AW: [Security Firewall] Re: Problems after installation of naat-packages from CVS - Needs help

Hi Florin,

I've checked the /etc/httpd/conf/httpd2-naat.conf configuration file and I
think, that there is a missing
"Include /etc/httpd/conf.d/10_mod_auth_external.conf" directive.
I've added this line and a "https://nnn.nnn.nnn.nnn:8443/server-status"
results in the following message:

Forbidden
You don't have permission to access /server-status on this server.
----------------------------------------------------------------------------
----
Apache-AdvancedExtranetServer/2.0.53 (Mandrakelinux/PREFORK-9mdk) PHP/4.3.10
mod_ssl/2.0.53 OpenSSL/0.9.7e mod_auth_external/2.2.9 Server at 127.0.0.1
Port 8443

According to this message httpd2-naat now uses mod_auth_external.
So, now I hope mod_auth_external will be called when I trie to log in via
the web interface.
I've also added the debug directive to the following lines to see what's
going on under the hood during pam authentication:
/etc/pam.d/pwauth			auth       required     pam_stack.so debug
service=system-auth
/etc/pam.d/system-auth		auth       sufficient    pam_unix.so likeauth nullok
debug

But every time I tried to log in via the web interface, I received the
message "Wrong Login/Password".
Now here are the details from different log files after I restarted
httpd2-naat (service httpd2-naat restart) and tried to log in via web
interface:

/var/log/syslog:
Jul 25 09:04:07 localhost httpd2-naat: httpd2-naat heruntergefahren
succeeded
Jul 25 09:04:07 localhost httpd2-naat: httpd2-naat: Could not determine the
server's fully qualified domain name, using 127.0.0.1 for ServerName
Jul 25 09:04:07 localhost httpd2-naat: httpd2-naat Start succeeded
Jul 25 09:05:00 localhost CROND[5115]: (root) CMD (
/usr/share/msec/promisc_check.sh)
Jul 25 09:05:00 localhost CROND[5117]: (root) CMD (
/usr/sbin/monitoring.pl)
Jul 25 09:06:00 localhost CROND[5128]: (root) CMD (
/usr/share/msec/promisc_check.sh)
Jul 25 09:07:00 localhost CROND[5132]: (root) CMD (
/usr/share/msec/promisc_check.sh)
Jul 25 09:08:00 localhost CROND[5136]: (root) CMD (
/usr/share/msec/promisc_check.sh)

Although I've added the line
*.debug               -/var/log/debug.log
to /etc/syslog.conf, there is no logging from pam on debug level.

/var/log/messages:
Jul 25 09:04:07 localhost httpd2-naat: httpd2-naat heruntergefahren
succeeded
Jul 25 09:04:07 localhost httpd2-naat: httpd2-naat: Could not determine the
server's fully qualified domain name, using 127.0.0.1 for ServerName
Jul 25 09:04:07 localhost httpd2-naat: httpd2-naat Start succeeded
Jul 25 09:05:00 localhost CROND[5115]: (root) CMD (
/usr/share/msec/promisc_check.sh)
Jul 25 09:05:00 localhost CROND[5117]: (root) CMD (
/usr/sbin/monitoring.pl)
Jul 25 09:06:00 localhost CROND[5128]: (root) CMD (
/usr/share/msec/promisc_check.sh)
Jul 25 09:07:00 localhost CROND[5132]: (root) CMD (
/usr/share/msec/promisc_check.sh)
Jul 25 09:08:00 localhost CROND[5136]: (root) CMD (
/usr/share/msec/promisc_check.sh)

"heruntergefahren succeeded" because I've installed Mandrake 10.1 with
german language support

/var/log/secure:
nothing in connection with my attempt to log in via web interface

/var/log/httpd2-naat/httpd2-naat.error_log:
[Mon Jul 25 09:04:07 2005] [notice] caught SIGTERM, shutting down
[Mon Jul 25 09:04:07 2005] [notice] Digest: generating secret for digest
authentication ...
[Mon Jul 25 09:04:07 2005] [notice] Digest: done
[Mon Jul 25 09:04:07 2005] [notice] Apache-AdvancedExtranetServer/2.0.53
(Mandrakelinux/PREFORK-9mdk) PHP/4.3.10 mod_ssl/2.0.53 OpenSSL/0.9.7e
mod_auth_external/2.2.9 configured -- resuming normal operations
sh: -c: line 3: syntax error: unexpected end of file

/var/log/httpd2-naat/httpd2-naat.ssl_access_log:
192.nnn.n.nnn - - [25/Jul/2005:09:04:45 +0200] "POST /en/login.php HTTP/1.1"
302 -
192.nnn.n.nnn - - [25/Jul/2005:09:04:45 +0200] "GET
/index.php?msg=Wrong%20Login/Password HTTP/1.1" 302 -
192.nnn.n.nnn - - [25/Jul/2005:09:04:45 +0200] "GET
/en/?msg=Wrong%20Login/Password HTTP/1.1" 200 3496
192.nnn.n.nnn - - [25/Jul/2005:09:04:46 +0200] "GET
/en/main.php?msg=Wrong%20Login/Password HTTP/1.1" 200 4370
192.nnn.n.nnn - - [25/Jul/2005:09:04:46 +0200] "GET /lang.php HTTP/1.1" 200
1712

/var/log/httpd2-naat/httpd2-naat.ssl_error_log:
[Mon Jul 25 09:04:07 2005] [warn] RSA server certificate CommonName (CN)
`firetest.test.zzz' does NOT match server name!?
[Mon Jul 25 09:04:07 2005] [warn] RSA server certificate CommonName (CN)
`firetest.test.zzz' does NOT match server name!?

After a "shorewall clear" I have no problems to log in via ssh using admin
and the admin password.

I have not the faintest idea, where's the problem during the log on process.
Have you, in the meantime, installed a MNF2-System?
Are you running in similar problems?

Regards

Stephan


-----Ursprüngliche Nachricht-----
Von: security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected]
[mailto:security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected]]Im Auftrag von florin
Gesendet: Donnerstag, 21. Juli 2005 10:52
An: security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected]
Betreff: Re: [Security Firewall] Re: Problems after installation of
naat-packages from CVS - Needs help


Hi again,

1. ok, your setup seems ok according to your short description and the
apache2 server is up and running.
2. ideas:
2.1 can you login on the firewall using that admin login/passwd using
ssh to make sure that your admin login and password are ok ?
2.2 can you read some more details in the log files concerning your
error message ?
try /var/log/messages, /var/log/syslog/, /var/log/secure and also
/var/log/httpd2-naat/*
I don't remember the exact name of the last log names but you'll find out
:-)

I will also try to setup this here on a mandrake 10.1 x86_64 installed
on qemu and have a better view (because I'm currently working on the
future version with a already up and running mnf2+ and mandriva 10.2
:-) )

cheers,

On 7/20/05, Stephan Eck <[email protected]> wrote:
> Hi Florin,
>
> nice to have heard from you again - and thanks for the hint ;-)
> Ok, I've installed the following MNF2 specific packages and all their
> dependencies:
> naat-frontend-www-doc-0.8-76mdk
> naat-frontend-www-common-0.8-76mdk
> naat-monitoring-0.8-9mdk
> naat-backend-0.8-76mdk
> httpd2-naat-0.8-13mdk
> naat-frontend-www-en-0.8-76mdk
> mnf-en-10.0-16mdk (this file at last with --nodeps because of the missing
> mandrakelinux-mnf-release-file).
> Also I've installed the following mod-packages for apache2:
> apache2-mod_ssl-2.0.53-8mdk
> apache2-mod_php-2.0.53_4.3.10-7mdk
> apache2-modules-2.0.53-9mdk
> apache2-mod_auth_external-2.0.53_2.2.9-6mdk
>
> I've created two certificates (server.crt  server.key) using the
> gentestcrt.sh script in /usr/lib/ssl/apache2-mod_ssl
> copied them to /etc/ssl/apache2 and adjusted the file
> /etc/httpd/conf.d/51_ssl.httpd2-naat-vhost.naat with the following lines:
> SSLCertificateFile /etc/ssl/apache2/server.crt
> SSLCertificateKeyFile /etc/ssl/apache2/server.key
>
> Also I've fixed the symbolic link "extramodules" in /etc/httpd that
> primarily points to nirvana. Now it points to
> extramodules -> ../../usr/lib/apache2-extramodules/.
> This file contains the libraries mod_auth_external.so, mod_php4.so and
> mod_ssl.so.
>
> Here is the result of netstat -an|grep 8443
> tcp        0      0 :::8443                 :::*                    LISTEN
>
> and this is the server-status:
> service httpd2-naat extendedstatus
> Apache Server Status for 127.0.0.1
>
> Server Version: Apache-AdvancedExtranetServer/2.0.53
> (Mandrakelinux/PREFORK-9mdk) mod_auth_external/2.2.9
> mod_ssl/2.0.53 OpenSSL/0.9.7e PHP/4.3.10
> Server Built: Mar 30 2005 12:41:28
>      _________________________________________________________________
>
>    Current Time: Wednesday, 20-Jul-2005 22:08:06 CEST
>    Restart Time: Wednesday, 20-Jul-2005 20:07:11 CEST
>    Parent Server Generation: 0
>    Server uptime: 2 hours 54 seconds
>    Total accesses: 0 - Total Traffic: 0 kB
>    CPU Usage: u0 s0 cu0 cs0
>    0 requests/sec - 0 B/second -
>    1 requests currently being processed, 4 idle workers
>
> After a "shorewall clear" I can reach the logon-screen using
> https://nnn.nnn.n.n:8443.
> But every time I try to log in with user admin and my real simple
> testpassword, I receive the message "Wrong Login/Password".
>
> I hope that with the assistance of my description you can help me to solve
> this problem.
>
> Regards
>
> Stephan
> -----Ursprüngliche Nachricht-----
> Von: security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected]
> [mailto:security-firewall-owner-4qZELD6FgxheH41UXmfQsti2O/[email protected]]Im Auftrag von florin
> Gesendet: Dienstag, 19. Juli 2005 14:45
> An: security-firewall-4qZELD6FgxheH41UXmfQsti2O/[email protected];
> security-firewall-J4tZAbal8pkzaQFa27Lw39BPR1lH4CV8@public.gmane.org
> Cc: Stephan Eck
> Betreff: [Security Firewall] Re: Problems after installation of
> naat-packages from CVS - Needs help
>
>
> Hi Stephan,
>
> please post this kind of message on the mailing list and do not
> address it directly tome. Your increase your changes to get more help.
> I also read the messages on the ML, you know :-)
>
> First, you should know that you don't need to install everything from the
> CVS.
> You don't need, for example:
> - httpd-naat (but only httpd2-naat)
> - naat-backend-devel
> - naat-frontend-www-devel
> - naat-frontend-www-doc
>
> I'm not sure I understand. Do you get the login screen through the web
> mnf2 interface ?
> If not, you seem to have a problem running the httpd2-naat script
> after running the service httpd2-naat restart command do you see the
> 8443 port in netstat -an |grep 8443 ? also, what do you get with
> service httpd2-naat status ?
>
> If yes, did you install the mod-auth-external package for apache 2 ?
> This package deals with the authentication ...
>
> that's all for now,
>
> cheers,
>
> On 7/17/05, Stephan Eck <[email protected]> wrote:
> > Hi Florin,
> >
> > I've tried to install MNF2 using the MNF2 specific naat-files from CVS
and
> a
> > Mandrake 10.1 basic installation doing the following steps:
> > 1. Download the MNF2 specific source code from CVS in my home directory
> > /home/user/src with
> >         export CVS_RSH=ssh
> >         export CVSROOT=:ext:[email protected]:/cooker
> >         cvs co firewall2
> > 2. Built the rpm specific build tree (i.e. BUILD, SOURCES, SPECS, RPMS,
> > SRPMS)in my home directory under the directory rpm.
> > 3. Created the file .rpmmacros in my home directory with %_topdir
> > /home/user/rpm
> > 4. Running make rpm (make rpm2 for httpd2-naat) in every source
directory
> > ending with following files:
> >         httpd2-naat-0.8-13mdk.noarch.rpm
> >         httpd-naat-0.8-13mdk.noarch.rpm
> >         mnf-en-10.0-16mdk.noarch.rpm
> >         naat-backend-0.8-76mdk.i586.rpm
> >         naat-backend-devel-0.8-76mdk.i586.rpm
> >         naat-frontend-www-common-0.8-76mdk.noarch.rpm
> >         naat-frontend-www-devel-0.8-76mdk.noarch.rpm
> >         naat-frontend-www-doc-0.8-76mdk.noarch.rpm
> >         naat-frontend-www-en-0.8-76mdk.noarch.rpm
> >         naat-monitoring-0.8-9mdk.noarch.rpm
> > 5. I did a basic installation of Mandrake 10.1 and a subsequent
> installation
> > of the MNF2 specific rpms and all their dependencies
> >         using the instruction from www.flexbeta.net and the slightly
> outdated but
> > very detailed description from amaury.
> >
> > Everything went fine. After a "shorewall clear" I could access the
machine
> > using ssh and my admin password which contains
> > no special characters.
> >
> > But (of course there is a but) I can't access the machine using the web
> > frontend.
> > I've tried it from a WIN and a Linux Machine but every time I get a
"wrong
> > account/password" message.
> >
> > I don't know enough about the logon mechanism to figure out what's going
> > wrong.
> >
> > I've found something strange in the
> > /var/log/httpd2-naat/httpd2-naat.error_log file
> >
> > After a "service httpd2-naat restart" I can find the following lines:
> > [Sun Jul 17 15:46:35 2005] [notice] caught SIGTERM, shutting down
> > [Sun Jul 17 15:46:35 2005] [notice] Digest: generating secret for digest
> > authentication ...
> > [Sun Jul 17 15:46:35 2005] [notice] Digest: done
> > [Sun Jul 17 15:46:35 2005] [notice] Apache-AdvancedExtranetServer/2.0.53
> > (Mandrakelinux/PREFORK-9mdk) PHP/4.3.10 mod_ssl/2.0.5
> > 3 OpenSSL/0.9.7e configured -- resuming normal operations
> >
> > so everything seems to be ok, but every time I try to logon via the web
> > interface there appears the following message in the
> > httpd2-naat.error_log file.
> >
> > sh: -c: line 3: syntax error: unexpected end of file
> > sh: -c: line 3: syntax error: unexpected end of file
> > looks like that there is a shell script broken.
> >
> > I hope, with your guidance, I can solve the problem.
> >
> > Regards
> >
> > Stephan
> >
> >
> >
>
>
> --
> Florin
>
>
>
>
>
>
> ____________________________________________________
> Want to buy your Pack or Services from Mandriva?
> Go to http://store.mandriva.com
> Join the Club : http://www.mandrivaclub.com
> ____________________________________________________
>
>
>


--
Florin

____________________________________________________
Want to buy your Pack or Services from Mandriva? 
Go to http://store.mandriva.com
Join the Club : http://www.mandrivaclub.com
____________________________________________________