Subject: RE: "Newbie tries to make toolkit - fails", Part 2

From: Malcolm Tester <[email-masked]>
Date: Wed, 19 Jul 2000 03:59:50 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Postfix is written by Wietse Venema, who is one of the foremost experts on
Internet security software.  You can check out his home page at
http://www.porcupine.org/wietse or the Postfix program at
http://www.postfix.org.  Postfix was built from the ground up with security
in mind, which Sendmail can't claim or come close to.  To quote Wietse,
"Postfix attempts to be fast, easy to administer, and secure, while at the
same time being sendmail compatible enough to not upset existing users."

I have that O'Reilly book on Sendmail too.  I haven't touched it since the
day I installed Postfix.  Postfix is officially "unreleased".  That means
there are continual updates to it, and it is recognized as "beta" software.
However, anything Wietse tends to write that's beta could be considered
better than commercially released packages by others.

For detailed information on the security Postfix provides, look at
http://www.porcupine.org/postfix-mirror/security.html.

For books/press information, look at
http://www.porcupine.org/postfix-mirror/press.html.

Regards,
Malcolm Tester II

Malcolm W. Tester II
Systems Administrator
Cambric Corporation
110 West Business Park Drive
Draper, Utah 84020
http://www.cambric.com

This message is intended only for the use of the individual or entity to
whom it is addressed and may contain information that is privileged,
confidential and exempt from disclosure under applicable law.  If the reader
of this message is not the intended recipient, or the employee or agent
responsible for delivering the message to the intended recipient, you are
hereby notified that any dissemination, distribution or copying of this
communication is strictly prohibited.  If you have received this
communication in error, please delete it from your system and notify the
sender identified above by e-mail.

> -----Original Message-----
> From: Karen Ellrick [mailto:[email-masked]]
> Sent: Wednesday, July 19, 2000 12:53 AM
> To: Joseph S D Yao
> Cc: [email-masked]
> Subject: Re: "Newbie tries to make toolkit - fails", Part 2
> 
> 
> Thank you to all the folks who told me I goofed, and my 
> apologies.  I only
> work two days a week, so I couldn't check on it until today, but I did
> indeed fail to attach the attachment.  This time, here it is. 
>  I'm very
> encouraged by the number of people reading this mailing list 
> and willing to
> help!
> 
> I searched for the first few files that make complained 
> about, and found
> most of them in /usr/lib/bcc/include.  I found syslog.h in the fwtk
> heirarchy (...fwtk/tools/server/syslog/).  I'm glad they were 
> already on my
> system, considering that I currently can't get at my CD-ROM 
> drive to rpm
> them.  So now how do I tell make where to find these files?
> 
> Now, to respond to a couple specifics in Joe Yao's response:
> 
> > > ...I have not been able to mount the CD-ROM drive on any of the
> > > three machines I have installed RedHat 6.1 on...
> > You appear to be trying to mount /mnt/cdrom on some directory
> > [/cdrom?], instead of mounting /dev/cdrom.  The "device 
> special files"
> > are all in /dev/ and its subdirectories.
> 
> It doesn't matter - "mount /dev/mcd" and "mount /mnt/cdrom" 
> give me the same
> error.  The entry in my fstab is:
>    /dev/mcd    /mnt/cdrom   iso9660   ro,owner,noauto  0 0
> And this is the exact wording of the error I get:
>    mount: the kernel does not recognize /dev/mcd as a block device
>          (maybe 'insmod driver'?)
> I understand that the part in parentheses is supposed to be a hint for
> troubleshooting, but it's difficult to be sure which of the 
> eleven CD-ROM
> driver files I found is the right one.  Since my device file 
> is /dev/mcd,
> and I know I have a Mitsumi CD-ROM drive, today I tried 
> typing "insmod mcd".
> I got the error:
>    Init failed. No mcd device at 0x300 irq 11
>    ./mcd.o: init_module: Device or resource busy
> Then I remembered that at installation time I had to specify 
> parameters of
> "0x340,11", so I suspect there is a possibility that if I 
> could specify
> 0x340 instead of 0x300 in this case, it might work.  But the 
> man page didn't
> say how parameters go in the command line (after an option 
> flag? after a
> space?).  I tried "insmod mcd 0x340,11" but it just hung with 
> no feedback
> (even in verbose mode).  That's when I ran out of ideas on my 
> own.  Any
> clues?  [Sorry that this is off-topic for this discussion 
> group, but I doubt
> there's a discussion group for such a basic thing as 
> accessing your hardware
> ([email-masked]? - probably not!).]
> 
> > Smap is an extremely good idea.  You do NOT want 'sendmail' 
> to talk to
> > the 'Net directly, especially if you are not skilled at 
> configuring it
> > for security.  [Of course, download the latest version and 
> compile and
> > load it, and security will be greatly increased.  ;-)]
> 
> I did, but I have the same problem compiling it (and a 
> dramatically longer
> spewing of error messages!).
> 
> > You never want ANY user services on the bastion host.  They 
> should all
> > be on internal servers.  Mailboxes are a prime example.  The only
> > things running on the bastion host should be those 
> processes having to
> > do with being a firewall.
> I know - that's why I have to learn how to configure 
> sendmail.  Currently we
> have a single server happily handling our mail, but now that 
> we're adding a
> firewall I need to configure two hosts - the one inside the 
> firewall would
> have the mailboxes, and the one on the bastion host would 
> send mail in and
> out - as a sort of proxy.  It will have no user accounts on 
> it - only stuff
> for the world (http, dns, and the mail forwarding).  I would 
> think that this
> has been done thousands of times before and that there would 
> be examples out
> there of how to configure the two, especially since our 
> network is really
> small and really simple.  But I can't seem to find anything 
> like that, so
> I'm slogging through O'Reilly's Sendmail book and getting dizzy.
> 
> > > I thought that smap could replace sendmail for simple 
> store-and-forward
> > > setups, but apparently that's not true.  ...
> >
> > Quite.  Smap/smapd form the network proxy.  Sendmail is 
> still the prime
> > mail transfer agent [MTA], although 'postfix' can do many 
> of the more
> > common mail transfer things more simply.
> 
> You're the second person to mention postfix in the last 24 
> hours or so.  But
> I've never heard of it before - even when I recently attended a SANS
> conference with all kinds of training about firewalls, good 
> and bad network
> services, etc.  Has it been out there enough to be security 
> tested by the
> wild wild west?
> 
> Thanks for all the friendly advice!
> 
> Karen
> 
> --------------------------------
> Karen Ellrick
> S & C Technology, Inc.
> 1-21-35 Kusatsu-shinmachi
> Hiroshima  733-0834  Japan
> (from U.S. 011-81, from Japan 0) 82-293-2838
> --------------------------------
> 
>

---

From: Malcolm Tester <[email-masked]>
Date: Tue, 25 Jul 2000 09:47:05 -0600

Hi,

To answer your question below, I asked the Postifx users group about it.
Here's the reply from Wietse himself:

> Postfix has been in use in Japan from the days it was in alpha test
> several years ago. If there was a problem with Japanese characters
> people would be screaming all the time.
> 
> 	Wietse

So, to answer this question you posted:

> Sendmail 8.10.0 is even worse - I found a place in the .../sendmail/Build
> file to specify a directory for include files, but I still get some errors
> about the very files that are in that directory, as if the various
sendmail
> source files that include them are overriding the directory I gave it and
> specifying paths directly or something.  Sendmail is huge (fwtk isn't a
> shrimp, either!) - I can't go looking through every source file to learn
> what's going on with each include reference that bombs (at least not
unless
> I have a whole lot more time on my hands).  There has to be a simpler
> solution... right?

The answer is yes.  Postfix :)  I spent 3 weeks on Sendmail 8.10.3 trying to
get it to work properly before giving up.  I spent 2 hours on Postfix.  If
you are dead set on using Sendmail, then go to www.sendmail.org and
subscribe to a mailing list there.  You'll be more likely to find someone
who can help you configure the Sendmail software itself.

As far as compiling the fwtk, I can compile the base 2.1 package (meaning no
patches) and only needing to modify the ftp daemon command a bit to work
with gate-ftp properly.  And I believe I had problems getting gate-ftp to
compile properly at all.  Otherwise, everything compiled nicely using gcc.
(I've used gcc 2.7*, 2.8*, and 2.95* successfully with it)

Wish I could help more, but I don't use RedHat currently.

Regards,
Malcolm

> From: Dan and Karen Ellrick [mailto:[email-masked]]
> Sent: Friday, July 21, 2000 7:11 PM
> To: Joseph S D Yao
> Subject: RE: "Newbie tries to make toolkit - fails", Part 2
> Thank you for all the comments about postfix, but when I 
> mentioned it to my
> sysadmin, he pointed out that we need to have a mail 
> transport program that
> won't mess up the Japanese multi-byte characters that could show up in
> subject lines, body of messages, and attached file names.  He 
> knows that
> sendmail works - postfix, qmail, etc. have possibly never 
> been tested in
> that regard.  So we'll stick with sendmail.  I tried the