On Thu, 2007-10-11 at 12:24 -0400, Matthew Saltzman wrote:
> On Thu, 2007-10-11 at 10:01 -0400, Tony Nelson wrote:
> > At 3:39 AM +0000 10/11/07, Matthew Saltzman wrote:
> > >I'm trying to get my scanner running as a network service so remote
> > >machines can use it, but I've run into a snag. So my questions:
> > >
> > >- Does anyone have a good HOWTO for this?
> > >
> > >- In particular, there seems to be a connection tracker module for sane,
> > >but if I add ip_conntrack_sane to the modules list in
> > >/etc/sysconfig/iptables-config, the modules fail to load when I restart
> > >iptables. What am I missing as far as that step?
> >
> > Do you have any evidence that ip_conntrack_sane exists? The only mention
> > on Google is someone who couldn't find it (if I made sense of the
> > translation from Chinese).
>
> I'm not even sure where to look. ip_conntrack_netbios_ns and
> ip_conntrack_amanda load fine. The only files with similar names I can
> find are
> /lib/modules/<version>/kernel/net/netfilter/nf_conntrack_netbios_ns.ko
> and /lib/modules/<version>/kernel/net/netfilter/nf_conntrack_amanda.ko,
> but there is
> a /lib/modules/<version>/kernel/net/netfilter/nf_conntrack_sane.ko. So
> if those files are related to those modules, the answer should be yes.
>
> If not, then I really don't understand how the iptables modules thing
> works at all.
Well, in retrospect it seems like an obvious thing. Loading
nf_conntrack_sane works just fine. In fact, for many of the modules,
you can have iptables load ip_conntrack_<service> or
nf_conntrack_<service>. I suppose that's a backward compatibility thing
where "nf" is the new form and "ip" is the old, but for sane, the old
form doesn't work.
On to figure out the rest of this.
>
> >
> > I see a hack using ipt_recent. Eww.
> >
> > You could always roll your own from the other examples. (I wonder if there
> > is a configurable conntrack module? It seems that there could be, but I'd
> > have to read the various modules to be sure.)
>
> I could also just take down the firewall (or open all unprivileged
> ports), but I was hoping not to have to do anything that drastic.
>
> >
> >
> > >- Is there a way to get a Windows client to use a scanner served by a
> > >Linux machine over the net?
> >
> > Googling makes me think "yes, of course", but I haven't tried it.
>
> Thanks.
--
Matthew Saltzman
Clemson University Math Sciences
mjs AT clemson DOT edu
http://www.math.clemson.edu/~mjs
