Re: NoCat redirects its own requests to the auth service

I don't mean to be a nag, but does anyone have any thoughts on the following?


On Tuesday 01 February 2005 11:17, Philip Dowie wrote:
> todays log.
>
> [2005-02-01 10:40:36] Spawning child process 32402.
> [2005-02-01 10:40:37] Connection to 10.10.4.1 from 10.10.4.12
> [2005-02-01 10:40:37] Capturing  10.10.4.12  for
> http://www.suse.de/cgi-bin/ suseservers.cgi?product=SUSE%
> 20LINUX&version=9.2&basearch=i386&arch=i686&lang=de&business=0&check=1&dist
>product=SUSE-LINUX-FTP-i386-9.2-0&yast2-online-update=2.10.3-2.1&yast2-packa
>gemanager=2.10.18-2.1&liby2util=2.10.6-2.1&timezone=NZ [2005-02-01 10:40:37]
> Notifying parent of Capture on peer 00:02:3F:37:38:CB [2005-02-01 10:40:37]
> Got notification Capture of peer 00:02:3F:37:38:CB [2005-02-01 10:40:37]
> Child process returned 1
> [2005-02-01 10:42:11] Spawning child process 32405.
> [2005-02-01 10:42:11] Connection to 10.10.4.1 from 10.10.4.12
> [2005-02-01 10:42:11] Capturing  10.10.4.12  for
> http://www.novell.com/linux/ [2005-02-01 10:42:11] Notifying parent of
> Capture on peer 00:02:3F:37:38:CB [2005-02-01 10:42:11] Got notification
> Capture of peer 00:02:3F:37:38:CB [2005-02-01 10:42:11] Child process
> returned 1
> [2005-02-01 10:49:08] Gateway running on port 5280.
> [2005-02-01 10:49:32] Spawning child process 32501.
> [2005-02-01 10:49:32] Connection to 10.10.4.1 from 10.10.4.12
> [2005-02-01 10:49:32] Capturing  10.10.4.12  for http://google.co.nz/
> [2005-02-01 10:49:32] Notifying parent of Capture on peer 00:02:3F:37:38:CB
> [2005-02-01 10:49:32] Got notification Capture of peer 00:02:3F:37:38:CB
> [2005-02-01 10:49:32] Child process returned 1
>
>
>
> the gateway
>
> b040a12eb7b0623fec8d7508063cf940  /usr/local/nocat/pgp/pubring.gpg
> 09ef447e45aee3f4f38dfa1bc72e084e  /usr/local/nocat/pgp/random_seed
> 5759db00ef0d9f4257364fce926c1a00  /usr/local/nocat/pgp/secring.gpg
> 9320f28ef138d04542879f42f22c362a  /usr/local/nocat/pgp/trustedkeys.gpg
>
> -rw-r--r--    1 www-data root         1816 Jan 13 12:41 pubring.gpg
> -rw-------    1 www-data root          600 Jan 13 12:41 random_seed
> -rw-------    1 www-data root         2579 Jan 13 12:41 secring.gpg
> -rw-r--r--    1 www-data root          557 Jan 18 10:40 trustedkeys.gpg
>
>
> the auth server
>
> 65d4ef28a883d471388e73f5a34db764  /usr/local/nocat/pgp/pubring.gpg
> a5da6ddcfce4c2c241f2e5179ec6001d  /usr/local/nocat/pgp/random_seed
> 35a37eefda4786e8ab10eed22f4620bd  /usr/local/nocat/pgp/secring.gpg
> 3cb6ef67d4a7177a05b983f7a26bed8b  /usr/local/nocat/pgp/trustdb.gpg
> 9320f28ef138d04542879f42f22c362a  /usr/local/nocat/pgp/trustedkeys.gpg
>
> -rw-------    1 wwwrun   nogroup       931 2005-01-19 10:34 pubring.gpg
> -rw-------    1 wwwrun   nogroup       600 2005-02-01 10:49 random_seed
> -rw-------    1 wwwrun   nogroup       992 2005-01-19 10:34 secring.gpg
> -rw-------    1 wwwrun   nogroup      1240 2005-01-19 10:34 trustdb.gpg
> -rw-r--r--    1 wwwrun   nogroup       557 2005-01-19 10:32 trustedkeys.gpg
>
>
>
> as mentioned, the AP is a piece of crossover cable., the SSL certificates
> are Self signed until I can get the system working, where upon those in
> charge will fork out for proper certificates.
>
>
> today's error is the 404 for the cgi-bin,
> the requested URL, /cgi-bin/5; URL=http://10.10.4.1:5280/ was not found,
> error from the auth server, (not the gateway).  I get this error if I click
> on the link instead of waiting.   if I wait, I get back to the login page.
>
>
>
>
> httpd configuration on auth server:
>
> <VirtualHost *:443>
>  Include /usr/local/nocat/httpd.conf
>  ServerName auth.wireless.computerlink.co.nz
>  SSLEngine on
>  SSLcertificateKeyFile /etc/httpd/ssl.key/motzart.key
>  SSLCertificateFile /etc/httpd/ssl.crt/motzart.crt
>  SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:
> +eNULL
>  DocumentRoot /usr/local/nocat/htdocs
> </VirtualHost>
>
>
> nocat/httpd.conf on auth server is unchanged from source.
>
>
>
> nocat.conf on gateway
>
> Verbosity       10
> GatewayName     the NoCat Network
> GatewayMode     Passive
> GatewayLog      /usr/local/nocat/nocat.log
> LoginTimeout    600
> HomePage        http://nocat.net/
> DocumentRoot    /usr/local/nocat/htdocs
> SplashForm      splash.html
> StatusForm      status.html
> TrustedGroups Any
> AuthServiceAddr auth.wireless.computerlink.co.nz
> AuthServiceURL  https://$AuthServiceAddr/cgi-bin/login
> LogoutURL       https://$AuthServiceAddr/logout.html
> ExcludePorts    25
>
>
>
> nocat.conf on auth server
>
> Verbosity       10
> HomePage        http://nocat.net/
> DocumentRoot    /usr/local/nocat/htdocs
> DataSource      Passwd
> UserFile            /usr/local/nocat/etc/passwd
> GroupUserFile       /usr/local/nocat/etc/group
> GroupAdminFile    /usr/local/nocat/etc/groupadm
> MinPasswdLength 6
> LoginForm       login.html
> LoginOKForm     login_ok.html
> FatalForm       fatal.html
> ExpiredForm     expired.html
> RenewForm       renew.html
> PassiveRenewForm renew_pasv.html
> RegisterForm    register.html
> RegisterOKForm  register_ok.html
> RegisterFields  name url description
> UpdateForm      update.html
> UpdateFields    url description
> LoginGreeting   Greetings! Welcome to the NoCat Network.
> LoginMissing    Please fill in all fields!
> LoginBadUser    That e-mail address is unknown. Please try again.
> LoginBadPass    That e-mail and password do not match. Please try again.
> LoginBadStatus  Sorry, you are not a registered co-op member.
> RegisterGreeting    Welcome! Please enter the following information to
> register.
> RegisterMissing     Name, E-mail, and password fields must be filled in.
> RegisterUserExists  Sorry, that e-mail address is already taken. Are you
> already registered?
> RegisterBadUser     The e-mail address provided appears to be invalid. Did
> you spell it correctly?
> RegisterInvalidPass All passwords must be at least six characters long.
> RegisterPassNoMatch The passwords you provided do not match. Please try
> again. RegisterSuccess     Congratulations, you have successfully
> registered. UpdateGreeting      Enter your E-mail and password to update
> your info. UpdateBadUser       That e-mail address is unknown. Please try
> again. UpdateBadPass       That e-mail and password do not match. Please
> try again. UpdateInvalidPass   New passwords must be at least six
> characters long. UpdatePassNoMatch   The new passwords you provided do not
> match. Please try again.
> UpdateSuccess       Congratulations, you have successfully updated your
> account.
>
>
>
>
> if I try, to visit the login page direct from the client, without it being
> a redirect, the auth server says the mac address is undefined, which I
> presume has something to do with the way the system communicates such
> things.
>
>
>
>
> network topology:
>
>
> (internet)
>   ^
>
>   v
> router
>   ^
>
>   |--> auth server
>
>   v
> gateway
>   ^
>
>   v
> clients (private subnet)
>
>
> router, auth server and gateway all share a publicly addressed subnet, the
> router has 2 public ip addresses, the gateway has a public ip address and a
> private ip address.
>
>
>
>
>
> Phil
>
> On Friday 28 January 2005 07:11, you wrote:
> > a snip of nocat.log would be helpful...
> >
> >
> > ----- Original Message -----
> > From: "Philip Dowie" <[email protected]>
> > To: <[email protected]>
> > Sent: Thursday, January 27, 2005 1:05 PM
> > Subject: Re: [NoCat] NoCat redirects its own requests to the auth service
> >
> > > my AP is a piece of crossover at the minute.
> > >
> > > :)
> > >
> > > On Friday 28 January 2005 02:46, Scott Tully wrote:
> > > > Sounds like your AP is not configured correctly.  Hopefully something
> > > > i say will be helpful ;-)
> > > >
> > > > What's probably occurring is the AP is sending it's own IP/MAC
> > > > address to nocat and not alowing the IP/MAC of the client to
> > > > passthru.  This results in the wrong iptable rule being written with
> > > > an ip/mac combination that doesn't match your clients... resulting in
> > > > the infamous login loop.   Is your client nat'ed behind the ap
> > > > somehow? Setup dhcpd on your nocat gateway, and turn it off on the
> > > > ap.  Your ap should be acting more like a wireless hub or switch...
> > > > this might mean putting it in bridge mode.  If it's a router, don't
> > > > use the WAN port.
> > > >
> > > > Hope this helps...
> > > >
> > > > Scott
> > > >
> > > >
> > > >
> > > >
> > > > ----- Original Message -----
> > > > From: "Philip Dowie" <[email protected]>
> > > > To: <[email protected]>
> > > > Sent: Wednesday, January 26, 2005 8:32 PM
> > > > Subject: [NoCat] NoCat redirects its own requests to the auth service
> > > >
> > > > > I have a couple of strange events happening:
> > > > >
> > > > > 1) my NoCat installation just goes in a continual loop of
> > > > > redirecting any request[to itself - I log in, attempt to go
> > > > > somewhere, and it asks me to log in again.
> > > > >
> > > > >
> > > > > 2)  If I tell it that it is not to capture requests to my auth
> > > > > service, then I get 404 errors to the tune of
> > > > > http://<auth>/;cgi-bin/5;url=<url>   not found, etc..
> > > > >
> > > > >
> > > > >
> > > > > NoCat gateway is running on a public/private ip combination,
> > > > > NoCatAuth server is running on a public IP in the same (public)
> > > > > subnet as the gateway.
> > > > >
> > > > > I'm using Self Signed SSL certificates until I get the system
> > > > > working, when we will upgrade to proper certificated.
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > Any tips or pointers for me?
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > Regards
> > > > >
> > > > > Phil
> > > > >
> > > > > _______________________________________________
> > > > > NoCat mailing list
> > > > > [email protected]
> > > > > http://lists.nocat.net/mailman/listinfo/nocat
> > >
> > > _______________________________________________
> > > NoCat mailing list
> > > [email protected]
> > > http://lists.nocat.net/mailman/listinfo/nocat
>
> _______________________________________________
> NoCat mailing list
> [email protected]
> http://lists.nocat.net/mailman/listinfo/nocat