August 2002 - SUSE Proxy Suite - openSUSE Mailing Lists

proxy-suite-1.9 avaliable - feature release
by Marius Tomaschewski 11 May '03

11 May '03

Hi! The proxy-suite-1.9.tar.gz archive is avaliable on ftp://ftp.suse.com/pub/projects/proxy-suite/src/ and its mirror sites, i.e. ftp://ftp.gwdg.de in /pub/linux/suse/ftp.suse.com/projects/proxy-suite/src/ * 1.9 - released 2002-05-02 ----------------------------------- - implemented user authentication - currently ldap based only - updated documentation, merged with v1.8.2.2 fixes Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 1

Can't build data connection
by Emmanuel Halbwachs 06 Sep '02

06 Sep '02

Hello everybody, First of all, thank you to the developpers of ftp-proxy. I'm very happy that such a tool exists in open source. I am a new user of ftp-proxy and I am fighting with the problem (using an active mode client) : ftp> ls 200 PORT command successful. 425 Can't build data connection: Cannot assign requested address. or ftp> get foo.txt 200 PORT command successful. 425 Can't build data connection: Address already in use. I scratched my hair so often that I lost some, and now I have to ask some advices. Here is my context. It is very classic. My network is designed with two zones : - public zone with public IP address - private zone with private IP address A firewall (router) filters traffic between the two zones and the Internet. A ftp client in the private zone is not able to connect directly to a ftp server on the Internet, so I'd like to use ftp-proxy on one machine in the public zone. I want private client able to do download or upload from/to outside servers. Here is a piece of my poor ascii art : Private zone Public zone Router Internet ------------ ----------- ------ -------- ftp client ----------> ftp proxy -------(filter)----> ftp server The ftp-proxy (version 1.8-2) is installed on an Debian box, with the configuration below : # ftp-proxy -c Config-File: '/etc/ftp-proxy.conf' Config-Section ------ '(-global-)' Config: ActiveMaxDataPort = '40999' Config: ActiveMinDataPort = '40000' Config: AllowMagicUser = 'yes' Config: AllowTransProxy = 'no' Config: DestinationMaxPort = '42999' Config: DestinationMinPort = '42900' Config: Group = 'ftpproxy' Config: LogDestination = 'daemon' Config: LogLevel = 'INF' Config: MaxClients = '64' Config: MaxClientsMessage = '/etc/proxy-suite/ftp-maxclients.txt' Config: MaxClientsString = 'The server is full' Config: PidFile = '/var/run/ftp-proxy.pid' Config: ServerType = 'standalone' Config: User = 'ftpproxy' Config: WelcomeMessage = '/etc/proxy-suite/ftp-welcome.txt' Config: WelcomeString = 'Welcome to the ftp proxy server on %h' In order to figure out what's happening, I tried a ftp session from a private client to a private server (so I can monitor both) via the proxy : Private zone Public zone Private zone ------------ ----------- ------------ ftp client ----------> ftp proxy -----------> ftp server I observe the following behaviour : First, the proxy, has successfully established a control connexion to the server. Then, to established a data connexion, the proxy sends a PORT with the *same* port number that is already used. That's why, I suppose, the server tells the proxy via the control channel "Cannot assign requested address" or "Address already in use". Any advice ? Thanks in advance. Here is an exemple of wich port numbers are used : Client Proxy Server (10.5.0.4) (193.8.163.6) (any IP) ------- ------------------- ------ 35271 -----> 21 - - - > 42900 -----> 21 35271 <----- 21 < - - - 42900 <----- 21 The control channel is initiated by the client, and so does the proxy with the server. No problem. 35272 <----- 40000 The user do a "ls" or a "get", so the client sends to the proxy a PORT command : PORT 10,5,0,4,137,200 (35272). The proxy establishes the data connexion. No problem. 42900 <----- 20 The proxy sends to the server a PORT command : PORT 193,8,163,6,167,148 (42900). The server tries to establish the data connexion and fails : the port 42900 is already in use, by the control connexion. The server sends an error message to the proxy via the control channel, and the proxy sends it in turn to the client : "Can't build data connection" Strange, isn't it ? Or is it normal and have I missed something ? Any advice will help. Friendly yours, -- Emmanuel Halbwachs Laboratoire de Photonique et Nanostructures tél : 01 69 63 61 34 CNRS UPR 20 fax : 01 69 63 60 06 Route de Nozay mailto:Emmanuel.Halbwachs@lpn.cnrs.fr 91460 Marcoussis

2 2

Proxy-suite and transparent proxying on FreeBSD not working
by Henrik Holmstam 01 Sep '02

01 Sep '02

Hello all, I'm having trouble getting transparent proxying working on my FreeBSD 4.6-STABLE machine. Non-transparent works fine with MagicChar. I'm using IPFilter v3.4.27 to redirect the packets. ipnat.rules: rdr rl0 0.0.0.0/0 port 21 -> 192.168.1.1 port 2121 (rl0 is int interface) ftp-proxy.conf: [-Global-] AllowMagicUser yes AllowTransProxy yes DestinationTransferMode passive Listen 192.168.1.1 LogDestination /var/log/proxy-suite/ftp-proxy.log LogLevel DBG Port 2121 ServerType standalone UseMagicChar % turbo@sebulba:~$ ftp ftp.sunet.se Connected to ftp.sunet.se. 220 darkwing.home.lan FTP server (Version 1.9 - 2002/05/02 15:14:55) ready. Name (ftp.sunet.se:turbo): anonymous 501 Unknown destination address. ftp: Login failed. log: ftp-child [22788] <08/26-22:57:02> USER-INF connect from 192.168.1.15 ftp-child [22788] <08/26-22:57:05> TECH-DBG no transparent proxy destination found ftp-child [22788] <08/26-22:57:05> USER-ERR unknown destination address ftp-child [22788] <08/26-22:57:05> USER-WRN 'SYST' without login from 192.168.1.15 If I specify DestinationAddress to some server, it connects fine, so somehow it has trouble detecting the Destination when using normal transparent proxying. I would really like to get this working, so if anyone have any suggestions I would be thankful. Regards, Henrik Holmstam

3 4

Re: WG: failure notice
by Marius Tomaschewski 30 Aug '02

30 Aug '02

Hallo! RTFM - "man 5 ftp-proxy.conf": WelcomeString Global context only. Defines the string that is sent to the client in order to start login negotia tion. The string is prefixed with '220 ' and vari able substitution is applied to it. If this option is not given it defaults to the following string: '%h FTP server (%v - %b) ready'. See also WelcomeMessage option. WelcomeMessage Global context only. Defines the name of a file that will be displayed to all clients as the first action when they open the control connection. Each line is prefixed with '220-' and variable substitu tion is applied to it. If no such file exists it is silently ignored. See also WelcomeString option. The proxy does something like: if(WelcomeString) print("220 %s", WelcomeString); if(WelcomeMessage) { while(line=getline(WelcomeMessage)) print("220-%s", line); } On Thu, Aug 29, 2002 at 03:42:29PM +0200, Junge, Stefan wrote: > > Hello together ! > > Today I installed my first ftp-proxy with suse-proxy-suite. > > At the moment it still works fine ... > > My problem is : > How to change the server message at login ? > When I connect to my ftp-server I got the message > "220 servername FTP server (Version 1.7tp7 -2001/06/20 21:05:20) ready." > > I do not want to show the software version. > With proftpd e.g. I can change this message - but where in ftp-proxy.conf ? > > Greetings ... > Stefan Junge Gruesse, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 0

Possible a bug in v1.9
by Ruiyuan Jiang 19 Aug '02

19 Aug '02

Hi, We are testing using v1.9 on Solaris 9 with Sun Blade-100 hardware. I logged into a particular ftp server which uses ftp active connection. I tried the same command under my HP-UX client and my windows 2000 PC client to access the ftp server. It seems UNIX host is fine while my PC lost connection with the ftp server. Here is what I did and what I got: >From Windows 2000 PC client under DOS command prompt: c:\> ftp ftp-proxy.liz.com (my ftp proxy server) Connected to ftp-proxy.liz.com. 220 smtp3 FTP server (Version 1.9 - 2002/05/02 15:14:55) ready. User (ftp-proxy.liz.com:(none)): ftp(a)208.7.93.233 331 Password required for ftp. Password: 230 User ftp logged in. ftp> ls khlapp997.0858371010 200 PORT command successful. 550 khlapp997.0858371010: No such file or directory ftp> bin 426 Connection closed; transfer aborted. 421 Service not available, closing control connection. ftp> quit 530 Not logged in. >From HP-UX client: $ ftp ftp-proxy.liz.com (my ftp proxy server) Connected to ftp-proxy.liz.com. 220 smtp3 FTP server (Version 1.9 - 2002/05/02 15:14:55) ready. User (ftp-proxy.liz.com:(none)): ftp(a)208.7.93.233 331 Password required for ftp. Password: 230 User ftp logged in. Remote system type is UNIX. Using binary mode to transfer files. ftp> ls khlapp997.0858371010 200 PORT command successful. 150 Opening ASCII mode data connection for file list. 226-Transfer complete. 226 Quotes on: using 364544.00 of 65000000.00 bytes ftp> bin 200 Type set to I. ftp> quit 221 Goodbye. $ As we see here, if the file is not there on the ftp server, PC client is being disconnected while UNIX client is still connected. Does anyone know why this happens? Attacheed is the output from proxy server log, one is from PC client and one is from UNIX client. Thanks in advance. Ruiyuan Jian Liz Claiborne, Inc. <<ftp-proxy.log.UNIX>> <<ftp-proxy.log.PC>>

1 0

Re: [proxy-suite] Problem with LDAP reading values
by Jonathan Zuilkowski 19 Aug '02

19 Aug '02

Thanks for the response. Let me know when you have a fix. I'm eager to test it. >From: Marius Tomaschewski <mt(a)suse.de> >To: proxy-suite(a)suse.com >CC: Jonathan Zuilkowski <j_zuilkowski(a)hotmail.com> >Subject: Re: [proxy-suite] Problem with LDAP reading values >Date: Mon, 12 Aug 2002 12:28:14 +0200 > >On Wed, Aug 07, 2002 at 06:11:47PM -0400, Jonathan Zuilkowski wrote: > > Hi, > >Hi! > >Yes, I see the problem in the proxy-suite-1.9 as you >have explained. > > > #if defined(HAVE_LIBLDAP) > > /* > > ** If an LDAP server is configured, insist on using it > > */ > > > > #################this doesn't seem to work #################### > > //if ((p = config_str(NULL, "LDAPServer", NULL)) != NULL) { > > // int rc = ldap_fetch(ctx, p, who, pwd); > > /* > > ** check if we have to read profile from config... > > */ > > // syslog_write(T_DBG, "ldap_fetch returned %d", rc); > > // if(0 != rc) return rc; > > // } > > > > ################I got this from 1.8.2.2 ######################### > > > > if ((p = config_str(NULL, "LDAPServer", NULL)) != NULL) { > > int rc; > > if ((rc = ldap_fetch(ctx, p, who, pwd)) != LDAP_SUCCESS) >{ > > errno = 0; > > syslog_write(T_DBG, "can't read LDAP data " > > "for %s: %.512s", > > ctx->cli_ctrl->peer, > > ldap_err2string(lderr)); > > exit(EXIT_FAILURE); > > } > > if (ctx->srv_addr != (u_int32_t) 0) { > > syslog_write(U_INF, > > "reading data for '%s' from LDAP", > > ctx->username); > > return 0; /* LDAP has delivered */ > > } > > } > > > > #endif > >Yes. This is the bug place. > >The fallback to user config from file is broken in 1.9; >the user config is read from file if all needed ldap >fetches succeed... > >I'll try to fix it this week (or weekend) - it's needed >to rewrite and test the fallback code. > >It can't be done that simple way as in 1.8, because the >user config should be read from file if LDAPAuthDN is >used, but no LDAPBaseDN... > > LDAPBaseDN: dn for user config _and_ auth > LDAPAuthDN: dn for auth only > >Kind regards, > Marius Tomaschewski <mt(a)suse.de> >-- > SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement > PGP public key available: http://www.suse.de/~mt/mt.pgp > Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18 _________________________________________________________________ Send and receive Hotmail on your mobile device: http://mobile.msn.com

2 1

Browser Error When Using Proxy Server
by Ruiyuan Jiang 16 Aug '02

16 Aug '02

Hi, all I tried to use Netscape browser (on a particular HP-UX 11.0) to access ftp servers on the Internet (testing). The way set up is: HP-UX server (model N4000) ---> Cacheflow proxy appliance (on the same internal corporate subnet as HP-UX host and is configured as ftp forwarding mode to forward requests to ftp proxy server) ---> Solaris 9 ftp proxy server (v1.9 Sun Blade-100) at DMZ ---> ftp servers (on the Internet) On the HP-UX host, I started Netscape browser (the browser is configured to direct connect to Internet while the default route goes to Cacheflow box) and typed URL, ftp://ftp.netscape.com and I got an error message from the browser: FTP Error Could not login to FTP server Unknow destination address. From the proxy server log, I saw a message (debuging mode): ftp-child: USER-INF connect from (IP address of Cacheflow appliance) ftp-child: TECH-DBG ipchains transparent destination: (IP address of ftp proxy server) ftp-child: TECH-DBG requested transparent destination (IP address of ftp proxy server is local) ftp-child: USER-ERR unknown destination address ftp-child: TECH-DBG zero bytes to read reported: Cli-Ctrl 0=(IP address of Cacheflow appliance) ftp-child: USER-INF closing connect from (IP address of Cacheflow appliance) after 0 secs - read 0/0, sent 0/0 byte/sec On the same HP-UX host, if I do the same thing from the command line: $ ftp ftp.netscape.com Connected to ftp.gftp.netscape.com 220 smtp3 FTP server (Version 1.9 - 2002/05/02 15:14:55) ready. Name (ftp.netscape.com:abc): anonymous(a)ftp.netscape.com 331 Guest login ok, send your complete e-mail address as password. Password: 230 Guest login ok, access restrictions apply. Remote system type is UNIX. Using binary mode to transfer files. ftp> I am able to access ftp servers on the Internet from the command line. Does anyone know how do I configure the browser to let me access ftp servers using my ftp proxy server. Thanks. Ruiyuan Jiang Senior UNIX administrator Liz Claiborne, Inc. (201) 295-7171

1 0

Re: [proxy-suite] Passive and Active ftp mode
by Marius Tomaschewski 14 Aug '02

14 Aug '02

On Tue, Aug 13, 2002 at 08:09:26AM -0400, Ruiyuan Jiang wrote: > I let tcp high port traffic pass through firewall from proxy > server to ftp client and it works. OK, thanx for the info! Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 0

RE: [proxy-suite] Passive and Active ftp mode
by Ruiyuan Jiang 13 Aug '02

13 Aug '02

Yes, Marius The client is in the corporate internal network and proxy server is in the DMZ zone. In this case, I don't use NAT between ftp client and proxy server. I guess from proxy server to ftp server connection may do NAT which on ftp server side it shows proxy server IP address incoming, right, Marius? What is netcat? I don't see it on my Solaris and HP-UX boxes. Is it snope on Solaris or nettl on HP-UX? Does proxy server need to initiate connection to ftp client also? My setup is that ftp client initiate connection to ftp proxy server and ftp proxy server can't initiate connection to ftp client which is blocked by firewall. I just made it worked followed your suggestion. Thanks. Ruiyuan Jiang Liz Claiborne, Inc. -----Original Message----- From: Marius Tomaschewski [mailto:mt@suse.de] Sent: Monday, August 12, 2002 11:53 AM To: Ruiyuan Jiang Cc: proxy-suite(a)suse.com Subject: Re: [proxy-suite] Passive and Active ftp mode On Mon, Aug 12, 2002 at 11:18:38AM -0400, Ruiyuan Jiang wrote: > Thanks for your answer, Marius Hi! > I changed SockBindRand to "yes" in the proxy configuration file > and officially register the box on the DNS server. But I got the > same thing. I don't see any messages in the syslog, etc. > I do see a message in proxy server log once "ls" command in ftp > session connection timed out and got back to ftp> prompt: > > ftp-child: TECH-ERR can't connect Cli-Data for 156.146.239.33 The proxy isn't able to connect (data transfer) back to the client. > What else can I do? Thanks. The clients are in your internal network, right? Start i.e. netcat on one of your ftp client machines: netcat -v -t -l -p 50021 Try to connect the it from the proxy machine: netcat -v -t ftp-client01 50021 Type "hello" - you should see it on the other machine. Only if this test has worked, the proxy is able to support active ftp on the client side. There souldn't be any NAT or Masquerading between the proxy and the client. It is possible to use NAT between proxy and server - you may need to set TranslatedAddress propelly in some cases. Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

2 1

RE: [proxy-suite] Passive and Active ftp mode
by Ruiyuan Jiang 12 Aug '02

12 Aug '02

Thanks for your answer, Marius I changed SockBindRand to "yes" in the proxy configuration file and officially register the box on the DNS server. But I got the same thing. I don't see any messages in the syslog, etc. I do see a message in proxy server log once "ls" command in ftp session connection timed out and got back to ftp> prompt: ftp-child: TECH-ERR can't connect Cli-Data for 156.146.239.33 What else can I do? Thanks. Ruiyuan Jiang Liz Claiborne, Inc. -----Original Message----- From: Marius Tomaschewski [mailto:mt@suse.de] Sent: Monday, August 12, 2002 6:43 AM To: Ruiyuan Jiang Cc: proxy-suite(a)suse.com Subject: Re: [proxy-suite] Passive and Active ftp mode On Fri, Aug 09, 2002 at 11:35:23AM -0400, Ruiyuan Jiang wrote: > Hi, all Hi! > In my ftp-proxy.conf file, I have enabled "DestinationTransferMode client" > which I believe that transfer mode is decided by whoever starts ftp session > not by ftp proxy server. Yes, "DestinationTransferMode client" is the right flag to allow users to select the transfer mode (active or passive ftp) to server. > Generally we run ftp passive mode and the command is issued by ftp users > from their PCs, etc which runs great. But we have a particular ftp site > which requires ftp active mode connection. When users login to the ftp > server, they can't do anything such as ls, dir command after a while they > get a message "can't open data connection". If you are using "DestinationTransferMode client" the proxy have to be able to do active transfers - it should run on a machine with an official IP. Take a look into the syslog messages, there may be different reasons (you can see them in syslog messages) for the "425 Can't open data connection" answer from proxy, i.e.: bad PASV 277 response from server ... can't connect Srv-Data ... can't connect Cli-Data ... Cli-Data: can't bind to ... Srv-Data: can't bind to ... > The message to me is that ftp > data connection port problem. What configuration that I have to change to > make it happen? My guess is that parameter "ActiveMinDataPort 40000" and > "ActiveMaxDataPort 40999" cause the problem but they are commented out in > the configuration file. You may use "SockBindRand yes" as well if you are using port ranges. > I have enabled TCP Wrapper and chroot functions on > the proxy server. Does anyone know the problem? Thanks. By the way, we run > proxy server v1.9 on Solaris 9, Sun Blade 100 and attached configuration > file. Marius, I have compiled the patch you sent me for the Solaris error > but I have not installed and tested because my users are using it. OK. Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18 --------------------------------------------------------------------- To unsubscribe, e-mail: proxy-suite-unsubscribe(a)suse.com For additional commands, e-mail: proxy-suite-help(a)suse.com

2 1