[7.460][BUG][FIXED] Can't resolv short names when IPS enabled

Hi,

I already reported on another thread... but that thread was not clear enough I think as I was thinking something else was causing the problem !

So bascially I've DNS names which can be resolved from internet with a domain which is fully registered...
For this domain I've A records which are pointing to private IPs, (things like 172.18.0.0/16)...

in my /etc/resolv.conf on my linux box (ubuntu 9.04) I've things like:


search domain1.com domain2.com ...

nameserver x.y.z.t

when my IPS is off, everything is fine I can resolv thing like host1 or host1.domain1.com..

as soon as I activate my asg IPS I'm able to resolve host1.domain1.com (FQDN) but not host1 [[[:(]]]

and I've tried to add an exceptions for all my internal network into the IPS without luck [[[:(]]]

So to me there is 2 bugs there:
1/ can't resolv the short names when IPS is active
2/ exceptions are not working for my case [[[:(]]]

So I need to disable my IPS... which is really annoying, hope this will be fixed in upcoming beta...

thx

0 Astaro Beta Bot over 15 years ago

Astaro Beta Report
--------------------------------
Version: 7.460
Type: BUG
State: FIXED
Reporter: BuBU
Contributor: 
MantisID: 10831
--------------------------------

0 andyk007 over 15 years ago

thanks for the information I've forwarded it to our R&D team

Greetings
Andreas
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 andyk007 over 15 years ago

Hi Bubu,

could you please add more details in this case?

- which settings have you in the exception tab (maybe a screenshot)
- how can we reproduce it
- have you error messages in /var/log/ips.log if the problem exist?
- is this error still existing in 7.470?

Greetings
Andreas
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BuBU over 15 years ago in reply to andyk007

Hi

The problems is still in 7.470.

Screenshots for my IPS config are attached, I've only one exception for my whole internal.

I've no special errors in ips.log

to reproduce this you need to have a registered domain that resolv private IPs, I think if you add static names for private IPs in your astaro you will also get the problem... then add yourdomain.com in the search in your /etc/resolv.conf if you are under linux or in your search stuff in your network properties if you are under windows...

Personnally using linux ubuntu, you can use a livecd if you do not have any linux box to test...

then try to resolv a short name which is in your domain, ie: nslookup myhost will not work (at least for me) but myhost.domain.com is working fine (in both case with IPS on) and if IPS is off I can resolv shortnames...

if you need more info just let me know I will PM more details if needed...

thx
- ips_config.jpg
- View
- Hide
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 andyk007 over 15 years ago

could you please send me the ips.log?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 BuBU over 15 years ago in reply to andyk007

could you please send me the ips.log?

ok I've just PMed all infos you need [:)]

let me know if you need more...

thx
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 andyk007 over 15 years ago

thanks for the login. I will take a look today on it together with our IPS engineer. I will inform you if we are ready.

Greetings
Andreas
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 andyk007 over 15 years ago

BUG in the new beta, please add as workaround add to /var/chroot-snort/etc/snort/
snort.conf-default:

output syslog_astaro: LOG_DAEMON LOG_ALERT LOG_PID

and restart snort via
cc / ips / status 0 /status 1
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 BuBU over 15 years ago in reply to andyk007

BUG in the new beta, please add as workaround add to /var/chroot-snort/etc/snort/
snort.conf-default:

output syslog_astaro: LOG_DAEMON LOG_ALERT LOG_PID

and restart snort via
cc / ips / status 0 /status 1

I tried through the console as u mentionned but got:


asg:/var/sec/chroot-snort/etc/snort # cc
Confd command-line client.  Maintainer: 
$Id: confd-client.pl,v 1.107.2.8.2.8.4.2 2009/05/22 09:32:08 ischwarze Exp $

Connected to 127.0.0.1:4472, SID = JDDKwtqshGcuXaIdwSen.
Available modes: MAIN OBJS RAW WIZARD.
Type mode name to switch mode.
Typing 'help' will always give some help.

127.0.0.1 MAIN > ips
dns_servers@
exceptions@
status$
http_servers@
local_networks@
rules@
smtp_servers@
rule_modifiers@
num_instances$
policy$
groups@
sql_servers@
pattern_version$

127.0.0.1 MAIN ips > status 0
Syntax error, or no such command, node, array, hash or scalar.

So I disabled/enabled through the interface...

but I still have no logs while to trying nslookup load1...

thx

0 BuBU over 15 years ago in reply to BuBU

Hi

I've just updated to 7.480 on my asg120,
and I still can't resolv short names when IPS is active and web proxy is disabled...

nslookup shortname 192.168.9.1

does not resolv ! [:(]

as soon as I activate web proxy it is working !

thx
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel