August 2000 - SUSE Proxy Suite - openSUSE Mailing Lists

inet mode, chroot environement, SuSE 7.0
by Wolfgang Barth 31 Aug '00

31 Aug '00

Hi, I am playing around with ftp-proxy from SuSE 7.0, fwproxys-1.7-12. The standard features works fine, I like configurable options like "ValidCommands" ;-) If ftp-proxy works in inet-mode, a file "LogDestination" like /var/log/ftp-proxy.log would be overwriten after every start of a new ftp-proxy process. ServerRoot doesn't work with the SuSE 7.0 environment. SuSE installs a directory /var/ftp-proxy/rundir (empty), the ftp-proxy ist statically linked. The error message is: TECH-ERR can't chroot to '/var/ftp-proxy/rundir' (errno=1 [Operation not permitted]) The permissions on the chroot directory are drwxr-x--- root root 1024 Jul 29 21:41 /var/ftp-proxy/rundir I'am using User=ftpproxy and Group=nogroup, so I tried chown ftpproxy.nogroup /var/ftp-proxy/rundir but it doesn't work. I don't know exactly how chroot works. Can somebody here explain, how it should work? It would be also nice, if SuSE can ship a rpm package which works in a chroot environment at default. At least an idea: if ftp-proxy would recognize '%' as an '@' in an AllowMagicUser case, we can use the url ftp://<user>%ftp.suse.com(a)proxy-in.mydomain:<port>/ with browsers like netscape (as an alternative way to transparent proxy). -- <wob(a)swobspace.de> *** How often do you wan't to boot today ? ***

2 1

LDAP - Howto
by Larry Canup 30 Aug '00

30 Aug '00

Is there a howto on LDAP for authentication with SuSE Proxy Suite FTP Proxy? I have a need to front-end a Corporate FTP Gateway to the Internet for a division. SuSe works great in transparent mode and provides me with a valuable access log. However, now I need to authenticate these users before allowing them through to the Corporate FTP gateway. LDAP looks promising but I can't find any doc on how to set it up. Further, what I have found implies that user attributes are pulled from LDAP but does not indicate that users are authenticated by password. Can someone straighted me out here? Larry Canup Network Security Systems Integrator Raytheon Aircraft 316 676 1797

2 2

Re: Maillist no. 62
by Marius Tomaschewski 30 Aug '00

30 Aug '00

On Wed, Aug 30, 2000 at 10:20:28AM +0200, Thomas Wagner wrote: > Hi. Hi! > I haven't get the maillist no. 62 because I'm in this mailing list > only for a few days. > > Could you tell me, where I can read or get it? There is a archive of the list - see: http://www.suse.com/us/support/mailinglists/index.html > Specially I need information how to download the transparent > version of ftp-proxy. This is a first "experimental" version/patch at the moment: http://www.suse.de/~mt/proxy-suite/ Volker Wiegand is currently working on a new version/update for the proxy and the transparent patches should be also included there. > Thomas Wagner. > > > > I have read proxy-suite maillist no. 62 and also downloaded your > > > transparent version. I installed it onto RedHat 6.2 with all your > > > advised parameter settings. Regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE GmbH, Hamburg --- SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 0

Re: [proxy-suite] Re: Problem on transparent FTP-proxy
by Marius Tomaschewski 27 Aug '00

27 Aug '00

On Sun, Aug 27, 2000 at 07:46:36PM +0800, Peter Chu wrote: > Dear Marius, Hi! > Thanks you so much for your information. I'll try again the test with > proxy-suite. > > I would also like to know if your transparant version works only on SuSE or > with both SuSE and Red Hat. As I am not familar with configurating SuSE. It works on both - you should use the src.rpm and rebuild it. It works also for most other unixes. Transparent proxying is currently tested only on linux. > Also, how can I add in the configuration option? Are all of them have > already been configured in you rpm package and I can just activate > them in the ftp-proxy.conf file. Yes, they are "all" in the config file. There is only one new option in the transparent version: AllowTransProxy yes/no. You have also set Listen to the IP number of the interface you are "sitting on" (the internal net), and if you like it also AllowMagicUser to yes. Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE GmbH, Hamburg --- SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 0

Re: Problem on transparent FTP-proxy
by Marius Tomaschewski 25 Aug '00

25 Aug '00

On Fri, Aug 25, 2000 at 08:44:31PM +0800, Peter Chu wrote: > Dear Marius Tomaschewski, Dear Peter Chu, thanks for your Question. > I have read proxy-suite maillist no. 62 and also downloaded your > transparent version. I installed it onto RedHat 6.2 with all your > advised parameter settings. > > I tried to connect from Windows 98 using I.E. 5.5 with FTP proxy > setting pointing to the local proxy machine 192.168.0.240 port 21. > I tried to go to the RedHat ftp site by entering > ftp://ftp.cse.cuhk.edu.hk/pub/redhat/ in the address field. No, a transparent ftp-proxy is _not_ a proxy you can use in your web-browser. the web-browser proxies "speaks" the http protocol - our proxy is an "real" _ftp_ proxy. If you want a proxy for your web-browser, try squid or something similar. You can use our proxy, if you want to use normal ftp clients like cute-ftp, wftp, igloftp or the ftp command in your dos box. In normal operation you have to connect to the proxy and give them a username _and_ the ftp-server name you want to log in, i.e.: $ ftp proxy.yourdomain.de Name: anonymous(a)ftp.suse.com (here you have to enable the MagicUser directive). Now, in the transparent ftp-proxy implementation you can do it directly. you set up the proxy on a gateway and redirect all incomming connections from your internal network, that are going to the internet to your proxy (i.e. with ipchains on a linux box - see example config in /usr/doc/packages/fwproxy/TRANSPARENT_PROXY.txt). After this you can simply do a $ ftp ftp.suse.com Name: anonymous that's all :-) > Client station are using Windows 9x and I have got the Squid > http proxy running to handle the http routing. ^^^^^^^^^^ yes, that is the reason. our proxy is a ftp proxy. > I want to know if FTP-proxy will resolve the proxy routing. > I am new to all these topics and have already been messing > with the proxy-suite from ver 1.5 to 1.7, SuSE and RedHat > for a few days but still in a misery. > > Would appreciate if you can give me some guidelines and > installation hints. > > > Thanks a lot > > Peter Chu Kind Regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE GmbH, Buero Hamburg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 0

USER-WRN unknown 'GET'
by Andreas Fey 05 Aug '00

05 Aug '00

Hi, I want to use FTP-Proxy for an application gateway. The clients (ie Internet Explorer) should connect to the proxy and ask him to download the files via ftp. If I make a ftp-request, the ftp-proxy.log says: ftp-child [8907] <08/05-16:57:22> USER-INF connect from 192.168.60.104 ftp-child [8907] <08/05-16:57:22> USER-WRN unknown 'GET' from 192.168.60.104 ftp-child [8907] <08/05-16:57:22> USER-WRN unknown 'User-Agent:' from 192.168 .60.104 ftp-child [8907] <08/05-16:57:22> USER-WRN unknown 'Host:' from 192.168.60.10 4 ftp-child [8907] <08/05-16:57:22> USER-WRN unknown 'Proxy-Connection:' from 1 92.168.60.104 ftp-child [8907] <08/05-16:57:22> USER-WRN unknown 'Pragma:' from 192.168.60. 104 Doesn't ftp-proxy understand the basic FTP-Commands ? I have compiled it with the newest regex-lib.

2 1

no connection to data-channel
by Tobias Gasser 01 Aug '00

01 Aug '00

Hello, i'm trying to set up a suse-firewal with the ftp-proxy on it (or on the ftp-server behind) to be able to limit the open ports via the Min/MaxPort settings to a range of 50. I'm running proftp as ftp-server. Now my problem is this: the login into the server works just fine. I can even do 'cd's an 'rm's, but as soon as i do a 'ls' or things that need to have a data channel opened i get no connection to it. So i tried - to exclude the possibility that the firewall is blocking something - to do a local connect to the proxy. But the thing didn't work either. Any suggestions ? Thank you for your help ! Tobias

1 1