January 2001 - SUSE Proxy Suite - openSUSE Mailing Lists

Problems to get proxy to work properly
by Joerg Kammerer 13 Feb '01

13 Feb '01

hi! I Installed the proxy on my server, all from inetd, to forward outgoing connections through the Server i've installed the proxy on. The conf file has this switches activated: [-Global-] AllowMagicUser yes DestinationAddress trick DestinationTransferMode passive PassiveMinDataPort 41000 PassiveMaxDataPort 41999 PortResetsPasv no # this i tested also with yes In this example i use the default server cazlled trick, dante is the Server with the proxy on. As u see, pwd works fine, but an ls blocks somehow, and after the timeout we are kicked out. [joe@192 joe]$ ftp dante Connected to dante. 220 dante FTP server (Version 1.7 - 1999/10/22 09:22:47) ready. Name (dante:joe): 331 Password required for joe. Password: 230 User joe logged in. Remote system type is UNIX. Using binary mode to transfer files. ftp> pwd 257 "/home/joe" is current directory. ftp> cd /tmp 250 CWD command successful. ftp> pwd 257 "/tmp" is current directory. ftp> ls 421 Service not available, remote server timed out. Connection closed ftp> I switched the dest ftpserver to debug mode, Jan 23 22:01:16 dante ftp-proxy[29263]: connect from 192.168.2.90 (192.168.2.90) Jan 23 22:01:47 trick wu.ftpd[15582]: connect from root(a)192.168.2.80 Jan 23 22:01:47 trick ftpd[15582]: <--- 220 Jan 23 22:01:47 trick ftpd[15582]: trick.sinatra.inka.de FTP server (Version wu-2.4.2-academ[BETA-15](1) Fri Nov 14 21:44:45 1997) ready. Jan 23 22:01:47 trick ftpd[15582]: command: USER joe^M Jan 23 22:01:47 trick ftpd[15582]: <--- 331 Jan 23 22:01:47 trick ftpd[15582]: Password required for joe. Jan 23 22:01:47 trick ftpd[15582]: USER joe Jan 23 22:01:50 trick ftpd[15582]: command: PASS password^M Jan 23 22:01:50 trick ftpd[15582]: PASS password Jan 23 22:01:50 trick ftpd[15582]: <--- 230 Jan 23 22:01:50 trick ftpd[15582]: User joe logged in. Jan 23 22:01:50 trick ftpd[15582]: FTP LOGIN FROM dante [192.168.2.80],joe Jan 23 22:01:50 trick ftpd[15582]: command: PWD^M Jan 23 22:01:50 trick ftpd[15582]: PWD Jan 23 22:01:50 trick ftpd[15582]: <--- 257 Jan 23 22:01:50 trick ftpd[15582]: "/home/joe" is current directory. Jan 23 22:01:50 trick ftpd[15582]: command: SYST^M Jan 23 22:01:50 trick ftpd[15582]: SYST Jan 23 22:01:50 trick ftpd[15582]: <--- 215 Jan 23 22:01:50 trick ftpd[15582]: UNIX Type: L8 Jan 23 22:01:57 trick ftpd[15582]: command: PWD^M Jan 23 22:01:57 trick ftpd[15582]: PWD Jan 23 22:01:57 trick ftpd[15582]: <--- 257 Jan 23 22:01:57 trick ftpd[15582]: "/home/joe" is current directory. Jan 23 22:02:05 trick ftpd[15582]: command: CWD /tmp^M Jan 23 22:02:05 trick ftpd[15582]: CWD /tmp Jan 23 22:02:05 trick ftpd[15582]: <--- 250 Jan 23 22:02:06 trick ftpd[15582]: CWD command successful. Jan 23 22:02:06 trick ftpd[15582]: command: PWD^M Jan 23 22:02:06 trick ftpd[15582]: PWD Jan 23 22:02:06 trick ftpd[15582]: <--- 257 Jan 23 22:02:06 trick ftpd[15582]: "/tmp" is current directory. Jan 23 22:02:07 trick ftpd[15582]: command: PWD^M Jan 23 22:02:07 trick ftpd[15582]: PWD Jan 23 22:02:07 trick ftpd[15582]: <--- 257 Jan 23 22:02:07 trick ftpd[15582]: "/tmp" is current directory. Jan 23 22:03:10 trick ftpd[15582]: <--- 221 Jan 23 22:03:10 trick ftpd[15582]: You could at least say goodbye. Jan 23 22:03:10 trick ftpd[15582]: FTP session closed I used the clients in passive mode and in active mode The very strange thing is, that the connect from a Windows Box worked... (Booooooooo) Whats wrong?? Has anybody an Idea???? All three Systems were Suse7 Installations. Hope for Help. Joerg -- Finagle's First Law: If an experiment works, something has gone wrong.

2 1

ftp-proxy.conf
by Walter Krohe 02 Feb '01

02 Feb '01

Hello everybody ! I ask for friendly help. Maybe my question ist an "Dummie" one. I have to install on my webserver an ftp service for two guy's who has her domains on it. Up to now I had disabled ftp access at all. Today I installd on the webserver (running SuSE 6.3, 2.2.13 kernel) the fwproxy-1.7tp5-0.i386.rpm. I added the inted command, modified ftp-proxy.conf (AllowMagicUser -> no/DestinationAdress -> to the default webserver/LogDestination/ServerRoot) Also I added to ftp-proxy.conf: [username] DestinationAdress otherdomain.tld ServerRoot /usr/local/httpd/otherdomain By trying to connect I get: 421 Service not available, remote server has closed connection Login failed. The log tells: -i [32076] <01/23-22:48:45> TECH-ERR can't eval DestAddr for 62.224.92.75 # its a remote dialin-IP outside the LAN My idea is: ftp connect to no one, expect 2 users to their http-root directories with full read/write access. Who can give me the hint to realize my idea? Thank you for the time you spend reading my question. Kind regads, -- Walter Krohe, wk(a)u2me.de Hauffstr. 15, D-73779 Deizisau voice +49 7153 6149380, fax +49 7153 921217

3 5

TranslatedAddress
by Thomas Göttlicher 15 Jan '01

15 Jan '01

Hi! I want my FTP-Proxy to send its official IP-address as source-address on its eth1-interface, which has a local IP-address. I need this for routing reasons. In ftp-proxy.conf I use »TranslatedAddress«, but it doesn't work! My packet-sniffer tells me that ftp-proxy uses its local address but not the official. Why does FTP-Proxy not use »TranslatedAddress« for all its connections? Thank you! Thomas

1 0

Application level gateway and security?
by Thomas Ziegler 13 Jan '01

13 Jan '01

We are running an application level gateway, currently only with squid (http proxy) to hide our intra net from the internet. All ports are denyed by the firewall, exept the necessary ones. Gateway |--Client --- | | | |--Client ----+ +---| | | |--Client Inter --- | Net |--Client Intranet To get all features from the ftp protocol, we plan to use the suse proxy-suite. - What ports have to be opened in addition for the ftp-proxy? Are there firewall examples available for suse-7.0 - We do not want access from the external world into our net. What's the best entry for the mandatory 'DestinationAddress' in ftp-proxy.conf? - Is there a common way, how to access an ftp-proxy from the client side? I could imagine an approach like the proxy entry for http browsers. - Which clients are recommended for use in conjunction with the ftp-proxy ( ncftp?, other unix clients, win32 clients?) - Should the standard ports (20/21) be used or other ones? - I do not understand the use of an LDAP server with an ftp-proxy. Is that one used to get access to the gateway itself or to authenticate users which want to get access to the outside world? - Suse-7.0 comes with an ssl-version of the ftp-proxy. Which clients/servers make use of ssl? - Any other experiences about security? Thanks in advance, Thomas PS: In case anybody in this list want's to use the ftp-proxy on the suse7.0 CDs: It seems their ftp-proxy do not work. I had to recompile the sources. -- Dr.-Ing. Thomas Ziegler Coding Technologies GmbH Deutscherrnstr. 15-19 Phone +49(911)92891-27 D-90429 Nürnberg FAX +49(911)92891-99

2 3

Re: [proxy-suite] No control connection
by Thomas Göttlicher 11 Jan '01

11 Jan '01

Yes, it was so simple. I use the hostname, but it only works with the numeric IP-address. Thank you very much! >>>>>>>>>>>>>>>>>> Ursprüngliche Nachricht <<<<<<<<<<<<<<<<<< Am 1/11/01, 1:31:11 PM, schrieb Antoniu-George SAVU <santoniu(a)libertysurf.fr> zum Thema Re: [proxy-suite] No control connection: > Ok, > The problem is prety simple. Look at the "DestinationAddress". "other.none" > is not good. You have to put there the IP address of the FTP server to which > all the connections will be forwarded. Look at the diagram below: > +-------------+ +------------+ > | Normal FTP server | <------> | FTP proxy server | > +-------------+ +-------------+ > IP: 192.168.0.1 IP: some_ip > So, from the diagram, the DEstinationAddress for the FTP proxy is: > 192.168.0.1 > Please change your "DestinationAddress" and put instead of the "other.none" > some REAL IP of some FTP server. > Cheers, > Tony > Thomas Göttlicher wrote: > > Hi! > > > > Yes,Of course! > > Here it is: > > > > --------------------------- > > [-Global-] > > AllowMagicUser yes > > DestinationAddress other.none > > DestinationPort 21 > > DestinationTransferMode client > > LogDestination daemon > > MaxClientsString The server is full > > ServerRoot /var/ftp-proxy/rundir > > ServerType standalone > > ValidCommands ABOR, PASS, PASV, STOR, USER, \ > > MODE, QUIT, SYST > > WelcomeString Welcome to %h > > > > Thomas > > > > > Thomas, > > > Can you send me your ftp-proxy.conf file??? > > > > > Cheers, > > > Tony > >

2 1

Re: [proxy-suite] No control connection
by Thomas Göttlicher 11 Jan '01

11 Jan '01

Hi! Yes,Of course! Here it is: --------------------------- [-Global-] AllowMagicUser yes DestinationAddress other.none DestinationPort 21 DestinationTransferMode client LogDestination daemon MaxClientsString The server is full ServerRoot /var/ftp-proxy/rundir ServerType standalone ValidCommands ABOR, PASS, PASV, STOR, USER, \ MODE, QUIT, SYST WelcomeString Welcome to %h Thomas > Thomas, > Can you send me your ftp-proxy.conf file??? > Cheers, > Tony > Thomas Göttlicher wrote: > > Hi! > > > > Thanks for your answer! > > My ftp-proxy.debug looks like this: > > 10:56:29 < 8458> accepted 5=127.0.0.1 > > 10:56:29 < 8458> config_int: s='(nil)' n='ForkLimit' d=40 > > 10:56:29 < 8458> config_int: s='(nil)' n='MaxClients' d=512 > > 10:56:29 < 8458> client pid=8529 (127.0.0.1) added > > 10:56:29 < 8529> {{{{{ ftp-child client-fork > > 10:56:29 < 8529> config_int: s='(nil)' n='TimeOut' d=900 > > 10:56:29 < 8529> config_str: s='(nil)' n='DenyMessage' d='(nil)' > > 10:56:29 < 8529> alloc 68 (com-socket.c:327): 0x805d648 > > 10:56:29 < 8529> created HLS for 0=127.0.0.1:1260 > > 10:56:29 < 8529> USER-INF connect from 127.0.0.1 > > 10:56:29 < 8529> config_str: s='(nil)' n='WelcomeString' d='(nil)' > > 10:56:29 < 8529> config_str: result='Welcome to %h' > > 10:56:29 < 8529> config_str: s='(nil)' n='WelcomeMessage' d='(nil)' > > 10:56:29 < 8529> printf Cli-Ctrl 0=127.0.0.1: 32 bytes '220 Welcome to > > localhost.' > > 10:56:29 < 8529> alloc 56 (com-socket.c:688): 0x805d690 > > 10:56:29 < 8529> config_str: s='(nil)' n='ServerRoot' d='(nil)' > > 10:56:29 < 8529> config_str: result='/var/ftp-proxy/rundir' > > 10:56:29 < 8458> client pid=8529 (127.0.0.1) gone > > And my /var/log/messages: > > ftp-child[8554]: USER-INF connect from 127.0.0.1 > > ftp-child[8554]: USER-INF 'USER user' from 127.0.0.1 > > ftp-child[8554]: USER-INF reading data for 'user' from cfg-file > > ftp-child[8554]: TECH-ERR can't eval DestAddr for 127.0.0.1 > > > > I think »TECH-ERR can't eval DestAddr« is a problem with LDAP. But I > > don't want to use LDAP and did noch use »configure --libldap[=PATH]«. > > > > Do you know how to turn of LDAP-Support? > > > > Thomas > >

2 1

Re: [proxy-suite] Using ftp-proxy for outgoing FTP
by Fraser Campbell 11 Jan '01

11 Jan '01

Marius Tomaschewski <mt(a)suse.de> writes: > See > ftp://ftp.suse.com/pub/projects/proxy-suite/src/TRANSPARENT_PROXY.txt > > and its "AllowTransProxy" config directive. Thanks! A followup question: How can we limit who would have access to outgoing FTP using this software? By IP obviously, but would authentication mechanisms be possible? -- fraser campbell <fraser(a)starnix.com> starnix inc. tollfree: (905) 771-0017 thornhill, ontario, canada http://www.starnix.com/ professional linux services & products

2 1

Using ftp-proxy for outgoing FTP
by Fraser Campbell 11 Jan '01

11 Jan '01

We are utilizing ftp-proxy for inbound FTP (public IP -> DMZ) in several locations with great success ... I would now like to try it for outbound FTP. Is there any documentation on using ftp-proxy for proxying outbound FTP, perhaps I missed it? Thanks! -- fraser campbell <fraser(a)starnix.com> starnix inc. tollfree: (905) 771-0017 thornhill, ontario, canada http://www.starnix.com/ professional linux services & products

2 1

Re: [proxy-suite] No control connection
by Thomas Göttlicher 11 Jan '01

11 Jan '01

Hi! Thanks for your answer! My ftp-proxy.debug looks like this: 10:56:29 < 8458> accepted 5=127.0.0.1 10:56:29 < 8458> config_int: s='(nil)' n='ForkLimit' d=40 10:56:29 < 8458> config_int: s='(nil)' n='MaxClients' d=512 10:56:29 < 8458> client pid=8529 (127.0.0.1) added 10:56:29 < 8529> {{{{{ ftp-child client-fork 10:56:29 < 8529> config_int: s='(nil)' n='TimeOut' d=900 10:56:29 < 8529> config_str: s='(nil)' n='DenyMessage' d='(nil)' 10:56:29 < 8529> alloc 68 (com-socket.c:327): 0x805d648 10:56:29 < 8529> created HLS for 0=127.0.0.1:1260 10:56:29 < 8529> USER-INF connect from 127.0.0.1 10:56:29 < 8529> config_str: s='(nil)' n='WelcomeString' d='(nil)' 10:56:29 < 8529> config_str: result='Welcome to %h' 10:56:29 < 8529> config_str: s='(nil)' n='WelcomeMessage' d='(nil)' 10:56:29 < 8529> printf Cli-Ctrl 0=127.0.0.1: 32 bytes '220 Welcome to localhost.' 10:56:29 < 8529> alloc 56 (com-socket.c:688): 0x805d690 10:56:29 < 8529> config_str: s='(nil)' n='ServerRoot' d='(nil)' 10:56:29 < 8529> config_str: result='/var/ftp-proxy/rundir' 10:56:29 < 8458> client pid=8529 (127.0.0.1) gone And my /var/log/messages: ftp-child[8554]: USER-INF connect from 127.0.0.1 ftp-child[8554]: USER-INF 'USER user' from 127.0.0.1 ftp-child[8554]: USER-INF reading data for 'user' from cfg-file ftp-child[8554]: TECH-ERR can't eval DestAddr for 127.0.0.1 I think »TECH-ERR can't eval DestAddr« is a problem with LDAP. But I don't want to use LDAP and did noch use »configure --libldap[=PATH]«. Do you know how to turn of LDAP-Support? Thomas Am 1/9/01, 4:33:18 PM, schrieb Antoniu-George SAVU <santoniu(a)libertysurf.fr> zum Thema Re: [proxy-suite] No control connection: > Mea culpa. > I was a little bit tired yesterday when I have answered to your Email. > So, try compiling the ftp proxy with the "--enable-debug" option > (./configure --enable-debug ; make ; make install) and start it with: > ftp-proxy -v 4 --someotherparams > and then watch the /tmp/ftp-proxy.debug file for informations > Cheers && nutchos, > Tony > Thomas Göttlicher wrote: > > I installed the ftp-proxy from the proxy-suite 1.7. > > > > But when I connect to the proxy-server I get the following message > > after typing my user-name: > > > > 421 Service not available, remote server has closed connection > > Login failed. > > No control connection for command: Permission denied > > > > And as root I get the message: > > > > No control connection for command: No such file or directory > > > > My /var/log/messages only contains: > > > > ftp-proxy[5712]: USER-INF connect from 127.0.0.1 > > > > Does anyone know a answer to my problem? > > > > Thank you! > > > > Thomas

1 0

FRP Proxy and Port Forwarding
by Charles Hart 08 Jan '01

08 Jan '01

I have one external IP address that is attached to a LRP Box (Linux Router Project) which portfw's to an internal private IP address which is running Caldera Open Linux 2.3 and a Wu-ftpd. I can connect from the outside world to the ftp server but always get Error 425 Can't route to host when I do a chdir or list. Is the FTP-proxy app a solution to this problem, and if so does anyone have a working example of this? Your help is greatly appreciate!!! Regards, Charles

1 0