July 2002 - SUSE Proxy Suite - openSUSE Mailing Lists

LDAP Suggestion
by Jonathan Zuilkowski 22 Jul '02

22 Jul '02

I have a suggestion that I'd like you all to take a look at. The background is that I'm using SunOne/iPlanet/Netscape(name of the week, take your pick) LDAP server with SHA1 for the passwords. This isn't something that I can change. Instead of using a BindDN and getting the password, comparing, etc., how about just performing a bind operation with the login and password in question? If you are able to bind with them then you've determined that they are valid. The added benefit is that you can then use the same login and password to obtain the rest of the attributes required and you don't need the BindDN. You also won't need to store a password in a text file, something we should all frown on anyway. Below I've included an example of what I'm trying to do. It's based on the LDAP authenticator included with Squid proxy. I think that the bind operation with the BindDN occurs earlier, so this probably won't work as-is, but it should illustrate my suggestion. Caveat: I'm a complete amature. I'd appreciate feedback. Please be kind. Thanks -Jon /* ------------------------------------------------------------ ** ** ** Function......: ldap_auth ** ** Parameters....: ld Pointer to LDAP struct ** e Pointer to result buffer ** who Pointer to user name ** pwd Pointer to user pwd ** ** Return........: 0 on success ** ** Purpose.......: Preform LDAP userauth ** ** ------------------------------------------------------------ */ static int ldap_auth(LDAP *ld, LDAPMessage *e, char *who, char *pwd) { int luser; char *dn; char *base = "ou=people,o=x.com"; char str[MAX_PATH_SIZE]; char *v, *p; size_t len; /* test server connection */ if (ld == NULL || e == NULL) { misc_die(FL, "ldap_checkauth: ?ld? ?e?"); } /* no null usernames or passwords accepted */ if (who == NULL || strcmp(who, "") == 0) { syslog_write(U_WRN, "access denied for NULL usernames"); return -1; } if (pwd == NULL || strcmp(pwd, "") == 0) { syslog_write(U_WRN, "access denied for NULL passwords"); return -1; } /* ** check "user enabled" flag if present */ if( (p = config_str(NULL, "LDAPAuthOKFlag", NULL))) { misc_strncpy(str, p, sizeof(str)); if( (v = strchr(str, '='))) { *v++ = '\0'; } else { v = 0; } if(v && strlen(v) && strlen(str)) { if(0 != ldap_exists(ld, e, str, v, 0)) { syslog_write(U_WRN, "access denied for %s", NIL(who)); return -1; } else { syslog_write(T_DBG, "LDAP auth ok-check: '%.256s'='%.256s' passed", NIL(str), NIL(v)); } } else { errno = 0; misc_die(FL, "ldap_auth: ?LDAPAuthOKFlag?"); } } else { syslog_write(T_DBG, "LDAP auth ok-check skipped"); } /* dn=uid=<username>,<ldapbase> */ auth_dn=malloc(255); strcpy(auth_dn,"uid="); strcpy(auth_dn+4,who); luser=strlen(who); strcpy(auth_dn+4+luser,", "); strcpy(auth_dn+6+luser,base); /* attempt bind to server using found DN and provided password */ if (ldap_simple_bind_s(ld, auth_dn, pwd) == LDAP_SUCCESS) { free(auth_dn); ldap_unbind(ld); return 0; } /* bind failed, password probably no good */ free(auth_dn); ldap_unbind(ld); return -1; } _________________________________________________________________ Join the worlds largest e-mail service with MSN Hotmail. http://www.hotmail.com

2 1

What is USER-ERR
by ALLAIN Norbert 22 Jul '02

22 Jul '02

When i try to connect to the ftp-proxy on a ftp site, i have the fowllowing message: USER-ERR reject : '192.168.0.1' (deny message) I use user: nobody, and i have it in my ftp-proxy.conf How indicate allow host, like 192.168.0.1/24 in the ftp-proxy.conf Thanks for all Norbert

2 1

selecting interface for traffic
by David Watson 22 Jul '02

22 Jul '02

I run proxy-suite on my firewall, it listens on the inside (192.168.1.1 eth0 ) and works great as a transparent proxy. The firewall has 2 external interfaces (eth1 and eth2) which both connect to the internet over different links. I would like to have all the ftp traffic go over eth2 but ftp-proxy uses eth1, is there any way to control this without resorting to iptables (MARK) and ip rules ? My config is below, any help is greatly appreciated. [-Global-] AllowMagicUser yes AllowTransProxy yes DestinationTransferMode passive Group nobody Listen 192.168.1.1 LogDestination /var/log/ftp-proxy/ftp-proxy.log MaxRecvBufSize 8192 PidFile /var/run/ftp-proxy.pid ServerType standalone User ftp-proxy _____________________________________________________________ David Watson, Network Manager, Team17 Software Ltd. Phone: +44-1924-267776 Fax: +44-1924-267658 _____________________________________________________________

2 4

LDAP Auth patch
by Jonathan Zuilkowski 21 Jul '02

21 Jul '02

Hey guys, I didn't hear back from anyone, so I don't know if there's a lot of interest or not. I did get this to work. I did away with the password comparison and substituted that with a bind. Now you can use SHA1, or anything else for that matter. Replace the entire ldap_auth function with this one. Enjoy. /* ------------------------------------------------------------ ** ** ** Function......: ldap_auth ** ** Parameters....: ld Pointer to LDAP struct ** e Pointer to result buffer ** who Pointer to user name ** pwd Pointer to user pwd ** ** Return........: 0 on success ** ** Purpose.......: Preform LDAP userauth ** ** ------------------------------------------------------------ */ static int ldap_auth(LDAP *ld, LDAPMessage *e, char *who, char *pwd) { int luser; char *auth_dn; char *base = "ou=people,o=equifax.com"; char str[MAX_PATH_SIZE]; char *v, *p; /* test server connection */ if (ld == NULL || e == NULL) { misc_die(FL, "ldap_checkauth: ?ld? ?e?"); } /* dn=uid=<username>,<ldapbase> */ auth_dn=malloc(255); strcpy(auth_dn,"uid="); strcpy(auth_dn+4,who); luser=strlen(who); strcpy(auth_dn+4+luser,", "); strcpy(auth_dn+6+luser,base); /* attempt bind to server using found DN and provided password */ if (ldap_simple_bind_s(ld, auth_dn, pwd) == LDAP_SUCCESS) { free(auth_dn); ldap_unbind(ld); /* ** check "user enabled" flag if present */ if( (p = config_str(NULL, "LDAPAuthOKFlag", NULL))) { misc_strncpy(str, p, sizeof(str)); if( (v = strchr(str, '='))) { *v++ = '\0'; } else { v = 0; } if(v && strlen(v) && strlen(str)) { if(0 != ldap_exists(ld, e, str, v, 0)) { syslog_write(U_WRN, "access denied for %s", NIL(who)); return -1; } else { syslog_write(T_DBG, "LDAP auth ok-check: '%.256s'='%.256s' passed", NIL(str), NIL(v)); } } else { errno = 0; misc_die(FL, "ldap_auth: ?LDAPAuthOKFlag?"); } } else { syslog_write(T_DBG, "LDAP auth ok-check skipped"); } return 0; } /* bind failed, password probably no good */ free(auth_dn); ldap_unbind(ld); return -1; } _________________________________________________________________ MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx

1 0

Re: [proxy-suite] What is the port listen by proxy-suite ?
by Robert Rottscholl 19 Jul '02

19 Jul '02

Hi Norbert, i suggest writing "ftp-proxy 3129/tcp", because it is easier to interpret and read if you list your firewall rules by "iptables -L" or you watch out for open ports by typing "netstat -a", if you use "ftp 3129/tcp" you canÄt be sure if it's the ftp server or the ftp proxy. Ciao ;-) Robert - DE ALLAIN Norbert wrote: > In the /etc/services files can i write: > ftp-proxy 3129/tcp > or > ftp 3129/tcp > > Robert Rottscholl wrote: > > >>Hi Norbert, >> >>I am sorry to tell you that I told you the wrong option the port is >>specified by the value port ("Port 3129")(I dropped the line while >>reading my config.) Setting the value Listen specifies the IP address >>where the ftp proxy should bind to. (e.g. "Listen 192.168.0.1"). >>Now the next problem: >>You are right Norbert. You should add a line like "ftp-proxy" to your >>"/etc/services" pointing to the port "3129". >>Then you have to add the name of this service to your "/etc/inetd.conf" >>(e.g. "ftp-proxy stream tcp nowait root /usr/sbin/ftp-proxy \i"). >>Now you only have to restart inetd and then it should work. >> >>Ciao ;-) >> >>Robert - DE >> >>P.S.: I am sorry for that mistake. >> >>NORBERT ALLAIN wrote: >> >> >>>I have in my inetd.conf the lines: >>> >>>ftp stream tcp nowait root /usr/sbin/tcpd wu.ftpd \a >>>ftp stream tcp nowait root /usr/sbin/ftp-proxy \i >>> >>>My ftp-proxy have the following line: Listen 3129 >>>But i am enable to connect to my local ftp server 192.168.0.1 (21) >>>without the proxy and with the proxy. >>> >>>May i change the /etc/services to add a line for 3129 ? >>> >>> >>>What is the default user to connect to ftp-proxy ? >>> >>> >>>Thanks for all, i am a beginner. >>> >>>Norbert >>> >>> >>> >>> >>>>>>>>>>>>>>>>>>>>>Message d'origine <<<<<<<<<<<<<<<<<< >>>>>>>>>>>>>>>>>>>>> >>>Le 18/07/2002, à 11:23:04 h, Robert Rottscholl <lv426(a)web.de> vous a >>>écrit sur le sujet suivant Re: [proxy-suite] What is the port listen by >>>proxy-suite ?: >>> >>> >>> >>> >>>>Hi Norbert, >>>> >>>> >>>>you can use the standard ftp port (21) for your ftp proxy, if no ftp >>>>server (like proftpd,...) is listening on it, otherwise I suggest >>>> >>>> >>>using >>> >>> >>>>port 3129 (because ist has no assignment in /etc/services and it's >>>> >>>> >>>easy >>> >>> >>>> to remember because it's one port above the squid proxy.). You can >>>>configure the port in the config file by adding/typing 'Listen >>>> >>>> >>>3129'. >>> >>> >>> >>>>Ciao ;-) >>>> >>>> >>>>Robert >>>> >>>> >>>>ALLAIN Norbert wrote: >>>> >>>> >>>>>I use Squid and i kwow that the port is 3128. >>>>>But with proxy-suite i don't kwnow the port number (i must use it for >>>>> >>>>> >>>my >>> >>> >>>>>windows ftp client). >>>>> >>>>>Can i use a ftp local site (port 21) with the proxy-suite in the same >>>>>machine ? >>>>> >>>>> >>>>> >>>>> >>>>>--------------------------------------------------------------------- >>>>>To unsubscribe, e-mail: proxy-suite-unsubscribe(a)suse.com >>>>>For additional commands, e-mail: proxy-suite-help(a)suse.com >>>>> >>>>> >>>>> >>>>> >>>>> >>> >>> >>>>--------------------------------------------------------------------- >>>>To unsubscribe, e-mail: proxy-suite-unsubscribe(a)suse.com >>>>For additional commands, e-mail: proxy-suite-help(a)suse.com >>>> >>>> >>> >>> >>> >>--------------------------------------------------------------------- >>To unsubscribe, e-mail: proxy-suite-unsubscribe(a)suse.com >>For additional commands, e-mail: proxy-suite-help(a)suse.com >> > > > >

1 0

Re: [proxy-suite] selecting interface for traffic
by GentooRulez 19 Jul '02

19 Jul '02

Check out that http://defiant.coinet.com/iproute2/ for your purposes. ---snip The purpose of this website is to facillitate communications between persons wishing to better understand and utilize Linux's new iproute2 and traffic control (QoS) features. ---snap Feedback to me, whether that was applicable or not :O) Yours Michael

1 0

Re: [proxy-suite] What is the port listen by proxy-suite ?
by Robert Rottscholl 18 Jul '02

18 Jul '02

Hi Norbert, I am sorry to tell you that I told you the wrong option the port is specified by the value port ("Port 3129")(I dropped the line while reading my config.) Setting the value Listen specifies the IP address where the ftp proxy should bind to. (e.g. "Listen 192.168.0.1"). Now the next problem: You are right Norbert. You should add a line like "ftp-proxy" to your "/etc/services" pointing to the port "3129". Then you have to add the name of this service to your "/etc/inetd.conf" (e.g. "ftp-proxy stream tcp nowait root /usr/sbin/ftp-proxy \i"). Now you only have to restart inetd and then it should work. Ciao ;-) Robert - DE P.S.: I am sorry for that mistake. NORBERT ALLAIN wrote: > I have in my inetd.conf the lines: > > ftp stream tcp nowait root /usr/sbin/tcpd wu.ftpd \a > ftp stream tcp nowait root /usr/sbin/ftp-proxy \i > > My ftp-proxy have the following line: Listen 3129 > But i am enable to connect to my local ftp server 192.168.0.1 (21) > without the proxy and with the proxy. > > May i change the /etc/services to add a line for 3129 ? > > > What is the default user to connect to ftp-proxy ? > > > Thanks for all, i am a beginner. > > Norbert > > > >>>>>>>>>>>>>>>>>>>Message d'origine <<<<<<<<<<<<<<<<<< >>>>>>>>>>>>>>>>>>> > > Le 18/07/2002, à 11:23:04 h, Robert Rottscholl <lv426(a)web.de> vous a > écrit sur le sujet suivant Re: [proxy-suite] What is the port listen by > proxy-suite ?: > > > >>Hi Norbert, >> > >>you can use the standard ftp port (21) for your ftp proxy, if no ftp >>server (like proftpd,...) is listening on it, otherwise I suggest >> > using > >>port 3129 (because ist has no assignment in /etc/services and it's >> > easy > >> to remember because it's one port above the squid proxy.). You can >>configure the port in the config file by adding/typing 'Listen >> > 3129'. > > >>Ciao ;-) >> > >>Robert >> > >>ALLAIN Norbert wrote: >> > >>>I use Squid and i kwow that the port is 3128. >>>But with proxy-suite i don't kwnow the port number (i must use it for >>> > my > >>>windows ftp client). >>> >>>Can i use a ftp local site (port 21) with the proxy-suite in the same >>>machine ? >>> >>> >>> >>> >>>--------------------------------------------------------------------- >>>To unsubscribe, e-mail: proxy-suite-unsubscribe(a)suse.com >>>For additional commands, e-mail: proxy-suite-help(a)suse.com >>> >>> >>> >>> > > > >>--------------------------------------------------------------------- >>To unsubscribe, e-mail: proxy-suite-unsubscribe(a)suse.com >>For additional commands, e-mail: proxy-suite-help(a)suse.com >> > > > >

1 0

RE: [proxy-suite] Compiling Proxy-Suite
by Ruiyuan Jiang 18 Jul '02

18 Jul '02

Yes, it seemed gmake works. Thanks. -----Original Message----- From: Rainer Link [mailto:link@foo.fh-furtwangen.de] Sent: Wednesday, July 17, 2002 6:37 PM To: Ruiyuan Jiang Cc: 'proxy-suite(a)suse.com' Subject: Re: [proxy-suite] Compiling Proxy-Suite Ruiyuan Jiang schrieb: > I downloaded Proxy-Suite v1.9. First I tried to compile it on my Sun Blade > 100 workstation (Solaris 9, gcc v2.95.3). The "configure" process with or > without any option ran without problem. I then tried to "make" and I got an > error message: > > $ make > > ::::::::::::: make 'all' in ./doc > > ::::::::::::: make 'all' in ./common > make: Fatal error in reader: Makefile, line 76: Unexpected end of line seen > Current working directory /export/home/rc6/proxy-suite-1.9/common > *** Error code 1 > make: Fatal error: Command failed for target `all' Hum, I'd guess using GNU make (gmake) instead of make will work (if gmake is installed, of course). HTH best regards, Rainer Link -- Rainer Link | Student of Computer Networking link(a)suse.de | University of Applied Sciences, Furtwangen, Germany rainer.w3.to | http://www.computer-networking.de/

1 0

What is the port listen by proxy-suite ?
by ALLAIN Norbert 18 Jul '02

18 Jul '02

I use Squid and i kwow that the port is 3128. But with proxy-suite i don't kwnow the port number (i must use it for my windows ftp client). Can i use a ftp local site (port 21) with the proxy-suite in the same machine ?

2 1

test
by Daniel Stellwagen 18 Jul '02

18 Jul '02

test

1 0