From mboxrd@z Thu Jan  1 00:00:00 1970
From: Matthias Fischer <matthias.fischer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: Betatest Guardian 2.0
Date: Sun, 07 Aug 2016 00:41:21 +0200
Message-ID: <251990ec-a92b-7c31-98ea-2b5451ad9b7a@ipfire.org>
In-Reply-To: <8916bfc3-2af6-af48-992b-b014d51a405a@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2682712335728560239=="
List-Id: <development.lists.ipfire.org>

--===============2682712335728560239==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hi,

On 04.08.2016 18:41, Matthias Fischer wrote:
> Hi,
>=20
> ...for the records...:
>=20
> Today I found the time to take a look with 'htop' and 'top' for the
> 'iptables'-process and found that 'top' lists '1 zombie' (screenshots
> attached).
>=20
> "ps -el | grep 'Z'" says:
>=20
> ...
> root(a)ipfire: / # ps -el | grep 'Z'
> Warning: /boot/System.map-3.14.65-ipfire-pae not parseable as a System.map
> F S   UID   PID  PPID  C PRI  NI ADDR SZ  WCHAN TTY          TIME CMD
> 4 Z     0   771 10643  0  80   0 -     0      - ?        00:00:00
> iptables <defunct>
> ...

Ok, I think at last I found something - perhaps this helps:

After some playing around I discovered that this 'iptables'-zombie comes
up if I unblock an entry from the "Currently blocked hosts"-list.

Secondly I altered the 'sleep'-time of the 'stop/start'-cycle in
'/etc/init.d/guardian' to four seconds to avoid restart problems.
If start/stop happens too soon, I got "Unable to continue:
/usr/sbin/guardian is running" warnings.

Now, after stopping/restarting 'guardian, the 'iptables'-zombie is gone.

HTH,
Matthias

>=20
> IMHO this is definitely not as it should be...
>=20
> Best,
> Matthias
>=20
> On 31.07.2016 10:39, Michael Tremer wrote:
>> On Sun, 2016-07-31 at 09:20 +0200, Matthias Fischer wrote:
>>> Hi,
>>>=20
>>> On 28.07.2016 20:05, Stefan Schantl wrote:
>>> > New test version (004) available.
>>> >=20
>>> > http://people.ipfire.org/~stevee/guardian-2.0/
>>> >=20
>>> >=20
>>> > Changelog: http://people.ipfire.org/~stevee/guardian-2.0/Changelog.txt
>>> >=20
>>> > Installation is the same way than all previous versions.
>>> >=20
>>> > Please do a lot of testing, I'm still lacking of feedback for=20
>>> >=20
>>> > * owncloud
>>> > * proper handling of reconnections on red
>>> > * detection of rotating the logfiles (logrotate)
>>> >=20
>>> > As usual please provide your feedback on this list and report any bugs
>>> > to our bugtracker.
>>> >=20
>>> > Best regards,
>>> >=20
>>> > -Stefan
>>> > > ...
>>>=20
>>> Perhaps this is something you need to know?
>>>=20
>>> Yesterday 'guardian' was still running, but didn't block anymore. I
>>> think this happened because I had changed the DNS-Servers through 'setup'=
!?
>>>=20
>>> Since I'm 'static', there is no way doing this through GUI, so I had to
>>> do this with a 'root'-console and PuTTY.
>>>=20
>>> After network had stopped/started, 'guardian' was still running, but
>>> scanning with http://www.whatsmyip.org/port-scanner/server/ didn't
>>> trigger a block action on Port 1433 anymore as it usually did before.
>>>=20
>>> I'm using Snort 2.9.8.3 with "Emergingthreats.net Community Rules" and
>>> this test normally ends with:
>>>=20
>>> Datum:	07/31 01:26:34
>>> Name:	ET POLICY Suspicious inbound to MSSQL port 1433
>>> Priorit=C3=A4t:	2
>>> Typ:	Potentially Bad Traffic
>>> IP-Info: 	208.64.38.55:55036 -> 192.168.99.254:1433
>>> Referenzen:	http://doc.emergingthreats.net/2010935
>>> SID: 	2010935
>>>=20
>>> But after changing DNS entries and restarting network, 'guardian' didn't
>>> react/block anymore during the next scan test.
>>>=20
>>> After restarting 'guardian' with /'etc/init.d/guardian restart',
>>> 'guardian' changed status ID, memory raised from 14342 KB to 14732 KB
>>> and during the next scan, 208.64.38.55 was blocked again.
>>>=20
>>> 'pstree' says:
>>>=20
>>> ...
>>>      |-guardian-+-iptables
>>>      |          `-4*[{guardian}]
>>> ...
>>=20
>> I would like to know as well why this iptables process seems to remain in =
memory
>> all of the time.
>>=20
>> Memory consumption of guardian itself seems to be fixed now.
>>=20
>>>=20
>>>=20
>>> Best,
>>> Matthias
>>>=20
>>=20
>=20


--===============2682712335728560239==--