| *** peter___ (3a6cbcf9@gateway/web/freenode/ip.58.108.188.249) has joined #wikid | 04:33 | |
| peter___ | hi | 04:33 |
|---|---|---|
| *** peter___ has quit (Client Quit) | 04:36 | |
| *** nowen (~nowen@adsl-176-210-205.asm.bellsouth.net) has joined #wikid | 13:39 | |
| *** gvidals (18f9cf04@gateway/web/freenode/ip.24.249.207.4) has joined #wikid | 15:28 | |
| gvidals | owen, i'm stuck on the ssh authentication using wikid. | 15:28 |
| nowen | gvidals: which part? pam-radius? | 15:29 |
| gvidals | using PAM-RADIUS and i'm trying to authenticate gvidals@216.240.181.29 | 15:29 |
| gvidals | is the user "gvidals" suppose to be the same user as what is in the users section of wikid? | 15:30 |
| nowen | yes | 15:30 |
| nowen | check out your /var/log/secure for errors | 15:30 |
| nowen | on the ssh box | 15:30 |
| nowen | also, WiKIDAdmin logs | 15:30 |
| nowen | also, gvidals will have to be a user on the ssh box | 15:30 |
| gvidals | i thought i had success here: <181> Access-Accept(2) LEN=110 216.240.181.29:28709 Access-Request by gvandroid succeeded | 15:33 |
| gvidals | but i couldn't log in. this log entry seems to indicate that the PAM-RADIUS portion is set up properly. | 15:33 |
| nowen | yeah. it's probably that you're not a user on the box. run | 15:33 |
| nowen | 'useradd gvidalis' | 15:33 |
| gvidals | a user on the Ubuntu ssh box. | 15:34 |
| nowen | yes | 15:34 |
| gvidals | i'm looking at the /var/log/auth.log on the ubuntu ssh server and I see "pam_radius_auth: packet from RADIUS server 127.0.0.1 fails verification: the shared secret is probably incorrect". | 15:47 |
| gvidals | i thought PAM would try the next server in the list which is the wikid server.... | 15:48 |
| nowen | is there a radius listener on 127? | 15:48 |
| nowen | if the first server rejects, it stops | 15:48 |
| nowen | if the first server fails to answer, it goes to the next | 15:48 |
| gvidals | i installed by using apt-get pam-radius... and it probably is listening on 127.0.0.1... checking now... | 15:51 |
| nowen | no, pam-radius won't listen | 15:51 |
| gvidals | i see that this line is before the wikid server in /etc/pam_radius_auth.conf: 127.0.0.1 secret 1 | 15:58 |
| gvidals | i will comment that line out and test. | 15:58 |
| gvidals | commenting out that line did the trick! | 16:01 |
| gvidals | you're the man. tks. | 16:01 |
| nowen | huh | 16:01 |
| nowen | that's weird. must be something on the ubuntu side, because redhat is ok with it | 16:02 |
| gvidals | you are probably right. | 16:03 |
| gvidals | i changed "auth sufficient /lib/security/pam_radius_auth.so" to "required" and I cannot log in (i left the 127.0.0.1 commented out for now). | 16:04 |
| gvidals | testing again with sufficient to ensure i can get in that way. | 16:04 |
| nowen | it's good to test with 2 ssh tunnels - so you don't get locked out ;) | 16:05 |
| gvidals | is it reasonable to request the software token from my android Wikid's client and then use that for the ubuntu ssh password? | 16:21 |
| nowen | sure | 16:21 |
| gvidals | that's what i thought, just checking.... | 16:21 |
| gvidals | still no success. i thought i was able to log in with "sufficient", but not good. | 16:21 |
| gvidals | <114> Access-Request(1) LEN=110 216.240.181.29:13444 Access-Request by gvidals Failed: AccessRejectException: Access Denied | 16:22 |
| gvidals | and on auth.log on the ubuntu ssh machine i see "Failed password for gvidals". | 16:22 |
| nowen | user enabled? | 16:23 |
| gvidals | pam_radius_auth: DEBUG: getservbyname(radius, udp) returned -1469523808. Dec 16 08:19:15 gw sshd[12419]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=wsip-24-249-207-4.sd.sd.cox.net user=gvidals Dec 16 08:19:16 gw sshd[12419]: Failed password for gvidals from 24.249.207.4 port 58324 ssh2 | 16:23 |
| gvidals | yes, the user exists. i can log in with that user if I change the required to "sufficient" in /etc/pam.d/sshd | 16:24 |
| gvidals | i mean i can log in with gvidals using "sufficient" and typing in my regular password | 16:24 |
| nowen | what else do you have in pam.d/sshd? | 16:24 |
| gvidals | if i try the token, it fails. | 16:24 |
| nowen | do you have a line pointing to pam-radius? | 16:25 |
| gvidals | auth required pam_env.so # [1] # In Debian 4.0 (etch), locale-related environment variables were moved to # /etc/default/locale, so read that as well. auth required pam_env.so envfile=/etc/default/locale # Standard Un*x authentication. @include common-auth # Disallow non-root logins when /etc/nologin exists. account required pam_nologin.so # Uncomment and edit /etc/security/access.conf if you need to set c | 16:26 |
| gvidals | the word "radius" does not appear anywhere in pam.d/sshd | 16:27 |
| nowen | there should be a line 'auth sufficient /lib/security/pam_radius_auth.so' | 16:32 |
| gvidals | i emailed you my pam.d/sshd | 16:32 |
| nowen | assuming that is where you pam radius so is | 16:32 |
| nowen | just add that line below the system auth line | 16:33 |
| gvidals | ok. got it. | 16:34 |
| gvidals | <92> Access-Request(1) LEN=110 216.240.181.29:13672 Access-Request by gvidals Failed: AccessRejectException: Access Denied | 16:46 |
| gvidals | does this log entry indicate that at least i got past the radius server/client exchanging the shared secret? | 16:46 |
| nowen | I think so. Set you radius logging to debug and you will see more data | 16:46 |
| gvidals | on the wikid server logs area you mean? | 16:48 |
| nowen | yes | 16:48 |
| nowen | http://www.wikidsystems.com/support/wikid-support-center/troubleshooting-faq/how-can-i-set-radius-logging-to-debug-how-can-i-see-if-wikid-is-getting-the-radius-requests/?searchterm=radius%20debug | 16:48 |
| gvidals | ok i'll turn on debugging in the logs and take a look. | 16:52 |
| gvidals | arghh :-/ "gvidals" was disabled | 17:03 |
| gvidals | it woud be helpful to see that kind of event in the logs so the admin could re-enable. | 17:03 |
| gvidals | it is working now. thanks for the help once again. | 17:03 |
| nowen | cool | 17:26 |
| *** remix_tj has quit (Quit: http://quassel-irc.org - Chat comfortably. Anywhere.) | 17:48 | |
| *** remix_tj (~remix_tj@ip6.server.remixtj.net) has joined #wikid | 17:49 | |
| *** cmatthews (d8ed3803@gateway/web/freenode/ip.216.237.56.3) has joined #wikid | 19:22 | |
| cmatthews | Nick .. On the freenx server I changed the shared password for the raddb server.. Do I need to do anything to get that to take affect? | 19:23 |
| nowen | so, is it the same as on the network client on the WIKID server? | 19:23 |
| nowen | if you changed it on the WiKID server, you need to restart wikid | 19:24 |
| nowen | no restart on the freenx box | 19:24 |
| cmatthews | Okay I'll give that a go ty | 19:24 |
| cmatthews | bleh... eventually need to figure out why so far it's been 8 minutes since "wikidctl restart" but the radius daemon hasn't hit yet.... | 19:33 |
| cmatthews | just started.. | 19:34 |
| gvidals | owen is there a way to change the number of failed attempts before the wikid server disables a user? | 19:35 |
| nowen | yes, on the domain page | 19:36 |
| gvidals | ok i'll look there. | 19:36 |
| nowen | it happens during testing, but really, not so much in production | 19:36 |
| nowen | cmatthews: thats a but | 19:37 |
| nowen | bug | 19:37 |
| nowen | we know about it, but we use an upstream provider for the radius interface | 19:37 |
| cmatthews | cool ty.. no big deal so long as it eventually does come up | 19:38 |
| cmatthews | and it does | 19:38 |
| nowen | it's looking for an snmp listener. since it's not there, it takes awhile to fail | 19:38 |
| cmatthews | hmmm... back to getting access denied resulting from wikid.... | 19:41 |
| cmatthews | Check returned false. | 19:41 |
| nowen | cmatthews: user still enabled? | 19:42 |
| cmatthews | You know it is.. but something wierd their. | 19:42 |
| nowen | set the com.wikidsystems.server.wAuth and com.wikidsystems loggers to debug and try again | 19:44 |
| *** cmatthews has quit (Ping timeout: 265 seconds) | 19:47 | |
| gvidals | i must be missing something.... i'm about to send Lipso their domain code so they can test their login. | 20:02 |
| gvidals | however, the thought occured to me that any user on the internet can download the WiKID client and register a domain on a WiKID client. | 20:03 |
| nowen | on the phone - brb | 20:03 |
| gvidals | so instead of guessting a password, they have to guess a username to gain access to a network device. | 20:03 |
| gvidals | a user needs to know the following to access a server: a) wikid server (domain) code, target machine IP and username. | 20:05 |
| gvidals | oh yea. I forgot that I have to authorize the new user as the WiKID admin :-) | 20:07 |
| nowen | there ya go ;) | 20:07 |
| nowen | or they need to self-register based on some existing trusted creds | 20:12 |
| *** JackH (4013e42d@gateway/web/freenode/ip.64.19.228.45) has joined #wikid | 20:14 | |
| JackH | Anyone around? | 20:14 |
| nowen | yes | 20:14 |
| nowen | just got your email | 20:15 |
| JackH | Oh sweet | 20:15 |
| JackH | Sorry for pestering so much | 20:15 |
| nowen | np | 20:15 |
| nowen | good to know | 20:16 |
| JackH | Yea strangest thing | 20:16 |
| JackH | everything works fine until I close out then bam no more domains | 20:17 |
| nowen | which os version is this? | 20:17 |
| JackH | Froyo 2.2 | 20:18 |
| JackH | Is there a file like there is in desktop version that holds the domain information? | 20:23 |
| nowen | JackH: can you try to add this domain: 88888888888? | 20:26 |
| JackH | 3vpMGhgL | 20:29 |
| nowen | now, back out of the program using the return button? | 20:29 |
| JackH | That worked | 20:31 |
| JackH | I still have that domain | 20:31 |
| nowen | hmm | 20:32 |
| nowen | try adding your corp domain | 20:33 |
| JackH | registered | 20:34 |
| nowen | so, this might have to be the work-around until we get it reworked | 20:35 |
| JackH | Now my corp domain stayed | 20:36 |
| nowen | JackH: ok - well, we'll work on an update, it might be a bit though | 21:02 |
| JackH | no worries, idont work remotely that often | 21:02 |
| JackH | thanks for the help | 21:03 |
| nowen | it's all working now? | 21:03 |
| JackH | For now yes | 21:03 |
| JackH | it saved the domain | 21:03 |
| nowen | don't forget to validate it soon. the regcodes are not valid forever | 21:04 |
| JackH | yea i sent it to the admins | 21:04 |
| *** JackH has quit (Ping timeout: 265 seconds) | 21:38 | |
| *** gvidals has quit (*.net *.split) | 21:57 | |
| *** remix_tj has quit (*.net *.split) | 21:57 | |
| *** remix_tj (~remix_tj@ip6.server.remixtj.net) has joined #wikid | 21:57 | |
| *** gvidals (18f9cf04@gateway/web/freenode/ip.24.249.207.4) has joined #wikid | 21:57 | |
| *** nowen has parted #wikid (None) | 23:16 | |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!