From bounce-fwtk-users-303@listserv.nai.com Sat Dec 1 11:45 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id LAA17353 Sat, 1 Dec 2001 11:45:32 -0500 (EST) Date: Sat, 1 Dec 2001 11:54:40 -0500 (EST) From: Ted Keller To: "fwtk-users" Subject: [fwtk-users] Re: Smap Message: peer dropped connection In-Reply-To: Message-ID: MIME-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2286 Status: RO Well I have included a rendition of Rick's code in my version of smap. It caught an additional 300+ spammers from aol and hotmail for part of a week. That's still a small part of my overall spam filters (we tend to catch some 30,000 spammers - but I'll take it! It's fast and efficient - and save the internal scanning of the mail body. With regard to the ongoing discussion, we may want to compile a list of the major e-mail services where the code as implemented is valid. That we we can all benefit from the anti-spam feature this provides. Then we could also compose an alternative list where the mx lookup may be beneficial. From these, we can determine if the mxlookup feature is beneficial. ted keller On 28 Nov 2001, Tony Gale wrote: > On Wed, 2001-11-28 at 00:35, Rick Murphy wrote: > > At 09:38 AM 11/27/01 +0000, Tony Gale wrote: > > >I haven't looked into the code, but am going from the description above. > > >I believe the "correct" way to do this check is to look up the MX record > > >for the envelope senders domain and check it against the address of the > > >sending system. > > > > > >Using a reverse dns lookup is much more likely to fail and to give an > > >incorrect result. > > > > For the big ISPs that is being used on, that's not the case. A big ISP's > > outgoing SMTP servers aren't necessarily the same as their incoming servers > > - but they're very likely to have a valid reverse lookup in their own domain. > > > > All the patch does is to say that if you're trying to send mail with an > > envelope sender of "*@yahoo.com", you *must* be coming from a host with a > > valid reverse DNS somewhere in the yahoo.com domain. So far, that works > > well for detecting the most common forged domains. > > The contra-argument being that some ISPs don't allow you to establish a > reverse DNS for an IP range they have allocated to you. > > So, it would be best to do both tests, and catch virtually everyone. > > Thanks > > -tony > > > > --- > You are currently subscribed to fwtk-users as: keller@bfg.com > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Sat Dec 1 15:28 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id PAA17688 Sat, 1 Dec 2001 15:28:09 -0500 (EST) Date: Sat, 1 Dec 2001 15:37:33 -0500 (EST) From: Ted Keller To: "fwtk-users" Subject: [fwtk-users] Re: Bug in ftp-gw.c/sendsaved ? In-Reply-To: Message-ID: MIME-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 2848 Status: RO So is there a bonified patch for this issue? The updated looks pretty easy - however, if you have a patch - would like to see it and post it to fwtk.org. ted keller On Fri, 16 Nov 2001, Michel Bardiaux wrote: > Symptoms: FTP client (any) comes from behind a Checkpoint Firewall-1, > goes through TIS FWTK 2.1 ftp-gw (configured incoming), to *any* ftp > server, whather loval or in the DMZ. Client sends "USER foo", receives > "331 Password required for ..." then "421 Service not available". > > We looked in the FAQs, the FWTK archives, Google, the FWTK patches > pages, etc... and found about the port-20 problem and patch (which was > already applied), and about the problem of \r\n in a separate packet > from the PORT command, which supposed to be fixed in 2.1. > > We then added lots of trace printouts in ftp-gw.c and it finally emerged > that there is one place where the \r\n problem is *not* completely fixed > because there is one case when ftp-gw tals to the client not using > sayn() but directly calling net_send(): in sendsaved(). After patching > sendsaved() the sessions through FW-1 worked. > > With the benefit of hindsight, I could find in the archive on reference > to apparently the same problem and the same solution, but the specifics > were not given: > > =========== From the archive: > > At 11:10 AM 9/8/00 -0500, Larry D. Bonham wrote: > >Rick, > > > >Thanks for the response. We had already had the default port setting at > >port 20. We dealt with that problem quite some time ago. > > Rats. Never anything easy. > > > >As it turns out I had to do a little slash and burn. I disabled most of > >the entire sendsaved() function and sent it directly to flushsaved(). For > >whatever reason the Checkpoint proxy couldn't (wouldn't) handle the > >multiline response 331-. > > That's probably a side effect of Checkpoint's "patch" to fix their FTP > vulnerability. That's the only time ftp-gw adds anything to the > interaction, so your change shouldn't have any effect (authenticated ftp > users will probably break, though, if you're using authentication.) > -Rick > > =========== End archive > > Now, I unsubscribe from the list during my holidays, I could have missed > the patch when published. If it is a new one, I will post it here, and > someone could put in th the patches web page. > > BTW: this patch is already known for Gauntlet. > > Greetings, > -- > Michel Bardiaux > Peaktime Belgium S.A. Rue Margot, 37 B-1457 Nil St Vincent > Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 > > --- > You are currently subscribed to fwtk-users as: keller@bfg.com > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Dec 3 09:40 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id JAA21775 Mon, 3 Dec 2001 09:40:57 -0500 (EST) Message-Id: Date: Mon, 3 Dec 2001 15:49:32 +0100 (MET) From: lebayle Reply-To: "fwtk-users" Subject: [fwtk-users] Re: RBL lookups don't work anymore To: "fwtk-users" Cc: lebayle@esrf.fr MIME-Version: 1.0 Content-MD5: NdUFbXxP3mAuqJTRXh2q5A== X-Mailer: dtmail 1.3.0 CDE Version 1.3 SunOS 5.7 sun4u sparc List-Unsubscribe: Content-Type: TEXT/plain; charset=us-ascii Content-Length: 844 Status: RO Hi Rick, Could you please provide your source code handling the "block-list" option below ? >What I use are the lists at relays.osirusoft.com, some outright rejecting >and some marking for users to decide. The top-level "relays.osirusoft.com" >has everything listed; only those hosts with address 127.0.0.2 are on their >relay list, thus the first entry (.relays.osirusoft.com:127.0.0.2). ... ># ># OSIRUSOFT blocks ># >smap: block-list "ORL" block .relays.osirusoft.com:127.0.0.2 "%s/%s was found >in the Osirusoft relays list (see http://relays.osirusoft.com/)" Thanks in advance, Bruno LEBAYLE (lebayle@esrf.fr) European Synchrotron Radiation Facility - Grenoble, FRANCE --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 4 02:48 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id CAA24895 Tue, 4 Dec 2001 02:48:39 -0500 (EST) Message-Id: Date: Tue, 4 Dec 2001 08:56:08 +0100 (MET) From: lebayle Reply-To: "fwtk-users" Subject: [fwtk-users] ssh setup To: "fwtk-users" Cc: lebayle@esrf.fr MIME-Version: 1.0 Content-MD5: 2SmZni1MdhfOLZA7sSNLyQ== X-Mailer: dtmail 1.3.0 CDE Version 1.3 SunOS 5.7 sun4u sparc List-Unsubscribe: Content-Type: TEXT/plain; charset=us-ascii Content-Length: 915 Status: RO Hi, I would like to setup the already mentioned ssh setup as follows: ssh client ---> crypted ---> firewall sshd (-rsh launches telnet localhost) | V tn-gw ---> uncrypted ---> internal host The aim is to avoid passwords in clear text on the Internet. Everything works fine, but I would like to avoid passwords for logging into the firewall since the actual password check is done with the internal host instead. I could not find a way to avoid this, any idea from someone who implemented this ? Thanks, Bruno LEBAYLE (lebayle@esrf.fr) European Synchrotron Radiation Facility - Grenoble, FRANCE --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 4 04:58 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id EAA25120 Tue, 4 Dec 2001 04:58:21 -0500 (EST) X-Authentication-Warning: spider.usrconsult.be: mail set sender to using -f Message-ID: Date: Tue, 04 Dec 2001 11:07:55 +0100 From: Michel Bardiaux Organization: Peaktime Belgium S.A. X-Mailer: Mozilla 4.73 [en] (WinNT; I) X-Accept-Language: en,fr MIME-Version: 1.0 To: "fwtk-users" Subject: [fwtk-users] Re: ssh setup Content-Transfer-Encoding: 7bit List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=us-ascii Content-Length: 1876 Status: RO lebayle wrote: > > Hi, > > I would like to setup the already mentioned ssh setup as follows: > ssh client ---> crypted ---> firewall > sshd (-rsh launches telnet localhost) > | > V > tn-gw ---> uncrypted ---> internal host > > The aim is to avoid passwords in clear text on the Internet. > Everything works fine, but I would like to avoid passwords for logging into > the firewall since the actual password check is done with the internal host > instead. > I could not find a way to avoid this, any idea from someone who implemented > this ? > > Thanks, > Bruno LEBAYLE (lebayle@esrf.fr) > European Synchrotron Radiation Facility - Grenoble, FRANCE > Why would you want to do things like that? It brings telnet and rsh into play, involves cleartext traffic between the firewall and the internal host, and requires the ssh keys to be on the firewall, where they are harder to administrate. We use the following setup: ssh client ---> crypted ---> firewall plug-gw | V internal host sshd The drawback is that it gives you access to only *one* internal host. But hopping from there using rsh is not so much of a risk. (I tend to favor rsh with .rhosts access control, to avoid cleartext password traffic even on the internal net. If you do not trust your internal net, you could use ssh there as well) HaND -- Michel Bardiaux Peaktime Belgium S.A. Rue Margot, 37 B-1457 Nil St Vincent Tel : +32 10 65.44.15 Fax : +32 10 65.44.10 --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 4 06:27 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id GAA25247 Tue, 4 Dec 2001 06:27:45 -0500 (EST) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 04 Dec 2001 06:30:02 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: Bug in ftp-gw.c/sendsaved ? In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 492 Status: RO At 03:37 PM 12/1/01 -0500, Ted Keller wrote: >So is there a bonified patch for this issue? The updated looks pretty >easy - however, if you have a patch - would like to see it and post it to >fwtk.org. I haven't seen a patch and I'm reluctant to just write one - I don't have the ability to test any proposed fix. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 4 16:23 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id QAA11381 Tue, 4 Dec 2001 16:23:29 -0500 (EST) From: "Ken Long" Organization: Lectrosonics, Inc. To: "fwtk-users" Date: Tue, 4 Dec 2001 14:32:04 -0700 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: [fwtk-users] Email filtering at the firewall Message-ID: Priority: normal X-mailer: Pegasus Mail for Win32 (v3.12c) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=US-ASCII Content-Length: 420 Status: RO Ok, it has become painfully obvious that I can't depend on my users to scan attachments before running them. Can anyone recommend a product to scan email and block certain extensions that works with smap/sendmail on Linux? TIA, Ken Long Lectrosonics, Inc. --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 4 16:30 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id QAA11390 Tue, 4 Dec 2001 16:30:13 -0500 (EST) X-Authentication-Warning: guardian.hartwellcorp.com: mail set sender to using -f Message-ID: From: "Michael St. Laurent" To: "fwtk-users" Cc: "'ken@lectrosonics.com'" Subject: [fwtk-users] RE: Email filtering at the firewall Date: Tue, 4 Dec 2001 13:38:11 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1125 Status: RO Sure. I understand that Procmail does this. Also, there's a project called Amavis that will unpack the email, scan the attachments with your antivirus software and if it comes back negative, forward the email. -------------------- Michael St. Laurent Hartwell Corporation [root@earth] root# rm -rf /bin/laden > -----Original Message----- > From: Ken Long [mailto:ken@lectrosonics.com] > Sent: Tuesday, December 04, 2001 1:32 PM > To: fwtk-users > Subject: [fwtk-users] Email filtering at the firewall > > > Ok, it has become painfully obvious that I can't depend on my > users to > scan attachments before running them. Can anyone recommend a > product to > scan email and block certain extensions that works with > smap/sendmail on > Linux? > > TIA, > Ken Long > Lectrosonics, Inc. > > > --- > You are currently subscribed to fwtk-users as: mikes@hartwellcorp.com > To unsubscribe send a blank email to > leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 4 16:55 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id QAA11424 Tue, 4 Dec 2001 16:55:32 -0500 (EST) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 04 Dec 2001 16:55:06 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] RE: Email filtering at the firewall In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 395 Status: RO For procmail filtering, I use html-trap - it has a list of extensions that get "defanged" by adding a suffix - that keeps the luser from opening the virus. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Dec 5 03:16 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id DAA13126 Wed, 5 Dec 2001 03:16:05 -0500 (EST) Subject: [fwtk-users] Re: Email filtering at the firewall From: Berend De Schouwer To: "fwtk-users" In-Reply-To: Content-Transfer-Encoding: 7bit X-Mailer: Evolution/0.99.2 (Preview Release) Date: 05 Dec 2001 10:24:24 +0200 Message-Id: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain Content-Length: 787 Status: RO On Tue, 2001-12-04 at 23:32, Ken Long wrote: > Ok, it has become painfully obvious that I can't depend on my users to > scan attachments before running them. Can anyone recommend a product to > scan email and block certain extensions that works with smap/sendmail on > Linux? Inflex http://www.pldaniels.com/inflex/ or procmail-sanitizer http://www.impsec.org/email-tools/procmail-security.html work. > > TIA, > Ken Long > Lectrosonics, Inc. > > > --- > You are currently subscribed to fwtk-users as: bds@jhb.ucs.co.za > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com -- Berend De Schouwer --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Dec 5 14:56 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id OAA23524 Wed, 5 Dec 2001 14:56:55 -0500 (EST) From: "Todd Williams" To: "fwtk-users" Subject: [fwtk-users] Problem using http-gw to deny browsers Date: Wed, 5 Dec 2001 15:03:07 -0500 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Importance: Normal List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 887 Status: RO Hi folks, I just attempted to add a few limiting entries to my netperm-table file which would deny users access to a few select websites. I found that this worked for a short period of time, and then without warning (or any changes), http-gw starts denying traffic to any and/or all web sites. Here's what I tried: http-gw: permit-hosts 192.168.22.* -dest !*.pager.yahoo.com -dest !*.icq.com -dest !login.oscar.aol.com -dest * It would seem that the majority of the time this works fine, but occasionally http-gw will log and deny traffic that should not get denied! Somehow, http-gw gets confused and breaks. Has anyone else seen this behavior, and does anybody have any idea what might be causing it? Thanks, Todd --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Dec 6 10:32 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id KAA00648 Thu, 6 Dec 2001 10:32:22 -0500 (EST) To: "fwtk-users" Subject: [fwtk-users] Re: Email filtering at the firewall X-Sun-Charset: US-ASCII Message-Id: Date: Thu, 6 Dec 2001 10:41:10 -0500 (EST) From: jseymour@medar.com (James Seymour) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text Content-Length: 1597 Status: RO "Ken Long" wrote: > > Ok, it has become painfully obvious that I can't depend on my users to > scan attachments before running them. Now *there's* a surprise! :-) > Can anyone recommend a product to > scan email and block certain extensions that works with smap/sendmail on > Linux? The problem with relying on virus-scanning incoming email, IMO, is that you must constantly keep updating virus signature files. And even if you do: the anti-virus people will always be behind the curve. This is particularly problematical when a new fast-mover appears. Starting some number of email-borne virus/worm/trojan attacks ago: I simply configured the email gateways to reject all known dangerous attachment types. Problem solved (for the most part). I replaced smap/smapd/sendmail with Postfix long ago. Postfix allowed me to accomplish the MIME type filtering quite easily. And Postfix has been far more stable and predictable than the smap/smapd/sendmail combo ever was. (Note: maybe the recent smap/smapd/sendmail trios are better than the old ones. I don't bother to keep track anymore.) HTH Regards, Jim -- Jim Seymour | Welding Technology Corporation jseymour@weldtechcorp.com | 24775 Crestview Ct. Systems, Network & TelCom Admin. | Farmington Hills, MI. 48335 | FAX: (248)477-8897 --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Dec 6 11:47 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id LAA00847 Thu, 6 Dec 2001 11:47:16 -0500 (EST) To: "fwtk-users" Subject: [fwtk-users] Re: Problem using http-gw to deny browsers Message-ID: Date: Thu, 06 Dec 2001 22:16:59 +0600 (IST) From: jkm_79@sify.com In-Reply-To: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain Content-Length: 1574 Status: RO hai, i also attempted the same problem, then i changed my browser settings in netscape, edit->preferences-> give the option to access the page every time, not once per session, i works for me. bye. Quoting Todd Williams : > Hi folks, > > I just attempted to add a few limiting entries to my netperm-table file > which would deny users access to a few select websites. I found that > this > worked for a short period of time, and then without warning (or any > changes), http-gw starts denying traffic to any and/or all web sites. > Here's what I tried: > > http-gw: permit-hosts 192.168.22.* -dest !*.pager.yahoo.com -dest > !*.icq.com -dest !login.oscar.aol.com -dest * > > It would seem that the majority of the time this works fine, but > occasionally http-gw will log and deny traffic that should not get > denied! > Somehow, http-gw gets confused and breaks. Has anyone else seen this > behavior, and does anybody have any idea what might be causing it? > > Thanks, > > Todd > > > > > > --- > You are currently subscribed to fwtk-users as: jkm_79@sify.com > To unsubscribe send a blank email to > leave-fwtk-users-303A@listserv.nai.com > ------------------------------------------------- This mail helped a tree grow. Know more at http://green.sify.com Want to win a PC or Palm Tops or Digital Diaries or T-Shirts? Click here http://promos.sify.com/niit/main.asp?mail --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Dec 6 12:09 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id MAA00900 Thu, 6 Dec 2001 12:09:31 -0500 (EST) From: "Ken Long" Organization: Lectrosonics, Inc. To: "fwtk-users" Date: Thu, 6 Dec 2001 10:17:45 -0700 MIME-Version: 1.0 Content-transfer-encoding: 7BIT Subject: [fwtk-users] Re: Email filtering at the firewall Message-ID: Priority: normal In-reply-to: X-mailer: Pegasus Mail for Win32 (v3.12c) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=US-ASCII Content-Length: 1418 Status: RO On 6 Dec 2001, at 10:41, James Seymour wrote: > The problem with relying on virus-scanning incoming email, IMO, is that > you must constantly keep updating virus signature files. And even if > you do: the anti-virus people will always be behind the curve. This is > particularly problematical when a new fast-mover appears. This is indeed a real problem. I wasn't really thinking of virus scanning though... > Starting some number of email-borne virus/worm/trojan attacks ago: I > simply configured the email gateways to reject all known dangerous > attachment types. Problem solved (for the most part). This is what I had in mind as well. I thought I would propose blocking all .exe, .com, .pif, .scr, .bat and .cmd. > I replaced smap/smapd/sendmail with Postfix long ago. Postfix allowed > me to accomplish the MIME type filtering quite easily. And Postfix > has been far more stable and predictable than the smap/smapd/sendmail > combo ever was. (Note: maybe the recent smap/smapd/sendmail trios are > better than the old ones. I don't bother to keep track anymore.) Ah, another possible solution to look into. A large local ISP recently moved to Postfix. They've been singing its praises ever since. Thanks, Ken Long Lectrosonics, Inc. --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Dec 6 20:40 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id UAA02379 Thu, 6 Dec 2001 20:40:04 -0500 (EST) Date: Thu, 6 Dec 2001 20:48:40 -0500 (EST) From: Ted Keller To: "fwtk-users" Subject: [fwtk-users] Re: Email filtering at the firewall In-Reply-To: Message-ID: MIME-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 913 Status: RO I have used in the past some code based on libmilter. If you do a search on libmilter using your favorite search engine, you should be able to find a number of references that will provide the desired filtering through sendmail. These have in the past been quite effective. ted keller On Tue, 4 Dec 2001, Ken Long wrote: > Ok, it has become painfully obvious that I can't depend on my users to > scan attachments before running them. Can anyone recommend a product to > scan email and block certain extensions that works with smap/sendmail on > Linux? > > TIA, > Ken Long > Lectrosonics, Inc. > > > --- > You are currently subscribed to fwtk-users as: keller@bfg.com > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Dec 7 06:11 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id GAA03841 Fri, 7 Dec 2001 06:11:05 -0500 (EST) From: ark@eltex.ru Date: Fri, 7 Dec 2001 14:12:23 +0300 Message-Id: In-Reply-To: from "Ted Keller " Organization: "Klingon Imperial Intelligence Service" Subject: [fwtk-users] Re: Email filtering at the firewall To: "fwtk-users" X-Virus-Scanned: by Eltex TC List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text Content-Length: 1935 Status: RO -----BEGIN PGP SIGNED MESSAGE----- I am thinking on possibility to integrate milter into smap because i don't use sendmail. Is there an API that will mimick sendmail for milter-based av scanners? Ted Keller said : > I have used in the past some code based on libmilter. If you do a search > on libmilter using your favorite search engine, you should be able to find > a number of references that will provide the desired filtering through > sendmail. These have in the past been quite effective. > > ted keller > > > On Tue, 4 Dec 2001, Ken Long wrote: > > > Ok, it has become painfully obvious that I can't depend on my users to > > scan attachments before running them. Can anyone recommend a product to > > scan email and block certain extensions that works with smap/sendmail on > > Linux? > > > > TIA, > > Ken Long > > Lectrosonics, Inc. > > > > > > --- > > You are currently subscribed to fwtk-users as: keller@bfg.com > > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > > > > > --- > You are currently subscribed to fwtk-users as: ark@eltex.ru > To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com > _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBPBCkFqH/mIJW9LeBAQEEYQP/adpLt8vBdd2TLW1MGVMhVattxNBIqMPF CHuSbsKIdLbrLWexloS7Lui/LG9DqdAQt2kIx1PTnqSNRyXV5VitDXNPgeQnPsKW 2Z56JGG0MuC0fTAMchk0PfQsxGGkUZhC8coYK59HUDs0rCxC/wmfzJXs4V88P4cD gblvLDg4ZoM= =mDNn -----END PGP SIGNATURE----- --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Dec 7 06:14 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id GAA03856 Fri, 7 Dec 2001 06:14:42 -0500 (EST) From: ark@eltex.ru Date: Fri, 7 Dec 2001 14:13:36 +0300 Message-Id: Organization: "Klingon Imperial Intelligence Service" Subject: [fwtk-users] Re: Email filtering at the firewall To: "fwtk-users" X-Virus-Scanned: by Eltex TC List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text Content-Length: 917 Status: RO -----BEGIN PGP SIGNED MESSAGE----- Oops, i should mention that actually that's not smap either, it is obtuse smtpd modified to read smap-style config from netperm-table ;) _ _ _ _ _ _ _ {::} {::} {::} CU in Hell _| o |_ | | _|| | / _||_| |_ |_ |_ (##) (##) (##) /Arkan#iD |_ o _||_| _||_| / _| | o |_||_||_| [||] [||] [||] Do i believe in Bible? Hell,man,i've seen one! -----BEGIN PGP SIGNATURE----- Version: PGP 6.5.1i iQCVAwUBPBCkX6H/mIJW9LeBAQGY8gQAgI72J3okPJ7kQoA4DqwTiqinM0NRIUop i6d71QU6vVDwIWYU7NBDvhaakpEr5NgAypW2O4qKQM1WlVP7QSsd4ZeahKjcrNvC RishKSkJ4TdzXc1awWNe+XcmeFpq/WOJ5d0wP2eS8b0NqKRXPtxJs/2Ll6rekL3b TIhobTaq8uI= =1YOX -----END PGP SIGNATURE----- --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Dec 7 08:24 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id IAA04274 Fri, 7 Dec 2001 08:24:28 -0500 (EST) To: "fwtk-users" Subject: [fwtk-users] Re: Email filtering at the firewall X-Sun-Charset: US-ASCII Message-Id: Date: Fri, 7 Dec 2001 08:33:18 -0500 (EST) From: jseymour@medar.com (James Seymour) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text Content-Length: 1505 Status: RO "Ken Long" wrote: > > On 6 Dec 2001, at 10:41, James Seymour wrote: > [snip] > > > Starting some number of email-borne virus/worm/trojan attacks ago: I > > simply configured the email gateways to reject all known dangerous > > attachment types. Problem solved (for the most part). > > This is what I had in mind as well. I thought I would propose blocking > all .exe, .com, .pif, .scr, .bat and .cmd. Consulting with some local Windows-heads here, I started out with: .bat .chm .cmd .com .exe .hta .js .jse .pif .scr .shb .shs .vbe .vbs .vbx .wsf .wsh On advice from someone posting a follow-up to that list somewhere, I added: .ade .adp .bas .cpl .crt .hlp .inf .ins .isp .lnk .mdb .mde .msc .msi .msp .mst .pcd .reg .sct .shs .url .vb .wsc I think that's all of 'em :-). > > > I replaced smap/smapd/sendmail with Postfix long ago. ... [snip] > > Ah, another possible solution to look into. A large local ISP recently > moved to Postfix. They've been singing its praises ever since. It's worked well for me :-). Regards, Jim -- Jim Seymour | Welding Technology Corporation jseymour@weldtechcorp.com | 24775 Crestview Ct. Systems, Network & TelCom Admin. | Farmington Hills, MI. 48335 | FAX: (248)477-8897 --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 18 05:06 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id FAA08814 Tue, 18 Dec 2001 05:06:43 -0500 (EST) Date: Tue, 18 Dec 2001 13:16:16 +0300 From: den X-Mailer: The Bat! (v1.53d) Reply-To: "fwtk-users" Organization: Tensor X-Priority: 3 (Normal) Message-ID: To: "fwtk-users" Subject: [fwtk-users] http-gw & connect MIME-Version: 1.0 Content-Transfer-Encoding: 7bit List-Unsubscribe: Content-Type: text/plain; charset=us-ascii Content-Length: 510 Status: RO Hello fwtk-users, I think it would be nice to patch http-gw to allow or disallow connect-method for some hosts. Configuration directive may be "http-gw permit-hosts a.b.c.d -connect". And that do YOU think about it? Its an old problem, i know, but i cannot find any good solution, except rip connect support from source code... /dvt --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 18 06:26 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id GAA08994 Tue, 18 Dec 2001 06:26:49 -0500 (EST) X-Authentication-Warning: tyger.hq.internetmedia.ru: antuan owned process doing -bs Date: Tue, 18 Dec 2001 14:35:42 +0300 (MSK) From: Antuan Avdioukhine X-X-Sender: To: "fwtk-users" Subject: [fwtk-users] Re: http-gw & connect In-Reply-To: Message-ID: MIME-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: TEXT/PLAIN; charset=US-ASCII Content-Length: 732 Status: RO On Tue, 18 Dec 2001, den wrote: > I think it would be nice to patch http-gw to allow or disallow > connect-method for some hosts. > Configuration directive may be > "http-gw permit-hosts a.b.c.d -connect". > And that do YOU think about it? Its an old problem, i know, but i > cannot find any good solution, except rip connect support from > source code... Bad idea, I think. There is CONNECT-feature in original plug-gw, as well as third-party ssl-gw. -- Antuan Avdioukhine (DEKA-RIPN) InternetMedia Holding Ltd. St.Petersburg, Russia. +7 (812) 320 8585 --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 18 11:25 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id LAA09888 Tue, 18 Dec 2001 11:25:57 -0500 (EST) Date: Tue, 18 Dec 2001 11:35:13 -0500 (EST) From: bleary@ipass.net Message-Id: X-Authentication-Warning: jupiter.portbridge.com: web set sender to bleary@ipass.net using -f To: "fwtk-users" Reply-To: "fwtk-users" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit User-Agent: IMP/PHP3 Imap webMail Program 2.0.11 Sender: bleary@ipass.net X-Originating-IP: 56.0.96.18 Subject: [fwtk-users] logging src IP without DNS lookups List-Unsubscribe: Content-Type: text/plain Content-Length: 381 Status: RO I have an application where I do not need to log the name of the source connection, only the IP address. I'll be using plug-gw. I figured I should ask before I hack - Does anyone have a patch to do this? Brion Leary --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 18 19:43 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id TAA11456 Tue, 18 Dec 2001 19:43:30 -0500 (EST) X-Authentication-Warning: guardian.hartwellcorp.com: mail set sender to using -f Message-ID: From: "Michael St. Laurent" To: "fwtk-users" Subject: [fwtk-users] Destination blocking & deny-destination Date: Tue, 18 Dec 2001 16:52:31 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 568 Status: RO Is the deny-destination parameter documented anywhere? I can't seem to get it to work. For example, I placed the following in the netperm-table file: Http-gw: deny-destination www.microsoft.com However, it didn't seem to make any difference. If someone would loan me a clue I promise to return it. :-) -------------------- Michael St. Laurent Hartwell Corporation [root@earth] root# rm -rf /bin/laden --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 18 21:16 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id VAA11702 Tue, 18 Dec 2001 21:16:02 -0500 (EST) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 18 Dec 2001 21:21:38 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: Destination blocking & deny-destination In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 677 Status: RO At 04:52 PM 12/18/01 -0800, Michael St. Laurent wrote: >Is the deny-destination parameter documented anywhere? I can't seem to get >it to work. For example, I placed the following in the netperm-table file: > >Http-gw: deny-destination www.microsoft.com > >However, it didn't seem to make any difference. If someone would loan me a >clue I promise to return it. :-) That looks like a Gauntlet thing to me. The only fwtk equivalent is http-gw: permit-hosts -dest {!www.microsoft.com} -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Dec 19 01:20 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id BAA12309 Wed, 19 Dec 2001 01:20:25 -0500 (EST) X-Authentication-Warning: guardian.hartwellcorp.com: mail set sender to using -f Message-ID: From: "Michael St. Laurent" To: "fwtk-users" Subject: [fwtk-users] Re: Destination blocking & deny-destination Date: Tue, 18 Dec 2001 22:29:36 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1701 Status: RO Ahhh. I got it from a post on the fwtk mailing list so I just assumed that it wasn't a Gauntlet thing. Oh well. My netperm-table file is set up sort of like this: *: permit-hosts system1.hartwellcorp.com *: permit-hosts system2.hartwellcorp.com *: permit-hosts system139.hartwellcorp.com What I need to do is make entries that will block access to particular addresses/URLs and I would very much prefer not to duplicate them on every line. Is there any way to do this? If so do I need a patch? -------------------- Michael St. Laurent Hartwell Corporation [root@earth] root# rm -rf /bin/laden > -----Original Message----- > From: Rick Murphy [mailto:rmurphy@itm-inst.com] > Sent: Tuesday, December 18, 2001 6:22 PM > To: fwtk-users > Subject: [fwtk-users] Re: Destination blocking & deny-destination > > > At 04:52 PM 12/18/01 -0800, Michael St. Laurent wrote: > >Is the deny-destination parameter documented anywhere? I > can't seem to get > >it to work. For example, I placed the following in the > netperm-table file: > > > >Http-gw: deny-destination www.microsoft.com > > > >However, it didn't seem to make any difference. If someone > would loan me a > >clue I promise to return it. :-) > > That looks like a Gauntlet thing to me. The only fwtk equivalent is > http-gw: permit-hosts -dest {!www.microsoft.com} > -Rick > > > --- > You are currently subscribed to fwtk-users as: mikes@hartwellcorp.com > To unsubscribe send a blank email to > leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Dec 19 15:06 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id PAA15042 Wed, 19 Dec 2001 15:06:06 -0500 (EST) From: "Todd Williams" To: "fwtk-users" Subject: [fwtk-users] Re: Destination blocking & deny-destination Date: Wed, 19 Dec 2001 15:12:24 -0500 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook 8.5, Build 4.71.2173.0 In-Reply-To: X-MimeOLE: Produced By Microsoft MimeOLE V4.72.2106.4 Importance: Normal List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 4234 Status: RO Hi, What's the right format to deny access to multiple hosts and permit the rest? I attempted to add a few limiting entries to our netperm-table file which would deny users access to a few websites. I found that without warning (or any configuration changes), http-gw starts denying traffic to other valid web sites intermittently. Here's what I'm using: http-gw: permit-hosts 192.168.22.* -dest !*.pager.yahoo.com -dest !*.icq.com -dest !login.oscar.aol.com -dest * It would seem that the majority of the time this works fine and it does deny traffic to the sites that are specified, but occasionally http-gw will deny traffic to other sites that is valid ("*") and should be allowed. Perhaps I'm not using the configuration correctly? I made a change to the code in hmain.c after having logged/debugged it quite a bit, and found that the hostmatch routine was somehow not correctly comparing "*" to "whateversites.com" for some unknown reason... Here's what I did that seems to have partially fixed it, at least the way my configuration was configured. It no longer seems to intermittently deny valid web requests. Warning: This may be a bogus fix, but it seemed to work, at least partially, in our case. /* - if(hostmatch(*xp, rem_server)) { - */ if(hostmatch(*xp, rem_server) || ( **xp == '*' || **xp == 0 )) { break; } >From a logical standpoint, when http-gw is comparing (-dest) destinations (*xp) to the site requested by the user (rem_server) - if the last item is a "*" (a "!*" is handled differently) it should be permitted to pass, and the hostmatch call is somewhat pointless? A permit all is a permit all, with matching or not, right? Maybe I missed something. If my -dest configuration/usage in netperm-table is incorrect, this may all be moot. However - having said all that, I've since noticed something else odd I've not seen before in the logging before, although it's recurrence is infrequent. Likely a result of the code change? Perhaps it's not the correct fix to the problem, but I'm still trying to figure out the problem at this point. Here are two examples of what I saw (multiple occurrences of the same message both times): Dec 18 07:56:11 proxybox http-gw[22445]: securityalert: possible spoof - DNS lookup for address 64.90.162.92 gives name bogusns.julianhaight.com but the reverse lookup is |^C^I ---- Dec 18 19:10:12 proxybox http-gw[21240]: securityalert: possible spoof - DNS lookup for address 64.77.49.6 gives name nikoncoolpix.com but the reverse lookup is |^C^I According to what I can see in "nama.c" this should return "lookup is unknown" but it's seems to be spitting back garbage for the reverse lookup (rev) because of a problem with the hostmatch routine? Anybody have any ideas? "rev" is found by "rev = inet_ntoa(*hp_addr);" here. if(!eq) { syslog(LLEV,"securityalert: possible spoof - DNS lookup for address %.20s gives name %.512s but the reverse lookup is %.20s", name,nam,rev); return(namatch(pat,"unknown")); } Perhaps someone can shed some light on all this and on http-gw and using -dest to block sites properly. TIA, Todd -----Original Message----- From: Rick Murphy [mailto:rmurphy@itm-inst.com] Sent: Tuesday, December 18, 2001 9:22 PM To: fwtk-users Subject: [fwtk-users] Re: Destination blocking & deny-destination At 04:52 PM 12/18/01 -0800, Michael St. Laurent wrote: >Is the deny-destination parameter documented anywhere? I can't seem to get >it to work. For example, I placed the following in the netperm-table file: > >Http-gw: deny-destination www.microsoft.com > >However, it didn't seem to make any difference. If someone would loan me a >clue I promise to return it. :-) That looks like a Gauntlet thing to me. The only fwtk equivalent is http-gw: permit-hosts -dest {!www.microsoft.com} -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Dec 19 18:55 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id SAA15549 Wed, 19 Dec 2001 18:55:29 -0500 (EST) From: JMadincea@cs.com Message-ID: Date: Wed, 19 Dec 2001 19:04:29 EST Subject: [fwtk-users] Re: Destination blocking & deny-destination To: "fwtk-users" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Mailer: CompuServe 2000 32-bit sub 113 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="US-ASCII" Content-Length: 1108 Status: RO Michael, you should be able to do a "man http-gw" to see a description of options and parameters. One thing that I noticed in your email is that you have a capital 'H' for http-gw (IE first character). Not sure if that was a type-o or not, but you could validate that. You should be able to add entries as follows: policy-http-gw: deny-destination abc.def.ghi.jkl policy http-gw: deny-destination etc... policy-http-gw: permit-destination * Hope this helps, John Madincea In a message dated 12/18/2001 7:55:54 PM Eastern Standard Time, mikes@hartwellcorp.com writes: << Is the deny-destination parameter documented anywhere? I can't seem to get it to work. For example, I placed the following in the netperm-table file: Http-gw: deny-destination www.microsoft.com However, it didn't seem to make any difference. If someone would loan me a clue I promise to return it. :-) -------------------- Michael St. Laurent >> --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Dec 19 19:27 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id TAA15712 Wed, 19 Dec 2001 19:27:01 -0500 (EST) X-Authentication-Warning: guardian.hartwellcorp.com: mail set sender to using -f Message-ID: From: "Michael St. Laurent" To: "fwtk-users" Subject: [fwtk-users] Re: Destination blocking & deny-destination Date: Wed, 19 Dec 2001 16:35:59 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1983 Status: RO Yeah, I've read the man pages many times but there is no mention of policy-http-gw or deny-destination anywhere in them. Also, Rick Murphy stated in another email to the list that FWTK does not have the deny-destination directive. He seemed to think it was a Gauntlet thing. Is this possible in your case? -------------------- Michael St. Laurent Hartwell Corporation [root@earth] root# rm -rf /bin/laden > -----Original Message----- > From: JMadincea@cs.com [mailto:JMadincea@cs.com] > Sent: Wednesday, December 19, 2001 4:04 PM > To: fwtk-users > Subject: [fwtk-users] Re: Destination blocking & deny-destination > > > Michael, > > you should be able to do a "man http-gw" to see a description > of options and > parameters. One thing that I noticed in your email is that > you have a capital > 'H' for http-gw (IE first character). Not sure if that was a > type-o or not, > but you > could validate that. > > You should be able to add entries as follows: > > policy-http-gw: deny-destination abc.def.ghi.jkl > policy http-gw: deny-destination etc... > policy-http-gw: permit-destination * > > Hope this helps, > > John Madincea > > > In a message dated 12/18/2001 7:55:54 PM Eastern Standard Time, > mikes@hartwellcorp.com writes: > > << Is the deny-destination parameter documented anywhere? I > can't seem to get > it to work. For example, I placed the following in the > netperm-table file: > > Http-gw: deny-destination www.microsoft.com > > However, it didn't seem to make any difference. If someone > would loan me a > clue I promise to return it. :-) > > -------------------- > Michael St. Laurent >> > > --- > You are currently subscribed to fwtk-users as: mikes@hartwellcorp.com > To unsubscribe send a blank email to > leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Dec 19 19:30 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id TAA15730 Wed, 19 Dec 2001 19:30:38 -0500 (EST) X-Authentication-Warning: guardian.hartwellcorp.com: mail set sender to using -f Message-ID: From: "Michael St. Laurent" To: "fwtk-users" Subject: [fwtk-users] Re: Destination blocking & deny-destination Date: Wed, 19 Dec 2001 16:38:24 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1756 Status: RO Sure enough, I tried out the entries you suggested but http-gw just ignored them. -------------------- Michael St. Laurent Hartwell Corporation [root@earth] root# rm -rf /bin/laden > -----Original Message----- > From: JMadincea@cs.com [mailto:JMadincea@cs.com] > Sent: Wednesday, December 19, 2001 4:04 PM > To: fwtk-users > Subject: [fwtk-users] Re: Destination blocking & deny-destination > > > Michael, > > you should be able to do a "man http-gw" to see a description > of options and > parameters. One thing that I noticed in your email is that > you have a capital > 'H' for http-gw (IE first character). Not sure if that was a > type-o or not, > but you > could validate that. > > You should be able to add entries as follows: > > policy-http-gw: deny-destination abc.def.ghi.jkl > policy http-gw: deny-destination etc... > policy-http-gw: permit-destination * > > Hope this helps, > > John Madincea > > > In a message dated 12/18/2001 7:55:54 PM Eastern Standard Time, > mikes@hartwellcorp.com writes: > > << Is the deny-destination parameter documented anywhere? I > can't seem to get > it to work. For example, I placed the following in the > netperm-table file: > > Http-gw: deny-destination www.microsoft.com > > However, it didn't seem to make any difference. If someone > would loan me a > clue I promise to return it. :-) > > -------------------- > Michael St. Laurent >> > > --- > You are currently subscribed to fwtk-users as: mikes@hartwellcorp.com > To unsubscribe send a blank email to > leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Dec 19 19:49 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id TAA15772 Wed, 19 Dec 2001 19:49:45 -0500 (EST) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Wed, 19 Dec 2001 19:56:19 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: Destination blocking & deny-destination In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 522 Status: RO At 07:04 PM 12/19/01 -0500, JMadincea@cs.com wrote: >You should be able to add entries as follows: > >policy-http-gw: deny-destination abc.def.ghi.jkl >policy http-gw: deny-destination etc... >policy-http-gw: permit-destination * Unfortunately, those will only work on a Gauntlet (4.x or later) system. The fwtk doesn't have the policy stuff. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Wed Dec 19 19:52 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id TAA15778 Wed, 19 Dec 2001 19:52:51 -0500 (EST) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Wed, 19 Dec 2001 19:52:39 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: Destination blocking & deny-destination In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1795 Status: RO At 03:12 PM 12/19/01 -0500, Todd Williams wrote: >Hi, > >What's the right format to deny access to multiple hosts and permit the >rest? > >I attempted to add a few limiting entries to our netperm-table file which >would deny users access to a few websites. I found that without warning (or >any configuration changes), http-gw starts denying traffic to other valid >web sites intermittently. Here's what I'm using: > >http-gw: permit-hosts 192.168.22.* -dest !*.pager.yahoo.com -dest >!*.icq.com -dest !login.oscar.aol.com -dest * You can simplify that: http-gw: permit-hosts 192.168.22.* -dest { !*.pager.yahoo.com, !*icq.com, !login.oscar.aol.com, * } >It would seem that the majority of the time this works fine and it does deny >traffic to the sites that are specified, but occasionally http-gw will deny >traffic to other sites that is valid ("*") and should be allowed. Perhaps >I'm not using the configuration correctly? > >I made a change to the code in hmain.c after having logged/debugged it quite >a bit, and found that the hostmatch routine was somehow not correctly >comparing "*" to "whateversites.com" for some unknown reason... Here's what >I did that seems to have partially fixed it, at least the way my >configuration was configured. It no longer seems to intermittently deny >valid web requests. Warning: This may be a bogus fix, but it seemed to >work, at least partially, in our case. That's something I haven't seen - the "*" pattern should always match. There are some problems that happen when the remote server's reverse lookup doesn't work - you may be seeing one of those cases. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Dec 20 12:52 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id MAA18132 Thu, 20 Dec 2001 12:52:22 -0500 (EST) X-Authentication-Warning: guardian.hartwellcorp.com: mail set sender to using -f Message-ID: From: "Michael St. Laurent" To: "fwtk-users" Subject: [fwtk-users] Webmin module for FWTK? Date: Thu, 20 Dec 2001 10:02:25 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 320 Status: RO Does anyone know if a Webmin module for FWTK has been done? -------------------- Michael St. Laurent Hartwell Corporation [root@earth] root# rm -rf /bin/laden --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Dec 20 13:06 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id NAA18191 Thu, 20 Dec 2001 13:06:15 -0500 (EST) X-Authentication-Warning: guardian.hartwellcorp.com: mail set sender to using -f Message-ID: From: "Michael St. Laurent" To: "fwtk-users" Subject: [fwtk-users] Re: Destination blocking & deny-destination Date: Thu, 20 Dec 2001 10:15:37 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2650.21) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 2533 Status: RO Can the -dest !*.block.this.com be put at the end of the deny unknown? For example: http-gw deny-hosts unknown -dest { !*.block.this.com, * } -------------------- Michael St. Laurent Hartwell Corporation [root@earth] root# rm -rf /bin/laden > -----Original Message----- > From: Rick Murphy [mailto:rmurphy@itm-inst.com] > Sent: Wednesday, December 19, 2001 4:53 PM > To: fwtk-users > Subject: [fwtk-users] Re: Destination blocking & deny-destination > > > At 03:12 PM 12/19/01 -0500, Todd Williams wrote: > >Hi, > > > >What's the right format to deny access to multiple hosts and > permit the > >rest? > > > >I attempted to add a few limiting entries to our > netperm-table file which > >would deny users access to a few websites. I found that > without warning (or > >any configuration changes), http-gw starts denying traffic > to other valid > >web sites intermittently. Here's what I'm using: > > > >http-gw: permit-hosts 192.168.22.* -dest !*.pager.yahoo.com -dest > >!*.icq.com -dest !login.oscar.aol.com -dest * > > You can simplify that: > http-gw: permit-hosts 192.168.22.* -dest { !*.pager.yahoo.com, !*icq.com, > !login.oscar.aol.com, * } > > > >It would seem that the majority of the time this works fine > and it does deny > >traffic to the sites that are specified, but occasionally > http-gw will deny > >traffic to other sites that is valid ("*") and should be > allowed. Perhaps > >I'm not using the configuration correctly? > > > >I made a change to the code in hmain.c after having > logged/debugged it quite > >a bit, and found that the hostmatch routine was somehow not correctly > >comparing "*" to "whateversites.com" for some unknown > reason... Here's what > >I did that seems to have partially fixed it, at least the way my > >configuration was configured. It no longer seems to > intermittently deny > >valid web requests. Warning: This may be a bogus fix, but > it seemed to > >work, at least partially, in our case. > > That's something I haven't seen - the "*" pattern should always match. > There are some problems that happen when the remote server's > reverse lookup > doesn't work - you may be seeing one of those cases. > -Rick > > > --- > You are currently subscribed to fwtk-users as: mikes@hartwellcorp.com > To unsubscribe send a blank email to > leave-fwtk-users-303A@listserv.nai.com > --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Dec 20 14:51 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id OAA18413 Thu, 20 Dec 2001 14:51:39 -0500 (EST) Date: Thu, 20 Dec 2001 15:00:32 -0500 (EST) From: bleary@ipass.net Message-Id: X-Authentication-Warning: jupiter.portbridge.com: web set sender to bleary@ipass.net using -f To: "fwtk-users" Reply-To: "fwtk-users" MIME-Version: 1.0 User-Agent: IMP/PHP3 Imap webMail Program 2.0.11 Sender: bleary@ipass.net X-Originating-IP: 56.0.96.17 Subject: [fwtk-users] Solution: logging src IP without DNS lookups List-Unsubscribe: Content-Type: multipart/mixed; boundary="-MOQ10088784319f16a50c713749e2b8e123215fbee423" Content-Length: 2818 Status: RO This message is in MIME format. ---MOQ10088784319f16a50c713749e2b8e123215fbee423 Content-Type: text/plain Content-Transfer-Encoding: 8bit Attached is solution I used. Brion Leary ----- Forwarded message from bleary@ipass.net ----- Date: Tue, 18 Dec 2001 11:35:13 -0500 (EST) From: bleary@ipass.net Reply-To: fwtk-users Subject: [fwtk-users] logging src IP without DNS lookups To: fwtk-users I have an application where I do not need to log the name of the source connection, only the IP address. I'll be using plug-gw. I figured I should ask before I hack - Does anyone have a patch to do this? Brion Leary ---MOQ10088784319f16a50c713749e2b8e123215fbee423 Content-Type: text/plain; name="nodns.txt" Content-Transfer-Encoding: 8bit Content-Disposition: inline; filename="nodns.txt" diff lib/pname.c lib/pname.c.REL 34,38d33 < < 2001 1218 Brion Leary < Sometimes I'm not paranoid, I just want to be fast. So ... < if (char*)lname == NULL, skip the DNS lookup and the reverse < lookup and just set (char*)sname to the ascii'd IP address. 88,90d82 < /* No lookups if lname is a null pointer */ < if (lname == NULL) return(0) ; < diff plug-gw/plug-gw.c plug-gw/plug-gw.c.REL 16,22d15 < * < * 2001 1218 Brion Leary < * if arg -n, do not do reverse name lookups < * arg -n goes after [ -daemon port ], before service. < * < * plug-gw [ -daemon port ] [ -n ] service < * 53,54d45 < static int rlookup = 1 ; < 81,86d71 < /* no reverse lookups? */ < if (ac && !strcmp(av[1], "-n")) { < rlookup = 0 ; < ac-- ; < av++ ; < } 112,122c97,99 < if (rlookup) { < if(peername(0,rhost,raddr,sizeof(rhost))) { < syslog(LLEV,"cannot get remote host: %m"); < exit(1); < } < } else { < if(peername(0,(char*)NULL,raddr,sizeof(rhost))) { < syslog(LLEV,"cannot get remote host: %m"); < exit(1); < } < rhost[0] = '\0' ; --- > if(peername(0,rhost,raddr,sizeof(rhost))) { > syslog(LLEV,"cannot get remote host: %m"); > exit(1); ---MOQ10088784319f16a50c713749e2b8e123215fbee423 Content-Type: text/plain; charset="us-ascii" Content-description: footer --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ---MOQ10088784319f16a50c713749e2b8e123215fbee423-- From bounce-fwtk-users-303@listserv.nai.com Sat Dec 22 23:00 EST 2001 Received: from listserv.nai.com (listserv.nai.com [161.69.213.6]) by lists.tislabs.com (8.9.1/8.9.1) with SMTP id XAA26997 Sat, 22 Dec 2001 23:00:53 -0500 (EST) Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Sat, 22 Dec 2001 23:03:06 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: Destination blocking & deny-destination In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1168 Status: RO At 10:15 AM 12/20/01 -0800, Michael St. Laurent wrote: >Can the -dest !*.block.this.com be put at the end of the deny unknown? For >example: > >http-gw deny-hosts unknown -dest { !*.block.this.com, * } That will work, but I'm not sure where it makes sense. "deny-hosts unknown" would apply *any* time the host that you're checking has no valid reverse DNS. Now, it's perfectly OK to have "deny-hosts unknown", the problem with what you have above is that the deny happens before destination checking is done. Once you deny a source host, you're done - destination checking is never invoked. One of the changes we did for Gauntlet was to remove all the source/destination checking from proxies and put it into library functions so that we knew that worked consistently; for fwtk, each proxy implements a separate "accept_setdest" function that handles the destination checking. That's some of the changes that lead to the different configuration lines we've discussed recently. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com