ipcop-devel Mailing List for IPCop Firewall

On Sun, 2006-04-30 at 18:33 +0200, Gilles Espinasse wrote:
> ----- Original Message ----- 
> From: "Ivan Kabaivanov" <ch...@ya...>
> To: "Alan Hourihane" <al...@fa...>
> Cc: <ipc...@li...>
> Sent: Sunday, April 30, 2006 6:13 PM
> Subject: Re: [IPCop-devel] New Installer for 1.5
> 
> 
> > On Sunday 30 April 2006 05:50, Alan Hourihane wrote:
> > > On Sat, 2006-04-29 at 18:44 -0400, Ivan Kabaivanov wrote:
> > > > On Saturday 29 April 2006 15:41, Alan Hourihane wrote:
> > > > > On Sat, 2006-04-29 at 20:30 +0200, Achim Weber wrote:
> > > > > > Alan Hourihane wrote:
> > > > > > > On Sat, 2006-04-29 at 18:20 +0200, Achim Weber wrote:
> > > > > > >> When I select [OK] to choose automatic patitioning instead of
> > > > > > >> [fdisk] I get a grub splashscreen but the options are not
> working.
> > > > > > >> I get grub error: "Error 15: file not found"
> > > > > > >> What makes me a bit perplex is the grub-config line:
> > > > > > >>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> > > > > > >> Shouldn't be the LABEL a device name?
> > > > > > >
> > > > > > > Whoops. Sorry I missed this part of your email.
> > > > > > >
> > > > > > > So, onto this bit...
> > > > > > >
> > > > > > > There's something screwy with the grub.conf file. If you press
> 'e'
> > > > > > > to edit the boot label and delete the line that says
> 'savedefault'
> > > > > > > and hit 'b' to boot. It should be fine.
> > > > > > >
> > > > > > > I need to look at why it's not liking savedefault.
> > > > > > >
> > > > > > > Alan.
> > > > > >
> > > > > > Wow, that did the trick! Thanks Alan.
> > > > > >
> > > > > > Now I have to set root PW and setup the network, but not today...
> > > > >
> > > > > rootpw defaults to 'ipcop' now.
> > > > >
> > > > > Alan.
> > > >
> > > > Default root passwords are always a bad idea...
> > >
> > > Not really. All off the shelf boxes have default passwords, and you as
> > > the customer has to change it to ensure your own security.
> > >
> > > We can make the 1.5 installer offer to set a root password again in the
> > > future though.
> > >
> > > Alan.
> >
> > Yes, but we're not talking about off the shelf consumer products here,
> where
> > marketing trumps good reason ("So user-friendly, even your mom can use
> it!").
> > In the context of a firewall with an installer, you must ask the user to
> set
> > such an important piece of information as the root password.  Arguably the
> > admin password seems more important than the root password, but we should
> > make no assumptions and cut corners in the name of "ease of use."
> >
> > IvanK.
> >
> gentoo make an 'root' random password that you have to set during first step
> of the install
> 
> Just my two cents

No problem folks.

We'll add setting the admin & root password into the installer.

Alan.

On Sun, 30 Apr 2006 18:33:34 +0200, the rabid St. John's geese heard "Gilles Espinasse" <g....@fr...> say:

> 
> ----- Original Message ----- 
> From: "Ivan Kabaivanov" <ch...@ya...>
> To: "Alan Hourihane" <al...@fa...>
> Cc: <ipc...@li...>
> Sent: Sunday, April 30, 2006 6:13 PM
> Subject: Re: [IPCop-devel] New Installer for 1.5
> 
> 
> > On Sunday 30 April 2006 05:50, Alan Hourihane wrote:
> > > On Sat, 2006-04-29 at 18:44 -0400, Ivan Kabaivanov wrote:
> > > > On Saturday 29 April 2006 15:41, Alan Hourihane wrote:
> > > > > On Sat, 2006-04-29 at 20:30 +0200, Achim Weber wrote:
> > > > > > Alan Hourihane wrote:
> > > > > > > On Sat, 2006-04-29 at 18:20 +0200, Achim Weber wrote:
> > > > > > >> When I select [OK] to choose automatic patitioning instead of
> > > > > > >> [fdisk] I get a grub splashscreen but the options are not
> working.
> > > > > > >> I get grub error: "Error 15: file not found"
> > > > > > >> What makes me a bit perplex is the grub-config line:
> > > > > > >>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> > > > > > >> Shouldn't be the LABEL a device name?
> > > > > > >
> > > > > > > Whoops. Sorry I missed this part of your email.
> > > > > > >
> > > > > > > So, onto this bit...
> > > > > > >
> > > > > > > There's something screwy with the grub.conf file. If you press
> 'e'
> > > > > > > to edit the boot label and delete the line that says
> 'savedefault'
> > > > > > > and hit 'b' to boot. It should be fine.
> > > > > > >
> > > > > > > I need to look at why it's not liking savedefault.
> > > > > > >
> > > > > > > Alan.
> > > > > >
> > > > > > Wow, that did the trick! Thanks Alan.
> > > > > >
> > > > > > Now I have to set root PW and setup the network, but not today...
> > > > >
> > > > > rootpw defaults to 'ipcop' now.
> > > > >
> > > > > Alan.
> > > >
> > > > Default root passwords are always a bad idea...
> > >
> > > Not really. All off the shelf boxes have default passwords, and you as
> > > the customer has to change it to ensure your own security.
> > >
> > > We can make the 1.5 installer offer to set a root password again in the
> > > future though.
> > >
> > > Alan.
> >
> > Yes, but we're not talking about off the shelf consumer products here,
> where
> > marketing trumps good reason ("So user-friendly, even your mom can use
> it!").
> > In the context of a firewall with an installer, you must ask the user to
> set
> > such an important piece of information as the root password.  Arguably the
> > admin password seems more important than the root password, but we should
> > make no assumptions and cut corners in the name of "ease of use."
> >
> > IvanK.
> >
> gentoo make an 'root' random password that you have to set during first step
> of the install

It's an optional step (as described in the Gentoo Docs) and yes, when I re-installed it, I skipped that part and installed the user accounts towards the end of the install as one would for any rational Linux install. The problem with not having a default password is that people will tend leave post-it notes on their computer screens informing them what these are. I hardly ever need to use that password provided I know what the admin password is. Perhaps one should have two options at the beginning of the install with one "advanced" = let you set the password and "newbie" = don't even offer the password option but then inform them that if they screw their machine up (the ipcop one) they would have to reinstall from scratch - which doesn't even take them that much time.

Just a thought...

 -Jan

----- Original Message ----- 
From: "Ivan Kabaivanov" <ch...@ya...>
To: "Alan Hourihane" <al...@fa...>
Cc: <ipc...@li...>
Sent: Sunday, April 30, 2006 6:13 PM
Subject: Re: [IPCop-devel] New Installer for 1.5


> On Sunday 30 April 2006 05:50, Alan Hourihane wrote:
> > On Sat, 2006-04-29 at 18:44 -0400, Ivan Kabaivanov wrote:
> > > On Saturday 29 April 2006 15:41, Alan Hourihane wrote:
> > > > On Sat, 2006-04-29 at 20:30 +0200, Achim Weber wrote:
> > > > > Alan Hourihane wrote:
> > > > > > On Sat, 2006-04-29 at 18:20 +0200, Achim Weber wrote:
> > > > > >> When I select [OK] to choose automatic patitioning instead of
> > > > > >> [fdisk] I get a grub splashscreen but the options are not
working.
> > > > > >> I get grub error: "Error 15: file not found"
> > > > > >> What makes me a bit perplex is the grub-config line:
> > > > > >>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> > > > > >> Shouldn't be the LABEL a device name?
> > > > > >
> > > > > > Whoops. Sorry I missed this part of your email.
> > > > > >
> > > > > > So, onto this bit...
> > > > > >
> > > > > > There's something screwy with the grub.conf file. If you press
'e'
> > > > > > to edit the boot label and delete the line that says
'savedefault'
> > > > > > and hit 'b' to boot. It should be fine.
> > > > > >
> > > > > > I need to look at why it's not liking savedefault.
> > > > > >
> > > > > > Alan.
> > > > >
> > > > > Wow, that did the trick! Thanks Alan.
> > > > >
> > > > > Now I have to set root PW and setup the network, but not today...
> > > >
> > > > rootpw defaults to 'ipcop' now.
> > > >
> > > > Alan.
> > >
> > > Default root passwords are always a bad idea...
> >
> > Not really. All off the shelf boxes have default passwords, and you as
> > the customer has to change it to ensure your own security.
> >
> > We can make the 1.5 installer offer to set a root password again in the
> > future though.
> >
> > Alan.
>
> Yes, but we're not talking about off the shelf consumer products here,
where
> marketing trumps good reason ("So user-friendly, even your mom can use
it!").
> In the context of a firewall with an installer, you must ask the user to
set
> such an important piece of information as the root password.  Arguably the
> admin password seems more important than the root password, but we should
> make no assumptions and cut corners in the name of "ease of use."
>
> IvanK.
>
gentoo make an 'root' random password that you have to set during first step
of the install

Just my two cents

Gilles

On Sunday 30 April 2006 05:50, Alan Hourihane wrote:
> On Sat, 2006-04-29 at 18:44 -0400, Ivan Kabaivanov wrote:
> > On Saturday 29 April 2006 15:41, Alan Hourihane wrote:
> > > On Sat, 2006-04-29 at 20:30 +0200, Achim Weber wrote:
> > > > Alan Hourihane wrote:
> > > > > On Sat, 2006-04-29 at 18:20 +0200, Achim Weber wrote:
> > > > >> When I select [OK] to choose automatic patitioning instead of
> > > > >> [fdisk] I get a grub splashscreen but the options are not working.
> > > > >> I get grub error: "Error 15: file not found"
> > > > >> What makes me a bit perplex is the grub-config line:
> > > > >>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> > > > >> Shouldn't be the LABEL a device name?
> > > > >
> > > > > Whoops. Sorry I missed this part of your email.
> > > > >
> > > > > So, onto this bit...
> > > > >
> > > > > There's something screwy with the grub.conf file. If you press 'e'
> > > > > to edit the boot label and delete the line that says 'savedefault'
> > > > > and hit 'b' to boot. It should be fine.
> > > > >
> > > > > I need to look at why it's not liking savedefault.
> > > > >
> > > > > Alan.
> > > >
> > > > Wow, that did the trick! Thanks Alan.
> > > >
> > > > Now I have to set root PW and setup the network, but not today...
> > >
> > > rootpw defaults to 'ipcop' now.
> > >
> > > Alan.
> >
> > Default root passwords are always a bad idea...
>
> Not really. All off the shelf boxes have default passwords, and you as
> the customer has to change it to ensure your own security.
>
> We can make the 1.5 installer offer to set a root password again in the
> future though.
>
> Alan.

Yes, but we're not talking about off the shelf consumer products here, where 
marketing trumps good reason ("So user-friendly, even your mom can use it!").  
In the context of a firewall with an installer, you must ask the user to set 
such an important piece of information as the root password.  Arguably the 
admin password seems more important than the root password, but we should 
make no assumptions and cut corners in the name of "ease of use."

IvanK.

On Sat, 2006-04-29 at 18:44 -0400, Ivan Kabaivanov wrote:
> On Saturday 29 April 2006 15:41, Alan Hourihane wrote:
> > On Sat, 2006-04-29 at 20:30 +0200, Achim Weber wrote:
> > > Alan Hourihane wrote:
> > > > On Sat, 2006-04-29 at 18:20 +0200, Achim Weber wrote:
> > > >> When I select [OK] to choose automatic patitioning instead of [fdisk]
> > > >> I get a grub splashscreen but the options are not working.
> > > >> I get grub error: "Error 15: file not found"
> > > >> What makes me a bit perplex is the grub-config line:
> > > >>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> > > >> Shouldn't be the LABEL a device name?
> > > >
> > > > Whoops. Sorry I missed this part of your email.
> > > >
> > > > So, onto this bit...
> > > >
> > > > There's something screwy with the grub.conf file. If you press 'e' to
> > > > edit the boot label and delete the line that says 'savedefault' and hit
> > > > 'b' to boot. It should be fine.
> > > >
> > > > I need to look at why it's not liking savedefault.
> > > >
> > > > Alan.
> > >
> > > Wow, that did the trick! Thanks Alan.
> > >
> > > Now I have to set root PW and setup the network, but not today...
> >
> > rootpw defaults to 'ipcop' now.
> >
> > Alan.
> 
> Default root passwords are always a bad idea...

Not really. All off the shelf boxes have default passwords, and you as
the customer has to change it to ensure your own security.

We can make the 1.5 installer offer to set a root password again in the
future though. 

Alan.

On Saturday 29 April 2006 15:41, Alan Hourihane wrote:
> On Sat, 2006-04-29 at 20:30 +0200, Achim Weber wrote:
> > Alan Hourihane wrote:
> > > On Sat, 2006-04-29 at 18:20 +0200, Achim Weber wrote:
> > >> When I select [OK] to choose automatic patitioning instead of [fdisk]
> > >> I get a grub splashscreen but the options are not working.
> > >> I get grub error: "Error 15: file not found"
> > >> What makes me a bit perplex is the grub-config line:
> > >>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> > >> Shouldn't be the LABEL a device name?
> > >
> > > Whoops. Sorry I missed this part of your email.
> > >
> > > So, onto this bit...
> > >
> > > There's something screwy with the grub.conf file. If you press 'e' to
> > > edit the boot label and delete the line that says 'savedefault' and hit
> > > 'b' to boot. It should be fine.
> > >
> > > I need to look at why it's not liking savedefault.
> > >
> > > Alan.
> >
> > Wow, that did the trick! Thanks Alan.
> >
> > Now I have to set root PW and setup the network, but not today...
>
> rootpw defaults to 'ipcop' now.
>
> Alan.

Default root passwords are always a bad idea...

IvanK.

On Sat, 2006-04-29 at 20:30 +0200, Achim Weber wrote:
> Alan Hourihane wrote:
> 
> > On Sat, 2006-04-29 at 18:20 +0200, Achim Weber wrote:
> >>    
> >> When I select [OK] to choose automatic patitioning instead of [fdisk]
> >> I get a grub splashscreen but the options are not working.
> >> I get grub error: "Error 15: file not found"
> >> What makes me a bit perplex is the grub-config line:
> >>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> >> Shouldn't be the LABEL a device name?
> 
> > Whoops. Sorry I missed this part of your email.
> 
> > So, onto this bit...
> 
> > There's something screwy with the grub.conf file. If you press 'e' to
> > edit the boot label and delete the line that says 'savedefault' and hit
> > 'b' to boot. It should be fine.
> 
> > I need to look at why it's not liking savedefault.
> 
> > Alan.
> 
> Wow, that did the trick! Thanks Alan.
> 
> Now I have to set root PW and setup the network, but not today...

rootpw defaults to 'ipcop' now.

Alan.

Alan Hourihane wrote:

> On Sat, 2006-04-29 at 18:20 +0200, Achim Weber wrote:
>>    
>> When I select [OK] to choose automatic patitioning instead of [fdisk]
>> I get a grub splashscreen but the options are not working.
>> I get grub error: "Error 15: file not found"
>> What makes me a bit perplex is the grub-config line:
>>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
>> Shouldn't be the LABEL a device name?

> Whoops. Sorry I missed this part of your email.

> So, onto this bit...

> There's something screwy with the grub.conf file. If you press 'e' to
> edit the boot label and delete the line that says 'savedefault' and hit
> 'b' to boot. It should be fine.

> I need to look at why it's not liking savedefault.

> Alan.

Wow, that did the trick! Thanks Alan.

Now I have to set root PW and setup the network, but not today...

Achim

On Sat, 2006-04-29 at 18:20 +0200, Achim Weber wrote:
>    
> When I select [OK] to choose automatic patitioning instead of [fdisk]
> I get a grub splashscreen but the options are not working.
> I get grub error: "Error 15: file not found"
> What makes me a bit perplex is the grub-config line:
>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> Shouldn't be the LABEL a device name?

Whoops. Sorry I missed this part of your email.

So, onto this bit...

There's something screwy with the grub.conf file. If you press 'e' to
edit the boot label and delete the line that says 'savedefault' and hit
'b' to boot. It should be fine.

I need to look at why it's not liking savedefault.

Alan.

On Sat, 2006-04-29 at 12:34 -0400, Ivan Kabaivanov wrote:
> On Saturday 29 April 2006 12:20, Achim Weber wrote:
> > > One other thing for those braving the new installer....
> > >
> > > The installer doesn't yet do automatic partitioning like the old
> > > installer, so it relies on the user doing the fdisk during install.
> > >
> > > But the new installer allows the user to assign the mount points
> > > themselves (aka e2label) once the fdisk is complete. So, ensure you have
> > > your partitions setup correctly to boot after the install is complete.
> > >
> > > Alan.
> >
> > Hi Alan,
> >
> > can you please give some more hints to the partionioning and install
> > procedure.
> >
> > I have a fresh 1.5 ISO (compiled tonight), when i come to the
> > partionioning I switch to console 2 and remove old partions with
> > parted. back to installation screen I select [fdisk], partition
> > my 1GB disk:
> > hda1     *boot*     8 MB
> > hda2                300 MB
> > hda3                ~700 MB (the remaining)
> >
> > [write]: yes
> > [quit]
> >
> > Next is the prompt for partition labels, I enter:
> > hda1    /boot
> > hda2    /
> > hda3    /var/log
> >
> > Messages:
> > - "Creating Filesystem...."
> > - "Extracting IPCop...."
> > - one or two messages I can't read (they disapear to fast)
> 
> Alan, can we log all installer messages for debugging purposes?  That log can 
> then be saved to a floppy for review.  Or discarded.

Currently the installer messages are output to /dev/tty4, /dev/tty5
and /dev/tty6 for now. But we'll be able to redirect them later.

> > - "Creating initrd...."
> >
> > Not sure because it is to fast but I think at this point there is a
> > error message but it does disappear too fast.
> >
> > Next message is the start message "Select the language....".
> > Last command displayed on console 5 is:
> > "Running command: /bin/chroot /harddisk /bin/cp -f /boot/grub/grubbatch
> > /tmp"
> >
> > When I do:
> > 1) reboot, I get an empty grub prompt: "grub> _CURSOR_"
> > 2) select language, select CDROM etc., at [Fdisk] all partitions show
> >    up, too with the correct labels. When I proceed I get the "Press OK
> >    to reboot" prompt and after reboot the empty grub like in 1).
> >    On console 5 I have failed to mount cdrom.
> >
> >
> > When I select [OK] to choose automatic patitioning instead of [fdisk]
> > I get a grub splashscreen but the options are not working.
> > I get grub error: "Error 15: file not found"
> > What makes me a bit perplex is the grub-config line:
> >      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> > Shouldn't be the LABEL a device name?
> 
> 
> Achim,
> 
> the LABEL is ok.  You can label your ext2 or ext3 filesystems and use the 
> labels to refer to the actual physical devices.  The advantage is that you 
> don't have to remember or care about device names.  Just label them properly.

Right.

Alan.

On Sat, 2006-04-29 at 18:20 +0200, Achim Weber wrote:
> > One other thing for those braving the new installer....
> > 
> > The installer doesn't yet do automatic partitioning like the old
> > installer, so it relies on the user doing the fdisk during install.
> > 
> > But the new installer allows the user to assign the mount points
> > themselves (aka e2label) once the fdisk is complete. So, ensure you have
> > your partitions setup correctly to boot after the install is complete.
> > 
> > Alan.
> 
> Hi Alan,
> 
> can you please give some more hints to the partionioning and install
> procedure.
> 
> I have a fresh 1.5 ISO (compiled tonight), when i come to the
> partionioning I switch to console 2 and remove old partions with
> parted. back to installation screen I select [fdisk], partition
> my 1GB disk:
> hda1     *boot*     8 MB
> hda2                300 MB
> hda3                ~700 MB (the remaining)
> 
> [write]: yes
> [quit]
> 
> Next is the prompt for partition labels, I enter:
> hda1    /boot
> hda2    /
> hda3    /var/log
> 
> Messages:
> - "Creating Filesystem...."
> - "Extracting IPCop...."
> - one or two messages I can't read (they disapear to fast)
> - "Creating initrd...."
> 
> Not sure because it is to fast but I think at this point there is a
> error message but it does disappear too fast.
> 
> Next message is the start message "Select the language....".
> Last command displayed on console 5 is:
> "Running command: /bin/chroot /harddisk /bin/cp -f /boot/grub/grubbatch /tmp"
> 
> When I do:
> 1) reboot, I get an empty grub prompt: "grub> _CURSOR_"
> 2) select language, select CDROM etc., at [Fdisk] all partitions show
>    up, too with the correct labels. When I proceed I get the "Press OK
>    to reboot" prompt and after reboot the empty grub like in 1).
>    On console 5 I have failed to mount cdrom.
> 
>    
> When I select [OK] to choose automatic patitioning instead of [fdisk]
> I get a grub splashscreen but the options are not working.
> I get grub error: "Error 15: file not found"
> What makes me a bit perplex is the grub-config line:
>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> Shouldn't be the LABEL a device name?
> 
> Can't remember all what I have tried now. I'm lost now, did I missed
> some point?

Sounds like you just grabbed CVS at a bad point. Try cvs updating.

Also look at /dev/tty4 /dev/tty5 and /dev/tty6 for debug output.

But if you don't press 'fdisk' but, just hit 'OK' the auto-partitioner
will do it's job.

Let me know if you still run into trouble.

Alan.

On Saturday 29 April 2006 12:20, Achim Weber wrote:
> > One other thing for those braving the new installer....
> >
> > The installer doesn't yet do automatic partitioning like the old
> > installer, so it relies on the user doing the fdisk during install.
> >
> > But the new installer allows the user to assign the mount points
> > themselves (aka e2label) once the fdisk is complete. So, ensure you have
> > your partitions setup correctly to boot after the install is complete.
> >
> > Alan.
>
> Hi Alan,
>
> can you please give some more hints to the partionioning and install
> procedure.
>
> I have a fresh 1.5 ISO (compiled tonight), when i come to the
> partionioning I switch to console 2 and remove old partions with
> parted. back to installation screen I select [fdisk], partition
> my 1GB disk:
> hda1     *boot*     8 MB
> hda2                300 MB
> hda3                ~700 MB (the remaining)
>
> [write]: yes
> [quit]
>
> Next is the prompt for partition labels, I enter:
> hda1    /boot
> hda2    /
> hda3    /var/log
>
> Messages:
> - "Creating Filesystem...."
> - "Extracting IPCop...."
> - one or two messages I can't read (they disapear to fast)

Alan, can we log all installer messages for debugging purposes?  That log can 
then be saved to a floppy for review.  Or discarded.

> - "Creating initrd...."
>
> Not sure because it is to fast but I think at this point there is a
> error message but it does disappear too fast.
>
> Next message is the start message "Select the language....".
> Last command displayed on console 5 is:
> "Running command: /bin/chroot /harddisk /bin/cp -f /boot/grub/grubbatch
> /tmp"
>
> When I do:
> 1) reboot, I get an empty grub prompt: "grub> _CURSOR_"
> 2) select language, select CDROM etc., at [Fdisk] all partitions show
>    up, too with the correct labels. When I proceed I get the "Press OK
>    to reboot" prompt and after reboot the empty grub like in 1).
>    On console 5 I have failed to mount cdrom.
>
>
> When I select [OK] to choose automatic patitioning instead of [fdisk]
> I get a grub splashscreen but the options are not working.
> I get grub error: "Error 15: file not found"
> What makes me a bit perplex is the grub-config line:
>      "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
> Shouldn't be the LABEL a device name?


Achim,

the LABEL is ok.  You can label your ext2 or ext3 filesystems and use the 
labels to refer to the actual physical devices.  The advantage is that you 
don't have to remember or care about device names.  Just label them properly.

I still haven't booted with the new installer, and therefore I can't comment 
on the rest.

IvanK.

>
> Can't remember all what I have tried now. I'm lost now, did I missed
> some point?
>
> Achim
>
>
>
>
>
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> IPCop-devel mailing list
> IPC...@li...
> https://lists.sourceforge.net/lists/listinfo/ipcop-devel

> One other thing for those braving the new installer....
> 
> The installer doesn't yet do automatic partitioning like the old
> installer, so it relies on the user doing the fdisk during install.
> 
> But the new installer allows the user to assign the mount points
> themselves (aka e2label) once the fdisk is complete. So, ensure you have
> your partitions setup correctly to boot after the install is complete.
> 
> Alan.

Hi Alan,

can you please give some more hints to the partionioning and install
procedure.

I have a fresh 1.5 ISO (compiled tonight), when i come to the
partionioning I switch to console 2 and remove old partions with
parted. back to installation screen I select [fdisk], partition
my 1GB disk:
hda1     *boot*     8 MB
hda2                300 MB
hda3                ~700 MB (the remaining)

[write]: yes
[quit]

Next is the prompt for partition labels, I enter:
hda1    /boot
hda2    /
hda3    /var/log

Messages:
- "Creating Filesystem...."
- "Extracting IPCop...."
- one or two messages I can't read (they disapear to fast)
- "Creating initrd...."

Not sure because it is to fast but I think at this point there is a
error message but it does disappear too fast.

Next message is the start message "Select the language....".
Last command displayed on console 5 is:
"Running command: /bin/chroot /harddisk /bin/cp -f /boot/grub/grubbatch /tmp"

When I do:
1) reboot, I get an empty grub prompt: "grub> _CURSOR_"
2) select language, select CDROM etc., at [Fdisk] all partitions show
   up, too with the correct labels. When I proceed I get the "Press OK
   to reboot" prompt and after reboot the empty grub like in 1).
   On console 5 I have failed to mount cdrom.

   
When I select [OK] to choose automatic patitioning instead of [fdisk]
I get a grub splashscreen but the options are not working.
I get grub error: "Error 15: file not found"
What makes me a bit perplex is the grub-config line:
     "kernel /vmlinuz root=LABEL=/ ro panic=10 acpi=off"
Shouldn't be the LABEL a device name?

Can't remember all what I have tried now. I'm lost now, did I missed
some point?

Achim

Hi,
Am Samstag, den 29.04.2006, 15:18 +0200 schrieb Gilles Espinasse:
> Maybe we still suffer from the very big delay between anonymous cvs access
> and authentified access.
> Similary cvs web interface is far away (4 weeks later) with lfs/openswan in
> 1.18 version
> Actual version in cvs for lfs/openswan is openswan,v 1.21 2006/04/19
> 13:07:14
> 
> Try with a snapshoot available at http://ipcop.sourceforge.net/cvs_snapshot/
> they are more up to date.
Thanks. I will try that.

Ralf

-- 
Ralf Spenneberg
OpenSource Training                     http://www.opensource-training.de
Webereistr. 1                           48565 Steinfurt           Germany

Hi,
Am Samstag, den 29.04.2006, 15:55 +0100 schrieb Robert Kerr:
> SELinux is a pain to set up, and requires a filesystem that supports
> labelling. As far as I remember the filesystem we're using for compact
> flash installs doesn't support labels, which prevents us using SELinux
> on those architectures even if we wanted too. It's not bad from a
> security point of view, and the fact it's in kernel rather than a patch
> is a plus, but the initial setup is so much effort it easily negates
> that advantage.
I got that point.

> One big disadvantage of AppArmor is that HLFS (which IPCop is based
> around) doesn't include any AppArmor support, but does support
> grsecurity and SELinux.
This of course makes it much easier to use grsecurity. Thanks for the
clarification.

Ralf

-- 
Ralf Spenneberg
OpenSource Training                     http://www.opensource-training.de
Webereistr. 1                           48565 Steinfurt           Germany

On Sat, 2006-04-29 at 13:42 +0200, Ralf Spenneberg wrote:
> Hi,
> 
> I just downloaded the IPcop-head-branch and tried to compile it.
> Unfortunately it still tries to access openswan-2.4.5rc5 which is not
> available anymore. How do you update the paths and md5sums? Of course I
> can update them manually, but I am interested in the 'correct' way. When
> will they be updated by the devel team? Shall I update them and send the
> patch to you?
> 
> In the long term I am interested in including both AppArmor and/or
> SELinux in IPcop. I noticed that you apparently chose grsecurity. Any
> thoughts on AppArmor or SELinux?

SELinux is a pain to set up, and requires a filesystem that supports
labelling. As far as I remember the filesystem we're using for compact
flash installs doesn't support labels, which prevents us using SELinux
on those architectures even if we wanted too. It's not bad from a
security point of view, and the fact it's in kernel rather than a patch
is a plus, but the initial setup is so much effort it easily negates
that advantage.

AppArmor wasn't GPLed when we first went with grsecurity. I'm not really
sure it has any advantage over grsecurity - the ACL system is quite
similar, but it lacks any of the other protections grsecurity has. I
guess it's perhaps possible to combine PaX and AppArmor, but unless
AppArmor has any particular advantages I'm not sure I see the point.

One big disadvantage of AppArmor is that HLFS (which IPCop is based
around) doesn't include any AppArmor support, but does support
grsecurity and SELinux.

-- 
 Robert Kerr

----- Original Message ----- 
From: "Ralf Spenneberg" <li...@sp...>
To: <ipc...@li...>
Sent: Saturday, April 29, 2006 1:42 PM
Subject: [IPCop-devel] IPcop 1.5 build system


> Hi,
>
> I just downloaded the IPcop-head-branch and tried to compile it.
> Unfortunately it still tries to access openswan-2.4.5rc5 which is not
> available anymore. How do you update the paths and md5sums? Of course I
> can update them manually, but I am interested in the 'correct' way. When
> will they be updated by the devel team? Shall I update them and send the
> patch to you?
>
Maybe we still suffer from the very big delay between anonymous cvs access
and authentified access.
Similary cvs web interface is far away (4 weeks later) with lfs/openswan in
1.18 version
Actual version in cvs for lfs/openswan is openswan,v 1.21 2006/04/19
13:07:14

Try with a snapshoot available at http://ipcop.sourceforge.net/cvs_snapshot/
they are more up to date.

Gilles

Hi,

I just downloaded the IPcop-head-branch and tried to compile it.
Unfortunately it still tries to access openswan-2.4.5rc5 which is not
available anymore. How do you update the paths and md5sums? Of course I
can update them manually, but I am interested in the 'correct' way. When
will they be updated by the devel team? Shall I update them and send the
patch to you?

In the long term I am interested in including both AppArmor and/or
SELinux in IPcop. I noticed that you apparently chose grsecurity. Any
thoughts on AppArmor or SELinux?

Cheers,

Ralf

-- 
Ralf Spenneberg
OpenSource Training                     http://www.opensource-training.de
Webereistr. 1                           48565 Steinfurt           Germany

Gilles, Franck

Do you have any instructions for using a USB key for installation, or  
restoring settings from a USB key?

I have tested installing v1.4.11 from a CD, but I don't seem to be  
able to get the file system mounted.

Is any special preparation required? Can you explain what's meant to  
happen, so I can see if it's my hardware at fault?

Thanks.

Eric

Le Vendredi 28 Avril 2006 15:36, ja...@gu... a =E9crit=A0:
> > a unique screen for each network. Allways the same screen
> > with SIMPLE options listed.
> > the NAME (color)
> > the interface it is bound too
> > the not so big list of rules applied to this interface:
> > -my IP fixed/dhcp
> > -checkbox for active service : squid, ntp server, log , snort
> > -and the firewall rules (buttons to another simple screen):
> > --list of port transfert
> > --list of enabled stations (macadress, ip, authen <=3D addon stuff to
> > extend this)
> > --list of other interface this one can speak with
> > That 'all
>
> YES, but with 1 small change.
>
> The interface is the control, NOT the color/rules.
>
> Interface:  ETH1
> Type:       GREEN/TRUSTED    <-- make this a drop down choice
>
> jackb

Ok,
We will validate all this with 'fake' GUI screens.=20

Alan wrote:
>Great. Please go ahead and do some 'mockups'.
I will.


Meanwhile, if you[developpers] can think to a kind
of repository to store everything so that GUI+addons can
get reply to questions like
=2Dgive me list of NIC,[with prop]?
=2Dstore easily lists of anything.

We already have=20
=2Dread/writehashvalues for single variables.
=2Dmultilines for read/write repeated lines of same structure.



=46ranck

> a unique screen for each network. Allways the same screen
> with SIMPLE options listed.
> the NAME (color)
> the interface it is bound too
> the not so big list of rules applied to this interface:
> -my IP fixed/dhcp
> -checkbox for active service : squid, ntp server, log , snort
> -and the firewall rules (buttons to another simple screen):
> --list of port transfert
> --list of enabled stations (macadress, ip, authen <= addon stuff to extend 
> this)
> --list of other interface this one can speak with
> That 'all

YES, but with 1 small change.

The interface is the control, NOT the color/rules.

Interface:  ETH1
Type:       GREEN/TRUSTED    <-- make this a drop down choice

jackb

On Fri, 2006-04-28 at 12:48 +0200, Franck Bourdonnec wrote:
> What we can do is a 'maquette' of what could 
> the GUI looks like.
> 
> Then everybody can say something about 'logical'
> access, about readabilty, ergonomy etc...
> 
> No code behind this, just four or five cgi so that
> everybody agree on.
> 
> Then everything(the code) will follow logically....

Great. Please go ahead and do some 'mockups'.

Alan.

What we can do is a 'maquette' of what could 
the GUI looks like.

Then everybody can say something about 'logical'
access, about readabilty, ergonomy etc...

No code behind this, just four or five cgi so that
everybody agree on.

Then everything(the code) will follow logically....


Franck

On Fri, 2006-04-28 at 10:09 +0200, Franck Bourdonnec wrote:
> Le Vendredi 28 Avril 2006 04:57, Harry Goldschmitt a =C3=A9crit :
> > At 8:42 PM -0500 4/27/06, ja...@gu... wrote:
> > >  > I wan't this features too, but i understand also jackb and the oth=
ers.
> > >>
> > >>  Lets think about following:
> > >>
> > >>  We do a initial setup with green/orange/blue/red as in 1.4,
> > >>  but if a user wants to change green (or orange or red...)
> > >>  then copy that to greenplus (or green-1 or green-green) where
> > >>  everything can be changed and disable the original green net.
> > >>  So we can ask a user if its the green or green-1 'interface'.
> > >>
> > >>  In this way we know that there is anything changed from the origina=
l
> > >>  design and a user can't change the design of original green (from t=
he
> > >> gui).
> > >
> > >REAL REAL CLOSE!!!
> Designing specs can't be done with two or three mail exchange.
> If IPCop 1.5 is still a four fixed interface machine, just say it.
> If a major change is allowing any numbers of interfaces, we
> have to find best way to implement this.
>=20
> We have to mix opinions of
> -users
> -developpers
> -docwriters
> -ancestors

Agreed.

> > Also, please keep in mind us poor documentation types that have to
> > document whatever we come up with for folks that don't know
> > networking.  If we have to document details, we'll loose our current
> > simplicity.  We currently have pages of documentation trying to
> > explain what GREEN, BLUE, ORANGE and RED mean.  I hope we won't have
> > to have dozens of pages that try to explain the new options.
> >
> > Harry
>=20
> You want have a dozen of 'new page' ! Strange screen like 'blue access'
> will disappear.

Right.

> All top level applications screens (ntp, squid, ...) won't change radical=
ly.

Yup.

> Some messy screens like adslmodem+ppp should be split in to level
> -screens discribing hardware link (rnis,adsl,ethX,serial,...)
> -screens describing logical interface like ppp0, vpn.

I think we could have a single screen here, but with a drop down list of
interfaces that IPCop has *detected* only. Then when the user picks that
interface. The rest of the screen below adapts to that choice. Much like
what we have with pppsetup, but we keep having to click 'refresh' - ugh.

> nothing really new here.
> simplification is here:
>=20
> a unique screen for each network. Allways the same screen
> with SIMPLE options listed.
> the NAME (color)
> the interface it is bound too
> the not so big list of rules applied to this interface:
> -my IP fixed/dhcp
> -checkbox for active service : squid, ntp server, log , snort
> -and the firewall rules (buttons to another simple screen):
> --list of port transfert
> --list of enabled stations (macadress, ip, authen <=3D addon stuff to ext=
end=20
> this)
> --list of other interface this one can speak with
> That 'all
>=20
> It is a request users of having 'control' for a network in a single point=
 and
> not to naviguate trought multiple screen to enble this or disable that.

Yes. Is it possible for you to work on IPCop 1.5 and change pppsetup.cgi
for this Franck ??

You should look at using the /sys directory to probe for hardware that
IPCop has found to display in the CGI script.

Alan.

Le Vendredi 28 Avril 2006 04:57, Harry Goldschmitt a =E9crit=A0:
> At 8:42 PM -0500 4/27/06, ja...@gu... wrote:
> >  > I wan't this features too, but i understand also jackb and the other=
s.
> >>
> >>  Lets think about following:
> >>
> >>  We do a initial setup with green/orange/blue/red as in 1.4,
> >>  but if a user wants to change green (or orange or red...)
> >>  then copy that to greenplus (or green-1 or green-green) where
> >>  everything can be changed and disable the original green net.
> >>  So we can ask a user if its the green or green-1 'interface'.
> >>
> >>  In this way we know that there is anything changed from the original
> >>  design and a user can't change the design of original green (from the
> >> gui).
> >
> >REAL REAL CLOSE!!!
Designing specs can't be done with two or three mail exchange.
If IPCop 1.5 is still a four fixed interface machine, just say it.
If a major change is allowing any numbers of interfaces, we
have to find best way to implement this.

We have to mix opinions of
=2Dusers
=2Ddeveloppers
=2Ddocwriters
=2Dancestors


> Also, please keep in mind us poor documentation types that have to
> document whatever we come up with for folks that don't know
> networking.  If we have to document details, we'll loose our current
> simplicity.  We currently have pages of documentation trying to
> explain what GREEN, BLUE, ORANGE and RED mean.  I hope we won't have
> to have dozens of pages that try to explain the new options.
>
> Harry

You want have a dozen of 'new page' ! Strange screen like 'blue access'
will disappear.

All top level applications screens (ntp, squid, ...) won't change radically.

Some messy screens like adslmodem+ppp should be split in to level
=2Dscreens discribing hardware link (rnis,adsl,ethX,serial,...)
=2Dscreens describing logical interface like ppp0, vpn.

nothing really new here.
simplification is here:

a unique screen for each network. Allways the same screen
with SIMPLE options listed.
the NAME (color)
the interface it is bound too
the not so big list of rules applied to this interface:
=2Dmy IP fixed/dhcp
=2Dcheckbox for active service : squid, ntp server, log , snort
=2Dand the firewall rules (buttons to another simple screen):
=2D-list of port transfert
=2D-list of enabled stations (macadress, ip, authen <=3D addon stuff to ext=
end=20
this)
=2D-list of other interface this one can speak with
That 'all

It is a request users of having 'control' for a network in a single point a=
nd
not to naviguate trought multiple screen to enble this or disable that.


=46ranck