From owner-fwtk-users@ex.tis.com Mon Jul 2 10:56 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA02403 Mon, 2 Jul 2001 10:56:21 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA22824; Mon, 2 Jul 2001 10:00:36 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Jul 2001 07:17:07 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id HAA29898 for fwtk-users-outgoing; Mon, 2 Jul 2001 07:15:44 -0500 (CDT) Message-ID: <3B4065B8.10108@dr.gdf.fr> Date: Mon, 02 Jul 2001 14:14:48 +0200 From: Nicolas Leroy User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; fr-FR; m18) Gecko/20010131 Netscape6/6.01 X-Accept-Language: fr MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: Outlook Web Access thrue http-gw Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii; format=flowed Content-Length: 688 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, We've encountered connection problem while trying to give an access to an Internet Outlook Web Server to internal people thrue the TIS http-gw. As a matter of fact, we believe that http-gw v2.1 is NOT "Search Method" compliant and therefore, there's a lost of information (such as directory list, received mail, and so on...) when opening user letter box. The mailing list only gives one solution based on plug-gw connection and I wonder if http-gw can't be configured or upgraded to allow such Method. Thanks in advance for the help, N. Leroy From owner-fwtk-users@ex.tis.com Mon Jul 2 13:34 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA02758 Mon, 2 Jul 2001 13:34:22 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA21777; Mon, 2 Jul 2001 12:38:50 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 2 Jul 2001 09:57:30 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA22090 for fwtk-users-outgoing; Mon, 2 Jul 2001 09:56:09 -0500 (CDT) Message-ID: <00c501c10306$f6cbe810$0b32010a@univlr.fr> Reply-To: "Wilfrid" From: "Wilfrid" To: Subject: HTTPS Date: Mon, 2 Jul 2001 16:54:58 +0200 Organization: IUT La Rochelle MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4133.2400 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 871 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I want to permit HTTP,HTTPS and SSH access to an insidehost from outsidehosts. it works for HTTP and SSH but not for HTTPS. and there are no messages in the logs, and the request doesn't end. So here is my netpermtable: #SSH : OK netacl-ssh: permit-hosts * -exec /usr/local/etc/plug-gw ssh plug-gw: port ssh * -plug-to etubd.univ-lr.fr -port ssh # HTTP: OK http-gw: default-httpd etudiut.univ-lr.fr http-gw: hosts * #HTTPS: PB plug-gw: port https2 * -plug-to etudiut.univ-lr.fr -port 8443 -ssl and /etc/xinet.d/https2: service https2 { socket_type=stream protocol=tcp wait=no user=root server=/usr/local/etc/plug-gw server_args=https2 disable=no } and /etc/services : https2 8443/tcp https2 8443/udp From owner-fwtk-users@ex.tis.com Fri Jul 6 13:27 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id NAA15161 Fri, 6 Jul 2001 13:27:27 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id MAA09930; Fri, 6 Jul 2001 12:31:58 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 6 Jul 2001 09:49:35 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA11203 for fwtk-users-outgoing; Fri, 6 Jul 2001 09:48:14 -0500 (CDT) Message-ID: From: "Skolnik, Ed" To: "'fwtk-users@lists.nai.com'" Subject: Newbee Questions Date: Fri, 6 Jul 2001 09:46:46 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 916 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] How do I find out wha release of the tool kit is runnung? Can I order the FWTK tool kit on CD-ROM or do I have too download it? What are the detailed steps for a Unix novice to "open up " ports on the filewall? Thank you in adavance! Ed Skolnik Florsheim Group Inc. MIT Consultants 200 N. LaSalle Chicago IL. 60601 312-458-2655 Phone 312-458-2661 Fax ed.skolnik@florsheim.com Confidentiality Notice: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message. Thank you. From owner-fwtk-users@ex.tis.com Fri Jul 6 14:07 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA15342 Fri, 6 Jul 2001 14:07:10 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id NAA16213; Fri, 6 Jul 2001 13:11:43 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 6 Jul 2001 10:32:14 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA19735 for fwtk-users-outgoing; Fri, 6 Jul 2001 10:30:52 -0500 (CDT) Message-ID: From: "Skolnik, Ed" To: "'fwtk-users@lists.nai.com'" Subject: RE: Newbee Questions Date: Fri, 6 Jul 2001 10:29:25 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1131 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] > -----Original Message----- > From: Skolnik, Ed > Sent: Friday, July 06, 2001 9:47 AM > To: 'fwtk-users@lists.nai.com' > Subject: Newbee Questions > > How do I find out wha release of the tool kit is runnung? > Can I order the FWTK tool kit on CD-ROM or do I have too download it? > What are the detailed steps for a Unix novice to "open up " ports on the > filewall? > > > > Thank you in adavance! > > Ed Skolnik > Florsheim Group Inc. > MIT Consultants > 200 N. LaSalle > Chicago IL. 60601 > 312-458-2655 Phone > 312-458-2661 Fax > ed.skolnik@florsheim.com > > > > Confidentiality Notice: This e-mail message, including any attachments, is > for the sole use of the intended recipient(s) and may contain confidential > and privileged information. Any unauthorized review, use, disclosure or > distribution is prohibited. If you are not the intended recipient, please > contact the sender by reply e-mail and destroy all copies of the original > message. Thank you. > > > > > From owner-fwtk-users@ex.tis.com Fri Jul 6 17:23 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA16021 Fri, 6 Jul 2001 17:23:28 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA25357; Fri, 6 Jul 2001 16:28:00 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 6 Jul 2001 13:47:50 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA21967 for fwtk-users-outgoing; Fri, 6 Jul 2001 13:46:29 -0500 (CDT) From: "Ken Long" Organization: Lectrosonics, Inc. To: "'fwtk-users@lists.nai.com'" Date: Fri, 6 Jul 2001 12:46:07 -0600 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: Re: Newbee Questions Message-ID: <3B45B30F.32723.6AFE61@localhost> In-reply-to: X-mailer: Pegasus Mail for Win32 (v3.12c) Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 485 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] A good place to get started is: http://www.fwtk.org/main.html Ken Long Lectrosonics, Inc. On 6 Jul 2001, at 9:46, Skolnik, Ed wrote: > How do I find out wha release of the tool kit is runnung? > Can I order the FWTK tool kit on CD-ROM or do I have too download it? > What are the detailed steps for a Unix novice to "open up " ports on the > filewall? From owner-fwtk-users@ex.tis.com Sun Jul 8 23:02 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id XAA19536 Sun, 8 Jul 2001 23:02:49 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id WAA23591; Sun, 8 Jul 2001 22:07:24 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 8 Jul 2001 19:24:13 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA09823 for fwtk-users-outgoing; Sun, 8 Jul 2001 19:22:52 -0500 (CDT) Message-ID: <134812100.994638056348.JavaMail.nobody@fmweb05.unimessage.net> Date: Mon, 9 Jul 2001 02:20:56 +0200 (GMT+02:00) From: Michael Barkhoff To: fwtk-users@ex.tis.com Subject: problem with FTP-GW Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 538 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have a little Problem with the FTP-GW: How can I add "Hostname-Resolving" to FTP-GW? When I try to connect to an FTP-Server thru FTP-GW I get the message "hostname unknown" (I have tried the Command "user anonymous@ftp.redhat.de" via a console-Client). I Use redhat 7.0 ______________________________________________________ http://firemail.fireball.de - Ihr Briefkasten im Web. Einfach, schnell, sicher. From owner-fwtk-users@ex.tis.com Mon Jul 9 01:35 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id BAA19809 Mon, 9 Jul 2001 01:35:37 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA06393; Mon, 9 Jul 2001 00:40:13 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Sun, 8 Jul 2001 21:59:21 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA22632 for fwtk-users-outgoing; Sun, 8 Jul 2001 21:58:00 -0500 (CDT) Date: Sun, 8 Jul 2001 22:55:19 -0400 (EDT) From: Ted Keller To: Michael Barkhoff cc: Subject: Re: problem with FTP-GW In-Reply-To: <134812100.994638056348.JavaMail.nobody@fmweb05.unimessage.net> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 956 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Michael, ftp-gw uses the resolver pointed to by your /etc/resolv.conf file. Verify that your firewall can resolve your remote host (use nslookup). If not - re-direct your resolv.conf file to a valid DNS server. ted keller On Mon, 9 Jul 2001, Michael Barkhoff wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > I have a little Problem with the FTP-GW: How can I add "Hostname-Resolving" to FTP-GW? When I try to connect to an FTP-Server thru FTP-GW I get the message "hostname unknown" (I have tried the Command "user anonymous@ftp.redhat.de" via a console-Client). I Use redhat 7.0 > ______________________________________________________ > http://firemail.fireball.de - Ihr Briefkasten im Web. > Einfach, schnell, sicher. > > From owner-fwtk-users@ex.tis.com Wed Jul 11 09:53 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA26832 Wed, 11 Jul 2001 09:53:48 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA04803; Wed, 11 Jul 2001 08:58:28 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Jul 2001 06:11:43 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA15662 for fwtk-users-outgoing; Wed, 11 Jul 2001 06:10:22 -0500 (CDT) Message-Id: Mime-Version: 1.0 Date: Wed, 11 Jul 2001 13:00:36 -0800 To: fwtk-users@lists.nai.com From: heim@sip.medizin.uni-ulm.de (Stefan Heim) Subject: PCSHARE (Helios) through FW Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="us-ascii" Content-Length: 574 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] How can I access an external pcshare-server (from Helios) through the firewall ? Thanks! /--------------------------------o00-----00o-------------------------\ Stefan Heim Uni Ulm Sektion Informatik in der Psychotherapie Am Hochstraess 8 89081 Ulm Germany E-Mail: heim@sip.Medizin.Uni-Ulm.de http://sip.medizin.uni-ulm.de Tel: +49-(0)731-50-25702 Fax: +49-(0)731-50-25662 \-------------------------------ooo0-----0ooOo---------------------/ From owner-fwtk-users@ex.tis.com Wed Jul 11 17:10 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA28062 Wed, 11 Jul 2001 17:10:47 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA20042; Wed, 11 Jul 2001 16:12:44 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 11 Jul 2001 13:30:56 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id NAA20589 for fwtk-users-outgoing; Wed, 11 Jul 2001 13:29:35 -0500 (CDT) Message-ID: <3B4C9AF5.FF931B44@tensor.ru> Date: Wed, 11 Jul 2001 22:29:09 +0400 From: Denis Tokarev Reply-To: den@tensor.ru Organization: Tensor X-Mailer: Mozilla 4.77 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: fwtk-users@lists.nai.com Subject: HTTP-GW Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=koi8-r Content-Length: 459 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi! I notice some weird behavior of http-gw daemon. While its running on dual-homed gateway with options "-dest !some.host.net -dest *" and when requesting some urls(for example http://195.34.34.80/counter?) it crashes with sig 11. I tested this on different hardware, so i think its not a harware problem. Is any ideas? /dvt From owner-fwtk-users@ex.tis.com Fri Jul 13 16:21 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA04745 Fri, 13 Jul 2001 16:21:18 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA23807; Fri, 13 Jul 2001 15:27:20 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Jul 2001 15:20:17 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA22044 for fwtk-users-outgoing; Fri, 13 Jul 2001 15:20:15 -0500 (CDT) Message-ID: <015901c10bd9$5381aa60$c889cdcd@lclcan.com> From: "Don" To: "fwtk" Subject: Secure Shell Date: Fri, 13 Jul 2001 16:20:57 -0400 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: multipart/alternative; boundary="----=_NextPart_000_0156_01C10BB7.CC5619C0" Content-Length: 2147 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] This is a multi-part message in MIME format. ------=_NextPart_000_0156_01C10BB7.CC5619C0 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Hi, I've set up a SSH server on my RedHat Linux 6.2 server. I also have the = Internet firewall toolkit 2.1 with all available patches installed. = Using any Secure Shell client software, I am able to log on to my server = through the internet from any external internet connection. My question is as such: Is there a facility within the FWTK that will = restrict SSH logins from specific I.P's that I specify, possibly within = the netperm-table file?? Thanks, Don ------=_NextPart_000_0156_01C10BB7.CC5619C0 Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable
Hi,
 
I've set up a SSH server on my RedHat = Linux 6.2=20 server.  I also have the Internet firewall toolkit 2.1 with all = available=20 patches installed.  Using any Secure Shell client software, = I am able=20 to log on to my server through the internet from any external = internet=20 connection.
 
My question is as such: Is there a = facility within=20 the FWTK that will restrict SSH logins from specific I.P's that I = specify,=20 possibly within the netperm-table file??
 
Thanks,
Don
------=_NextPart_000_0156_01C10BB7.CC5619C0-- From owner-fwtk-users@ex.tis.com Fri Jul 13 20:40 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA05106 Fri, 13 Jul 2001 20:40:52 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA03938; Fri, 13 Jul 2001 19:46:56 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 13 Jul 2001 19:44:26 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA03380 for fwtk-users-outgoing; Fri, 13 Jul 2001 19:44:25 -0500 (CDT) Date: Fri, 13 Jul 2001 20:43:52 -0400 (EDT) From: Ted Keller To: Don cc: fwtk Subject: Re: Secure Shell In-Reply-To: <015901c10bd9$5381aa60$c889cdcd@lclcan.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 835 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Don, SSH supports the concept of AllowHosts that are permitted to connect to the machind. The allowable hosts are listed by IP numbers separated by spaces if I remember coorectly. ted keller On Fri, 13 Jul 2001, Don wrote: > Hi, > > I've set up a SSH server on my RedHat Linux 6.2 server. I also have the Internet firewall toolkit 2.1 with all available patches installed. Using any Secure Shell client software, I am able to log on to my server through the internet from any external internet connection. > > My question is as such: Is there a facility within the FWTK that will restrict SSH logins from specific I.P's that I specify, possibly within the netperm-table file?? > > Thanks, > Don > From owner-fwtk-users@ex.tis.com Mon Jul 16 02:58 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA08784 Mon, 16 Jul 2001 02:58:42 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id CAA29626; Mon, 16 Jul 2001 02:04:48 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 16 Jul 2001 01:58:03 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA28566 for fwtk-users-outgoing; Mon, 16 Jul 2001 01:58:01 -0500 (CDT) Message-Id: <200107160657.IAA10484@ezrh04.Swiss.Sun.COM> Date: Mon, 16 Jul 2001 08:57:55 +0200 (MET DST) From: Harald von Fellenberg - Sun Switzerland Zurich - Technology Strategy Office Reply-To: Harald von Fellenberg - Sun Switzerland Zurich - Technology Strategy Office Subject: Re: Secure Shell To: don@lclcan.com, keller@bfg.com Cc: fwtk-users@lists.nai.com MIME-Version: 1.0 Content-MD5: 4uT6+ev+KP2BH9S+QfIqdg== X-Mailer: dtmail 1.3.0 @(#)CDE Version 1.3.4p_5 SunOS 5.7 sun4u sparc Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/plain; charset=us-ascii Content-Length: 1059 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] If you compile SSH with tcp-wrapper support (which you should do anyway), then it supports the /etc/hosts.{allow,deny} mechanism. I do this with openssh, to be precise. Harald von Fellenberg > >Don, > >SSH supports the concept of AllowHosts that are permitted to connect to >the machind. The allowable hosts are listed by IP numbers separated by >spaces if I remember coorectly. > >ted keller > > >On Fri, 13 Jul 2001, Don wrote: > >> Hi, >> >> I've set up a SSH server on my RedHat Linux 6.2 server. I also have the Internet firewall toolkit 2.1 with all available patches installed. Using any Secure Shell client software, I am able to log on to my server through the internet from any external internet connection. >> >> My question is as such: Is there a facility within the FWTK that will restrict SSH logins from specific I.P's that I specify, possibly within the netperm-table file?? >> >> Thanks, >> Don >> > From owner-fwtk-users@ex.tis.com Mon Jul 16 06:25 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA09094 Mon, 16 Jul 2001 06:25:48 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA21152; Mon, 16 Jul 2001 05:31:53 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 16 Jul 2001 05:29:33 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA20380 for fwtk-users-outgoing; Mon, 16 Jul 2001 05:29:32 -0500 (CDT) From: ark@eltex.ru Date: Mon, 16 Jul 2001 14:24:48 +0400 Message-Id: <200107161024.OAA27652@paranoid.eltex.ru> In-Reply-To: <015901c10bd9$5381aa60$c889cdcd@lclcan.com> from ""Don" " Organization: "Klingon Imperial Intelligence Service" Subject: Re: Secure Shell To: don@lclcan.com Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 2168 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- There is a problem with it: original ssh does not provide ip to authsrv when doing authentication. The patch is simple, though. OpenSSH does not have authsrv support at all, though you can import it easy. And - you need "permit-authentication" patch for authsrv to do it. The one i posted an year ago or so is broken (typo in it). No one did complain so i think no one uses it. You can enforce the restriction via sshd configuration itself, though. Does not look so pretty as netperm-table but still works. P.S. please don't use html in your mail. "Don" said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > This is a multi-part message in MIME format. > > ------=_NextPart_000_0156_01C10BB7.CC5619C0 > Content-Type: text/plain; > charset="Windows-1252" > Content-Transfer-Encoding: quoted-printable > > Hi, > > I've set up a SSH server on my RedHat Linux 6.2 server. I also have the = > Internet firewall toolkit 2.1 with all available patches installed. = > Using any Secure Shell client software, I am able to log on to my server = > through the internet from any external internet connection. > > My question is as such: Is there a facility within the FWTK that will = > restrict SSH logins from specific I.P's that I specify, possibly within = > the netperm-table file?? > > Thanks, > Don _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBO1LA76H/mIJW9LeBAQEj2QP+LpRsLVROt2Vht9+xDFSX5y30lnCJ50MH ZO11MiEOU6Wx0zbL8owxOhztSScAgbUksTdhAMbHj1gZgSZ5abU+1oVW4g1hJXA3 YZJKOe37ksDS0P354Bl2ow2941cYD2e0Oz3TciT1H9e8r+Aaxrluo9QNtC4ONzN5 AFkMFK2J6F4= =aI3u -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Mon Jul 16 18:15 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA10943 Mon, 16 Jul 2001 18:15:21 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA17397; Mon, 16 Jul 2001 17:21:26 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 16 Jul 2001 17:17:18 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA16002 for fwtk-users-outgoing; Mon, 16 Jul 2001 17:17:17 -0500 (CDT) Message-ID: <000f01c10e45$3a8c9ab0$962137ce@Discovery.local> From: "Frank Natoli" To: "FWTK Users" Subject: ftp-gw internal to external Date: Mon, 16 Jul 2001 18:17:42 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 493 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] After updating /etc/services to run ftp-gw (copied to /usr/sbin) when ports 20 or 21 are connected, xinetd does indeed run ftp-gw when external users attempt a connection. However, internal users, running ftp, attempting to get "outside", get message "ftp: ftp:tcp: unknown service". What is correct setup for ftp-gw when ftp'ing from inside to outside? Thanks. From owner-fwtk-users@ex.tis.com Tue Jul 17 17:30 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA13823 Tue, 17 Jul 2001 17:30:49 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA00478; Tue, 17 Jul 2001 16:36:55 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Jul 2001 16:32:23 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA29479 for fwtk-users-outgoing; Tue, 17 Jul 2001 16:32:22 -0500 (CDT) Message-ID: <001101c10f08$2b6af770$962137ce@bastogne> From: "Frank Natoli" To: "FWTK Users" Subject: FWTK Documentation Date: Tue, 17 Jul 2001 17:33:38 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 491 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Any place the FWTK documentation can be found in PDF or DOC format? Toolkit is, of course, distributed with PS files, but can't figure how to get my HP 1220C with PostScript support to swallow a file already in PS format. The toolkit README says goto http://www.tis.com/docs/products/fwtk, but that simply vectors you to NAI, which isn't very helpful. Thanks. From owner-fwtk-users@ex.tis.com Tue Jul 17 17:38 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA13845 Tue, 17 Jul 2001 17:38:45 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA03176; Tue, 17 Jul 2001 16:44:53 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Jul 2001 16:42:49 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA02214 for fwtk-users-outgoing; Tue, 17 Jul 2001 16:42:46 -0500 (CDT) Message-ID: <3B54B1C3.4050605@v-one.com> Date: Tue, 17 Jul 2001 17:44:35 -0400 From: Keith Young Organization: V-ONE User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.2) Gecko/20010628 X-Accept-Language: en-us MIME-Version: 1.0 To: Frank Natoli CC: FWTK Users Subject: Re: FWTK Documentation References: <001101c10f08$2b6af770$962137ce@bastogne> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii; format=flowed Content-Length: 784 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Frank Natoli wrote: > Any place the FWTK documentation can be found in PDF or DOC format? Toolkit > is, of course, distributed with PS files, but can't figure how to get my HP > 1220C with PostScript support to swallow a file already in PS format. The > toolkit README says goto http://www.tis.com/docs/products/fwtk, but that > simply vectors you to NAI, which isn't very helpful. Thanks. > > Info is at fwtk.org: * 1.5 Where can I find the documentation in something other than PostScript format? http://www.fwtk.org/fwtk/docs/documentation.html#1.5 Cheers, -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Tue Jul 17 18:19 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id SAA13899 Tue, 17 Jul 2001 18:19:36 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id RAA11715; Tue, 17 Jul 2001 17:25:44 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 17 Jul 2001 17:23:55 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id RAA11111 for fwtk-users-outgoing; Tue, 17 Jul 2001 17:23:54 -0500 (CDT) Date: Tue, 17 Jul 2001 18:23:49 -0400 From: Joseph S D Yao To: Frank Natoli Cc: FWTK Users Subject: Re: FWTK Documentation Message-ID: <20010717182349.M12026@washington.cospo.osis.gov> Mail-Followup-To: Frank Natoli , FWTK Users References: <001101c10f08$2b6af770$962137ce@bastogne> Mime-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <001101c10f08$2b6af770$962137ce@bastogne>; from frankn@palace.net on Tue, Jul 17, 2001 at 05:33:38PM -0400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 989 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Tue, Jul 17, 2001 at 05:33:38PM -0400, Frank Natoli wrote: > Any place the FWTK documentation can be found in PDF or DOC format? Toolkit > is, of course, distributed with PS files, but can't figure how to get my HP > 1220C with PostScript support to swallow a file already in PS format. The > toolkit README says goto http://www.tis.com/docs/products/fwtk, but that > simply vectors you to NAI, which isn't very helpful. Thanks. If by DOC format you mean MS Word, that's a proprietary non-portable format. Try: lp < document.ps or lpr < document.ps depending on your platform. You may have to just cat document.ps > /dev/lp -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao OSIS Center Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Wed Jul 18 16:14 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA16616 Wed, 18 Jul 2001 16:14:28 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id PAA25602; Wed, 18 Jul 2001 15:20:38 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Jul 2001 15:17:19 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id PAA24351 for fwtk-users-outgoing; Wed, 18 Jul 2001 15:17:18 -0500 (CDT) Message-ID: <0a0a01c10fc6$776789e0$c889cdcd@lclcan.com> From: "Don" To: "fwtk" Subject: smap problem - my e-mail is rejected Date: Wed, 18 Jul 2001 16:16:02 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="Windows-1252" Content-Length: 621 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, I've been using Ted Keller's anti-relaying & anti-spam version of smap/smapd for many weeks now. Suddenly, I have a major problem sending e-mail from my internal server to and/or through my web server (where the fwtk is installed). All the e-mail gets rejected with the message: "552 your site has been depermitted - no DNS record" I have gone back to the original version of smap/smapd and it now works. Can anyone clue me in on why this suddenly happened after several weeks? From owner-fwtk-users@ex.tis.com Wed Jul 18 17:24 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA16788 Wed, 18 Jul 2001 17:24:11 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id QAA09334; Wed, 18 Jul 2001 16:30:20 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Jul 2001 16:27:19 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id QAA08257 for fwtk-users-outgoing; Wed, 18 Jul 2001 16:27:18 -0500 (CDT) Date: Wed, 18 Jul 2001 17:27:12 -0400 From: Joseph S D Yao To: Don Cc: fwtk Subject: Re: smap problem - my e-mail is rejected Message-ID: <20010718172712.X19523@washington.cospo.osis.gov> Mail-Followup-To: Don , fwtk References: <0a0a01c10fc6$776789e0$c889cdcd@lclcan.com> Mime-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <0a0a01c10fc6$776789e0$c889cdcd@lclcan.com>; from don@lclcan.com on Wed, Jul 18, 2001 at 04:16:02PM -0400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1329 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Wed, Jul 18, 2001 at 04:16:02PM -0400, Don wrote: > I've been using Ted Keller's anti-relaying & anti-spam version of smap/smapd > for many weeks now. Suddenly, I have a major problem sending e-mail from my > internal server to and/or through my web server (where the fwtk is > installed). All the e-mail gets rejected with the message: > > "552 your site has been depermitted - no DNS record" > > I have gone back to the original version of smap/smapd and it now works. > Can anyone clue me in on why this suddenly happened after several weeks? Your DNS has changed. The firewall may be using an old version of DNS, or something else may have happened, but suddenly it does not have any record of your site. Try doing forward and backwards lookups of your site name and IP address on the firewall machine. I suspect it is looking out to the Internet, rather inside, for its information. OR, your internal DNS server is not speeaking to it for whatever reason. -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao OSIS Center Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Wed Jul 18 19:07 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA16948 Wed, 18 Jul 2001 19:07:20 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id SAA27759; Wed, 18 Jul 2001 18:13:26 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 18 Jul 2001 18:08:07 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id SAA26217 for fwtk-users-outgoing; Wed, 18 Jul 2001 18:08:05 -0500 (CDT) Date: Wed, 18 Jul 2001 19:07:52 -0400 (EDT) From: Ted Keller To: Don cc: fwtk Subject: Re: smap problem - my e-mail is rejected In-Reply-To: <0a0a01c10fc6$776789e0$c889cdcd@lclcan.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1253 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Don, It would almost appear that your DNS server cannot resolve your local domain (the mail from address). Sometimes this will happen if your local e-mail server forgets to masqurade to your domain name - thus listing the fully qualified domain name on the from address. Check out the following.... from your firewall nslookup nslookup> set type=any nslookup> yourdomainname.com and see what the results are telling you. ted keller On Wed, 18 Jul 2001, Don wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi all, > > I've been using Ted Keller's anti-relaying & anti-spam version of smap/smapd > for many weeks now. Suddenly, I have a major problem sending e-mail from my > internal server to and/or through my web server (where the fwtk is > installed). All the e-mail gets rejected with the message: > > "552 your site has been depermitted - no DNS record" > > I have gone back to the original version of smap/smapd and it now works. > Can anyone clue me in on why this suddenly happened after several weeks? > > From owner-fwtk-users@ex.tis.com Thu Jul 19 04:18 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA17994 Thu, 19 Jul 2001 04:18:27 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA20228; Thu, 19 Jul 2001 03:24:38 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 19 Jul 2001 03:20:29 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA19327 for fwtk-users-outgoing; Thu, 19 Jul 2001 03:20:27 -0500 (CDT) From: ark@eltex.ru Date: Thu, 19 Jul 2001 12:15:21 +0400 Message-Id: <200107190815.MAA07349@paranoid.eltex.ru> Organization: "Klingon Imperial Intelligence Service" Subject: multiple vendor telnet daemon vulnerability (fwd) To: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 8323 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Does our fwtk proxy handle that properly (and what the proper way is?) -- Begin forwarded message --- --x+6KMIRAuhnl3hBn Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable This is a short version of the original advisory. Most details about exploiting this vulnerabilty have been removed after thinking about it. I do not release it because it makes me happy, and I would like you to plea= se not assume things about the reasons involving this posting. I wish things w= ould have worked out better for all of us. I do not want to get that much involv= ed into disclosure policies, but I am sure a lot of advocates from both sides = are going to flame me about this one. Please save yourself and me the time, I c= ould not care less. A few days ago some script kiddies have somehow got access to a copy of an exploit for this vulnerability. I do not know how it happened, but while I write this dozen of BSD hosts fall victim to clueless attackers. And please, again, I would like to ask you to not assume and speculate how this might has happened. The copy of the exploit was quite script-kiddie safe and requires no fiddling. It works out of the box. Please patch fast, or better disable telnetd at all. Btw, I do not think a simple patch will do it anyway, there are so many horrible bugs - also non security related - in telnetd beside this one. Just send some random junk at telnetd and see it die if you do not believe me. ciao, -scut ------ TESO Security Advisory 07/18/2001 Multiple vendor Telnet Daemon vulnerability Summary =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Within most of the current telnet daemons in use today there exist a bu= ffer overflow in the telnet option handling. Under certain circumstances it = may be possible to exploit it to gain root priviledges remotely. Systems Affected =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D System | vulnerable | exploitable * ----------------------------------------+--------------+---------------= --- BSDI 4.x default | yes | yes FreeBSD [2345].x default | yes | yes IRIX 6.5 | yes | no Linux netkit-telnetd < 0.14 | yes | ? Linux netkit-telnetd >=3D 0.14 | no | NetBSD 1.x default | yes | yes OpenBSD 2.x | yes | ? OpenBSD current | no | Solaris 2.x sparc | yes | ? | yes | ? ----------------------------------------+--------------+---------------= --- * =3D From our analysis and conclusions, which may not be correct or we= may have overseen things. Do not rely on this. Details about the systems can be found below. Impact =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Through sending a specially formed option string to the remote telnet daemon a remote attacker might be able to overwrite sensitive informati= on on the static memory pages. If done properly this may result in arbitra= ry code getting executed on the remote machine under the priviledges the telnet daemon runs on, usually root. Explanation =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Within every BSD derived telnet daemon under UNIX the telnet options are processed by the 'telrcv' function. This function parses the options according to the telnet protocol and its internal state. During this parsing the results which should be send back to the client are stored within the 'netobuf' buffer. This is done without any bounds checking, since it is assumed that the reply data is smaller than the buffer size (which is BUFSIZ bytes, usually). However, using a combination of options, especially the 'AYT' Are You T= here option, it is possible to append data to the buffer, usually nine bytes long. To trigger this response, two bytes in the input buffer are necessary. Since this input buffer is BUFSIZ bytes long, you can exceed= the output buffer by as much as (BUFSIZ / 2) * 9) - BUFSIZ bytes. For the common case that BUFSIZ is defined to be 1024, this results in a buffer overflow by up to 3584 bytes. On systems where BUFSIZ is defined to be 4096, this is an even greater value (14336). Due to the limited set of characters an attacker is able to write outsi= de of the buffer it is difficult - if not impossible on some systems - to exploit this buffer overflow. Another hurdle for a possible attacker ma= y be the lack of interesting information to modify after the buffer. This buffer overflow should be considered serious nevertheless, since experience has shown that even complicated vulnerabilities can be exploited by skilled attackers, BIND TSIG and SSH deattack come to mind. We have constructed a working exploit for any version of BSDI, NetBSD a= nd FreeBSD. Exploitation on Solaris sparc may be possible but if it is, it= is very difficult involving lots of arcane tricks. OpenBSD is not as easily exploitable as the other BSD's, because they do compile with other options by default, changing memory layout. Solution =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The vendors have been notified of the problem at the same time as the general public, vendor patches for your telnet daemon that fix the bug = will show up soon. Sometimes a fix might not be trivial and require a lot of changes to the source code, due to the insecure nature the 'nfrontp' pointer is handle= d. The best long term solution is to disable the telnet daemon at all, sin= ce there are good and free replacements. Acknowledgements =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The bug has been discovered by scut. (It is easy to spot, so I do not want to rule out discoveries by other persons) The tests and further analysis were done by smiler, lorian, zip and scu= t. Contact Information =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The TESO crew can be reached by mailing to teso@team-teso.net Our web page is at http://www.team-teso.net/ References =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [1] TESO http://www.team-teso.net/ Disclaimer =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D This advisory does not claim to be complete or to be usable for any purpose. Especially information on the vulnerable systems may be inaccu= rate or wrong. Possibly supplied exploit code is not to be used for malicious purposes, but for educational purposes only. This advisory is free for open distribution in unmodified form. Articles that are based on information from this advisory should include link [1]. Exploit =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Not this time. Not here. ------ --=20 -. scut@nb.in-berlin.de -. + http://segfault.net/~scut/ `------------------= --. -' segfault.net/~scut/pgp `' 5453 AC95 1E02 FDA7 50D2 A42D 427E 6DEF 745A 8= E07 `- AFIWC control and information seized. awaiting orders. hi echelon ------= --' --x+6KMIRAuhnl3hBn Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7Ve5NQn5t73RajgcRAnN7AKDS0wmMSpwu29J9jdBiuu59GXZGaQCghSjc VqoGwd+UxWuDFqEvPz3CuuU= =+r9F -----END PGP SIGNATURE----- --x+6KMIRAuhnl3hBn-- -- End forwarded message --- _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! From owner-fwtk-users@ex.tis.com Mon Jul 23 09:42 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA27650 Mon, 23 Jul 2001 09:42:37 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA22668; Mon, 23 Jul 2001 08:48:53 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 23 Jul 2001 08:43:35 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA21393 for fwtk-users-outgoing; Mon, 23 Jul 2001 08:43:33 -0500 (CDT) Message-ID: <008601c1137d$afaa5520$c889cdcd@lclcan.com> From: "Don" To: "Ted Keller" Cc: "fwtk" References: Subject: Re: smap problem - my e-mail is rejected Date: Mon, 23 Jul 2001 09:45:07 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2165 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Looking at the /var/log/messages file, I see Jul 23 09:46:01 lclweb smap[30650]: security:552 - rejected spam from host myhost.lclcan.com/205.205.137.197 for site lclcan.com - DNS entry not found However, lclcab.com is in my netperm-table next to the local-domain entry Following your instructions concerning issuing a nslookup on my localdomain, I get: Server: lclcan.com Address: 216.94.98.2 lclcan.com origin = lclweb.lclcan.com mail addr = postmaster.lclcan.com serial = 2001012203 refresh = 3600 (1H) retry = 900 (15M) expire = 1209600 (2W) minimum ttl = 43200 (12H) lclcan.com nameserver = lclweb.lclcan.com lclcan.com nameserver = lclweb.lclcan.com lclweb.lclcan.com internet address = 216.94.98.2 It does seem like the domain is being resolved. Don > Don, > > It would almost appear that your DNS server cannot resolve your local > domain (the mail from address). Sometimes this will happen if your local > e-mail server forgets to masqurade to your domain name - thus listing the > fully qualified domain name on the from address. > > Check out the following.... > > from your firewall > > nslookup > nslookup> set type=any > nslookup> yourdomainname.com > > and see what the results are telling you. > > ted keller > > > On Wed, 18 Jul 2001, Don wrote: > > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > > BODY of a mail message to majordomo@ex.tis.com.] > > > > Hi all, > > > > I've been using Ted Keller's anti-relaying & anti-spam version of smap/smapd > > for many weeks now. Suddenly, I have a major problem sending e-mail from my > > internal server to and/or through my web server (where the fwtk is > > installed). All the e-mail gets rejected with the message: > > > > "552 your site has been depermitted - no DNS record" > > > > I have gone back to the original version of smap/smapd and it now works. > > Can anyone clue me in on why this suddenly happened after several weeks? > > > > > From owner-fwtk-users@ex.tis.com Tue Jul 24 00:57 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id AAA00282 Tue, 24 Jul 2001 00:57:41 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA11443; Tue, 24 Jul 2001 00:03:55 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Jul 2001 00:00:08 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA10117 for fwtk-users-outgoing; Tue, 24 Jul 2001 00:00:05 -0500 (CDT) Date: Tue, 24 Jul 2001 00:59:46 -0400 (EDT) From: Ted Keller To: Don cc: fwtk Subject: Re: smap problem - my e-mail is rejected In-Reply-To: <008601c1137d$afaa5520$c889cdcd@lclcan.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2520 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Don, You mail server is creating the from address as myhost.lclcan.com instead of masqurading the mail to lclcan.com. Since myhost is not resolvable - smap rejects it ted keller On Mon, 23 Jul 2001, Don wrote: > Looking at the /var/log/messages file, I see > > Jul 23 09:46:01 lclweb smap[30650]: security:552 - rejected spam from host > myhost.lclcan.com/205.205.137.197 for site lclcan.com - DNS entry not found > > However, lclcab.com is in my netperm-table next to the local-domain entry > > Following your instructions concerning issuing a nslookup on my localdomain, > I get: > > Server: lclcan.com > Address: 216.94.98.2 > > lclcan.com > origin = lclweb.lclcan.com > mail addr = postmaster.lclcan.com > serial = 2001012203 > refresh = 3600 (1H) > retry = 900 (15M) > expire = 1209600 (2W) > minimum ttl = 43200 (12H) > lclcan.com nameserver = lclweb.lclcan.com > lclcan.com nameserver = lclweb.lclcan.com > lclweb.lclcan.com internet address = 216.94.98.2 > > > It does seem like the domain is being resolved. > > Don > > > Don, > > > > It would almost appear that your DNS server cannot resolve your local > > domain (the mail from address). Sometimes this will happen if your local > > e-mail server forgets to masqurade to your domain name - thus listing the > > fully qualified domain name on the from address. > > > > Check out the following.... > > > > from your firewall > > > > nslookup > > nslookup> set type=any > > nslookup> yourdomainname.com > > > > and see what the results are telling you. > > > > ted keller > > > > > > On Wed, 18 Jul 2001, Don wrote: > > > > > [To be removed from this list send the message "unsubscribe fwtk-users" > in the > > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > Hi all, > > > > > > I've been using Ted Keller's anti-relaying & anti-spam version of > smap/smapd > > > for many weeks now. Suddenly, I have a major problem sending e-mail > from my > > > internal server to and/or through my web server (where the fwtk is > > > installed). All the e-mail gets rejected with the message: > > > > > > "552 your site has been depermitted - no DNS record" > > > > > > I have gone back to the original version of smap/smapd and it now works. > > > Can anyone clue me in on why this suddenly happened after several weeks? > > > > > > > > > > From owner-fwtk-users@ex.tis.com Tue Jul 24 06:53 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA00955 Tue, 24 Jul 2001 06:53:08 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA15675; Tue, 24 Jul 2001 05:59:25 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Jul 2001 05:56:55 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA15011 for fwtk-users-outgoing; Tue, 24 Jul 2001 05:56:54 -0500 (CDT) Subject: ANNOUNCE: balrog - a multithreaded web proxy From: Tony Gale To: fwtk-users@lists.nai.com Content-Transfer-Encoding: 7bit X-Mailer: Evolution/0.11.99 (Preview Release) Date: 24 Jul 2001 11:56:47 +0100 Message-Id: <995972207.1692.14.camel@syntax.dera.gov.uk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 700 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, I've been developing a replacement for http-gw, with an aim to support more features and to speed things up somewhat. I have released the current code base, for details please see: http://www.precipice.freeserve.co.uk There is a mailing list which isn't mentioned on the web page yet, so for details see: http://www.topica.com/lists/balrog Development is on-going, but I've put over 50million requests through this code without problem, so it is pretty stable. Thanks -tony Disclaimer: This software is nothing to do with my employer or any other body. From owner-fwtk-users@ex.tis.com Tue Jul 24 09:48 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id JAA01357 Tue, 24 Jul 2001 09:48:42 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id IAA09969; Tue, 24 Jul 2001 08:54:56 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Jul 2001 08:47:52 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id IAA07802 for fwtk-users-outgoing; Tue, 24 Jul 2001 08:47:51 -0500 (CDT) Message-ID: <001301c11447$16ea9370$932137ce@omaha> From: "Frank Natoli" To: "FWTK Users" , "FWTK Support" Cc: "Tim \(Yahoo\) Williams" , "Tim Williams" Subject: Old version of FWTK 2.1? Date: Tue, 24 Jul 2001 09:46:36 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1898 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Recently downloaded "current" FWTK V2.1. Am porting to Linux 7.1. Have found it necessary to modify many sources and makefiles simply to compile, link and install without error. TIS documents that all firewall modules compile and link (though were not tested) under Linux. Worried that I have "bad" copy. Please comment. [Makefile.config.linux] XLIBDIR=/usr/X11R6/lib (not /usr/X11/lib) [auth/db.c] #include (not simply ) [tools/server/ftpd/glob.c] Had to remove fstat(dirp->dd_fd, &stb) and subsequent isdir(stb) because Linux explicitly leaves internal structure of DIR undefined. Additionally, preceding opendir(path) would fail if argument was not a directory, thus making the fstat/isdir superfluous. [tools/server/syslogd/Makefile] Did not provide any install rule, thus causing install of server modules to abort. Presume following is required: install: $(CP) syslogd $(DEST) [tools/client/gate-ftp/ftp.c] Global replace "struct fd_set" with "fd_set". [tools/client/gate-ftp/glob.c] Same as above glob.c. [tools/client/gate-ftp/getpass.c] "struct sgttyb", TIOCGETP and TIOCSETP not available. Had to substitute termios equivalents "struct termios", tcgetattr() and tcsetattr(). [tools/client/gate-ftp/Makefile] ftp rule claims dependency LIBC=/lib/libc.a; file /lib/libc.a not available; dependency removed and ftp links without error. man page ftp.1 cannot be installed in non-existent /usr/man/man1; must reference /usr/share/man/man1. [tools/client/gate-ftp/main.c] getservbyname() attempts to find /etc/services rule for ftp:tcp. But upon installation of FWTK, appropriate rule in /etc/services is changed to ftp-gw:tcp. Therefore, must modify main.c invocation of getservbyname() to look for "ftp-gw", not "ftp". From owner-fwtk-users@ex.tis.com Tue Jul 24 10:27 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA01513 Tue, 24 Jul 2001 10:27:53 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA19310; Tue, 24 Jul 2001 09:34:10 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Jul 2001 09:31:35 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA18340 for fwtk-users-outgoing; Tue, 24 Jul 2001 09:31:33 -0500 (CDT) From: Mark Wiater Reply-To: mwiater@bayserve.net To: fwtk-users@lists.nai.com Subject: Squid-gw & hotmail.com Date: Tue, 24 Jul 2001 10:30:19 -0400 X-Mailer: KMail [version 1.2] MIME-Version: 1.0 Message-Id: <01072410301901.01192@snuffleupagus.localdomain> Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1227 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello, I've gotten and installed squid-gw annd am quite pleased with the granularity of control over mobile code that it gives me. I am having a problem with hotmail though and was wondering if anyone else has either experienced the problem or has developed a solution. The problem seems to be that after login, hotmail assumes that javascript is disabled even though the only way that I could have gotten to the point in the login process that I've reached is to execute javascript... The pertinent sections of the netperm-table are enclosed: squid-gw: permit-destinations http*://*.hotmail.com -class msn squid-gw: permit-destinations http*://*.msn.com -class msn squid-gw: permit-destinations http*://*.avenuea.com -class msn squid-gw: permit-connect *.passport.com -class msn squid-gw: permit-destinations http://*.*.*.* squid-gw: permit-destinations http://*.*.* squid-gw-msn: href http: https: javascript: cslid: squid-gw-msn: allow javascript cookies java object embed squid-gw-msn: script verbatim Am I missing something? Thanks Mark From owner-fwtk-users@ex.tis.com Tue Jul 24 10:34 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA01529 Tue, 24 Jul 2001 10:34:20 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA21365; Tue, 24 Jul 2001 09:40:34 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Jul 2001 09:38:22 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA20487 for fwtk-users-outgoing; Tue, 24 Jul 2001 09:38:21 -0500 (CDT) Date: Tue, 24 Jul 2001 10:38:11 -0400 From: Joseph S D Yao To: Frank Natoli Cc: FWTK Users , FWTK Support , "Tim (Yahoo) Williams" , Tim Williams Subject: Re: Old version of FWTK 2.1? Message-ID: <20010724103811.D854@washington.cospo.osis.gov> Mail-Followup-To: Frank Natoli , FWTK Users , FWTK Support , "Tim (Yahoo) Williams" , Tim Williams References: <001301c11447$16ea9370$932137ce@omaha> Mime-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <001301c11447$16ea9370$932137ce@omaha>; from frankn@palace.net on Tue, Jul 24, 2001 at 09:46:36AM -0400 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1064 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] On Tue, Jul 24, 2001 at 09:46:36AM -0400, Frank Natoli wrote: ... > Recently downloaded "current" FWTK V2.1. Am porting to Linux 7.1. Have found > it necessary to modify many sources and makefiles simply to compile, link > and install without error. TIS documents that all firewall modules compile > and link (though were not tested) under Linux. Worried that I have "bad" > copy. Please comment. Your version of Linux is many years more recent than the "current" version of FWTK. Since TIS was bought by NAI, I haven't seen any upgrades. See www.fwtk.org and the mailing list archives for any support that may have happened. (Apologies to TISlab folks if I have missed something; please respond if so.) -- Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao OSIS Center Computer Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of COSPO policies. From owner-fwtk-users@ex.tis.com Tue Jul 24 15:25 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA02357 Tue, 24 Jul 2001 15:25:37 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA24929; Tue, 24 Jul 2001 14:31:54 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Jul 2001 14:26:32 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA23029 for fwtk-users-outgoing; Tue, 24 Jul 2001 14:26:30 -0500 (CDT) Message-ID: <026701c11476$bd6e3f60$c889cdcd@lclcan.com> From: "Don" To: "Ted Keller" Cc: "fwtk" References: Subject: Re: smap problem - my e-mail is rejected Date: Tue, 24 Jul 2001 15:27:55 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2976 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] True, however, I have the following line in my netperm-table file which should negate that: smap: local-host 205.205.137.131 205.205.137.132 205.205.137.193 205.205.137.197 The spam error message below shows host 205.205.137.197 Why isn't the above line preventing the spam check? > Don, > > You mail server is creating the from address as myhost.lclcan.com instead > of masqurading the mail to lclcan.com. Since myhost is not resolvable - > smap rejects it > > ted keller > > > On Mon, 23 Jul 2001, Don wrote: > > > Looking at the /var/log/messages file, I see > > > > Jul 23 09:46:01 lclweb smap[30650]: security:552 - rejected spam from host > > myhost.lclcan.com/205.205.137.197 for site lclcan.com - DNS entry not found > > > > However, lclcab.com is in my netperm-table next to the local-domain entry > > > > Following your instructions concerning issuing a nslookup on my localdomain, > > I get: > > > > Server: lclcan.com > > Address: 216.94.98.2 > > > > lclcan.com > > origin = lclweb.lclcan.com > > mail addr = postmaster.lclcan.com > > serial = 2001012203 > > refresh = 3600 (1H) > > retry = 900 (15M) > > expire = 1209600 (2W) > > minimum ttl = 43200 (12H) > > lclcan.com nameserver = lclweb.lclcan.com > > lclcan.com nameserver = lclweb.lclcan.com > > lclweb.lclcan.com internet address = 216.94.98.2 > > > > > > It does seem like the domain is being resolved. > > > > Don > > > > > Don, > > > > > > It would almost appear that your DNS server cannot resolve your local > > > domain (the mail from address). Sometimes this will happen if your local > > > e-mail server forgets to masqurade to your domain name - thus listing the > > > fully qualified domain name on the from address. > > > > > > Check out the following.... > > > > > > from your firewall > > > > > > nslookup > > > nslookup> set type=any > > > nslookup> yourdomainname.com > > > > > > and see what the results are telling you. > > > > > > ted keller > > > > > > > > > On Wed, 18 Jul 2001, Don wrote: > > > > > > > [To be removed from this list send the message "unsubscribe fwtk-users" > > in the > > > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > > > Hi all, > > > > > > > > I've been using Ted Keller's anti-relaying & anti-spam version of > > smap/smapd > > > > for many weeks now. Suddenly, I have a major problem sending e-mail > > from my > > > > internal server to and/or through my web server (where the fwtk is > > > > installed). All the e-mail gets rejected with the message: > > > > > > > > "552 your site has been depermitted - no DNS record" > > > > > > > > I have gone back to the original version of smap/smapd and it now works. > > > > Can anyone clue me in on why this suddenly happened after several weeks? > > > > > > > > > > > > > > > > From owner-fwtk-users@ex.tis.com Tue Jul 24 15:32 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id PAA02363 Tue, 24 Jul 2001 15:32:03 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id OAA27212; Tue, 24 Jul 2001 14:38:21 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Jul 2001 14:34:49 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id OAA25907 for fwtk-users-outgoing; Tue, 24 Jul 2001 14:34:47 -0500 (CDT) Message-ID: <02b501c11477$df3a7ae0$c889cdcd@lclcan.com> From: "Don" To: "Ted Keller" Cc: "fwtk" References: Subject: Re: smap problem - my e-mail is rejected Date: Tue, 24 Jul 2001 15:36:02 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 3064 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] One more note fro the netperm-table file. Should not the following line also negate the refusal? smap: local-domain lclcan.com *.lclcan.com ----- Original Message ----- From: "Ted Keller" To: "Don" Cc: "fwtk" Sent: Tuesday, July 24, 2001 12:59 AM Subject: Re: smap problem - my e-mail is rejected > Don, > > You mail server is creating the from address as myhost.lclcan.com instead > of masqurading the mail to lclcan.com. Since myhost is not resolvable - > smap rejects it > > ted keller > > > On Mon, 23 Jul 2001, Don wrote: > > > Looking at the /var/log/messages file, I see > > > > Jul 23 09:46:01 lclweb smap[30650]: security:552 - rejected spam from host > > myhost.lclcan.com/205.205.137.197 for site lclcan.com - DNS entry not found > > > > However, lclcab.com is in my netperm-table next to the local-domain entry > > > > Following your instructions concerning issuing a nslookup on my localdomain, > > I get: > > > > Server: lclcan.com > > Address: 216.94.98.2 > > > > lclcan.com > > origin = lclweb.lclcan.com > > mail addr = postmaster.lclcan.com > > serial = 2001012203 > > refresh = 3600 (1H) > > retry = 900 (15M) > > expire = 1209600 (2W) > > minimum ttl = 43200 (12H) > > lclcan.com nameserver = lclweb.lclcan.com > > lclcan.com nameserver = lclweb.lclcan.com > > lclweb.lclcan.com internet address = 216.94.98.2 > > > > > > It does seem like the domain is being resolved. > > > > Don > > > > > Don, > > > > > > It would almost appear that your DNS server cannot resolve your local > > > domain (the mail from address). Sometimes this will happen if your local > > > e-mail server forgets to masqurade to your domain name - thus listing the > > > fully qualified domain name on the from address. > > > > > > Check out the following.... > > > > > > from your firewall > > > > > > nslookup > > > nslookup> set type=any > > > nslookup> yourdomainname.com > > > > > > and see what the results are telling you. > > > > > > ted keller > > > > > > > > > On Wed, 18 Jul 2001, Don wrote: > > > > > > > [To be removed from this list send the message "unsubscribe fwtk-users" > > in the > > > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > > > Hi all, > > > > > > > > I've been using Ted Keller's anti-relaying & anti-spam version of > > smap/smapd > > > > for many weeks now. Suddenly, I have a major problem sending e-mail > > from my > > > > internal server to and/or through my web server (where the fwtk is > > > > installed). All the e-mail gets rejected with the message: > > > > > > > > "552 your site has been depermitted - no DNS record" > > > > > > > > I have gone back to the original version of smap/smapd and it now works. > > > > Can anyone clue me in on why this suddenly happened after several weeks? > > > > > > > > > > > > > > > > From owner-fwtk-users@ex.tis.com Tue Jul 24 21:17 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA02960 Tue, 24 Jul 2001 21:16:59 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA28595; Tue, 24 Jul 2001 20:23:16 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Jul 2001 20:20:41 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id UAA27769 for fwtk-users-outgoing; Tue, 24 Jul 2001 20:20:40 -0500 (CDT) Message-ID: <000701c114a7$ca59a0d0$932137ce@omaha> From: "Frank Natoli" To: "FWTK Support" , "FWTK Users" Subject: ftp client on firewall machine Date: Tue, 24 Jul 2001 21:18:26 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 282 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Can an ftp client, running on the firewall machine, be prevented by the firewall from connecting to IP addresses outside the firewall machine? Thanks. From owner-fwtk-users@ex.tis.com Tue Jul 24 21:33 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id VAA02989 Tue, 24 Jul 2001 21:33:51 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id UAA01112; Tue, 24 Jul 2001 20:40:09 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Jul 2001 20:38:40 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id UAA00512 for fwtk-users-outgoing; Tue, 24 Jul 2001 20:38:38 -0500 (CDT) MIME-Version: 1.0 Message-Id: <3B5E23D2.04368@ud4> Date: Wed, 25 Jul 2001 09:41:38 +0800 (CST) From: "truename" To: fwtk-users@lists.nai.com Subject: about smap X-Priority: 3 X-Originating-IP: [202.99.17.23] Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 579 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi all, I want only some users in my company can use SMAP proxy, but I am not sure how to define it in the netperm-table. I am using the FWTK v3.2 just now, and the smap src v1.8. Please help me if you know how to do it, thanks Jing ================================================ ÊÖ»ú£¬ÊýÂëÓ°µú»ú + 200ÍòÉÏÍøСʱ ¡­¡­ ¾«²ÊÅÉËÍ£¡¿ì¿ìµã»÷ >> http://win.163.com Á¢¼´²ÎÓë »ú»á¶à¶à £¡£¡£¡ ================================================ From owner-fwtk-users@ex.tis.com Tue Jul 24 22:11 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id WAA03018 Tue, 24 Jul 2001 22:11:58 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id VAA06019; Tue, 24 Jul 2001 21:18:16 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 24 Jul 2001 21:16:30 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id VAA05346 for fwtk-users-outgoing; Tue, 24 Jul 2001 21:16:28 -0500 (CDT) Date: Tue, 24 Jul 2001 22:16:13 -0400 (EDT) From: Ted Keller To: Don cc: fwtk Subject: Re: smap problem - my e-mail is rejected In-Reply-To: <026701c11476$bd6e3f60$c889cdcd@lclcan.com> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 3406 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Don, The local-host line prevents the relay check. It does not negate the spam checks in any way. Either fix up your sendmail - or add the mail-hosts to the DNS tables. ted keller On Tue, 24 Jul 2001, Don wrote: > True, however, I have the following line in my netperm-table file which > should negate that: > > smap: local-host 205.205.137.131 205.205.137.132 205.205.137.193 > 205.205.137.197 > > The spam error message below shows host 205.205.137.197 > > Why isn't the above line preventing the spam check? > > > > Don, > > > > You mail server is creating the from address as myhost.lclcan.com instead > > of masqurading the mail to lclcan.com. Since myhost is not resolvable - > > smap rejects it > > > > ted keller > > > > > > On Mon, 23 Jul 2001, Don wrote: > > > > > Looking at the /var/log/messages file, I see > > > > > > Jul 23 09:46:01 lclweb smap[30650]: security:552 - rejected spam from > host > > > myhost.lclcan.com/205.205.137.197 for site lclcan.com - DNS entry not > found > > > > > > However, lclcab.com is in my netperm-table next to the local-domain > entry > > > > > > Following your instructions concerning issuing a nslookup on my > localdomain, > > > I get: > > > > > > Server: lclcan.com > > > Address: 216.94.98.2 > > > > > > lclcan.com > > > origin = lclweb.lclcan.com > > > mail addr = postmaster.lclcan.com > > > serial = 2001012203 > > > refresh = 3600 (1H) > > > retry = 900 (15M) > > > expire = 1209600 (2W) > > > minimum ttl = 43200 (12H) > > > lclcan.com nameserver = lclweb.lclcan.com > > > lclcan.com nameserver = lclweb.lclcan.com > > > lclweb.lclcan.com internet address = 216.94.98.2 > > > > > > > > > It does seem like the domain is being resolved. > > > > > > Don > > > > > > > Don, > > > > > > > > It would almost appear that your DNS server cannot resolve your local > > > > domain (the mail from address). Sometimes this will happen if your > local > > > > e-mail server forgets to masqurade to your domain name - thus listing > the > > > > fully qualified domain name on the from address. > > > > > > > > Check out the following.... > > > > > > > > from your firewall > > > > > > > > nslookup > > > > nslookup> set type=any > > > > nslookup> yourdomainname.com > > > > > > > > and see what the results are telling you. > > > > > > > > ted keller > > > > > > > > > > > > On Wed, 18 Jul 2001, Don wrote: > > > > > > > > > [To be removed from this list send the message "unsubscribe > fwtk-users" > > > in the > > > > > BODY of a mail message to majordomo@ex.tis.com.] > > > > > > > > > > Hi all, > > > > > > > > > > I've been using Ted Keller's anti-relaying & anti-spam version of > > > smap/smapd > > > > > for many weeks now. Suddenly, I have a major problem sending e-mail > > > from my > > > > > internal server to and/or through my web server (where the fwtk is > > > > > installed). All the e-mail gets rejected with the message: > > > > > > > > > > "552 your site has been depermitted - no DNS record" > > > > > > > > > > I have gone back to the original version of smap/smapd and it now > works. > > > > > Can anyone clue me in on why this suddenly happened after several > weeks? > > > > > > > > > > > > > > > > > > > > > > > > From owner-fwtk-users@ex.tis.com Wed Jul 25 02:22 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA03461 Wed, 25 Jul 2001 02:22:23 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA29468; Wed, 25 Jul 2001 01:28:39 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 25 Jul 2001 01:26:23 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA28772 for fwtk-users-outgoing; Wed, 25 Jul 2001 01:26:22 -0500 (CDT) Date: Tue, 24 Jul 2001 22:09:31 -0700 (PDT) From: David Lang To: Joseph S D Yao cc: Frank Natoli , FWTK Users , FWTK Support , "Tim (Yahoo) Williams" , Tim Williams Subject: Re: Old version of FWTK 2.1? In-Reply-To: <20010724103811.D854@washington.cospo.osis.gov> Message-ID: MIME-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 1744 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] In addition Redhat 7.x changes a number of things that have been standard on Linux systems for several years. David Lang On Tue, 24 Jul 2001, Joseph S D Yao wrote: > Date: Tue, 24 Jul 2001 10:38:11 -0400 > From: Joseph S D Yao > To: Frank Natoli > Cc: FWTK Users , FWTK Support , > "Tim (Yahoo) Williams" , > Tim Williams > Subject: Re: Old version of FWTK 2.1? > > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > On Tue, Jul 24, 2001 at 09:46:36AM -0400, Frank Natoli wrote: > ... > > Recently downloaded "current" FWTK V2.1. Am porting to Linux 7.1. Have found > > it necessary to modify many sources and makefiles simply to compile, link > > and install without error. TIS documents that all firewall modules compile > > and link (though were not tested) under Linux. Worried that I have "bad" > > copy. Please comment. > > Your version of Linux is many years more recent than the "current" > version of FWTK. Since TIS was bought by NAI, I haven't seen any > upgrades. See www.fwtk.org and the mailing list archives for any > support that may have happened. (Apologies to TISlab folks if I have > missed something; please respond if so.) > > -- > Joe Yao jsdy@cospo.osis.gov - Joseph S. D. Yao > OSIS Center Computer Support EMT-B > ----------------------------------------------------------------------- > This message is not an official statement of COSPO policies. > From owner-fwtk-users@ex.tis.com Wed Jul 25 07:06 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id HAA04036 Wed, 25 Jul 2001 07:06:10 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id GAA24302; Wed, 25 Jul 2001 06:12:27 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 25 Jul 2001 06:10:15 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id GAA23679 for fwtk-users-outgoing; Wed, 25 Jul 2001 06:10:13 -0500 (CDT) From: ark@eltex.ru Date: Wed, 25 Jul 2001 15:05:05 +0400 Message-Id: <200107251105.PAA04083@paranoid.eltex.ru> In-Reply-To: <3B5E23D2.04368@ud4> from ""truename" " Organization: "Klingon Imperial Intelligence Service" Subject: Re: about smap To: openwhale@yeah.net Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1317 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, smap 1.8 is not fwtk, it seems to be Gauntlet 3.2, it is different code branch and configuration is not 100% (to say least) compatible. "truename" said : > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi all, > > I want only some users in my company can use SMAP proxy, but I am not sure how to define it in the netperm-table. > > I am using the FWTK v3.2 just now, and the smap src v1.8. > > Please help me if you know how to do it, thanks _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBO16n4KH/mIJW9LeBAQH8bAP/aUylYAMYFjCBpPvlRhg1g8PPF3A0+AzD 2CE6KpjcmnxCJzBmjladsBYuaCn+aQKLZo99jT5qiLYn20aKa6pBB2JcfcsR9xtI NJrwjieRHlvNnqot+ocUuPKHLu4IWEis4+YqJUUGl/r8iMMnDF8+X+BDj3tPBnCn Bue5aDdpE0w= =vb7A -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Wed Jul 25 11:59 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA04915 Wed, 25 Jul 2001 11:59:11 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id LAA13351; Wed, 25 Jul 2001 11:05:09 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Wed, 25 Jul 2001 10:59:17 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA11778 for fwtk-users-outgoing; Wed, 25 Jul 2001 10:59:16 -0500 (CDT) Message-ID: <002301c11523$41e8d0a0$0d01a8c0@powernet.net> From: "MailLists" To: Subject: Using pop through fwtk Date: Wed, 25 Jul 2001 09:02:51 -0700 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.50.4522.1200 X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4522.1200 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 549 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] I have the following configuration to handle the pop service for my firewall. It appears to me that this would only allow hosts 192.168.1.* to use the service pop. This doesnt appear to be working, as outside sources can still access pop. What am I doing wrong here? # pop gateway services #--------------------- plug-gw: permit-hosts 192.168.1.* service=pop plug-gw: port pop * -plug-to From owner-fwtk-users@ex.tis.com Thu Jul 26 20:22 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id UAA12157 Thu, 26 Jul 2001 20:22:34 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id TAA17642; Thu, 26 Jul 2001 19:28:54 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Thu, 26 Jul 2001 19:23:21 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id TAA16559 for fwtk-users-outgoing; Thu, 26 Jul 2001 19:23:20 -0500 (CDT) Message-ID: <002001c11632$94f42a50$962137ce@bastogne> From: "Frank Natoli" To: "FWTK Users" Subject: Gateway Access Date: Thu, 26 Jul 2001 20:24:51 -0400 MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 5.00.2919.6700 X-MimeOLE: Produced By Microsoft MimeOLE V5.00.2919.6700 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1117 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] A few days ago I posted a query regarding running ftp on the gateway/proxy machine. I was in error. The requirement is, as other more firewall savvy people guessed, to run ftp on a "secure side" machine, through the gateway/proxy machine, to a "non-secure side" machine. I must permit "get" (non-secure to secure) but no "put" (secure to non-secure) transfers. If I understand the ftp-gw proxy operation correctly, I need to forbid "put", "mput" and "send" operations from the "secure" side. ftp-gw.c sees the operation names as they're moved, so interception and manipulation is straightforward. Problem for the moment is ftp-gw's use of function oktotalkto(). I can put a "secure" machine in netperm-table, allowing it access to the gateway/proxy. But I don't want to allow "non-secure" machines access. When ftp-gw attempts to setup a connection, it fails because oktotalkto() denies the remote host. Should I simply supress the call to oktotalkto() for the remote host? Thanks. From owner-fwtk-users@ex.tis.com Fri Jul 27 04:44 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA12907 Fri, 27 Jul 2001 04:44:39 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id DAA05029; Fri, 27 Jul 2001 03:50:59 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 27 Jul 2001 03:48:15 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA04347 for fwtk-users-outgoing; Fri, 27 Jul 2001 03:48:14 -0500 (CDT) Message-ID: <3B612AAC.2E33D61F@tensor.ru> Date: Fri, 27 Jul 2001 12:47:40 +0400 From: Denis Tokarev Reply-To: den@tensor.ru Organization: Tensor X-Mailer: Mozilla 4.77 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: "fwtk-users@lists.nai.com" Subject: From FAQ: FTP through http-gw gives a "-501 Unknown ftp problem" error message. Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=koi8-r Content-Length: 516 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi! FAQ explain this as "That'll only happen if the connection is being terminated prematurely for some reason. You'll probably find more reason why in the logs." So, if your client support proxy type "HTTP-CONNECT"(by default client say "GET" command) like FlashGet, you succefully get files from such ftp(MS FTP service, for example). I think theres a reason to update FAQ. /dvt From owner-fwtk-users@ex.tis.com Fri Jul 27 10:19 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA13494 Fri, 27 Jul 2001 10:19:18 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id JAA09448; Fri, 27 Jul 2001 09:25:39 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 27 Jul 2001 09:23:10 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id JAA08597 for fwtk-users-outgoing; Fri, 27 Jul 2001 09:23:09 -0500 (CDT) Message-ID: <3B617983.5070801@v-one.com> Date: Fri, 27 Jul 2001 10:24:03 -0400 From: Keith Young Reply-To: kyoung@v-one.com Organization: V-ONE User-Agent: Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.2) Gecko/20010628 X-Accept-Language: en-us MIME-Version: 1.0 To: den@tensor.ru CC: "fwtk-users@lists.nai.com" Subject: Re: From FAQ: FTP through http-gw gives a "-501 Unknown ftp problem" error message. References: <3B612AAC.2E33D61F@tensor.ru> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=KOI8-R; format=flowed Content-Length: 807 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Denis Tokarev wrote: > FAQ explain this as "That'll only happen if the connection is being terminated > prematurely for some reason. You'll probably find more reason why in the logs." > So, if your client support proxy type "HTTP-CONNECT"(by default client say > "GET" command) like FlashGet, you succefully get files from such ftp(MS FTP > service, for example). I think theres a reason to update FAQ. Denis, I don't understand... do you mean that you should try "HTTP-CONNECT" in your client if ftp-gw is disconnecting downloads early? Let me know and I can add it to the FAQ.... -- --Keith Young -Director of Customer Care/Support, V-ONE Corp. -kyoung@v-one.com From owner-fwtk-users@ex.tis.com Fri Jul 27 11:04 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA13659 Fri, 27 Jul 2001 11:04:41 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA18869; Fri, 27 Jul 2001 10:10:59 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Fri, 27 Jul 2001 10:09:03 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA18081 for fwtk-users-outgoing; Fri, 27 Jul 2001 10:09:02 -0500 (CDT) From: ark@eltex.ru Date: Fri, 27 Jul 2001 19:03:30 +0400 Message-Id: <200107271503.TAA13072@paranoid.eltex.ru> In-Reply-To: <002001c11632$94f42a50$962137ce@bastogne> from ""Frank Natoli" " Organization: "Klingon Imperial Intelligence Service" Subject: Re: Gateway Access To: frankn@palace.net Cc: fwtk-users@tis.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1944 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, What for? It is just the purpose of oktotalkto() function - to control access for incoming connections. What's wrong with it? "Frank Natoli" said : > A few days ago I posted a query regarding running ftp on the gateway/proxy > machine. I was in error. The requirement is, as other more firewall savvy > people guessed, to run ftp on a "secure side" machine, through the > gateway/proxy machine, to a "non-secure side" machine. I must permit "get" > (non-secure to secure) but no "put" (secure to non-secure) transfers. > > If I understand the ftp-gw proxy operation correctly, I need to forbid > "put", "mput" and "send" operations from the "secure" side. ftp-gw.c sees > the operation names as they're moved, so interception and manipulation is > straightforward. > > Problem for the moment is ftp-gw's use of function oktotalkto(). I can put a > "secure" machine in netperm-table, allowing it access to the gateway/proxy. > But I don't want to allow "non-secure" machines access. When ftp-gw attempts > to setup a connection, it fails because oktotalkto() denies the remote host. > > Should I simply supress the call to oktotalkto() for the remote host? _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBO2GCwaH/mIJW9LeBAQFLOgP6A5aD3+iijHzwXK6OAGndIT43X1zCkg2y hilxpjKdA/6BeVM5mFR7Wpfrbb8JCMWO++w02D2mibLlTpeQljY0oz0HmuZhanFK ViG12abJuEgE/i4lpTgvZ6gBcSN9/oD6R+qTyZ6vLDnWuvnWQ9eqd44l0G0rJGjc viQL9zg13FE= =NMhq -----END PGP SIGNATURE----- From owner-fwtk-users@ex.tis.com Sat Jul 28 06:47 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA15506 Sat, 28 Jul 2001 06:47:26 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA00616; Sat, 28 Jul 2001 05:53:48 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Sat, 28 Jul 2001 05:49:18 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA29966 for fwtk-users-outgoing; Sat, 28 Jul 2001 05:49:17 -0500 (CDT) From: ark@eltex.ru Message-Id: <200107281043.OAA16703@paranoid.eltex.ru> Subject: Re: ANNOUNCE: balrog - a multithreaded web proxy To: gale@syntax.dera.gov.uk (Tony Gale) Date: Sat, 28 Jul 2001 14:43:24 +0400 (MSD) Cc: fwtk-users@lists.nai.com Reply-To: ark@eltex.ru In-Reply-To: <995972207.1692.14.camel@syntax.dera.gov.uk> from "Tony Gale" at Jul 24, 2001 11:56:47 AM X-Mailer: ELM [version 2.5 PL3] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=us-ascii Content-Length: 1068 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] nuqneH, Why not to use fwtk api to keep configuration and log format close to those implemented in fwtk proxies? YOU (Tony Gale) WROTE: > I've been developing a replacement for http-gw, with an aim to support > more features and to speed things up somewhat. I have released the > current code base, for details please see: > > http://www.precipice.freeserve.co.uk > > There is a mailing list which isn't mentioned on the web page yet, so > for details see: > > http://www.topica.com/lists/balrog > > Development is on-going, but I've put over 50million requests through > this code without problem, so it is pretty stable. -- _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! From owner-fwtk-users@ex.tis.com Mon Jul 30 01:50 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id BAA18062 Mon, 30 Jul 2001 01:49:50 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id AAA29322; Mon, 30 Jul 2001 00:56:12 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Jul 2001 00:50:45 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id AAA28297 for fwtk-users-outgoing; Mon, 30 Jul 2001 00:50:44 -0500 (CDT) Message-ID: <3B64F58B.5C168FDC@tensor.ru> Date: Mon, 30 Jul 2001 09:50:03 +0400 From: Denis Tokarev Reply-To: den@tensor.ru Organization: Tensor X-Mailer: Mozilla 4.77 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: kyoung@v-one.com CC: "fwtk-users@lists.nai.com" Subject: Re: From FAQ: FTP through http-gw gives a "-501 Unknown ftp problem" error message. References: <3B612AAC.2E33D61F@tensor.ru> <3B617983.5070801@v-one.com> Content-Transfer-Encoding: 8bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=koi8-r Content-Length: 985 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Keith Young wrote: > > FAQ explain this as "That'll only happen if the connection is being terminated > > prematurely for some reason. You'll probably find more reason why in the logs." > > So, if your client support proxy type "HTTP-CONNECT"(by default client say > > "GET" command) like FlashGet, you succefully get files from such ftp(MS FTP > > service, for example). I think theres a reason to update FAQ. > > Denis, > > I don't understand... do you mean that you should try "HTTP-CONNECT" in > your client if ftp-gw is disconnecting downloads early? Yes. But i mean http-gw(not ftp-gw). In many cases it works(i not sure it works always!) -- ôÏËÁÒÅ× äÅÎÉÓ, ëÏÍÐÁÎÉÑ "ôÅÎÚÏÒ" Ç. ñÒÏÓÌÁ×ÌØ, 150001, íÏÓËÏ×ÓËÉÊ ÐÒ-Ô, 12 (ÓÉÓÔÅÍÎÙÊ ÁÄÍÉÎÉÓÔÒÁÔÏÒ) ÐÉÛÉÔÅ: den@tensor.ru ÞÉÔÁÊÔÅ: http://www.tensor.ru Ú×ÏÎÉÔÅ: [0852] 45-14-13 (6 ÌÉÎÉÊ) From owner-fwtk-users@ex.tis.com Mon Jul 30 04:57 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA18519 Mon, 30 Jul 2001 04:57:55 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id EAA22469; Mon, 30 Jul 2001 04:03:27 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Jul 2001 03:58:39 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id DAA21652 for fwtk-users-outgoing; Mon, 30 Jul 2001 03:58:35 -0500 (CDT) Subject: Re: From FAQ: FTP through http-gw gives a "-501 Unknown ftp problem" error message. From: Tony Gale To: den@tensor.ru Cc: fwtk-users@lists.nai.com In-Reply-To: <3B612AAC.2E33D61F@tensor.ru> References: <3B612AAC.2E33D61F@tensor.ru> Content-Transfer-Encoding: 7bit X-Mailer: Evolution/0.11.99 (Preview Release) Date: 30 Jul 2001 09:58:24 +0100 Message-Id: <996483504.27724.5.camel@syntax.dera.gov.uk> Mime-Version: 1.0 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain Content-Length: 821 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] You'll also get this error if you haven't applied the jumbo patch from www.fwtk.org. -tony On 27 Jul 2001 12:47:40 +0400, Denis Tokarev wrote: > [To be removed from this list send the message "unsubscribe fwtk-users" in the > BODY of a mail message to majordomo@ex.tis.com.] > > Hi! > > FAQ explain this as "That'll only happen if the connection is being terminated > prematurely for some reason. You'll probably find more reason why in the logs." > So, if your client support proxy type "HTTP-CONNECT"(by default client say > "GET" command) like FlashGet, you succefully get files from such ftp(MS FTP > service, for example). I think theres a reason to update FAQ. > > > /dvt From owner-fwtk-users@ex.tis.com Mon Jul 30 11:26 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA19433 Mon, 30 Jul 2001 11:26:32 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id KAA26840; Mon, 30 Jul 2001 10:32:53 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Jul 2001 10:29:26 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id KAA25835 for fwtk-users-outgoing; Mon, 30 Jul 2001 10:29:24 -0500 (CDT) Message-ID: <8D270E9C2BC4D311968E009027CCC0DA3809A6@cetu-mel.cetu.i2> From: "MARCON Michel, CETU/SG/Informatique" To: "'fwtk-users@lists.nai.com'" Subject: TR: fwtk newbie: compile problem Date: Mon, 30 Jul 2001 17:28:41 +0200 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by relay2.nai.com id KAA25798 Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset="iso-8859-1" Content-Length: 750 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hello. Using a Linux Slackware platfomrm with /etc/shadow, I have a misfunctionning authsrv program. (compilation was OK). I have #define AUTHPROTO_PASSWORD in auth.h. But authsrv refuses to add a password to the use admin: crash with "Segment violation ..." After fumbling here and there I had to [manually] patch .../auth/pass.c because the crypt function wants the salt argument to begin with "$1$". How come this doens'nt makes any comùole error/warning ?? Or have I missed soething important?? -------------------------- Michel Marcon SysAdmin Unix & Windows NT Ministere Equipement, CETU Tel (33) 04 7214-3408 From owner-fwtk-users@ex.tis.com Tue Jul 31 00:42 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id AAA21403 Tue, 31 Jul 2001 00:42:28 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id XAA24634; Mon, 30 Jul 2001 23:48:49 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Mon, 30 Jul 2001 23:44:39 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id XAA23560 for fwtk-users-outgoing; Mon, 30 Jul 2001 23:44:38 -0500 (CDT) From: mike@mjctech.com (Michael Cassidy) Message-Id: <0107310441.AA16830@dec5a.mjctech.com> Subject: http-gw restrictions from WinNT Term Svr/Citrix MetaFrame To: FWTK-list Date: Mon, 30 Jul 2001 21:41:56 -0700 (PDT) X-Mailer: ELM [version 2.4ME+ PL66 (25)] Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=US-ASCII Content-Length: 879 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Hi All, Just wondering if anyone might have any ideas on how one could go about controlling access to http-gw for users running from WinNT sessions on a Windows NT Terminal Server (which also happens to be running Citrix MetaFrame). I'm guessing not much can be done since each user on any given server will be seen as coming from the same IP address, but I thought it would be worth a try anyway. Of course the objective is to be able to allow certain users access to http-gw and others not. Although all the users would have the same IP address, I'm wondering whether there might be some way to "push" some additional info to http-gw that could be used to distinguish one user from another. Anyone have any suggestions? Thanks. Michael Cassidy From owner-fwtk-users@ex.tis.com Tue Jul 31 02:22 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id CAA21541 Tue, 31 Jul 2001 02:21:59 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id BAA05665; Tue, 31 Jul 2001 01:28:22 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 31 Jul 2001 01:19:09 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id BAA04257 for fwtk-users-outgoing; Tue, 31 Jul 2001 01:19:08 -0500 (CDT) Message-ID: <3B664DB5.E0DE9BA7@tensor.ru> Date: Tue, 31 Jul 2001 10:18:29 +0400 From: Denis Tokarev Reply-To: den@tensor.ru Organization: Tensor X-Mailer: Mozilla 4.77 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 To: Michael Cassidy CC: FWTK-list Subject: Re: http-gw restrictions from WinNT Term Svr/Citrix MetaFrame References: <0107310441.AA16830@dec5a.mjctech.com> Content-Transfer-Encoding: 7bit Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text/plain; charset=koi8-r Content-Length: 986 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] Michael Cassidy wrote: > > Just wondering if anyone might have any ideas on how one could go about > controlling access to http-gw for users running from WinNT sessions on > a Windows NT Terminal Server (which also happens to be running Citrix > MetaFrame). I'm guessing not much can be done since each user on any > given server will be seen as coming from the same IP address, but I > thought it would be worth a try anyway. Of course the objective is to > be able to allow certain users access to http-gw and others not. > > Although all the users would have the same IP address, I'm wondering > whether there might be some way to "push" some additional info to > http-gw that could be used to distinguish one user from another. > May be using some kind of authorisation is a solution? Consider using of authsrv component from fwtk package. /dvt From owner-fwtk-users@ex.tis.com Tue Jul 31 06:13 EDT 2001 Received: from relay2.nai.com (relay2.nai.com [161.69.3.67]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id GAA22042 Tue, 31 Jul 2001 06:13:39 -0400 (EDT) Received: from localhost (daemon@localhost) by relay2.nai.com (8.9.3/8.9.3) with SMTP id FAA00278; Tue, 31 Jul 2001 05:20:00 -0500 (CDT) Received: by ex.tis.com (bulk_mailer v1.11); Tue, 31 Jul 2001 05:14:56 -0500 Received: (from majordomo@localhost) by relay2.nai.com (8.9.3/8.9.3) id FAA29161 for fwtk-users-outgoing; Tue, 31 Jul 2001 05:14:55 -0500 (CDT) From: ark@eltex.ru Date: Tue, 31 Jul 2001 14:07:53 +0400 Message-Id: <200107311007.OAA01623@paranoid.eltex.ru> In-Reply-To: <3B664DB5.E0DE9BA7@tensor.ru> from "Denis Tokarev " Organization: "Klingon Imperial Intelligence Service" Subject: Re: http-gw restrictions from WinNT Term Svr/Citrix MetaFrame To: den@tensor.ru Cc: fwtk-users@lists.nai.com Sender: owner-fwtk-users@lists.tislabs.com Content-Type: text Content-Length: 1896 [To be removed from this list send the message "unsubscribe fwtk-users" in the BODY of a mail message to majordomo@ex.tis.com.] -----BEGIN PGP SIGNED MESSAGE----- nuqneH, http authorization is real PITA and it is really hard to implement it properly. the proper way seems to be use of short-living reusable passwords generated after traditional authsrv OTP authentication succeeds. Denis Tokarev said : > Michael Cassidy wrote: > > > > Just wondering if anyone might have any ideas on how one could go about > > controlling access to http-gw for users running from WinNT sessions on > > a Windows NT Terminal Server (which also happens to be running Citrix > > MetaFrame). I'm guessing not much can be done since each user on any > > given server will be seen as coming from the same IP address, but I > > thought it would be worth a try anyway. Of course the objective is to > > be able to allow certain users access to http-gw and others not. > > > > Although all the users would have the same IP address, I'm wondering > > whether there might be some way to "push" some additional info to > > http-gw that could be used to distinguish one user from another. > > > > May be using some kind of authorisation is a solution? Consider using of > authsrv component from fwtk package. _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBO2aDeKH/mIJW9LeBAQEjdQP/Q65nVftqWZDgr+jMYtRJM5BTfHu7gnqD ThXT+NpbbmjpxgEboA4OmWwXi6kVp+Y8UuLuBzkvt9G/K2XlRiA2vkRN4bR6AJw1 u2xrRuZojuMhPWH9WIQGQ6vtEgeg0uz4DF/8we2ig9L4hBRYTiUbFe12Ot2xgXhu UwIAE/3ZdOQ= =a2J+ -----END PGP SIGNATURE-----