At 12:00 PM 9/02/2001, you wrote:
At 10:31 PM 5/02/2001, you wrote:
Ftp will only work as ftp over http (e.g. the ftp your browser uses)
This is only partially correct. It is actually not possible to transparently redirect ftp due to the number of ports it uses. This is only partially correct. You can't transparently redirect active ftp, but I guess it's possible to do it with passive ftp, just with some PASV
On Thursday 08 February 2001 20:27, you wrote: tricks. Take a look at suseproxysuite, it _almost_ implement it.
Nope.. I run SuSE proxy suite.. It doesn't do this AT ALL. It is simply an ftp proxy. NOT a transparent one, although they may be adding this in future, I'm not sure. Transparent redirection is quite different to transparent proxying!!! What you are suggesting with "some PASV tricks" would definately NOT be a firewall rule but rather and application level proxy (like TIS) in conjunction with packet filter rules.. TIS infact CAN transparently proxy active ftp. My last email was pointing out that there is currently no way to do this on Linux without TIS which does not have a viable license for most people.
You can transparently proxy ftp, but not with squid. The only transparent ftp proxy that currently works on Linux (that I know of) is the one in the TIS Firewall Toolkit (http://www.tis.com) (This is the same one that is in gauntlet firewall on solaris) TIS has a very restrictive liscence, basically you have to be an educational institution, or you have to buy gauntlet.
You may wish to wait for SuSE 7.1 with kernel 2.4.x with all the netfilter and iptables stuff as it is much more powerful. I had a long talk to Rusty and a one of the other Linux firewall people at http://linux.conf.au and Rusty is talking about adding some transparent application level proxies to netfilter, but this probably will not happen for 6 months. (Rusty is the guy who wrote IPCHAINS as well as NETFILTER and IPTABLES and all the associated kernel bells and whistles) I hope he does do this in the near future, as it will mean linux has something that NO other OS does except Solaris with the addition of Gauntlet. (I have offered to do the documentation of some of this stuff for him, so you can be sure that I'll let you know when it happens :-)
So, to clarify, you CAN transparently redirect ftp over http by virtue that it is a http stream, however the only way to make you browser do ftp over http instead of normal ftp is to tell it that you have a proxy, which sorta defeats the purpose of transparent redirection. Sorry to give you the bad news... This is all in the squid doco if you feel like reading up on it more..
Cheers
--- Nix - nix@susesecurity.com http://www.susesecurity.com
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
--- Nix - nix@susesecurity.com http://www.susesecurity.com
On Thursday 08 February 2001 23:35, Nix wrote:
At 12:00 PM 9/02/2001, you wrote:
On Thursday 08 February 2001 20:27, you wrote:
At 10:31 PM 5/02/2001, you wrote:
Ftp will only work as ftp over http (e.g. the ftp your browser uses)
This is only partially correct. It is actually not possible to transparently redirect ftp due to the number of ports it uses.
This is only partially correct. You can't transparently redirect active ftp, but I guess it's possible to do it with passive ftp, just with some PASV tricks. Take a look at suseproxysuite, it _almost_ implement it.
Nope.. I run SuSE proxy suite.. It doesn't do this AT ALL. It is simply an ftp proxy. NOT a transparent one, although they may be adding this in future, I'm not sure.
Well, I run SuSE proxy suite 1.7 and if you take a look at the file TRANSPARENT_PROXY.txt with the docs you'll see that it's possible, but it's unstable code. You can also take a look at mmtcpfw, a ftp proxy/tcp redirector
Transparent redirection is quite different to transparent proxying!!! What you are suggesting with "some PASV tricks" would definately NOT be a firewall rule but rather and application level proxy (like TIS) in conjunction with packet filter rules..
OK, I really misunderstood when you said transparent redirection. SuSE Proxy Suite and TIS are application level + some ip level redirection. Passive ftp use predictables ports so you can redirect it. But you must intercept PORT/PASV, LPRT/LPSV and EPRT/EPSV and rewrite accordingly. I know it's application level, but so is mod_masq_ftp. This is the PASV trick I was talking about. AFAIK, except for some terminology (proxy, redirection, ip, application), it's possible to redirect passive ftp traffic this way. []s Davi
TIS infact CAN transparently proxy active ftp. My last email was pointing out that there is currently no way to do this on Linux without TIS which does not have a viable license for most people.
You can transparently proxy ftp, but not with squid. The only transparent ftp proxy that currently works on Linux (that I know of) is the one in the TIS Firewall Toolkit (http://www.tis.com) (This is the same one that is in gauntlet firewall on solaris) TIS has a very restrictive liscence, basically you have to be an educational institution, or you have to buy gauntlet.
You may wish to wait for SuSE 7.1 with kernel 2.4.x with all the netfilter and iptables stuff as it is much more powerful. I had a long talk to Rusty and a one of the other Linux firewall people at http://linux.conf.au and Rusty is talking about adding some transparent application level proxies to netfilter, but this probably will not happen for 6 months. (Rusty is the guy who wrote IPCHAINS as well as NETFILTER and IPTABLES and all the associated kernel bells and whistles) I hope he does do this in the near future, as it will mean linux has something that NO other OS does except Solaris with the addition of Gauntlet. (I have offered to do the documentation of some of this stuff for him, so you can be sure that I'll let you know when it happens :-)
So, to clarify, you CAN transparently redirect ftp over http by virtue that it is a http stream, however the only way to make you browser do ftp over http instead of normal ftp is to tell it that you have a proxy, which sorta defeats the purpose of transparent redirection. Sorry to give you the bad news... This is all in the squid doco if you feel like reading up on it more..
Cheers
--- Nix - nix@susesecurity.com http://www.susesecurity.com
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
--- Nix - nix@susesecurity.com http://www.susesecurity.com
--------------------------------------------------------------------- To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com
At 01:40 PM 9/02/2001, you wrote:
Well, I run SuSE proxy suite 1.7 and if you take a look at the file TRANSPARENT_PROXY.txt with the docs you'll see that it's possible, but it's unstable code. You can also take a look at mmtcpfw, a ftp proxy/tcp redirector
OK. I run whatever is with SuSE 7.0
Transparent redirection is quite different to transparent proxying!!! What you are suggesting with "some PASV tricks" would definately NOT be a firewall rule but rather and application level proxy (like TIS) in conjunction with packet filter rules..
OK, I really misunderstood when you said transparent redirection. SuSE Proxy Suite and TIS are application level + some ip level redirection.
Passive ftp use predictables ports so you can redirect it. But you must intercept PORT/PASV, LPRT/LPSV and EPRT/EPSV and rewrite accordingly. I know it's application level, but so is mod_masq_ftp. This is the PASV trick I was talking about. AFAIK, except for some terminology (proxy, redirection, ip, application), it's possible to redirect passive ftp traffic this way.
Yeah, well, all these modules will change when the transproxy stuff is written. It should pretty much do away with the need for the SuSE Proxy Suite.. There are probably still reasons where you would want to use it tho I spose.. --- Nix - nix@susesecurity.com http://www.susesecurity.com
How do I show every packets with tcpdump except those annoying unknow IPX data windows send to everywhere? It makes tcpdump output unreadable. []s Davi
Davi,
How do I show every packets with tcpdump except those annoying unknow IPX data windows send to everywhere? It makes tcpdump output unreadable.
Use ngrep with pcap filters instead ..you get much better control over the output. Adam
* Davi wrote on Tue, Feb 13, 2001 at 20:43 -0200:
How do I show every packets with tcpdump except those annoying unknow IPX data windows send to everywhere? It makes tcpdump output unreadable.
man tcpdump /filter I believe a "tcpdump ip" could be that what you need. oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.
Steffen, Thanks for your answer, it helps, but doesn't give me a solution. I also want GRE (ip proto 47) traffic as well, so tcpdump ip wouldn't help I need something as tcpdump ! ipx []s Davi On Wednesday 14 February 2001 09:03, Steffen Dettmer wrote:
* Davi wrote on Tue, Feb 13, 2001 at 20:43 -0200:
How do I show every packets with tcpdump except those annoying unknow IPX data windows send to everywhere? It makes tcpdump output unreadable.
man tcpdump /filter
I believe a "tcpdump ip" could be that what you need.
oki,
Steffen
* Davi wrote on Wed, Feb 14, 2001 at 16:20 -0200:
Thanks for your answer, it helps, but doesn't give me a solution. I also want GRE (ip proto 47) traffic as well, so tcpdump ip wouldn't help
ip proto 47 should be one of the ethernet ip protocols and should be matched by "ip". IPX is not a IP protocol IIRC, otherwise you could use something like: tcpdump ether proto ip or ether proto 47 but I think you could read the man page for youself... ;) oki, Steffen -- Dieses Schreiben wurde maschinell erstellt, es trägt daher weder Unterschrift noch Siegel.
participants (4)
-
Adam Daniel -
Davi -
Nix -
Steffen Dettmer