Re: [Security Firewall] Re: Problems after installation of naat-packages from CVS - Needs help

Hi again,

1. ok, your setup seems ok according to your short description and the
apache2 server is up and running.
2. ideas: 
2.1 can you login on the firewall using that admin login/passwd using
ssh to make sure that your admin login and password are ok ?
2.2 can you read some more details in the log files concerning your
error message ?
try /var/log/messages, /var/log/syslog/, /var/log/secure and also
/var/log/httpd2-naat/*
I don't remember the exact name of the last log names but you'll find out :-)

I will also try to setup this here on a mandrake 10.1 x86_64 installed
on qemu and have a better view (because I'm currently working on the
future version with a already up and running mnf2+ and mandriva 10.2
:-) )

cheers,

On 7/20/05, Stephan Eck <[email protected]> wrote:
> Hi Florin,
> 
> nice to have heard from you again - and thanks for the hint ;-)
> Ok, I've installed the following MNF2 specific packages and all their
> dependencies:
> naat-frontend-www-doc-0.8-76mdk
> naat-frontend-www-common-0.8-76mdk
> naat-monitoring-0.8-9mdk
> naat-backend-0.8-76mdk
> httpd2-naat-0.8-13mdk
> naat-frontend-www-en-0.8-76mdk
> mnf-en-10.0-16mdk (this file at last with --nodeps because of the missing
> mandrakelinux-mnf-release-file).
> Also I've installed the following mod-packages for apache2:
> apache2-mod_ssl-2.0.53-8mdk
> apache2-mod_php-2.0.53_4.3.10-7mdk
> apache2-modules-2.0.53-9mdk
> apache2-mod_auth_external-2.0.53_2.2.9-6mdk
> 
> I've created two certificates (server.crt  server.key) using the
> gentestcrt.sh script in /usr/lib/ssl/apache2-mod_ssl
> copied them to /etc/ssl/apache2 and adjusted the file
> /etc/httpd/conf.d/51_ssl.httpd2-naat-vhost.naat with the following lines:
> SSLCertificateFile /etc/ssl/apache2/server.crt
> SSLCertificateKeyFile /etc/ssl/apache2/server.key
> 
> Also I've fixed the symbolic link "extramodules" in /etc/httpd that
> primarily points to nirvana. Now it points to
> extramodules -> ../../usr/lib/apache2-extramodules/.
> This file contains the libraries mod_auth_external.so, mod_php4.so and
> mod_ssl.so.
> 
> Here is the result of netstat -an|grep 8443
> tcp        0      0 :::8443                 :::*                    LISTEN
> 
> and this is the server-status:
> service httpd2-naat extendedstatus
> Apache Server Status for 127.0.0.1
> 
> Server Version: Apache-AdvancedExtranetServer/2.0.53
> (Mandrakelinux/PREFORK-9mdk) mod_auth_external/2.2.9
> mod_ssl/2.0.53 OpenSSL/0.9.7e PHP/4.3.10
> Server Built: Mar 30 2005 12:41:28
>      _________________________________________________________________
> 
>    Current Time: Wednesday, 20-Jul-2005 22:08:06 CEST
>    Restart Time: Wednesday, 20-Jul-2005 20:07:11 CEST
>    Parent Server Generation: 0
>    Server uptime: 2 hours 54 seconds
>    Total accesses: 0 - Total Traffic: 0 kB
>    CPU Usage: u0 s0 cu0 cs0
>    0 requests/sec - 0 B/second -
>    1 requests currently being processed, 4 idle workers
> 
> After a "shorewall clear" I can reach the logon-screen using
> https://nnn.nnn.n.n:8443.
> But every time I try to log in with user admin and my real simple
> testpassword, I receive the message "Wrong Login/Password".
> 
> I hope that with the assistance of my description you can help me to solve
> this problem.
> 
> Regards
> 
> Stephan
> -----Ursprüngliche Nachricht-----
> Von: security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected]
> [mailto:security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected]]Im Auftrag von florin
> Gesendet: Dienstag, 19. Juli 2005 14:45
> An: security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected];
> security-firewall-J4tZAbal8pkzaQFa27Lw39BPR1lH4CV8@public.gmane.org
> Cc: Stephan Eck
> Betreff: [Security Firewall] Re: Problems after installation of
> naat-packages from CVS - Needs help
> 
> 
> Hi Stephan,
> 
> please post this kind of message on the mailing list and do not
> address it directly tome. Your increase your changes to get more help.
> I also read the messages on the ML, you know :-)
> 
> First, you should know that you don't need to install everything from the
> CVS.
> You don't need, for example:
> - httpd-naat (but only httpd2-naat)
> - naat-backend-devel
> - naat-frontend-www-devel
> - naat-frontend-www-doc
> 
> I'm not sure I understand. Do you get the login screen through the web
> mnf2 interface ?
> If not, you seem to have a problem running the httpd2-naat script
> after running the service httpd2-naat restart command do you see the
> 8443 port in netstat -an |grep 8443 ? also, what do you get with
> service httpd2-naat status ?
> 
> If yes, did you install the mod-auth-external package for apache 2 ?
> This package deals with the authentication ...
> 
> that's all for now,
> 
> cheers,
> 
> On 7/17/05, Stephan Eck <[email protected]> wrote:
> > Hi Florin,
> >
> > I've tried to install MNF2 using the MNF2 specific naat-files from CVS and
> a
> > Mandrake 10.1 basic installation doing the following steps:
> > 1. Download the MNF2 specific source code from CVS in my home directory
> > /home/user/src with
> >         export CVS_RSH=ssh
> >         export CVSROOT=:ext:[email protected]:/cooker
> >         cvs co firewall2
> > 2. Built the rpm specific build tree (i.e. BUILD, SOURCES, SPECS, RPMS,
> > SRPMS)in my home directory under the directory rpm.
> > 3. Created the file .rpmmacros in my home directory with %_topdir
> > /home/user/rpm
> > 4. Running make rpm (make rpm2 for httpd2-naat) in every source directory
> > ending with following files:
> >         httpd2-naat-0.8-13mdk.noarch.rpm
> >         httpd-naat-0.8-13mdk.noarch.rpm
> >         mnf-en-10.0-16mdk.noarch.rpm
> >         naat-backend-0.8-76mdk.i586.rpm
> >         naat-backend-devel-0.8-76mdk.i586.rpm
> >         naat-frontend-www-common-0.8-76mdk.noarch.rpm
> >         naat-frontend-www-devel-0.8-76mdk.noarch.rpm
> >         naat-frontend-www-doc-0.8-76mdk.noarch.rpm
> >         naat-frontend-www-en-0.8-76mdk.noarch.rpm
> >         naat-monitoring-0.8-9mdk.noarch.rpm
> > 5. I did a basic installation of Mandrake 10.1 and a subsequent
> installation
> > of the MNF2 specific rpms and all their dependencies
> >         using the instruction from www.flexbeta.net and the slightly
> outdated but
> > very detailed description from amaury.
> >
> > Everything went fine. After a "shorewall clear" I could access the machine
> > using ssh and my admin password which contains
> > no special characters.
> >
> > But (of course there is a but) I can't access the machine using the web
> > frontend.
> > I've tried it from a WIN and a Linux Machine but every time I get a "wrong
> > account/password" message.
> >
> > I don't know enough about the logon mechanism to figure out what's going
> > wrong.
> >
> > I've found something strange in the
> > /var/log/httpd2-naat/httpd2-naat.error_log file
> >
> > After a "service httpd2-naat restart" I can find the following lines:
> > [Sun Jul 17 15:46:35 2005] [notice] caught SIGTERM, shutting down
> > [Sun Jul 17 15:46:35 2005] [notice] Digest: generating secret for digest
> > authentication ...
> > [Sun Jul 17 15:46:35 2005] [notice] Digest: done
> > [Sun Jul 17 15:46:35 2005] [notice] Apache-AdvancedExtranetServer/2.0.53
> > (Mandrakelinux/PREFORK-9mdk) PHP/4.3.10 mod_ssl/2.0.5
> > 3 OpenSSL/0.9.7e configured -- resuming normal operations
> >
> > so everything seems to be ok, but every time I try to logon via the web
> > interface there appears the following message in the
> > httpd2-naat.error_log file.
> >
> > sh: -c: line 3: syntax error: unexpected end of file
> > sh: -c: line 3: syntax error: unexpected end of file
> > looks like that there is a shell script broken.
> >
> > I hope, with your guidance, I can solve the problem.
> >
> > Regards
> >
> > Stephan
> >
> >
> >
> 
> 
> --
> Florin
> 
> 
> 
> 
> 
> 
> ____________________________________________________
> Want to buy your Pack or Services from Mandriva?
> Go to http://store.mandriva.com
> Join the Club : http://www.mandrivaclub.com
> ____________________________________________________
> 
> 
> 


-- 
Florin

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________