Firewall state suppliers 11.. PPrriinncciipplleess A suppliers is a server (generally) which can send updates to the file /var/run/userfirewall.state. These updates are sent with the utility firesendid. A supplier is identified by a name and a secret. Suppliers are stored in the file /etc/userfirewall/suppliers.conf. 22.. TThhee ffiirreelliisstteenn uuttiilliittyy iiss ggeenneerraallllyy eexxeeccuutteedd ffrroomm iinneettdd ((oorr xxiinneettdd)) IInnssttaalllliinngg tthhee ffiirreelliisstteenn 22..11.. FFiillee //eettcc//sseerrvviicceess Configure the service in /etc/services. Add the following line in that file: firelisten 999/tcp Pick an TCP port number. 22..22.. xxiinneettdd ccoonnffiigguurraattiioonn The package provides a configuration file /etc/xinetd.d/firelisten. Edit the file and turn the service on (disable = no). 22..33.. iinneettdd ccoonnffiigguurraattiioonn For the inetd server, edit the file /etc/inetd.conf and add the following line: firelisten stream tcp nowait root tcpd /usr/lib/linuxconf/lib/firelisten firelisten --updfw /sbin/linuxconf --modulemain firewall --update 33.. UUssiinngg ffiirreesseennddiidd You must install the userfirewall package on the firewall and on the various servers contributing to the firewall rules. On those server, the firesendid is used to exchange with the firewall. Here are the various command lines: 33..11.. ffiirreesseennddiidd ooppttiioonnss +o --fhost host host is either the name or IP number of the firewall. +o --port port This specifies the TCP port to use to reach the firelisten service (999 by default). +o --id id This specifies the supplier ID to use. This ID correspond to an entry in /etc/userfirewall/suppliers.conf. The entry is located and the secret is used to authenticate with the firewall. 33..22.. AAddddiinngg iinnffoorrmmaattiioonn aabboouutt aa llooggggeedd uusseerr /usr/lib/linuxconf/lib/firesendid options login user IP-number groups ... 33..33.. RReemmoovviinngg iinnffoorrmmaattiioonn aabboouutt aa llooggggeedd oouutt uusseerr The following command remove the entry for user "user" with IP "IP- number". /usr/lib/linuxconf/lib/firesendid options logout user IP-number 33..44.. RReemmoovviinngg aallll iinnffoorrmmaattiioonn aabboouutt aa llooggggeedd oouutt uusseerr The following command remove all entries for user "user". /usr/lib/linuxconf/lib/firesendid options logout user 33..55.. RReemmoovviinngg aallll iinnffoorrmmaattiioonn oonn tthhee ffiirreewwaallll The following command remove all entries (for all users) int /var/run/userfirewall.state on the firewall /usr/lib/linuxconf/lib/firesendid options reset 44.. UUsseerrffiirreewwaallll aanndd SSaammbbaa The interest of the firesendid utility is limited, unless you hook it to a service already providing authentication for users on your network. The Samba server does exactly that. Once a user is logged to your Samba server, you can retrieve his IP number and you can trust the authentication (the user provided a password). To hook firesendid, you modify one share configuration (homes for one) and place a "root-preexec" directive. Using the %U and %I macro, you can update your firewall in real time from your Samba server: [homes] . . root-preexec = /usr/lib/linuxconf/lib/firesendid --fhost host \ --port 999 --id your_server login %U %I root-postexec = /usr/lib/linuxconf/lib/firesendid --fhost host \ --port 999 --id your_server logout %U . . 55.. SShhaarriinngg ssuupppplliieerrss..ccoonnff The firesendid is reading its secret from the file suppliers.conf. One can create a suppliers.conf on the firewall and distribute it to the contributing servers as needed. The format is straightforward: supplierID:secret: