Subject: Re:

From: Preston Hogue <[email-masked]>
Date: Fri, 7 Jan 2000 09:20:38 -0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

    I am currently using a product call Webshield for Solaris (2.6).  When
I purchased this product NAI told me that they created a mail relay that
virus scans.  Well come to find out the mail relay is none other than fwtk's
smap.  So my question is: does Network Associates have a sub-license to use
your product. The main reason I am asking this question is, because NAI is
clueless to how it works.  If it is sub-licensed I am hoping that you guys
can help me.  I have set up a split fire DNS configuration on my network.  I
have the outside DNS MX records pointing to the Webshield box (running smap)
and the Webshield box /etc/resolv.conf file points to my inside DNS box.
The inside DNS MX record points to my Sendmail server.  The problem is that
the Webshield box is not passing it on to the Sendmail box.  It places the
mail on the local box with out any attempt to pass it on.  If you guys can
be of any assistance, I would greatly appreciate it.

Thank you,
Preston Hogue

---

From: Rick Murphy <[email-masked]>
Date: Fri, 07 Jan 2000 17:05:04 -0500

At 09:20 AM 1/7/00 -0800, Preston Hogue wrote:
>your product.

Network Associates OWNS the firewall toolkit. They can do what they want 
with it :-) (NAI bought TIS).

>  The main reason I am asking this question is, because NAI is

Your sendmail configuration on the firewall is wrong. Normally smap expects 
the sendmail on the firewall to pass all mail destined for your domain to 
an internal mail server. My rule 0 has
R$*<@$*$N>$*    $#smtp $@$R $:$1<@$2$N>$3       our domain

where $N is my domain, $R is the internal mail server.
         -Rick

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 13 Jan 2000 12:53:09 -0500

> be of any assistance, I would greatly appreciate it.

I wish your e-mail had a subject line.  I am several days behind on
various "non-critical" e-mail threads, and I have no idea whether
anybody has responded to you.

The FireWall ToolKit [FWTK] was a free toolkit put out by Trusted
Information Systems [TIS] with which knowledgeable netgineers could put
together firewalls like, but not as good as, TIS Gauntlet, which also
uses an enhanced version of 'smap'.

Network Associates, Inc. [NAI] bought TIS a good while ago.

No, NAI does not have a sub-license.  They OWN the bloody thing.
Although they obviously do not own all of the knowledge about it - they
let a lot of it leave, and the rest is clearly not percolating well
into the previously-MSW-oriented base of NAI.

If your WebShield's 'smapd' is configured to pass it to local
'sendmail', then the "sendmail.cf" file must be set up to pass ALL mail
for your internal domain to your internal server.  This is NOT the
default setup for Solaris.  You may want to check out the instructions
for your WebShield, if NAI thought to copy over the instructions that
come with TIS Gauntlet.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: Jennifer Tippens <[email-masked]>
Date: Thu, 13 Jan 2000 13:20:46 -0600

Hello,
We are using the fwtk and I was asked to find a RealAudio proxy for our system.
I downloaded the Real Time Streaming Protocol Proxy reference implimentation.  I
compiled and "installed" it.  That worked fine, but now how do I configure it for
use?  I gave it my (several times) best guess and this is what I came up with
(which doesn't work)

Added in netperm-table:
rtsp: permit-hosts 192.168.1.* -exec /usr/local/sbin/rtspd

Added in /etc/services:
rtsp:    554/tcp

Added in inetd.conf:
rtsp    stream    tcp    nowait    root    /usr/local/sbin/rtspd    rtsp

I have no idea what I'm supposed to do with it-- I have looked everywhere for
some (anything) information, contacted RealAudio, got on the
comp.security.firewalls newsgroup, read a book and I have gotten nowhere and
found nothing except a vague reference on the patches and add-ons page for fwtk
that says to download the rtspd proxy kit.  Am I even close?  Please help.

Thank you,
Jennifer

---

From: Ted Keller <[email-masked]>
Date: Thu, 13 Jan 2000 19:50:12 -0500 (EST)

Jennifer,

The rstpd reference proxy is just that - a reference proxy.  It does not
have the support required for enable/disable connections.  It permits all
connections - both inbound and outbound. - not good.

Modifing this code is a bit tricky - unless you are really good....

To get around this, I  "socksified" it - and ran it on an internal server
- using a socks5 gateway with the connection rules defined.  you may want
to consider a similar approach.

Note - socks5 is important since the proxy opens udp connections for the
content transfer.

ted keller