Subject: RE: First impression of T.Rex

From: Tony Mai <[email-masked]>
Date: Tue, 29 Feb 2000 01:27:32 -0500 (EST)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi Bill. I for one would like to read your How-to document when it is ready.

However, an intro/eval of the product would be super at this time since I am
(and I am pretty there are plenty of others) would be more interested in
learning if this product is 'like you said' usable.

If you're hestitate about posting T-Rexx related message to this board,
please email me directly at [email-masked]. I know that may be a lot to
ask but I would greatly appreciate the help since I am new at this
application proxy/firewall stuffs.

Best regards,
Tony Mai

------Original Message------
From: Bill Kocik <[email-masked]>
To: [email-masked]
Sent: February 28, 2000 3:39:46 AM GMT
Subject: First impression of T.Rex

[To be removed from this list send the message "unsubscribe fwtk-users" in
the
BODY of a mail message to [email-masked].]

Hi all,

I've spent the last three days fiddling with a copy of the T.Rex
source code. Just a quick first impression:

It won't compile on Solaris 7 x86, so unless you're really good
at trouble-shooting compile problems and fixing code, I wouldn't
try it on that platform. Of course, noone ever told me it
*would*, but I tried it anyways since it's reported to compile on
2.6. (HINT: Modifying 100/src/include/firewall.h will get you
past step 1). If anyone does get it to run on Sol7 x86, I'd love
to hear your story.

It will build on Red Hat Linux 6.1. A friend of mine reports to
have built it with virtually no problems. I had to tweak a few
things, but nothing major.

The documentation has some errors. If you plan to run this, plan
on reading Makefiles, and plan on working past a lot of errors in
the documentation. A couple of hints: Four of the keys you're
told to change are *not* random alphanumeric strings as the
documentation says (two of the six keys you need to change are,
four are not), they're 4-byte hex values and must be treated as
such unless you really have a thing for compiler errors like
"numeric constant contains digits beyond the radix". Also, when
you try to create your first user or group and you can't figure
out why "gwuser.dir" doesn't exist or where it's supposed to come
from, the answer is "gwuser -c". If following the included
README.build file actually works, consider it a stroke of luck.

There is typically a fine line firewalls must walk between having
an ultra-secure network, and having a usable network. In my
opinion (read that carefully: this is just my opinion) T.Rex
crosses over that line in a couple of ways. For example, if you
want to do authenticated FTP you're going to have to get a
CryptoCard (or one of a couple of other similar products which
are also supported). I can see this being an option...but with
T.Rex you *can't* authenticate to the FTP proxy without one. Same
goes for ptelnet (their encrypted telnet proxy).

In all, though, it seems to be quite a feature-rich package,
especially when you consider it's free if you don't mind
compiling it yourself. The documentation could sure use some
fixing, though.

Just my $.02. Anyone else have anything to contribute? (By the
way, I know this is the FWTK mailing list, but I saw a few other
posts about T.Rex so I figured I'd go ahead and share my
experience with you all...sorry if you think I shouldn't have.)

Also, if anyone's really interested in it, I might see if I have
time over the coming days/weeks to put together a comprehensive
how-to for building and installing the thing on Red Hat Linux
6.1. Lemme know if you'd like a copy. If there's enough interest
it might inspire me to get the thing done (anyone from Freemont
Avenue listening? It's okay for me to do that, right?).

--
Bill Kocik
Taos Mountain - "The Sys Admin Company"
Santa Clara, California
http://www.taos.com

.................................................................................
iWon.com     http://www.iwon.com     why wouldn't you? 
.................................................................................

---

From: [email-masked] (James Seymour)
Date: Tue, 29 Feb 2000 08:11:25 -0500 (EST)

> Message-ID: <[email-masked]>
> Date: Tue, 29 Feb 2000 01:27:32 -0500 (EST)
> From: Tony Mai <[email-masked]>
> Subject: RE: First impression of T.Rex
> 
[snip]
> learning if this product is 'like you said' usable.

Looks "usable" to me.  A few initial random observations/thoughts...

Built, installed and configured on a Dell PowerEdge 1300 running RH
Linux 6.1.  I've a terse list of build/install documentation errata
that may smooth the road.  (I've already sent 'em in to FAS, so maybe
the main docs will soon be corrected.)  Otherwise built cleanly with no
untoward problems.

The telnet and ftp proxies are not transparent.  The HTTP proxy, which
would appear to have been built atop a lobotomized Apache, is.  Haven't 
fooled with the other proxies yet.  (Don't know when or if I will.  
Don't really need 'em, myself.)

It's paranoid.  Once it's fully installed as per the instructions, you
cannot telnet into it even from the "trusted" network.  Except with
ptelnet.  Which, of course, requires that you build/install ptelnet
clients on each machine from which you wish to login to the firewall.
And using ptelnet: not only are you not allowed to log in as root--you
can't "su" to root, either.  A little *too* paranoid for me: I chose
instead to install OpenSSH.

It's got something called "fwmon" that I have not looked into
thoroughly yet.  It would appear to be a daemon that wakes up at
scheduled intervals and checks the integrity of the "core system." (I'm
running the old familiar tripwire as well anyway.)  I'm gonna figure
out a way to trigger it to see what happens :-).

For SMTP, it runs a separate smtpd daemon like FWTK/Gauntlet does--
with something called "smwrapd."  (I just out-right replaced the whole
shootin' match with Postfix, just like I did on my Gauntlet
firewall--so this was a non-issue for me.)

It doesn't config/work at all like Gauntlet/FWTK.  (I've been running
Gauntlet for several years now.  And will likely [?] continue to do
so.  This is a new firewall for a new location.)  But like those:  it's
"componentized."  So the neat thing is: you can pick-and-choose which
components you want to use, which not, and which, if any, you might
want to replace with alternatives.  (Like I did.)  I don't see any
particular reason why, for example, one couldn't create a hybrid from
T.REX and FWTK--choosing the combination of components that they felt
best suited their needs.  (I think somebody noted that they already
snagged the RPC proxy and got it to fly "stand-alone".  One would
assume on a FWTK-based firewall.)

I've got one more custom piece to install, then I'm going to spend the
remainder of the week hammering it with the likes of nmap, fine-tuning
it, cleanup, etc.  If it all works out, off it goes to the vict^H^H^H^H
target site.

> If you're hestitate about posting T-Rexx related message to this
[snip]

Nobody's objected so far.  T.REX's mailing list is *supposed* to be up 
tomorrow anyway.

Regards,
Jim
-- 
Jim Seymour                         | Medar, Inc.
[email-masked]                  | 24775 Crestview Ct.
Systems & Network Administrator     | Farmington Hills, MI. 48335
                                    | FAX: (248)477-8897

---

From: Tony Mai <[email-masked]>
Date: Tue, 29 Feb 2000 18:28:29 -0500 (EST)

Thanks James.

Can I have that errata note from your? I'm going to try to build starting
tonight. Please keep us posted with your findings...

Much appreciated.
Tony Mai

------Original Message------
From: [email-masked] (James Seymour)
To: [email-masked]
Sent: February 29, 2000 1:11:25 PM GMT
Subject: RE: First impression of T.Rex

[snip]

[snip]

Regards,
Jim