Re: is nocat working properly?

David

I'm not sure how this works in nocat with the two separate layers of 
users, in my configuration you are granted full user access, or you are 
not and therefore only allowed to access my websites.

However in iptables I would probably approach it to write and specific 
rules to your initialize.fw script for the specific access class that 
specifically say 80/443 are permitted and everything else is dropped.

something like:

$ports - p tcp -i $iface --dport 80 -m mark --mark 3 -j ACCEPT
$ports - p tcp -i $iface --dport 443 -m mark --mark 3 -j ACCEPT

(I'm not exactly sure if 3 is co-op or public class - might wanna check 
that)


However, I too am not exceedingly familiar with IPtables, I just have a 
basic knowledge of it and I have found this, albeit old, tutorial pretty 
helpful: http://iptables-tutorial.frozentux.net/iptables-tutorial.html

best

chris


David Bowman wrote:

> Thanks Chris!
>  
> My GatewayMode  is Passive
>  
> I am using the default login page.  (with the "skip" button)
>  
> I can also login at that point with a user account, and have full access on all ports.
>  
> Is this the default behavior of nocat or is my setup not running right:
> "skip" users have only access to the domain of their homepage.
> "logged in" users have full access.
> 
> I would like to limit access for logged in users (co-op class correct?) to just 
> ports 80, 443.  I would then disallow skipping.  (Just my preference for experimentation)
>  
> I found that if I changed initialize.fw to attempt to limit access for 
> "logged in users" (class 2 users) I ended up making it behave like a 
> "skipped" user (class 3 user)  I could only hit my homepage. 
>  
> I have IncludePorts = 80 443
>  
> If I change the initialize.fw script like the following:
> #Enable all ports in IncludePorts
> for iface in $IncludePorts; do
>   $ports - p tcp -i $iface --dport $port -m mark --mark 3 -j ACCEPT
>   $ports - p udp -i $iface --dport $port -m mark --mark 3 -j ACCEPT
>   $ports - p tcp -i $iface --dport $port -m mark --mark 2 -j ACCEPT
>   $ports - p udp -i $iface --dport $port -m mark --mark 2 -j ACCEPT
> (added last two lines for class 2)
> 
> farther below...in initialize.fw:
>  
> # ...and disable access to the rest.
>   $ports - p tcp -i $iface --dport $port -m mark --mark 3 -j DROP
>   $ports - p udp -i $iface --dport $port -m mark --mark 3 -j DROP
>   $ports - p tcp -i $iface --dport $port -m mark --mark 2 -j DROP
>   $ports - p udp -i $iface --dport $port -m mark --mark 2 -j DROP
> (added last two lines for class 2)
>  
> Then I restart the gateway, and I login with a username and password, 
> I end up with the same access level as a "skipped" user.  
> (I can only browse my homepage)
>  
> This access level is 3 correct? (public class)
>  
> What I don't understand is where the rules are being created to limit my access 
> to just my homepage. (the first page I hit)
>  
> I'm new to tweaking firewall rules in linux.  The way I'm reading the statements 
> in initialize.fw it seems that I should be able to browse ANY website on ports 80 and 443
>  
> My goal is to be able to allow logged in users (co-op) to be able to browse webpages only.
>  
> I must be missing something.  Thanks for any help.
> David
>  
> chris neitzert <[email protected]> wrote:
> David
> that depends, how is your NoCat configured (see nocat.conf)
> # GatewayMode -- Determines the mode of operation of the gateway. Possible
> # values are:
> #
> # Captive - Allow authentication against an auth service. LEGACY.
> # Passive - Like Captive, but YOU MUST USE THIS if your gateway
> # is behind a NAT. Will work anyway if not. *RECOMMENDED*.
> # Open - Simply require a user to view a splash page and accept
> # a use agreement.
> and if you are using login or login_no_skip
> What i've done on my portal is to remove the skip button from the forms 
> on all of login pages and symbolicaly link everything to the 
> login_no_skip page.
> chris
> 
> David Bowman wrote:
> 
>>I have nocat .82 gateway and auth on same machine (running fc2) Just experimenting with nocat. 
>>
>>When I click on "skip" at the login page, I get redirected to my homepage (www.google.com set in browser). But at that point I can only browse pages on that domain. (www.google.com)
>>
>>Does anyone know if this is the default behavior of the nocat system with .82???
>>
>>Or should I be able to browse any website (after clicking "skip") on ports 80 and 443???
>>
>>Just a confirmation would be much appreciated so I can do further work with nocat.
>>Thanks.
>>
>>
>>
>>__________________________________________________
>>Do You Yahoo!?
>>Tired of spam? Yahoo! Mail has the best spam protection around 
>>http://mail.yahoo.com 
>>
>>
>>------------------------------------------------------------------------
>>
>>_______________________________________________
>>NoCat mailing list
>>[email protected]
>>http://lists.nocat.net/mailman/listinfo/nocat
> 
> 
> 
> 		
> ---------------------------------
> Do you Yahoo!?
> vote.yahoo.com - Register online to vote today!