Open GoogleCodeExporter opened 8 years ago
I did some more testing, server port 443 is not responding, here is my config
below
-----------------------------------------------------------------
/*
Configuration file for kanet
*/
{
/*
Server configuration
SERVER_MODE="STANDALONE" (default) or "PROXY"
*/
"SERVER_MODE" : "STANDALONE",
"SERVER_URL" : "https://10.200.0.254",
"SERVER_PORT" : "443",
"SERVER_IP" : "10.200.0.254",
"REDIRECT_SERVER_PORT" : "8080",
"QUEUE_NUM" : "0",
"SSL_CERT_FILE" : "/etc/kanet/ssl-kanet.crt",
"SSL_KEY_FILE" : "/etc/kanet/ssl-kanet.key",
"DEBUG" : "0",
/*
Persistent data,
only sqlite is available.
*/
"database" : "sqlite",
"sqlite_connection_string" : "/var/lib/kanet/kanet.sqlite",
"mysql_connection_string" : "Server=xxx; Port=3306; Database=xxx; uid=xxx; pwd=xxx;",
/*
Server behavior
*/
"login_page" : "https://login.bshp.edu/cas/login?service=https://10.200.0.254/login_cas/",
"captive_portal_page" : "https://10.200.0.254/update.html",
"cas_url" : "https://login.bshp.edu/cas",
"www_path" : "/usr/share/kanet/",
"module_path" : "/usr/lib",
"auth_module_name" : "kanet-radiusclient",
/*
blacklist acls
always rejected.
*/
"KANET_ACL_TYPE_BLACKLIST": [
{ "address" : "127.0.0.1", "port" : 9090 },
{ "port" : 8089 }
],
/*
open acls
always open
*/
"KANET_ACL_TYPE_OPEN": [
{ "address" : "10.200.0.254" },
{ "address" : "10.200.0.254", "port" : 443 },
{ "address" : "login.bshp.edu" },
{ "address" : "login.bshp.edu", "port" : 443 },
{ "port" : 60 }
],
/*
default acls
open to authenticated users.
*/
"KANET_ACL_TYPE_DEFAULT": [
{ "port" : 8089 },
{ "port" : 443 },
{ "port" : 80 }
],
/* Admins : comma separated login list */
"admins": "colin,colin@upvm",
/*
blacklist_part
*/
"blacklist_users" : [
{ "login" : "colin", "message" : "hi foo ! you're login have been locked .." },
{ "login" : "johndoe", "message" : "hi john doe ! this account is locked .." }
],
"default_blacklist_message" : "Your account have been locked",
/*
auto_blacklist_acl
used to inform user they are probably infected, if a user try to join
one of this address, the user is automatically blacklisted and the message
display on is login window
*/
"auto_blacklist_acls": [
{ "address" : "192.168.1.45", "message" : "You're account have been temporarily locked <br/> because you're probably infected by a virus" },
{ "port" : 45678, "message" : "You're account have been temporarily locked <br/> because you're probably infected by a virus" }
],
/*
quota, in bytes or seconds. 0 is unlimited.
*/
"bytes_quota" : "0",
"time_quota" : "0",
/*
message
variables : $upbytes $downbytes $duration
*/
"update_msg" : "Up : $upbytes, Down: $downbytes, Time: $duration",
"over_quota_msg" : "Sorry you exceed your quota",
"blacklist_msg" : "Sorry, you're account have been locked",
"update_error_msg" : "An error occured during authentication process, please restart your browser",
}
Original comment by jason.ev...@gmail.com
on 20 Jun 2012 at 7:23
Hi jason,
start kanet in console mode and watch if there's error message about certificat.
Is "SSL_CERT_FILE" : "/etc/kanet/ssl-kanet.crt",
"SSL_KEY_FILE" : "/etc/kanet/ssl-kanet.key",
exists ?
Cyrille
Original comment by cymo...@gmail.com
on 20 Jun 2012 at 9:47
OK I didn't get any errors, and yes the cert paths exist and are correct, I
created self signed for testing and named them the same as in the default
config;
Also if I browse to https://kanet IP/update.HTML I get server not responding,
it responds on port 8080 and i get the redirect to my CAS login , I am guessing
its because its not responding on port 443 is why its not going through. I do
not have Apache installed or any other using that port and is why I left in
stand-alone mode. Does the cert path need certain permissions on the folder for
kanet to read?
Original comment by jason.ev...@gmail.com
on 20 Jun 2012 at 10:15
try with debug set to "1", kanet should be start as a superuser. do you set the
correct ip in the iptables file (kanet-rules) ?
Original comment by cymo...@gmail.com
on 21 Jun 2012 at 10:50
Ok i got it working on HTTPS now and can browse it, BUT when using cas what
should the redirect url be for cas? https://kanet ip/update.html ? or
https://kanet ip/login_cas/ ? the first option seems to not respond, firefox
says the server is redirecting the request for this address in a way that will
never complete
Original comment by jason.ev...@gmail.com
on 21 Jun 2012 at 1:42
the address used to authenticate with CAS is :
https://CAS_SERVER/index.jsp?service=https://KANET_PRIVATE_ADDRESS/login_cas/
and if cas authentitcation success, you should received a redirect to
"captive_portal_page"
Original comment by cymo...@gmail.com
on 21 Jun 2012 at 1:52
Ok i did that and it the cas authentication goes through, I verified on my CAS
logs that a ST and TGT are created and it is, but i am not getting a redirect
to the captive portal page, it just stays at https://KANET
IP/login_cas/?ticket=**** see the attached screenshot, oh and btw when i
changed the certificate files to a .pem format instead of .crt is when it fixed
the https issue
Original comment by jason.ev...@gmail.com
on 21 Jun 2012 at 2:11
Attachments:
I see now, it is looking for a module
un 21 09:19:28 SHPWAUTH kanet: [KANET-ERROR] Unable to load module
/usr/lib/libmod_auth_cas.so in /usr/lib
but within my install it is labeled , mod_auth_cas.so not limod_auth_cas.so
or am i missing something?
Original comment by jason.ev...@gmail.com
on 21 Jun 2012 at 2:20
CAS Authentication is embedded. Do you change your kanet.conf /
"auth_module_name" ?
Original comment by cymo...@gmail.com
on 21 Jun 2012 at 2:33
also make a try with :
"cas_url" : "https://login.bshp.edu/" or
"cas_url" : "https://login.bshp.edu/cas/" <- with a final slash
Verify if login.bshp.edu is correctly resolved on server
Original comment by cymo...@gmail.com
on 21 Jun 2012 at 2:38
hah!!! all it was was that trailing slash for the CAS server and also i had
https://KANET IP/update.html and I changed to https://kanet ip/www/update.html
AND IT WORKS,!!! OMG Finally, after a week a messing around with it! Awesome!!!
Original comment by jason.ev...@gmail.com
on 21 Jun 2012 at 2:41
:D cool ...
in anyway prefer the proxy mode .. much better !
for the next week ;)
Original comment by cymo...@gmail.com
on 21 Jun 2012 at 2:44
yeah Im good for now, lol, Question,
If i wanted to block access to certain ports, I would just add the Kanet rules?
Like I want to block SSH, RDP, MYSQL, and MSSQL ports, I would just add to
kanet-rules right?
Original comment by jason.ev...@gmail.com
on 21 Jun 2012 at 2:48
you don't have to modify kanet-rules but kanet.conf instead. The default
behavior is to reject all.
use blaclist to ovveride rules define after like to block an ip that shoulb be
open with the generic rules prot = 80 :
* KANET_ACL_TYPE_BLACKLIST
* KANET_ACL_TYPE_OPEN : is for address always open (without authentication
useful for CAS, Certificat check server etc ...
* KANET_ACL_TYPE_DEFAULT : the main rules, here you choose what you want to
open :
{ "port" : 8089 },
{ "port" : 443 },
{ "port" : 80 }
],
in that case SSH is not open.
Please close the issue
Original comment by cymo...@gmail.com
on 21 Jun 2012 at 3:02
Ok thanks
Will not let me close, says only project owners can close
Original comment by jason.ev...@gmail.com
on 21 Jun 2012 at 3:07
Original issue reported on code.google.com by
jason.ev...@gmail.com
on 20 Jun 2012 at 7:04