Subject: RE: plug-gw + ssh config question

From: "Davis, Ricardo C." <[email-masked]>
Date: Fri, 13 Apr 2001 15:21:49 -0400

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Rick,

It appears I wasn't thinking carefully about what I was doing.  So I went
back to the docs regarding plug-gw and fixed the problem...works like a
charm now.

-R

[netperm-table]
ssh:        port ssh * -plug-to 192.168.0.50 -port 22

[inetd.conf]
ssh     stream tcp      nowait     root /usr/local/etc/plug-gw  plug-gw ssh

-----Original Message-----
From: Rick Murphy [mailto:[email-masked]]
Sent: Friday, April 13, 2001 2:25 PM
To: Davis, Ricardo C.; [email-masked]
Subject: Re: plug-gw + ssh config question

At 12:34 PM 4/13/01 -0400, Davis, Ricardo C. wrote:
># Plug-gw rules:
># --------------
>netacl-ssh:     permit-hosts * -exec /usr/local/etc/plug-gw ssh
>plug-gw:        port ssh * -plug-to 192.168.0.50 -port 22

...

>Apr 13 12:21:16 proxy netacl[29063]: permit
>host=ftp2.abnbilling.com/209.48.180.234 service=ssh
>execute=/usr/local/etc/plug-gw
>Apr 13 12:21:16 proxy plug-gw[29063]: deny
>host=ftp2.abnbilling.com/209.48.180.234 service=ssh
>
>
>This looks similar to the problem Georg was having.  Did I mess up the
>plug-gw configuration?

Yes. Netacl fires up plug-gw as ssh; plug-gw looks for "ssh" rules and
fails.
Try changing "plug-gw" to "ssh" on the second netperm-table line.

Why are you running netacl in front of plug-gw in this configuration? If 
you *always* run a plug-gw, just run it and don't bother with netacl.
         -Rick