November 2000 - SUSE Proxy Suite - openSUSE Mailing Lists

Archive
by Helvio Candido Jr. 01 Dec '00

01 Dec '00

I'd like to know if I can use ftp enabled browsers (like Netscape or IE) and use the AllowMagicUser feature to connect to other ftp servers. As far as I know (though it may be not so far), the browsers won't accept "URLs" like "ftp://anonymous@ftp.domain.com@ftp-proxy.server", as it would try to connect to the ftp.domain.com(a)ftp-proxy.server instead of ftp-proxy.server. I tried quotes or "%40", but, as expected, it didn't work out. Maybe we could change the separators characteres (i.e. # instead of @ and % instead of :, so we could try "ftp://anonymous#ftp.domain.com%30@ftp-proxy.server" and connect to the ftp.domain.com server, on port 30, using the user anonymous!). If there is a different way to do that, please, let me know. Helvio Candido Jr. helvio(a)multiconecta.com.br

2 1

DestinationMin/MaxPort: possible problem
by Wolfgang Barth 24 Nov '00

24 Nov '00

Hi, I think I found a bug around DestinationMinPort/DestinationMaxPort. In my configuration (standalone oder inetd doesn't matter) I've set the following values: DestinationMinPort 42900 DestinationMaxPort 42999 The ftp server ist proftpd on the same host as the ftp-proxy. One example session: >>>---------------------------------------------------------------- 116 % ftp ftp.mosaic-enet.com Connected to ftp.mosaic-enet.com. 220 mosaic04 FTP server (Version 1.7 - 1999/10/22 09:22:47) ready. Name (ftp.mosaic-enet.com:wba): wba 331 Password required for wba. Password: 530 Login incorrect. ftp: Login failed. ftp> user (username) bla 421 Service not available, remote server has closed connection. Login failed. ftp> quit [ mosaic99, wba, /home/wba/test ] 117 % ftp ftp.mosaic-enet.com Connected to ftp.mosaic-enet.com. 220 mosaic04 FTP server (Version 1.7 - 1999/10/22 09:22:47) ready. Name (ftp.mosaic-enet.com:wba): wba 421 Service not available, remote server has closed connection. ftp: Login failed. ftp: No control connection for command. ftp> <<<---------------------------------------------------------------- The proxy connected to the ftp server, after the "Login failed", the ftp server closes the connection. Due to the tcp implementation, there is a connection from proxy, port 42000 to the ftp server, one or two minutes in the state TIME_WAIT. A second try gives an error 99 (I don't mention the error messages). Same with two parallel connections to the proxy: first login works fine, but as long the first login is active, no further connection to the ftp service is possible (same error message). I disabled the DestinationMin/MaxPort, so the ftp-proxy can use every non privileged port, and all works fine. May be this is a problem in selecting a source port for the proxy->server connection, if the first port in the range is in use. My configuration: tested with fwproxy-1.7tp5-0, fwproxy-1.7-39 tested in standalone and inetd mode proxy binds to port 21, server on the same host to port 1089 or port 1090. I've set all Min/MaxPort values as in the example configuration. The server is running two parallel proxies (both on port 21, but 2 different ip addresses on the same network interface). Proftpd is configured with 3 virtual ftp servers, 2 for work with the proxies, one for direct connection. The two virtual ftp servers binds to 127.0.0.1 (different ports), and are not reachable from outside the server. wob -- <wob(a)swobspace.de> *** How often do you wan't to boot today ? ***

2 1

ftp://ftp.suse.com/pub/projects/proxy-suite
by Marius Tomaschewski 21 Nov '00

21 Nov '00

Hi *! I've put the current proxy-suite-1.7tp5 to ftp://ftp.suse.com/pub/projects/proxy-suite so my "private place" at http://www.suse.de/~mt/proxy-suite is not needed anymore. Here is the INDEX.md5 of /pub/projects/proxy-suite: 5894d4c80888bcfa4cb2e345676dc69e SuSE-7.0/fwproxy-1.7tp3-0.i386.rpm 3522e255e0d8bf5f106def52246d0c49 SuSE-7.0/fwproxy-1.7tp3-0.src.rpm 97ff630536c13757f529f4502c1b1244 SuSE-7.0/fwproxy-1.7tp4-0.i386.rpm 52cef5adc32b620ef715b3f3b2cba0fb SuSE-7.0/fwproxy-1.7tp4-0.src.rpm f85d5af18ebda2f4caaf2a821a8298cb SuSE-7.0/fwproxy-1.7tp5-0.i386.rpm cec9494eb5587655229f6ac9e69e3c84 SuSE-7.0/fwproxy-1.7tp5-0.src.rpm 0798c57e86d86257cdd8b4734b25d8c1 changelog 793a1aa545934e9d50c4b1859149f109 proxy-suite-1.5.tar.gz 7223a2c0aaba74312a61a2e5fc83791a proxy-suite-1.6.tar.gz de879e5d0c6398fde9970db3c5877fad proxy-suite-1.7.tar.gz 40948cf2501f6ad637de110a7fb08746 src/CHANGES.mt 66850d6a61cbe0d05a8929b894666079 src/TRANSPARENT_PROXY.txt c7bd3055b7bc0000fb5f237a96aa0d5f src/build-freebsd4.sh a3b76922e96ce59c4247d35cc9c24b08 src/build-solaris7.sh 345063f24f394f558aacb1e72ee44ad2 src/ftp-daemon.c.dif 7bdd137a8111e5b66da65b594b2f994b src/fwproxy.spec fad814983807875dc4217b70d1b8fa14 src/log-rotate.dif 2f02592e2181b8c49cf993f97f6a700d src/proxy-suite-1.7.dif de879e5d0c6398fde9970db3c5877fad src/proxy-suite-1.7.tar.gz and src/CHAANGES.mt file: - 1.7tp1 / 01.07.2000: first implementation of transparent proxying - 1.7tp2 / 14.07.2000: added checks if destination is a local address; transparent proxying should work fine now - 1.7tp3 / 22.09.2000: fixed ugly daemon-mode bug killing all proxy instances on QUIT - 1.7tp4 / 03.10.2000: changed log file opening to rename the log file if it already exists instead of delete it :-) - 1.7tp5 / 08.10.2000: autoconf cleanups - tested on linux, freebsd4.0 and solaris7. added UseMagicChar config keyword to support other chars than @ as user separators in "AllowMagicUser" mode. The files will be avaliable on ftp://ftp.suse.com after the next mirror run... Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE GmbH, Hamburg --- SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

2 2

fwproxy newbie question
by Olivier Hislaire 21 Nov '00

21 Nov '00

Hi, This should be trivial, but ... I have fwproxy (v1.7) running OK as long as I am using ftp from the command line of one of my internal machines, but if I try to access, say, ftp://ftp.suse.com/pub/i386 (using netscape version 4 or so), all I get from my browser is: 220 Welcome to ftp-proxy. 500 'GET': command unrecognized. 500 'Referer:': command unrecognized. 500 'Proxy-Connection:': command unrecognized. 500 'User-Agent:': command unrecognized. 500 'Host:': command unrecognized. 500 'Accept:': command unrecognized. 500 'Accept-Language:': command unrecognized. 500 'Accept-Charset:': command unrecognized. And the ftp-proxy.log file shows: ftp-child [1062] <11/20-13:13:45> USER-INF connect from 192.168.32.11 ftp-child [1062] <11/20-13:13:45> USER-WRN unknown 'GET' from 192.168.32.11 ftp-child [1062] <11/20-13:13:45> USER-WRN unknown 'Referer:' from 192.168.32.11 ftp-child [1062] <11/20-13:13:45> USER-WRN unknown 'Proxy-Connection:' from 192.168.32.11 ftp-child [1062] <11/20-13:13:45> USER-WRN unknown 'User-Agent:' from 192.168.32.11 ftp-child [1062] <11/20-13:13:45> USER-WRN unknown 'Host:' from 192.168.32.11 ftp-child [1062] <11/20-13:13:45> USER-WRN unknown 'Accept:' from 192.168.32.11 ftp-child [1062] <11/20-13:13:45> USER-WRN unknown 'Accept-Language:' from 192.168.32.11 ftp-child [1062] <11/20-13:13:45> USER-WRN unknown 'Accept-Charset:' from 192.168.32.11 What have I done wrong ? Any help appreciated, Olivier. ------------------------------------------------------------------------------------------------ Olivier Hislaire MSG International Email: O.Hislaire(a)msg-i.com 97 Avenue de Tervuren Phone: +32 (0)2 735.91.59 Ext. 55 1040 Brussels Fax: +32 (0)2 732.12.19 Belgium http://www.msg-i.com ------------------------------------------------------------------------------------------------

2 1

Kummer mit squid
by Werner Bierwirth 16 Nov '00

16 Nov '00

Hallo, ich kenne mich mit Linux noch nicht si gut aus und habe Probleme mit SuSE Linux 7 und Squid. Vielleicht hat jemand eine Idee. Im Anhang sind einige Linux Log Dateien und meine squid.conf. Rechner: Intel, P700 System: SuSE Linux 7.0, Squid2 Client: Windows 2000, Internet Explorer ISDN Karte: AVM Fritz!PCI Lokal am Linux Server kann ich mich mit Netscape ins Internet einwählen. Auch Squid startet beim Systemstart ohne Fehlermelung an. Starte ich beim Client den Internet Explorer sehe ich beim Server (xisdnload) das ein Einwahlvorgang stattfindet. Nach einer Weile erscheint beim Client (Internet Explorer) die Meldung: (s. Datei Client - Internet Expolorer.txt) (101) Network is unreachable Kurz bevor beim Client diese Meldung erscheint legt der Linux Server (Squid) wieder auf (das sehe ich an xisdnload). Kann mir jemand helfen ?

2 1

new adress
by Sven Rassmann 15 Nov '00

15 Nov '00

ähem, my mail-adress has changed. where can i tell the server to delete the old one ? http://www.suse.de/en/support/proxy_suite/ only tells the subscribe adress. sven.

1 0

Transparent Proxy with APT
by Andreas Metzler 14 Nov '00

14 Nov '00

Hello! I am testing the latest ftp-proxy (iirc 1.7t5) as transparent proxy. Testing with lftp in passive and active mode works well, but Debians APT throws this error (*iirc*, I am sitting at another computer now): Download of foo/bar/Packages.gz failed, server said "Could not open data channel to client" ftp-proxy.log says this: ftp-child [30279] <11/13-18:31:58> USER-INF 'RETR /debian/dists/woody/contrib/source/Release' from XXX.XXX.XXX.XXX ftp-child [30280] <11/13-18:31:59> USER-INF 'MDTM /stable/2.0/distribution/deb/Debian/dists/potato/.//binary-i386/Packages.gz' from XXX.XXX.XXX.XXX ftp-child [30279] <11/13-18:31:59> TECH-ERR can't connect Cli-Data for XXX.XXX.XXX.XXX ftp-child [30279] <11/13-18:31:59> USER-INF 'SIZE /debian/dists/woody/non-free/source/Sources.gz' from XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX is the IP of the computer running apt. cu andreas -- Andreas Metzler, Wien | ametzler(a)downhill.at.eu.org Key-ID 8B8D7663 |

1 0

Newbie
by Oliver Moser 10 Nov '00

10 Nov '00

Hello, I'm new to this mailing list and of course I've got a problem with the suse proxy suite :). I installed the package from CD (Suse 7.0 pro) and setup the ftp-proxy.conf file. I run the proxy through inetd (tried with and without Wrappers). Ok, so if I connect to my firewall (that's the box where the proxy is installed) it should redirect me (Destination Adress 192.168.0.5) to an internal machine, namely the acctual FTP server. I've made an account called 'olmo' on the FTP server. Now, my problem is that everytime I try to connect to my firewall with 'olmo', my ftp client just prints the deny string 421 Service not availabe and disconnects. Do you have an idea what I've done wrong? I also tried clearing my ipchains table, because at first I blamed my firewall script. It would be great if you could help me. Thanks a lot in advance, oliver

2 1

Re: Strange situation with FW-PROXY Suite
by Marius Tomaschewski 08 Nov '00

08 Nov '00

Hi! On Tue, Nov 07, 2000 at 07:42:28PM -0500, Rob Cotrone wrote: > Thanks for the update. > > I have another situation which is possibly a feature enhancement. > > Our HP-UX server is going to be moving to our new data center. > We were planning on using this proxy to forward the stragglers > from the internet that have hard coded IP addressee instead > of the host names within their scripts. > > I'm not sure if you are familiar with HP-UX's older FTPD. No. > It had a mode where the remote user would login anonymously. > I.E> Anonymous or FTP with email address. > Then issue another user statement which would read a local > password file and login with the user definitions of that > passwd entry. You can do this also with proftpd - http://proftpd.net/. There is a nice Feature DefaultRoot that enables you to do a chroot for users in specified groups. Because proftpd doesn't use external binaries, you do not need any libs, devices,... in the users directory (-> better than wuftpd). Proftpd can use external password files and LDAP (and DBs). > When using the proxy it seems that every 'user' command is > intercepted and a brand new connection is established. The proxy opens the connection to the server after the username is known (because of MagicUser and transparent proxy feature). > This is good for the local user security feature within > the ftp-proxy.conf file, but breaks the login procedure > with the HP-UX ftpd daemon. I do not really understand what the HP-UX ftpd needs... Does it handle more than one user via one control socket or reuse the socket for next users? > It is not uncommon for firewalls to be configured like that > also. In fact I've working with some people from Citibank > that have to logon to a firewall then issue the user command > for the remote destination like the magic user facility within > the ftp-proxy code. You mean like the ftp-proxy from TIS toolkit? > I looked at the code and it looks very neat and well thought out. > However, I'm not the greatest C Programmer in the world. > > How difficult would it be to add this feature? I do not realy understand what you need. > Can it be done, If so where? This is a kind of "special feature" I mean... If it is possible to implement it (i mean it is :-), you can implement it yourself or contact our professional services (solutions(a)suse.de) and they can do it for you. > if you are willing to add this feature and need a host to > test it on, I can give you access to one of our test accounts. I've no time to implement all feature request, sorry! > If you do not feel it worthwhile, > please let me know and I will farm it out internally. > > Again, thanks for such great work. > I've convinced my boss to purchase a copy of SUSE Linux > just because we are using this package. Oh, that's a nice idea - you can try out SuSE Linux :-) > At this point I'm going to subscribe to the mailing list. > Yeah... I'm at the web page.. Reading TFM.... :-) cu, Marius Tomaschewski <mt(a)suse.de> -- SuSE GmbH, Hamburg --- SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 0

Re: Strange situation with FW-PROXY Suite
by Marius Tomaschewski 07 Nov '00

07 Nov '00

Hi! Thanks for your report! This is a known and fixed bug - I'll find the patched one on: http://www.suse.de/~mt/proxy-suite/fwproxy-1.7tp4-0.src.rpm (it is the ftp-daemon.c.dif patch inside of the src.rpm) I mean, there will be a new version tommorrow - I'm doing some autoconfig cleanup today, so it catches some problems with Freebsd, Solaris7 and perhaps HP-UX... On Tue, Nov 07, 2000 at 04:03:03PM -0500, rcotrone(a)weebotech.com wrote: > Hello all, First of all I should thank you for doing a great job on > the ftp proxy. It was a good idea and it helped me out of a huge jam. > > The story... > > Our company is moving our data center and some of our customers did > not have their T1 lines to the new data center in time for our move. > > Through the use of your program I was able to fake the customers out > and allow them to access our new hosts without any changes to their > network configuration. > When dealing with huge customers like Fidelity and Citibank, > who can not get things done in a rapid time frame, tools like these > help. So Kudos.. > Your application has been put through the paces in many ways. > > The strange sitatuation... > I think I may have run across a bug with the FW-PROXY Suite program. > > I have a new configuration I'm building where I will have 8 network > adapters in one machine to front end another set of customers. > (Same situation above, but caused by the telephone company strike > in the summer). > Each customer as a completely different network so I'm going to set > 1 NIC per customer with one set of addressing per customer and > proxy them into our FTP server. > > During my testing I configured the FTP proxy to run in daemon mode > and bind to a specific address. > The situation I'm having is interference from multiple ftp's. > > Example. FTP through proxy to one location sending a 17MB file. > FTP through proxy to another location sending a 1 MB file. > > When the small transmission (or connection ends "quits"). > It terminates what ever other connections are present through the proxy's > IP that is binded. I have not tested to another bound address yet. > > Note this does not happen in inetd mode. > > I'm not sure if anyone is even interested in reviewing this situation, > I figured I would try anyway. > I've attached a config and a startup script I use to fire off the daemon. > > If you need my assistance in any way, such as debug dumps, let me know. > > For now I'm considering using xinetd to capture incoming connections and > spawning the fw proxy server that way. > > Any assistance is greatly appreciated. > Thanks. > > > > > > > > > > > > > -- Gruesse, Marius Tomaschewski <mt(a)suse.de> -- SuSE GmbH, Hamburg --- SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 0