Endless Login

Hi All,

I'm new to this list so please forgive me if this issue has been addressed
before. I googled high and low but couldn't find a solution.

Anyway I've got the NoCat gateway and auth service setup on my box with the
gateway set to passive mode. I've got a desktop pc plugged into the public
interface with a crossover cable for testing purposes at the moment. I can
login and the keep-alive popup opens but it doesn't redirect at all.

What happens is after 5 seconds it tries to redirect to
https://192.168.0.254/cgi-bin/5;%20URL=http://192.168.0.254:5280/?ticket=owG
bwMvMwCQ42%2f732jOh1z4wnj7AncTgtH%2flp6DUlMyi1OQSzoySkgIrff3y8nK93Mzkovzi%2f
LQSveT8XP3M4sSCTP0ikDq9lJwc%2b4KiFNvMVLWCstQiWzO1xCLb3OK8jPzcVC7fxGROAwMrYwM
rQycrJ1MrJ0crSzMux%2bSSzPw8zoDUotzMEq7Q4tQiztzEkhIHEKGXlwrEVVy%2b%2bSmpnDn56
Zl5XCGZuan5pSWcxgYGXCH52al5nCqGKqaGRqYWBhYGKqUFpcnORr4pkVle%2fmF5FvkB4a7JBQZ
cHfbMrGDfwPwnyNT9lWGujBfTU%2bFra%2fhNdsmtnewrHGA54%2fgyhnnKKfKy36w3fH4xY7rvh
s28jF%2fVQ7cBAA%3d%3d%3dcKv%2f which of course generates a 404 error. If we
remove the preceding https://192.168.0.254/cgi-bin/5;%20URL= I end up at the
login page.

This is using apache2, NoCatAuth-0.82, gnupg-1.4.1 on Gentoo 2005.0 and the
client is IE6.0 on WinXP SP2

Any ideas?

I wasn't sure what logs and config files would be helpful so below is the
gateway nocat.conf, the auth nocat.conf, my apache configs and logs as well
as the nocat logs.

Also the public interface is called public and is 192.168.0.0/24, the
private interface is called inet and is 192.168.1.0/24

One thing to note is that I was getting a lot of errors related to NetMask
in the apache error logs from line 77 of AuthService.pm but changing line 11
of AuthService.pm to the following seemed to fix that
GatewayPort NotifyTimeout LoginTimeout RenewTimeout HomePage LocalNetwork


I think I've posted as much detail as I can but will provide whatever else
is asked for.

Thanks in advance for any help you may be able to provide.

Matt Courtney

--->Gateway nocat.conf
======================
###### gateway.conf -- NoCatAuth Gateway Configuration.
#
# Format of this file is: <Directive> <Value>, one per
#   line. Trailing and leading whitespace is ignored. Any
#   line beginning with a punctuation character is assumed to
#   be a comment.

###### General settings.
#
# See the bottom of this file for options for logging to syslog.
#
# Log verbosity -- 0 is (almost) no logging. 10 is log
#   everything. 5 is probably a safe middle road.
#
Verbosity       10

##### Gateway application settings.
#
# GatewayName -- The name of this gateway, to be optionally displayed
#   on the splash and status pages. Any short string of text will do.
#
GatewayName     Hotlink Internet Gateway

##
#
# GatewayMode -- Determines the mode of operation of the gateway. Possible
#   values are:
#
#   Captive     - Allow authentication against an auth service. LEGACY.
#   Passive     - Like Captive, but YOU MUST USE THIS if your gateway
#                   is behind a NAT. Will work anyway if not. *RECOMMENDED*.
#   Open        - Simply require a user to view a splash page and accept
#                   a use agreement.
#
# If Captive or Passive Mode is set, you will need to have values set for
#   AuthServiceAddr, AuthServiceURL, and LogoutURL. You will want to leave a
#   short value for LoginTimeout (probably <600).
#
# If Open Mode is set, you will need to have values set for SplashForm,
#   HomePage, and possibly DocumentRoot (or provide an absolute path for
#   SplashForm).  Also, you will want to set a large value for LoginTimeout
#   (probably >3600).
#
GatewayMode     Passive

##
# GatewayLog -- Optional.  If unset, messages will go to STDERR.
#
GatewayLog      /usr/local/nocat/gw/nocat.log

##
# LoginTimeout - Number of seconds after a client's last
#   login/renewal to terminate their connection. Probably
#   don't want to set this to less than 60 or a lot of
#   bandwidth is likely to get consumed by the client's
#   renewal attempts. Defaults to 300 seconds.
#
# For Captive Mode, you want to set this to something
#   fairly short (like 10 minutes) to prevent connection
#   spoofing.
#
 LoginTimeout   300

###### Active/Passive Portal settings.
#
##
# TrustedGroups - A list of groups registered with the auth server
#   that a user may claim membership in order to gain Member-class
#   access through this portal. The default magic value "Any" indicates
#   that a member of *any* group is granted member-class access from
#   this gateway.
#
# TrustedGroups NoCat NYCWireless PersonalTelco
#
TrustedGroups Any

##
# Owners - Optional.  List all local "owner" class users here, separated
#   by spaces.  Owners typically get full bandwidth, and unrestricted
#   access to all network resources.
#
# Owners [email protected] [email protected]

##
# AuthServiceAddr - Required, for captive mode. Must be set to the address
of
#   your authentication service. You must use an IP address
#   if DNS resolution isn't available at gateway startup.
#
# AuthServiceAddr 208.201.239.21
#
AuthServiceAddr 192.168.0.254

##
# AuthServiceURL - HTTPS URL to the login script at the authservice.
#
AuthServiceURL  https://$AuthServiceAddr/cgi-bin/login

##
# LogoutURL - HTTP URL to redirect user after logout.
#
LogoutURL       https://$AuthServiceAddr/logout.html

### Network Topology
#
# ExternalDevice - Required if and only if NoCatAuth can't figure it out
#   from looking at your routing tables and picking the interface
#   that carries the default route. Must be set to the interface
#   connected to the Internet. Usually 'eth0' or 'eth1'
#   under Linux, or maybe even 'ppp0' if you're running
#   PPP or PPPoE.
#
ExternalDevice  inet

##
# InternalDevice - Required if and only if you have ethernet devices
#   on your gateway besides your wireless device and your 'Net connection.
#   Must be set to the interface connected to your local network, normally
#   your wireless card. In Linux, some wireless devices are named 'wvlan0'
#   or 'wlan0' rather than 'ethX'.
#
InternalDevice  public

##
# LocalNetwork - Required if and only if NoCatAuth can't figure out
#   the network address of your local (probably wireless) network,
#   given your InternalDevice(s). Must be set to the network
#   address and net mask of your internal network. You
#   can use the number of bits in the netmask (e.g. /16, /24, etc.)
#   or the full x.x.x.x specification.
#
LocalNetwork    192.168.0.0/255.255.255.0

##
# DNSAddr - Optional. *If* you choose not to run DNS on your internal
network,
#   specify the address(es) of one or more domain name server on the
Internet
#   that wireless clients can use to get out. Should be the same DNS that
your
#   DHCP server hands out. If left blank, NoCatAuth will presume that you
#   want to use whatever nameservers are listed in /etc/resolv.conf.
#
DNSAddr 192.168.0.254

##
# AllowedWebHosts - Optional.  List any domains that you would like to
#   allow web access (TCP port 80 and 443) BEFORE logging in (this is the
#   pre-'skip' stage, so be careful about what you allow.)
#
 AllowedWebHosts        hotlink.net.nz

##
# RouteOnly - Required only if you DO NOT want your gateway to act as a NAT.
#   Uncomment this only if you're running a strictly routed network, and
#   don't need the gateway to enable NAT for you.
#
# RouteOnly     1

##
# IgnoreMAC - Set this if and only if the NoCat gateway isn't directly
#   connected (or bridged at Layer 2) to your internal (usually wireless)
#   network. In that event, the gateway won't be able to match clients based
#   on MAC address, and will fall back to using IPs only. This is
#   theoretically less secure, as IP addresses are usually easier to spoof
#   than MAC addresses, so don't use this unless you know what you're doing.
#
# IgnoreMAC     1

##
# MembersOnly - Optional.  Uncomment this if you want to disable public
#   access (i.e. unauthenticated 'skip' button access).  You'll also want to
#   point AuthServiceURL somewhere that doesn't include a skip button (like
#   at your own Auth server.)
#
 MembersOnly    1

##
# IncludePorts - Optional.  Specify TCP ports to allow access to when
#   public class users login.  All others will be denied.
#
#   For a list of common services and their respective port numbers, see
#   your /etc/services file. Depending on your firewall, you might even
#   be able to specify said services here, instead of using port numbers.
#
# IncludePorts    22 80 443

##
# ExcludePorts - Optional.  Specify TCP ports to denied access to when
#   public class users login.  All others will be allowed.
#
#   Note that you should use either IncludePorts or ExcludePorts, but not
#   both.  If neither is specified, access is granted to all ports to
#   public class users.
#
#   You should *always* exclude port 25, unless you want to run an portal
#   for wanton spam sending. Users should have their own way of sending
#   mail. It sucks, but that's the way it is. Comment this out *only if*
#   you're using IncludePorts instead.
#
# ExcludePorts 23 25 111
#
#ExcludePorts    25

####### Syslog Options -- alter these only if you want NoCat to log to the
#        system log!
#
# Log Facility - syslog or internal.  Internal sends log messages
#    using the GatewayLog or STDERR if GatewayLog is unset.  Syslog
#    sends all messages to the system log.
#
# LogFacility   internal

##
# SyslogSocket - inet or unix.  Inet connects to an inet socket returned
#    by getsrvbyname().  Unix connects to a unix domain socket returned by
#    _PATH_LOG in syslog.ph (typically /dev/log).  Defaults to unix.
#
# SyslogSocket unix

##
# SyslogOptions - Zero or more of the words pid, ndelay, cons, nowait
#    Defaults to "cons,pid".
#
# SyslogOptions cons,pid

##
# SyslogPriority - The syslog class of message to use:  In decreasing
importance,
#    the typical priorities are EMERG, ALERT, CRIT, ERR, WARNING, NOTICE,
INFO,
#    and DEBUG.  Defaults to INFO.
#
# SyslogPriority INFO

##
# SyslogFacility - The facility used to log messages.  Defaults to user.
# SyslogFacility user

##
# SyslogIdent - The ident of the program that is calling syslog.  This will
#    be prepended to every log entry made by NoCat.  Defaults to NoCat.
# SyslogFacility - The facility used to log messages.  Defaults to user.
# SyslogFacility user

##
# SyslogIdent - The ident of the program that is calling syslog.  This will
#    be prepended to every log entry made by NoCat.  Defaults to NoCat.
#
# SyslogIdent NoCat

###### Other Common Gateway Options. (stuff you probably won't have to
change)
#
# ResetCmd, PermitCmd, DenyCmd -- Shell commands to reset,
#   open and close the firewall. You probably don't need to
#   change these.
#
# ResetCmd      initialize.fw
# PermitCmd     access.fw permit $MAC $IP $Class
# DenyCmd       access.fw deny $MAC $IP $Class

##
# GatewayPort - The TCP port to bind the gateway
#   service to. 5280 is de-facto standard for NoCatAuth.
#   Change this only if you absolutely need to.
#
# GatewayPort     5280

##
# PGPKeyPath -- The directory in which PGP keys are stored.
#   NoCat tries to find this in the pgp/ directory above
#   the bin/ parent directory. Set this only if you put it
#   somewhere that NoCat doesn't expect.
#
# PGPKeyPath    /usr/local/nocat/gw/pgp

##
# MessageVerify -- Shell command to verify a PGP signed
#   message. The actual message is delivered to the
#   command's standard input. NoCat tries to find gpg
#   and gpgv in your path. Set these only if you need to find
#   them elsewhere.
#
# GpgvPath      /usr/bin/gpgv
#
# MessageVerify $GpgvPath --homedir=$PGPKeyPath 2>/dev/null

##
#
# IdleTimeout -- How often to check the ARP cache, in seconds,
#   for expiration of idle clients.
#
# MaxMissedARP -- How many times a client can be missing from
#   the ARP cache before we assume they've gone away, and log them
#   out. Set to 0 to disable logout based on ARP cache expiration.
#
# MaxMissedARP  2
#
# IdleTimeout   300

### Fin!

--->Gateway nocat.log
=====================

[2005-06-27 18:49:35] Gateway running on port 5280.
[2005-06-27 18:50:14] Spawning child process 12308.
[2005-06-27 18:50:14] Connection to 192.168.0.254 from 192.168.0.199
[2005-06-27 18:50:14] Capturing  192.168.0.199  for
http://www.thinkgeek.com/
[2005-06-27 18:50:14] Notifying parent of Capture on peer 00:30:1B:B5:BA:96
[2005-06-27 18:50:14] Got notification Capture of peer 00:30:1B:B5:BA:96
[2005-06-27 18:50:14] Child process returned 1
 [2005-06-27 18:50:54] Received notify from 192.168.0.199
[2005-06-27 18:50:54] gpg --decrypt --homedir=/usr/local/nocat/gw/bin/../pgp
--keyring trustedkeys.gpg --no-tty -o- returned error message:
gpg: WARNING: unsafe permissions on homedir `/usr/local/nocat/gw/bin/../pgp'
gpg: Signature made Mon Jun 27 18:50:48 2005 NZST using DSA key ID CC55D6F0
gpg: Good signature from "Hotlink <[email protected]>"
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the
owner.
Primary key fingerprint: 7346 B99F 3E95 CEB8 5167  1EB0 9B3F FBAD CC55 D6F0
[2005-06-27 18:50:54] Got auth msg:
Redirect        http://www.thinkgeek.com/
Mac     00:30:1B:B5:BA:96
Action  Permit
User    [email protected]
Mode    login
Timeout 300
Token   $1$95412277$CqZ0/m6sob9NSdA6PxzuN1
[2005-06-27 18:50:54] User () v. trusted (Any)
[2005-06-27 18:50:54] User  [email protected]  permitted in class
Public
[2005-06-27 18:50:54] Notifying parent of Permit on peer 00:30:1B:B5:BA:96
[2005-06-27 18:50:54] Available MACs: 00:30:1B:B5:BA:96
[2005-06-27 18:50:54] Got notification Permit of peer 00:30:1B:B5:BA:96
[2005-06-27 18:50:54] Child process returned 1
[2005-06-27 18:50:54] Spawning child process 12503.
[2005-06-27 18:50:54] Connection to 192.168.0.254 from 192.168.0.199
[2005-06-27 18:50:54] Capturing  192.168.0.199  for
http://www.thinkgeek.com/
[2005-06-27 18:50:54] Notifying parent of Capture on peer 00:30:1B:B5:BA:96
[2005-06-27 18:50:54] Got notification Capture of peer 00:30:1B:B5:BA:96
[2005-06-27 18:50:54] Child process returned 1

--->NoCat auth nocat.conf
=========================

###### authserv.conf -- NoCatAuth Authentication Service Configuration.
#
# Format of this file is: <Directive> <Value>, one per
#   line. Trailing and leading whitespace is ignored. Any
#   line beginning with a punctuation character is assumed to
#   be a comment.

###### General settings.
#
# Log verbosity -- 0 is (almost) no logging. 10 is log
#   everything. 5 is probably a safe middle road.
#
Verbosity       10

##
# PGPKeyPath -- The directory in which PGP keys are stored.
#   NoCat tries to find this in the pgp/ directory above
#   the bin/ parent directory. Set this only if you put it
#   somewhere that NoCat doesn't expect.
#
 PGPKeyPath     /usr/local/nocat/authserv/pgp


###### Authservice-specific settings.
#
# HomePage -- The authservice's notion of a default
#   redirect.
#
HomePage        http://www.hotlink.net.nz/

# DocumentRoot -- Where all of the application templates (including
#   SplashPage) are hiding. Can be different from Apache's DocumentRoot.
#
DocumentRoot    /usr/local/nocat/authserv/htdocs

##### Authservice authentication source.
#
# DataSource -- specifies what to authenticate against.
#   Possible values are DBI, Passwd, LDAP, RADIUS, PAM, Samba, IMAP, NIS.
#
DataSource      DBI

##
# Auth service database settings.
#
# If you select DataSource DBI, then Database, DB_User, and DB_Password
#   are required.
#
# Database is a DBI-style data source specification.
#
# For postgres support:
# Database      dbi:Pg:dbname=nocat
#
# For mysql support:
Database        dbi:mysql:database=nocat;host=localhost
DB_User         root
DB_Passwd       mgehladmin

###### Auth service user table settings.
#
# UserTable names the table containing the user ID data.
#
# UserIDField names the column containing the ID that the
#    client uses to uniquely identifying themselves, i.e. their
#    e-mail address or username.
#
# UserPasswdField stores the user's MD5-hashed password.
#
# UserAuthField is deprecated and will go away.
#
UserTable       member
UserIDField     login
UserPasswdField pass
UserAuthField   status
UserStampField  created

GroupTable      network
GroupIDField    network
GroupAdminField admin

####### Auth service web application settings.
#
# MinPasswdLength -- Enforced minimum user password length.
#   Not much other checking is done on the user's p/w.
#
MinPasswdLength 6

# MessageSign -- shell command to sign an auth notification
#   with. The message to be signed is written to the
#   command's standard in, and the signed message is read
#   from standard out.
#
# GpgPath       /usr/bin/gpg
#
# MessageSign   $GpgPath --clearsign --homedir=$PGPKeyPath -o-

# LocalGateway -- If you run auth service on the same subnet
#   (or host) as the gateway you need to specify the hostname
#   of the gateway. Otherwise omit it.  (Requires Net::Netmask)
#
 LocalGateway    192.168.0.254
 LocalNetwork    192.168.0.0/255.255.255.0

# Auth service template names. See the individual templates
#   for details on what each one does.
#
LoginForm       login.html
LoginOKForm     login_ok.html
FatalForm       fatal.html
ExpiredForm     expired.html
RenewForm       renew.html
PassiveRenewForm renew_pasv.html

RegisterForm    register.html
RegisterOKForm  register_ok.html
RegisterFields  name url description

UpdateForm      update.html
MinPasswdLength 6

# MessageSign -- shell command to sign an auth notification
#   with. The message to be signed is written to the
#   command's standard in, and the signed message is read
#   from standard out.
#
# GpgPath       /usr/bin/gpg
#
# MessageSign   $GpgPath --clearsign --homedir=$PGPKeyPath -o-

# LocalGateway -- If you run auth service on the same subnet
#   (or host) as the gateway you need to specify the hostname
#   of the gateway. Otherwise omit it.  (Requires Net::Netmask)
#
 LocalGateway    192.168.0.254
 LocalNetwork    192.168.0.0/255.255.255.0

# Auth service template names. See the individual templates
#   for details on what each one does.
#
LoginForm       login.html
LoginOKForm     login_ok.html
FatalForm       fatal.html
ExpiredForm     expired.html
RenewForm       renew.html
PassiveRenewForm renew_pasv.html

RegisterForm    register.html
RegisterOKForm  register_ok.html
RegisterFields  name url description

UpdateForm      update.html
UpdateFields    url description

###### Auth service user messages. Should be self-explanatory.
#
LoginGreeting   Greetings! Welcome to the NoCat Network.
LoginMissing    Please fill in all fields!
LoginBadUser    That e-mail address is unknown. Please try again.
LoginBadPass    That e-mail and password do not match. Please try again.
LoginBadStatus  Sorry, you are not a registered co-op member.

RegisterGreeting    Welcome! Please enter the following information to
register.
RegisterMissing     Name, E-mail, and password fields must be filled in.
RegisterUserExists  Sorry, that e-mail address is already taken. Are you
already registered?
RegisterBadUser     The e-mail address provided appears to be invalid. Did
you spell it correctly?
RegisterInvalidPass All passwords must be at least six characters long.
RegisterPassNoMatch The passwords you provided do not match. Please try
again.
RegisterSuccess     Congratulations, you have successfully registered.

UpdateGreeting      Enter your E-mail and password to update your info.
UpdateBadUser       That e-mail address is unknown. Please try again.
UpdateBadPass       That e-mail and password do not match. Please try again.
UpdateInvalidPass   New passwords must be at least six characters long.
UpdatePassNoMatch   The new passwords you provided do not match. Please try
again.
UpdateSuccess       Congratulations, you have successfully updated your
account.

###### Fin.

--->apache2.conf
================

### /etc/apache2/conf/apache2.conf
### $Id: apache2.conf,v 1.1 2004/03/22 21:17:57 stuart Exp $
###
### Main Configuration Section
### You really shouldn't change these settings unless you're a guru
###
ServerRoot /usr/lib/apache2
ServerName gateway.hotlink.net.nz
#LockFile /etc/apache2/apache2.lock
PidFile /var/run/apache2.pid
ErrorLog logs/error_log
LogLevel warn
#DocumentRoot /var/www/localhost/htdocs
#DocumentRoot /usr/local/nocat/authserv/htdocs

### Dynamic Shared Object (DSO) Support
###
### You should always leave these three, as they are needed for normal use.
### mod_access (Order, Allow, etc..)
### mod_log_config (Transferlog, etc..)
### mod_mime (AddType, etc...)
###
LoadModule access_module                 modules/mod_access.so
#LoadModule auth_module                   modules/mod_auth.so
#LoadModule auth_anon_module              modules/mod_auth_anon.so
#LoadModule auth_dbm_module               modules/mod_auth_dbm.so
#LoadModule auth_digest_module            modules/mod_auth_digest.so
#LoadModule include_module                modules/mod_include.so
LoadModule log_config_module             modules/mod_log_config.so
LoadModule env_module                    modules/mod_env.so
LoadModule mime_magic_module             modules/mod_mime_magic.so
LoadModule cern_meta_module              modules/mod_cern_meta.so
LoadModule expires_module                modules/mod_expires.so
LoadModule headers_module                modules/mod_headers.so
LoadModule usertrack_module              modules/mod_usertrack.so
#LoadModule unique_id_module              modules/mod_unique_id.so
LoadModule setenvif_module               modules/mod_setenvif.so
#LoadModule proxy_module                  modules/mod_proxy.so
#LoadModule proxy_connect_module          modules/mod_proxy_connect.so
#LoadModule proxy_ftp_module              modules/mod_proxy_ftp.so
#LoadModule proxy_http_module            modules/mod_proxy_http.so
LoadModule mime_module                   modules/mod_mime.so
#LoadModule status_module                 modules/mod_status.so
#LoadModule autoindex_module              modules/mod_autoindex.so
LoadModule asis_module                   modules/mod_asis.so
#LoadModule info_module                   modules/mod_info.so
LoadModule cgi_module                    modules/mod_cgi.so
LoadModule cgid_module                   modules/mod_cgid.so
LoadModule vhost_alias_module            modules/mod_vhost_alias.so
LoadModule negotiation_module            modules/mod_negotiation.so
LoadModule dir_module                    modules/mod_dir.so
#LoadModule imap_module                   modules/mod_imap.so
LoadModule actions_module                modules/mod_actions.so
LoadModule speling_module                modules/mod_speling.so
#LoadModule userdir_module                modules/mod_userdir.so
LoadModule alias_module                  modules/mod_alias.so
LoadModule rewrite_module                modules/mod_rewrite.so
LoadModule ssl_module                   extramodules/mod_ssl.so
###
### New Modules for 2.0 (some are experimental)
###
#LoadModule file_cache_module             modules/mod_file_cache.so
#LoadModule echo_module                   modules/mod_echo.so
LoadModule charset_lite_module           modules/mod_charset_lite.so
#LoadModule cache_module                  modules/mod_cache.so
#LoadModule disk_cache_module             modules/mod_disk_cache.so
#LoadModule mem_cache_module              modules/mod_mem_cache.so
LoadModule ext_filter_module             modules/mod_ext_filter.so
#LoadModule case_filter_module            modules/mod_case_filter.so
#LoadModule case_filter_in_module         modules/mod_case_filter_in.so
#LoadModule deflate_module                modules/mod_deflate.so
#LoadModule optional_hook_export_module
modules/mod_optional_hook_export.so
#LoadModule optional_hook_import_module
modules/mod_optional_hook_import.so
#LoadModule optional_fn_import_module     modules/mod_optional_fn_import.so
#LoadModule optional_fn_export_module     modules/mod_optional_fn_export.so
#LoadModule bucketeer_module              modules/mod_bucketeer.so
#LoadModule logio_module                  modules/mod_logio.so

###
### Global Configuration
###
# Splitting up apache2.conf into two files makes it easier to support
# multiple configurations on the same serer.  In commonapache2.conf
# you keep directives that apply to all implementations and in this
# file you keep server-specific directives.  While we don't yet have
# multiple configurations out-of-the-box, this allows us to do that
# in the future easily.  (PERLPROXIED *ahem*)
#
# For Apache2 we load all conf files in conf/modules.d
Include conf/modules.d/*.conf
Include conf/commonapache2.conf

###
### IP Address/Port
###
#BindAddress *
#Listen 192.168.0.254:443

###
### Log configuration Section
###
<IfModule mod_log_config.c>
#Single logfile with access, agent and referer information
#This is the default, if vlogs are not defined for the main server
CustomLog logs/access_log combined env=!VLOG
#If VLOG is defined in conf/vhosts/vhosts.conf, we use this entry
#CustomLog "|/usr/sbin/apache2splitlogfile" vhost env=VLOG
</IfModule>

###
### Virtual Hosts
###
# We include different templates for Virtual Hosting. Have a look in the
# vhosts directory and modify to suit your needs.
Include conf/vhosts/vhosts.conf
#Include conf/vhosts/dynamic-vhosts.conf
#Include conf/vhosts/virtual-homepages.conf
###
### Performance settings Section
###
#
# Timeout: The number of seconds before receives and sends time out.
#
Timeout 300

#
# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#
KeepAlive On

#
# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 100

#
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
#
KeepAliveTimeout 15

# prefork MPM [THIS IS THE DEFAULT]
# StartServers: number of server processes to start
# MinSpareServers: minimum number of server processes which are kept spare
# MaxSpareServers: maximum number of server processes which are kept spare
# MaxClients: maximum number of server processes allowed to start
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule prefork.c>
StartServers         5
MinSpareServers      5
MaxSpareServers     10
MaxClients         150
MaxRequestsPerChild  0
</IfModule>

# worker MPM
# StartServers: initial number of server processes to start
# MaxClients: maximum number of simultaneous client connections
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadsPerChild: constant number of worker threads in each server process
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule worker.c>
StartServers         2
MaxClients         150
MinSpareThreads     25
MaxSpareThreads     75
ThreadsPerChild     25
MaxRequestsPerChild  0
</IfModule>

# perchild MPM
#
# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 100

#
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
#
KeepAliveTimeout 15

# prefork MPM [THIS IS THE DEFAULT]
# StartServers: number of server processes to start
# MinSpareServers: minimum number of server processes which are kept spare
# MaxSpareServers: maximum number of server processes which are kept spare
# MaxClients: maximum number of server processes allowed to start
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule prefork.c>
StartServers         5
MinSpareServers      5
MaxSpareServers     10
MaxClients         150
MaxRequestsPerChild  0
</IfModule>

# worker MPM
# StartServers: initial number of server processes to start
# MaxClients: maximum number of simultaneous client connections
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadsPerChild: constant number of worker threads in each server process
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule worker.c>
StartServers         2
MaxClients         150
MinSpareThreads     25
MaxSpareThreads     75
ThreadsPerChild     25
MaxRequestsPerChild  0
</IfModule>

# perchild MPM
# NumServers: constant number of server processes
# StartThreads: initial number of worker threads in each server process
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# MaxThreadsPerChild: maximum number of worker threads in each server
process
# MaxRequestsPerChild: maximum number of connections per server process
<IfModule perchild.c>
NumServers           5
StartThreads         5
MinSpareThreads      5
MaxSpareThreads     10
MaxThreadsPerChild  20
MaxRequestsPerChild  0
</IfModule>

--->vhosts.conf
===============

################# Named VirtualHosts
NameVirtualHost 192.168.0.254:443
<VirtualHost 192.168.0.254:443>
ServerName gateway.hotlink.net.nz
DocumentRoot /usr/local/nocat/authserv/htdocs
SSLEngine On
SSLCertificateFile /etc/apache2/conf/ssl/server.crt
SSLCertificateKeyFile /etc/apache2/conf/ssl/server.key
Options FollowSymLinks Includes Indexes MultiViews
ScriptAlias /cgi-bin/ /usr/local/nocat/authserv/cgi-bin/
<Directory "/usr/local/nocat/authserv/htdocs">
AllowOverride All
Options FollowSymLinks Includes Indexes MultiViews
<Limit GET POST OPTIONS PROPFIND>
Order allow,deny
Allow from all
</Limit>
<LimitExcept GET POST OPTIONS PROPFIND>
Order deny,allow
Deny from all
</LimitExcept>
</Directory>
<Directory "/usr/local/nocat/authserv/cgi-bin">
AllowOverride All
Options ExecCGI
<IfModule mod_access.c>
Order allow,deny
Allow from all
</IfModule>
SetEnv PERL5LIB /usr/local/nocat/authserv/lib
SetEnv NOCAT /usr/local/nocat/authserv/nocat.conf
SSLOptions +StdEnvVars
</Directory>
<IfModule mod_setenvif.c>
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
downgrade-1.0 force-response-1.0
</IfModule>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteOptions inherit
</IfModule>
</VirtualHost>

--->apache error_log
====================

[Mon Jun 27 18:49:23 2005] [warn] RSA server certificate CommonName (CN)
`localhost' does NOT match server name!?
[Mon Jun 27 18:49:23 2005] [warn] RSA server certificate CommonName (CN)
`localhost' does NOT match server name!?
[Mon Jun 27 18:49:23 2005] [notice] Apache/2.0.54 (Gentoo/Linux)
mod_ssl/2.0.54 OpenSSL/0.9.7e configured -- resuming normal operations
[Mon Jun 27 18:50:29 2005] [error] [client 192.168.0.199] [2005-06-27
18:50:29] User UNKNOWN from 192.168.0.199 requests form
[Mon Jun 27 18:50:48 2005] [error] [client 192.168.0.199] [2005-06-27
18:50:48] User [email protected] from 192.168.0.199 requests form,
referer: https://192.
168.0.254/cgi-bin/login?redirect=http%3a%2f%2fwww%2ethinkgeek%2ecom%2f&timeo
ut=300&gateway=192%2e168%2e0%2e254%3a5280&mac=00%3a30%3a1B%3aB5%3aBA%3a96&to
ken=%
241%2495412277%24CqZ0%2fm6sob9NSdA6PxzuN1
[Mon Jun 27 18:50:49 2005] [error] [client 192.168.0.199] [2005-06-27
18:50:49] Request from local ip 192.168.0.199, directing to local gateway
192.168.0.254
., referer:
https://192.168.0.254/cgi-bin/login?redirect=http%3a%2f%2fwww%2ethinkgeek%2e
com%2f&timeout=300&gateway=192%2e168%2e0%2e254%3a5280&mac=00%3a30%3a1
B%3aB5%3aBA%3a96&token=%241%2495412277%24CqZ0%2fm6sob9NSdA6PxzuN1
[Mon Jun 27 18:50:49 2005] [error] [client 192.168.0.199] [2005-06-27
18:50:49] User [email protected] from 192.168.0.199 requests popup
[Mon Jun 27 18:50:50 2005] [error] [client 192.168.0.199] [2005-06-27
18:50:50] Request from local ip 192.168.0.199, directing to local gateway
192.168.0.254