November 2001 - SUSE Proxy Suite - openSUSE Mailing Lists

more question on ldap integration
by Student Learner 27 Nov '01

27 Nov '01

Hi List, I asked some questions on ldap integration earlier, and got a response from Marius. Thx. Well, I'd just implemented what he suggested, and it still doesn't work. I've attached log output. Can you help pleeeaase? Here's the error message: Discovery:/home/student> ftp saturn 8021 Name (saturn:student): jsc49 421 Service not available, remote server has closed connection Login failed. Discovery:/home/student Here's the log from ftp-proxy.log ftp-child [3266] <11/27-01:43:29> USER-INF connect from 12.10.247.23 ftp-child [3266] <11/27-01:43:33> USER-INF 'USER student' from 12.10.247.23 ftp-child [3266] <11/27-01:43:33> TECH-ERR can't read LDAP data for 12.10.247.23: No such object note 12.10.247.23 is the ip addr of discovery - the host I'm connecting to saturn (the proxy server) from. Finally here's the syslog entries from the ldap server Nov 27 01:55:44 saturn slapd[3262]: connection_get(9): got connid=2 Nov 27 01:55:44 saturn slapd[3262]: connection_read(9): checking for input on id =2 Nov 27 01:55:44 saturn slapd[3262]: ber_get_next on fd 9 failed errno=11 (Resour ce temporarily unavailable) Nov 27 01:55:44 saturn slapd[3265]: do_bind Nov 27 01:55:44 saturn slapd[3265]: do_bind: version=2 dn="" method=128 Nov 27 01:55:44 saturn slapd[3265]: send_ldap_result: conn=2 op=0 p=2 Nov 27 01:55:44 saturn slapd[3265]: send_ldap_response: msgid=1 tag=97 err=0 Nov 27 01:55:44 saturn slapd[3265]: do_bind: v2 anonymous bind Nov 27 01:55:44 saturn slapd[3262]: connection_get(9): got connid=2 Nov 27 01:55:44 saturn slapd[3262]: connection_read(9): checking for input on id =2 Nov 27 01:55:44 saturn slapd[3262]: ber_get_next on fd 9 failed errno=11 (Resour ce temporarily unavailable) Nov 27 01:55:44 saturn slapd[3264]: do_search Nov 27 01:55:44 saturn slapd[3264]: => ldbm_back_search Nov 27 01:55:44 saturn slapd[3264]: dn2entry_r: dn: "DC=JUPITER,DC=COM" Nov 27 01:55:44 saturn slapd[3264]: => dn2id( "DC=JUPITER,DC=COM" ) Nov 27 01:55:44 saturn slapd[3264]: => ldbm_cache_open( "/var/lib/ldap/dn2id.dbb ", 7, 600 ) Nov 27 01:55:44 saturn slapd[3264]: <= ldbm_cache_open (cache 0) Nov 27 01:55:44 saturn slapd[3264]: <= dn2id NOID Nov 27 01:55:44 saturn slapd[3264]: send_ldap_result: conn=2 op=1 p=2 Nov 27 01:55:44 saturn slapd[3264]: send_ldap_response: msgid=2 tag=101 err=32 Nov 27 01:55:44 saturn slapd[3262]: connection_get(9): got connid=2 Nov 27 01:55:44 saturn slapd[3262]: connection_read(9): checking for input on id =2 Nov 27 01:55:44 saturn slapd[3262]: ber_get_next on fd 9 failed errno=11 (Resour ce temporarily unavailable) Nov 27 01:55:44 saturn slapd[3265]: do_unbind Nov 27 01:55:44 saturn slapd[3265]: connection_closing: readying conn=2 sd=9 for close Nov 27 01:55:44 saturn slapd[3265]: connection_resched: attempting closing conn= 2 sd=9 Nov 27 01:55:44 saturn slapd[3265]: connection_close: conn=2 sd=9 Would really appreciate any help here. Thanks, Student __________________________________________________ Do You Yahoo!? Yahoo! GeoCities - quick and easy web site hosting, just $8.95/month. http://geocities.yahoo.com/ps/info1

1 0

RV: How i install a cybercafe with suse ?
by Arturo Enriquez 20 Nov '01

20 Nov '01

-----Mensaje original----- De: Arturo Enriquez [mailto:arturo@enriquez.com] Enviado el: domingo, 18 de noviembre de 2001 1:00 Para: proxy-suite-help(a)suse.com Asunto: How i install a cybercafe with suse ? dear friends How i install a cybercafe with suse ? I need to conect a ADSL 512K line to a Server Linux or NT to work as proxy and a lan of 4 machines w98 how? thanks Arturo Enriquez de Leon

2 1

ftp-proxy on Solaris 7?
by Thomas Bätzler 02 Nov '01

02 Nov '01

Hi, I'm trying to port ftp-proxy to Solaris 7, and I'm having a hard time getting it to work properly. Using the hints that Marius Tomaschewski gave in <20010828115222.B13695(a)suse.de> and some more tinkering on my part (replacing inet_aton with inet_addr) I'm getting a clean compile. The resultant code however does not work reliably - I'm experiencing sudden drops of the data connection. Similar patches work fine for a build on Solaris 8, though. I don't understand half of the code that's there, but I guess that the problem is somehow related to the FIONREAD ioctl in socket_ll_read. Does anybody else have a suggestion as to what I could try to get this up and running or where I should proceed with debugging the problem? I'm building the code on a Sun E250 and testing on an E6500. MfG, -- Thomas Bätzler, System Administrator, Network Operations EMEA Harbinger, e-Business Connectivity Group, a part of Peregrine Steinhäuserstraße 22 phone: +49-721-98143-110 D-76135 Karlsruhe / Germany fax: +49-721-98143-196

2 1

Technical Problem
by Robert Rottscholl 02 Nov '01

02 Nov '01

Dear List, I try now for two months to setup an absolutely transparent ftp-proxy. I redirect packages from port 21 to my ftp-proxy port 3129 using iptables (the same way i do with squid) squid works transparent but my ftp-proxy doesn't. I use the configuration given with the patch from suse.com. Has anyone done something like this befor? Can anyone help me? Shema of my network _______ / \ | Internet | -------~-----| Proxy |------| Localnet | | | \________/ Thanks a lot! Ciao ;-) Robert Rottscholl - DE

2 1

RE: [proxy-suite] Proxy of SSL sessions
by Barry Gill 01 Nov '01

01 Nov '01

::There is something that caches asp pages, (Oracle 9iAS WebCache). Thanks, but am trying to get the cust to spend cash RIGHT NOW is a prob, maybe in 8 months, but by then they SHOULD have installed a fully fledged web front end here in ZA. ::If you use squid (and probably any other proxy), the SSL ::connection that the ::user 'sees' on his/her web browser is actually between the ::proxy and the user. ::The proxy then opens a persistent connection with the remote ::server (in the UK), ::and basically forwards the packets between the user and the ::server. It is a ::broker. The problem here is that this is a typical man-in-the-middle attack and may be picked up by the UK side firewall. (Thank you Marius) If I can find a way to successfully do this then my problem is solved. Can the Authentication of user be proxied to web front end in UK and be used to create both the ssl session between EU and Proxy and the ssl session between Proxy and US/EU server?

2 1

Any Reverse SSL Proxy
by Alan 01 Nov '01

01 Nov '01

Dear All Special people, I need reverse SSL proxy for linux. But the squid can't support at this time. I need very urgent. Thank a lot. Alan Au

2 1

RE: [proxy-suite] Proxy of SSL sessions
by Barry Gill 01 Nov '01

01 Nov '01

::Without mirroring the frontend, you won't be buying them ::much, since SSL ::connections usually depend on sessions that expire, and they ::propably won't be ::cached because they would have expired on next use. I know the sessions won't be cached, it's literally, as long as they can be forced to use a specific route I can ensure that congestion is not a problem for the delivery of International Bandwidth to this user for this APP only. ::What you might be buying them is the caching of the cosmetic ::stuff, like the ::pictures and non-ssl pages. I definitely want to cache all images (the pages are .asp thereforee not cacheable) and this is where the proxy side of the question came in. ::Getting back to the question, I don't believe there is a way ::to cache SSL ::connections, or proxy them since they are supposed to be secure and ::non-reusable. (or am I missing the point here?) Nope, not missing the point, am trying to find a way is all. I originally thought to have a non-authenticated SSL session between the ZA proxy and the end user. The page they access consissts of one frame. this frame is a direct refereance to the end US/EU server front end page. Problem is I see no way once the SSL session is up to keep the traffic passing through the frame...

2 1

RE: [proxy-suite] Proxy of SSL sessions
by Barry Gill 01 Nov '01

01 Nov '01

::The squid proxy proxies SSL connections, but there isn't a ::solution for what ::you're trying to do using a proxy server. Basically you're ::trying to mirror a UK ::server in ZA so that the poor suckers who don't have ::international bandwidth can ::access a local server ? You're 'giving' international ::bandwidth to local users ::who don't pay for it? :: ::Working for uunet, would you allow this? I am not trying to give users international bandwidth if they aren't paying for it. The ZA Proxy will be hosted with us and we will manage the QoS of international bandwidth delivery to that box. The supplier (our customer) will pay for this as it increases their end user experience quality. Am trying to find a short term solution without mirroring the fromt end in ZA just yet. Bazz

2 1

Proxy of SSL sessions
by Barry Gill 01 Nov '01

01 Nov '01

Hello All, Has anyone come across a method to proxy a connection between a user and an ssl server, forcing all traffic to remain between the user and proxy and proxy and ssl server. user <--> proxy <--> ssl server Where the user comes in at any point on the web and the proxy is in the public domain (i.e hosted by an ISP). What I am trying to do:- In South Africa international bandwidth is expensive so many ISP's oversell their international bandwidth (all provided via satellite). This makes user experience when accessing some international sites a bit slow. I have a site that is located in Europe that has an HTTPS (ssl) frontend and a large number of people who need to access this form many different ISP's, some of whom have little or no bandwidth available. In order to improve end user experience I am looking to set up a server in South Africa with a ZA specific URL and notify all end users to access this site. I then wish to have the user authenticate on the ZA server and establish an ssl session between ZA server and ZA end user. I am thinking of how to forward the ssl authentication to the US/EU server to establish a ZA end user specific ssl session between US/EU server and ZA proxy and have the proxy take info from ZA end user ssl session and forward it through ZA Proxy and US/EU ssl session and vice versa. My biggest problem is that the guys in US/EU are running .asp pages and have backends into all sorts and as such cannot bring a true front end to ZA just yet. Any ideas, comments or thoughts on this matter would be greatly appreciated. Bazz Barry Gill Product Manager - UUdirect UUNET South Africa - A Worldcom Company Tel: +27 11 235 6540 Fax: +27 11 235 6501 Cel: +27 83 299 1122 barry(a)za.uu.net

2 1