| *** Lake_Lurker (~Just@h20.211.39.162.dynamic.ip.windstream.net) has joined #wikid | 10:34 | |
| *** Lake_Lurker has parted #wikid (None) | 10:39 | |
| *** henry__ (5362f462@gateway/web/freenode/ip.83.98.244.98) has joined #wikid | 12:13 | |
| *** henry__ has quit (Quit: Page closed) | 12:23 | |
| *** Henry__ (5362f462@gateway/web/freenode/ip.83.98.244.98) has joined #wikid | 13:00 | |
| Henry__ | Hi | 13:00 |
|---|---|---|
| Henry__ | small question is there an newer android client available? | 13:01 |
| *** Henry__ has quit (Quit: Page closed) | 14:39 | |
| *** nowen (~nowen@adsl-74-176-212-94.asm.bellsouth.net) has joined #wikid | 15:09 | |
| *** vp_ (40b3d246@gateway/web/freenode/ip.64.179.210.70) has joined #wikid | 15:19 | |
| vp_ | Anyone here? | 15:19 |
| nowen | yes | 15:19 |
| vp_ | hey, Nick. | 15:19 |
| vp_ | How have you been doing? | 15:19 |
| nowen | good | 15:19 |
| vp_ | good stuff. | 15:20 |
| vp_ | I just have a quick question to you. | 15:20 |
| nowen | ok | 15:20 |
| vp_ | I will be migrating our server to a new server. | 15:20 |
| *** asofrank (~laszlof@wookie.tvog.net) has joined #wikid | 15:20 | |
| vp_ | and now I am trying to do some test if wikid works with a new server. | 15:20 |
| nowen | ok | 15:21 |
| nowen | is it a new ip address? | 15:21 |
| vp_ | so basically I have one domain and 2 network clients (current one and another one for a new server) | 15:21 |
| vp_ | with same configuration of Protocol Modules | 15:22 |
| nowen | ahh - ok - a new network client. is it radius? | 15:22 |
| vp_ | yes | 15:22 |
| vp_ | so my question is that this should work theorically, right? | 15:23 |
| nowen | yes | 15:23 |
| vp_ | or I have to add a new domain for this testing? | 15:23 |
| nowen | did you restart the server after adding the new network client? | 15:23 |
| vp_ | let me check it with another tech guy here, just give me a sec, plz | 15:24 |
| vp_ | Nick, you mean shut down and start the server or the wikid server? | 15:28 |
| nowen | just run wikidctl restart | 15:29 |
| vp_ | yes, he told me he did it. | 15:29 |
| nowen | ok - so what is happening or not happening? ;) | 15:29 |
| nowen | when you try to login, is there anything in the wikid logs after the passcode request? | 15:32 |
| vp_ | it seems that gererating a passcode works fine, but it doesn't communicate with a new server. | 15:32 |
| nowen | ok, is there anything between the two boxes that would block port 1812 udp? | 15:32 |
| vp_ | they are opened for that port. | 15:33 |
| nowen | also, on the wikid server command line, run 'iptables -L -n' and make sure that the ip of the new server is listed | 15:34 |
| vp_ | yes, it is there. | 15:35 |
| vp_ | because I changed it accordingly. | 15:35 |
| vp_ | so I guess I have to double check with a configuration of a new server. | 15:35 |
| nowen | yeah you can run tcpdump on the wikid server to see if the packets are getting there | 15:36 |
| vp_ | ok, thx, Nick. | 15:37 |
| asofrank | hrm, for some reason, when I click on "Create Intermediate CA" it just throws up a mostly blank page with the header. | 15:41 |
| nowen | asofrank: are you using sun's jdk? | 15:42 |
| asofrank | no, openjdk | 15:42 |
| nowen | hmm | 15:42 |
| asofrank | I had to create a symlink cause I was getting an error when starting wikid | 15:42 |
| asofrank | /opt/WiKID/bin/daemonctl: line 174: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/bin/java: No such file or directory | 15:42 |
| nowen | hmm | 15:42 |
| asofrank | the actual java executable was in jre/bin | 15:43 |
| asofrank | not just bin | 15:43 |
| nowen | arg | 15:43 |
| nowen | run 'locate java.security' | 15:43 |
| asofrank | [root@wikid log]# locate java.security | 15:43 |
| asofrank | /etc/java/security/security.d/1000-gnu.java.security.provider.Gnu | 15:43 |
| asofrank | /opt/WiKID/conf/templates/java.security | 15:43 |
| asofrank | /usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre/lib/security/java.security | 15:43 |
| nowen | there should be on in /opt/WiKID and one in your java directory. | 15:43 |
| asofrank | /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/security/java.security | 15:43 |
| nowen | 'diff /opt/WiKID/conf/templates/java.security /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64/jre/lib/security/java.security' | 15:44 |
| asofrank | its weird, I installed this on a VM and it didnt do the same thing | 15:44 |
| nowen | if it returns anything cp the first over the last | 15:44 |
| nowen | huh | 15:44 |
| asofrank | no difference. | 15:44 |
| nowen | I saw something similar to this but it was only with sun's jdk | 15:45 |
| nowen | is there an error in the WiKIDAdmin logs? | 15:45 |
| asofrank | where is that log located? | 15:45 |
| nowen | in the Web UI top left corner you will see a link | 15:46 |
| asofrank | ah yes | 15:46 |
| asofrank | 2011-06-06 11:43:20.324ERRORorg.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/WiKIDAdmin].[jsp]Servlet.service() for servlet jsp threw exception | 15:46 |
| nowen | and if you click on the bomb icon, the full trace should come up | 15:46 |
| asofrank | java.net.UnknownHostException: wikid.asmallorange.com: wikid.asmallorange.com | 15:47 |
| asofrank | at java.net.InetAddress.getLocalHost(InetAddress.java:1426) | 15:47 |
| asofrank | at org.apache.jsp.cert1_jsp._jspService(cert1_jsp.java:778) | 15:47 |
| asofrank | at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:98) | 15:47 |
| asofrank | at javax.servlet.http.HttpServlet.service(HttpServlet.java:729) | 15:47 |
| asofrank | at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:369) | 15:47 |
| asofrank | at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:308) | 15:47 |
| asofrank | at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:259) | 15:47 |
| nowen | ok | 15:47 |
| asofrank | at javax.servlet.http.HttpServlet.service(HttpServlet.java:729) | 15:47 |
| asofrank | at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:269) | 15:47 |
| nowen | what do you have in /etc/hosts? | 15:47 |
| asofrank | at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188) | 15:47 |
| asofrank | at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213) | 15:47 |
| asofrank | at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:172) | 15:47 |
| asofrank | at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:563) | 15:47 |
| asofrank | at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127) | 15:47 |
| asofrank | at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117) | 15:47 |
| asofrank | at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108) | 15:47 |
| asofrank | at com.wikidsystems.catalina.valves.Log4jAccessLogValve.invoke(Log4jAccessLogValve.java:553) | 15:47 |
| asofrank | at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:174) | 15:47 |
| asofrank | at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:879) | 15:47 |
| asofrank | at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665) | 15:47 |
| asofrank | at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528) | 15:47 |
| asofrank | at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81) | 15:48 |
| asofrank | at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:689) | 15:48 |
| asofrank | at java.lang.Thread.run(Thread.java:636) | 15:48 |
| asofrank | probably no entry for this host name | 15:48 |
| asofrank | yeah, just localhost stuff | 15:48 |
| asofrank | i havent setup dns or hostname resolution | 15:48 |
| asofrank | let me fix that | 15:48 |
| nowen | yeah, I bet that is it | 15:48 |
| asofrank | yeah, that fixed it | 15:48 |
| nowen | ok | 15:48 |
| asofrank | heres a question. We have an existing radius server that we use to authenticate clients for our fortigate unit. | 15:49 |
| asofrank | is there any way to setup wikid to pass authentication through that first, and then prompt for the OTP | 15:49 |
| asofrank | so basically they would need a username/password (stored in radius) plus a OTP from the token app | 15:50 |
| nowen | you should be able to pass the auth through the radius server and then have that server pass the cred to wikid after authorization | 15:50 |
| nowen | whether you can check both the OTP and the password I don't know | 15:51 |
| asofrank | ah, ok | 15:51 |
| nowen | in general, we recommend not using the LAN password outside the LAN | 15:51 |
| nowen | you've got the PIN and the private key embedded in the token, that's two-factors. best to keep the password for internal use, I think. but each to his own :) | 15:55 |
| nowen | it's really a question for the fortigate too - can you configure it to request three fields | 15:56 |
| asofrank | well, they have their own tokens so I suppose its possible | 15:56 |
| asofrank | they support a challenge response configuration | 15:57 |
| nowen | that's cool | 15:57 |
| asofrank | for now, I'm just trying to set this up along side our radius setup so I dont break that functionality while im testing | 15:57 |
| asofrank | whats limited in the non-paid version? | 15:58 |
| nowen | you should be able to create a group that is only you | 15:58 |
| asofrank | that works. | 15:58 |
| nowen | no wireless token client or radius - we use 3rd party libs for that | 15:58 |
| asofrank | hm, so I need to use the desktop token client | 15:59 |
| asofrank | and not use radius | 15:59 |
| asofrank | for testing, anyways | 15:59 |
| nowen | you can test with the enterprise version | 15:59 |
| asofrank | yeah, thats what I installed. | 16:00 |
| asofrank | I was just curious if anything was disabled or limited in it | 16:00 |
| nowen | no, it's just that we can't opensource those. you could write a plugin to freeradius via our api | 16:02 |
| asofrank | theres a good chance we'll be purchasing something within a week or two, just trying to find the best solution for the best price | 16:03 |
| asofrank | most of the hardware tokens we looked at were at least $35 each | 16:04 |
| asofrank | plus the hardware and middleware software | 16:04 |
| nowen | please let us know where we stand. we typically don't discount to get a deal, but we do change prices based on market feedback | 16:04 |
| nowen | our position is software tokens allow you to better balance your info sec budget | 16:05 |
| nowen | so did you get to a total per user? | 16:07 |
| asofrank | we havent broke it down that much | 16:09 |
| asofrank | but we were looking at about $55 per user xusing the fortinet tokens | 16:09 |
| asofrank | a bit cheaper going with digipass, but still about $45 | 16:09 |
| asofrank | we're looking probably at an initial purchase of 40 users | 16:10 |
| asofrank | that should cover us for this year anyways | 16:10 |
| nowen | that's a sweet spot for us, it seems | 16:10 |
| nowen | plus, if there's any issue, you can come over and beat us up | 16:10 |
| asofrank | ok, when setting up a domain, what is the "domain name" and device domain name" in reference to. | 16:11 |
| asofrank | yeah, I saw you guys are local | 16:11 |
| asofrank | even better to support local business | 16:11 |
| nowen | :) | 16:11 |
| nowen | the domain name is internal to the server - the device name is what shows up on the token | 16:11 |
| asofrank | ah, so it mostly doesnt matter | 16:11 |
| asofrank | its for reference purposes | 16:12 |
| nowen | so, you can have users in multiple domains, but still have 1 set of documents, eg | 16:12 |
| asofrank | and the servercode is for the wikid box, or for the vpn device? | 16:12 |
| nowen | it's the zero-padded ip of the server. it's how the tokens find the server | 16:12 |
| asofrank | gotcha | 16:13 |
| asofrank | doesnt appear to be authenticating for some reason | 16:20 |
| asofrank | taking a while, it might be having toruble communicating with the wikid server | 16:20 |
| asofrank | yeah, not getting any data over UDP 1812 (radius) on the wikid box | 16:22 |
| nowen | did you run 'wikidctl restart' after adding the network client? | 16:24 |
| nowen | also, there is a slight delay in the radius listener actually starting | 16:24 |
| nowen | 'netstat -anp | grep 1812' will show the listener | 16:25 |
| asofrank | probably not | 16:26 |
| asofrank | the listener is running | 16:26 |
| asofrank | still not seeing any traffic coming from my fortigate unit | 16:26 |
| asofrank | let me make sure its not trying to auth to my other radius server | 16:26 |
| asofrank | do you know off hand how to enable authentication logging on Fortigate? | 16:44 |
| nowen | no, sorry | 16:45 |
| nowen | vp_: any progress? | 17:03 |
| asofrank | i really wish this fortigate unit would give me more detailed logs | 17:09 |
| asofrank | giving me a "no_matching_policy" error. But logging in with just a regular local user in the same group works fine | 17:10 |
| nowen | hmm | 17:11 |
| asofrank | not seeing any traffic hitting the wikid server either. | 17:12 |
| nowen | sounds like you need to specify something to get the policy to kick in | 17:14 |
| nowen | a policy condition | 17:14 |
| asofrank | well thats the weird thing, another user in the exact same group works fine | 17:17 |
| asofrank | the only difference between the 2 is one hsa the password stored locally, the other grabs it from wikid | 17:17 |
| asofrank | and its not even trying to pull the password | 17:17 |
| asofrank | as far as I can see | 17:17 |
| asofrank | [root@wikid ~]# tcpdump -A -vvv "udp port radius" | 17:19 |
| asofrank | tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes | 17:19 |
| asofrank | 0 packets captured | 17:19 |
| asofrank | 0 packets received by filter | 17:19 |
| asofrank | 0 packets dropped by kernel | 17:19 |
| asofrank | woah, nevermind | 17:21 |
| nowen | what? | 17:21 |
| asofrank | aliased IP address | 17:21 |
| asofrank | [root@wikid ~]# tcpdump -i eth0:0 -A -vvv "udp port radius" | 17:21 |
| asofrank | tcpdump: listening on eth0:0, link-type EN10MB (Ethernet), capture size 96 bytes | 17:21 |
| asofrank | 13:19:56.257989 IP (tos 0x0, ttl 64, id 40023, offset 0, flags [none], proto: UDP (17), length: 131) 10.10.10.1.XSIP-network > 10.0.3.22.radius: RADIUS, length: 103 | 17:21 |
| asofrank | so, its getting it | 17:21 |
| asofrank | but not authenticating | 17:21 |
| nowen | is that on the wikid server? | 17:21 |
| asofrank | yes | 17:21 |
| nowen | if the IP doesn't match what is in the network client page, then the radius server should reject it | 17:22 |
| asofrank | thats probably it | 17:22 |
| asofrank | I might have used the external IP | 17:22 |
| asofrank | let mee check | 17:22 |
| asofrank | yeah, it had the external IP | 17:25 |
| asofrank | changed it to the internal one and restarted | 17:25 |
| asofrank | still no love | 17:27 |
| nowen | ok, on the WiKIDAdmin logs / configure loggers, there are 5 loggers listed, set the middle 3 to debug and try again | 17:27 |
| asofrank | do I need to restart for that to go into effect? | 17:28 |
| nowen | nope | 17:28 |
| asofrank | what the hell.. | 17:29 |
| asofrank | i enable debug logging and it works | 17:29 |
| asofrank | maybe I fat fingered the OTP | 17:29 |
| nowen | possible, but I bet that the listener just hadn't started yet. it needs pseudo random data and it takes awhile on a headless system | 17:30 |
| asofrank | ah | 17:30 |
| asofrank | ok well, it appears to be working | 17:30 |
| asofrank | slightly slower than our existing setup, but not too bad | 17:30 |
| asofrank | I'll pass the informationover to my boss and see what he thinks. How do I go about getting a quote for a 40 user enterprise license? | 17:32 |
| asofrank | oh nice, you dont even have to add the users into fortinet | 17:34 |
| asofrank | just add the radius server to the user group and it'll do the lookups for you | 17:34 |
| nowen | I can send you a pdf, or you can look online. just let me know. http://www.wikidsystems.com/simplecartitem | 17:40 |
| asofrank | we'll probably need a custom quote for 40 licenses | 17:44 |
| asofrank | let me talk with my employer and I'll shoot you an email | 17:44 |
| nowen | np | 17:45 |
| asofrank | you should have another price break for like 50 or 100 users | 17:45 |
| nowen | hmm | 17:45 |
| asofrank | it goes from 25 to 500 on the website | 17:45 |
| asofrank | thats a huge gap | 17:45 |
| asofrank | (in my opinion) | 17:45 |
| nowen | yes, I can see that | 17:46 |
| nowen | I think we just copied the competition | 17:46 |
| asofrank | yeah, the price is pretty good. | 17:46 |
| asofrank | i actually found you by searching for "2 factor authentication fortinet" on google. | 17:47 |
| asofrank | i think you're one of the first hits | 17:47 |
| nowen | interesting. we have that one doc, but that's it | 17:48 |
| asofrank | the howto you have is a little outdated though, probably from an older fortiOS version | 17:48 |
| nowen | I wonder if the all powerful google knew we were neighbors | 17:48 |
| asofrank | maybe | 17:48 |
| nowen | yeah, I bet it is quite old | 17:48 |
| asofrank | where in atlanta is your office? | 17:48 |
| asofrank | ah, peachtree street | 17:49 |
| asofrank | we're over by the zoo, at least for now | 17:49 |
| asofrank | off of boulavard | 17:50 |
| nowen | oh, that's cool | 17:50 |
| asofrank | as soon as our lease is up the new CEO is moving to a smaller office in Durham, NC | 17:50 |
| asofrank | 99% of us are remote workers | 17:50 |
| nowen | ahh | 17:50 |
| nowen | yes, we are very virtual too | 17:50 |
| nowen | so you won't have to move? | 17:50 |
| asofrank | the office we have is just way too big for what we need, and no one really uses it | 17:50 |
| asofrank | no, we still have a cage at GNAX where most of our servers are | 17:51 |
| asofrank | but I do mostly development and some security stuff for now, so I rarely need to go anywhere | 17:51 |
| nowen | gotcha | 17:52 |
| nowen | did you see our api stuff? | 17:52 |
| asofrank | i havent looked at it yet, but I likely will | 17:52 |
| asofrank | we have some internal systems now that authenticate against our existing radius server | 17:53 |
| nowen | it was created for a multi-tenant environment for user management, etc. | 17:53 |
| asofrank | its a SOAP API right? | 17:53 |
| nowen | essentially. xml-based. it requires a cert from the server | 17:54 |
| asofrank | ah, should be simple to implement | 17:54 |
| asofrank | most of our systems use PHP, so a quick curl call to handle those requests | 17:54 |
| nowen | yes and we have a php package with examples | 17:55 |
| asofrank | have a class written for it? | 17:55 |
| nowen | I think so, I don't really know php, but I assume that's what we have. | 17:56 |
| nowen | and there's a sample.php that has all the functions well documented | 17:56 |
| nowen | it might need an update for the latest functionality | 17:56 |
| asofrank | yeah, its juyst like any other xml api | 17:57 |
| asofrank | cept you use a certificate for authentication, which is nice | 17:57 |
| nowen | yes, the 'here's your secret API key' approach is not enough for us | 17:58 |
| asofrank | im impressed with all the mobile clients you offer | 17:59 |
| asofrank | most venders will do like, iphone, maybe android | 17:59 |
| asofrank | or just blackberry | 17:59 |
| asofrank | heh, even a firefox extension | 18:00 |
| asofrank | you're missing the chrome extension :P | 18:00 |
| nowen | actually, we're going with the HTML5 token for browsers | 18:02 |
| nowen | there's a python token that someone else has written too | 18:02 |
| asofrank | ah | 18:03 |
| asofrank | with the API, is there a way to add users? | 18:14 |
| nowen | yes | 18:14 |
| nowen | they can enter their registration codes | 18:14 |
| nowen | or add a second token, with or without an OTP from the first | 18:15 |
| nowen | and we can also pre-register tokens | 18:15 |
| asofrank | great. we have a central management portal that we use, we use that to add users to the radius server for authentication | 18:15 |
| asofrank | if I can modify that to instead add the users to the wikid system using the API, that would be ideal and save a lot of time | 18:15 |
| nowen | i guess you could add a step: 'enter your token reg code' | 18:16 |
| asofrank | yeah | 18:16 |
| asofrank | users are added by existing admins (management), so we can just request that and enter it in the details | 18:16 |
| asofrank | now if I can only figure out how to do that with the fortinet unit | 18:17 |
| nowen | does the fortinet need users? I would think having them in radius is all you need | 18:17 |
| asofrank | yeah, thats what I thought, but when I completely removed the user it stopped working | 18:18 |
| asofrank | i might need to look into it a bit more | 18:18 |
| asofrank | it seems to be that it should work like any other radius server | 18:18 |
| nowen | yeah, that's sound wrong. it could be that you need to do authorization and authentication | 18:19 |
| asofrank | your fortinet docs need to be rewritten. :) | 18:20 |
| asofrank | once I get this all figured out maybe I'll take a look | 18:21 |
| nowen | contributions welcome! :) | 18:21 |
| asofrank | yeah, it does work without the user | 18:23 |
| asofrank | i dont know why it didnt the first time | 18:23 |
| asofrank | so that makes things easier | 18:23 |
| nowen | cool | 18:23 |
| asofrank | where is the full api documentation? | 18:24 |
| nowen | http://www.wikidsystems.com/simplecartitem | 18:24 |
| nowen | oops | 18:24 |
| nowen | http://www.wikidsystems.com/support/wikid-support-center/manual/wikid-network-client-wclient-api-manual/referencemanual-all-pages | 18:24 |
| nowen | samples: http://www.wikidsystems.com/downloads/network-clients | 18:25 |
| asofrank | yup, has a class. code looks clean and should be easy to implement | 18:32 |
| *** vp_ has quit (Quit: Page closed) | 18:49 | |
| *** carda (2e2cbe7e@gateway/web/freenode/ip.46.44.190.126) has joined #wikid | 20:46 | |
| carda | good afternoon / evening | 20:46 |
| carda | i'm trying to setup a wikid server, can it authenticate users with a sbs server? | 20:48 |
| nowen | hi | 21:00 |
| nowen | do you want the users to be valid in AD and to use two-factor auth? | 21:01 |
| nowen | so that if the user is deleted in sbs, they do not get access? | 21:01 |
| carda | i think so | 21:03 |
| carda | i've relayed our 2nd router ip to the wikid server @ port 80 | 21:04 |
| nowen | is this for VPN access? | 21:04 |
| carda | yes | 21:04 |
| carda | euhm, no i mean the token client works over port 80 right? | 21:05 |
| nowen | yes, the token client works over port 80 | 21:05 |
| carda | well, i set up a domain the wikid, i gave it our external ip | 21:05 |
| carda | then when i try to connect to it with the token client it fails with 'no configuration found' | 21:06 |
| nowen | what did you use for your domain identifier? | 21:06 |
| carda | you mean the domain name? | 21:08 |
| nowen | sorry, I mean the Server Code (12-digits): | 21:09 |
| carda | ow ok | 21:09 |
| carda | 082075180020 | 21:09 |
| nowen | is that the external ip of the wikid server> | 21:11 |
| nowen | > | 21:11 |
| nowen | ? | 21:11 |
| carda | yes | 21:11 |
| carda | the internal ip (which is relayed) is 10.0.0.52 | 21:11 |
| nowen | I can't seem to get to it. can you? | 21:11 |
| carda | pling! | 21:13 |
| carda | lightbulb moment | 21:13 |
| carda | ip is wrong...pff | 21:13 |
| nowen | haha :) | 21:13 |
| carda | getting in now | 21:16 |
| carda | btw, there is no other port which i can use to get it working right? | 21:16 |
| nowen | the token talk to port 80. You can have wikid listen on a different port and proxy the requests to it | 21:18 |
| carda | ok | 21:20 |
| carda | i have 2 choices i think | 21:20 |
| carda | i have a netgear vpn firewall | 21:21 |
| carda | which can use wikid pap or chap | 21:21 |
| nowen | wikid pap | 21:22 |
| carda | so the router checks if the user is authenticated by the wikid server right? | 21:23 |
| nowen | yes | 21:26 |
| carda | k | 21:26 |
| carda | another question, the key i get back is my password to use? | 21:32 |
| nowen | yes | 21:34 |
| nowen | so, you enter your PIN and get back the OTP, which you enter into the password field | 21:34 |
| carda | the 'passcode' | 21:34 |
| carda | yeah | 21:34 |
| carda | k | 21:34 |
| carda | then the router prolly isn't correctly configged | 21:34 |
| nowen | did you add the router as a network client on the wikid server? | 21:35 |
| carda | nope :) | 21:36 |
| carda | wAuth or LDAP? | 21:37 |
| nowen | you need radius | 21:38 |
| nowen | is it enabled? | 21:38 |
| nowen | are you using the enterprise version? | 21:38 |
| carda | yes using the enterprise one | 21:38 |
| carda | enabling radius then | 21:38 |
| nowen | you can disable ldap too - it will just use memory | 21:39 |
| carda | ok | 21:43 |
| carda | will do after it works | 21:43 |
| carda | what are the return attributes? | 21:43 |
| nowen | leave them blank | 21:44 |
| carda | k | 21:44 |
| nowen | they will return radius info to your router if you want | 21:44 |
| nowen | but I doubt you do :) | 21:44 |
| carda | hehe ok | 21:45 |
| carda | well | 21:46 |
| carda | do i have to create the user on vpn? | 21:46 |
| carda | on the router i mean? | 21:46 |
| nowen | I'm not sure | 21:47 |
| nowen | I doubt it | 21:47 |
| nowen | is it not working? | 21:47 |
| carda | not yet | 21:47 |
| nowen | did you run 'wikidctl restart' after adding the network client | 21:47 |
| carda | aaaah | 21:48 |
| carda | i did after adding the module though | 21:48 |
| nowen | you have to do it after adding the nc. it opens a port on the firewall | 21:49 |
| carda | damn, auth failed | 21:50 |
| carda | still | 21:50 |
| nowen | check the WIKIDAdmin logs | 21:51 |
| carda | logs say access granted | 21:54 |
| carda | only the router says not :( | 21:54 |
| carda | hmm, what else to setup | 21:56 |
| nowen | well, it could be that you need to add the user to the router or make some change so that you don't have to | 22:01 |
| carda | yeah think so | 22:06 |
| carda | jep | 22:10 |
| carda | logged in now | 22:10 |
| carda | now i only need to get these pages to display externally ;) | 22:10 |
| nowen | did you add a user? | 22:10 |
| carda | yes | 22:10 |
| carda | without a password | 22:10 |
| nowen | without a wikid OTP? | 22:11 |
| carda | no | 22:11 |
| carda | with | 22:11 |
| nowen | ahh, ok. that's better :) | 22:11 |
| carda | but without creating the user with a password | 22:11 |
| carda | :) | 22:11 |
| carda | now i'm trying to get the portal to work externally | 22:12 |
| nowen | what is 'the portal'? | 22:12 |
| *** gvidals (479fe031@gateway/web/freenode/ip.71.159.224.49) has joined #wikid | 22:14 | |
| gvidals | nick, what ports does the wikid client on an android use to talk with the wikid server. | 22:14 |
| nowen | 80 | 22:14 |
| gvidals | my client is setting up for the first time on his android and is getting an error "unable to add domain: unable to resolve server code" | 22:15 |
| gvidals | the server code is 216240180135 | 22:15 |
| nowen | can you add it? | 22:16 |
| nowen | I can't | 22:16 |
| nowen | http://216.240.180.135/wikid/servlet/com.wikidsystems.server.InitDevice4AES?a=0&S=216240180135&CT=1 | 22:16 |
| nowen | chrome also cannot connect :) | 22:17 |
| carda | nowen, thnx for the help, ssl works now | 22:24 |
| carda | vpn ;) | 22:24 |
| nowen | carda: great! | 22:24 |
| carda | k | 22:30 |
| carda | so we need the enterprise server, time to talk to the boss and demonstrate it :) | 22:31 |
| nowen | :) | 22:31 |
| carda | 240 per year isn't that expensive ;) | 22:32 |
| carda | thnx and cya! | 22:33 |
| *** carda has quit () | 22:33 | |
| nowen | later! | 22:33 |
| nowen | ok - later people. cya tomorrow | 23:15 |
| *** nowen has quit (Quit: Leaving.) | 23:15 | |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!