Re: Chroot feature on proxy-suite

On Mon, Jul 22, 2002 at 04:53:29PM -0400, Ruiyuan Jiang wrote:
> Hi, Marius and all
> 
> I have another question. When I compiled proxy-suite, I enabled TCP Wrapper.
> Since Solaris 9 comes with TCP Wrapper, I used TCP Wrapper from the OS. I
> used configure utility of proxy-suite:
> 
> $ cd proxy-suite source directory
> $ ./configure --prefix=/opt/ftp-proxy --sysconfdir=/etc --enable-warnings
> --enable-so-linger --with-libwrap=/usr/sfw/lib --with-libldap=/usr/lib
> --with-crypt=/usr/lib
> 
> In the /etc/hosts.allow, I have a line:
> ftp-proxy: IPaddress1, IPaddress2, IPaddress3
> 
> In the ftp-proxy.conf file, I removed comment of the line "TCPWrapperName
> ftp-proxy" and removed the comment from line "TCPWrapper	yes". Also I
> enabled "AllowMagicUser" and "AllowTransProxy".
> 
> I tried to ftp to the box from my HP-UX workstation which IP address is not
> in the /etc/hosts.allow file (I don't have /etc/hosts.deny file on the ftp
> proxy server). 
> 
> $ ftp ftp-proxy.liz.com
> Connected to ftp-proxy.liz.com
> 220 ftp-proxy FTP server (Version 1.9 - 2002/05/02 15:14:55) ready.
> Name (HP workstation:ryan): [email protected]
> 331 Password required fro anonymous.
> Password:
> ...
> 
> My question is: Does my ftp proxy server supposes to reject my HP-UX
> workstation to connect to it? As a fact, when I tried to start ftp-proxy as
> a standalone daemon and TCP Wrapper libray not in my library path, it said
> can't find libwrap.so.1 and refuse to start which I guess ftp proxy needs
> TCP Wrapper lbrary to start.

You have to copy libwrap.so.1 as well as /etc/hosts.{deny,allow}
into the chroot as well.

The proxy can't access any files from outside of the chroot...

You may use the trace ulitilies (like strace, ptrace, ltrace
or whatever they are called on the system) to see what fails.

Gruesse,
 Marius Tomaschewski <[email protected]>
--
 SuSE Linux AG, NÃŒrnberg - SuSE Labs, Product Developement
 PGP public key available:   http://www.suse.de/~mt/mt.pgp
 Fprint:  EA 1F 92 75 1A F9 82 07  A1 28 DE 7A 32 E8 97 18

---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]