June 2001 - SUSE Proxy Suite - openSUSE Mailing Lists

(kein Betreff)
by Matthias Mohr 13 Jun '01

13 Jun '01

1 0

Question about proxy-suite configuration.
by Louis W. Erickson 13 Jun '01

13 Jun '01

Hello there! I've been trying to get a firewall installed and working for some time. FTP has been a problem, and the ftp-proxy sounds like it ought to be able to do exactly what I need it to do. However, I'm unable to make it do what I need to do. I'm relatively certain this is configuration error on my part. Let me describe the configuration I'm using, and the prolem I'm having. My current setup is that I have a server, behind a firewall/nat machine. The server is called holly.rdwarf.com, and has an IP address of 192.168.0.177. The firewall/nat machine is called muspell.rdwarf.com and has two IP addresses, 192.168.0.250 and 63.205.237.162. I was using a client called ERICKSONL which had the IP address 158.252.208.8. The firewall exposes 63.205.237.177 to the Internet. It does a bidirectional NAT mapping to 192.168.0.177. This allows simple protocols, such as Telnet and ssh to work. This even allows active FTP to work. Passive dosen't work for a couple of reasons. So, I installed the ftp-proxy on the firewall, and told it to redirect all traffic from 63.205.237.177 port 21 to the firewall on a strange port, and set inetd to launch ftp-proxy on that port. ftp-proxy is configured with a destination of 192.168.0.177 - the private IP of the server, behind the firewall. FTP to the server successfully opens the proxy. You can log in, and commands are redirected by the proxy, to the server behind the firewall. So far, everything is good. However, if you try a PORT command, be it part of an NLST or whatever, the proxy is unable to open the port, or something. I don't quite understand what the error is, and which machine the proxy is trying to connect to port 20 on, if it's got the right address or not. I don't understand what is going wrong here, and I would very much like to. Any light anyone can shed on this would be very much appreciated. If I've confused people with my description of the problem, please let me know, or ask for more information. The configuration information from the config file is in the log file, so I won't include that again. Here is the log file: 09:47:21 < 348> ############# ftp-debug startup ############# 09:47:21 < 348> TECH-INF Config-File: '/etc/proxy-suite/holly-ftp.conf' 09:47:21 < 348> TECH-INF Config-Section ------ '(-global-)' 09:47:21 < 348> TECH-INF Config: AllowMagicUser = 'no' 09:47:21 < 348> TECH-INF Config: DestinationAddress = '192.168.0.178' 09:47:21 < 348> TECH-INF Config: Listen = '192.168.0.250' 09:47:21 < 348> TECH-INF Config: Port = '23001' 09:47:21 < 348> {{{{{ ftp-debug client-start 09:47:21 < 348> uid-gid desired: uid=-1 gid=-1 09:47:21 < 348> uid-gid adopted: uid=0 gid=0 09:47:21 < 348> created HLS for 0=158.252.208.8:1576 09:47:21 < 348> USER-INF connect from 158.252.208.8 09:47:21 < 348> printf Cli-Ctrl 0=158.252.208.8: 82 bytes '220 muspell.stormtiger.com FTP server (Version 1.7 - 1999/10/22 09:22:47) ready.' 09:47:28 < 348> gets Cli-Ctrl 0=158.252.208.8: 11 bytes 'USER wwonko' 09:47:28 < 348> from User-PI (0): cmd='USER' arg='wwonko' 09:47:28 < 348> allowed: '(all)' 09:47:28 < 348> USER-INF 'USER wwonko' from 158.252.208.8 09:47:28 < 348> USER-INF reading data for 'wwonko' from cfg-file 09:47:28 < 348> DestAddr for 158.252.208.8: '192.168.0.178' 09:47:28 < 348> DestPort for 158.252.208.8: 21 09:47:28 < 348> DestMode for 158.252.208.8: client 09:47:28 < 348> DestRange for 158.252.208.8: 0-0 09:47:28 < 348> ActiveRange for 158.252.208.8: 20-20 09:47:28 < 348> PassiveRange for 158.252.208.8: 0-0 09:47:28 < 348> SameAddress for 158.252.208.8: yes 09:47:28 < 348> TimeOut for 158.252.208.8: 900 09:47:28 < 348> allowed: '(all)' 09:47:28 < 348> created HLS for 3=192.168.0.178:21 09:47:28 < 348> Srv-Ctrl is 192.168.0.178:21 09:47:28 < 348> gets Srv-Ctrl 3=192.168.0.178: 76 bytes '220 bluemidget.rdwarf.com FTP server (Version 6.2/OpenBSD/Linux-0.11) ready.' 09:47:28 < 348> from Server-PI (3): '220 bluemidget.rdwarf.com FTP server (Version 6.2/OpenBSD/Linux-0.11) ready.' 09:47:28 < 348> printf Srv-Ctrl 3=192.168.0.178: 13 bytes 'USER wwonko' 09:47:28 < 348> gets Srv-Ctrl 3=192.168.0.178: 33 bytes '331 Password required for wwonko.' 09:47:28 < 348> from Server-PI (3): '331 Password required for wwonko.' 09:47:28 < 348> printf Cli-Ctrl 0=158.252.208.8: 35 bytes '331 Password required for wwonko.' 09:47:30 < 348> gets Cli-Ctrl 0=158.252.208.8: 11 bytes 'PASS 1skunk' 09:47:30 < 348> from User-PI (0): cmd='PASS' arg='1skunk' 09:47:30 < 348> printf Srv-Ctrl 3=192.168.0.178: 13 bytes 'PASS 1skunk' 09:47:30 < 348> USER-INF 'PASS XXXX' from 158.252.208.8 09:47:30 < 348> gets Srv-Ctrl 3=192.168.0.178: 25 bytes '230- Have a lot of fun...' 09:47:30 < 348> from Server-PI (3): '230- Have a lot of fun...' 09:47:30 < 348> '230-'... forwarded to Cli-Ctrl 0=158.252.208.8 09:47:30 < 348> printf Cli-Ctrl 0=158.252.208.8: 27 bytes '230- Have a lot of fun...' 09:47:30 < 348> gets Srv-Ctrl 3=192.168.0.178: 26 bytes '230 User wwonko logged in.' 09:47:30 < 348> from Server-PI (3): '230 User wwonko logged in.' 09:47:30 < 348> printf Cli-Ctrl 0=158.252.208.8: 28 bytes '230 User wwonko logged in.' 09:47:39 < 348> gets Cli-Ctrl 0=158.252.208.8: 23 bytes 'PORT 158,252,208,8,6,41' 09:47:39 < 348> from User-PI (0): cmd='PORT' arg='158,252,208,8,6,41' 09:47:39 < 348> printf Cli-Ctrl 0=158.252.208.8: 30 bytes '200 PORT command successful.' 09:47:39 < 348> USER-INF 'PORT 158.252.208.8:1577' from 158.252.208.8 09:47:40 < 348> gets Cli-Ctrl 0=158.252.208.8: 4 bytes 'NLST' 09:47:40 < 348> from User-PI (0): cmd='NLST' arg='' 09:47:40 < 348> USER-INF 'NLST' from 158.252.208.8 09:47:40 < 348> created HLS for -1=:0 09:47:40 < 348> listen: Srv-Data (fd=4) 192.168.0.250:44026 09:47:40 < 348> printf Srv-Ctrl 3=192.168.0.178: 28 bytes 'PORT 192,168,0,250,171,250' 09:47:40 < 348> TECH-INF 'PORT 192.168.0.250:44026' for 158.252.208.8 09:47:40 < 348> gets Srv-Ctrl 3=192.168.0.178: 28 bytes '200 PORT command successful.' 09:47:40 < 348> from Server-PI (3): '200 PORT command successful.' 09:47:40 < 348> try to con-bind Cli-Data to 192.168.0.250:20 09:48:54 < 348> TECH-ERR can't connect Cli-Data for 158.252.208.8 (errno=60 [Connection timed out]) 09:48:54 < 348> printf Cli-Ctrl 0=158.252.208.8: 33 bytes '425 Can't open data connection.' 09:50:05 < 348> gets Cli-Ctrl 0=158.252.208.8: 4 bytes 'QUIT' 09:50:05 < 348> from User-PI (0): cmd='QUIT' arg='' 09:50:05 < 348> deleting HLS Srv-Data 4=:0 09:50:05 < 348> printf Srv-Ctrl 3=192.168.0.178: 6 bytes 'QUIT' 09:50:05 < 348> printf Cli-Ctrl 0=158.252.208.8: 14 bytes '221 Goodbye.' 09:50:05 < 348> USER-INF 'QUIT' from 158.252.208.8 09:50:05 < 348> deleting HLS Srv-Ctrl -1=192.168.0.178:21 09:50:05 < 348> }}}}} ftp-debug client-exit 09:50:05 < 348> deleting HLS Cli-Ctrl -1=158.252.208.8:1576 09:50:05 < 348> ------------- ftp-debug exiting ------------- Thanks for any help you can provide! -- Louis Erickson - wwonko(a)rdwarf.com - http://www.rdwarf.com/~wwonko/ 186,282 miles per second: It isn't just a good idea, it's the law!

2 1

type of proxy
by Matthieu Le Corre 12 Jun '01

12 Jun '01

hum i just want to kown what type of proxy ftp-proxy is ? and why i get : OPEN command unkown !!! need help please -- _______________________________________ Matthieu Le Corre Service informatique Ecole Polytechnique de l'Université de Nantes Matthieu.lecorre(a)polytech.univ-nantes.fr 02.40.68.32.23 _______________________________________

2 2

new version 1.7tp6
by Marius Tomaschewski 08 Jun '01

08 Jun '01

Hi *! On ftp://ftp.suse.com/pub/projects/proxy-suite/src is an updated proxy-suite. Many, many thanks to Antoniu-George Savu <santoniu(a)libertysurf.fr>, Rogier Wolff <R.E.Wolff(a)BitWizard.nl> and others for providing patches, ideas and bug reports!! * 1.7tp6 / 05.06.2001: - added sample rc.config.ftp-proxy and rc.script.ftp-config - implemented LDAPBindDN, LDAPBindPW for authenticated simple bind - autoconf ctags, ftp-proxy.conf.sample cleanups - fixed QUIT to be allowed every time - fixed pid file creation order to be before UID 0 is dropped - fixed ActivePort default to be INPORT_ANY (random port) if not running as UID 0 instead of IPPORT_FTP - 1 (port 20) an no ActiveMinDataPort/ActiveMaxDataPort given - fixed (I hope ;-) bind/connect problems (see also SockBindRand option) - added patch for infinite-loop bug in telnet control handling - added patch for unneeded exit in socket_sck2addr and on client fork failure - added patch for clean up the PID of a child in daemon array (MaxClients) - added contributors to CREDITS file - updated manual page (ftp-proxy.conf.5.in) There are 3 new Options you can (must not) use: LDAPBindDN Defines the distinguished name that is used to (simple) bind the directory service. Defaults to an empty string (anonymous bind). See also LDAPBindPW option. LDAPBindPW Defines the credential (password) that is used to (simple) bind the directory service using distin guished name given in the LDAPBindDN option. Defaults to an empty string (anonymous bind). SockBindRand Global context only. Defines a flag that when set to yes, true, or on , causes the proxy to use a random port in the specified range with Destina tionMinPort/MaxPort, ActiveMinPort/MaxDataPort, PassiveMinDataPort/MaxDataPort instead of increment the port number. See also DestinationMinPort, Des tinationMaxPort, PassiveMinDataPort, PassiveMaxDat aPort, ActiveMinPort, ActiveMaxPort options. For more information, see ftp-proxy.conf(5) manual page, and also Chroot-Mini-Howto.txt, TransProxy-Mini-Howto.txt. BTW: To patch the source, use i.e.: gunzip proxy-suite-1.7.tar.gz tar xf proxy-suite-1.7.tar cd proxy-suite-1.7 patch -p0 < ../proxy-suite-1.7.dif aclocal autoheader autoconf Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE GmbH, Hamburg --- SuSE Labs, Product Developement GPG/PGP public key see: http://www.suse.de/~mt/mt.pgp Key-FP: DF17 271A AD15 006A 5BB9 6C96 CA2F F3F7 373A 1CC0

2 1

transparent ftp proxy
by Manfred Meerkoetter 07 Jun '01

07 Jun '01

Hi, I have an internal net with some Windows machines. Those Windows machines are connected to the internet over a Linux box with SuSE 7.1. I tried to setup the ftp-proxy from the SuSE proxy suite as transparent proxy. It works so far that I can use a magic user name on a Win FTP-client to connect to an external FTP-server. But I need full transparency for my Windows machines, so that IE5 and Netscape users can access external FTP-servers. Is this possible with the SuSE ftp proxy ? And how have I to configure it ? Thank you in advance Manfred Meerkoetter

1 0

Fw: [proxy-suite] unsubscribe
by Àåêñåé 04 Jun '01

04 Jun '01

----- Original Message ----- From: Àåêñåé <informsystem_by(a)mail.ru> To: <proxy-suite(a)suse.de> Sent: Monday, May 28, 2001 8:43 PM Subject: [proxy-suite] unsbscribe

1 0