Fwd: [ANNOUNCEMENT] Umit 0.8.2-testing release

["Adriano Monteiro" <py.adriano () gmail com>]

Just forwarding my answer...

Hi Fyodor!

I glad that you answered with this long e-mail telling me your
experiences with Umit.

On 8/14/06, Fyodor <fyodor () insecure org> wrote:
> Hi Adriano.  I've been playing with your latest release and I find
> that, when it works, Umit beats the pants off NmapFE!  I would like to
> replace NmapFE with UMIT if we can resolve some of the issues.  I'll
> first describe my Linux testing as that was the most successful.

Did tested Umit only in Linux? Or have you tried it on a Windows box also?

> I downloaded umit-0.8.2.tar.bz2 and was glad to see that it was only
> 971K.  I was also pleased to see a README file in the tarball giving
> installation instructions.

I can considerably reduce this size if I make specific packages for
umit (like a deb or rpm), by removing some unused icons (in a Linux
box with PyGTK 2.6 or higher Umit doesn't use the png files).

> The README has "Default (source) Installation" which involves running
> umit.pyw and "GNU/Linux Installation" which involves running setup.py.
> I first tried running umit.py.  It didn't have the execute bit set and
> so I had to chmod 755 it first.  But even after that, umit.py failed
> with the message "ImportError: No module named pysqlite2".  Indeed I
> don't have such a package installed on my updated Fedora Core 5 system,
> but I do have "python-sqlite-1.1.7-1.2".

That's right... The import error is due to the lack of the pysqlite2
module that is used for search purposes. I don't know if you saw that
the installation instructions page
(http://umit.sf.net/install.html#linux1) has a simple bash script that
verifies if your system meet the dependency needs.

> Next I tried running setup.py.  It installed a bunch of stuff to
> /usr/bin and other /usr paths.  It would be nice for the README to
> explain how to select the installation directory.  Nmap can be
> installed in an unprivileged user's home directory, and UMIT should be
> able to support the same.

This installation process is done by the python's distutils module,
and I don't know if you can select the installation path (but I
believe it's possible). I'll manage to explain that on the README file
and on the installation docs. Another way of accomplish this, is by
just unpacking the umit package inside your user directory and run it
from there.

> Anyway, I then ran /usr/bin/umit.pyw and up popped UMIT!  It did say
> "ERROR - 2006-08-13 20:09:04,086 - RUNNING WITHOUT PSYCO!", whatever
> that means.  I filled out the target "scanme.nmap.org" and pressed
> "Start Scan".  Everything else was left as is.  Unfortunately, nothing
> happened in the GUI.  On the terminal in which UMIT started I saw the
> error "sh: -oX: command not found".  This sort of error should
> probably pop up a dialogue since people may not see terminal window
> errors (especially if they start the app through a window manager
> menu).

Psyco is a module that speeds up Umit execution. You don't need it,
but I recomend its use if you want to boost the application
(http://psyco.sf.net). I'll change this error to a warning message, as
the word error can make the user think that something really bad
happenned and Umit won't work properly (what in not true, as Umit run
exactly the same without it - just a bit slow).

> Guessing that the problem may have been the blank-by-default profile
> field, I changed it to "Quick Scan".  This time the "command" field
> was populated and the scan commenced successfully as soon as I hit the
> start button.  Yay!  There should probably be a default profile, or at
> least an error message if you try to start a scan without selecting
> one.

Yes... It's surely an usability issue. I'll put there a default
profile, and a error dialog to avoid problems.

> But once I began dealing with multiple tabs, I accidently closed a tab
> when I was trying to just switch to that tab.  Argh!  The "close tab"
> X icon placement is really bad.  Is there an easy way to put the
> "close" button on the right side of the panel like it is on FireFox?
> Or some other alternative to having it inside the "switch to this tab"
> area?  If there is no other option for moving the "close tab" button,
> I'd like to have a confirm dialogue when you close a tab.

Well, if no dialog appeared asking if you were sure about closing the
tab, is because the tab content is already saved, and had no changes
on it, right?
I don't know if I can put the close button in another place of the
notebook with GTK. But I'll try anyway. I remember of you questioning
this last year, and I tried to make it different for you, but had no
lucky. There's another thing that behaves differently in GTK tabs when
compared to those in firefox. If you open lots of tabs in GTK, there
will appear two arrows in each side of the tabs bar to let you move
between tabs. In firefox, the tabs are resized and you don't have to
use those buttons. I think that because of these buttons in GTK, it's
not possible to make it be like in firefox, unless if I create a new
widget or reimplement it.

> I started a moderately long scan and Nmap (not surprisingly) just
> sat there for a while.  Is there any way to see progress reporting?
> I guess a start would be including "-v" in more of the default
> profiles.

Progress was one of the features that I was going to implement during
this SoC, but, I discovered that it is not possible to do in a
cross-platform way (not without adding too much dependencies to umit).
I sent you an e-mail at the time that I discovered that, in which I
said that to get that working would be better and less error-prone to
make a python wrapper to Nmap libs and use then directly, instead of
running the Nmap command. Anyway, I'll add the -v at default profiles
to help on that until we decide on what to do about this issue.

> I then tried the "compare results" option.  I can see this generic text
> diff potentially being useful, but we may want to consider making it
> understand Nmap output later so that it can directly tell you about
> new/missing hosts, newly open/closed ports, etc.

Well... Did you tried the new compare mode? The text mode is a legacy mode now.

> I tried resizing the application and that was totally graceful!  Too
> many GUIs (and web pages) fail that test.  Good job!

Thanks!

> I really like the way you can flip through the target hosts on the
> left-menu and see them displayed in the "Open Ports", "Host Details",
> or "Scan Details" panes.  But what do you think about also letting you
> flip through them while reading the "Nmap Output" pane?  Selecting a
> host on the left would cause the "Nmap Output" pane to be positioned
> at the "Interesting ports on ..." line for that host.

Great point! I'll do it.

> The "Profile editor" is great.  But is it possible to do a UDP scan
> with this?  Also, the "Special scans" pull-down on the "scans" pane
> seems to overlap with the checkboxes on the "special" pane.  You can
> probably just remove the Special pane entirely.  I really like the way
> you can see the command-line as it is constructed.

Sure! I don't know if you remember, but profile editor is fully
customizable by the user through the profile_editor.xml and
options.xml files (the wizard can be customized also by editing the
wizard.xml file). In the future, I'm thinking of doing a kind of
profile customizer to ease this task and avoid xml editing by the
user. I wrote a tutorial some time ago on how to do that:
http://umitproject.blogspot.com/2005/12/oh-god-dont-have-latest-nmap-options.html

> Before Linux, I actually tried your Windows installer.  The 18MB size
> is rather unfortunate.  That makes the Nmap GUI Windows installer
> almost 20 times as large as the Windows installer for Nmap itself!
> Can you think of any ways to slim it down without hampering
> functionality too much?

It is too large because it has the Umit dependencies embeded. Umit has
the same code base for any platform (even for Nokia 770), so the Umit
code has the same size as on Linux. The Umit installer that doesn't
have those dependencies is about 1.2mb
(http://prdownloads.sourceforge.net/umit/Umit-0.8.2.exe?download)

> Running the installer was a bit of work as well.  Separate installers
> for Python, PyGTK, PySqlite, and PyCairo all popped up.  I think
> installers for Nmap and GTK itself were run too, but in silent mode.
> Is there a way to make that easier?

I tried to make then run silently, but got too much headache. To avoid
this problem, we can generate a stand-alone exe file with everything
embeded.

> Once installation was finished, I was glad to see UMIT added to the
> start menu.  It would be nice to give an option to add it to the
> Windows desktop as well.

There are something that must be improved on this installer. Umit
doesn't have an icon yet, so the icon is very ugly and doesn't
transmit good feelings to the user. I'm working on having a good icon
and a better installation process for Umit to the stable release.

> So I clicked on the new UMIT start menu item and nothing happened :(.
> I cruised on over to c:\nmap\umit-0.8.2 in Windows explorer and saw
> that umit.pyw was apparently properly registered to Python (it had a
> green snake icon).  I clicked and got a "busy" icon for about 5
> seconds before the hourglass disappeared and nothing pops up.  What
> would you like me to run to debug this?

Hum... Did you installed it on c:\nmap\umit-0.8.2 ? When you click on
it, the process hangs for a while and die without showing the poup-up?
Try to run it and see if it appears on the task manager. It's going to
appear named as a pythonw process.

> UMIT definitely has a lot of potential, but I would to get the most
> serious of the issues above resolved before we do a mainstream release
> much beyond nmap-dev.  But you might want to start announcing releases
> on freshmeat.net, as that can be a good way to get users.

Sure! I'm working on making it ready for production use, and I won't
rest until it. I think that maybe this is going to take more time than
the SoC, but don't worry, I'll keep working on it until we get it good
enough for end users.

> I hope this helps!

Helped a lot! Thanks!


Cheeers!

-- 
Adriano Monteiro Marques
http://umit.sourceforge.net
py.adriano () gmail com

"Don't stay in bed, unless you can make money in bed." - George Burns

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org