- zorp - lists.balabit.hu

http + smtp
by Zoltán Gyula Beck 24 May '13

24 May '13

Kedves Tagok, egyelőre nagyon kezdő vagyok a témában, de úgy alakult, hogy tesztelnem kell(ene) a Zorp GPL-t és ebben szeretném kérni a segítségeteket. A tesztelést egy önálló webserveren kellene megtennem, a Zorp is azon lenne (nem külön gateway), kb. ez lenne a cél: - bejövő http (több domain) - bejövő https (több domain) - kimenő smtp - kimenő smtp + TLS Nagyon megköszönném ha tudnátok példát mutatni vagy elérhető dokumentációt, én egyelőre ezt nézegettem: https://github.com/balabit/zorp-examples/blob/master/policy.py de ez alapján nem látom, hogy az iptables hogyan kellene kinézzen, illetve a zonákat sem látom, hogyan kellene felépíteni egy standalone szerveren. Üdv és köszönöm, bzg

3 2

Latest Zorp posts
by Szilárd Pfeiffer 07 Jan '13

07 Jan '13

Dear List Members, Below, there are Zorp solutions to some common network security issues, such as forward/reverse proxy, protocol enforcement and access control. http://bit.ly/VIq3Hf http://bit.ly/133FFv2 http://bit.ly/XrpgR2 http://bit.ly/Wr3cjc ... and another post about configuring Zorp if you want to use it with its kernel module KZorp. http://bit.ly/VCYGyR Best regards, Zorp team

1 0

make install nem fut le
by Stefán István 06 Sep '12

06 Sep '12

Sziasztok! Próbálok ismerkedni a zorp gpl-es verziójával. Forrásból telepítem, de a make install résznél hibát kapok: /usr/bin/python ../../pylib/kznf/setup.py install --prefix //usr/local/zorp --install-layout=deb usage: setup.py [global_opts] cmd1 [cmd1_opts] [cmd2 [cmd2_opts] ...] or: setup.py --help [cmd1 cmd2 ...] or: setup.py --help-commands or: setup.py cmd --help error: option --install-layout not recognized zorp verzió: 3.9.5 Köszi előre is a segítséget: -- Stefán István TUXIT Informatikai és Mérnöki Tanácsadó Bt. 2030 Érd, Szénégető u. 54. Tel: +36 20 388 8611 http://www.tuxit.hu

3 3

[ANN] Zorp GPL APT repositories
by Gergely Nagy 19 Jun '12

19 Jun '12

Greetings! I'm happy to announce that as of a week or two ago, there is now an APT repository for Debian-based systems, with up-to-date Zorp GPL packages, patched tools and kernels, to make it possible to use all the power Zorp provides on any modern Debian-based platform! As of this writing, the repository below contains Zorp 3.9.5 (and dependencies), along with iptables 1.4.14 and a KZorp-enabled linux 2.6.32 kernel. The repository can be used by putting these into your sources.list file: deb http://packages.madhouse-project.org/$DIST $RELEASE zorp deb http://packages.madhouse-project.org/zorp-kernel kernel 2.6 Where $DIST can be one of "debian" or "ubuntu", and release one of "squeeze", "wheezy" or "unstable" in case of Debian; "lucid", "natty", "oneiric", "precise" or "quantal" in case of Ubuntu. The packages will be kept up to date, future versions of Zorp (and the kernel) will be available from the same repository, as long as the relevant distributions are supported by their respective vendors. To install Zorp itself, after adding the source.list lines and updating, install zorp and the patched iptables as follows: $ sudo apt-get install zorp iptables Installing the kernel is similarly easy: $ sudo apt-get install linux-image-2.6.32-5+kzorp-amd64 Or, on a 32-bit system where you would not want a 64-bit kernel: $ sudo apt-get install linux-image-2.6.32-5+kzorp-486 For now, only linux 2.6.32 images are provided, but there are plans to support 3.x kernels too. As soon as those are available, I will announce it on this list, and my blog too. The Debian repository page[1] on my homepage will always contain the most up-to-date information on how to use the repository, the current signing key and so on and so forth. I hope these packages will be useful! [1]: http://asylum.madhouse-project.org/projects/debian/ -- |8]

1 0

Reverse proxy + side stacking broken (config?) for large pages?
by David Yerger 15 Mar '12

15 Mar '12

Using Zorp GPL 3.3, have a reverse proxy for OWA, I added def Zcommunicator(): Service("INcommunicator", INcommunicator, chainer=SideStackChainer(CommunicatorHttpProxy), router=DirectedRouter(SockAddrInet("<LAN IP>", 80))) Listener(SockAddrInet("<public ip>", 55000), "INcommunicator") class CommunicatorHttpProxy(HttpProxy): def config(self): HttpProxy.config(self) self.request["GET"] = (HTTP_REQ_POLICY, self.filterURL) self.request["POST"] = (HTTP_REQ_POLICY, self.filterURL) def filterURL(self, method, url, version): if ("http://<public DNS>:5500/cas" in url): self.session.setServer(SockAddrInet("10.0.7.2", 5447)) elif ("http://<public DNS>:5500/director2" in url): self.session.setServer(SockAddrInet("10.0.7.2", 5449)) elif ("http://<public DNS>:5500/techops" in url): self.session.setServer(SockAddrInet("10.0.0.6", 80)) elif ("http://<public DNS>:5500/fubar" in url): self.session.setServer(SockAddrInet("10.0.0.6", 80)) else: self.session.setServer(SockAddrInet("10.0.7.2", 80)) return HTTP_REQ_ACCEPT class INcommunicator(PsslProxy): def config(self): PsslProxy.config(self) self.client_verify_type = SSL_VERIFY_NONE self.client_ca_directory = "/etc/ssl/certs" self.server_need_ssl=FALSE self.client_key_file = "/etc/ssl/private/xxx.key" self.client_cert_file = "/etc/ssl/certs/xxx.crt" #self.stack_proxy = CommunicatorHttpProxy the "fubar" URL doesn't point to a real location--and I get the 500 error page back from the web server. But when I try a (larger) real page, I'm seeing Nov 28 15:42:39 localhost zorp/Zcommunicator[4334]: (svc/INcommunicator:9): Starting proxy instance; client_fd='15', client_address='AF_INET(<public ip>:2220)', client_zone='Zone(inter, 0.0.0.0/0)', client_local='AF_INET(<public ip>:5500)', client_protocol='TCP' Nov 28 15:42:39 localhost zorp/Zcommunicator[4334]: (svc/INcommunicator:9/pssl): SSL handshake failed on the client side; error='error:1407609C:SSL routines:lib(20):SSL23_GET_CLIENT_HELLO:func(118):http request:reason(156)' Ideas? Should I just reinstall 3.9.2 and copy my config files over? (no apt-get dist-upgrade option I see) Thanks in advance

4 6

kzorp -e help
by David Yerger 28 Feb '12

28 Feb '12

Trying to migrate from zorp GPL 3.1.15 to 3.9.3, following the guide at http://siposg.blogs.balabit.com/2012/01/howto-install-zorp-3-9-2-on-debi an-squeeze/ mostly, with the virtual machine as an example for rc.local and /etc/iptables/rules. 1. Is kzorp supported on Zorp GPL now? 2. My reverse proxy doesn't seem to be passing traffic. Don't see anything in the logs except accounting info, even after cranking the verbosity up. When I test my policy.py with with kzorp -e, having (among other things) InetZone("intra", "<internal network>/16", outbound_services=[], inbound_services=["INhttp", etc.]) InetZone("local", "127.0.0.0/8", inbound_services=["*"], outbound_services=[]) InetZone("inter", "0.0.0.0/0", inbound_services=[], outbound_services=["INhttp", etc.]) InetZone(name="server", addr=["<internal address>/32", ], inbound_services=["*"], outbound_services=["*"], admin_parent="intra" ) def Zhttp(): Service(name="INhttp", proxy_class=INhttp, router=DirectedRouter(SockAddrInet("<internal address>", 80) ) ) #Listener(SockAddrInet("<external address>", 50080), "INhttp") NDimensionDispatcher(bindto=DBSockAddr(SockAddrInet('<external address>', 50080), ZD_PROTO_TCP), transparent=TRUE, rules=( { 'iface' : "eth1", 'proto' : socket.IPPROTO_TCP, 'dst_port' : 80, 'src_zone' : ('inter', ), 'dst_zone' : ('server', ), 'service' : 'INhttp' } ) ) class INhttp(HttpProxy): def config(self): HttpProxy.config(self) I get # kzorp -e tcp <outside client IP> 5000 <external interface> 50080 <external interface> Evaluating ... on eth1 Client zone: inter Server zone: inter Service: not found Dispatcher: not found # kzorp -e tcp <outside client IP> 5000 <external interface> 80 <external interface> Evaluating ... on eth1 Client zone: inter Server zone: inter Service: not found Dispatcher: not found But when I try one of my services having the old Listener syntax I get # kzorp -e tcp <outside client IP> 5000 <external interface> 443 <external interface> Evaluating ... on eth1 Client zone: inter Server zone: inter Service: not found Dispatcher: not found But: root@owa:/etc/zorp# kzorp -e tcp <outside client IP> 5000 <external address> 50443 eth1 evaluating <outside client IP>:5000 -> <external address>:50443 on eth1 Client zone: inter Server zone: inter Service: INhttps Dispatcher: SA(proto=1,addr=AF_INET(<external address>:50443)) Not sure of the Server zone is right. Shouldn't it be 'server' or 'intra'? Also, it seems like kzorp can't find the service and dispatcher unless A. You give it the proxy port not the outside port? B. It wants the old Listener syntax? If I try to connect to the proxy port (:50080), I get in the logs ...Transparent listener connected directly, dropping connection; Which is reasonable enough. Seems like it would work if kzorp was feeding it properly. So what did I do wrong? Thanks David

2 3

Zorp on social networking websites
by Szilárd Pfeiffer 16 Jan '12

16 Jan '12

Dear list members! Now you can follow Zorp GPL on social networking sites. http://www.linkedin.com/groups/Zorp-GPL-4166962 http://www.facebook.com/pages/Zorp-GPL/239692256091025 http://twitter.com/#!/ZorpGPL Best regards, Zorp team

1 0

Zorp GPL 3.9.2
by Szilárd Pfeiffer 24 Aug '11

24 Aug '11

Dear list members! Zorp GPL version 3.9.2 has been released. Click on this blog post for details. Best regards, Zorp team

1 0

Re: [zorp] Help with intermediate certificate
by David Yerger 25 Aug '08

25 Aug '08

Bazsi wrote: >e.g. put the intermediate CA certificates in the directory pointed to be >self.client_ca_directory, named by the hash value of their subject name >(openssl x509 -hash) Testing with our box, seems like it's working, the -showcerts is showing both certificates now, thanks again! You're the best! Dave

1 0

Help with intermediate certificate
by David Yerger 25 Aug '08

25 Aug '08

Doing a transparent http-to-https proxy: I have client_ca_directory defined, with my CA's intermediate and root certs in there, but client devices without the intermediate cert can't connect, for example: $ openssl s_client -connect owa.<deleted>.com:443 -showcerts < /dev/null CONNECTED(00000003) depth=0 /O=owa.<deleted>.com/OU=Domain Control Validated/CN=owa.<deleted>.com verify error:num=20:unable to get local issuer certificate verify return:1 depth=0 /O=owa.<deleted>.com/OU=Domain Control Validated/CN=owa.<deleted>.com verify error:num=27:certificate not trusted verify return:1 depth=0 /O=owa.<deleted>.com/OU=Domain Control Validated/CN=owa.<deleted>.com verify error:num=21:unable to verify the first certificate verify return:1 --- Certificate chain 0 s:/O=owa.<deleted>.com/OU=Domain Control Validated/CN=owa.<deleted>.com i:/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.go daddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=079 69287 -----BEGIN CERTIFICATE----- MIIE8zCCA9ugAwIBAgIDRqHrMA0GCSqGSIb3DQEBBQUAMIHKMQswCQYDVQQGEwJV UzEQMA4GA1UECBMHQXJpem9uYTETMBEGA1UEBxMKU2NvdHRzZGFsZTEaMBgGA1UE ChMRR29EYWRkeS5jb20sIEluYy4xMzAxBgNVBAsTKmh0dHA6Ly9jZXJ0aWZpY2F0 <snip> 3PGHYxjmpBFZKtaSFoI4QyAWywn0CXefB/hOPkc0IP7fiRlsFZj/JrknfpKo6qps uy+Df1AdPf+OXBSqwWWlDdSbFrx9wZc1i0oafe837YNiixVtJ9Sr955It7RL0FpD +iv15z3HwJ+U0Fuundwp8n/P1j18rtM= -----END CERTIFICATE----- --- Server certificate subject=/O=owa.<deleted>.com/OU=Domain Control Validated/CN=owa.<deleted>.com issuer=/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates. godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=0 7969287 --- No client certificate CA names sent --- SSL handshake has read 1433 bytes and written 316 bytes --- New, TLSv1/SSLv3, Cipher is AES256-SHA Server public key is 1024 bit Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : AES256-SHA Session-ID: 4F0D7577C6C97C7D0E66C73C82896637E4866CFCF9CE371B0CD4DA34E4FD1777 $ Session-ID-ctx: Master-Key: 463D578F6593F1B7C634388F7A1FA90D3C832AEC9C68FF4598F921D9E6E84D2A E1EB996564D802FA159B46D10EF14785 Key-Arg : None Start Time: 1219420426 Timeout : 300 (sec) Verify return code: 21 (unable to verify the first certificate) --- DONE It appears that it's not picking up the intermediate cert, any way around this? Apache has a SSLCertificateChainFile directive, is something similar needed? Thanks in advance David Yerger

2 1