March 2001 - SUSE Proxy Suite - openSUSE Mailing Lists

broken pipe pb (suite)
by Christophe.Weidemann＠alcatel.fr 27 Mar '01

27 Mar '01

> I've installed proxy-suite on sun OS 5.8 and each time I do a download > of a file ~ > 1 Meg, I have a broken pipe error. I've already tested > several configuration of the product but the problem is always the same. > > The trace in the ftp-proxy.log is the following: > ftp-child [21938] <03/13-09:33:31> TECH-ERR can't read from 4=159.140.3.145 > where 159.140.3.145 is the ftp destination address. Below, I give more details I've used the sources in ftp.suse.com/pub/projects/proxy-suite/proxy-suite-1.7.tar.gz and I encounter this problem. I 've also tried with ftp.suse.com/pub/projects/proxy-suite/proxy-suite-1.7tp5-src_patched.tar.gz but it didn't change anything. I didn't find the patch you told in the devel directory. Is it the .rpm file which is a binary distribution ? How can I install it on my sun OS machine ? I give you my configuration file which is very simple ##################################################################### # # $Id: ftp-proxy.conf.sample,v 1.3 1999/09/24 06:39:43 wiegand Exp $ # # Sample FTP Proxy Configuration File # # The general format is "Keyword Value". # # Any white space at the beginning or end of a line and after # the Keyword is ignored. Lines can be continued with '\'. # Case is *NOT* sensitive, so "user" is "User" is "USER". # # Several variables can also be assigned to a client's user name. # User specific sections are introduced by a '[username]' line. # The variables are: TimeOut, ValidCommands, SameAddress, # ActiveMinDataPort, ActiveMaxDataPort, # PassiveMinDataPort, PassiveMaxDataPort, # DestinationAddress, DestinationPort, # DestinationMinPort, DestinationMaxPort, # DestinationTransferMode, MaxPathLength, # LegalPathChars, ValidPathPattern. # These variables can also be obtained from an LDAP server, in # which case the values from this file are not evaluated any # more. # ##################################################################### # # The start of the file is implicitly the [-Global-] section. # [-Global-] # The following entries select a port range for client DTP # ports in active mode, i.e. when the client sends a PORT # command. The default is port 20 as per RFC 959. # #ActiveMinDataPort 40000 #ActiveMaxDataPort 40999 # The follwing flag is especially useful for outbound FTP # traffic. It allows to put some "magic" in the USER name. # If set, it enables the USER name to contain the target # server in the form "user[@host[:port]]" and overrides # the DestinationAddress (and DestinationPort) below. # #AllowMagicUser yes # This message prevents any login if a file with the given # name exists. Instead the contents of the file will be sent # to the client and the connection closed. Lines are prefixed # with "421-". If no such file exists, the mechanism is not # triggered and DenyString (s.b.) is ignored altogether. # # DenyMessage /etc/proxy-suite/ftp-deny.txt # If a DenyMessage file exists, the deny mechanism will be # activated in any case. If a DenyString exists, it will be # sent (with escape sequences) as the last line (with a 421 # reply code), else the standard message # "Service not available" will be displayed. # # DenyString Service out of order # Where to redirect incoming FTP traffic. This destination # will be used if a client has not set its own target. # WARNING: ftp-proxy will refuse to run if this directive # is not set. # DestinationAddress 156.132.28.143 # (Local) port range for all connections to the server. The # default is to let the proxy select any ephemeral port. # # DestinationMinPort 42900 # DestinationMaxPort 42999 # This is the port corresponding to DestinationAddress. It # defaults to 21, the standard FTP port. # DestinationPort 21 # Specify the FTP transfer mode to be used from the proxy to # the server. TransferMode can be active, passive, or client. # The default is "client" which means to use the same as the # client. # # DestinationTransferMode client # DestinationTransferMode passive # DestinationTransferMode active # If given, change GID to give up root privileges. In POSIX # environments this changes all group ID's. # #Group nogroup # Group nobody # Access information based upon users can also be obtained # dynamically from an LDAP directory. This works only if the # program was compiled with LDAP support. Both the University # of Michigan and the Netscape LDAP API are supported. # # LDAPServer ldap.domain.tld[:port] # When accessing the LDAP directory, a search base can be # handed to the search functions. We strongly recommend to # do so. This is the "root" of the relevant search tree. # # LDAPBaseDN dc=domain, dc=tld # The next thing to decide when using LDAP is the attribute # used as the main identificator. Some administrators will # use the CN (Common Name) attribute, and this is also the # default, but it can be any legal identifier. # # LDAPIdentifier LoginName # Additionally, an LDAP ObjectClass should be defined for # the FTP User(s). This will be especially useful if the # user entries are located inside a mixed LDAP hierarchy. # If an ObjectClass is given, the search is executed as: # "(&(ObjectClass=<class>)(CN=<username>))", else it will # just be based upon CN (the Common Name) or whatever has # been assigned to LDAPIdentifier above. # # LDAPObjectClass FTPProxyUser # Set to listen on a specific interface (0.0.0.0 means all # and is also the default). Address can be given as dotted # decimal IP address or DNS host name. # Listen 0.0.0.0 # Determine where to send logging information. If the value # starts with a '/' it is assumed to be a file. If it starts # with a '|' it is assumed to be a program which will be # popen()-ed. Anything else is assumed to be a facility for # syslog(). See ftp-proxy.conf(5) and the "SYSLOG" file for # severity handling. # # LogDestination daemon LogDestination /var/log/ftp-proxy.log # LogDestination |/usr/bin/rotatelogs /var/log/ftp-proxy.log # Maximum number of concurrent clients if running as daemon. MaxClients 64 # This message (or rather the contents of a file with this # name) will be issued when MaxClients is exceeded, each # line prefixed with "421-". If no such file exists, only # the MaxClientsString below will be displayed. # # MaxClientsMessage /etc/proxy-suite/ftp-maxclients.txt # This string (with a default of "Service not available" will # be displayed, if the configured maximum number of concurrent # clients has been reached. It is prefixed with '421 '. # MaxClientsString The server is full # The following entries select a port range for client DTP # ports in passive mode, i.e. when the client sends a PASV. # If no port range is given, no bind is performed, in which # case the proxy lets the machine select an ephemeral port. # # PassiveMinDataPort 41000 # PassiveMaxDataPort 41999 # Write an ASCII file with the Program ID if given. Only valid # if running as daemon, in which case the daemon itself uses it. # #PidFile /var/run/ftp-proxy.pid # Port to listen on (for the SERVER-PI). Default is "ftp". # Can be given as TCP service name or as a plain number. # Port ftp # The following flag specifies the action when a PORT command # is received while a PASV listening socket is outstanding. # The RFC is not really clear about the "correct" behaviour, # but since most existing implementations seem to reset the # listener, we do the same by default. Nevertheless they all # may be ... inaccurate. # # PortResetsPasv yes # Shall we allow data connections only from the same host where # the control connection originated from? Default is yes. If # you say no here, the proxy is able to take part in so called # third party server to server transfers. # # SameAddress yes # If given, chroot() to this directory after initializing. Only # valid for inetd mode or forked clients. The daemon will stay. # # ServerRoot /var/ftp-proxy/rundir # Determine whether to run as daemon or in inetd mode. This can # be overridden by -d/-i command line switch. Default is inetd. # #ServerType inetd ServerType standalone # Shall we use the TCP Wrapper Library when running as daemon? # "on", "yes", "true" or a non-zero number means yes, anything # else no. Default no. Only applicable when running as daemon. # Note that TCP Wrapper support must be compiled in for this to # work. # # TCPWrapper yes # If a client has no activity for this many seconds, it is # regarded to be dead and the connection will be terminated. # Default is 900 seconds, i.e. 15 minutes. # TimeOut 900 # If the proxy server needs to advertise itself (in outgoing # responses like answers to PASV commands) with a different # address than it actually has, the following option can be # used. Relevant e.g. when using a NAT device in the path.# # TranslatedAddress 0.0.0.0 # If given, change UID to give up root privileges. In POSIX # environments this changes all user ID's. # #User nobody # User ftpproxy # List of FTP commands that will be allowed from a client. # All commands not on this list will be rejected. If no list # exists, then all commands will be allowed. # Each command can be followed by an optional equals sign # and regular expression (POSIX 1003.2) to restrict legal # argument(s) syntax. In order to avoid confusing the # configuration reading functions, the expression is "pre- # processed." This means that a sequence like "%20" will be # replaced by a space and "%5c" or "%5C" by a backslash # before being compiled. In fact, this looks a bit like the # HTML way of doing things. The percent sign itself is # represented by "%25" of course. The pattern is interpreted # as a POSIX 1003.2 RE (with REG_NEWLINE flag set), and is # case sensitive. In any case, this works only if compiled # with regular expression support compiled into the program. # # ValidCommands ABOR, PASS, PASV, STOR, USER, \ # # MODE, QUIT, SYST # This file will be presented to all clients immediately after # the connection has been established. Each line is prefixed # with "220-". The whole message is followed by a standard # "220 <host> FTP server (<version>) ready" or whatever has # been substituted with WelcomeString below. Escape sequences # (like %h for hostname; see ftp-proxy.conf(5)) are active. # # WelcomeMessage /etc/proxy-suite/ftp-welcome.txt # If we wanted to disguise as some known other FTP server we # could use the following option. It replaces the standard # "<host> FTP server (<version>) ready" in the initial 220 # message. As with all Messages and Strings, various escape # sequences are available. # # WelcomeString Welcome to %h ############################################################ # $Log: ftp-proxy.conf.sample,v $ # Revision 1.3 1999/09/24 06:39:43 wiegand # added regular expressions for all commands # removed character map and length of paths # added flag to reset PASV on every PORT # added "magic" user with built-in destination # added some argument pointer fortification # # Revision 1.2 1999/09/17 11:04:02 wiegand # added path name restriction options # # Revision 1.1 1999/09/16 07:53:54 wiegand # initial checkin # ############################################################ The log file with the error in" ---> <----": ftp-child [24032] <03/21-10:36:12> USER-INF 'PASS XXXX' from 156.132.3.112 ftp-child [24032] <03/21-10:36:15> USER-INF 'TYPE I' from 156.132.3.112 ftp-child [24032] <03/21-10:36:19> USER-INF 'TYPE A' from 156.132.3.112 ftp-child [24032] <03/21-10:36:19> USER-INF 'PORT 156.132.3.112:1099' from 156.132.3.112 ftp-child [24032] <03/21-10:36:19> USER-INF 'NLST' from 156.132.3.112 ftp-child [24032] <03/21-10:36:19> TECH-INF 'PORT 156.132.2.192:34112' for 156.132.3.112 ftp-child [24032] <03/21-10:36:19> TECH-INF 'NLST' sent for 156.132.3.112 ftp-child [24032] <03/21-10:36:19> USER-INF Transfer for 156.132.3.112: NLST '' 1 sec ftp-child [24032] <03/21-10:36:19> USER-INF 'TYPE I' from 156.132.3.112 ftp-child [24032] <03/21-10:36:22> USER-INF 'TYPE A' from 156.132.3.112 ftp-child [24032] <03/21-10:36:22> USER-INF 'PORT 156.132.3.112:1100' from 156.132.3.112 ftp-child [24032] <03/21-10:36:22> USER-INF 'NLST -l' from 156.132.3.112 ftp-child [24032] <03/21-10:36:22> TECH-INF 'PORT 156.132.2.192:34113' for 156.132.3.112 ftp-child [24032] <03/21-10:36:22> TECH-INF 'NLST -l' sent for 156.132.3.112 ftp-child [24032] <03/21-10:36:22> USER-INF Transfer for 156.132.3.112: NLST '-l' 1 sec ftp-child [24032] <03/21-10:36:22> USER-INF 'TYPE I' from 156.132.3.112 ftp-child [24032] <03/21-10:36:38> USER-INF 'PORT 156.132.3.112:1101' from 156.132.3.112 ftp-child [24032] <03/21-10:36:39> USER-INF 'RETR test5.pdf' from 156.132.3.112 ftp-child [24032] <03/21-10:36:39> TECH-INF 'PORT 156.132.2.192:34114' for 156.132.3.112 ftp-child [24032] <03/21-10:36:39> TECH-INF 'RETR test5.pdf' sent for 156.132.3.112 ----> ftp-child [24032] <03/21-10:36:39> TECH-ERR can't ll_read: Srv-Data -1=156.132.28.143 <----- ftp-child [24032] <03/21-10:36:39> USER-INF Transfer for 156.132.3.112: RETR 'test5.pdf' 1 sec ftp-child [24032] <03/21-10:36:45> USER-INF 'QUIT' from 156.132.3.112 Thank you for your answer Best Regards CHristophe WEIDEMANN

2 1

broken pipe pb
by Christophe.Weidemann＠alcatel.fr 19 Mar '01

19 Mar '01

Hi, I've installed proxy-suite on sun OS 5.8 and each time I do a download of a file ~ > 1 Meg, I have a broken pipe error. I've already tested several configuration of the product but the problem is always the same. The trace in the ftp-proxy.log is the following: ftp-child [21938] <03/13-09:33:31> TECH-ERR can't read from 4=159.140.3.145 where 159.140.3.145 is the ftp destination address. Thank you Christophe Weidemann

1 0

Problems with multiple clients
by Andreas Wassatsch 15 Mar '01

15 Mar '01

Hello list, I'm trying to proxy ftp to an internal server on a firewall. It works quite well on the first connect, but when a second client tries to connect, the server answers with: 421 Service not available, remote server has closed connection Login failed. Any Ideas what is wrong ? Best Regards, Andreas Wassatsch Logfile: first client (ok) Mar 15 13:07:36 fwall ftp-child[23706]: USER-INF connect from 62.96.xxx.x Mar 15 13:07:42 fwall ftp-child[23706]: USER-INF 'USER ard' from 62.96.xxx.x Mar 15 13:07:42 fwall ftp-child[23706]: USER-INF reading data for 'ard' from cfg-file Mar 15 13:07:51 fwall ftp-child[23706]: USER-INF 'PASS XXXX' from 62.96.192.2 Mar 15 13:07:51 fwall ftp-child[23706]: USER-INF 'PWD' from 62.96.xxx.x Mar 15 13:07:51 fwall ftp-child[23706]: USER-INF 'SYST' from 62.96.xxx.x Logfile: second client Mar 15 13:08:00 fwall ftp-child[23723]: USER-INF connect from 195.143.xxx.xx Mar 15 13:08:06 fwall ftp-child[23723]: USER-INF 'USER ard' from 195.143.xxx.xx Mar 15 13:08:06 fwall ftp-child[23723]: USER-INF reading data for 'ard' from cfg-file Mar 15 13:08:06 fwall ftp-child[23723]: TECH-ERR can't connect 10.yy.yy.101:21 for 195.143.xxx.xx (errno=99 [Cannot assign requested address]) ftp-proxy.conf [-Global-] ActiveMinDataPort 40900 ActiveMaxDataPort 40999 DestinationAddress 10.yy.yy.101 DestinationMinPort 42900 DestinationMaxPort 42999 Listen 62.96.xxx.xxx PortResetsPasv yes ServerType standalone MaxClients 64 MaxClientsString "Service nicht verfuegbar" LogDestination daemon -- Andreas Wassatsch CAT Systems AG Dipl.-Ing. Robert-Bosch-Straße 3-5 D-68723 Schwetzingen using Linux since 0.99pl10 Fon 06202/857-303 Fax -100

1 0

Multiple Listen directives
by Fraser Campbell 14 Mar '01

14 Mar '01

Hi, I'm wondering if it's possible to have ftp-proxy listen on multiple addresses. This is what the man page says: Listen Global context only. Defines the address where the proxy itself opens the listening port. The default is 0.0.0.0 which instructs the server to bind to any address. See also Port. I was hoping I could have either multiple Listen lines or multiple addresses listed on the listen line. The situation is multiple IPs forwarding to the same internal server. We'd like to have one instance of ftp-proxy handling both external addresses ... for now we're resorting to two instances of ftp-proxy per internal server. -- fraser campbell <fraser(a)starnix.com> starnix inc. telepone: (905) 771-0017 thornhill, ontario, canada http://www.starnix.com/ professional linux services & products

1 0

Sever to Server Transfer Problem
by Glen M. 14 Mar '01

14 Mar '01

Hi, so far my settings works but a major problem is that all the traffic during a "Server to Server" session goes through my Masquerading Router (SourceServer->MyMasqRouter->DestServer). I read the manuals and tested all possible setting so far, but I can't solve this problem. In addition I include my ftp-proxy.conf: -------------------------------------------------------------------------------- [-Global-] ActiveMinDataPort 40000 ActiveMaxDataPort 40999 PassiveMinDataPort 41000 PassiveMaxDataPort 41999 AllowMagicUser yes AllowTransProxy no DestinationAddress xxx.xx.xxx.xx DestinationPort 21 DestinationTransferMode client User mimosius Group users Listen 192.168.0.99 Port 1090 LogDestination /var/log/ftp-proxy.log PidFile /var/run/ftp-proxy.pid Port 1090 PortResetsPasv no SameAddress no TranslatedAddress xxx.xx.xxx.xx ServerType inetd TCPWrapper yes -------------------------------------------------------------------------------- Mimosius

1 0

problem with open relay ...
by Wolfgang Schäfer 14 Mar '01

14 Mar '01

Hi to all, I receive this message! Paul L Daniels schrieb: > > One thing to note here, > > If you firewall is just a "port-forwarding" firewall (ie, it just > controls access to your real internal mail server) then yes, it will still > show up as relaying. As apposed to something like a PROXY firewall (ie, > Gauntlet, FWTK). Only with a proxy based firewall can you get away with > having a open-relaying setup on the inside (someone want to correct me > here?) > > Regards. > > -- > Paul L Daniels http://www.pldaniels.com > Linux/Unix systems Internet Development > ICQ#103642862,AOL:cinflex,IRC:inflex > A.B.N. 19 500 721 806 Support the suse-proxy this feature and how can I use this? -- _______________________________ Wolfgang Schaefer Diplom-Ingenieur (FH) Elektronik Systemadministrator Fon +49-(0)7308-818-22 Fax +49-(0)7308-818-65 busse design ulm gmbh Nersinger Str. 18 89275 Elchingen / Ulm, Germany http://www.busse-design-ulm.de _______________________________

1 0

compilation error: ctags: Unknown option:-w
by Klaus Bömken 12 Mar '01

12 Mar '01

Hello! I tried to install the proxy-suite-1.7 on a SuSE 7.1 system today. Following the installation instructions in the proxy-suite white paper I succeeded in running ./configure. But compilation with make produced the following error message: ::::::::::::: make 'all' in ./common make[1]: Entering directory `/usr/src/proxy-suite-1.7/common' ctags -w com-config.c com-debug.c com-misc.c com-socket.c com-syslog.c com-config.h com-debug.h com-misc.h com-socket.h com-syslog.h ctags: Unknown option: -w make[1]: *** [tags] Error 1 make[1]: Leaving directory `/usr/src/proxy-suite-1.7/common' make: *** [all] Error 1 I did a ´man ctags´ after that, but there is nothing explained about an option -w. Next - although not knowing what it meant - I deleted the -w from the corresponding Makefiles. Afterwards compilation went a little further but finally produced: gcc -g -O2 -c -I. -I.. -I../common ftp-cmds.c ftp-cmds.c: In function `cmds_user': ftp-cmds.c:374: structure has no member named `regex' ftp-cmds.c:376: structure has no member named `regex' ftp-cmds.c:376: warning: assignment makes pointer from integer without a cast make[1]: *** [ftp-cmds.o] Error 1 make[1]: Leaving directory `/usr/src/proxy-suite-1.7/ftp-proxy' make: *** [all] Error 1 OK. I searched and found an option to configure, called --with-regex, so I did: ./configure --with-regex make (Don´t blame me. I´m not a programmer. It was just trial and error.) Again it went a little further, producing: proc_ftp.c:134: warning: initialization from incompatible pointer type proc_ftp.c:135: warning: initialization from incompatible pointer type proc_ftp.c:151: warning: initialization from incompatible pointer type proc_ftp.c:167: warning: excess elements in struct initializer proc_ftp.c:167: warning: (near initialization for `proc_ftp_inode_operations') proc_ftp.c:168: warning: excess elements in struct initializer proc_ftp.c:168: warning: (near initialization for `proc_ftp_inode_operations') proc_ftp.c:169: warning: excess elements in struct initializer proc_ftp.c:169: warning: (near initialization for `proc_ftp_inode_operations') proc_ftp.c:170: warning: excess elements in struct initializer proc_ftp.c:170: warning: (near initialization for `proc_ftp_inode_operations') ... at least no more error messages, but lots of warnings. cit. white paper: "The program should not display any warnings or errors." So what is this all about. Where´s the mistake? I will try to go on but what will I end up with? Anybody out there who knows the answer? Thanks a lot.

1 0