November 2002 - SUSE Proxy Suite - openSUSE Mailing Lists

proxy-suite-1.9 avaliable - feature release
by Marius Tomaschewski 11 May '03

11 May '03

Hi! The proxy-suite-1.9.tar.gz archive is avaliable on ftp://ftp.suse.com/pub/projects/proxy-suite/src/ and its mirror sites, i.e. ftp://ftp.gwdg.de in /pub/linux/suse/ftp.suse.com/projects/proxy-suite/src/ * 1.9 - released 2002-05-02 ----------------------------------- - implemented user authentication - currently ldap based only - updated documentation, merged with v1.8.2.2 fixes Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 1

Re: Re: Re: Re: [proxy-suite] USER-WRN bad 'USER@' dest
by Frank Sackewitz 02 Dec '02

02 Dec '02

1st sorry for the delay, was on businesstrip! Marius Tomaschewski wrote: >On Thu, Nov 21, 2002 at 10:28:00AM +0100, Frank Sackewitz wrote: >> Hi, > >Hi! > Shark! (german joke!) >> I´ve to apologize to the proxy-suite-team. The mistake was sitting in >> front of the screen. >> >> ftp-proxy works fine if I start it out of my chroot. Running in my >> chroot-envir ftp-proxy is >> unable to resolve IP-Addresses via bind. Via host it works. >> >> What functions uses ftp-proxy to resolve addresses via bind? >> Does it call any binary? > <No, it uses normal glibc functions gethostname, gethostbyname >and inet_aton, inet_ntoa. No direct resolver calls are used. > >The glibc is using the NSS stuff (name service switch), i.e. >/etc/nsswitch.conf, /etc/resolv.conf, libnss_dns, libnsl, >libresolv. You need them all - config+libs - in your chroot. > As I said - all files where there. >Note also: if you do any changes to these files, you have to >restart/reload the nscd (name service caching daemon). > I´m not sure, but I think I hav´nt change anything. >Try to strace it. Start the proxy, connect using the clinent, >find out the pid of the child process and attach strace to it: > > strace -f -o filename -p PID > >After strace is running, login using MagicChar with hostname. >You should be able to see, what happens / fails. > Part of the output: 29650 recv(0, "USER anonymous(a)ftp.de.openbsd.or"..., 35, 0) = 35 => I have typed in: .org 30226 recv(0, "USER anonymous(a)ftp.de.openbsd.or"..., 36, 0) = 36 30226 gettimeofday({1038481617, 376494}, NULL) = 0 30226 getpid() = 30226 30226 open("/etc/resolv.conf", O_RDONLY) = 3 30226 fstat64(3, {st_mode=S_IFREG|0644, st_size=90, ...}) = 0 30226 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40018000 30226 read(3, "nameserver 193.101.111.10\nnamese"..., 4096) = 90 30226 read(3, "", 4096) = 0 30226 close(3) = 0 30226 munmap(0x40018000, 4096) = 0 30226 getpid() = 30226 30226 open("/etc/resolv.conf", O_RDONLY) = 3 30226 fstat64(3, {st_mode=S_IFREG|0644, st_size=90, ...}) = 0 30226 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40018000 30226 read(3, "nameserver 193.101.111.10\nnamese"..., 4096) = 90 30226 read(3, "", 4096) = 0 30226 close(3) = 0 30226 munmap(0x40018000, 4096) = 0 30226 socket(PF_UNIX, SOCK_STREAM, 0) = 3 30226 connect(3, {sin_family=AF_UNIX, path="/var/run/.nscd_socket"}, 110) = -1 ENOENT (No such file or directory) 30226 close(3) = 0 30226 open("/etc/host.conf", O_RDONLY) = 3 30226 fstat64(3, {st_mode=S_IFREG|0644, st_size=370, ...}) = 0 30226 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40018000 30226 read(3, "#\n# /etc/host.conf - resolver co"..., 4096) = 370 30226 read(3, "", 4096) = 0 30226 close(3) = 0 30226 munmap(0x40018000, 4096) = 0 30226 open("/etc/hosts", O_RDONLY) = 3 30226 fcntl64(3, F_GETFD) = 0 30226 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 30226 fstat64(3, {st_mode=S_IFREG|0644, st_size=917, ...}) = 0 30226 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40018000 30226 read(3, "#\n# hosts This file desc"..., 4096) = 917 30226 read(3, "", 4096) = 0 30226 close(3) = 0 30226 munmap(0x40018000, 4096) = 0 30226 open("/etc/ld.so.cache", O_RDONLY) = 3 30226 fstat64(3, {st_mode=S_IFREG|0644, st_size=64, ...}) = 0 30226 old_mmap(NULL, 64, PROT_READ, MAP_PRIVATE, 3, 0) = 0x40018000 30226 close(3) = 0 30226 open("/lib/i586/mmx/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 30226 stat64("/lib/i586/mmx", 0xbfffc3dc) = -1 ENOENT (No such file or directory) 30226 open("/lib/i586/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 30226 stat64("/lib/i586", 0xbfffc3dc) = -1 ENOENT (No such file or directory) 30226 open("/lib/mmx/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 30226 stat64("/lib/mmx", 0xbfffc3dc) = -1 ENOENT (No such file or directory) 30226 open("/lib/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 30226 stat64("/lib", {st_mode=S_IFDIR|0755, st_size=272, ...}) = 0 30226 open("/usr/lib/i586/mmx/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 30226 stat64("/usr/lib/i586/mmx", 0xbfffc3dc) = -1 ENOENT (No such file or directory) 30226 open("/usr/lib/i586/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 30226 stat64("/usr/lib/i586", 0xbfffc3dc) = -1 ENOENT (No such file or directory) 30226 open("/usr/lib/mmx/libnss_dns.so.2", O_RDONLY) = -1 ENOENT (No such file or directory) 30226 stat64("/usr/lib/mmx", 0xbfffc3dc) = -1 ENOENT (No such file or directory) 30226 open("/usr/lib/libnss_dns.so.2", O_RDONLY) = 3 30226 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0`\16\0\000"..., 1024) = 1024 30226 fstat64(3, {st_mode=S_IFREG|0755, st_size=16184, ...}) = 0 30226 old_mmap(NULL, 15560, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x40415000 30226 mprotect(0x40418000, 3272, PROT_NONE) = 0 30226 old_mmap(0x40418000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 3, 0x2000) = 0x40418000 30226 close(3) = 0 30226 munmap(0x40018000, 64) = 0 30226 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 30226 connect(3, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("193.101.111.10")}}, 28) = 0 30226 send(3, "0n\1\0\0\1\0\0\0\0\0\0\3ftp\2de\7openbsd\4org "..., 37, 0) = 37 30226 gettimeofday({1038481617, 444069}, NULL) = 0 30226 poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 5000) = 1 30226 recvfrom(3, "0n\205\203\0\1\0\0\0\1\0\0\3ftp\2de\7openbsd\4org "..., 1024, 0, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("193.101.111.10")}}, [16]) = 112 30226 close(3) = 0 30226 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 30226 connect(3, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("193.101.111.10")}}, 28) = 0 30226 send(3, "0o\1\0\0\1\0\0\0\0\0\0\3ftp\2de\7openbsd\4org "..., 46, 0) = 46 30226 gettimeofday({1038481617, 716641}, NULL) = 0 30226 poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 5000) = 1 30226 recvfrom(3, "0o\205\203\0\1\0\0\0\1\0\0\3ftp\2de\7openbsd\4org "..., 1024, 0, {sin_family=AF_INET, sin_port=htons(53), sin_addr=inet_addr("193.101.111.10")}}, [16]) = 121 30226 close(3) = 0 30226 time([1038481617]) = 1038481617 30226 getpid() = 30226 30226 write(4, "ftp-child [30226] <11/28-11:06:5"..., 105) = 105 30226 select(1, [0], [0], NULL, {900, 0}) = 1 (out [0], left {900, 0}) 30226 send(0, "501 Invalid destination in user "..., 39, 0) = 39 30226 select(1, [0], [], NULL, {900, 0} <unfinished ...> -- Bye Frank Sackewitz EDM HASCO-GERMANY

3 2

Log parsing
by Arkadi Colson 28 Nov '02

28 Nov '02

Does anyone have some kind of log parser for the proxy-suite loggings? regards, Arkadi

1 0

Re: Re: Re: [proxy-suite] USER-WRN bad 'USER@' dest
by Frank Sackewitz 22 Nov '02

22 Nov '02

Hi, I´ve to apologize to the proxy-suite-team. The mistake was sitting in front of the screen. ftp-proxy works fine if I start it out of my chroot. Running in my chroot-envir ftp-proxy is unable to resolve IP-Addresses via bind. Via host it works. What functions uses ftp-proxy to resolve addresses via bind? Does it call any binary? -- Bye Frank Sackewitz EDM HASCO-GERMANY

2 1

Antwort: Re: Re: [proxy-suite] USER-WRN bad 'USER@' dest
by Frank Sackewitz 20 Nov '02

20 Nov '02

Marius Tomaschewski <mt(a)suse.de> 20.11.2002 16:37 An: Frank Sackewitz <FSackewitz(a)hasco.com> Kopie: proxy-suite(a)suse.com Thema: Re: Re: [proxy-suite] USER-WRN bad 'USER@' dest >On Wed, Nov 20, 2002 at 04:03:12PM +0100, Frank Sackewitz wrote: >> >> It works (in parts): >> >> # ftp 192.168.127.225 >> Connected to 192.168.127.225. >> 220 sordns FTP server (Version 1.8.1 - 2002/01/29 00:30:00) ready. >> Name (192.168.127.225:anton): anonymous(a)ftp.de.openbsd.org >> 501 Invalid destination in user name. >> Login failed. >> ftp> user ftp(a)130.133.1.100 >> 331 Anonymous login ok, send anything as password. >> Password: >> 230- >> Welcome at Freie Universität Berlin, Germany. >> Willkommen auf dem FTP-Server der Freien Universität Berlin. >> Ein Service der Zentraleinrichtung für Datenverarbeitung (ZEDAT). >> >> 230 Anonymous login ok. >> ftp> quit >> 221 Goodbye. > >OK. As I said, the proxy is not able to resolv hostnames >in your chroot, because the some files are missed there. > >Are you using DNS for resolving? Do you have something >like this in these files (needed in chroot dir as well! ): > >/etc/nsswitch.conf >hosts: files dns >networks: files dns > >/etc/resolv.conf >domain your-domain.top >search your-domain.top >nameserver 192.168.x.y > >/etc/host.conf >order hosts, bind >multi on All Files are there, but I´m afraid the problem is on the bind running on that system. If I put the name and the address in hosts, everything works fine. But why ping can resolve the name if I try it on the console? OK, the ping is not running in this chroot. But all files are there where there should be. sordns:/var/ftp-proxy/rundir/etc # less host.conf ... order bind, hosts multi on sordns:/var/ftp-proxy/rundir/etc # less nsswitch.conf ... hosts: files dns networks: files dns sordns:/var/ftp-proxy/rundir/etc # less resolv.conf nameserver 193.101.111.10 nameserver 193.101.111.20 ... -- Bye Frank Sackewitz EDM HASCO-GERMANY

1 0

Re: Re: [proxy-suite] USER-WRN bad 'USER@' dest
by Frank Sackewitz 20 Nov '02

20 Nov '02

Marius Tomaschewski <mt(a)suse.de> 20.11.2002 15:14 An: Frank Sackewitz <FSackewitz(a)hasco.com> Kopie: proxy-suite(a)suse.com Thema: Re: [proxy-suite] Antwort: Re: [proxy-suite] USER-WRN bad 'USER@' dest >On Wed, Nov 20, 2002 at 02:31:21PM +0100, Frank Sackewitz wrote: >> Hi, > >Hi! > >> I made the changes on the startscript as described below but the same >> behavoir. >> >> sordns:~ # ps -e |grep ftp >> 673 ? 00:00:00 ftp-proxy >> >> sordns:~ # less /proc/673/maps |grep /lib/libnsl -B2 -A2 >> 4016c000-40175000 r-xp 00000000 08:02 21824 /usr/lib/liblber.so.2.0.15 >> 40175000-40176000 rw-p 00008000 08:02 21824 /usr/lib/liblber.so.2.0.15 >> 40176000-40188000 r-xp 00000000 08:02 9446 /lib/libnsl.so.1 >> 40188000-4018a000 rw-p 00011000 08:02 9446 /lib/libnsl.so.1 >> 4018a000-4018d000 rw-p 00000000 00:00 0 >> 4018d000-4019a000 r-xp 00000000 08:02 9456 /lib/libresolv.so.2 >> >> The Library is there and is used. > >Hmm... the proxy is not able to resolv hostnames... something >is missed in the chroot. Perhaps some NSS specials you use? > >Make sure, the proxy works propelly without a chroot first. > >$ host ftp.de.openbsd.org >ftp.de.openbsd.org is a nickname for ftp.fu-berlin.de >ftp.fu-berlin.de has address 130.133.1.100 >ftp.fu-berlin.de mail is handled (pri=10) by ftp.fu-berlin.de >ftp.fu-berlin.de mail is handled (pri=20) by mail.fu-berlin.de > >Try out if ftp(a)130.133.1.100" in USER works (MagicUser mode). > It works (in parts): # ftp 192.168.127.225 Connected to 192.168.127.225. 220 sordns FTP server (Version 1.8.1 - 2002/01/29 00:30:00) ready. Name (192.168.127.225:anton): anonymous(a)ftp.de.openbsd.org 501 Invalid destination in user name. Login failed. ftp> user ftp(a)130.133.1.100 331 Anonymous login ok, send anything as password. Password: 230- Welcome at Freie Universität Berlin, Germany. Willkommen auf dem FTP-Server der Freien Universität Berlin. Ein Service der Zentraleinrichtung für Datenverarbeitung (ZEDAT). 230 Anonymous login ok. ftp> quit 221 Goodbye. ftp-child [1348] <11/20-16:29:27> USER-INF connect from 192.168.1.11 ftp-child [1348] <11/20-16:29:33> USER-WRN bad 'USER@' dest 'ftp.de.openbsd.org:(nil)' from 192.168.1.11 ftp-child [1348] <11/20-16:30:03> USER-INF 'USER ftp' dest 130.133.1.100:21 from 192.168.1.11 ftp-child [1348] <11/20-16:30:03> USER-INF reading data for 'ftp' from cfg-file ftp-child [1348] <11/20-16:30:03> TECH-DBG from Server-PI (3): '220 FTP.FU-Berlin.DE ready, please login as user "ftp".' ftp-child [1348] <11/20-16:30:03> TECH-DBG from Server-PI (3): '331 Anonymous login ok, send anything as password.' ftp-child [1348] <11/20-16:30:05> USER-INF 'PASS XXXX' from 192.168.1.11 ftp-child [1348] <11/20-16:30:05> TECH-DBG from Server-PI (3): '230-' ftp-child [1348] <11/20-16:30:05> TECH-DBG from Server-PI (3): ' Welcome at Freie Universität Berlin, Germany.' ftp-child [1348] <11/20-16:30:05> TECH-DBG from Server-PI (3): ' Willkommen auf dem FTP-Server der Freien Universität Berlin.' ftp-child [1348] <11/20-16:30:05> TECH-DBG from Server-PI (3): ' Ein Service der Zentraleinrichtung für Datenverarbeitung (ZEDAT).' ftp-child [1348] <11/20-16:30:05> TECH-DBG from Server-PI (3): ' ' ftp-child [1348] <11/20-16:30:05> TECH-DBG from Server-PI (3): '230 Anonymous login ok.' ftp-child [1348] <11/20-16:30:07> USER-INF 'QUIT' from 192.168.1.11 ftp-child [1348] <11/20-16:30:07> USER-INF closing connect from 192.168.1.11 after 40 secs - read 0/0, sent 0/0 byte/sec On a console on sordns they can resolve the name ftp.de.openbsd.org. -- Bye Frank Sackewitz EDM HASCO-GERMANY

2 1

Antwort: Re: [proxy-suite] USER-WRN bad 'USER@' dest
by Frank Sackewitz 20 Nov '02

20 Nov '02

Hi, I made the changes on the startscript as described below but the same behavoir. sordns:~ # ps -e |grep ftp 673 ? 00:00:00 ftp-proxy sordns:~ # less /proc/673/maps |grep /lib/libnsl -B2 -A2 4016c000-40175000 r-xp 00000000 08:02 21824 /usr/lib/liblber.so.2.0.15 40175000-40176000 rw-p 00008000 08:02 21824 /usr/lib/liblber.so.2.0.15 40176000-40188000 r-xp 00000000 08:02 9446 /lib/libnsl.so.1 40188000-4018a000 rw-p 00011000 08:02 9446 /lib/libnsl.so.1 4018a000-4018d000 rw-p 00000000 00:00 0 4018d000-4019a000 r-xp 00000000 08:02 9456 /lib/libresolv.so.2 The Library is there and is used. -- Bye Frank Sackewitz EDM HASCO-GERMANY Marius Tomaschewski <mt(a)suse.de> 20.11.2002 13:44 An: proxy-suite(a)suse.com Kopie: Thema: Re: [proxy-suite] USER-WRN bad 'USER@' dest On Wed, Nov 20, 2002 at 08:19:26AM +0100, Frank Sackewitz wrote: > Hi folks, Hi! You are running the proxy in a chroot. I mean there is a library missed - try to add the nsl-library to your script: --- ftp-proxy/rc.script.in +++ ftp-proxy/rc.script.in 2002/07/18 23:41:35 @@ -389,7 +360,7 @@ # copy/update nss libraries if [ -f /etc/nsswitch.conf ] ; then - LIBS="/lib/libnss* /lib/libresolv* /lib/libdb*" + LIBS="/lib/libnss* /lib/libnsl* /lib/libresolv* /lib/libdb*" fi [ -n "$LIBS" ] && for lib in $LIBS ; do if [ -n "$lib" ] && [ -x "$lib" ] ; then Gruesse, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg -- Product Developement PGP public key on: http://www.suse.de/~mt/mt.pgp DF17 271A AD15 006A 5BB9 6C96 CA2F F3F7 373A 1CC0 --------------------------------------------------------------------- To unsubscribe, e-mail: proxy-suite-unsubscribe(a)suse.com For additional commands, e-mail: proxy-suite-help(a)suse.com

2 1

Re: Re: [proxy-suite] USER-WRN bad 'USER@' dest
by Frank Sackewitz 20 Nov '02

20 Nov '02

Hi, I dont want to do any firewalling nor NAT. The server is behind a separate firewall. I certainly had a look in the TransProxy-Mini-Howto, but i just could´nd repeat the first example connection before they apply the rules. -- Bye Frank Sackewitz EDM HASCO-GERMANY Marius Tomaschewski <mt(a)suse.de> 20.11.2002 14:59 An: Frank Sackewitz <FSackewitz(a)hasco.com> Kopie: proxy-suite(a)suse.com Thema: Re: Antwort: Re: [proxy-suite] USER-WRN bad 'USER@' dest On Wed, Nov 20, 2002 at 02:32:38PM +0100, Frank Sackewitz wrote: > Hi, Hi! > sorry I forgot to mention that the system is running SuSE 8.0. OK. see also TransProxy-Mini-Howto.txt The ipchains (emulation or compatibility mode) on 2.4.x kernel does not contain the transparent proxy support/hook. With 2.4.x kernel, you have to use "native" iptables NAT rules. > Do I need the patch anyway? No, it is not needed there - it is the OpenBSD 3.x pf support. Gruesse, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg -- Product Developement PGP public key on: http://www.suse.de/~mt/mt.pgp DF17 271A AD15 006A 5BB9 6C96 CA2F F3F7 373A 1CC0

1 0

Re: Antwort: Re: [proxy-suite] USER-WRN bad 'USER@' dest
by Marius Tomaschewski 20 Nov '02

20 Nov '02

On Wed, Nov 20, 2002 at 02:32:38PM +0100, Frank Sackewitz wrote: > Hi, Hi! > sorry I forgot to mention that the system is running SuSE 8.0. OK. see also TransProxy-Mini-Howto.txt The ipchains (emulation or compatibility mode) on 2.4.x kernel does not contain the transparent proxy support/hook. With 2.4.x kernel, you have to use "native" iptables NAT rules. > Do I need the patch anyway? No, it is not needed there - it is the OpenBSD 3.x pf support. Gruesse, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg -- Product Developement PGP public key on: http://www.suse.de/~mt/mt.pgp DF17 271A AD15 006A 5BB9 6C96 CA2F F3F7 373A 1CC0

1 0

Antwort: Re: [proxy-suite] USER-WRN bad 'USER@' dest
by Frank Sackewitz 20 Nov '02

20 Nov '02

Hi, sorry I forgot to mention that the system is running SuSE 8.0. Do I need the patch anyway? -- Bye Frank Sackewitz EDM HASCO-GERMANY Marius Tomaschewski <mt(a)suse.de> 20.11.2002 13:55 An: proxy-suite(a)suse.com Kopie: Frank Sackewitz <FSackewitz(a)hasco.com> Thema: Re: [proxy-suite] USER-WRN bad 'USER@' dest On Wed, Nov 20, 2002 at 08:19:26AM +0100, Frank Sackewitz wrote: > Hi folks, Are you running the ftp-proxy on OpenBSD 3.x? If yes, you need this patch as well to get transparent mode working: ftp://ftp.suse.com/pub/projects/proxy-suite/patches/openbsd-3_pf.dif ftp://ftp.suse.com/pub/projects/proxy-suite/patches/openbsd-3_pf.txt Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg -- Product Developement PGP public key on: http://www.suse.de/~mt/mt.pgp DF17 271A AD15 006A 5BB9 6C96 CA2F F3F7 373A 1CC0

1 0