Wednesday, 2011-05-04

« Tuesday, 2011-05-03 Index Thursday, 2011-05-05 »
*** alamarca has quit (Ping timeout: 240 seconds)05:32
*** alamarca (~alamarca@201.246.122.210) has joined #wikid05:46
*** perestrelka (~vlad@194.242.5.47) has joined #wikid06:30
*** alamarca has quit (Ping timeout: 252 seconds)07:12
*** alamarca (~alamarca@201.246.122.210) has joined #wikid07:24
*** alamarca has quit (Ping timeout: 240 seconds)07:40
*** alamarca (~alamarca@201.246.122.210) has joined #wikid07:53
*** alamarca has quit (Ping timeout: 240 seconds)11:01
*** alamarca (~alamarca@201.246.122.210) has joined #wikid11:13
*** sakhi (~sakhi@uwcfw.uwc.ac.za) has joined #wikid11:19
*** myndwire (myndwire@208.40.196.99) has joined #wikid12:39
*** myndwire has parted #wikid (None)12:39
*** myndwire (myndwire@208.40.196.99) has joined #wikid12:51
myndwireanyone around? :)12:52
*** alamarca has quit (Ping timeout: 240 seconds)15:13
*** alamarca (~alamarca@201.246.122.210) has joined #wikid15:26
*** nowen (~nowen@adsl-98-66-164-120.asm.bellsouth.net) has joined #wikid16:08
myndwirehola16:09
nowenhi16:10
nowenmake any progress?16:10
myndwirei actually went ahead and built the 2nd box, configured wikid's network client to be the ip of the new box, and set the server file / pam.d/sshd files on the new one.16:10
myndwirethe new box that's solely freenx now.. it's essentially going to try to connect to wikid's radius16:11
myndwireright?16:11
nowencorrect16:11
myndwirei'm just a bit confused if that's the case, because it's only running on localhost on the old box16:11
myndwireso there's no network-possible-path for the new box to touch radius on the wikid box16:11
myndwireunless it works via ssh, then calls localhost for radius16:12
nowenthe new box needs to be able to talk to the WIKID server over 1812 udp16:12
myndwireyeah, it should be able to, but radius on the wikid box is only running on 127.0.0.1, so how can i touch it via 10.2.21.51?16:12
myndwirei'm nmap'ing from the nx box to the wikid box, but seeing the udp port closed, which makes sens since it runs on localhost16:13
nowendid you add the new box as a network client on the WiKID box?16:14
myndwireyessir16:14
myndwirethe new box is the sole network client on the wikid box16:14
nowenand does iptables show the port open?16:14
myndwireyes16:15
nowenwhat command did you use for nmap?16:15
myndwire[root@rmuauth02 ~]# nmap -sU -p1812 10.2.21.5016:15
myndwire1812/udp closed radius16:15
nowenand if you run that on the wikid server?16:16
myndwirewtf..16:16
myndwire[root@rmuauth01 ~]# nmap -sU -p1812 10.2.21.5016:16
myndwireStarting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2011-05-04 12:16 EDT16:16
myndwireInteresting ports on rmuauth01 (10.2.21.50):16:16
myndwirePORT     STATE  SERVICE16:16
myndwire1812/udp closed radius16:16
myndwireyeah16:16
myndwireexactly as i'd expect16:16
myndwiresince:16:16
myndwire[root@rmuauth01 ~]# nmap -sU -p1812 10.2.21.5016:16
myndwireStarting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2011-05-04 12:16 EDT16:16
myndwireInteresting ports on rmuauth01 (10.2.21.50):16:16
myndwirePORT     STATE  SERVICE16:16
myndwire1812/udp closed radius16:16
myndwireoops16:16
myndwiresorry16:16
nowenand 'netstat -anp | grep 1812'?16:16
myndwire[root@rmuauth01 ~]# netstat -an |grep 181216:16
myndwireudp        0      0 ::ffff:127.0.0.1:1812       :::*16:16
myndwireudp        0      0 ::ffff:127.0.0.1:1812       :::*                                    15035/java16:17
myndwireman, if i could only bind that to an interface ip... the world would rejoice16:17
nowendid you setup the networking using WiKID's setup command?16:18
nowenb/c this is what I get16:23
nowennmap -v -sU localhost16:23
nowen[root@localhost ~]# netstat -anp | grep 181216:23
nowenudp        0      0 :::1812                     :::*                                    15813/ja16:23
nowenI mena16:23
nowenmean16:23
nowenwow typing is extra hard today :)16:23
*** alamarca has quit (Ping timeout: 240 seconds)16:28
myndwirea-ha16:31
myndwireyou've got the checkbox checked.16:32
myndwiremultihomed = binds to all interfaces16:32
myndwirethis will fix it, as long as it starts16:32
*** alamarca (~alamarca@201.246.122.210) has joined #wikid16:40
myndwireudp        0      0 :::1812                     :::*16:49
myndwirethere we go16:49
myndwire1812/udp open|filtered radius16:50
nowenthere we go!16:50
nowenso, we need to disable the ability to disable multi-home16:50
myndwirewoah16:54
myndwireAccess granted for obringer, domain code: 010002021050 client: /10.2.21.5116:54
myndwire<184> Access-Accept(2) LEN=89 10.2.21.51:8176 Access-Request by obringer succeeded16:55
myndwireyet the client fails16:55
myndwirehrm16:55
nowencheck the logs on the freenx box16:55
nowenyou may need to add the user to that box16:55
myndwireMay  4 12:54:31 rmuauth02 nxserver[7158]: (nx) Failed login for user=obringer from IP=10.15.18.17416:55
myndwirethey're identical os-wise16:55
myndwirehmm16:55
myndwireohh16:55
myndwireso the user needs to have an actual shell login/pw that matches16:56
myndwirein addition to the vnc session16:56
myndwireit must...16:57
nowenthe user needs to be able to meet the freenx login requirements, which are determined by ssh on the freenx box, typically16:57
myndwireahh... so if i can login to this box via ssh (which i am now), and the nx desktop client is configured with that user/pass, it should work16:58
nowenyes16:58
myndwiregahhhh17:00
myndwireMay  4 13:00:39 rmuauth02 nxserver[7427]: (nx) Failed login for user=obringer from IP=10.15.18.17417:01
myndwirei wonder if nx has some sort of anything anywhere17:01
myndwiredoesnt appear so... as far as changeable stuff17:02
nowencan you login via ssh?17:02
myndwireyep17:02
myndwireer...17:02
myndwirei'm logged in..wtf i cant now though17:02
myndwirei must've changed pam17:02
myndwirehah17:02
myndwireholdon17:02
myndwireoh yea i can, nm17:03
myndwireclient's configured for the .51 ip, port 22, vnc, and the password i set on the vnc host (port 5900, etc).17:04
myndwireman, nx hates me17:37
nowenstill no love?17:37
myndwire-- NX SERVER START: -c /usr/bin/nxserver - ORIG_COMMAND=17:37
myndwire-- NX SERVER START:  - ORIG_COMMAND=17:37
myndwireInfo: Using fds #4 and #3 for communication with nxnode.17:37
myndwireHELLO NXSERVER - Version 3.2.0-74-SVN OS (GPL, using backend: not detected)17:37
myndwireNX> 105 hello NXCLIENT - Version 3.2.017:37
myndwireNX> 134 Accepted protocol: 3.2.017:37
nowendid you try creating a user acct for yourself on the nx machine?17:37
myndwireNX> 105 SET SHELL_MODE SHELL17:37
myndwireNX> 105 SET AUTH_MODE PASSWORD17:37
myndwireNX> 105 login17:37
myndwireNX> 101 User: obringer17:37
myndwireNX> 102 Password:17:37
myndwireInfo: Closing connection to slave with pid 8499.17:37
myndwireNX> 404 ERROR: wrong password or login17:37
myndwireNX> 999 Bye17:37
myndwirei dont quite get where my unix credentials within the windows client come into play17:37
myndwireso far i'm entering my username (which would work at the unix layer), the pin from my token, and within the vnc config, the vnc password17:38
nowenthat should be it17:38
myndwirei even tried swapping over to a test RDP host, same17:38
nowenit's not the VNC part, it's the unix login.  it could be the nx key17:39
nowendid you update the key?17:39
myndwirewe did that a few days ago, yeah17:39
nowenI thought so17:39
myndwirewe had gotten pretty stuck without it17:39
nowenthat's right, I remember now17:39
myndwirealthough17:39
nowenwas freenx working without wikid?17:39
myndwireconsider this -- the key (if its on auth02)17:40
myndwiredoesnt match the hostnme of the box anymore17:40
myndwirenot sure if that mattered or not17:40
nowencould be17:40
myndwiresince all nx / ssh stuff is now on this new one17:40
myndwirein that case, what would i have to regenerate?17:40
myndwirenothing within wikid i dont think17:40
nowenI'm guessing the nx keys.17:42
nowenI think there's a command for it17:42
myndwirehrm... the key came from the keystore on the wikid box17:56
myndwireat least the one we had put there originally17:56
myndwirewithout it, my pins don't generate17:57
myndwireer.. no, they do, i just cant even try to login w/ nx17:57
nowenno - there is an NX command to create key s for the nx server and clients, is what I mean17:57
myndwireohh ok i gotcha17:57
nowenright -the client key we used has the wrong host.. now17:58
myndwirehttp://www.nomachine.com/ar/view.php?ar_id=AR01C0012617:58
myndwireaha17:58
myndwire[root@rmuauth02 ~]# /usr/bin/nxserver --keygen17:59
myndwireNX> 100 NXSERVER - Version 3.2.0-74-SVN OS (GPL, using backend: not detected)17:59
myndwireNX> 500 Error: Function --keygen not implemented yet.17:59
myndwireNX> 999 Bye17:59
myndwiredoh'17:59
myndwireoh i see ...17:59
myndwire /etc/nxserver contains client.id_dsa.key18:00
myndwirehave to regen those18:00
nowenyeah, that's what I was thinking18:00
myndwirethey look like standard openssl keys18:01
myndwirelike for keyless auth..hmm18:01
myndwirei THINK this was installed with yum18:02
myndwirebet i could just reinstall it18:02
myndwirePackage freenx-0.7.3-6.el5.centos.i386 already installed and latest version18:02
myndwireyeah18:02
nowentry just typing nx and then tab and see what comes up18:02
myndwirei think i found it18:03
myndwire[root@rmuauth02 ~]# /usr/bin/nxsetup --install --setup-nomachine-key18:04
myndwireSetting up /etc/nxserver ...done18:04
myndwireSetting up /var/lib/nxserver/db ...done18:04
myndwireSetting up /var/log/nx/nxserver.log ...done18:04
myndwireAdding user "nx" to group "utmp" ...done18:04
myndwireSetting up known_hosts and authorized_keys2 ...done18:04
myndwireSetting up permissions ...done18:04
myndwireSetting up cups nxipp backend ...cp: cannot stat `/usr/lib/cups/backend/ipp': No such file or directory18:04
myndwirecrap, it didnt regen18:05
myndwirei wonder if theres an equivilent of dpkg-reconfigure for yum hah18:05
nowenhttp://www.nomachine.com/ar/view.php?ar_id=AR01C0012618:06
myndwireyeah thats 2.0.0+ of the non-free18:06
myndwirethat command doesnt work18:06
nowenhmm18:06
myndwirei just neeed cups18:08
myndwire /var/lib/nxserver/home/.ssh/client.id_dsa.key18:11
myndwiregot it18:11
myndwirei just hope it didnt do a bunch of shit to freenx18:11
myndwireshit18:11
myndwire'the nx service is not available or the nx access was disabled on host 10.2.21.51'18:12
myndwirelame18:12
myndwiresimple pubkey fail18:12
myndwirethe key that goes into the client is supposed to be from nx?18:15
myndwirei swear we got that from wikid18:15
nowenno, it's an nx key18:32
myndwirehttp://wiki.centos.org/HowTos/FreeNX18:44
myndwireclosest thing to reality i can find18:44
myndwirebut the key is the big issue18:44
myndwireamazing...still works with the key we pulled originally, just password bad.18:46
nowenit's possible that the key doesn't check the hostname18:46
myndwireprobably not18:46
myndwireb/c the stock keys that all of the howtos insist on using don't work18:46
myndwirethe one we've been using works perfect18:46
myndwirejust cant auth18:46
myndwirei wonder if its specific to my own set of keys in my /home/.ssh/18:47
nowenI don't think so18:47
myndwireevery step of this has been insane :(18:47
myndwireyeah, i didn't really think so either18:47
nowenbut are you able to log in without your ssh keys?18:47
myndwirelogin to the box via ssh?18:48
myndwireer..18:48
myndwirenode.conf... tons of stuff that can be ocnfigured in nx18:50
myndwirei wonder why they had me install both nx and freenx..18:50
myndwiredidnt think i required both18:50
nowennx is definitely showing its age.  I think the commercial version is a lot easier18:50
myndwireyeah seriously18:51
myndwirethis should be pretty drop-in..18:51
*** alamarca has quit (Read error: Connection reset by peer)19:18
myndwirehow ridiculous19:25
myndwireif i put my actual server-side username where the PIN goes within the nxclient, it ALMOST displays a vnc window...19:25
myndwireheh19:25
myndwireit should be enforcing two-factor..19:26
myndwiregod i'm so lost... i was so close... and i really need to get this going :-\19:27
nowenmaybe you should first get nx working and then add WiKID19:27
*** alamarca (~alamarca@201.246.76.78) has joined #wikid19:34
nowenanything more in the logs?  in /var/log/secure?  about the nx failure?19:34
myndwirei think there's some sort of disconnect with nx authing with my pins19:38
myndwire-- NX SERVER START:  - ORIG_COMMAND=19:38
myndwireInfo: Using fds #4 and #3 for communication with nxnode.19:38
myndwireHELLO NXSERVER - Version 3.2.0-74-SVN OS (GPL, using backend: not detected)19:38
myndwireNX> 105 hello NXCLIENT - Version 3.2.019:38
myndwireNX> 134 Accepted protocol: 3.2.019:38
myndwireNX> 105 SET SHELL_MODE SHELL19:38
myndwireNX> 105 SET AUTH_MODE PASSWORD19:38
myndwireNX> 105 login19:38
myndwireNX> 101 User: obringer19:38
myndwireNX> 102 Password:19:38
myndwireNX> 103 Welcome to: rmuauth02 user: obringer19:38
myndwirethis is me logging in with box credentials in the password field19:38
myndwireyeah, i mean, i'd shoot for nx to work at all as a goal a this point19:40
nowenand then it dies?  what's in your /etc/pam.d/sshd file?  feel free to use http://pastebin.org if you prefer19:41
myndwire#%PAM-1.019:41
myndwireauth       include      system-auth19:41
myndwireauth       required     /lib/security/pam_radius_auth.so19:41
myndwireyeah true, pastebin would be useful with these19:41
nowenis that is? what do you have for session?19:41
myndwirethats not it19:42
myndwireits just the 2 top lines19:42
myndwirethe file's stock, same as it was on the other19:42
myndwiresec19:42
nowenand is obringer an account on the server?19:42
myndwireyeah19:42
myndwirehttp://pastebin.com/uL0NdsMi19:42
nowenhuh. looks like things have changed since i last looked at pam19:44
myndwirewhen i attempt login with my pin19:44
myndwirehttp://pastebin.com/xRcCBSP519:44
myndwirewhen i nix the pin from the pw field and just put in my unix-layer password for auth2:19:45
myndwirehttp://pastebin.com/gLRwkFw719:45
myndwire(seems it shouldn't get this far done this way, but who knows)19:45
noweni think that if you comment out the first line, only wikid will work19:46
myndwireALMOST pushes a vnc window. who knows, may be designed to not, but it seems it shouldn't get that far.19:46
myndwireoh yeah19:46
myndwirebut local ssh will never work19:46
nowenwhy not?19:46
myndwirei was under the impression from my testing and docs i've read off the website that with this:19:47
myndwireauth       include      system-auth19:47
myndwireyou cant login via normal ssh login19:47
nowennot to my knowledge19:47
myndwireah...gotcha19:52
myndwirei'll give it a try at some point i guess19:52
nowenI'm thinking it is one of the session lines.  I assume you can get to the virtual console, so playing with these won't lock you out.19:53
myndwireoh yeah, i'd be fine with that19:53
myndwireauth       include      system-auth19:55
myndwireyou def need this first to be able to login with l/p creds19:56
nowenif you have an account on the box, then that should be fine.  I think I remember something about needing that line.19:56
nowenhmm - I might know how to get a copy of a working file19:56
myndwireyeah, it was part of the instructions n whatnot19:56
myndwirewhich file?19:57
nowen/etc/pam.d/ssh19:57
myndwireah, so that appears to be the actual problem?19:57
myndwirei sort of want to eliminate the top line and try authing again19:57
myndwirelemme try that19:57
myndwiresame crap19:58
nowenyes, it is not auth, it is session, IMO19:59
myndwireyeah thats what i think19:59
myndwirei wish there was a more recent tutorial for the iso20:00
myndwire:-\20:00
nowenthe WiKID iso?20:01
myndwireyeah20:03
myndwirei guess i mean updated situational tutorials20:03
myndwirethat's probably more realistics20:04
myndwire-s20:04
nowenit's very difficult for us to document all the things you can add two-factor auth to20:04
myndwireoh absolutely, completely understandable. it just seems that nomachine integration is the most common thing... you'd think *someone* out there would have a more recent tutorial.. haven't found much yet though20:05
myndwirea few specific to centos that don't work20:05
nowenno, it's funny. I think it is awesome, but I don't think anyone else cares20:06
myndwirea bunch that have you changing nx stuff out the wazoo, limiting ssh to users/group, utilizing the nx user every time, etc20:06
myndwireit's a shame, it's an awesome concept, and i see SO many people have it in place..20:06
myndwirewe could do this environment wide and i'd gratefully buy a ton of site licenses20:06
myndwireseat*20:06
myndwiremaybe once i have it figured out i'll just write the thing20:07
myndwirei've seen where some folks have built their nx's on ubuntu/debian and are fine20:07
myndwireperhaps thats an idea... not like it has to be the wikid iso20:07
nowenyou're welcome to do that.20:07
nowenexactly, we just want the radius packets20:08
myndwireya exactly20:08
nowenmy last test box on this is a fedora 10 box20:23
nowenit does have: account    sufficient    /lib/security/pam_radius_auth.so20:23
myndwireah yeah20:25
myndwireseems that mechanism works20:25
nowenalso, I have commented out: #session    required     pam_loginuid.so20:26
myndwireoh nice...yea, that works for me, still can login anyway. i disabled that line too.20:34
nowenso nx is working?20:34
myndwireoh i just meant i disabled that extra line20:35
myndwirenah, saw deal20:36
myndwirei've got to head out, i'll talk to ya later. thanks again for your help nick20:36
myndwirewe'll get this thing working20:36
nowenok.20:37
*** myndwire has parted #wikid (None)20:37
*** alamarca has quit (Ping timeout: 240 seconds)22:16
*** alamarca (~alamarca@201.246.76.78) has joined #wikid22:27
*** nowen has parted #wikid (None)22:41
*** alamarca has quit (Ping timeout: 246 seconds)22:50
*** alamarca (~alamarca@201.246.76.78) has joined #wikid23:03
« Tuesday, 2011-05-03 Index Thursday, 2011-05-05 »

Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!