On 12/10/06, Chris - WEBignite <[EMAIL PROTECTED]> wrote:
I've actually just started seeing this same error. I do have a rule set
for
local 127.0.0.1 and an allow for layer2 traffic.
Oct 11 23:59:02 firewall sshd[49200]: fatal: Write failed: Permission
denied
Yes this is the same exactly message i got.
I get this error when updating my firewall rules via ssh. Any current ssh
connections are dropped, but I'm able to reinitiate a new connection
without
trouble.
-Chris
The only difference is that i could not su to root so i could not update any
rules remotely.
I could login to a normal user account properly though
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
]
On Behalf Of Mark Jose
Sent: Wednesday, October 11, 2006 8:41 PM
To: 'Spiros Papadopoulos'; freebsd-questions@freebsd.org;
freebsd-ipfw@freebsd.org
Subject: RE: Problems with ipfw and ssh
Hi,
Just a suggestion/query: Do you have you localhost/127.0.0.1 rules defined
to allow all traffic?
Well actually i copied the following rules from /etc/rc.firewall plus the
comment (..because of the comment!) without thinking of it too much and i
consider them trusty and i never thought they could cause any problem.
Are you suggesting that these rules may be the reason for this?
# Only in rare cases do you want to change these rules
${addcmd} 50 allow all from any to any via lo0
${addcmd} 100 deny all from any to 127.0.0.0/8
${addcmd} 150 deny ip from 127.0.0.0/8 to any
Unfortunately i will not be on the machine for the next 7 or so hrs
Cheers
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:
[EMAIL PROTECTED]
On Behalf Of Spiros Papadopoulos
Sent: Thursday, 12 October 2006 7:53 AM
To: freebsd-questions@freebsd.org; freebsd-ipfw@freebsd.org
Subject: Problems with ipfw and ssh
Hi,
I am trying to configure a firewall using ipfw for a machine running
FreeBSD
5.4.
Without NAT.
I am nearly a newbie on this (since i never had time until now..) but
still
i believe i understand exactly the
concepts and what needs to be done.
Except the manual page and chapter 26.1 in the handbook I am using good
references such as:
http://www.freebsd-howto.com/HOWTO/Ipfw-HOWTO
I need to connect remotely to the machine using ssh and this is where i
get
the problem:
Initially i can connect properly using a normal user account.
When later i am trying to su to root it does nothing and the connection
closes.
I have ipfw enabled in the kernel to deny everything by default.
I have used both (one at a time) the following rules concerning ssh, in
/etc/ipfw.rules
and also other combinations, such as taking off setup and keep-state etc
etc
which would then make my firewall stateless as far as i understood, which
is
something i don't want anyway.
${addcmd} 300 allow log logamount 5 tcp from any to me 22 setup keep-state
-
${addcmd} 300 allow log logamount 5 tcp from any to any ssh keep-state
In a first investigation (not thorough) i found this post:
http://www.freebsdforums.org/forums/showthread.php?t=21876
where from, i cannot realize what is wrong or how to fix this.
I run the sshd in debug mode and below is the portion, for when i am
trying
to su to root
/* sshd -d */
Write failed: Permission denied
debug1: do_cleanup
debug1: PAM: cleanup
debug1: do_cleanup
debug1: PAM: cleanup
debug1: session_pty_cleanup: session 0 release /dev/ttyp7
And here are related logs:
/* line from /var/log/messages */
Oct 11 20:25:54 username sshd[26251]: fatal: Write failed: Permission
denied
/* /var/log/auth.log */
Sep 26 11:17:34 username sshd[50073]: Connection from xxx.xxx.xxx.xx port
1545
Sep 26 11:17:46 username sshd[50073]: Accepted keyboard-interactive/pam
for
user from xxx.xxx.xxx.xx port 1545 ssh2
Sep 26 10:17:49 username su: user to root on /dev/ttyp4
Sep 26 11:17:51 username sshd[50068]: Read error from remote host
xxx.xxx.xxx.xx: Connection reset by peer
Sep 26 13:29:40 username sshd[50076]: Read error from remote host
xxx.xxx.xxx.xx: Operation timed out
Is it trying to write to a
socket? I cannot see what is trying to do and the permission is denied
(of course maybe it is in front of me..but..)
Could anyone please advice?
Thanks in advance
Spiros
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to " [EMAIL PROTECTED]"
_______________________________________________
freebsd-ipfw@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-ipfw
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "
[EMAIL PROTECTED]"
--
Spiros Papadopoulos
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
