KCLUG

8 participants
3271 discussions

Re: Request for help: Debian firewall, and maybe some kernelupgradetips
by Brian Kelsay 16 Apr '05

16 Apr '05

ip_conntrack_ftp is a kernel module, but I'm not sure if it is on my firewall or not. A person could just check "lsmod" to see if it is loaded or "modprobe ip_conntrack_ftp" to initiate. Where in the kernel options is the support for this module? Under networking perhaps? Brian Kelsay >>> Brad <> 04/15/05 10:58AM >>> > Correct me if I'm wrong, but the simple firewall rules > posted earlier would effectively break ftp. Wouldn't > the unpriviledged ports also be blocked? Wouldn't you > need to specifically allow the unpriviledged ports for > either active or passive ftp? Wouldn't you need to > allow outbound ports also? I don't remember all the > rules posted, but I would think that the default rule > would be to drop inbound and outbound unused ports. > > Brian D. The default policy for the Output chain is usually ACCEPT, so there is no need to open outbound ports specifically. The ACCEPT statement on the ESTABLISHED,RELATED line will allow connections to the unprivileged ports since they are related to the connection on port 21. I believe ip_conntrack_ftp helps with this. Brad

4 3

Visual of KCLUG Meeting Area
by djgoku 15 Apr '05

15 Apr '05

This is where we meet. I can't really tell if this looks correct or not. http://maps.google.com/maps?q=14+W+10th+St++Kansas+City,MO+64105-1702&spn=0… jonathan

3 2

Re: Request for help: Debian firewall, and maybe some kernel upgradetips
by Jack 15 Apr '05

15 Apr '05

--- Brad wrote: > > > The default policy for the Output chain is usually > ACCEPT, so there is > no need to open outbound ports specifically. The > ACCEPT statement on > the ESTABLISHED,RELATED line will allow connections > to the unprivileged > ports since they are related to the connection on > port 21. I believe > ip_conntrack_ftp helps with this. Right, I wnet back and looked at Chris's post. I thought he set in and out to default to drop. Which he didn't. Thanks for clarifying the ESTABLISHED,RELATED context. I've wondered about that before. So you can that way on a server, not open the unpriviledged ports globally, but allow each connection to open those ports. That's much better. Brian D. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Re: Request for help: Debian firewall, and maybe some kernel upgradetips
by Jack 15 Apr '05

15 Apr '05

--- Gerald Combs wrote: > Justin Dugger wrote: > > Actually, you probably need a ftp tracking module > installed into the > > kernel; ftp has two ports, the command and data > port. The command port > > is 21, which does things like initiate transfers > ... > > FTP uses port 21 for commands, such as LIST, PWD, > DIR, CD, etc. as you > stated above. It uses a separate socket and > separate ports for data > transfers (such as directory listings and files). > Data transfers are > either "active" or "passive." For active > connections, the server > initiates a connection _from_ port 20 to a randomly > selected port on the > client. For passive connections, the client > initiates a connection to a > randomly selected port on the server. You shouldn't > have to unblock > port 20 no matter what, since there isn't going to > be traffic coming > into that port in either case. > > Firewalls can trip up two things: > > - They can block active data connections to clients > (which is why most > FTP client software uses passive connections > nowadays). > > - If a data connection takes a long time, they can > time out the > associated command connection (which sits idle). > > To get around these issues firewalls typically use > stateful inspection > or proxying. Correct me if I'm wrong, but the simple firewall rules posted earlier would effectively break ftp. Wouldn't the unpriviledged ports also be blocked? Wouldn't you need to specifically allow the unpriviledged ports for either active or passive ftp? Wouldn't you need to allow outbound ports also? I don't remember all the rules posted, but I would think that the default rule would be to drop inbound and outbound unused ports. Brian D. __________________________________ Do you Yahoo!? Make Yahoo! your home page http://www.yahoo.com/r/hs

3 2

Another Linux consultant startup question
by Jack 15 Apr '05

15 Apr '05

Hope I'm not upsetting the consultants on the list, but I'm going to try and pick your brains again. Thanks for all the help so far! I'm wondering if anyone is using any templates to generate quote documents from or responses to RFPs. I could of course make one up, but it'd be faster to take templates already made and customize them. Thanks again, Brian D. __________________________________ Do you Yahoo!? Yahoo! Small Business - Try our new resources site! http://smallbusiness.yahoo.com/resources/

1 0

Re: Migrating to Linux - WP
by Jack 15 Apr '05

15 Apr '05

--- Jonathan Hutchins wrote: > On Wed, April 13, 2005 12:30 pm, Jack said: > > So it appears that oo has decided to use Java for > functions somewhat like > MS Offices uses Visual Basic. "Document Wizards" > are a Microsoftian evil, > but some amount of macro scripting is useful for > things like invoice > systems. Well what would you recommend they use? > which Java do you install? When in doubt install the official version which would be Sun's. > ... Choosing, > installing, and maintaining a Java distribution to > support a single app is > a bit like installing Microsoft Office Professional > to edit a one-page > text file, if there were multiple versions of Office > to choose from. While Java could be considered an OS, just as much as say PERL or Python could be, I don't really see it as such. I see it as an appliaction that interacts with other applications. I also respectfully disagree with MS Office comparison. Open Office is as far as I can tell more powerful. I've written small books in OO, that can easily be sent in a format that is ready for a printer (printer as in commercial book printer as opposed to the office hardware printer) to use. I've found OO to be much more robust creating usable online books and it also loads books faster. Not that OO is perfect, far from it. Brian D. __________________________________ Do you Yahoo!? Make Yahoo! your home page http://www.yahoo.com/r/hs

1 0

RE: Request for help: Debian firewall, and maybe some kernel upgradetips
by djgoku 14 Apr '05

14 Apr '05

>On 4/14/05, Brian Kelsay <Brian.Kelsay(a)kcc.usda.gov> wrote: > I just said that because when I was enabling FTP on my server and thru the firewall, I >opened port 20. Course I listened to dj_goku and that may have been mistake number 1. ;-) >(We just love to bag on dj_goku.) The only port I opened for ftp was 223. Also the router/firewall had at the time 443, 222 open. So your port 20 was not needed in my case, Jonathan #1 (jhutchins) verified my ftp was working. hehe Maybe port 20 open on your box is slowing down the scp and ssh connections... =) -- dj_goku -www.djgoku.com- -www.tektronic.org-

1 0

Re: Request for help: Debian firewall, and maybe some kernel upgradetips
by Justin Dugger 14 Apr '05

14 Apr '05

Actually, you probably need a ftp tracking module installed into the kernel; ftp has two ports, the command and data port. The command port is 21, which does things like initiate transfers and list directory contents, etc. It also sends a random number which pertains to the port number for the data port. Now that I think of it, this usually matters much more for the clients, I'm not so sure of the server. Anyone wiser than I (it isn't hard)? > > Don't you also need port 20 open for ftp? > > > > Brian Kelsay > > > > _______________________________________________ > > Kclug mailing list > > Kclug(a)kclug.org > > http://kclug.org/mailman/listinfo/kclug

2 1

Re: Request for help: Debian firewall,and maybe some kernel upgradetips
by Brian Kelsay 14 Apr '05

14 Apr '05

I just said that because when I was enabling FTP on my server and thru the firewall, I opened port 20. Course I listened to dj_goku and that may have been mistake number 1. ;-) (We just love to bag on dj_goku.) Brian Kelsay >>> Justin Dugger <jldugger(a)gmail.com> 04/14/05 11:52AM >>> Actually, you probably need a ftp tracking module installed into the kernel; ftp has two ports, the command and data port. The command port is 21, which does things like initiate transfers and list directory contents, etc. It also sends a random number which pertains to the port number for the data port. Now that I think of it, this usually matters much more for the clients, I'm not so sure of the server. Anyone wiser than I (it isn't hard)? > > Don't you also need port 20 open for ftp? > > > > Brian Kelsay > > > >

1 0

Firefox and T-bird on flash drive
by Brian Kelsay 14 Apr '05

14 Apr '05

Oren was talking last week at the meeting about putting Thunderbird on a flash drive and so this seemed appropriate. Windows-only for now. PUTTING FIREFOX AND THUNDERBIRD ON A FLASH DRIVE I had a caller on the radio show last week who wanted to put Firefox and Thunderbird on a USB flash drive. I said it could be done, but that it would take some work that I just could not explain on the air. (Note: If you don't know what a flash drive is, I cover that below in the Rookie Rundown below.) The way that I did it was to create a profile on the drive, copy some files and do a bit more tweaking. Well, Brad, in Spring Hill, TN, wrote me to say that much of the work has been done already. You just have to download the portable versions. You can find all of the details on these sites. Thank you, Brad! You rock! http://johnhaller.com/jh/mozilla/portable_firefox/ http://johnhaller.com/jh/mozilla/portable_thunderbird/ Brian Kelsay

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

KCLUG