| *** nowen (~nowen@99-174-92-191.lightspeed.tukrga.sbcglobal.net) has joined #wikid | 12:09 | |
| *** salik (45f6d450@gateway/web/freenode/ip.69.246.212.80) has joined #wikid | 15:20 | |
| salik | hi nick. you there? | 15:20 |
|---|---|---|
| nowen | yes | 15:20 |
| salik | ok we made a bit more progress. still not able to login but now seeing radius traffic on gateway/wikid server | 15:20 |
| nowen | sweet | 15:20 |
| salik | 10:54:41.856791 IP atldc02.tcprod.local.61814 > gtwl01.gain.tcprod.local.radius: RADIUS, Access Request (1), id: 0x08 length: 101 10:54:41.859380 IP gtwl01.gain.tcprod.local.radius > atldc02.tcprod.local.61814: RADIUS, Access Reject (3), id: 0x08 length: 30 | 15:21 |
| nowen | is the user still enabled? | 15:21 |
| salik | let me check | 15:21 |
| salik | and this is from the logs: Access denied for ssiddiqi, domain code: 010030136114 client: /10.30.137.202 | 15:22 |
| salik | user is enabled. staus is 1 | 15:22 |
| nowen | ok | 15:23 |
| nowen | are the loggers still on debug? | 15:23 |
| nowen | they get reset on a restart unless you specify otherwise | 15:24 |
| salik | yeah filter is set to debug | 15:24 |
| nowen | under configure loggers too? | 15:24 |
| salik | so what do i need to do under Configure Loggers | 15:25 |
| salik | i never set that before | 15:25 |
| nowen | com.wikidsystems , com.wikidsystems.client.wClient, com.wikidsystems.server.wAuth and the radius logger to debug | 15:26 |
| salik | i dont see a radius logger. I see com.wikidsystems.radius.access.WikidAccess4. is that what u are talking about? | 15:28 |
| nowen | yeah do that one, but also under New logger, Select a current logger, add com.wikidsystems.radius.log.DBSvrLogImpl as debug | 15:29 |
| salik | ok. any changes in the startup logging configuration section? | 15:30 |
| nowen | no | 15:31 |
| nowen | just try to login and it will be there | 15:31 |
| nowen | remember to reset these by restarting before going into production | 15:31 |
| nowen | or you will swamp the system with logs ;) | 15:31 |
| salik | ok. made changes. will try to login again | 15:32 |
| nowen | ok | 15:32 |
| salik | 2014-04-23 11:34:53.721INFOcom.wikidsystems.radius.log.DBSvrLogImpl<12> Access-Request(1) LEN=101 10.30.137.202:61814 Access-Request by ssiddiqi Failed: AccessRejectException: Access Denied 2014-04-23 11:34:53.720INFOcom.wikidsystems.radius.access.WikidAccess4Access denied for ssiddiqi, domain code: 010030136114 client: /10.30.137.202 | 15:41 |
| nowen | can you paste the whole thing after the passcode into pastebin.com? | 15:42 |
| salik | ok | 15:42 |
| salik | http://pastebin.com/Qn624pHr | 15:45 |
| nowen | check that you're still enabled. Can you also double-check the shared secret b/w wikid and nps | 15:46 |
| nowen | I don't see any change in the logs after changing the loggers | 15:46 |
| salik | ok. status 1 means enabled? | 15:46 |
| nowen | yes | 15:46 |
| salik | ok account is configured. | 15:46 |
| salik | enabled | 15:47 |
| salik | which screen do i go to check shared secret in wikid side? | 15:49 |
| nowen | Network client | 15:49 |
| nowen | you have to modify the one for nps | 15:53 |
| salik | yeah i just entered the nps one again and will try logging in again. | 15:53 |
| salik | i think it was ok, but we shall see | 15:53 |
| salik | still getting access denied | 15:55 |
| salik | will get u the logs | 15:55 |
| nowen | and are com.wikidsystems , com.wikidsystems.client.wClient, com.wikidsystems.server.wAuth all set to debug? | 15:56 |
| nowen | not sure why you don't see more in the logs | 15:56 |
| salik | ok let me double check | 15:57 |
| salik | yeah all set to debug | 15:57 |
| salik | http://pastebin.com/rg5gVgdf | 15:58 |
| nowen | and that's the correct domain? | 15:59 |
| nowen | you only have the one network client? | 15:59 |
| salik | yes | 16:00 |
| salik | well actually, what is the definition of network client in wikid talk? | 16:01 |
| nowen | it would be the nps. | 16:01 |
| salik | yeah only 1 | 16:01 |
| nowen | it's like your other loggers aren't reporting at all | 16:01 |
| nowen | Source is None and substring is empty? | 16:02 |
| salik | how do i check that | 16:03 |
| nowen | it's just on the logs page | 16:04 |
| salik | oh ok | 16:04 |
| nowen | the default source is None, which means all ;-) | 16:04 |
| salik | oh ok | 16:04 |
| salik | on the network client section where I set shared secret, I have Assign Return Attribute set to user-name and a blank in the box after. not sure if that is ok? | 16:08 |
| nowen | did you set it up on the NPS too? | 16:08 |
| nowen | I say delete it | 16:09 |
| salik | i dont see how i can delete it | 16:09 |
| nowen | you may need to restart the server. if so, you might want to save the loggers | 16:09 |
| salik | it was already selected by default | 16:09 |
| nowen | oh | 16:10 |
| nowen | if you add it, then you will see a table below the dropdown | 16:10 |
| salik | yeah it wasnt something i added | 16:11 |
| nowen | ok | 16:11 |
| salik | so to save loggers, i select save current configuration as startup configuration"? | 16:12 |
| nowen | yes | 16:12 |
| salik | ok restarting server and trying again | 16:12 |
| nowen | ok | 16:13 |
| nowen | you know you only need to run 'wikidctl restart', right? | 16:26 |
| salik | yeah. thats what i did. it looks like it didnt retain the logging changes I made even though I saved them | 16:28 |
| nowen | hmm | 16:28 |
| salik | ill set them again and try again | 16:29 |
| nowen | ok | 16:29 |
| salik | http://pastebin.com/L94RL2C9 | 16:34 |
| nowen | not much difference, is there? | 16:35 |
| nowen | :( | 16:35 |
| salik | not really :( | 16:35 |
| nowen | is there anything in /opt/WiKID/log/radius.log? | 16:35 |
| salik | let me check. one sec | 16:36 |
| salik | no. empty | 16:36 |
| nowen | hmm | 16:38 |
| nowen | what version of wikid is this? | 16:38 |
| nowen | the latest, right? | 16:38 |
| salik | yes | 16:38 |
| nowen | can you edit a file in linux? | 16:41 |
| salik | sure | 16:41 |
| nowen | ok | 16:42 |
| nowen | ok - open /etc/WiKID/log4j.properties | 16:44 |
| salik | ok i have it open | 16:44 |
| nowen | comment out the line "log4j.rootLogger=DEBUG, socketLogger" | 16:44 |
| nowen | and uncomment "#log4j.rootLogger=DEBUG, socketLogger, A1" | 16:45 |
| salik | ok done | 16:46 |
| nowen | ok - restart wikid | 16:46 |
| nowen | and now the logs should go into /opt/WiKID/log | 16:46 |
| salik | ok | 16:46 |
| nowen | in particular radius.log | 16:46 |
| salik | ok | 16:46 |
| salik | i can share my desktop with you. it might make it easier to troubleshoot. | 16:47 |
| nowen | maybe. I run linux so not everything works | 16:48 |
| salik | i was going to use join.me. it works fine in linux | 16:48 |
| nowen | let's see the radius.log first, then | 16:48 |
| salik | ok. wikid has restarted. i am trying to login now | 16:49 |
| salik | http://pastebin.com/eWfMHvuL | 16:52 |
| nowen | ugh | 16:52 |
| nowen | 10.30.137.202 is the NPS? | 16:52 |
| salik | yes | 16:53 |
| nowen | run 'netstat -anp | grep 1812' on the server | 16:55 |
| salik | udp 0 0 0.0.0.0:1812 0.0.0.0:* 26122/java | 16:57 |
| nowen | run tcpdump port radius on the server and try to login | 16:58 |
| salik | http://pastebin.com/qBnCCP39 | 17:00 |
| nowen | try 'tcpdump -vv port radius' | 17:01 |
| salik | and login again? | 17:02 |
| nowen | yes | 17:02 |
| nowen | send me a join.me invite | 17:05 |
| salik | i just emailed it to u | 17:07 |
| nowen | ok - I'm in | 17:17 |
| salik | ok | 17:17 |
| nowen | show me the WiKIDAdmin - configure loggers | 17:18 |
| salik | it seems to reset it everytime i reboot | 17:18 |
| nowen | did you "Save currrent configuration as startup configuration" | 17:19 |
| nowen | ? | 17:19 |
| salik | yeah | 17:19 |
| salik | and i clicked change config button | 17:19 |
| nowen | hmm | 17:19 |
| nowen | ok - well set them to debug again | 17:19 |
| salik | look ok? | 17:20 |
| nowen | yep | 17:20 |
| nowen | click apply chabnges | 17:20 |
| nowen | and try to login | 17:21 |
| salik | ok logging in from another system now | 17:21 |
| nowen | hmm Bad udp checksum | 17:23 |
| salik | ok | 17:23 |
| nowen | show me the wikidadmin logs | 17:23 |
| nowen | wait, why are there so many | 17:25 |
| salik | i tried 6 times until it kicked me out | 17:25 |
| nowen | oh | 17:25 |
| nowen | is the user enabled? | 17:25 |
| nowen | hit reload on that page | 17:26 |
| salik | i did | 17:26 |
| salik | u want to take a quick look at how my NPS is setup? | 17:29 |
| nowen | show me the network client first | 17:31 |
| nowen | ok | 17:31 |
| nowen | I wonder if we should try a simple shared secret | 17:32 |
| salik | ok | 17:32 |
| salik | i can change it | 17:32 |
| *** ddreggors (b85a8505@gateway/web/freenode/ip.184.90.133.5) has joined #wikid | 17:34 | |
| salik | ok shared secret is changed | 17:35 |
| nowen | you need to restart wikid | 17:35 |
| salik | u want to look at anything else at NPS? i kept pretty much the standard policies. and just configured them to froward requests to wikid server | 17:36 |
| salik | should i set these to debug again? | 17:38 |
| nowen | yes | 17:38 |
| salik | ok trying to login now | 17:40 |
| nowen | ok | 17:40 |
| nowen | just once is all we need | 17:40 |
| salik | ok done | 17:41 |
| nowen | testing something over here | 17:42 |
| salik | ok | 17:42 |
| nowen | I'm at a loss | 17:49 |
| nowen | show me your nps again | 17:50 |
| nowen | wait | 17:51 |
| salik | ok | 17:51 |
| nowen | gtwl01.gain.tcprod.local is what machine? | 17:51 |
| salik | thats the gateway/wikid server | 17:51 |
| nowen | so, I think this is not going to work | 17:52 |
| nowen | looking at tcpdump: 12:59:05.377200 IP gtwl01.gain.tcprod.local.27459 > atldc02.tcprod.local.radius: RADIUS, Access Request (1), id: 0x68 length: 91 | 17:52 |
| nowen | what is atldc02.tcprod.local.radius | 17:52 |
| nowen | ? | 17:52 |
| salik | yes | 17:52 |
| nowen | is that AD? | 17:52 |
| salik | yes | 17:52 |
| salik | its a domain controller | 17:52 |
| nowen | ok - show me the radius server on NPS | 17:53 |
| salik | well the FQDN is atldc02.tcprod.local | 17:53 |
| salik | not .local.radius | 17:53 |
| nowen | ok | 17:53 |
| nowen | edit that | 17:54 |
| nowen | show me the Authentication table | 17:54 |
| nowen | chec the Authenticator attribute | 17:55 |
| nowen | and turn off accounting | 17:55 |
| ddreggors | add shared secret now? | 17:56 |
| salik | yeah our shared secret is blank here | 17:56 |
| nowen | ? | 17:56 |
| nowen | isn't that where you entered it? | 17:56 |
| salik | i entered it on Radius client window | 17:56 |
| nowen | oh | 17:56 |
| nowen | yeah, you need it here too | 17:56 |
| salik | ok | 17:57 |
| nowen | I bet that was it | 17:57 |
| salik | ok let me save and try again | 17:57 |
| nowen | ok | 17:57 |
| salik | still access denied | 17:58 |
| salik | lets go through the rest of the NPS settings to make sure it is all ok | 17:59 |
| salik | so i am forwarded requests to the wikid server here | 18:00 |
| salik | forwarding | 18:01 |
| nowen | did you use the new shared secret? | 18:01 |
| salik | yes | 18:01 |
| salik | i updated it at radius client and radius server | 18:02 |
| nowen | and wikid? | 18:02 |
| salik | and it is updated on wikid too | 18:02 |
| nowen | show me the auth methods again | 18:02 |
| salik | in wikid? | 18:03 |
| nowen | no on nps | 18:03 |
| nowen | radius server | 18:03 |
| nowen | ok - let me see the network policy settings | 18:04 |
| nowen | ok show settings | 18:05 |
| nowen | go back to encrpytion | 18:06 |
| nowen | ok | 18:07 |
| nowen | login again and show me the tcpdump | 18:09 |
| salik | ok | 18:09 |
| ddreggors | bad udp checksum | 18:10 |
| nowen | pastebin that for me | 18:10 |
| ddreggors | ctrl+c Salik | 18:11 |
| salik | ok | 18:11 |
| ddreggors | and copy all output | 18:11 |
| salik | http://pastebin.com/DWM9dwqA | 18:12 |
| nowen | I think the checksum error is an artifact of using tcpdump | 18:16 |
| salik | ok | 18:16 |
| nowen | show me the radius.log | 18:16 |
| nowen | did you have this working with just pam and wikid? | 18:20 |
| salik | nick, do we need to update the passwords in the raddb/server file too? | 18:22 |
| salik | the shared secret | 18:22 |
| ddreggors | no I do not believe so, this is a new install and we have never authenticated with it | 18:22 |
| nowen | each pair is separate but must be the same | 18:22 |
| salik | ok | 18:22 |
| nowen | does the one in nps client match the one in /etc/raddb? | 18:23 |
| salik | what about pam_radius.conf | 18:23 |
| salik | no | 18:23 |
| nowen | so you have two pairs of shared secrets | 18:24 |
| salik | all we updated on wikid was through the web interface | 18:24 |
| ddreggors | OEL 6 ships with pam_radius module that provides a pam_radius.conf | 18:24 |
| nowen | pam/nps and nps server/wikid | 18:24 |
| nowen | each one must be the same | 18:24 |
| nowen | just set all four to the same thing ri | 18:24 |
| nowen | now | 18:24 |
| nowen | show me /etc/raddb/server | 18:25 |
| salik | ok everything is same pw now | 18:26 |
| nowen | ok try logging in | 18:26 |
| ddreggors | tcpdump too | 18:26 |
| ddreggors | ok | 18:27 |
| ddreggors | I was able to capture dump lol | 18:27 |
| ddreggors | looks like it succeeded | 18:27 |
| salik | i think it worked | 18:27 |
| nowen | it did | 18:27 |
| ddreggors | nice | 18:27 |
| ddreggors | great job guys | 18:27 |
| nowen | yes | 18:28 |
| ddreggors | Salik, go for NoMachine now | 18:28 |
| salik | nick, i am trying with nomachine now | 18:28 |
| nowen | ok | 18:28 |
| ddreggors | should be the same, it uses ssh | 18:28 |
| ddreggors | it worked | 18:29 |
| salik | yeah that worked | 18:30 |
| ddreggors | do we always have to give a pass at Gnome? | 18:30 |
| ddreggors | or was that because you did not log out and that was screen saver pass check? | 18:30 |
| salik | i will log out completely and see | 18:31 |
| ddreggors | please log completely out and reconnect witn NM | 18:31 |
| ddreggors | ok | 18:31 |
| ddreggors | ok | 18:32 |
| ddreggors | looks good | 18:32 |
| ddreggors | now try Domain credentials without wikid in ssh | 18:32 |
| ddreggors | or NM | 18:32 |
| ddreggors | that should not happen right? | 18:33 |
| ddreggors | with just domain credentials and no wikid token | 18:34 |
| salik | so nick, we can still login with just active directory credentials | 18:34 |
| salik | bypassign wikid | 18:34 |
| nowen | depends on your pam config | 18:34 |
| ddreggors | ok we have sufficient and not required | 18:34 |
| salik | this was the issue we were having before on the other server | 18:34 |
| nowen | show me /etc/pam.d/sshd | 18:34 |
| salik | but never resolved | 18:34 |
| salik | ok | 18:34 |
| ddreggors | we added top line only, the rest is default | 18:35 |
| nowen | change it to required and try again | 18:35 |
| nowen | keep a session open | 18:35 |
| salik | ok | 18:36 |
| salik | ok fails with AD creds | 18:36 |
| salik | will try with wikid nw | 18:36 |
| salik | now | 18:36 |
| salik | wikid fails now too | 18:37 |
| nowen | try include | 18:37 |
| nowen | oh | 18:37 |
| nowen | why did it fail on wikid? | 18:38 |
| salik | says access denied | 18:38 |
| nowen | try again | 18:38 |
| ddreggors | Salik, start process over with new token | 18:38 |
| salik | still access denied | 18:40 |
| nowen | user enabled? | 18:40 |
| salik | yes. status 1 | 18:40 |
| nowen | try include rather than required | 18:41 |
| nowen | oh | 18:41 |
| nowen | probably an NPS setting. you don't have a user account on the gw server right? | 18:41 |
| salik | no | 18:42 |
| salik | we use winbind | 18:42 |
| salik | and use AD accounts to authenticate | 18:42 |
| nowen | for auth? or acct? | 18:42 |
| nowen | I don't see winbind there | 18:42 |
| ddreggors | for auth | 18:43 |
| nowen | did you turn it off? | 18:43 |
| ddreggors | --> /etc/pam.d/password-auth:auth sufficient pam_winbind.so use_first_pass | 18:43 |
| nowen | is that for local or ssh or both? | 18:44 |
| ddreggors | both | 18:44 |
| nowen | well | 18:44 |
| ddreggors | that is just one line | 18:44 |
| ddreggors | Salik... run this "grep winbind /etc/pam.d/* | 18:45 |
| nowen | yeah, but if it is allowing AD auth... | 18:45 |
| ddreggors | shouldn't it succeed if sshd/auth required passes though? | 18:46 |
| ddreggors | and then only use acct after that | 18:46 |
| nowen | pam is odd | 18:47 |
| ddreggors | ok it is because of this: | 18:48 |
| salik | access still denied after changing that line to "include" btw | 18:48 |
| ddreggors | auth include password-auth | 18:48 |
| ddreggors | 3rd line | 18:48 |
| ddreggors | in sshd | 18:48 |
| ddreggors | Salik try requisite | 18:49 |
| ddreggors | rather than required | 18:49 |
| ddreggors | sorry out now | 18:50 |
| salik | so u are saying to change include to requisite? | 18:51 |
| ddreggors | yes | 18:51 |
| ddreggors | it is still going to include though, but a fail should not process the include | 18:52 |
| ddreggors | basically, if pass... include, if fail stop here and send fail | 18:52 |
| salik | wikid fails | 18:52 |
| ddreggors | yeah | 18:52 |
| salik | AD fails | 18:53 |
| ddreggors | of course, you never reach winbind now | 18:53 |
| ddreggors | requisite will not include password-auth which does winbind | 18:53 |
| ddreggors | only if pass with it do include | 18:54 |
| ddreggors | put back to sufficient | 18:54 |
| salik | ok wikid works now | 18:55 |
| ddreggors | look at wikid logs | 18:56 |
| nowen | comment out password auth as an option and I bet AD will no longer work | 18:56 |
| ddreggors | so questions is why does wikid succeed when sufficient? | 18:56 |
| ddreggors | and not when required or requisite? | 18:57 |
| ddreggors | Salik comment password auth include line | 18:57 |
| ddreggors | try wikid now | 18:58 |
| salik | ok AD doesnt work. trying wikid now | 18:58 |
| salik | wikid works | 18:59 |
| ddreggors | yeah... | 18:59 |
| ddreggors | not sure that is what we want, but it works as expected | 18:59 |
| nowen | not sure why sufficient is required, but it's between pam and pam-radius | 19:00 |
| nowen | most likely it is a pam-radius issue. that module is old | 19:03 |
| salik | ok. i think we are on the right track now. we will do some more testing and get back to you if we need help | 19:03 |
| nowen | ok | 19:03 |
| salik | we will have some more team members test it for functionality and then we will probably roll this out to our other users next week | 19:04 |
| nowen | ok | 19:04 |
| salik | we will go back and change all 4 shared secret as well | 19:05 |
| salik | thanks again for the help | 19:05 |
| nowen | np | 19:05 |
| nowen | will you give Talal the update? | 19:05 |
| salik | yeah | 19:05 |
| nowen | cool | 19:05 |
| salik | nick, you there? | 19:57 |
| nowen | yes | 19:57 |
| salik | u had me uncomment some stuff in log4j.properties | 19:57 |
| salik | can i change that back to how it was? | 19:57 |
| salik | or is it ok to leave as is | 19:58 |
| nowen | change it back | 19:58 |
| nowen | also reset your loggers to factory defualt | 19:58 |
| salik | ok | 19:59 |
| *** ddreggors has quit (Ping timeout: 240 seconds) | 20:31 | |
| *** nowen has quit (Quit: Leaving.) | 22:13 | |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!