plug-gw(8) · carta

NAME

plug-gw - generic TCP plugboard proxy

SYNOPSIS

plug-gw portnumber/name [invoked from inetd]

DESCRIPTION

plug-gw provides pass-through TCP services with logging and access control for generic connection-oriented applications like NNTP. When plug-gw is invoked from inetd(8), it reads its configuration and checks to see if the system that has just connected is permitted to use the proxy. If not, it shuts down and logs the connection. If the peer is permitted to use the proxy, plug-gw determines, based on its configuration, what host to connect to on the "other side".

The service port plug-gw is servicing must be specified on the command line.

OPTIONS

plug-gw reads its configuration rules and permissions information from the firewall configuration table netperm-table, retrieving all rules specified for "plug-gw". The following configuration rules are recognized:

timeout seconds: specifies a timeout value, after which to disconnect inactive connections. If no timeout is specified, the default is to remain connected until one side or the other closes its connection.

port portid host-pattern [options]: specifies a connection rule. When a connection is made, a match is searched for on the port-id and calling host. The port-id may be either a numeric value (e.g.: 119) or a value from /etc/services (e.g.: "nntp"). If the calling port matches, then the host-pattern is checked for a match, following the standard address matching rules employed by the firewall. If the rule matches, the connection will be made based on the remaining options in the rule, all of which begin with '-'. Sub-options are:

: -plug-to host specifies the name or address of the host to connect to. This option is mandatory.

: -privport indicates that a reserved port number should be used when connecting. Reserved port numbers must be specified for protocols like rlogin which rely on them for "security."

: -port portid specifies a different port. The default port is the same as the port used by the incoming connection.

INSTALLATION

To install plug-gw first place the executable in a system area, then modify inetd.conf(5) to install plug-gw for whatever services will be plugboarded. Reinitialize inetd(8) and test by connecting to the port.

plug-gw was designed to permit "tunnelling" NNTP traffic through firewalls, but it can be used for a variety of purposes such as permitting remote access to a single service on a single host. Typically, when configured for NNTP traffic, one configures one's software so that internal NNTP connections to the outside news server connect to the firewall and are automatically plugboarded to the external NNTP server, and vice versa. The USENET news software must then be configured so that both the internal and external NNTP servers believe they are exchanging news with the firewall machine.

EXAMPLE

The following entries permit NNTP transfer through a firewall

bastion host. In this example the interior news server host is "foo.us.org" (111.11.1.11) and the externam news server is "nntp.outside.someplace" (222.22.2.22). Our bastion host, where the software is installed is "bastion.us.org". On the bastion host, we place an entry for the NNTP service in inetd.conf:

nntp stream  tcp  nowait  root  /usr/local/etc/plug-gw plug-gw nntp

The plug gateway is invoked as "plug-gw nntp" to inform it that it is providing NNTP service. The configuration entries in netperm-table are as follows:

plug-gw: timeout 60
plug-gw: port webster 111.11.1.* -plug-to WEBSTER.LCS.MIT.EDU -port webster
plug-gw: port nntp 111.11.1.11 -plug-to 222.22.2.22 -port nntp
plug-gw: port nntp 222.22.2.22 -plug-to 111.11.1.11 -port nntp

Whenever 111.11.1.11 connects to the bastion host, it is automatically connected to 222.22.2.22's nntp service. The news software on 111.11.1.11 should be configured to believe that its news server is the bastion host "bastion.us.org", since that is the host to which it transfers and receives news. Note too that a simple webster service is provided by plugging webster on another host over the internet to the webster service port on the bastion host.

FILES

/etc/inetd.conf: netperm-table

BUGS

Since incoming connection hosts can be wildcarded, plug-gw works well in a many-to-one relationship but does not work at all in a one-to-many relationship. If, for example, a site has 3 news feeds - it is easy to configure plug-gw to plugboard any connections from those 3 hosts to an internal news server, but unless there are multiple instances of plug-gw on different ports, and the internal news server's software can support connecting on a non-standard port, modification to software will be required.