Subject: [fwtk-users] Re: http-gw V 2.1 - page won't load

From: Tony Gale <[email-masked]>
Date: 01 Aug 2002 10:41:51 +0100

Sent Philip a patch which should hopefully fix it - seems the list
doesn't allow attachments anymore - sillyness.

Anyway, the patch is in the list archive at:

http://marc.theaimsgroup.com/?l=fwtk-users&m=97733456929934&w=2

Cheers,
-tony

On Wed, 2002-07-31 at 20:36, Atwood, Philip L. wrote:
> I'm using http-gw V 2.1 on a Linux box and also on an older freebsd system. Several months ago I had
> problems loading some pages a different web sites. These problems were solved by applying Tony
> Gale's Jumbo patch (trg-jumbo-20001114.diff).
> 
> I have recently found a page ( www.fitchratings.com ) that still won't load through either the Linux
> or the freebsd firewalls. I can load the page on a browser connected outside our firewall, so I'm
> certain that the pages are being dropped by http-gw. This web site is using cold fusion to generate
> a lot of their web content. Can anyone confirm that they have a similar problem with this site? Any
> thoughts on the cause or a solution?
> 
> Thanks,
> 
> -------------------
> Philip L. Atwood
> Systems & Networking Manager
> ALAS, Inc.
> (312) 697-6985
> [email-masked]
> 
> ---
> You are currently subscribed to fwtk-users as: [email-masked]
> To unsubscribe send a blank email to [email-masked]

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: "Atwood, Philip L." <[email-masked]>
Date: Thu, 1 Aug 2002 22:48:29 -0500

Tony's patch solved the problem. Thanks to all for the help

-Phil

-----Original Message-----
From: Tony Gale [mailto:[email-masked]]
Sent: Thursday, August 01, 2002 4:42 AM
To: fwtk-users
Subject: [fwtk-users] Re: http-gw V 2.1 - page won't load

Cheers,
-tony

> thoughts on the cause or a solution?

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

---

From: [email-masked] (James Seymour)
Date: Mon, 5 Aug 2002 10:22:13 -0400 (EDT)

> From: "Atwood, Philip L." <[email-masked]>
> 
> I'm using http-gw V 2.1 on a Linux box and also on an older freebsd
> system. Several months ago I had problems loading some pages a
> different web sites. 
[snip]

Hmmm...  We're running an older version of Gauntlet (4.2) and
experiencing similar problems with some sites.  I've been looking for a
replacement HTTP proxy for some time, but not found anything suitable.
(For some reason, FWTK's HTTP proxy didn't occur to me?) Perhaps FWTK's
http-gw proxy would be better than Gauntlet 4.2's http-gw proxy?
Anybody know?

Thanks,
Jim
-- 
Jim Seymour                         | Welding Technology Corporation
[email-masked]           | 24775 Crestview Ct.
Systems, Network & TelCom Admin.    | Farmington Hills, MI. 48335
                                    | FAX: (248)477-8897

---

---

From: Hirsch Wolfgang <[email-masked]>
Date: Mon, 5 Aug 2002 16:28:58 +0200

I've had the same problems with FWTK's http-gw. I solved the problem by
replaceing http-gw with squid and it works fine.

Wolfgang

> -----Ursprüngliche Nachricht-----
> Von: [email-masked] [mailto:[email-masked]] 
> Gesendet: Montag, 05. August 2002 16:22
> An: fwtk-users
> Betreff: [fwtk-users] Re: http-gw V 2.1 - page won't load
> 
> 
> You are currently subscribed to fwtk-users as: [email-masked]

---

---

From: [email-masked] (James Seymour)
Date: Mon, 5 Aug 2002 10:44:47 -0400 (EDT)

> From: Hirsch Wolfgang <[email-masked]>
> 

Problem is: last time I looked at squid (maybe as much as a year
ago now) it didn't support removing ActiveX, Java, etc., whereas
Gauntlet's and FWTK's http-gw proxies do.  This is important to
us.  We don't allow ActiveX in *ever*.  And on occasion there is
a new exploit/hole in Java that causes us to block that, as well,
until the hole is plugged.  FWTK's http-gw also appears to allow
selective (by site) (non)blocking and the same for JavaScript.

Regards,
Jim

---

---

From: Hirsch Wolfgang <[email-masked]>
Date: Mon, 5 Aug 2002 16:49:58 +0200

> Gesendet: Montag, 05. August 2002 16:45
> An: fwtk-users
> Betreff: [fwtk-users] Re: AW: Re: http-gw V 2.1 - page won't load
> 
> 

Yes, you're right. We solved this problem by not installing this features at
our client boxes.
regards,
Wolfgang

---

---

From: [email-masked]
Date: Mon, 5 Aug 2002 19:07:55 +0400

Considered using em's squid-gw?

> http-gw proxy would be better than Gauntlet 4.2's http-gw proxy?

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

---

From: [email-masked] (James Seymour)
Date: Mon, 5 Aug 2002 11:29:20 -0400 (EDT)

[snip]
> > ago now) it didn't support removing ActiveX, Java, etc., ...
[snip]
> Yes, you're right. We solved this problem by not installing this features at

The problem there, IMO, is if a user of a client machine turns around
and undoes your hard work one way or the other (perhaps by accident,
perhaps not), they're exposed.  Particularly in an enterprise
environment consisting of dozens, hundreds or thousands of desktops,
the "do it at the client" solution is impractical and untrustworthy,
IMO.

We also work to turn of active scripting and so-forth on client
machines (defense in depth), but I wouldn't rely just on that.  Keeping
Evil Stuff out of our trusted network is properly the firewall's job.

Regards,
Jim

---