RE: Endless Login

Hey All,

I managed to figure it out. I am an idiot as I originally suspected. 

In nocat.conf MembersOnly    1 was uncommented but I hadn't added my user to
a group - Doh!

All seems to be up and running now :) Stage two of my project is to
integrate it with a prepay card system that has a code we generate rather
than an email address and password combination - if anyone has had any
experience with that your tips/ideas etc would be greatly appreciated.

M.


-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of Ben Blakely
Sent: Tuesday, 28 June 2005 1:16 a.m.
To: [email protected]
Subject: Re: [NoCat] Endless Login

I've experienced the same problem with a Fedora Core 3 machine.  The odd 
thing was that out of probably fifty users, only two had this problem.  
One was on a PocketPC (so Windows CE, not sure which IE Version) and the 
other was on a laptop (XP, probably IE6).  The one on the laptop 
eventually got through just by logging in repeatedly but the PocketPC 
user never was able to.  I have posted these details before but the 
message never made it into publication on the list so I had given up.  
If anyone knows of a solution to this problem I would much appreciate it!

/bab

[email protected] wrote:

>Hi All,
>
>I'm new to this list so please forgive me if this issue has been addressed
>before. I googled high and low but couldn't find a solution.
>
>Anyway I've got the NoCat gateway and auth service setup on my box with the
>gateway set to passive mode. I've got a desktop pc plugged into the public
>interface with a crossover cable for testing purposes at the moment. I can
>login and the keep-alive popup opens but it doesn't redirect at all.
>
>What happens is after 5 seconds it tries to redirect to
>https://192.168.0.254/cgi-bin/5;%20URL=http://192.168.0.254:5280/?ticket=ow
G
>bwMvMwCQ42%2f732jOh1z4wnj7AncTgtH%2flp6DUlMyi1OQSzoySkgIrff3y8nK93Mzkovzi%2
f
>LQSveT8XP3M4sSCTP0ikDq9lJwc%2b4KiFNvMVLWCstQiWzO1xCLb3OK8jPzcVC7fxGROAwMrYw
M
>rQycrJ1MrJ0crSzMux%2bSSzPw8zoDUotzMEq7Q4tQiztzEkhIHEKGXlwrEVVy%2b%2bSmpnDn5
6
>Zl5XCGZuan5pSWcxgYGXCH52al5nCqGKqaGRqYWBhYGKqUFpcnORr4pkVle%2fmF5FvkB4a7JBQ
Z
>cHfbMrGDfwPwnyNT9lWGujBfTU%2bFra%2fhNdsmtnewrHGA54%2fgyhnnKKfKy36w3fH4xY7rv
h
>s28jF%2fVQ7cBAA%3d%3d%3dcKv%2f which of course generates a 404 error. If we
>remove the preceding https://192.168.0.254/cgi-bin/5;%20URL= I end up at
the
>login page.
>
>This is using apache2, NoCatAuth-0.82, gnupg-1.4.1 on Gentoo 2005.0 and the
>client is IE6.0 on WinXP SP2
>
>Any ideas?
>
>I wasn't sure what logs and config files would be helpful so below is the
>gateway nocat.conf, the auth nocat.conf, my apache configs and logs as well
>as the nocat logs.
>
>Also the public interface is called public and is 192.168.0.0/24, the
>private interface is called inet and is 192.168.1.0/24
>
>One thing to note is that I was getting a lot of errors related to NetMask
>in the apache error logs from line 77 of AuthService.pm but changing line
11
>of AuthService.pm to the following seemed to fix that
>GatewayPort NotifyTimeout LoginTimeout RenewTimeout HomePage LocalNetwork
>
>
>I think I've posted as much detail as I can but will provide whatever else
>is asked for.
>
>Thanks in advance for any help you may be able to provide.
>
>Matt Courtney
>
>--->Gateway nocat.conf
>======================
>###### gateway.conf -- NoCatAuth Gateway Configuration.
>#
># Format of this file is: <Directive> <Value>, one per
>#   line. Trailing and leading whitespace is ignored. Any
>#   line beginning with a punctuation character is assumed to
>#   be a comment.
>
>###### General settings.
>#
># See the bottom of this file for options for logging to syslog.
>#
># Log verbosity -- 0 is (almost) no logging. 10 is log
>#   everything. 5 is probably a safe middle road.
>#
>Verbosity       10
>
>##### Gateway application settings.
>#
># GatewayName -- The name of this gateway, to be optionally displayed
>#   on the splash and status pages. Any short string of text will do.
>#
>GatewayName     Hotlink Internet Gateway
>
>##
>#
># GatewayMode -- Determines the mode of operation of the gateway. Possible
>#   values are:
>#
>#   Captive     - Allow authentication against an auth service. LEGACY.
>#   Passive     - Like Captive, but YOU MUST USE THIS if your gateway
>#                   is behind a NAT. Will work anyway if not.
*RECOMMENDED*.
>#   Open        - Simply require a user to view a splash page and accept
>#                   a use agreement.
>#
># If Captive or Passive Mode is set, you will need to have values set for
>#   AuthServiceAddr, AuthServiceURL, and LogoutURL. You will want to leave
a
>#   short value for LoginTimeout (probably <600).
>#
># If Open Mode is set, you will need to have values set for SplashForm,
>#   HomePage, and possibly DocumentRoot (or provide an absolute path for
>#   SplashForm).  Also, you will want to set a large value for LoginTimeout
>#   (probably >3600).
>#
>GatewayMode     Passive
>
>##
># GatewayLog -- Optional.  If unset, messages will go to STDERR.
>#
>GatewayLog      /usr/local/nocat/gw/nocat.log
>
>##
># LoginTimeout - Number of seconds after a client's last
>#   login/renewal to terminate their connection. Probably
>#   don't want to set this to less than 60 or a lot of
>#   bandwidth is likely to get consumed by the client's
>#   renewal attempts. Defaults to 300 seconds.
>#
># For Captive Mode, you want to set this to something
>#   fairly short (like 10 minutes) to prevent connection
>#   spoofing.
>#
> LoginTimeout   300
>
>###### Active/Passive Portal settings.
>#
>##
># TrustedGroups - A list of groups registered with the auth server
>#   that a user may claim membership in order to gain Member-class
>#   access through this portal. The default magic value "Any" indicates
>#   that a member of *any* group is granted member-class access from
>#   this gateway.
>#
># TrustedGroups NoCat NYCWireless PersonalTelco
>#
>TrustedGroups Any
>
>##
># Owners - Optional.  List all local "owner" class users here, separated
>#   by spaces.  Owners typically get full bandwidth, and unrestricted
>#   access to all network resources.
>#
># Owners [email protected] [email protected]
>
>##
># AuthServiceAddr - Required, for captive mode. Must be set to the address
>of
>#   your authentication service. You must use an IP address
>#   if DNS resolution isn't available at gateway startup.
>#
># AuthServiceAddr 208.201.239.21
>#
>AuthServiceAddr 192.168.0.254
>
>##
># AuthServiceURL - HTTPS URL to the login script at the authservice.
>#
>AuthServiceURL  https://$AuthServiceAddr/cgi-bin/login
>
>##
># LogoutURL - HTTP URL to redirect user after logout.
>#
>LogoutURL       https://$AuthServiceAddr/logout.html
>
>### Network Topology
>#
># ExternalDevice - Required if and only if NoCatAuth can't figure it out
>#   from looking at your routing tables and picking the interface
>#   that carries the default route. Must be set to the interface
>#   connected to the Internet. Usually 'eth0' or 'eth1'
>#   under Linux, or maybe even 'ppp0' if you're running
>#   PPP or PPPoE.
>#
>ExternalDevice  inet
>
>##
># InternalDevice - Required if and only if you have ethernet devices
>#   on your gateway besides your wireless device and your 'Net connection.
>#   Must be set to the interface connected to your local network, normally
>#   your wireless card. In Linux, some wireless devices are named 'wvlan0'
>#   or 'wlan0' rather than 'ethX'.
>#
>InternalDevice  public
>
>##
># LocalNetwork - Required if and only if NoCatAuth can't figure out
>#   the network address of your local (probably wireless) network,
>#   given your InternalDevice(s). Must be set to the network
>#   address and net mask of your internal network. You
>#   can use the number of bits in the netmask (e.g. /16, /24, etc.)
>#   or the full x.x.x.x specification.
>#
>LocalNetwork    192.168.0.0/255.255.255.0
>
>##
># DNSAddr - Optional. *If* you choose not to run DNS on your internal
>network,
>#   specify the address(es) of one or more domain name server on the
>Internet
>#   that wireless clients can use to get out. Should be the same DNS that
>your
>#   DHCP server hands out. If left blank, NoCatAuth will presume that you
>#   want to use whatever nameservers are listed in /etc/resolv.conf.
>#
>DNSAddr 192.168.0.254
>
>##
># AllowedWebHosts - Optional.  List any domains that you would like to
>#   allow web access (TCP port 80 and 443) BEFORE logging in (this is the
>#   pre-'skip' stage, so be careful about what you allow.)
>#
> AllowedWebHosts        hotlink.net.nz
>
>##
># RouteOnly - Required only if you DO NOT want your gateway to act as a
NAT.
>#   Uncomment this only if you're running a strictly routed network, and
>#   don't need the gateway to enable NAT for you.
>#
># RouteOnly     1
>
>##
># IgnoreMAC - Set this if and only if the NoCat gateway isn't directly
>#   connected (or bridged at Layer 2) to your internal (usually wireless)
>#   network. In that event, the gateway won't be able to match clients
based
>#   on MAC address, and will fall back to using IPs only. This is
>#   theoretically less secure, as IP addresses are usually easier to spoof
>#   than MAC addresses, so don't use this unless you know what you're
doing.
>#
># IgnoreMAC     1
>
>##
># MembersOnly - Optional.  Uncomment this if you want to disable public
>#   access (i.e. unauthenticated 'skip' button access).  You'll also want
to
>#   point AuthServiceURL somewhere that doesn't include a skip button (like
>#   at your own Auth server.)
>#
> MembersOnly    1
>
>##
># IncludePorts - Optional.  Specify TCP ports to allow access to when
>#   public class users login.  All others will be denied.
>#
>#   For a list of common services and their respective port numbers, see
>#   your /etc/services file. Depending on your firewall, you might even
>#   be able to specify said services here, instead of using port numbers.
>#
># IncludePorts    22 80 443
>
>##
># ExcludePorts - Optional.  Specify TCP ports to denied access to when
>#   public class users login.  All others will be allowed.
>#
>#   Note that you should use either IncludePorts or ExcludePorts, but not
>#   both.  If neither is specified, access is granted to all ports to
>#   public class users.
>#
>#   You should *always* exclude port 25, unless you want to run an portal
>#   for wanton spam sending. Users should have their own way of sending
>#   mail. It sucks, but that's the way it is. Comment this out *only if*
>#   you're using IncludePorts instead.
>#
># ExcludePorts 23 25 111
>#
>#ExcludePorts    25
>
>####### Syslog Options -- alter these only if you want NoCat to log to the
>#        system log!
>#
># Log Facility - syslog or internal.  Internal sends log messages
>#    using the GatewayLog or STDERR if GatewayLog is unset.  Syslog
>#    sends all messages to the system log.
>#
># LogFacility   internal
>
>##
># SyslogSocket - inet or unix.  Inet connects to an inet socket returned
>#    by getsrvbyname().  Unix connects to a unix domain socket returned by
>#    _PATH_LOG in syslog.ph (typically /dev/log).  Defaults to unix.
>#
># SyslogSocket unix
>
>##
># SyslogOptions - Zero or more of the words pid, ndelay, cons, nowait
>#    Defaults to "cons,pid".
>#
># SyslogOptions cons,pid
>
>##
># SyslogPriority - The syslog class of message to use:  In decreasing
>importance,
>#    the typical priorities are EMERG, ALERT, CRIT, ERR, WARNING, NOTICE,
>INFO,
>#    and DEBUG.  Defaults to INFO.
>#
># SyslogPriority INFO
>
>##
># SyslogFacility - The facility used to log messages.  Defaults to user.
># SyslogFacility user
>
>##
># SyslogIdent - The ident of the program that is calling syslog.  This will
>#    be prepended to every log entry made by NoCat.  Defaults to NoCat.
># SyslogFacility - The facility used to log messages.  Defaults to user.
># SyslogFacility user
>
>##
># SyslogIdent - The ident of the program that is calling syslog.  This will
>#    be prepended to every log entry made by NoCat.  Defaults to NoCat.
>#
># SyslogIdent NoCat
>
>###### Other Common Gateway Options. (stuff you probably won't have to
>change)
>#
># ResetCmd, PermitCmd, DenyCmd -- Shell commands to reset,
>#   open and close the firewall. You probably don't need to
>#   change these.
>#
># ResetCmd      initialize.fw
># PermitCmd     access.fw permit $MAC $IP $Class
># DenyCmd       access.fw deny $MAC $IP $Class
>
>##
># GatewayPort - The TCP port to bind the gateway
>#   service to. 5280 is de-facto standard for NoCatAuth.
>#   Change this only if you absolutely need to.
>#
># GatewayPort     5280
>
>##
># PGPKeyPath -- The directory in which PGP keys are stored.
>#   NoCat tries to find this in the pgp/ directory above
>#   the bin/ parent directory. Set this only if you put it
>#   somewhere that NoCat doesn't expect.
>#
># PGPKeyPath    /usr/local/nocat/gw/pgp
>
>##
># MessageVerify -- Shell command to verify a PGP signed
>#   message. The actual message is delivered to the
>#   command's standard input. NoCat tries to find gpg
>#   and gpgv in your path. Set these only if you need to find
>#   them elsewhere.
>#
># GpgvPath      /usr/bin/gpgv
>#
># MessageVerify $GpgvPath --homedir=$PGPKeyPath 2>/dev/null
>
>##
>#
># IdleTimeout -- How often to check the ARP cache, in seconds,
>#   for expiration of idle clients.
>#
># MaxMissedARP -- How many times a client can be missing from
>#   the ARP cache before we assume they've gone away, and log them
>#   out. Set to 0 to disable logout based on ARP cache expiration.
>#
># MaxMissedARP  2
>#
># IdleTimeout   300
>
>### Fin!
>
>--->Gateway nocat.log
>=====================
>
>[2005-06-27 18:49:35] Gateway running on port 5280.
>[2005-06-27 18:50:14] Spawning child process 12308.
>[2005-06-27 18:50:14] Connection to 192.168.0.254 from 192.168.0.199
>[2005-06-27 18:50:14] Capturing  192.168.0.199  for
>http://www.thinkgeek.com/
>[2005-06-27 18:50:14] Notifying parent of Capture on peer 00:30:1B:B5:BA:96
>[2005-06-27 18:50:14] Got notification Capture of peer 00:30:1B:B5:BA:96
>[2005-06-27 18:50:14] Child process returned 1
> [2005-06-27 18:50:54] Received notify from 192.168.0.199
>[2005-06-27 18:50:54] gpg --decrypt
--homedir=/usr/local/nocat/gw/bin/../pgp
>--keyring trustedkeys.gpg --no-tty -o- returned error message:
>gpg: WARNING: unsafe permissions on homedir
`/usr/local/nocat/gw/bin/../pgp'
>gpg: Signature made Mon Jun 27 18:50:48 2005 NZST using DSA key ID CC55D6F0
>gpg: Good signature from "Hotlink <[email protected]>"
>gpg: WARNING: This key is not certified with a trusted signature!
>gpg:          There is no indication that the signature belongs to the
>owner.
>Primary key fingerprint: 7346 B99F 3E95 CEB8 5167  1EB0 9B3F FBAD CC55 D6F0
>[2005-06-27 18:50:54] Got auth msg:
>Redirect        http://www.thinkgeek.com/
>Mac     00:30:1B:B5:BA:96
>Action  Permit
>User    [email protected]
>Mode    login
>Timeout 300
>Token   $1$95412277$CqZ0/m6sob9NSdA6PxzuN1
>[2005-06-27 18:50:54] User () v. trusted (Any)
>[2005-06-27 18:50:54] User  [email protected]  permitted in class
>Public
>[2005-06-27 18:50:54] Notifying parent of Permit on peer 00:30:1B:B5:BA:96
>[2005-06-27 18:50:54] Available MACs: 00:30:1B:B5:BA:96
>[2005-06-27 18:50:54] Got notification Permit of peer 00:30:1B:B5:BA:96
>[2005-06-27 18:50:54] Child process returned 1
>[2005-06-27 18:50:54] Spawning child process 12503.
>[2005-06-27 18:50:54] Connection to 192.168.0.254 from 192.168.0.199
>[2005-06-27 18:50:54] Capturing  192.168.0.199  for
>http://www.thinkgeek.com/
>[2005-06-27 18:50:54] Notifying parent of Capture on peer 00:30:1B:B5:BA:96
>[2005-06-27 18:50:54] Got notification Capture of peer 00:30:1B:B5:BA:96
>[2005-06-27 18:50:54] Child process returned 1
>
>--->NoCat auth nocat.conf
>=========================
>
>###### authserv.conf -- NoCatAuth Authentication Service Configuration.
>#
># Format of this file is: <Directive> <Value>, one per
>#   line. Trailing and leading whitespace is ignored. Any
>#   line beginning with a punctuation character is assumed to
>#   be a comment.
>
>###### General settings.
>#
># Log verbosity -- 0 is (almost) no logging. 10 is log
>#   everything. 5 is probably a safe middle road.
>#
>Verbosity       10
>
>##
># PGPKeyPath -- The directory in which PGP keys are stored.
>#   NoCat tries to find this in the pgp/ directory above
>#   the bin/ parent directory. Set this only if you put it
>#   somewhere that NoCat doesn't expect.
>#
> PGPKeyPath     /usr/local/nocat/authserv/pgp
>
>
>###### Authservice-specific settings.
>#
># HomePage -- The authservice's notion of a default
>#   redirect.
>#
>HomePage        http://www.hotlink.net.nz/
>
># DocumentRoot -- Where all of the application templates (including
>#   SplashPage) are hiding. Can be different from Apache's DocumentRoot.
>#
>DocumentRoot    /usr/local/nocat/authserv/htdocs
>
>##### Authservice authentication source.
>#
># DataSource -- specifies what to authenticate against.
>#   Possible values are DBI, Passwd, LDAP, RADIUS, PAM, Samba, IMAP, NIS.
>#
>DataSource      DBI
>
>##
># Auth service database settings.
>#
># If you select DataSource DBI, then Database, DB_User, and DB_Password
>#   are required.
>#
># Database is a DBI-style data source specification.
>#
># For postgres support:
># Database      dbi:Pg:dbname=nocat
>#
># For mysql support:
>Database        dbi:mysql:database=nocat;host=localhost
>DB_User         root
>DB_Passwd       mgehladmin
>
>###### Auth service user table settings.
>#
># UserTable names the table containing the user ID data.
>#
># UserIDField names the column containing the ID that the
>#    client uses to uniquely identifying themselves, i.e. their
>#    e-mail address or username.
>#
># UserPasswdField stores the user's MD5-hashed password.
>#
># UserAuthField is deprecated and will go away.
>#
>UserTable       member
>UserIDField     login
>UserPasswdField pass
>UserAuthField   status
>UserStampField  created
>
>GroupTable      network
>GroupIDField    network
>GroupAdminField admin
>
>####### Auth service web application settings.
>#
># MinPasswdLength -- Enforced minimum user password length.
>#   Not much other checking is done on the user's p/w.
>#
>MinPasswdLength 6
>
># MessageSign -- shell command to sign an auth notification
>#   with. The message to be signed is written to the
>#   command's standard in, and the signed message is read
>#   from standard out.
>#
># GpgPath       /usr/bin/gpg
>#
># MessageSign   $GpgPath --clearsign --homedir=$PGPKeyPath -o-
>
># LocalGateway -- If you run auth service on the same subnet
>#   (or host) as the gateway you need to specify the hostname
>#   of the gateway. Otherwise omit it.  (Requires Net::Netmask)
>#
> LocalGateway    192.168.0.254
> LocalNetwork    192.168.0.0/255.255.255.0
>
># Auth service template names. See the individual templates
>#   for details on what each one does.
>#
>LoginForm       login.html
>LoginOKForm     login_ok.html
>FatalForm       fatal.html
>ExpiredForm     expired.html
>RenewForm       renew.html
>PassiveRenewForm renew_pasv.html
>
>RegisterForm    register.html
>RegisterOKForm  register_ok.html
>RegisterFields  name url description
>
>UpdateForm      update.html
>MinPasswdLength 6
>
># MessageSign -- shell command to sign an auth notification
>#   with. The message to be signed is written to the
>#   command's standard in, and the signed message is read
>#   from standard out.
>#
># GpgPath       /usr/bin/gpg
>#
># MessageSign   $GpgPath --clearsign --homedir=$PGPKeyPath -o-
>
># LocalGateway -- If you run auth service on the same subnet
>#   (or host) as the gateway you need to specify the hostname
>#   of the gateway. Otherwise omit it.  (Requires Net::Netmask)
>#
> LocalGateway    192.168.0.254
> LocalNetwork    192.168.0.0/255.255.255.0
>
># Auth service template names. See the individual templates
>#   for details on what each one does.
>#
>LoginForm       login.html
>LoginOKForm     login_ok.html
>FatalForm       fatal.html
>ExpiredForm     expired.html
>RenewForm       renew.html
>PassiveRenewForm renew_pasv.html
>
>RegisterForm    register.html
>RegisterOKForm  register_ok.html
>RegisterFields  name url description
>
>UpdateForm      update.html
>UpdateFields    url description
>
>###### Auth service user messages. Should be self-explanatory.
>#
>LoginGreeting   Greetings! Welcome to the NoCat Network.
>LoginMissing    Please fill in all fields!
>LoginBadUser    That e-mail address is unknown. Please try again.
>LoginBadPass    That e-mail and password do not match. Please try again.
>LoginBadStatus  Sorry, you are not a registered co-op member.
>
>RegisterGreeting    Welcome! Please enter the following information to
>register.
>RegisterMissing     Name, E-mail, and password fields must be filled in.
>RegisterUserExists  Sorry, that e-mail address is already taken. Are you
>already registered?
>RegisterBadUser     The e-mail address provided appears to be invalid. Did
>you spell it correctly?
>RegisterInvalidPass All passwords must be at least six characters long.
>RegisterPassNoMatch The passwords you provided do not match. Please try
>again.
>RegisterSuccess     Congratulations, you have successfully registered.
>
>UpdateGreeting      Enter your E-mail and password to update your info.
>UpdateBadUser       That e-mail address is unknown. Please try again.
>UpdateBadPass       That e-mail and password do not match. Please try
again.
>UpdateInvalidPass   New passwords must be at least six characters long.
>UpdatePassNoMatch   The new passwords you provided do not match. Please try
>again.
>UpdateSuccess       Congratulations, you have successfully updated your
>account.
>
>###### Fin.
>
>--->apache2.conf
>================
>
>### /etc/apache2/conf/apache2.conf
>### $Id: apache2.conf,v 1.1 2004/03/22 21:17:57 stuart Exp $
>###
>### Main Configuration Section
>### You really shouldn't change these settings unless you're a guru
>###
>ServerRoot /usr/lib/apache2
>ServerName gateway.hotlink.net.nz
>#LockFile /etc/apache2/apache2.lock
>PidFile /var/run/apache2.pid
>ErrorLog logs/error_log
>LogLevel warn
>#DocumentRoot /var/www/localhost/htdocs
>#DocumentRoot /usr/local/nocat/authserv/htdocs
>
>### Dynamic Shared Object (DSO) Support
>###
>### You should always leave these three, as they are needed for normal use.
>### mod_access (Order, Allow, etc..)
>### mod_log_config (Transferlog, etc..)
>### mod_mime (AddType, etc...)
>###
>LoadModule access_module                 modules/mod_access.so
>#LoadModule auth_module                   modules/mod_auth.so
>#LoadModule auth_anon_module              modules/mod_auth_anon.so
>#LoadModule auth_dbm_module               modules/mod_auth_dbm.so
>#LoadModule auth_digest_module            modules/mod_auth_digest.so
>#LoadModule include_module                modules/mod_include.so
>LoadModule log_config_module             modules/mod_log_config.so
>LoadModule env_module                    modules/mod_env.so
>LoadModule mime_magic_module             modules/mod_mime_magic.so
>LoadModule cern_meta_module              modules/mod_cern_meta.so
>LoadModule expires_module                modules/mod_expires.so
>LoadModule headers_module                modules/mod_headers.so
>LoadModule usertrack_module              modules/mod_usertrack.so
>#LoadModule unique_id_module              modules/mod_unique_id.so
>LoadModule setenvif_module               modules/mod_setenvif.so
>#LoadModule proxy_module                  modules/mod_proxy.so
>#LoadModule proxy_connect_module          modules/mod_proxy_connect.so
>#LoadModule proxy_ftp_module              modules/mod_proxy_ftp.so
>#LoadModule proxy_http_module            modules/mod_proxy_http.so
>LoadModule mime_module                   modules/mod_mime.so
>#LoadModule status_module                 modules/mod_status.so
>#LoadModule autoindex_module              modules/mod_autoindex.so
>LoadModule asis_module                   modules/mod_asis.so
>#LoadModule info_module                   modules/mod_info.so
>LoadModule cgi_module                    modules/mod_cgi.so
>LoadModule cgid_module                   modules/mod_cgid.so
>LoadModule vhost_alias_module            modules/mod_vhost_alias.so
>LoadModule negotiation_module            modules/mod_negotiation.so
>LoadModule dir_module                    modules/mod_dir.so
>#LoadModule imap_module                   modules/mod_imap.so
>LoadModule actions_module                modules/mod_actions.so
>LoadModule speling_module                modules/mod_speling.so
>#LoadModule userdir_module                modules/mod_userdir.so
>LoadModule alias_module                  modules/mod_alias.so
>LoadModule rewrite_module                modules/mod_rewrite.so
>LoadModule ssl_module                   extramodules/mod_ssl.so
>###
>### New Modules for 2.0 (some are experimental)
>###
>#LoadModule file_cache_module             modules/mod_file_cache.so
>#LoadModule echo_module                   modules/mod_echo.so
>LoadModule charset_lite_module           modules/mod_charset_lite.so
>#LoadModule cache_module                  modules/mod_cache.so
>#LoadModule disk_cache_module             modules/mod_disk_cache.so
>#LoadModule mem_cache_module              modules/mod_mem_cache.so
>LoadModule ext_filter_module             modules/mod_ext_filter.so
>#LoadModule case_filter_module            modules/mod_case_filter.so
>#LoadModule case_filter_in_module         modules/mod_case_filter_in.so
>#LoadModule deflate_module                modules/mod_deflate.so
>#LoadModule optional_hook_export_module
>modules/mod_optional_hook_export.so
>#LoadModule optional_hook_import_module
>modules/mod_optional_hook_import.so
>#LoadModule optional_fn_import_module     modules/mod_optional_fn_import.so
>#LoadModule optional_fn_export_module     modules/mod_optional_fn_export.so
>#LoadModule bucketeer_module              modules/mod_bucketeer.so
>#LoadModule logio_module                  modules/mod_logio.so
>
>###
>### Global Configuration
>###
># Splitting up apache2.conf into two files makes it easier to support
># multiple configurations on the same serer.  In commonapache2.conf
># you keep directives that apply to all implementations and in this
># file you keep server-specific directives.  While we don't yet have
># multiple configurations out-of-the-box, this allows us to do that
># in the future easily.  (PERLPROXIED *ahem*)
>#
># For Apache2 we load all conf files in conf/modules.d
>Include conf/modules.d/*.conf
>Include conf/commonapache2.conf
>
>###
>### IP Address/Port
>###
>#BindAddress *
>#Listen 192.168.0.254:443
>
>###
>### Log configuration Section
>###
><IfModule mod_log_config.c>
>#Single logfile with access, agent and referer information
>#This is the default, if vlogs are not defined for the main server
>CustomLog logs/access_log combined env=!VLOG
>#If VLOG is defined in conf/vhosts/vhosts.conf, we use this entry
>#CustomLog "|/usr/sbin/apache2splitlogfile" vhost env=VLOG
></IfModule>
>
>###
>### Virtual Hosts
>###
># We include different templates for Virtual Hosting. Have a look in the
># vhosts directory and modify to suit your needs.
>Include conf/vhosts/vhosts.conf
>#Include conf/vhosts/dynamic-vhosts.conf
>#Include conf/vhosts/virtual-homepages.conf
>###
>### Performance settings Section
>###
>#
># Timeout: The number of seconds before receives and sends time out.
>#
>Timeout 300
>
>#
># KeepAlive: Whether or not to allow persistent connections (more than
># one request per connection). Set to "Off" to deactivate.
>#
>KeepAlive On
>
>#
># MaxKeepAliveRequests: The maximum number of requests to allow
># during a persistent connection. Set to 0 to allow an unlimited amount.
># We recommend you leave this number high, for maximum performance.
>#
>MaxKeepAliveRequests 100
>
>#
># KeepAliveTimeout: Number of seconds to wait for the next request from the
># same client on the same connection.
>#
>KeepAliveTimeout 15
>
># prefork MPM [THIS IS THE DEFAULT]
># StartServers: number of server processes to start
># MinSpareServers: minimum number of server processes which are kept spare
># MaxSpareServers: maximum number of server processes which are kept spare
># MaxClients: maximum number of server processes allowed to start
># MaxRequestsPerChild: maximum number of requests a server process serves
><IfModule prefork.c>
>StartServers         5
>MinSpareServers      5
>MaxSpareServers     10
>MaxClients         150
>MaxRequestsPerChild  0
></IfModule>
>
># worker MPM
># StartServers: initial number of server processes to start
># MaxClients: maximum number of simultaneous client connections
># MinSpareThreads: minimum number of worker threads which are kept spare
># MaxSpareThreads: maximum number of worker threads which are kept spare
># ThreadsPerChild: constant number of worker threads in each server process
># MaxRequestsPerChild: maximum number of requests a server process serves
><IfModule worker.c>
>StartServers         2
>MaxClients         150
>MinSpareThreads     25
>MaxSpareThreads     75
>ThreadsPerChild     25
>MaxRequestsPerChild  0
></IfModule>
>
># perchild MPM
>#
># MaxKeepAliveRequests: The maximum number of requests to allow
># during a persistent connection. Set to 0 to allow an unlimited amount.
># We recommend you leave this number high, for maximum performance.
>#
>MaxKeepAliveRequests 100
>
>#
># KeepAliveTimeout: Number of seconds to wait for the next request from the
># same client on the same connection.
>#
>KeepAliveTimeout 15
>
># prefork MPM [THIS IS THE DEFAULT]
># StartServers: number of server processes to start
># MinSpareServers: minimum number of server processes which are kept spare
># MaxSpareServers: maximum number of server processes which are kept spare
># MaxClients: maximum number of server processes allowed to start
># MaxRequestsPerChild: maximum number of requests a server process serves
><IfModule prefork.c>
>StartServers         5
>MinSpareServers      5
>MaxSpareServers     10
>MaxClients         150
>MaxRequestsPerChild  0
></IfModule>
>
># worker MPM
># StartServers: initial number of server processes to start
># MaxClients: maximum number of simultaneous client connections
># MinSpareThreads: minimum number of worker threads which are kept spare
># MaxSpareThreads: maximum number of worker threads which are kept spare
># ThreadsPerChild: constant number of worker threads in each server process
># MaxRequestsPerChild: maximum number of requests a server process serves
><IfModule worker.c>
>StartServers         2
>MaxClients         150
>MinSpareThreads     25
>MaxSpareThreads     75
>ThreadsPerChild     25
>MaxRequestsPerChild  0
></IfModule>
>
># perchild MPM
># NumServers: constant number of server processes
># StartThreads: initial number of worker threads in each server process
># MinSpareThreads: minimum number of worker threads which are kept spare
># MaxSpareThreads: maximum number of worker threads which are kept spare
># MaxThreadsPerChild: maximum number of worker threads in each server
>process
># MaxRequestsPerChild: maximum number of connections per server process
><IfModule perchild.c>
>NumServers           5
>StartThreads         5
>MinSpareThreads      5
>MaxSpareThreads     10
>MaxThreadsPerChild  20
>MaxRequestsPerChild  0
></IfModule>
>
>--->vhosts.conf
>===============
>
>################# Named VirtualHosts
>NameVirtualHost 192.168.0.254:443
><VirtualHost 192.168.0.254:443>
>ServerName gateway.hotlink.net.nz
>DocumentRoot /usr/local/nocat/authserv/htdocs
>SSLEngine On
>SSLCertificateFile /etc/apache2/conf/ssl/server.crt
>SSLCertificateKeyFile /etc/apache2/conf/ssl/server.key
>Options FollowSymLinks Includes Indexes MultiViews
>ScriptAlias /cgi-bin/ /usr/local/nocat/authserv/cgi-bin/
><Directory "/usr/local/nocat/authserv/htdocs">
>AllowOverride All
>Options FollowSymLinks Includes Indexes MultiViews
><Limit GET POST OPTIONS PROPFIND>
>Order allow,deny
>Allow from all
></Limit>
><LimitExcept GET POST OPTIONS PROPFIND>
>Order deny,allow
>Deny from all
></LimitExcept>
></Directory>
><Directory "/usr/local/nocat/authserv/cgi-bin">
>AllowOverride All
>Options ExecCGI
><IfModule mod_access.c>
>Order allow,deny
>Allow from all
></IfModule>
>SetEnv PERL5LIB /usr/local/nocat/authserv/lib
>SetEnv NOCAT /usr/local/nocat/authserv/nocat.conf
>SSLOptions +StdEnvVars
></Directory>
><IfModule mod_setenvif.c>
>SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
>downgrade-1.0 force-response-1.0
></IfModule>
><IfModule mod_rewrite.c>
>RewriteEngine On
>RewriteOptions inherit
></IfModule>
></VirtualHost>
>
>--->apache error_log
>====================
>
>[Mon Jun 27 18:49:23 2005] [warn] RSA server certificate CommonName (CN)
>`localhost' does NOT match server name!?
>[Mon Jun 27 18:49:23 2005] [warn] RSA server certificate CommonName (CN)
>`localhost' does NOT match server name!?
>[Mon Jun 27 18:49:23 2005] [notice] Apache/2.0.54 (Gentoo/Linux)
>mod_ssl/2.0.54 OpenSSL/0.9.7e configured -- resuming normal operations
>[Mon Jun 27 18:50:29 2005] [error] [client 192.168.0.199] [2005-06-27
>18:50:29] User UNKNOWN from 192.168.0.199 requests form
>[Mon Jun 27 18:50:48 2005] [error] [client 192.168.0.199] [2005-06-27
>18:50:48] User [email protected] from 192.168.0.199 requests form,
>referer: https://192.
>168.0.254/cgi-bin/login?redirect=http%3a%2f%2fwww%2ethinkgeek%2ecom%2f&time
o
>ut=300&gateway=192%2e168%2e0%2e254%3a5280&mac=00%3a30%3a1B%3aB5%3aBA%3a96&t
o
>ken=%
>241%2495412277%24CqZ0%2fm6sob9NSdA6PxzuN1
>[Mon Jun 27 18:50:49 2005] [error] [client 192.168.0.199] [2005-06-27
>18:50:49] Request from local ip 192.168.0.199, directing to local gateway
>192.168.0.254
>., referer:
>https://192.168.0.254/cgi-bin/login?redirect=http%3a%2f%2fwww%2ethinkgeek%2
e
>com%2f&timeout=300&gateway=192%2e168%2e0%2e254%3a5280&mac=00%3a30%3a1
>B%3aB5%3aBA%3a96&token=%241%2495412277%24CqZ0%2fm6sob9NSdA6PxzuN1
>[Mon Jun 27 18:50:49 2005] [error] [client 192.168.0.199] [2005-06-27
>18:50:49] User [email protected] from 192.168.0.199 requests popup
>[Mon Jun 27 18:50:50 2005] [error] [client 192.168.0.199] [2005-06-27
>18:50:50] Request from local ip 192.168.0.199, directing to local gateway
>192.168.0.254
>
>_______________________________________________
>NoCat mailing list
>[email protected]
>http://lists.nocat.net/mailman/listinfo/nocat
>  
>

_______________________________________________
NoCat mailing list
[email protected]
http://lists.nocat.net/mailman/listinfo/nocat