LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices



Reply
 
Search this Thread
Old 11-15-2009, 09:47 AM   #1
spatieman
Member
 
Registered: Jan 2004
Location: netherlands, europe, in a crapy house. xD
Distribution: openBSD
Posts: 65

Rep: Reputation: 21
firefox and foxyproxy vs Mcafee siteadvisor.


hardware:
OpenBSD 4.4 firewall / NAT.
Squid 2.7 Stable
PF for firewalling xD

user OS:
Ubuntu and windows XP both with FireFox and foxyproxy.
all with mcafee siteadvisor installed

situation:
Squid for caching, works perfect.
firefox and internet explorer are both configed for use with squid as proxy.

now i got some lan users who share internet with me to.
for denieing use or bittorrend and other p2p stuff, i added a rule in pf.conf like this.

rdr on $int_if proto { tcp,udp } from any to any port { 80,443 } -> 192.168.0.240

so that all trafic is redirectect to the local apache, wich advises to setup the proxy settings.
so a direct connection to internet is not possible any more.

works good.
but the weard stuff is, after i enabled above line, siteadvisor refuse to work with firefox, also not works with internet explorer.

when doing google search, i dont get the green or red warnings any more on searched, and when visiting site it doesnt gives green or what collor SA should give in that site.

so i disabled the redirect line in pf.conf and it works again.

after some search, it seems that siteavisor needs to contact dss1.siteadvisor.com to comunicate with.
but when blocking direct traffic to internet is wont work, and SA isnt correct working over squid.

is there a way to override this behaveing ?
i dont want exesive use of p2p on my network.

Last edited by spatieman; 11-15-2009 at 01:00 PM.
 
Old 11-15-2009, 02:18 PM   #2
unixfool
Member
 
Registered: May 2005
Location: Northern VA
Distribution: Slackware, Ubuntu, FreeBSD, OpenBSD, OS X
Posts: 781
Blog Entries: 8

Rep: Reputation: 157Reputation: 157
Maybe allow communication with dss1.siteadvisor.com? Or, do you not want to do this? How is your system communicating with siteadvisor.com? TCP? UDP? Would be nice to see a tcpdump of the traffic. In fact, when I've issues with a FW policy (at work AND at home), the first thing I do is look at the raw traffic. To get a good indication of what's going on, I'd run tcpdump or snort, analyse the results and parse the FW logs, attempt to find any drops/blocks or (if you're not logging drops in the FW logs) a steady stream of non-bidirectional traffic. If there's not a three-way handshake, you know you've an issue.

Without knowing your full network architecture or your full FW policy, it is difficult to determine what's going on. Since it works when you remove the redirect but doesn't when you enable the redirect, there's probably an issue with the way your redirect rule is configured. It could also be that maybe you need to add something more to your policy. Then again, it could be how your Squid is set up (ie, the FW rule may be working, but because the traffic is being handed off to your Squid setup, maybe there's something within your Squid ACLs that may be blocking that traffic).

I know what info I gave may not be of any help, but I'd suggest posting your whole FW policy (at the very least) so that we can make a better assessment of your issue.
 
Old 11-16-2009, 01:34 PM   #3
spatieman
Member
 
Registered: Jan 2004
Location: netherlands, europe, in a crapy house. xD
Distribution: openBSD
Posts: 65

Original Poster
Rep: Reputation: 21
hi.

i have adapted my pf.conf with following.
rdr on $int_if proto tcp from any to dss1.siteadvisor.com port { 80,443 } -> 208.69.152.105
rdr on $int_if proto tcp from any to dss2.siteadvisor.com port { 80,443 } -> 208.69.152.106
rdr on $int_if proto { tcp,udp } from any to any port { 80,443 } -> 192.168.0.240

where dss1 and dss2 are the adresses where siteadvisor does talk to.
the other is the normal http redirect to the local webserver what advises users to set the correct proxy settings.
i also set dss1/dss2 in my DNS server.

sometimes it happens that SA is comunicating ,mostly not.
but if they need UDP to, mhh, i need to do some adapting..

as sayed, when i remove rdr on $int_if proto { tcp,udp } from any to any port { 80,443 } -> 192.168.0.240
it al works, but everyone can work without the proxy.

normaly i dont care, but SA is such a usefull tool.
a shame that it cannot be configed for work with a proxy.

Last edited by spatieman; 11-16-2009 at 01:42 PM.
 
Old 11-16-2009, 02:42 PM   #4
spatieman
Member
 
Registered: Jan 2004
Location: netherlands, europe, in a crapy house. xD
Distribution: openBSD
Posts: 65

Original Poster
Rep: Reputation: 21
oh.
here my current pf.conf.

## START CONFIG ##
#
ext_if = "fxp0"
int_if = "rl0"

set block-policy return
set loginterface $ext_if
set limit { frags 5000, states 2500 }
set state-policy if-bound
set optimization high-latency
set skip on lo
#
scrub in on $ext_if all fragment reassemble min-ttl 15 max-mss 1400
scrub in on $ext_if all no-df
scrub on $ext_if all reassemble tcp
#
nat on $ext_if from $int_if:network to any -> ($ext_if)
#

rdr on $int_if proto { tcp,udp } from any to dss1.siteadvisor.com port { 80,443 } -> 208.69.152.105
rdr on $int_if proto { tcp,udp } from any to dss2.siteadvisor.com port { 80,443 } -> 208.69.152.106
rdr on $int_if proto { tcp,udp } from any to any port { 21,22,23,113,80,443 } -> 192.168.0.240

block on { $ext_if, $int_if } all

pass in on $ext_if inet proto tcp from any to 192.168.0.254 port { 25,110 } flags S/SA keep state
antispoof for $ext_if inet
pass out quick keep state
pass in quick on $int_if
## END CONFIG ##

p.s
i removed dss1 and dss2 out of my dns server.
seems that it couses some #$@@&&$&( troubles to..

Last edited by spatieman; 11-16-2009 at 02:45 PM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Trying to install McAfee Rig24 Linux - Software 2 07-10-2007 12:57 PM
LXer: Mcafee Adds Firefox Support To Anti-Fraud Service LXer Syndicated Linux News 0 12-20-2006 01:03 AM
Mcafee Linuxshield and Debian ursus Debian 2 10-17-2005 08:51 AM
McAfee Scan??? dsschanze Linux - Software 0 12-23-2004 10:22 AM
need some help with script to dl mcafee updates zen0n Programming 2 10-05-2004 01:22 AM


All times are GMT -5. The time now is 08:33 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration