On Mon, Jul 25, 2016 at 5:40 PM, R.B. <[email protected]> wrote:
> On 07/25/2016 09:31 PM, Franz wrote:
>
>>
>>
>> On Mon, Jul 25, 2016 at 3:20 PM, Marek Marczykowski-Górecki
>> <[email protected]
>> <mailto:[email protected]>> wrote:
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA256
>>
>> On Mon, Jul 25, 2016 at 03:14:02PM -0300, Franz wrote:
>> > On Mon, Jul 25, 2016 at 2:51 PM, Marek Marczykowski-Górecki <
>> > [email protected]
>> <mailto:[email protected]>> wrote:
>> >
>> > > -----BEGIN PGP SIGNED MESSAGE-----
>> > > Hash: SHA256
>> > >
>> > > On Mon, Jul 25, 2016 at 02:46:55PM -0300, Franz wrote:
>> > > > On Mon, Jul 25, 2016 at 1:24 PM, Marek Marczykowski-Górecki <
>> > > > [email protected]
>> <mailto:[email protected]>> wrote:
>> > > > > On Mon, Jul 25, 2016 at 12:06:54PM -0300, Franz wrote:
>> > > > > > On Mon, Jul 25, 2016 at 11:11 AM, Marek
>> Marczykowski-Górecki <
>> > > > > > [email protected]
>> <mailto:[email protected]>> wrote:
>> > > > > > > On Mon, Jul 25, 2016 at 09:37:10AM -0400, Steve Coleman
>> wrote:
>> > > > > > Anyway regarding Marek script I tried it in a dispVM, it
>> writes:
>> > > > > > tcpdump: listening on eth0, link-type EN10MB (Ethernet),
>> capture size
>> > > > > > 262144 bytes
>> > > > > >
>> > > > > > but then if on the same dispVM I use firefox to go to a
>> gmail
>> > > account or
>> > > > > > another account, nothing appears on the terminal.
>> > > > > >
>> > > > > > I even looked if anything changed on dispVM firewall
>> rules, but found
>> > > > > > nothing different.
>> > > > > >
>> > > > > > So how is this script working?
>> > > > >
>> > > > > I've just tried and it is still working. It should output
>> list of
>> > > > > blocked destinations in format of qvm-firewall commands
>> ready to load
>> > > > > into Qubes firewall.
>> > > > >
>> > > > ,
>> > > > "blocked destinations"? This makes me think that I should block
>> > > > destinations somehow before running the script. Is that so?
>> > >
>> > > Yes, change VM firewall to deny by default.
>> > >
>> > >
>> > ok now it works, it outputted a list of addresses. But I have to
>> paste this
>> > list on firewall rules of that VM and this is on Qubes Manager
>> that is on
>> > Dom0, so normal copy paste between VMs does not work.
>> >
>> > I can only imagine of writing the addresses on a text file, then
>> copying
>> > the file to Dom0, using
>> >
>> > qvm-run --pass-io <src-vm> 'cat /path/to/file_in_src_domain' >
>> > /path/to/file_name_in_dom0
>> >
>> > opening the file in Dom0 (which seems half prohibited) and finally
>> copying
>> > the adresses to Qubes Manager.
>> >
>> > Otherwise I'll have to digit manually the addresses to Qubes
>> Manager.
>> >
>> > Which is the suggested way to do that?
>>
>> Personally I do some thing like:
>> qvm-run --pass-io <src-vm> 'cat output-of-that-command'
>>
>>
>> After much trying I am unable to figure out how to get this command
>> working. If anybody may give an example I would appreciate.
>> Best
>> Fran
>>
>
> Hi Franz,
>
> The way I use it:
>
> - Make sure Marek's perl script is in the vm you want to monitor.
> Preferably in /home/user.
> - Make sure the firewall is set to "Deny network access except..." by
> default.
> - Open a terminal in Dom0.
> - Enter the command:
> qvm-run --pass-io YourVM 'sudo tcpdump -vni eth0 port 53 or icmp | perl
> ./firewall-learn.pl'
>
>
Thanks for the example, this goes a little more, in dom0 I reach the step:
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size
262144 bytes
but then instead of
qvm-firewall -a debian-8-multimedia-dvm 104.20.30.3 tcp 443 that I get on
dispVM terminal
I get nothing more appearing on Dom0 terminal.
On the other hand if I try to use Marek suggestion adding "cat" with
something like
qvm-run --pass-io disp16 'cat sudo tcpdump -vni eth0 port 53 or icmp | perl
./firewall-learn.pl'
I get: cat: invalid option -- 'i'
I even tried to invent parenthesis :-)
qvm-run --pass-io disp16 'cat {sudo tcpdump -vni eth0 port 53 or icmp |
perl ./firewall-learn.pl}'
getting more errors.
Fact is I cannot invent nothing. One should understand what is doing and I
am not.
Best
Fran
- Run your program you want to monitor.
> - Select the rules you think you need the program to run properly and
> copy/paste them to another terminal in Dom0.
>
> Few things I'm unsure about,
> - a Check at ICMP?
> - a Check at DNS?
> - is using this perl script via qvm-run considered safe?
>
> Have fun and thanks Marek for your script! Just what I needed!
>
> Greetings,
>
> RB
>
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/CAPzH-qBh%3D4iwudDo1FiaALxRx1mms7rab2F7seLqyh-ZQLqwxg%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.
