- zorp - lists.balabit.hu

Hi... Installing on OpenBSD 2.7
by Chris H 06 Jul '01

06 Jul '01

Hello: Im installing zorp on openbsd. Any requests (or hints;). other than the freebsd tips in a prior posting. http://lists.balabit.hu/pipermail/zorp/2001-May/000066.html Ill post info (dmesg, etc...) after. --CH

2 1

Re: Desperately needs your help(Listener Syntax Error)
by Balazs Scheidler 29 Jun '01

29 Jun '01

Hello, I'm Cc:-ing this message to the zorp mailing list as well. On Tue, Jun 26, 2001 at 02:38:42PM +0000, sameer multani wrote: > > I want to configure zorp to connect to my ftp server 192.168.91.14 in DMZ > from internet m/c 202.60.30.2 > > My firewall internet interface is 202.60.30.1 > " " DMZ " " 192.168.91.23 > > When i use DirectedChainer it gives me error at Listener(..) function. > While if i replace it with TransparentChainer it gives no error. > Zorp Ftp Proxy starts and asks for the authentication and after entering the > username and password in logs it says > > dropped line USER sameer and stops Ftp Proxy. > > My Linux box has no ftp server running. > > Can you tell me where am i going wrong? I cleaned up your policy.py file (removed comments remaining from the sample policy. I marked my changes. # # sample firewall policy with transparent access to FTP, HTTP and CVS # protocols. # For FTP and HTTP we use application level gateways, for CVS we use a plug. # (as long as CVS protocol proxy is not available) # # firewall internal network: 192.168.91.0/24 # firewall internal interface: 192.168.1.23 # firewall external interface: 202.60.30.1 from Zorp.Zorp import * from Zorp import Zorp from Zorp.Zone import InetZone from Zorp.Service import Service from Zorp.SockAddr import SockAddrInet from Zorp.Chainer import TransparentChainer, DirectedChainer, InbandChainer, FailoverChainer from Zorp.Plug import PlugProxy from Zorp import Http from Zorp.Http import HttpProxy from Zorp.Ftp import FtpProxyAllow, FtpProxyMinimal, FtpProxy from Zorp.Listener import Listener Zorp.firewall_name = 'sameer@firewall' InetZone("dmz", "192.168.91.0/24", inbound_services=["itod_ftp"], outbound_services=["dtoi_ftp"]), InetZone("internet", "0.0.0.0/0", inbound_services=["*"], outbound_services=["*"]) class dtoi_ftp(FtpProxyAllow): def config(self): FtpProxyAllow.config(self) #self.transparent_mode = TRUE # the following two lines are not needed # for zorp later than 0.8.x, # ip addresses are automatically determined #self.fw_server_data.ip_s = "202.60.30.1" #self.fw_client_data.ip_s = "192.168.91.23" class itod_ftp(FtpProxyAllow): def config(self): FtpProxyAllow.config(self) #self.transparent_mode = FALSE # I commented these out, just like the previous ones #self.fw_server_data.ip_s = "192.168.91.23" #self.fw_client_data.ip_s = "202.60.30.1" # although def init() can still be used, the recommended way is # to use def _instance_name(), so I changed the definition below # zorp is the default instance name. def zorp(): # create services # this assignment is not needed, again a change between # 0.6.x and 0.8.x, services are simply identified by their # name. # dtoiftp = \ Service("dtoiftp", TransparentChainer(), dtoi_ftp) #itodftp = \ Service("itodftp", DirectedChainer(SockAddrInet("192.168.91.14", 21), itod_ftp) # Service("itodftp",TransparentChainer(), itod_ftp) Listener(SockAddrInet("202.60.30.1", 21), "itodftp") Listener(SockAddrInet("192.168.91.23", 21), "dtoiftp") --- end of policy --- This policy file should work now. If you have a problem (an error message for example), please send me the traceback (it is sent to the syslog) Zorp can work both in transparent and in non-transparent mode. Your proxies are configured in transparent_mode (the default setting), and you are listening on port 21. If you want transparent mode (when you simply connect to the ftp server from the client, without first having to connect to the proxy), you should listen on a port other than 21, and redirect traffic going through your firewall to your local listener using ipchains. For example: we listen on port 50021: Listener(SockAddrInet("192.168.91.23", 50021), "dtoiftp") and we use this ipchains rule to redirect traffic: ipchains -A input -i <DMZ interface> -p tcp -s 192.168.91.0/24 ! -d 192.168.91.23 21 -j REDIRECT 50021 (similarly in the other direction) For this to work, you'll have to enable IP forwarding in your kernel (and place a default DENY in your FORWARD chain). Other suggested IP stack settings: rp_filter off (substitute with appropriate ipchains rules) ip_dynaddr off ip_forward on tcp_keepalive_* set to a short timeout, and small number of probes You might need to increase the number of file descriptors, and number of processes in your kernel, otherwise you might run out of them quite quickly. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Python Extension Class - Zorp Requirement
by Richards, Steven (ISS Chicago) 28 Jun '01

28 Jun '01

I've been trying to find the download Python Extclass 1.2. Where can I find this? Also, I'm trying to install Zorp on FreeBSD 4.3-RELEASE. Is there any issues I should be aware of? I planning on installing zorp-0.9.1. ---Steve

2 1

Adatatvitel- es halozattechnika
by HUMANsoft AHT Kft. 29 May '01

29 May '01

Ezt a levelet a szamitogepes rendszerek es alkalmazasok kodtablai kozott fennallo kulonbsegek miatt magyar ekezetes betuk nelkul kapta meg. Levelunk tartalma egy rovid cegismerteto. Teremeszetesen szabadon donthet, hogy elolvassa-e vagy nem. Ha minden megjegyzes nelkul visszakuldi, cime automatikusan torlodik cimlistankbol. Bizonyara On is elegedetten tapasztalja, hogy az utobbi evekben milyen sokat fejlodott a hazai tavkozlestechnika. Ennek termeszetesen csak egy reszet kepezik a megjavult telefonalasi lehetosegek. A vallalatok es egyeni elofizetok szamara hasonloan fontosak lehetnek a szamitogepes adatatviteli es halozati megoldasok. Az elektronikus levelezes es az internet hasznalata ma mar altalanosnak mondhato, de tovabbi ujszeru alkalmazasokat kinal az ISDN, az ADSL stb. szolgaltatas megjelenese is. Cegunk sokeves szakmai tapasztalat birtokaban dolgozik ezen a teruleten. Engedje meg, hogy roviden bemutassam termekeinket es szolgaltatasainkat: Neves keszulekgyartok hazai kepviselete, termekeik forgalmazasa: ZyXEL professzionalis modemek, ISDN terminal adapterek, routerek ZyDATA kapcsolt vonali modemek, ISDN kartyak, terminal adapterek GESKO ISDN telefonkozpontok Comtrol nagysebessegu intelligens multiportok, InterChange VS RAS eszkozok TITAN gyors soros portok, 422/485 ipari kartyak, RAID kartyak ZERO ONE print szerverek viaLAN vezetekes es szort spektrumu radios h l>zati term,kek Nagynyeresegu adatatviteli antennak Szolgaltatasaink, rendszereink: Egyeni es csoportos internet hozzaferesek, levelezo rendszerek Teljes irodai kommunikacios rendszerek (telefon, LAN, internet, remote access stb.) Kiterjedt szamitogepes (WAN) halozatok tervezese, kivitelezese Vezetekes es vezetek nelkuli adatatviteli rendszerek Kedvezmenyes ISDN, ADSL, berelt vonal tovabba internet elofizetesi lehetosegek Cegunknel a szaktanacs es konzultacio ingyenes! Kerdeseire akkor kapja meg a leggyorsabban a valaszt, ha az AHT forrodrotot hivja: 414-4048 HUMANsoft Adatatvitel- es Halozattechnikai Kft. 1155 Budapest, Toth Istvan u. 105. Tel.: 414-4040 Fax: 414-4049 E-Mail: vialan(a)humansoft.hu JART MA MAR A HONLAPUNKON? <www.humansoftaht.hu>

1 0

ANN: Zorp 0.9.1 released
by Balazs Scheidler 14 May '01

14 May '01

Hi, We are happy to announce that we have released Zorp 0.9.1, the first member of our development tree. As this release contains new features and has only been tested internally, we consider it BETA quality code. This is the first Zorp version which compiled and worked on non-Linux platforms. I tested it on FreeBSD 4.3 and successfully send through a transparent HTTP request. There are two big changes in this release: * Connection tracking for UDP based protocols UDP based protocols has always been a nightmare for Proxy based firewalls. With this component in-place, Zorp will be able to provide application level gateways for UDP based protocols like Radius, TFTP and SNMP. Zorp tracks sessions using timeouts, _AND_ protocol information. * Authentication framework Requiring authentication when crossing a firewall is often required in company security policies. For now, we released parts of our framework which provide inband authentication. Inband authentication implements authentication strictly in the protocol itself (like HTTP proxy authentication, or authenticating twice in FTP) Since most protocols do not support the notion of authentication when crossing a security perimeter, other authentication methods are required. Outband authentication uses an independent channel between the client and the firewall, and this independent channel is used to perform authentication. This method is transparent to the underlying application, and enables strong authentication systems like RB1 CryptoCard or RSA SecurID. Our outband authentication system is not yet published and will be part of our commercial solution. Here's the NEWS entry. zorp 0.9.1 Mon, 14 May 2001 11:17:28 +0200 The first release in the 0.9.x branch is released containing our three months' worth work. Most notable changes, news are summarized below: * Connection tracking for UDP based protocols, an example can be found in Plug which is now able to proxy UDP packet streams in both directions. * Authentication framework, inband authentication support in Http authenticating against TIS fwtk compatible authserv. * General cleanup, fixes, small additions to proxies. This release is available at the usual places http://www.balabit.hu/en/products/Zorp/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Zorp vs. FreeBSD 1:0
by Balazs Scheidler 11 May '01

11 May '01

Hi, I've successfully compiled and ran Zorp on the top of FreeBSD 4.3-RELEASE, with ipf 3.4.16 (stock in FreeBSD 4.3) There are some small issues left, but I thought I would release a 0.9 snapshot real soon now. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Zorp vs. FreeBSD 4.3 (x86)
by Foldi Tamas 10 May '01

10 May '01

Hello, Someone has experience Zorp install under FreeBSD? I try to compile, but the "MSG_PROXY" is not defined in my enviroment. If you can help me (source patch, install instruction, etc.), please drop me a mail. (If not necessary, I wouldn't port the main source.) Best Regards, Tamas FOLDI . . _ __ ______________________________________________________ __ _ . . Foldi Tamas - We Are The Hashmark In The Rootshell - Security Consultant crow(a)kapu.hu - PGP: finger://crow@thot.banki.hu - (+3630) 221-7477

3 3

zorp 0.8.3 released
by Balazs Scheidler 18 Apr '01

18 Apr '01

Hi, We released zorp 0.8.3 incorporating the following changes: zorp 0.8.3 Tue, 17 Apr 2001 17:09:36 +0200 This release contains the following fixes: * FTP: fixed a problem which caused a SIGSEGV after large number of file transfers. * Core: readded umbrella zone support, zorpctl takes care about stale pidfiles, experimental support for Linux 2.4 netfilter (the UDP plug doesn't work) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Pingu Black config style
by Magosanyi Arpad 12 Apr '01

12 Apr '01

Hi! Azoknak, akiknek túl bonyolult a Zorp konfigja. [A magyar verzióért lapozz lejjebb] For those who feel that the configuration of Zorp is too complex. Here is the Pingu Black config style for Zorp(0.8.2). If you unpack the .tar.gz into /etz/zorp, you will find the following important things: pingublack: This should be given in instances.conf for on-the fly policy parsing. config: An example config. local/pingublack.py: This is the main stuff. If you want to generate a policy offline, you should issue something like this: /etc/zorp/local/pingublack.py policy /etc/zorp/config >/etc/zorp/genconfig local/pb: These are shadow definitions for the Zorp classes, only used in offline operation. The config file talks for itself, there are the following attributes: For services: 'bindaddress', 'userport', 'listenport', 'fromzone', 'tozone', 'proxy', 'local_ip_to_show', 'local_port_to_show', 'forge_addr', 'remote_ip', 'remote_port' for zones: 'ip', 'adminparent', 'umbrella' If(!) I will have the mood, it will generate ipchains rules as well, but the interfaces should be generated for that, and (which is harder) I will need the logic for searching the umbrella for a zone. ---Magyar változat----Hungarian version---------------- Hi! Itt a Zorphoz (0.8.2) a Pingu Black config style. A kopasz gizellát kicsomizva a /etc/zorp könyvtárba, a következő lényegeket kapod: pigublack: Ezt kell megadni az instances.conf-ban, ha on-the fly szeretnéd a policyt nyomni. config: Egy példa konfig local/pingublack.py: Ez a nagy lényeg. Ha off-line akarsz policyt generálni, a következőhöz hasonlót kell bírni: /etc/zorp/local/pingublack.py policy /etc/zorp/config >/etc/zorp/genconfig local/pb: Ezek shadow definíciók a Zorp classokra, csak az offline működéshez kellenek. A config file önmagáért beszél, a következő attribútumok vannak: Service-nél: 'bindaddress', 'userport', 'listenport', 'fromzone', 'tozone', 'proxy', 'local_ip_to_show', 'local_port_to_show', 'forge_addr', 'remote_ip', 'remote_port' Zone-nál: 'ip', 'adminparent', 'umbrella' Ha(!) majd lesz kedvem, megcsinálom azt is hogy ipchains-et generáljon, de ahhoz az interface-eket is definiálni kell, és (ami nehezebb) kell arra logika hogy egy zónához megtalálja az umbrella-t. -- GNU GPL: csak tiszta forrásból

1 0

Re: [zorp] Help on installation of zorp 0.8.1
by arneschram＠vandijkconsulting.nl 27 Mar '01

27 Mar '01

On Tue, Mar 27, 2001 at 12:15:49PM +0200, arneschram(a)vandijkconsulting.nl wrote: > > > I'am istalling zorp on RedHat Linux 7.0. > > > I've added Glib 1.3.1 and Python Extclass 1.2 to my system > > When running make ends with: > > make[3]: *** [pyproxy.lo] Error 1 > make[3]: Leaving directory `/install/zorp-0.8.1/lib' > make[2]: *** [all-recursive] Error 1 > make[2]: Leaving directory `/install/zorp-0.8.1/lib' > make[1]: *** [all-recursive] Error 1 > make[1]: Leaving directory `/install/zorp-0.8.1' > make: *** [all-recursive-am] Error 2 you seem to have a broken development environment. could you send me the end of your _compiler_ output? the lines just before the make errors above. -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1 _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/zorp

1 0