October 2000 - SUSE Proxy Suite - openSUSE Mailing Lists

data transfer aborts
by Ulrich Hiller 30 Oct '00

30 Oct '00

Dear all, we have problems getting big files over the proxy-suite server. First: our system is sun solaris 2.7 and the proxy-suite version is 1.7 Getting small files with ftp is no problem. But with bigger files (about 50k or bigger) the ftp-transfer aborts and gives the error message in the LogDestination file: TECH-ERR: can't ll_read Srv-Data -1=202.58.118.5 I don't know whether this is connected to my problem, but I also get USER-WRN 'MDTM' from 149.217.41.132 not allowed. Does anybody have an idea what could be wrong? Or do you need more information? Regards and thank you for the answer, Ulrich Hiller Ulrich Hiller Max-Planck-Institut fuer Astronomie Koenigstuhl 17 69117 Heidelberg Germany phone +49 6221 528238 fax +49 6221 528246 email hiller(a)mpia-hd.mpg.de

1 0

Re: ftp-proxy
by Marius Tomaschewski 23 Oct '00

23 Oct '00

On Sun, Oct 22, 2000 at 07:04:51PM -0700, Volker Wiegand wrote: > Hi, Hi! > I am currently a little bit overloaded, but I believe Marius can > help you find the answer. Marius, would you be so kind as to > answer Simon? > > Kind regards > Volker > > > > On Fri, 13 Oct 2000 STCassling(a)somerset.gov.uk wrote: > > > Hello Volker, > > > I realise you probably get many e-mail's but if you get them > > time to reply I would greatly appreciate it. The requirement we have > > is to proxy internal FTP clients to the Internet (where we can > > therefore control what sites they can FTP to). I plan to implement a direct support of destination control, but at the moment it is not supported by the proxy itself. > > I have tried to > > configure the ftp-proxy software but am currently getting the > > following error "TECH-ERR can't get peername for socket 0" - I have I need more info to say anything about, i.e. the config file, log / debug output. > > looked through the proxy-suite archive lists and although the question > > has been raised before there appears to be no answer, I have also > > noticed in the lists reference to a file "TRANSPARENT_PROXY.txt" but The transparent proxy version is not "official" at the moment. You can get it from: http://www.suse.de/~mt/proxy-suite/ 5894d4c80888bcfa4cb2e345676dc69e fwproxy-1.7tp3-0.i386.rpm 3522e255e0d8bf5f106def52246d0c49 fwproxy-1.7tp3-0.src.rpm With this "transparent-version" you cann control the destinations with ipchains. You simply redirect allowed destinations to the proxy and deny all other... For example, if your local network is 192.168.1.0/24 and the proxy (= gateway) with the ftp-proxy is 192.168.1.254 you can do something like that (a shell script): allow_dest="/etc/proxy-suite/allowed-destinations" LOCALNET="192.168.1.0/24" LOCAL_IP="192.168.1.254" LOG="-l" ipchains -A input -s $LOCALNET -d $LOCAL_IP 21 -j REJECT $LOG ipchains -A input -s ! $LOCALNET -d $LOCAL_IP 21 -j DENY $LOG if test -f "$allow_dest" ; then while read xdest xport ; do dest=${xdest%%\#*} port=${xport%%\#*} test -z "$dest" && continue test -z "$port" && port=21 ipchains -A input -s $LOCALNET -d $dest $port -j REDIRECT 21 $LOG done < "$allow_dest" else echo "can not read file $allow_dest" 1>&2 fi ipchains -A input -s $LOCALNET -d 0/0 21 -j REJECT $LOG ipchains -A input -s ! $LOCALNET -d 0/0 21 -j DENY $LOG In /etc/proxy-suite/allowed-destinations you enter all ip's (and optional also the port) your users can connect to via the proxy: # # <ip-number/hostname> [port] # ftp.suse.com ftp.suse.de 21 you may also set "AllowMagicUser no" in the proxy configuration so the user can't override the destination... > > there is no copy of that on my installation (version 7 with the latest > > rpm update for ftp-proxy) - although I have found a version in German > > on the web, which leads me on to my second question - am I using the > > right tool for what I am trying to achieve or should I be using some > > sort of ipchains/masquerading set-up etc. Please be aware I am not a > > Unix/Linux expert but am a keen amateur trying to push Linux where > > possible/safe into our work environment to gain greater acceptance of > > the platform. > > > > Many thanks for you time - again, any help or pointers would be > > greatly appreciated. > > > > Regards, > > Simon Cassling > > > > > > -- > Freundschaftlich / With kind regards > Volker > > -- > Volker Wiegand Voice: +1-510-628-3380 ext 5029 > SuSE Inc. Fax: +1-510-628-3381 > 580 Second Street, Suite 210 Mobile: +1-510-333-9248 > Oakland, CA 94607 USA E-Mail: wiegand(a)suse.com > > -- Gruesse, Marius Tomaschewski <mt(a)suse.de> -- SuSE GmbH, Hamburg --- SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 0

proxy-suite on solaris
by Ulrich Hiller 17 Oct '00

17 Oct '00

Hello, has somebody tested to install proxy-suite on a sun solaris machine? Doing 'make' always gives me the following error messages: > /usr/include/netinet/ip.h:130: parse error before `n_long' > /usr/include/netinet/ip.h:130: warning: no semicolon at end of struct or union > /usr/include/netinet/ip.h:130: warning: no semicolon at end of struct or union > /usr/include/netinet/ip.h:133: parse error before `n_long' > /usr/include/netinet/ip.h:133: warning: no semicolon at end of struct or union > /usr/include/netinet/ip.h:134: warning: data definition has no type or storage class > /usr/include/netinet/ip.h:135: parse error before `}' > /usr/include/netinet/ip.h:135: warning: data definition has no type or storage class > /usr/include/netinet/ip.h:136: parse error before `}' > com-socket.c: In function `socket_ll_read': > com-socket.c:934: `FIONREAD' undeclared (first use in this function) > com-socket.c:934: (Each undeclared identifier is reported only once > com-socket.c:934: for each function it appears in.) Any idea how I can fix this? Regards and thank you for the answer, Ulrich Hiller Ulrich Hiller Max-Planck-Institut fuer Astronomie Koenigstuhl 17 69117 Heidelberg Germany phone +49 6221 528238 fax +49 6221 528246 email hiller(a)mpia-hd.mpg.de

2 1

Problem with the log file
by News system 10 Oct '00

10 Oct '00

Hello, I had problems with the TIS Fwtk "ftp-gw" in passive mode on some servers. So I'm trying to use the proxy suite. It works very well in passive mode. I just have a little problem cause of the log file. With the fwtk ftp-gw at the end of the ftp session, there is a line in the log file like this one: ftp-gw[6309]: exit host=pablo/ip_adress cmds=91 in=216001 out=0 user=unauth duration=40 This line contains the amount of data transfered. (in and out fields) With the "ftp-proxy", I don't get this information in the log file. So my question is How could I force ftp-proxy to be more verbose in the log file ? Is there a patch ? Thanks ___ Herve Bossant Herve.Bossant(a)alcatel.fr

2 1