| *** nowen (~nowen@adsl-66-184-38.asm.bellsouth.net) has joined #wikid | 12:12 | |
| *** SEJeff (~jeff__@209.160.81.1) has joined #wikid | 15:35 | |
| SEJeff | nowen, Hi :) | 15:35 |
|---|---|---|
| nowen | hi! | 15:35 |
| SEJeff | Just curious about the next release of wikid | 15:36 |
| SEJeff | that uses derby instead of postgres | 15:36 |
| SEJeff | and does web api sync to support multi master | 15:36 |
| SEJeff | We've deployed wikid and everyone seems to really like it | 15:37 |
| nowen | testing right now. not quite ready for public release, but getting there | 15:37 |
| nowen | I'm glad to hear it! | 15:37 |
| SEJeff | We also replaced a couple of cisco vpn 3000 devices with a couple of small servers + the commercial openvpn variant | 15:37 |
| SEJeff | it is probably the best mix of 2fa + ssl vpn with openvpn + wikid together | 15:37 |
| nowen | interesting. did that save money? I would have thought the ciscos were sunk costs? | 15:38 |
| SEJeff | Well those ciscos are way EOL | 15:38 |
| nowen | ahh | 15:38 |
| SEJeff | and management told us to move to ssl vpn | 15:38 |
| SEJeff | So we were looking at the new cisco stuff which is a mess, and then at juniper ssl vpn, which is crap | 15:38 |
| SEJeff | ie: doesn't work on linux and only sort of works on os x | 15:38 |
| SEJeff | openvpn just worked and the commercial version has a shiney webui to manage it all so our network / security team is happy. We're all really pleased with wikid | 15:39 |
| nowen | awesome | 15:39 |
| SEJeff | But when we roll out the new version... | 15:39 |
| SEJeff | I would like some help in building a proper setup | 15:39 |
| nowen | certainly | 15:39 |
| SEJeff | We were going to do Xen vms in a DMZ in 3 locations (2 in the US and one in Europe) | 15:40 |
| nowen | ok | 15:40 |
| SEJeff | then you mentioned a way to proxy requests back to IAS so that the Framed-IP-Address radius attribute works | 15:40 |
| nowen | hmm, hoping i have the logs on that ... | 15:40 |
| SEJeff | so that the last 4 digits of a vpn users's ip == their voip extension | 15:40 |
| SEJeff | Well I'd like to put wikid in a DMZ | 15:41 |
| SEJeff | and also have it talk to IAS via radius. You mentioned that someone did it with Apache + mod_proxy | 15:41 |
| nowen | someone didn't want wikid in the dmz so they put apache in the dmz and proxied the otps from there | 15:42 |
| SEJeff | Ah, that actually sounds great | 15:42 |
| nowen | as for the Framed-IP-Address, I have to dig into that again | 15:43 |
| SEJeff | nowen, Well wikid can't do per-user arbitrary radius attributes | 15:54 |
| SEJeff | we tried doing a group for a user, and assigning that attribute to the group | 15:54 |
| SEJeff | but no matter how much I tried, it wouldn't work. I was even tcpdumping the radius call to try and compare against a working stream | 15:54 |
| nowen | can it be inserted by IAS after WiKID's ok? | 15:55 |
| SEJeff | Yup | 15:55 |
| SEJeff | thats why the plan is to proxy through IAS with the upgrade | 15:55 |
| nowen | ahh - ok | 15:55 |
| SEJeff | Also, will there be an upgrade path of any sort, or do we need all new tokens issued? | 15:56 |
| nowen | it's a pretty drastic re-write, so new tokens will be needed | 15:56 |
| SEJeff | We just finished rolling out wikid to 4 offices | 15:56 |
| nowen | it uses DNS instead of IP | 15:56 |
| SEJeff | in 3 continents | 15:56 |
| SEJeff | What do you mean by dns instead of ip | 15:56 |
| SEJeff | The 0 padded ip address can be a dns entry now? That would be very nice | 15:57 |
| nowen | yes | 15:57 |
| nowen | so, the domain id can be: anything@wikid.yourdomain.com | 15:57 |
| SEJeff | Oh thats great | 16:00 |
| SEJeff | You said that this version wont have an open source version, right? | 16:00 |
| SEJeff | Not that this matters to us, I'm just curious | 16:00 |
| nowen | correct. we will probably have 3 versions: community, commercial and enterprise. 3x will become Commercial | 16:01 |
| nowen | 4.x Enterprise | 16:01 |
| nowen | unless we can think of a better branding than "enterprise" | 16:02 |
| SEJeff | Sure | 16:02 |
| SEJeff | commercial pro ultimate edition | 16:02 |
| SEJeff | More words must mean better | 16:02 |
| nowen | turbo maz | 16:02 |
| nowen | max | 16:02 |
| SEJeff | ha | 16:02 |
| nowen | cloud | 16:02 |
| SEJeff | Honestly, opening a cloud 2fa service might not be a bad small side project | 16:02 |
| nowen | I think we will be partnering with someone on that soon | 16:03 |
| SEJeff | Sure, thats a good idea | 16:03 |
| SEJeff | Get Amazon or Rackspace to use it | 16:03 |
| nowen | though, I think we may also partner with some cloud services to make a cloud network client simple | 16:03 |
| nowen | do you use Qualys, for example? | 16:03 |
| SEJeff | Nope | 16:04 |
| SEJeff | our company's vulnerability management is to hire former professional penetration testers as sysadmins | 16:04 |
| nowen | hehe, that's good. | 16:04 |
| SEJeff | Yup | 16:05 |
| SEJeff | So what would be the difference between commercial and enterprise turbo max? | 16:05 |
| nowen | anyway, we could do a qualys network client. the wikid box is in your DC, you control access | 16:05 |
| SEJeff | You're missing an upper case X | 16:05 |
| SEJeff | Would it be wikid branded, or Qualys branded? | 16:06 |
| SEJeff | Like how Dell oem's EMC san kit and sells it as their own | 16:06 |
| nowen | wikid, but Qualys currently pays for cloud 2FA from versign and some of their users want it in house | 16:08 |
| SEJeff | Ah nice | 16:09 |
| nowen | wikidmaX has global load balancing via web services, a better UI, dns instead of ip, but otherwise, much of the same | 16:10 |
| nowen | radius, googlesso, etc | 16:10 |
| SEJeff | Gotcha | 16:10 |
| SEJeff | I take it that would be much more expensive too | 16:11 |
| SEJeff | The multimaster replication is really the killer feature for us | 16:11 |
| nowen | we're looking at that right now | 16:11 |
| SEJeff | You might consider rewriting the webui in python / django :) | 16:11 |
| SEJeff | have it be a python api client | 16:11 |
| SEJeff | And jQuery, make it the pretty with jQuery | 16:12 |
| nowen | my thinking is that we add a per server charge per year | 16:12 |
| nowen | hehe, it does use the GWT | 16:12 |
| SEJeff | Do you "own" wikid sys? | 16:12 |
| SEJeff | GWT is cheating | 16:12 |
| nowen | 50% | 16:12 |
| SEJeff | Ah ok | 16:12 |
| nowen | but GWT does bring some security | 16:12 |
| SEJeff | So you're a partner | 16:12 |
| SEJeff | is the other guy a developer? | 16:12 |
| SEJeff | guy/gal | 16:12 |
| nowen | yes, Eric and I co-founded | 16:12 |
| nowen | yes, CTO | 16:13 |
| SEJeff | gotcha | 16:13 |
| SEJeff | And I take it you're both in CO? | 16:14 |
| nowen | Ga | 16:14 |
| SEJeff | Not sure where I got CO from | 16:14 |
| nowen | so, what would you pay for master-master replication? :) | 16:19 |
| SEJeff | I'm the tech monkey, so no clue there | 16:19 |
| SEJeff | Honestly we are the most interested in the ability to login to any specific wikid server | 16:19 |
| SEJeff | but have the user token info on all of the servers | 16:19 |
| nowen | yes, that's the idea. whatever server is fastest responds | 16:20 |
| SEJeff | Sure | 16:20 |
| SEJeff | But there is one thing I'd like (not sure if it is possible) | 16:20 |
| nowen | also, every domain will be on every server - do you see that as an issue? | 16:20 |
| SEJeff | We have users in LA, NYC, London, and Sydney Austrailia | 16:20 |
| SEJeff | We have vpn concentrators near every office | 16:20 |
| SEJeff | in "serious business TM" datacenters | 16:21 |
| SEJeff | ideally, a user could use their token to get an otp from the local (by region) wikid server | 16:21 |
| SEJeff | but that the token could also be used to login to other region's wikid servers. | 16:21 |
| SEJeff | make sense, or would you prefer me to mock up a diagram in inkscape real quick? | 16:22 |
| nowen | ok - each user would typically get the OTP from the nearest WiKID server. | 16:22 |
| SEJeff | in a perfect world, yes | 16:22 |
| nowen | but if that server went down, they would get one from the other | 16:23 |
| nowen | s | 16:23 |
| SEJeff | Now if you use dns, we could use geoip based dns responses | 16:23 |
| nowen | It shouldn't matter, but you guys are the speed freaks :) | 16:24 |
| SEJeff | Ha | 16:24 |
| SEJeff | Well wikid is what we deem "enterprise" stuff | 16:24 |
| SEJeff | production and enterprise are totally separate | 16:24 |
| SEJeff | enterprise needs to be stable, production needs to be low latency | 16:24 |
| nowen | interesting | 16:25 |
| SEJeff | low latency stuff can be less stable so long as we have the work duplicated on >1 nodes | 16:27 |
| *** finalbeta (~finalbeta@ip-81-11-184-161.dsl.scarlet.be) has joined #wikid | 18:47 | |
| *** Ken__ (a5bd4f37@gateway/web/freenode/ip.165.189.79.55) has joined #wikid | 19:30 | |
| Ken__ | Anyone here who would have a minute or two to T-shoot an issue with the ADRegister script? | 19:31 |
| nowen | sure | 19:32 |
| Ken__ | OK. This is a new Install we are using as an eval. I have made changes to the adregister scipt and when I browse to the scrip it prompt for username and password; however when attempting to auth i get an error that Authentication to the directory failed for user@mydomain.com. I setup a logging filter on my firewall but never see any communicaitons to the LDAP server | 19:35 |
| nowen | hmm | 19:37 |
| nowen | have you tried just 'user'? | 19:38 |
| Ken__ | user@mydomain.com is just a place holder for a real username and domain | 19:39 |
| nowen | right, I'm just wondering if the domain part is needed | 19:39 |
| Ken__ | Hmm I would not think so as that is specified in the scripts directoryDomainSuffix | 19:40 |
| Ken__ | Nope as the error adds the domin suffix. The login is user the error is user@mydomain.com | 19:41 |
| nowen | anything on the Event Viewer in AD? | 19:42 |
| Ken__ | No. But that's expected as the LDAP server is on the private network and the WiKID server is in the DMZ and I can monitor all communications between the two and there is 0 communiciton attempts | 19:45 |
| nowen | can you ping the AD server from the WiKID server? | 19:46 |
| Ken__ | Yes | 19:46 |
| nowen | hmm | 19:49 |
| nowen | booting up my AD vmware | 19:50 |
| Ken__ | K | 19:58 |
| nowen | want to install ldapsearch on the server to see if you can connect to your AD via the commandline? | 20:07 |
| Ken__ | Going to have to wait., I have a meeting until 5. | 20:07 |
| nowen | ok | 20:09 |
| *** nprodromou (~nprodromo@dsl092-049-221.sfo4.dsl.speakeasy.net) has joined #wikid | 21:07 | |
| nprodromou | nowen: How goes? | 21:07 |
| nprodromou | busy? | 21:07 |
| nowen | nprodromou: pretty busy. what's up | 21:08 |
| nprodromou | I can circle back later | 21:08 |
| nprodromou | still trying to make my wikid install work | 21:08 |
| nowen | refresh my memory | 21:08 |
| nprodromou | I've got this wikid install | 21:09 |
| nprodromou | that doesn't work. | 21:09 |
| nprodromou | :) | 21:09 |
| nprodromou | Let me pull it up | 21:09 |
| nowen | hehe | 21:09 |
| nprodromou | I think that when we were looking at it last, the problem appeared to be java based perhaps? | 21:09 |
| nprodromou | essentially wikid controls would say that it was starting, but nothing happened | 21:10 |
| nprodromou | well | 21:10 |
| nprodromou | stuff happened | 21:10 |
| nprodromou | but the web interface never came up | 21:10 |
| nprodromou | Is now actually a good time to check it out with you? | 21:11 |
| nprodromou | that's why I asked the busy question first | 21:12 |
| nowen | is this an rpm install? | 21:12 |
| nprodromou | yes | 21:12 |
| nprodromou | it's hosted on a slice | 21:12 |
| nprodromou | so ISO install won't work | 21:13 |
| nowen | what does 'java -version' say? | 21:13 |
| nprodromou | though it seems like you heavily favor the iso install, huh? | 21:13 |
| nowen | the iso just avoids a lot of this because it has all the sw needed | 21:13 |
| nprodromou | http://privatepaste.com/820707de47 | 21:13 |
| nowen | any error in /opt/WiKID/tomcat/logs/catalina.out? | 21:15 |
| nprodromou | http://privatepaste.com/419791593c | 21:18 |
| nprodromou | Is the answer here that I should host this myself and make my life easier? | 21:18 |
| nowen | is SELINUX disabled? | 21:18 |
| nprodromou | uh... dunno | 21:19 |
| nowen | run getenforce | 21:20 |
| nprodromou | Disabled now | 21:20 |
| nprodromou | er | 21:20 |
| nprodromou | that returned "Disabled" | 21:20 |
| nowen | OK | 21:20 |
| nprodromou | getenforce jsut tells me the status, huh? | 21:21 |
| nowen | is the database running? | 21:21 |
| nowen | yes | 21:21 |
| nprodromou | dunno | 21:21 |
| nowen | try running 'service postgresql status' | 21:21 |
| nprodromou | postmaster (pid 16604 16600 16419 16418 16417 16415 16413 434) is running... | 21:22 |
| nowen | what does /usr/sbin/alternatives --config java show? | 21:26 |
| nprodromou | http://privatepaste.com/06302078cf | 21:27 |
| nowen | can you run: keytool -list -v -keystore /opt/WiKID/private/intCAKeys.p12 -storetype pkcs12 -storepass yourpassphrase | 21:28 |
| nprodromou | uh | 21:29 |
| nprodromou | like, I'm creating a key? | 21:29 |
| nowen | have you created the wikid certs yet? | 21:29 |
| nprodromou | don't they get manually created? | 21:29 |
| nowen | via the web interface | 21:29 |
| nowen | hmm | 21:30 |
| nprodromou | can't get to teh web interface yet | 21:30 |
| nowen | when you ran wikidctl setup did you get prompted to create an ssl cert? | 21:30 |
| nprodromou | yes | 21:30 |
| nowen | do you see the file /opt/WiKID/conf/tomcatKeystore ? | 21:32 |
| nprodromou | [root@wikid ~]# locate tomcatKeystore | 21:33 |
| nprodromou | /opt/WiKID/conf/tomcatKeystore | 21:33 |
| nprodromou | We're talking about this at the office here | 21:34 |
| nprodromou | I can allocate hardware on site to make this work if I'd be better off installing from ISO | 21:34 |
| nowen | it's totally doable via rpm | 21:34 |
| nowen | this is centos, right? | 21:34 |
| nowen | can you delete /opt/WiKID/conf/tomcatKeystore and then re-run setup? | 21:35 |
| nprodromou | sure | 21:35 |
| nprodromou | nope | 21:40 |
| nprodromou | well, I mean, it's run | 21:40 |
| nprodromou | but same thing | 21:40 |
| nprodromou | you want to see catalina.out again? | 21:40 |
| nowen | not if it is the same | 21:41 |
| nowen | ok | 21:42 |
| nowen | host about posting your history? | 21:42 |
| nprodromou | http://privatepaste.com/d01ac149c3 | 21:42 |
| nowen | did you install the pre-regs? | 21:45 |
| nowen | yum install postgresql postgresql-libs postgresql-jdbc postgresql-server postgresql-pl compat-libstdc++-296 ntp system-config-date perl-libwww-perl | 21:45 |
| nprodromou | yep | 21:45 |
| nowen | I'm wondering about postgresql-jdbc | 21:45 |
| nowen | hmm | 21:45 |
| nprodromou | I think I sudoed it | 21:45 |
| nprodromou | OK | 21:46 |
| nprodromou | I'm loading from iso | 21:46 |
| nowen | ok | 21:46 |
| nprodromou | too much screwing with this. | 21:46 |
| nprodromou | :) | 21:46 |
| nprodromou | and, from a security standpoint, I should probably host internally anyway | 21:47 |
| nprodromou | specs... | 21:47 |
| nowen | 1 gig of ram | 21:47 |
| nprodromou | 4G of RAM is plenty for 25 users, right? | 21:47 |
| nprodromou | great | 21:47 |
| nowen | oh yes | 21:47 |
| nprodromou | well, I'll probably run clipperz or something on the same box | 21:47 |
| nprodromou | I need to use wikid to authenticate to a client password database... | 21:48 |
| nprodromou | so having a couple of GB extra there seems right to me. | 21:48 |
| nprodromou | okay, and the idea is that I'm goign to install from scratch using your iso, right? | 21:49 |
| nowen | yes, when you get to the install prompts, type 'install' and it will install the wikid appliance | 21:50 |
| nprodromou | cool | 21:50 |
| *** SEJeff has quit (Read error: Connection reset by peer) | 21:53 | |
| *** SEJeff (~jeff__@209.160.81.1) has joined #wikid | 21:53 | |
| nprodromou | oh... one question about that | 21:53 |
| nprodromou | what's the unerlying OS on the appliance? | 21:53 |
| nowen | centos | 21:56 |
| *** nprodromou has quit (Ping timeout: 240 seconds) | 21:58 | |
| nowen | Ken__: are you still here> | 22:25 |
| nowen | ? | 22:25 |
| nowen | Ken: I have to go, but I have tested this on win2008 and it is working form me | 22:28 |
| nowen | I did use an IP address instead of a FQDN | 22:28 |
| nowen | not sure if it matters, just didn't have that server in dns | 22:29 |
| *** nowen has parted #wikid (None) | 22:37 | |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!