From bounce-fwtk-users-303@listserv.nai.com Tue Dec 3 10:56 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA13185 Tue, 3 Dec 2002 10:56:37 -0500 (EST) Received: by sentry.gw.tislabs.com; id KAA29179; Tue, 3 Dec 2002 10:58:30 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma029144; Tue, 3 Dec 02 10:58:21 -0500 Message-ID: From: Fritsch Jonathan D CONT PSNS To: "fwtk-users" Subject: [fwtk-users] telnet Date: Tue, 3 Dec 2002 07:57:36 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-N-Score: scored -400 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 355 Status: RO Does any one have a working inetd.conf on a Solaris box? I'm trying to fix my proxy telnet on my firewall. Jonathan D Fritsch SRA Int. - PSNS IT Configuration Mgmt. Code 1233.24 (360) 476-0019 --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 3 11:46 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA13390 Tue, 3 Dec 2002 11:46:12 -0500 (EST) Received: by sentry.gw.tislabs.com; id LAA02055; Tue, 3 Dec 2002 11:48:05 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma002013; Tue, 3 Dec 02 11:47:46 -0500 Message-ID: From: Fritsch Jonathan D CONT PSNS To: "fwtk-users" Cc: fwtk-users Subject: [fwtk-users] RE: telnet Date: Tue, 3 Dec 2002 08:47:23 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-N-Score: scored -400 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 1371 Status: RO I ended up putting telnet stream tcp nowait root /usr/local/etc/tn-gw tn-gw in my inetd.conf It will come to a point where I'm to 'telnet localhost' to proxy into the firewall. BUT I will get a connection refused. And I did enter what you suggested into my netperm-table -----Original Message----- From: Rude Yak [mailto:rudeyak@yahoo.com] Sent: Tuesday, December 03, 2002 8:13 AM To: fritschj@psns.navy.mil Subject: re: [fwtk-users] telnet Jonathan - Try something like this: --inetd.conf: telnet stream tcp nowait root /usr/local/etc/netacl netacl tn-gw (make sure this is the only line that starts with "telnet" and then kill -HUP the process ID of inetd) --netperm-table: netacl-telnetd: permit-hosts 10.1.1.* -exec /usr/local/etc/tn-gw tn-gw: denial-msg /usr/local/etc/tn-deny.txt tn-gw: welcome-msg /usr/local/etc/tn-welcome.txt tn-gw: help-msg /usr/local/etc/tn-help.txt tn-gw: timeout 3600 tn-gw: permit-hosts 10.1.1.* -passok -dest 10.2.2.2 tn-gw: permit-hosts 10.1.1.* -passok -dest 10.2.2.4 As usual, your mileage may vary. Good luck. __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Dec 5 17:14 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id RAA22623 Thu, 5 Dec 2002 17:14:57 -0500 (EST) Received: by sentry.gw.tislabs.com; id RAA05503; Thu, 5 Dec 2002 17:16:55 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma005495; Thu, 5 Dec 02 17:16:28 -0500 Message-ID: From: Fritsch Jonathan D CONT PSNS To: "fwtk-users" Subject: [fwtk-users] ftp Date: Thu, 5 Dec 2002 14:15:50 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-N-Score: scored -400 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 324 Status: RO What is need in the netperm-table to be able to ftp though my web browser? Jonathan D Fritsch SRA Int. - PSNS IT Configuration Mgmt. Code 1233.24 (360) 476-0019 --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Dec 5 19:30 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA23078 Thu, 5 Dec 2002 19:30:03 -0500 (EST) Received: by sentry.gw.tislabs.com; id TAA10646; Thu, 5 Dec 2002 19:32:00 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma010640; Thu, 5 Dec 02 19:31:35 -0500 Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Thu, 05 Dec 2002 19:30:12 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: ftp In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 443 Status: RO At 02:15 PM 12/5/02 -0800, Fritsch Jonathan D CONT PSNS wrote: >What is need in the netperm-table to be able to ftp though my web browser? Browser ftp access uses the http proxy. Make sure your web browser has a FTP proxy set; that will let ftp work if http works. -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Thu Dec 5 19:45 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA23112 Thu, 5 Dec 2002 19:45:17 -0500 (EST) Received: by sentry.gw.tislabs.com; id TAA11170; Thu, 5 Dec 2002 19:47:14 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma011149; Thu, 5 Dec 02 19:46:28 -0500 Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Thu, 05 Dec 2002 19:36:43 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] SMAP Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 2571 Status: RO [I'm redirecting this for Chris Hutchinson - his messages appear to not be making it to the list. Please reply to him at . -Rick Not sure if this went through the first time. I am having two new problems with smap. Both cause the following error: Nov 29 11:13:52 smtp4 smap[2624]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2625]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2627]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2620]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2629]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2621]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2630]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2627]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2636]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:54 smtp4 smap[2629]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV (segmentation error), aborting It only appears to happen from internal connections, specifically from Microsoft Exchange. The session shown below also causes a SIGSEGV error. Note the MAIL FROM: <> line. I'm guessing an empty from line is not valid?? This may be normal behaviour for smap for outbound traffic however the error doesn't happen for inbound. polar:/home/admin% telnet cor_smtp4 25 Trying 192.168.201.244... Connected to smtp4.bws.com. Escape character is '^]'. 220 smtp4 SMTP/smap Ready. EHLO diamond.bri.bws.com 500 Command unrecognized HELO diamond.bri.bws.com 250 (diamond.bri.bws.com) pleased to meet you. MAIL FROM:<> 250 <>... Sender OK RCPT TO: 250 OK DATA 354 Enter mail, end with "." on a line by itself Connection closed by foreign host. polar:/home/admin% As a result of this error my smap spool directory is quickly filling with empty sma?????? files. Any thoughts? Chris --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Fri Dec 6 10:13 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id KAA24583 Fri, 6 Dec 2002 10:13:10 -0500 (EST) Received: by sentry.gw.tislabs.com; id KAA08696; Fri, 6 Dec 2002 10:15:08 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma008687; Fri, 6 Dec 02 10:14:29 -0500 Message-ID: From: Fritsch Jonathan D CONT PSNS To: "fwtk-users" Subject: [fwtk-users] Re: ftp Date: Fri, 6 Dec 2002 07:13:52 -0800 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) X-N-Score: scored -400 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="iso-8859-1" Content-Length: 814 Status: RO I have a ftp browers proxy set same as my http proxy. -----Original Message----- From: Rick Murphy [mailto:rmurphy@itm-inst.com] Sent: Thursday, December 05, 2002 4:30 PM To: fwtk-users Subject: [fwtk-users] Re: ftp At 02:15 PM 12/5/02 -0800, Fritsch Jonathan D CONT PSNS wrote: >What is need in the netperm-table to be able to ftp though my web browser? Browser ftp access uses the http proxy. Make sure your web browser has a FTP proxy set; that will let ftp work if http works. -Rick --- You are currently subscribed to fwtk-users as: fritschj@PSNS.navy.mil To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 11:12 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA02753 Mon, 9 Dec 2002 11:12:30 -0500 (EST) Received: by sentry.gw.tislabs.com; id LAA20654; Mon, 9 Dec 2002 11:14:32 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma020641; Mon, 9 Dec 02 11:14:04 -0500 From: "Juan Torres" To: "fwtk-users" Subject: [fwtk-users] Problems with the netperm-table configuration Date: Fri, 6 Dec 2002 02:35:18 +0100 Message-ID: MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.3416 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: multipart/alternative; boundary="----=_NextPart_000_0001_01C29CD0.2CC19550" Content-Length: 5053 This is a multi-part message in MIME format. ------=_NextPart_000_0001_01C29CD0.2CC19550 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hello, I'm trying to configure the TIS FWTK, and I have read all the documentation, but the netperm-table rules don't work as I expect. For example, the permit-hosts rule is to decide from which addresses you can connect to, but it works as if it was to decide the destination addresses, and options as -dest or -dest ! doesn't do anything, so I can't deny any destination. I'm using the SuSE Linux 8.0, and now I'm working only with one computer, so I always try to connect from the server where the fwtk is installed (I don't know if the problem could be there) Please, It would very important for me if anybody could help me, this is my project to finish my University studies (I have to install the fwtk and then, study the source code to understand how it works) :-) Thank you very much Torres. --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------=_NextPart_000_0001_01C29CD0.2CC19550 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Problems with the netperm-table configuration

        Hello,

        I’m trying to configure = the TIS FWTK, and I have read all the documentation, but = the netperm-table rules = don’t work as I expect. For example, the permit-hosts <IP = address> = rule is to decide from which addresses you can connect to, but it works = as if it was to decide the destination addresses, and options = as –dest <IP = address> = or –dest !<IP address> doesn’t do anything, so I can’t = deny any destination.

I’m using the SuSE Linux 8.0, and now I’m = working only with one computer, so I always try to connect from the = server where the fwtk is installed (I don’t know if the problem = could be there)

Please, It would very important for me if anybody could = help me, this is my project to finish my University studies (I have to = install the fwtk and then, study the source code to understand how it = works) :-)

Thank you very much

    Torres.

---
You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com
To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------=_NextPart_000_0001_01C29CD0.2CC19550-- From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 11:15 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA02791 Mon, 9 Dec 2002 11:15:32 -0500 (EST) Received: by sentry.gw.tislabs.com; id LAA20750; Mon, 9 Dec 2002 11:17:34 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma020717; Mon, 9 Dec 02 11:17:15 -0500 From: "Juan Torres" To: "fwtk-users" Subject: [fwtk-users] Problems with the netperm-table configuration Date: Tue, 3 Dec 2002 12:29:50 +0100 Message-ID: MIME-Version: 1.0 X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.3416 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: multipart/alternative; boundary="----=_NextPart_000_0007_01C29AC7.AFC3CF50" Content-Length: 11263 This is a multi-part message in MIME format. ------=_NextPart_000_0007_01C29AC7.AFC3CF50 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hello, I'm trying to configure the TIS FWTK, and I have read all the documentation, but the netperm-table rules don't work as I expect. For example, the permit-hosts rule is to decide from which addresses you can connect to, but it works as if it was to decide the destination addresses, and options as -dest or -dest ! doesn't do anything, so I can't deny any destination. I'm using the SuSE Linux 8.0, and now I'm working only with one computer, so I always try to connect from the server where the fwtk is installed (I don't know if the problem could be there) Please, It would very important for me if anybody could help me, this is my project to finish my University studies (I have to install the fwtk and then, study the source code to understand how it works) :-) Thank you very much Torres. --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------=_NextPart_000_0007_01C29AC7.AFC3CF50 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Problems with the netperm-table configuration

        Hello,

        I’m = trying to configure = the TIS FWTK, and I have read all the documentation, but = the netperm-table rules don’t = work as I expect. For = example, = the permit-hosts <IP address> rule is to decide from which addresses you can connect to, but it works as = if it was = to decide the destination addresses, = and options as –dest <IP = address> = or –dest !<IP = address> doesn’t = do anything, = so I can’t deny any destination.

I’m = using the SuSE Linux 8.0, and now I’m working only with one computer, so = I always try to connect from the server where the fwtk is = installed (I = don’t know if the problem could be = there)

Please, It would very important for me if anybody could = help me, this is my project = to finish my University studies (I have to install the fwtk and = then, = study the source code to understand how it works) :-)

Thank you very much

    Torres.

---
You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com
To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------=_NextPart_000_0007_01C29AC7.AFC3CF50-- From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 11:16 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA02866 Mon, 9 Dec 2002 11:16:32 -0500 (EST) Received: by sentry.gw.tislabs.com; id LAA20779; Mon, 9 Dec 2002 11:18:34 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma020760; Mon, 9 Dec 02 11:17:46 -0500 Message-ID: From: "Behm, Jeffrey L." To: "fwtk-users" Subject: [fwtk-users] RE: telnet Date: Tue, 3 Dec 2002 10:15:13 -0600 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain Content-Length: 6358 > Does any one have a working inetd.conf on a Solaris box? I'm > trying to fix > my proxy telnet on my firewall. Since there are multiple admins on this box, some changes may have been made, but hey, telnet works. Your mileage may vary. Note that this is not a system I would expose to the Internet, with the default settings below in inetd.conf. --------------------------------------------------------------- Jeff Behm Opinions expressed are solely my own and not of any company and usually contain very little, if any, valuable information. #ident "@(#)inetd.conf 1.27 96/09/24 SMI" /* SVr4.0 1.5 */ # # # # Configuration file for inetd(1M). See inetd.conf(4). # # To re-configure the running inetd process, edit this file, then # send the inetd process a SIGHUP. # # Syntax for socket-based Internet services: # # # Syntax for TLI-based Internet services: # # tli # # Ftp and telnet are standard Internet services. # ftp stream tcp nowait root /usr/sbin/in.ftpd in.ftpd telnet stream tcp nowait root /usr/sbin/in.telnetd in.telnetd # # Tnamed serves the obsolete IEN-116 name server protocol. # name dgram udp wait root /usr/sbin/in.tnamed in.tnamed # # Shell, login, exec, comsat and talk are BSD protocols. # shell stream tcp nowait root /usr/sbin/in.rshd in.rshd login stream tcp nowait root /usr/sbin/in.rlogind in.rlogind exec stream tcp nowait root /usr/sbin/in.rexecd in.rexecd comsat dgram udp wait root /usr/sbin/in.comsat in.comsat talk dgram udp wait root /usr/sbin/in.talkd in.talkd # # Must run as root (to read /etc/shadow); "-n" turns off logging in utmp/wtmp. # uucp stream tcp nowait root /usr/sbin/in.uucpd in.uucpd # # Tftp service is provided primarily for booting. Most sites run this # only on machines acting as "boot servers." # #tftp dgram udp wait root /usr/sbin/in.tftpd in.tftpd -s /tftpboot # # Finger, systat and netstat give out user information which may be # valuable to potential "system crackers." Many sites choose to disable # some or all of these services to improve security. # finger stream tcp nowait nobody /usr/sbin/in.fingerd in.fingerd #systat stream tcp nowait root /usr/bin/ps ps -ef #netstat stream tcp nowait root /usr/bin/netstat netstat -f inet # # Time service is used for clock synchronization. # time stream tcp nowait root internal time dgram udp wait root internal # # Echo, discard, daytime, and chargen are used primarily for testing. # echo stream tcp nowait root internal echo dgram udp wait root internal discard stream tcp nowait root internal discard dgram udp wait root internal daytime stream tcp nowait root internal daytime dgram udp wait root internal chargen stream tcp nowait root internal chargen dgram udp wait root internal # # # RPC services syntax: # / rpc/ \ # # # can be either "tli" or "stream" or "dgram". # For "stream" and "dgram" assume that the endpoint is a socket descriptor. # can be either a nettype or a netid or a "*". The value is # first treated as a nettype. If it is not a valid nettype then it is # treated as a netid. The "*" is a short-hand way of saying all the # transports supported by this system, ie. it equates to the "visible" # nettype. The syntax for is: # *||{[,]} # For example: # dummy/1 tli rpc/circuit_v,udp wait root /tmp/test_svc test_svc # # Solstice system and network administration class agent server 100232/10 tli rpc/udp wait root /usr/sbin/sadmind sadmind # # Rquotad supports UFS disk quotas for NFS clients # rquotad/1 tli rpc/datagram_v wait root /usr/lib/nfs/rquotad rquotad # # The rusers service gives out user information. Sites concerned # with security may choose to disable it. # rusersd/2-3 tli rpc/datagram_v,circuit_v wait root /usr/lib/netsvc/rusers/rpc.rusersd rpc.rusersd # # The spray server is used primarily for testing. # sprayd/1 tli rpc/datagram_v wait root /usr/lib/netsvc/spray/rpc.sprayd rpc.sprayd # # The rwall server allows others to post messages to users on this machine. # walld/1 tli rpc/datagram_v wait root /usr/lib/netsvc/rwall/rpc.rwalld rpc.rwalld # # Rstatd is used by programs such as perfmeter. # rstatd/2-4 tli rpc/datagram_v wait root /usr/lib/netsvc/rstat/rpc.rstatd rpc.rstatd # # The rexd server provides only minimal authentication and is often not run # #rexd/1 tli rpc/tcp wait root /usr/sbin/rpc.rexd rpc.rexd # # rpc.cmsd is a data base daemon which manages calendar data backed # by files in /var/spool/calendar # # # Sun ToolTalk Database Server # # # UFS-aware service daemon # #ufsd/1 tli rpc/* wait root /usr/lib/fs/ufs/ufsd ufsd -p # # Sun KCMS Profile Server # 100221/1 tli rpc/tcp wait root /usr/openwin/bin/kcms_server kcms_server # # Sun Font Server # fs stream tcp wait nobody /usr/openwin/lib/fs.auto fs # # Print Protocol Adaptor - BSD listener # printer stream tcp nowait root /usr/lib/print/in.lpd in.lpd # # CacheFS Daemon # 100235/1 tli rpc/tcp wait root /usr/lib/fs/cachefs/cachefsd cachefsd # # Kerbd Daemon # kerbd/4 tli rpc/ticlts wait root /usr/sbin/kerbd kerbd dtspc stream tcp nowait root /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd xaudio stream tcp wait root /usr/openwin/bin/Xaserver Xaserver -noauth -inetd 100068/2-5 dgram rpc/udp wait root /usr/dt/bin/rpc.cmsd rpc.cmsd 100083/1 tli rpc/tcp wait root /usr/dt/bin/rpc.ttdbserverd /usr/dt/bin/rpc.ttdbserverd --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 11:16 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA02874 Mon, 9 Dec 2002 11:16:35 -0500 (EST) Received: by sentry.gw.tislabs.com; id LAA20812; Mon, 9 Dec 2002 11:18:37 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xmaa20760; Mon, 9 Dec 02 11:18:16 -0500 X-Authentication-Warning: cor_smtp: smap set sender to using -f Message-ID: From: "Hutchison, Chris" To: "fwtk-users" Subject: [fwtk-users] SMAP Date: Tue, 3 Dec 2002 16:36:43 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C29B14.12AB90C0" Content-Length: 6388 This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C29B14.12AB90C0 Content-Type: text/plain Not sure if this went through the first time. I am having two new problems with smap. Both cause the following error: Nov 29 11:13:52 smtp4 smap[2624]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2625]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2627]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2620]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2629]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2621]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2630]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2627]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2636]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:54 smtp4 smap[2629]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV (segmentation error), aborting It only appears to happen from internal connections, specifically from Microsoft Exchange. The session shown below also causes a SIGSEGV error. Note the MAIL FROM: <> line. I'm guessing an empty from line is not valid?? This may be normal behaviour for smap for outbound traffic however the error doesn't happen for inbound. polar:/home/admin% telnet cor_smtp4 25 Trying 192.168.201.244... Connected to smtp4.bws.com. Escape character is '^]'. 220 smtp4 SMTP/smap Ready. EHLO diamond.bri.bws.com 500 Command unrecognized HELO diamond.bri.bws.com 250 (diamond.bri.bws.com) pleased to meet you. MAIL FROM:<> 250 <>... Sender OK RCPT TO: 250 OK DATA 354 Enter mail, end with "." on a line by itself Connection closed by foreign host. polar:/home/admin% As a result of this error my smap spool directory is quickly filling with empty sma?????? files. Any thoughts? Chris --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------_=_NextPart_001_01C29B14.12AB90C0 Content-Type: text/html Content-Transfer-Encoding: quoted-printable SMAP

Not sure if this went through the first time.

I am having two new problems with smap.  Both = cause the following error:

Nov 29 11:13:52 smtp4 smap[2624]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2625]: = connect host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 = smap[2627]: connect host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:52 = smtp4 smap[2620]: received SIGSEGV (segmentation error), aborting =

Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:53 smtp4 smap[2629]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2621]: = received SIGSEGV (segmentation error), aborting

Nov 29 11:13:53 smtp4 smap[2630]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2627]: = received SIGSEGV (segmentation error), aborting

Nov 29 11:13:54 smtp4 smap[2636]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:54 smtp4 smap[2629]: = received SIGSEGV (segmentation error), aborting

Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV = (segmentation error), aborting


It only appears to happen from internal connections, = specifically from Microsoft Exchange. The session shown below also = causes a SIGSEGV error.  Note the MAIL FROM: <>  line. = I'm guessing an empty from line is not valid?? This may be normal = behaviour for smap for outbound traffic however the error doesn't = happen for inbound.


polar:/home/admin% telnet cor_smtp4 25
Trying 192.168.201.244...
Connected to smtp4.bws.com.
Escape character is '^]'.
220 smtp4 SMTP/smap Ready.
EHLO diamond.bri.bws.com
500 Command unrecognized
HELO diamond.bri.bws.com
250 (diamond.bri.bws.com) pleased to meet = you.
MAIL FROM:<>
250 <>... Sender OK
RCPT TO:<chis86@yahoo.com>
250 <chis86@yahoo.com> OK
DATA
354 Enter mail, end with "." on a line by = itself
Connection closed by foreign host.
polar:/home/admin%


As a result of this error my smap spool directory is = quickly filling with empty sma?????? files. Any thoughts?

Chris

---
You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com
To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------_=_NextPart_001_01C29B14.12AB90C0-- From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 11:16 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id LAA02868 Mon, 9 Dec 2002 11:16:32 -0500 (EST) Received: by sentry.gw.tislabs.com; id LAA20785; Mon, 9 Dec 2002 11:18:34 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xmaa20717; Mon, 9 Dec 02 11:17:46 -0500 Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Thu, 05 Dec 2002 18:34:39 -0500 To: "fwtk-users" From: "Hutchison, Chris" (by way of Rick Murphy ) Subject: [fwtk-users] SMAP Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 2498 [I'm redirecting this for Chris Hutchinson - his messages appear to not be making it to the list.] Not sure if this went through the first time. I am having two new problems with smap. Both cause the following error: Nov 29 11:13:52 smtp4 smap[2624]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2625]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2627]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2620]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2629]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2621]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2630]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2627]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2636]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:54 smtp4 smap[2629]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV (segmentation error), aborting It only appears to happen from internal connections, specifically from Microsoft Exchange. The session shown below also causes a SIGSEGV error. Note the MAIL FROM: <> line. I'm guessing an empty from line is not valid?? This may be normal behaviour for smap for outbound traffic however the error doesn't happen for inbound. polar:/home/admin% telnet cor_smtp4 25 Trying 192.168.201.244... Connected to smtp4.bws.com. Escape character is '^]'. 220 smtp4 SMTP/smap Ready. EHLO diamond.bri.bws.com 500 Command unrecognized HELO diamond.bri.bws.com 250 (diamond.bri.bws.com) pleased to meet you. MAIL FROM:<> 250 <>... Sender OK RCPT TO: 250 OK DATA 354 Enter mail, end with "." on a line by itself Connection closed by foreign host. polar:/home/admin% As a result of this error my smap spool directory is quickly filling with empty sma?????? files. Any thoughts? Chris --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 14:51 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA05836 Mon, 9 Dec 2002 14:51:00 -0500 (EST) Received: by sentry.gw.tislabs.com; id OAA03243; Mon, 9 Dec 2002 14:53:04 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xmaa03203; Mon, 9 Dec 02 14:52:49 -0500 X-Authentication-Warning: cor_smtp: smap set sender to using -f Message-ID: From: "Hutchison, Chris" To: "fwtk-users" Subject: [fwtk-users] SMAP Date: Mon, 2 Dec 2002 08:52:47 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C29A0A.18A4A8F0" Content-Length: 6388 This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C29A0A.18A4A8F0 Content-Type: text/plain Not sure if this went through the first time. I am having two new problems with smap. Both cause the following error: Nov 29 11:13:52 smtp4 smap[2624]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2625]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2627]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2620]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2629]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2621]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2630]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2627]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2636]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:54 smtp4 smap[2629]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV (segmentation error), aborting It only appears to happen from internal connections, specifically from Microsoft Exchange. The session shown below also causes a SIGSEGV error. Note the MAIL FROM: <> line. I'm guessing an empty from line is not valid?? This may be normal behaviour for smap for outbound traffic however the error doesn't happen for inbound. polar:/home/admin% telnet cor_smtp4 25 Trying 192.168.201.244... Connected to smtp4.bws.com. Escape character is '^]'. 220 smtp4 SMTP/smap Ready. EHLO diamond.bri.bws.com 500 Command unrecognized HELO diamond.bri.bws.com 250 (diamond.bri.bws.com) pleased to meet you. MAIL FROM:<> 250 <>... Sender OK RCPT TO: 250 OK DATA 354 Enter mail, end with "." on a line by itself Connection closed by foreign host. polar:/home/admin% As a result of this error my smap spool directory is quickly filling with empty sma?????? files. Any thoughts? Chris --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------_=_NextPart_001_01C29A0A.18A4A8F0 Content-Type: text/html Content-Transfer-Encoding: quoted-printable SMAP

Not sure if this went through the first time.

I am having two new problems with smap.  Both = cause the following error:

Nov 29 11:13:52 smtp4 smap[2624]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2625]: = connect host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 = smap[2627]: connect host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:52 = smtp4 smap[2620]: received SIGSEGV (segmentation error), aborting =

Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:53 smtp4 smap[2629]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2621]: = received SIGSEGV (segmentation error), aborting

Nov 29 11:13:53 smtp4 smap[2630]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2627]: = received SIGSEGV (segmentation error), aborting

Nov 29 11:13:54 smtp4 smap[2636]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:54 smtp4 smap[2629]: = received SIGSEGV (segmentation error), aborting

Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV = (segmentation error), aborting


It only appears to happen from internal connections, = specifically from Microsoft Exchange. The session shown below also = causes a SIGSEGV error.  Note the MAIL FROM: <>  line. = I'm guessing an empty from line is not valid?? This may be normal = behaviour for smap for outbound traffic however the error doesn't = happen for inbound.


polar:/home/admin% telnet cor_smtp4 25
Trying 192.168.201.244...
Connected to smtp4.bws.com.
Escape character is '^]'.
220 smtp4 SMTP/smap Ready.
EHLO diamond.bri.bws.com
500 Command unrecognized
HELO diamond.bri.bws.com
250 (diamond.bri.bws.com) pleased to meet = you.
MAIL FROM:<>
250 <>... Sender OK
RCPT TO:<chis86@yahoo.com>
250 <chis86@yahoo.com> OK
DATA
354 Enter mail, end with "." on a line by = itself
Connection closed by foreign host.
polar:/home/admin%


As a result of this error my smap spool directory is = quickly filling with empty sma?????? files. Any thoughts?

Chris

---
You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com
To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------_=_NextPart_001_01C29A0A.18A4A8F0-- From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 14:50 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id OAA05815 Mon, 9 Dec 2002 14:50:58 -0500 (EST) Received: by sentry.gw.tislabs.com; id OAA03212; Mon, 9 Dec 2002 14:53:02 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma003203; Mon, 9 Dec 02 14:52:28 -0500 From: "Ernesto A. Zapata Icart" To: "fwtk-users" Subject: [fwtk-users] Can't download Date: Sat, 30 Nov 2002 07:02:09 -0300 Message-ID: MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 Importance: Normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="US-ASCII" Content-Length: 488 Friends: I've got a problem, I just can't download the toolkit. I tried many times. I accepted the terms of TIS, and send the mail. I've got the "hidden" directory, but I can't download. I use W2000 at home and I don't have idea of as configuring reverse DNS. I appreciated any help Ernesto --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 16:43 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA07271 Mon, 9 Dec 2002 16:43:15 -0500 (EST) Received: by sentry.gw.tislabs.com; id QAA09483; Mon, 9 Dec 2002 16:45:19 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma009354; Mon, 9 Dec 02 16:44:12 -0500 Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Mon, 09 Dec 2002 16:42:26 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: ftp In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 549 At 07:13 AM 12/6/02 -0800, Fritsch Jonathan D CONT PSNS wrote: >I have a ftp browers proxy set same as my http proxy. If that's the case, web browser access to ftp sites uses the http-gw and the http-gw destination rules. "http-gw: permit-hosts 1.2.3.*" should suffice for http-gw rules. What problem are you having with FTP sites? What errors are logged by the proxy? -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 16:52 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id QAA07389 Mon, 9 Dec 2002 16:52:49 -0500 (EST) Received: by sentry.gw.tislabs.com; id QAA10303; Mon, 9 Dec 2002 16:54:53 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma010260; Mon, 9 Dec 02 16:54:08 -0500 Message-Id: X-Sender: rmurphy@mail.itm-inst.com X-Mailer: QUALCOMM Windows Eudora Version 5.2.0.9 Date: Mon, 09 Dec 2002 16:44:56 -0500 To: "fwtk-users" From: Rick Murphy Subject: [fwtk-users] Re: Problems with the netperm-table configuration In-Reply-To: Mime-Version: 1.0 List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset="us-ascii"; format=flowed Content-Length: 1067 At 02:35 AM 12/6/02 +0100, Juan Torres wrote: > Hello, > > IR17;m trying to configure the TIS FWTK, and I have read all > the documentation, but the netperm-table rules dont work as I expect. > For example, the permit-hosts rule is to decide from > which addresses you can connect to, but it works as if it was to > decide the destination addresses, and options as R11;dest address> or R11;dest ! doesnt do anything, so I cant deny > any destination. First, fix your e-mail client. It's apparently some brain-dead Microsoft thing that encodes characters strangely - I don't know what "R11;dest " means. Then, what proxy are you trying to configure? Is it correct to assume that you're trying to set up destination blocking? Something like the following should work: ftp-gw: permit-hosts -dest { 1.2.3.4, !5.6.7.8 } -Rick --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 19:04 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA07943 Mon, 9 Dec 2002 19:04:58 -0500 (EST) Received: by sentry.gw.tislabs.com; id TAA15194; Mon, 9 Dec 2002 19:07:02 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma015168; Mon, 9 Dec 02 19:06:02 -0500 Date: Mon, 9 Dec 2002 19:05:34 -0500 From: Joseph S D Yao To: "fwtk-users" Subject: [fwtk-users] RE: telnet Message-ID: Mail-Followup-To: fwtk-users Mime-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from BehmJL@bvsg.com on Tue, Dec 03, 2002 at 10:15:13AM -0600 X-Virus-Scanned: at The OSIS Center by AMaViS-perl11-milter (http://amavis.org/) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=us-ascii Content-Length: 1216 On Tue, Dec 03, 2002 at 10:15:13AM -0600, Behm, Jeffrey L. wrote: > > Does any one have a working inetd.conf on a Solaris box? I'm > > trying to fix > > my proxy telnet on my firewall. > > > > Since there are multiple admins on this box, some changes may have been > made, > but hey, telnet works. Your mileage may vary. > Note that this is not a system I would expose to the Internet, with the > default > settings below in inetd.conf. First thing you have to do with 'fwtk' is make sure that everything that was turned on in that "inetd.conf" example is turned OFF, by removing it from the file or commenting it out. Then you make sure that the tn-gw is in the file, IIRC. And make sure that 'inetd' has been made aware of the changes. -- Joe Yao jsdy@center.osis.gov - Joseph S. D. Yao OSIS Center Systems Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of OSIS Center policies. --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Mon Dec 9 19:07 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id TAA07947 Mon, 9 Dec 2002 19:07:58 -0500 (EST) Received: by sentry.gw.tislabs.com; id TAA15241; Mon, 9 Dec 2002 19:10:02 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma015228; Mon, 9 Dec 02 19:09:06 -0500 Message-ID: Date: Mon, 9 Dec 2002 19:06:43 -0500 From: Joseph S D Yao To: "fwtk-users" Subject: [fwtk-users] Re: SMAP Mail-Followup-To: fwtk-users Mime-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from Chris.Hutchison@TheBeerStore.ca on Thu, Dec 05, 2002 at 06:34:39PM -0500 X-Virus-Scanned: at The OSIS Center by AMaViS-perl11-milter (http://amavis.org/) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: text/plain; charset=us-ascii Content-Length: 874 On Thu, Dec 05, 2002 at 06:34:39PM -0500, Hutchison, Chris wrote: > [I'm redirecting this for Chris Hutchinson - his messages appear to not > be making it to the list.] > > Not sure if this went through the first time. > > I am having two new problems with smap. Both cause the following error: No, I've seen this a time or two. I don't have an answer without more work than I have time to put into it right now. But I'm sure that some enterprising soul can check it out. -- Joe Yao jsdy@center.osis.gov - Joseph S. D. Yao OSIS Center Systems Support EMT-B ----------------------------------------------------------------------- This message is not an official statement of OSIS Center policies. --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com From bounce-fwtk-users-303@listserv.nai.com Tue Dec 10 04:23 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id EAA09380 Tue, 10 Dec 2002 04:23:11 -0500 (EST) Received: by sentry.gw.tislabs.com; id EAA29170; Tue, 10 Dec 2002 04:25:14 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma029157; Tue, 10 Dec 02 04:24:17 -0500 Message-ID: From: "Randal, Phil" To: "fwtk-users" Subject: [fwtk-users] RE: SMAP Date: Tue, 10 Dec 2002 09:17:59 -0000 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2656.59) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C2A02D.08210770" Content-Length: 8346 This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C2A02D.08210770 Content-Type: text/plain; charset="iso-8859-1" The "MAIL FROM: <>" line is a delivery notification message, which must be accepted by all mailers (RFC2821 section 6.1, if I recall correctly). Cheers, Phil --------------------------------------------- Phil Randal Network Engineer Herefordshire Council Hereford, UK -----Original Message----- From: Hutchison, Chris [mailto:Chris.Hutchison@TheBeerStore.ca] Sent: 02 December 2002 13:53 To: fwtk-users Subject: [fwtk-users] SMAP Not sure if this went through the first time. I am having two new problems with smap. Both cause the following error: Nov 29 11:13:52 smtp4 smap[2624]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2625]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2627]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2620]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2629]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2621]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2630]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2627]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2636]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:54 smtp4 smap[2629]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV (segmentation error), aborting It only appears to happen from internal connections, specifically from Microsoft Exchange. The session shown below also causes a SIGSEGV error. Note the MAIL FROM: <> line. I'm guessing an empty from line is not valid?? This may be normal behaviour for smap for outbound traffic however the error doesn't happen for inbound. polar:/home/admin% telnet cor_smtp4 25 Trying 192.168.201.244... Connected to smtp4.bws.com. Escape character is '^]'. 220 smtp4 SMTP/smap Ready. EHLO diamond.bri.bws.com 500 Command unrecognized HELO diamond.bri.bws.com 250 (diamond.bri.bws.com) pleased to meet you. MAIL FROM:<> 250 <>... Sender OK RCPT TO: 250 OK DATA 354 Enter mail, end with "." on a line by itself Connection closed by foreign host. polar:/home/admin% As a result of this error my smap spool directory is quickly filling with empty sma?????? files. Any thoughts? Chris --- You are currently subscribed to fwtk-users as: prandal@herefordshire.gov.uk To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------_=_NextPart_001_01C2A02D.08210770 Content-Type: text/html; charset="iso-8859-1" SMAP
The "MAIL FROM: <>" line is a delivery notification message, which must be accepted by all mailers (RFC2821 section 6.1, if I recall correctly).
 
Cheers,
 
Phil
---------------------------------------------
Phil Randal
Network Engineer
Herefordshire Council
Hereford, UK
-----Original Message-----
From: Hutchison, Chris [mailto:Chris.Hutchison@TheBeerStore.ca]
Sent: 02 December 2002 13:53
To: fwtk-users
Subject: [fwtk-users] SMAP

Not sure if this went through the first time.

I am having two new problems with smap.  Both cause the following error:

Nov 29 11:13:52 smtp4 smap[2624]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2625]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2627]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2620]: received SIGSEGV (segmentation error), aborting

Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV (segmentation error), aborting
Nov 29 11:13:53 smtp4 smap[2629]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2621]: received SIGSEGV (segmentation error), aborting

Nov 29 11:13:53 smtp4 smap[2630]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2627]: received SIGSEGV (segmentation error), aborting

Nov 29 11:13:54 smtp4 smap[2636]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:54 smtp4 smap[2629]: received SIGSEGV (segmentation error), aborting

Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV (segmentation error), aborting
Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV (segmentation error), aborting
Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV (segmentation error), aborting
Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV (segmentation error), aborting


It only appears to happen from internal connections, specifically from Microsoft Exchange. The session shown below also causes a SIGSEGV error.  Note the MAIL FROM: <>  line. I'm guessing an empty from line is not valid?? This may be normal behaviour for smap for outbound traffic however the error doesn't happen for inbound.


polar:/home/admin% telnet cor_smtp4 25
Trying 192.168.201.244...
Connected to smtp4.bws.com.
Escape character is '^]'.
220 smtp4 SMTP/smap Ready.
EHLO diamond.bri.bws.com
500 Command unrecognized
HELO diamond.bri.bws.com
250 (diamond.bri.bws.com) pleased to meet you.
MAIL FROM:<>
250 <>... Sender OK
RCPT TO:<chis86@yahoo.com>
250 <chis86@yahoo.com> OK
DATA
354 Enter mail, end with "." on a line by itself
Connection closed by foreign host.
polar:/home/admin%


As a result of this error my smap spool directory is quickly filling with empty sma?????? files. Any thoughts?

Chris

---
You are currently subscribed to fwtk-users as: prandal@herefordshire.gov.uk
To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com
---
You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com
To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------_=_NextPart_001_01C2A02D.08210770-- From bounce-fwtk-users-303@listserv.nai.com Tue Dec 10 08:37 EST 2002 Received: from sentry.gw.tislabs.com (firewall-user@sentry.gw.tislabs.com [192.94.214.100]) by lists.tislabs.com (8.9.1/8.9.1) with ESMTP id IAA09715 Tue, 10 Dec 2002 08:37:28 -0500 (EST) Received: by sentry.gw.tislabs.com; id IAA02210; Tue, 10 Dec 2002 08:39:33 -0500 (EST) Received: from listserv.nai.com(161.69.213.6) by sentry.gw.tislabs.com via smap (V5.5) id xma002194; Tue, 10 Dec 02 08:38:53 -0500 X-Authentication-Warning: cor_smtp.brewers.com: smap set sender to using -f Message-ID: From: "Hutchison, Chris" To: "fwtk-users" Subject: [fwtk-users] RE: SMAP Date: Mon, 9 Dec 2002 23:57:59 -0500 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2653.19) List-Unsubscribe: Reply-To: "fwtk-users" Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C2A008.B5ECE920" Content-Length: 23015 This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C2A008.B5ECE920 Content-Type: text/plain I'm hoping this reaches the fwtk email list. I have been having trouble posting and receiving. Lucky for me Ted Keller was kind enough to help me with my smap questions directly. I'm posting this one to confirm that I have resolved my smap problems and to share the information Ted gave. Thanks again for your help Ted. Chris -----Original Message----- From: Keller, Ted Sent: December 9, 2002 9:23 PM To: 'Hutchison, Chris ' Subject: RE: SMAP Chris, See answers below.... tek -----Original Message----- From: Hutchison, Chris To: 'Keller, Ted' Sent: 12/9/2002 8:45 AM Subject: RE: SMAP Ted, Just added the postmaster entry and its seems to have resolved the segv. It looks like everything is good now. I have just a couple of quick questions. 1. What are the following log messages trying to tell me: "Security: Remote Client Confused host=unknown/202.141.25.233" "Notice: Remote Clinet Buffer: EHLO mail11.uunets.ca^M" I've noted over time that there are some poor imitation e-mail servers out there that simply don't understand rfc821 protocols. What we see with them are sequences like.... ehlo xxx 500 unrecognized command from 500 must say hello ... inother words - the remote system didn't autofall back to the helo command - simply ignored the error message - and continued on. Now - we continued to send back error meesages - we will get ourselves in a loop with some bad behaving remote servers that simply don't give up - but try to continously get through our e-mail systems. This almost results in a denail of service type attack. So what I did was to implement some error counters - the number of bad commands since the last good command. And if we exceed the threshold (something like 10 bad commands in a row) I know that I don't want to talk to them - print out the error - and exit. Now the second entry is the optional feature of printing out when we detect an error in the remote client stream. 2. In my last email I asked about blocking all address to a specific domain with the exception of only a few. Can this be done and if so how. Well - let's think about this... I suspect we could do something like from @aol.com> in the spamlist.dat file - then have entries like in the trusted domain file. I think this would work... 3. As part of my debugging process I would have loved to capture the original email to see why it was rejected by smap. Is there a way to capture the session and email but not deliver it for whatever the reject reason may have been? For internal hosts - I report the reason for the reject in the 552 error message. - and log it in syslog. For external hosts - I only log it in syslog. The syslog entries try to capture the scan stream "in context" - by printing out what immediatly precedes and follows the offending phrase. ----------------- Now - there is also a debug option in the netperm-table. This doesn't quite work the way you are asking - but will allow you to capture a message in the inspool directory if it detects the phrase in the message - this then allows you to review the complete message manually. It will delete any messages, however, that it detects the spam phrase in. This will be the end of my bugging you ( I hope ). I do appreciate all your efforts. I have been using the FWTK for a number of years but never became an expert due to the lack of "C" knowledge. Everyone at our place is a Microsoft worshiper so I carry the lone Unix / Linux torch. I think the toolkit is a great way to help protect the weak Microsoft world. Thanks again for all your help! Chris -----Original Message----- From: Keller, Ted Sent: December 7, 2002 7:37 PM To: 'Hutchison, Chris ' Subject: RE: SMAP Chris, OK - This is just about the time when we create the temp sma file - and write the header. There is special logic in the code to insert the postmaster mail address for outbound. I tend to use this because a number of sites will not accept null mail addresses. I wonder... (I will look just a bit later) if by not having a postmaster entry - I reference a out of bounds address for that substitution process.... (hmmm - you just can't get good coders anymore....). Let me know if you have a smap postmaster entry - or if you deleted it. I will assume for the time being that you don't - and will check the code to ensure I process that stuff correctly. tek -----Original Message----- From: Hutchison, Chris To: 'Keller, Ted' Sent: 12/7/2002 5:10 PM Subject: RE: SMAP Ted, Thanks for getting back to me. I was in a bit of a crises last Thursday but was able to put in a work around. I have attached a copy of my netperm-table although I don't think that is the problem. I only get the segv errors under this one condition. When a local-host connects to smap and gives a "mail from: <>", its causes the smap program to segv right after you hit enter on the DATA command. You can see this displayed at the bottom of this email. At first I thought it was exchange being a Microsoft product and all, but I can reproduce it using telnet on port 25. I was also wondering if you can block a complete domain and only allow a handful of valid email address. I have two other domains with a total of 10-15 users each and I get A LOT of spam. If you need more info I will have to forward it Monday. Thanks for your help. Chris -----Original Message----- From: Keller, Ted Sent: December 7, 2002 1:49 PM To: 'Chris.Hutchison@TheBeerStore.ca' Subject: RE: SMAP Chris, I'm convinced that the fwtk list is broken.... Can you forward me a copy of your smap netperm-table config entries? Also, if you can capture it - a tcpdump of the incoming line that causes the segv. I haven't seen any of these .... so I'm a bit baffled. My best guess possibly is that MS exchange is passing some extended smtp entries on the line that I don't expect for some reason. Would like to see the input - and what was sent just prior to the segv. Null addresses are permitted.... tek -----Original Message----- From: Hutchison, Chris Sent: Thursday, December 05, 2002 1:19 PM To: 'keller@goodrich.com' Subject: SMAP Hi Ted, Sorry to email you direct but I'm not sure if my email's to the list are working. I recently changed domain names and had to re subscribe. Below is the email I sent to the fwtk-list. I would appreciate any help you could give. Thanks Chris P.S. do you have a syslog.conf file that will redirect all fwtk messages to a separate file? Not sure if this went through the first time. I am having two new problems with smap. Both cause the following error: Nov 29 11:13:52 smtp4 smap[2624]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2625]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2627]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2620]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2629]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2621]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:53 smtp4 smap[2630]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2627]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2636]: connect host=exng.tbs.ca/192.168.201.30 Nov 29 11:13:54 smtp4 smap[2629]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV (segmentation error), aborting Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV (segmentation error), aborting It only appears to happen from internal connections, specifically from Microsoft Exchange. The session shown below also causes a SIGSEGV error. Note the MAIL FROM: <> line. I'm guessing an empty from line is not valid?? This may be normal behaviour for smap for outbound traffic however the error doesn't happen for inbound. polar:/home/admin% telnet cor_smtp4 25 Trying 192.168.201.244... Connected to smtp4.bws.com. Escape character is '^]'. 220 smtp4 SMTP/smap Ready. EHLO diamond.bri.bws.com 500 Command unrecognized HELO diamond.bri.bws.com 250 (diamond.bri.bws.com) pleased to meet you. MAIL FROM:<> 250 <>... Sender OK RCPT TO: 250 OK DATA 354 Enter mail, end with "." on a line by itself Connection closed by foreign host. polar:/home/admin% As a result of this error my smap spool directory is quickly filling with empty sma?????? files. Any thoughts? Chris <> --- You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------_=_NextPart_001_01C2A008.B5ECE920 Content-Type: text/html Content-Transfer-Encoding: quoted-printable RE: SMAP

I'm hoping this reaches the fwtk email list.  I = have been having trouble posting and receiving.
Lucky for me Ted Keller was kind enough to help me = with my smap questions directly.

I'm posting this one to confirm that I have resolved = my smap problems and to share the information Ted gave.

Thanks again for your help Ted.
Chris


-----Original Message-----
From: Keller, Ted
Sent: December 9, 2002 9:23 PM
To: 'Hutchison, Chris '
Subject: RE: SMAP


 
Chris,

See answers below....

tek

-----Original Message-----
From: Hutchison, Chris
To: 'Keller, Ted'
Sent: 12/9/2002 8:45 AM
Subject: RE: SMAP

Ted,

Just added the postmaster entry and its seems to have = resolved the segv.

It looks like everything is good now.

I have just a couple of quick questions.

1. What are the following log messages trying to tell = me:
        = "Security: Remote Client Confused = host=3Dunknown/202.141.25.233"
        = "Notice: Remote Clinet Buffer: EHLO mail11.uunets.ca^M" =

I've noted over time that there are some poor = imitation e-mail servers out there that simply don't understand rfc821 = protocols.  What we see with them are sequences = like....


ehlo xxx
500 unrecognized command
from <abc.dat>
500 must say hello
...

inother words - the remote system didn't autofall = back to the helo command - simply ignored the error message - and = continued on.  Now - we continued to send back error meesages - we = will get ourselves in a loop with some bad behaving remote servers that = simply don't give up - but try to continously get through our e-mail = systems.  This almost results in a denail of service type = attack.  So what I did was to implement some error counters - the = number of bad commands since the last good command.  And if we = exceed the threshold (something like 10 bad commands in a row) I know = that I don't want to talk to them - print out the error - and = exit.

Now the second entry is the optional feature of = printing out when we detect an error in the remote client = stream.


2. In my last email I asked about blocking all = address to a specific domain with the exception of only a few.  = Can this be done and if so how.

Well - let's think about this...  I suspect we = could do something like

from @aol.com>

 in the spamlist.dat file - then have entries = like

<good.one@aol.com>

in the trusted domain file.  I think this would = work...



3. As part of my debugging process I would have loved = to capture the original email to see why it was rejected by smap.  = Is there a way to capture the session and email but not deliver it for = whatever the reject reason may have been?

For internal hosts - I report the reason for the = reject in the 552 error message. - and log it in syslog.

For external hosts - I only log it in syslog.  = The syslog entries try to capture the scan stream "in = context" - by printing out what immediatly precedes and follows = the offending phrase.

-----------------

Now - there is also a debug option in the = netperm-table.  This doesn't quite work the way you are asking - = but will allow you to capture a message in the inspool directory if it = detects the phrase in the message - this then allows you to review the = complete message manually.  It will delete any messages, however, = that it detects the spam phrase in.



This will be the end of my bugging you ( I hope = ).  I do appreciate all your efforts.
I have been using the FWTK for a number of years but = never became an expert due to the lack of "C" = knowledge.  Everyone at our place is a Microsoft worshiper so I = carry the lone Unix / Linux torch.  I think the toolkit is a great = way to help protect the weak Microsoft world.

Thanks again for all your help!
Chris


-----Original Message-----
From: Keller, Ted
Sent: December 7, 2002 7:37 PM
To: 'Hutchison, Chris '
Subject: RE: SMAP


 
Chris,


OK - This is just about the time when we create the = temp sma file - and write the header.  There is special logic in = the code to insert the postmaster mail address for outbound.  I = tend to use this because a number of sites will not accept null mail = addresses.  I wonder...  (I will look just a bit later) if by = not having a postmaster entry - I reference a out of bounds address for = that substitution process.... (hmmm - you just can't get good coders = anymore....).  Let me know if you have a smap postmaster entry - = or if you deleted it.  I will assume for the time being that you = don't - and will check the code to ensure I process that stuff = correctly.

tek

-----Original Message-----
From: Hutchison, Chris
To: 'Keller, Ted'
Sent: 12/7/2002 5:10 PM
Subject: RE: SMAP

Ted,

Thanks for getting back to me.  I was in a bit = of a crises last Thursday but was able to put in a work around.

I have attached a copy of my netperm-table although I = don't think that is the problem.
I only get the segv errors under this one condition. =

When a local-host connects to smap and gives a = "mail from: <>", its causes the smap program to segv = right after you hit enter on the DATA command.  You can see this = displayed at the bottom of this email.

At first I thought it was exchange being a Microsoft = product and all, but I can reproduce it using telnet on port 25. =

I was also wondering if you can block a complete = domain and only allow a handful of valid email address.
I have two other domains with a total of 10-15 users = each and I get A LOT of spam.

If you need more info I will have to forward it = Monday.

Thanks for your help.

Chris





-----Original Message-----
From: Keller, Ted
Sent: December 7, 2002 1:49 PM
To: 'Chris.Hutchison@TheBeerStore.ca'
Subject: RE: SMAP


Chris,

I'm convinced that the fwtk list is broken.... =

Can you forward me a copy of your smap netperm-table = config entries? Also, if you can capture it - a tcpdump of the incoming = line that causes the segv. I haven't seen any of these .... so I'm a = bit baffled.  My best guess possibly is that MS exchange is = passing some extended smtp entries on the line that I don't expect for = some reason.  Would like to see the input - and what was sent just = prior to the segv.  Null addresses are permitted....

tek

-----Original Message-----
From: Hutchison, Chris
Sent: Thursday, December 05, 2002 1:19 PM
To: 'keller@goodrich.com'
Subject: SMAP


Hi Ted,

Sorry to email you direct but I'm not sure if my = email's to the list are working.
I recently changed domain names and had to re = subscribe.

Below is the email I sent to the fwtk-list.  I = would appreciate any help you could give.

Thanks
Chris

P.S. do you have a syslog.conf file that will = redirect all fwtk messages to a separate file?





Not sure if this went through the first time.

I am having two new problems with smap.  Both = cause the following error:



Nov 29 11:13:52 smtp4 smap[2624]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:52 smtp4 smap[2625]: = connect host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:52 = smtp4

smap[2627]: connect host=3Dexng.tbs.ca/192.168.201.30 = Nov 29 11:13:52 smtp4 smap[2620]: received SIGSEGV (segmentation = error), aborting

Nov 29 11:13:52 smtp4 smap[2618]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:53 smtp4 smap[2629]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2621]: = received SIGSEGV (segmentation error), aborting

Nov 29 11:13:53 smtp4 smap[2630]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:53 smtp4 smap[2627]: = received SIGSEGV (segmentation error), aborting

Nov 29 11:13:54 smtp4 smap[2636]: connect = host=3Dexng.tbs.ca/192.168.201.30 Nov 29 11:13:54 smtp4 smap[2629]: = received SIGSEGV (segmentation error), aborting

Nov 29 11:13:54 smtp4 smap[2630]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:54 smtp4 smap[2634]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:54 smtp4 smap[2633]: received SIGSEGV = (segmentation error), aborting
Nov 29 11:13:55 smtp4 smap[2636]: received SIGSEGV = (segmentation error), aborting



It only appears to happen from internal connections, = specifically from Microsoft Exchange. The session shown below also = causes a SIGSEGV error. Note the MAIL FROM: <>  line. I'm = guessing an empty from line is not valid?? This may be normal behaviour = for smap for outbound traffic however the error doesn't happen for inbou= nd.



polar:/home/admin% telnet cor_smtp4 25
Trying 192.168.201.244...
Connected to smtp4.bws.com.
Escape character is '^]'.
220 smtp4 SMTP/smap Ready.
EHLO diamond.bri.bws.com
500 Command unrecognized
HELO diamond.bri.bws.com
250 (diamond.bri.bws.com) pleased to meet you. =
MAIL FROM:<>
250 <>... Sender OK
RCPT TO:<chis86@yahoo.com>
250 <chis86@yahoo.com> OK
DATA
354 Enter mail, end with "." on a line by = itself
Connection closed by foreign host.
polar:/home/admin%



As a result of this error my smap spool directory is = quickly filling with empty sma?????? files. Any thoughts?

Chris

 

 <<netperm-table.txt>>

---
You are currently subscribed to fwtk-users as: fwtk-archive@lists.tislabs.com
To unsubscribe send a blank email to leave-fwtk-users-303A@listserv.nai.com ------_=_NextPart_001_01C2A008.B5ECE920--