Genboy's questions

I have iptables and apache running on a gateway machine.

1) All machines behind the gateway should not be able to access the internet.

2) If they try to browse any other website, they should be automatically redirected to a another site http://www.xyz.com (which is also under my control).

In order to do this, I tried the following in iptables.

*nat
-A PREROUTING -i eth3 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 80

(redirect all browsing requests to port 80 on gateway machine itself)

And in the Apache server running on the gateway machine,

in /etc/apache2/sites-available/default

RedirectMatch  .* http://www.xyz.com/

After doing, this when I try to browse any site from behind the gateway, I get errors.

In firefox - "Firefox has detected that the server is redirecting the request for this address in a way that will never complete."

In Chrome - Error 310 (net::ERR_TOO_MANY_REDIRECTS): There were too many redirects.

In IE - something similar happens.

It looks like the iptables & RedirectMatch work with each other to go into a recursive loop. What can I do to prevent this?

I am running Apache on a box. I want to redirect every hit coming to that site to the entry page of a different site.

Site1 is www.site1.com Site2 is www.site2.com

I want every URL on Site1 to be redirected to site2 after stripping out everything at the end - i.e.

1) www.site1.com ==> www.site2.com/
2) www.site1.com/abc ==> www.site2.com/ (NOT site2.com/abc)
3) www.site2.com/pqr/mno ==> www.site2.com/ (NOT not site2.com/pqr/mno)

I have the following ProxyPass setting in Site1

ProxyPass / http://www.site2.com/

1) works fine - i.e. site1.com goes to site2.com
2) & 3) try to go to /abc & /pqr/mno on site2.com

How to I prevent this - I want everything on site1.com to go to the entry page on site2.

I have integrated Squid running on a gateway Debian machine with an LDAP directory.

I have an acl called ldaplogin for the ldap authentication configured with the right parameters. I also have rules like this using the acl

acl ldaplogin proxy_auth REQUIRED
http_access deny !ldaplogin
http_access allow localnet
http_access deny all

I have iptables redirect port 80 to port 3128 on the gateway machine running squid.

However, the browser running on a laptop which is behind the gateway doesn't ask for password at all. However, if I go to IE & set the IP of the gateway as proxy with port 3128, then in that case the browser asks for username/password.

Is there any way at all to have it working even without setting a proxy in the browser?

I am very new to LDAP & just trying to learn. I am using openldap on debian.

Can someone clarify this - or alternately point me to some link which will clarify these basic concepts?

Let's say I have the following situation I want represent in ldap

I am running a company. The company sells servers which are installed at customer sites. The company sells some servers directly and some through resellers. Company has a central administration tool which can manage all customer servers. I want to have different access permissions when someone logs into the server.

There are 3 levels of permissions P1, P2 & P3.

there are logins for company employees, reseller employees & also for customer employees.

Each employee's access will be decided by whose employee he is - My employees will have access to all servers - Reseller's employees will have access to only servers which have been sold by the reseller. - Customer's employees will have access only to servers which belong to the customer.

Even amongst all these employees what level of access they have will depend on whether they have P1, P2, or P3 permissions.

i.e. My employee with P3 access can do all operations for all servers. My employee with P1 access can do limited operations on all servers Reseller's employee with P1 access can do limited operations on all servers on all servers which have been sold through that reseller & so on and so forth.

This is what I am starting with dn: dc=mycompany,dc=com objectclass: organization objectclass: dcObject o: mycompany.net dc: mycompany

# Perms #
dn: ou=perms, dc=mycompany,dc=com
objectclass: organizationalUnit

dn: cn=p1, ou=perms, dc=mycompany,dc=com
objectclass: organizationalRole
cn: p1

dn: cn=p2, ou=perms,dc=mycompany,dc=com
objectclass: organizationalRole
cn: p2


# Reseller #
dn: ou=resellers, dc=mycompany,dc=com
objectclass: organizationalUnit

dn: cn=r1, ou=resellers, dc=mycompany,dc=com
objectclass: organizationalUnit
member: uid=xyz, ou=unames, dc=mycompany,dc=com

dn: cn=r2, ou=resellers, dc=mycompany,dc=com
objectclass: organizationalUnit
member: uid=abc, ou=unames, dc=mycompany,dc=com


# Customers #

dn: ou=customers, dc=mycompany,dc=com
objectclass: organizationalUnit

dn: cn=c1, ou=customers, dc=mycompany,dc=com
objectclass: organizationalUnit
member: uid=mno, ou=logins, dc=mycompany,dc=com
member: uid=pqr, ou=logins, dc=mycompany,dc=com

dn: cn=c2, ou=customers, dc=mycompany,dc=com
objectclass: organizationalUnit
member: uid=mno2, ou=logins, dc=mycompany,dc=com


// unames
dn: ou=unames, dc=mycompany,dc=com
objectclass: organizationalUnit
ou: logins

dn: uid=abc, ou=unames, dc=mycompany,dc=com
objectclass: inetOrgPerson
cn: a
sn: bc
employeeType: cn=p2, ou=roles,dc=mycompany,dc=com

dn: uid=pqr, ou=logins, dc=mycompany,dc=com
objectclass: inetOrgPerson
cn: p
sn: qr
employeeType: cn=p1, ou=roles, dc=mycompany,dc=com

Not sure if this is correct. But even if this is correct, I am getting confused beyond this

How do I have servers? Let's say I create an ou=servers,dc=mycompany,dc=com Then I have one entry for each server cn=srv1, ou=servers,dc=mycompany,dc=com etc.

How do see which server belongs to which customer. Do I add a member: inside the customer? In that case, the customer will have some members who are employees & some members which are servers. Is that OK?

Or is there a better way to do it?

How do I represent direct customers?

Should I create a reseller called direct & put direct customers in those & then use code logic to treat it as a special customer?

I have squid running on a gateway machine & I am trying to integrate it with Active Directory for authentication.

I am able to authentication by using ldap_auth & having this in squid.conf.

/usr/lib/squid/ldap_auth -b OU=my,DC=company,DC=com -h ldapserver -f sAMAccountName=%s -D "CN=myadmin,OU=Unrestricted Users,OU=my,DC=company,DC=com" -w mypwd

However, I am worried about the fact that I have the admin password in cleartext in squid.conf.

Is there a way that I can avoid this?

Squid is running on a debian machine.

Is it possible to slow down/throttle P2P traffic using iptables.

I am running IPtables on a Linux box which is a gateway to the intranet. Blocking P2P altogether seems to be rather difficult.

So I was thinking if there is a way to slow it down, so that it becomes useless for the user & also saves bandwidth. Googling showed me that it may be possible by using connlimit/limit-burst for doing this, but I can't find a detailed write up on this? Any iptables expert to help out with this using particular characteristics of P2P traffic. Also will this work with encrypted P2P also?

There may be 50 to 100 machines behind the gateway.

I am pretty new to LDAP & trying to design a schema for a particular need.

I have a Support Organization.

There are three levels P1 - lowest permissions P2 - middle P3 - highest permissions.

I have split the support team into subteams.

TeamA manages customers A1, A2, A3 etc TeamB manages customers B1, B2, B3 etc.

Customer A1 has his internal users. Internal Users of each customer have 2 levels of permissions either P1 or P2. Their P1 or P2 permissions are only for stuff relevant to themselves. i.e a P2 from Customer A1 will not have any permissions for Customer A2.

TeamA people (who manage customers A1, A2 etc) have either P1 or P2 permissions. A person from TeamA who has P2 permissions will have P2 permissions for each customer who is managed by TeamA. i.e. A TeamA P2 will have P2 for A1, A2, A3 (all of them).

Then there is a super support team. Here people are not specific to groups of customers. A P2 from the SuperSupport team will have P2 permissions for Customer A1, Customer B1 - for everything. A P3 will be similiar.

I have designing a schema

# Root node
dn: dc=myorg,dc=com
objectclass: organization
objectclass: dcObject
o: myorg.com
dc: myorg

# Groups
dn: ou=Groups, dc=myorg,dc=com
objectclass: organizationalUnit
ou: Groups

dn: cn=P1, ou=Groups, dc=myorg,dc=com
objectclass: organizationalRole
cn: P1
description: Lowest level

dn: cn=P2, ou=Groups,dc=myorg,dc=com
objectclass: organizationalRole
cn: P2
description: Higher level

dn: cn=P3, ou=Groups,dc=myorg,dc=com
objectclass: organizationalRole
cn: P3
description: Highest level of Support

# Teams
dn: ou=Team, dc=myorg,dc=com
objectclass: organizationalUnit
ou: partner
description: Teams

# Team A
dn: ou=teamB, ou=Team, dc=myorg,dc=com
objectclass: organizationalUnit
ou: teamA
description: Team A

# Team B
dn: ou=teamb, ou=Team, dc=myorg,dc=com
objectclass: organizationalUnit
ou: teamB
description: Team B

# Customers

# Customer A1 of Team A
dn: ou=custa1, ou=teama, ou=Team dc=myorg,dc=com
objectclass: organizationalUnit
ou: custa1
description: Some Org

# Customer B2 of Team B
dn: ou=custb2, ou=teamb, ou=Team, dc=myorg,dc=com
objectclass: organizationalUnit
ou: custb2
description: Some other Org

Is it correct up to this?

I am getting a little stuck beyond this - how do I put in people from different teams, different customers, super support etc, so that it would be easy to easily figure out after binding to the ldap server with a uname/passwd - what permissions that particular user has.

Can someone help or point me to a sample schema for similar requirements?

We have our own internal package repository hosted on a webserver running apache.

Internal users who want to install one of these packages point these sources.list to the webserver & do a apt-get update & apt-get install packgname.

One of these packages is a package called ourpkgname_1.0.0-0_all.deb

now i have made come changes and created a new updated package called ourpkgname_1.0.1-0_all.deb.

I have no idea how to remove the original package from the webserver directory & add the new version. just deleting it at the /tmp/mirror/pool etc & copying the name package doesn't work. I am assuming there is some command which i need to run to copy & regenarate anything at the repository, but don't know how to.

Can someone help or point me to the appropriate documentation

I have a Debian server running at the gateway level on a LAN. This runs squid for creating block lists of websites - for eg. blocking social networking on the LAN. Also uses iptables.

I am able to do a lot of things with squid & iptables, but a few things seem difficult to achieve.

1) If I block facebook through their http url, people can still access https://www.facebook.com because squid doesn't go through https traffic by default. However, if the users set the gateway IP address as proxy on their web browser, then https is also blocked. So I can do one thing - using iptables drop all outgoing 443 traffic, so that people are forced to set proxy on their browser in order to browse any HTTPS traffic. However, is there a better solution for this.

2) As the number of blocked urls increase in squid, I am planning to integrate squidguard. However, the good squidguard lists are not free for commercial use. Anyone knows of a good squidguard list which is free.

3) Block yahoo messenger, gtalk etc. There are so many ports on which these Instant Messenger softwares work. You need to drop lots of outgoing ports in iptables. However, new ports get added, so you have to keep adding them. And even if your list of ports is current, people can still use the web version of gtalk etc.

4) Blocking P2P. Haven't been able to figure out how to do this till now.