforms). the way we work > > internally is to use cvs, so we've put fwtk into a cvs repository. i > > would like to make it available to the general public (and will add all > > the other patches as well if that's useful), but only if the > > licence/owner permits. > > Adam, > > Unfortunately, the license still hasn't changed; you still cannot > redistribute the source in any form. > > If you have a patch (or an updated version to one of the patches on > fwtk.org) send it to me and I'll upload it on my next update. this is a patch that needs to be applied AFTER ipbind-1.2.patch: ---- start patch ----- --- lib/daemon.c.orig Tue Oct 17 12:55:37 2000 +++ lib/daemon.c Sun Oct 15 16:12:18 2000 @@ -160,7 +160,8 @@ exit(0); /* parent exits */ - bzero( (char *)&sa.sin_addr, sizeof(sa.sin_addr)); + bzero( (char *)&sa, sizeof(sa)); + sa.sin_family = AF_INET; sa.sin_port = htons(port); ---- end patch ----- we suspect the problem is caused by random ipv6 stuff being left in the uninitialised structure overriding the intended ipv4 stuff. this fix is by Ben Laurie , btw. cheers, Adam -- Adam Laurie Tel: +44 (20) 8742 0755 A.L. Digital Ltd. Fax: +44 (20) 8742 5995 Voysey House http://www.thebunker.net Barley Mow Passage http://www.aldigital.co.uk London W4 4GB mailto:adam@algroup.co.uk UNITED KINGDOM PGP key on keyservers From owner-fwtk-users@ex.tis.com Tue Oct 17 10:20 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA10660 Tue, 17 Oct 2000 10:20:21 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA26857; Tue, 17 Oct 2000 07:29:58 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Oct 2000 06:04:48 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA15723 for fwtk-users-outgoing; Tue, 17 Oct 2000 06:04:28 -0700 (PDT) Date: Tue, 17 Oct 2000 12:46:44 +0100 (BST) From: "Neil A. Hillard" To: Tony Gale cc: fwtk-users@tis.com Subject: RE: Unknown problem causing machine to hang... In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2250 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Tony, > What kernel are you running, and on what hardware? Right, sorry for leaving that out, here goes: first of all it was working on a Compaq Proliant 5000 (Pentium Pro 200), 128Mb RAM, running RedHat Linux 6.1 (2.2.12), this was working flawlessly since 31-March-2000 until about a month ago. Now it's running on a HP NetServer (Pentium II 266), 128Mb RAM, 3 x 4Gb disks, with software raid 0 running across two of them, with /usr/local/squid/cache mounted on it. Running RedHat 6.2 (2.2.14). I've now built the Proliant 5000 up with RedHat 7.0 (2.2.16) as a test box. It hasn't exhibited the problem yet, but it's not under half as much load as the live box. I've just pulled down 2.2.17 and it's compiling as I type. The weird thing about it all is it was working perfectly for 6 months and then suddenly went, and we hadn't even changed anything on the box at all. Anyway, hope you can understand this and hopefully it's of some use. Many thanks in advance, Neil. > On 17-Oct-2000 Neil A. Hillard wrote: > > Symptoms: > > > > Every now and again, doesn't appear to be load related as it's > > happened early in the morning and late at night as well as during > > the day, > > the server totally hangs. Nothing is logged to the syslog, I've > > enabled > > kernel messages on the console and disabled screen blanking but > > still > > nothing. APM is disabled. It's not a hardware problem (as first > > suspected) as I've rebuilt the machine on completely different > > hardware, > > not utilising any of the old hardware and I'm still at a complete > > loss for > > ideas. > > > > --- > E-Mail: Tony Gale > People are always available for work in the past tense. > > The views expressed above are entirely those of the writer > and do not represent the views, policy or understanding of > any other person or official body. > -- Neil Hillard hillardn@gkn-whl.co.uk GKN Westland Helicopters Ltd. http://www.gkn-whl.co.uk/ Disclaimer: This message does not necessarily reflect the views of GKN Westland Helicopters Ltd. From owner-fwtk-users@ex.tis.com Tue Oct 17 11:06 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA10908 Tue, 17 Oct 2000 11:06:17 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA03332; Tue, 17 Oct 2000 08:15:21 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Oct 2000 06:57:29 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA22318 for fwtk-users-outgoing; Tue, 17 Oct 2000 06:56:57 -0700 (PDT) Date: Mon, 16 Oct 2000 20:02:54 -0400 (EDT) From: Ted Keller To: Keith Young cc: Adam Laurie , fwtk-users@lists.nai.com Subject: Re: code redistribution In-Reply-To: <39EB75C7.6310BF56@v-one.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1624 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Sure would like to contribute my smap process for consideration for a next release. Any news would be good. ted keller On Mon, 16 Oct 2000, Keith Young wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Adam Laurie wrote: > > > > this probably gets asked from time to time, but i couldn't find anything > > in the archives, so i'll ask again... > > > > what is the status of the licence and redistributing the modified source > > instead of patches? > > > > the reason i ask is because we've recently fixed a small bug (-daemon > > won't bind to an ip address on certain platforms). the way we work > > internally is to use cvs, so we've put fwtk into a cvs repository. i > > would like to make it available to the general public (and will add all > > the other patches as well if that's useful), but only if the > > licence/owner permits. > > Adam, > > Unfortunately, the license still hasn't changed; you still cannot > redistribute the source in any form. > > If you have a patch (or an updated version to one of the patches on > fwtk.org) send it to me and I'll upload it on my next update. > > Its too bad that NAI doesn't at least allow us to update it (even if it > isn't completely open source). > > Hmm, Rick do you still have contacts that would allow you to build a > FWTK v2.2? > > -- > --Keith Young > -Director of Customer Care/Support, V-ONE Corp. > -kyoung@v-one.com > From owner-fwtk-users@ex.tis.com Tue Oct 17 11:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA11040 Tue, 17 Oct 2000 11:38:16 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA08175; Tue, 17 Oct 2000 08:47:59 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Oct 2000 07:26:27 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA26291 for fwtk-users-outgoing; Tue, 17 Oct 2000 07:26:16 -0700 (PDT) From: "Fred LB" To: Subject: [solved] mail not delivered once upgraded to RedHat 7.0 Date: Tue, 17 Oct 2000 16:24:27 +0200 Message-ID: <6305E79D086AD4119FE700508B9A16DF019565@WALLIS> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Importance: Normal In-Reply-To: <6305E79D086AD4119FE700508B9A16DF017852@WALLIS> Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 4762 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, and thanks for your help. The problem i had was, as suspected, a sendmail misconfiguration : in RH 7.0, the /etc/sendmail.cw file is not used, and replaced by /etc/mail/local-host-names, which I misconfigured ! This file is supposed to handle the aliases of your box, and i added all the domains I recieve mail for ! So that sendmail tried to deliver mail locally, instead of using mailertable ! Now it works, i'm glad :-) Fred Frederic Le Bastard Administrateur systeme - developpement web Tel : 02 40 35 32 32 Fax : 02 40 12 18 74 frederic.lebastard@strathom.com Decouvrez notre site web : http://www.strathom.com > -----Message d'origine----- > De : owner-fwtk-users@ex.tis.com > [mailto:owner-fwtk-users@ex.tis.com]De > la part de Naresh Narang > Envoye : vendredi 13 octobre 2000 21:45 > A : Frederic Le Bastard; 'Mike Kercher' > Cc : fwtk-users@tis.com > Objet : RE: mail not delivered once upgraded to RedHat 7.0 > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Copy your mailertable files also. Make sure your DNS > is working. > > NKN > > --- Fred LB wrote: > > [To be removed from this list send the message > > "unsubscribe fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > Hi, and thank you for you answer. > > > > As i explained, i just moved my working config files > > from a working RH 6.2 > > box to a new RH 7.0 box. > > > > My mailhub is declared in the sendmail.cw file, but > > not in the sendmail.cf. > > (but this works on my actual box !) > > > > Thanks for your help :) > > > > Fridiric Le Bastard > > Administrateur systhme - diveloppement web > > Til : 02 40 35 32 32 > > Fax : 02 40 12 18 74 > > frederic.lebastard@strathom.com > > Dicouvrez notre site web : http://www.strathom.com > > > > > > > > > -----Message d'origine----- > > > De : Mike Kercher [mailto:mike@CamaroSS.net] > > > Envoyi : jeudi 12 octobre 2000 19:59 > > > @ : Frederic Le Bastard > > > Objet : RE: mail not delivered once upgraded to > > RedHat 7.0 > > > > > > > > > Did you specify your mailhub in /etc/sendmail.cf? > > > > > > -----Original Message----- > > > From: owner-fwtk-users@ex.tis.com > > > [mailto:owner-fwtk-users@ex.tis.com]On > > > Behalf Of Fred LB > > > Sent: Thursday, October 12, 2000 10:45 AM > > > To: fwtk-users@tis.com > > > Subject: mail not delivered once upgraded to > > RedHat 7.0 > > > > > > > > > [To be removed from this list send the message > > "unsubscribe > > > fwtk-users" in > > > the > > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > Hi all, > > > > > > We recentely decide to move our strategic gateway > > (old > > > Pentium 75) to a > > > brand new Compaq server. > > > I installed the new compaq with a redhat 7.0 (was > > redhat 6.2 > > > on the old > > > P75). > > > I moved all the stuff (FWTK binaires, config files > > ...) from > > > the old serv to > > > the new one. > > > > > > Everything seems to work fine, except sendmail : > > when i get > > > an inbound mail, > > > smap handles it correctly, but it looks like > > sendmail doesn't want to > > > deliver it to my exchange server (my mailhub), but > > tries to deliver it > > > locally, which of course doesn't work. > > > > > > What did i forget ? I strongly suspect a sendmail > > > misconfiguration, but i > > > haven't got a serious clue ! > > > > > > My maillog follows : > > > Oct 12 16:44:14 firewall sendmail[1503]: > > e9CEOnI01503: > > > from=flb@nowhere.com, > > > size=167, class=0, nrcpts=0, > > > > > > msgid=<200010121424.e9CEOnI01503@firewall.strathom.com>, > > > relay=nobody@localhost > > > Oct 12 16:44:14 firewall sendmail[1503]: > > e9CEOnI01503: > > > to=flb@strathom.com, > > > delay=00:02:25, mailer=local, pri=167, dsn=4.4.3, > > stat=queued > > > Oct 12 16:45:26 firewall sendmail[812]: > > e9CEOnI01503: > > > e9CEi7700812: DSN: > > > User unknown > > > > > > > > > If anyone has an idea ... i'd be graceful :-) > > > > > > Thanks in advance > > > > > > Fred > > > > > > > > > Fridiric Le Bastard > > > Administrateur systhme - diveloppement web > > > Til : 02 40 35 32 32 > > > Fax : 02 40 12 18 74 > > > frederic.lebastard@strathom.com > > > Dicouvrez notre site web : http://www.strathom.com > > > > > > > > > > > ===== > -- Naresh > > __________________________________________________ > Do You Yahoo!? > Get Yahoo! Mail - Free email you can access from anywhere! > http://mail.yahoo.com/ > From owner-fwtk-users@ex.tis.com Wed Oct 18 02:42 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA13747 Wed, 18 Oct 2000 02:42:12 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id XAA27999; Tue, 17 Oct 2000 23:48:00 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Oct 2000 21:23:32 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA20064 for fwtk-users-outgoing; Tue, 17 Oct 2000 21:23:21 -0700 (PDT) Message-ID: <39ED257E.7D1FF35@digmanolson.com> Date: Tue, 17 Oct 2000 21:22:22 -0700 From: "Keith V. Olson" X-Mailer: Mozilla 4.7 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@tis.com Subject: http-gw slow with IE but not NS Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="------------2D6D0039F235077A4A91FFAB" Content-Length: 10438 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. --------------2D6D0039F235077A4A91FFAB Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hello, I just recently installed fwtk on a Redhat Linux 6.1 486 with 16M memory. I having problems with http-gw being very slow in general, but extremely slow to non-functioning when I use IE as the browser. From the same machine when I use NS it's slower than going directly to the web server, but still reasonable. The http-gw lines from my netperm-table: http-gw: userid root http-gw: timeout 3600 http-gw: default-httpd 192.168.1.5 http-gw: hosts * -log { read write ftp } http-gw: deny-hosts unknown The http line from /etc/inetd.conf: http stream tcp nowait root /usr/local/etc/http-gw http-gw The firewall is 192.168.1.1, the intranet DNS and webserver are on 192.168.1.5 and the computer I'm browsing from is 192.168.1.4. The DNS is correctly setup in the /etc/resolv.conf on the firewall and nslookup is ok. Attached is the lines for the IE download of a webpage. It takes bout 5 seconds directly to the webserver or 15 seconds in NS. IN IE it takes about 3 minutes and still some of the graphics don't download. Keith -- ///\\ (O O) +--------oOO--(_)-------------+ | Keith V. Olson | | keithvolson@digmanolson.com | | http://www.digmanolson.com/ | +------------------oOO--------+ Portland |__|__| <*> Oregon || || MTFBWY ooO Ooo --------------2D6D0039F235077A4A91FFAB Content-Type: text/plain; charset=us-ascii; name="snipit" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="snipit" Oct 17 21:11:49 irvington http-gw[12881]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:11:49 irvington http-gw[12881]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/frames.html Oct 17 21:11:50 irvington http-gw[12882]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:11:50 irvington http-gw[12882]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/homepage.html Oct 17 21:12:06 irvington http-gw[12881]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:12:06 irvington http-gw[12883]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:12:06 irvington http-gw[12883]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/toc.html Oct 17 21:12:07 irvington http-gw[12882]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:12:07 irvington http-gw[12884]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:12:07 irvington http-gw[12884]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/crinklep.jpg Oct 17 21:12:23 irvington http-gw[12883]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:12:23 irvington http-gw[12885]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:12:23 irvington http-gw[12885]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/xmasdog.jpg Oct 17 21:12:24 irvington http-gw[12884]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:12:24 irvington http-gw[12886]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:12:24 irvington http-gw[12886]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/wedding.gif Oct 17 21:12:40 irvington http-gw[12885]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:12:40 irvington http-gw[12887]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:12:40 irvington http-gw[12887]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/globeani.gif Oct 17 21:12:41 irvington http-gw[12886]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:12:41 irvington http-gw[12888]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:12:41 irvington http-gw[12888]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/leftbtns.gif Oct 17 21:12:57 irvington http-gw[12887]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:12:57 irvington http-gw[12889]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:12:57 irvington http-gw[12889]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/home.gif Oct 17 21:12:58 irvington http-gw[12888]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:12:58 irvington http-gw[12890]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:12:58 irvington http-gw[12890]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/newspapr.gif Oct 17 21:13:14 irvington http-gw[12889]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:13:14 irvington http-gw[12893]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:13:14 irvington http-gw[12893]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/pennote.gif Oct 17 21:13:15 irvington http-gw[12890]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:13:15 irvington http-gw[12894]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:13:15 irvington http-gw[12894]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/hacker.gif Oct 17 21:13:31 irvington http-gw[12893]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:13:31 irvington http-gw[12895]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:13:31 irvington http-gw[12895]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/emailk.gif Oct 17 21:13:32 irvington http-gw[12894]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:13:32 irvington http-gw[12896]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:13:32 irvington http-gw[12896]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/snow2.gif Oct 17 21:13:48 irvington http-gw[12895]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:13:48 irvington http-gw[12897]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:13:48 irvington http-gw[12897]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/star.gif Oct 17 21:13:49 irvington http-gw[12896]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:13:49 irvington http-gw[12898]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:13:49 irvington http-gw[12898]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/rnew.gif Oct 17 21:14:05 irvington http-gw[12897]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:14:05 irvington http-gw[12900]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:14:05 irvington http-gw[12900]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/updated.gif Oct 17 21:14:06 irvington http-gw[12898]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:14:06 irvington http-gw[12901]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:14:06 irvington http-gw[12901]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/emailc.gif Oct 17 21:14:22 irvington http-gw[12900]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:14:22 irvington http-gw[12903]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:14:22 irvington http-gw[12903]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/docs.gif Oct 17 21:14:23 irvington http-gw[12901]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:14:23 irvington http-gw[12904]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:14:23 irvington http-gw[12904]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/mail1.gif Oct 17 21:14:39 irvington http-gw[12903]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:14:39 irvington http-gw[12905]: permit host=beaumont.digmanolson.com/192.168.1.4 use of gateway (V2.1) Oct 17 21:14:39 irvington http-gw[12905]: log host=beaumont.digmanolson.com/192.168.1.4 protocol=HTTP cmd=get dest=192.168.1.5 path=/homepage/www.gif Oct 17 21:14:40 irvington http-gw[12904]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 Oct 17 21:14:56 irvington http-gw[12905]: exit host=beaumont.digmanolson.com/192.168.1.4 cmds=1 in=0 out=0 user=unauth duration=17 --------------2D6D0039F235077A4A91FFAB-- From owner-fwtk-users@ex.tis.com Wed Oct 18 07:32 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA14797 Wed, 18 Oct 2000 07:32:39 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA06375; Wed, 18 Oct 2000 04:42:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Oct 2000 03:11:52 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA03516 for fwtk-users-outgoing; Wed, 18 Oct 2000 03:11:31 -0700 (PDT) Message-Id: <4.3.2.7.2.20001018060658.00b75100@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Wed, 18 Oct 2000 06:09:27 -0400 To: "Keith V. Olson" , fwtk-users@tis.com From: Rick Murphy Subject: Re: http-gw slow with IE but not NS In-Reply-To: <39ED257E.7D1FF35@digmanolson.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 753 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 09:22 PM 10/17/00 -0700, Keith V. Olson wrote: >I just recently installed fwtk on a Redhat Linux 6.1 486 >with 16M memory. I having problems with http-gw being >very slow in general, but extremely slow to non-functioning >when I use IE as the browser. From the same machine when >I use NS it's slower than going directly to the web server, >but still reasonable. Disable HTTP/1.1 in IE and try again. (That's on the Tools/Internet Options page, Advanced Tab, HTTP 1.1 Settings. Unclick "Use HTTP 1.1 through proxy connections". You have both browsers set up to use the firewall as a proxy, correct? -Rick From owner-fwtk-users@ex.tis.com Wed Oct 18 07:57 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA14922 Wed, 18 Oct 2000 07:57:06 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA07381; Wed, 18 Oct 2000 05:06:33 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Oct 2000 03:52:26 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA04610 for fwtk-users-outgoing; Wed, 18 Oct 2000 03:52:06 -0700 (PDT) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: Date: Wed, 18 Oct 2000 11:45:49 +0100 (BST) From: Tony Gale To: "Neil A. Hillard" Subject: RE: Unknown problem causing machine to hang... Cc: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 2776 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] It may be a buggy ethernet driver. 2.2.17 is the way to go. -tony On 17-Oct-2000 Neil A. Hillard wrote: > Tony, > >> What kernel are you running, and on what hardware? > Right, sorry for leaving that out, here goes: > > first of all it was working on a Compaq Proliant 5000 (Pentium Pro > 200), > 128Mb RAM, running RedHat Linux 6.1 (2.2.12), this was working > flawlessly > since 31-March-2000 until about a month ago. > > Now it's running on a HP NetServer (Pentium II 266), 128Mb RAM, 3 x > 4Gb > disks, with software raid 0 running across two of them, with > /usr/local/squid/cache mounted on it. Running RedHat 6.2 (2.2.14). > > I've now built the Proliant 5000 up with RedHat 7.0 (2.2.16) as a > test > box. It hasn't exhibited the problem yet, but it's not under half > as much > load as the live box. I've just pulled down 2.2.17 and it's > compiling as > I type. > > The weird thing about it all is it was working perfectly for 6 > months and > then suddenly went, and we hadn't even changed anything on the box > at all. > > Anyway, hope you can understand this and hopefully it's of some > use. > > > Many thanks in advance, > > > Neil. > > >> On 17-Oct-2000 Neil A. Hillard wrote: >> > Symptoms: >> > >> > Every now and again, doesn't appear to be load related as >> > it's >> > happened early in the morning and late at night as well as >> > during >> > the day, >> > the server totally hangs. Nothing is logged to the syslog, I've >> > enabled >> > kernel messages on the console and disabled screen blanking but >> > still >> > nothing. APM is disabled. It's not a hardware problem (as >> > first >> > suspected) as I've rebuilt the machine on completely different >> > hardware, >> > not utilising any of the old hardware and I'm still at a >> > complete >> > loss for >> > ideas. >> > >> >> --- >> E-Mail: Tony Gale >> People are always available for work in the past tense. >> >> The views expressed above are entirely those of the writer >> and do not represent the views, policy or understanding of >> any other person or official body. >> > > -- > Neil Hillard hillardn@gkn-whl.co.uk > GKN Westland Helicopters Ltd. http://www.gkn-whl.co.uk/ > > Disclaimer: This message does not necessarily reflect the > views of GKN Westland Helicopters Ltd. --- E-Mail: Tony Gale Fortune and love befriend the bold. -- Ovid The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Wed Oct 18 09:12 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA15167 Wed, 18 Oct 2000 09:12:01 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA11799; Wed, 18 Oct 2000 06:20:38 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Oct 2000 04:54:58 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA06886 for fwtk-users-outgoing; Wed, 18 Oct 2000 04:54:37 -0700 (PDT) Date: Wed, 18 Oct 2000 12:38:25 +0100 (BST) From: "Neil A. Hillard" To: Tony Gale cc: fwtk-users@tis.com Subject: RE: Unknown problem causing machine to hang... In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 3847 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Tony, > It may be a buggy ethernet driver. 2.2.17 is the way to go. I'll pursue 2.2.17, but it doesn't want to compile, complaining about 'badly punctuated parameter list in #define' in checksum.S. I therefore tried compiling 2.2.16 and that failed the same way. Anyone know of any bugs with compiling the kernal on RedHat 7.0 ??? One thing I didn't mention was that the symptoms were happening on the original box (the one that was up for 6 months) and it had a Compaq NetFlex 3 (TI ThunderLan). We put this down to the network card and swapped it out for a 3com 3c905b (or c). The new box also has a 3c905. It may well be worth routing around for a different network card, then. Thanks in advance for any more help, Neil. > On 17-Oct-2000 Neil A. Hillard wrote: > > Tony, > > > >> What kernel are you running, and on what hardware? > > Right, sorry for leaving that out, here goes: > > > > first of all it was working on a Compaq Proliant 5000 (Pentium Pro > > 200), > > 128Mb RAM, running RedHat Linux 6.1 (2.2.12), this was working > > flawlessly > > since 31-March-2000 until about a month ago. > > > > Now it's running on a HP NetServer (Pentium II 266), 128Mb RAM, 3 x > > 4Gb > > disks, with software raid 0 running across two of them, with > > /usr/local/squid/cache mounted on it. Running RedHat 6.2 (2.2.14). > > > > I've now built the Proliant 5000 up with RedHat 7.0 (2.2.16) as a > > test > > box. It hasn't exhibited the problem yet, but it's not under half > > as much > > load as the live box. I've just pulled down 2.2.17 and it's > > compiling as > > I type. > > > > The weird thing about it all is it was working perfectly for 6 > > months and > > then suddenly went, and we hadn't even changed anything on the box > > at all. > > > > Anyway, hope you can understand this and hopefully it's of some > > use. > > > > > > Many thanks in advance, > > > > > > Neil. > > > > > >> On 17-Oct-2000 Neil A. Hillard wrote: > >> > Symptoms: > >> > > >> > Every now and again, doesn't appear to be load related as > >> > it's > >> > happened early in the morning and late at night as well as > >> > during > >> > the day, > >> > the server totally hangs. Nothing is logged to the syslog, I've > >> > enabled > >> > kernel messages on the console and disabled screen blanking but > >> > still > >> > nothing. APM is disabled. It's not a hardware problem (as > >> > first > >> > suspected) as I've rebuilt the machine on completely different > >> > hardware, > >> > not utilising any of the old hardware and I'm still at a > >> > complete > >> > loss for > >> > ideas. > >> > > >> > >> --- > >> E-Mail: Tony Gale > >> People are always available for work in the past tense. > >> > >> The views expressed above are entirely those of the writer > >> and do not represent the views, policy or understanding of > >> any other person or official body. > >> > > > > -- > > Neil Hillard hillardn@gkn-whl.co.uk > > GKN Westland Helicopters Ltd. http://www.gkn-whl.co.uk/ > > > > Disclaimer: This message does not necessarily reflect the > > views of GKN Westland Helicopters Ltd. > > --- > E-Mail: Tony Gale > Fortune and love befriend the bold. > -- Ovid > > The views expressed above are entirely those of the writer > and do not represent the views, policy or understanding of > any other person or official body. > -- Neil Hillard hillardn@gkn-whl.co.uk GKN Westland Helicopters Ltd. http://www.gkn-whl.co.uk/ Disclaimer: This message does not necessarily reflect the views of GKN Westland Helicopters Ltd. From owner-fwtk-users@ex.tis.com Wed Oct 18 10:36 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA15528 Wed, 18 Oct 2000 10:36:30 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA19864; Wed, 18 Oct 2000 07:45:47 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Oct 2000 06:15:41 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA11467 for fwtk-users-outgoing; Wed, 18 Oct 2000 06:15:20 -0700 (PDT) From: "Fred LB" To: "'Neil A. Hillard'" Cc: Subject: RE: Unknown problem causing machine to hang... Date: Wed, 18 Oct 2000 15:12:49 +0200 Message-ID: <6305E79D086AD4119FE700508B9A16DF019570@WALLIS> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 In-Reply-To: <6305E79D086AD4119FE700508B9A16DF017863@WALLIS> Importance: Normal Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 4825 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I had exactly the same problem as yours. It looks like editing /usr/src/linux/Makefile and replacing 'cc' by 'kgcc' solves the problem ... Good luck Fred Frederic Le Bastard Administrateur systeme - developpement web Tel : 02 40 35 32 32 Fax : 02 40 12 18 74 frederic.lebastard@strathom.com Decouvrez notre site web : http://www.strathom.com > -----Message d'origine----- > De : owner-fwtk-users@ex.tis.com > [mailto:owner-fwtk-users@ex.tis.com]De > la part de Neil A. Hillard > Envoye : mercredi 18 octobre 2000 13:38 > A : Tony Gale > Cc : fwtk-users@tis.com > Objet : RE: Unknown problem causing machine to hang... > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Tony, > > > It may be a buggy ethernet driver. 2.2.17 is the way to go. > I'll pursue 2.2.17, but it doesn't want to compile, complaining about > 'badly punctuated parameter list in #define' in checksum.S. > > I therefore tried compiling 2.2.16 and that failed the same > way. Anyone > know of any bugs with compiling the kernal on RedHat 7.0 ??? > > One thing I didn't mention was that the symptoms were happening on the > original box (the one that was up for 6 months) and it had a Compaq > NetFlex 3 (TI ThunderLan). We put this down to the network card and > swapped it out for a 3com 3c905b (or c). The new box also > has a 3c905. > It may well be worth routing around for a different network > card, then. > > Thanks in advance for any more help, > > > Neil. > > > On 17-Oct-2000 Neil A. Hillard wrote: > > > Tony, > > > > > >> What kernel are you running, and on what hardware? > > > Right, sorry for leaving that out, here goes: > > > > > > first of all it was working on a Compaq Proliant 5000 (Pentium Pro > > > 200), > > > 128Mb RAM, running RedHat Linux 6.1 (2.2.12), this was working > > > flawlessly > > > since 31-March-2000 until about a month ago. > > > > > > Now it's running on a HP NetServer (Pentium II 266), > 128Mb RAM, 3 x > > > 4Gb > > > disks, with software raid 0 running across two of them, with > > > /usr/local/squid/cache mounted on it. Running RedHat 6.2 > (2.2.14). > > > > > > I've now built the Proliant 5000 up with RedHat 7.0 (2.2.16) as a > > > test > > > box. It hasn't exhibited the problem yet, but it's not under half > > > as much > > > load as the live box. I've just pulled down 2.2.17 and it's > > > compiling as > > > I type. > > > > > > The weird thing about it all is it was working perfectly for 6 > > > months and > > > then suddenly went, and we hadn't even changed anything on the box > > > at all. > > > > > > Anyway, hope you can understand this and hopefully it's of some > > > use. > > > > > > > > > Many thanks in advance, > > > > > > > > > Neil. > > > > > > > > >> On 17-Oct-2000 Neil A. Hillard wrote: > > >> > Symptoms: > > >> > > > >> > Every now and again, doesn't appear to be load related as > > >> > it's > > >> > happened early in the morning and late at night as well as > > >> > during > > >> > the day, > > >> > the server totally hangs. Nothing is logged to the > syslog, I've > > >> > enabled > > >> > kernel messages on the console and disabled screen blanking but > > >> > still > > >> > nothing. APM is disabled. It's not a hardware problem (as > > >> > first > > >> > suspected) as I've rebuilt the machine on completely different > > >> > hardware, > > >> > not utilising any of the old hardware and I'm still at a > > >> > complete > > >> > loss for > > >> > ideas. > > >> > > > >> > > >> --- > > >> E-Mail: Tony Gale > > >> People are always available for work in the past tense. > > >> > > >> The views expressed above are entirely those of the writer > > >> and do not represent the views, policy or understanding of > > >> any other person or official body. > > >> > > > > > > -- > > > Neil Hillard hillardn@gkn-whl.co.uk > > > GKN Westland Helicopters Ltd. http://www.gkn-whl.co.uk/ > > > > > > Disclaimer: This message does not necessarily reflect the > > > views of GKN Westland Helicopters Ltd. > > > > --- > > E-Mail: Tony Gale > > Fortune and love befriend the bold. > > -- Ovid > > > > The views expressed above are entirely those of the writer > > and do not represent the views, policy or understanding of > > any other person or official body. > > > > -- > Neil Hillard hillardn@gkn-whl.co.uk > GKN Westland Helicopters Ltd. http://www.gkn-whl.co.uk/ > > Disclaimer: This message does not necessarily reflect the > views of GKN Westland Helicopters Ltd. > From owner-fwtk-users@ex.tis.com Wed Oct 18 12:02 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA15906 Wed, 18 Oct 2000 12:02:15 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA03694; Wed, 18 Oct 2000 09:06:09 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Oct 2000 07:40:56 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA19220 for fwtk-users-outgoing; Wed, 18 Oct 2000 07:40:35 -0700 (PDT) From: "Fred LB" To: "'Neil A. Hillard'" Cc: Subject: RE: Unknown problem causing machine to hang... Date: Wed, 18 Oct 2000 16:38:04 +0200 Message-ID: <6305E79D086AD4119FE700508B9A16DF019573@WALLIS> MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook CWS, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 In-Reply-To: <6305E79D086AD4119FE700508B9A16DF017864@WALLIS> Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 6162 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Sorry for writing back, but an updated RPM of glibc, available on any good redhat mirror, should also solve the problem. The thing is the glibc (2.96) shipped with RH 7.0 is not yet supported by 2.2.17 kernel ... but well ... at least redhat was ready before the kernel ... can't blame them :-) info : The trick of replacing cc by kgcc makes your stuff compiled with egcs 1.1.2 instead of glibc 2.96 Fred Frederic Le Bastard Administrateur systeme - developpement web Tel : 02 40 35 32 32 Fax : 02 40 12 18 74 frederic.lebastard@strathom.com Decouvrez notre site web : http://www.strathom.com > -----Message d'origine----- > De : owner-fwtk-users@ex.tis.com > [mailto:owner-fwtk-users@ex.tis.com]De > la part de Fred LB > Envoye : mercredi 18 octobre 2000 15:13 > A : 'Neil A. Hillard' > Cc : fwtk-users@tis.com > Objet : RE: Unknown problem causing machine to hang... > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi, > > I had exactly the same problem as yours. It looks like editing > /usr/src/linux/Makefile and replacing 'cc' by 'kgcc' solves > the problem ... > > Good luck > > Fred > > Frederic Le Bastard > Administrateur systeme - developpement web > Tel : 02 40 35 32 32 > Fax : 02 40 12 18 74 > frederic.lebastard@strathom.com > Decouvrez notre site web : http://www.strathom.com > > > > > -----Message d'origine----- > > De : owner-fwtk-users@ex.tis.com > > [mailto:owner-fwtk-users@ex.tis.com]De > > la part de Neil A. Hillard > > Envoye : mercredi 18 octobre 2000 13:38 > > A : Tony Gale > > Cc : fwtk-users@tis.com > > Objet : RE: Unknown problem causing machine to hang... > > > > > > [To be removed from this list send the message "unsubscribe > > fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > Tony, > > > > > It may be a buggy ethernet driver. 2.2.17 is the way to go. > > I'll pursue 2.2.17, but it doesn't want to compile, > complaining about > > 'badly punctuated parameter list in #define' in checksum.S. > > > > I therefore tried compiling 2.2.16 and that failed the same > > way. Anyone > > know of any bugs with compiling the kernal on RedHat 7.0 ??? > > > > One thing I didn't mention was that the symptoms were > happening on the > > original box (the one that was up for 6 months) and it had a Compaq > > NetFlex 3 (TI ThunderLan). We put this down to the network card and > > swapped it out for a 3com 3c905b (or c). The new box also > > has a 3c905. > > It may well be worth routing around for a different network > > card, then. > > > > Thanks in advance for any more help, > > > > > > Neil. > > > > > On 17-Oct-2000 Neil A. Hillard wrote: > > > > Tony, > > > > > > > >> What kernel are you running, and on what hardware? > > > > Right, sorry for leaving that out, here goes: > > > > > > > > first of all it was working on a Compaq Proliant 5000 > (Pentium Pro > > > > 200), > > > > 128Mb RAM, running RedHat Linux 6.1 (2.2.12), this was working > > > > flawlessly > > > > since 31-March-2000 until about a month ago. > > > > > > > > Now it's running on a HP NetServer (Pentium II 266), > > 128Mb RAM, 3 x > > > > 4Gb > > > > disks, with software raid 0 running across two of them, with > > > > /usr/local/squid/cache mounted on it. Running RedHat 6.2 > > (2.2.14). > > > > > > > > I've now built the Proliant 5000 up with RedHat 7.0 > (2.2.16) as a > > > > test > > > > box. It hasn't exhibited the problem yet, but it's not > under half > > > > as much > > > > load as the live box. I've just pulled down 2.2.17 and it's > > > > compiling as > > > > I type. > > > > > > > > The weird thing about it all is it was working perfectly for 6 > > > > months and > > > > then suddenly went, and we hadn't even changed anything > on the box > > > > at all. > > > > > > > > Anyway, hope you can understand this and hopefully it's of some > > > > use. > > > > > > > > > > > > Many thanks in advance, > > > > > > > > > > > > Neil. > > > > > > > > > > > >> On 17-Oct-2000 Neil A. Hillard wrote: > > > >> > Symptoms: > > > >> > > > > >> > Every now and again, doesn't appear to be load > related as > > > >> > it's > > > >> > happened early in the morning and late at night as well as > > > >> > during > > > >> > the day, > > > >> > the server totally hangs. Nothing is logged to the > > syslog, I've > > > >> > enabled > > > >> > kernel messages on the console and disabled screen > blanking but > > > >> > still > > > >> > nothing. APM is disabled. It's not a hardware problem (as > > > >> > first > > > >> > suspected) as I've rebuilt the machine on completely > different > > > >> > hardware, > > > >> > not utilising any of the old hardware and I'm still at a > > > >> > complete > > > >> > loss for > > > >> > ideas. > > > >> > > > > >> > > > >> --- > > > >> E-Mail: Tony Gale > > > >> People are always available for work in the past tense. > > > >> > > > >> The views expressed above are entirely those of the writer > > > >> and do not represent the views, policy or understanding of > > > >> any other person or official body. > > > >> > > > > > > > > -- > > > > Neil Hillard hillardn@gkn-whl.co.uk > > > > GKN Westland Helicopters Ltd. http://www.gkn-whl.co.uk/ > > > > > > > > Disclaimer: This message does not necessarily reflect the > > > > views of GKN Westland Helicopters Ltd. > > > > > > --- > > > E-Mail: Tony Gale > > > Fortune and love befriend the bold. > > > -- Ovid > > > > > > The views expressed above are entirely those of the writer > > > and do not represent the views, policy or understanding of > > > any other person or official body. > > > > > > > -- > > Neil Hillard hillardn@gkn-whl.co.uk > > GKN Westland Helicopters Ltd. http://www.gkn-whl.co.uk/ > > > > Disclaimer: This message does not necessarily reflect the > > views of GKN Westland Helicopters Ltd. > > > From owner-fwtk-users@ex.tis.com Wed Oct 18 12:43 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA15972 Wed, 18 Oct 2000 12:43:34 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA10189; Wed, 18 Oct 2000 09:52:33 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Oct 2000 08:33:16 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA26726 for fwtk-users-outgoing; Wed, 18 Oct 2000 08:32:54 -0700 (PDT) Date: Wed, 18 Oct 2000 08:03:42 -0700 (PDT) From: "Keith V. Olson" To: Rick Murphy cc: "Keith V. Olson" , fwtk-users@tis.com Subject: Re: http-gw slow with IE but not NS In-Reply-To: <4.3.2.7.2.20001018060658.00b75100@mail.itm-inst.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1835 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Wed, 18 Oct 2000, Rick Murphy wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > At 09:22 PM 10/17/00 -0700, Keith V. Olson wrote: > >I just recently installed fwtk on a Redhat Linux 6.1 486 > >with 16M memory. I having problems with http-gw being > >very slow in general, but extremely slow to non-functioning > >when I use IE as the browser. From the same machine when > >I use NS it's slower than going directly to the web server, > >but still reasonable. > > Disable HTTP/1.1 in IE and try again. (That's on the Tools/Internet Options > page, Advanced Tab, HTTP 1.1 Settings. Unclick "Use HTTP 1.1 through proxy > connections". That option was unselected. Selecting it and trying the connection again didn't seem to change the performance. > > You have both browsers set up to use the firewall as a proxy, correct? This might be a problem with my understanding of proxy-ing. I don't want to proxy outgoing connections. Just connections incoming on port 80 of the firewall. To test this I've been hitting port 80 from another computer inside the firewall. I think that is a valid test. Maybe I shouldn't be using http-gw? Would plug-gw be better? Keith ///\ (O O) +--------oOO--(_)-------------+ | Keith V. Olson | | keithvolson@digmanolson.com | | http://www.digmanolson.com/ | +------------------oOO--------+ Portland |__|__| <*> Oregon || || MTFBWY ooO Ooo From owner-fwtk-users@ex.tis.com Wed Oct 18 19:36 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA17105 Wed, 18 Oct 2000 19:35:47 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA20932; Wed, 18 Oct 2000 16:45:36 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Oct 2000 15:10:57 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA12331 for fwtk-users-outgoing; Wed, 18 Oct 2000 15:10:37 -0700 (PDT) Message-Id: <4.3.2.7.2.20001018175630.00bb1ae0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Wed, 18 Oct 2000 17:58:00 -0400 To: "Keith V. Olson" From: Rick Murphy Subject: Re: http-gw slow with IE but not NS Cc: "Keith V. Olson" , fwtk-users@tis.com In-Reply-To: References: <4.3.2.7.2.20001018060658.00b75100@mail.itm-inst.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 758 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 08:03 AM 10/18/00 -0700, Keith V. Olson wrote: >This might be a problem with my understanding of proxy-ing. I don't want >to proxy outgoing connections. Just connections incoming on port 80 of >the firewall. To test this I've been hitting port 80 from another computer >inside the firewall. I think that is a valid test. > >Maybe I shouldn't be using http-gw? Would plug-gw be better? If you are intending to proxy inbound, untrusted users to your web site, don't use http-gw. Use plug-gw instead. The http-gw has far more functionality than you need, some of which can be exploited by untrusted users. -Rick From owner-fwtk-users@ex.tis.com Thu Oct 19 03:45 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA18408 Thu, 19 Oct 2000 03:45:09 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA09105; Thu, 19 Oct 2000 00:53:55 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Oct 2000 22:45:34 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id WAA04955 for fwtk-users-outgoing; Wed, 18 Oct 2000 22:45:13 -0700 (PDT) Message-ID: <39EE89FE.E1A86E1A@digmanolson.com> Date: Wed, 18 Oct 2000 22:43:26 -0700 From: "Keith V. Olson" X-Mailer: Mozilla 4.7 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: Rick Murphy , fwtk-users@tis.com Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS) References: <4.3.2.7.2.20001018060658.00b75100@mail.itm-inst.com> <4.3.2.7.2.20001018175630.00bb1ae0@mail.itm-inst.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1986 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Humm, reading item 2.4.13 in the fwtk faq makes more sense now. So is http-gw meant specifically for outbound traffic? The documentation seems a little vague. The other proxies seem to be for both inbound and outbound. Thanks for the plug-gw tip. One more question. About that faq item (2.4.13), there is a statement... "Your best bet for this is to use a plug-gw; however, that will not protect the web server from penetration attempts." I had thought the purpose of proxy-ing an inbound connection was to 'plug' a hole in the firewall and prevent a root access type attack against the internal server running the webserver? If not then what's the difference, security-wise, between using a proxy and using port forwarding? Keith Rick Murphy wrote: > > At 08:03 AM 10/18/00 -0700, Keith V. Olson wrote: > >This might be a problem with my understanding of proxy-ing. I don't want > >to proxy outgoing connections. Just connections incoming on port 80 of > >the firewall. To test this I've been hitting port 80 from another computer > >inside the firewall. I think that is a valid test. > > > >Maybe I shouldn't be using http-gw? Would plug-gw be better? > > If you are intending to proxy inbound, untrusted users to your web site, > don't use http-gw. Use plug-gw instead. The http-gw has far more > functionality than you need, some of which can be exploited by untrusted users. > -Rick -- ///\\ (O O) +--------oOO--(_)-------------+ | Keith V. Olson | | keithvolson@digmanolson.com | | http://www.digmanolson.com/ | +------------------oOO--------+ Portland |__|__| <*> Oregon || || MTFBWY ooO Ooo From owner-fwtk-users@ex.tis.com Thu Oct 19 10:03 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA19873 Thu, 19 Oct 2000 10:03:49 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA22973; Thu, 19 Oct 2000 07:13:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 19 Oct 2000 05:40:14 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA16134 for fwtk-users-outgoing; Thu, 19 Oct 2000 05:39:43 -0700 (PDT) Message-ID: <39EEEBD2.5BF8A676@v-one.com> Date: Thu, 19 Oct 2000 08:40:51 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: "Keith V. Olson" CC: Rick Murphy , fwtk-users@tis.com Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS) References: <4.3.2.7.2.20001018060658.00b75100@mail.itm-inst.com> <4.3.2.7.2.20001018175630.00bb1ae0@mail.itm-inst.com> <39EE89FE.E1A86E1A@digmanolson.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1251 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] "Keith V. Olson" wrote: > > One more question. About that faq item (2.4.13), there is a > statement... "Your best bet for this is to use a plug-gw; > however, that will not protect the web server from penetration > attempts." I had thought the purpose of proxy-ing an inbound > connection was to 'plug' a hole in the firewall and prevent a > root access type attack against the internal server running > the webserver? If not then what's the difference, > security-wise, between using a proxy and using port > forwarding? What I was trying to say in the FAQ is that if someone finds a hole in your web server and it is on your inside network, then they will have access to your network. The plug proxy cannot protect against bugs in web servers or CGI scripts. You may want to consider putting the web server in a DMZ (third network interface of your firewall box). This will have the firewall protect the server from the Internet, and will also force attackers to break through the firewall in order to get to the inside network. -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Thu Oct 19 12:53 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA20363 Thu, 19 Oct 2000 12:53:29 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA13672; Thu, 19 Oct 2000 10:02:30 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 19 Oct 2000 08:33:26 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA02341 for fwtk-users-outgoing; Thu, 19 Oct 2000 08:33:16 -0700 (PDT) From: "Luis Fernando Barrera" To: Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS) Date: Thu, 19 Oct 2000 09:31:48 -0600 Message-ID: MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Importance: Normal Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id IAA02326 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1773 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] So...what's the difference, security-wise, between using a proxy and using port forwarding? Luis -----Original Message----- From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On Behalf Of Keith Young Sent: Thursday, October 19, 2000 6:41 AM To: Keith V. Olson Cc: Rick Murphy; fwtk-users@tis.com Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS) [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] "Keith V. Olson" wrote: > > One more question. About that faq item (2.4.13), there is a > statement... "Your best bet for this is to use a plug-gw; > however, that will not protect the web server from penetration > attempts." I had thought the purpose of proxy-ing an inbound > connection was to 'plug' a hole in the firewall and prevent a > root access type attack against the internal server running > the webserver? If not then what's the difference, > security-wise, between using a proxy and using port > forwarding? What I was trying to say in the FAQ is that if someone finds a hole in your web server and it is on your inside network, then they will have access to your network. The plug proxy cannot protect against bugs in web servers or CGI scripts. You may want to consider putting the web server in a DMZ (third network interface of your firewall box). This will have the firewall protect the server from the Internet, and will also force attackers to break through the firewall in order to get to the inside network. -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Thu Oct 19 13:23 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA20524 Thu, 19 Oct 2000 13:23:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA17166; Thu, 19 Oct 2000 10:33:13 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 19 Oct 2000 09:18:13 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA08198 for fwtk-users-outgoing; Thu, 19 Oct 2000 09:18:01 -0700 (PDT) Message-ID: <39EF1C9C.1F2180ED@ordix.de> Date: Thu, 19 Oct 2000 18:09:00 +0200 From: Markus Schreier X-Mailer: Mozilla 4.7 [de]C-CCK-MCD QXW03237 (WinNT; I) X-Accept-Language: de,en MIME-Version: 1.0 To: fwtk-users@tis.com Subject: Aranging oneself? Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 614 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello all of you, i've set up a Box with FWTK as a test machine. As fare as I can see it relay works fine. Now i wan't to set up a real firewall with fwtk. This new machine should - not have a compiler installed - schould be somekind of uptodate with patches. How should i arrange things to get patches compiled in without having a compiler? Which stragety are you following? Do you have a second system for makeing newer deamons? Thanks for your ideas. Markus Schreier ORDIX AG From owner-fwtk-users@ex.tis.com Thu Oct 19 14:56 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA20740 Thu, 19 Oct 2000 14:56:17 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA00119; Thu, 19 Oct 2000 12:03:26 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 19 Oct 2000 10:37:38 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA17707 for fwtk-users-outgoing; Thu, 19 Oct 2000 10:37:17 -0700 (PDT) Message-ID: <28279157.971976954357.JavaMail.imail@dotty.excite.com> Date: Thu, 19 Oct 2000 10:35:54 -0700 (PDT) From: "T. Esting" Reply-To: To: Luis Fernando Barrera , fwtk-users@tis.com Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS) Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: Excite Inbox X-Sender-Ip: 63.73.213.5 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 3108 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] A proxy, or application-level gateway, usually implies a program that has knowledge of the application streams being forwarded. A plug will just blindly forward all network traffic. For instance, a snapshot of a web request might look like this, from an OSI layer perspective: App GET /scripts/..%c1%1c../winnt/system32/cmd.exe HTTP/1.0 Pre Ses Tra Src port: 36021 Dst port: 80 Net Src ip: 1.2.3.4 Dst ip: 2.3.4.5 Dat you get the picture... Phy An application-level gateway understands the semantics of HTTP requests and can inspect /scripts/..%c1%1c../winnt/system32/cmd.exe in order to decide, individually for this particular request, whether or not it is valid (as opposed to, for instance /index.html), whether to forward it, and to where. A plug will forward requests for both /index.html and scripts/..%c1%1c../winnt/system32/cmd.exe, no questions asked. On Thu, 19 Oct 2000 09:31:48 -0600, Luis Fernando Barrera wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > So...what's the difference, > security-wise, between using a proxy and using port > forwarding? > > Luis > > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Keith Young > Sent: Thursday, October 19, 2000 6:41 AM > To: Keith V. Olson > Cc: Rick Murphy; fwtk-users@tis.com > Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS) > > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > "Keith V. Olson" wrote: > > > > One more question. About that faq item (2.4.13), there is a > > statement... "Your best bet for this is to use a plug-gw; > > however, that will not protect the web server from penetration > > attempts." I had thought the purpose of proxy-ing an inbound > > connection was to 'plug' a hole in the firewall and prevent a > > root access type attack against the internal server running > > the webserver? If not then what's the difference, > > security-wise, between using a proxy and using port > > forwarding? > > What I was trying to say in the FAQ is that if someone finds a hole in > your web server and it is on your inside network, then they will have > access to your network. The plug proxy cannot protect against bugs in > web servers or CGI scripts. > > You may want to consider putting the web server in a DMZ (third network > interface of your firewall box). This will have the firewall protect the > server from the Internet, and will also force attackers to break through > the firewall in order to get to the inside network. > > -- > --Keith Young > -Director of Customer Care/Support, V-ONE Corp. > -kyoung@v-one.com > _______________________________________________________ Say Bye to Slow Internet! http://www.home.com/xinbox/signup.html From owner-fwtk-users@ex.tis.com Thu Oct 19 15:27 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA20838 Thu, 19 Oct 2000 15:27:00 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA04354; Thu, 19 Oct 2000 12:36:41 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 19 Oct 2000 11:19:23 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA23430 for fwtk-users-outgoing; Thu, 19 Oct 2000 11:19:01 -0700 (PDT) Message-ID: <003001c039f8$abf35ee0$fc00a8c0@k62350> From: "Larry Jackson" To: "FWTK List" Cc: "Markus Schreier" References: <39EF1C9C.1F2180ED@ordix.de> Subject: Re: Aranging oneself? Date: Thu, 19 Oct 2000 14:16:15 -0400 Organization: Falun Technical Service, Inc. MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1373 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] "Markus Schreier" asked: > > Hello all of you, > i've set up a Box with FWTK as a test machine. > As fare as I can see it realy works fine. > Now i wan't to set up a real firewall with fwtk. > This new machine should > - not have a compiler installed > - schould be somekind of uptodate with patches. > > How should i arrange things to get patches > compiled in without having a compiler? > Which stragety are you following? > Do you have a second system for makeing newer deamons? > I use one old P90 system with the with a minimal installation of OpenBSD w/o a compiler and with FWTK on an old 40MB hard drive. This is the day to day operational drive. In the same box I then have a 2nd large hard drive with a full install of OpenBSD w/ compiler and FWTK with full source. I normally have the 2nd drive unplugged so its not accessable. When I need to recompile, patch or make changes I plug in the 2nd drive, then I overlay mount /usr and /bin onto the small drive so I can make changes. When I'm done I make sure the files are up to date on the 1st drive, power down and unplug 2nd drive and reboot. I've also done this with external SCSI drives which makes it easier to add and remove drives. LarryJackson@iName.com From owner-fwtk-users@ex.tis.com Thu Oct 19 15:39 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA20890 Thu, 19 Oct 2000 15:39:56 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA06645; Thu, 19 Oct 2000 12:49:36 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 19 Oct 2000 11:35:09 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA25826 for fwtk-users-outgoing; Thu, 19 Oct 2000 11:34:46 -0700 (PDT) From: "Tom Krotchko" To: "Markus Schreier" , Subject: RE: Aranging oneself? Date: Thu, 19 Oct 2000 14:33:51 -0400 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2911.0) Importance: Normal In-Reply-To: <39EF1C9C.1F2180ED@ordix.de> X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 813 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] The easiest way is to set up 2 machines, and use one as a test bed. Then on the production machine, remove the compiler/linker executable / source /obj (I'm assuming you're not using solaris, which doesn't come with source or obj). Then for patches, you compile on the test machine, and move to production. If this is BSD, the cost of intel hardware is so cheap, probably for $200 you can get a machine that would fit the bill of test/development machine. -----Original Message----- How should i arrange things to get patches compiled in without having a compiler? Which stragety are you following? Do you have a second system for makeing newer deamons? Thanks for your ideas. From owner-fwtk-users@ex.tis.com Fri Oct 20 11:58 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA00993 Fri, 20 Oct 2000 11:58:24 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA00808; Fri, 20 Oct 2000 09:07:38 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 20 Oct 2000 06:52:25 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA14735 for fwtk-users-outgoing; Fri, 20 Oct 2000 06:52:15 -0700 (PDT) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <39EFEC2B.9854EB12@peaktime.be> Date: Fri, 20 Oct 2000 08:54:35 +0200 From: Michel Bardiaux Organization: Peaktime Belgium S.A. X-Mailer: Mozilla 4.73 [en] (WinNT; I) X-Accept-Language: en,fr MIME-Version: 1.0 To: fwtk-users@tis.com Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS) References: <28279157.971976954357.JavaMail.imail@dotty.excite.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 757 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] "T. Esting" wrote: [snipped very good explanation of application-level proxies] Still, there *is* a difference between using packet-level filtering and forwarding (a la ipfwadm and ipchains), and using a content-insensitive application-level proxy (like FWTK plug-gw): although the *contents* may be "hostile", at least no *packets* from the Internet will be seen except by the FW machine itself. That will contain *some* forms of attack, like flooding and spoofing, to the firewall. Right? Cheers. -- Michel Bardiaux Peaktime Belgium S.A. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 From owner-fwtk-users@ex.tis.com Fri Oct 20 12:14 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA01026 Fri, 20 Oct 2000 12:14:43 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA03599; Fri, 20 Oct 2000 09:24:33 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 20 Oct 2000 08:08:19 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA22977 for fwtk-users-outgoing; Fri, 20 Oct 2000 08:08:08 -0700 (PDT) Message-ID: <39F05F97.87CAAC1@zrz.TU-Berlin.DE> Date: Fri, 20 Oct 2000 17:07:03 +0200 From: Gerd Schering Organization: TUB X-Mailer: Mozilla 4.75 [en] (X11; U; Linux 2.2.14-15mdk i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users Subject: Where is udprelay 0.3.0-pl16? Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 482 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, the above mentioned udprelay,cited in the patches section of www.fwtk.org, seems to have disappeared. At least the links from the fwtk sites point to -> "not found..." Any idea? Gerd ------------------------------------------------------ -- Gerd Schering -- Email: Schering@zrz.TU-Berlin.DE ------------------------------------------------------ From owner-fwtk-users@ex.tis.com Fri Oct 20 15:36 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA01855 Fri, 20 Oct 2000 15:36:24 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA01678; Fri, 20 Oct 2000 12:46:06 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 20 Oct 2000 11:15:48 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA17755 for fwtk-users-outgoing; Fri, 20 Oct 2000 11:15:27 -0700 (PDT) Date: Fri, 20 Oct 2000 14:14:50 -0400 From: Joseph S D Yao To: Michel Bardiaux Cc: fwtk-users@tis.com Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS) Message-Id: <20001020141450.F14450@washington.cospo.osis.gov> Mail-Followup-To: Michel Bardiaux , fwtk-users@tis.com References: <28279157.971976954357.JavaMail.imail@dotty.excite.com> <39EFEC2B.9854EB12@peaktime.be> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <39EFEC2B.9854EB12@peaktime.be>; from mbardiaux@peaktime.be on Fri, Oct 20, 2000 at 08:54:35AM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1008 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Oct 20, 2000 at 08:54:35AM +0200, Michel Bardiaux wrote: ... > Still, there *is* a difference between using packet-level filtering and > forwarding (a la ipfwadm and ipchains), and using a content-insensitive > application-level proxy (like FWTK plug-gw): although the *contents* may > be "hostile", at least no *packets* from the Internet will be seen > except by the FW machine itself. That will contain *some* forms of > attack, like flooding and spoofing, to the firewall. Right? > > Cheers. > -- > Michel Bardiaux > Peaktime Belgium S.A. Rue Margot, 37 B-1457 Nil St Vincent > Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 Quite right. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Oct 20 16:54 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA02190 Fri, 20 Oct 2000 16:54:30 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA12243; Fri, 20 Oct 2000 14:04:12 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 20 Oct 2000 12:32:44 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA29882 for fwtk-users-outgoing; Fri, 20 Oct 2000 12:32:23 -0700 (PDT) Date: Fri, 20 Oct 2000 15:31:03 -0400 From: Joseph S D Yao To: Stroganova Cc: fwtk-users@lists.nai.com Subject: Re: smap/smap/qmail Message-Id: <20001020153103.M14450@washington.cospo.osis.gov> Mail-Followup-To: Stroganova , fwtk-users@lists.nai.com References: <39E6D285.AC9AC952@tulaprombank.ru> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <39E6D285.AC9AC952@tulaprombank.ru>; from strogv@tulaprombank.ru on Fri, Oct 13, 2000 at 01:14:45PM +0400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 737 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Oct 13, 2000 at 01:14:45PM +0400, Stroganova wrote: > I have FWTK 2.1, Linux Redhat 6.2 , mail agent -QMAIL > I whant to have smap/smapd process the message and then send it to > QMail. > Can I smap/smapd running as a wrapper for QMAIL? Yes. But, rather than 'qmail', I would run 'sendmail' or 'postfix'. If you are much more familiar with 'qmail', though, have at it. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Fri Oct 20 20:37 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA02793 Fri, 20 Oct 2000 20:37:12 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA00086; Fri, 20 Oct 2000 17:47:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 20 Oct 2000 16:14:28 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA24080 for fwtk-users-outgoing; Fri, 20 Oct 2000 16:14:08 -0700 (PDT) Date: Fri, 20 Oct 2000 19:13:33 -0400 From: Joseph S D Yao To: Gerd Schering Cc: fwtk-users Subject: Re: Where is udprelay 0.3.0-pl16? Message-Id: <20001020191333.Q14450@washington.cospo.osis.gov> Mail-Followup-To: Gerd Schering , fwtk-users References: <39F05F97.87CAAC1@zrz.TU-Berlin.DE> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <39F05F97.87CAAC1@zrz.TU-Berlin.DE>; from Schering@zrz.tu-berlin.de on Fri, Oct 20, 2000 at 05:07:03PM +0200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 868 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Fri, Oct 20, 2000 at 05:07:03PM +0200, Gerd Schering wrote: ... > the above mentioned udprelay,cited in the patches section > of www.fwtk.org, seems to have disappeared. > At least the links from the fwtk sites point to -> "not found..." > Any idea? > > Gerd Decidedly odd. The link is to a copy on the machine itself, yet it is stale. And the only version I can find outside of fwtk.org itself is 0.2.0. I don't know what is going on. Try sending e-mail to the addresses listed there. Let us know, eh? -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Sat Oct 21 02:09 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA03264 Sat, 21 Oct 2000 02:09:11 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id XAA05629; Fri, 20 Oct 2000 23:19:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 20 Oct 2000 21:46:08 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA04027 for fwtk-users-outgoing; Fri, 20 Oct 2000 21:45:26 -0700 (PDT) Message-ID: <39F11F5C.E0607EDA@v-one.com> Date: Sat, 21 Oct 2000 00:45:16 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Joseph S D Yao CC: Gerd Schering , fwtk-users Subject: Re: Where is udprelay 0.3.0-pl16? References: <39F05F97.87CAAC1@zrz.TU-Berlin.DE> <20001020191333.Q14450@washington.cospo.osis.gov> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 710 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Joseph S D Yao wrote: > > Decidedly odd. The link is to a copy on the machine itself, yet it is > stale. And the only version I can find outside of fwtk.org itself is > 0.2.0. > > I don't know what is going on. > > Try sending e-mail to the addresses listed there. Let us know, eh? Wierd indeed... I updated this when I got the new version of updrelay, but I guess I overwrote the file before I transferred it. The page has been fixed. It will take a day or so for the mirrors to update. -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Sat Oct 21 05:41 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA03601 Sat, 21 Oct 2000 05:40:52 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA08932; Sat, 21 Oct 2000 02:50:46 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 21 Oct 2000 01:21:38 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA07537 for fwtk-users-outgoing; Sat, 21 Oct 2000 01:21:28 -0700 (PDT) Message-ID: <39F14FDF.53DB3B07@mahindrabt.com> Date: Sat, 21 Oct 2000 13:42:15 +0530 From: Rajesh Khanduja X-Mailer: Mozilla 4.7 [en] (Win95; I) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users Subject: udp relay ... Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 603 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi I know this may not be the right forum but then I don't know where else to post this query. I wish to access Win95 m/cs from behind the firewall (Linux 6.1 kernel 2.2.12). I have installed udp relay and I am proxying port 137,138,139 (udp) but it's not working. Here is the confg relay * * 137 10.3.2.102 137 any relay * * 138 10.3.2.102 138 any relay * * 139 10.3.2.102 139 any Is the confg right ? What does the setting RELAYHOST stand for ? Cheers, Rajesh From owner-fwtk-users@ex.tis.com Sun Oct 22 18:05 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA07095 Sun, 22 Oct 2000 18:05:24 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA05592; Sun, 22 Oct 2000 15:15:20 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 22 Oct 2000 12:58:44 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA03059 for fwtk-users-outgoing; Sun, 22 Oct 2000 12:58:33 -0700 (PDT) Message-ID: <39F346AB.72AADCB2@digmanolson.com> Date: Sun, 22 Oct 2000 12:57:31 -0700 From: "Keith V. Olson" X-Mailer: Mozilla 4.7 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 CC: fwtk-users@tis.com Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS) References: <28279157.971976954357.JavaMail.imail@dotty.excite.com> <39EFEC2B.9854EB12@peaktime.be> <20001020141450.F14450@washington.cospo.osis.gov> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2111 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Thanks for all of the information and answers. I discovered that apache itself installed on the FW machine can proxy to an internal webserver. What apache calls 'reverse' proxy. This should work for me since this is for my home DSL connection that I also use from work, etc. I'll just have to make sure apache is secure and everything the proxy feature doesn't need is disabled. Thanks again, Keith Joseph S D Yao wrote: > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > On Fri, Oct 20, 2000 at 08:54:35AM +0200, Michel Bardiaux wrote: > ... > > Still, there *is* a difference between using packet-level filtering and > > forwarding (a la ipfwadm and ipchains), and using a content-insensitive > > application-level proxy (like FWTK plug-gw): although the *contents* may > > be "hostile", at least no *packets* from the Internet will be seen > > except by the FW machine itself. That will contain *some* forms of > > attack, like flooding and spoofing, to the firewall. Right? > > > > Cheers. > > -- > > Michel Bardiaux > > Peaktime Belgium S.A. Rue Margot, 37 B-1457 Nil St Vincent > > Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 > > Quite right. > > -- > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao > COSPO/OSIS Computer Support EMT-B > ----------------------------------------------------------------------- > This message is not an official statement of COSPO policies. -- ///\\ (O O) +--------oOO--(_)-------------+ | Keith V. Olson | | keithvolson@digmanolson.com | | http://www.digmanolson.com/ | +------------------oOO--------+ Portland |__|__| <*> Oregon || || MTFBWY ooO Ooo From owner-fwtk-users@ex.tis.com Mon Oct 23 05:20 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA08532 Mon, 23 Oct 2000 05:20:10 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA22397; Mon, 23 Oct 2000 02:29:34 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 00:47:57 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA06581 for fwtk-users-outgoing; Mon, 23 Oct 2000 00:47:36 -0700 (PDT) From: "John Ward" To: "Rajesh Khanduja" , "fwtk-users" Subject: RE: udp relay ... Date: Mon, 23 Oct 2000 09:51:49 +0200 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal In-Reply-To: <39F14FDF.53DB3B07@mahindrabt.com> X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 1063 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] as far as i can remember ... you need to proxy port 139 for tcp, as that is the protocol uses the 137,138 on udp and 139 on tcp ;) enjoy -----Original Message----- From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On Behalf Of Rajesh Khanduja Sent: 21 October 2000 10:12 To: fwtk-users Subject: udp relay ... [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi I know this may not be the right forum but then I don't know where else to post this query. I wish to access Win95 m/cs from behind the firewall (Linux 6.1 kernel 2.2.12). I have installed udp relay and I am proxying port 137,138,139 (udp) but it's not working. Here is the confg relay * * 137 10.3.2.102 137 any relay * * 138 10.3.2.102 138 any relay * * 139 10.3.2.102 139 any Is the confg right ? What does the setting RELAYHOST stand for ? Cheers, Rajesh From owner-fwtk-users@ex.tis.com Mon Oct 23 11:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA10061 Mon, 23 Oct 2000 11:38:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA07482; Mon, 23 Oct 2000 08:48:06 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 07:12:36 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA22901 for fwtk-users-outgoing; Mon, 23 Oct 2000 07:12:25 -0700 (PDT) Message-Id: <200010210835.KAA22838@ry04-sun.home.rz.uni-karlsruhe.de> X-Mailer: XFMail 1.2 [p0] on Solaris X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <20001020191333.Q14450@washington.cospo.osis.gov> Date: Sat, 21 Oct 2000 10:35:36 +0200 (MET DST) From: Christoph Moench-Tegeder To: fwtk-users@tis.com Subject: Re: Where is udprelay 0.3.0-pl16? Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 715 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On 20-Oct-00 Joseph S D Yao wrote: > Decidedly odd. The link is to a copy on the machine itself, yet it is > stale. And the only version I can find outside of fwtk.org itself is > 0.2.0. > I don't know what is going on. The newest release of udprelay ist 0.3.0-pl17, and it has been put up on fwtk.org, but on some mirrors (rwth-aachen.de, for example), the HTML hasn´t been updated. Try http://www.fwtk.org/fwtk/patches/patches/udprelay-0.3.0-p17.tar.gz or http://${YOURMIRROR}/www.fwtk.org/fwtk/patches/udprelay-0.3.0-p17.tar.gz Regards cmt -- Build on 100% commercial OS From owner-fwtk-users@ex.tis.com Mon Oct 23 11:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA10064 Mon, 23 Oct 2000 11:38:25 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA07488; Mon, 23 Oct 2000 08:48:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 07:30:43 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA25323 for fwtk-users-outgoing; Mon, 23 Oct 2000 07:30:32 -0700 (PDT) Message-ID: From: "Samer, Michael, IN" To: fwtk-users@tis.com Subject: RE: Code for firewall "implementation" on an NT OS Date: Mon, 23 Oct 2000 09:11:19 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2448.0) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1187 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] A simple tip: -delete NT +install any BSD (pref. OpenBSD) +install fwtk +configure it =secure firewall. elsewhere use wingate ; quite "secure" Cheers Sam CNA and NT Admin (and BSD lover) > -----Original Message----- > From: Joseph S D Yao [SMTP:jsdy@cospo.osis.gov] > Sent: Friday, October 13, 2000 6:50 PM > To: John Ward > Cc: fwtk-users@tis.com > Subject: Re: Code for firewall "implementation" on an NT OS > > [To be removed from this list send the message "unsubscribe fwtk-users" in > the > BODY of a mail message to majordomo@ex.tis.com.] > > On Fri, Oct 13, 2000 at 10:38:24AM +0200, John Ward wrote: > > Does anyone have info on where i can get to grips with writing code for > an > > NT firewall ?? > > How ccan you write a good firewall on an inherently insecure platform? > > -- > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. > Yao > COSPO/OSIS Computer Support EMT-B > ----------------------------------------------------------------------- > This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Mon Oct 23 11:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA10067 Mon, 23 Oct 2000 11:38:40 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA07469; Mon, 23 Oct 2000 08:48:01 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 07:11:56 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA22785 for fwtk-users-outgoing; Mon, 23 Oct 2000 07:11:25 -0700 (PDT) From: dreamwvr To: Joseph S D Yao , Gerd Schering Subject: Re: Where is udprelay 0.3.0-pl16? Date: Fri, 20 Oct 2000 23:06:54 -0600 X-Mailer: KMail [version 1.0.29] Cc: fwtk-users References: <39F05F97.87CAAC1@zrz.TU-Berlin.DE> <20001020191333.Q14450@washington.cospo.osis.gov> In-Reply-To: <20001020191333.Q14450@washington.cospo.osis.gov> MIME-Version: 1.0 Message-Id: <00102023075920.00926@rainmaker> Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 1304 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi, if you can't locate it i will see if i still have a cp on one of my servers if so will send it to you if you want. well let me know.. Best Regards, dreamwvr@dreamwvr.com On Fri, 20 Oct 2000, Joseph S D Yao wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > On Fri, Oct 20, 2000 at 05:07:03PM +0200, Gerd Schering wrote: > ... > >> the above mentioned udprelay,cited in the patches section > > of www.fwtk.org, seems to have disappeared. > > At least the links from the fwtk sites point to -> "not found..." > > Any idea? > > > > Gerd > > Decidedly odd. The link is to a copy on the machine itself, yet it is > stale. And the only version I can find outside of fwtk.org itself is > 0.2.0. > > I don't know what is going on. > > Try sending e-mail to the addresses listed there. Let us know, eh? > > -- > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao > COSPO/OSIS Computer Support EMT-B > ----------------------------------------------------------------------- > This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Mon Oct 23 11:38 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA10071 Mon, 23 Oct 2000 11:38:53 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA07490; Mon, 23 Oct 2000 08:48:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 07:18:36 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA23637 for fwtk-users-outgoing; Mon, 23 Oct 2000 07:18:25 -0700 (PDT) Message-ID: <39EDD64E.3B0D3C19@zrz.tu-berlin.de> Date: Wed, 18 Oct 2000 18:56:46 +0200 From: Gerd Schering X-Mailer: Mozilla 4.75 [en] (X11; U; Linux 2.2.14-15mdk i586) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@tis.com Subject: Re: Where Re: Where is udprelay 0.30-pl16? Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 653 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I finally found the cited version of udprelay under http://www.scn.rain.com/pub/security/firewalls/ Nevertheless thanks to all who offered to send me a copy. Gerd -- PS.: Send replies (if any) to the address below. The address in the header might be misleading or not available! --------------------------------------------------------- - Gerd Schering email: Schering@zrz.TU-Berlin.DE - - TU Berlin, Zentraleinrichtung Rechenzentrum - --------------------------------------------------------- From owner-fwtk-users@ex.tis.com Mon Oct 23 11:58 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA10173 Mon, 23 Oct 2000 11:58:24 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA10936; Mon, 23 Oct 2000 09:06:33 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 07:49:32 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA27979 for fwtk-users-outgoing; Mon, 23 Oct 2000 07:49:22 -0700 (PDT) Message-ID: <39F44FB8.96F7C7CF@zrz.TU-Berlin.DE> Date: Mon, 23 Oct 2000 16:48:24 +0200 From: Gerd Schering Organization: TUB X-Mailer: Mozilla 4.75 [en] (X11; U; Linux 2.2.14-15mdk i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users Subject: Re: Where is udprelay 0.3.0-pl16? References: <39F05F97.87CAAC1@zrz.TU-Berlin.DE> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 640 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Gerd Schering wrote: > Hi, > > the above mentioned udprelay,cited in the patches section > of www.fwtk.org, seems to have disappeared. > At least the links from the fwtk sites point to -> "not found..." > Any idea? I found the file under http://www.scn.rain.com/pub/security/firewalls/ Nevertheless thanks to all who offered sending copies! ------------------------------------------------------ -- Gerd Schering -- Email: Schering@zrz.TU-Berlin.DE ------------------------------------------------------ From owner-fwtk-users@ex.tis.com Mon Oct 23 13:13 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA10409 Mon, 23 Oct 2000 13:13:07 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA22733; Mon, 23 Oct 2000 10:22:43 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 08:56:13 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA08766 for fwtk-users-outgoing; Mon, 23 Oct 2000 08:55:52 -0700 (PDT) Message-ID: <39F45FDD.3FFDFDF0@v-one.com> Date: Mon, 23 Oct 2000 11:57:17 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Gerd Schering , fwtk-users Subject: Re: SCN firewall (waS: Where is udprelay 0.3.0-pl16?) References: <39F05F97.87CAAC1@zrz.TU-Berlin.DE> <39F44FB8.96F7C7CF@zrz.TU-Berlin.DE> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1127 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Gerd Schering wrote: > > I found the file under > http://www.scn.rain.com/pub/security/firewalls/ > Hmm... I think that someone at NAI might be interested to read this: http://www.scn.rain.com/firewall.html (only revelant lines are shown) "SCN Research Firewall Features Up-to-the-date SunOS 4.1.4 or Solaris 2.6, with all current Sun Microsystems-approved patches applied. All unnecessary kernel and OS services disabled. Complete DNS services for firewall system, completely hiding internal machine names and access. Installation of TripWire, SOCKS, Firewall Toolkit, and other network security applications. Services Custom Squid Proxy for web caching. Includes support of SSL. [squid-gw?] SCN Research Costs Full system price is $5000 which includes all of the above plus training on administration of the system. This installation takes one full day (approx 12 hours). " -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Mon Oct 23 13:55 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA10533 Mon, 23 Oct 2000 13:55:39 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA27614; Mon, 23 Oct 2000 11:02:13 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 09:42:48 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA17092 for fwtk-users-outgoing; Mon, 23 Oct 2000 09:42:27 -0700 (PDT) Date: Mon, 23 Oct 2000 12:41:49 -0400 From: Joseph S D Yao To: "Keith V. Olson" Cc: fwtk-users@tis.com Subject: Re: inbound http proxy (was: http-gw slow with IE but not NS) Message-Id: <20001023124149.E24195@washington.cospo.osis.gov> Mail-Followup-To: "Keith V. Olson" , fwtk-users@tis.com References: <28279157.971976954357.JavaMail.imail@dotty.excite.com> <39EFEC2B.9854EB12@peaktime.be> <20001020141450.F14450@washington.cospo.osis.gov> <39F346AB.72AADCB2@digmanolson.com> Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: <39F346AB.72AADCB2@digmanolson.com>; from keithvolson@digmanolson.com on Sun, Oct 22, 2000 at 12:57:31PM -0700 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 980 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Sun, Oct 22, 2000 at 12:57:31PM -0700, Keith V. Olson wrote: > Thanks for all of the information and answers. I discovered > that apache itself installed on the FW machine can proxy to > an internal webserver. What apache calls 'reverse' proxy. > This should work for me since this is for my home DSL > connection that I also use from work, etc. I'll just have to > make sure apache is secure and everything the proxy feature > doesn't need is disabled. This may work. Generally, you want proxies to be much more simply written than the Apache Web server. But I believe that some are using it for something similar. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao COSPO/OSIS Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Mon Oct 23 15:14 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA10806 Mon, 23 Oct 2000 15:14:38 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA10579; Mon, 23 Oct 2000 12:23:56 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 10:59:27 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA27254 for fwtk-users-outgoing; Mon, 23 Oct 2000 10:58:56 -0700 (PDT) Date: Mon, 23 Oct 2000 13:56:48 -0400 (EDT) From: Ted Keller To: Keith Young cc: Gerd Schering , fwtk-users Subject: Re: SCN firewall (waS: Where is udprelay 0.3.0-pl16?) In-Reply-To: <39F45FDD.3FFDFDF0@v-one.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1796 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Keith, This appears to be using the Socks5 proxy (which may have licening issues itself - even more restrictive that the fwtk) along with a few other packages. I don't see any reference to the tool-kit per se. They seemed to have glued a number of packages together - not all of which are recognized as secure....or recommened to run on an end user firewall. Are you seeing something different? ted keller On Mon, 23 Oct 2000, Keith Young wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Gerd Schering wrote: > > > > I found the file under > > http://www.scn.rain.com/pub/security/firewalls/ > > > > Hmm... > > I think that someone at NAI might be interested to read this: > http://www.scn.rain.com/firewall.html > > (only revelant lines are shown) > > "SCN Research Firewall Features > > Up-to-the-date SunOS 4.1.4 or Solaris 2.6, with all current Sun > Microsystems-approved patches applied. All unnecessary kernel and OS > services disabled. > Complete DNS services for firewall system, completely hiding > internal machine names and access. > Installation of TripWire, SOCKS, Firewall Toolkit, and other > network security applications. > > Services > > Custom Squid Proxy for web caching. Includes support of SSL. [squid-gw?] > > SCN Research Costs > > Full system price is $5000 which includes all of the above plus training > on administration of the system. This installation takes one full day > (approx 12 > hours). " > > -- > --Keith Young > -Director of Customer Care/Support, V-ONE Corp. > -kyoung@v-one.com > From owner-fwtk-users@ex.tis.com Mon Oct 23 16:05 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA10948 Mon, 23 Oct 2000 16:05:36 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA18554; Mon, 23 Oct 2000 13:15:21 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 11:54:34 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA05392 for fwtk-users-outgoing; Mon, 23 Oct 2000 11:54:24 -0700 (PDT) Message-ID: <001e01c03d01$006bcba0$9b0a0a0a@ustwo.com> From: "Jonathan B. Smith" To: Subject: IP Masquerading Date: Mon, 23 Oct 2000 14:53:27 -0000 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 X-SLUIDL: 4751AEA9-A6E511D4-A8290010-5AE061F1 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="----=_NextPart_000_001B_01C03D01.0017DF40" Content-Length: 1800 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. ------=_NextPart_000_001B_01C03D01.0017DF40 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Does anyone know how I might be able use ipchains/ipfwadm to allow = outbound FTP Access? The problem I seem to be having is that IPChains = does now allow the FTP-Data back on port 20(Probably because the = connection didn't originate internally). Any help on this issue would = be much appreciated. Jonathan B. Smith Network Administrator Aston Office US=B2 UNITED SUPPORT SYSTEMS jsmith@ustwo.com ------=_NextPart_000_001B_01C03D01.0017DF40 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Does anyone know how I might be able = use=20 ipchains/ipfwadm to allow outbound FTP Access? The problem I seem to be = having=20 is that IPChains does now allow the FTP-Data back on port 20(Probably = because=20 the connection didn't originate internally).  Any help on this = issue would=20 be much appreciated.
 
Jonathan B. Smith
Network = Administrator
Aston=20 Office
US=B2 UNITED SUPPORT SYSTEMS
jsmith@ustwo.com
= ------=_NextPart_000_001B_01C03D01.0017DF40-- From owner-fwtk-users@ex.tis.com Mon Oct 23 17:22 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA11255 Mon, 23 Oct 2000 17:22:46 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA00566; Mon, 23 Oct 2000 14:32:12 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 13:01:16 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA16413 for fwtk-users-outgoing; Mon, 23 Oct 2000 13:00:55 -0700 (PDT) Message-ID: <39F48A65.FE973619@v-one.com> Date: Mon, 23 Oct 2000 14:58:45 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Ted Keller CC: fwtk-users Subject: Re: SCN firewall (waS: Where is udprelay 0.3.0-pl16?) References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2031 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Ted, > This appears to be using the Socks5 proxy (which may have licening issues > itself - even more restrictive that the fwtk) along with a few other > packages. I don't see any reference to the tool-kit per se. > > They seemed to have glued a number of packages together - not all of which > are recognized as secure....or recommened to run on an end user firewall. > > Are you seeing something different? Ted, I saw this: "Installation of TripWire, SOCKS, Firewall Toolkit, and other network security applications." along with references to other FWTK features in their features list... I'm not trying to "tattle" on them, but this is definately a blatant offense against the FWTK license. -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com > > > I found the file under > > > http://www.scn.rain.com/pub/security/firewalls/ > > > > > > > Hmm... > > > > I think that someone at NAI might be interested to read this: > > http://www.scn.rain.com/firewall.html > > > > (only revelant lines are shown) > > > > "SCN Research Firewall Features > > > > Up-to-the-date SunOS 4.1.4 or Solaris 2.6, with all current Sun > > Microsystems-approved patches applied. All unnecessary kernel and OS > > services disabled. > > Complete DNS services for firewall system, completely hiding > > internal machine names and access. > > Installation of TripWire, SOCKS, Firewall Toolkit, and other > > network security applications. > > > > Services > > > > Custom Squid Proxy for web caching. Includes support of SSL. [squid-gw?] > > > > SCN Research Costs > > > > Full system price is $5000 which includes all of the above plus training > > on administration of the system. This installation takes one full day > > (approx 12 > > hours). " > > > > -- > > --Keith Young > > -Director of Customer Care/Support, V-ONE Corp. > > -kyoung@v-one.com > > From owner-fwtk-users@ex.tis.com Mon Oct 23 18:23 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA11356 Mon, 23 Oct 2000 18:23:02 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA11279; Mon, 23 Oct 2000 15:32:27 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 13:41:33 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA22424 for fwtk-users-outgoing; Mon, 23 Oct 2000 13:41:22 -0700 (PDT) From: Dave_Chen@acml.com X-Lotus-FromDomain: ALLIANCE CAPITAL To: fwtk-users@tis.com Message-ID: <85256981.00716A19.00@njdmta01.acml.com> Date: Mon, 23 Oct 2000 16:40:18 -0400 Subject: IP Chain ruleset Mime-Version: 1.0 Content-Disposition: inline Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 978 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, The question is with regards to IP Chain in the Oct. issue of Linux Journal (p42), Marcel Gagne' wrote a rule sequence is listed below: 1> ipchains -P input ACCEPT 2> ipchains -A input -j ACCEPT -s 192.168.1.0/24 -d 0.0.0.0/0 3> ipchans -A input -j ACCEPT -s 0.0.0.0/0 -d 0.0.0.0/0 4> ipchains -A input -j DENY -p tcp -s 0.0.0.0/0 -d 259.25.132.55 137:139 5> ipchains -A input -j DENY -p udp -s 0.0.0.0/0 -d 259.25.132.55 137:139 6> ipchains -A input -j ACCEPT -p tcp -s 0.0.0.0/0 -d 259.25.132.55 80 7> ipchains -A input -j DENY -s 0.0.0.0/0 -d 0.0.0.0/0 Question is this: Line #3 is allow any source address (0.0.0.0/0) to any destination address (0.0.0.0/0) does it not superseded the following lines (#4 -7)? How can you DENY service when it is already allowed? Does the order not matter? Thanks. Dave Chen From owner-fwtk-users@ex.tis.com Mon Oct 23 18:23 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA11359 Mon, 23 Oct 2000 18:23:12 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA11275; Mon, 23 Oct 2000 15:32:27 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 14:01:36 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA25398 for fwtk-users-outgoing; Mon, 23 Oct 2000 14:01:14 -0700 (PDT) Date: Mon, 23 Oct 2000 16:58:45 -0400 (EDT) From: Ted Keller To: Keith Young cc: fwtk-users Subject: Re: SCN firewall (waS: Where is udprelay 0.3.0-pl16?) In-Reply-To: <39F48A65.FE973619@v-one.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2554 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Well - Went and looked again - and the index of their site came up. You are right - the toolkit tarball is setting out there. I agree - they appear to be in violation of the agreement - and they are a US company which probably means the license is enforcable. I assume NAI is listening and will take their own steps to resolve? ted keller On Mon, 23 Oct 2000, Keith Young wrote: > > Ted, > > > This appears to be using the Socks5 proxy (which may have licening issues > > itself - even more restrictive that the fwtk) along with a few other > > packages. I don't see any reference to the tool-kit per se. > > > > They seemed to have glued a number of packages together - not all of which > > are recognized as secure....or recommened to run on an end user firewall. > > > > Are you seeing something different? > > Ted, > > I saw this: > "Installation of TripWire, SOCKS, Firewall Toolkit, and other network > security applications." > > along with references to other FWTK features in their features list... > > I'm not trying to "tattle" on them, but this is definately a blatant > offense against the FWTK license. > > -- > --Keith Young > -Director of Customer Care/Support, V-ONE Corp. > -kyoung@v-one.com > > > > > > I found the file under > > > > http://www.scn.rain.com/pub/security/firewalls/ > > > > > > > > > > Hmm... > > > > > > I think that someone at NAI might be interested to read this: > > > http://www.scn.rain.com/firewall.html > > > > > > (only revelant lines are shown) > > > > > > "SCN Research Firewall Features > > > > > > Up-to-the-date SunOS 4.1.4 or Solaris 2.6, with all current Sun > > > Microsystems-approved patches applied. All unnecessary kernel and OS > > > services disabled. > > > Complete DNS services for firewall system, completely hiding > > > internal machine names and access. > > > Installation of TripWire, SOCKS, Firewall Toolkit, and other > > > network security applications. > > > > > > Services > > > > > > Custom Squid Proxy for web caching. Includes support of SSL. [squid-gw?] > > > > > > SCN Research Costs > > > > > > Full system price is $5000 which includes all of the above plus training > > > on administration of the system. This installation takes one full day > > > (approx 12 > > > hours). " > > > > > > -- > > > --Keith Young > > > -Director of Customer Care/Support, V-ONE Corp. > > > -kyoung@v-one.com > > > > > From owner-fwtk-users@ex.tis.com Mon Oct 23 20:19 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA11624 Mon, 23 Oct 2000 20:19:07 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA20157; Mon, 23 Oct 2000 17:28:27 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Oct 2000 15:57:18 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA13726 for fwtk-users-outgoing; Mon, 23 Oct 2000 15:56:58 -0700 (PDT) Message-Id: <4.3.2.7.2.20001023185333.00ba1220@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Mon, 23 Oct 2000 18:54:16 -0400 To: "Jonathan B. Smith" , From: Rick Murphy Subject: Re: IP Masquerading In-Reply-To: <001e01c03d01$006bcba0$9b0a0a0a@ustwo.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 598 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 02:53 PM 10/23/00 +0000, Jonathan B. Smith wrote: >Does anyone know how I might be able use ipchains/ipfwadm to allow >outbound FTP Access? The problem I seem to be having is that IPChains does >now allow the FTP-Data back on port 20(Probably because the connection >didn't originate internally). Any help on this issue would be much >appreciated. You need to load the FTP masquerading module - it adds support for editing the data connection. -Rick From owner-fwtk-users@ex.tis.com Tue Oct 24 10:11 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA14394 Tue, 24 Oct 2000 10:11:13 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA22527; Tue, 24 Oct 2000 07:20:14 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Oct 2000 05:43:03 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA15648 for fwtk-users-outgoing; Tue, 24 Oct 2000 05:42:42 -0700 (PDT) Message-ID: <952FAEB97E0AD111BB7000805F0D84F6049DA7DA@eesusciexs3.eesus.jnj.com> From: "Drash, Jim [EESUS]" To: "'Jonathan B. Smith'" , fwtk-users@tis.com Subject: RE: IP Masquerading Date: Tue, 24 Oct 2000 08:40:11 -0400 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C03DB7.8CAE0C20" Content-Length: 2698 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C03DB7.8CAE0C20 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable You need to enable the ip_masq_ftp kernel module. -----Original Message----- From: Jonathan B. Smith [mailto:jsmith@ustwo.com] Sent: Monday, October 23, 2000 10:53 AM To: fwtk-users@tis.com Subject: IP Masquerading Does anyone know how I might be able use ipchains/ipfwadm to allow = outbound FTP Access? The problem I seem to be having is that IPChains does now = allow the FTP-Data back on port 20(Probably because the connection didn't originate internally). Any help on this issue would be much = appreciated. =20 Jonathan B. Smith Network Administrator Aston Office US=B2 UNITED SUPPORT SYSTEMS jsmith@ustwo.com =20 ------_=_NextPart_001_01C03DB7.8CAE0C20 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
You=20 need to enable the ip_masq_ftp kernel module.
-----Original Message-----
From: Jonathan B. Smith = [mailto:jsmith@ustwo.com]
Sent: Monday, October 23, 2000 = 10:53=20 AM
To: fwtk-users@tis.com
Subject: IP=20 Masquerading

Does anyone know how I might be able = use=20 ipchains/ipfwadm to allow outbound FTP Access? The problem I seem to = be having=20 is that IPChains does now allow the FTP-Data back on port 20(Probably = because=20 the connection didn't originate internally).  Any help on this = issue=20 would be much appreciated.
 
Jonathan B. Smith
Network=20 Administrator
Aston Office
US=B2 UNITED SUPPORT SYSTEMS
jsmith@ustwo.com
------_=_NextPart_001_01C03DB7.8CAE0C20-- From owner-fwtk-users@ex.tis.com Tue Oct 24 11:16 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA14777 Tue, 24 Oct 2000 11:16:05 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA00082; Tue, 24 Oct 2000 08:25:52 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Oct 2000 07:04:57 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA21049 for fwtk-users-outgoing; Tue, 24 Oct 2000 07:04:46 -0700 (PDT) Message-ID: <001801c03ddc$6e1456a0$200a0a0a@ustwo.com> From: "Jonathan B. Smith" To: Subject: Re: IP Masquerading Date: Tue, 24 Oct 2000 10:03:56 -0700 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 X-SLUIDL: 4751AFA7-A6E511D4-A8290010-5AE061F1 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="----=_NextPart_000_000E_01C03DA1.B88C3800" Content-Length: 3292 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. ------=_NextPart_000_000E_01C03DA1.B88C3800 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Ok now that I have that piece of the puzzle fixed.. I thought that = another problem was directly linked to the ftp issue, looks like I was = wrong. Now I can't send file attachments larger than 100k. Anyone have = any ideas on that one?? ----- Original Message -----=20 From: Jonathan B. Smith=20 To: fwtk-users@tis.com=20 Sent: Monday, October 23, 2000 7:53 AM Subject: IP Masquerading Does anyone know how I might be able use ipchains/ipfwadm to allow = outbound FTP Access? The problem I seem to be having is that IPChains = does now allow the FTP-Data back on port 20(Probably because the = connection didn't originate internally). Any help on this issue would = be much appreciated. Jonathan B. Smith Network Administrator Aston Office US=B2 UNITED SUPPORT SYSTEMS jsmith@ustwo.com ------=_NextPart_000_000E_01C03DA1.B88C3800 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Ok now that I have that piece of the = puzzle fixed..=20 I thought that another problem was directly linked to the ftp issue, = looks like=20 I was wrong.  Now I can't send file attachments larger than = 100k. =20 Anyone have any ideas on that one??
----- Original Message -----
From:=20 Jonathan = B. Smith=20
Sent: Monday, October 23, 2000 = 7:53=20 AM
Subject: IP Masquerading

Does anyone know how I might be able = use=20 ipchains/ipfwadm to allow outbound FTP Access? The problem I seem to = be having=20 is that IPChains does now allow the FTP-Data back on port 20(Probably = because=20 the connection didn't originate internally).  Any help on this = issue=20 would be much appreciated.
 
Jonathan B. Smith
Network=20 Administrator
Aston Office
US=B2 UNITED SUPPORT SYSTEMS
jsmith@ustwo.com
------=_NextPart_000_000E_01C03DA1.B88C3800-- From owner-fwtk-users@ex.tis.com Thu Oct 26 12:05 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA23915 Thu, 26 Oct 2000 12:05:34 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA08760; Thu, 26 Oct 2000 09:15:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 26 Oct 2000 06:56:33 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA23110 for fwtk-users-outgoing; Thu, 26 Oct 2000 06:56:22 -0700 (PDT) Message-ID: From: BC - Tibiletti Pedro To: "'fwtk-support@tis.com'" , "'fwtk-users@tis.com'" Subject: FTP with Vbasic Date: Wed, 25 Oct 2000 15:58:03 -0300 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 932 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Dear TIS's Gurus: We are trying to do FTP using FTP VBasic 6 Control, through TIS FTP proxy V2.1, and the connection is never stablished. FTP works OK from MSIExplorer, WSFTP, DOS, always through the same firewall. PC is pentium 166, operating system is W95. The FTP gateway runs over Linux Red Hat 6.1 server. Below I paste a successful DOS sesion. Thanks. Pedro Tibiletti C:\WINDOWS>ftp 172.17.140.1 Connected to 172.17.140.1. 220 proxy.bcba.com.ar FTP proxy (Version V2.1) ready. User (172.17.140.1:(none)): bolsa_upload@63.69.230.251 331-(----GATEWAY CONNECTED TO 63.69.230.251----) 331-(220 isis Microsoft FTP Service (Version 4.0).) 331 Password required for bolsa_upload. Password: 230-Bienvenidos al FTP de technisys 230 User bolsa_upload logged in. ftp> quit 221 Hasta luego C:\WINDOWS> From owner-fwtk-users@ex.tis.com Thu Oct 26 12:06 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA23918 Thu, 26 Oct 2000 12:05:53 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA08778; Thu, 26 Oct 2000 09:15:14 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 26 Oct 2000 07:05:10 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA23914 for fwtk-users-outgoing; Thu, 26 Oct 2000 07:04:29 -0700 (PDT) Message-ID: <39F80D7F.67ABDF1F@geekgang.co.uk> Date: Thu, 26 Oct 2000 11:54:55 +0100 From: pre X-Mailer: Mozilla 4.7 [en] (WinNT; I) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@lists.nai.com, buqtraq@securityfocus.com Subject: FWTK x-gw Security Advisory [GSA2000-01] Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 2838 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] geekgang Security Advisory [gsa2000-01] [www.geekgang.co.uk] © Copyright 2000 geekgang ID: geekgang GSA2000-01 01 v1.0 Topic: FWTK x-gw format bug Status: Release 26th October, 2000 Author: pre Credit: Pekka Savola found the potential problem in the code [Abstract] The x-gw (X Windows gateway) component of the TIS Firewall Toolkit (FWTK) contains a format bug vulnerability that may be exploitable within some installations, allowing users to execute arbitrary code. [Description] The FWTK contains a set of proxy applications that are designed to aid a computing professional in building a firewall system. It is not a complete firewall product within itself. As such it is impossible to ascertain all the different configurations in which the various parts of the FWTK have been installed. The x-gw component is designed to proxy connections bewteen X Windows clients and servers. It would normally be invoked via the tn-gw (Telnet gateway) component of the FWTK. Installations using this tn-gw invocation method of the x-gw are not vulnerable to this problem due to pre-processing of input data that is performed by the tn-gw. Installations using any other method to invoke the x-gw should check their vulnerability status. The x-gw takes the X Windows display to connect to as a command line parameter or environment variable. It performs some sanity checking on this input and reports an error if the checks fail. The function that outputs the error message has a format bug, and uses the supplied display string as part of the output. The function at fault is pmsg() in the source file x-gw/pmsg.c [Solution] Patch: --- x-gw/pmsg.c.orig Mon Oct 23 13:21:26 2000 +++ x-gw/pmsg.c Mon Oct 23 13:22:36 2000 @@ -37,9 +37,9 @@ buf[sizeof(buf)-1] = '\0'; } - if( uselog ) syslog( LLEV, buf ); + if( uselog ) syslog( LLEV, "%s", buf ); else { - fprintf( stderr, buf ); + fprintf( stderr, "%s", buf ); fflush(stderr); } } [Exploit] An exploit for this vulnerability will be made available on the geekgang website. [Disclaimer] THE INFORMATION CONTAINED IN THIS ADVISORY IS BELIEVED TO BE ACCURATE , BUT NO REPRESENTATION OR WARRANTY IS GIVEN, EXPRESS OR IMPLIED, AS TO ITS ACCURACY OR COMPLETENESS. NEITHER THE AUTHOR NOR THE PUBLISHER ACCEPTS ANY LIABILITY WHATSOEVER FOR ANY DIRECT, INDIRECT OR CONSEQUENTIAL LOSS OR DAMAGE ARISING IN ANY WAY FROM ANY USE OF, OR RELIANCE PLACED ON, THIS INFORMATION FOR ANY PURPOSE. THIS ADVISORY MAY BE REDISTRIBUTED PROVIDED THAT NO FEE IS ASSIGNED AND THAT THE ADVISORY IS NOT MODIFIED IN ANY WAY. From owner-fwtk-users@ex.tis.com Thu Oct 26 18:29 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA24978 Thu, 26 Oct 2000 18:29:15 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA25318; Thu, 26 Oct 2000 15:39:05 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 26 Oct 2000 14:01:49 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA13477 for fwtk-users-outgoing; Thu, 26 Oct 2000 14:01:38 -0700 (PDT) From: "Luis Fernando Barrera" To: Subject: ftp-gw and windows nt Date: Thu, 26 Oct 2000 14:59:22 -0600 Message-ID: MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Importance: Normal Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id OAA13454 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 457 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I just applied the Tor's PASV patch to the ftp-gw proxy... However when I try to connect to some Windows NT/2000 ftp server, I get the message "cannot decode port". With the Unix/Linux ftp servers I got no problem... Has anybody experieced this problem? What is it all about? Luis Fernando Barrera luba@assist.com.gt From owner-fwtk-users@ex.tis.com Thu Oct 26 18:33 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA24984 Thu, 26 Oct 2000 18:33:43 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA25679; Thu, 26 Oct 2000 15:43:33 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 26 Oct 2000 14:26:17 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA16166 for fwtk-users-outgoing; Thu, 26 Oct 2000 14:26:04 -0700 (PDT) Date: Thu, 26 Oct 2000 17:24:15 -0400 (EDT) From: Ted Keller To: Fwtk Users Subject: FWTK x-gw Security Advisory [GSA2000-01] (fwd) Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from QUOTED-PRINTABLE to 8bit by relay2.nai.com id OAA16109 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=X-UNKNOWN Content-Length: 3138 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This advisory just came across bug-track. We need to validate the patch - and add it to the fwtk.org site. ted keller ---------- Forwarded message ---------- Date: Thu, 26 Oct 2000 12:00:03 +0100 From: pre To: BUGTRAQ@SECURITYFOCUS.COM Subject: FWTK x-gw Security Advisory [GSA2000-01] geekgang Security Advisory [gsa2000-01] [www.geekgang.co.uk] © Copyright 2000 geekgang ID: geekgang GSA2000-01 01 v1.0 Topic: FWTK x-gw format bug Status: Release 26th October, 2000 Author: pre Credit: Pekka Savola found the potential problem in the code [Abstract] The x-gw (X Windows gateway) component of the TIS Firewall Toolkit (FWTK) contains a format bug vulnerability that may be exploitable within some installations, allowing users to execute arbitrary code. [Description] The FWTK contains a set of proxy applications that are designed to aid a computing professional in building a firewall system. It is not a complete firewall product within itself. As such it is impossible to ascertain all the different configurations in which the various parts of the FWTK have been installed. The x-gw component is designed to proxy connections bewteen X Windows clients and servers. It would normally be invoked via the tn-gw (Telnet gateway) component of the FWTK. Installations using this tn-gw invocation method of the x-gw are not vulnerable to this problem due to pre-processing of input data that is performed by the tn-gw. Installations using any other method to invoke the x-gw should check their vulnerability status. The x-gw takes the X Windows display to connect to as a command line parameter or environment variable. It performs some sanity checking on this input and reports an error if the checks fail. The function that outputs the error message has a format bug, and uses the supplied display string as part of the output. The function at fault is pmsg() in the source file x-gw/pmsg.c [Solution] Patch: --- x-gw/pmsg.c.orig Mon Oct 23 13:21:26 2000 +++ x-gw/pmsg.c Mon Oct 23 13:22:36 2000 @@ -37,9 +37,9 @@ buf[sizeof(buf)-1] = '\0'; } - if( uselog ) syslog( LLEV, buf ); + if( uselog ) syslog( LLEV, "%s", buf ); else { - fprintf( stderr, buf ); + fprintf( stderr, "%s", buf ); fflush(stderr); } } [Exploit] An exploit for this vulnerability will be made available on the geekgang website. [Disclaimer] THE INFORMATION CONTAINED IN THIS ADVISORY IS BELIEVED TO BE ACCURATE , BUT NO REPRESENTATION OR WARRANTY IS GIVEN, EXPRESS OR IMPLIED, AS TO ITS ACCURACY OR COMPLETENESS. NEITHER THE AUTHOR NOR THE PUBLISHER ACCEPTS ANY LIABILITY WHATSOEVER FOR ANY DIRECT, INDIRECT OR CONSEQUENTIAL LOSS OR DAMAGE ARISING IN ANY WAY FROM ANY USE OF, OR RELIANCE PLACED ON, THIS INFORMATION FOR ANY PURPOSE. THIS ADVISORY MAY BE REDISTRIBUTED PROVIDED THAT NO FEE IS ASSIGNED AND THAT THE ADVISORY IS NOT MODIFIED IN ANY WAY. From owner-fwtk-users@ex.tis.com Thu Oct 26 19:44 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA25143 Thu, 26 Oct 2000 19:44:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA01721; Thu, 26 Oct 2000 16:54:02 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 26 Oct 2000 15:28:37 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA24047 for fwtk-users-outgoing; Thu, 26 Oct 2000 15:28:15 -0700 (PDT) Message-ID: <39F8B03F.27CC1D9D@v-one.com> Date: Thu, 26 Oct 2000 18:29:19 -0400 From: Keith Young Organization: V-ONE X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Ted Keller CC: Fwtk Users Subject: Re: FWTK x-gw Security Advisory [GSA2000-01] (fwd) References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 460 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Ted Keller wrote: > > This advisory just came across bug-track. We need to validate the patch - > and add it to the fwtk.org site. Ted, Already forwarded it to my home account so I can quickly put it on the site (along with other additions). -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Fri Oct 27 00:14 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id AAA25745 Fri, 27 Oct 2000 00:14:09 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id VAA12590; Thu, 26 Oct 2000 21:23:17 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 26 Oct 2000 19:51:01 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA09225 for fwtk-users-outgoing; Thu, 26 Oct 2000 19:50:28 -0700 (PDT) Message-Id: <4.3.2.7.2.20001026175853.00b86cb0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Thu, 26 Oct 2000 22:39:41 -0400 To: pre , fwtk-users@lists.nai.com, buqtraq@securityfocus.com From: Rick Murphy Subject: Re: FWTK x-gw Security Advisory [GSA2000-01] In-Reply-To: <39F80D7F.67ABDF1F@geekgang.co.uk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 960 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] There's a short solution for this problem - Don't allow anyone other than administrator to log in to your firewall directly. Or, don't run x-gw setuid. If either of the above is true, the bug can't be exploited. I'd like to think there's nobody out there running x-gw setuid root. (You're supposed to TURN OFF the setuid bits of unnecessary programs, not grant root permission to programs that don't need it.) However, if you're running that way, chmod 555 x-gw and you're safe. What complicates this is that x-gw could possibly be set up by someone to run by a daemon or program that's setuid root and which fails to drop privileges before it forks x-gw. The patch will be published on the www.fwtk.org web site for distribution. I'd be interested if anyone is actually vulnerable to this; send me private mail. -Rick From owner-fwtk-users@ex.tis.com Fri Oct 27 08:39 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA27362 Fri, 27 Oct 2000 08:39:05 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA27031; Fri, 27 Oct 2000 05:48:12 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 27 Oct 2000 04:05:23 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA23292 for fwtk-users-outgoing; Fri, 27 Oct 2000 04:04:43 -0700 (PDT) From: ark@eltex.ru Date: Fri, 27 Oct 2000 14:56:06 +0400 Message-Id: <200010271056.OAA25012@paranoid.alpha.int> In-Reply-To: <4.3.2.7.2.20001026175853.00b86cb0@mail.itm-inst.com> from "Rick Murphy " Organization: "Klingon Imperial Intelligence Service" Subject: Re: FWTK x-gw Security Advisory [GSA2000-01] To: rmurphy@itm-inst.com Cc: pre@geekgang.co.uk, fwtk-users@lists.nai.com, buqtraq@securityfocus.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 2032 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, BTW mjr warned me that x-gw is potentially dangerous some years ago ;) a brief look at the code shows why - it is far from being as simple and elegant as other fwtk components are.. but i had no time to examine it closer :( Rick Murphy said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > There's a short solution for this problem - > Don't allow anyone other than administrator to log in to your firewall > directly. > Or, don't run x-gw setuid. > > If either of the above is true, the bug can't be exploited. I'd like to > think there's nobody out there running x-gw setuid root. (You're supposed > to TURN OFF the setuid bits of unnecessary programs, not grant root > permission to programs that don't need it.) However, if you're running that > way, chmod 555 x-gw and you're safe. > What complicates this is that x-gw could possibly be set up by someone to > run by a daemon or program that's setuid root and which fails to drop > privileges before it forks x-gw. > The patch will be published on the www.fwtk.org web site for distribution. > I'd be interested if anyone is actually vulnerable to this; send me private > mail. > -Rick > _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBOflfRKH/mIJW9LeBAQHnrgP/VroYP0AN2P1/npbHja3mRqjacMCuRod+ ock95ycPLpWD1V+5H6PAKWJMT52S1iSKrKJqivv1n1OmwEkayiivob+iItFimqzl yU1ve0gJMwLNn55HmAKrcankBjGKR/mPbjZ17i/tnVZJauKS+NXI0RFGjexLbYdK 0UywDyYn+K4= =+aOg -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Fri Oct 27 09:09 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA27483 Fri, 27 Oct 2000 09:08:58 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA29000; Fri, 27 Oct 2000 06:19:21 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 27 Oct 2000 05:03:12 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA24896 for fwtk-users-outgoing; Fri, 27 Oct 2000 05:02:51 -0700 (PDT) Message-ID: <39F92DDF.A257CE3F@geekgang.co.uk> Date: Fri, 27 Oct 2000 08:25:19 +0100 From: pre X-Mailer: Mozilla 4.7 [en] (WinNT; I) X-Accept-Language: en MIME-Version: 1.0 To: Rick Murphy CC: fwtk-users@lists.nai.com Subject: Re: FWTK x-gw Security Advisory [GSA2000-01] References: <4.3.2.7.2.20001026175853.00b86cb0@mail.itm-inst.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 647 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Rick Murphy wrote: > There's a short solution for this problem - > Don't allow anyone other than administrator to log in to your firewall > directly. > Or, don't run x-gw setuid. > Just to clarify this a bit. If you're doing either of the above you need your head read. So, excluding the above, the problem scenario is: o You're using x-gw with remote user access and invoking it with something other than the tn-gw. This is gonna be a small number of people, but someone out there will be doing it. -pre From owner-fwtk-users@ex.tis.com Fri Oct 27 13:19 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA28396 Fri, 27 Oct 2000 13:19:50 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA27304; Fri, 27 Oct 2000 10:29:26 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 27 Oct 2000 08:20:20 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA11693 for fwtk-users-outgoing; Fri, 27 Oct 2000 08:20:10 -0700 (PDT) Message-ID: <3D6CFAEE245FD411938A00508BE371480133855F@exchnj01.nj.ssmb.com> From: "Barreira, Fernando [IT]" To: "'fwtk-support@tis.com'" , "'fwtk-users@tis.com'" Subject: FTP-GW hangs when large files are sent Date: Fri, 27 Oct 2000 11:00:17 -0400 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1891 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi there, i have a situation in which when i transfer large files (20 megs) using the ftp-gw, the connection stays hanged indefinitely (no problem when transfering small files). in other words, we don't get the message indicating a successfull transfer or the ftp> prompt back. at first we though the file transfer didn't go through but when we checked the far end we saw that the file had indeed been transferred. this is causing a problem because we have a script that does handles this job and allways thinks it failed. has anyone seen any thing like this? thanks. the machine running fwtk is as follows: sun ultra2 sparc solaris 5.6 fwtk version 2.1 with the following netperm-table: #netacl-ftp-gw: permit-hosts * -chroot /proxy/black_hole -exec /opt/fwtk/ftp-gw # # proxy-FTP rules: # ftp-gw: welcome-msg /opt/fwtk/msg/migrate.txt ftp-gw: directory /proxy/black_hole ftp-gw: userid tis-proxy ftp-gw: groupid other ftp-gw: permit-hosts * ftp-gw: deny-hosts unknown ftp-gw: timeout 30000 # # ========================================== # NETACL rules for fingerit: netacl-fingerit: deny-hosts unknown -exec /bin/cat /opt/fwtk/msg/fingerit-deny. txt netacl-fingerit: deny-hosts * -exec /bin/cat /opt/fwtk/msg/fingerit-deny.txt # ========================================== # NETACL rules for traceroute: netacl-traceroute: deny-hosts unknown -exec /bin/cat /opt/fwtk/msg/traceroute-d eny.txt netacl-traceroute: deny-hosts * -exec /bin/cat /opt/fwtk/msg/traceroute-deny.tx t # ========================================== # NETACL rules for nslookup: netacl-nslookup: deny-hosts unknown -exec /bin/cat /opt/fwtk/msg/nslookup-deny. txt netacl-nslookup: deny-hosts * -exec /bin/cat /opt/fwtk/msg/nslookup-deny.txt continued........... From owner-fwtk-users@ex.tis.com Fri Oct 27 16:12 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA28907 Fri, 27 Oct 2000 16:12:36 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA20391; Fri, 27 Oct 2000 13:22:11 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 27 Oct 2000 11:53:44 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA08419 for fwtk-users-outgoing; Fri, 27 Oct 2000 11:53:33 -0700 (PDT) Message-ID: <3D6CFAEE245FD411938A00508BE3714801338570@exchnj01.nj.ssmb.com> From: "Barreira, Fernando [IT]" To: "'fwtk-support@tis.com'" , "'fwtk-users@tis.com'" Subject: timeout parameter for ftp-gw Date: Fri, 27 Oct 2000 14:40:12 -0400 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 233 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi there, what is the recommended (most common) timeout to be configured for the ftp-gw? thanks. From owner-fwtk-users@ex.tis.com Fri Oct 27 18:11 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA29094 Fri, 27 Oct 2000 18:11:14 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA05342; Fri, 27 Oct 2000 15:20:42 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 27 Oct 2000 13:54:21 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA24614 for fwtk-users-outgoing; Fri, 27 Oct 2000 13:54:00 -0700 (PDT) Date: Fri, 27 Oct 2000 16:52:52 -0400 (EDT) From: Ted Keller To: "Barreira, Fernando [IT]" cc: "'fwtk-support@tis.com'" , "'fwtk-users@tis.com'" Subject: Re: FTP-GW hangs when large files are sent In-Reply-To: <3D6CFAEE245FD411938A00508BE371480133855F@exchnj01.nj.ssmb.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2439 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Fernando, You might want to check to see if either of the boxes is behind another firewall - packet filter. It almost sounds like you are getting timeout issues on your command connection during the data transfer.... ted keller On Fri, 27 Oct 2000, Barreira, Fernando [IT] wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > hi there, > > > i have a situation in which when i transfer large files (20 megs) using the > ftp-gw, the connection stays hanged indefinitely (no problem when > transfering small files). in other words, we don't get the message > indicating a successfull transfer or the ftp> prompt back. > at first we though the file transfer didn't go through but when we checked > the far end we saw that the file had indeed been transferred. > this is causing a problem because we have a script that does handles this > job and allways thinks it failed. > has anyone seen any thing like this? thanks. > > the machine running fwtk is as follows: > > sun ultra2 sparc > solaris 5.6 > fwtk version 2.1 > with the following netperm-table: > > #netacl-ftp-gw: permit-hosts * -chroot /proxy/black_hole -exec > /opt/fwtk/ftp-gw > # > # proxy-FTP rules: > # > ftp-gw: welcome-msg /opt/fwtk/msg/migrate.txt > ftp-gw: directory /proxy/black_hole > ftp-gw: userid tis-proxy > ftp-gw: groupid other > ftp-gw: permit-hosts * > ftp-gw: deny-hosts unknown > ftp-gw: timeout 30000 > # > # ========================================== > # NETACL rules for fingerit: > > netacl-fingerit: deny-hosts unknown -exec /bin/cat > /opt/fwtk/msg/fingerit-deny. > txt > netacl-fingerit: deny-hosts * -exec /bin/cat > /opt/fwtk/msg/fingerit-deny.txt > > # ========================================== > # NETACL rules for traceroute: > > netacl-traceroute: deny-hosts unknown -exec /bin/cat > /opt/fwtk/msg/traceroute-d > eny.txt > netacl-traceroute: deny-hosts * -exec /bin/cat > /opt/fwtk/msg/traceroute-deny.tx > t > > # ========================================== > # NETACL rules for nslookup: > > netacl-nslookup: deny-hosts unknown -exec /bin/cat > /opt/fwtk/msg/nslookup-deny. > txt > netacl-nslookup: deny-hosts * -exec /bin/cat > /opt/fwtk/msg/nslookup-deny.txt > > continued........... > From owner-fwtk-users@ex.tis.com Sat Oct 28 02:26 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA00201 Sat, 28 Oct 2000 02:26:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id XAA20185; Fri, 27 Oct 2000 23:36:22 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 27 Oct 2000 21:53:37 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA18115 for fwtk-users-outgoing; Fri, 27 Oct 2000 21:53:27 -0700 (PDT) Message-ID: <39FA5AF4.3953F71F@lclcan.com> Date: Sat, 28 Oct 2000 00:49:56 -0400 From: Don X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk Subject: mail problem Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="------------A9B79D84E9C71A70A951B4F7" Content-Length: 1399 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. --------------A9B79D84E9C71A70A951B4F7 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Hi,

I've installed the fwtk 2.1 on my webserver / mailserver.  I am haveing a problem sending and receiving email to/from the outside.  Inspection ofm my log file shows the following error:

smap[1693]:fwtksyserr: cannot open temp file Permission denied

Can someone shed light on this error and what steps I may have to take to fix it?

Thanks,
Don --------------A9B79D84E9C71A70A951B4F7 Content-Type: text/x-vcard; charset=us-ascii; name="don.vcf" Content-Transfer-Encoding: 7bit Content-Description: Card for Don Content-Disposition: attachment; filename="don.vcf" begin:vcard n:Proshetsky;Don tel;pager:n/a tel;cell:416-605-5908 tel;fax:416-733-1475 tel;home:416-733-3733 tel;work:416-665-1726 x-mozilla-html:FALSE url:www.lclcan.com org:LCL Navigation;Novonet Data Systems version:2.1 email;internet:don@lclcan.com title:Systems Administrator adr;quoted-printable:;;4711 Yonge St., Suite 1102=0D=0A;Toronto;Ontario;M2N 6K8;Canada fn:Don Proshetsky end:vcard --------------A9B79D84E9C71A70A951B4F7-- From owner-fwtk-users@ex.tis.com Sat Oct 28 10:05 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA00923 Sat, 28 Oct 2000 10:05:57 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA27623; Sat, 28 Oct 2000 07:15:49 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 28 Oct 2000 05:49:46 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA25289 for fwtk-users-outgoing; Sat, 28 Oct 2000 05:49:25 -0700 (PDT) Date: Sat, 28 Oct 2000 08:47:45 -0400 (EDT) From: Ted Keller To: Don cc: fwtk Subject: Re: mail problem In-Reply-To: <39FA5AF4.3953F71F@lclcan.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 813 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Don, smap/smapd accept mail in and temporarily store it in a directory specified by the spooldir in your netperm-table. Verify that you have an entry like.... smap, smapd: spooldir /var/inspool The temp directory is then the /var/inspool directory. ted keller On Sat, 28 Oct 2000, Don wrote: > Hi, > > I've installed the fwtk 2.1 on my webserver / mailserver. I am haveing a > problem sending and receiving email to/from the outside. Inspection ofm > my log file shows the following error: > > smap[1693]:fwtksyserr: cannot open temp file Permission denied > > Can someone shed light on this error and what steps I may have to take to > fix it? > > Thanks, > Don > From owner-fwtk-users@ex.tis.com Sat Oct 28 10:05 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA00922 Sat, 28 Oct 2000 10:05:57 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA27619; Sat, 28 Oct 2000 07:15:49 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 28 Oct 2000 05:39:42 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA25103 for fwtk-users-outgoing; Sat, 28 Oct 2000 05:39:21 -0700 (PDT) Message-Id: <4.3.2.7.2.20001028082911.00ba6580@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Sat, 28 Oct 2000 08:33:07 -0400 To: Don , fwtk From: Rick Murphy Subject: Re: mail problem In-Reply-To: <39FA5AF4.3953F71F@lclcan.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 696 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 12:49 AM 10/28/00 -0400, Don wrote: >Hi, > >I've installed the fwtk 2.1 on my webserver / mailserver. I am haveing a >problem sending and receiving email to/from the outside. Inspection ofm >my log file shows the following error: > >smap[1693]:fwtksyserr: cannot open temp file Permission denied The directory that you chroot smap to must be owned by the user that you run smap under. In other words, if you've got: smap: userid uucp smap, smapd: directory /var/spool/smap then the '/var/spool/smap' directory must be owned by user 'uucp'. -Rick From owner-fwtk-users@ex.tis.com Sat Oct 28 12:00 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA01100 Sat, 28 Oct 2000 12:00:04 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA02083; Sat, 28 Oct 2000 09:10:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 28 Oct 2000 07:49:18 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA28839 for fwtk-users-outgoing; Sat, 28 Oct 2000 07:49:06 -0700 (PDT) Message-ID: <39FAE6F5.1F8A2797@lclcan.com> Date: Sat, 28 Oct 2000 10:47:17 -0400 From: Don X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk Subject: [Fwd: Problem accessing my own website] Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="------------C6B11CDCC2184699C5B1229C" Content-Length: 3604 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. --------------C6B11CDCC2184699C5B1229C Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit In relation to this problem, I've noted something else.  The previous line in my log file states:

http-gw[1352]:log host=unknown/<my ip> protocol=HTTP cmd=dir dest=www.my.domain.com path=/

looking at this, I see that the PATH appears to be incorrect???  Where wouldthis be configured? --------------C6B11CDCC2184699C5B1229C Content-Type: message/rfc822 Content-Transfer-Encoding: 7bit Content-Disposition: inline X-Mozilla-Status2: 00000000 Message-ID: <39FAE5E3.5C551AF4@lclcan.com> Date: Sat, 28 Oct 2000 10:42:43 -0400 From: Don X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk Subject: Problem accessing my own website Content-Type: multipart/mixed; boundary="------------30AE60E7DB08FDAE9FDC9841" This is a multi-part message in MIME format. --------------30AE60E7DB08FDAE9FDC9841 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Hello,

I am not quite certain whether this problem pertains to the fwtk but if not, I trust someone will point me to the correct news group?

I am running RedHat Linux 7.0 with all the patches and have installed FWTK 2.1.  I have two networks. External network hosts the web server and the FWTK while my internal network hosts my database application.  I allow internal users to access the internet via my external machine via the FWTK proxies.

Now my problem.  I can access all internet web sites except my own.  The message in the log file states:

http-gw[1336]: failed to connect to http server www.mydomain.com (80)

I "think" the problem is that it is trying to access via port 80 while in my /etc/services file, I've set up port 81 to be http-out.   What I can't figure out is why this happens and only for my own web site. --------------30AE60E7DB08FDAE9FDC9841 Content-Type: text/x-vcard; charset=us-ascii; name="don.vcf" Content-Transfer-Encoding: 7bit Content-Description: Card for Don Content-Disposition: attachment; filename="don.vcf" begin:vcard n:Proshetsky;Don tel;pager:n/a tel;cell:416-605-5908 tel;fax:416-733-1475 tel;home:416-733-3733 tel;work:416-665-1726 x-mozilla-html:FALSE url:www.lclcan.com org:LCL Navigation;Novonet Data Systems version:2.1 email;internet:don@lclcan.com title:Systems Administrator adr;quoted-printable:;;4711 Yonge St., Suite 1102=0D=0A;Toronto;Ontario;M2N 6K8;Canada fn:Don Proshetsky end:vcard --------------30AE60E7DB08FDAE9FDC9841-- --------------C6B11CDCC2184699C5B1229C Content-Type: text/x-vcard; charset=us-ascii; name="don.vcf" Content-Transfer-Encoding: 7bit Content-Description: Card for Don Content-Disposition: attachment; filename="don.vcf" begin:vcard n:Proshetsky;Don tel;pager:n/a tel;cell:416-605-5908 tel;fax:416-733-1475 tel;home:416-733-3733 tel;work:416-665-1726 x-mozilla-html:FALSE url:www.lclcan.com org:LCL Navigation;Novonet Data Systems version:2.1 email;internet:don@lclcan.com title:Systems Administrator adr;quoted-printable:;;4711 Yonge St., Suite 1102=0D=0A;Toronto;Ontario;M2N 6K8;Canada fn:Don Proshetsky end:vcard --------------C6B11CDCC2184699C5B1229C-- From owner-fwtk-users@ex.tis.com Sat Oct 28 12:00 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA01101 Sat, 28 Oct 2000 12:00:04 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA02087; Sat, 28 Oct 2000 09:10:07 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 28 Oct 2000 07:44:46 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA28404 for fwtk-users-outgoing; Sat, 28 Oct 2000 07:44:35 -0700 (PDT) Message-ID: <39FAE5E3.5C551AF4@lclcan.com> Date: Sat, 28 Oct 2000 10:42:43 -0400 From: Don X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk Subject: Problem accessing my own website Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="------------30AE60E7DB08FDAE9FDC9841" Content-Length: 1899 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. --------------30AE60E7DB08FDAE9FDC9841 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Hello,

I am not quite certain whether this problem pertains to the fwtk but if not, I trust someone will point me to the correct news group?

I am running RedHat Linux 7.0 with all the patches and have installed FWTK 2.1.  I have two networks. External network hosts the web server and the FWTK while my internal network hosts my database application.  I allow internal users to access the internet via my external machine via the FWTK proxies.

Now my problem.  I can access all internet web sites except my own.  The message in the log file states:

http-gw[1336]: failed to connect to http server www.mydomain.com (80)

I "think" the problem is that it is trying to access via port 80 while in my /etc/services file, I've set up port 81 to be http-out.   What I can't figure out is why this happens and only for my own web site. --------------30AE60E7DB08FDAE9FDC9841 Content-Type: text/x-vcard; charset=us-ascii; name="don.vcf" Content-Transfer-Encoding: 7bit Content-Description: Card for Don Content-Disposition: attachment; filename="don.vcf" begin:vcard n:Proshetsky;Don tel;pager:n/a tel;cell:416-605-5908 tel;fax:416-733-1475 tel;home:416-733-3733 tel;work:416-665-1726 x-mozilla-html:FALSE url:www.lclcan.com org:LCL Navigation;Novonet Data Systems version:2.1 email;internet:don@lclcan.com title:Systems Administrator adr;quoted-printable:;;4711 Yonge St., Suite 1102=0D=0A;Toronto;Ontario;M2N 6K8;Canada fn:Don Proshetsky end:vcard --------------30AE60E7DB08FDAE9FDC9841-- From owner-fwtk-users@ex.tis.com Sat Oct 28 14:49 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA01440 Sat, 28 Oct 2000 14:49:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA07719; Sat, 28 Oct 2000 11:58:56 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 28 Oct 2000 09:52:46 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA03402 for fwtk-users-outgoing; Sat, 28 Oct 2000 09:52:24 -0700 (PDT) Date: Sat, 28 Oct 2000 12:50:47 -0400 (EDT) From: Ted Keller To: Don cc: fwtk Subject: Re: [Fwd: Problem accessing my own website] In-Reply-To: <39FAE6F5.1F8A2797@lclcan.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 682 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Don, Just a coupld of thoughts. First - verify that your firewall can resolve www.mydomain.com. Second, make sure that you have a route defined such that the firewall can contact www.mydomain.com ted keller On Sat, 28 Oct 2000, Don wrote: > In relation to this problem, I've noted something else. The previous > line in my log file states: > > http-gw[1352]:log host=unknown/ protocol=HTTP cmd=dir > dest=www.my.domain.com path=/ > > looking at this, I see that the PATH appears to be incorrect??? Where > wouldthis be configured? > From owner-fwtk-users@ex.tis.com Sat Oct 28 14:49 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA01441 Sat, 28 Oct 2000 14:49:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA07723; Sat, 28 Oct 2000 11:58:56 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 28 Oct 2000 10:06:58 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA04124 for fwtk-users-outgoing; Sat, 28 Oct 2000 10:06:37 -0700 (PDT) Message-ID: <20001028170535.9695.qmail@web1806.mail.yahoo.com> Date: Sat, 28 Oct 2000 10:05:35 -0700 (PDT) From: Naresh Narang Subject: Re: Problem accessing my own website To: Don Cc: fwtk-users@lists.nai.com MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1847 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] If you want to run web server on your firewall, you should be able to access it using: http://firewall:81/http://www.mydomain.com NKN --- Don wrote:

Hello,

I am not quite certain whether this problem pertains to the fwtk but if not, I trust someone will point me to the correct news group?

I am running RedHat Linux 7.0 with all the patches and have installed FWTK 2.1.  I have two networks. External network hosts the web server and the FWTK while my internal network hosts my database application.  I allow internal users to access the internet via my external machine via the FWTK proxies.

Now my problem.  I can access all internet web sites except my own.  The message in the log file states:

http-gw[1336]: failed to connect to http server www.mydomain.com (80)

I "think" the problem is that it is trying to access via port 80 while in my /etc/services file, I've set up port 81 to be http-out.   What I can't figure out is why this happens and only for my own web site. > begin:vcard > n:Proshetsky;Don > tel;pager:n/a > tel;cell:416-605-5908 > tel;fax:416-733-1475 > tel;home:416-733-3733 > tel;work:416-665-1726 > x-mozilla-html:FALSE > url:www.lclcan.com > org:LCL Navigation;Novonet Data Systems > version:2.1 > email;internet:don@lclcan.com > title:Systems Administrator > adr;quoted-printable:;;4711 Yonge St., Suite > 1102=0D=0A;Toronto;Ontario;M2N 6K8;Canada > fn:Don Proshetsky > end:vcard > ===== -- Naresh __________________________________________________ Do You Yahoo!? Yahoo! Messenger - Talk while you surf! It's FREE. http://im.yahoo.com/ From owner-fwtk-users@ex.tis.com Sat Oct 28 16:27 EDT 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA01647 Sat, 28 Oct 2000 16:27:26 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA10789; Sat, 28 Oct 2000 13:37:20 -0700 (PDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 28 Oct 2000 12:09:39 -0700 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA08225 for fwtk-users-outgoing; Sat, 28 Oct 2000 12:09:18 -0700 (PDT) Message-Id: <4.3.2.7.2.20001028145723.00bdfde0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Sat, 28 Oct 2000 15:00:23 -0400 To: Don , fwtk From: Rick Murphy Subject: Re: [Fwd: Problem accessing my own website] In-Reply-To: <39FAE6F5.1F8A2797@lclcan.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1036 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:47 AM 10/28/00 -0400, Don wrote: >In relation to this problem, I've noted something else. The previous line >in my log file states: > >http-gw[1352]:log host=unknown/ protocol=HTTP cmd=dir >dest=www.my.domain.com path=/ > >looking at this, I see that the PATH appears to be incorrect??? Where >wouldthis be configured? That looks correct to me. It's connecting to your web server and asking for the root directory - exactly what should do. >Now my problem. I can access all internet web sites except my own. The >message in the log file states: > >http-gw[1336]: failed to connect to http server www.mydomain.com (80) Is your web server running on port 80? Does the firewall know the correct IP address for that machine (internal or external depending on where it's connected.) I'd try 'telnet www.mydomain.com 80' - does that connect? -Rick From owner-fwtk-users@ex.tis.com Mon Oct 30 11:29 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA07330 Mon, 30 Oct 2000 11:29:38 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA22621; Mon, 30 Oct 2000 08:38:54 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Oct 2000 06:19:44 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA04390 for fwtk-users-outgoing; Mon, 30 Oct 2000 06:19:33 -0800 (PST) Message-ID: <39FD82CA.7FF4EB2B@lclcan.com> Date: Mon, 30 Oct 2000 09:16:42 -0500 From: Don X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk Subject: Re: [Fwd: Problem accessing my own website] References: Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="------------406BF855BF6554D8861790B7" Content-Length: 2030 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. --------------406BF855BF6554D8861790B7 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit When I ping any Internet address from my firewall/web server, I have success.  However, when I ping www.mydomain.com, I get "unknown host www.mydomain.com".

My /etc/resolv.conf looks like this:

domain mydomain.com
nameserver 127.0.0.1
nameserver <ISP DNS#1>
nameserver (ISP DNS#2>

any recommendations?

Ted Keller wrote:

Don,

Just a coupld of thoughts.

First - verify that your firewall can resolve www.mydomain.com.  Second,
make sure that you have a route defined such that the firewall can contact
www.mydomain.com

ted keller

On Sat, 28 Oct 2000, Don wrote:

> In relation to this problem, I've noted something else.  The previous
> line in my log file states:
>
> http-gw[1352]:log host=unknown/<my ip> protocol=HTTP cmd=dir
> dest=www.my.domain.com path=/
>
> looking at this, I see that the PATH appears to be incorrect???  Where
> wouldthis be configured?
>

--------------406BF855BF6554D8861790B7 Content-Type: text/x-vcard; charset=us-ascii; name="don.vcf" Content-Transfer-Encoding: 7bit Content-Description: Card for Don Content-Disposition: attachment; filename="don.vcf" begin:vcard n:Proshetsky;Don tel;pager:n/a tel;cell:416-605-5908 tel;fax:416-733-1475 tel;home:416-733-3733 tel;work:416-665-1726 x-mozilla-html:FALSE url:www.lclcan.com org:LCL Navigation;Novonet Data Systems version:2.1 email;internet:don@lclcan.com title:Systems Administrator adr;quoted-printable:;;4711 Yonge St., Suite 1102=0D=0A;Toronto;Ontario;M2N 6K8;Canada fn:Don Proshetsky end:vcard --------------406BF855BF6554D8861790B7-- From owner-fwtk-users@ex.tis.com Mon Oct 30 12:16 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA07527 Mon, 30 Oct 2000 12:16:38 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA00195; Mon, 30 Oct 2000 09:26:44 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Oct 2000 08:05:19 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA17013 for fwtk-users-outgoing; Mon, 30 Oct 2000 08:05:03 -0800 (PST) Message-ID: <3D6CFAEE245FD411938A00508BE3714801338578@exchnj01.nj.ssmb.com> From: "Barreira, Fernando [IT]" To: "'fwtk-support@tis.com'" , "'fwtk-users@tis.com'" Subject: how to apply the patch to fwtk2.1 Date: Mon, 30 Oct 2000 10:20:48 -0500 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 287 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi there, i need to apply this patch "2.9 Patch for specifying ftp data port in netperm-table [2.1]" is there any information on how to do it? thanks. From owner-fwtk-users@ex.tis.com Mon Oct 30 12:16 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA07533 Mon, 30 Oct 2000 12:16:42 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA00191; Mon, 30 Oct 2000 09:26:44 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Oct 2000 08:04:39 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA16869 for fwtk-users-outgoing; Mon, 30 Oct 2000 08:04:05 -0800 (PST) Message-ID: <39FAB78D.CCACEDFD@geekgang.co.uk> Date: Sat, 28 Oct 2000 12:25:01 +0100 From: pre X-Mailer: Mozilla 4.75 [en] (X11; U; Linux 2.2.14-5.0 i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: Re: FWTK x-gw Security Advisory [GSA2000-01] Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 513 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Whilst that may be true, mjr's coding style isn't exactly good. And he seems to have lost the plot completly lately. -pre ark@eltex.ru said: > > BTW mjr warned me that x-gw is potentially dangerous > some years ago ;) > a brief look at the code shows why - it is far from > being as simple and elegant > as other fwtk components are.. but i had no time to > examine it closer :( From owner-fwtk-users@ex.tis.com Mon Oct 30 12:36 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA07640 Mon, 30 Oct 2000 12:36:36 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA03433; Mon, 30 Oct 2000 09:46:42 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Oct 2000 08:29:56 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA21078 for fwtk-users-outgoing; Mon, 30 Oct 2000 08:29:43 -0800 (PST) Message-ID: <39FDA146.1AEEE53@lclcan.com> Date: Mon, 30 Oct 2000 11:26:46 -0500 From: Don X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk Subject: Re: [Fwd: Problem accessing my own website] References: <39FD82CA.7FF4EB2B@lclcan.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/html; charset=us-ascii Content-Length: 1463 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I may have solved it although it may just be a workaround.  In my
/etc/hosts file, I placed a line for my webserver as follows:

<ip address>    www.mydomain.com
 

Don wrote:

When I ping any Internet address from my firewall/web server, I have success.  However, when I ping www.mydomain.com, I get "unknown host www.mydomain.com".

My /etc/resolv.conf looks like this:

domain mydomain.com
nameserver 127.0.0.1
nameserver <ISP DNS#1>
nameserver (ISP DNS#2>

any recommendations?

Ted Keller wrote:

Don,

Just a coupld of thoughts.

First - verify that your firewall can resolve www.mydomain.com.  Second,
make sure that you have a route defined such that the firewall can contact
www.mydomain.com

ted keller

On Sat, 28 Oct 2000, Don wrote:

> In relation to this problem, I've noted something else.  The previous
> line in my log file states:
>
> http-gw[1352]:log host=unknown/<my ip> protocol=HTTP cmd=dir
> dest=www.my.domain.com path=/
>
> looking at this, I see that the PATH appears to be incorrect???  Where
> wouldthis be configured?
>

From owner-fwtk-users@ex.tis.com Mon Oct 30 15:41 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA08369 Mon, 30 Oct 2000 15:41:42 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA29790; Mon, 30 Oct 2000 12:51:45 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Oct 2000 11:24:20 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA17540 for fwtk-users-outgoing; Mon, 30 Oct 2000 11:24:09 -0800 (PST) Date: Fri, 27 Oct 2000 08:04:28 +0700 (JAVT) From: Moh Riky S To: fwtk-users@lists.nai.com Subject: netacl In-Reply-To: <39F80D7F.67ABDF1F@geekgang.co.uk> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 228 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] How i configure netacl to protect our server from telnet's service ? any body help me, please ! From owner-fwtk-users@ex.tis.com Mon Oct 30 18:16 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA08938 Mon, 30 Oct 2000 18:16:18 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA23228; Mon, 30 Oct 2000 15:26:13 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Oct 2000 13:59:00 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA10268 for fwtk-users-outgoing; Mon, 30 Oct 2000 13:58:49 -0800 (PST) Message-ID: <39FDEE44.E95D3413@lclcan.com> Date: Mon, 30 Oct 2000 16:55:16 -0500 From: Don X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk Subject: using FWTK 2.1 with Yahoo messnager Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/html; charset=us-ascii Content-Length: 410 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Has anyone had a problem using Yahoo IM with the FWTK?  I configured Yahoo to use HTTP proxy on port 81.  It actually does connect but then immediately drops the connection.

Thanks,
Don From owner-fwtk-users@ex.tis.com Mon Oct 30 18:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA08981 Mon, 30 Oct 2000 18:32:35 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA25030; Mon, 30 Oct 2000 15:42:31 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Oct 2000 14:26:25 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA14008 for fwtk-users-outgoing; Mon, 30 Oct 2000 14:26:03 -0800 (PST) Date: Mon, 30 Oct 2000 17:23:42 -0500 (EST) From: Ted Keller To: Don cc: fwtk Subject: Re: [Fwd: Problem accessing my own website] In-Reply-To: <39FD82CA.7FF4EB2B@lclcan.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1725 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Don, Looks like your domain is not validating correctly. Since your firewall is a valid name server, I assume it is either primary or secondary for mydomain.com. Try... nslookup nslookup> ls -d mydomain.com it should dump out the contents of your zone file. If it fails with an unspecified error, then either the domain did not validate or your local system is not a valid secondary or primary for that domain. Let's get the DNS issue solved first. ted keller On Mon, 30 Oct 2000, Don wrote: > When I ping any Internet address from my firewall/web server, I have > success. However, when I ping www.mydomain.com, I get "unknown host > www.mydomain.com". > > My /etc/resolv.conf looks like this: > > domain mydomain.com > nameserver 127.0.0.1 > nameserver > nameserver (ISP DNS#2> > > any recommendations? > > Ted Keller wrote: > > Don, > > Just a coupld of thoughts. > > First - verify that your firewall can resolve > www.mydomain.com. Second, > make sure that you have a route defined such that the > firewall can contact > www.mydomain.com > > ted keller > > On Sat, 28 Oct 2000, Don wrote: > > > In relation to this problem, I've noted something else. > The previous > > line in my log file states: > > > > http-gw[1352]:log host=unknown/ protocol=HTTP > cmd=dir > > dest=www.my.domain.com path=/ > > > > looking at this, I see that the PATH appears to be > incorrect??? Where > > wouldthis be configured? > > > > > From owner-fwtk-users@ex.tis.com Mon Oct 30 18:51 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA09055 Mon, 30 Oct 2000 18:51:07 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA27159; Mon, 30 Oct 2000 16:01:04 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Oct 2000 14:43:31 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA16446 for fwtk-users-outgoing; Mon, 30 Oct 2000 14:43:06 -0800 (PST) Date: Mon, 30 Oct 2000 17:40:20 -0500 (EST) From: Ted Keller To: Moh Riky S cc: fwtk-users@lists.nai.com Subject: Re: netacl In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 613 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Moh Riky, I assume you want to permit certain hosts to telnet to the firewall while preventing all other hosts from doing that. Check out question 2.9.2 on the www.fwtk.org site. ted keller On Fri, 27 Oct 2000, Moh Riky S wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > How i configure netacl to protect our server from telnet's service ? > > any body help me, please ! > From owner-fwtk-users@ex.tis.com Mon Oct 30 20:21 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA09267 Mon, 30 Oct 2000 20:21:04 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA08019; Mon, 30 Oct 2000 17:30:50 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Oct 2000 16:02:11 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA27227 for fwtk-users-outgoing; Mon, 30 Oct 2000 16:01:50 -0800 (PST) Message-Id: <5.0.0.25.0.20001030184710.01d26da0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0 Date: Mon, 30 Oct 2000 18:47:57 -0500 To: "Barreira, Fernando [IT]" , "'fwtk-support@tis.com'" , "'fwtk-users@tis.com'" From: Rick Murphy Subject: Re: how to apply the patch to fwtk2.1 In-Reply-To: <3D6CFAEE245FD411938A00508BE3714801338578@exchnj01.nj.ssmb. com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 500 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:20 AM 10/30/00 -0500, Barreira, Fernando [IT] wrote: > hi there, > > i need to apply this patch "2.9 Patch for specifying ftp data port >in netperm-table [2.1]" > is there any information on how to do it? You use the patch utility on your system - cd to the ftp-gw directory, then 'patch -p0 In-Reply-To: <39FAB78D.CCACEDFD@geekgang.co.uk> from "pre " Organization: "Klingon Imperial Intelligence Service" Subject: Re: FWTK x-gw Security Advisory [GSA2000-01] To: pre@geekgang.co.uk Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1139 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] nuqneH, Ok, he abused copy-block programming somehow, but it is much better than things written by TIS/NAI after he left anyways ;). pre said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > Whilst that may be true, mjr's coding style isn't exactly good. And he > seems to have lost the plot completly lately. > > -pre > > ark@eltex.ru said: > > > > BTW mjr warned me that x-gw is potentially dangerous > > some years ago ;) > > a brief look at the code shows why - it is far from > > being as simple and elegant > > as other fwtk components are.. but i had no time to > > examine it closer :( > _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! From owner-fwtk-users@ex.tis.com Tue Oct 31 15:19 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA12810 Tue, 31 Oct 2000 15:19:40 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA27044; Tue, 31 Oct 2000 12:29:23 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 31 Oct 2000 10:23:30 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA09333 for fwtk-users-outgoing; Tue, 31 Oct 2000 10:23:19 -0800 (PST) Message-ID: From: "Glen, Mike" To: "'fwtk-users@lists.nai.com'" Subject: newbie question Date: Tue, 31 Oct 2000 13:22:04 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 641 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi All, I'm trying to setup ftp-gw, and I can connect to the proxy and login with no problem, however, when i try to use the user command and connect to a ftp site I get an error that says "no match in netperm-table for "user" to ftp to xxx.xxx.xxx.xxx. I thought it had something to do with the operation command in authsrv but I can't seem to get that working either, this is what I get authsrv# operation user mglen ftp-gw * No match in netperm-table any help would be greatly appreciated. Regards, Mike From owner-fwtk-users@ex.tis.com Tue Oct 31 15:48 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA12937 Tue, 31 Oct 2000 15:48:21 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA00966; Tue, 31 Oct 2000 12:58:19 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 31 Oct 2000 11:43:08 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA19476 for fwtk-users-outgoing; Tue, 31 Oct 2000 11:42:57 -0800 (PST) From: Chris Wakelin To: fwtk-users@tis.com Subject: Patch for ftp-gw to restrict passive ports for incoming FTP In-Reply-To: <3D6CFAEE245FD411938A00508BE3714801338578@exchnj01.nj.ssmb.com> Message-ID: Date: Tue, 31 Oct 2000 19:40:58 +0000 (GMT Standard Time) X-Mailer: Simeon for Win32 Version 4.1.1 Build (17) X-Authentication: none MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: MULTIPART/MIXED; BOUNDARY="Part10010311958.I" Content-Length: 4629 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --Part10010311958.I Content-Type: TEXT/PLAIN; CHARSET=US-ASCII Hi all, I've been fiddling with fwtk and IP-filter on Solaris and came across the need to restrict the ports allocated by ftp-gw for incoming passive FTP data. According to the IP-filter HowTo, WU-FTPD has a configuration option for this. The attached patch adds two extra options to netperm-table e.g.: ftp-gw: pasv-from-port 30000 ftp-gw: pasv-to-port 31000 allocates passive data ports in the range 30000-31000. If one or both of the options are not present, ftp-gw should behave in the normal way. The patch (probably) assumes you have the PASV patch (2.1.1 in the list of patches at www.fwtk.org) installed. I'm not an experienced programmer, so I ripped the port-binding code out of socket.c in x-gw. It's quite possible I've done something silly, so I'd appreciate it if the more experienced people on this list could give it a once-over (it's quite a small patch) and let me (and the list) know if it's bad. Best Wishes, Chris --+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-- Christopher Wakelin, c.d.wakelin@reading.ac.uk IT Services Centre, The University of Reading, Tel: +44 (0)118 931 6630 Whiteknights, Reading, RG6 2AF, UK Fax: +44 (0)118 975 3094 --Part10010311958.I Content-Type: APPLICATION/octet-stream; name="pasv_port.diff" Content-Transfer-Encoding: BASE64 LS0tIGZ0cC1ndy5jLm9yZwlUdWUgT2N0IDMxIDEwOjI2OjM5IDIwMDAKKysr IGZ0cC1ndy5jCVR1ZSBPY3QgMzEgMTA6MjY6MDggMjAwMApAQCAtOTIsNiAr OTIsOSBAQAogc3RhdGljCWludAkJCXRpbWVvdXQgPSBQUk9YWV9USU1FT1VU Owogc3RhdGljCWludAkJCWRhdGFfcG9ydCA9IDA7CiAKK3N0YXRpYyAgaW50 CQkJcGFzdl9mcm9tX3BvcnQgPSAwOworc3RhdGljICBpbnQJCQlwYXN2X3Rv X3BvcnQgPSAwOworCiAKIHN0YXRpYwlpbnQJY21kX3VzZXIoKTsKIHN0YXRp YwlpbnQJY21kX2F1dGhvcml6ZSgpOwpAQCAtMjgzLDYgKzI4NiwyMiBAQAog CWRhdGFfcG9ydCA9IHN0cl90b19wb3J0KGNmLT5hcmd2WzBdKTsKIAl9CiAK KwlpZigoY2YgPSBjZmdfZ2V0KCJwYXN2LWZyb20tcG9ydCIsY29uZnApKSAh PSAoQ2ZnICopMCkgeworCQlpZiAoY2YtPmFyZ2MgIT0gMSkgeworCQkJc3lz bG9nKExMRVYsICJmd3RrY2ZnZXJyOiBwYXN2LWZyb20tcG9ydCBtdXN0IGhh dmUgYW4gYXJndW1lbnQsIGxpbmUgJWQiLCBjZi0+bG4pOworCQkJZXhpdCgx KTsKKwkJfQorCXBhc3ZfZnJvbV9wb3J0ID0gc3RyX3RvX3BvcnQoY2YtPmFy Z3ZbMF0pOworCX0KKworCWlmKChjZiA9IGNmZ19nZXQoInBhc3YtdG8tcG9y dCIsY29uZnApKSAhPSAoQ2ZnICopMCkgeworCQlpZiAoY2YtPmFyZ2MgIT0g MSkgeworCQkJc3lzbG9nKExMRVYsICJmd3RrY2ZnZXJyOiBwYXN2LXRvLXBv cnQgbXVzdCBoYXZlIGFuIGFyZ3VtZW50LCBsaW5lICVkIiwgY2YtPmxuKTsK KwkJCWV4aXQoMSk7CisJCX0KKwlwYXN2X3RvX3BvcnQgPSBzdHJfdG9fcG9y dChjZi0+YXJndlswXSk7CisJfQorCiAJaWYoKGNmID0gY2ZnX2dldCgiZGly ZWN0b3J5Iixjb25mcCkpICE9IChDZmcgKikwKSB7CiAJCWlmKGNmLT5hcmdj ICE9IDEpIHsKIAkJCXN5c2xvZyhMTEVWLCJmd3RrY2ZnZXJyOiBkaXJlY3Rv cnkgbXVzdCBoYXZlIG9uZSBwYXJhbWV0ZXIsIGxpbmUgJWQiLGNmLT5sbik7 CkBAIC0xMzMwLDYgKzEzNDksNyBAQAogCXVuc2lnbmVkIGNoYXIJCSpsOwog CWNoYXIJCQlidWZbNTEyXTsKIAljaGFyCQkJYmJ1Zls1MTJdOworICAgICAg ICBpbnQJCQlpOwogCiAJLyogb2ssIG5vdyBidWlsZCBhbmQgYmluZCBhIHNv Y2tldCAqLwogCWlmKGJvdW5kcG9ydCAhPSAtMSkKQEAgLTEzNTEsMTEgKzEz NzEsMzIgQEAKIAkJcmV0dXJuKHNheSgwLGJ1ZikpOwogCX0KIAliY29weSgo Y2hhciAqKSZuLnNpbl9hZGRyLChjaGFyICopJnIuc2luX2FkZHIsc2l6ZW9m KG4uc2luX2FkZHIpKTsKLQlyLnNpbl9wb3J0ID0gMDsKLQlpZihiaW5kKHBh c3Zwb3J0LChzdHJ1Y3Qgc29ja2FkZHIgKikmcixzaXplb2YocikpKSB7Ci0J CXNwcmludGYoYnVmLCI1MjEgUEFTViBiaW5kOiAlcyIsc3RyZXJyb3IoZXJy bm8pKTsKLQkJcmV0dXJuKHNheSgwLGJ1ZikpOworCisvKiBBZGRpdGlvbiB0 byBiaW5kIGEgcG9ydCBpbiBnaXZlbiByYW5nZSBmb3IgUEFTViBkYXRhIGNv bm5lY3Rpb24KKyAqICAgICAgQmFzZWQgb24gYmluZHBvcnQoKSBmcm9tIC4u L3gtZ3cvc29ja2V0LmMKKyAqICAgICAgSWYgcGFzdl9mcm9tX3BvcnQgaXMg MCB0aGVuIHNob3VsZCBnaXZlIG9yaWdpbmFsIGZ0cC1ndyBiZWhhdmlvdXIK KyAqLworCisJci5zaW5fcG9ydCA9IGh0b25zKHBhc3ZfZnJvbV9wb3J0KTsK KworCWlmKChwYXN2X2Zyb21fcG9ydCA+IHBhc3ZfdG9fcG9ydCkgfHwgKHBh c3ZfZnJvbV9wb3J0ID09IDApKQorCQlwYXN2X3RvX3BvcnQgPSBwYXN2X2Zy b21fcG9ydDsKKworCWkgPSBwYXN2X2Zyb21fcG9ydDsKKwl3aGlsZShiaW5k KHBhc3Zwb3J0LChzdHJ1Y3Qgc29ja2FkZHIgKikmcixzaXplb2YocikpIDwg MCkgeworCQlpZihlcnJubyA9PSBFQUREUklOVVNFKSB7CisJCQlpKys7CisJ CQlpZihpID4gcGFzdl90b19wb3J0KSB7CisJCQkJc3ByaW50ZihidWYsIjUy MSBQQVNWIGFsbCBwb3J0cyBhcmUgaW4gdXNlIik7CisJCQkJcmV0dXJuKHNh eSgwLGJ1ZikpOworCQkJfQorCQkJci5zaW5fcG9ydCA9IGh0b25zKGkpOwor CQl9IGVsc2UgeworCQkJc3ByaW50ZihidWYsIjUyMSBQQVNWIGJpbmQ6ICVz IixzdHJlcnJvcihlcnJubykpOworCQkJcmV0dXJuKHNheSgwLGJ1ZikpOwor CQl9CiAJfQorCiAJaWYobGlzdGVuKHBhc3Zwb3J0LDEpIDwgMCkgewogCQlz cHJpbnRmKGJ1ZiwiNTIxIFBBU1YgbGlzdGVuOiAlcyIsc3RyZXJyb3IoZXJy bm8pKTsKIAkJcmV0dXJuKHNheSgwLGJ1ZikpOwo= --Part10010311958.I-- From owner-fwtk-users@ex.tis.com Tue Oct 31 19:06 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA13429 Tue, 31 Oct 2000 19:06:39 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA27265; Tue, 31 Oct 2000 16:16:07 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 31 Oct 2000 14:49:01 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA18169 for fwtk-users-outgoing; Tue, 31 Oct 2000 14:48:30 -0800 (PST) Message-Id: <5.0.1.3.0.20001031171933.01d4e5d0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.1.3 (Beta) Date: Tue, 31 Oct 2000 17:31:38 -0500 To: ark@eltex.ru, pre@geekgang.co.uk From: Rick Murphy Subject: Re: FWTK x-gw Security Advisory [GSA2000-01] Cc: fwtk-users@lists.nai.com In-Reply-To: <200010311136.OAA15235@paranoid.alpha.int> References: <39FAB78D.CCACEDFD@geekgang.co.uk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 928 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 02:36 PM 10/31/00 +0300, ark@eltex.ru wrote: >nuqneH, > >Ok, he abused copy-block programming somehow, but it is much better than >things written by TIS/NAI after he left anyways ;). Just FYI: Marcus didn't write all of the FWTK. I don't think any of x-gw is his code. Nor is any of http-gw. I do appreciate the 'compliment' though. Gee, I thought I wrote pretty good code. Actually, I'd say that some of the firewall code written after Marcus left - particularly the Gauntlet for NT proxies - were quite an improvement. (I can say that unbiased since I didn't write any of it.) I haven't seen Gauntlet for Unix source since 4.0 so I can't judge the quality. I assume you have seen recent Gauntlet source or have some other reason to deem the recent code not worthy. :-) -Rick From owner-fwtk-users@ex.tis.com Tue Oct 31 19:58 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA13576 Tue, 31 Oct 2000 19:58:19 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA00759; Tue, 31 Oct 2000 17:07:58 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 31 Oct 2000 15:51:36 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA25400 for fwtk-users-outgoing; Tue, 31 Oct 2000 15:51:04 -0800 (PST) From: ark@eltex.ru Message-Id: <200010312342.CAA17783@paranoid.alpha.int> Subject: Re: FWTK x-gw Security Advisory [GSA2000-01] To: rmurphy@itm-inst.com (Rick Murphy) Date: Wed, 1 Nov 2000 02:42:43 +0300 (MSK) Cc: ark@eltex.ru, pre@geekgang.co.uk, fwtk-users@lists.nai.com Reply-To: ark@eltex.ru In-Reply-To: <5.0.1.3.0.20001031171933.01d4e5d0@mail.itm-inst.com> from "Rick Murphy" at Oct 31, 2000 05:31:38 PM X-Mailer: ELM [version 2.5 PL3] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1657 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] nuqneH, > >Ok, he abused copy-block programming somehow, but it is much better than > >things written by TIS/NAI after he left anyways ;). > > Just FYI: Marcus didn't write all of the FWTK. I don't think any of x-gw is > his code. > Nor is any of http-gw. I know. I also don't use http-gw because squid-gw looks better for me ;) > > I do appreciate the 'compliment' though. Gee, I thought I wrote pretty good > code. Sorry, you misunderstood me - i was talking about http-gw (not to say http-gw is really bad - but it looks too big for such programming style), x-gw and things that did not go into fwtk but are/were present in Gauntlet. (some are really nasty) > Actually, I'd say that some of the firewall code written after Marcus left > - particularly the Gauntlet for NT proxies - were quite an improvement. (I > can say that unbiased since I didn't write any of it.) Sure it is possible, but.. > I haven't seen Gauntlet for Unix source since 4.0 so I can't judge the > quality. I assume you have seen recent Gauntlet source or have some other > reason to deem the recent code not worthy. :-) Nope, i was talking about 3.2 and 4.0 - i don't have newer code too :( (it would be interesting to have a look, though) _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! From owner-fwtk-users@ex.tis.com Tue Oct 31 21:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA13873 Tue, 31 Oct 2000 21:22:36 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA05309; Tue, 31 Oct 2000 18:32:04 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 31 Oct 2000 17:06:54 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA00672 for fwtk-users-outgoing; Tue, 31 Oct 2000 17:06:14 -0800 (PST) Date: Tue, 31 Oct 2000 17:14:07 -0800 From: Carson Gaspar To: Rick Murphy , ark@eltex.ru, pre@geekgang.co.uk Cc: fwtk-users@lists.nai.com Subject: Re: FWTK x-gw Security Advisory [GSA2000-01] Message-ID: <2349838928.973012447@[192.168.5.161]> In-Reply-To: <5.0.1.3.0.20001031171933.01d4e5d0@mail.itm-inst.com> X-Mailer: Mulberry/2.0.5 (Win32) MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii; format=flowed Content-Length: 1468 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --On Tuesday, October 31, 2000 5:31 PM -0500 Rick Murphy wrote: > I haven't seen Gauntlet for Unix source since 4.0 so I can't judge the > quality. I assume you have seen recent Gauntlet source or have some other > reason to deem the recent code not worthy. :-) -Rick I have seen it. The new code is better at first glance, but a lot of old bad code is still lying around. As of 5.5 (and supposedly patched 5.0 - I don't have patch source so I can't tell for sure), all the _really_ nasty things I'd found have been fixed. SMAP was still a disaster in 5.5 - it leaves files littering your spool directory until you manually delete them due to bad file locking design and clients that abort mail transmissions. It also doesn't log failures under various edge conditions. There were still signal races in some proxies as well, as I recall, but I think they've been patched since 5.5's release. I will definitely agree that the 4.x code base was, ummm..., differently coded. :) I have yet to do a real audit of the PDK code. At this point I'm waiting 'till I get the 6.0 code, rather than look at 5.5 code and finding bugs that have already been fixed. I also have to get motivated enough to trudge through thread locking stuff :) -- Carson Gaspar - carson@taltos.org Queen trapped in a butch body From owner-fwtk-users@ex.tis.com Tue Oct 31 23:31 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA15870 Tue, 31 Oct 2000 23:31:33 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA09555; Tue, 31 Oct 2000 20:41:21 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 31 Oct 2000 19:13:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA06736 for fwtk-users-outgoing; Tue, 31 Oct 2000 19:13:19 -0800 (PST) Message-Id: <5.0.1.3.0.20001031220351.01d790b0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.1.3 (Beta) Date: Tue, 31 Oct 2000 22:06:57 -0500 To: ark@eltex.ru From: Rick Murphy Subject: Re: FWTK x-gw Security Advisory [GSA2000-01] Cc: ark@eltex.ru, fwtk-users@lists.nai.com In-Reply-To: <200010312342.CAA17783@paranoid.alpha.int> References: <5.0.1.3.0.20001031171933.01d4e5d0@mail.itm-inst.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 643 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 02:42 AM 11/1/00 +0300, ark@eltex.ru wrote: >Sorry, you misunderstood me - i was talking about http-gw (not to say http-gw >is really bad - but it looks too big for such programming style), x-gw and >things that did not go into fwtk but are/were present in Gauntlet. >(some are really nasty) No, didn't misunderstand - just pointing out that the reality isn't so black and white. Someone who takes credit for fwtk gets credit for it all, warts included. Just giving you a bit of a tweak. :-) -Rick