Subject: "Newbie tries to make toolkit - fails", Part 2

From: "Karen Ellrick" <[email-masked]>
Date: Fri, 14 Jul 2000 21:19:54 +0900

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hi all!

Thanks to John Armstrong's prompt response, I learned how to capture the
output of make, and the mess is attached as a .txt file.  My original
message is below, in case someone didn't get it.  Thanks in advance for any
help you can give me.

--------------------------------
Karen Ellrick
S & C Technology, Inc.
1-21-35 Kusatsu-shinmachi
Hiroshima  733-0834  Japan
(from U.S. 011-81, from Japan 0) 82-293-2838
--------------------------------

ORIGINAL MESSAGE:

This is probably a dumb question to most of you, but please bear with me.  I
downloaded the toolkit, unzipped and untarred it, and as best I could tried
to follow the directions in the README file for running make (since I am on
Linux, I copied Makefile.config.linux to Makefile.config).  But I get a huge
stream of "No such file or directory" errors when I run make.  (I would love
to attach a list of the output for you to see, but I don't know how to
redirect stderr to a file, either - so much to learn!)  Anyway, regarding
the solution, I know I could start looking through the makefile line by
line, and search to see if each needed include file is on my system
somewhere (some of them I even recognize from my C programming days way back
when), but I suspect that there's one simple thing I missed that would make
it work the way it is (like run it from a certain directory or something),
rather than looking for and retrieving each of dozens of files one by one.
Anybody immediately know what I did wrong?

Karen the Clueless

---

From: Rick Murphy <[email-masked]>
Date: Sat, 15 Jul 2000 19:11:53 -0400

At 09:19 PM 7/14/00 +0900, Karen Ellrick wrote:
By now, you've probably figured out that you forgot the attachment. 
However, seeing the below:
>I copied Makefile.config.linux to Makefile.config).  But I get a huge
>stream of "No such file or directory" errors when I run make.
You probably are missing the C header files (/usr/include/stdio.h, 
/usr/include/sys/socket.h , for example.) If you don't have those, install 
the programming subsets from your OS distribution. Otherwise, let us know 
what files are missing and we may be able to help. Please note that FWTK is 
rather novice hostile.
         -Rick

---

From: "Dan and Karen Ellrick" <[email-masked]>
Date: Sun, 16 Jul 2000 22:54:16 +0900

> However, seeing the below:
I'm not at work now to be able to confirm, but I'm pretty sure I didn't
forget the attachment.  However, I am not sure whether attached files make
it through the mail group system unscathed - perhaps only my main message
was re-distributed to everyone.  I even wondered about that at the time I
sent it.

 > /usr/include/sys/socket.h , for example.)
That fits the symptoms.  Do they all need to be in the same directory where
I am compiling? - surely not!

 > If you don't have those, install
 > the programming subsets from your OS distribution.
That runs into a different problem that has been handicapping me all along.
After the installation process (which, of course, uses the CD-ROM) is
completed, I have not been able to mount the CD-ROM drive on any of the
three machines I have installed RedHat 6.1 on, which is obviously very
frustrating.  It says that "/mnt/cdrom is not recognized as a block device",
an error I do not know the meaning of.  All I know to do is ensure that the
entry in /etc/fstab looks right, and as far as I know, "right" means it
resembles lots of examples I have seen in books or on the web for mounting
CD-ROM file systems.  I have a variety of "little" problems like this with
the servers I'm trying to set up, and unfortunately all the man pages,
third-party books, etc. seem to assume things are generally working
correctly after a fresh OS install, and so they only talk about doing new
things.

 > Otherwise, let us know
 > what files are missing and we may be able to help.
Too numerous to list - lots and lots of header files.  That's why I said I
thought it was one, more fundamental thing I was doing wrong.  I did select
"kernel development" when I installed Linux, so I have been assuming the
normal header files were installed somewhere (after all, the compiler is
there!).  But maybe that's giving RedHat (and myself, as the one who
"drives" the installation) too much credit! :-/

 > Please note that FWTK is rather novice hostile.
If I have no business using it, I wouldn't be surprised to hear it.  I
really don't have any business doing any of the things I'm currently up to
my elbows in, but there is no one else available to do it and no one locally
I can even consult with (the job is essentially reconfiguring the network of
a dozen-person company to include a firewall and several new services).
What I thought I wanted from FWTK is smap, as it was recommended as a good
security measure to "wrap around" sendmail on our bastion host.  But maybe
it's more trouble than it's worth - I haven't yet figured out how to
configure sendmail itself (the new aspect from our current setup being that
the bastion host is to simply pass the mail to another server rather than
housing our mailboxes), and smap would just add to the complexity.  At first
I thought that smap could replace sendmail for simple store-and-forward
setups, but apparently that's not true.  It's frustrating when I consider
that any one of the people reading this mailing list, and a variety of
others I've consulted with, could probably set up our little network in less
than a day.  Instead I chew up hours of time slogging through a dozen books,
semi-constant web searches, e-mail consultations, etc. to find each clue.  I
am an electrical engineer by training, have extensive programming
experience, and have been a lover of Unix (as a user) every since college,
but prior to starting this project I had no experience with the system admin
and security side of things, and I had no idea how hard it would be.
Anyway, sorry I went off on a tangent whining about my challenges.  I guess
my main point is, am I right in my current thinking that smap, although
perhaps improving security, will not make the configuration any simpler but
actually more complex, and that I should consider dropping, for now, the
idea of using it?

Thanks for your help,
Karen

P.S. In case you're wondering why the address is different than my previous
messages, I get my work mail at home also, and so I'm answering from home
this time, because I won't go to work again until Wednesday.  It's best to
write to my work address, so I have the info there where I can use it
([email-masked]).

---

From: Joseph S D Yao <[email-masked]>
Date: Mon, 17 Jul 2000 15:54:18 -0400

> I am compiling? - surely not!

No.

You will typically find them in /usr/include and its sub-directories.

...
> correctly after a fresh OS install, and so they only talk about doing new

You appear to be trying to mount /mnt/cdrom on some directory
[/cdrom?], instead of mounting /dev/cdrom.  The "device special files"
are all in /dev/ and its subdirectories.

I hope this provides enough information to help you.

Different distributions call the device different things.  On a
slightly older Linux box with a SCSI CD-ROM drive, I have:

/dev/scd0		/cdrom		iso9660	defaults,ro	0 0

On a more recent Red Hat distribution, there is:

/dev/cdrom		/mnt/cdrom	iso9660	noauto,owner,ro	0 0

...
> "drives" the installation) too much credit! :-/

You don't need the kernel development subset to do normal development,
so the normal header files are not included.

You can check which header files are found in which RPM package:
bash$ rpm -q -f /usr/include/stdio.h
glibc-devel-2.1.3-15

> a dozen-person company to include a firewall and several new services).

;-)  Welcome to Total Immersion System Administration.  It is a very
poor but extremely common way companies have of re-using valuable
personnel in tasks for which they have no training.  ;-(

> housing our mailboxes), and smap would just add to the complexity.  At first

Smap is an extremely good idea.  You do NOT want 'sendmail' to talk to
the 'Net directly, especially if you are not skilled at configuring it
for security.  [Of course, download the latest version and compile and
load it, and security will be greatly increased.  ;-)]  Smap only adds
a small degree of complexity to the configuration.

You never want ANY user services on the bastion host.  They should all
be on internal servers.  Mailboxes are a prime example.  The only
things running on the bastion host should be those processes having to
do with being a firewall.

> setups, but apparently that's not true.  ...

Quite.  Smap/smapd form the network proxy.  Sendmail is still the prime
mail transfer agent [MTA], although 'postfix' can do many of the more
common mail transfer things more simply.

-- 
Joe Yao				[email-masked] - Joseph S. D. Yao
COSPO/OSIS Computer Support					EMT-B
-----------------------------------------------------------------------
This message is not an official statement of COSPO policies.

---

From: "Karen Ellrick" <[email-masked]>
Date: Wed, 19 Jul 2000 15:52:40 +0900

Thank you to all the folks who told me I goofed, and my apologies.  I only
work two days a week, so I couldn't check on it until today, but I did
indeed fail to attach the attachment.  This time, here it is.  I'm very
encouraged by the number of people reading this mailing list and willing to
help!

I searched for the first few files that make complained about, and found
most of them in /usr/lib/bcc/include.  I found syslog.h in the fwtk
heirarchy (...fwtk/tools/server/syslog/).  I'm glad they were already on my
system, considering that I currently can't get at my CD-ROM drive to rpm
them.  So now how do I tell make where to find these files?

Now, to respond to a couple specifics in Joe Yao's response:

> > ...I have not been able to mount the CD-ROM drive on any of the
> > three machines I have installed RedHat 6.1 on...

It doesn't matter - "mount /dev/mcd" and "mount /mnt/cdrom" give me the same
error.  The entry in my fstab is:
   /dev/mcd    /mnt/cdrom   iso9660   ro,owner,noauto  0 0
And this is the exact wording of the error I get:
   mount: the kernel does not recognize /dev/mcd as a block device
         (maybe 'insmod driver'?)
I understand that the part in parentheses is supposed to be a hint for
troubleshooting, but it's difficult to be sure which of the eleven CD-ROM
driver files I found is the right one.  Since my device file is /dev/mcd,
and I know I have a Mitsumi CD-ROM drive, today I tried typing "insmod mcd".
I got the error:
   Init failed. No mcd device at 0x300 irq 11
   ./mcd.o: init_module: Device or resource busy
Then I remembered that at installation time I had to specify parameters of
"0x340,11", so I suspect there is a possibility that if I could specify
0x340 instead of 0x300 in this case, it might work.  But the man page didn't
say how parameters go in the command line (after an option flag? after a
space?).  I tried "insmod mcd 0x340,11" but it just hung with no feedback
(even in verbose mode).  That's when I ran out of ideas on my own.  Any
clues?  [Sorry that this is off-topic for this discussion group, but I doubt
there's a discussion group for such a basic thing as accessing your hardware
([email-masked]? - probably not!).]

> load it, and security will be greatly increased.  ;-)]

I did, but I have the same problem compiling it (and a dramatically longer
spewing of error messages!).

> do with being a firewall.
I know - that's why I have to learn how to configure sendmail.  Currently we
have a single server happily handling our mail, but now that we're adding a
firewall I need to configure two hosts - the one inside the firewall would
have the mailboxes, and the one on the bastion host would send mail in and
out - as a sort of proxy.  It will have no user accounts on it - only stuff
for the world (http, dns, and the mail forwarding).  I would think that this
has been done thousands of times before and that there would be examples out
there of how to configure the two, especially since our network is really
small and really simple.  But I can't seem to find anything like that, so
I'm slogging through O'Reilly's Sendmail book and getting dizzy.

> common mail transfer things more simply.

You're the second person to mention postfix in the last 24 hours or so.  But
I've never heard of it before - even when I recently attended a SANS
conference with all kinds of training about firewalls, good and bad network
services, etc.  Has it been out there enough to be security tested by the
wild wild west?

Thanks for all the friendly advice!

Karen

---

From: Joseph S D Yao <[email-masked]>
Date: Wed, 19 Jul 2000 11:13:16 -0400

(1) Go to www.redhat.com and sign up in the "how to install my fool
Linux" mailing list.  No, it has a different name, but you'll recognize
it.  ;-)

(2) Sendmail has 20 years of experience behind it.  Postfix has but a
few.  I have no experience with it.  But it was designed "with security
in mind" by one of the better producer of Open Source software tools,
and few have had bad things to say about it, besides "it doesn't do X
esoteric thing that sendmail does."  Even boosters of sendmail will
praise postfix.

---

From: "Dan and Karen Ellrick" <[email-masked]>
Date: Thu, 20 Jul 2000 10:47:13 +0900

> Linux" mailing list.  No, it has a different name, but you'll recognize

Yesterday, after I wrote the previous message, I went to redhat.com and
tried exactly that.  When I clicked on the "Subscribe" link, it created a
new message with "Subscribe" as the subject.  I sent that as-is (it had my
signature, but nowhere did the web site say the message had to be blank, or
should have thus-and-info, or anything), but never got a response.  I tried
submitting my question two hours later (hoping I had been subscribed without
notification), but it was refused, saying I was not a subscriber.  I then
tried looking for a contact page for redhat.com to ask about that, but at
that time it seemed that their web site was down (all requests for
non-cached pages came up with my browser's page-not-found message).  I
suppose I should try that again this morning from home.

I really am doing all I know to do, but everything seems to end up harder
than it ought to be... :(

Karen

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 20 Jul 2000 19:46:10 -0400

> than it ought to be... :(

Let's see.
<URL: mailto:[email-masked]?Subject=Subscribe>

This sends e-mail asking that you be subscribed to redhat-install-list.
This does not necessarily happen instantly [or even in 24 hours].

This information used to be in the e-mail messages as they were sent
out, but it doesn't seem that it is any more.  I wonder if it's
outdated.

Have you tried finding a local Linux user group, whose mailing list you
might join?

---

From: "Dan and Karen Ellrick" <[email-masked]>
Date: Sat, 22 Jul 2000 10:11:12 +0900

> This does not necessarily happen instantly [or even in 24 hours].
I still haven't gotten any notification (three days later)... oh, well.
With some struggle (i.e. serious time invested by myself and the company
system administrator [who doesn't really know any more than I do about
troubleshooting these things] and some serendipitous web searches), I
finally found how to issue an insmod command with the proper parameters to
allow me to mount my CD-ROM drives.  Hooray for small victories!

> Have you tried finding a local Linux user group, whose mailing list you
If you mean geographically local, that would be hard for me, because it
would all be in Japanese.  Plus, I don't live in the technology hot-bed of
the country, here in Hiroshima.  I found out yesterday that my sysadmin guy
subscribes to a magazine (in Japanese, although it may be a translation of
an English one) called Linux, and when I asked him for help with sendmail he
dug through his pile of them and found some applicable stuff.  Unfortunately
it didn't work.  (Rather than a change to the sendmail.cf file, a daunting
task I'm not ready to do, the magazine said to simply use the "mailertable"
file to specify the IP address where the sendmail server on our bastion host
should send mail for our domain - but it just queued the mail and didn't
send it anywhere.)

Thank you for all the comments about postfix, but when I mentioned it to my
sysadmin, he pointed out that we need to have a mail transport program that
won't mess up the Japanese multi-byte characters that could show up in
subject lines, body of messages, and attached file names.  He knows that
sendmail works - postfix, qmail, etc. have possibly never been tested in
that regard.  So we'll stick with sendmail.  I tried the sendmail.org site
looking for a mailing list to join, but all they had listed was a couple
news groups, and whatever software I need to do news I don't have.  I bet
there's a regular e-mail based group out there somewhere - anyone know about
one?  Or does anyone know how to do the (theoretically simple) task of
getting sendmail to forward all incoming mail (all mail to the company
domain) to another, single server?

Or how about my original question about how to tell make where all my
include files are (I've looked through the Build and Makefile structure of
both fwtk and sendmail 8.10, both of interest to me, and I don't see where
the include file paths are specified - in my C programming days as far as I
can remember it always just worked...)?

Karen

---

From: Joseph S D Yao <[email-masked]>
Date: Mon, 24 Jul 2000 19:38:45 -0400

> can remember it always just worked...)?

They should be, as I have said, in /usr/include/.  I also included the
'rpm' command to find in which RPM set any one file would be found.  I
don't remember it now, but it should be in your mail.

Try www.tux.org for some Linux resources and mailing lists.  Linux
Journal and Linux Magazine are two periodicals.

---

From: syntax <[email-masked]>
Date: Mon, 24 Jul 2000 20:55:04 -0500

A great sendmail book is Sendmail Theory and Practice
by Frederick M. Avolio & Paul A. Vixie

The 1st addition should be all you need if you use the smap
interface.

A second addition looks to be coming out December 15, 2000
and I look forward to the update to a book that explains 
sendmail so clearly.

Syntax

---

From: "Karen Ellrick" <[email-masked]>
Date: Tue, 25 Jul 2000 12:00:02 +0900

> They should be, as I have said, in /usr/include/.

On my system, the normal files (like stdio.h) are in /usr/lib/bcc/include.
Even though fwtk's Makefile.config.linux is using cc rather than bcc (I seem
to have at least three compilers on my system: cc, bcc, and gcc - no wonder
this stuff is confusing!), I solved the errors related to those by changing
the CC variable in Makefile.config(.linux) from "cc" to "cc -I
/usr/lib/bcc/include" (I couldn't figure out any more elegant way to give
the compiler that option).  But there are still eight include files that are
not found (in 28 error messages), four of which are nowhere on my system and
the other four are scattered here and there (one in the fwtk directory
structure itself - syslog.h).  Does everybody have to work this hard to
compile things?  I doubt it - I still think there's some single package I
should have that I don't, or something like that.

> I also included the

   > bash$ rpm -q -f /usr/include/stdio.h
But if the file is not already there, it will simply give the message:
   file /usr/include/stdio.h: No such file or directory
Obviously if I'm looking for the right package to install, it's because I
don't already have the file, so that doesn't do me any good.  Next idea?
(I'll attach the output file I got after adding "-I /usr/lib/bcc/include".)

Sendmail 8.10.0 is even worse - I found a place in the .../sendmail/Build
file to specify a directory for include files, but I still get some errors
about the very files that are in that directory, as if the various sendmail
source files that include them are overriding the directory I gave it and
specifying paths directly or something.  Sendmail is huge (fwtk isn't a
shrimp, either!) - I can't go looking through every source file to learn
what's going on with each include reference that bombs (at least not unless
I have a whole lot more time on my hands).  There has to be a simpler
solution... right?

Karen

---

From: Joseph S D Yao <[email-masked]>
Date: Thu, 27 Jul 2000 15:59:57 -0400

Looks like I was right about the Red Hat mailing lists being
re-organized ...

----- Forwarded message from Kambiz Aghaiepour <[email-masked]> -----

Date: Wed, 26 Jul 2000 09:58:33 -0400
From: Kambiz Aghaiepour <[email-masked]>
Organization: Red Hat, Inc.
Subject: [linux-xxxxxx] IMPORTANT Changes to Mailing List

Attention all List Members:

We are in the process of migrating all Red Hat lists from the current list
manager software/server running qmail/Smartlist to a new server running
postfix and GNU Mailman (*). Within the next week you will receive more
information about this migration including information on how to access your
membership, including subscribe/unsubscribe information and instructions on
how to set your preferences  for your membership on the list.  The preferences
include setting/unsetting digest mode, temporarily disabling delivery, and the
option of receiving your own posts.  This migration will not only address
performace issues that have arisen due to the number of lists/members on Red
Hat lists, but also highly improve ease of use for list members.  Your
patience is greatly appreciated.

Thank you for your attention
Kambiz Aghaiepour

(*) For information on Mailman, see http://www.list.org/

-- 
\o__O  o   Kambiz Aghaiepour, RHCE  -    Phone: (919) 524-7423   o   o
  \_  /|\  -=   Red Hat, Inc.   =-  |\|  Pager: (800) 946-4646  //\ //\
   |\  |\  -=-=-=-=-=-=-=-=-=-=-=-  | |  Pager  Pin #: 1412622   //  //
  / /  |/  mailto:[email-masked]   |  http://www.redhat.com   |\  ||

...