October 2001 - SUSE Proxy Suite - openSUSE Mailing Lists

Proxy of SSL sessions
by Barry Gill 01 Nov '01

01 Nov '01

Hello All, Has anyone come across a method to proxy a connection between a user and an ssl server, forcing all traffic to remain between the user and proxy and proxy and ssl server. user <--> proxy <--> ssl server Where the user comes in at any point on the web and the proxy is in the public domain (i.e hosted by an ISP). What I am trying to do:- In South Africa international bandwidth is expensive so many ISP's oversell their international bandwidth (all provided via satellite). This makes user experience when accessing some international sites a bit slow. I have a site that is located in Europe that has an HTTPS (ssl) frontend and a large number of people who need to access this form many different ISP's, some of whom have little or no bandwidth available. In order to improve end user experience I am looking to set up a server in South Africa with a ZA specific URL and notify all end users to access this site. I then wish to have the user authenticate on the ZA server and establish an ssl session between ZA server and ZA end user. I am thinking of how to forward the ssl authentication to the US/EU server to establish a ZA end user specific ssl session between US/EU server and ZA proxy and have the proxy take info from ZA end user ssl session and forward it through ZA Proxy and US/EU ssl session and vice versa. My biggest problem is that the guys in US/EU are running .asp pages and have backends into all sorts and as such cannot bring a true front end to ZA just yet. Any ideas, comments or thoughts on this matter would be greatly appreciated. Bazz Barry Gill Product Manager - UUdirect UUNET South Africa - A Worldcom Company Tel: +27 11 235 6540 Fax: +27 11 235 6501 Cel: +27 83 299 1122 barry(a)za.uu.net

2 1

AW: [proxy-suite] no listing of dirs
by "Thiemann, André" 05 Oct '01

05 Oct '01

>-----Ursprüngliche Nachricht----- >Von: Thomas Bätzler [mailto:thomas.baetzler@peregrine.com] >Gesendet: Donnerstag, 4. Oktober 2001 19:42 >An: 'proxy-suite(a)suse.com' >Betreff: RE: [proxy-suite] no listing of dirs ...please reply on weekends to: mailto:andre.thiemann@epost.de (you never know...some people are freaks like me...) >Hi, >> "Thiemann, André" [SMTP:andre.thiemann@bva.de] asked: >> i´m not getting the 150-message (Opening ASCII mode data blablabla...) >> connecting to server works fine so far... >> >What happens if you add "DestinationTransferMode passive" >to ftp-proxy.conf? ...still the same problem; i have installed new kernel, autoconf etc, works a little bit better (doesn´t hang anymore) still no ipchains-rules. This is what i get: 220 ivbbfw FTP server (Version 1.7tp7 - 2001/06/20 21:05:20) ready. Name (192.168.253.14:admin): anonymous(a)ftp.heise.de 331- (---> Proxy connected to ftp.heise.de <---) 331-(220 www02 FTP server (Version wu-2.6.1(2) Thu Jan 25 14:19:23 MET 2001) ready.) 331 Guest login ok, send your complete e-mail address as password. Password: 230-Willkommen beim Heise FTP-Server 230- 230-Sie koennen unter 230-http://www.heise.de/ftp/ 230-im lokalen Archiv nach Dateien suchen. 230- 230-Bei Fragen oder Anregungen wenden Sie sich bitte an ftpadmin(a)heise.de 230- 230 Guest login ok, access restrictions apply. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 500 'EPSV': command unrecognized. 227 Entering Passive Mode (192,168,253,14,17,206). 227 ftp> before changing configuration the daemon hung after first 227-message ...what me confuses is the fact that i get a 227-message twice, not the 150-message usually it looks like (done from a different host without ftp-proxy): 230-Bei Fragen oder Anregungen wenden Sie sich bitte an ftpadmin(a)heise.de 230- 230 Guest login ok, access restrictions apply. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls 500 'EPSV ': command not understood by Sidewinder proxy. 227 Entering passive mode (193,99,144,79,125,252) 150 Opening ASCII mode data connection for /bin/ls. total 648 drwxrws-wx 3 staff 512 Aug 2 2000 Incoming -rw-r--r-- 1 other 167 Dec 14 1999 Suche_im_Archiv.txt -rwxrw-r-- 1 staff 600 Dec 13 1999 WER_UNS_SPIEGELT d--x--x--x 2 root 512 Feb 12 1999 bin drwxr-xr-x 2 root 512 Nov 7 1995 dev d--x--x--x 3 root 512 Oct 10 2000 etc -r--r--r-- 1 other 228834 Oct 5 06:00 ls-lR -r--r--r-- 1 other 49918 Oct 5 06:00 ls-lR.Z -r--r--r-- 1 other 35702 Oct 5 06:00 ls-lR.gz drwxr-xr-x 7 staff 512 Oct 5 06:00 pub d--x--x--x 4 other 512 Feb 8 1996 usr 226 Transfer complete. it looks to me like i´m getting a 'printout' of what the server does, i have no idea...:o( changed config to: [-Global-] AllowTransProxy yes DestinationAddress 10.254.182.206 Listen 192.168.253.14<- Internal Interface ! Port ftp PortResetsPasv yes SameAddress no ServerType inetd TimeOut 900 LogDestination /etc/proxy-suite/ftp.txt External If has 10.11.32.2, Routing looks like: Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.253.12 192.168.253.14 255.255.255.252 UG 0 0 0 eth1 192.168.253.12 0.0.0.0 255.255.255.252 U 0 0 0 eth1 10.11.32.0 10.11.32.2 255.255.255.252 UG 0 0 0 eth0 10.11.32.0 0.0.0.0 255.255.255.252 U 0 0 0 eth0 127.0.0.0 0.0.0.0 255.0.0.0 U 0 0 0 lo 0.0.0.0 10.11.32.1 0.0.0.0 UG 0 0 0 eth0 Logging looks like: (getting two files, don´t know why...) ftp.txt ftp-proxy [9196] <10/05-14:42:27> USER-INF connect from 192.168.253.14 ftp-proxy [9196] <10/05-14:42:36> USER-WRN requested transparent proxy dest 192$ ftp-proxy [9196] <10/05-14:42:36> USER-INF 'USER anonymous(a)ftp.heise.de' from 1$ ftp-proxy [9196] <10/05-14:42:36> USER-INF reading data for 'anonymous(a)ftp.heis$ ftp-proxy [9196] <10/05-14:42:41> USER-INF 'PASS XXXX' from 192.168.253.14 ftp-proxy [9196] <10/05-14:42:41> USER-INF 'SYST' from 192.168.253.14 ftp-proxy [9196] <10/05-14:42:41> USER-WRN unknown 'FEAT' from 192.168.253.14 ftp-proxy [9196] <10/05-14:42:41> USER-INF 'PWD' from 192.168.253.14 ftp-proxy [9196] <10/05-14:42:43> USER-WRN unknown 'EPSV' from 192.168.253.14 ftp-proxy [9196] <10/05-14:42:43> USER-INF PASV set to 192.168.253.14:1466 for $ ftp-proxy [9196] <10/05-14:42:43> USER-INF 'LIST' from 192.168.253.14 ftp-proxy [9196] <10/05-14:42:43> USER-INF Transfer for 192.168.253.14: '' 1 s$ ftp-proxy [9196] <10/05-14:42:50> USER-INF 'QUIT' from 192.168.253.14 ftp.txt.20011005-14427 ftp-proxy [9194] <10/05-14:41:58> USER-INF connect from 192.168.253.13 ftp-proxy [9194] <10/05-14:42:06> USER-WRN requested transparent proxy dest 192$ ftp-proxy [9194] <10/05-14:42:06> USER-INF 'USER anonymous(a)ftp.heise.de' from 1$ ftp-proxy [9194] <10/05-14:42:06> USER-INF reading data for 'anonymous(a)ftp.heis$ ftp-proxy [9194] <10/05-14:42:12> USER-INF 'PASS XXXX' from 192.168.253.13 ftp-proxy [9194] <10/05-14:42:14> USER-INF 'PORT 192.168.253.13:32031' from 192$ ftp-proxy [9194] <10/05-14:42:14> USER-INF 'NLST' from 192.168.253.13 ftp-proxy [9194] <10/05-14:42:14> TECH-INF 'PORT 10.11.32.2:1320' for 192.168.2$ ftp-proxy [9194] <10/05-14:42:14> TECH-INF 'NLST' sent for 192.168.253.13 ftp-proxy [9194] <10/05-14:42:21> USER-INF Transfer for 192.168.253.13: NLST ''$

1 0

RE: [proxy-suite] no listing of dirs
by Thomas Bätzler 04 Oct '01

04 Oct '01

Hi, > "Thiemann, André" [SMTP:andre.thiemann@bva.de] asked: > i´m not getting the 150-message (Opening ASCII mode data blablabla...) > connecting to server works fine so far... > What happens if you add "DestinationTransferMode passive" to ftp-proxy.conf? HTH, Thomas

1 0

no listing of dirs
by "Thiemann, André" 04 Oct '01

04 Oct '01

hi there, i´m not getting the 150-message (Opening ASCII mode data blablabla...) connecting to server works fine so far... any ideas ??? my config: client--firewall--eth0--proxy---eth1--10.254.182.206--destination i have(!) to use the 10.254.182.206 as an proxy...(Intranet) (i´m not running firewall or ipchains...) ftp-proxy.conf: [-Global-] AllowTransProxy yes DestinationAddress 10.254.182.206 DestinationPort 21 Listen 192.168.253.14 PortResetsPasv yes SameAddress no ServerType standalone TimeOut 900 WelcomeString Welcome at %h !

1 0