Subject: [fwtk-users] authsrv cannot open .dir .pag

From: Mark Bergstrom <[email-masked]>
Date: Mon, 25 Mar 2002 19:20:54 -0800

The /etc/services, /etc/inetd.conf are correct.

Running either authsrv or authmgr brings up the prompt.

However, in authsrv, even an attempt to list yields:

Cannot open database.

In either authsrv or authmgr, an attempt to add even one user yields

Permission denied.

__________________

Note: the .dir and .pag did not even exist until I once experimented with
running authload.
Now they are there (in /usr/local/etc  as fw-authdb.dir and fw-authdb.pag of
zero size). They are permission 600 and hence readable/writeable.

_________________-
Been staring at the source and the mailing list, this does not even seem to
be a possibility, but there it is.

===============
I am assuming I need it to qualify non-directly connected users via passwd
proto for ftp-gw since I sniff on connects from partner-users (arriving via
WAN) attempting to use the ftp-proxy and see a reset sent.  For all my
locally connected nets, the netperm-table yields the correct functioning of
the ftp-gw.  I am at a loss to see any other source of the reset being sent
immediately upon the entry of the Username: into the prompt from the
non-local user.  The user prompt is being passed to the debug log on the
destination ftp machine, but then the ftp-gw box sends a reset after the
Password Required message.

In the router rules, I honestly cannot comprehend how the ftp-proxy box can
differentiate between the 'outside nets' arriving via the WAN and the
'inside nets' since all the addresses sit in the same rule space for the
routing to the ftp-proxy box.  There should be no differentiation so long as
the required 'outside net' is in the table.

Plenty of plug-gw's for these same WAN source addresses have been
functioning fine for years.

MB

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Tue, 26 Mar 2002 16:38:29 -0500

>In either authsrv or authmgr, an attempt to add even one user yields

Depending on the DBM library you're using, the library is locked by 
creating a file with a ".lock" type - fw-authdb.lock, for example. It may 
be that that's what is going on in your case. Who is authsrv running as (in 
the inetd.conf)? Does that user have write permission on the directory 
containing the auth database?
         -Rick

---

---

From: Ted Keller <[email-masked]>
Date: Tue, 26 Mar 2002 22:11:34 -0500 (EST)

Your authserve entries should look something like...

authsrv:        hosts 127.0.0.1
authsrv:        database /var/adm/fw-authdb
authsrv:        badsleep 120
authsrv:        nobogus true

# clients using the auth server
*:              authserver 127.0.0.1 7777

Note the authserver entry which accepts connections from local host (where
ftp-gw is running from).

Check these out and let me know.

tek

On Mon, 25 Mar 2002, Mark Bergstrom wrote:

> You are currently subscribed to fwtk-users as: [email-masked]

---

---

From: Mark Bergstrom <[email-masked]>
Date: Tue, 26 Mar 2002 19:41:55 -0800

OK. I spot the problem.
Whatever the tree is ABOVE the fw-authdb has to be owned,grouped by the
userid:groupid specified in the /etc/netperm-table.  Didn't think of that.
But changing it to nobody.nobody fixed things.  Was thinking that the 
authsrv	stream	tcp	nowait	root	/usr/etc/authsrv	authsrv in
/etc/inetd.conf would dominate the ownership for reading/writing.

However, no .lock is ever created.....unless that is the 0 length file in
/usr/local/etc called fw-authdb alongside fw-authdb.dir and fw-authdb.pag is
in fact it.

--------------
Now, on to the second half of my first posting.  Can this be at all related
to the 'reset' my sniffer sees sent when a WAN user hits the ftp-gw?  When I
put enabling permit-hosts rules for various hosts on our various nets here
(to test), I get handed off to the destination ftp-box and using the login
the WAN user would, use their password and I am in.  However, the WAN user
is not getting past the Username: from the destination ftp-box.  The reset
from the fwtk box follows directly upon the Reply from the ftp-box of
'Password required'.  Then they get a reset which disconnects them.  Since I
have not yet added the
 -auth option in the ftp-gw rules, I am now at a loss to explain why the
login behaves differently for them.

TNX
MB

====

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---