Re: is nocat working properly?

Thanks Chris!
 
My GatewayMode  is Passive
 
I am using the default login page.  (with the "skip" button)
 
I can also login at that point with a user account, and have full access on all ports.
 
Is this the default behavior of nocat or is my setup not running right:
"skip" users have only access to the domain of their homepage.
"logged in" users have full access.

I would like to limit access for logged in users (co-op class correct?) to just 
ports 80, 443.  I would then disallow skipping.  (Just my preference for experimentation)
 
I found that if I changed initialize.fw to attempt to limit access for 
"logged in users" (class 2 users) I ended up making it behave like a 
"skipped" user (class 3 user)  I could only hit my homepage. 
 
I have IncludePorts = 80 443
 
If I change the initialize.fw script like the following:
#Enable all ports in IncludePorts
for iface in $IncludePorts; do
  $ports - p tcp -i $iface --dport $port -m mark --mark 3 -j ACCEPT
  $ports - p udp -i $iface --dport $port -m mark --mark 3 -j ACCEPT
  $ports - p tcp -i $iface --dport $port -m mark --mark 2 -j ACCEPT
  $ports - p udp -i $iface --dport $port -m mark --mark 2 -j ACCEPT
(added last two lines for class 2)

farther below...in initialize.fw:
 
# ...and disable access to the rest.
  $ports - p tcp -i $iface --dport $port -m mark --mark 3 -j DROP
  $ports - p udp -i $iface --dport $port -m mark --mark 3 -j DROP
  $ports - p tcp -i $iface --dport $port -m mark --mark 2 -j DROP
  $ports - p udp -i $iface --dport $port -m mark --mark 2 -j DROP
(added last two lines for class 2)
 
Then I restart the gateway, and I login with a username and password, 
I end up with the same access level as a "skipped" user.  
(I can only browse my homepage)
 
This access level is 3 correct? (public class)
 
What I don't understand is where the rules are being created to limit my access 
to just my homepage. (the first page I hit)
 
I'm new to tweaking firewall rules in linux.  The way I'm reading the statements 
in initialize.fw it seems that I should be able to browse ANY website on ports 80 and 443
 
My goal is to be able to allow logged in users (co-op) to be able to browse webpages only.
 
I must be missing something.  Thanks for any help.
David
 
chris neitzert <[email protected]> wrote:
David
that depends, how is your NoCat configured (see nocat.conf)
# GatewayMode -- Determines the mode of operation of the gateway. Possible
# values are:
#
# Captive - Allow authentication against an auth service. LEGACY.
# Passive - Like Captive, but YOU MUST USE THIS if your gateway
# is behind a NAT. Will work anyway if not. *RECOMMENDED*.
# Open - Simply require a user to view a splash page and accept
# a use agreement.
and if you are using login or login_no_skip
What i've done on my portal is to remove the skip button from the forms 
on all of login pages and symbolicaly link everything to the 
login_no_skip page.
chris

David Bowman wrote:
> I have nocat .82 gateway and auth on same machine (running fc2) Just experimenting with nocat. 
> 
> When I click on "skip" at the login page, I get redirected to my homepage (www.google.com set in browser). But at that point I can only browse pages on that domain. (www.google.com)
> 
> Does anyone know if this is the default behavior of the nocat system with .82???
> 
> Or should I be able to browse any website (after clicking "skip") on ports 80 and 443???
> 
> Just a confirmation would be much appreciated so I can do further work with nocat.
> Thanks.
> 
> 
> 
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around 
> http://mail.yahoo.com 
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> NoCat mailing list
> [email protected]
> http://lists.nocat.net/mailman/listinfo/nocat


		
---------------------------------
Do you Yahoo!?
vote.yahoo.com - Register online to vote today!

_______________________________________________
NoCat mailing list
[email protected]
http://lists.nocat.net/mailman/listinfo/nocat