| *** _markh_ (~chatzilla@wish-hq3.gotadsl.co.uk) has joined #wikid | 12:10 | |
| *** zaeem (3d059f5a@gateway/web/freenode/ip.61.5.159.90) has joined #wikid | 12:18 | |
| zaeem | hi | 12:18 |
|---|---|---|
| zaeem | Does wikid support juniper and cisco routers for ssh/telnet logins? | 12:19 |
| zaeem | hello | 12:25 |
| zaeem | anyone around | 12:25 |
| *** zaeem has quit (Ping timeout: 265 seconds) | 12:29 | |
| *** zaeem (3d059f5a@gateway/web/freenode/ip.61.5.159.90) has joined #wikid | 12:32 | |
| zaeem | anyone around? | 12:32 |
| *** zaeem has quit (Quit: Page closed) | 13:18 | |
| *** _markh_ has quit (Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]) | 15:19 | |
| *** _markh_ (~chatzilla@wish-hq3.gotadsl.co.uk) has joined #wikid | 15:19 | |
| *** nowen (~nowen@adsl-176-210-205.asm.bellsouth.net) has joined #wikid | 16:01 | |
| nowen | hey _markh_ | 16:02 |
| _markh_ | hi nick | 16:15 |
| nowen | how's it going? sorry for the continued confusion! | 16:15 |
| _markh_ | np. We're doing well | 16:16 |
| _markh_ | Have a problem with one of our Netwrok Clients | 16:16 |
| nowen | ok | 16:16 |
| _markh_ | basically, whenever it tries to authenticate it gets access denied... | 16:17 |
| nowen | radius | 16:17 |
| nowen | ? | 16:17 |
| _markh_ | Yep. All the other services work fine | 16:17 |
| nowen | is there any info in the WiKIDAdmin logs? | 16:17 |
| nowen | did it's ip address change or anything like that? | 16:18 |
| _markh_ | nope. But here's what's in radius.log... | 16:18 |
| _markh_ | NASip is '109.200.13.2' | 16:18 |
| _markh_ | PAP Request | 16:18 |
| _markh_ | passcode is �^H^J�6^^k^L+� | 16:18 |
| _markh_ | Passcode is not a number. | 16:19 |
| _markh_ | Check PAP bombed with AccessRejectException: Access Denied | 16:19 |
| nowen | hmm. the encoding is bad. check the shared secrets | 16:19 |
| _markh_ | And when we start wikid, we get an exception (sorry for the inline pasting) | 16:20 |
| _markh_ | java.net.SocketException: Broken pipe | 16:20 |
| _markh_ | at java.net.SocketOutputStream.socketWrite0(Native Method) | 16:20 |
| _markh_ | at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:92) | 16:20 |
| _markh_ | at java.net.SocketOutputStream.write(SocketOutputStream.java:136) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.OutputRecord.writeBuffer(OutputRecord.java:283) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.OutputRecord.write(OutputRecord.java:272) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:666) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.Handshaker.sendChangeCipherSpec(Handshaker.java:584) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.ClientHandshaker.sendChangeCipherAndFinish(ClientHandshaker.java:698) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:624) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:160) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:495) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:433) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:818) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1030) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1057) | 16:20 |
| _markh_ | at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1041) | 16:20 |
| _markh_ | at com.wikidsystems.client.wClient.init(wClient.java:211) | 16:20 |
| _markh_ | at com.wikidsystems.client.wClient.<init>(wClient.java:149) | 16:20 |
| _markh_ | at com.wikidsystems.radius.access.WikidAccess4.set(WikidAccess4.java:68) | 16:20 |
| _markh_ | at com.wikidsystems.radius.access.MakeAccess.createAccessImpl(MakeAccess.java:112) | 16:20 |
| _markh_ | at com.theorem.radserver3.RADIUSServer.setAccessImplFactory(RADIUSServer.java:1468) | 16:20 |
| _markh_ | at com.wikidsystems.radius.authserver.AuthServer.configure(AuthServer.java:362) | 16:20 |
| _markh_ | at com.wikidsystems.radius.authserver.AuthServer.go(AuthServer.java:156) | 16:20 |
| _markh_ | at com.wikidsystems.radius.authserver.AuthServer.main(AuthServer.java:98) | 16:20 |
| _markh_ | brb | 16:20 |
| nowen | me too - be back in a bit | 16:29 |
| nowen | in the meantime, check your certs: | 16:29 |
| nowen | http://www.wikidsystems.com/support/wikid-support-center/troubleshooting-faq/how-do-i-know-if-my-certificate-is-valid/?searchterm=keytool | 16:29 |
| _markh_ | nick, secrets are good. IntCA is good, but keytools shows the localhost cert as follows: | 16:53 |
| _markh_ | keytool error: java.io.IOException: PKCS12 key store mac invalid - wrong password or corrupted file. | 16:53 |
| _markh_ | it is the same pasphrase as the CA right? | 16:53 |
| nowen | not necessarily | 16:53 |
| _markh_ | oh | 16:53 |
| nowen | you can go ahead and create a new localhost cert - are you only using radius? | 16:54 |
| _markh_ | nope, we use wAuth in one place | 16:54 |
| nowen | arg - pphone call | 16:54 |
| nowen | check that cert too | 16:54 |
| _markh_ | :) | 16:54 |
| nowen | if you recreate the localhost cert, restart wikid | 16:55 |
| _markh_ | recreated the localhost cert. still failing. anyhow, wouldn;t that affect ALL network clients rather than just this one? | 17:04 |
| nowen | might depend on when it was created, not sure | 17:05 |
| _markh_ | Anyhow, I don't seem to get the exception on startup but this one (Linux) client still fails... | 17:09 |
| _markh_ | There must be a clue in that it suddenly stopped working. To my knowledge neither the box nor wikid was changed | 17:10 |
| _markh_ | there _was_ a network topology change recently, but I don't see how that would make any difference (no IP changes). | 17:11 |
| nowen | did you check the shared secrets? | 17:29 |
| _markh_ | OK. Working now. The secrets were incorrect. I have NO idea how they becamed different. the file dtaes are consitent with the last change we made months ago. | 17:33 |
| _markh_ | So, we need to ionvestiogate what happened. Thx for your help | 17:33 |
| nowen | hehe | 17:34 |
| _markh_ | btw | 17:34 |
| nowen | it's always the simple stuff. unless it's not | 17:34 |
| _markh_ | If you recall we wanted to use Android/Iphone clients with our own DOMAIN DNS | 17:34 |
| _markh_ | any news on that front? | 17:35 |
| nowen | yeah, we're working on that a part of then next release. it will be a big update and require new token clients | 17:35 |
| _markh_ | because we still want to, but can't really delegate the DNS to you | 17:35 |
| nowen | I am looking for a beta in the next 30 days | 17:35 |
| _markh_ | without holding you to anyting - when is that likely? | 17:35 |
| _markh_ | beaten to it | 17:36 |
| _markh_ | thx | 17:36 |
| nowen | I'm hopeful 30 days | 17:36 |
| _markh_ | If you want a tester... | 17:36 |
| nowen | yes I do! | 17:36 |
| nowen | you're on the list | 17:36 |
| _markh_ | Thx | 17:37 |
| _markh_ | Gotta go now. Bye | 17:37 |
| nowen | later! | 17:37 |
| *** _markh_ has quit (Quit: ChatZilla 0.9.86 [Firefox 3.6.13/20101203075014]) | 17:39 | |
| *** JP (cf683602@gateway/web/freenode/ip.207.104.54.2) has joined #wikid | 17:52 | |
| JP | hello, I'm having issues with the example.jps file. I get "The wClient connection to the server was NOT successfully established" I changed lines 42 (Server code) and 48 (passphrase) as mentioned in the install doc. Restarted the service. and still get that error. | 17:55 |
| nowen | hmm | 17:56 |
| nowen | and you're passphrase is the localhost passphrase? | 17:56 |
| JP | i believe so | 17:56 |
| nowen | is this an iso install or rpm? | 17:56 |
| JP | iso | 17:57 |
| nowen | what's the error in the WiKIDAdmin logs? | 17:57 |
| JP | checking... | 17:58 |
| JP | ERROR: java.io.IOException: failed to decrypt safe contents entry: javax.crypto.BadPaddingException: Given final block not properly padded | 17:58 |
| nowen | try running this on the command line: keytool -list -v -keystore /opt/WiKID/private/localhost.p12 -storetype pkcs12 -storepass yourpassphrase | 17:59 |
| JP | got the same error plus a bunch of other text, trying to figure out how to copy and paste it here | 18:03 |
| nowen | ahh - use http://pastebin.com | 18:03 |
| nowen | paste there, then put the url here | 18:04 |
| nowen | can you run 'locate java.security' | 18:04 |
| JP | ya i get... | 18:05 |
| nowen | and then 'diff firstfile secondfile'? it should return nothing | 18:05 |
| JP | test | 18:05 |
| JP | it didn't accept what i typed, let me try again | 18:06 |
| JP | /opt/WiKID/conf/templates/java.security | 18:06 |
| JP | and... | 18:06 |
| JP | /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib/security/java.security | 18:07 |
| nowen | ok, run 'diff /opt/WiKID/conf/templates/java.security /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib/security/java.security' | 18:08 |
| nowen | it should return nothing | 18:08 |
| JP | a bunch of text scrolled by, now way to scroll up.. sorry linux noob here | 18:10 |
| nowen | np | 18:10 |
| nowen | run 'cp /opt/WiKID/conf/templates/java.security /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib/security/java.security' | 18:10 |
| JP | k... | 18:10 |
| nowen | this could be a bug in our iso | 18:11 |
| JP | do i overwite? | 18:11 |
| nowen | yes | 18:11 |
| JP | ok done | 18:12 |
| nowen | ok, 'wikidctl restart' | 18:12 |
| nowen | hmm. I wonder if you will need to create a new localhost cert? | 18:13 |
| JP | how would i know if I do? | 18:13 |
| nowen | let's just do it, I say | 18:13 |
| JP | from the web ui? | 18:14 |
| nowen | yeah | 18:14 |
| JP | ok | 18:14 |
| JP | doing it now | 18:15 |
| JP | ok created localhost cert | 18:17 |
| nowen | ok | 18:17 |
| nowen | if you used the same passphrase, you should be able to just browse to the example.jsp | 18:18 |
| JP | shoot i didn't use the same, do i just edit line 48 again in the example.jsp file on the server? | 18:18 |
| JP | ok we're good now | 18:21 |
| JP | thanks for your helpo | 18:21 |
| nowen | ok. I'll have to see what's going on in the iso | 18:21 |
| JP | *help | 18:21 |
| nowen | thanks for the report! | 18:21 |
| JP | yw | 18:21 |
| nowen | feel free to hang here for questions, can make it faster | 18:22 |
| JP | we're looking at using this for about 350 users in our company, what are the main differences between the enterprise and community version | 18:23 |
| nowen | wireless tokens and radius support | 18:23 |
| nowen | and support support | 18:23 |
| JP | lol | 18:23 |
| JP | ok | 18:23 |
| JP | so no radius in community? | 18:24 |
| nowen | although between irc and the forums, support is pretty good | 18:24 |
| nowen | no | 18:24 |
| nowen | we use a 3rd party plugin | 18:24 |
| nowen | so no gpl option | 18:24 |
| nowen | brb | 18:25 |
| JP | ok. We're looking to replace ActiveIdentity with a lower cost option so I am working to get a Proof of concept using wikid setup | 18:25 |
| JP | any links to help with setting this up with a cisco ASA SSL VPN solution? | 18:26 |
| nowen | maybe | 18:27 |
| nowen | is AD in the middle? | 18:28 |
| nowen | http://www.wikidsystems.com/support/wikid-support-center/how-to/how-to-configure-a-cisco-vpn-concentrator-for-two-factor-authentication-from-wikid/?searchterm=cisco | 18:28 |
| nowen | that's more for just a vpn concentrator | 18:28 |
| nowen | I don't know how close it is to the ASA | 18:29 |
| nowen | how expensive is the ActiveIdentity? | 18:30 |
| nowen | did you see our pricing? | 18:30 |
| JP | I can't see exactly how much we are paying, but lets just say we are looking to aff 150 tokens with Active ID for a total of 350 and I can basically replace Active ID with wikid for all 350 users for about half the cost 150 active ID users. | 18:32 |
| JP | *add not aff | 18:32 |
| JP | the recurring costs are about the same | 18:33 |
| nowen | that's like a math problem or something, but seems to work ;) | 18:34 |
| nowen | so the difference is in the upfront charge for hardware tokens? | 18:34 |
| JP | yes | 18:34 |
| JP | its about $100 per token | 18:34 |
| nowen | ok - we appreciate pricing feedback. we don't bend like Oracle to get a deal b/c who has the time?, but we will adjust pricing for all | 18:35 |
| JP | thats good. I work for Save Mart / Lucky / FoodMaxx in CA | 18:36 |
| nowen | ok - so PCI? | 18:36 |
| JP | oh ya! | 18:36 |
| JP | do the soft tokens need network connectivity to the server to generate the OTP? | 18:37 |
| nowen | yes, they encrypt the PIN and send it to the server | 18:38 |
| JP | ok | 18:38 |
| nowen | what will the tokens run on? wireless devices? laptops? | 18:39 |
| JP | so how would that work if the user is remote and needs to authenticate via vpn? | 18:39 |
| JP | they would be off the network | 18:39 |
| nowen | typically, the WiKID server has an external ip address (nat'd) | 18:39 |
| JP | ahhh, that right that was mentioned in those setup videos | 18:40 |
| JP | we would be using all of the above, wireless phones, laptops, PCs | 18:40 |
| nowen | and fyi, each user can have more than one token | 18:40 |
| JP | i saw that, that is nice | 18:41 |
| JP | user based license only | 18:41 |
| nowen | yes, so a seat equals a user in a domain, not tokens in a domain | 18:42 |
| JP | any issues using NAT if I place the wikid server in my dmz? | 18:42 |
| nowen | no | 18:42 |
| nowen | use the external ip as the domain identifier | 18:42 |
| JP | is there a listing of which ports I need to open up on my FW? | 18:42 |
| JP | ok | 18:43 |
| nowen | just 80 for the tokens | 18:43 |
| nowen | the WiKIDAdmin uses 443, but you probably don't want that outside | 18:43 |
| JP | no we wouldn't need that | 18:43 |
| JP | does it use http over port 80? Im thinking my auditor may have an issue with that | 18:49 |
| nowen | hehe, we use asymmetric encryption, so no need for ssl. | 18:50 |
| nowen | plus we have *lots* of PCI customers | 18:50 |
| JP | ok, but auditors don't typically accept that is used with other customers as a "pass" lol. Good to know though. Can you link me more info the the assymetric encryption setup? | 18:52 |
| nowen | http://www.wikidsystems.com/learn-more/technology/overview | 18:52 |
| JP | ty | 18:52 |
| nowen | I have talked to auditors in the past, but it's been awhile. I think word has spread | 18:53 |
| JP | ok cool | 18:53 |
| JP | well thanks for all the info... gotta run to a meeting. | 18:54 |
| nowen | you can think of WiKID like certificates. Except there is not "infrastructure" to the PK. Just flat public key pairs. The difference is that the PIN is encrypted and sent to the server. so, unlike certs, you cannot brute force attacj the pin | 18:54 |
| nowen | sicne most qsas accept certs... | 18:55 |
| nowen | ok - see you later! | 18:55 |
| JP | ok c ya | 18:55 |
| *** JP has quit (Quit: Page closed) | 19:10 | |
| *** nowen has parted #wikid (None) | 23:07 | |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!