| *** WiKIDLogbot (~WiKIDLogb@ec2-174-129-6-100.compute-1.amazonaws.com) has joined #wikid | 14:11 | |
| card.freenode.net | Topic for #wikid is: support for the WiKID Strong Authentication System. If no one is here, try the nabble forums: http://www.wikidsystems.com/support/support/wikid-forums | 14:11 |
|---|---|---|
| card.freenode.net | Users on #wikid: WiKIDLogbot @nowen perestre1ka coolacid ionepoch jY mikekr_ mick_laptop | 14:11 |
| *** SLiVER (~SLiVER@99-6-152-182.lightspeed.wlfrct.sbcglobal.net) has joined #wikid | 16:06 | |
| *** SLiVERR (~SLiVER@99-6-152-182.lightspeed.wlfrct.sbcglobal.net) has joined #wikid | 16:06 | |
| *** SLiVERR has parted #wikid (None) | 16:07 | |
| SLiVER | Anyone alive? | 16:07 |
| nowen | yep | 16:07 |
| SLiVER | hello hello | 16:07 |
| SLiVER | do you work for wikid? | 16:08 |
| nowen | yes :) | 16:08 |
| SLiVER | Oh great, I got a few questions for you then. | 16:08 |
| nowen | shoot | 16:08 |
| SLiVER | I am looking to set up wikid with a netgear vpn firewall. I was reading the whitepaper on it but would like to know if it supports IPSec VPNs or only SSL VPNS? | 16:09 |
| nowen | WiKID doesn't care what kind of vpn it is. as long as it supports radius, it will work | 16:10 |
| SLiVER | Ahh, ok gotcha, is there a way to keep 2 wikid servers syncronized? I have an amazon vpc and an onsite network that I would like to secure using same credentials | 16:12 |
| nowen | not with the current versions. we're working on a new product that would, but it would cost a bit more | 16:13 |
| SLiVER | ok, good to know | 16:13 |
| nowen | have you heard about radsec proxy? | 16:13 |
| nowen | it encrypts radius traffic | 16:13 |
| SLiVER | I have heard of it, but have to look into it some more I guess | 16:14 |
| nowen | same here | 16:14 |
| nowen | you can set up two server and have your users have two domains on a single token | 16:14 |
| SLiVER | hmm, does that mean I have to have 2 licenses per seat? | 16:15 |
| nowen | yes | 16:15 |
| SLiVER | ok, I will consider that | 16:16 |
| SLiVER | looks like radsec hasnt been standardised yet | 16:16 |
| nowen | radsecproxy would be better, most likely | 16:16 |
| nowen | ? | 16:16 |
| nowen | you mean that radius doesn't support encrpytion? | 16:17 |
| SLiVER | no i mean the radsec protocol hasnt been standardized by the IETF, not a huge deal, just not a standard prtocol for now | 16:17 |
| ionepoch | good morning... new here, almost done setting up wikid, plan to integrate radius auth with juniper firewall today.. have a few questions as well.. 1st... about radius... | 16:18 |
| ionepoch | i see that you guys mention radius is not encrypted | 16:18 |
| nowen | SLiVER: can't see that it matters as long as radius goes in one end and comes out the other :) | 16:18 |
| ionepoch | however, is the data somewhat masked due to the shared key? | 16:18 |
| nowen | ionepoch: correct. it is encoded by the shared key | 16:19 |
| SLiVER | iionepoch it is MD5 encrypted but MD5 is not secure | 16:19 |
| ionepoch | ok... | 16:19 |
| SLiVER | from what i understand | 16:19 |
| ionepoch | i've taken it for granted that it was secrue | 16:19 |
| ionepoch | however... | 16:19 |
| ionepoch | i guess what you are seeing is md5 is weak for complete security | 16:19 |
| ionepoch | ... (but i guess better than plaintext) | 16:19 |
| SLiVER | md5 is easily crackable so you cant rely on it | 16:20 |
| ionepoch | k | 16:20 |
| nowen | yes. radius traffic should only be on the inside | 16:20 |
| ionepoch | well... we're paranoid over here (inside and out) so i'll have to look into radsec as well | 16:20 |
| ionepoch | ... | 16:20 |
| ionepoch | i have another question about radius | 16:20 |
| ionepoch | i set it up in the wikidadmin panel | 16:21 |
| ionepoch | the configuration section was pretty clear stating you should have to mess with the default radius settings... however, the IP is set to 127.0.0.1 ... this makes it seem like the radius service attached to wikid will only be accessible by the local wikid server... | 16:21 |
| ionepoch | however... when i take a look at the ports... it appears radius is listening on all interfaces: | 16:21 |
| ionepoch | netstat -tupan | grep 1812 | 16:22 |
| ionepoch | udp6 0 0 :::1812 :::* 3752/java | 16:22 |
| ionepoch | does the IP Address under the "RADIUS Configuration" panel need to be the public facing id? | 16:22 |
| nowen | no. that's where the WiKID radius listener will be. | 16:22 |
| ionepoch | ok.. | 16:22 |
| ionepoch | so just leave it at 127.0.0.1 | 16:23 |
| ionepoch | correct? | 16:23 |
| nowen | correct | 16:23 |
| ionepoch | ok... | 16:23 |
| ionepoch | also... yo'll have to forgive my ignorance... we're switching from (icky) RSA | 16:23 |
| ionepoch | .. | 16:23 |
| nowen | I need to take out the option to change it at all. the dev thought of a scenario where this code would run off the WiKID server | 16:23 |
| nowen | np | 16:23 |
| ionepoch | RSA generated time synchronized OTP for us on our mobile phones (without the need to connect to the central RSA auth server) | 16:24 |
| ionepoch | ... | 16:24 |
| ionepoch | it seems obvious... but I just want to make sure I'm understanding this... | 16:24 |
| ionepoch | our mobile phones will need to be able to establish a data connection to our wikid auth server to generate the OTP for normal operation, correct? | 16:25 |
| nowen | in WiKID, the token communicates with the server | 16:25 |
| nowen | yes | 16:25 |
| ionepoch | to my next question... | 16:25 |
| ionepoch | no problem with the comminication... | 16:25 |
| ionepoch | but i'd like to NAT the server... | 16:25 |
| ionepoch | ie... some public ip 3.3.3.3 ... nat to... 192.168.x.x | 16:25 |
| ionepoch | .... | 16:25 |
| nowen | np. just use the external IP as teh domain identifier | 16:25 |
| ionepoch | awesome... | 16:25 |
| ionepoch | that was my question ... and seems to make since as the WIKID clients appear to use that ip in the server identifier to phone home... | 16:26 |
| ionepoch | also... in the examples... i do see a: Offline Login: | 16:26 |
| ionepoch | UserID: | 16:26 |
| ionepoch | Challenge: 23107009 | 16:26 |
| nowen | yeah, we support a fallback to C/R mode if the user doesn't have a network connection | 16:27 |
| ionepoch | not that it matters much... but is the offline login implemented as a fallback | 16:27 |
| ionepoch | k | 16:27 |
| ionepoch | ... | 16:27 |
| ionepoch | this is truly great | 16:27 |
| nowen | it comes up in pre-sales, but it never comes up in production, it seems. I think that with wifi and the fact that users choose carriers that cover where they go, it isn't an issue | 16:27 |
| ionepoch | fallback is really nice (not sure it will matter for us though).. chances are if we can't reach the auth server... we've got problems.... | 16:28 |
| ionepoch | yeah... | 16:28 |
| nowen | I'd be interested in your comparison between the RSA auth server and ours. | 16:28 |
| ionepoch | from sales point of view... everyone tries to poke holes in everything just in case | 16:28 |
| nowen | hehe, yeah, better before you pay than after :) | 16:28 |
| ionepoch | i can tell you right now... 95% better right off the bat | 16:28 |
| ionepoch | nightmare stories with RSA | 16:28 |
| ionepoch | it's been my goal to move our company off for sometime | 16:29 |
| ionepoch | ... | 16:29 |
| ionepoch | RSA doesn't run on debian based boxes (boo) | 16:29 |
| SLiVER | Is 10 users the minumum license I can purchase? | 16:29 |
| nowen | SLiVER: yes | 16:30 |
| ionepoch | RSA appears massively designed for Windows (all windows/linux flame wars aside)... we don't use windows for our production systems ... so i don't care about it | 16:30 |
| ionepoch | ... | 16:30 |
| ionepoch | also... RSA works with SUN's implementation of ldap... (never realized that it was different than regular openldap)... zero support for openldap... ie... you are on your own... | 16:30 |
| ionepoch | ... | 16:30 |
| SLiVER | ok, thanks for the support, i wish every business had an IRC channel. I am sure I will be back when I go to set up the server. THANKS! | 16:30 |
| nowen | hehe | 16:31 |
| nowen | irc is pretty nice for support | 16:31 |
| ionepoch | the self installer packages in RSA are horrible in unworkable unless you are running redhat... we ended up buying a dedicated appliance from RSA to get it done... | 16:31 |
| SLiVER | bah bye | 16:31 |
| nowen | SLiVER: also, if you come to irc for support, I know you won't need much support :) | 16:31 |
| ionepoch | the dedicate appliance you think would be easy ... but it was horrible... | 16:31 |
| SLiVER | yeh right eheh | 16:31 |
| nowen | ionepoch: doesn't their appliance run windows? | 16:31 |
| *** SLiVER has parted #wikid ("Taking my Vortec IRC elsewhere...") | 16:31 | |
| ionepoch | redhat | 16:31 |
| ionepoch | .... | 16:31 |
| ionepoch | wikid has been much more straightforward and actually works... | 16:32 |
| ionepoch | i am a huge fan of... "here ... apt-get these standard packages... then install ours" | 16:32 |
| ionepoch | simple... | 16:32 |
| nowen | I'm testing some new .debs. soon. a bit behind on those | 16:32 |
| ionepoch | in a dream world... getting into the apt repository would be AWESOME | 16:32 |
| nowen | yeah, we're working on that | 16:32 |
| nowen | or at least setting up our own | 16:33 |
| ionepoch | my only 5% confusion with WIKID i think has to do with either entropy or a name server timing out... | 16:33 |
| ionepoch | when i boot wikid... takes like 2 minutes for success (no problem, that's fine)... | 16:33 |
| ionepoch | but then when i load the admin panel... takes another 2 minutes to get the tomcat engine to wake up and respond... | 16:34 |
| ionepoch | any thoughts on this? | 16:34 |
| nowen | hmm | 16:34 |
| nowen | what are your machine's specs? | 16:34 |
| ionepoch | model name: Intel(R) Xeon(R) CPU X3430 @ 2.40GHz | 16:34 |
| ionepoch | 4gb | 16:35 |
| ionepoch | should be good | 16:35 |
| nowen | oh yeah | 16:35 |
| nowen | anything in the WiKIDAdmin logs? | 16:36 |
| ionepoch | let me check... | 16:36 |
| ionepoch | actually... very very little and nothing that would indicate a problem.. | 16:37 |
| ionepoch | let me check catalina | 16:37 |
| ionepoch | nothing in there either... | 16:38 |
| ionepoch | what is normal for boot times once you enter wikidctrl start? | 16:38 |
| nowen | what version # is this? | 16:38 |
| ionepoch | wikid-server-enterprise_3.4.87-b1092-1.deb | 16:39 |
| nowen | we have done some work to improve the radius start time. it needs entropy | 16:40 |
| ionepoch | no problem... | 16:40 |
| ionepoch | there are some entropy packages ... | 16:41 |
| nowen | running rngd -r /dev/urandom apparently gets radius to start quickly | 16:41 |
| ionepoch | hmm.. | 16:41 |
| nowen | I should be able to post a new .deb today | 16:41 |
| nowen | also, I can just give you the link if you want to test it too. | 16:42 |
| ionepoch | awesome, ok, i'll take a look... which brings me to my next questions... | 16:42 |
| ionepoch | mailing lists for updates and security updates? | 16:42 |
| nowen | working on that too. :) | 16:43 |
| ionepoch | ok... | 16:43 |
| ionepoch | no problem rome isn't built in a day (from dev cycles, believe me i understand) | 16:43 |
| ionepoch | ... | 16:43 |
| nowen | if you selected to subscribe when you downloaded, you'll get on it. or if you purcase | 16:43 |
| ionepoch | which leads me to next questions... | 16:43 |
| ionepoch | my goal for today is to integrate with juniper... and get mobile phone authenticating and then we're done. | 16:44 |
| ionepoch | do i need to have real licenses to test the phone? | 16:44 |
| nowen | no, everything should work | 16:44 |
| ionepoch | k.. | 16:44 |
| ionepoch | one more.. | 16:44 |
| ionepoch | since i will be natting the wikid auth server... | 16:45 |
| ionepoch | the only thing that our employees will need to reach is ... a.b.c.d:8388 ?? correct? | 16:45 |
| ionepoch | ie port 8388 ? | 16:45 |
| nowen | no, the tokens use port 80. that should be the only port open to the outside | 16:46 |
| ionepoch | ok, so mobile phones and clients connect on 80... and just to be clear... no need for 443? | 16:47 |
| nowen | only if you want the WiKIDAdmin available outside. the tokens use asymmetric encryption, so no ssl is needed | 16:47 |
| ionepoch | awesome.. | 16:48 |
| ionepoch | we have ssl vpn... | 16:48 |
| ionepoch | so.. i think i will pat the ports... 443 to vpn server... and 80 to wikid server | 16:48 |
| ionepoch | sweet | 16:48 |
| nowen | sounds right | 16:48 |
| ionepoch | ok... thank you so much for your time | 16:48 |
| nowen | np. thanks for the feedback | 16:48 |
| ionepoch | how long does it take to get 10seat 3yr license delivered once payment is made? | 16:49 |
| nowen | like seconds :) | 16:49 |
| ionepoch | do you have an option for 10seat 5 yr? I didn't see it on the purchase page | 16:49 |
| nowen | no, just 3 yr | 16:49 |
| ionepoch | k | 16:50 |
| nowen | ok - I haven't tested this, but i have tested the rpm. http://wikidsystems-dl.com/wikid-server-enterprise_3.4.87-b1181-1.deb | 16:50 |
| ionepoch | alright back to work for me... probably keep that chat open... i'll check back in a bit later... thanks again! | 16:50 |
| nowen | p | 16:50 |
| ionepoch | for updates... can i just dpkg that and away we go? | 16:51 |
| nowen | yes | 16:55 |
| ionepoch | ok... | 16:55 |
| ionepoch | i'll get working on all of this and let you know what i find... be back in a while, cheers | 16:55 |
| *** mikekr_ has quit (Quit: Page closed) | 19:41 | |
| ionepoch | nowen... small update... i haven't installed the new test deb yet... but... the rngd -r /dev/urandom seems to have fixed the slow boot times... (starting to work on this again) | 19:42 |
| nowen | yeah, we basically added that as the fix | 19:43 |
| ionepoch | as a heads up ... apt-get install rng-tools | 19:43 |
| nowen | damn, the ssl cert gen takes a long time too | 19:43 |
| ionepoch | rng-tools is the package i installed for rngs... not sure if you need people to add that to the list of standard packages to install before getting started | 19:44 |
| ionepoch | i didn't have any problems with ssl gen times so far | 19:47 |
| ionepoch | will let you know if i encounter any | 19:47 |
| ionepoch | nowen, if i want to rename the server's host name... from blah.myinternalserver.com to... auth.liveserver.com ... should i recreate the intermediate cert, install it, and recreate the local host cert? | 19:53 |
| nowen | yes | 19:53 |
| nowen | rerun set up too | 19:53 |
| ionepoch | thanks! | 19:56 |
| ionepoch | woohoo... first test auth success with juniper device | 20:19 |
| ionepoch | super easy! | 20:19 |
| ionepoch | sweet! | 20:19 |
| nowen | hehe, nice | 20:19 |
| nowen | btw, I will be traveling tomorrow. if you need something, you can use the forums or email me (if you have it :) | 23:09 |
| *** dystonic (c7ff532e@gateway/web/freenode/ip.199.255.83.46) has joined #wikid | 23:33 | |
| *** dystonic is now known as dystie | 23:33 | |
| dystie | hi, Nick, you around | 23:33 |
| dystie | i'm having a service restart issue and could use some pointers. | 23:33 |
| ionepoch | hola~ i'm not nick (think he might have left for the day)... | 23:47 |
| ionepoch | but i've been messing with this... | 23:47 |
| ionepoch | couple things I had issues with... | 23:47 |
| ionepoch | killall java related processes on restart | 23:47 |
| ionepoch | ... and the entropy random generator seems to help alot | 23:47 |
| ionepoch | rngd -r /dev/urandom | 23:47 |
| ionepoch | once i loaded the rngd processes... restarts worked alot better | 23:48 |
| dystie | hi. | 23:50 |
| dystie | ok -- i can't get the services up. kinda frustrating, | 23:51 |
| ionepoch | i'm in the processes of moving away from rsa to wikid | 23:51 |
| ionepoch | so far ... | 23:51 |
| dystie | so i'm in a paired setup; we fail from our 01 box to our 02 box, but it's not failing back or coming up and i'm not sure what's wrong cus i didn't build the solution. | 23:51 |
| ionepoch | the initial setup has been pretty good | 23:51 |
| dystie | yeah rsa makes me cranky. didja read the sp-800-01 doc from nist? i think that's the name | 23:52 |
| dystie | was updated twofactor guidance. | 23:52 |
| ionepoch | 01 and 02 ... 02 is a backup box? | 23:52 |
| ionepoch | so do you have 2 issues? | 23:53 |
| dystie | yeah, i'm not sure what our license count on it is, but things fail to 02; when 01 is back up we restart service on 02 and it's supposed to fail back | 23:53 |
| dystie | but things arne't communicating right and i can't get either server to bring up the wikid browser page. | 23:53 |
| ionepoch | ahh | 23:53 |
| dystie | well tomcat is starting but it's not bringing up the auth page | 23:53 |
| ionepoch | ok... | 23:53 |
| ionepoch | so... | 23:53 |
| dystie | and i'm getting database connection errors. | 23:53 |
| ionepoch | ahh | 23:53 |
| dystie | whatcha think? | 23:53 |
| ionepoch | i recall setting a password on postgres | 23:54 |
| dystie | dya know what user it needs to run as? | 23:54 |
| ionepoch | are you on a debian based box? | 23:54 |
| ionepoch | if so... | 23:54 |
| dystie | centos | 23:54 |
| ionepoch | hmm | 23:54 |
| ionepoch | well | 23:54 |
| ionepoch | cat /etc/passwd | 23:54 |
| ionepoch | look for a postgres user | 23:54 |
| ionepoch | postgres or postgresql (we're on ubuntu so i don't know what centos did) | 23:55 |
| ionepoch | ... | 23:55 |
| ionepoch | then sudo su to root | 23:55 |
| ionepoch | ... | 23:55 |
| ionepoch | then su - postgres user | 23:55 |
| ionepoch | whatever the postgres user is for you distro | 23:55 |
| ionepoch | i had to google search this for ubuntu... | 23:55 |
| ionepoch | on ubuntu | 23:55 |
| ionepoch | it's postgres | 23:55 |
| ionepoch | su - postgres | 23:55 |
| ionepoch | then psql -Upostgres | 23:55 |
| dystie | check. | 23:56 |
| dystie | what commands do you typcially run to diagnose issues? in terms of what do you check is listening or started. | 23:56 |
| ionepoch | well | 23:57 |
| ionepoch | first i'd see that postgres is running.. | 23:57 |
| ionepoch | then... | 23:57 |
| ionepoch | su - postgres | 23:58 |
| ionepoch | psql | 23:58 |
| ionepoch | \c template1 | 23:58 |
| ionepoch | ALTER USER postgres WITH PASSWORD 'changeme'; | 23:58 |
| ionepoch | \q | 23:58 |
| ionepoch | dpkg -i wikid-server-xxx.deb | 23:58 |
| ionepoch | 23:58 | |
| ionepoch | # Follow prompts... not cert takes a while to generate (up to 5 minutes). | 23:58 |
| ionepoch | 23:58 | |
| ionepoch | 23:58 | |
| ionepoch | 23:58 | |
| ionepoch | # type postgres password as many times as prompted | 23:58 |
| ionepoch | 23:58 | |
| ionepoch | 23:58 | |
| ionepoch | # type postgres password as many times as prompted | 23:58 |
| ionepoch | 23:58 | |
| ionepoch | (if you have the rngd -r /dev/urandom ... the cert generation should be faster | 23:59 |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!