| *** dchilton has parted #wikid (None) | 00:16 | |
| *** dave (6337face@gateway/web/freenode/ip.99.55.250.206) has joined #wikid | 00:16 | |
| *** dave has parted #wikid (None) | 00:16 | |
| *** CowboyPride (~BartSimps@cpe-075-183-170-059.sc.res.rr.com) has joined #wikid | 00:34 | |
| *** CowboyPride has quit (Remote host closed the connection) | 01:04 | |
| *** Embalmed (embalmed@204.188.217.2) has joined #wikid | 01:11 | |
| Embalmed | hey guys, if i want to move from the community edition to the enterprise, does an rpm -Uvh work or is there more to it? | 01:12 |
|---|---|---|
| *** CowboyPride (~BartSimps@cpe-075-183-170-059.sc.res.rr.com) has joined #wikid | 01:16 | |
| Embalmed | hrm, well i am not having much success.. i installed the enterprise rpm's and now i can't seem to get authenticated anymore, tacacs is saying the keys are invalid | 02:31 |
| Embalmed | but they aren't | 02:31 |
| Embalmed | and the adregister page isn't working for me anymore | 02:31 |
| Embalmed | and wtf happened to the tacacs server | 03:33 |
| Embalmed | grumble | 03:43 |
| Embalmed | is anyone actually here? | 03:43 |
| *** Lake_Lurker (~Just@h202.197.140.67.dynamic.ip.windstream.net) has joined #wikid | 10:52 | |
| *** Lake_Lurker has parted #wikid (None) | 10:52 | |
| *** nowen (~nowen@adsl-74-176-160-111.asm.bellsouth.net) has joined #wikid | 14:17 | |
| *** PC1 (480ca40a@gateway/web/freenode/ip.72.12.164.10) has joined #wikid | 17:31 | |
| PC1 | Good day, I'm back with some a couple more questions. | 17:31 |
| nowen | welcome back | 17:31 |
| PC1 | So far so good I have local wikid software clients talking back and forth with the Wikid Server, | 17:32 |
| PC1 | getting their tokens and have a few accounts setup and registered on the server. | 17:32 |
| PC1 | For internal testing purposes the server code for the domain is based on the internal IP address of the Wikid server. | 17:33 |
| PC1 | Now once we get into the remote access testing phase of this project I will need to change this ServerCode to the public | 17:33 |
| nowen | just create a new one. You can't edit the domain id | 17:34 |
| PC1 | Ohh okay | 17:34 |
| PC1 | Ok so, | 17:34 |
| PC1 | what ports must be open to allow software clients to talk to the Wikid Domain to get their Passcode? | 17:35 |
| nowen | just 80 | 17:35 |
| PC1 | My concern is this, the same IP address (public address), is going to be used to hit the Citrix Secure Gateway page. | 17:36 |
| nowen | hmm | 17:36 |
| PC1 | the CSG server is in a DMZ, | 17:36 |
| PC1 | so I'm a little concerned about port 80 being open inbound like that. | 17:36 |
| nowen | all the token requests will go to /wikid/ | 17:36 |
| nowen | can you proxy based on that? | 17:37 |
| nowen | what is in front the citrix? | 17:37 |
| PC1 | My understanding is that yes the tokens requests go straight to Wikid. | 17:37 |
| PC1 | In front of citrix is a firewall that will probably be doing some kind | 17:37 |
| nowen | I mean they go to http://ipaddress/wikid/ | 17:37 |
| nowen | so, for example, in apache to can proxy based on the directory | 17:38 |
| PC1 | They will not be able to do that from outside the LAN as the wikid server is on our internal LAN . | 17:38 |
| nowen | /wikid/ | 17:38 |
| nowen | what I mean is that if you only have one external ip, you will need something that sends some requests to the Citrix and some to wikid | 17:39 |
| PC1 | yes. | 17:39 |
| PC1 | Over different ports though, as | 17:39 |
| PC1 | CSG will be SSL. | 17:40 |
| nowen | ahh, ok, if CSG is on a different port, then any firewall should be able to do that | 17:40 |
| PC1 | yes that's whatI figured but my concern was that since the CSG server is on the internal network, would allowing inbound | 17:41 |
| PC1 | sorry let me rephrase that. | 17:41 |
| PC1 | My wikid server is on an internal private IP. I now have a public IP assigned to a hardware firewall that is configured | 17:42 |
| PC1 | to forward port 443 to the internal CSG server and port 80 to the internal IP of the Wikid Server. | 17:43 |
| PC1 | Doesn't the forwarding of port 80 create a security risk? | 17:43 |
| nowen | ahh | 17:43 |
| PC1 | Since its inbound traffic. | 17:43 |
| PC1 | and the wikid server is not in a DMZ. | 17:44 |
| PC1 | Only the CSG is. | 17:44 |
| PC1 | I just did not realize that Wikid has to first talk to the wikid server to get a token. | 17:44 |
| nowen | would you prefer that the wikid server be in the dmz? | 17:44 |
| nowen | you could also put an apache server in the dmz and have it proxy the requests to the internal wikid box | 17:44 |
| PC1 | So that would create a layer of abstraction true but end result is that we have inbound port 80 traffic getting into the corporate network. | 17:45 |
| PC1 | Correct? | 17:45 |
| nowen | correct. Most of our users put wikid in the dmz | 17:46 |
| PC1 | hmmm yep that's what I'm getting at (i'm not the person responsible for the networking portion of it, but I need to know enough | 17:46 |
| PC1 | to suggest the best setup scenario. | 17:46 |
| PC1 | Okay .. so it should be in a dmz.. | 17:47 |
| nowen | that is where most put it. it has a firewall on it, of course and is hardened. since it is talking to things in the dmz, it makes sense | 17:47 |
| PC1 | That's what I figured, Unless the port can be changed so it communicates over some non well known port. | 17:48 |
| nowen | well, you can't change the port on the tokens - it needs to be a port supported by isps etc. but you can change the listen port on the server and have the proxy use that | 17:48 |
| nowen | so requests come in to ipaddress:80/wikid and get proxied to internalip:8080/wikid | 17:49 |
| PC1 | yes that's what exactly!. | 17:49 |
| PC1 | Would you think that would be relatively secure? | 17:49 |
| nowen | yes, but I don't know much about your setup, your risk profile, etc | 17:50 |
| PC1 | of course I understand! | 17:50 |
| PC1 | Well that's helpfull thanks I have something else to think about I will keep a copy of this converstation for my records. | 17:51 |
| PC1 | As usual appreciate your help. | 17:51 |
| nowen | np. remember ymmv! | 17:51 |
| PC1 | ymmv>? | 17:51 |
| nowen | your mileage may vary ;) | 17:52 |
| PC1 | ahhh !! | 17:52 |
| PC1 | oky doky later... | 17:53 |
| nowen | later | 17:53 |
| *** PC1 has quit (Quit: Page closed) | 17:54 | |
| *** nowen1 (~nowen@adsl-98-66-182-32.asm.bellsouth.net) has joined #wikid | 23:09 | |
| *** nowen has quit (Ping timeout: 250 seconds) | 23:09 | |
| *** nowen1 has parted #wikid (None) | 23:11 | |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!