From owner-fwtk-users@ex.tis.com Wed Nov 1 16:42 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA20167 Wed, 1 Nov 2000 16:42:19 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA10085; Wed, 1 Nov 2000 13:52:25 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 1 Nov 2000 11:35:00 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA23424 for fwtk-users-outgoing; Wed, 1 Nov 2000 11:34:48 -0800 (PST) X-Authentication-Warning: cor_smtp: smap set sender to using -f Message-ID: <037D9C3BD3CDD311B45A009027DE2EF8CB84AE@DIAMOND> From: "Hutchison, Chris" To: fwtk-users@lists.nai.com Subject: NT Security - FW: Q251199 - Error Message HTTP 401.2 - Unauthoriz ed Logon Failed Du e to Server Co Date: Wed, 1 Nov 2000 14:33:38 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id LAA23399 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 4453 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I am getting the following error while trying to access a remote web server. They are running NT Security. Does anyone have any idea how I can get around this? Chris -----Original Message----- From: Allen Kim [mailto:KimA@SAMG.com] Sent: Tuesday, October 31, 2000 4:25 PM To: 'chris.hutchison@brewers.com' Subject: Q251199 - Error Message HTTP 401.2 - Unauthorized Logon Failed Du e to Server Co Maybe this will help. I'll continue looking..... _____ TOPTOP Microsoft Product Support Services All Products | Support | Search | microsoft.com Home microsoft.com Support Home | Self Support | Assisted Support | Custom Support | Worldwide Support | Error Message: HTTP 401.2 - Unauthorized: Logon Failed Due to Server Configuration _____ The information in this article applies to: * Microsoft Internet Information Services version 5.0 _____ SYMPTOMS When you use Internet Explorer to browse an intranet Web site by its IP address (rather than its NetBIOS machine name), and that site uses integrated Windows authentication, the following error message occurs: You are not authorized to view this page You do not have permission to view this directory or page using the credentials you supplied. HTTP 401.2 - Unauthorized: Logon failed due to server configuration Internet Information Services CAUSE Internet Explorer uses a period (.) in the URL to determine if the address is on the (external) Internet, rather than the (internal) intranet. In this situation, because the IP address uses periods, Internet Explorer identifies the URL as an external site, and does not attempt to initiate the authentication session because integrated Windows authentication does not work across a firewall or proxy. RESOLUTION On the client computer, set Internet Explorer to not use the proxy server for that particular IP address. To do this in Internet Explorer 5.0, perform the following steps: 1. On the Tools menu, click Internet Options. 2. On the Connections tab, click LAN Settings. 3. Click Advanced, and then type the IP address under Exceptions. (c) Microsoft Corporation 2000, All Rights Reserved. Contributions by Kevin Zollman, Microsoft Corporation. Additional query words: IIS 5 ntlm challenge/response challenge\response challenge-response challenge response ie 401-2 internet protocol akz Keywords : kbWinOS2000 Issue type : kbprb Technology : kbvcSearch Last Reviewed: August 3, 2000 © 2000 Microsoft Corporation. All rights reserved. Terms of Use. Article ID: Q251199 Last Reviewed: August 3, 2000 Send to a friend Provided by Microsoft Product Support Services _____ Did the information in this article help answer your question? Yes No Did not apply Please provide additional comments about this information. (255 character max) From owner-fwtk-users@ex.tis.com Thu Nov 2 10:30 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA22973 Thu, 2 Nov 2000 10:30:03 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA12099; Thu, 2 Nov 2000 07:40:14 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Nov 2000 06:05:11 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA01738 for fwtk-users-outgoing; Thu, 2 Nov 2000 06:04:49 -0800 (PST) Message-ID: <3A0173EF.8E6FF5B2@lclcan.com> Date: Thu, 02 Nov 2000 09:02:24 -0500 From: Don X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en MIME-Version: 1.0 To: Ted Keller CC: fwtk Subject: Re: [Fwd: Problem accessing my own website] References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 2576 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello Ted, I tried the nslookup on my domain and received the following: ============================== > www.mydomain.com Server: localhost Address: 127.0.0.1 *** localhost can't find www.mydomain.com: Non-existent host/domain ============================== Of course, I attempted the above on outside domains with success! So, it appears that there is a subtle problem with my DNS. I say subtle because: a) requests to access my web site from the outside are successful b) sending mail from the outside in and vice versa works fine I don't know if this is a clue but my /etc/messages file is littered with the following: sysquery: findns error (NXDOMAIN) on myserver.mydomain.com? Thanks for your assistance, Don Ted Keller wrote: > Don, > > Looks like your domain is not validating correctly. Since your firewall > is a valid name server, I assume it is either primary or secondary for > mydomain.com. Try... > > nslookup > nslookup> ls -d mydomain.com > > it should dump out the contents of your zone file. If it fails with an > unspecified error, then either the domain did not validate or your local > system is not a valid secondary or primary for that domain. > > Let's get the DNS issue solved first. > > ted keller > > On Mon, 30 Oct 2000, Don wrote: > > > When I ping any Internet address from my firewall/web server, I have > > success. However, when I ping www.mydomain.com, I get "unknown host > > www.mydomain.com". > > > > My /etc/resolv.conf looks like this: > > > > domain mydomain.com > > nameserver 127.0.0.1 > > nameserver > > nameserver (ISP DNS#2> > > > > any recommendations? > > > > Ted Keller wrote: > > > > Don, > > > > Just a coupld of thoughts. > > > > First - verify that your firewall can resolve > > www.mydomain.com. Second, > > make sure that you have a route defined such that the > > firewall can contact > > www.mydomain.com > > > > ted keller > > > > On Sat, 28 Oct 2000, Don wrote: > > > > > In relation to this problem, I've noted something else. > > The previous > > > line in my log file states: > > > > > > http-gw[1352]:log host=unknown/ protocol=HTTP > > cmd=dir > > > dest=www.my.domain.com path=/ > > > > > > looking at this, I see that the PATH appears to be > > incorrect??? Where > > > wouldthis be configured? > > > > > > > > > From owner-fwtk-users@ex.tis.com Thu Nov 2 11:00 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA23091 Thu, 2 Nov 2000 11:00:07 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA16806; Thu, 2 Nov 2000 08:10:31 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 2 Nov 2000 06:54:26 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA07195 for fwtk-users-outgoing; Thu, 2 Nov 2000 06:54:05 -0800 (PST) Message-Id: <5.0.0.25.0.20001102092524.00afc580@mailhost.csca.ryerson.ca> X-Sender: pdunphy@mailhost.csca.ryerson.ca X-Mailer: QUALCOMM Windows Eudora Version 5.0 Date: Thu, 02 Nov 2000 09:33:14 -0500 To: Don From: Paul Dunphy Subject: Re: [Fwd: Problem accessing my own website] Cc: fwtk-users@lists.nai.com In-Reply-To: <3A0173EF.8E6FF5B2@lclcan.com> References: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 3935 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Don, Is it possible that your internal name server (127.0.0.1) is authoritative for mydomain.com, but does not have an entry for "www" in its db files? If that is the case, it will not query the ISP's DNS servers, since it is believes that it is authoritative for your domain; it will simply say that the host does not exist. Outside systems, however, probably query the ISP DNS servers first, which are able to resolve the address. A similar thing happened to me recently when I set up split DNS - it seems I forgot to put an entry for www on the internal DNS server, so machines on the outside could resolve it (using the external DNS server), but those on the inside couldn't. Hope this helps, Paul At 09:02 AM 11/2/00 -0500, you wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >Hello Ted, > >I tried the nslookup on my domain and received the following: > >============================== > > www.mydomain.com >Server: localhost >Address: 127.0.0.1 > >*** localhost can't find www.mydomain.com: Non-existent host/domain >============================== > >Of course, I attempted the above on outside domains with success! > >So, it appears that there is a subtle problem with my DNS. I say subtle >because: > >a) requests to access my web site from the outside are successful >b) sending mail from the outside in and vice versa works fine > >I don't know if this is a clue but my /etc/messages file is littered with the >following: > >sysquery: findns error (NXDOMAIN) on myserver.mydomain.com? > >Thanks for your assistance, >Don > >Ted Keller wrote: > > > Don, > > > > Looks like your domain is not validating correctly. Since your firewall > > is a valid name server, I assume it is either primary or secondary for > > mydomain.com. Try... > > > > nslookup > > nslookup> ls -d mydomain.com > > > > it should dump out the contents of your zone file. If it fails with an > > unspecified error, then either the domain did not validate or your local > > system is not a valid secondary or primary for that domain. > > > > Let's get the DNS issue solved first. > > > > ted keller > > > > On Mon, 30 Oct 2000, Don wrote: > > > > > When I ping any Internet address from my firewall/web server, I have > > > success. However, when I ping www.mydomain.com, I get "unknown host > > > www.mydomain.com". > > > > > > My /etc/resolv.conf looks like this: > > > > > > domain mydomain.com > > > nameserver 127.0.0.1 > > > nameserver > > > nameserver (ISP DNS#2> > > > > > > any recommendations? > > > > > > Ted Keller wrote: > > > > > > Don, > > > > > > Just a coupld of thoughts. > > > > > > First - verify that your firewall can resolve > > > www.mydomain.com. Second, > > > make sure that you have a route defined such that the > > > firewall can contact > > > www.mydomain.com > > > > > > ted keller > > > > > > On Sat, 28 Oct 2000, Don wrote: > > > > > > > In relation to this problem, I've noted something else. > > > The previous > > > > line in my log file states: > > > > > > > > http-gw[1352]:log host=unknown/ protocol=HTTP > > > cmd=dir > > > > dest=www.my.domain.com path=/ > > > > > > > > looking at this, I see that the PATH appears to be > > > incorrect??? Where > > > > wouldthis be configured? > > > > > > > > > > > > > --------------------------------------------------------------------- Paul T. Dunphy, P.Eng. Systems Administrator/Research Engineer Centre for the Study of Commercial Activity Ryerson Polytechnic University Toronto, Ontario, CANADA Phone: (416) 979-5000 ext. 7537 Fax: (416) 979-5378 E-mail: pdunphy@csca.ryerson.ca From owner-fwtk-users@ex.tis.com Fri Nov 3 05:27 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA25961 Fri, 3 Nov 2000 05:27:29 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA11492; Fri, 3 Nov 2000 02:37:43 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 3 Nov 2000 00:28:13 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA07980 for fwtk-users-outgoing; Fri, 3 Nov 2000 00:27:52 -0800 (PST) Date: Tue, 31 Oct 2000 16:13:47 +0700 (JAVT) From: Moh Riky S To: Ted Keller cc: fwtk-users@lists.nai.com Subject: Re: netacl In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 746 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I mean a aplication with authsrv and netacl On Mon, 30 Oct 2000, Ted Keller wrote: > Moh Riky, > > I assume you want to permit certain hosts to telnet to the firewall while > preventing all other hosts from doing that. > > Check out question 2.9.2 on the www.fwtk.org site. > > ted keller > > > On Fri, 27 Oct 2000, Moh Riky S wrote: > > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > How i configure netacl to protect our server from telnet's service ? > > > > any body help me, please ! > > > > From owner-fwtk-users@ex.tis.com Fri Nov 3 16:01 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA28075 Fri, 3 Nov 2000 16:01:29 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA11726; Fri, 3 Nov 2000 13:11:21 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 3 Nov 2000 11:36:51 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA29756 for fwtk-users-outgoing; Fri, 3 Nov 2000 11:36:30 -0800 (PST) Date: Fri, 3 Nov 2000 14:33:26 -0500 (EST) From: Ted Keller To: Moh Riky S cc: fwtk-users@lists.nai.com Subject: Re: netacl In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1445 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Moh Riky, Authsrv is an application for authenticating users to the firewall's proxy services. This does not need to run under netacl. Authserv has support enherently to allow specific remote computers to access via the authmgr for user maintenance. netacl is an application that is used to run specific other applications - from specific trusted hosts or networks. I guess I'm not sure what you are asking for? Please explain a bit more. thanks ted keller On Tue, 31 Oct 2000, Moh Riky S wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > I mean a aplication with authsrv and netacl > > On Mon, 30 Oct 2000, Ted Keller wrote: > > > Moh Riky, > > > > I assume you want to permit certain hosts to telnet to the firewall while > > preventing all other hosts from doing that. > > > > Check out question 2.9.2 on the www.fwtk.org site. > > > > ted keller > > > > > > On Fri, 27 Oct 2000, Moh Riky S wrote: > > > > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > > > > How i configure netacl to protect our server from telnet's service ? > > > > > > any body help me, please ! > > > > > > > > From owner-fwtk-users@ex.tis.com Tue Nov 7 09:06 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA11213 Tue, 7 Nov 2000 09:06:58 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA18003; Tue, 7 Nov 2000 06:17:58 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Nov 2000 05:33:12 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA14799 for fwtk-users-outgoing; Tue, 7 Nov 2000 05:33:07 -0800 (PST) X-Authentication-Warning: cor_smtp: smap set sender to using -f Message-ID: <037D9C3BD3CDD311B45A009027DE2EF8CB84D9@DIAMOND> From: "Hutchison, Chris" To: fwtk-users@lists.nai.com Subject: Smapd - rejecting other domains Date: Tue, 7 Nov 2000 08:32:04 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 961 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have been running the TIS toolkit for quite some time now and have recently comes across the following problem. When running smapd I setup my local-domain as "mydomain.com" This works fine with one exception. If someone sends mail to bob@host.mydomain.com I will get an error message as "host.mydomain.com" does not exist. This is happening quite frequently as some has a domain called "hostmydomain.com" and people are using "host.mydomain.com" resulting in mail going to the wrong site. As I only want to receive mail from user@mydomain.com and not user@host.mydomain.com I would like to reject all mail not addressed to "mydomain.com". I am hoping there is an easy way to do this. Any help is greatly appreciated. Thanks Chris From owner-fwtk-users@ex.tis.com Tue Nov 7 09:07 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA11216 Tue, 7 Nov 2000 09:07:02 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA18013; Tue, 7 Nov 2000 06:18:06 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Nov 2000 05:02:21 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA13550 for fwtk-users-outgoing; Tue, 7 Nov 2000 05:02:04 -0800 (PST) 1. Cut Government in half 2. Wait thirty years 3. Repeat as necessary Message-Id: <200011070247.SAA12694@noid.net> X-Mini-Diatribe: To fix America: 1. Cut Government in half 2. Wait thirty years 3. Repeat as necessary Date: Mon, 6 Nov 2000 18:47:32 -0800 From: Tor Perkins <973561477@noid.net> To: fwtk-users@lists.nai.com Subject: Re: ftp-gw and windows nt Mail-Followup-To: fwtk-users@lists.nai.com References: Mime-Version: 1.0 X-Mailer: Mutt 1.0i In-Reply-To: ; from luba@assist.com.gt on Thu, Oct 26, 2000 at 02:59:22PM -0600 X-Operating-System: Linux 2.2.17pre19 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1169 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] When using this patch, and configuring for "pasv true", any server that refuses to honor PASV requests will fail. This is because ftp-gw will not fall back to PORT. That is what's meant by: CAVEAT: We're in trouble if the remote 502's us; we don't fall back... :^) ... in the doco-blurb that accompanies the patch. This is the FTP protocol's biggest problem. The patch is not a perfect fix. It let's you do FTP through a restrictive packet screen to servers that do PASV, which fortunately, is most of the servers "out there". If you are not dealing with any packet filters, then it's probably best not to use this patch. - Tor On Thu, Oct 26, 2000 at 02:59:22PM -0600, Luis Fernando Barrera wrote: > > Hi, > > I just applied the Tor's PASV patch to the ftp-gw proxy... However > when I try to connect to some Windows NT/2000 ftp server, I get > the message "cannot decode port". With the Unix/Linux ftp servers > I got no problem... > > Has anybody experieced this problem? What is it all about? > From owner-fwtk-users@ex.tis.com Tue Nov 7 12:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA15207 Tue, 7 Nov 2000 12:32:18 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA12393; Tue, 7 Nov 2000 09:31:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Nov 2000 08:47:30 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA03784 for fwtk-users-outgoing; Tue, 7 Nov 2000 08:47:24 -0800 (PST) Message-Id: Mime-Version: 1.0 Date: Tue, 7 Nov 2000 17:45:58 -0800 To: fwtk-users@lists.nai.com From: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.) Subject: Makefile for IRIX Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 552 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I need the Makefile.config.IRIX file for the fwtk. Thanks! /--------------------------------o00-----00o-------------------------\ Stefan Heim Uni Ulm Sektion Informatik in der Psychotherapie Am Hochstraess 8 89081 Ulm Germany E-Mail: heim@sip.Medizin.Uni-Ulm.de http://sip.medizin.uni-ulm.de Tel: +49-(0)731-50-25702 Fax: +49-(0)731-50-25662 \-------------------------------ooo0-----0ooOo---------------------/ From owner-fwtk-users@ex.tis.com Tue Nov 7 13:38 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA15354 Tue, 7 Nov 2000 13:38:05 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA26593; Tue, 7 Nov 2000 10:37:37 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Nov 2000 09:54:03 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA16658 for fwtk-users-outgoing; Tue, 7 Nov 2000 09:53:53 -0800 (PST) From: "Luis Fernando Barrera" To: "Tor Perkins" <973561477@noid.net> Cc: Subject: RE: ftp-gw and windows nt Date: Tue, 7 Nov 2000 11:51:43 -0600 Message-ID: MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 In-Reply-To: <200011070247.SAA12694@noid.net> Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id JAA16615 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2059 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] But you know something? If you connect to the servers that are refussing the connection, directly from the firewall (i.e. not using the ftp-gw), you can connect in passive mode. So it seems the problem is in the ftp-gw patch code. When I try to make an "ls" command I get the message 500 cannot decode remote port It seems this problem applies only to WinNT/2000 servers...rare? huh... :-) Thanks Luis Fernando Barrera luba@assist.com.gt > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Tor Perkins > Sent: Monday, November 06, 2000 8:48 PM > To: fwtk-users@lists.nai.com > Subject: Re: ftp-gw and windows nt > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > When using this patch, and configuring for "pasv true", any server > that refuses to honor PASV requests will fail. This is because > ftp-gw will not fall back to PORT. That is what's meant by: > > CAVEAT: We're in trouble if the remote 502's us; > we don't fall back... :^) > > ... in the doco-blurb that accompanies the patch. This is the FTP > protocol's biggest problem. The patch is not a perfect fix. It let's > you do FTP through a restrictive packet screen to servers that do > PASV, which fortunately, is most of the servers "out there". > > If you are not dealing with any packet filters, then it's probably > best not to use this patch. > > - Tor > > > On Thu, Oct 26, 2000 at 02:59:22PM -0600, Luis Fernando Barrera wrote: > > > > Hi, > > > > I just applied the Tor's PASV patch to the ftp-gw proxy... However > > when I try to connect to some Windows NT/2000 ftp server, I get > > the message "cannot decode port". With the Unix/Linux ftp servers > > I got no problem... > > > > Has anybody experieced this problem? What is it all about? > > > From owner-fwtk-users@ex.tis.com Tue Nov 7 16:49 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA15933 Tue, 7 Nov 2000 16:49:11 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA24839; Tue, 7 Nov 2000 13:48:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Nov 2000 13:04:01 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA17895 for fwtk-users-outgoing; Tue, 7 Nov 2000 13:03:55 -0800 (PST) Message-ID: <3D6CFAEE245FD411938A00508BE37148013385D2@exchnj01.sbi.com> From: "Barreira, Fernando [IT]" To: "'fwtk-users@tis.com'" Subject: problem with fwtk ftp-gw Date: Tue, 7 Nov 2000 15:36:15 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 463 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi there, we are experiencing a problem when we try ftp to a particular site, basically after i login, and issue a "ls" command, the session gets hunged and i get: ftp> ls 200 PORT command successful. 150 Opening ASCII mode data connection for file list any help would be appreciated. PS. we are using fwtk version 2.1. thanks. From owner-fwtk-users@ex.tis.com Tue Nov 7 21:13 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA16554 Tue, 7 Nov 2000 21:13:21 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA24636; Tue, 7 Nov 2000 18:12:57 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Nov 2000 17:27:06 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA21952 for fwtk-users-outgoing; Tue, 7 Nov 2000 17:26:55 -0800 (PST) Message-Id: <5.0.1.3.0.20001107202006.01d690c0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.1.3 (Beta) Date: Tue, 07 Nov 2000 20:23:38 -0500 To: "Hutchison, Chris" , fwtk-users@lists.nai.com From: Rick Murphy Subject: Re: Smapd - rejecting other domains In-Reply-To: <037D9C3BD3CDD311B45A009027DE2EF8CB84D9@DIAMOND> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 835 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 08:32 AM 11/7/00 -0500, Hutchison, Chris wrote: >As I only want to receive mail from user@mydomain.com > and not user@host.mydomain.com > I would like to reject all mail not >addressed to "mydomain.com". > >I am hoping there is an easy way to do this. >Any help is greatly appreciated. That's not a FWTK question, it's a DNS question :-) Set up a MX record on your nameserver saying the MX for mydomain.com is your server. Set up a MX record on your nameserver saying the MX for host.mydomain.com is their server. That of course assumes that you own the mydomain.com DNS servers. If someone else does, get them to fix this. -Rick From owner-fwtk-users@ex.tis.com Tue Nov 7 21:19 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA16583 Tue, 7 Nov 2000 21:19:45 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA25025; Tue, 7 Nov 2000 18:19:34 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 7 Nov 2000 17:42:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA22694 for fwtk-users-outgoing; Tue, 7 Nov 2000 17:42:05 -0800 (PST) Message-Id: <5.0.1.3.0.20001107202450.01d68ae0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.1.3 (Beta) Date: Tue, 07 Nov 2000 20:26:09 -0500 To: heim@sip.medizin.uni-ulm.de (Stefan Heim, Dipl.-Ing.), fwtk-users@lists.nai.com From: Rick Murphy Subject: Re: Makefile for IRIX In-Reply-To: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 344 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 05:45 PM 11/7/00 -0800, Stefan Heim, Dipl.-Ing. wrote: >I need the Makefile.config.IRIX file for the fwtk. >Thanks! Nobody has shared one with me; I'd start with the sunos one and work with that. -Rick From owner-fwtk-users@ex.tis.com Wed Nov 8 05:34 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA17750 Wed, 8 Nov 2000 05:34:39 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA09858; Wed, 8 Nov 2000 02:34:12 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Nov 2000 01:46:58 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA08109 for fwtk-users-outgoing; Wed, 8 Nov 2000 01:46:52 -0800 (PST) User-Agent: Microsoft Outlook Express Macintosh Edition - 5.0 (1513) Date: Wed, 08 Nov 2000 10:46:49 +0100 Subject: mails not delivered due to possible spoof From: Holger Will To: Message-ID: Mime-version: 1.0 Content-transfer-encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="US-ASCII" Content-Length: 773 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, as far I have had understood the docs if a sending mailserver does not have a correct A or PTR record smap is logging a message about a poosible spoof but should accept the message for further delivery. But on our system this is definitly not the case. I get messages like this: smap[14831]: securityalert: possible spoof NS.Nepustil.NET/193.96.243.22 != 212.71.192.22 name lookup mismatch but the mail is not accepted. Since the sending servers tries to send the message again every 3 minutes, this is very annoying. I've had applied the yao-patch to smap.c. Maybe that's why the smap is so strict in its behavior? -- Holger Will From owner-fwtk-users@ex.tis.com Wed Nov 8 10:00 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA18789 Wed, 8 Nov 2000 10:00:52 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA19908; Wed, 8 Nov 2000 07:00:21 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Nov 2000 05:54:04 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA15893 for fwtk-users-outgoing; Wed, 8 Nov 2000 05:53:54 -0800 (PST) Date: Wed, 8 Nov 2000 08:51:53 -0500 (EST) From: Ted Keller To: Holger Will cc: fwtk-users@lists.nai.com Subject: Re: mails not delivered due to possible spoof In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1317 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Holger, In an earlier version of the fwtk - lib/pname.c used to return an error if the reverse lookup name did not match. As I remember, pname.c, if it detects a difference, jumps to "badguy" where he returns something other than a success. You should be able to do a return (0) there and solve this problem. ted keller On Wed, 8 Nov 2000, Holger Will wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello, > > as far I have had understood the docs if a sending > mailserver does not have a correct A or PTR record > smap is logging a message about a poosible spoof > but should accept the message for further delivery. > > But on our system this is definitly not the case. I > get messages like this: > > smap[14831]: securityalert: possible spoof > NS.Nepustil.NET/193.96.243.22 != 212.71.192.22 name lookup mismatch > > but the mail is not accepted. Since the sending > servers tries to send the message again every 3 > minutes, this is very annoying. I've had applied > the yao-patch to smap.c. Maybe that's why the smap > is so strict in its behavior? > -- > Holger Will > From owner-fwtk-users@ex.tis.com Wed Nov 8 14:10 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA19581 Wed, 8 Nov 2000 14:10:27 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA21869; Wed, 8 Nov 2000 11:09:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Nov 2000 10:22:50 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA14942 for fwtk-users-outgoing; Wed, 8 Nov 2000 10:22:34 -0800 (PST) Message-ID: <3D6CFAEE245FD411938A00508BE37148013385D4@exchnj01.sbi.com> From: "Barreira, Fernando [IT]" To: "'fwtk-users@tis.com'" Subject: still fwtk ftp-gw problem. Date: Wed, 8 Nov 2000 10:01:17 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 2794 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi there, we are experiencing a problem when we try ftp to a particular site, basically after i login, and issue a "ls" command, the session gets hunged and i get: ftp> ls 200 PORT command successful. 150 Opening ASCII mode data connection for file list basically after i issue the "ls" command, i noticed from a packet capture that the source port changes from 21 to 47891, and the destination changes from 36033 to 36034. is this normal for ftp? here is the packet sequence: TCP: Source port = 21 TCP: Destination port = 36033 TCP: Sequence number = 1450748822 TCP: Acknowledgement number = 2015767618 TCP: Data offset = 20 bytes TCP: Flags = 0x18 TCP: ..0. .... = No urgent pointer TCP: ...1 .... = Acknowledgement TCP: .... 1... = Push TCP: .... .0.. = No reset TCP: .... ..0. = No Syn TCP: .... ...0 = No Fin TCP: Window = 8760 TCP: Checksum = 0xbec6 TCP: Urgent pointer = 0 TCP: No options TCP: FTP: ----- FTP: ----- FTP: FTP: "150 Opening ASCII mode data connection for file list.\r\n" FTP: ETHER: ----- Ether Header ----- ETHER: ETHER: Packet 28 arrived at 15:52:38.53 ETHER: Packet size = 60 bytes ETHER: Destination = 8:0:20:74:f2:45, Sun ETHER: Source = 0:10:11:64:40:1, ETHER: Ethertype = 0800 (IP) ETHER: IP: ----- IP Header ----- IP: IP: Version = 4 IP: Header length = 20 bytes IP: Type of service = 0x00 IP: xxx. .... = 0 (precedence) IP: ...0 .... = normal delay IP: .... 0... = normal throughput IP: .... .0.. = normal reliability IP: Total length = 44 bytes IP: Identification = 239 IP: Flags = 0x4 IP: .1.. .... = do not fragment IP: ..0. .... = last fragment IP: Fragment offset = 0 bytes IP: Time to live = 113 seconds/hops IP: Protocol = 6 (TCP) IP: Header checksum = 88b1 IP: Source address = abcd IP: Destination address = 192.195.121.7, rutherford3 IP: No options IP: TCP: ----- TCP Header ----- TCP: TCP: Source port = 47891 TCP: Destination port = 36034 TCP: Sequence number = 1345341180 TCP: Acknowledgement number = 0 TCP: Data offset = 24 bytes TCP: Flags = 0x02 TCP: ..0. .... = No urgent pointer TCP: ...0 .... = No acknowledgement TCP: .... 0... = No push TCP: .... .0.. = No reset TCP: .... ..1. = Syn TCP: .... ...0 = No Fin TCP: Window = 49152 TCP: Checksum = 0x78f7 TCP: Urgent pointer = 0 TCP: Options: (4 bytes) TCP: - Maximum segment size = 1460 bytes TCP: any help would be appreciated. PS. we are using fwtk version 2.1 on a solaris 5.6 platform, our machine sits behind a firewall. thanks. From owner-fwtk-users@ex.tis.com Wed Nov 8 15:18 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA19814 Wed, 8 Nov 2000 15:18:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA02680; Wed, 8 Nov 2000 12:17:57 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Nov 2000 11:33:51 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA26595 for fwtk-users-outgoing; Wed, 8 Nov 2000 11:33:40 -0800 (PST) Date: Wed, 8 Nov 2000 14:31:55 -0500 (EST) From: Ted Keller To: "Barreira, Fernando [IT]" cc: "'fwtk-users@tis.com'" Subject: Re: still fwtk ftp-gw problem. In-Reply-To: <3D6CFAEE245FD411938A00508BE37148013385D4@exchnj01.sbi.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 3248 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Fernando, Did you install the ftp-gw patch we discusses last week? tek On Wed, 8 Nov 2000, Barreira, Fernando [IT] wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > hi there, > > we are experiencing a problem when we try ftp to a particular site, > basically after i login, and issue a "ls" command, > the session gets hunged and i get: > > ftp> ls > 200 PORT command successful. > 150 Opening ASCII mode data connection for file list > > basically after i issue the "ls" command, i noticed from a packet capture > that the source port changes from 21 to 47891, and the destination changes > from 36033 to 36034. is this normal for ftp? > > here is the packet sequence: > > TCP: Source port = 21 > TCP: Destination port = 36033 > TCP: Sequence number = 1450748822 > TCP: Acknowledgement number = 2015767618 > TCP: Data offset = 20 bytes > TCP: Flags = 0x18 > TCP: ..0. .... = No urgent pointer > TCP: ...1 .... = Acknowledgement > TCP: .... 1... = Push > TCP: .... .0.. = No reset > TCP: .... ..0. = No Syn > TCP: .... ...0 = No Fin > TCP: Window = 8760 > TCP: Checksum = 0xbec6 > TCP: Urgent pointer = 0 > TCP: No options > TCP: > FTP: ----- FTP: ----- > FTP: > FTP: "150 Opening ASCII mode data connection for file list.\r\n" > FTP: > > ETHER: ----- Ether Header ----- > ETHER: > ETHER: Packet 28 arrived at 15:52:38.53 > ETHER: Packet size = 60 bytes > ETHER: Destination = 8:0:20:74:f2:45, Sun > ETHER: Source = 0:10:11:64:40:1, > ETHER: Ethertype = 0800 (IP) > ETHER: > IP: ----- IP Header ----- > IP: > IP: Version = 4 > IP: Header length = 20 bytes > IP: Type of service = 0x00 > IP: xxx. .... = 0 (precedence) > IP: ...0 .... = normal delay > IP: .... 0... = normal throughput > IP: .... .0.. = normal reliability > IP: Total length = 44 bytes > IP: Identification = 239 > IP: Flags = 0x4 > IP: .1.. .... = do not fragment > IP: ..0. .... = last fragment > IP: Fragment offset = 0 bytes > IP: Time to live = 113 seconds/hops > IP: Protocol = 6 (TCP) > IP: Header checksum = 88b1 > IP: Source address = abcd > IP: Destination address = 192.195.121.7, rutherford3 > IP: No options > IP: > TCP: ----- TCP Header ----- > TCP: > TCP: Source port = 47891 > TCP: Destination port = 36034 > TCP: Sequence number = 1345341180 > TCP: Acknowledgement number = 0 > TCP: Data offset = 24 bytes > TCP: Flags = 0x02 > TCP: ..0. .... = No urgent pointer > TCP: ...0 .... = No acknowledgement > TCP: .... 0... = No push > TCP: .... .0.. = No reset > TCP: .... ..1. = Syn > TCP: .... ...0 = No Fin > TCP: Window = 49152 > TCP: Checksum = 0x78f7 > TCP: Urgent pointer = 0 > TCP: Options: (4 bytes) > TCP: - Maximum segment size = 1460 bytes > TCP: > > > any help would be appreciated. > PS. we are using fwtk version 2.1 on a solaris 5.6 platform, our machine > sits behind a firewall. > thanks. > From owner-fwtk-users@ex.tis.com Wed Nov 8 16:03 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA19866 Wed, 8 Nov 2000 16:03:42 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA09067; Wed, 8 Nov 2000 13:03:03 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 8 Nov 2000 12:23:57 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA03363 for fwtk-users-outgoing; Wed, 8 Nov 2000 12:23:45 -0800 (PST) Message-ID: <000701c049c0$fddf6b40$fc00a8c0@k62350> From: "Larry Jackson" To: Cc: "Barreira, Fernando [IT]" References: <3D6CFAEE245FD411938A00508BE37148013385D4@exchnj01.sbi.com> Subject: Re: still fwtk ftp-gw problem. Date: Wed, 8 Nov 2000 15:17:59 -0500 Organization: Falun Technical Service, Inc. MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 3699 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I'm not an expert, but this looks normal. The port change should be the data channel. Your problem probably has to do with blocked high # ports. Check your firewall packet filters for these ports. There is a patch to restrict the data port to a certain range. You could enable a few and restrict ftp-gw. Another possibility is that IIRC is that there is a problem in ftp-gw regarding rolling back the data port when the requested one is rejected. I think this was discussed resently, check the archive. http://marc.theaimsgroup.com/?l=fwtk-users&w=2&r=1&s=ftp+port&q=b or http://marc.theaimsgroup.com/?l=fwtk-users&w=2&r=1&s=ftp+data&q=b LarryJackson@iName.com ----- Original Message ----- From: "Barreira, Fernando [IT]" > > we are experiencing a problem when we try ftp to a particular site, > basically after i login, and issue a "ls" command, > the session gets hunged and i get: > > ftp> ls > 200 PORT command successful. > 150 Opening ASCII mode data connection for file list > > basically after i issue the "ls" command, i noticed from a packet capture > that the source port changes from 21 to 47891, and the destination changes > from 36033 to 36034. is this normal for ftp? > > here is the packet sequence: > > TCP: Source port = 21 > TCP: Destination port = 36033 > TCP: Sequence number = 1450748822 > TCP: Acknowledgement number = 2015767618 > TCP: Data offset = 20 bytes > TCP: Flags = 0x18 > TCP: ..0. .... = No urgent pointer > TCP: ...1 .... = Acknowledgement > TCP: .... 1... = Push > TCP: .... .0.. = No reset > TCP: .... ..0. = No Syn > TCP: .... ...0 = No Fin > TCP: Window = 8760 > TCP: Checksum = 0xbec6 > TCP: Urgent pointer = 0 > TCP: No options > TCP: > FTP: ----- FTP: ----- > FTP: > FTP: "150 Opening ASCII mode data connection for file list.\r\n" > FTP: > > ETHER: ----- Ether Header ----- > ETHER: > ETHER: Packet 28 arrived at 15:52:38.53 > ETHER: Packet size = 60 bytes > ETHER: Destination = 8:0:20:74:f2:45, Sun > ETHER: Source = 0:10:11:64:40:1, > ETHER: Ethertype = 0800 (IP) > ETHER: > IP: ----- IP Header ----- > IP: > IP: Version = 4 > IP: Header length = 20 bytes > IP: Type of service = 0x00 > IP: xxx. .... = 0 (precedence) > IP: ...0 .... = normal delay > IP: .... 0... = normal throughput > IP: .... .0.. = normal reliability > IP: Total length = 44 bytes > IP: Identification = 239 > IP: Flags = 0x4 > IP: .1.. .... = do not fragment > IP: ..0. .... = last fragment > IP: Fragment offset = 0 bytes > IP: Time to live = 113 seconds/hops > IP: Protocol = 6 (TCP) > IP: Header checksum = 88b1 > IP: Source address = abcd > IP: Destination address = 192.195.121.7, rutherford3 > IP: No options > IP: > TCP: ----- TCP Header ----- > TCP: > TCP: Source port = 47891 > TCP: Destination port = 36034 > TCP: Sequence number = 1345341180 > TCP: Acknowledgement number = 0 > TCP: Data offset = 24 bytes > TCP: Flags = 0x02 > TCP: ..0. .... = No urgent pointer > TCP: ...0 .... = No acknowledgement > TCP: .... 0... = No push > TCP: .... .0.. = No reset > TCP: .... ..1. = Syn > TCP: .... ...0 = No Fin > TCP: Window = 49152 > TCP: Checksum = 0x78f7 > TCP: Urgent pointer = 0 > TCP: Options: (4 bytes) > TCP: - Maximum segment size = 1460 bytes > TCP: > > > any help would be appreciated. > PS. we are using fwtk version 2.1 on a solaris 5.6 platform, our machine > sits behind a firewall. > thanks. > From owner-fwtk-users@ex.tis.com Thu Nov 9 05:17 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA21896 Thu, 9 Nov 2000 05:13:00 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA01181; Thu, 9 Nov 2000 02:12:16 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Nov 2000 00:36:46 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA24632 for fwtk-users-outgoing; Thu, 9 Nov 2000 00:36:41 -0800 (PST) X-Internal-ID: 3A0285CC0000AB97 X-Internal-ID: 39F2070F000120E3 Message-ID: <3A0A61D7.BD1F52A8@fr.airsysatm.thomson-csf.com> Date: Thu, 09 Nov 2000 09:35:35 +0100 From: laurent Poncin Organization: THOMSON-CSF X-Mailer: Mozilla 4.5 [fr] (Win95; I) X-Accept-Language: fr MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: TIS fwtk and Digital Unix V4.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="------------7ABCDB7486B5295EB22A40A2" Content-Length: 1062 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Il s'agit d'un message multivolet au format MIME. --------------7ABCDB7486B5295EB22A40A2 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit is some one already used, installed TIS fwtk on Compaq Alpha Digital Unix V4.O? in advanced, thank s for all --------------7ABCDB7486B5295EB22A40A2 Content-Type: text/x-vcard; charset=us-ascii; name="laurent.poncin.vcf" Content-Transfer-Encoding: 7bit Content-Description: Carte pour laurent Poncin Content-Disposition: attachment; filename="laurent.poncin.vcf" begin:vcard n:Poncin;Laurent tel;cell:09 06 64 40 24 tel;work:01 41 48 08 35 (ou 01 40 84 16 40) x-mozilla-html:FALSE org:AirSys ATM;TIV version:2.1 email;internet:laurent.poncin@fr.airsysatm.thomson-csf.com title:HardWare Integrator adr;quoted-printable:;;19 rue de la Fontaine=0D=0A92 223 Bagneux cedex;;;; x-mozilla-cpt:;28448 fn:Laurent Poncin end:vcard --------------7ABCDB7486B5295EB22A40A2-- From owner-fwtk-users@ex.tis.com Thu Nov 9 10:08 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA22903 Thu, 9 Nov 2000 10:08:27 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA19874; Thu, 9 Nov 2000 07:08:07 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Nov 2000 05:59:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA08848 for fwtk-users-outgoing; Thu, 9 Nov 2000 05:59:37 -0800 (PST) User-Agent: Microsoft Outlook Express Macintosh Edition - 5.0 (1513) Date: Thu, 09 Nov 2000 14:59:20 +0100 Subject: Re: mails not delivered due to possible spoof From: Holger Will To: Message-ID: In-Reply-To: Mime-version: 1.0 Content-transfer-encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="US-ASCII" Content-Length: 2470 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Ted, thanks for your answer. Unfortunetly this didn't solve my problem. You mean this part: ... syslog(LLEV,"securityalert: possible spoof %.512s/%.20s != %.512s name lookup mismatch",lname,sname,inet_ntoa(a.sin_addr)); -------> goto badguy; } for(x = lname; *x != '\0'; x++) if(isupper((unsigned char)*x)) *x = tolower((unsigned char)*x); return(0); } badguy: strcpy(lname,unknown); return(0); } I've changed it to return(0) and compiled the libs and smap again --> no success. The second try was to change the line to strcpy(lname,unknown); return(0); to ensure that it returns "unknown" for this host ---> no success too. Any other ideas? -- Holger Will > Von: Ted Keller > Datum: Wed, 8 Nov 2000 08:51:53 -0500 (EST) > An: Holger Will > Cc: fwtk-users@lists.nai.com > Betreff: Re: mails not delivered due to possible spoof > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Holger, > > In an earlier version of the fwtk - lib/pname.c used to return an error if > the reverse lookup name did not match. As I remember, pname.c, if it > detects a difference, jumps to "badguy" where he returns something other > than a success. You should be able to do a return (0) there and solve > this problem. > > ted keller > > > On Wed, 8 Nov 2000, Holger Will wrote: > >> [To be removed from this list send the message "unsubscribe fwtk-users" in >> the >> BODY of a mail message to majordomo@ex.tis.com.] >> >> Hello, >> >> as far I have had understood the docs if a sending >> mailserver does not have a correct A or PTR record >> smap is logging a message about a poosible spoof >> but should accept the message for further delivery. >> >> But on our system this is definitly not the case. I >> get messages like this: >> >> smap[14831]: securityalert: possible spoof >> NS.Nepustil.NET/193.96.243.22 != 212.71.192.22 name lookup mismatch >> >> but the mail is not accepted. Since the sending >> servers tries to send the message again every 3 >> minutes, this is very annoying. I've had applied >> the yao-patch to smap.c. Maybe that's why the smap >> is so strict in its behavior? >> -- >> Holger Will >> From owner-fwtk-users@ex.tis.com Thu Nov 9 11:15 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA23182 Thu, 9 Nov 2000 11:15:54 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA01733; Thu, 9 Nov 2000 08:14:26 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Nov 2000 07:30:41 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA24844 for fwtk-users-outgoing; Thu, 9 Nov 2000 07:30:35 -0800 (PST) Message-ID: <3A0AC303.FA95DCB8@sellbuysector.com> Date: Thu, 09 Nov 2000 15:30:11 +0000 From: Masih Tavassoli Organization: Sellbuy Sector X-Mailer: Mozilla 4.6 [en-gb]C-CCK-MCD NetscapeOnline.co.uk (Win98; I) X-Accept-Language: en-GB,en MIME-Version: 1.0 To: fwtk-users@tis.com Subject: VPN/PPP tunnelling Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="------------6739773BA154E0CECC4F11B0" Content-Length: 5219 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --------------6739773BA154E0CECC4F11B0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hi all, I was wondering if it is possible to connect two private networks over the internet securely. And is it something that fwtk can do, perhaps through ppp tunnelling? Here is the scenario: Private network Private network ______________ ____________ | __ | ______ ________ | | |A| |----|ISP FW|--------internet---------|My FWTK|-----| B | --- | | |_____________| |_____________ Machine A can ssh to the firewall(My FWTK) and therefore get access to Machine B, however the reverse is not true. Machine B does not know of the ISP FW and hence can not initiate a connection to machine A. Question: Is there a way to create a VPN between machine A and B so I can get access to machine A from machine B? Any help/pointers into the right direction is highly appreciated. Kind regards, Masih -- Masih Tavassoli Tel: +44 (020) 7936 5884 Sellbuysector.com Fax: +44 (020) 7681 6600 88 Kingsway London WC2B 6AA, UK --------------6739773BA154E0CECC4F11B0 Content-Type: text/html; charset=us-ascii Content-Transfer-Encoding: 7bit Hi all,

I was wondering if it is possible to connect two private networks over the internet securely. And is it something that fwtk can do, perhaps through ppp tunnelling?

Here is the scenario:

Private network                                                                            Private network
______________                                                                     ____________
|       __           |     ______                                 ________       |
|       |A|          |----|ISP FW|--------internet---------|My FWTK|-----|     B
|       ---           |                                                                    |
|_____________|                                                                    |_____________
 
 
 

Machine A can ssh to the firewall(My FWTK) and therefore get access to Machine B, however the reverse is not true. Machine B does not know of the ISP FW  and hence can not initiate a connection to machine A.

Question: Is there a way to create a VPN between machine A and B so I can get access to machine A from machine B?

Any help/pointers into the right direction is highly appreciated.
 
 

Kind regards,
Masih
--
Masih Tavassoli                                   Tel: +44 (020) 7936 5884
Sellbuysector.com                           Fax: +44 (020) 7681 6600
88 Kingsway
London WC2B 6AA, UK
  --------------6739773BA154E0CECC4F11B0-- From owner-fwtk-users@ex.tis.com Thu Nov 9 11:54 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA23324 Thu, 9 Nov 2000 11:54:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA07827; Thu, 9 Nov 2000 08:54:03 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Nov 2000 08:14:51 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA01762 for fwtk-users-outgoing; Thu, 9 Nov 2000 08:14:45 -0800 (PST) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: <3A0ACB38.437ABF30@peaktime.be> Date: Thu, 09 Nov 2000 17:05:12 +0100 From: Michel Bardiaux Organization: Peaktime Belgium S.A. X-Mailer: Mozilla 4.73 [en] (WinNT; I) X-Accept-Language: en,fr MIME-Version: 1.0 To: fwtk-users@tis.com Subject: Re: VPN/PPP tunnelling References: <3A0AC303.FA95DCB8@sellbuysector.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1541 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Masih Tavassoli wrote: > > Hi all, > > I was wondering if it is possible to connect two private networks over > the internet securely. And is it something that fwtk can do, perhaps > through ppp tunnelling? > [snip] > > Machine A can ssh to the firewall(My FWTK) and therefore get access to > Machine B, Personnally I favor ssh *through* the FW, i.e. sshd runs on some internal machine, not on the FW. > however the reverse is not true. Machine B does not know of > the ISP FW and hence can not initiate a connection to machine A. > > Question: Is there a way to create a VPN between machine A and B so I > can get access to machine A from machine B? > You can configure port forwarding on both ends of an SSH session, this will let connections be made from A to B; this eg is how SSH supports X: X apps running on B must access the server on A. It is not, however, since, apart from X which is handled automagically by SSH, on B you connect to localhost:some-non-privileged-port rather than to A:some-well-known-port. For a true VPN, you need PPP tunneling, or IP-over-IP, or IPSEC. FWTK usually does nothing on tunneling connections; they are encrypted end-to-end, so FWTK can't know content, so one usually uses simply plug-gw (or ipchains rules) Cheers. -- Michel Bardiaux Peaktime Belgium S.A. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 From owner-fwtk-users@ex.tis.com Thu Nov 9 14:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA23771 Thu, 9 Nov 2000 14:22:46 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA01835; Thu, 9 Nov 2000 11:22:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Nov 2000 10:34:18 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA22578 for fwtk-users-outgoing; Thu, 9 Nov 2000 10:34:04 -0800 (PST) Date: Thu, 9 Nov 2000 13:32:36 -0500 (EST) From: Ted Keller To: Holger Will cc: fwtk-users@lists.nai.com Subject: Re: mails not delivered due to possible spoof In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2992 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Holger, You have the spot I was remembering. The return (0) should be correct. Revalidate that you are executing the new version ...in the meantime - let me ponder.... tek On Thu, 9 Nov 2000, Holger Will wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Ted, > > thanks for your answer. Unfortunetly this didn't solve my problem. > > You mean this part: > ... > syslog(LLEV,"securityalert: possible spoof %.512s/%.20s != %.512s name > lookup mismatch",lname,sname,inet_ntoa(a.sin_addr)); > -------> goto badguy; > } > > > for(x = lname; *x != '\0'; x++) > if(isupper((unsigned char)*x)) > *x = tolower((unsigned char)*x); > return(0); > } > badguy: > strcpy(lname,unknown); > return(0); > } > I've changed it to return(0) and compiled the libs and smap again --> no > success. > > The second try was to change the line to > > strcpy(lname,unknown); > return(0); > > to ensure that it returns "unknown" for this host ---> no success too. > > Any other ideas? > > -- > Holger Will > > > Von: Ted Keller > > Datum: Wed, 8 Nov 2000 08:51:53 -0500 (EST) > > An: Holger Will > > Cc: fwtk-users@lists.nai.com > > Betreff: Re: mails not delivered due to possible spoof > > > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > Holger, > > > > In an earlier version of the fwtk - lib/pname.c used to return an error if > > the reverse lookup name did not match. As I remember, pname.c, if it > > detects a difference, jumps to "badguy" where he returns something other > > than a success. You should be able to do a return (0) there and solve > > this problem. > > > > ted keller > > > > > > On Wed, 8 Nov 2000, Holger Will wrote: > > > >> [To be removed from this list send the message "unsubscribe fwtk-users" in > >> the > >> BODY of a mail message to majordomo@ex.tis.com.] > >> > >> Hello, > >> > >> as far I have had understood the docs if a sending > >> mailserver does not have a correct A or PTR record > >> smap is logging a message about a poosible spoof > >> but should accept the message for further delivery. > >> > >> But on our system this is definitly not the case. I > >> get messages like this: > >> > >> smap[14831]: securityalert: possible spoof > >> NS.Nepustil.NET/193.96.243.22 != 212.71.192.22 name lookup mismatch > >> > >> but the mail is not accepted. Since the sending > >> servers tries to send the message again every 3 > >> minutes, this is very annoying. I've had applied > >> the yao-patch to smap.c. Maybe that's why the smap > >> is so strict in its behavior? > >> -- > >> Holger Will > >> > From owner-fwtk-users@ex.tis.com Thu Nov 9 19:21 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA24591 Thu, 9 Nov 2000 19:21:34 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA13196; Thu, 9 Nov 2000 16:21:09 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Nov 2000 15:32:11 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA08033 for fwtk-users-outgoing; Thu, 9 Nov 2000 15:31:59 -0800 (PST) Message-Id: <5.0.1.3.0.20001109181802.01d6bec0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.1.3 (Beta) Date: Thu, 09 Nov 2000 18:20:55 -0500 To: Holger Will , From: Rick Murphy Subject: Re: mails not delivered due to possible spoof In-Reply-To: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 795 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:46 AM 11/8/00 +0100, Holger Will wrote: >as far I have had understood the docs if a sending >mailserver does not have a correct A or PTR record >smap is logging a message about a poosible spoof >but should accept the message for further delivery. That's true, *if you don't have it set up to reject it*. For the Joe Yao patch, turning on "smap: check-from-address 1" works the way you describe. The repeated resends are an unfortunate side-effect of badly implemented SMTP servers; they don't recognize the fatal error and requeue the message. I had one of these that requeued it immediately, to the tune of tens of thousands of attempts. -Rick From owner-fwtk-users@ex.tis.com Fri Nov 10 03:41 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA25840 Fri, 10 Nov 2000 03:41:51 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA03403; Fri, 10 Nov 2000 00:41:26 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 9 Nov 2000 23:54:39 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id XAA01794 for fwtk-users-outgoing; Thu, 9 Nov 2000 23:54:33 -0800 (PST) Message-ID: <3A0BA985.BC575696@zrz.TU-Berlin.DE> Date: Fri, 10 Nov 2000 08:53:42 +0100 From: Gerd Schering Organization: TUB X-Mailer: Mozilla 4.75 [en] (X11; U; Linux 2.2.14-15mdk i686) X-Accept-Language: en MIME-Version: 1.0 To: FWTK Mailing Liste Subject: Virus scanner for smap(d)? Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------msF796B1C82F80D050FFB11739" Content-Length: 2709 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a cryptographically signed message in MIME format. --------------msF796B1C82F80D050FFB11739 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hi, I know this topic has already been discussed, but.... We would like to have a virus scanner operating directly on the firewall, so it can scan every in/outgoing mail and possibly also HTML. At the moment, we handle the HTML portion of the problem by removing all "active" content + style sheets from each document. For the email part, many people recommend Amavis, but as far as I could see, it only seems - to handle incoming mail (well, that's a lot already :-) - to rely heavily on sendmail (or other MTAs) My question is: is there anything out, that is capable to cooperate with smap(d)? Any recommendations would be welcomed! Gerd ------------------------------------------------------ -- Gerd Schering -- Email: Schering@zrz.TU-Berlin.DE ------------------------------------------------------ --------------msF796B1C82F80D050FFB11739 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIDvwYJKoZIhvcNAQcCoIIDsDCCA6wCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC AiMwggIfMIIBiKADAgECAgIA2zANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJERTESMBAG A1UEChMJVFUtQmVybGluMQwwCgYDVQQLEwNaUloxFDASBgNVBAMTC1RDIFRVQiAyMDAwMB4X DTAwMDgyMTExNDcyNVoXDTAyMDIxMjExNDcyNVowcTELMAkGA1UEBhMCREUxEjAQBgNVBAoT CVRVLUJlcmxpbjEMMAoGA1UECxMDWlJaMRYwFAYDVQQDEw1HZXJkIFNjaGVyaW5nMSgwJgYJ KoZIhvcNAQkBFhlTY2hlcmluZ0B6cnouVFUtQmVybGluLkRFMFwwDQYJKoZIhvcNAQEBBQAD SwAwSAJBAMzO07BsdY4ao1jwlxpa3z6t32gF+XfuOORFv5n8cg4vBbjipcmd8xujpYDGY9GY gZa24RA34B4ZHwKv7Af1XOECAwEAAaM2MDQwEQYJYIZIAYb4QgEBBAQDAgCgMB8GA1UdIwQY MBaAFAbN8qubZqQJJpbjkE+k2mOXQCqPMA0GCSqGSIb3DQEBBAUAA4GBAFmom4WWG42yDme4 Thl+NXRjM+tCqbmE6L70TkL0IU8D0LaJb2KcfvU1FCK+xZWvHn7q1wSUioAFn2Kg4jD/hPww 40E7WMDT+0RNWDWqd94z6+UCBp453jdqwuq4gw+d6vYC7coCdnoW/6VQw+ZaFQs0RFnObEtM 132MBEUbQ0nyMYIBZDCCAWACAQEwSzBFMQswCQYDVQQGEwJERTESMBAGA1UEChMJVFUtQmVy bGluMQwwCgYDVQQLEwNaUloxFDASBgNVBAMTC1RDIFRVQiAyMDAwAgIA2zAJBgUrDgMCGgUA oIGxMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTAwMTExMDA3 NTM0NFowIwYJKoZIhvcNAQkEMRYEFK3jR8zXnxVk6vwWh+Qx9CJfLGrxMFIGCSqGSIb3DQEJ DzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgFAMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABECbHriFZDaSAtUQUpNAKQG3cIdP ZOMKZIxvSyY2/SsODsFSZtXV/4kvQjqXD3SHPbF9ZJjtyDKI52VSBWFDMRo8 --------------msF796B1C82F80D050FFB11739-- From owner-fwtk-users@ex.tis.com Fri Nov 10 04:20 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA25909 Fri, 10 Nov 2000 04:20:36 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA05439; Fri, 10 Nov 2000 01:20:17 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Nov 2000 00:41:34 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA03410 for fwtk-users-outgoing; Fri, 10 Nov 2000 00:41:29 -0800 (PST) X-Internal-ID: 3A0AA89500001AB2 X-Internal-ID: 39F2070F00013B02 Message-ID: <3A0BB476.6E908D4A@fr.airsysatm.thomson-csf.com> Date: Fri, 10 Nov 2000 09:40:22 +0100 From: laurent Poncin Organization: THOMSON-CSF X-Mailer: Mozilla 4.5 [fr] (Win95; I) X-Accept-Language: fr MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: TIS fwtk and Digital Unix V4.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 378 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] is some one already used, installed TIS fwtk on Compaq Alpha Digital Unix V4.O? And is some one know where to dowload fwtk for Compaq Alpha Digital Unix V4.O (the tis request mail for ftp is without any answer ... )? in advanced, thank s for all From owner-fwtk-users@ex.tis.com Fri Nov 10 06:35 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA26378 Fri, 10 Nov 2000 06:35:00 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA09823; Fri, 10 Nov 2000 03:34:41 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Nov 2000 02:50:15 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA08248 for fwtk-users-outgoing; Fri, 10 Nov 2000 02:50:09 -0800 (PST) User-Agent: Microsoft Outlook Express Macintosh Edition - 5.0 (1513) Date: Fri, 10 Nov 2000 11:49:45 +0100 Subject: Re: mails not delivered due to possible spoof From: Holger Will To: Message-ID: In-Reply-To: <5.0.1.3.0.20001109181802.01d6bec0@mail.itm-inst.com> Mime-version: 1.0 Content-transfer-encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="US-ASCII" Content-Length: 1340 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Rick, I've checked this but the problem still remains the same. Currently there are two servers which cause this problem. Both have uppercase letters in their name, maybe this causes the problem. Additionally I get a connect host ... message but neither deny host ... nor permit host ... messages. -- Holger Will > Von: Rick Murphy > Datum: Thu, 09 Nov 2000 18:20:55 -0500 > An: Holger Will , > Betreff: Re: mails not delivered due to possible spoof > > At 10:46 AM 11/8/00 +0100, Holger Will wrote: >> as far I have had understood the docs if a sending >> mailserver does not have a correct A or PTR record >> smap is logging a message about a poosible spoof >> but should accept the message for further delivery. > > That's true, *if you don't have it set up to reject it*. For the Joe Yao > patch, turning on "smap: check-from-address 1" works the way you describe. > The repeated resends are an unfortunate side-effect of badly implemented > SMTP servers; they don't recognize the fatal error and requeue the message. > I had one of these that requeued it immediately, to the tune of tens of > thousands of attempts. > -Rick From owner-fwtk-users@ex.tis.com Fri Nov 10 12:19 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA27430 Fri, 10 Nov 2000 12:19:44 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA01255; Fri, 10 Nov 2000 09:19:12 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Nov 2000 07:55:03 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA08892 for fwtk-users-outgoing; Fri, 10 Nov 2000 07:54:56 -0800 (PST) Message-ID: <3D6CFAEE245FD411938A00508BE37148013385F9@exchnj01.sbi.com> From: "Barreira, Fernando [IT]" To: "'fwtk-support@tis.com'" , "'fwtk-users@tis.com'" Subject: fwtk ftp-gw question Date: Fri, 10 Nov 2000 10:03:45 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 704 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] hi there, i have fwtk 2.1 running on a solaris 5.6 platform, when i go to this particular site, after i login and try setting mode to "passive" i get: "We only support stream mode, sorry" what does this mean? could this be related to the situation i am experiencing where this same remote ftp server cannot establish a data session because it uses a ramdom high TCP port as the source and my firewall in front of the fwtk drops it? i noticed that on sites that work, the remote ftp server uses instead port 20 as the source data port. anyfedback would be appreciated. From owner-fwtk-users@ex.tis.com Fri Nov 10 12:44 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA27488 Fri, 10 Nov 2000 12:44:56 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA02465; Fri, 10 Nov 2000 09:44:38 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Nov 2000 09:02:21 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA26283 for fwtk-users-outgoing; Fri, 10 Nov 2000 09:02:15 -0800 (PST) Date: Fri, 10 Nov 2000 18:14:52 +0100 (CET) From: Enrico Morelli To: fwtk-users@tis.com Subject: authsrv under RH 7.0 DOESN'T WORK!! TRAGEDY!!!! HEEEEELPPP!!! Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2719 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Dear all, we had a wonderful linux box running under RH 6.2 and fwtk 2.1. We decided to upgrade (!@@###!@) the system to RH 7.0 with PAM and xinetd instead of inetd. 192.168.100.0 ---->[ firewall RH7.0] ---> internet [intranet] So, all connections (ftp and telnet) coming from inside our intranet to outside seem to work fine :-) But when I try to connect to the firewall with telnet, I have the following error: Lost connection to authentication server Using ftp I have: Name (firewall:pippo): pippo 501 Cannot connect to authentication server Login failed. :-(((( May someone help me??? -------------------------------- /\\\\\\ Enrico Morelli /\||||||| ---- /__ __ ::; CE.R.M. | O O _ CEntro Risonanze Magnetiche / | | --- |_/ _| Tel : +39 055 4209269 |_/ | Fax : +39 055 4209253 | / e-mail: morelli@cerm.unifi.it / _/ http://litio.cerm.unifi.it/~morelli _ / ------------------------------------------- Centro di Risonanze Magnetiche Polo Scientifico - Universita' di Firenze Via Luigi Sacconi, 6 50019 Sesto Fiorentino (FI) -------------------------------------------- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 5.0i for non-commercial use mQGiBDmj5dMRBADV1wp4QRQ79WCyDphbWCBdWetYQrzBYPxQcOU4ws8tiblwrS3f iGMJFH1P4R1VXlSKuFoPr9L4Z+T+4FRQzy1bU8Su9CT5wvaqPqE3MBqwpCuZdIVV nlLNXqlh9lWSpSJYKLj+LIFOEYlc9JBuuFwEyyHj2VmfXp2ByGipx9L2zQCg/31A 2UjQ2hamsdXUU0DR7m6KmRsEAKvsPBKwazKjq3iRHXKkF49iWLcCS9E5wSQ3Fyax R/O5Q2AjrzXCMbQxeoMbWGR5BzaxJOqnKxuCDYIiV85RqvFTW+R/TKolSZdvpgH5 SKWd3KZs0Of3Y90HzK5HNOAA1H1xtVBs6CvL3gyns1DYz9GRNsHEATq6AmyE9uCP lVs3BACsF/HlvQhBS1YHfsufsj8ma77mk5XvMgm9VwZje81jE3THyt7Y1kGAfjEo rf+BGSn9HOm74rAreCsxnZE1wHgwdpvWGF8Y4rKsngknRizjSVWgGSDRZaBbwOvI p1XmiAuNAmW3CvcFCYOAK+UWDAN7gbmKbDPmXOrqIL4g5+XUKbQmRW5yaWNvIE1v cmVsbGkgPG1vcmVsbGlAY2VybS51bmlmaS5pdD6JAEsEEBECAAsFAjmj5dMECwMB AgAKCRDeSiHb3ArdvzmpAJ4h3WTK8dlEh+usXKDKRsReeQtOxwCeI80d6zjV39DB Pw4A0uJctKfqo8q5AQ0EOaPl3BAEAOvOi8Vr5eoCx2G5IhuAaUXE7c92rYrY8NSj izDBxYatLE2NdJAPoz66cbRKPvqaLAu+Jdg0ImC3YINN3Kgtttz1P0Wn0Q/tpAOp 8y1m3zg7pNVkY3ZQ0pZY+hq7zEYAV4g8Z4YsWHesM9Tq3942iWKfybiAO8V1Xkfj /SLmev8ZAAICBADL9+LWL+UejkN9yxvv2c3lvXf/OV6p+nta8fm8NPk8lhIqZFFp X09kvJInMPAUjP1VMMPE6hQSxmJCQKUa+OZF5wbGFKiX1C5w88OUpCJXgXxACAjC zwnNYNSAqG1s0KITF2BE/evtltrkgp5ocqkBcxnKhh3h5uUoi0teS7W9nokAPwMF GDmj5dzeSiHb3ArdvxECxoAAoOIPg9g2j0WG2r8atkIKeKYOWKcrAKDYzJr4gnLL A4r9wqoFojM8rMkfAw== =iYyE -----END PGP PUBLIC KEY BLOCK----- From owner-fwtk-users@ex.tis.com Fri Nov 10 15:53 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA28204 Fri, 10 Nov 2000 15:53:08 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA16866; Fri, 10 Nov 2000 12:52:45 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Nov 2000 11:56:08 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA02642 for fwtk-users-outgoing; Fri, 10 Nov 2000 11:55:57 -0800 (PST) Message-Id: <5.0.1.3.0.20001110142945.01d338e0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.1.3 (Beta) Date: Fri, 10 Nov 2000 14:32:54 -0500 To: "Barreira, Fernando [IT]" , "'fwtk-support@tis.com'" , "'fwtk-users@tis.com'" From: Rick Murphy Subject: Re: fwtk ftp-gw question In-Reply-To: <3D6CFAEE245FD411938A00508BE37148013385F9@exchnj01.sbi.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 910 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 10:03 AM 11/10/00 -0500, Barreira, Fernando [IT] wrote: >i have fwtk 2.1 running on a solaris 5.6 platform, >when i go to this particular site, after i login and try setting mode to >"passive" i get: > >"We only support stream mode, sorry" Sounds like that FTP server doesn't support passive FTP. >what does this mean? could this be related to the situation i am >experiencing where this same remote ftp server cannot establish a data >session because it uses a ramdom high TCP port as the source and my firewall >in front of the fwtk drops it? Sounds like the firewall in front of the fwtk is part of the problem. If it won't permit you to connect to sites that don't use a priv'd data port, you're not going to be able to work around that from behind it. -Rick From owner-fwtk-users@ex.tis.com Fri Nov 10 15:53 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA28205 Fri, 10 Nov 2000 15:53:09 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA16870; Fri, 10 Nov 2000 12:52:45 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Nov 2000 11:56:12 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA02643 for fwtk-users-outgoing; Fri, 10 Nov 2000 11:55:57 -0800 (PST) Message-Id: <5.0.1.3.0.20001110142906.01d356a0@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.1.3 (Beta) Date: Fri, 10 Nov 2000 14:29:40 -0500 To: Enrico Morelli , fwtk-users@tis.com From: Rick Murphy Subject: Re: authsrv under RH 7.0 DOESN'T WORK!! TRAGEDY!!!! HEEEEELPPP!!! In-Reply-To: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 334 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 06:14 PM 11/10/00 +0100, Enrico Morelli wrote: >501 Cannot connect to authentication server Is authsrv running on your firewall? If so, what happens when you 'telnet localhost 7777' ? -Rick From owner-fwtk-users@ex.tis.com Fri Nov 10 16:27 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA28312 Fri, 10 Nov 2000 16:27:25 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA24957; Fri, 10 Nov 2000 13:27:01 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Nov 2000 12:43:18 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA15000 for fwtk-users-outgoing; Fri, 10 Nov 2000 12:43:06 -0800 (PST) Message-Id: <5.0.1.3.0.20001110142333.01d79560@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.1.3 (Beta) Date: Fri, 10 Nov 2000 14:28:16 -0500 To: Holger Will , From: Rick Murphy Subject: Re: mails not delivered due to possible spoof In-Reply-To: References: <5.0.1.3.0.20001109181802.01d6bec0@mail.itm-inst.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1027 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 11:49 AM 11/10/00 +0100, Holger Will wrote: >[To be removed from this list send the message "unsubscribe fwtk-users" in the >BODY of a mail message to majordomo@ex.tis.com.] > >Rick, > >I've checked this but the problem still remains the same. > >Currently there are two servers which cause this problem. Both have >uppercase letters in their name, maybe this causes the problem. > >Additionally I get a connect host ... message but neither deny host ... nor >permit host ... messages. I never see permit or deny host messages from smap. What you may be seeing is a host with a broken PTR lookup. If you try a nslookup for the name (nslookup 1.2.3.4), dig -x 1.2.3.4 does it take a long time? If so, you could be seeing a timeout due to the overhead of the name lookup. Smap looks up the hostname for each entry in your netperm-table 'smap: spam xxxxx" list. -Rick From owner-fwtk-users@ex.tis.com Fri Nov 10 17:17 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA28389 Fri, 10 Nov 2000 17:17:32 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA03557; Fri, 10 Nov 2000 14:17:14 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Nov 2000 13:32:31 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA25930 for fwtk-users-outgoing; Fri, 10 Nov 2000 13:32:26 -0800 (PST) Message-ID: <3A0C6958.F4BEE3BA@lclcan.com> Date: Fri, 10 Nov 2000 16:32:08 -0500 From: Don X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en,pdf MIME-Version: 1.0 To: fwtk Subject: smap Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/html; charset=us-ascii Content-Length: 280 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Where can I get an in depth definition of what exactly SMAP is and does? From owner-fwtk-users@ex.tis.com Fri Nov 10 18:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA28534 Fri, 10 Nov 2000 18:26:23 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA12770; Fri, 10 Nov 2000 15:25:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Nov 2000 14:39:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA07765 for fwtk-users-outgoing; Fri, 10 Nov 2000 14:39:29 -0800 (PST) Date: Fri, 10 Nov 2000 17:37:55 -0500 (EST) From: Ted Keller To: Don cc: fwtk Subject: Re: smap In-Reply-To: <3A0C6958.F4BEE3BA@lclcan.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1816 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Don, smap/smapd is essentailly a set of sendmail wrappers which protect your sendmail system from abusive use. The process works as follows.... smap is added to your inetd file - sendmail is not run as daemon. Connection is made to your firewall on port 25 (smtp port). smap executes and start the communication using the smtp protocol - RFC 821 Only basic command are implemented - help, helo, mail from, rcpt to, data, quit Data is read in from remote site and stored in a local temp file. Note - it the remote side mis-behaves, smap dropt the connection. smap exits. periocially smapd runs, collects all of the files located in the temp directory - checks them again - and if ok - passes them along to sendmail for delivery only. Note - no external system can connect to sendmail directly. Therefore, sendmail cannot be abused directly by using protocol violations. Additionally, sendmail can not be abused by the esmtp protocol extentions. There have been serveral extension to smap - patches to the basic system. These, depending on who's you use, do additional things like.... 1. not authorized email relay processing 2. strict rfc 821 protocol enforcement 3. e-mail blocking based on envelope data 4. from/to combination mail blocking (this is handy for people who get on list servers - then leave) 5. mail content spam checking (based on from, to , subject, header, or text contents). Hope this helps. ted keller On Fri, 10 Nov 2000, Don wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" > in the BODY of a mail message to majordomo@ex.tis.com.] Where can I get > an in depth definition of what exactly SMAP is and does? > From owner-fwtk-users@ex.tis.com Fri Nov 10 19:05 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA28562 Fri, 10 Nov 2000 19:05:24 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA16329; Fri, 10 Nov 2000 16:05:16 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 10 Nov 2000 15:26:07 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA12775 for fwtk-users-outgoing; Fri, 10 Nov 2000 15:25:56 -0800 (PST) Message-Id: <5.0.1.3.0.20001110181513.01d6c880@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.1.3 (Beta) Date: Fri, 10 Nov 2000 18:18:26 -0500 To: Don , fwtk From: Rick Murphy Subject: Re: smap In-Reply-To: <3A0C6958.F4BEE3BA@lclcan.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 787 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 04:32 PM 11/10/00 -0500, Don wrote: >Where can I get an in depth definition of what exactly SMAP is and does? The TIS Firewall Toolkit uses smap as a SMTP proxy and smapd as a SMTP delivery daemon. Delivery agents talk to smap, which accepts a mail message and stores it in a queue directory. Smapd reads that queue and hands the incoming messages to a delivery agent (sendmail, typically.) This separation of message acceptance and message delivery allows a simple proxy to be written (smap) that knows only enough to accept and store a message; that process is less likely to be compromised than a heavyweight MTA like sendmail. -Rick From owner-fwtk-users@ex.tis.com Mon Nov 13 05:18 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA05159 Mon, 13 Nov 2000 05:18:14 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA05930; Mon, 13 Nov 2000 02:18:00 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Nov 2000 01:14:52 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA03042 for fwtk-users-outgoing; Mon, 13 Nov 2000 01:14:31 -0800 (PST) User-Agent: Microsoft Outlook Express Macintosh Edition - 5.0 (1513) Date: Mon, 13 Nov 2000 10:12:37 +0100 Subject: Re: mails not delivered due to possible spoof From: Holger Will To: Rick Murphy CC: Message-ID: In-Reply-To: <5.0.1.3.0.20001110142333.01d79560@mail.itm-inst.com> Mime-version: 1.0 Content-transfer-encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="US-ASCII" Content-Length: 2880 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Since I applied the yao-Patch I get a permit or deny message for each connect: Nov 12 21:21:37 is smap[26250]: connect host=max3pool146.vegasnet.net/208.147.126.146 Nov 12 21:21:39 is smap[26247]: deny host=max3pool146.vegasnet.net/208.147.126.146 use of gateway Nov 12 21:21:39 is smap[26247]: fwtksyserr: Mail not local (this is a relaying attempt) or (normal): Nov 13 06:06:18 is smap[26648]: connect host=neo.daxinternet.com/209.219.103.10 Nov 13 06:06:19 is smap[26648]: permit host=neo.daxinternet.com/209.219.103.10 use of gateway Nov 13 06:06:19 is smap[26648]: host=neo.daxinternet.com/209.219.103.10 bytes=12761 from= to= xma026648 Nov 13 06:06:19 is smap[26648]: exiting host=neo.daxinternet.com/209.219.103.10 bytes=12761 Nov 13 06:06:36 is smapd[26649]: delivered file=sma026648 pid=26650 code=0 but in the case of the discussed problem I only get a Nov 13 05:44:15 is smap[26629]: securityalert: possible spoof NS.Nepustil.NET/193.96.243.22 != 212.71.192.22 name lookup mismatch Nov 13 05:44:15 is smap[26629]: connect host=NS.Nepustil.NET/193.96.243.22 and nothing else. nslookup and dig behave normal (3ms), but of course there is a problem because the entries are different. nslookup ns.nepustil.net Non-authoritative answer: Name: ns.nepustil.net Address: 212.71.192.22 nslookup 193.96.243.22 Name: NS.Nepustil.NET Address: 193.96.243.22 -- Holger Will > Von: Rick Murphy > Datum: Fri, 10 Nov 2000 14:28:16 -0500 > An: Holger Will , > Betreff: Re: mails not delivered due to possible spoof > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > At 11:49 AM 11/10/00 +0100, Holger Will wrote: >> [To be removed from this list send the message "unsubscribe fwtk-users" in >> the >> BODY of a mail message to majordomo@ex.tis.com.] >> >> Rick, >> >> I've checked this but the problem still remains the same. >> >> Currently there are two servers which cause this problem. Both have >> uppercase letters in their name, maybe this causes the problem. >> >> Additionally I get a connect host ... message but neither deny host ... nor >> permit host ... messages. > > I never see permit or deny host messages from smap. > > What you may be seeing is a host with a broken PTR lookup. If you try a > nslookup for the name (nslookup 1.2.3.4), dig -x 1.2.3.4 does it take a > long time? If so, you could be seeing a timeout due to the overhead of the > name lookup. Smap looks up the hostname for each entry in your > netperm-table 'smap: spam xxxxx" list. > -Rick > From owner-fwtk-users@ex.tis.com Mon Nov 13 05:18 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA05160 Mon, 13 Nov 2000 05:18:17 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA05936; Mon, 13 Nov 2000 02:18:04 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Nov 2000 01:00:43 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA02728 for fwtk-users-outgoing; Mon, 13 Nov 2000 01:00:33 -0800 (PST) From: "E. Bostanci" Organization: Fachhochschule Mannheim To: fwtk-users@lists.nai.com Date: Mon, 13 Nov 2000 09:54:10 +0100 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: yao-patch Reply-to: emin@fh-mannheim.de Message-ID: <3A0FBA42.25985.3DB8D8@localhost> X-mailer: Pegasus Mail for Win32 (v3.12cDE) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 747 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello fwtk-users, I have compiled the smap patch of yao several weeks ago. Everything works fine. But some emails are sent many times to certain receptients. Some receipt confirmations of emails from certain receptients are received continously, too. What's wrong? Has anybody got the same problems? Emin ______________________________________________________________ Dipl.-Inform. (FH) Emin Bostanci Fachhochschule Mannheim Hochschule fuer Technik u. Gestaltung Tel.: +49 (0)621/292-6406 ______________________________________________________________ From owner-fwtk-users@ex.tis.com Mon Nov 13 05:25 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA05188 Mon, 13 Nov 2000 05:25:42 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA06270; Mon, 13 Nov 2000 02:25:38 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Nov 2000 01:45:24 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA04085 for fwtk-users-outgoing; Mon, 13 Nov 2000 01:45:13 -0800 (PST) Date: Mon, 13 Nov 2000 10:57:56 +0100 (CET) From: Enrico Morelli To: Rick Murphy cc: fwtk-users@tis.com Subject: Re: authsrv under RH 7.0 DOESN'T WORK!! TRAGEDY!!!! HEEEEELPPP!!! In-Reply-To: <5.0.1.3.0.20001110142906.01d356a0@mail.itm-inst.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 3086 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] uOn Fri, 10 Nov 2000, Rick Murphy wrote: > At 06:14 PM 11/10/00 +0100, Enrico Morelli wrote: > >501 Cannot connect to authentication server > > Is authsrv running on your firewall? If so, what happens when you 'telnet > localhost 7777' ? > -Rick > If I try 'telnet localhost 7777' I see: Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host. If I try 'telnet host 7777' I see: Trying 192.168.100.1... Connected to host.ourdomain.net. Escape character is '^]'. Authentication server does not recognize this host Connection closed by foreign host. If I run 'netstat' I see: Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 host.ourdomain.:authsrv host.ourdomain.nmr:1130 TIME_WAIT tcp 0 0 localhost:authsrv localhost:1129 TIME_WAIT Is it PAM or xinetd problem? Thanks in advance -------------------------------- /\\\\\\ Enrico Morelli /\||||||| ---- /__ __ ::; CE.R.M. | O O _ CEntro Risonanze Magnetiche / | | --- |_/ _| Tel : +39 055 4209269 |_/ | Fax : +39 055 4209253 | / e-mail: morelli@cerm.unifi.it / _/ http://litio.cerm.unifi.it/~morelli _ / ------------------------------------------- Centro di Risonanze Magnetiche Polo Scientifico - Universita' di Firenze Via Luigi Sacconi, 6 50019 Sesto Fiorentino (FI) -------------------------------------------- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGPfreeware 5.0i for non-commercial use mQGiBDmj5dMRBADV1wp4QRQ79WCyDphbWCBdWetYQrzBYPxQcOU4ws8tiblwrS3f iGMJFH1P4R1VXlSKuFoPr9L4Z+T+4FRQzy1bU8Su9CT5wvaqPqE3MBqwpCuZdIVV nlLNXqlh9lWSpSJYKLj+LIFOEYlc9JBuuFwEyyHj2VmfXp2ByGipx9L2zQCg/31A 2UjQ2hamsdXUU0DR7m6KmRsEAKvsPBKwazKjq3iRHXKkF49iWLcCS9E5wSQ3Fyax R/O5Q2AjrzXCMbQxeoMbWGR5BzaxJOqnKxuCDYIiV85RqvFTW+R/TKolSZdvpgH5 SKWd3KZs0Of3Y90HzK5HNOAA1H1xtVBs6CvL3gyns1DYz9GRNsHEATq6AmyE9uCP lVs3BACsF/HlvQhBS1YHfsufsj8ma77mk5XvMgm9VwZje81jE3THyt7Y1kGAfjEo rf+BGSn9HOm74rAreCsxnZE1wHgwdpvWGF8Y4rKsngknRizjSVWgGSDRZaBbwOvI p1XmiAuNAmW3CvcFCYOAK+UWDAN7gbmKbDPmXOrqIL4g5+XUKbQmRW5yaWNvIE1v cmVsbGkgPG1vcmVsbGlAY2VybS51bmlmaS5pdD6JAEsEEBECAAsFAjmj5dMECwMB AgAKCRDeSiHb3ArdvzmpAJ4h3WTK8dlEh+usXKDKRsReeQtOxwCeI80d6zjV39DB Pw4A0uJctKfqo8q5AQ0EOaPl3BAEAOvOi8Vr5eoCx2G5IhuAaUXE7c92rYrY8NSj izDBxYatLE2NdJAPoz66cbRKPvqaLAu+Jdg0ImC3YINN3Kgtttz1P0Wn0Q/tpAOp 8y1m3zg7pNVkY3ZQ0pZY+hq7zEYAV4g8Z4YsWHesM9Tq3942iWKfybiAO8V1Xkfj /SLmev8ZAAICBADL9+LWL+UejkN9yxvv2c3lvXf/OV6p+nta8fm8NPk8lhIqZFFp X09kvJInMPAUjP1VMMPE6hQSxmJCQKUa+OZF5wbGFKiX1C5w88OUpCJXgXxACAjC zwnNYNSAqG1s0KITF2BE/evtltrkgp5ocqkBcxnKhh3h5uUoi0teS7W9nokAPwMF GDmj5dzeSiHb3ArdvxECxoAAoOIPg9g2j0WG2r8atkIKeKYOWKcrAKDYzJr4gnLL A4r9wqoFojM8rMkfAw== =iYyE -----END PGP PUBLIC KEY BLOCK----- From owner-fwtk-users@ex.tis.com Mon Nov 13 11:28 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA06692 Mon, 13 Nov 2000 11:28:08 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA03490; Mon, 13 Nov 2000 08:27:53 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Nov 2000 07:39:00 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA25263 for fwtk-users-outgoing; Mon, 13 Nov 2000 07:38:54 -0800 (PST) Message-Id: <4.3.2.7.1.20001113100634.00d6fc90@pophost> X-Sender: ohe4pop3@pophost X-Mailer: QUALCOMM Windows Eudora Version 4.3.2 Date: Mon, 13 Nov 2000 10:10:10 +0100 To: From: Olivier Hislaire Subject: Re: smap In-Reply-To: References: <3A0C6958.F4BEE3BA@lclcan.com> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 967 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, At 05:37 PM 11/10/00 -0500, you wrote: >Only basic command are implemented - help, helo, mail from, rcpt to, data, >quit No ETRN or altenative to ETRN ? >Additionally, sendmail can not be abused by the esmtp protocol extentions. Does it means that ESMTP (8 bits stuff and so, if I am not wrong) is not supported by SMAP ? Regards, Olivier. ------------------------------------------------------------------------------------------------ Olivier Hislaire MSG International Email: O.Hislaire@msg-i.com 97 Avenue de Tervuren Phone: +32 (0)2 735.91.59 Ext. 55 1040 Brussels Fax: +32 (0)2 732.12.19 Belgium http://www.msg-i.com ------------------------------------------------------------------------------------------------ From owner-fwtk-users@ex.tis.com Mon Nov 13 14:52 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA07411 Mon, 13 Nov 2000 14:52:58 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA02819; Mon, 13 Nov 2000 11:52:33 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 13 Nov 2000 11:04:01 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA25357 for fwtk-users-outgoing; Mon, 13 Nov 2000 11:03:50 -0800 (PST) Date: Mon, 13 Nov 2000 13:58:27 -0500 (EST) From: Ted Keller To: Olivier Hislaire cc: fwtk-users@lists.nai.com Subject: Re: smap In-Reply-To: <4.3.2.7.1.20001113100634.00d6fc90@pophost> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1529 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] ETRN is not supported in smap - and not required by rfc821. 8bit data must be 7-bit encoded. It is the remote MTA's responsibility to recognize smap is a RFC821 only MTA. This is accomplished by: remote to smap: EHLO smap to remote: 500 syntax error remote to smap: HELO smap to remote: 200 ready tedkeller On Mon, 13 Nov 2000, Olivier Hislaire wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello, > > At 05:37 PM 11/10/00 -0500, you wrote: > > > >Only basic command are implemented - help, helo, mail from, rcpt to, data, > >quit > > No ETRN or altenative to ETRN ? > > >Additionally, sendmail can not be abused by the esmtp protocol extentions. > > Does it means that ESMTP (8 bits stuff and so, if I am not wrong) is not > supported by SMAP ? > > Regards, > Olivier. > > > ------------------------------------------------------------------------------------------------ > Olivier Hislaire > > MSG International Email: O.Hislaire@msg-i.com > 97 Avenue de Tervuren Phone: +32 (0)2 735.91.59 Ext. 55 > 1040 Brussels Fax: +32 (0)2 732.12.19 > Belgium http://www.msg-i.com > ------------------------------------------------------------------------------------------------ > > > > From owner-fwtk-users@ex.tis.com Tue Nov 14 04:11 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA09582 Tue, 14 Nov 2000 04:11:35 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA13019; Tue, 14 Nov 2000 01:11:14 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Nov 2000 00:23:23 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA10954 for fwtk-users-outgoing; Tue, 14 Nov 2000 00:23:17 -0800 (PST) Message-ID: <3A10F643.5DB2BCD1@zrz.TU-Berlin.DE> Date: Tue, 14 Nov 2000 09:22:27 +0100 From: Gerd Schering Organization: TUB X-Mailer: Mozilla 4.75 [en] (X11; U; Linux 2.2.14-15mdk i686) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users Subject: new fwtk release? Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/signed; protocol="application/x-pkcs7-signature"; micalg=sha1; boundary="------------ms5A10E4D40C7FD750E0AC00E8" Content-Length: 2265 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a cryptographically signed message in MIME format. --------------ms5A10E4D40C7FD750E0AC00E8 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hi, I remember some couple of week ago there was a discussion about the license of the TIS fwtk and thereby the idea of a new release of the fwtk. Is this work in progress or is it no longer actual? Gerd ------------------------------------------------------ -- Gerd Schering -- Email: Schering@zrz.TU-Berlin.DE ------------------------------------------------------ --------------ms5A10E4D40C7FD750E0AC00E8 Content-Type: application/x-pkcs7-signature; name="smime.p7s" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="smime.p7s" Content-Description: S/MIME Cryptographic Signature MIIDvwYJKoZIhvcNAQcCoIIDsDCCA6wCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHAaCC AiMwggIfMIIBiKADAgECAgIA2zANBgkqhkiG9w0BAQQFADBFMQswCQYDVQQGEwJERTESMBAG A1UEChMJVFUtQmVybGluMQwwCgYDVQQLEwNaUloxFDASBgNVBAMTC1RDIFRVQiAyMDAwMB4X DTAwMDgyMTExNDcyNVoXDTAyMDIxMjExNDcyNVowcTELMAkGA1UEBhMCREUxEjAQBgNVBAoT CVRVLUJlcmxpbjEMMAoGA1UECxMDWlJaMRYwFAYDVQQDEw1HZXJkIFNjaGVyaW5nMSgwJgYJ KoZIhvcNAQkBFhlTY2hlcmluZ0B6cnouVFUtQmVybGluLkRFMFwwDQYJKoZIhvcNAQEBBQAD SwAwSAJBAMzO07BsdY4ao1jwlxpa3z6t32gF+XfuOORFv5n8cg4vBbjipcmd8xujpYDGY9GY gZa24RA34B4ZHwKv7Af1XOECAwEAAaM2MDQwEQYJYIZIAYb4QgEBBAQDAgCgMB8GA1UdIwQY MBaAFAbN8qubZqQJJpbjkE+k2mOXQCqPMA0GCSqGSIb3DQEBBAUAA4GBAFmom4WWG42yDme4 Thl+NXRjM+tCqbmE6L70TkL0IU8D0LaJb2KcfvU1FCK+xZWvHn7q1wSUioAFn2Kg4jD/hPww 40E7WMDT+0RNWDWqd94z6+UCBp453jdqwuq4gw+d6vYC7coCdnoW/6VQw+ZaFQs0RFnObEtM 132MBEUbQ0nyMYIBZDCCAWACAQEwSzBFMQswCQYDVQQGEwJERTESMBAGA1UEChMJVFUtQmVy bGluMQwwCgYDVQQLEwNaUloxFDASBgNVBAMTC1RDIFRVQiAyMDAwAgIA2zAJBgUrDgMCGgUA oIGxMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTAwMTExNDA4 MjIyOVowIwYJKoZIhvcNAQkEMRYEFLSyUNV0h8yCO7tMPuWn2IVLV0oNMFIGCSqGSIb3DQEJ DzFFMEMwCgYIKoZIhvcNAwcwDgYIKoZIhvcNAwICAgCAMAcGBSsOAwIHMA0GCCqGSIb3DQMC AgFAMA0GCCqGSIb3DQMCAgEoMA0GCSqGSIb3DQEBAQUABEAl8s0KEA4u5tX9yUpMlB9ZN7Ly aT0pskSYsBNow+fUScHKE9dkUnQtN5nmQUiMmfaGiEnCBA6f6GKrx0+6V3R+ --------------ms5A10E4D40C7FD750E0AC00E8-- From owner-fwtk-users@ex.tis.com Tue Nov 14 04:40 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA09730 Tue, 14 Nov 2000 04:39:59 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA14276; Tue, 14 Nov 2000 01:39:40 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Nov 2000 00:59:21 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA12397 for fwtk-users-outgoing; Tue, 14 Nov 2000 00:59:11 -0800 (PST) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: <3A10F643.5DB2BCD1@zrz.TU-Berlin.DE> Date: Tue, 14 Nov 2000 08:58:48 -0000 (GMT) From: Tony Gale To: Gerd Schering , fwtk-users@ex.tis.com Subject: RE: new fwtk release? Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 997 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] To perhaps get some impetence going (rather than impotence), I'll post my current patch kit a little later, when I have ten minutes to sort it out. -tony On 14-Nov-2000 Gerd Schering wrote: > Hi, > > I remember some couple of week ago there was a discussion > about the license of the TIS fwtk and thereby the idea of a new > release of the fwtk. > Is this work in progress or is it no longer actual? > > Gerd > ------------------------------------------------------ > -- Gerd Schering > -- Email: Schering@zrz.TU-Berlin.DE > ------------------------------------------------------ --- E-Mail: Tony Gale Many Myths are based on truth -- Spock, "The Way to Eden", stardate 5832.3 The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Tue Nov 14 08:08 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA10450 Tue, 14 Nov 2000 08:08:25 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA20371; Tue, 14 Nov 2000 05:08:04 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Nov 2000 04:00:45 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA18273 for fwtk-users-outgoing; Tue, 14 Nov 2000 04:00:34 -0800 (PST) From: ark@eltex.ru Date: Tue, 14 Nov 2000 15:16:38 +0300 Message-Id: <200011141216.PAA01256@paranoid.alpha.int> In-Reply-To: <3A10F643.5DB2BCD1@zrz.TU-Berlin.DE> from "Gerd Schering " Organization: "Klingon Imperial Intelligence Service" Subject: Re: new fwtk release? To: Schering@zrz.tu-berlin.de Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1570 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Yep. I rewrote the library implemeting full API compatibility. I expect it will be ready for release soon after some code audit and debugging as well as new API that will (should) make proxy development easier. Gerd Schering said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > This is a cryptographically signed message in MIME format. > > --------------ms5A10E4D40C7FD750E0AC00E8 > Content-Type: text/plain; charset=us-ascii > Content-Transfer-Encoding: 7bit > > Hi, > > I remember some couple of week ago there was a discussion > about the license of the TIS fwtk and thereby the idea of a new > release of the fwtk. > Is this work in progress or is it no longer actual? > > Gerd _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBOhEtJaH/mIJW9LeBAQEfogP7BGQbnRCqLaV8Uy7Eokqc4GUs7s/0XRT5 VpTTxje+FYvAZPV413EtPoJdYmhaYxESpBqsi8fQf5AVMbN/P3+J6QKIwEJ5jLGi 0KkH8W4kt9AcnoZOG2XIKGnmzIXk2vfX2UAjilztBZ1OO/mYKXGQVAUHI1x9nsRc y0vKPoO/lJ0= =eg6m -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Nov 14 08:39 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA10558 Tue, 14 Nov 2000 08:39:31 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA22058; Tue, 14 Nov 2000 05:39:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Nov 2000 04:57:00 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA19815 for fwtk-users-outgoing; Tue, 14 Nov 2000 04:56:49 -0800 (PST) From: ark@eltex.ru Date: Tue, 14 Nov 2000 14:38:43 +0300 Message-Id: <200011141138.OAA01135@paranoid.alpha.int> In-Reply-To: <4.3.2.7.1.20001113100634.00d6fc90@pophost> from "Olivier Hislaire " Organization: "Klingon Imperial Intelligence Service" Subject: Re: smap To: O.Hislaire@msg-i.com Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1367 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Olivier Hislaire said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hello, > > At 05:37 PM 11/10/00 -0500, you wrote: > > > >Only basic command are implemented - help, helo, mail from, rcpt to, data, > >quit > > No ETRN or altenative to ETRN ? No. What for? > >Additionally, sendmail can not be abused by the esmtp protocol extentions. > > Does it means that ESMTP (8 bits stuff and so, if I am not wrong) is not > supported by SMAP ? It is 8bit clean. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBOhEkQaH/mIJW9LeBAQGoWwP/bjnP5V7+6rmtxZbvfNz7yCcF4Eos83lo gvOUqKM4Au1ji0zzlUJjjtbdFACnf0vNjzys6yXc4yumDI4h0jI4PRuG/WJMLRxA Plex4Q+ucVOdN8n/FA6Fbfs4rcbnCe17igGIv0urdITJ7Q/dJJiysPZse80G68Y6 BEld9FCsAPE= =ZTG+ -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Tue Nov 14 10:31 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA11037 Tue, 14 Nov 2000 10:31:35 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id HAA02967; Tue, 14 Nov 2000 07:31:22 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Nov 2000 06:43:25 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA27227 for fwtk-users-outgoing; Tue, 14 Nov 2000 06:43:14 -0800 (PST) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) MIME-Version: 1.0 In-Reply-To: Date: Tue, 14 Nov 2000 14:42:51 -0000 (GMT) From: Tony Gale To: fwtk-users@ex.tis.com Subject: RE: new fwtk release? Cc: Gerd Schering Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="_=XFMail.1.4.4.Linux:20001114144251:30105=_" Content-Length: 7309 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format --_=XFMail.1.4.4.Linux:20001114144251:30105=_ Content-Type: text/plain; charset=iso-8859-1 Patch kit attached. Doesn't include smap, as that is pretty well covered by Ted (et al) elsewhere and I don't use it. Included: o http-gw: complete list of URL escape characters, as per RFC1738 o http-gw: accommodate FTP servers that don't need a username/password o http-gw: be less stringent about \r handling - for FTP servers o http-gw: try and send messages in a single packet, fixes broken FTP servers o http-gw: allow for browsers that send CRLF on POST commands (they do this for backwards compatibility) o http-gw: javascript quoting bug o x-gw: correct debug messages o x-gw: fix potential format bug overflow o x-gw: fix dereference-after-free bug This covers *at least* the following FAQ patch sections (plus a few other things): 1.3 1.6 1.7 1.8 1.9 2.8 Have fun, -tony --- E-Mail: Tony Gale Have you locked your file cabinet? The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. --_=XFMail.1.4.4.Linux:20001114144251:30105=_ Content-Disposition: attachment; filename="fwtk-trg-20001114.diff" Content-Description: fwtk-trg-20001114.diff Content-Type: text/plain; charset=iso-8859-1; name=fwtk-trg-20001114.diff; SizeOnDisk=5678 Content-Transfer-Encoding: 7bit diff -ur ../fwtk.dist/fwtk/http-gw/auth.c fwtk/http-gw/auth.c --- ../fwtk.dist/fwtk/http-gw/auth.c Fri Nov 22 16:21:05 1996 +++ fwtk/http-gw/auth.c Tue Nov 14 13:47:47 2000 @@ -23,7 +23,10 @@ }; struct res_chars res_chars[] = { - { TYPE_HTTP, "()%:+/;?=&\r\n"}, + /* Do not unescape "reserved", "unsafe" or "special" characters from RFC1738 + * TRG - 20000714 + */ + { TYPE_HTTP, ";/?:@=&$-_.+!*'(), <>\"#%{}|\\^~[]`\r\n"}, { 0, NULL} }; diff -ur ../fwtk.dist/fwtk/http-gw/ftp.c fwtk/http-gw/ftp.c --- ../fwtk.dist/fwtk/http-gw/ftp.c Sat Jan 18 20:17:37 1997 +++ fwtk/http-gw/ftp.c Tue Nov 14 13:47:47 2000 @@ -216,6 +216,7 @@ int ftp_setup(sockfd, rfd, ftp_listen) int sockfd, rfd, *ftp_listen; { int siteinfo = ftp_siteinfo; + int reply; ftp_siteinfo = -1; if( get_ftp_reply(rfd) != '2') @@ -225,19 +226,24 @@ say(rfd,"USER anonymous"); else say(rfd, ftp_user); - if( get_ftp_reply(rfd) != '3') - goto broken; - - if( ftp_pass[0] == '\0') - sprintf(ftp_reply_buf,"PASS http-gw@%s", ourname); - else - strcpy(ftp_reply_buf, ftp_pass); - say(rfd, ftp_reply_buf); + reply = get_ftp_reply(rfd); + if (reply != '2') { + if( reply != '3') + goto broken; - ftp_siteinfo = siteinfo; + if( ftp_pass[0] == '\0') + sprintf(ftp_reply_buf,"PASS http-gw@%s", ourname); + else + strcpy(ftp_reply_buf, ftp_pass); + say(rfd, ftp_reply_buf); - if( get_ftp_reply(rfd) != '2') - goto broken; + ftp_siteinfo = siteinfo; + + if( get_ftp_reply(rfd) != '2') + goto broken; + } else { + ftp_siteinfo = siteinfo; + } if( ftp_repcnt > 2){ ftp_gensitedir = 1; diff -ur ../fwtk.dist/fwtk/http-gw/hmain.c fwtk/http-gw/hmain.c --- ../fwtk.dist/fwtk/http-gw/hmain.c Fri Feb 6 23:32:16 1998 +++ fwtk/http-gw/hmain.c Tue Nov 14 14:06:27 2000 @@ -857,13 +857,10 @@ if(html_read(fd,(char *)&buf[x],1) != 1) goto done; - /* get \r\n - read a char and throw it away */ - if(buf[x] == '\r') { + /* eat all \r from the stream */ + while(buf[x] == '\r') { if(html_read(fd,(char *)&buf[x],1) != 1) goto done; - buf[x] = '\0'; - ret = x; - goto done; } if(buf[x] == '\n') { @@ -945,9 +942,24 @@ char *s; int n; { - if(net_write(fd,s,n) != n) - return(1); - return(net_write(fd,"\r\n",2) != 2); + char *buff; + int retval; + + /* Attempt to send message in one packet + * Some FTP servers don't like split messages + * TRG - 20001114 + */ + if ( (buff = malloc(n+2)) == NULL) { + if(net_write(fd,s,n) != n) + return(1); + return(net_write(fd,"\r\n",2) != 2); + } + memcpy(buff, s, n); + buff[n]='\r'; + buff[n+1]='\n'; + retval = net_write(fd,buff,n+2); + free(buff); + return(retval); } diff -ur ../fwtk.dist/fwtk/http-gw/http-gw.c fwtk/http-gw/http-gw.c --- ../fwtk.dist/fwtk/http-gw/http-gw.c Fri Feb 6 23:32:25 1998 +++ fwtk/http-gw/http-gw.c Tue Nov 14 14:19:17 2000 @@ -1362,6 +1362,22 @@ }else break; } + /* Check if there is a CRLF left in the buffer. + * Netscape sends CRLF on the end of POST commands. + * TRG - 19990817 + */ + { + char str[2]; + int count; + if (ioctl(rfd, FIONREAD, &count) == 0) { + if (count == 2) { + if (recv(rfd, str, 2, MSG_PEEK) == 2) { + if ((str[0] == '\r') && (str[1] == '\n')) + read(rfd, str, 2); + } + } + } + } } return 0; } @@ -2285,8 +2301,13 @@ seek_and_destroy(value); /* Quote at end removed to avoid double write*/ - p = value + strlen(value) - 1; - if ((*p == '"') || (*p == '\'')) *p = 0; + if (*value == '"' || *value == '\'') { + /* leave single quote intact */ + if (strlen(value) > 1) { + char *p2 = value + strlen(value) - 1; + if (*value == *p2) *p2 = 0; + } + } /* write out the saved (or rewritten) field now */ if (!in_blocked) diff -ur ../fwtk.dist/fwtk/x-gw/fwd.c fwtk/x-gw/fwd.c --- ../fwtk.dist/fwtk/x-gw/fwd.c Tue Jul 22 15:05:01 1997 +++ fwtk/x-gw/fwd.c Tue Nov 14 13:53:09 2000 @@ -30,8 +30,9 @@ if( maxb <=0 ) return bsize; switch( cnt=read(*rfd,&pbuf[bsize],maxb) ) { - case -1: sprintf(buf,"read fd:%d",readfd); + case -1: sprintf(buf,"read fd:%d",*rfd); pmsg(buf,1); + /* FALL THROUGH */ case 0: clear_close_fd(*rfd,rset,wset); cnt= -1; break; @@ -51,8 +52,9 @@ int cnt; switch( (cnt=write(*wfd,pbuf,bsize)) ) { - case -1: sprintf(buf,"write fd:%d",readfd); + case -1: sprintf(buf,"write fd:%d",*wfd); pmsg(buf,1); + /* FALL THROUGH */ case 0: clear_close_fd(*wfd,rset,wset); return -1; default: if(cntid))>= -1 && cb) ret=cb(p->id,data,ret); - if( ret>= -1) + if( ret>= -1) { + ptemp=p->next; pidlist=(list_t*)deleteListItem(pidlist,p->id); - p=p->next; + p=ptemp; + } else { + p=p->next; + } } return pidlist; } --_=XFMail.1.4.4.Linux:20001114144251:30105=_-- End of MIME message From owner-fwtk-users@ex.tis.com Tue Nov 14 14:24 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA12108 Tue, 14 Nov 2000 14:24:24 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA02646; Tue, 14 Nov 2000 11:24:08 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 14 Nov 2000 10:35:24 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA25725 for fwtk-users-outgoing; Tue, 14 Nov 2000 10:35:18 -0800 (PST) Message-ID: From: "Glen, Mike" To: "'fwtk-users@lists.nai.com'" Subject: ftp-gw problem Date: Tue, 14 Nov 2000 13:34:36 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 353 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I have a problem with my ftp-gw. I can connect to the proxy server, authenticate, and hit my destination, but when I try to download/upload a file my connection drops. I'm runinng redhat linux 7. Any ideas? -Mike From owner-fwtk-users@ex.tis.com Thu Nov 16 14:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA23883 Thu, 16 Nov 2000 14:26:48 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA22400; Thu, 16 Nov 2000 11:26:10 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 16 Nov 2000 10:10:04 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA11537 for fwtk-users-outgoing; Thu, 16 Nov 2000 10:09:48 -0800 (PST) Date: Thu, 16 Nov 2000 13:07:47 -0500 (EST) From: Ted Keller To: Tony Gale cc: Gerd Schering , fwtk-users@ex.tis.com Subject: RE: new fwtk release? In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1349 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Rick, Sometime back, you offered to coordinate a new fwtk release. Are you still able to do that? ted keller On Tue, 14 Nov 2000, Tony Gale wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > To perhaps get some impetence going (rather than impotence), I'll > post my current patch kit a little later, when I have ten minutes to > sort it out. > > -tony > > > On 14-Nov-2000 Gerd Schering wrote: > > Hi, > > > > I remember some couple of week ago there was a discussion > > about the license of the TIS fwtk and thereby the idea of a new > > release of the fwtk. > > Is this work in progress or is it no longer actual? > > > > Gerd > > ------------------------------------------------------ > > -- Gerd Schering > > -- Email: Schering@zrz.TU-Berlin.DE > > ------------------------------------------------------ > > --- > E-Mail: Tony Gale > Many Myths are based on truth > -- Spock, "The Way to Eden", stardate 5832.3 > > The views expressed above are entirely those of the writer > and do not represent the views, policy or understanding of > any other person or official body. > From owner-fwtk-users@ex.tis.com Thu Nov 16 23:30 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA27908 Thu, 16 Nov 2000 23:29:46 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA09316; Thu, 16 Nov 2000 20:28:53 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 16 Nov 2000 18:08:12 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA03753 for fwtk-users-outgoing; Thu, 16 Nov 2000 18:07:31 -0800 (PST) Message-Id: <5.0.2.1.0.20001116205109.01d64a10@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.2 Date: Thu, 16 Nov 2000 20:51:59 -0500 To: Ted Keller , Tony Gale From: Rick Murphy Subject: RE: new fwtk release? Cc: Gerd Schering , fwtk-users@ex.tis.com In-Reply-To: References: Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 448 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 01:07 PM 11/16/00 -0500, Ted Keller wrote: >Rick, > >Sometime back, you offered to coordinate a new fwtk release. Are you >still able to do that? Not for the next few weeks, but I'm hoping to get something done around the holidays. It remains to be seen if NAI will host a new distribution or not. -Rick From owner-fwtk-users@ex.tis.com Fri Nov 17 05:31 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA28850 Fri, 17 Nov 2000 05:31:10 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA24904; Fri, 17 Nov 2000 02:30:17 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 17 Nov 2000 00:28:56 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA16580 for fwtk-users-outgoing; Fri, 17 Nov 2000 00:28:45 -0800 (PST) From: murray.barton@police.wa.gov.au Message-ID: <7A889AE3548BD4119F830008C7F35DAF936D78@EXHSRV1> To: fwtk-users@ex.tis.com Subject: smap Date: Fri, 17 Nov 2000 16:30:01 +0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1988 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I am seeking some assistance with SMAP. The configuration here has smap loggin to /var/log/smaplog. The logs are rotated. For ~ 7day period we have > 100M of smaplog. I do not know if this is normal. Taking a look in the log I see a lot of the messages are like- smap[4953]: mask failed: or smap[5768]: mask failed: Our syslog's are also ver large for a 7 day period (~ 20M) most of which seems to be mail related of the form- Nov 12 03:41:29 phq1098 sendmail[11480]: DAA11480: from=, s ize=6562, class=0, pri=7562, nrcpts=1, msgid=, relay=smap@localhost I have had a look at the smap man pages and the faq on the FWTK web page but I could not find anything about large log files. Is what I am seeing out of the normal? Is there any way I can cut down the ammount of messages logged? Sorry if these are stupido questions but I have never had to manage smap before. thanks for your assistance regards Murray ************************************************************************************************ This email message and any attached files may contain information that is confidential and subject of legal privilege intended only for use by the individual or entity to whom they are addressed. If you are not the intended recipient or the person responsible for delivering the message to the intended recipient be advised that you have received this message in error and that any use, copying, circulation, forwarding, printing or publication of this message or attached files is strictly forbidden, as is the disclosure of the information contained therein. If you have received this message in error, please notify the sender immediately and delete it from your Inbox. ************************************************************************************************ From owner-fwtk-users@ex.tis.com Fri Nov 17 05:54 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA28891 Fri, 17 Nov 2000 05:54:16 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA25660; Fri, 17 Nov 2000 02:53:42 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 17 Nov 2000 01:09:16 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA27260 for fwtk-users-outgoing; Fri, 17 Nov 2000 01:08:54 -0800 (PST) X-Authentication-Warning: proxy.hundert6.de: mail set sender to using -f Message-ID: <3A14F532.3A9A66ED@radio.hundert6.de> Date: Fri, 17 Nov 2000 10:06:58 +0100 From: Jan Muenther Organization: Radio Hundert,6 X-Mailer: Mozilla 4.72 [en] (X11; I; FreeBSD 4.0-RELEASE i386) X-Accept-Language: en MIME-Version: 1.0 To: murray.barton@police.wa.gov.au, "'fwtk-users@ex.tis.com'" Subject: Re: smap References: <7A889AE3548BD4119F830008C7F35DAF936D78@EXHSRV1> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 700 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, > Our syslog's are also ver large for a 7 day period (~ 20M) most of which > seems to be mail related of the form- > Nov 12 03:41:29 phq1098 sendmail[11480]: DAA11480: from=, > s > ize=6562, class=0, pri=7562, nrcpts=1, > msgid= l.com>, relay=smap@localhost Erm, sorry about the question, but you did apply the yao patch or alike to prevent your host from being used as an open relay for spammers....??? If not, DO SO. Bye, Jan -- Radio HUNDERT,6 Medien GmbH Berlin - EDV - j.muenther@radio.hundert6.de From owner-fwtk-users@ex.tis.com Fri Nov 17 08:31 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA29239 Fri, 17 Nov 2000 08:30:44 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA01166; Fri, 17 Nov 2000 05:29:51 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 17 Nov 2000 04:00:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA27913 for fwtk-users-outgoing; Fri, 17 Nov 2000 04:00:21 -0800 (PST) Message-Id: <5.0.2.1.0.20001117065114.01d0c560@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.2 Date: Fri, 17 Nov 2000 06:57:31 -0500 To: murray.barton@police.wa.gov.au, fwtk-users@ex.tis.com From: Rick Murphy Subject: Re: smap In-Reply-To: <7A889AE3548BD4119F830008C7F35DAF936D78@EXHSRV1> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 939 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 04:30 PM 11/17/00 +0800, murray.barton@police.wa.gov.au wrote: >Taking a look in the log I see a lot of the messages are like- >smap[4953]: mask failed: >or >smap[5768]: mask failed: That's a new one for me - what operating system is this running on? >Our syslog's are also ver large for a 7 day period (~ 20M) most of which >seems to be mail related of the form- >Nov 12 03:41:29 phq1098 sendmail[11480]: DAA11480: from=, >s >ize=6562, class=0, pri=7562, nrcpts=1, >msgid=l.com>, relay=smap@localhost You may be being used as a spam relay. If the messages are being sent to users outside of your domain, it's quite certain that you are. Get Joe Yao's smap patch from the FAQ site (www.fwtk.org) and install it, or turn smap off. -Rick From owner-fwtk-users@ex.tis.com Mon Nov 20 08:23 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA09458 Mon, 20 Nov 2000 08:23:45 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA27825; Mon, 20 Nov 2000 05:22:57 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Nov 2000 03:01:42 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA22805 for fwtk-users-outgoing; Mon, 20 Nov 2000 03:01:31 -0800 (PST) From: "Roelf Schreurs" To: "Fwtk-Users" Subject: Linux upgrade Date: Mon, 20 Nov 2000 12:51:15 +0200 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 292 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] We want to upgrade our Red Hat server from 5.2 to 6.2. Has anybody done this and will there be any problems with the firewall kit if we do this?? Roelf Schreurs From owner-fwtk-users@ex.tis.com Mon Nov 20 09:23 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA09723 Mon, 20 Nov 2000 09:23:19 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA01907; Mon, 20 Nov 2000 06:22:50 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Nov 2000 04:59:27 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA26850 for fwtk-users-outgoing; Mon, 20 Nov 2000 04:59:16 -0800 (PST) Date: Mon, 20 Nov 2000 13:58:39 +0100 From: Georg Wittig To: fwtk-users@ex.tis.com Subject: User database question Message-ID: <20001120135839.E15219@twister.gmd.de> Mime-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.2.5i Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1066 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi, I'm running fwtk-2.1 under RedHat-6.2. For authenitication of my users I use authsrv together with opie-2.32. How can I establish and initialize users that are in my fw-authdb, but *not* in the /etc/passwd file? Authsrv can establish such users, but when I try to initialize those users in the opie system, then opiepasswd insists that those users can be found in /etc/passwd. In case this problem can be solved easier with s/key instead of opie: Where can I get an s/key version which handles md5 and can work together with fwtk? The fwtk documentation doesn't seem to cover my problem, nor does the fwtk mailing list archive, nor do deja.com and altavista. Thanks for your help, -- Georg Wittig, GMD Georg.Wittig@gmd.de - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Spiders keep both flies and alligators away. I've never found an alligator in my garage, and there are lots of spiders in there. From owner-fwtk-users@ex.tis.com Mon Nov 20 11:05 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA09975 Mon, 20 Nov 2000 11:05:37 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA14139; Mon, 20 Nov 2000 08:04:48 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Nov 2000 06:40:02 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA03815 for fwtk-users-outgoing; Mon, 20 Nov 2000 06:39:41 -0800 (PST) From: Chris Wakelin To: Georg Wittig cc: fwtk-users@ex.tis.com Subject: Re: User database question In-Reply-To: <20001120135839.E15219@twister.gmd.de> Message-ID: Date: Mon, 20 Nov 2000 14:36:51 +0000 (GMT Standard Time) X-Mailer: Simeon for Win32 Version 4.1.1 Build (17) X-Authentication: none MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: MULTIPART/MIXED; BOUNDARY="Part10011201451.B" Content-Length: 3896 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] --Part10011201451.B Content-Type: TEXT/PLAIN; CHARSET=US-ASCII This is what I did: "cd opie-2.32" "./configure --prefix=/opt/local/fwtk" (or wherever) "make client" (don't make install or you'll overwrite your system files!) Apply the opie.patch from fwtk.org (you don't need to uncomment the SKEY lines in auth.h). I found I needed to modify auth/opie.c (patch attached) to make it work properly - it was always warning about running out of passwords. Hope this helps, Chris On Mon, 20 Nov 2000 13:58:39 +0100 Georg Wittig wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > Hi, > > I'm running fwtk-2.1 under RedHat-6.2. For authenitication of my users > I use authsrv together with opie-2.32. > > How can I establish and initialize users that are in my fw-authdb, but > *not* in the /etc/passwd file? Authsrv can establish such users, but > when I try to initialize those users in the opie system, then > opiepasswd insists that those users can be found in /etc/passwd. > --+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-- Christopher Wakelin, c.d.wakelin@reading.ac.uk IT Services Centre, The University of Reading, Tel: +44 (0)118 931 6630 Whiteknights, Reading, RG6 2AF, UK Fax: +44 (0)118 975 3094 --Part10011201451.B Content-Type: TEXT/Plain; name="opie.patch" *** opie.c Wed Dec 1 18:05:04 1999 --- opie.c.orig Mon Nov 20 14:27:01 2000 *************** *** 6,16 **** * */ - /* - * Modified by Chris Wakelin, IT Services, The University of Reading - * to fix bug in test for running out of passwords - */ - #include #include #include --- 6,11 ---- *************** *** 48,63 **** Auth *ap; char *rbuf; { - int i; strcpy(rbuf,"Permission Denied."); if(!challenged) return(1); challenged = 0; - i = opiegetsequence(&kbuf); /* save password sequence number */ - /* since opieverify zeros kbuf */ if(opieverify(&kbuf,pass) == 0) { strcpy(rbuf,"ok"); ! if(i < 5) strcat(rbuf,"Warning -- Change password soon!"); return(0); } --- 43,55 ---- Auth *ap; char *rbuf; { strcpy(rbuf,"Permission Denied."); if(!challenged) return(1); challenged = 0; if(opieverify(&kbuf,pass) == 0) { strcpy(rbuf,"ok"); ! if(kbuf.opie_n < 5) strcat(rbuf,"Warning -- Change password soon!"); return(0); } *************** *** 84,93 **** switch (rval) { case 0: ! printf("Updating %s:\n", user); break; case 1: ! printf("Adding %s:\n", user); break; case 2: strcpy(rbuf, "Error: Can't update key database.\n"); --- 76,85 ---- switch (rval) { case 0: ! /* printf("Updating %s:\n", user); */ break; case 1: ! /* printf("Adding %s:\n", user); */ break; case 2: strcpy(rbuf, "Error: Can't update key database.\n"); *************** *** 120,144 **** goto bad_finish; } - /* Added by CDW to fix problem with report giving meaningless data */ - /* Gets opie settings for newly created/updated user */ - rval = opielookup(&opie, user); - switch (rval) { - case 0: - break; - case 1: - strcpy(rbuf, "Error: Key database wasn't updated for some reason.\n"); - return(1); - case 2: - strcpy(rbuf, "Error (2) reading key database.\n"); - return(1); - default: - strcpy(rbuf, "Error (other) reading key database.\n"); - return(1); - } - - /* End CDW addition */ - sprintf(rbuf, "ID %s OTP key is %d %s", opie.opie_principal, opie.opie_n, opie.opie_seed); --- 112,117 ---- --Part10011201451.B-- From owner-fwtk-users@ex.tis.com Mon Nov 20 15:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA12957 Mon, 20 Nov 2000 15:26:02 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA22031; Mon, 20 Nov 2000 12:25:12 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Nov 2000 11:07:44 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id LAA09268 for fwtk-users-outgoing; Mon, 20 Nov 2000 11:07:33 -0800 (PST) Message-ID: <3A1932DF.FD8C253@lclcan.com> Date: Mon, 20 Nov 2000 09:19:11 -0500 From: Don X-Mailer: Mozilla 4.75 [en] (Win98; U) X-Accept-Language: en,pdf MIME-Version: 1.0 To: Fwtk-Users Subject: Re: Linux upgrade References: Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 722 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I did that very upgrade with no noticeable problems. I had installed the FWTK priorto doing the upgrade. Roelf Schreurs wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > We want to upgrade our Red Hat server from 5.2 to 6.2. Has anybody done this > and will there be any problems with the firewall kit if we do this?? > > Roelf Schreurs -- please visit our website at:  www.lclcan.com From owner-fwtk-users@ex.tis.com Mon Nov 20 15:26 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA12956 Mon, 20 Nov 2000 15:26:00 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA22027; Mon, 20 Nov 2000 12:25:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 20 Nov 2000 10:53:13 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA07097 for fwtk-users-outgoing; Mon, 20 Nov 2000 10:52:51 -0800 (PST) From: "Luis Fernando Barrera" To: Cc: Subject: RE: Linux upgrade Date: Mon, 20 Nov 2000 12:50:34 -0600 Message-ID: MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 Importance: Normal In-Reply-To: Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id KAA07045 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 739 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] FWTK works fine on RedHat 6.2... Luis Fernando Barrera luba@assist.com.gt > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Roelf Schreurs > Sent: Monday, November 20, 2000 4:51 AM > To: Fwtk-Users > Subject: Linux upgrade > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > We want to upgrade our Red Hat server from 5.2 to 6.2. Has > anybody done this > and will there be any problems with the firewall kit if we do this?? > > Roelf Schreurs From owner-fwtk-users@ex.tis.com Tue Nov 21 05:43 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA15603 Tue, 21 Nov 2000 05:43:28 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA22684; Tue, 21 Nov 2000 02:42:29 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Nov 2000 01:28:48 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA19920 for fwtk-users-outgoing; Tue, 21 Nov 2000 01:28:37 -0800 (PST) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: Date: Tue, 21 Nov 2000 09:28:10 -0000 (GMT) From: Tony Gale To: fwtk-users@ex.tis.com Subject: RE: Linux upgrade Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 1399 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] You will want to at least apply the "connection reset by peer" patch if you haven't already (FAQ section 1.7) - it's also in the patch kit I sent out recently. -tony On 20-Nov-2000 Luis Fernando Barrera wrote: > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > FWTK works fine on RedHat 6.2... > > Luis Fernando Barrera > luba@assist.com.gt > >> -----Original Message----- >> From: owner-fwtk-users@ex.tis.com >> [mailto:owner-fwtk-users@ex.tis.com]On >> Behalf Of Roelf Schreurs >> Sent: Monday, November 20, 2000 4:51 AM >> To: Fwtk-Users >> Subject: Linux upgrade >> >> >> [To be removed from this list send the message "unsubscribe >> fwtk-users" in the >> BODY of a mail message to majordomo@ex.tis.com.] >> >> We want to upgrade our Red Hat server from 5.2 to 6.2. Has >> anybody done this >> and will there be any problems with the firewall kit if we do >> this?? >> >> Roelf Schreurs --- E-Mail: Tony Gale In most instances, all an argument proves is that two people are present. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Tue Nov 21 05:43 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id FAA15606 Tue, 21 Nov 2000 05:43:31 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA22674; Tue, 21 Nov 2000 02:42:11 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 21 Nov 2000 01:04:26 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA19226 for fwtk-users-outgoing; Tue, 21 Nov 2000 01:04:05 -0800 (PST) X-Authentication-Warning: proxy.hundert6.de: mail set sender to using -f Message-ID: <3A1A3A56.EFBF1CC4@radio.hundert6.de> Date: Tue, 21 Nov 2000 10:03:18 +0100 From: Jan Muenther Organization: Radio Hundert,6 X-Mailer: Mozilla 4.72 [en] (X11; I; FreeBSD 4.0-RELEASE i386) X-Accept-Language: en MIME-Version: 1.0 To: Don , "'fwtk-users@ex.tis.com'" Subject: Re: Linux upgrade References: <3A1932DF.FD8C253@lclcan.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 772 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > > We want to upgrade our Red Hat server from 5.2 to 6.2. Has anybody done this > > and will there be any problems with the firewall kit if we do this?? There are just a few things I think of whilst hearing (reading) that: - as far as I recall there are quite a few security issues with RH 6.2 - check bastille linux for hardening your installation (e.g. ping was broken, I think. - 5.2 didn't have shadow passwords by default, I think. Apart from that, fwtk runs fine under every Linux distro I've tried so far (Slackware, RH, Debian, DLD, SuSE). Cheers, Jan -- Radio HUNDERT,6 Medien GmbH Berlin - EDV - j.muenther@radio.hundert6.de From owner-fwtk-users@ex.tis.com Wed Nov 22 20:49 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA23258 Wed, 22 Nov 2000 20:49:33 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA25108; Wed, 22 Nov 2000 17:48:16 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Nov 2000 15:37:26 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA20487 for fwtk-users-outgoing; Wed, 22 Nov 2000 15:37:15 -0800 (PST) From: "Ken Long" Organization: Lectrosonics, Inc. To: fwtk-users@ex.tis.com Date: Wed, 22 Nov 2000 16:36:43 -0700 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: smap: spam-block Message-ID: <3A1BF61B.29409.2303EA2@localhost> X-mailer: Pegasus Mail for Win32 (v3.12c) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 835 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] The archives don't have an answer to this... I'm trying to get the spam-block option working. I'm using smap 2.1 with the Yao patches (V2.1/2.1+anti-relay+anti-spam). I've tried two ways but email from the specified sender still gets through to the specified recipient. smap: spam-block deny sender-klong@compuserve.com \ recipient-ken@lectrosonics.com (Shown line wrapped in this message only.) smap: spam-block deny klong@compuserve.com ken@lectrosonics.com Neither one of these will block. Am I doing this correctly? Other options in my netperm-table are smap: scrub-spam smap: check-from-address 1 smap: broken-from <> plus some other unrelated stuff. TIA, Ken Long Lectrosonics, Inc. From owner-fwtk-users@ex.tis.com Wed Nov 22 23:14 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA23527 Wed, 22 Nov 2000 23:14:55 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA29810; Wed, 22 Nov 2000 20:13:38 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 22 Nov 2000 18:48:26 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA26658 for fwtk-users-outgoing; Wed, 22 Nov 2000 18:48:04 -0800 (PST) Message-Id: <5.0.2.1.0.20001122213919.01d34d70@mail.itm-inst.com> X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.0.2 Date: Wed, 22 Nov 2000 21:43:41 -0500 To: "Ken Long" , fwtk-users@ex.tis.com From: Rick Murphy Subject: Re: smap: spam-block In-Reply-To: <3A1BF61B.29409.2303EA2@localhost> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 643 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] At 04:36 PM 11/22/00 -0700, Ken Long wrote: >I'm trying to get the spam-block option working. I'm using smap 2.1 with the >Yao patches (V2.1/2.1+anti-relay+anti-spam). Make sure you compile smap with PROTECTINBOUND defined; otherwise, spam-block doesn't do anything. It's not defined in the default source. The form of the block entry is your second example: smap: spam-block deny sender@outside.address.org recipient@inside.address.com I've never used 'spam-block', however, so good luck :-) -Rick From owner-fwtk-users@ex.tis.com Mon Nov 27 12:48 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id MAA08027 Mon, 27 Nov 2000 12:48:07 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA08089; Mon, 27 Nov 2000 09:46:55 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 27 Nov 2000 07:21:34 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA16536 for fwtk-users-outgoing; Mon, 27 Nov 2000 07:21:23 -0800 (PST) From: "Ken Long" Organization: Lectrosonics, Inc. To: fwtk-users@ex.tis.com Date: Mon, 27 Nov 2000 08:20:29 -0700 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: Re: smap: spam-block Message-ID: <3A22194A.13600.5F3CA1@localhost> In-reply-to: <5.0.2.1.0.20001122213919.01d34d70@mail.itm-inst.com> References: <3A1BF61B.29409.2303EA2@localhost> X-mailer: Pegasus Mail for Win32 (v3.12c) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 584 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Thanks Rick. Except for the Yao patches, I haven't modified the source at all. I'll check my source for PROTECTINBOUND. Ken On 22 Nov 2000, at 21:43, Rick Murphy wrote: > Make sure you compile smap with PROTECTINBOUND defined; otherwise, > spam-block doesn't do anything. It's not defined in the default source. > > The form of the block entry is your second example: > smap: spam-block deny sender@outside.address.org recipient@inside.address.com From owner-fwtk-users@ex.tis.com Mon Nov 27 19:54 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA09370 Mon, 27 Nov 2000 19:54:21 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA14460; Mon, 27 Nov 2000 16:53:33 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 27 Nov 2000 15:23:53 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA05527 for fwtk-users-outgoing; Mon, 27 Nov 2000 15:23:43 -0800 (PST) From: "Ken Long" Organization: Lectrosonics, Inc. To: fwtk-users@ex.tis.com Date: Mon, 27 Nov 2000 16:23:13 -0700 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: Re: smap: spam-block Message-ID: <3A228A6F.29432.D392BC@localhost> In-reply-to: <5.0.2.1.0.20001122213919.01d34d70@mail.itm-inst.com> References: <3A1BF61B.29409.2303EA2@localhost> X-mailer: Pegasus Mail for Win32 (v3.12c) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 1202 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I added this to the Makefile CFLAGS= -I.. $(COPT) -DPROTECTINBOUND but smap still isn't blocking defined addresses. They just sail on through like a knife through butter! The output of the make command was: lectro7:/usr/src/fwtk/smap# make cc -I.. -g -DLINUX -DPROTECTINBOUND -c smap.c -o smap.o cc -I.. -g -DLINUX -DPROTECTINBOUND -c arpadate.c -o arpadate.o cc -g -static -o smap smap.o arpadate.o ../libfwall.a I can post my entire netperm-table if necessary. Thanks, Ken On 22 Nov 2000, at 21:43, Rick Murphy wrote: > At 04:36 PM 11/22/00 -0700, Ken Long wrote: > >I'm trying to get the spam-block option working. I'm using smap 2.1 with the > >Yao patches (V2.1/2.1+anti-relay+anti-spam). > > Make sure you compile smap with PROTECTINBOUND defined; otherwise, > spam-block doesn't do anything. It's not defined in the default source. > > The form of the block entry is your second example: > smap: spam-block deny sender@outside.address.org recipient@inside.address.com > > I've never used 'spam-block', however, so good luck :-) > -Rick From owner-fwtk-users@ex.tis.com Wed Nov 29 13:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA16959 Wed, 29 Nov 2000 13:32:30 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA01949; Wed, 29 Nov 2000 10:32:14 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 29 Nov 2000 08:13:37 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA10492 for fwtk-users-outgoing; Wed, 29 Nov 2000 08:13:26 -0800 (PST) Message-Id: <200011291612.JAA04884@lectrosonics.com> From: "Ken Long" Organization: Lectrosonics, Inc. To: fwtk-users@ex.tis.com Date: Wed, 29 Nov 2000 09:12:36 -0600 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: Re: smap: spam-block In-reply-to: <3A228A6F.29432.D392BC@localhost> References: <5.0.2.1.0.20001122213919.01d34d70@mail.itm-inst.com> X-mailer: Pegasus Mail for Windows (v3.12b) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 1517 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Ok, is anyone using spam-block successfully? I'm beginning to wonder if this feature is working at all. (BTW, this list has really dropped in volume. What's everyone using these days? Netfilter?) Ken On 27 Nov 00, at 16:23, Ken Long wrote: > I added this to the Makefile > > CFLAGS= -I.. $(COPT) -DPROTECTINBOUND > > but smap still isn't blocking defined addresses. They just sail on through > like a knife through butter! > > The output of the make command was: > > lectro7:/usr/src/fwtk/smap# make > cc -I.. -g -DLINUX -DPROTECTINBOUND -c smap.c -o smap.o > cc -I.. -g -DLINUX -DPROTECTINBOUND -c arpadate.c -o arpadate.o > cc -g -static -o smap smap.o arpadate.o ../libfwall.a > > I can post my entire netperm-table if necessary. > > Thanks, > Ken > > On 22 Nov 2000, at 21:43, Rick Murphy wrote: > > > At 04:36 PM 11/22/00 -0700, Ken Long wrote: > > >I'm trying to get the spam-block option working. I'm using smap 2.1 with the > > >Yao patches (V2.1/2.1+anti-relay+anti-spam). > > > > Make sure you compile smap with PROTECTINBOUND defined; otherwise, > > spam-block doesn't do anything. It's not defined in the default source. > > > > The form of the block entry is your second example: > > smap: spam-block deny sender@outside.address.org recipient@inside.address.com > > > > I've never used 'spam-block', however, so good luck :-) > > -Rick From owner-fwtk-users@ex.tis.com Wed Nov 29 13:32 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA16962 Wed, 29 Nov 2000 13:32:31 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA01957; Wed, 29 Nov 2000 10:32:15 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 29 Nov 2000 08:54:31 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA17779 for fwtk-users-outgoing; Wed, 29 Nov 2000 08:54:10 -0800 (PST) Date: Wed, 29 Nov 2000 11:47:10 -0500 (EST) From: Ross Bergman To: rmurphy@itm-inst.com cc: fwtk-users@ex.tis.com Subject: http://www.fwtk.org/fwtk/faq/faq.html#2.4.5 Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 803 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] We've been running FWTK for a number of years now, and recently I've received complaints from users trying to access www.boston.com and odt.jamestower.com that they're unable to do so. The error logged is described in the FAQ, as you've pointed out in numerous emails over the years. Is there a patch for this supposed "bug in the http-gw code"? Thank you. ------------------------------------------------------------------------------- Ross E. Bergman Director of Information Technologies Ross.Bergman@PerkinElmer.com PerkinElmer Detection Systems ------------------------------------------------------------------------------- From owner-fwtk-users@ex.tis.com Wed Nov 29 18:43 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA17779 Wed, 29 Nov 2000 18:43:03 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA19736; Wed, 29 Nov 2000 15:42:10 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 29 Nov 2000 14:14:17 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA04891 for fwtk-users-outgoing; Wed, 29 Nov 2000 14:14:03 -0800 (PST) Message-Id: <200011292213.OAA17338@relay.nai.com> Date: Wed, 29 Nov 2000 23:16:41 +0100 From: Jens Sauer Reply-To: Jens Sauer To: fwtk-users@ex.tis.com Subject: Re: smap: spam-block X-Mailer: Jens Sauer's registered AK-Mail 3.1 publicbeta2a [ger] Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 750 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] X Hello, was asking that myself too. I was just a reader on this list, thinking about an attempt to install fwtk on my gateway, but was afraid of the needed patches, because of my "beginner-status" on FreeBSD. Could anyone (with experience) please tell me, if there is an alternative to fwtk, that is providing the same functionality without being this complicated to install. Thanks in advance Jens > Ok, is anyone using spam-block successfully? I'm beginning to wonder if > this > feature is working at all. > (BTW, this list has really dropped in volume. What's everyone using these > days? Netfilter?) > Ken From owner-fwtk-users@ex.tis.com Wed Nov 29 20:22 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA18071 Wed, 29 Nov 2000 20:22:12 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA28369; Wed, 29 Nov 2000 17:21:21 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 29 Nov 2000 15:57:44 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA21332 for fwtk-users-outgoing; Wed, 29 Nov 2000 15:57:33 -0800 (PST) From: "Ken Long" Organization: Lectrosonics, Inc. To: fwtk-users@ex.tis.com Date: Wed, 29 Nov 2000 16:57:04 -0700 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: Re: smap: spam-block Message-ID: <3A25355D.25030.2371732@localhost> In-reply-to: <200011292213.OAA17338@relay.nai.com> X-mailer: Pegasus Mail for Win32 (v3.12c) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 1358 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Heh, a co-worker and I were just talking about how the fwtk is from the "old school". Many of the features are not documented, some of the features are mis-documented or simply don't work and to really find out how to make it work requires reading the source code. In fact, if you need anything else besides basic proxy services, modifying the source will be necessary. We've had to do that here several times. I think it's time to find a different solution what with this list falling by the wayside. Ken On 29 Nov 2000, at 23:16, Jens Sauer wrote: > X > Hello, > > was asking that myself too. > I was just a reader on this list, thinking about an attempt to install > fwtk on my gateway, but was afraid of the needed patches, because of my > "beginner-status" on FreeBSD. > Could anyone (with experience) please tell me, if there is an alternative > to fwtk, that is providing the same functionality without being this complicated > to install. > > Thanks in advance > Jens > > > Ok, is anyone using spam-block successfully? I'm beginning to wonder if > > this > > feature is working at all. > > > (BTW, this list has really dropped in volume. What's everyone using these > > days? Netfilter?) > > > Ken From owner-fwtk-users@ex.tis.com Thu Nov 30 03:06 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id DAA19004 Thu, 30 Nov 2000 03:06:29 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA14016; Thu, 30 Nov 2000 00:04:42 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 29 Nov 2000 22:30:27 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id WAA11294 for fwtk-users-outgoing; Wed, 29 Nov 2000 22:30:16 -0800 (PST) Date: Thu, 30 Nov 2000 08:28:12 +0200 (EET) From: Adrian Florea To: fwtk-users@ex.tis.com Subject: fwtk & Red Hat Linux In-Reply-To: Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 350 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I'm a begginer in network administration and I want to ask about how is fwtk working under Linux. I'm currently using IP-Masquerading and tools like IP-Chains for firewalling for 2 subnetworks. Thanks, Adi From owner-fwtk-users@ex.tis.com Thu Nov 30 06:04 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA19345 Thu, 30 Nov 2000 06:04:05 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA27756; Thu, 30 Nov 2000 03:02:19 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 30 Nov 2000 01:00:38 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA15335 for fwtk-users-outgoing; Thu, 30 Nov 2000 01:00:04 -0800 (PST) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: Date: Thu, 30 Nov 2000 08:57:42 -0000 (GMT) From: Tony Gale To: Ross Bergman Subject: RE: http://www.fwtk.org/fwtk/faq/faq.html#2.4.5 Cc: fwtk-users@ex.tis.com, rmurphy@itm-inst.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 1582 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] The error discussed in the FAQ is due to improper propagation of an error condition. The real issue is, why was the connection closed in the first place? I'll have a look into what is failing. I have an even wierder one to look into anyway. On 29-Nov-2000 Ross Bergman wrote: > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > We've been running FWTK for a number of years now, and recently > I've > received complaints from users trying to access www.boston.com and > odt.jamestower.com that they're unable to do so. The error logged > is > described in the FAQ, as you've pointed out in numerous emails over > the years. > > Is there a patch for this supposed "bug in the http-gw code"? > > Thank you. > > -------------------------------------------------------------------- > ----------- > Ross E. Bergman Director of Information > Technologies > Ross.Bergman@PerkinElmer.com PerkinElmer Detection > Systems > -------------------------------------------------------------------- > ----------- --- E-Mail: Tony Gale Virtue does not always demand a heavy sacrifice -- only the willingness to make it when necessary. -- Frederick Dunn The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Thu Nov 30 06:04 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA19346 Thu, 30 Nov 2000 06:04:07 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA27752; Thu, 30 Nov 2000 03:02:19 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 30 Nov 2000 01:01:31 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA15449 for fwtk-users-outgoing; Thu, 30 Nov 2000 01:01:11 -0800 (PST) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) Content-Transfer-Encoding: 8bit MIME-Version: 1.0 In-Reply-To: Date: Thu, 30 Nov 2000 08:59:05 -0000 (GMT) From: Tony Gale To: Adrian Florea Subject: RE: fwtk & Red Hat Linux Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=iso-8859-1 Content-Length: 937 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] It works fine - check the FAQ at www.fwtk.org and apply the patches that are on there. -tony On 30-Nov-2000 Adrian Florea wrote: > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > > > Hello, > > I'm a begginer in network administration and I want to ask about > how is > fwtk working under Linux. I'm currently using IP-Masquerading and > tools > like IP-Chains for firewalling for 2 subnetworks. > > > > Thanks, > > Adi --- E-Mail: Tony Gale Nothing is so firmly believed as that which we least know. -- Michel de Montaigne The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. From owner-fwtk-users@ex.tis.com Thu Nov 30 06:58 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA19431 Thu, 30 Nov 2000 06:58:24 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA00724; Thu, 30 Nov 2000 03:57:40 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 30 Nov 2000 02:19:40 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA14411 for fwtk-users-outgoing; Thu, 30 Nov 2000 02:18:58 -0800 (PST) Message-Id: <200011301017.CAA24732@relay.nai.com> Date: Thu, 30 Nov 2000 11:20:41 +0100 From: Jens Sauer Reply-To: Jens Sauer To: fwtk-users@ex.tis.com Subject: Re: smap: spam-block X-Mailer: Jens Sauer's registered AK-Mail 3.1 publicbeta2a [ger] Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1604 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Maybe you're right, will go on trying to find another solution although I've read somewehere, that "somebody" maybe plans to continue work on the fwtk in the (not so near) future. Good luck Jens > Heh, a co-worker and I were just talking about how the fwtk is from the > "old > school". Many of the features are not documented, some of the features > are > mis-documented or simply don't work and to really find out how to make it > work requires reading the source code. In fact, if you need anything else > besides basic proxy services, modifying the source will be necessary. > We've > had to do that here several times. I think it's time to find a different > solution what with this list falling by the wayside. > Ken > On 29 Nov 2000, at 23:16, Jens Sauer wrote: >> X >> Hello, >> >> was asking that myself too. >> I was just a reader on this list, thinking about an attempt to install >> fwtk on my gateway, but was afraid of the needed patches, because of my >> "beginner-status" on FreeBSD. >> Could anyone (with experience) please tell me, if there is an alternative >> to fwtk, that is providing the same functionality without being this >> complicated >> to install. >> >> Thanks in advance >> Jens >> >> > Ok, is anyone using spam-block successfully? I'm beginning to wonder >> > if >> > this >> > feature is working at all. >> >> > (BTW, this list has really dropped in volume. What's everyone using >> > these >> > days? Netfilter?) >> >> > Ken From owner-fwtk-users@ex.tis.com Thu Nov 30 06:59 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA19436 Thu, 30 Nov 2000 06:59:04 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA00737; Thu, 30 Nov 2000 03:57:49 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 30 Nov 2000 02:38:13 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id CAA22569 for fwtk-users-outgoing; Thu, 30 Nov 2000 02:36:50 -0800 (PST) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) MIME-Version: 1.0 In-Reply-To: Date: Thu, 30 Nov 2000 10:33:33 -0000 (GMT) From: Tony Gale To: Ross Bergman Subject: RE: http://www.fwtk.org/fwtk/faq/faq.html#2.4.5 Cc: rmurphy@itm-inst.com, fwtk-users@ex.tis.com, support@netscape.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="_=XFMail.1.4.4.Linux:20001130103333:10486=_" Content-Length: 4984 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format --_=XFMail.1.4.4.Linux:20001130103333:10486=_ Content-Type: text/plain; charset=iso-8859-1 Ouch. This is gonna hurt. www.boston.com is running Netscape-Enterprise/3.6 SP3 It is possibly the most broken server I've ever seen. If it doesn't receive the GET request and a Host header in the *same packet* it will simply reset the connection. I enclose a test program to illustrate my point. The other server is broken in a different way - haven't looked at it in detail yet. -tony On 30-Nov-2000 Tony Gale wrote: > > I'll have a look into what is failing. I have an even wierder one > to > look into anyway. > > > On 29-Nov-2000 Ross Bergman wrote: >> >> We've been running FWTK for a number of years now, and recently >> I've >> received complaints from users trying to access www.boston.com and >> odt.jamestower.com that they're unable to do so. The error logged >> is >> described in the FAQ, as you've pointed out in numerous emails >> over >> the years. >> >> Is there a patch for this supposed "bug in the http-gw code"? >> --- E-Mail: Tony Gale These screamingly hilarious gogs ensure owners of X Ray Gogs to be the life of any party. -- X-Ray Gogs Instructions The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. --_=XFMail.1.4.4.Linux:20001130103333:10486=_ Content-Disposition: attachment; filename="svrtst.c" Content-Transfer-Encoding: 7bit Content-Description: svrtst.c Content-Type: text/plain; charset=iso-8859-1; name=svrtst.c; SizeOnDisk=3145 #include #include #include #include #include #include #include #include #include #define BUFFSIZE 8192 #define SERV_PORT 80 #define SERV_ADDR "140.239.226.200" /* www.boston.com */ static char *string1 = "GET / HTTP/1.0\r\n" "Host: www.boston.com\r\n" "\r\n"; static char *string2_1 = "GET / HTTP/1.0\r\n"; static char *string2_2 = "Host: www.boston.com\r\n" "\r\n"; int cpline(int source) { int n; char buff[BUFFSIZE]; if ( (n = read(source, buff, BUFFSIZE)) > 0) { buff[n]='\0'; printf("%s\n", buff); fflush(stdout); } else return(1); return(0); } int svr_connect() { int outsd; struct sockaddr_in rserv_addr; /* Open TCP connection to the server */ bzero((char *) &rserv_addr, sizeof(rserv_addr)); rserv_addr.sin_family = AF_INET; rserv_addr.sin_addr.s_addr = inet_addr(SERV_ADDR); rserv_addr.sin_port = htons(SERV_PORT); if ( (outsd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { perror("client socket"); exit(1); } if (connect(outsd, (struct sockaddr *) &rserv_addr, sizeof(rserv_addr)) < 0) { perror("client connect"); exit(1); } return(outsd); } int main() { int outsd, i, done; fd_set fdvar; /* --===== Test1 ====-- */ printf("--===== Test1 ====--\n\n"); outsd = svr_connect(); printf("Connected to server\n\n"); errno=0; i = write(outsd, string1, strlen(string1)); if (i != strlen(string1)) { if (i == -1) { perror("write"); } else { printf("wrote %d/%d\n", i, strlen(string1)); exit(1); } } do { FD_ZERO(&fdvar); FD_SET(outsd, &fdvar); if (select(outsd+1, &fdvar, 0, 0, 0) < 0) { perror("select"); exit(1); } if (FD_ISSET(outsd, &fdvar)) { printf("\n--------=========== SERVER\n"); if ( (done = cpline(outsd)) == 1) { printf("--------=========== SERVER DISCONNECTED\n"); } } }while(!done); close(outsd); /* --===== Test2 ====-- */ printf("\n\n--===== Test2 ====--\n\n"); outsd = svr_connect(); printf("Connected to server\n\n"); errno=0; i = write(outsd, string2_1, strlen(string2_1)); if (i != strlen(string2_1)) { if (i == -1) { perror("write"); } else { printf("wrote %d/%d\n", i, strlen(string2_1)); exit(1); } } errno=0; i = write(outsd, string2_2, strlen(string2_2)); if (i != strlen(string2_2)) { if (i == -1) { perror("write"); } else { printf("wrote %d/%d\n", i, strlen(string2_2)); exit(1); } } do { FD_ZERO(&fdvar); FD_SET(outsd, &fdvar); if (select(outsd+1, &fdvar, 0, 0, 0) < 0) { perror("select"); exit(1); } if (FD_ISSET(outsd, &fdvar)) { printf("\n--------=========== SERVER\n"); if ( (done = cpline(outsd)) == 1) { printf("--------=========== SERVER DISCONNECTED\n"); } } }while(!done); close(outsd); return(0); } --_=XFMail.1.4.4.Linux:20001130103333:10486=_-- End of MIME message From owner-fwtk-users@ex.tis.com Thu Nov 30 09:11 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA19823 Thu, 30 Nov 2000 09:11:04 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA07179; Thu, 30 Nov 2000 06:09:58 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 30 Nov 2000 04:43:56 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id EAA02849 for fwtk-users-outgoing; Thu, 30 Nov 2000 04:43:25 -0800 (PST) Message-ID: X-Mailer: XFMail 1.4.4 on Linux X-Priority: 3 (Normal) MIME-Version: 1.0 In-Reply-To: Date: Thu, 30 Nov 2000 12:41:10 -0000 (GMT) From: Tony Gale To: Ross Bergman Subject: RE: http://www.fwtk.org/fwtk/faq/faq.html#2.4.5 Cc: rmurphy@itm-inst.com, fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/mixed; boundary="_=XFMail.1.4.4.Linux:20001130124110:10486=_" Content-Length: 4834 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This message is in MIME format --_=XFMail.1.4.4.Linux:20001130124110:10486=_ Content-Type: text/plain; charset=iso-8859-1 odt.jamestower.com, it turns out, is broken in a similar way, except it's running IIS4.0 and it just hangs the connection, rather than resetting it. Test program enclosed. When are people going to stop employing monkeys to write software, do proper design, and actually test products. -tony On 30-Nov-2000 Tony Gale wrote: > > I'll have a look into what is failing. I have an even wierder one > to > look into anyway. > > > On 29-Nov-2000 Ross Bergman wrote: >> >> We've been running FWTK for a number of years now, and recently >> I've >> received complaints from users trying to access www.boston.com and >> odt.jamestower.com that they're unable to do so. The error logged >> is >> described in the FAQ, as you've pointed out in numerous emails >> over >> the years. >> >> Is there a patch for this supposed "bug in the http-gw code"? --- E-Mail: Tony Gale For good, return good. For evil, return justice. The views expressed above are entirely those of the writer and do not represent the views, policy or understanding of any other person or official body. --_=XFMail.1.4.4.Linux:20001130124110:10486=_ Content-Disposition: attachment; filename="svrtst.c" Content-Transfer-Encoding: 7bit Content-Description: svrtst.c Content-Type: text/plain; charset=iso-8859-1; name=svrtst.c; SizeOnDisk=3154 #include #include #include #include #include #include #include #include #include #define BUFFSIZE 8192 #define SERV_PORT 80 #define SERV_ADDR "198.12.16.30" /* odt.jamestower.com */ static char *string1 = "GET / HTTP/1.0\r\n" "Host: odt.jamestower.com\r\n" "\r\n"; static char *string2_1 = "GET / HTTP/1.0\r\n"; static char *string2_2 = "Host: odt.jamestower.com\r\n" "\r\n"; int cpline(int source) { int n; char buff[BUFFSIZE]; if ( (n = read(source, buff, BUFFSIZE)) > 0) { buff[n]='\0'; printf("%s\n", buff); fflush(stdout); } else return(1); return(0); } int svr_connect() { int outsd; struct sockaddr_in rserv_addr; /* Open TCP connection to the server */ bzero((char *) &rserv_addr, sizeof(rserv_addr)); rserv_addr.sin_family = AF_INET; rserv_addr.sin_addr.s_addr = inet_addr(SERV_ADDR); rserv_addr.sin_port = htons(SERV_PORT); if ( (outsd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { perror("client socket"); exit(1); } if (connect(outsd, (struct sockaddr *) &rserv_addr, sizeof(rserv_addr)) < 0) { perror("client connect"); exit(1); } return(outsd); } int main() { int outsd, i, done; fd_set fdvar; /* --===== Test1 ====-- */ printf("--===== Test1 ====--\n\n"); outsd = svr_connect(); printf("Connected to server\n\n"); errno=0; i = write(outsd, string1, strlen(string1)); if (i != strlen(string1)) { if (i == -1) { perror("write"); } else { printf("wrote %d/%d\n", i, strlen(string1)); exit(1); } } do { FD_ZERO(&fdvar); FD_SET(outsd, &fdvar); if (select(outsd+1, &fdvar, 0, 0, 0) < 0) { perror("select"); exit(1); } if (FD_ISSET(outsd, &fdvar)) { printf("\n--------=========== SERVER\n"); if ( (done = cpline(outsd)) == 1) { printf("--------=========== SERVER DISCONNECTED\n"); } } }while(!done); close(outsd); /* --===== Test2 ====-- */ printf("\n\n--===== Test2 ====--\n\n"); outsd = svr_connect(); printf("Connected to server\n\n"); errno=0; i = write(outsd, string2_1, strlen(string2_1)); if (i != strlen(string2_1)) { if (i == -1) { perror("write"); } else { printf("wrote %d/%d\n", i, strlen(string2_1)); exit(1); } } errno=0; i = write(outsd, string2_2, strlen(string2_2)); if (i != strlen(string2_2)) { if (i == -1) { perror("write"); } else { printf("wrote %d/%d\n", i, strlen(string2_2)); exit(1); } } do { FD_ZERO(&fdvar); FD_SET(outsd, &fdvar); if (select(outsd+1, &fdvar, 0, 0, 0) < 0) { perror("select"); exit(1); } if (FD_ISSET(outsd, &fdvar)) { printf("\n--------=========== SERVER\n"); if ( (done = cpline(outsd)) == 1) { printf("--------=========== SERVER DISCONNECTED\n"); } } }while(!done); close(outsd); return(0); } --_=XFMail.1.4.4.Linux:20001130124110:10486=_-- End of MIME message From owner-fwtk-users@ex.tis.com Thu Nov 30 11:55 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA20708 Thu, 30 Nov 2000 11:55:23 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA26813; Thu, 30 Nov 2000 08:54:13 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 30 Nov 2000 07:24:35 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA14476 for fwtk-users-outgoing; Thu, 30 Nov 2000 07:24:13 -0800 (PST) Message-ID: <3A266E6B.ABD9C7A4@algroup.co.uk> Date: Thu, 30 Nov 2000 15:12:43 +0000 From: Adam Laurie X-Mailer: Mozilla 4.7 [en-gb] (Win98; I) X-Accept-Language: en MIME-Version: 1.0 To: Jens Sauer CC: fwtk-users@ex.tis.com Subject: Re: smap: spam-block References: <200011301017.CAA24732@relay.nai.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 988 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Jens Sauer wrote: > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Maybe you're right, > > will go on trying to find another solution although I've read somewehere, > that "somebody" maybe plans to continue work on the fwtk in the (not so > near) future. lots of us are prepared to work on it, the only question is will the distribution restrictions be lifted? if not then it's time to re-write from scratch... cheers. Adam -- Adam Laurie Tel: +44 (20) 8742 0755 A.L. Digital Ltd. Fax: +44 (20) 8742 5995 Voysey House http://www.thebunker.net Barley Mow Passage http://www.aldigital.co.uk London W4 4GB mailto:adam@algroup.co.uk UNITED KINGDOM PGP key on keyservers From owner-fwtk-users@ex.tis.com Thu Nov 30 14:33 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA21354 Thu, 30 Nov 2000 14:33:32 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA20722; Thu, 30 Nov 2000 11:32:36 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 30 Nov 2000 09:21:48 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA01277 for fwtk-users-outgoing; Thu, 30 Nov 2000 09:21:37 -0800 (PST) From: "Luis Fernando Barrera" To: Subject: RE: smap: spam-block Date: Thu, 30 Nov 2000 11:19:20 -0600 Message-ID: MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.2416 (9.0.2910.0) X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2314.1300 In-reply-to: <200011301017.CAA24732@relay.nai.com> Importance: Normal Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id JAA01228 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2314 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Once I've got into the T-Rex firewall site and it seems this firewall is from the "new school". It has a lot of features and it seems well documented. Does anyone has try it? Luis Fernando Barrera luba@assist.com.gt > -----Original Message----- > From: owner-fwtk-users@ex.tis.com [mailto:owner-fwtk-users@ex.tis.com]On > Behalf Of Jens Sauer > Sent: Thursday, November 30, 2000 4:21 AM > To: fwtk-users@ex.tis.com > Subject: Re: smap: spam-block > > > [To be removed from this list send the message "unsubscribe > fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Maybe you're right, > > will go on trying to find another solution although I've read somewehere, > that "somebody" maybe plans to continue work on the fwtk in the (not so > near) future. > > Good luck > Jens > > > Heh, a co-worker and I were just talking about how the fwtk is from the > > "old > > school". Many of the features are not documented, some of the features > > are > > mis-documented or simply don't work and to really find out how > to make it > > work requires reading the source code. In fact, if you need > anything else > > besides basic proxy services, modifying the source will be necessary. > > We've > > had to do that here several times. I think it's time to find a different > > solution what with this list falling by the wayside. > > > Ken > > > > On 29 Nov 2000, at 23:16, Jens Sauer wrote: > > >> X > >> Hello, > >> > >> was asking that myself too. > >> I was just a reader on this list, thinking about an attempt to install > >> fwtk on my gateway, but was afraid of the needed patches, because of my > >> "beginner-status" on FreeBSD. > >> Could anyone (with experience) please tell me, if there is an > alternative > >> to fwtk, that is providing the same functionality without being this > >> complicated > >> to install. > >> > >> Thanks in advance > >> Jens > >> > >> > Ok, is anyone using spam-block successfully? I'm beginning to wonder > >> > if > >> > this > >> > feature is working at all. > >> > >> > (BTW, this list has really dropped in volume. What's everyone using > >> > these > >> > days? Netfilter?) > >> > >> > Ken > > From owner-fwtk-users@ex.tis.com Thu Nov 30 17:16 EST 2000 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA21667 Thu, 30 Nov 2000 17:16:10 -0500 (EST) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA10272; Thu, 30 Nov 2000 14:15:57 -0800 (PST) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 30 Nov 2000 12:43:17 -0800 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id MAA29695 for fwtk-users-outgoing; Thu, 30 Nov 2000 12:42:35 -0800 (PST) From: ark@eltex.ru Date: Thu, 30 Nov 2000 21:44:57 +0300 Message-Id: <200011301844.VAA01900@paranoid.alpha.int> In-Reply-To: <3A266E6B.ABD9C7A4@algroup.co.uk> from "Adam Laurie " Organization: "Klingon Imperial Intelligence Service" Subject: Re: smap: spam-block To: adam@algroup.co.uk Cc: fwtk-users@ex.tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1631 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, Adam Laurie said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Jens Sauer wrote: > > > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > Maybe you're right, > > > > will go on trying to find another solution although I've read somewehere, > > that "somebody" maybe plans to continue work on the fwtk in the (not so > > near) future. > > lots of us are prepared to work on it, the only question is will the > distribution restrictions be lifted? if not then it's time to re-write > from scratch... The work is already in progress. The old API is subset of new one. Contact me if you need details or if you have some suggestions. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBOiagJ6H/mIJW9LeBAQE4mQP/fK0o+UFLGZEiiVY/VtKZzldbYaBU/o/e 05rqPBrRm/05oG7of+WdYMtoydBrhLkWHv1Mot6n5Io7OVfGXCofp2zRriL2mhR0 DL3C29tLD37eq921xTAGetHcmzXtrq5vBArOBgoh0E9vjsHRq61o5oWhWpHbsGD3 QNbsJATK2EI= =tCCx -----END PGP SIGNATURE-----