ipcop-devel Mailing List for IPCop Firewall

>> Since 1.4.7 the bootparameter 'single' is not working. One user in
>> german IPCop forum forgot the root PW and wanted to boot in
>> single-user mode but this is not working.
>>
>> I can reproduce this,
>> - installed 1.4.6, boot with 'single' param and got into single mode
>> - update to 1.4.7, boot with 'single' param and got NOT into single
>>   mode
>> - after update to 1.4.8 same as with 1.4.7
>>
>> Have looked in grub.conf but it looks the same.
>>
>> Any ideas what is going wrong?
>>
> May be something related to sysvinit-2.86 upgrade as init was updated in
> 1.4.7?

> Gilles

Ok i replaced the 1.4.8 'init' with the 1.4.6 'init'.
The 'single' param is working again.

Is this a bug which should be fixed in 1.4.9 or is this a security
hole(?) which is closed now?
There where some discussing on german forum how this should be
classified. 

Achim

Hi,

in CVS I found a pppd patch which obviously solves a packet loss problem
when doing dial on demand together with dynamic IP assignment.

Who wrote this patch? I'd like to discuss why (or where) the 
re-translation
for the incoming packets is done and if not whether this patch also works
with masquerading.

I was working on a similar patch when I noticed that a patch was already
available.

Thanks a lot.

Markus

I get an error building the cdrom, where tar can't find some files, e.g.:

tar: etc/dev.d : cannot stat : No such file or archive
...
tar: etc/dev.d/default : cannot stat : No such file or archive
tar: etc/hotplug...

Anybody else see this, or is it just me? Where should I look to fix this?

Thanks for any help.

Eric

Feature Requests item #1277287, was opened at 2005-08-31 10:59
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1277287&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Priority: 5
Submitted By: AndyLawn (andylawn)
Assigned to: Nobody/Anonymous (nobody)
Summary: Redetect green NIC driver in setup

Initial Comment:
It would be nice to be able to re-detect and change the 
green NIC driver from the setup program after 
installation.  Particularly so for compact flash 
installations - if the staging machine has different NICs 
to the target machine, then the CF image ends up with 
the wrong NIC drivers set up on it.  You then have to 
manually edit /var/ipcop/ethernet/settings to specify the 
correct green NIC driver.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1277287&group_id=40604

Le Mardi 30 Ao=FBt 2005 02:41, Andre Yanoviak a =E9crit :
> Hi,
>
> Just installed a fresh ISO from 1.4.8, using my floppy backup from 1.4.6.
>
> Next, I WinSCP'd over the AddOns 2.3 server, chkrootkit, and rkhunter.
>
> Installed AddOns server, then chkrootkit.
>
> Ran chkrootkit & got a new message I'd not noticed before:
>
> ...
> Searching for suspicious files and dirs, it may take a while...
> /usr/lib/perl5/site_perl/5.8.5/i386-linux/auto/Net/SSLeay/.packlist
> ...
>
> I'm assuming this is not a threat, but would appreciate confirmation.

I have put this file in #comment in the file building iso (ROOTFILES)
It should not be on your machine. Delete it.=20
If it is recreated, then, something is using 'https' on your machine.=20
Currently only one or two dyndns providers use it.

=46ranck

----- Original Message ----- 
From: "Achim Weber" <dot...@gm...>
To: "IPCop devel" <ipc...@li...>
Sent: Tuesday, August 30, 2005 7:49 PM
Subject: [IPCop-devel] 'single' bootparameter not working in 1.4.7/.8


> Since 1.4.7 the bootparameter 'single' is not working. One user in
> german IPCop forum forgot the root PW and wanted to boot in
> single-user mode but this is not working.
>
> I can reproduce this,
> - installed 1.4.6, boot with 'single' param and got into single mode
> - update to 1.4.7, boot with 'single' param and got NOT into single
>   mode
> - after update to 1.4.8 same as with 1.4.7
>
> Have looked in grub.conf but it looks the same.
>
> Any ideas what is going wrong?
>
May be something related to sysvinit-2.86 upgrade as init was updated in
1.4.7?

Gilles

Since 1.4.7 the bootparameter 'single' is not working. One user in
german IPCop forum forgot the root PW and wanted to boot in
single-user mode but this is not working.

I can reproduce this,
- installed 1.4.6, boot with 'single' param and got into single mode
- update to 1.4.7, boot with 'single' param and got NOT into single
  mode
- after update to 1.4.8 same as with 1.4.7

Have looked in grub.conf but it looks the same.

Any ideas what is going wrong?

Achim

Bugs item #1276844, was opened at 2005-08-30 18:27
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1276844&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Installation
Group: 1.4.8
Status: Open
Resolution: None
Priority: 5
Submitted By: Crimblepud (crimblepud)
Assigned to: Nobody/Anonymous (nobody)
Summary: root.orig File Contains Duplicate Entry

Initial Comment:
After upgrading my IPCop 1.4.6 to 1.4.8, I noticed 
that /var/spool/cron/root.orig file was overwriten, with a 
duplicate entry:

	"3 2 1 * *	[ -f "/var/ipcop/red/active" ] 
&& /usr/local/bin/setddns.pl -f -m"

I have included a section cut from my copy of this file 
below:

	# Force update the dynamic dns registration 
once a week
	# Force update even if IP has not changed 
once a month if 'minimize update' selected in GUI
	# to avoid account declared as dead
	*/5 * * * *	[ -f "/var/ipcop/red/active" ] 
&& /usr/local/bin/setddns.pl
	9 2 * * 0	[ -f "/var/ipcop/red/active" ] 
&& /usr/local/bin/setddns.pl -f
	3 2 1 * *	[ -f "/var/ipcop/red/active" ] 
&& /usr/local/bin/setddns.pl -f -m
	
	# Logwatch
	01 0 * * *	/usr/local/bin/logwatch 
> /var/log/logwatch/`date -I -d yesterday`; 		
	LOGWATCH_KEEP=$(sed -
ne 's/^LOGWATCH_KEEP=\([0-9]\+\)$/
\1/p' /var/ipcop/logging/settings); 			find /var/log/logwatch/ -
ctime +${LOGWATCH_KEEP=56} -exec rm -f '{}' ';'
	
	# ipcop update 1.4.7 addition to not original 
crontab
	# force update (even if name match IP) once 
a month if minimize option selected
	3 2 1 * *     [ -f "/var/ipcop/red/active" ] 
&& /usr/local/bin/setddns.pl -f -m


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1276844&group_id=40604

> Well this is not the final fix im sure but it will get transparent proxy 
>  working. Its a bit of a hack but it fixes the transparent squid problem
>  
>  edit the file called acl in the /var/ipcop/proxy directory
>  
>  add these lines
>  
>  acl all dst 0.0.0.0/0
>  acl localnet src x.x.x.x/24   --- where x.x.x.x is your local subnet ie: 
>  192.168.0.0/24
>  acl localhost src 127.0.0.1/32
>  
>  change
>  acl IPCop_ip dst GREEN_IP to
>  acl IPCop_ip dst y.y.y.y/32  -- where y.y.y.y is your green interface ip 
>  address
>  
>  if you have this line change it as well
>  acl IPCop_ip dst BLUE_IP to
>  acl IPCop_ip dst z.z.z.z/32  -- where z.z.z.z is your blue interface ip 
>  address
> 

Hello *,

If you have this kind a "acl" file in your machine, then this is a completly 
wrong one. Never replaced since an 1.4.rc2 installation (maybe 
backuped/restored).

The file is correct since 1.4.rc3

Just grab the correct one here:
http://cvs.sourceforge.net/viewcvs.py/*checkout*/ipcop/ipcop/config/cfgroot/proxy-acl?rev=1.2.2.3

To check: if you see
__GREEN_IP__   this is good file
GREEN_IP this is old file


Franck

This was my acl file in /var/ipcop/proxy

acl SSL_ports port 443 563
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 563 # https, snews
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl Safe_ports port 800 # Squids port (for icons)

acl IPCop_http  port 81
acl IPCop_https port 445
acl IPCop_ip dst GREEN_IP
acl IPCop_blue_ip dst BLUE_IP

acl CONNECT method CONNECT

http_access allow         localhost
http_access allow         IPCop_ip IPCop_blue_ip localnet IPCop_http
http_access allow CONNECT IPCop_ip IPCop_blue_ip localnet IPCop_https
http_access deny          !Safe_ports
http_access deny  CONNECT !SSL_ports
http_access allow         localnet
http_access deny          all

when I do a squid -k check I get

2005/08/30 18:46:01| aclParseIpData: Bad host/IP: 'GREEN_IP'
2005/08/30 18:46:01| aclParseAclLine: WARNING: empty ACL: acl IPCop_ip =
dst GREEN_IP
2005/08/30 18:46:01| aclParseIpData: Bad host/IP: 'BLUE_IP'
2005/08/30 18:46:01| aclParseAclLine: WARNING: empty ACL: acl =
IPCop_blue_ip dst BLUE_IP
2005/08/30 18:46:01| ACL name 'localhost' not defined!
FATAL: Bungled squid.conf line 40: http_access allow         localhost
Squid Cache (Version 2.5.STABLE10): Terminated abnormally.

Im 99% sure I started with a 1.4.2 ISO of ipcop as I did install 1.4.0 =
betas but im pretty sure I blew them away .. I could be 1% wrong :)

hope this helps

regards
-todd-


-----------------------------------------------
Message: 10
Date: Sun, 28 Aug 2005 13:06:11 +0100
From: Robert Kerr <Lit...@xs...>
To: ipc...@li...
Subject: RE: [IPCop-devel] After updating, I can't browse the web

In message <006501c5abab$745b6070$020...@to...>
          "Todd Hampson" <tha...@ne...> wrote:


> I have had a similar problem with the proxy, it doesnt seem to want to
> work. wont start. I was using the proxy transparent on green. I did an
> update not a reinstall

> The errors with

> squid -k check

> related to the definitions of the variables in squid.conf

> ie:

> GREEN_IP
> localnet
> localhost
> BLUE_IP

> id didnt liek them.

> I have tried putting definitions like

> acl GREEN_IP dst x.x.x.x

> but when i restart the box it goes back to the default squid.conf. I =
am
> updating the one in /etc/squid/squid.conf

> thats as far as i got last night

GREEN_IP and BLUE_IP should never appear in your squid.conf. There are =
some
similar named items __GREEN_IP__ and __BLUE_IP__ used internally but =
even
these are supposed to be substituted for actual IP addresses, so they =
should
never appear in squid.conf either. Can you show us the actual errors and =
the
relevant lines appearing in your squid.conf?

This seems somewhat similar to a previously filed bug, #1183433. We were
never actually able to find the cause of it and the submitter reported =
it
just fixed itself. It sounds to me like something might have messed with =
your
/var/ipcop/proxy/acl - are you using any addons at all?

--=20
 Robert Kerr

Bugs item #1276399, was opened at 2005-08-30 10:25
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1276399&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: General
Group: 1.4.6
Status: Open
Resolution: None
Priority: 5
Submitted By: Henrik (superboss)
Assigned to: Nobody/Anonymous (nobody)
Summary: DNS Update bugged?

Initial Comment:
I am getting reports from zoneedit.com that they are
getting excessive update hits from my ipcop box. I have
several domains and subdomains on my zoneedit.com and
it seems like they are all updated individually rather
than a bulk update which is causing zoneedit to
interpret it as excessive update. I reported this bug a
few days ago but my bug report was mysteriously
removed?? I verified that it was indeed submitted but
as of today it is nowhere to be found, very disturbing.

What in the DNS update routine is causing this problem
(excessive dns updates at zoneedit.com) and will it be
fixed?

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1276399&group_id=40604

Jan M. Dziewulski wrote:
> On Mon, 29 Aug 2005 21:09:29 +0100
> "Ricardo Meechan" <r.m...@wg...> wrote:
> 
> 
>>I agree that this is a usefull addon!
>>I have my dell 640 snoozing at night and sometimes leave it snoozin when
>>I goto work, I have a vpn to my home net and its ideal for me to wake up
>>my dell if I need to access the "my docs" onit! Well done!
>>
>>Security worries? Nah. 
> 
> 
> Brilliant! Then why not contact http://sourceforge.net/projects/firewalladdons
> to ask if it can be included as part of their tree? It doesn't have to be part
> of ipcop. It can just be an addon, as you specified.
> 
> --
> Jan

The first version from "WOL" for the addon-server is ready, in the next 
few days i will send the WOL-Addon to the projectleader of the 
firewalladdons.sourceforge.net

The WOL-Addon works fine, but in the moment the script can only be 
installed from the console. Feel free to have a 
look...http://www.fbug.de/ipcop/wol/wakeonlan_1.4.x_addon_1.0-b1.tar.gz

cheers,
pm





>>-----Original Message-----
>>From: ipc...@li...
>>[mailto:ipc...@li...] On Behalf Of Patrick M.
>>Sent: 29 August 2005 6:08 PM
>>To: ipc...@li...
>>Subject: Re: [IPCop-devel] WakeOnLan on IPCop 1.4.8]
>>
>>
>>>>>>>>Hi all,
>>>>>>>>
>>>>>>>>with recent release of IpCop 1.4.8 we found that you now 
>>>>>>>>include the 'xyz' package only for providing wakeonlan 
>>>>>>>>functionality, and that even only at commandline level. 
>>>>>>>>Therefore we want to contribute the mp-form.cgi script which 
>>>>>>>>does the whole wakeonlan stuff with only _one_ additional Perl 
>>>>>>>>script since Perl is capable  of sending magic packets just 
>>>>>>>>fine. Feel free to include this  handy script with future 
>>>>>>>>releases. The script is certainly only  at a hackish state yet 
>>>>>>>>since we are not the IpCop-Menu-Kings; but  others who have 
>>>>>>>>better knowledge of the IpCop special headers may  hopefully
>>
>>quickly beautify the script.... have a look at...
>>
>>>>>>>>screenshot:
>>>>>>>>http://www.fbug.de/ipcop/wol/IpCop_WakeOnLan.PNG
>>>>>>>>
>>>>>>>>download:
>>>>>>>>http://www.fbug.de/ipcop/wol/mp-from_ipcop-0.72-ipcop-1.4.8.tar
>>>>>>>>.gz
>>>>>>>>
>>>>>>>>cheers,
>>>>>>>>gk/pm.
>>>>>>>>
>>>>
>>>>>>Thank for your contribution.
>>>>>>But I don't understand for what usage it would be used.
>>>>>>
>>>>>>I add ethtool because it is capable to set a netcard on ipcop in a
>>
>>>>>>state where sending a magic packet to ipcop green card can wake up
>>
>>>>>>the whole machine in case you don't want to let ipcop machine run
>>>>>>24/24 (and will not use orange and dhcp on green).
>>>
>>>>ok, the previous post was probably a bit misleading regarding 
>>>>ethtool; it was more that we found other users already trying to 
>>>>wakeup their machines with that...
>>>>
>>>
>>>>>>Your proposition is the reverse : wake up a machine from ipcop.
>>>>>>I don't know for what you need this, related a firewall 
>>>>>>administration..
>>>
>>>>oh, ask this the users! I maintain some wakeonlan utilities which I 
>>>>have on my site: http://www.gknw.com/mpform.html and got tons of 
>>>>questions of how to wakeup a machine behind a firewall/router....We 
>>>>think you do many IpCop users a great favour with adding the simple 
>>>>script...
>>
>>
>>>..AFAICT, it could be useful for boxes in dmz (orange), if combined 
>>>with >_out_bound proxy (web, ftp, rsync etc) server, but would defeat 
>>>security if access is allowed to boxes to early, they will need to get
>>
>>>allsecurity measures started fully up, before allowing access.
>>>And such access elsewhere, (blue or green) would warrant either custom
>>
>>>WOL zones or relaxing your security policy to "below" standard Ipcop 
>>>no-pin-hole policy.
>>
>>
>>sorry, but I cant get your points; the script itself resides in the
>>cgi-bin which is secured by IpCop self; so the one who can only use this
>>script must be logged in, hence he can do everything - that includes
>>adding a port forward rule and do the same wakeup from outside; so what
>>'security policy' do you see compromised with this script???
>>
>>I think a small script which gets into main distribution will quickly be
>>fixed _if_ there are any security leaks; and that stops folks from
>>searching for other, probably more unsecure solutions.
>>
>>to explain for its good for: its usual for admins to remotely update
>>machines during off-work hours while the machines are normally not used,
>>and therefore switched off. Here the script comes in play which enables
>>the admin to easily wakeup the machines, take over control remotely, do
>>the update and then shutdown again. Furthermore since the script only
>>reads IpCop's own static dhcp list it has always the right entries and
>>saves the admin to have lists over lists with mac addresses to
>>wakeup....
>>
>>
>>best regards,
>>gk/pm.
>>
>>
>>--
>>No virus found in this outgoing message.
>>Checked by AVG Anti-Virus.
>>Version: 7.0.344 / Virus Database: 267.10.16/83 - Release Date:
>>26.08.2005
> 
> 
>> 
>>Ricardo Meechan 
>>IT Administrator 
>>Mobile: +44 (0) 7966 484 371 
>> 
>>Wilson & Garden LTD 
>>t: +44 (0) 1236 823291 
>>f: +44 (0) 1236 825683 
>> 
>> 
>>Company registered in Scotland  SC267457 
>> 
>>NOTE: All emails to and from Wilson & Garden are protected by Antivirus and spam filters.  
>>We use Trend Scanmail for AV and spamhaus.org & spamcop.net for spam filtering.  
>> 
>>This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from us may be monitored.  
>> 
>>Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Therefore, we do not accept responsibility for any errors or omissions that are present in this message, or any attachment, that have arisen as a result of e-mail transmission. If verification is required, please request a hard-copy version. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.  
> 
> 
> 


-- 
-------------------------------
[PM] EDV-Service

Tel: ..........	+49 2426 901167
Fax: ..........	+49 2426 902928
eMail: ........ pm...@fb...
Web: .......... www.fbug.de
-------------------------------


-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.10.17/84 - Release Date: 29.08.2005

Bugs item #1276303, was opened at 2005-08-29 20:57
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1276303&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: barnbarn (barnbarn)
Assigned to: Nobody/Anonymous (nobody)
Summary: 1.4.6 -> 1.4.8 upgrade trouble

Initial Comment:
I've been happily running IPCop since version 0.1.1 in
March of 2002, when I converted from Smoothwall.
The upgrade from 1.4.6 to 1.4.8 did not work for me.
After the upgrade, web access outbound to the outside
world was blocked, giving a "connection refused"
message for any attempted website.
Then I tried a fresh installation of IPCop using the
1.4.8 iso image instead of an upgrade. Same result.
(During the installation, I used the backup data from a
floppy made some while ago while running 1.4.2.) 
Then I reinstalled from 1.4.2, again restoring data
from the same floppy, and upgraded to 1.4.3, 1.4.4,
1.4.5, 1.4.6, 1.4.7, and 1.4.8 in order and retesting
after each. All worked OK except for 1.4.8, which still
had the same problem.
During the tests, I discovered that mail and ftp access
to the outside world still worked, but web access did not.
The only indications I saw that looked weird were the
IPCop boot messages about problems with ACLs, as
reported  for lines 44, 45, 54, 62, and 63 in the
squid.conf file.
Have since reverted to 1.4.6 to get working again. No
big loss, just a bunch of logs, statistics and pretty
graphs.
Thank you very much for all your work.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1276303&group_id=40604

On Mon, 29 Aug 2005 21:09:29 +0100
"Ricardo Meechan" <r.m...@wg...> wrote:

> I agree that this is a usefull addon!
> I have my dell 640 snoozing at night and sometimes leave it snoozin when
> I goto work, I have a vpn to my home net and its ideal for me to wake up
> my dell if I need to access the "my docs" onit! Well done!
> 
> Security worries? Nah. 

Brilliant! Then why not contact http://sourceforge.net/projects/firewalladdons
to ask if it can be included as part of their tree? It doesn't have to be part
of ipcop. It can just be an addon, as you specified.

--
Jan

> -----Original Message-----
> From: ipc...@li...
> [mailto:ipc...@li...] On Behalf Of Patrick M.
> Sent: 29 August 2005 6:08 PM
> To: ipc...@li...
> Subject: Re: [IPCop-devel] WakeOnLan on IPCop 1.4.8]
> 
> >>>> > > Hi all,
> >>>> > >
> >>>> > > with recent release of IpCop 1.4.8 we found that you now 
> >>>> > > include the 'xyz' package only for providing wakeonlan 
> >>>> > > functionality, and that even only at commandline level. 
> >>>> > > Therefore we want to contribute the mp-form.cgi script which 
> >>>> > > does the whole wakeonlan stuff with only _one_ additional Perl 
> >>>> > > script since Perl is capable  of sending magic packets just 
> >>>> > > fine. Feel free to include this  handy script with future 
> >>>> > > releases. The script is certainly only  at a hackish state yet 
> >>>> > > since we are not the IpCop-Menu-Kings; but  others who have 
> >>>> > > better knowledge of the IpCop special headers may  hopefully
> quickly beautify the script.... have a look at...
> >>>> > >
> >>>> > > screenshot:
> >>>> > > http://www.fbug.de/ipcop/wol/IpCop_WakeOnLan.PNG
> >>>> > >
> >>>> > > download:
> >>>> > > http://www.fbug.de/ipcop/wol/mp-from_ipcop-0.72-ipcop-1.4.8.tar
> >>>> > > .gz
> >>>> > >
> >>>> > > cheers,
> >>>> > > gk/pm.
> >>>> > >
> >>
> >>> >
> >>> > Thank for your contribution.
> >>> > But I don't understand for what usage it would be used.
> >>> >
> >>> > I add ethtool because it is capable to set a netcard on ipcop in a
> 
> >>> > state where sending a magic packet to ipcop green card can wake up
> 
> >>> > the whole machine in case you don't want to let ipcop machine run
> >>> > 24/24 (and will not use orange and dhcp on green).
> >
> >>
> >> ok, the previous post was probably a bit misleading regarding 
> >> ethtool; it was more that we found other users already trying to 
> >> wakeup their machines with that...
> >>
> >
> >>> > Your proposition is the reverse : wake up a machine from ipcop.
> >>> > I don't know for what you need this, related a firewall 
> >>> > administration..
> >
> >>
> >> oh, ask this the users! I maintain some wakeonlan utilities which I 
> >> have on my site: http://www.gknw.com/mpform.html and got tons of 
> >> questions of how to wakeup a machine behind a firewall/router....We 
> >> think you do many IpCop users a great favour with adding the simple 
> >> script...
> 
> 
> > ..AFAICT, it could be useful for boxes in dmz (orange), if combined 
> > with >_out_bound proxy (web, ftp, rsync etc) server, but would defeat 
> > security if access is allowed to boxes to early, they will need to get
> 
> > allsecurity measures started fully up, before allowing access.
> > And such access elsewhere, (blue or green) would warrant either custom
> 
> > WOL zones or relaxing your security policy to "below" standard Ipcop 
> > no-pin-hole policy.
> 
> 
> sorry, but I cant get your points; the script itself resides in the
> cgi-bin which is secured by IpCop self; so the one who can only use this
> script must be logged in, hence he can do everything - that includes
> adding a port forward rule and do the same wakeup from outside; so what
> 'security policy' do you see compromised with this script???
> 
> I think a small script which gets into main distribution will quickly be
> fixed _if_ there are any security leaks; and that stops folks from
> searching for other, probably more unsecure solutions.
> 
> to explain for its good for: its usual for admins to remotely update
> machines during off-work hours while the machines are normally not used,
> and therefore switched off. Here the script comes in play which enables
> the admin to easily wakeup the machines, take over control remotely, do
> the update and then shutdown again. Furthermore since the script only
> reads IpCop's own static dhcp list it has always the right entries and
> saves the admin to have lists over lists with mac addresses to
> wakeup....
> 
> 
> best regards,
> gk/pm.
> 
> 
> --
> No virus found in this outgoing message.
> Checked by AVG Anti-Virus.
> Version: 7.0.344 / Virus Database: 267.10.16/83 - Release Date:
> 26.08.2005

>  
> Ricardo Meechan 
> IT Administrator 
> Mobile: +44 (0) 7966 484 371 
>  
> Wilson & Garden LTD 
> t: +44 (0) 1236 823291 
> f: +44 (0) 1236 825683 
>  
>  
> Company registered in Scotland  SC267457 
>  
> NOTE: All emails to and from Wilson & Garden are protected by Antivirus and spam filters.  
> We use Trend Scanmail for AV and spamhaus.org & spamcop.net for spam filtering.  
>  
> This message (and any associated files) is intended only for the use of the individual or entity to which it is addressed and may contain information that is confidential, subject to copyright or constitutes a trade secret. If you are not the intended recipient you are hereby notified that any dissemination, copying or distribution of this message, or files associated with this message, is strictly prohibited. If you have received this message in error, please notify us immediately by replying to the message and deleting it from your computer. Messages sent to and from us may be monitored.  
>  
> Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses. Therefore, we do not accept responsibility for any errors or omissions that are present in this message, or any attachment, that have arisen as a result of e-mail transmission. If verification is required, please request a hard-copy version. Any views or opinions presented are solely those of the author and do not necessarily represent those of the company.  


-- 
Jan

Mathematics is the supreme nostalgia of our time.

Feature Requests item #1276231, was opened at 2005-08-29 22:27
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1276231&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: Interface Improvements (example)
Group: None
Status: Open
Priority: 5
Submitted By: John (jgreene27)
Assigned to: Nobody/Anonymous (nobody)
Summary: VLAN implementation

Initial Comment:
The current version 1.4.8, I am happy to say has VLAN 
capabilities, however when I tried to use the vfconfig 
command it is not recognised.

Do I need to install a kernal patch? If so in order not to 
break or do damage to the current install, which site is 
recommended for the download and procedure for 
install?.

Any help in getting VLAN running would be greatly 
appreciated.

...and thanks for implementing this capability.

Regards
John

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1276231&group_id=40604

Hi,

Just installed a fresh ISO from 1.4.8, using my floppy backup from 1.4.6.

Next, I WinSCP'd over the AddOns 2.3 server, chkrootkit, and rkhunter.

Installed AddOns server, then chkrootkit.

Ran chkrootkit & got a new message I'd not noticed before:

...
Searching for suspicious files and dirs, it may take a while...
/usr/lib/perl5/site_perl/5.8.5/i386-linux/auto/Net/SSLeay/.packlist
...

I'm assuming this is not a threat, but would appreciate confirmation.

I also got another message earlier (before the upgrade), but hadn't noticed 
it before:

...
Checking `z2' ... user root deleted or never logged from lastlog!
...

Bottom line: am I safe?

-- Andre

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

Bugs item #1276103, was opened at 2005-08-29 22:49
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1276103&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: General
Group: 1.4.8
Status: Open
Resolution: None
Priority: 5
Submitted By: Crimblepud (crimblepud)
Assigned to: Nobody/Anonymous (nobody)
Summary: "setreservedports" Does Not Update All Files

Initial Comment:
I have a shell script that changes the https access port, 
and it updates the following files:

	/etc/httpd/conf/httpd.conf
	/home/httpd/cgi-bin/portfw.cgi
	/var/ipcop/header.pl
	/var/ipcop/proxy/acl
	/var/ipcop/proxy/squid.conf
	/var/ipcop/xtaccess/config

I posted these details a while back on the mailing list 
(see: http://sourceforge.net/mailarchive/message.php?
msg_id=11669022).

I ran "/usr/local/bin/setreservedports 4445" to compare 
it's results against those of my script and noticed that 
one of the above files, "/var/ipcop/xtaccess/config" was 
not updated to reflect the change - a quick look at the 
source for setreservedports confirms this.

Can setreservedports be changed to update the 
file: "/var/ipcop/xtaccess/config"?

(P.S. I have attached my script for your persusal - I 
would offer a suggestion for the required change, but I 
am no expert with sed, so I think it better that some 
else should take a peek.)


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428516&aid=1276103&group_id=40604

I agree that this is a usefull addon!
I have my dell 640 snoozing at night and sometimes leave it snoozin when
I goto work, I have a vpn to my home net and its ideal for me to wake up
my dell if I need to access the "my docs" onit! Well done!

Security worries? Nah.=20

-----Original Message-----
From: ipc...@li...
[mailto:ipc...@li...] On Behalf Of Patrick M.
Sent: 29 August 2005 6:08 PM
To: ipc...@li...
Subject: Re: [IPCop-devel] WakeOnLan on IPCop 1.4.8]

>>>> > > Hi all,
>>>> > >
>>>> > > with recent release of IpCop 1.4.8 we found that you now=20
>>>> > > include the 'xyz' package only for providing wakeonlan=20
>>>> > > functionality, and that even only at commandline level.=20
>>>> > > Therefore we want to contribute the mp-form.cgi script which=20
>>>> > > does the whole wakeonlan stuff with only _one_ additional Perl=20
>>>> > > script since Perl is capable  of sending magic packets just=20
>>>> > > fine. Feel free to include this  handy script with future=20
>>>> > > releases. The script is certainly only  at a hackish state yet=20
>>>> > > since we are not the IpCop-Menu-Kings; but  others who have=20
>>>> > > better knowledge of the IpCop special headers may  hopefully
quickly beautify the script.... have a look at...
>>>> > >
>>>> > > screenshot:
>>>> > > http://www.fbug.de/ipcop/wol/IpCop_WakeOnLan.PNG
>>>> > >
>>>> > > download:
>>>> > > http://www.fbug.de/ipcop/wol/mp-from_ipcop-0.72-ipcop-1.4.8.tar
>>>> > > .gz
>>>> > >
>>>> > > cheers,
>>>> > > gk/pm.
>>>> > >
>>
>>> >
>>> > Thank for your contribution.
>>> > But I don't understand for what usage it would be used.
>>> >
>>> > I add ethtool because it is capable to set a netcard on ipcop in a

>>> > state where sending a magic packet to ipcop green card can wake up

>>> > the whole machine in case you don't want to let ipcop machine run
>>> > 24/24 (and will not use orange and dhcp on green).
>
>>
>> ok, the previous post was probably a bit misleading regarding=20
>> ethtool; it was more that we found other users already trying to=20
>> wakeup their machines with that...
>>
>
>>> > Your proposition is the reverse : wake up a machine from ipcop.
>>> > I don't know for what you need this, related a firewall=20
>>> > administration..
>
>>
>> oh, ask this the users! I maintain some wakeonlan utilities which I=20
>> have on my site: http://www.gknw.com/mpform.html and got tons of=20
>> questions of how to wakeup a machine behind a firewall/router....We=20
>> think you do many IpCop users a great favour with adding the simple=20
>> script...


> ..AFAICT, it could be useful for boxes in dmz (orange), if combined=20
> with >_out_bound proxy (web, ftp, rsync etc) server, but would defeat=20
> security if access is allowed to boxes to early, they will need to get

> allsecurity measures started fully up, before allowing access.
> And such access elsewhere, (blue or green) would warrant either custom

> WOL zones or relaxing your security policy to "below" standard Ipcop=20
> no-pin-hole policy.


sorry, but I cant get your points; the script itself resides in the
cgi-bin which is secured by IpCop self; so the one who can only use this
script must be logged in, hence he can do everything - that includes
adding a port forward rule and do the same wakeup from outside; so what
'security policy' do you see compromised with this script???

I think a small script which gets into main distribution will quickly be
fixed _if_ there are any security leaks; and that stops folks from
searching for other, probably more unsecure solutions.

to explain for its good for: its usual for admins to remotely update
machines during off-work hours while the machines are normally not used,
and therefore switched off. Here the script comes in play which enables
the admin to easily wakeup the machines, take over control remotely, do
the update and then shutdown again. Furthermore since the script only
reads IpCop's own static dhcp list it has always the right entries and
saves the admin to have lists over lists with mac addresses to
wakeup....


best regards,
gk/pm.


--
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.10.16/83 - Release Date:
26.08.2005



-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle
Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing &
QA
Security * Process Improvement & Measurement *
http://www.sqe.com/bsce5sf
_______________________________________________
IPCop-devel mailing list
IPC...@li...
https://lists.sourceforge.net/lists/listinfo/ipcop-devel=20
=20
=20
=20
Ricardo Meechan=20
IT Administrator=20
Mobile: +44 (0) 7966 484 371=20
=20
Wilson & Garden LTD=20
t: +44 (0) 1236 823291=20
f: +44 (0) 1236 825683=20
=20
=20
Company registered in Scotland  SC267457=20
=20
NOTE: All emails to and from Wilson & Garden are protected by Antivirus =
and spam filters. =20
We use Trend Scanmail for AV and spamhaus.org & spamcop.net for spam =
filtering. =20
=20
This message (and any associated files) is intended only for the use of =
the individual or entity to which it is addressed and may contain =
information that is confidential, subject to copyright or constitutes a =
trade secret. If you are not the intended recipient you are hereby =
notified that any dissemination, copying or distribution of this =
message, or files associated with this message, is strictly prohibited. =
If you have received this message in error, please notify us immediately =
by replying to the message and deleting it from your computer. Messages =
sent to and from us may be monitored. =20
=20
Internet communications cannot be guaranteed to be secure or error-free =
as information could be intercepted, corrupted, lost, destroyed, arrive =
late or incomplete, or contain viruses. Therefore, we do not accept =
responsibility for any errors or omissions that are present in this =
message, or any attachment, that have arisen as a result of e-mail =
transmission. If verification is required, please request a hard-copy =
version. Any views or opinions presented are solely those of the author =
and do not necessarily represent those of the company. =20
=20

=20

=20

>>>> > > Hi all,
>>>> > >
>>>> > > with recent release of IpCop 1.4.8 we found that you now include
>>>> > > the 'xyz' package only for providing wakeonlan functionality, and
>>>> > > that even only at commandline level. Therefore we want to
>>>> > > contribute the mp-form.cgi script which does the whole wakeonlan
>>>> > > stuff with only _one_ additional Perl script since Perl is capable
>>>> > >  of sending magic packets just fine. Feel free to include this
>>>> > >  handy script with future releases. The script is certainly only
>>>> > >  at a hackish state yet since we are not the IpCop-Menu-Kings; but
>>>> > >  others who have better knowledge of the IpCop special headers may
>>>> > >  hopefully quickly beautify the script.... have a look at...
>>>> > >
>>>> > > screenshot:
>>>> > > http://www.fbug.de/ipcop/wol/IpCop_WakeOnLan.PNG
>>>> > >
>>>> > > download:
>>>> > > http://www.fbug.de/ipcop/wol/mp-from_ipcop-0.72-ipcop-1.4.8.tar.gz
>>>> > >
>>>> > > cheers,
>>>> > > gk/pm.
>>>> > >
>>
>>> >
>>> > Thank for your contribution.
>>> > But I don't understand for what usage it would be used.
>>> >
>>> > I add ethtool because it is capable to set a netcard on ipcop in a
>>> > state where sending a magic packet to ipcop green card can wake up
>>> > the whole machine in case you don't want to let ipcop machine run
>>> > 24/24 (and will not use orange and dhcp on green).
>
>>
>> ok, the previous post was probably a bit misleading regarding ethtool;
>> it was more that we found other users already trying to wakeup their
>> machines with that...
>>
>
>>> > Your proposition is the reverse : wake up a machine from ipcop.
>>> > I don't know for what you need this, related a firewall
>>> > administration..
>
>>
>> oh, ask this the users! I maintain some wakeonlan utilities which I
>> have on my site: http://www.gknw.com/mpform.html and got tons of
>> questions of how to wakeup a machine behind a firewall/router....We
>> think you do many IpCop users a great favour with adding the simple
>> script...


> ..AFAICT, it could be useful for boxes in dmz (orange), if combined
> with >_out_bound proxy (web, ftp, rsync etc) server, but would defeat
> security if access is allowed to boxes to early, they will need to get
> allsecurity measures started fully up, before allowing access.
> And such access elsewhere, (blue or green) would warrant either custom
> WOL zones or relaxing your security policy to "below" standard Ipcop
> no-pin-hole policy.


sorry, but I cant get your points; the script itself resides in the
cgi-bin which is secured by IpCop self; so the one who can only use this
script must be logged in, hence he can do everything - that includes
adding a port forward rule and do the same wakeup from outside; so what
'security policy' do you see compromised with this script???

I think a small script which gets into main distribution will quickly be
fixed _if_ there are any security leaks; and that stops folks from
searching for other, probably more unsecure solutions.

to explain for its good for: its usual for admins to remotely update
machines during off-work hours while the machines are normally not used,
and therefore switched off. Here the script comes in play which enables
the admin to easily wakeup the machines, take over control remotely, do
the update and then shutdown again. Furthermore since the script only
reads IpCop's own static dhcp list it has always the right entries and
saves the admin to have lists over lists with mac addresses to wakeup....


best regards,
gk/pm.


-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.10.16/83 - Release Date: 26.08.2005

Hi , I try compile with fedora core 4 & debian sid , the both display 
the same issue:
The md5sum is ok for binutils.
I compile with last cvs and any modification...

/root/ipcop/build/usr/src/binutils-2.15.94.0.2.2/binutils/bucomm.c:425: 
warning: the use of `mktemp' is dangerous, better use `mkstemp'
gcc -W -Wall -Wstrict-prototypes -Wmissing-prototypes -g -O2 -static -o 
cxxfilt cxxfilt.o bucomm.o version.o filemode.o  ../bfd/.libs/libbfd.a 
../libiberty/libiberty.a -ldl
bucomm.o(.text+0x400): In function `make_tempname':
/root/ipcop/build/usr/src/binutils-2.15.94.0.2.2/binutils/bucomm.c:425: 
warning: the use of `mktemp' is dangerous, better use `mkstemp'
gcc -W -Wall -Wstrict-prototypes -Wmissing-prototypes -g -O2 -static -o 
ar arparse.o arlex.o ar.o not-ranlib.o arsup.o rename.o binemul.o 
emul_vanilla.o bucomm.o version.o filemode.o  ../bfd/.libs/libbfd.a 
../libiberty/libiberty.a -lfl -ldl
bucomm.o(.text+0x400): In function `make_tempname':
/root/ipcop/build/usr/src/binutils-2.15.94.0.2.2/binutils/bucomm.c:425: 
warning: the use of `mktemp' is dangerous, better use `mkstemp'
make[4]: Leaving directory 
`/root/ipcop/build/usr/src/binutils-build/binutils'
make[3]: Leaving directory 
`/root/ipcop/build/usr/src/binutils-build/binutils'
make[2]: Leaving directory 
`/root/ipcop/build/usr/src/binutils-build/binutils'
make[1]: Leaving directory `/root/ipcop/build/usr/src/binutils-build'
make: *** [/root/ipcop/log/binutils-2.15.94.0.2.2-tools1] Error 2

What is the problem please

leso

On Sun, 28 Aug 2005 18:03:00 +0200, Patrick wrote in message 
<431...@fb...>:

> > > Hi all,
> > > 
> > > with recent release of IpCop 1.4.8 we found that you now include
> > > the 'xyz' package only for providing wakeonlan functionality, and
> > > that even only at commandline level. Therefore we want to
> > > contribute the mp-form.cgi script which does the whole wakeonlan
> > > stuff with only _one_ additional Perl script since Perl is capable
> > >  of sending magic packets just fine. Feel free to include this
> > >  handy script with future releases. The script is certainly only
> > >  at a hackish state yet since we are not the IpCop-Menu-Kings; but
> > >  others who have better knowledge of the IpCop special headers may
> > >  hopefully quickly beautify the script.... have a look at...
> > > 
> > > screenshot:
> > > http://www.fbug.de/ipcop/wol/IpCop_WakeOnLan.PNG
> > >
> > > download:
> > > http://www.fbug.de/ipcop/wol/mp-from_ipcop-0.72-ipcop-1.4.8.tar.gz
> > > 
> > > cheers,
> > > gk/pm.
> > >
> > 
> > Thank for your contribution.
> > But I don't understand for what usage it would be used.
> > 
> > I add ethtool because it is capable to set a netcard on ipcop in a
> > state where sending a magic packet to ipcop green card can wake up
> > the whole machine in case you don't want to let ipcop machine run
> > 24/24 (and will not use orange and dhcp on green).
> 
> ok, the previous post was probably a bit misleading regarding ethtool;
> it was more that we found other users already trying to wakeup their
> machines with that...
> 
> > Your proposition is the reverse : wake up a machine from ipcop.
> > I don't know for what you need this, related a firewall
> > administration..
> 
> oh, ask this the users! I maintain some wakeonlan utilities which I
> have on my site: http://www.gknw.com/mpform.html and got tons of
> questions of how to wakeup a machine behind a firewall/router....We
> think you do many IpCop users a great favour with adding the simple
> script...

..AFAICT, it could be useful for boxes in dmz (orange), if combined with
_out_bound proxy (web, ftp, rsync etc) server, but would defeat security
if access is allowed to boxes to early, they will need to get all
security measures started fully up, before allowing access.    
And such access elsewhere, (blue or green) would warrant either custom
WOL zones or relaxing your security policy to "below" standard Ipcop
no-pin-hole policy.  


-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;o)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

Feature Requests item #1275241, was opened at 2005-08-28 20:50
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1275241&group_id=40604

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: None
Group: None
Status: Open
Priority: 5
Submitted By: ceger (ceger)
Assigned to: Nobody/Anonymous (nobody)
Summary: include ipp2p or equiv.

Initial Comment:
Peer-to-peer can be filtred via source/destination
ports but in some p2p software users can change ports -
and rules are diffficult to maintain.
An iptable matching module like ipp2p and eventually
with its p2p filtering options in GUI would be very useful.

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=428519&aid=1275241&group_id=40604

Le Mercredi 24 Ao=FBt 2005 08:41, Achim Weber a =E9crit :
> >>>So I guess the most important thing here is to make the data layer awa=
re
> >>>of what it's doing ie readportfw() versus readfile(). Sounds like a job
> >>>for some object orientated perl modules.
> >
> > 100% objectc oriented yes.
> >
> > And Robert, it is easy for this data layer to use call-backs functions
> > to validate data.
>
> Jep that is what i had in mind, sorry for the confusion. Each config has
> its own two read/save functions.
>
> Attached is an example to show the idea. The read/save functions know whi=
ch
> data is read/written and validate it.
> There could be a simple "&validatePortFwRule($rule);" inside of
> &readPortfwConf(...).
>
> Achim
Achim,
I think this is not enougth generic. The call to read / write should be
independant of the caller.=20

readdata (filename, @data-table, $field-list, $sort-field,=20
call-back-validation-filter, any-options);

Must be usable by any ipcop code,=20
Must provide facility with call-backs like sorting, filtering,
etc,etc.=20

Is not something already written onto CPAN to manipulate this
kind of data ?!


=46ranck

Franck Bourdonnec wrote:
> Le Dimanche 28 Ao=FBt 2005 18:36, Patrick M. a =E9crit :
>=20
>>Zapphood wrote:
>>
>>This is the rigth filename:
>>http://www.fbug.de/ipcop/wol/mp-form_ipcop-0.72-ipcop-1.4.8.tar.gz
>>
>>
>>>cheers,
>>>gk/pm.
>>
>>cheers again,
>>gk/pm.
>=20
>=20
>=20
> Hello,
> I just read the readme txt in your zip. It is a bad idea to explain aga=
in
> how to modify en.pl.
> Just add the correct lang file in english, in deutsch, in any lang you =
know,
> Header.pl is a problem not solved yet.
>=20
> Small howto is here:
> http://www.ipcop-forum.de/forum/viewtopic.php?t=3D6906&highlight=3D
> Copy/past !
>=20
>=20
> Franck

Hello Franck,

many thanks for the helpful link. ;)

pm.


--=20
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.344 / Virus Database: 267.10.16/83 - Release Date: 26.08.200=
5

Le Dimanche 28 Ao=FBt 2005 18:36, Patrick M. a =E9crit :
> Zapphood wrote:
>
> This is the rigth filename:
> http://www.fbug.de/ipcop/wol/mp-form_ipcop-0.72-ipcop-1.4.8.tar.gz
>
> > cheers,
> > gk/pm.
>
> cheers again,
> gk/pm.


Hello,
I just read the readme txt in your zip. It is a bad idea to explain again
how to modify en.pl.
Just add the correct lang file in english, in deutsch, in any lang you know,
Header.pl is a problem not solved yet.

Small howto is here:
http://www.ipcop-forum.de/forum/viewtopic.php?t=3D6906&highlight=3D
Copy/past !


=46ranck