Re: netfilter digest, Vol 1 #811 - 7 msgs

Re: netfilter digest, Vol 1 #811 - 7 msgs

[John A. Sullivan III]

	I may be able to help a little.  For the ISCS project
(http://iscs.sourceforge.net), we use X.509 user authentication.  User
are assigned to user groups based upon their certs.  We create dynamic
iptables rules for users when they authenticate via X.509 certificates
based upon the fields in the ID passed during IKE.  We then tear down
those rules when the session is torn down.  The scripts we use to do
this (X509updown and DNRead) can be found in the project CVS
(http://sourceforge.net/projects/iscs) under PEP.  Perhaps they can
point you in the right direction.
	We plan to include LDAP authentication in version 2.0 of ISCS so I'd
love to know the specifics of how you ultimately accomplish it.  There
are some important security implications since, in effect, we are
caching the IP address against the user authentication.  With an IPSec
tunnel created with X.50 certs, we have the advantage that no one can
easily spoof the cert user's IP.  The rules only pertain to the IPSec
tunnel and when the tunnel is destroyed, so are the rules.  I'm not sure
how one would plug that hole with LDAP authentication.  Good luck - John

On Fri, 2003-05-02 at 18:26, netfilter-request@lists.netfilter.org
wrote:

> Message: 4
> Date: Fri, 2 May 2003 12:25:32 +0530 (IST)
> From: "Yogesh Talekar (M.T.S.@C.N.C.)" <yogesh@unipune.ernet.in>
> To: netfilter@lists.netfilter.org
> Subject: IP-tables with authentication
> 
> hi
> 
> Is this possible ...
> 
> I have a IP-tables firewall on a machine "A". I have LDAP database on 
> machine "B". And I want all the traffic going out of my firewall(A) to be 
> authenticated against this LDAP server(B).
> 
> Consider following scenario (network diagram)...
> 
> ********************************FIGURE********************************
> 
> Internet <--> Router (realIP-X.X.X.254) <--> Linux FW (Bridge-No IP) 
> 					|	
> 					|
> 					|
> 		------------------ switch---------------
> 		|			|		|
> 	LDAP Server(X.X.X.100)		|		|
> 	     			     server-1	    server-2
> 			(RealIP-X.X.X.10)    	(RealIP-X.X.X.3)
> 			(FakeIP-192.168.1.X) 	(FakeIP-192.168.2.X
> 				|
> 				|
> 				|
> 				Intranet
> 
> **********************************************************************
> 
> The question is, can I keep log and count the traffic per user if he 
> (from Intranet) uses any type of service (http,ssh,telnet,ftp) via the 
> Linux firewall. And Can I authenticate this user against the LDAP server 
> (which has a realIP)
> 
> Please advice
> 
> --yogesh
-- 
John A. Sullivan III
Chief Technology Officer
Nexus Management
+1 207-985-7880
john.sullivan@nexusmgmt.com
---
If you are interested in helping to develop a GPL enterprise class
VPN/Firewall/Security device management console, please visit
http://iscs.sourceforge.net 

RE: netfilter digest, Vol 1 #811 - 7 msgs

[Andrius Cibulskis]

Hello,

I apply route patch and after that I cannot compile iptables. Could
anybody tell me what is wrong?

Thank you.



cc -O2 -Wall -Wunused -I/usr/src/linux/include -Iinclude/
-DIPTABLES_VERSION=\"1.2.8\"  -fPIC -o extensions/libipt_ROUTE_sh.o -c
extensions/libipt_ROUTE.c
extensions/libipt_ROUTE.c: In function `init':
extensions/libipt_ROUTE.c:44: structure has no member named `oif'
extensions/libipt_ROUTE.c:45: structure has no member named `iif'
extensions/libipt_ROUTE.c:46: structure has no member named `gw'
extensions/libipt_ROUTE.c: In function `parse':
extensions/libipt_ROUTE.c:73: structure has no member named `oif'
extensions/libipt_ROUTE.c:76: structure has no member named `oif'
extensions/libipt_ROUTE.c:78: structure has no member named `oif'
extensions/libipt_ROUTE.c:78: structure has no member named `oif'
extensions/libipt_ROUTE.c:78: structure has no member named `oif'
extensions/libipt_ROUTE.c:91: structure has no member named `iif'
extensions/libipt_ROUTE.c:94: structure has no member named `iif'
extensions/libipt_ROUTE.c:96: structure has no member named `iif'
extensions/libipt_ROUTE.c:96: structure has no member named `iif'
extensions/libipt_ROUTE.c:96: structure has no member named `iif'
extensions/libipt_ROUTE.c:105: structure has no member named `gw'
extensions/libipt_ROUTE.c: In function `print':
extensions/libipt_ROUTE.c:142: structure has no member named `oif'
extensions/libipt_ROUTE.c:143: structure has no member named `oif'
extensions/libipt_ROUTE.c:145: structure has no member named `iif'
extensions/libipt_ROUTE.c:146: structure has no member named `iif'
extensions/libipt_ROUTE.c:148: structure has no member named `gw'
extensions/libipt_ROUTE.c:149: structure has no member named `gw'
extensions/libipt_ROUTE.c: In function `save':
extensions/libipt_ROUTE.c:161: structure has no member named `oif'
extensions/libipt_ROUTE.c:162: structure has no member named `oif'
extensions/libipt_ROUTE.c:164: structure has no member named `iif'
extensions/libipt_ROUTE.c:165: structure has no member named `iif'
extensions/libipt_ROUTE.c:167: structure has no member named `gw'
extensions/libipt_ROUTE.c:168: structure has no member named `gw'
make: *** [extensions/libipt_ROUTE_sh.o] Error 1