Linux-Networking Digest #574, Volume #10 Sun, 21 Mar 99 00:13:34 EST
Contents:
2 computers (Win98 & Linux) sharing modem to Internet ("SmokeSerpent")
strange Masquerading problem (Jon-o Addleman)
RH5.1 PPP server ??? (Rick Lim)
Re: ipfwadm and msaquerade - is my setup secure? ("LP")
FacetWin - anyone using it? Review/comment? (John McKee)
Netscape and ftp (david koski)
A fix for dhcpcd-1.3.17-pl5 (Olivier Baudron)
cable modem and pnp ethernet card ("David Bazell")
diald (Marco Fonseca)
Need help with dsl (3rd request) ("Ben Goble, Lakewood Colorado")
Re: terminal problem with SCO (from linux) (Larry Rivera)
Re: ne.o & 3c509.o compiled ??? (Enbugger)
----------------------------------------------------------------------------
From: "SmokeSerpent" <[EMAIL PROTECTED]>
Subject: 2 computers (Win98 & Linux) sharing modem to Internet
Date: Sat, 20 Mar 1999 18:12:06 -0800
Background:
I have a 486DX-33 running Linux and a Win98 computer. I have a single
dial-up account at an ISP which I would like to share betwixt the two,
instead of coordinating with my wife over access. The Windows machine will
be taking the Lion's share of the bandwidth. I am not interested in sharing
disks, printers, and whatnot. Neither computer has a network card at this
point.
Theory:
Connect the Win98 box to the Linux box via null-modem. The Linux box
connects to the internet at will. The Win98 box "dials-in" to the Linux box,
which connects to the internet if it isn't already, and shares the
connection with the Win98 computer.
Question(s):
Am I crazy? Is this too much to ask of my little 33Mhz Linux baby?
»SmokeSerpent«
--
[EMAIL PROTECTED]
------------------------------
From: [EMAIL PROTECTED] (Jon-o Addleman)
Subject: strange Masquerading problem
Date: Sun, 21 Mar 1999 02:21:50 GMT
I've got masquerading perfectly - even ICQ is happy now.
Unfortunately, though the masqed computers are fine, the masqING
computer isn't. After a short time online (5-10 minutes) I lose the
ability to connect on ftp and irc ports. What could possibly cause
that? Even after this happens, the masqed computers can still use them
- it's only the firewall that loses it.
--
Jon-o Addleman
------------------------------
From: Rick Lim <[EMAIL PROTECTED]>
Subject: RH5.1 PPP server ???
Date: 21 Mar 1999 02:48:38 GMT
I am trying to set up a dialin server on a RH5.1
with shadow passwords, ppp2.2.0
The clients dialing in will be win95/98 clients
The clients dial in and get disconnected before
ppp starts up, here is the ppp options file
-detach
modem
crtscts
lock
proxyarp
require-pap
refuse-chap
login
here is the pap-secrets
# Secrets for authentication using PAP
# client server secret IP addresses
* * ""
here is the messages file
Mar 20 06:45:37 linux1 PAM_pwdb[832]: (login) session closed for user root
Mar 20 06:46:07 linux1 PAM_pwdb[867]: bad username [/AutoPPP/]
Mar 20 06:46:07 linux1 login[867]: FAILED LOGIN 1 FROM (null) FOR
/AutoPPP/, UseMar 20 06:46:07 linux1 PAM_pwdb[867]: bad username [^?]
Mar 20 06:46:07 linux1 login[867]: FAILED LOGIN 2 FROM (null) FOR ^?, User
not eMar 20 06:46:10 linux1 PAM_pwdb[867]: bad username [~^?}#@]
Mar 20 06:46:10 linux1 login[867]: FAILED LOGIN 3 FROM (null) FOR ~^?}#@,
User eMar 20 06:46:10 linux1 PAM_pwdb[867]: bad username [!}!}"} }]
Mar 20 06:46:10 linux1 login[867]: FAILED LOGIN SESSION FROM (null) FOR
!}!}"} eMar 20 06:46:51 linux1 PAM_pwdb[868]: (login) session opened for
user root by ()Mar 20 06:46:51 linux1 login[868]: DIALUP AT ttyS0 BY root
here is the mgetty.ttyS0 file
03/20 06:46:07 yS0 getlogname (AUTO_PPP), read:~[ff]}#[c0]!
03/20 06:46:07 yS0 input finished with '\r', setting ICRNL ONLCR
03/20 06:46:07 yS0 tio_get_rs232_lines: status: RTS CTS DSR DTR DCD
03/20 06:46:07 yS0 login: use login config file
/usr/local/etc/mgetty+sendfax/login.config
03/20 06:46:07 yS0 match: user='/AutoPPP/', key=''
03/20 06:46:07 yS0 match: user='/AutoPPP/', key='/FIDO/'
03/20 06:46:07 yS0 match: user='/AutoPPP/', key=''
03/20 06:46:07 yS0 match: user='/AutoPPP/', key=''
03/20 06:46:07 yS0 match: user='/AutoPPP/', key='*'*** hit!
03/20 06:46:07 yS0 calling login: cmd='/bin/login', argv[]='login
/AutoPPP/'
03/20 06:46:07 ##### data dev=ttyS0, pid=867, caller=none,
conn='12000/ARQ/V32/LAPM/V42BIS', name='', cmd='/bin/login',
user='/AutoPPP/'
What I can't figure out is this a mgetty problem
or a pppd problem.
Can anyone help ?????
--
The wealth of reality, cannot be seen from your locality.
------------------------------
From: "LP" <[EMAIL PROTECTED]>
Subject: Re: ipfwadm and msaquerade - is my setup secure?
Date: Sun, 21 Mar 1999 02:53:46 GMT
Tom Marsh <[EMAIL PROTECTED]> wrote in message
news:[EMAIL PROTECTED]...
> I've put together a firewall (based on postings here and in 'Linuux
> Netowrk Toolkit' ) script for my home network which looks like:
>
> win95 machines <=eth0=> linux(RH5.2) box <=internet w/dynamic ip
> (ppp0)=>
>
> The linux box is also running apache web server.
>
> The script:
> #
> # firewall rules: $1 is dynamic IP from ISP
> #
> echo -- Executing firewall.rules for $1 >> /etc/ppp/ip-up.log
>
> ISP_IP="$1"
>
> echo $ISP_IP
>
> # My fixed addresses
> ME="10.77.45.1"
> FIRE_NET="10.77.45.0/24"
> ALLIP="0.0.0.0/0"
>
> # Clear out whatever rules are still set
> ipfwadm -I -f
> ipfwadm -O -f
> ipfwadm -F -f
>
> # Start by completely denying any network access.
> ipfwadm -I -p deny
> ipfwadm -O -p deny
> ipfwadm -F -p deny
Might want to set the policy to deny before flushing - otherwise there's a
_very_ brief period of time where you don't have any rules and its possible
for the default policy to be 'accept'...
>
> # Deny spoofed packets.
> ipfwadm -I -a deny -V $ISP_IP \
> -S $FIRE_NET \
> -D $ALLIP
> ipfwadm -I -a deny -V $ISP_IP \
> -S $ISP_IP \
> -D $ALLIP
>
> # Permit eth0 into and out of the firewall
> # Note: modified to accept ALLIP in either direction, because DHCP
> # traffic was not getting through eth0
> #
If you log the rejected packets, you'll see that DHCP requests need to be
enabled with:
ipfwadm -I -a accept -S 0/0 68 -D $ALLIP 67 -P udp -W eth0
I generally don't use Output firewall rules since I only have two
interfaces, but perhaps the one below would work:
ipfwadm -O -a accept -S 0/0 68 -D $ALLIP 67 -P udp -W eth0
Then, you can limit incoming traffic on your internal interface (which
probably is not necessary unless someone gets through the firewall...):
ipfwadm -I -a accept -S $FIRE_NET -D $ALLIP -W eth0
ipfwadm -O -a accept -S $FIRE_NET -D $ALLIP -W eth0
> ipfwadm -I -a accept -S $ALLIP -D $ALLIP -W eth0
> ipfwadm -O -a accept -S $ALLIP -D $ALLIP -W eth0
>
> # Permit ppp0 into and out of the firewall
> ipfwadm -I -a accept -S $ALLIP -D $ISP_IP -W ppp0
> ipfwadm -O -a accept -S $ISP_IP -D $ALLIP -W ppp0
>
> # Masquerade the Lan (eth0)
> ipfwadm -F -a masquerade -S $FIRE_NET -D $ALLIP -W ppp0
>
> I just don't want to leave any gaping holes!
I personally disable all incoming packets to the firewall except a couple
necessary services - DHCP from my cable modem, VPN from remote computers
when I'm not at home, etc...This is not as important when dialing over a
modem, though. It also means that I cannot perform services such as ftp
from the firewall since I disable return tcp and udp packets. However, this
makes it possible for me to tell whenever someone is probing thr system.
Since IP Masquerade on kernel 2.2.2 uses ports between 61000 and 65096 (see
the kernel headers), I just have to open up these ports and everything
works. Haven't tried it over PPP, though that shouldn't matter.
-LP
------------------------------
From: [EMAIL PROTECTED] (John McKee)
Subject: FacetWin - anyone using it? Review/comment?
Reply-To: [EMAIL PROTECTED]
Date: Sun, 21 Mar 1999 03:04:32 GMT
While looking for documentation for Samba, the AltaVista site displayed an add for
FacetWin. I went
to their site and d/l'd a demo (30 day trial) copy which I have not yet installed.
Has anyone used this software?
TIA,
John McKee
[EMAIL PROTECTED]
Democracy is three wolves and a sheep voting what to have for lunch.
------------------------------
Date: Sat, 20 Mar 1999 18:59:56 -0800
From: david koski <[EMAIL PROTECTED]>
Subject: Netscape and ftp
I cannot ftp with Netscape but I *can* with other ftp programs including
the standard ftp with Linux. I have confirmed that ftp works in
"normal" non-passive mode through my packet filtering filewall
(ipfwadm). I am running RH5.1 for a file/print server and gateway to
Internet through a dialup PPP connection to my local ISP. Clients
(Windoze and OS/2) work the same--i.e. Netscape=no go, other ftp in
"normal" mode=yes.
Ok, so the problem seems to be the reverse of the common "can't get
through with ftp" problem. I can get through with "normal" non-pasive
ftp but not PASV mode which seems to be what Netscape defaults to. If
Netscape *defaults* to PASV mode that seems to imply that there is a way
to switch it to "normal" non-pasive mode. Any clues how to do it?
regards,
david
[EMAIL PROTECTED]
------------------------------
From: Olivier Baudron <[EMAIL PROTECTED]>
Subject: A fix for dhcpcd-1.3.17-pl5
Date: Sun, 21 Mar 1999 03:30:58 +0100
If one download dhcpcd-1.3.17-pl5.tar.gz and type make, the executable dhcpcd
will not be able to connect to the isp (on Intel Pentium, at least, whatever the
compiler may be).
To compile and use dhcpcd-1.3.17-pl5, one has to replace line 46 of udpipgen.c:
sum += answer;
by
sum += answer & 0xFF;
Another solution is to remove the -O2 option in the Makefile.
The reason is that "answer" is not correctly initialized when the optimization
-O2 is set.
Olivier.
------------------------------
From: "David Bazell" <[EMAIL PROTECTED]>
Subject: cable modem and pnp ethernet card
Date: Sun, 21 Mar 1999 03:16:42 GMT
Hi
I have been looking at all the information on getting my cable modem
(motorola) working with the @home network. i have a intel etherexpress
pro/10+ (pnp enabled) card.
I have gotten my system to recognize my card using isapnptools. Then I load
the driver using /sbin/modprobe eepro io=0x230,irq=10
If I then do ifconfig -a I get the eth0 interface recognized.
I then run dhcpcd -d -h "cc1011962-a" to run in the foreground. After about
a minute I get the message
no DHCPOFFER
Looks to me link I am not getting out of my computer. Any suggestions of
what to try from here will be greatly appreciated.
Thanks,
Dave
------------------------------
From: Marco Fonseca <[EMAIL PROTECTED]>
Crossposted-To: redhat.news.networking
Subject: diald
Date: Sat, 20 Mar 1999 21:44:13 -0500
What is the latest version of diald and where could I get it? Would it
be compatible with default rpms and programs in the original RH52?
Thanks.
------------------------------
From: "Ben Goble, Lakewood Colorado" <[EMAIL PROTECTED]>
Subject: Need help with dsl (3rd request)
Date: Sat, 20 Mar 1999 21:06:40 -0700
I requested help from RedHat but they said they do not provivde
help for this type of problem. I guess that is reasonable.
Objective:
Get Linux to work with my USWest dsl (MegaBit) service.
My hardware:
3Com 3C509B NIC card - this is a PnP ISA card
The PnP is disabled on this NIC card and the 3Com
3C5X9Cfg.exe program shows the card at IRQ 11
and i/o address 0300
ASUS main board (TX97-XE) with AMD K6-233
My software:
Redhat 5.2 with kernel ungraded to ver 2.2.2
Description of my set-up:
Netscape is running with dsl on Win98
In Win98 winipcfg shows this information:
Windows 98 IP Configuration
Host Name . . . . . . . . . : BEN.dnvr.uswest.net
DNS Servers . . . . . . . . : 206.196.128.1
Node Type . . . . . . . . . : Broadcast
NetBIOS Scope ID. . . . . . :
IP Routing Enabled. . . . . : No
WINS Proxy Enabled. . . . . : No
NetBIOS Resolution Uses DNS : No
Ethernet adapter :
Description . . . . . . . . : ELNK3 Ethernet Adapter
Physical Address. . . . . . : 00-10-4B-C4-A8-A4
DHCP Enabled. . . . . . . . : Yes
IP Address. . . . . . . . . : 209.180.253.212
Subnet Mask . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . : 209.180.253.254
DHCP Server . . . . . . . . : 172.16.2.180
Primary WINS Server . . . . :
Secondary WINS Server . . . :
Lease Obtained. . . . . . . : 03 01 99 5:58:05 PM
Lease Expires . . . . . . . : 03 01 99 9:58:05 PM
Meanwhile back in Linux
dmesg | grep eth yields
eth0: 3c509 at 0x300 tag 1, 10baseT port, address 00 10 4b c4 a8 a4, IRQ
11.
/proc/ioports and /proc/interrupts show no conflicts
While booting up I also see:
Using DHCP for eth0... done
I am using version 0.70 of dhcpcd.
When I type 'ifconfig' I see
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:3924 Metric:1
RX packets:67 errors:0 dropped:0 overruns:0 frame:0
TX packets:67 errors:0 dropped:0 overruns:0 carrier:0
collisions:0
and when I type 'ifconfig eth0 up' and then 'ifconfig' I also see
eth0 Link encap:Ethernet HWaddr 00:10:4B:C4:A8:A4
unspec addr:[NONE SET] Bcast:[NONE SET] Mask:[NONE SET]
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:48 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0
Interrupt:11 Base address:0x300
I read in the DHCP HOWTO that all you have to do to get dsl to work is in
Control Panel > Network Configurator > Interface tab
edit the eth0 entry so that you see
interface ip proto atboot active
eth0 dhcp yes active
/|\
|
This I can switch to active or to inactive by entering at the command line
using ifconfig eth0 up (or down). The Cisco LAN LED goes on/off when
eth0 is activated/inactivated.
This appears to be as it should be.
I can not ping out but I can ping local (127.0.0.1)
There is nothing in my /etc/dhcpd.leases, /etc/dhcpd.conf or
/etc/dhcpc/resolve.conf files.
I read in the DHCP mini HOWTO that all I need to do edit the eth0 entry in the
Network Configurator (see above). If something else does indeed need to be in
these
files, I do not know what information from the winipcfg (see above) needs to
go where.
If I use ezppp to contact another of my ISPs (*not* dsl) I can get Netscape to
work in Linux but I do not know how to get Netscape (or ncftp) to work with in
Linux with the
dsl.
Any suggestions would be greatly appreciated.
--
Ben Goble Lakewood, Colorado USA
[EMAIL PROTECTED] [EMAIL PROTECTED] [EMAIL PROTECTED]
A Stranger and a Pilgrim on the Earth
--
Ben Goble Lakewood, Colorado USA
bgoble at uswest dot net bgoble at nyx dot net bgoble at chisp dot net
A Stranger and a Pilgrim on the Earth
------------------------------
From: Larry Rivera <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Subject: Re: terminal problem with SCO (from linux)
Date: Sun, 21 Mar 1999 00:45:04 -0400
Ed Weinberg wrote:
>
> On Wed, 10 Mar 1999 22:31:17 +0100, Raymond Doetjes
> <[EMAIL PROTECTED]> wrote:
>
> >If you wanna connect your Linuxbox via RS232 to the SCO server you, then
> >you can use mincom (do you rember telix well this is the Unix version).
> >
> >When you have a LAN then you can just telnet to the SCO server
> >concedering that the telnet deamon is started on the SCO server
>
> Thanks.
>
> Tried that. The problem is sco terminal emulation. Neither the VT or
> the ansi in mincom are close enough to the SCO emulation for their
> application.
>
> -- Ed Weinberg,
> Detel, Inc., An Internet Presence Provider
> [EMAIL PROTECTED]
I have exactly the same problem. I would love to add linux boxen to a
SCO network but terminal emulation has to be scoansi. An entry for this
is included in Slackware's /etc/terminfo.bsd file and I understand you
need to run tic at the SCO end to make it work, since the terminal
"linux" is not recognized by the SCO OS. Anyway, programs that require
the SCO-ANSI display of 80x25, etc. will not be displayed properly or
use some of the same keystrokes. Perhaps some emulation guru out there
can help us both in this.
LR
------------------------------
From: Enbugger <enbugger@usa./NO-SPAM/net>
Crossposted-To: hk.comp.os.linux,hk.comp.pc
Subject: Re: ne.o & 3c509.o compiled ???
Date: Sun, 21 Mar 1999 12:58:52 +0800
You are welcome. ^_^
Would you mind dump your dmesg, lilo.conf, conf.modules here?
You can do it by, e.g.:
dmesg > ne_problem.txt
cat /etc/lilo.conf >> ne_problem.txt
cat /etc/conf.modules >> ne_problem.txt
then send the file ne_problem.txt.
You may be in Windows now. You may have to find a way to get the file
ne_problem.txt in Linux and send it in Windows. If you have difficulty
in doing these, please feel free to contact me.
"¤ñ¥d¶W" wrote:
>
> I am glad to know that you are still going along with me !
>
> Up to now, I'd tried the method by adding append="linux eth0=0x300, 9" to
> the file /etc/lilo.conf.
> I did lilo -v, too.
> But the kernel still cannot detect it.
>
> Enbugger ¼¶¼g©ó¤å³¹ <7d0kfi$117$[EMAIL PROTECTED]>...
> >
> >
> >"¤ñ¥d¶W" wrote:
> >>
> >> would you mind telling me what is initrd image ?
> >> I haven't done this step.
> >> Is it too late for me to do this now ?
> >>
> >
> >initrd image is the image of the "Initial RAM disk" which contains
> >some of the kernel modules that are necessary to boot up the system,
> >e.g. some block devices: SCSI drivers, sound card drivers, etc.
> >
> >> Another Question is that:
> >> How can I obtain the ne.o and 3c59x.o modules for kernel 2.2.3 ?
> >> Can I compile it from /usr/src/linux-2.2.3/drivers/net/3c59x.c
> >> and /usr/src/linux-2.2.3/drivers/net/ne.c
> after
> >> built kernel ?
> >> How to compile ?
> >
> >As you stated in your past messages, you have built the modules _INTO_
> >the kernel image, i.e. bzImage.
> >
> >If you _do_ want to build them as loadable modules instead, you can do:
> > make xconfig <OR> make config <Whatever you want>
> > Select the drivers: NE2000 and 3C59x as modules [M] (instead of [Y])
> > make modules
> > make modules_install
> >
> >However, please refer to my last message. In it, you can find a way
> >to force the kernel to detect your NE2000.
> >
> >Ref.
> >news:7cuasi%2478c%241%40imsp009a.netvigator.com
> >
> >> Enbugger ¼¶¼g©ó¤å³¹ <7ctuhj$kss$[EMAIL PROTECTED]>...
> >> >Have you re-built the initrd image by using
> >> >mkinitrd ?
> >> >
> >> >If you have set
> >> >[Y] in both 3com NIC support and NE2000
> >> >[Y] Enable IPv4 packet forwarding
> >> >when building the kernel, they are already
> >> >compiled into the kernel image.
> >> >
> >> >You can check the eth drivers by
> >> >dmesg |grep eth
> >> >
> >> >Can you actually use the ethernet by running the
> >> >new kernel?
> >> >
> >> >
> >> >
> >> >HTH
> >> >
> >> >"¤ñ¥d¶W" wrote:
> >> >>
> >> >> I have done this la !
> >> >>
> >> >> Enbugger ¼¶¼g©ó¤å³¹ <7ctncl$l52$[EMAIL PROTECTED]>...
> >> >> >I am not sure if you are using RedHat.
> >> >> >If you are, please refer to this document for
> >> >> >version 2.2 kernel upgrade:
> >> >> >
> >> >>
> >http://www.redhat.com/support/docs/rhl/kernel-2.2/kernel2.2-upgrade.html
> >> >> >
> >> >> >Hints:
> >> >> >Have you done:
> >> >> > make modules
> >> >> >and
> >> >> > make modules_install
> >> >> >?
> >> >> >
> >> >> >"¤ñ¥d¶W" wrote:
> >> >> >>
> >> >> >> Before, I haven't build the kernel.
> >> >> >> I need to prepare the file /etc/conf.modules:
> >> >> >>
> >> >> >> alias eth0 ne
> >> >> >> options ne io=0x300
> >> >> >> alias eth1 3c59x
> >> >> >>
> >> >> >> And today, I try to build the kernel.
> >> >> >> I have chosen the [Y] in both 3com NIC support and NE2000 support.
> >> >> >> So, I won't got this two modules(ne.o and 3c59x.o) any more during
> >> >> building.
> >> >> >> Then, the problem happened !!!
> >> >> >> On starting:
> >> >> >> ...
> >> >> >> Enable IPv4 packet forwarding.
> >> >> >> modprobe: can't locate module net-pf-5
> >> >> >> ...
> >> >> >> eth1: unknown interface. (NE2000 NIC change from eth0 to eth1)
> >> >> >> modprobe: can't locate module net-pf-5
> >> >> >>
> >> >> >> What's more, I try to copy back the files:
> >> >> >> ne.o to /lib/modules/2.2.3/net/ne.o
> >> >> >> 3c59x.o to /lib/modules/2.2.3/net/3c59x.o
> >> >> >>
> >> >> >> Then the system report:
> >> >> >> ...
> >> >> >> modprobe: can't locate module net-pf-5
> >> >> >> insmod: /lib/modules/2.2.3/net/3c59x.o: kernel module version
> mismatch
> >> >> >> /lib/modules/2.2.3/net/3c59x.o was compiled for kernel
> >> >> version
> >> >> >> 2.0.36 while this kernel is version 2.2.3.
> >> >> >> eht1: unknown interface.
> >> >> >> modprobe: can't locate module net-pf-5
> >> >> >> ...
> >> >> >>
> >> >> >> What should I do now, is that supports been compiled to kernel yet
> ???
> >> >> >> I have chosen [Y] for these 2 NIC support already !!!
> >> >> >> Would you please offer your Kindly Help ?
> >> >> >
> >> >> >--
> >> >> >Enbugger
> >> >> >
> >> >> >p.s. Remove /NO-SPAM/ for e-mail.
> >> >
> >> >--
> >> >Enbugger
> >> >
> >> >p.s. Remove /NO-SPAM/ for e-mail.
> >
> >--
> >Enbugger
> >
> >p.s. Remove /NO-SPAM/ for e-mail.
--
Enbugger
p.s. Remove /NO-SPAM/ for e-mail.
------------------------------
** FOR YOUR REFERENCE **
The service address, to which questions about the list itself and requests
to be added to or deleted from it should be directed, is:
Internet: [EMAIL PROTECTED]
You can send mail to the entire list (and comp.os.linux.networking) via:
Internet: [EMAIL PROTECTED]
Linux may be obtained via one of these FTP sites:
ftp.funet.fi pub/Linux
tsx-11.mit.edu pub/linux
sunsite.unc.edu pub/Linux
End of Linux-Networking Digest
******************************
