Is there any way that you guys know of to configure Astaro so that the IDENT proxy will return a CLOSED response rather than open?

Neither open nor stealthed/filtered is desired for me since I need to be able to use Outlook from behind Astaro. If the port is stealthed it takes almost a minute to get my mail.

If it is open...well, it's open.

Is there any way to have it return an RST?

Thanks,

danielrm26

3.2 has "reject" and "log reject" packet filter actions.

use

"Any" "IDENT" "external_Interface__"

and you should be set.

/tom

I already tried that; it doesn't work for some reason.

It still stealthes/filters the incoming probes, which bogs down my email checking process as described.

I am going to try again though to make sure I didn't do something dumb.

I think I found the problem. Astaro is using ICMP destination unreachable responses to indicate a 'reject' response.

This, I don't think, is standard. A TCP RST is what both email servers (and less importantly scanners) are looking for to determine whether or not a machine is there. All the email server wants is to know that it is there, which it accepts as true if it gets anything back from the mail requesting machine. The problem seems to be that ICMP is not included in its list of things to watch for.

So, the only things it is waching for are SYN ACK or RST flags, not ICMP 3,3 responses. This is why I can't get my mail faster or come up 'closed' on any scanners when I reject rather than drop. For all intents and purposes I am dropping the requests.

Any thoughts on this?

Have you tried just turning on the "IDENT Relay" WITHOUT forwarding?

Yes, the relay doesn't need a rule in the packetfilter. If you open the relay the port is open.

So, what's wrong with that port being open (only on the firewall)?

ISTM the "IDENT Relay" was designed exactly to handle your problem, assuming you're using masquerading for the internal clients.

[ 25 July 2002, 18:00: Message edited by: barrygould ]

<font size="2" face="Verdana, Arial">I've had similar problems with POP3, but they turned out to be missing reverse DNS, rather than Ident, but maybe Exchange (or whatever server you're using) does Ident. (IMO, it's stupid if it does. Ident is an almost useless protocol.) You might want to double check the reverse DNS though.

Barry

<font size="2" face="Verdana, Arial">I simply would rather not use the proxy, or have the proxy show closed on that port. I just don't see a reason to allow a complete connection to my firewall box (on any port) when all the stupid legacy IDENT protocol needs is an RST packet.

Astaro 3.2 uses "oidentd"

fw:/var/chroot-identd/bin # ./oidentd__ -v
oidentd 2.0.3
Ryan McCabe <odin@numb.org>
http://dev.ojnk.net

I don't know if it's vulnerable or not, but it is CHROOTED so root compromise of the entire ASL box is unlikely.

Barry