- wlug - list.wlug.org.nz

firewall hell
by Glenn Ramsey 08 Jul '04

08 Jul '04

I'm having some trouble with the ipmasq firewall setup on my Debian box. For those that aren't familiar with how it works, the iptables commands are specified in a number of .def/.rul files in /etc/ipmasq/rules. I think these get run by run-parts when /usr/sbin/ipmasq is run. Also ipmasq gets run whenever ppp goes up or down. The default ipmasq with ppp installation firewalls the internal (masqueraded) machines but does not protect the firewall machine itself. A while back this machine got rootkitted (over a dialup link!) and at that time I discovered that when the ipmasq docs talk about it providing a firewall, they don't mean the masq machine itself. I then modified one of the the ipmasq rule scripts using some info from the wlug wiki and it all worked. Recently I was looking at trying to make the audio work in Windows Messenger[1] and discovered that my firewall was no longer working and I couldn't see any dropped packets in the logs ( which led me to think that logging wasn't enabled). I must have upgraded something, don't know what, that caused the firewall to stop working. I discovered that there are some default scripts that provide what I want in the ipmasq examples and installed those. Now I'm firewalled but the firewall drops DNS forwards from my internal bind so things don't work so well. However if I do: $/etc/init.d/ipmasq stop $/etc/init.d/ipmasq start after dialing in then it works. What should I be looking for to diagnose the problem? As far I can tell, which admittedly is not very far, the configuration is fine and is essentially the default install with only changes made to the config definitions to specify which ports to block. Any advice appreciated. g [1] If anyone has done that, any advice would be appreciated on that too. -- Glenn Ramsey <glenn(a)componic.co.nz> 07 8627077 http://www.componic.co.nz

3 9

RE: [wlug] Any Hints or Advice?
by Lindsay Druett 07 Jul '04

07 Jul '04

I strongly agree with Gavin. Sounds like you have had a good start anyway. Not many people have come me saying "I have just installed (whatever) Linux on my machine and it feels great", a lot of people have said, "I tried to get Linux working on my machine, but I couldn't get it to work...", and a lot of those people were IT professionals - they have got sucked in too deep into the dark side. Yep, there is a steep learning curve ahead, but it's really worth it. Open Source Software has done a lot for me than any variant of MS Windows will ever do. I'm not anti-Microsoft - but the more you get into Linux, the more you realise why other people think Windows Sux, furthermore you are siding them with those views. > -----Original Message----- > From: Gavin Denby [mailto:redhat(a)ihug.co.nz] > Sent: Thursday, 8 July 2004 08:30 > To: Waikato Linux Users Group > Subject: Re: [wlug] Any Hints or Advice? > > > If you an get into Hamilton on a Monday night, (Sadly I cant > ) get along > to the lug meetings. > > At the beginning a lot goes over your head, just let it go, > meeting the > people and the tips you pick up by watching them will make your life > easier, you will learn a lot, and you will build good friendships and > strong networks. Linux is more community than OS IMHO ..... > And the OS > really rocks. > > Mandrake is good place to start in Linux, but most of the > local lug use > Fedora, Although there are a lot of die hard debian fans too. > I'm on a > slackware derivative nowadays, but we all learn from each > other and help > each other. > > Also Google is a very good search engine for linux users. > > > David7 wrote: > > >Hello > > > >I have just gone over, or come over, to Unix - Mandrake 10.0 > they call it. It > >feels great. > >Are there any hints or advice for a new guy? > > > >David C in Huntly, NZ, > > amateur Pascal progger, digest member. > > > >_______________________________________________ > >wlug mailing list | wlug(a)list.waikato.ac.nz > >Unsubscribe: http://list.waikato.ac.nz/mailman/listinfo/wlug > > > > > > > > > > _______________________________________________ > wlug mailing list | wlug(a)list.waikato.ac.nz > Unsubscribe: http://list.waikato.ac.nz/mailman/listinfo/wlug > >

1 0

[NZOSS-OpenChat] LUG / NZOSS support for DSE Hamilton PowerhouseComputer Weekend
by Craig Box 06 Jul '04

06 Jul '04

Mark Foster writes... > I appreciate this is late notice but we are concerned with the > commercial implications of broadcasting an event like this prior to it > occurring. Also, I understand that some members may take offence at > this message or our approach. If this is the case, then I do sincerely > apologise - please bear with us as we figure out the right way to do > this. > Hi Chris, Ross et al. I personally have no issues whatsoever with this being posted either on NZLUG or the NZOSS Openchat list. I'd also be quite happy to trek down to Hamilton and wave the flag, for one of the two days of that weekend. Also happy to help coordinate if any Aucklanders want to carpool, etc, and can bring my Laptop (a DSE Product funnily enough) running Knoppix-from-CD (its not HD installed, sadly). Likewise theres always my Windows XP Install running Mozilla Firefox as its default browser, Thunderbird for Email and other open source applications for media, etc etc... Ross based on the number of volunteers you get and which day or days they prefer to attend, let me know when suits. Thanks for the opportunity to give Linux and OSS a plug :-) Mark.

1 0

Dumping old stuff
by Daniel Lawson 04 Jul '04

04 Jul '04

As the topic says - I won't add glamour to this :) I've got a pile of old books and software that have sat on my shelves, unused, for a long time. For various reason I don't think they are suitable for donation to the WLUG library, nor do I think anyone will read them anyway. If anyone wants any of the list below, contact me offlist. Also, if anyone has any bright ideas regarding how I can get rid of this in a way that allows other people to make use of it if possible, please let me know. I hate dumping stuff - even though much of this has little value at all any more :). I've listed the books and delphi on trademe, but if you want them let me know. I doubt they'll move quick. It's all going to the dump if I don't get any other suggestions (I have no idea if second hand stores would even touch these...) Books: Sams MS SQL Server DBA Survival Guide Hitch-hikers guide to Visual Basic and SQL Access 97 Unleashed Informix Unleashed Using Sybase Access 2 Developer's Guide Office 97 Unleashed Mastering Delphi Software: Delphi 5 Professional PC Handyman Games: Asheron's Call Reach for the Skies (5.25") Cannon Fodder Command & Conquer - Red Alert (CD) Spelljammer - Pirates of Realmspace (5.25") Populous II and Powermonger Sowrd of Aragon (5.25" i think) Warlords II Diablo and Hellfire expansion pack. Hardware: USB Webcam, win98 only (will kill win2k/xp), some support in linux last i looked.

2 2

logging in ipmasq
by Glenn Ramsey 04 Jul '04

04 Jul '04

Hi, Anyone know how to turn on logging in ipmasq in Debian? The docs in /usr/share/doc/ipmasq do not mention it. g -- Glenn Ramsey <glenn(a)componic.co.nz> 07 8627077 http://www.componic.co.nz

1 0

IBM and the JVM
by s swami 03 Jul '04

03 Jul '04

Hi guys, here is text of what I'll put up somewhere. Thought I'd get some feedback here first. It's meant to piss IBM supporters off -- don't take it personally. I make some unsubstantiated claims but wtf everybody else is :-) Cheers, Sid --------------------------------------------------------------------- In an open letter to Sun, http://www-106.ibm.com/developerworks/library/j-openlet IBM offers to work with Sun on an open-source implementation of the Java Virtual Machine (JVM). Here is how the letter came about. o IBM had/have been bleating for a while that Sun should open-source the Sun JVM. o Some open source enthusiasts had/have been doing the same - i.e. bleating*. o Analysts and journalists just repeat what the different factions say. Some seem to conflate the language, the virtual machine and the runtime libraries. It was after an insistent journalist (enraptured by IBM's self-professed commitment to an "open-source Java") repeated the call (at a public event) that someone from Sun asked: why does IBM not open-source its own version of the JVM? i.e. why are the buggers haranguing Sun? IBM jumped at this with the open letter mentioned above. In short: they will gladly work with Sun on a common open-source implementation of a JVM if both Sun and IBM offered resources including source code (to their respective JVMs). Excuse me IBM, who asked you to open-source Sun's JVM? I'd like you to open-source /yours/ please. IBM have been veritably shouting their desire for an open source JVM but they are not willing to open source their own implementation. They will if Sun does the same (that's what it boils down to). This smacks of hypocrisy at least and hidden agendas. Why bring Sun into it? Why not BEA or Oracle or ... the open source community? The strength of the present arrangement is that the specs are there for all to see, vendors implement their own JVMs (and they have) and the consumer chooses one or more implementations based on what he requires and his estimation of the competing JVMs. This leads to a thriving industry with high quality JVMs. It gives me choice and I like that. Great. So what's the problem? Simple: IBM's JVM just can't compete with Sun's. Both of them are free for us to download and use. Try them yourself. Yep, IBM can't even give its JVM away. Whose JVM do you have running on your machine? Now Sun's JVM is a beautiful thing! And it is Sun's JVM that will take hardware customers from IBM to Sun. For the same money, Sun's JVM running on Solaris and Sun hardware will outperform the corresponding offering from IBM -- I reckon. And IBM knows it too. My conclusion: IBM are telling fibs, really obvious ones too. Hey whattup IBM? Cat got ya source? ------------------------------------------------------------------- * we have lots of sheep in New Zealand.

7 14

Re: [wlug] Cool things that were released today [OT]
by Matthew Browne (DSL HN) 02 Jul '04

02 Jul '04

At 13:03 2/07/2004, Oliver Jones wrote: >Yep. I completely agree. My stock answer to people who say they want a >computer to surf and do email with I say "buy a Mac". Problem is they >don't like the fact that a Mac is $1000 more expensive than a Windows >box. You can buy a brand new Windows box for $500? Where can I get one... http://store.apple.co.nz/public/product/group.php?pgid=AP13

1 0

Re: [wlug] IBM and the JVM
by s swami 01 Jul '04

01 Jul '04

On Thursday 01 July 2004 20:43, you wrote: > Sid > > Your arguments seem emotional, poorly founded, irrational > overreactions stemmed from unrealistic and idealistic goals, and > you would be best to drop the subject. What are the unrealistic and idealistic goals you refer to? How is it emotional, poorly founded and an overreaction. You would be best to do better :-) > If you really want to help, do some real research into what IBM is > doing give them real-world reasons to do what you ask, things that > managers will respond to. They have themselves given reasons for open-sourcing their JVM. I'm just asking them to do it. > This isn't a personal attack and I apoligise if this is the way I > come across. I really think you're overreacting here, try to > >approach the situation pragmatically. Hey no worries Dr Spooner. But unfortunately you've got yourself into an interesting situation. Please read carefully what you have written and you will see that all you have done is given us your opinion with "jack" to back them up. > Best Regards And to you my friend. Sid.

1 0

Samba (re Monday's meeting)
by Daniel Lawson 01 Jul '04

01 Jul '04

One thing I forgot to mention when Greig asked me to talk about Samba in general, is that I am completely and utterly sick of samba playing catchup. Samba will always chase behind Microsoft's implementation. If Samba ever fully catches up and can play the AD game perfectly, and has zero problems, MS only has to move to another structure. It's a futile game to play at. Current Samba implementations fall foul of many of the problems Greig talked about. It's almost the same, but it is subtly different in many ways, and this causes problems. There aren't really any decent unified configuration systems yet, so running an LDAP backed samba system which *works* is not a trivial task to set up. The entire domain model of samba is tedious to work with unless you're running MS gear. That said, it's the only option right now. There are ways around it which have been implemented on large university networks, however support is tedious. I'm looking at using a custom GINA (the login part of windows) which will auth via Kerberos or LDAP, and having an AFS based network (Andrew File System), a distributed file system). It's not all doom and gloom, I guess. I get fairly frustrated with the attitude that seems to dominate overall major linux development which says that we have to mimic Windows. GNOME and KDE have done this, Samba is perpetually doing this. If Linux actually *is* better than Windows, why do we have to mimic them? We could at least be mimicing Mac OS X. I'd like that. Daniel

5 13

Fw: Transparent Proxy install - RH linux 7.3(2.4.20-28.7) updated via RHN w/ IPtables enabled & Squid 2.5-Stable5 w/ Dansguardian-2.6.1 & AV plug-in.
by scott.pichelman＠weirslurry.com 30 Jun '04

30 Jun '04

Ok, since I haev to wait moderator approval for over 40KB , I did not attach my files and will have to later on... TIA! Scott Scott Pichelman Systems Administrator Weir Slurry TM North America 2701 S Stoughton Rd Madison WI 53716 USA T: +001 608 226 5615 F: +001 608 221 5807 M: +001 608 279 0368 E: scott.pichelman(a)weirslurry.com W: http://weirslurry.com ----- Forwarded by Scott Pichelman/US/WAR/Weir on 06/30/2004 09:55 AM ----- Scott Pichelman/US/WAR/Weir 06/30/2004 09:36 AM To wlug(a)list.waikato.ac.nz cc Subject Transparent Proxy install - RH linux 7.3(2.4.20-28.7) updated via RHN w/ IPtables enabled & Squid 2.5-Stable5 w/ Dansguardian-2.6.1 & AV plug-in. Hi all, Can anyone help me out with my dilemma? Here is a brief overview of my situation... Research: I have been trying to get the above mentioned to work for some time! I have read Doc from these sources: http://dansguardian.org/?page=documentation http://dansguardian.org/?page=dgflow http://www.nyetwork.org/wiki/DansGuardian And...other posts/threads and doc as well! Mission: We are a mid-sized organization trying to set-up a Proxy server to cache & filter requests from Windows users. We "would" like to set-up all the above in the email "subject" line on one machine. Can we use it as a gateway like transparent proxying suggests? Can I use a test machine w/ a "DHCP" address & will the FW(iptables) still work properly? In what order should I configure, whast type of logging could I use to troubleshoot? I know it has been done and I have little time now, sigh. So, I found your list while searching google noticed that WPAD might be a better way to go, is this true in some cases? We do not want to have to change "browser settings" on all of the client machines. I am unfamiliar with a transparent proxy versus other options but wonder if someone could help me out with doc? Finally, I may be missing something very easily, if so, please forgive my carelessness. Is there a simple procedure to follow so I install simply and than add complexity as I go? Tryed installing one app at a time starting w/ Squid then DG w/ plug-in, then IP tables but to no avail... I used the standard config files in many cases and will attach those files. The errors I receive are when setting my browser to "direct connection" are "ERROR Requested URL could not be retrieved" & "Access Denied". There have been times when Squid/DG & IPtables filtering seem to work, but would filter "all" sites most of the time. Most of the time when I enable the FW or IPtables it does not seem to work correctly. Meanwhile, I am trying a new distro - RH AS 2.1 server and will patch 2/ up2date. Please view my attached doc and conf files. root(a)Linux-Test dansguardian]# cat /etc/sysconfig/iptables # Generated by iptables-save v1.2.8 on Tue Jun 29 16:49:36 2004 *nat :PREROUTING ACCEPT [22:4542] :POSTROUTING ACCEPT [1:132] :OUTPUT ACCEPT [1:132] -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 COMMIT # Completed on Tue Jun 29 16:49:36 2004 # Generated by iptables-save v1.2.8 on Tue Jun 29 16:49:36 2004 *filter :INPUT ACCEPT [627:56813] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [293:29548] -A INPUT -s ! 127.0.0.1 -p tcp -m tcp --dport 3128 -j DROP COMMIT # Completed on Tue Jun 29 16:49:36 2004 Any help is greatly appreciated, if possible. Thanks. Scott Scott Pichelman Systems Administrator Weir Slurry TM North America 2701 S Stoughton Rd Madison WI 53716 USA T: +001 608 226 5615 F: +001 608 221 5807 M: +001 608 279 0368 E: scott.pichelman(a)weirslurry.com W: http://weirslurry.com The information contained in this email (including any attachments) is confidential, subject to copyright and for the use of the intended recipient only. If you are not the intended recipient please delete this message after notifying the sender. Unauthorised retention, alteration or distribution of this email is forbidden and may be actionable. Attachments are opened at your own risk and you are advised to scan incoming email for viruses before opening any attached files. We give no guarantee that any communication is virus-free and accept no responsibility for virus contamination or other system loss or damage of any kind.

2 2