December 2004 - zorp-hu - lists.balabit.hu

libzorpll licenss
by Milus János 13 Dec '04

13 Dec '04

Hi A libzorpll-ben mind a COPYING mind a debian/copyright fájl üres, valamint a forrásban sincs licensz feltüntetve. Szeretném elindítani, hogy a zorp-gpl bekerüljön a gentoo portage fába, ehhez viszont ezekre az információkra szükség lenne. Mi a pontos licenszelése a libzorpll-nek? -- Üdv Jo-Hans

3 4

apt-get problema
by Makay Kalman 08 Dec '04

08 Dec '04

Sziasztok, Nem sikerul a Zorp telepitese a Balabitos szerverrol: apt-get update eredmenye: ... ... Ign http://apt.balabit.com 2.0/zorp-common Release Err http://apt.balabit.com 2.0/zorp-gpl Packages 404 Not Found Ign http://apt.balabit.com 2.0/zorp-gpl Release Get:3 http://apt.balabit.com 2.0/zorp-os Packages [52.2kB] Ign http://apt.balabit.com 2.0/zorp-os Release Fetched 104kB in 1s (81.1kB/s) Failed to fetch http://apt.balabit.com/zorp-gpl-os/dists/2.0/zorp-gpl/binary-i386/Packag es 404 Not Found ... ... apt.source tartalma tobbek kozt (a tobbi nem lenyeg): deb http://apt.balabit.com/zorp-gpl-os 2.0 main zorp-common zorp-gpl zorp-os Udv., Makay Kalman

3 2

Zorp fordítás
by Milus János 08 Dec '04

08 Dec '04

Próbáltam Zorpot forrásból fordítani, de már a libzorpll-nél elakadtam: creating cache ./config.cache checking for a BSD compatible install... /bin/install -c checking whether build environment is sane... yes checking whether make sets ${MAKE}... yes checking for working aclocal... found checking for working autoconf... found checking for working automake... found checking for working autoheader... found checking for working makeinfo... found checking for gcc... gcc checking whether the C compiler (gcc -O2 ) works... yes checking whether the C compiler (gcc -O2 ) is a cross-compiler... no checking whether we are using GNU C... yes checking whether gcc accepts -g... yes checking for Cygwin environment... no checking for mingw32 environment... no checking how to run the C preprocessor... gcc -E checking host system type... i686-pc-linux-gnu checking build system type... i686-pc-linux-gnu checking for ld used by GCC... /usr/i686-pc-linux-gnu/bin/ld checking if the linker (/usr/i686-pc-linux-gnu/bin/ld) is GNU ld... yes checking for /usr/i686-pc-linux-gnu/bin/ld option to reload object files... -r checking for BSD-compatible nm... /usr/bin/nm -B checking whether ln -s works... yes checking how to recognise dependant libraries... pass_all checking for object suffix... o checking for executable suffix... no checking command to parse /usr/bin/nm -B output... ok checking for dlfcn.h... yes checking for ranlib... ranlib checking for strip... strip checking for objdir... .libs checking for gcc option to produce PIC... -fPIC checking if gcc PIC flag -fPIC works... yes checking if gcc static flag -static works... yes checking if gcc supports -c -o file.o... yes checking if gcc supports -c -o file.lo... yes checking if gcc supports -fno-rtti -fno-exceptions... yes checking whether the linker (/usr/i686-pc-linux-gnu/bin/ld) supports shared libraries... yes checking how to hardcode library paths into programs... immediate checking whether stripping libraries is possible... yes checking dynamic linker characteristics... GNU/Linux ld.so checking if libtool supports shared libraries... yes checking whether to build shared libraries... yes checking whether to build static libraries... yes checking whether -lc should be explicitly linked in... no creating libtool checking for dirent.h that defines DIR... yes checking for opendir in -ldir... no checking for ANSI C header files... yes checking for fcntl.h... yes checking for sys/ioctl.h... yes checking for sys/time.h... yes checking for syslog.h... yes checking for unistd.h... yes checking for sys/capability.h... yes checking for dlfcn.h... (cached) yes checking for openssl/ssl.h... yes checking for working const... yes checking for size_t... yes checking for uid_t in sys/types.h... yes checking whether struct tm is in sys/time.h or time.h... time.h checking for PR_SET_KEEPCAPS... yes checking for working alloca.h... yes checking for alloca... yes checking whether gcc needs -traditional... no checking for 8-bit clean memcmp... yes checking for strftime... yes checking for cap_set_proc in -lcap... yes checking for pthread_create in -lpthread... yes checking for inet_aton in -lresolv... yes checking for socket in -lsocket... no checking for crypt in -lcrypt... yes checking for socket... yes checking for strtol... yes checking for strtoul... yes checking for strlcpy... no checking for backtrace... yes checking for inet_aton... yes checking for inet_addr... yes checking for pkg-config... /usr/bin/pkg-config checking for GLIB - version >= 2.0.1... yes (version 2.4.8) checking for library containing DES_ecb_encrypt... -lcrypto checking for library containing SSL_accept... -lssl checking for ENGINE_by_id... yes checking whether to enable POSIX 1003.1e capability support... yes checking whether to enable stack dumping (only in i386 Linux)... yes checking whether to enable SSL crypto engine support... yes Compile time options: --------------------- debug: no trace: no mem_trace: no heap_trace: no dmalloc: no caps: yes residual_protection: no stackdump: yes ssl_engine: yes updating cache ./config.cache creating ./config.status creating Makefile creating debian/Makefile creating src/Makefile creating src/zorp/Makefile creating zorplibll.pc creating debian/libzorpll.shlibs creating src/zorp/zorplibconfig.h src/zorp/zorplibconfig.h is unchanged Making all in src [egy darabig semmi hiba] gcc -DHAVE_CONFIG_H -I. -I. -I../src/zorp -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/lib -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include -O2 -Wall -g -D_GNU_SOURCE -c stream.c -fPIC -DPIC -o .libs/stream.lo stream.c:400: warning: dereferencing type-punned pointer will break strict-aliasing rules gcc -DHAVE_CONFIG_H -I. -I. -I../src/zorp -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/lib -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include -O2 -Wall -g -D_GNU_SOURCE -c stream.c -o stream.o >/dev/null 2>&1 rm -f .libs/streamline.lo gcc -DHAVE_CONFIG_H -I. -I. -I../src/zorp -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/lib -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include -O2 -Wall -g -D_GNU_SOURCE -c streamline.c -fPIC -DPIC -o .libs/streamline.lo streamline.c:810: warning: dereferencing type-punned pointer will break strict-aliasing rules mv -f .libs/stream.lo stream.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I. -I../src/zorp -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/lib -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include -O2 -Wall -g -D_GNU_SOURCE -c log.c gcc -DHAVE_CONFIG_H -I. -I. -I../src/zorp -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/lib -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include -O2 -Wall -g -D_GNU_SOURCE -c streamline.c -o streamline.o >/dev/null 2>&1rm -f .libs/log.lo gcc -DHAVE_CONFIG_H -I. -I. -I../src/zorp -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/lib -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include -O2 -Wall -g -D_GNU_SOURCE -c log.c -fPIC -DPIC -o .libs/log.lo log.c: In function `z_log_register_class': log.c:693: error: assignment of read-only location mv -f .libs/streamline.lo streamline.lo /bin/sh ../libtool --mode=compile gcc -DHAVE_CONFIG_H -I. -I. -I../src/zorp -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/lib -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include -O2 -Wall -g -D_GNU_SOURCE -c io.c make[2]: *** [log.lo] Error 1 make[2]: *** Waiting for unfinished jobs.... rm -f .libs/io.lo gcc -DHAVE_CONFIG_H -I. -I. -I../src/zorp -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/lib -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include -O2 -Wall -g -D_GNU_SOURCE -c io.c -fPIC -DPIC -o .libs/io.lo gcc -DHAVE_CONFIG_H -I. -I. -I../src/zorp -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/lib -I/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5 -pthread -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/include -O2 -Wall -g -D_GNU_SOURCE -c io.c -o io.o >/dev/null 2>&1 mv -f .libs/io.lo io.lo make[2]: Leaving directory `/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/src' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/var/tmp/portage/libzorpll-2.1.12.5/work/libzorpll-2.1.12.5/src' make: *** [all-recursive] Error 1 A gcc verziója 3.4.3 -- Üdv Jo-Hans

3 2

RE: [zorp-hu] ntp problema
by Kucsera László 07 Dec '04

07 Dec '04

Szia! Meg lett a problema: ntpd[1896]: getconfig: Couldn't open </etc/ntp.conf> A ZMC mindig visszaallitotta a chroot-olt etc/ntp.conf tulajdonosat root:root-ra a jogosultsagat pedig 640-re. Most mar megy! A loggolas sokat segitett! Koszi Kucsera Laszlo -----Eredeti üzenet----- Feladó: zorp-hu-admin(a)lists.balabit.hu meghatalmazó: Gellér Sándor Küldve: 2004. 12. 07., K 17:19 Címzett: zorp-hu(a)lists.balabit.hu Tárgy: Re: [zorp-hu] ntp problema Kucsera László wrote: > Szia! > > Ha ZMC-bol restartoltatom, akkor ennyi van a logban: > 2004-12-07T16:46:22+0100 patyomkin zms/transfer[363]: ((zms/transferagent)): Run script in batch mode; command='/etc/init.d/ntp restart' > 2004-12-07T16:46:24+0100 patyomkin zms/transfer[363]: ((zms/transferagent)): Message handled; message_id='184', type='script', resultcode='1' > > Ha kezzel, akkor semmi. Viszont, ha az /etc/init.d/ntp.harden -nel inditom (ez nem chroot-ol), akkor o ir a logba. > Ha a servert ip cimmel, vagy masik servert irtam, a helyzett valtozatlan. Az /etc/init.d/ntp.harden-t ne hasznald, az a "gyari" init script, a dpkg azt fogja felulirni az ntp frissitesekor. A syslog-ng konfigjat meg kellene nezni, valoszinuleg hianyzik a source-ok kozul a /var/chroot/ntp/dev/log, be kene irni, es reload-olni a syslog-ng-t, igy mar a chroot-ban futo ntp logja is latszani fog. Ha sikerult rabirni az ntp-t a logolasra, akkor erdekelne, mi is tortenik. -- Geller Sandor wildy(a)balabit.hu _______________________________________________ zorp-hu mailing list zorp-hu(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp-hu

1 0

RE: [zorp-hu] ntp problema
by Kucsera László 07 Dec '04

07 Dec '04

Szia! Ha ZMC-bol restartoltatom, akkor ennyi van a logban: 2004-12-07T16:46:22+0100 patyomkin zms/transfer[363]: ((zms/transferagent)): Run script in batch mode; command='/etc/init.d/ntp restart' 2004-12-07T16:46:24+0100 patyomkin zms/transfer[363]: ((zms/transferagent)): Message handled; message_id='184', type='script', resultcode='1' Ha kezzel, akkor semmi. Viszont, ha az /etc/init.d/ntp.harden -nel inditom (ez nem chroot-ol), akkor o ir a logba. Ha a servert ip cimmel, vagy masik servert irtam, a helyzett valtozatlan. Nincs otletem.... Udvozlettel: Kucsera Laszo

2 2

Zorp, tproxy kerdes
by Ifj. Darvas Istvan 07 Dec '04

07 Dec '04

sziasztok, Az elso kerdesem az lenne, hogy a tproxy patch, ami kint van: cttproxy-2.6.8.1-2.0.0, az a 2.6.8.1-es kernelhez keszult e? ;) Ha nem akkor nem is kell tovabb olvasni a levelet ;) Ha viszont ahhoz keszult, akkor ez a helyzet A kovetkezo naplobejegyzesben ez a mezo ---> local='AF_INET(80.98.229.71:0)' <--- mit jelent? Dec 6 14:25:04 ext-ip0 Proba[5847]: (proba-Zorp/proba:0/plug): Connecting to remote host; protocol='1', local='AF_INET(80.98.229.71 :0)', remote='AF_INET(192.168.1.101:80)' Dec 6 14:25:04 ext-ip0 Proba[5847]: (proba-Zorp/proba:0/plug): bind() failed; error='Cannot assign requested address' bedig ott van fent a local, amit hozzakene fuznie nem? egyebkent miert 0 a port? lenne meg egy kerdesem... az alabbi definicio helyes? kulonosen az snat erdekelne. def Proba(): Service("proba", PlugProxy, router=DirectedRouter(SockAddrInet("192.168.1.101",80)), snat=ForgeClientSourceNAT() ) Listener(SockAddrInet("195.70.58.137",55000), "proba") Udv, Istvan

3 2

RE: [zorp-hu] ntp problema
by Kucsera László 07 Dec '04

07 Dec '04

Szia! >> Miutan elinditom az ntpd-t (librestrict-el) egy deka csomag >sem megy ki a time.kfki.hu fele. >> Ezekutan a kliensek sem tudnak idot kerni a Zorptol >(valaszok jonnek, csak a "strat 0"): >> # ntpdate -q 10.0.50.200 >> server 10.0.50.200, stratum 16, offset 0.043695, delay 0.02893 >> 7 Dec 14:40:03 ntpdate[19979]: no server suitable for >synchronization found >> # >> A Zorprol az ntpdate jol mukodik. > >Ez ugye chroot-olt ntp? Igen. >Meg kellene nezni, rendben van-e az ntp chroot-ja. Volt >korabban gond a >chroot kialakitasaval, amikor is nem volt benne /tmp konyvtar, ami >nelkul az ntpd nem mukodik. Emellett a (termeszetesen a >chroot-ban levo) Meg van a chroot-olt tmp is. >/var/run/, /var/lib/ntp, /var/log/ntpstats konyvtarok jogosultsagat >kellene megnezni, van-e ra irasjoga az ntpd-t futtato usernek. Probaltam mar az egesz chroot-olt konyvtarstrukturanak a tulajdonosat beallitan nobody:nogroup-ra, de igy sem megy. Igy van elinditva (/etc/init.d/ntp): export RESTRICT_UID=nobody export RESTRICT_GID=nogroup #export RESTRICT_GROUPS= #export RESTRICT_VERBOSE=1 export RESTRICT_CAPS=cap_sys_time,cap_net_bind_service,cap_sys_nice,cap_ipc_lock=pe export RESTRICT_CHROOT=/var/chroot/ntp/ export RESTRICT_FAKEUID=0 PATH=/sbin:/usr/sbin:/bin:/usr/bin DAEMON=/usr/sbin/ntpd NAME=ntpd DESC="NTP daemon" LD_PRELOAD=/usr/lib/librestrict.so FLAGS="defaults 23" PIDFILE=${RESTRICT_CHROOT}/var/run/ntpd.pid test -x $DAEMON || exit 0 case "$1" in start) echo -n "Starting $DESC: " chown $RESTRICT_UID:$RESTRICT_GID ${RESTRICT_CHROOT}/var/run chown $RESTRICT_UID:$RESTRICT_GID ${RESTRICT_CHROOT}/var/lib/ntp chown $RESTRICT_UID:$RESTRICT_GID ${RESTRICT_CHROOT}/var/log/ntpstats export LD_PRELOAD $DAEMON -p /var/run/ntpd.pid echo "$NAME." ;; ------------------------------ Udv: Kucsera Laszlo

2 1

ntp problema
by Kucsera László 07 Dec '04

07 Dec '04

Udv! Egy ntp-s problemam lenne. Egy ntpd szertnek elindítani Zorpon. Az ntpd.conf: clientlimit 6 clientperiod 11 driftfile /var/lib/ntp/ntp.drift filegen loopstats file loopstats type day enable filegen peerstats file peerstats type day enable filegen clockstats file clockstats type day enable server time.kfki.hu minpoll 5 maxpoll 16 prefer statistics loopstats peerstats clockstats statsdir /var/log/ntpstats/ Miutan elinditom az ntpd-t (librestrict-el) egy deka csomag sem megy ki a time.kfki.hu fele. Ezekutan a kliensek sem tudnak idot kerni a Zorptol (valaszok jonnek, csak a "strat 0"): # ntpdate -q 10.0.50.200 server 10.0.50.200, stratum 16, offset 0.043695, delay 0.02893 7 Dec 14:40:03 ntpdate[19979]: no server suitable for synchronization found # A Zorprol az ntpdate jol mukodik. Udv: Kucsera Laszlo

2 1

tproxy nyug
by Ifj. Darvas Istvan 06 Dec '04

06 Dec '04

sziasztok, szituacio: telepitettem egy uj gepet, fel szerettem volna telepiteni arra ugyan azt a zorp konfigot, ami a masikon van. csak ujabb kernellel. Akkor bele is vagnek a lenyegbe. kornyezet: 2.6.8.1-es kernel, megbuheralva a cttproxy-2.6.8.1-2.0.0 csomagotokkal ---->lsmod Module Size Used by ipt_tproxy 2176 0 iptable_tproxy 20248 0 ipt_TPROXY 2560 1 iptables-1.2.7a megbuheralva szinten szepen lefordultak feltelepultek semmi extrat nem tudok mondani... fent van maga a program is meg a kiegeszitok hozza, szinten hiba nelkul minden OK nelkul feltelepultek.... libzorp2 2.0.9-8 libzorpll 2.0.26.24-5 zorp 2.0.9-8 zorp-modules 2.0.9-8 python 2.3.4-4 python-extcl 1.2.0zope-2 -------->instances.conf TESZT --verbose=8 --policy /etc/zorp/policy.py --autobind-ip 1.2.3.4 -------->policy.py def TESZT(): Service( "inter_TESZT_H12", PlugProxy, router=DirectedRouter(SockAddrInet(IP_H12,443)), snat=ForgeClientSourceNAT() ) Listener(SockAddrInet(IP0,52000), "inter_TESZT_H12") --------->iptables -t tproxy -A PREROUTING -i eth0 -p tcp -d 195.70.41.161 --dport 10000 -j TPROXY --on-port 52000 err.log csatolva Dec 4 18:40:20 hyperion TESZT[1279]: (https-Zorp/inter_TESZT_H12:0/plug): bind() failed; error='Cannot assign requested address' en ezt a sort nem ertem, hogy miert nem tud a zorp cimet igenyeleni Udv, Istvan

3 5