i've not heard of any recent problems..

illumos had a bug briefly where it was issuing the wrong LBAs (obviously not a good thing) but that's been fixed for a while

[illumos-gate] 15510 Update tzdata to 2023b -- Andy Fiddaman <illumos⊙fn>

Does illumos have an equivalent of GNU excvpe ?

execvpe

paulf no, but there is a WIP change to add it at code.illumos.org/c/illumos-gate/+/2066

→ CODE REVIEW 2066: 7125 Provide execvpe (NEW) | illumos.org/issues/7125

tzdata 2023c is likely to come out soon (Lebanon again).

Do they have a ETA on d?

<sigh>

Good thing this is early in the SmartOS release cycle (plus a Lebanon update *hopefully* wont' require manifest changes).

hi!

thanks for illumos!

I have a single IP and want to run an ftp server in a zone.  I need to use NAT.

the "rdr" directive in the man page has something that looks like

"port" port range port

what exactly does that mean

rdr e1000g0 from any to 144.76.69.252 port 65001-65100 -> 10.0.5.81

rdr e1000g0 from any to 144.76.69.252 port 65001:65100 -> 10.0.581

rdr e1000g0 from any to 144.76.69.252 port 65001 range 65100 -> 10.0.5.81

rdr e1000g0 from any to 144.76.69.252 port 65001 ... 65100 -> 10.0.5.81

don't work ... can anyone tell me what I should type?

hello hightower2, you're new here

do you know anything about ipnat.conf?  -- I need to redirect a block of ports

alternatively, do you need help?

I know everything, except, of course, for the things I don't know

os10000: according to the manpage you should be using the ':' in your port range.

"man ipnat.conf"

thanks, I'll try again

[6:28:36 PM] <os10000> "port" port range port

[6:28:41 PM] <os10000> what exactly does that mean

syntax error error at ":", line 16

000011  #       cmd-masq-service

000012          rdr e1000g0 from any to 144.76.69.252 port = 80 -> 10.0.17.217 port 80 tcp

000013          rdr e1000g0 from any to 144.76.69.252 port = 443 -> 10.0.17.217 port 443 tcp

000014          rdr e1000g0 from any to 144.76.69.252 port = 1194 -> 10.0.9.243 port 1194 tcp

000015          rdr e1000g0 from any to 144.76.69.252 port = 21 -> 10.0.5.81 port 21 tcp

000016          rdr e1000g0 from any to 144.76.69.252 port 65001:65100 -> 10.0.5.81

000017          rdr e1000g0 from any to 144.76.69.252 port = 2022 -> 10.0.5.81 port 22 tcp

000018  #

maybe rdr does not allow ranges

I'll read the man page again

redir ::= "rdr" ifname rlhs "->" ip [ "," ip ] rdrport rdroptions .

yeah, I don't see an example of a rdr with a port range in the man page. I don't know.

the rlhs could be

rlhs ::= ipmask dport | fromto .

a fromto

fromto ::= "from" object "to" object .

oh.... yeah, that might use a hyphen?!

I have "from any to ***"

the *** is an object

object :: = addr [ port-comp | port-range ] .

I would need an address, which I have ...

followed by a "port-range"

port-range :: = "port" port-num range port-num .

now that is the thing which puzzles me

rdr e1000g0 from any to 144.76.69.252 port 65001:65100 -> 10.0.5.81

I start on "port" alright

I have a number following it (65001)

then comes the >>>>range<<<<< whatever that is

followed by another port number

I think I was wrong. I think it's a hyphen, not a colon.

rdr e1000g0 from any to 144.76.69.252/32 port = www -> 10.0.17.217 port 80 tcp

rdr e1000g0 from any to 144.76.69.252/32 port = https -> 10.0.17.217 port 443 tcp

rdr e1000g0 from any to 144.76.69.252/32 port = openvpn -> 10.0.9.243 port 1194 tcp

rdr e1000g0 from any to 144.76.69.252/32 port = ftp -> 10.0.5.81 port 21 tcp

syntax error error at "-", line 16

000014          rdr e1000g0 from any to 144.76.69.252 port = 1194 -> 10.0.9.243 port 1194 tcp

000015          rdr e1000g0 from any to 144.76.69.252 port = 21 -> 10.0.5.81 port 21 tcp

000016          rdr e1000g0 from any to 144.76.69.252 port 65001-65100 -> 10.0.5.81

000017          rdr e1000g0 from any to 144.76.69.252 port = 2022 -> 10.0.5.81 port 22 tcp

000018  #

stop pasting the lines that work.

sorry

let me see if I have a zone I can use to test this.

oh thanks!

The grammar in the man page is slightly broken. There's no definition for "portnum" but it gets used...

ok ...

when I logged onto this IRC channel, I got a message where to find the illumos source code

I thought I could look at the BNF grammar, but found a bunch of examples first

maybe I can do without forwarding a range entirely

but I have another 12 hosts to do and I fear I will need a portrange before I'm done with all of them.  FTP might not be my only problem that needs a range

that's probably only going to grab the single port from /etc/services if I had to guess.

there's a builtin proxy

and ... it would be nice to understand what I'm doing ... when it's security relevant

I mean... you're using regular FTP...

clearly I'm not understanding something correctly

ok, that's an oxymoron ... using "ftp" and "security" in the same sentence

I'm trying to confine that thing to a zone without other services

oh, there is a "ftp proxy" in there... hmmm.

but it's a map rather than a redir.

I've been nerd-sniped into complete confusion now.

I couldn't get it to work, so I tried mapping 21 + a range

the proftpd allows itself to be restricted to a range and it has a masquerade command if I were to get the range to work

currently the proftpd is configured as a standard ftp server

from the parent zone it can be reached and used just fine

I have to tap out. I need to get back to work and I'm not any closer to helping you solve this.

many thanks for your time

have a good day

nahamu: The FTP proxy is, I believe, for users _inside_ a cone NAT that are trying to use "active" FTP instead of passive FTP (which is what everybody should use now)

where the FTP server is expected to connect _back_ to you

that sounds right

I suspect active ftp is a thing few people remember really these days

sftp != ftp.

and especially != active ftp

yeah, but still....

SFTP is basically fine

it's just SSH

jclulow, as long as you don't mind account management for $random_contact.