June 2001 - SUSE Proxy Suite - openSUSE Mailing Lists

Re: [proxy-suite] newbie q
by Marius Tomaschewski 29 Jun '01

29 Jun '01

Hi! On Thu, Jun 28, 2001 at 08:02:45AM -0400, Brett Lee wrote: > On Thu, 28 Jun 2001, Marius Tomaschewski wrote: > > On Tue, Jun 26, 2001 at 11:39:17AM -0400, Brett wrote: > > > > > Can someone tell me what configuration option specifies who can > > > connect? I do not have tcp wrappers compiled in. > > > > > > Thanks. > > > > > > linux.ndr.com:/etc/proxy-suite# grep ftp /etc/inetd.conf > > > #ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a > > > ftp stream tcp nowait root /usr/local/proxy-suite/ftp-proxy > > > ftp-proxy > > > # Tftp service is provided primarily for booting. Most sites > > > #tftp dgram udp wait root /usr/sbin/tcpd in.tftpd > > > linux.ndr.com:/etc/proxy-suite# /usr/local/proxy-suite/ftp-proxy -c > > > Config-Section ------ '(-global-)' > > > Config: AllowMagicUser = 'yes' > > > Config: DenyMessage = '/etc/proxy-suite/ftp-deny.txt' > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > > > > > Config: DenyString = 'Service out of order' > > ^^^^^^^^^^^^^^^^^^^^^^ > > > > Leave these options out. They causes, the proxy says "Service > > out of order" to all clients trying to connect. That's all. > > > > Thanks, but, I don't want to let _all_ clients connect. Only those on > the inside of our firewall. We want to use this proxy as a way to put ^^^^^^^^^^^^^^^^^^^^^^^^^^ OK, this is your intention. > files we have created onto other sites ftp servers. I realize that the > proxy suite is primarily for incoming ftp, but we want to use it ^^^^^^^^^^^^^^^^^^^^^^^^^^ not really. it supports both directions. > exclusivly for outgoing ftp (much like the fwtk @ www.tis.com). Have > read _all_ the doc I can find 2-3 times, and can find nothing on this. To use the proxy for outgoing connections you have to use the transparent proxy (on a gateway) and/or magic-user feature: Listen 192.168.1.1 # IP of internal interface AllowTransProxy yes and (optionally) allow your users to specify the destination manually inside of the USER command (user[%host[:port]]): AllowMagicUser yes UseMagicChar % See also TransProxy-Mini-Howto.txt in the source on our ftp server ftp://ftp.suse.com/pub/projects/proxy-suite/src/ You have also to apply the patch file to the source! To restrict alowed clients, use compile the proxy with tcp-wrapper support, set "TCPWrapper yes" in the config file and define a list of allowed clients in /etc/hosts.allow, i.e.: # first match wins: ftp-proxy: 192.168.0.0/255.255.0.0 : ALLOW ftp-proxy: ALL : DENY See the hosts_access(5) and hosts_options(5) manual pages for more informations. Additionaly you can use a ip-filter rule to protect the proxy (i.e. ipchains on Linux). You may also set: SameAddress = yes PortResetsPasv = yes > Finally, is this proxy-suite basically abandoned ? I do not understand what you are meaning. Gruesse, Marius Tomaschewski <mt(a)suse.de> -- SuSE GmbH, Hamburg --- SuSE Labs, Product Developement GPG/PGP public key see: http://www.suse.de/~mt/mt.pgp Key-FP: DF17 271A AD15 006A 5BB9 6C96 CA2F F3F7 373A 1CC0

1 0

newbie q
by Brett 28 Jun '01

28 Jun '01

Can someone tell me what configuration option specifies who can connect? I do not have tcp wrappers compiled in. Thanks. linux.ndr.com:/etc/proxy-suite# grep ftp /etc/inetd.conf #ftp stream tcp nowait root /usr/sbin/tcpd in.ftpd -l -a ftp stream tcp nowait root /usr/local/proxy-suite/ftp-proxy ftp-proxy # Tftp service is provided primarily for booting. Most sites #tftp dgram udp wait root /usr/sbin/tcpd in.tftpd linux.ndr.com:/etc/proxy-suite# /usr/local/proxy-suite/ftp-proxy -c Config-Section ------ '(-global-)' Config: AllowMagicUser = 'yes' Config: DenyMessage = '/etc/proxy-suite/ftp-deny.txt' Config: DenyString = 'Service out of order' Config: DestinationAddress = 'toaster' Config: LogDestination = '/var/log/ftp-proxy.log' Config: SameAddress = 'no' Config: ServerType = 'inetd' Config: WelcomeMessage = '/etc/proxy-suite/ftp-welcome.txt' linux.ndr.com:/etc/proxy-suite# ftp localhost Connected to localhost.localdomain. 421-No way, Jose !!! 421 Service out of order. ftp> bye linux.ndr.com:/etc/proxy-suite# -- Brett Lee Systems/Network Administrator Ned Davis Research Group brett(a)ndr.com

2 1

ipchains filter rules for ftp-proxy
by Alois Treindl 21 Jun '01

21 Jun '01

I intend to run ftp-proxy on the 'director' of an LVS cluster. The ftp server will run on one of the real servers in the cluster. I use ipchains for firewalling the director against the Internet. Only a very limited set of rules is curently active, to allow ssh access to the 'director' and for the load balanced http services, plus DNS and NTP lookups and such stuff. Question: Does someone have a ruleset for ipchains for the additional rules required for the ftp proxy service. a) allowing public access to the ftp-proxy service from outside b) (if possible) allowing inside users to use an ftp client (like ncftp or wget) to access public ftp servers on the Internet. I would be happy to search the mailing list but faild to find a search feature. || Alois Treindl, Astrodienst AG, mailto:alois@astro.com || Zollikon/Zurich, Switzerland

2 5

updated logfile for passive client problem
by Alois Treindl 21 Jun '01

21 Jun '01

I have only now noticed that I had been running an unpatched ftp-proxy 1.7 instead of 1.7p6 (I had been mis-lead by the recent file date on the 1.7 tarball, which is the same as the patch). My problem with the passive client and sysmbolic directory link under Netscape persists. I append an updated debug logfile, which is now from 1.7p6 The location of the bug is marked with 'here comes the bug' where the port 20 connection is opened by the proxy. 14:44:01 < 6281> accepted 5=192.53.104.46 wanting to go to 195.49.62.59 14:44:01 < 6281> config_int: s='(nil)' n='ForkLimit' d=40 14:44:01 < 6281> config_int: s='(nil)' n='MaxClients' d=512 14:44:01 < 6281> config_int: result=64 14:44:01 < 6281> client pid=6415 (192.53.104.46) added 14:44:01 < 6415> {{{{{ ftp-child client-fork 14:44:01 < 6415> config_int: s='(nil)' n='TimeOut' d=900 14:44:01 < 6415> config_int: result=300 14:44:01 < 6415> config_str: s='(nil)' n='DenyMessage' d='(nil)' 14:44:01 < 6415> alloc 68 (com-socket.c:351): 0x8060158 14:44:01 < 6415> created HLS for 0=192.53.104.46:4449 14:44:01 < 6415> USER-INF connect from 192.53.104.46 14:44:01 < 6415> config_str: s='(nil)' n='WelcomeString' d='(nil)' 14:44:01 < 6415> config_str: result='Welcome to Astrodienst' 14:44:01 < 6415> config_str: s='(nil)' n='WelcomeMessage' d='(nil)' 14:44:01 < 6415> printf Cli-Ctrl 0=192.53.104.46: 29 bytes '220 Welcome to Astrodienst.' 14:44:01 < 6415> alloc 53 (com-socket.c:712): 0x80601a0 14:44:01 < 6415> config_str: s='(nil)' n='ServerRoot' d='(nil)' 14:44:01 < 6415> FD_SET Cli-Ctrl for W 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:01 < 6415> free 0x80601a0 (com-socket.c:1070) 14:44:01 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 29 bytes 14:44:01 < 6415> client-loop ... 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:01 < 6415> alloc 40 (com-socket.c:980): 0x80601a0 14:44:01 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 16 bytes 14:44:01 < 6415> client-loop ... 14:44:01 < 6415> free 0x80601a0 (com-socket.c:562) 14:44:01 < 6415> gets Cli-Ctrl 0=192.53.104.46: 14 bytes 'USER anonymous' 14:44:01 < 6415> from User-PI (0): cmd='USER' arg='anonymous' 14:44:01 < 6415> config_str: s='(nil)' n='ValidCommands' d='(nil)' 14:44:01 < 6415> allowed: '(all)' 14:44:01 < 6415> config_bool: s='(nil)' n='AllowTransProxy' d=0 14:44:01 < 6415> config_bool: result=1 14:44:01 < 6415> interface lo has ip-address: 127.0.0.1 14:44:01 < 6415> interface eth0 has ip-address: 10.1.1.254 14:44:01 < 6415> interface eth1 has ip-address: 195.49.62.58 14:44:01 < 6415> interface eth1:0 has ip-address: 195.49.62.59 14:44:01 < 6415> found local ip addr: 195.49.62.59 14:44:01 < 6415> USER-WRN requested transparent proxy dest 195.49.62.59 is local 14:44:01 < 6415> config_bool: s='(nil)' n='AllowMagicUser' d=0 14:44:01 < 6415> config_str: s='(nil)' n='DestinationAddress' d='(nil)' 14:44:01 < 6415> config_str: result='w1' 14:44:01 < 6415> USER-INF 'USER anonymous' from 192.53.104.46 14:44:01 < 6415> alloc 10 (ftp-cmds.c:489): 0x80601a0 14:44:01 < 6415> USER-INF reading data for 'anonymous' from cfg-file 14:44:01 < 6415> config_addr: s='anonymous' n='DestinationAddress' d='255.255.255.255' 14:44:01 < 6415> config_addr: s='(nil)' n='DestinationAddress' d='255.255.255.255' 14:44:01 < 6415> str2addr: in='w1' 14:44:01 < 6415> config_addr: result='10.1.1.1' 14:44:01 < 6415> DestAddr for 192.53.104.46: '10.1.1.1' 14:44:01 < 6415> config_port: s='anonymous' n='DestinationPort' d=21 14:44:01 < 6415> config_port: s='(nil)' n='DestinationPort' d=21 14:44:01 < 6415> DestPort for 192.53.104.46: 21 14:44:01 < 6415> config_str: s='anonymous' n='DestinationTransferMode' d='client' 14:44:01 < 6415> config_str: s='(nil)' n='DestinationTransferMode' d='client' 14:44:01 < 6415> config_str: result='passive' 14:44:01 < 6415> DestMode for 192.53.104.46: passive 14:44:01 < 6415> config_port: s='anonymous' n='DestinationMinPort' d=0 14:44:01 < 6415> config_port: s='(nil)' n='DestinationMinPort' d=0 14:44:01 < 6415> config_port: s='anonymous' n='DestinationMaxPort' d=0 14:44:01 < 6415> config_port: s='(nil)' n='DestinationMaxPort' d=0 14:44:01 < 6415> DestRange for 192.53.104.46: 0-0 14:44:01 < 6415> config_port: s='anonymous' n='ActiveMinDataPort' d=0 14:44:01 < 6415> config_port: s='(nil)' n='ActiveMinDataPort' d=0 14:44:01 < 6415> config_port: s='anonymous' n='ActiveMaxDataPort' d=0 14:44:01 < 6415> config_port: s='(nil)' n='ActiveMaxDataPort' d=0 14:44:01 < 6415> ActiveRange for 192.53.104.46: 20-20 14:44:01 < 6415> config_port: s='anonymous' n='PassiveMinDataPort' d=0 14:44:01 < 6415> config_port: s='(nil)' n='PassiveMinDataPort' d=0 14:44:01 < 6415> config_port: result=41000 14:44:01 < 6415> config_port: s='anonymous' n='PassiveMaxDataPort' d=0 14:44:01 < 6415> config_port: s='(nil)' n='PassiveMaxDataPort' d=0 14:44:01 < 6415> config_port: result=41999 14:44:01 < 6415> PassiveRange for 192.53.104.46: 41000-41999 14:44:01 < 6415> config_bool: s='anonymous' n='SameAddress' d=1 14:44:01 < 6415> config_bool: s='(nil)' n='SameAddress' d=1 14:44:01 < 6415> config_int: s='anonymous' n='TimeOut' d=900 14:44:01 < 6415> config_int: s='(nil)' n='TimeOut' d=900 14:44:01 < 6415> config_int: result=300 14:44:01 < 6415> SameAddress for 192.53.104.46: yes 14:44:01 < 6415> TimeOut for 192.53.104.46: 300 14:44:01 < 6415> config_str: s='anonymous' n='ValidCommands' d='(nil)' 14:44:01 < 6415> config_str: s='(nil)' n='ValidCommands' d='(nil)' 14:44:01 < 6415> allowed: '(all)' 14:44:01 < 6415> config_int: s='(nil)' n='SockBindRand' d=0 14:44:01 < 6415> alloc 68 (com-socket.c:351): 0x8060810 14:44:01 < 6415> created HLS for 4=10.1.1.1:21 14:44:01 < 6415> Srv-Ctrl is 10.1.1.1:21 14:44:01 < 6415> FD_SET Srv-Ctrl for R 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:01 < 6415> alloc 68 (com-socket.c:980): 0x8060858 14:44:01 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 44 bytes 14:44:01 < 6415> client-loop ... 14:44:01 < 6415> free 0x8060858 (com-socket.c:562) 14:44:01 < 6415> gets Srv-Ctrl 4=10.1.1.1: 42 bytes '220 ProFTPD 1.2.2rc2 Server (ProFTPD) [w1]' 14:44:01 < 6415> from Server-PI (4): '220 ProFTPD 1.2.2rc2 Server (ProFTPD) [w1]' 14:44:01 < 6415> printf Srv-Ctrl 4=10.1.1.1: 16 bytes 'USER anonymous' 14:44:01 < 6415> alloc 40 (com-socket.c:712): 0x8060858 14:44:01 < 6415> FD_SET Srv-Ctrl for W 14:44:01 < 6415> FD_SET Srv-Ctrl for R 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:01 < 6415> free 0x8060858 (com-socket.c:1070) 14:44:01 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 16 bytes 14:44:01 < 6415> client-loop ... 14:44:01 < 6415> FD_SET Srv-Ctrl for R 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:01 < 6415> alloc 100 (com-socket.c:980): 0x8061150 14:44:01 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 76 bytes 14:44:01 < 6415> client-loop ... 14:44:01 < 6415> free 0x8061150 (com-socket.c:562) 14:44:01 < 6415> gets Srv-Ctrl 4=10.1.1.1: 74 bytes '331 Anonymous login ok, send your complete email address as your password.' 14:44:01 < 6415> from Server-PI (4): '331 Anonymous login ok, send your complete email address as your password.' 14:44:01 < 6415> printf Cli-Ctrl 0=192.53.104.46: 76 bytes '331 Anonymous login ok, send your complete email address as your password.' 14:44:01 < 6415> alloc 100 (com-socket.c:712): 0x8061150 14:44:01 < 6415> FD_SET Srv-Ctrl for R 14:44:01 < 6415> FD_SET Cli-Ctrl for W 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:01 < 6415> free 0x8061150 (com-socket.c:1070) 14:44:01 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 76 bytes 14:44:01 < 6415> client-loop ... 14:44:01 < 6415> FD_SET Srv-Ctrl for R 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:01 < 6415> alloc 39 (com-socket.c:980): 0x8060858 14:44:01 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 15 bytes 14:44:01 < 6415> client-loop ... 14:44:01 < 6415> free 0x8060858 (com-socket.c:562) 14:44:01 < 6415> gets Cli-Ctrl 0=192.53.104.46: 13 bytes 'PASS mozilla@' 14:44:01 < 6415> from User-PI (0): cmd='PASS' arg='mozilla@' 14:44:01 < 6415> printf Srv-Ctrl 4=10.1.1.1: 15 bytes 'PASS mozilla@' 14:44:01 < 6415> alloc 39 (com-socket.c:712): 0x8060858 14:44:01 < 6415> USER-INF 'PASS XXXX' from 192.53.104.46 14:44:01 < 6415> FD_SET Srv-Ctrl for W 14:44:01 < 6415> FD_SET Srv-Ctrl for R 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:01 < 6415> free 0x8060858 (com-socket.c:1070) 14:44:01 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 15 bytes 14:44:01 < 6415> client-loop ... 14:44:01 < 6415> FD_SET Srv-Ctrl for R 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:01 < 6415> alloc 75 (com-socket.c:980): 0x8060858 14:44:01 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 51 bytes 14:44:01 < 6415> client-loop ... 14:44:01 < 6415> free 0x8060858 (com-socket.c:562) 14:44:01 < 6415> gets Srv-Ctrl 4=10.1.1.1: 49 bytes '230 Anonymous access granted, restrictions apply.' 14:44:01 < 6415> from Server-PI (4): '230 Anonymous access granted, restrictions apply.' 14:44:01 < 6415> printf Cli-Ctrl 0=192.53.104.46: 51 bytes '230 Anonymous access granted, restrictions apply.' 14:44:01 < 6415> alloc 75 (com-socket.c:712): 0x8060858 14:44:01 < 6415> FD_SET Srv-Ctrl for R 14:44:01 < 6415> FD_SET Cli-Ctrl for W 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:01 < 6415> free 0x8060858 (com-socket.c:1070) 14:44:01 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 51 bytes 14:44:01 < 6415> client-loop ... 14:44:01 < 6415> FD_SET Srv-Ctrl for R 14:44:01 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 32 (com-socket.c:980): 0x8060858 14:44:02 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 8 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8060858 (com-socket.c:562) 14:44:02 < 6415> gets Cli-Ctrl 0=192.53.104.46: 6 bytes 'REST 0' 14:44:02 < 6415> from User-PI (0): cmd='REST' arg='0' 14:44:02 < 6415> printf Srv-Ctrl 4=10.1.1.1: 8 bytes 'REST 0' 14:44:02 < 6415> alloc 32 (com-socket.c:712): 0x8060858 14:44:02 < 6415> USER-INF 'REST 0' from 192.53.104.46 14:44:02 < 6415> FD_SET Srv-Ctrl for W 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8060858 (com-socket.c:1070) 14:44:02 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 8 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 91 (com-socket.c:980): 0x8060858 14:44:02 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 67 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8060858 (com-socket.c:562) 14:44:02 < 6415> gets Srv-Ctrl 4=10.1.1.1: 65 bytes '350 Restarting at 0. Send STORE or RETRIEVE to initiate transfer.' 14:44:02 < 6415> from Server-PI (4): '350 Restarting at 0. Send STORE or RETRIEVE to initiate transfer.' 14:44:02 < 6415> printf Cli-Ctrl 0=192.53.104.46: 67 bytes '350 Restarting at 0. Send STORE or RETRIEVE to initiate transfer.' 14:44:02 < 6415> alloc 91 (com-socket.c:712): 0x8060858 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for W 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8060858 (com-socket.c:1070) 14:44:02 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 67 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 30 (com-socket.c:980): 0x8060858 14:44:02 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 6 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8060858 (com-socket.c:562) 14:44:02 < 6415> gets Cli-Ctrl 0=192.53.104.46: 4 bytes 'SYST' 14:44:02 < 6415> from User-PI (0): cmd='SYST' arg='' 14:44:02 < 6415> printf Srv-Ctrl 4=10.1.1.1: 6 bytes 'SYST' 14:44:02 < 6415> alloc 30 (com-socket.c:712): 0x8060858 14:44:02 < 6415> USER-INF 'SYST' from 192.53.104.46 14:44:02 < 6415> FD_SET Srv-Ctrl for W 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8060858 (com-socket.c:1070) 14:44:02 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 6 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 43 (com-socket.c:980): 0x8060858 14:44:02 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 19 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8060858 (com-socket.c:562) 14:44:02 < 6415> gets Srv-Ctrl 4=10.1.1.1: 17 bytes '215 UNIX Type: L8' 14:44:02 < 6415> from Server-PI (4): '215 UNIX Type: L8' 14:44:02 < 6415> printf Cli-Ctrl 0=192.53.104.46: 19 bytes '215 UNIX Type: L8' 14:44:02 < 6415> alloc 43 (com-socket.c:712): 0x8060858 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for W 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8060858 (com-socket.c:1070) 14:44:02 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 19 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 30 (com-socket.c:980): 0x8060858 14:44:02 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 6 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8060858 (com-socket.c:562) 14:44:02 < 6415> gets Cli-Ctrl 0=192.53.104.46: 4 bytes 'PASV' 14:44:02 < 6415> from User-PI (0): cmd='PASV' arg='' 14:44:02 < 6415> config_int: s='(nil)' n='SockBindRand' d=0 14:44:02 < 6415> bind 195.49.62.59:41000 status: Success 14:44:02 < 6415> bound socket to port 41000 14:44:02 < 6415> alloc 68 (com-socket.c:351): 0x8060858 14:44:02 < 6415> created HLS for -1=:0 14:44:02 < 6415> listen: Cli-Data (fd=5) 195.49.62.59:41000 14:44:02 < 6415> config_str: s='(nil)' n='TranslatedAddress' d='(nil)' 14:44:02 < 6415> printf Cli-Ctrl 0=192.53.104.46: 50 bytes '227 Entering Passive Mode (195,49,62,59,160,40).' 14:44:02 < 6415> alloc 74 (com-socket.c:712): 0x8061150 14:44:02 < 6415> USER-INF PASV set to 195.49.62.59:41000 for 192.53.104.46 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for W 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061150 (com-socket.c:1070) 14:44:02 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 50 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> accept Cli-Data (6) from 192.53.104.46 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 32 (com-socket.c:980): 0x8061150 14:44:02 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 8 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061150 (com-socket.c:562) 14:44:02 < 6415> gets Cli-Ctrl 0=192.53.104.46: 6 bytes 'TYPE I' 14:44:02 < 6415> from User-PI (0): cmd='TYPE' arg='I' 14:44:02 < 6415> printf Srv-Ctrl 4=10.1.1.1: 8 bytes 'TYPE I' 14:44:02 < 6415> alloc 32 (com-socket.c:712): 0x8061150 14:44:02 < 6415> USER-INF 'TYPE I' from 192.53.104.46 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for W 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061150 (com-socket.c:1070) 14:44:02 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 8 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 44 (com-socket.c:980): 0x8061150 14:44:02 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 20 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061150 (com-socket.c:562) 14:44:02 < 6415> gets Srv-Ctrl 4=10.1.1.1: 18 bytes '200 Type set to I.' 14:44:02 < 6415> from Server-PI (4): '200 Type set to I.' 14:44:02 < 6415> printf Cli-Ctrl 0=192.53.104.46: 20 bytes '200 Type set to I.' 14:44:02 < 6415> alloc 44 (com-socket.c:712): 0x8061150 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for W 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061150 (com-socket.c:1070) 14:44:02 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 20 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 51 (com-socket.c:980): 0x8061150 14:44:02 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 27 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061150 (com-socket.c:562) 14:44:02 < 6415> gets Cli-Ctrl 0=192.53.104.46: 25 bytes 'SIZE /pub/swisseph/my_doc' 14:44:02 < 6415> from User-PI (0): cmd='SIZE' arg='/pub/swisseph/my_doc' 14:44:02 < 6415> printf Srv-Ctrl 4=10.1.1.1: 27 bytes 'SIZE /pub/swisseph/my_doc' 14:44:02 < 6415> alloc 51 (com-socket.c:712): 0x8061150 14:44:02 < 6415> USER-INF 'SIZE /pub/swisseph/my_doc' from 192.53.104.46 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for W 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061150 (com-socket.c:1070) 14:44:02 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 27 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 71 (com-socket.c:980): 0x8061150 14:44:02 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 47 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061150 (com-socket.c:562) 14:44:02 < 6415> gets Srv-Ctrl 4=10.1.1.1: 45 bytes '550 /pub/swisseph/my_doc: not a regular file.' 14:44:02 < 6415> from Server-PI (4): '550 /pub/swisseph/my_doc: not a regular file.' 14:44:02 < 6415> printf Cli-Ctrl 0=192.53.104.46: 47 bytes '550 /pub/swisseph/my_doc: not a regular file.' 14:44:02 < 6415> alloc 71 (com-socket.c:712): 0x8061150 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for W 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061150 (com-socket.c:1070) 14:44:02 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 47 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 51 (com-socket.c:980): 0x8061150 14:44:02 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 27 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061150 (com-socket.c:562) 14:44:02 < 6415> gets Cli-Ctrl 0=192.53.104.46: 25 bytes 'MDTM /pub/swisseph/my_doc' 14:44:02 < 6415> from User-PI (0): cmd='MDTM' arg='/pub/swisseph/my_doc' 14:44:02 < 6415> printf Srv-Ctrl 4=10.1.1.1: 27 bytes 'MDTM /pub/swisseph/my_doc' 14:44:02 < 6415> alloc 51 (com-socket.c:712): 0x8061150 14:44:02 < 6415> USER-INF 'MDTM /pub/swisseph/my_doc' from 192.53.104.46 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for W 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061150 (com-socket.c:1070) 14:44:02 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 27 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 69 (com-socket.c:980): 0x8061150 14:44:02 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 45 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061150 (com-socket.c:562) 14:44:02 < 6415> gets Srv-Ctrl 4=10.1.1.1: 43 bytes '550 /pub/swisseph/my_doc: not a plain file.' 14:44:02 < 6415> from Server-PI (4): '550 /pub/swisseph/my_doc: not a plain file.' 14:44:02 < 6415> printf Cli-Ctrl 0=192.53.104.46: 45 bytes '550 /pub/swisseph/my_doc: not a plain file.' 14:44:02 < 6415> alloc 69 (com-socket.c:712): 0x8061150 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for W 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061150 (com-socket.c:1070) 14:44:02 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 45 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 51 (com-socket.c:980): 0x8061150 14:44:02 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 27 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061150 (com-socket.c:562) 14:44:02 < 6415> gets Cli-Ctrl 0=192.53.104.46: 25 bytes 'RETR /pub/swisseph/my_doc' 14:44:02 < 6415> from User-PI (0): cmd='RETR' arg='/pub/swisseph/my_doc' 14:44:02 < 6415> USER-INF 'RETR /pub/swisseph/my_doc' from 192.53.104.46 14:44:02 < 6415> printf Srv-Ctrl 4=10.1.1.1: 6 bytes 'PASV' 14:44:02 < 6415> alloc 30 (com-socket.c:712): 0x8061150 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for W 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061150 (com-socket.c:1070) 14:44:02 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 6 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 71 (com-socket.c:980): 0x8061150 14:44:02 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 47 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061150 (com-socket.c:562) 14:44:02 < 6415> gets Srv-Ctrl 4=10.1.1.1: 45 bytes '227 Entering Passive Mode (10,1,1,1,214,119).' 14:44:02 < 6415> from Server-PI (4): '227 Entering Passive Mode (10,1,1,1,214,119).' 14:44:02 < 6415> config_int: s='(nil)' n='SockBindRand' d=0 14:44:02 < 6415> alloc 68 (com-socket.c:351): 0x8061150 14:44:02 < 6415> created HLS for 5=10.1.1.1:54903 14:44:02 < 6415> connect: Srv-Data fd=5 14:44:02 < 6415> config_int: s='(nil)' n='SockBindRand' d=0 14:44:02 < 6415> printf Srv-Ctrl 4=10.1.1.1: 27 bytes 'RETR /pub/swisseph/my_doc' 14:44:02 < 6415> alloc 51 (com-socket.c:712): 0x8061198 14:44:02 < 6415> TECH-INF 'RETR /pub/swisseph/my_doc' sent for 192.53.104.46 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for W 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061198 (com-socket.c:1070) 14:44:02 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 27 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 70 (com-socket.c:980): 0x8061198 14:44:02 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 46 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061198 (com-socket.c:562) 14:44:02 < 6415> gets Srv-Ctrl 4=10.1.1.1: 44 bytes '550 /pub/swisseph/my_doc: Not a regular file' 14:44:02 < 6415> from Server-PI (4): '550 /pub/swisseph/my_doc: Not a regular file' 14:44:02 < 6415> printf Cli-Ctrl 0=192.53.104.46: 46 bytes '550 /pub/swisseph/my_doc: Not a regular file' 14:44:02 < 6415> alloc 70 (com-socket.c:712): 0x8061198 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for W 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061198 (com-socket.c:1070) 14:44:02 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 46 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 50 (com-socket.c:980): 0x8061198 14:44:02 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 26 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061198 (com-socket.c:562) 14:44:02 < 6415> gets Cli-Ctrl 0=192.53.104.46: 24 bytes 'CWD /pub/swisseph/my_doc' 14:44:02 < 6415> from User-PI (0): cmd='CWD' arg='/pub/swisseph/my_doc' 14:44:02 < 6415> printf Srv-Ctrl 4=10.1.1.1: 26 bytes 'CWD /pub/swisseph/my_doc' 14:44:02 < 6415> alloc 50 (com-socket.c:712): 0x8061198 14:44:02 < 6415> USER-INF 'CWD /pub/swisseph/my_doc' from 192.53.104.46 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for W 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061198 (com-socket.c:1070) 14:44:02 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 26 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 53 (com-socket.c:980): 0x8061198 14:44:02 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 29 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061198 (com-socket.c:562) 14:44:02 < 6415> gets Srv-Ctrl 4=10.1.1.1: 27 bytes '250 CWD command successful.' 14:44:02 < 6415> from Server-PI (4): '250 CWD command successful.' 14:44:02 < 6415> printf Cli-Ctrl 0=192.53.104.46: 29 bytes '250 CWD command successful.' 14:44:02 < 6415> alloc 53 (com-socket.c:712): 0x8061198 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for W 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061198 (com-socket.c:1070) 14:44:02 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 29 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 30 (com-socket.c:980): 0x8061198 14:44:02 < 6415> ll_read Cli-Ctrl 0=192.53.104.46: 6 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8061198 (com-socket.c:562) 14:44:02 < 6415> gets Cli-Ctrl 0=192.53.104.46: 4 bytes 'LIST' 14:44:02 < 6415> from User-PI (0): cmd='LIST' arg='' 14:44:02 < 6415> USER-INF 'LIST' from 192.53.104.46 14:44:02 < 6415> printf Srv-Ctrl 4=10.1.1.1: 6 bytes 'PASV' 14:44:02 < 6415> alloc 30 (com-socket.c:712): 0x8061198 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for W 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061198 (com-socket.c:1070) 14:44:02 < 6415> ll_write Srv-Ctrl 4=10.1.1.1: 6 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Cli-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> closed: Srv-Data -1=10.1.1.1 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> about to destroy Srv-Data 14:44:02 < 6415> deleting HLS Srv-Data -1=10.1.1.1:54903 14:44:02 < 6415> free 0x8061150 (com-socket.c:497) 14:44:02 < 6415> FD_CLR Cli-Data 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> about to destroy Cli-Data 14:44:02 < 6415> USER-INF Transfer for 192.53.104.46: LIST '' 1 sec 14:44:02 < 6415> deleting HLS Cli-Data -1=192.53.104.46:4450 14:44:02 < 6415> free 0x8060858 (com-socket.c:497) 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> alloc 71 (com-socket.c:980): 0x8060858 14:44:02 < 6415> ll_read Srv-Ctrl 4=10.1.1.1: 47 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x8060858 (com-socket.c:562) 14:44:02 < 6415> gets Srv-Ctrl 4=10.1.1.1: 45 bytes '227 Entering Passive Mode (10,1,1,1,214,120).' 14:44:02 < 6415> from Server-PI (4): '227 Entering Passive Mode (10,1,1,1,214,120).' 14:44:02 < 6415> config_int: s='(nil)' n='SockBindRand' d=0 14:44:02 < 6415> alloc 68 (com-socket.c:351): 0x8060858 14:44:02 < 6415> created HLS for 5=10.1.1.1:54904 14:44:02 < 6415> connect: Srv-Data fd=5 14:44:02 < 6415> config_int: s='(nil)' n='SockBindRand' d=0 **** here comes the bug 14:44:02 < 6415> Cli-Data: about to bind to 195.49.62.59:range(20-20) 14:44:02 < 6415> bind 195.49.62.59:20 status: Success 14:44:02 < 6415> bound socket to port 20 14:44:02 < 6415> Cli-Data: connect failed with 'No route to host' 14:44:02 < 6415> TECH-ERR can't connect Cli-Data for 192.53.104.46 (errno=113 [No route to host]) 14:44:02 < 6415> printf Cli-Ctrl 0=192.53.104.46: 33 bytes '425 Can't open data connection.' 14:44:02 < 6415> alloc 57 (com-socket.c:712): 0x8061150 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for W 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> free 0x8061150 (com-socket.c:1070) 14:44:02 < 6415> ll_write Cli-Ctrl 0=192.53.104.46: 33 bytes 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> FD_SET Srv-Data for R 14:44:02 < 6415> FD_SET Srv-Ctrl for R 14:44:02 < 6415> FD_SET Cli-Ctrl for R 14:44:02 < 6415> closed: Cli-Ctrl -1=192.53.104.46 14:44:02 < 6415> client-loop ... 14:44:02 < 6415> free 0x80601a0 (ftp-client.c:398) 14:44:02 < 6415> }}}}} ftp-child client-exit 14:44:02 < 6415> deleting HLS Srv-Data 5=10.1.1.1:54904 14:44:02 < 6415> free 0x8060858 (com-socket.c:497) 14:44:02 < 6415> deleting HLS Srv-Ctrl 4=10.1.1.1:21 14:44:02 < 6415> free 0x8060810 (com-socket.c:497) 14:44:02 < 6415> deleting HLS Cli-Ctrl -1=192.53.104.46:4449 14:44:02 < 6415> free 0x8060158 (com-socket.c:497) 14:44:02 < 6415> free 0x8060138 (com-syslog.c:534) 14:44:02 < 6415> config_cleanup 14:44:02 < 6415> free 0x805fc38 (com-config.c:124) 14:44:02 < 6415> free 0x805fc50 (com-config.c:126) 14:44:02 < 6415> free 0x805fc28 (com-config.c:127) 14:44:02 < 6415> free 0x805fc70 (com-config.c:124) 14:44:02 < 6415> free 0x805fc88 (com-config.c:126) 14:44:02 < 6415> free 0x805fc60 (com-config.c:127) 14:44:02 < 6415> free 0x805fca8 (com-config.c:124) 14:44:02 < 6415> free 0x805fcc8 (com-config.c:126) 14:44:02 < 6415> free 0x805fc98 (com-config.c:127) 14:44:02 < 6415> free 0x805fce8 (com-config.c:124) 14:44:02 < 6415> free 0x805fcf8 (com-config.c:126) 14:44:02 < 6415> free 0x805fcd8 (com-config.c:127) 14:44:02 < 6415> free 0x805fd18 (com-config.c:124) 14:44:02 < 6415> free 0x805fd30 (com-config.c:126) 14:44:02 < 6415> free 0x805fd08 (com-config.c:127) 14:44:02 < 6415> free 0x805ffe8 (com-config.c:124) 14:44:02 < 6415> free 0x805fff8 (com-config.c:126) 14:44:02 < 6415> free 0x805fd50 (com-config.c:127) 14:44:02 < 6415> free 0x8060018 (com-config.c:124) 14:44:02 < 6415> free 0x8060030 (com-config.c:126) 14:44:02 < 6415> free 0x8060008 (com-config.c:127) 14:44:02 < 6415> free 0x80600a8 (com-config.c:124) 14:44:02 < 6415> free 0x80600c0 (com-config.c:126) 14:44:02 < 6415> free 0x8060098 (com-config.c:127) 14:44:02 < 6415> free 0x8060070 (com-config.c:124) 14:44:02 < 6415> free 0x8060088 (com-config.c:126) 14:44:02 < 6415> free 0x8060060 (com-config.c:127) 14:44:02 < 6415> free 0x80600e0 (com-config.c:124) 14:44:02 < 6415> free 0x80600f8 (com-config.c:126) 14:44:02 < 6415> free 0x80600d0 (com-config.c:127) 14:44:02 < 6415> free 0x8060118 (com-config.c:124) 14:44:02 < 6415> free 0x8060128 (com-config.c:126) 14:44:02 < 6415> free 0x8060108 (com-config.c:127) 14:44:02 < 6415> free 0x80602d8 (com-config.c:124) 14:44:02 < 6415> free 0x80602e8 (com-config.c:126) 14:44:02 < 6415> free 0x80602c8 (com-config.c:127) 14:44:02 < 6415> free 0x8060308 (com-config.c:124) 14:44:02 < 6415> free 0x8060320 (com-config.c:126) 14:44:02 < 6415> free 0x80602f8 (com-config.c:127) 14:44:02 < 6415> free 0x805fc18 (com-config.c:131) 14:44:02 < 6415> ------------- ftp-child exiting ------------- 14:44:02 < 6281> client pid=6415 (192.53.104.46) gone

2 1

Re: [proxy-suite] ipchains filter rules for ftp-proxy - done
by Alois Treindl 21 Jun '01

21 Jun '01

I think I got it, by thinking a bit more clearly and watching my ipchains filter with more logging enabled. in ftp-proxy.conf the only lines uncommented are: DestinationAddress 10.1.1.1 DestinationPort 21 Listen 195.49.62.59 PassiveMinDataPort 41000 PassiveMaxDataPort 41999 in my ipchains ruleset I have: # allow incoming ftp command connections on VIP -A input -j ACCEPT -i eth1 -p tcp -s ${ALL} $NPORTS -d ${VIP} 21 $L # data connections in active mode -A input -j ACCEPT -i eth1 -p tcp -s ${ALL} $NPORTS -d ${VIP} 20 $L # allow data connections in passive mode -A input -j ACCEPT -i eth1 -p tcp -s ${ALL} $NPORTS -d ${VIP} ${FTP_PORTS} $L where FTP_PORTS="41000:41999" NPORTS="1024:65535" ALL=0/0 VIP=195.49.62.59 Now I will have to find out how to configure a second proxy to allow inside clients to connect to outside ftp servers. --------------------------------------- | | eth1: real address $DEP, virtual address eth1:0 $VIP | DEP=195.49.62.58 VIP=195.49.62.59 +---------------------+ | LVS-NAT director | running kernel 2.2.19 | ipchains firewall | | ftp-proxy | +---------------------+ | eth0: 10.1.1.254 hostname="w0" | | switch--------------- other real http servers w2, w3, w4, ... | | eth0: 10.1.1.1 hostname="w1" +---------------------+ | http server | running kernel 2.4.5 | ftp server | ----------------------+

1 0

Help needed for LVS+ipchains+ Suse FTP Proxy,
by Alois Treindl 20 Jun '01

20 Jun '01

Hi I think I need some assistance. I have a problem to understand the cooperation between ftp proxy, ipvsadm and ipchains in a Linux virtual cluster system (LVS). The LVS consists of a load balancing 'director' operating in NAT mode and also acting as an ipchains firewall. Its main purpose is to loadbalance a http and https web server. It has two interfaces, one connecting to the Internet, the other to its privat network where four real servers are. What I want to do is this: set up an ftp server on 1 realserver (no need to load balance), so that it can be accessed by ***BOTH**** active and passive ftp from outside clients. Use ftp-proxy on the director, to keep the open ports and vulnerability to a minimum. There are three configuration scripts/files which need to cooperate: ftp-proxy.conf ipvs_rules (my shell script to configure ipvsadm) ipchains_rules (our shell script to set firewall rules) My main confusion is about who does the forwarding and NAT stuff: rules for ipvsadm, or rules for ipcains, or both? I can't seem to get that part right. Has any user of the Suse ftp-proxy ever set it up on an LVS director which also had strict firewall rules to maintain? What do all the configuration settings look like (please be explicit) for ftp-prox, ipvsadm and ipchains? Alois

1 0

compile error proxy-suite 1.7
by Alois Treindl 20 Jun '01

20 Jun '01

I get this error with 'make' in proxy-suite-1.7 gcc -g -O2 -c -I. -I.. -I../common ftp-cmds.c ftp-cmds.c: In function `cmds_user': ftp-cmds.c:374: structure has no member named `regex' ftp-cmds.c:376: structure has no member named `regex' ftp-cmds.c:376: warning: assignment makes pointer from integer without a cast I am trying to build it on Redhat 7.1 || Alois Treindl, Astrodienst AG, mailto:alois@astro.com || Zollikon/Zurich, Switzerland

2 1

Re: [proxy-suite] Re: Question about proxy-suite configuration.
by Louis W. Erickson 15 Jun '01

15 Jun '01

Hi there! I've got some more questions, after having messed around with the proxy some more and read what you said, Marius. And, what you said makes sense... On Thu, 14 Jun 2001, Marius Tomaschewski wrote: > On Thu, Jun 14, 2001 at 10:30:56AM -0700, Louis W. Erickson wrote: > > > > On Wed, 13 Jun 2001 13:11:28 +0200, Marius Tomaschewski <mt(a)suse.de> > > wrote: > > > > > Hi! [snip] > The version from ftp://ftp.suse.com/pub/projects/proxy-suite/src/ ? > > -rw-r--r-- 1 suse suse 1505 Jun 7 07:18 CHANGES.mt > -rw-r--r-- 1 suse suse 491 Jun 7 07:18 build-freebsd4.sh > -rw-r--r-- 1 suse suse 789 Jun 7 07:18 build-solaris7.sh > -rw-r--r-- 1 suse suse 81749 Jun 7 07:18 proxy-suite-1.7.dif > -rw-r--r-- 1 suse suse 170793 Jun 7 07:18 proxy-suite-1.7.tar.gz > Yes, that is the one I'm using. > > I don't think I need TranslateAddress. The proxy should be the one who > > talks to each side, and it is running on the firewall, which can get to > > both internal and external address directly. > > No, I was only confused by something :-) It's easy to get confused when talking about proxies and clients and servers. =). I may need TranslateAddress after all; I don't know yet. [snip] > > = Louis Erickson > = Marius Tomaschewski > > The FTP server has a data connection to the proxy. The proxy should now > > make a data connection to the client. This is from the debug logs: > > > > 09:47:40 < 348> try to con-bind Cli-Data to 192.168.0.250:20 > > 09:48:54 < 348> TECH-ERR can't connect Cli-Data for 158.252.208.8 (errno=60 [Connection timed out]) > > > > Now, it looks like it's trying to bind the client data port to > > 192.168.0.250:20. > > > > In ftp-client.c, in the function client_xfer_fireup(), it seems to make > > the connection for the active FTP connection. It calls societ_d_connect > > with ctx.cli_addr and ctx.cli_port again. > > > > The debug output says this is 192.168.0.250, port 20. Why is it not the > > client address/port of 158.252.208.8:1577 that was stored in the PORT > > command above? > > > > 192.168.0.250 is the proxy-server's own IP address. > > It _binds_ to post 20 in active mode and uses this bound socket > to _connect_ to the client (as set in PORT command). > > Your client will get a connect from proxy, port 20 to the port > the client has set in its port command. this seems to be not > possible, so it times out (bind 09:47:40, error 09:48:54). > > You firewall should allow connections from > proxy, port 20 ===> client, port > 1024 > > Or you can set the active port range to other ports (or 0 to > use a dynamic port). > > > Have I misunderstood? In active FTP, a PORT command from the client tells > > the server to connect to the client, who listens. The proxy needs to > > connect back to the client. Instead, it appears to be trying to connect > > to it's self. > > no, it only binds the socket before connect so the client gets a connect > from proxy, port 20. > Okay. What I was misreading is the bind call as the connect call, and you're exactly right. I added a little more output to my copy here, and the bind works perfectly. It's the connection that fails, and I think I know why. What to do about it, I don't know. Let me explain, and maybe you have an answer, or can tell me where I've missed something. What confused me above is the binding to 192.168.0.250; the IP of the firewall. The proxy binds to that port, and then tries to connect to the client. However, the NIC at 192.168.0.250 can't connect to outside clients. The firewall has several interfaces. The 192.168.0.250 interface dosen't route to that network; another, with the IP address 63.205.237.162 does. So, for the proxy to listen and be accessible to the client for passive mode, or to connect to the client, it needs to bind to the other interface. (Well, one of the other interfaces. There are several.) Checking with netstat shows that anything talking to the 192.168.x.x addresses has to use the 192.168.0.250 address, and anything talking to the outside world has to use the 63.205.237.162 address. I tried the Listen option in the configuration file, which didn't change what port the proxy bound to to connect out from. Is there a way to get the proxy to bind to one interface for the server, and another for the client? Or, have I missed something else? Thank you again for all the help. I've sent you several complex messages, and you've taken the time to answer them with enough detail to help me continue to work on this problem. Not every mailing list or author is so helpful, and I very much appreciate it. -- Louis Erickson - wwonko(a)rdwarf.com - http://www.rdwarf.com/~wwonko/ Help a swallow land at Capistrano.

1 0

pb with login format
by Christophe.Weidemann＠alcatel.fr 14 Jun '01

14 Jun '01

HI How can we do to go trough the ftp gateway when we have a login containing a '@' character ? ex: toto@home@remote_site.com \___ ___/ \_______ _____/ V V login end ftp server Is there a solution ? Thanks in advance Christophe WEIDEMANN

2 1

Re: Question about proxy-suite configuration.
by Louis W. Erickson 14 Jun '01

14 Jun '01

First, thanks to Rob Cotrone <rcotrone(a)weebotech.com> for pointing out in private mail that I'd included a password in that debug run. I would have missed that. It's changed now. =) On Wed, 13 Jun 2001 08:57:58 +0200, Matthieu Le Corre <mlecorre(a)ireste.fr> wrote: > be sure that your firewall as the port > 1024 open !! > or the ftp server won't be able to change port > > > as I see you haven't open the port 20 ! > > you known port 20 is ftp-data , the port used to transfert datas ! > so you will be able to open session but not to receive data ro list a > directory ! Thanks for the reply, Matthieu! I double-checked this, and I tried disabling all port blocking and restrictions from my firewall while running the test again. I had exactly the same result. The firewall had gotten in my way once already, and I was hoping you'd found it, but it dosen't seem to be. On Wed, 13 Jun 2001 13:11:28 +0200, Marius Tomaschewski <mt(a)suse.de> wrote: > Hi! > > Use the newest version from > > ftp://ftp.suse.com/pub/projects/proxy-suite/ > > the bind/connect problems and also other bugs should be fixed now. > Because of NAT, you may also set the TranslatedAddress (I'm not > sure, if I've understand your network bellow). Thanks to you too, Marius, for replying. It's very appreciated. I was using a copy of 1.7 from the OpenBSD ports tree. I went and downloaded the version from SuSE, and tried it, just to make sure I was current. The files seemed - except for the couple of tweaks needed to get it to build - identical. The one from the SuSE ftp server had the same problems as before, too. I don't think I need TranslateAddress. The proxy should be the one who talks to each side, and it is running on the firewall, which can get to both internal and external address directly. I was hoping this was an easy problem you'd seen before. I guess not. I've been looking at the debug output and sources a little more. I'm going to go through the output in great detail, along with my understanding of what those lines mean. If I'm confused someplace, please let me know. My first question when looking at the debug output was, "What is Cli-Ctrl, Cli-Data, Srv-Ctrl, and Srv-Data?" I think I figured that out. In the output, there is a line: 09:47:28 < 348> Srv-Ctrl is 192.168.0.178:21 This is creating the link to the real FTP server. The debug code refers to that at Srv-Ctrl. Cli-Ctrl should be the client control channel. Cli-Data should be the client data channel, and Srv-Data should be the server data channel. The terms 'client' and 'server' are being used from the proxy's point of view. The client I'm using does Active FTP - I'm using the Win2K command line client, because it's predictable. Let me make sure I know how active FTP works; The client connects to the server on port 21. This is the control channel. When data needs to be sent, the client sends a PORT command, with it's IP address and a port number on which it is listening. The server connects to the client on this port. Now, if I go through the debug output very carefully, I see the following things happen: In the case of the proxy, client does a PORT, which the proxy recieves: 09:47:39 < 348> gets Cli-Ctrl 0=158.252.208.8: 23 bytes 'PORT 158,252,208,8,6,41' 09:47:39 < 348> from User-PI (0): cmd='PORT' arg='158,252,208,8,6,41' 09:47:39 < 348> printf Cli-Ctrl 0=158.252.208.8: 30 bytes '200 PORT command successful.' 09:47:39 < 348> USER-INF 'PORT 158.252.208.8:1577' from 158.252.208.8 In ftp-cmds.c, in the function cmds_port(), the proxy verifies that command, and stores the IP address and port in ctx.cli_addr, and ctx.cli_port. It then returns a success to the client. This makes sense. The client then sends the NLST command: 09:47:40 < 348> gets Cli-Ctrl 0=158.252.208.8: 4 bytes 'NLST' 09:47:40 < 348> from User-PI (0): cmd='NLST' arg='' 09:47:40 < 348> USER-INF 'NLST' from 158.252.208.8 The proxy opens a socket to listen on, and then passes a PORT command back to the real FTP server, advising it of that: 09:47:40 < 348> listen: Srv-Data (fd=4) 192.168.0.250:44026 09:47:40 < 348> printf Srv-Ctrl 3=192.168.0.178: 28 bytes 'PORT 192,168,0,250,171,250' 09:47:40 < 348> TECH-INF 'PORT 192.168.0.250:44026' for 158.252.208.8 The FTP server acknowledges that: 09:47:40 < 348> gets Srv-Ctrl 3=192.168.0.178: 28 bytes '200 PORT command successful.' 09:47:40 < 348> from Server-PI (3): '200 PORT command successful.' The FTP server has a data connection to the proxy. The proxy should now make a data connection to the client. This is from the debug logs: 09:47:40 < 348> try to con-bind Cli-Data to 192.168.0.250:20 09:48:54 < 348> TECH-ERR can't connect Cli-Data for 158.252.208.8 (errno=60 [Connection timed out]) Now, it looks like it's trying to bind the client data port to 192.168.0.250:20. In ftp-client.c, in the function client_xfer_fireup(), it seems to make the connection for the active FTP connection. It calls societ_d_connect with ctx.cli_addr and ctx.cli_port again. The debug output says this is 192.168.0.250, port 20. Why is it not the client address/port of 158.252.208.8:1577 that was stored in the PORT command above? 192.168.0.250 is the proxy-server's own IP address. Have I misunderstood? In active FTP, a PORT command from the client tells the server to connect to the client, who listens. The proxy needs to connect back to the client. Instead, it appears to be trying to connect to it's self. I am still poking around to see if I can figure things out any better. Any other suggestions anyone has are more than welcome, and I shall try them out. Thanks fr any response, and for wading through my long and somewhat rambling messages. -- Louis Erickson - wwonko(a)rdwarf.com - http://www.rdwarf.com/~wwonko/ Bumper sticker: "All the parts falling off this car are of the very finest British manufacture"

1 0