RE: apt-get & firewall

["Davi Leal" <david.leal@ene.es>]

> Pontus Edvardsson wrote:
> I've followed the discussion, but, what if you have a proxy between
the
> client and firewall? Is it possible to have APT-GET log on the proxy?

I have not any idea.  :-(

Davi



> From: "Davi Leal" <david.leal@ene.es>
> > Paul 'Baloo' Johnson wrote:
> > > On Tue, 30 Oct 2001, Frederico.S.Muñoz wrote:
> > > > AFAIK either the HTTP, the FTP, or both; it depends on what you
> > > > define in your sources.line.
> > > >
> > > > If you only define http sites you would only need the http port
> > > > open, the same with the ftp.
> > >
> > > 2 things:
> > >
> > > 1) If you're blocking connections anal retentively, non-passive
FTP
> > > may break anyway.
> > >
> > > 2) Why are you blocking *outgoing* connections, anyway?  If you
don't
> > > trust people inside your network to make an outbound connection,
do
> > > they really need to be on the network at all?
> >
> > I am not an expert, anyhow, I think the *outgoing* connections are
> > allowed. See below:
> >
> > # Output rules
> > #
> > # ipfwadm -O -l
> > IP firewall output rules, default policy: deny
> > type  prot source       destination   ports
> > acc   ALL  X.X.X.0/25   0.0.0.0/0     n/a
> > acc   ALL  0.0.0.0/0    X.X.X.0/25    n/a
> >
> >
> >
> > And the machine which has the issue has the below allowed:
> >
> > # Input rules
> > #
> > # ipfwadm -I -l | grep 5
> > acc   TCP  0.0.0.0/0    X.X.X.5    * -> 80
> > acc   TCP  0.0.0.0/0    X.X.X.5    80,443 -> 1024:65535
> > acc   TCP  0.0.0.0/0    X.X.X.5    119,81,20,21 -> 1024:65535
> >        ^
> >        ^
> >
> >
> > The X.X.X.5 host is behind the firewall. Why pointing apt-get to
> > ftp.de.debian.org raises a "Connection time out" message after
> > Login-Connecting successfully?. The "Packages" file is not
downloaded
> > any byte (0%). Note: I can use "lynx" and "ftp" rightly on the
X.X.X.5
> > host. I can even download the "Packages" file using the "ftp"
command.
> > Uhmm, ... Is it needed enable the UDP protocol to use "apt-get"?.
> >
> > # ipfwadm -I -l | grep 5
> > acc   TCP  0.0.0.0/0    X.X.X.5    * -> 80
> > acc   TCP  0.0.0.0/0    X.X.X.5    80,443 -> 1024:65535
> > acc   TCP  0.0.0.0/0    X.X.X.5    119,81,20,21 -> 1024:65535
> >        ^
> >        ^
> >
> >
> >
> > Do you know any SMTP, FTP, firewall, DNS, POP3, ... server which
uses
> > Debian and  "apt-get update ; apt-get upgrade" in cron to fix the
> > security bugs automatically?. Is it usual?.
> >
> >
> > Davi