July 2002 - SUSE Proxy Suite - openSUSE Mailing Lists

proxy-suite-1.9 avaliable - feature release
by Marius Tomaschewski 11 May '03

11 May '03

Hi! The proxy-suite-1.9.tar.gz archive is avaliable on ftp://ftp.suse.com/pub/projects/proxy-suite/src/ and its mirror sites, i.e. ftp://ftp.gwdg.de in /pub/linux/suse/ftp.suse.com/projects/proxy-suite/src/ * 1.9 - released 2002-05-02 ----------------------------------- - implemented user authentication - currently ldap based only - updated documentation, merged with v1.8.2.2 fixes Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 1

Re: [proxy-suite] Error Message from my proxy server
by Marius Tomaschewski 30 Jul '02

30 Jul '02

On Tue, Jul 30, 2002 at 10:28:09AM -0400, Ruiyuan Jiang wrote: > Hi, Marius > > Here is the whole log since yesterday I changed in the > configuration from "LogLevel WRN" to LogLevel DBG" and > restarted ftp proxy server daemon. The messages are the > same as LogLevel WRN and DBG. Thanks. Hmm... The FIONREAD ioctl fails without to set any errno value... (the syslog_error function adds it to the log message if set). It is is redefined on solaris (see common/com-syslog.c) to use the streams I_NREAD ioctl instead of FIONREAD. Please take a look in "man iostream" (if I remember right); perhaps they have changed the behaviour of I_NREAD ?? The question is what this means on solaris9 that you are using... on solaris7 & 8 this does not happen, except on real socket errors. It seems to me, solaris9 returns -1 on EOF?! Or do you have noticed any transfer/connection aborts when this message happens? In the EOF case you can ignore the error, i.e. using (additionaly to the patch): syslog_write(T_DBG, "can't get num of bytes: %s %d=%s", instead of the syslog_error call, so the socket simply gets closed. The patch I've sent you last time closes the socket if FIONREAD/I_NREAD fails, but still displays it as error: if( (cnt=ioctl(hls->sock, FIONREAD, &len)) < 0) { hls->ernr = errno; syslog_error("can't get num of bytes: %s %d=%s", hls->ctyp, hls->sock, hls->peer); close(hls->sock); hls->sock = -1; return; } Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

1 0

RE: [proxy-suite] Error Message from my proxy server
by Ruiyuan Jiang 30 Jul '02

30 Jul '02

I tried to change LogLevel to DBG but no help. -----Original Message----- From: Marius Tomaschewski [mailto:mt@suse.de] Sent: Friday, July 26, 2002 7:24 AM To: proxy-suite(a)suse.com Cc: Ruiyuan Jiang Subject: Re: [proxy-suite] Error Message from my proxy server On Thu, Jul 25, 2002 at 05:07:07PM -0400, Ruiyuan Jiang wrote: > Hi, all Hi! > I found a lot of same messages in my new proxy server: > > ftp-child [1097] <07/25-10:06:07> TECH-ERR can't get num of bytes: Cli-Ctrl > 0=156.146.109.250 ^ | Are you running in inetd mode (not a problem - just a question)? > Where the IP address is the client connects to the proxy server to ftp in > and out of Internet through this ftp proxy server. The message repeats every > minute in the log file while the proxy server seems working fine. We run the > proxy server on Sun Blade 100, Solaris 9 and TCP Wrapper and chroot > functions of proxy server are enabled. Does anyone know whether I can ignore > this message or something is wrong? Thanks in advance. This is a common problem on Solaris, that Solaris powers up select (=data avaliable to read) but returns "no data" via the I_NREAD ioctl (see socket_ll_read in com-socket.c). The message you've got means, the ioctl is failed at all and the proxy goes back into the select loop... Set LogLevel DBG in your config, please and take a look if you can also see some "zero bytes to read reported" as well... As I see, there is also a bug in the code (static retries variable is shared for all sockets and may cause false errors). Please apply the patch from attachement (if it works, I'll put it on ftp.suse.com as well...). Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

2 1

logfiles
by Andreas Meyer 29 Jul '02

29 Jul '02

Hi! How can I teach the ftp-proxy not to create so many small logifiles in /var/log? I´m using Version 1.7tp7 - 2001/06/20 21:05:20 Is there an option to configure this behavior? Regards -- Andreas Meyer http://home.wtal.de/MeineHomepage

2 1

Error Message from my proxy server
by Ruiyuan Jiang 26 Jul '02

26 Jul '02

Hi, all I found a lot of same messages in my new proxy server: ftp-child [1097] <07/25-10:06:07> TECH-ERR can't get num of bytes: Cli-Ctrl 0=156.146.109.250 Where the IP address is the client connects to the proxy server to ftp in and out of Internet through this ftp proxy server. The message repeats every minute in the log file while the proxy server seems working fine. We run the proxy server on Sun Blade 100, Solaris 9 and TCP Wrapper and chroot functions of proxy server are enabled. Does anyone know whether I can ignore this message or something is wrong? Thanks in advance. Ryan Jiang Senior UNIX administrator Liz Claiborne, Inc. (201) 295-7171

2 1

RE: [proxy-suite] Chroot feature on proxy-suite
by Ruiyuan Jiang 23 Jul '02

23 Jul '02

Thanks for your help. Everything seems working. Ryan Jiang Liz Claiborne, Inc. -----Original Message----- From: Marius Tomaschewski [mailto:mt@suse.de] Sent: Tuesday, July 23, 2002 2:14 PM To: proxy-suite(a)suse.com Subject: Re: [proxy-suite] Chroot feature on proxy-suite On Mon, Jul 22, 2002 at 03:41:57PM -0400, Ruiyuan Jiang wrote: > Thanks. It seems that I can start ftp-proxy daemon as standalone. When I > tried to access outside ftp server, i.e. ftp.sun.com, I got a messages: > > # ftp ftp-proxy.liz.com > Connected to ftp-proxy.liz.com > 220 ftp-proxy FTP server (Version 1.9 - 2002/05/02 15:14:55) ready. > Name (ftp-proxy:ryan): anonymous(a)ftp.sun.com > 501 Invalid destination in user name. > Login failed. > ftp>quit > > > I commented out "chroot" statement in the configuration file so the ftp > proxy server runs as normal. I did the same thing to > acess ftp.sun.com. and I can access the ftp server without problem. It > seemed to me that ftp proxy server can't run chroot mode at least for > client side. Is this true? Thanks in advance. No, you need more libraries in the chroot, at _least_ the libs you can see using ldd - for example: # ldd ftp-proxy libldap.so.4 => /usr/lib/libldap.so.4 libresolv.so.2 => /usr/lib/libresolv.so.2 libnsl.so.1 => /usr/lib/libnsl.so.1 libsocket.so.1 => /usr/lib/libsocket.so.1 libc.so.1 => /usr/lib/libc.so.1 libdl.so.1 => /usr/lib/libdl.so.1 libmp.so.2 => /usr/lib/libmp.so.2 In the case you get "Invalid destination" (like above) the proxy is not able to resolve the hostname. Try out using IP-Number - this may work, i.e.: ftp ftp-proxy.liz.com Name (ftp-proxy:ryan): anonymous(a)217.9.113.66 Solaris is using /etc/nsswitch.conf - you need the corresponding libraries, i.e. if you are using following /etc/nsswitch.conf: # # /etc/nsswitch.dns: # passwd: files group: files hosts: files dns you need the libraries /usr/lib/nss_files* /usr/lib/nss_dns*. Further you need the /etc/nsswitch.conf, /etc/hosts (or /etc/inet/hosts), /etc/host.conf(?), /etc/resolv.conf, /etc/services and /etc/protocols in the chroot as well. Kind regards, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18 --------------------------------------------------------------------- To unsubscribe, e-mail: proxy-suite-unsubscribe(a)suse.com For additional commands, e-mail: proxy-suite-help(a)suse.com

1 0

RE: [proxy-suite] Chroot feature on proxy-suite
by Ruiyuan Jiang 23 Jul '02

23 Jul '02

Thanks. It seems that I can start ftp-proxy daemon as standalone. When I tried to access outside ftp server, i.e. ftp.sun.com, I got a messages: # ftp ftp-proxy.liz.com Connected to ftp-proxy.liz.com 220 ftp-proxy FTP server (Version 1.9 - 2002/05/02 15:14:55) ready. Name (ftp-proxy:ryan): anonymous(a)ftp.sun.com 501 Invalid destination in user name. Login failed. ftp>quit I commented out "chroot" statement in the configuration file so the ftp proxy server runs as normal. I did the same thing to acess ftp.sun.com. and I can access the ftp server without problem. It seemed to me that ftp proxy server can't run chroot mode at least for client side. Is this true? Thanks in advance. Ryan Jiang Liz Claiborne, Inc. (201) 295-7171 -----Original Message----- From: Marius Tomaschewski [mailto:mt@suse.de] Sent: Monday, July 22, 2002 8:39 AM To: proxy-suite(a)suse.com Cc: Ruiyuan Jiang Subject: Re: [proxy-suite] Chroot feature on proxy-suite On Fri, Jul 19, 2002 at 12:52:46PM -0400, Ruiyuan Jiang wrote: > Hi, all > > I would like to use chroot() feature for proxy-suite (Sun Blade 100, Solaris > 9). Under /var/proxy-suite/rundir, I created directories dev, etc, usr. I > linked /dev/null to null in the dev directory. No, a link can't work - use mknod instead and create a real $ServerRoot/dev/null device. > I copied /usr/lib/libc.so to usr/lib directory and copied > /etc/passwd and group files to etc subdirectory. Make sure, there are no real passwords. You can also create dummy files instead, i.e. $ServerRoot/etc/passwd: root:*:0:0:root:/:/bin/false ftp-proxy:*:5000:5000:proxy user:/:/bin/false $ServerRoot/etc/group: root:*:0:root ftp-proxy:*:5000: or specify the User and Group as UID/GID numbers in the ftp-proxy.conf... > I tried to start ftp-proxy standalone and I got a message: > > # ./ftp-proxy > ftp-proxy [9278] <07/19-16:13:13> TECH-ERR can't write config file into > chroot > > I tried to create var/run directory under /var/proxy-suite/rundir for pid > file and var/log under /var/proxy-suite/rundir for log file but I got the > same message when I tried to start the daemon. Does anyone know which config > file is? Thanks in advance. The proxy writes its config into the chroot if it is not there, to be able to reload it on SIGHUP. Copy your /etc/proxy-suite/ftp-proxy.conf into the chroot as well. An other solution is to make the config directory in the chroot $ServerRoot/etc/proxy-suite/ writeable to the user the proxy runs as... But this is not needed if you copy the config yourself. Gruesse, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

2 1

RE: [proxy-suite] Chroot feature on proxy-suite
by Ruiyuan Jiang 23 Jul '02

23 Jul '02

Hi, Marius and all I have another question. When I compiled proxy-suite, I enabled TCP Wrapper. Since Solaris 9 comes with TCP Wrapper, I used TCP Wrapper from the OS. I used configure utility of proxy-suite: $ cd proxy-suite source directory $ ./configure --prefix=/opt/ftp-proxy --sysconfdir=/etc --enable-warnings --enable-so-linger --with-libwrap=/usr/sfw/lib --with-libldap=/usr/lib --with-crypt=/usr/lib In the /etc/hosts.allow, I have a line: ftp-proxy: IPaddress1, IPaddress2, IPaddress3 In the ftp-proxy.conf file, I removed comment of the line "TCPWrapperName ftp-proxy" and removed the comment from line "TCPWrapper yes". Also I enabled "AllowMagicUser" and "AllowTransProxy". I tried to ftp to the box from my HP-UX workstation which IP address is not in the /etc/hosts.allow file (I don't have /etc/hosts.deny file on the ftp proxy server). $ ftp ftp-proxy.liz.com Connected to ftp-proxy.liz.com 220 ftp-proxy FTP server (Version 1.9 - 2002/05/02 15:14:55) ready. Name (HP workstation:ryan): anonymous(a)ftp.netscape.com 331 Password required fro anonymous. Password: ... My question is: Does my ftp proxy server supposes to reject my HP-UX workstation to connect to it? As a fact, when I tried to start ftp-proxy as a standalone daemon and TCP Wrapper libray not in my library path, it said can't find libwrap.so.1 and refuse to start which I guess ftp proxy needs TCP Wrapper lbrary to start. I tested this without chroot enabled. I would like to use TCP Wrapper with chroot enabled. Thanks in advance. Ryan Jiang Liz Claiborne, Inc. (201) 295-7171 -----Original Message----- From: Marius Tomaschewski [mailto:mt@suse.de] Sent: Monday, July 22, 2002 8:39 AM To: proxy-suite(a)suse.com Cc: Ruiyuan Jiang Subject: Re: [proxy-suite] Chroot feature on proxy-suite On Fri, Jul 19, 2002 at 12:52:46PM -0400, Ruiyuan Jiang wrote: > Hi, all > > I would like to use chroot() feature for proxy-suite (Sun Blade 100, Solaris > 9). Under /var/proxy-suite/rundir, I created directories dev, etc, usr. I > linked /dev/null to null in the dev directory. No, a link can't work - use mknod instead and create a real $ServerRoot/dev/null device. > I copied /usr/lib/libc.so to usr/lib directory and copied > /etc/passwd and group files to etc subdirectory. Make sure, there are no real passwords. You can also create dummy files instead, i.e. $ServerRoot/etc/passwd: root:*:0:0:root:/:/bin/false ftp-proxy:*:5000:5000:proxy user:/:/bin/false $ServerRoot/etc/group: root:*:0:root ftp-proxy:*:5000: or specify the User and Group as UID/GID numbers in the ftp-proxy.conf... > I tried to start ftp-proxy standalone and I got a message: > > # ./ftp-proxy > ftp-proxy [9278] <07/19-16:13:13> TECH-ERR can't write config file into > chroot > > I tried to create var/run directory under /var/proxy-suite/rundir for pid > file and var/log under /var/proxy-suite/rundir for log file but I got the > same message when I tried to start the daemon. Does anyone know which config > file is? Thanks in advance. The proxy writes its config into the chroot if it is not there, to be able to reload it on SIGHUP. Copy your /etc/proxy-suite/ftp-proxy.conf into the chroot as well. An other solution is to make the config directory in the chroot $ServerRoot/etc/proxy-suite/ writeable to the user the proxy runs as... But this is not needed if you copy the config yourself. Gruesse, Marius Tomaschewski <mt(a)suse.de> -- SuSE Linux AG, Nürnberg - SuSE Labs, Product Developement PGP public key available: http://www.suse.de/~mt/mt.pgp Fprint: EA 1F 92 75 1A F9 82 07 A1 28 DE 7A 32 E8 97 18

2 1

Chroot feature on proxy-suite
by Ruiyuan Jiang 22 Jul '02

22 Jul '02

Hi, all I would like to use chroot() feature for proxy-suite (Sun Blade 100, Solaris 9). Under /var/proxy-suite/rundir, I created directories dev, etc, usr. I linked /dev/null to null in the dev directory. I copied /usr/lib/libc.so to usr/lib directory and copied /etc/passwd and group files to etc subdirectory. I tried to start ftp-proxy standalone and I got a message: # ./ftp-proxy ftp-proxy [9278] <07/19-16:13:13> TECH-ERR can't write config file into chroot I tried to create var/run directory under /var/proxy-suite/rundir for pid file and var/log under /var/proxy-suite/rundir for log file but I got the same message when I tried to start the daemon. Does anyone know which config file is? Thanks in advance. Ryan Jiang Liz Claiborne, Inc. ruiyuan_jiang(a)liz.com

2 1

Problems with nat installation
by Konrad Trojok 22 Jul '02

22 Jul '02

Hi there, I need some help configuring nat for some simple gateway. I have edited the routing table according to my situation and the squid qroxy is doing fine. Only direct connections don't work due to nat is not configured yet. I dont want to mess with a complex firewall installation. I only want a simple gateway. Maybe someone already has some similar configuration running and has some clues for me. Regards Konrad trojok

2 1