| *** Lake_Lurker (~Just@h159.79.91.75.dynamic.ip.windstream.net) has joined #wikid | 11:21 | |
| *** Lake_Lurker has parted #wikid (None) | 11:21 | |
| *** nowen (~nowen@adsl-74-176-212-133.asm.bellsouth.net) has joined #wikid | 12:48 | |
| *** Wallyk (4004456e@gateway/web/freenode/ip.64.4.69.110) has joined #wikid | 13:59 | |
| Wallyk | Hello | 13:59 |
|---|---|---|
| nowen | hi | 13:59 |
| Wallyk | I am trying to setup an apache reverse proxy to go in a dmz and I am wondering what url's I need to forward through the proxy | 14:00 |
| nowen | the token requests will all go to the /wikid/ directory on your wikid server | 14:00 |
| Wallyk | ok that is what I wanted to know. Thanks. | 14:01 |
| nowen | np | 14:01 |
| Wallyk | I am trying to get "wikidctl start" to run at bootup is this possible? | 14:57 |
| nowen | yes, | 14:58 |
| Wallyk | I added it to rc.local is that right? | 14:58 |
| nowen | create a file called /etc/WiKID/security | 14:58 |
| nowen | and put one line it it: 'WAUTH_PASSPHRASE=yourpassphrase' | 14:58 |
| nowen | without the quotes, of course | 14:58 |
| nowen | and then, yes, rc.local should do it | 14:59 |
| Wallyk | hmm I will keep looking | 14:59 |
| nowen | is it not working? | 14:59 |
| Wallyk | no I rebooted the server and it is not working | 14:59 |
| Wallyk | when I run the command manualy it will start working | 15:00 |
| nowen | I can send you an /etc/init.d script | 15:00 |
| Wallyk | ok | 15:00 |
| nowen | what is your email? | 15:01 |
| Wallyk | wallyk@caamanitoba.com | 15:02 |
| Wallyk | is the time to renew a hint? : ) | 15:05 |
| nowen | hehe - not sure, I just forwarded an email to someone else. guess I forgot to change the subject :) | 15:05 |
| Wallyk | We did buy it last year I really don't kno were we stand | 15:06 |
| Wallyk | should rc.local work have other people done that? | 15:06 |
| nowen | I thought it would, but this guy had troubles. I thought it would be good to have a full script anyway and this was the start | 15:07 |
| nowen | you'll purchased in January, plenty of time left :) | 15:09 |
| Wallyk | will you guys send us a reminder? | 15:12 |
| nowen | oh yes :) | 15:12 |
| Wallyk | rc.local is working I just needed the full path | 15:13 |
| nowen | you mean /opt/WiKID/bin? | 15:13 |
| Wallyk | yep | 15:13 |
| nowen | good to know | 15:13 |
| Wallyk | is there a reason ldap protocol daemon takes such a long time? | 15:14 |
| Wallyk | We are not using ldap so I guess I could turn it off | 15:15 |
| nowen | because ldap is such a piece of crap? | 15:15 |
| Wallyk | : ) | 15:15 |
| nowen | oh yes, do turn it off. | 15:15 |
| Wallyk | can I trun it off from the admin page | 15:15 |
| nowen | yes, under Configuration/Enable Protocols | 15:15 |
| Wallyk | hmm it says not initialized | 15:16 |
| Wallyk | not a big deal we should not have to reboot that often | 15:19 |
| nowen | the WiKIDAdmin says that it isn't enabled? | 15:20 |
| Wallyk | right | 15:20 |
| nowen | hmm | 15:20 |
| Wallyk | but when I run wikidctl start it hangs on starting ldap protocol for a long time | 15:21 |
| Wallyk | it is also showing me all the protocols 4 times | 15:24 |
| Wallyk | I recently did an update I don't know if that could have caused the problem | 15:24 |
| nowen | hmm | 15:25 |
| nowen | ok | 15:25 |
| nowen | we can fix this, lemme see if I can find my notes | 15:25 |
| nowen | so, what version are you on now? | 15:25 |
| Wallyk | wikid-server-enterprise-3.4.87-b839 | 15:26 |
| nowen | ok - ready to some psql? | 15:29 |
| nowen | # su - postgres | 15:30 |
| nowen | $ psql -d wikid | 15:30 |
| nowen | wikid=# select * from host_type; | 15:30 |
| nowen | let me know the output. it should have doubles | 15:30 |
| Wallyk | wikid=# select * from host_type; id_hosttype | type | name | creation -------------+------+----------------------------------------------------+------------------------------- 1 | 0 | WAUTH | 2010-09-30 14:37:12.023515-05 2 | 1 | Radius | 2010-09-30 14:37:12.033849-0 | 15:32 |
| Wallyk | yep doubles that was messy | 15:32 |
| nowen | huh. that looks ok | 15:32 |
| nowen | oh, is that not all of it? | 15:32 |
| nowen | I guess irc limited it | 15:32 |
| Wallyk | no it does not want to past in properly I could email you back hang on | 15:33 |
| nowen | don't worry | 15:33 |
| nowen | I'm guessing that 1-5 are legit, correct? | 15:33 |
| Wallyk | Yep | 15:33 |
| nowen | so | 15:33 |
| nowen | wikid=# delete from host_type where id_hosttype > 6; | 15:33 |
| nowen | should delete any that are higher | 15:33 |
| Wallyk | yep that worked | 15:34 |
| Wallyk | though ldap still says not initialized | 15:35 |
| nowen | it should clear up with a restart | 15:35 |
| Wallyk | how do I get out of psql? | 15:37 |
| nowen | ctrl-d | 15:37 |
| nowen | a couple of times | 15:37 |
| Wallyk | rebooting now | 15:37 |
| nowen | oh, you don't have to reboot - sorry - I just meant to restart wikid | 15:38 |
| Wallyk | yeah I should have thought of that | 15:38 |
| Wallyk | oh well | 15:38 |
| nowen | np | 15:39 |
| Wallyk | That is good. It restarts quick now. Now I can get on to what I was really wanting to do. Create an apache reverse proxy to live in a dmz | 15:42 |
| nowen | cool. I need to write that up. | 15:43 |
| nowen | the only part I don't have is the proxypass rules, though I have re-write rules | 15:43 |
| Wallyk | We have been a blackberry shop untill recently and the bes let let our moble clients connect without wikid being internet facing | 15:44 |
| nowen | ahh yes | 15:44 |
| Wallyk | now we have ipads and I have an android and I need to get it to work | 15:44 |
| nowen | but now the xEO has an iphone? | 15:44 |
| Wallyk | : ) | 15:45 |
| Wallyk | how did you konw. he started the whole thing | 15:45 |
| nowen | hehe | 15:45 |
| nowen | lunchtime. bbl | 15:59 |
| *** nowen has quit (Quit: Leaving.) | 15:59 | |
| *** nowen (~nowen@adsl-74-176-212-133.asm.bellsouth.net) has joined #wikid | 17:06 | |
| *** Wallyk has quit (Ping timeout: 252 seconds) | 17:35 | |
| asofrank | Nick | 17:50 |
| asofrank | do you have a list of return codes from the API | 17:50 |
| nowen | hmm. let me dig | 17:51 |
| asofrank | im getting a "4" code when trying to add additional registration codes for a user | 17:51 |
| asofrank | btw, you should update the website to include the updated PHP API that greg has :) | 17:52 |
| nowen | I have it up there for download | 17:52 |
| asofrank | says 3.0-5 | 17:53 |
| asofrank | the one I have is 3.1-0 | 17:53 |
| nowen | oops. | 17:53 |
| nowen | it's on sourceforge but not the homepage | 17:53 |
| nowen | which Add additional function are you using? | 17:56 |
| asofrank | add-no-check | 17:56 |
| asofrank | ADDREGUSER | 17:56 |
| asofrank | actually | 17:56 |
| asofrank | I think I see the problem in the code | 17:57 |
| asofrank | its just an annoying way of doing it. let me recode and see if I'm still getting an error | 17:57 |
| nowen | you see a problem in your code? | 17:58 |
| asofrank | a bit of mine and the way the PHP class works | 17:58 |
| nowen | Should be a log message in the server log. | 17:59 |
| nowen | username exists perhaps? | 18:00 |
| nowen | "Registration of " + uname + " failed. Username exists in " + domainCode + " domain." | 18:00 |
| nowen | or | 18:00 |
| nowen | "Registration of " + uname + " failed in " + domainCode + " domain. Passcode failed validation." | 18:00 |
| nowen | are the two 4s | 18:01 |
| asofrank | yeah, i see what it is | 18:02 |
| asofrank | that particular function just didn't work as I expected it | 18:02 |
| asofrank | but now that I have findUser() to work with, it makes it easier | 18:02 |
| asofrank | cool. that seemed to work | 18:04 |
| asofrank | btw, there doesn't seem to be a way to add multiple token clients per user from the web admin | 18:04 |
| asofrank | if you enter the same username it just comes back with duplicate user | 18:05 |
| nowen | no, there isn't. we added it later and thought it more secure to keep it at the network client layer, specifically for a banking app of a customer | 18:05 |
| asofrank | ah | 18:06 |
| asofrank | no matter for me, as all the user stuff is being done over the API anyway | 18:06 |
| asofrank | s | 18:06 |
| asofrank | while testing it though, I noticed it wasnt possible :) | 18:07 |
| asofrank | I ended up creating username1 username2 username3 for some people while testing | 18:07 |
| asofrank | Nick: I got it working | 18:35 |
| nowen | excellent | 18:36 |
| asofrank | any word on the issues I brought up about the mac client? | 18:36 |
| asofrank | specifically, the latest version doesn't work if you're a non-admin | 18:36 |
| nowen | hmm. my mind is slipping | 18:37 |
| nowen | installer jar? or just the jar? | 18:37 |
| asofrank | the installer jar | 18:38 |
| asofrank | well, I think it installed fine | 18:38 |
| asofrank | but you couldnt add a domain | 18:38 |
| asofrank | let me test it again | 18:39 |
| nowen | hmm. what domain? | 18:39 |
| asofrank | it was an issue with writing to the location where the files were stored | 18:39 |
| nowen | hmm | 18:39 |
| nowen | there should be an option to install it in a different location during the install process | 18:39 |
| asofrank | ok. when you enter the passphrase, it just kicks back to it again | 18:55 |
| asofrank | it doesnt accept it | 18:55 |
| nowen | sounds like perms on the directory. can't write the file | 18:55 |
| nowen | where is it installed? | 19:00 |
| asofrank | it installs by default into /Applications/wikidtoken | 19:07 |
| asofrank | I can't reproduce the issue | 19:07 |
| asofrank | I'm having our CEO try again | 19:07 |
| nowen | hmm, /Applications is user-owned, right? | 19:08 |
| asofrank | i know it asks for privilege escalation when the installer starts | 19:08 |
| asofrank | /Applications is root owned if im not mistaken | 19:08 |
| asofrank | I tried putting it in /User/USERNAME/Applications but it said it couldnt write there | 19:08 |
| asofrank | which was weird | 19:08 |
| asofrank | CEO just tried locked version and had the same issue | 19:09 |
| asofrank | hes trying unlocked now | 19:10 |
| nowen | I think it's an issue on our end. | 19:10 |
| nowen | the token asks for root to install, but the user is the one writing the file | 19:10 |
| asofrank | yeah, thats what I figured when I checked the debugging output with greg | 19:11 |
| asofrank | hm, another user on a mac cant even run the client for some reason | 19:11 |
| asofrank | is 10.5.x not supported? | 19:11 |
| asofrank | ok. CEO tried unlocked version | 19:12 |
| asofrank | it worked fine | 19:12 |
| asofrank | so its just the locked version that is having the issue | 19:12 |
| nowen | does he have java on 10.5? | 19:14 |
| asofrank | the installer ran | 19:14 |
| asofrank | i dont understand why it would be any different | 19:14 |
| nowen | what version of java? | 19:14 |
| nowen | we require 1.6 | 19:14 |
| asofrank | let me check | 19:21 |
| asofrank | whats the option to get the java version | 19:21 |
| nowen | java -version | 19:21 |
| *** joshua___ (6264145c@gateway/web/freenode/ip.98.100.20.92) has joined #wikid | 19:22 | |
| joshua___ | Greetings. | 19:22 |
| *** joshua___ is now known as hublar | 19:22 | |
| nowen | howdy! | 19:22 |
| hublar | I could use some help -- security and networking are not my forte -- but, I need to put together a solution. | 19:22 |
| asofrank | bah, she signed up | 19:23 |
| asofrank | off* | 19:23 |
| asofrank | I'll get back with her later and see what it is | 19:23 |
| nowen | ok | 19:23 |
| asofrank | and tell her to get off 10.5 cause its old | 19:23 |
| nowen | hehe | 19:23 |
| hublar | I need to setup two-factor authentication with VNC. | 19:23 |
| asofrank | Lion should be out any time now I think | 19:23 |
| hublar | I have a bunch of clients who take card holder data -- I'd like to keep them PCI compliant. | 19:23 |
| hublar | I'm not sure where to begin, except for that -- my resources are tight. | 19:24 |
| nowen | hublar: ok, well, VNC typically doesn't have a lot of auth options. do you run it through something else? | 19:24 |
| hublar | That's what I thought I would do -- run it over SSH, and -- maybe set something up with tokens. | 19:24 |
| nowen | I'm a big fan of freenx and it's commercial version from Nomachine | 19:25 |
| hublar | Anytime I google two-factor authentication and VNC, wikid server comes up | 19:25 |
| asofrank | heh | 19:25 |
| hublar | Could you tell me more about freenx? | 19:25 |
| nowen | but if you are looking for hardware tokens, you're in the wrong place :) | 19:25 |
| asofrank | google loves to cache the wikid site, so I've found | 19:25 |
| hublar | I don't need hardware tokens. | 19:25 |
| hublar | I just need to make something PCI compliant. | 19:25 |
| hublar | Essentially -- I want to be able to slid into and service a machine that handles card holder data. | 19:26 |
| hublar | *slide | 19:26 |
| hublar | We're scaling our operations -- so, the importance of me being able to do this is critical to our growth. | 19:26 |
| hublar | As it is, I use showmypc and it requires a bunch of yucky user intervention. | 19:27 |
| nowen | freenx encrypts traffic with ssh and uses the NX protocol to speed VNC | 19:27 |
| hublar | I see. | 19:27 |
| hublar | So, it is one component of the problem at hand. | 19:27 |
| nowen | it uses pam for authentication | 19:27 |
| nowen | so you can configure pam_radius to talk to the WiKID server | 19:28 |
| hublar | What /is/ WiKID, exactly? | 19:28 |
| nowen | it is a two-factor authentication solution | 19:28 |
| hublar | Well, there you go. | 19:28 |
| hublar | http://www.wikidsystems.com/support/wikid-support-center/how-to/using-freenx-to-secure-terminal-services-and-vnc-with-two-factor-authentication | 19:28 |
| nowen | so, freenx and wikd gets you what you need | 19:29 |
| nowen | that is a bit dated. | 19:29 |
| nowen | you don't have to change the freenx code any more | 19:29 |
| hublar | Yes, it does. | 19:29 |
| hublar | Okay -- so, what is the pricepoint of a setup like this? | 19:29 |
| nowen | here is the pam-radius info for redhat/centos: http://www.wikidsystems.com/support/wikid-support-center/how-to/pam-radius-how-to/?searchterm=pam%20radius | 19:29 |
| asofrank | nearly half the price of standard hardware tokens :) | 19:30 |
| hublar | So, I need to put a box on the next to do PAM. | 19:30 |
| hublar | that communicates with WiKID. | 19:30 |
| nowen | yes, set up freenx and pam-radius on a box. it would radius to wikid | 19:30 |
| nowen | you could do it all in one box, but we recommend that wikid run on it's own server/virtual image | 19:31 |
| hublar | WiKID does whatever it does, authenticates the connection, and establishes the session. | 19:31 |
| hublar | okay, I see. | 19:31 |
| asofrank | it just sends a "login good" or "login bad" back to whatever is communicating with it. | 19:31 |
| nowen | WiKID authenticates the user. the sessions is all ssh or freenx | 19:31 |
| hublar | So - does WiKID systems do hosting? | 19:31 |
| nowen | exactly | 19:31 |
| hublar | Or is it simply the technology behind the solution? | 19:32 |
| nowen | we do not, but you can run it anywhere. The key question is encrypting the radius traffic | 19:32 |
| hublar | hrm | 19:32 |
| nowen | is most of your infrastructure hosted? | 19:32 |
| hublar | Well, we're a very tight group at the moment. I have a shared host for web, and the rest is a hodge-podge collection of devices a la battlestar. Working on it. | 19:33 |
| hublar | So, yes. | 19:33 |
| hublar | shared hosting for infrastructure. | 19:33 |
| hublar | Sounds like I need a VPS. | 19:33 |
| nowen | is the host PCI compliant? | 19:34 |
| asofrank | thats what I was thinking | 19:34 |
| hublar | Hostgator. | 19:34 |
| asofrank | shared hosting generally is not. | 19:34 |
| hublar | no, I should think I would have to do a VPS. | 19:34 |
| hublar | God forbid a colo. | 19:34 |
| nowen | yeah, I think amazon has a pci compliant offering | 19:34 |
| hublar | decent pricepoint? | 19:34 |
| hublar | Sounds like i wouldn't need a whole lotta cycles. | 19:34 |
| nowen | no idea | 19:34 |
| asofrank | the system itself doesn't use much juice | 19:35 |
| nowen | the WiKID iso is based on centos5 | 19:35 |
| asofrank | it sits idle 99% of the time | 19:35 |
| hublar | Sounds like I could go barebones VPS. | 19:35 |
| hublar | right. | 19:35 |
| nowen | yeah, and it doesn't use much memory. 1 gig should do it | 19:35 |
| hublar | So, I need 1) VPS. 2) Radius mojo 3)Freenix | 19:35 |
| nowen | and very little traffic | 19:35 |
| hublar | Freenx | 19:36 |
| hublar | What is FreeNX, exactly? | 19:36 |
| nowen | freenx might not be in the centos repos. | 19:36 |
| hublar | a PAM authenticator. | 19:36 |
| nowen | no, an open source version of this http://www.nomachine.com/ | 19:37 |
| nowen | haha, I'm looking for a copy of an article I wrote on freenx. | 19:38 |
| nowen | can't find it | 19:38 |
| nowen | because it was in print! | 19:38 |
| nowen | :) | 19:38 |
| nowen | I'll have to update the webiste | 19:39 |
| nowen | site | 19:39 |
| nowen | hublar: asofrank can help you out with a VPS | 19:40 |
| nowen | hey , asofrank what gives? http://www.asmallorange.com/hosting/business/ PCI compliance for $25 more? | 19:41 |
| nowen | Y U NO TELL US? | 19:41 |
| asofrank | its scheduled security checks and scans | 19:41 |
| asofrank | it really depends on what level of PCI you need | 19:41 |
| nowen | it is popular? | 19:41 |
| asofrank | not extremely, most people ignore PCI | 19:42 |
| nowen | haha LOL | 19:42 |
| nowen | true | 19:42 |
| hublar | The reddit is strong with you. | 19:42 |
| hublar | I cannot ignore PCI. | 19:42 |
| hublar | I am a Merchant Service Provider. | 19:42 |
| hublar | ;_; | 19:42 |
| nowen | no audit, no compliance | 19:42 |
| asofrank | indeed. | 19:42 |
| nowen | for the record, I spend very little time on reddit | 19:42 |
| asofrank | me either. | 19:43 |
| hublar | Now that google+ is out, amirite? | 19:43 |
| hublar | :E | 19:43 |
| asofrank | hah. yeah, im on google+ | 19:43 |
| nowen | haha | 19:43 |
| nowen | I am too, but I have like two posts. and it's all twitter people in my circle | 19:43 |
| hublar | I have to bail -- I need to image up a new machine and get it ready for a rapid deployment. | 19:43 |
| asofrank | good luck. | 19:44 |
| hublar | I'd love to continue this conversation, though. | 19:44 |
| nowen | k - come back | 19:44 |
| hublar | I know my solution is here. | 19:44 |
| hublar | I want, so much, to grok fully. | 19:44 |
| nowen | and if you like IRC, you're our kind of user | 19:44 |
| hublar | <4 | 19:44 |
| hublar | (<3++) | 19:44 |
| hublar | ;) | 19:44 |
| hublar | peace, fellas. | 19:44 |
| nowen | haha | 19:44 |
| nowen | later | 19:45 |
| asofrank | question for you. If we change server codes, will we have to reset all the client tokens? | 20:09 |
| nowen | yes | 20:09 |
| asofrank | ok | 20:09 |
| nowen | we can set you up an entry in our dns if you like. a la our 88888888888 demo domain | 20:10 |
| asofrank | well, we're downsizing our servers at GNAX, and the IP of that server may be changing | 20:10 |
| *** hublar has quit (Ping timeout: 252 seconds) | 20:11 | |
| asofrank | im not 100% sure it will be changing, but its possible | 20:11 |
| asofrank | we have several /24's that wont be used anymore | 20:11 |
| nowen | if you use our dns, we can point it to a domain in your dsn | 20:12 |
| nowen | the downside is that you are relying on our dns | 20:12 |
| nowen | the next edition will not have this issue | 20:12 |
| asofrank | yeah, we only have ~ 40 employees so it might be a non-issue to reset everyone | 20:12 |
| asofrank | so the server code itself is not used on the client to directly connect to our wikid server, or is it? | 20:13 |
| nowen | the token client will check the default dns. if that fails, then the ipaddress | 20:13 |
| nowen | this can be reversed on the java token with a custom jw.properties file and the dns can be changed | 20:14 |
| asofrank | ah | 20:14 |
| asofrank | gotcha | 20:14 |
| nowen | by the smartphone tokens do not do that yet | 20:14 |
| asofrank | the smartphone tokens need some work :) | 20:16 |
| nowen | hehe. yes. it isn't easy to keep up. | 20:16 |
| asofrank | i dont even pretend to know how to code mobile apps, so I'll leave that to you all. | 20:16 |
| asofrank | im sure. | 20:16 |
| nowen | too many platform | 20:16 |
| nowen | s | 20:16 |
| asofrank | you either need a couple rockstar developers who know everything, or a bunch of developers with various levels of expertise | 20:17 |
| *** nowen has parted #wikid (None) | 22:31 | |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!