ipcop-devel Mailing List for IPCop Firewall

On my Flash install (2.0.4) logs are rotated when the log files exceeds 
a size of 4MB and checked every hour by cron. This results in truncated 
daily log files if the logs were rotated at any time other than midnight 
when viewed from the GUI.

As a workaround I have set cron to only rotate the logs at midnight 
(0 0 * * *       /usr/sbin/logrotate /etc/logrotate.conf)
So far I haven't noticed any detrimental effect of this change.

Maybe this could be considered as the default for future releases.


Bob

ccache rely on a compiler signature to determine if a cache hit is valid or not.
The signature must change when the compiler is changed.

We can't rely on the compiler build date (mtime is the default signature) or each new build would create a new signature.

I made the compiler signature depend from gcc md5sum.
That's good enought when /usr/bin/gcc is changed, but not when /usr/bin/{cpp,c++} or anything else change (in /usr/lib/gcc or /usr/lib/{libgcc_s*,libc++*}

I understand this issue after doing that simple change on lfs/gcc
+       # Remove #ident deprecation made by mistake and removed after gcc-4.4. That fix many shadows warnings
+       cd $(DIR_APP) && sed -i '/T_IDENT/s/ | DEPRECATED//' libcpp/directives.c

I was disapointed when nothing changed on shadow compilation log until I understand this issue.

For the final gcc, the solution may be to create a big tar from gcc installed files and run md5sum against.
I don't know yet what disorder may affect the md5sum, maybe gcc static libs?

For the toolchain, I don't have the list of installed files available. I will see what I can cook.

Gilles

For your information :


1) there is already an addon snort for ipcop 2.0.x ; this addon is available since the  26/02/2012

To have informations : Télécharger Snort add-on pour Ipcop V2 					

To download the addon : Download Snort addon pour Ipcop V2.0.4 



2) there is another addon in complement of snort for ipcop 2.0.x ; this addon is "guardian" available since the  22/02/2012
Guardian is really effective with snort to automatically block IP addresses.

To have informations : Télécharger Guardian add-on pour Ipcop V2 					

To download the addon : Download Guardian add-on pour Ipcop V2.0.4

----- Mail original -----
> De: "Brian Jameson" <te...@ja...>
> À: ipc...@li...
> Envoyé: Dimanche 13 Mai 2012 13:01:07
> Objet: [IPCop-devel] Build error as root on rev. 6611
> 
> I guess this is known about but just in case... The recent changes have
> brought about the following build error under rev 6611 if being built by
> root. I know this is not advised but some people may do this, me included.
> 
> checking for mempcpy... (cached) yes
> checking for memrchr... yes
> checking whether mkdir handles trailing slash... yes
> checking whether mkdir handles trailing dot... yes
> checking whether mkfifo rejects trailing slashes... yes
> checking whether mknod can create fifo without root privileges...
> configure:
> error: in `/storage/ipcop4/trunk/build_i486/ipcop/usr/src/coreutils-8.17':
> configure: error: you should not run configure as root (set
> FORCE_UNSAFE_CONFIGURE=1 in environment to bypass this check)
> See `config.log' for more details
> make: ***
> [/storage/ipcop4/trunk/files_i486/01_toolchain/coreutils-8.17]
> Error 1
> 
> I shall now try and correct this bad proctice of mine and build as a normal
> user.
> 
> regards,
> Brian
> 
> 
Thank for the info.
Since it work well to build as non-root and should allow to break the host machine in case of mistake, I no more try the non-root way. Anyway I added FORCE_UNSAFE_CONFIGURE=1 to coreutils toolchain instruction, this is already made for tar.

Gilles

I guess this is known about but just in case... The recent changes have
brought about the following build error under rev 6611 if being built by
root. I know this is not advised but some people may do this, me included.

checking for mempcpy... (cached) yes
checking for memrchr... yes
checking whether mkdir handles trailing slash... yes
checking whether mkdir handles trailing dot... yes
checking whether mkfifo rejects trailing slashes... yes
checking whether mknod can create fifo without root privileges... configure:
error: in `/storage/ipcop4/trunk/build_i486/ipcop/usr/src/coreutils-8.17':
configure: error: you should not run configure as root (set
FORCE_UNSAFE_CONFIGURE=1 in environment to bypass this check)
See `config.log' for more details
make: *** [/storage/ipcop4/trunk/files_i486/01_toolchain/coreutils-8.17]
Error 1

I shall now try and correct this bad proctice of mine and build as a normal
user.

regards,
Brian

On 10/05/2012 4:56 p.m., David W Studeman wrote:
>    The creation of the addon was inevitable as there are people who don't
> think they can live without Snort, not the least of which is the author
> of the addon. Hopefully, he'll get it polished up and include more
> languages so it is usable by Snort devotees that insist on having Snort.
> As far as the reasons why the developers did not include it is well
> covered in this list a few years back but yeah, it would be a pain to
> maintain it. Other reasons are in line with my own reasons not to use
> it. False positives, high memory usage and so on. Basically extra noise
> that clouds the ability to see in a nutshell what's really happening at
> the firewall.
>
>    I'm curious to see how well the folks do if they enable the inline
> (active) option with the full ruleset as downloaded directly from Snort.
> Anyone care to bet on how many pissed off internet users result from
> this option?
>
>
I know that I used to have to look at logs and find the rule and turn it 
off, and that was just for my 2 PC home LAN, because my remote admin to 
a green PC rule would stop working on IPCop V 1.4  :(.
I also know of some sysadmins who like to make work for themselves...  
This is a very easy way to make yourself very busy for little benefit.  
I think setting up a labrea tarpit would be more effective if you were 
after blocking stuff.

-- 
Ciao, Dave

John Edwards wrote:
> Hi
>
> On Wed, May 09, 2012 at 06:41:52AM -0700, Necip Celepci wrote:
>> hi,
>> Is there a snort plugin for IPCop 2.x
>> Thank you.
>
> Not in the main distribution. I believe it has become too difficult
> to maintain as Snort kept making it harder to get rule updates for
> old versions.
>
> But a search on Google:
> 	https://www.google.co.uk/search?hl=en&output=search&sclient=psy-ab&q=snort+plugin+for+IPCop+2.x&btnG=&gbv=1&sei=8HWqT9umNeSi4gT2zYiDCQ
>
> shows this results:
> 	http://www.ipcops.com/phpbb3/viewtopic.php?f=7&t=17154
>
> The ipcops.com forums are well know, but you should still be
> careful about downloading and running code from the Internet.
>
> Also read the comment by Dave (of RaqCop) that shows you will
> still need to do some work yourself to keep it updated.
>
>
  The creation of the addon was inevitable as there are people who don't 
think they can live without Snort, not the least of which is the author 
of the addon. Hopefully, he'll get it polished up and include more 
languages so it is usable by Snort devotees that insist on having Snort. 
As far as the reasons why the developers did not include it is well 
covered in this list a few years back but yeah, it would be a pain to 
maintain it. Other reasons are in line with my own reasons not to use 
it. False positives, high memory usage and so on. Basically extra noise 
that clouds the ability to see in a nutshell what's really happening at 
the firewall.

  I'm curious to see how well the folks do if they enable the inline 
(active) option with the full ruleset as downloaded directly from Snort. 
Anyone care to bet on how many pissed off internet users result from 
this option?


-- 
Dave Studeman
http:/www.raqcop.com

Hi

On Wed, May 09, 2012 at 06:41:52AM -0700, Necip Celepci wrote:
> hi,
> Is there a snort plugin for IPCop 2.x
> Thank you.

Not in the main distribution. I believe it has become too difficult
to maintain as Snort kept making it harder to get rule updates for
old versions.

But a search on Google:
	https://www.google.co.uk/search?hl=en&output=search&sclient=psy-ab&q=snort+plugin+for+IPCop+2.x&btnG=&gbv=1&sei=8HWqT9umNeSi4gT2zYiDCQ

shows this results:
	http://www.ipcops.com/phpbb3/viewtopic.php?f=7&t=17154

The ipcops.com forums are well know, but you should still be
careful about downloading and running code from the Internet.

Also read the comment by Dave (of RaqCop) that shows you will
still need to do some work yourself to keep it updated.


-- 
#---------------------------------------------------------#
|    John Edwards   Email: jo...@co...    |
#---------------------------------------------------------#

hi,
Is there a snort plugin for IPCop 2.x
Thank you.

----- Mail original -----
> De: "David W Studeman" <dws...@ov...>
> À: ipc...@li...
> Envoyé: Jeudi 3 Mai 2012 20:31:55
> Objet: [IPCop-devel] Graphs fail on recent builds.
> 
> Hello all! I notice that more recent svn builds fail to generate
> graphs.
> The cron log shows exit status 9 for makegraphs. Manually invoking it
> leaves with:
> 
> root@5420:~ # makegraphs
> Can't load
> '/usr/lib/perl5/site_perl/5.10.1/i486-linux/auto/RRDs/RRDs.so' for
> module RRDs: libffi.so.5: cannot open shared object file: No such file
> or directory at /usr/lib/perl5/5.10.1/i486-linux/DynaLoader.pm line 200.
>  at /usr/local/bin/makegraphs line 31
> Compilation failed in require at /usr/local/bin/makegraphs line 31.
> BEGIN failed--compilation aborted at /usr/local/bin/makegraphs line 31.
> 
> The interesting thing about the missing library it complains about is
> that it is commented out in the libffi rootfiles. I plopped both the
> real libffi and the so.5 link to it and all works well.
> 
> I'm sure there are bigger things at the moment but I thought I'd mention
> it.
> --
> Dave Studeman
> http://www.raqcop.com
> 
> 
Thank

This is my error.
While looking at libffi usage in our build, I have seen only libgio linked and miss libgobject.

While testing, you should include every files that is spotted as DIFF from previous version in doc/IPCop-2.1.0-diff-list.i486.txt.
Some difference are related to openssl upgrade, other to glib upgrade.

Gilles

Hello all! I notice that more recent svn builds fail to generate graphs.
The cron log shows exit status 9 for makegraphs. Manually invoking it
leaves with:

root@5420:~ # makegraphs
Can't load
'/usr/lib/perl5/site_perl/5.10.1/i486-linux/auto/RRDs/RRDs.so' for
module RRDs: libffi.so.5: cannot open shared object file: No such file
or directory at /usr/lib/perl5/5.10.1/i486-linux/DynaLoader.pm line 200.
 at /usr/local/bin/makegraphs line 31
Compilation failed in require at /usr/local/bin/makegraphs line 31.
BEGIN failed--compilation aborted at /usr/local/bin/makegraphs line 31.

The interesting thing about the missing library it complains about is
that it is commented out in the libffi rootfiles. I plopped both the
real libffi and the so.5 link to it and all works well.

I'm sure there are bigger things at the moment but I thought I'd mention
it.
-- 
Dave Studeman
http://www.raqcop.com