April 2002 - zorp-hu - lists.balabit.hu

BalaBit Tanfolyamok!
by Gyorko Zoltan 30 Apr '02

30 Apr '02

Tisztelt Cím! Ezúton szeretnénk felhívni figyelmét az alábbi BalaBit tanfolyamokra. 1. TCP/IP Linux hálózat A tanfolyam időpontja: 2002. május 20-21. 2. Zorp Adminisztrátor A tanfolyam időpontja: 2002. május 27-28-29. A tanfolyamok helyszíne: Budapest, XI. Ker. Csurgói út 20/B (BalaBitHQ) A tanfolyamok díja: TCP/IP: 60.000 Ft Zorp Adm.: 100.000 Ft Kapcsolat: Szabó Gyöngyvér e-mail: szabo.gyongyver(a)balabit.hu tel: 1-217-1498 (május 5-e után 1-371-0540) Bővebb információ és jelentkezési lap: http://www.balabit.hu/hu/support/training/ Üdvözlettel -- Györkő Zoltán BalaBit IT Biztonságtechnikai Kft. tel/fax:(36-1)-217-14-98 1092 Bp. Köztelek u. 4/b http://www.balabit.hu

1 0

policy gond
by Barina Tamas 29 Apr '02

29 Apr '02

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Sziasztok. Itt egy konfig, de amikor megprobalom elinditani, akkor alszall. Egy kicsit hosszu leszek bocsi. Ez teszi a logba: Apr 26 16:13:09 fwall zorp-full[2976]: Zone(saps): inbound service=WD_sap Apr 26 16:13:09 fwall zorp-full[2976]: Zone(hosting-place): outbound service=DW_ftp Apr 26 16:13:09 fwall zorp-full[2976]: (zorp/nosession): Changing process capabilities; caps='= cap_net_bind_service+ep cap_net_admin+p' Apr 26 16:13:09 fwall zorp-full[2976]: (zorp/nosession): Changing process capabilities; caps='= cap_net_bind_service,cap_net_admin+ep' Apr 26 16:13:09 fwall zorp-full[2976]: bind(): failed due to: Address already in use. Apr 26 16:13:09 fwall zorp-full[2976]: (zorp/nosession): Resetting process capabilities; caps='= cap_net_bind_service,cap_net_admin+p' Apr 26 16:13:09 fwall zorp-full[2978]: (zorp/nosession): Traceback (innermost last): Apr 26 16:13:09 fwall zorp-full[2978]: (zorp/nosession): File "/etc/zorp/policy.py", line 189, in init Apr 26 16:13:09 fwall zorp-full[2978]: (zorp/nosession): Listener(SockAddrInet("192.168.64.3", 50021), "DW_ftp") Apr 26 16:13:09 fwall zorp-full[2978]: (zorp/nosession): File "/usr/share/zorp/pylib/Zorp/Listener.py", line 176, in __init__ Apr 26 16:13:09 fwall zorp-full[2978]: (zorp/nosession): SimpleListen.__init__(self, bindto, backlog=backlog) Apr 26 16:13:09 fwall zorp-full[2978]: (zorp/nosession): File "/usr/share/zorp/pylib/Zorp/Listener.py", line 68, in __init__ Apr 26 16:13:09 fwall zorp-full[2978]: (zorp/nosession): self.listen = Listen(bindto, self.accepted, accept_one, backlog) Apr 26 16:13:09 fwall zorp-full[2978]: (zorp/nosession): IOError: Error binding to interface Apr 26 16:13:09 fwall zorp-full[2976]: (zorp/nosession): Error initializing policy Apr 26 16:13:09 fwall zorp-full[2976]: zorp version 1.4.0rc18 going down. Es a config: # firewall internal network: 192.168.64.0/24 # firewall internal interface: 212.108.226.242 # firewall dmz interface: 192.168.64.3 # # WD = from World to DMZ # DW = from DMZ to World from Zorp.Core import * from Zorp.Http import * from Zorp.Plug import * from Zorp.Ftp import * Zorp.firewall_name = 'zorp@fwall' InetZone("local", "127.0.0.0/8", inbound_services=["*"], outbound_services=[]), InetZone("dmznet", "192.168.64.0/24", inbound_services=["WD_ntp"], outbound_services=["DW_irc","DW_webmin"]), InetZone("mails", "212.108.226.244", inbound_services=["WD_webmin","WD_pop","WD_imap","WD_smtp","WD_http"], outbound_services=["DW_pop","DW_smtp"]), InetZone("webs", "212.108.226.245", inbound_services=["WD_http","WD_ftp","WD_dns"], outbound_services=["DW_dns"]), InetZone("wtest", "212.108.226.250", inbound_services=["WD_http","WD_ssh","WD_ftp","WD_imap","WD_cvs","WD_m ysql","WD_pop3"], outbound_services=[]), InetZone("dev", "212.108.226.246", inbound_services=["WD_http","WD_ssh","WD_ftp","WD_imap","WD_cvs","WD_m ysql","WD_pop3"], outbound_services=[]), InetZone("saps", "212.108.226.251", inbound_services=["WD_http","WD_ssh","WD_ftp","WD_sap"], outbound_services=[]), InetZone("hosting-place", "195.228.254.145", inbound_services=[], outbound_services=["DW_ftp"]), InetZone("internet", "0.0.0.0/0", inbound_services=[], outbound_services=[]) InetZone("outnet", "212.108.226.0/24", inbound_services=[], outbound_services=[]) class WD_ftp(FtpProxy): def config(self): FtpProxy.config(self) self.transparent_mode = TRUE class DW_ftp(FtpProxy): def config(self): FtpProxy.config(self) self.transparent_mode = TRUE class WD_http(PlugProxy): def config(self): pass class DW_http(PlugProxy): def config(self): pass class WD_ssh(PlugProxy): def config(self): pass class DW_ssh(PlugProxy): def config(self): pass class WD_smtp(PlugProxy): def config(self): pass class DW_smtp(PlugProxy): def config(self): pass class WD_imap(PlugProxy): def config(self): pass class DW_imap(PlugProxy): def config(self): pass class DW_irc(PlugProxy): def config(self): pass class WD_pop3(PlugProxy): def config(self): pass class DW_pop3(PlugProxy): def config(self): pass class WD_webmin(PlugProxy): def config(self): pass class DW_webmin(PlugProxy): def config(self): pass class WD_cvs(PlugProxy): def config(self): pass class DW_cvs(PlugProxy): def config(self): pass class WD_mysql(PlugProxy): def config(self): pass class DW_mysql(PlugProxy): def config(self): pass class WD_ntp(PlugProxy): def config(self): pass class DW_ntp(PlugProxy): def config(self): pass class WD_sap(PlugProxy): def config(self): pass class DW_sap(PlugProxy): def config(self): pass class WD_dns(PlugProxy): def config(self): pass class DW_dns(PlugProxy): def config(self): pass def init(name): Service("WD_ftp", WD_ftp, router=TransparentRouter()) Service("WD_ssh", WD_ssh, router=TransparentRouter()) Service("WD_smtp", WD_smtp, router=TransparentRouter()) Service("WD_imap", WD_imap, router=TransparentRouter()) Service("WD_webmin", WD_webmin, router=TransparentRouter()) Service("WD_pop3", WD_pop3, router=TransparentRouter()) Service("WD_http", WD_http, router=TransparentRouter()) Service("WD_dns", WD_dns, router=TransparentRouter()) Service("WD_mysql", WD_mysql, router=TransparentRouter()) Service("WD_cvs", WD_cvs, router=TransparentRouter()) Service("WD_ntp", WD_ntp, router=TransparentRouter()) Service("WD_sap", WD_sap, router=TransparentRouter()) Service("DW_ftp", DW_ftp, router=TransparentRouter()) Service("DW_ssh", DW_ssh, router=TransparentRouter()) Service("DW_sap", DW_sap, router=TransparentRouter()) Service("DW_ntp", DW_ntp, router=TransparentRouter()) Service("DW_cvs", DW_cvs, router=TransparentRouter()) Service("DW_mysql", DW_mysql, router=TransparentRouter()) Service("DW_dns", DW_dns, router=TransparentRouter()) Service("DW_http", DW_http, router=TransparentRouter()) Service("DW_pop3", DW_pop3, router=TransparentRouter()) Service("DW_webmin", DW_webmin, router=TransparentRouter()) Service("DW_imap", DW_imap, router=TransparentRouter()) Service("DW_irc", DW_irc, router=TransparentRouter()) Service("DW_smtp", DW_smtp, router=TransparentRouter()) Listener(SockAddrInet("192.168.64.3", 50021), "DW_ftp") Listener(SockAddrInet("192.168.64.3", 50022), "DW_ssh") Listener(SockAddrInet("192.168.64.3", 50025), "DW_smtp") Listener(SockAddrInet("192.168.64.3", 56667), "DW_irc") Listener(SockAddrInet("192.168.64.3", 51000), "DW_webmin") Listener(SockAddrInet("192.168.64.3", 50110), "DW_pop3") Listener(SockAddrInet("192.168.64.3", 50053), "DW_dns") Listener(SockAddrInet("212.108.226.242", 50021), "WD_ftp") Listener(SockAddrInet("212.108.226.242", 50022), "WD_ssh") Listener(SockAddrInet("212.108.226.242", 50025), "WD_smtp") Listener(SockAddrInet("212.108.226.242", 50143), "WD_imap") Listener(SockAddrInet("212.108.226.242", 51000), "WD_webmin") Listener(SockAddrInet("212.108.226.242", 50110), "WD_pop3") Listener(SockAddrInet("212.108.226.242", 50080), "WD_http") Listener(SockAddrInet("212.108.226.242", 50053), "WD_dns") Listener(SockAddrInet("212.108.226.242", 52401), "WD_cvs") Listener(SockAddrInet("212.108.226.242", 53306), "WD_mysql") Listener(SockAddrInet("212.108.226.242", 51123), "WD_ntp") Listener(SockAddrInet("212.108.226.242", 53200), "WD_sap") Barina Tamás + 36 30 250 3863 - ------------------------------------- 1123 Budapest, Alkotás út 39/C Tel.: +36 1 457 7690 Fax: +36 1 457 7699 PGP KeyID: 0xAC43C74F Fingerprint: 11AE 0464 7428 3DD8 470D 9A51 DD55 AB3B AC43 C74F -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 7.0.3 for non-commercial use <http://www.pgp.com> iQA/AwUBPMlhi91VqzusQ8dPEQKYCACfXdPreCrw54LJKRurjUXWoksCX38AoPLC BfD//VrASmOSmZNXulvFdvpM =OW3U -----END PGP SIGNATURE-----

5 7

inbound service not permitted....
by Haluska György 24 Apr '02

24 Apr '02

Sziasztok, Telepítettem két zorp-ot (1.4.0rc20 deb-woody 2.2.20) Az egyik tökéletesen megy, a másik viszont állandóan s $SUBJ-beli üzenetekkel örvendeztet. A különbség a két telepítés között az az, hogy az utóbbi esetben minkét lábnak belső IP-je van. eth1=192.168...., eth0=10.0.... A konfig a sample.conf-okból való, csak az ip-ket változtattam. log részlet: Apr 23 17:10:58 site zorp-site[14582]: (zorp@site/intra_http:97): Inbound service intra_http not permitted into zone Zone(site-net, 192.168.20.0/24) Szóval nem úgy tekinti, hogy a külső 10.0... interfész az internet zónához tatozik. Nem jöttem rá hogyan tudnám elmagyarázni neki. A kérdésem hogyan kellene ? -- George

4 7

zorp GPL 1.4.0rc22
by HOLTZL Peter 23 Apr '02

23 Apr '02

sziasztok! Megjelent a Zorp GPL 1.4.0rc22. Mindenkinek sok sikert hozzá! Changelog: HIBAJAVÍTÁSOK: Core: * Import AF_UNIX and SOCK_STREAM to Chainer.py * fixed CA certificate name cache * Fixed a SIGSEGV in Connection Tracking. Http: * reset error message to none if no error was encountered Imap: * Handle flags in FETCH command correctly. * Handle when a range second tag is '*' correctly. Ftp: * Accept 550 answer to NLST command. * Doesn't set to null poll releated variables. ÚJ TULAJDNONSÁGOK: Core: * New NAT class. HashNAT Http: * added additional WebDAV methods * added additional WebDAV responses * process 102 response code needed for WebDAV Höltzl Péter -- Ho:ltzl Pe'ter | Tel/Fax:+36 1 217-1498 | GnuPG Fingerprint: BalaBit IT Kft | Mobil: +36 20 366-9667 | 0CF9 9E5D FCA5 3370 B05E holtzl.peter(a)balabit.hu | http://www.balabit.hu/ | 3531 88EB 97C3 26D3 EF03

1 0

1 apro kerdes
by Barina Tamas 15 Apr '02

15 Apr '02

A zorp GPL lekezeli a kovetkezoket is? -mysql -ntp -cvs Barina Tamás + 36 30 250 3863 ------------------------------------- 1123 Budapest, Alkotás út 39/C Tel.: +36 1 457 7690 Fax: +36 1 457 7699 PGP KeyID: 0xAC43C74F Fingerprint: 11AE 0464 7428 3DD8 470D 9A51 DD55 AB3B AC43 C74F

4 5

dependency problemak
by Gabor Halasz 09 Apr '02

09 Apr '02

Hali!! Te szerepelsz maintainerkent, ugyhogy inkabb neked irok, nem a listakra. thewall:/usr/src/zorp# dpkg -i zorp_1.4.0rc18-1_i386.deb (Reading database ... 14708 files and directories currently installed.) Preparing to replace zorp 1.4.0rc18-1 (using zorp_1.4.0rc18-1_i386.deb) ... Unpacking replacement zorp ... dpkg: dependency problems prevent configuration of zorp: zorp depends on libglib1.3 (>= 1.3.1); however: Package libglib1.3 is not installed. Viszont libglib1.3 csomag mar a potatoban sincs. Python-base is csak a potatoban van. http://packages.debian.org/cgi-bin/search_packages.pl?keywords=libglib&sear… http://packages.debian.org/cgi-bin/search_packages.pl?keywords=python&searc… Kellemes dolog, hogy csinalsz deb-et is, de sokkal hasznalhatobbak lennenek, ha az aktualis disztribuciokhoz konvergalnanak, igy nagyon sokat kell trukkozni. Mik a terveitek vele?

2 1

https->http
by Gabor Halasz 09 Apr '02

09 Apr '02

Lehet ilyet? Marmint https-en figyel, kibontja es tovabbkuldi http-vel a httpst nemtudo, jodragaalkalmazasnak? Csak igen/nem gpl/fizetos szinten erdekel.

2 1

Zorp GPL v1.4.0rc19
by HOLTZL Peter 05 Apr '02

05 Apr '02

Sziasztok! Megjelent a Zorp GPL 1.4 rc19-es verzió! Bemásolom a change-log-ot. Mindenkinek jó munkát hozzá! Höltzl Péter zorp 1.4.0rc19 Fri Apr 5 09:15:45 CEST 2002 Bugfixes: Core: * Fixes a bug in memtrace; * Fixes a double free bug in ssl; Ftp: * Doesn't drop the connection when EPSV or EPRT command arrive; * Fixes a typo in FtpProxyAnonRO; * Terminating command log with null in ftp_read_line; * Fixes a race condition in data channel build; Telnet: * Leave the proxy correctly when error occured in forward state; Some minor new features: Core: * After config event it dump the known variables to log; * New function: z_ssl_session_new_ctx; * When it get fatal signal, it dump the memory map for easying bug tracking; Http: * Now you can hide zorp error messages from clients. (anonymizing your firewall.); * extended strict_header_checking = FALSE state to allow spaces in headers everywhere; * report full line when the protocol version field cannot be parsed; -- Ho:ltzl Pe'ter | Tel/Fax:+36 1 217-1498 | GnuPG Fingerprint: BalaBit IT Kft | Mobil: +36 20 366-9667 | 0CF9 9E5D FCA5 3370 B05E holtzl.peter(a)balabit.hu | http://www.balabit.hu/ | 3531 88EB 97C3 26D3 EF03

1 0