Hi group,

Am running MEPIS 3.4-3, with kernel 2.6.15-1-586tsc and various extra packages installed - WORKS VERY WELL - JUST AS I WANT IT!!!

However I'd like to improve the firewall (iptables) side as the current kernel does not have the 'ipt_owner' for iptables configured - neither built-in nor as a module. Checked the kernel config file /boot/config-2.6.15-1-586tsc for what's enabled or not and 'ipt_owner' is not mentioned at all - so assume not configured!! If any of you out there are running MEPIS 3.4-3 and have 'uid-owner' or 'gid-owner' options applied in your iptables file, please advise as to how you got it to install and work!

Question 1: if I patch the kernel to include the 'ipt_owner' module - do I have to re-compile the kernel?

Question 2: if so - how do I re-compile - any guides available?

Question 3: anybody advise as to where I can get the relevant patches for 'ipt_owner' module from please?

TYIA

Oz-Rod

Hi all,

I'm not certain - but I may have found my answer to the above post!!

I rechecked the /boot/config-2.6.15-1-586tsc file for my running kernel and find that maybe the 'ipt-owner' options are enabled it seems:

<snip>:
>IP: Netfilter Configuration
>
>...............
>...............
>CONFIG_IP_NF_MATCH_OWNER=m
>...............
>...............

<end snip>

Also checked for possible modules and found:

/lib/modules/2.6.15-1-586tsc/kernel/net/ipv4/netfilter/ipt_owner.ko

and

/lib/iptables/libipt_owner.so

QUES: This looks like the kernel 'ipt-owner' option is enabled - is this correct?

QUES: If I include the following to my iptables firewall script in /etc/rc.firewall - what code do I add to it to allow me to log (confirm) that script snippet works?

"# Allow packets by UID
Listuid="$(gawk -F:'{print $3}' /etc/passwd)"
for Xuid in $Listuid; do
iptables -t filter -A chk-own -o ppp0 -m owner --uid-owner $Xuid -j RETURN
done
iptables -t filter -A chk-own -m limit --limit 10/s -j logdrop5
"
and for 'logdrop5':

"iptables -N logdrop5
iptables -A logdrop5 -j LOG --log-prefix "ILLEGAL packet owner: "
iptables -A logdrop5 -j DROP
"

NOTE:- the "logdrop5" section logs and drops the packet ONLY if it is illegal - not if it is ok. I also want to log if it IS OK (to confirm that the 'match' option is working).

Any help would be appreciated.

Oz-Rod

Yes, it looks like it is enabled - as a module.
Try "lsmod | grep -i owner". If it comes back with nothing, you'll need to load it; "modprobe ipt_owner". Then re-run the first command - you should see it now.
You'll need to add it to the initscripts to ensure it's always loaded.
As for how to use it, I have no bloody idea.

As for your initial query, Warren used to have a /usr/src/KERNEL-README (??? something like that) that had info on compiling a new (source) kernel for Mepis.
Have a look for that.

Hi syg00,

Thanks for you reply.
Tried your lsmod command - nothing as expected!! Did the modprobe, then the lsmod again - success!!!!!!

As to the initscripts - will load it within the iptables firewall script /etc/rc.firewall.

Haven't been able to find Warren's /usr/src/KERNEL-README - at least not on my machine - maybe someone can point me to where?

Any thoughts re my 2nd question in my 2nd post (i.e.. Allow packets by UID...)?

Any assistance would be appreciated!!!

Oz-Rod

Happy to help - as I said, you'll have to wait for others to answer.

What do the Queen Mary Falls look like these days - did that recent rain do you folks any good ???.
Might duck up and have a look this week (I'm in Brisbane)

Hi sygOO,

The falls have a little bit more water over them now - don't look too bad actually.

If you do come up - come into Killarney and drop in for a cuppa & chat - you'll find that we be friendly folk. Send me an email before you come up and I'll send one back with our address.

Oz-Rod

Just checked - my email address not listed in the forum profile!!

'craftybytes_at_dodo_dot_com_dot_au' will find me_..