From battersausage at hotmail.com Wed Oct 1 16:16:28 2003 From: battersausage at hotmail.com (Simon Mackey) Date: Wed, 01 Oct 2003 15:16:28 +0000 Subject: [NoCat] PGP ERRORS -- HELP!!!! Message-ID: Hi Robert, >Could someone tell me the exact locations of where the trustedkeys file >should be placed on the authserver and where on the gateway? For me, my trustedkeys file is in /usr/local/nocat/pgp/ directory on the authserver. On the gateway, they are in /usr/local/nocat/pgp/ directory, and it works for me. Perhaps some of the guys more acquainted with pgp and NoCat on the mailing list here might have some more insight into your problem, because I don't really understand your errors. hth though, simon. ----Original Message Follows---- From: "Robert Pera" Reply-To: rpera@ucsd.edu To: nocat@lists.nocat.net Subject: [NoCat] PGP ERRORS -- HELP!!!! Date: Fri, 26 Sep 2003 06:32:08 +0000 Hi Guys, Can someone tell me what is going on here? I know that it is a problem with PGP. Could someone tell me the exact locations of where the trustedkeys file should be placed on the authserver and where on the gateway? Here is my log below: Thanks! --Robert [2003-09-25 23:25:43] Connection to 192.168.1.1 from 192.168.1.149 [2003-09-25 23:25:43] Capturing 192.168.1.149 for http://www.apple.com/ [2003-09-25 23:25:43] Notifying parent of Capture on peer 00:03:93:4B:55:80 [2003-09-25 23:25:43] Got notification Capture of peer 00:03:93:4B:55:80 [2003-09-25 23:25:43] Child process returned 1 [2003-09-25 23:26:05] Connection to 192.168.1.1 from 192.168.1.149 [2003-09-25 23:26:05] Received notify from 192.168.1.149 [2003-09-25 23:26:05] Spawning child process 2384. [2003-09-25 23:26:05] gpg --decrypt --homedir=/usr/local/nocat/pgp --keyring trustedkeys.gpg --no-tty -o- returned error message: gpg: WARNING: unsafe permissions on homedir "/usr/local/nocat/pgp" gpg: Signature made Fri Sep 26 02:26:34 2003 PDT using DSA key ID B8C2E432 gpg: key B8C2E432 has been created 5026 seconds in future (time warp or clock problem) gpg: key B8C2E432 has been created 5026 seconds in future (time warp or clock problem) gpg: key B8C2E432 has been created 5026 seconds in future (time warp or clock problem) gpg: Can't check signature: timestamp conflict [2003-09-25 23:26:05] gpg --decrypt --homedir=/usr/local/nocat/pgp --keyring trustedkeys.gpg --no-tty -o- returned error: Illegal seek ( 2 ) [2003-09-25 23:26:05] Invalid notify from 192.168.1.149 [2003-09-25 23:26:05] Capturing 192.168.1.149 for http://192.168.1.1:5280/?ticket=owGbwMvMwCRovaLm345DT4wYTy9LYrAvYfMKSk3JLEpNLuHMKCkpsNLXLy8v10ssKMhJ1UvOz9Xn8k1M5jQwsDIwtrI0tjJxsjI1tbIw4HJMLsnMz%2bMMSC3KzSzhCi1OLeIsyk9KLSpxKEgtSsxLLSnPL8ouBpnA5ZufksqZk5%2bemccVkpmbml9awmlmYMAVkp%2bdmsepYqhiZGZibGhgYKJi7unq4uMemJcV4BmaEWiSamjoGVZswNVhz8wKdijM5YJMpQUM871a2Ne5xR7bcezqykP%2ftlXOuTI39QrDgpmRws7BH3wPxcxes%2fXoWoOm630PrgIA%3dcrdX [2003-09-25 23:26:05] Notifying parent of Capture on peer 00:03:93:4B:55:80 [2003-09-25 23:26:05] Got notification Capture of peer 0 _________________________________________________________________ Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail _______________________________________________ NoCat mailing list NoCat@lists.nocat.net http://lists.nocat.net/mailman/listinfo/nocat _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 From ryan at muppethouse.com Wed Oct 1 18:42:04 2003 From: ryan at muppethouse.com (Ryan) Date: Wed, 01 Oct 2003 13:42:04 -0400 Subject: [NoCat] Red Hat Enterprise Linux In-Reply-To: <23475E02-F2B8-11D7-B8BD-000393CFD88C@simmons.edu> References: <23475E02-F2B8-11D7-B8BD-000393CFD88C@simmons.edu> Message-ID: <3F7B11EC.1060601@muppethouse.com> I currently run my authentication server on a Red Hat Advanced Server 2.1 machine(sort of). I'm just an average joe, so certainly don't want to pay for a license. Like you I was not looking forward to an upgrade every year either. A buddy of mine set up a server which pulls down all the src rpms from Red Hat. He then recompiles each and every package and then sync's the newly-created binary RPMs to my apt server. When new RPMs arrive I get an email from his script. Basically this is Red Hat AS2.1 with only open source packages. I believe there is one RPM, redhat-logos which contains copyrighted redhat logos. From what I understand however this package can be used as long as it is not modified and it is necessary for another package. I am not a lawyer, but by recompiling open-source rpms available to the public seems kosher, and now I don't have to worry about painful upgrades. -Ryan David Bruce wrote: > > Anyone running nocat on Red Hat Enterprise Linux (formerly Advanced > Server)? I'm wondering what people's plans are with the end of life > for Red Hat 7.* at the end of the year, and Red Hat 9 in April of > 2004? A complete upgrade of the OS every year is going to be a pain. > > -- > David Bruce Phone: 617.521.2187 > UNIX Systems Administrator Fax: 617.521.3082 > Simmons College, Office of Information Technology > 300 The Fenway, Boston, MA 02115-5898 david.bruce@simmons.edu > > > _______________________________________________ > NoCat mailing list > NoCat@lists.nocat.net > http://lists.nocat.net/mailman/listinfo/nocat From ryan at muppethouse.com Wed Oct 1 18:54:49 2003 From: ryan at muppethouse.com (Ryan) Date: Wed, 01 Oct 2003 13:54:49 -0400 Subject: [NoCat] Redirect Proxy Server In-Reply-To: <3F4E1C7B@leto.ceplus.de> References: <3F4E1C7B@leto.ceplus.de> Message-ID: <3F7B14E9.5080606@muppethouse.com> I found a solution that works for me. My network basically looks like this: [wireless segment] (((((< [nocat gateway] -- [nocat auth / iptables firewall / squid proxy] -- [internet router] Configuring browsers is a pain, so what I decided to do was to was just redirect all traffic bound for port 80 to 3128 on my squid server / firewall. The iptables rule is like the one below. -A PREROUTING -s 10.0.10.0/255.255.255.0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 I didn't modify the nocat gatway at all to get this to work. I hope this is helpful. -Ryan Andreas Moehrlein wrote: >using Nocat with a browser with proxy settings doesn't work. >The patch to display the blockproxy.html messages is not a solutions... > >Redirecting all 3128 or 8080 request to a local squid on the NoCat machine, >doesn't solve the problem, because there is no authentication. > >Has anybody a solution for this problem ? > > >Andy > > > > > >_______________________________________________ >NoCat mailing list >NoCat@lists.nocat.net >http://lists.nocat.net/mailman/listinfo/nocat > > From ANDY at ceplus.de Wed Oct 1 19:01:00 2003 From: ANDY at ceplus.de (Andreas Moehrlein) Date: Wed, 1 Oct 2003 20:01:00 +0200 Subject: [NoCat] Redirect Proxy Server Message-ID: <3F4E269D@leto.ceplus.de> Ryan, with that solution you have access to squid and everything works fine - but there is no authentication from NoCat !!! Andy >I found a solution that works for me. My network basically looks like this: > >[wireless segment] (((((< [nocat gateway] -- [nocat auth / iptables firewall / squid proxy] -- [internet router] > >Configuring browsers is a pain, so what I decided to do was to was just >redirect all traffic bound for port 80 to 3128 on my squid server / >firewall. The iptables rule is like the one below. > >-A PREROUTING -s 10.0.10.0/255.255.255.0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 > >I didn't modify the nocat gatway at all to get this to work. I hope >this is helpful. > >-Ryan > From m_felo at libero.it Wed Oct 1 19:32:03 2003 From: m_felo at libero.it (m_felo@libero.it) Date: Wed, 1 Oct 2003 20:32:03 +0200 Subject: [NoCat] Nocat groups Message-ID: I installed nocat gateway and authservice 0.82. I inserted different user= s in different groups. Can I avoid that the users of a group go in som= e network? Does the gateway mark the packet of different groups in the = same mode? From schuyler at oreilly.com Wed Oct 1 20:18:48 2003 From: schuyler at oreilly.com (Schuyler Erle) Date: Wed, 1 Oct 2003 12:18:48 -0700 Subject: [NoCat] Re: [NoCatNet] 802.1x transparency? In-Reply-To: References: Message-ID: <20031001191848.GP15487@oreillynet.com> * On 1-Oct-2003 at 8:05AM PDT, Hansruedi Born said: > > Is NoCat 802.1x transparent? Does NoCat realize that a client has been > 802.1x authenticated (via radius) and afterwards open the internet-access > for the specific client? No, the NoCat gateway itself doesn't speak RADIUS, yet. If you have recommendations on how to make this possible, they would be greatly appreciated. SDE From schuyler at oreilly.com Wed Oct 1 20:19:50 2003 From: schuyler at oreilly.com (Schuyler Erle) Date: Wed, 1 Oct 2003 12:19:50 -0700 Subject: [NoCat] Fwd: NoCat Auth Message-ID: <20031001191950.GQ15487@oreillynet.com> Please reply to this gentleman off-list, if you can help him. Thanks. SDE ----- Forwarded message from "Stumpp, Johannes" ----- Date: Wed, 1 Oct 2003 08:20:49 +0200 From: "Stumpp, Johannes" To: Subject: NoCat Auth Dear Sir, Do you have a description in german, too??? We are very interested. Many Greets Johannes Stumpp INNEO SOLUTIONS ----- End forwarded message ----- From horton at rednecks.net Wed Oct 1 01:41:55 2003 From: horton at rednecks.net (horton wood) Date: Tue, 30 Sep 2003 20:41:55 -0400 Subject: [NoCat] nocat accounting Message-ID: <1064968777.2965.476.camel@funk.rednecks.net> Howdy, I have gone to the pogo website and looked at the accounting patches. http://www.pogozone.net/projects/nocat/ None seem to be able to accomplish exactly what I am looking for, but due to my lack of radius experience I could be wrong. What I am essentially trying to pass to radius is which AP a wireless user came through. This can be useful for many reasons but 2 quickly come to mind. A. Know what Hotspots are dead and therefore a waste of money. B. Be able to credit commissions to hosters of hotspots for new signups at their locations on a monthly basis. If you know of any patches for nocat to accomplish this please let me know. hwood From bong.ramilo at icasolution.com.au Wed Oct 1 03:54:23 2003 From: bong.ramilo at icasolution.com.au (Bong Ramilo) Date: Wed, 1 Oct 2003 12:24:23 +0930 (CST) Subject: [NoCat] Continuing problems with patches In-Reply-To: <20030926123701.13163.94065.Mailman@mouse> References: <20030926123701.13163.94065.Mailman@mouse> Message-ID: <36277.203.112.96.7.1064976863.squirrel@www.icasolution.com.au> i've applied the NoCatAuth-0.82+RADIUS-20030802.patch and am getting the following errors: after logging in, the popup window displays "The requested URL /nocat-cgi/90 was not found on this server." (Note: I use nocat-cgi as the cgi directory.) the main window displayed "The requested URL /nocat-cgi/5 was not found on this server" but this error disappeared after i commented out RedirectTime in the authserv/nocat.conf file. i am able to surf in the main window even while the popup has the error message. i tried using the login_ok_nopopup.html template, as suggested by Jacob Barrett. without the popup, however, i can't seem to timeout - closing the browser window does not time me out (until Session-Timeout is reached, that is). also, accounting data is not being written to the ICRADIUS MySQL database (radacct table). i have everything running on one box. been struggling with this for more than a week. help! From bong.ramilo at icasolution.com.au Wed Oct 1 03:42:40 2003 From: bong.ramilo at icasolution.com.au (Bong Ramilo) Date: Wed, 1 Oct 2003 12:12:40 +0930 (CST) Subject: [NoCat] PGP Errors :) In-Reply-To: <20030930190002.21384.53565.Mailman@mouse> References: <20030930190002.21384.53565.Mailman@mouse> Message-ID: <36113.203.112.96.7.1064976160.squirrel@www.icasolution.com.au> had similar problems on my setup. the gateway server's time was off by a few hours. i reset the time on it and the errors disappeared. From jbarrett at pogozone.com Thu Oct 2 16:12:31 2003 From: jbarrett at pogozone.com (Jacob S. Barrett) Date: Thu, 02 Oct 2003 08:12:31 -0700 Subject: [NoCat] Continuing problems with patches In-Reply-To: <36277.203.112.96.7.1064976863.squirrel@www.icasolution.com.au> References: <20030926123701.13163.94065.Mailman@mouse> <36277.203.112.96.7.1064976863.squirrel@www.icasolution.com.au> Message-ID: <3F7C405F.6040407@pogozone.com> Bong Ramilo wrote: > after logging in, the popup window displays "The requested URL > /nocat-cgi/90 was not found on this server." (Note: I use nocat-cgi as the > cgi directory.) > > the main window displayed "The requested URL /nocat-cgi/5 was not found on > this server" but this error disappeared after i commented out RedirectTime > in the authserv/nocat.conf file. The "90" and "5" in there is the number of seconds until the page reloads, so there must be format error in one of the web pages. renew_pasv.html, renew.html and login_ok.html should have this line: login_ok.html should have a line like this too: You will be redirected within $redirecttime seconds. If not, click here to continue.

AuthServ.pm line 291ish should read: # Add a refresh time of 30 seconds... $vars{redirecttime} = my $redirecttime = $self->{RedirectTime}; push @headers, -Refresh => "$redirecttime; URL=$redirect"; # push @headers, -Cookie => $self->{Cookie} if $self->{Cookie}; > also, accounting data is not being written to the ICRADIUS MySQL database > (radacct table). Can you run ICRADIUS in debug mode and watch the accounting requests being processed by it? If so send me a log of that session. -- Jacob S. Barrett Chief Technology Officer PogoZone LLC email: jbarrett@pogozone.com web: www.pogozone.com voice: 360-676-8772 fax: 360-733-3941 address: 114 W. Magnolia Street Suite 417 Bellingham, Washington 98225 From nocat at planetsphinx.com Thu Oct 2 22:14:50 2003 From: nocat at planetsphinx.com (Mike Cannon) Date: Thu, 2 Oct 2003 16:14:50 -0500 (CDT) Subject: [NoCat] More NoCatAuth 0.82 + RADIUS Patch woes... In-Reply-To: <3F7379B8.5060307@pogozone.com> References: <3F71031A.4070602@icasolution.com.au> <3F71B210.1080707@pogozone.com> <3F71C756.5000101@pogozone.com> <1237.199.3.116.26.1064520010.squirrel@www.planetsphinx.com> <3F7379B8.5060307@pogozone.com> Message-ID: <9939.204.96.220.49.1065129290.squirrel@www.planetsphinx.com> > > Sorry! :) > Hehe.. it's ok.. it was fun! :) > In your Passive.pm is line 47 one of these? You might try either > defining GatewayAddr in your nocat.conf of swapping the comments. > > Passive.pm: > #gateway => $peer->socket->sockhost . ":$self->{GatewayPort}" > gateway => $self->{GatewayAddr} . ":$self->{GatewayPort}" Cool.. I defined GatewayAddr, and NetworkAddr, and it started working.. I also had to correct a bug in the login_ok.html... the variable for (and forgive me.. I don't have access to that box right this second..) the URL Foward time was putting redirect="= 5; http://www.blah..."... there is an extra '=' in there.. I hardcoded the forward time (5), and left the forard URL variable.. and it works!! WOO! :) Now to figure out why it's allowing multple radius authentications for nocat.. hrmmm... Mike C From jbarrett at pogozone.com Thu Oct 2 22:48:44 2003 From: jbarrett at pogozone.com (Jacob S. Barrett) Date: Thu, 02 Oct 2003 14:48:44 -0700 Subject: [NoCat] More NoCatAuth 0.82 + RADIUS Patch woes... In-Reply-To: <9939.204.96.220.49.1065129290.squirrel@www.planetsphinx.com> References: <3F71031A.4070602@icasolution.com.au> <3F71B210.1080707@pogozone.com> <3F71C756.5000101@pogozone.com> <1237.199.3.116.26.1064520010.squirrel@www.planetsphinx.com> <3F7379B8.5060307@pogozone.com> <9939.204.96.220.49.1065129290.squirrel@www.planetsphinx.com> Message-ID: <3F7C9D3C.8010409@pogozone.com> Mike Cannon wrote: > Now to figure out why it's allowing multple radius authentications for > nocat.. hrmmm... Do you mean simultaneous use? Or is it sending the auth request to the radius server more than one time? -- Jacob S. Barrett Chief Technology Officer PogoZone LLC email: jbarrett@pogozone.com web: www.pogozone.com voice: 360-676-8772 fax: 360-733-3941 address: 114 W. Magnolia Street Suite 417 Bellingham, Washington 98225 From bh at nt.is Thu Oct 2 23:53:16 2003 From: bh at nt.is (Brynjar Hauksson) Date: Fri, 3 Oct 2003 05:53:16 +0700 Subject: [NoCat] status of nocat? Message-ID: <005101c38937$f7d95d50$0300a8c0@natuamia> Hi all dear fellow nocat users I have been having this question on my mind for a few months now and = have waited to ask it hoping for nice some things to happen. I=E2=80=99m a bit worried about the progress of the Nocat system and = there are some questions I=E2=80=99d really like to get answered: 1. When if ever will Jacob=E2=80=99s Radius Accounting be put into the = nightly build and eventually to a release? It seems that everyone on = the list is using it, and trying to patch nocat with different levels of = success. =20 2. Last time this patch discussion took place Karl Gaissmaier posted = tens of very interesting and useful scripts. How many of those have = made it into the nightly build, if any? 3. I expect there to be a schedule for these things to be included into = the nocat distribution? If not is there somebody ready to make a branch = distribution with all those useful features included? 4. Any plans to put nocat up on sourceforge.net ? Maybe some of these questions are trivial, but I'm not in the inner = development circle of the nocat community. I do understand that nocat = is a community effort and demanding users like me do not neccesarily = have much rights to make demands while not being a heavy contributor to = the project. I do though have some concerns about the pace of = development of nocat. There was 1 year between 0.81 and 0.82 =20 I really hope there will not be another year until 0.83 and we vill see = version 1.00 within a very long time I would like to thank all the developers though of making this great = software and I hope that more of the great effort from Jacob, Karl and = others will get it's rightful place within the distribution. If their = work will be appreciated as it should it might encourage more people to = contribute to the project. Best regards Brynjar Hauksson From rlotz at seattlewireless.net Thu Oct 2 23:55:14 2003 From: rlotz at seattlewireless.net (Richard Lotz) Date: Thu, 2 Oct 2003 15:55:14 -0700 Subject: [NoCat] Updating NoCat's PF support Message-ID: <7BDAE0E0-F52B-11D7-A5F6-000393CD7EC4@seattlewireless.net> I'd like to update NoCat to support some of the newer PF features (like tables). In doing so I'd like to make it easier to maintain additional, site specific firewall rules. I plan on doing this by pulling out some of the PF syntax from the firewall control scripts and putting them into a flat file. The scripts will then load the file, add/modify NoCat specific entries and then load via stdin. Anyone have any complaints? Anyone willing to test it? -richard -- Richard Lotz GPG Key: http://students.washington.edu/rlotz/key.txt Fingerprint: 6BD7 C584 7DDC 43FD F0D4 87AB 5A8F 89D5 B3CC 9517 From shubhobiswas at hotmail.com Fri Oct 3 02:48:51 2003 From: shubhobiswas at hotmail.com (Shubho Biswas) Date: Thu, 02 Oct 2003 21:48:51 -0400 Subject: [NoCat] nocat auth server Message-ID: Hi folks, I've got a pebble gateway (192.168.1.38) attempting to authenticate with a nocat server (192.168.1.39) that I just set up. My client pc, using MS IE sees the login page properly but I can't seem to login. I get "Server Error, Error Message: Premature End of script headers: login, Error 500" on my browser after I fill in my username and passwd and click login. Here is a step by step of my /etc/httpd/logs/ssl_err_log from apache with my comments interspersed: [Thu Oct 02 19:32:58 2003] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Oct 02 19:32:58 2003] [warn] RSA server certificate CommonName (CN) `localhost.localdomain' does NOT match server name!? [Thu Oct 02 19:33:01 2003] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Oct 02 19:33:01 2003] [warn] RSA server certificate CommonName (CN) `localhost.localdomain' does NOT match server name!? The above shows up immediately after I start my apache server. I don't have a registered ssl certificate but that should be ok for testing, right? [Thu Oct 02 19:34:17 2003] [error] [client 192.168.1.38] [2003-10-02 19:34:17] User UNKNOWN from 192.168.1.38 requests form The above appears after the login page loads on MS IE on the pc client. [Thu Oct 02 19:37:42 2003] [error] [client 192.168.1.38] Premature end of script headers: login, referer: https://192.168.1.39/cgi-bin/login?token=%241%2419663975%24%2fWHDGypwm1OL1uU%2eX7%2e%2ex%2e&timeout=600&redirect=http%3a%2f%2fwww%2emicrosoft%2ecom%2fisapi%2fredir%2edll%3fprd%3die%26pver%3d6%26ar%3dmsnhome&mac=00%3a0C%3a41%3a0C%3a71%3a18&gateway=192%2e168%2e89%2e1%3a5280 [Thu Oct 02 19:37:42 2003] [error] [client 192.168.1.38] [2003-10-02 19:37:42] User sbiswas from 192.168.1.38 requests form, referer: https://192.168.1.39/cgi-bin/login?token=%241%2419663975%24%2fWHDGypwm1OL1uU%2eX7%2e%2ex%2e&timeout=600&redirect=http%3a%2f%2fwww%2emicrosoft%2ecom%2fisapi%2fredir%2edll%3fprd%3die%26pver%3d6%26ar%3dmsnhome&mac=00%3a0C%3a41%3a0C%3a71%3a18&gateway=192%2e168%2e89%2e1%3a5280 [Thu Oct 02 19:37:42 2003] [error] [client 192.168.1.38] [2003-10-02 19:37:42] gpg --sign --armor --homedir=/usr/local/nocat/cgi-bin/../pgp --keyring trustedkeys.gpg --no-tty -o- returned error message:, referer: https://192.168.1.39/cgi-bin/login?token=%241%2419663975%24%2fWHDGypwm1OL1uU%2eX7%2e%2ex%2e&timeout=600&redirect=http%3a%2f%2fwww%2emicrosoft%2ecom%2fisapi%2fredir%2edll%3fprd%3die%26pver%3d6%26ar%3dmsnhome&mac=00%3a0C%3a41%3a0C%3a71%3a18&gateway=192%2e168%2e89%2e1%3a5280 [Thu Oct 02 19:37:42 2003] [error] [client 192.168.1.38] gpg: Warning: using insecure memory!, referer: https://192.168.1.39/cgi-bin/login?token=%241%2419663975%24%2fWHDGypwm1OL1uU%2eX7%2e%2ex%2e&timeout=600&redirect=http%3a%2f%2fwww%2emicrosoft%2ecom%2fisapi%2fredir%2edll%3fprd%3die%26pver%3d6%26ar%3dmsnhome&mac=00%3a0C%3a41%3a0C%3a71%3a18&gateway=192%2e168%2e89%2e1%3a5280 [Thu Oct 02 19:37:42 2003] [error] [client 192.168.1.38] gpg: please see http://www.gnupg.org/faq.html for more information, referer: https://192.168.1.39/cgi-bin/login?token=%241%2419663975%24%2fWHDGypwm1OL1uU%2eX7%2e%2ex%2e&timeout=600&redirect=http%3a%2f%2fwww%2emicrosoft%2ecom%2fisapi%2fredir%2edll%3fprd%3die%26pver%3d6%26ar%3dmsnhome&mac=00%3a0C%3a41%3a0C%3a71%3a18&gateway=192%2e168%2e89%2e1%3a5280 [Thu Oct 02 19:37:42 2003] [error] [client 192.168.1.38] Can't locate Net/Netmask.pm in @INC (@INC contains: ../lib/ /usr/lib/perl5/5.8.0/i386-linux-thread-multi /usr/lib/perl5/5.8.0 /usr/lib/perl5/site_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/site_perl/5.8.0 /usr/lib/perl5/site_perl /usr/lib/perl5/vendor_perl/5.8.0/i386-linux-thread-multi /usr/lib/perl5/vendor_perl/5.8.0 /usr/lib/perl5/vendor_perl .) at ../lib//NoCat/AuthService.pm line 76., referer: https://192.168.1.39/cgi-bin/login?token=%241%2419663975%24%2fWHDGypwm1OL1uU%2eX7%2e%2ex%2e&timeout=600&redirect=http%3a%2f%2fwww%2emicrosoft%2ecom%2fisapi%2fredir%2edll%3fprd%3die%26pver%3d6%26ar%3dmsnhome&mac=00%3a0C%3a41%3a0C%3a71%3a18&gateway=192%2e168%2e89%2e1%3a5280 The above appears after trying to login in with my username and password and clicking login. FYI: When I initially installed gnu privacy guard, I had created a key and revocation certificate. But I recompiled and installed my gpg without those afterwards (I don't know if recompiling and reinstalling changes anything though). Also, I didn't install DBD::MySQL module since I'm not using mysql and I can't download anything from CPAN now for some reason. I'm using password file authentication. And I did not include etc/authserv.conf in my httpd.conf as this gives me a syntax error on the first uncommented line when I try to start my apache server. There doesn't seem to be any useful info in nocat.log from my gateway. Do these logs mean anything to you guys? I'm not really well-versed in any of this so I can't make head or tail of the log. Are there any other logs that could help debug the problem? Shubho _________________________________________________________________ Protect your PC - get McAfee.com VirusScan Online http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963 From rob at capband.net Fri Oct 3 03:02:56 2003 From: rob at capband.net (Rob Nelson) Date: Thu, 02 Oct 2003 22:02:56 -0400 Subject: [NoCat] Heavily modified version of NoCat Message-ID: <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> Our company has used NoCat and modified it heavily. It's all been contract work, and everything's been internal. All the contractors are gone, we're moving away from it, and I'm left holding onto it. I'd like to release it back, but all I got is a tarball and a .doc file with some brief instructions. Would anyone be interested in this, and perhaps hacking it apart and back into the main? I'm just a project manager, not a programmer in any *real* sense of the world. Known modifications: - Authenticates against radius (I believe this was coded before the current radius patch was available) - Caches logins in a local postgres database - Does not time out any connections or delete "oem" sessions upon restart (we sell to apartment tenants, they don't like having to auth all the time) There's a few more functional bugfix type stuff, but those are the new features. If anyone's interested, I'm willing to up the tarball and doc to wherever is useful for the most people. Sorry, hate to say "I have a mess, anyone want it?" but I do know that while there's still bugs, things like radius auth DO work very well in this code. It would be a shame to trash it, with some of the problems people are having with it. Rob Nelson Network Administrator, Capitol Broadband C: 919-369-1874 rob@capband.net From bong at icasolution.com.au Fri Oct 3 03:07:16 2003 From: bong at icasolution.com.au (Bong Ramilo) Date: Fri, 3 Oct 2003 11:37:16 +0930 (CST) Subject: [NoCat] problems with patches (Jacob S. Barrett) In-Reply-To: <20031002190002.32376.39325.Mailman@mouse> References: <20031002190002.32376.39325.Mailman@mouse> Message-ID: <55737.203.112.96.7.1065146836.squirrel@www.icasolution.com.au> hi, jake an all. > renew_pasv.html, renew.html and login_ok.html should have this line: > > > login_ok.html should have a line like this too: > You will be redirected within $redirecttime seconds. If not, click > here to continue.

> > AuthServ.pm line 291ish should read: > # Add a refresh time of 30 seconds... > $vars{redirecttime} = my $redirecttime = $self->{RedirectTime}; > > push @headers, -Refresh => "$redirecttime; URL=$redirect"; > # push @headers, -Cookie => $self->{Cookie} if $self->{Cookie}; I have the same code in the patched files but kept getting errors when not using login_ok_nopopup.html. i'm now using the unpatched login, Authservice.pm and html files and I don,t get the refresh errors. the problem i have with this setup is that when i close the popup and the main windows, i don't get timed out until Session-Timeout is reached (using the patched Peer.pm file). I'd like it to timeout liek it did pre-patch -- that is, if the popup is closed, you are timed out when LoginTime is reached. > Can you run ICRADIUS in debug mode and watch the accounting requests > being processed by it? If so send me a log of that session. ICRADIUS now writes to the MySQL database. I commented out lines 97 and 112 in RADIUS.pm: #{ Name => 40, Value => '7', Type => 'integer' }, #Acct-Status-Type(Accounting-On) Seems ICRADIUS will accept only one Acct-Status-Type attribute at a time, so "Start" and "Stop" are enough for it -- RADIUS.pm also had "Accounting-On" and "Accounting-Off" as attributes. At this stage, I'm keen to get the log-off stuff sorted out. Thanks. From wireless at verma.sfsu.edu Fri Oct 3 07:13:17 2003 From: wireless at verma.sfsu.edu (Sameer Verma) Date: Thu, 02 Oct 2003 23:13:17 -0700 Subject: [NoCat] Heavily modified version of NoCat In-Reply-To: <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> References: <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> Message-ID: <3F7D137D.4080904@verma.sfsu.edu> Rob Nelson wrote: > Our company has used NoCat and modified it heavily. It's all been > contract work, and everything's been internal. All the contractors are > gone, we're moving away from it, and I'm left holding onto it. I'd > like to release it back, but all I got is a tarball and a .doc file > with some brief instructions. Would anyone be interested in this, and > perhaps hacking it apart and back into the main? I'm just a project > manager, not a programmer in any *real* sense of the world. > > Known modifications: > > - Authenticates against radius (I believe this was coded before the > current radius patch was available) > - Caches logins in a local postgres database > - Does not time out any connections or delete "oem" sessions upon > restart (we sell to apartment tenants, they don't like having to auth > all the time) > > There's a few more functional bugfix type stuff, but those are the new > features. If anyone's interested, I'm willing to up the tarball and > doc to wherever is useful for the most people. > > Sorry, hate to say "I have a mess, anyone want it?" but I do know that > while there's still bugs, things like radius auth DO work very well in > this code. It would be a shame to trash it, with some of the problems > people are having with it. > > Rob Nelson > Network Administrator, Capitol Broadband > C: 919-369-1874 > rob@capband.net > > _______________________________________________ > NoCat mailing list > NoCat@lists.nocat.net > http://lists.nocat.net/mailman/listinfo/nocat Rob, You could post the tarball here, or on the Wiki (http://nocat.net/wiki/), I suppose. The RADIUS features would be useful, and the "many eyeballs" logic might help people re-integrate the changes into the source. I'd also be curious to find out why your company is moving away from it. Sameer -- Dr. Sameer Verma, Ph.D. Asst. Professor of Information Systems San Francisco State University San Francisco CA 94132 USA http://verma.sfsu.edu/ From rio at martin.mu Fri Oct 3 07:26:29 2003 From: rio at martin.mu (Rio Martin) Date: Fri, 3 Oct 2003 13:26:29 +0700 Subject: [NoCat] Having error after submit login & password.. In-Reply-To: <3F7D137D.4080904@verma.sfsu.edu> References: <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <3F7D137D.4080904@verma.sfsu.edu> Message-ID: <200310031326.29365.rio@martin.mu> Dear all, I am having trouble with my Nocat-0.8.2 installation. After submiting login & password information, the page return "Internal Server Error". I ve check all the cgi permissions and it all belongs to the same UID as apache. Thanks, need help.. Regards, Rio Martin. From aklougbo at yahoo.com Fri Oct 3 09:41:45 2003 From: aklougbo at yahoo.com (Aime) Date: Fri, 3 Oct 2003 01:41:45 -0700 (PDT) Subject: [NoCat] More NoCatAuth 0.82 + RADIUS Patch woes... In-Reply-To: <3F7C9D3C.8010409@pogozone.com> Message-ID: <20031003084145.48175.qmail@web11007.mail.yahoo.com> All, Did someone find something about simultaneous login yet ? Thanks --Aimé --- "Jacob S. Barrett" wrote: > Mike Cannon wrote: > > Now to figure out why it's allowing multple radius > authentications for > > nocat.. hrmmm... > > Do you mean simultaneous use? Or is it sending the > auth request to the > radius server more than one time? > > -- > Jacob S. Barrett > Chief Technology Officer > PogoZone LLC > > email: jbarrett@pogozone.com > web: www.pogozone.com > voice: 360-676-8772 > fax: 360-733-3941 > address: 114 W. Magnolia Street Suite 417 > Bellingham, Washington 98225 > > > _______________________________________________ > NoCat mailing list > NoCat@lists.nocat.net > http://lists.nocat.net/mailman/listinfo/nocat __________________________________ Do you Yahoo!? The New Yahoo! Shopping - with improved product search http://shopping.yahoo.com From rob at capband.net Fri Oct 3 12:51:36 2003 From: rob at capband.net (Rob Nelson) Date: Fri, 03 Oct 2003 07:51:36 -0400 Subject: [NoCat] Heavily modified version of NoCat In-Reply-To: <3F7D137D.4080904@verma.sfsu.edu> References: <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> Message-ID: <5.2.1.1.0.20031003074736.0221be60@mail.capband.net> >You could post the tarball here, or on the Wiki (http://nocat.net/wiki/), >I suppose. The RADIUS features would be useful, and the "many eyeballs" >logic might help people re-integrate the changes into the source. >I'd also be curious to find out why your company is moving away from it. Reasons to move away from it: - It's still buggy and under heavy use (300+ people arriving home between 5:30-6:30 pm and logging in) it tends to die. - Sometimes it gets stuck in the login loop - successful login throws you back to the login screen. And the big kicker: - When we got hit by the Welchia worm, we realized that the only way to protect the local network, which was getting slammed regardless of whether the person authenticated or not, was to do MAC authentication at the AP. Our business is selling to apartment complexes, not as hotspots, which also contributed. And again, all the NoCat work was done by contractors - when something breaks, there's no programmers around who can fix it. I have a feeling if we hired two guys for 40 hours a week, in two months we could have all the serious bugs stamped out and a few minor ones, but my boss won't have it. Oh well. As for posting it, I've gotten a half dozen requests already. When I get to work, I'll grab the tarball and docs and throw them up on our site and/or the wiki. Rob Nelson Network Administrator, Capitol Broadband C: 919-369-1874 rob@capband.net From rob at capband.net Fri Oct 3 14:37:38 2003 From: rob at capband.net (Rob Nelson) Date: Fri, 03 Oct 2003 09:37:38 -0400 Subject: [NoCat] Source code for patched version Message-ID: <5.2.1.1.0.20031003093327.00b87408@mail.capband.net> Here's a link to the source code and the one document (pathetically dated 7/30/02) that I have available. Three people have worked on this code and I honestly couldn't tell you what the different versions do or do not have in them. All I can tell you is the newest date is January 28th, 2003, on v2.17internal. http://www.capband.net/ronelson/nocat/ I'll be hapy to answer any questions you might have about it. It was modified by three people here, only one of whom was decent about documenting the code. Hope this helps the nocat project, I enjoyed using the software. Oh, and as a side note, my personal email is ronelson@vt.edu, if anyone references this on nocat.net. Of course the code is GPL'ed, but my boss wouldn't want me spending precious company time helping out the people who made our business viable :) Rob Nelson Network Administrator, Capitol Broadband C: 919-369-1874 rob@capband.net From Dennis" <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <5.2.1.1.0.20031003074736.0221be60@mail.capband.net> Message-ID: <001001c389c0$d9134230$0500a8c0@Home> So... what did replace it with? Just curious. Dennis ----- Original Message ----- From: "Rob Nelson" To: "Sameer Verma" Cc: Sent: Friday, October 03, 2003 4:51 AM Subject: Re: [NoCat] Heavily modified version of NoCat > > >You could post the tarball here, or on the Wiki (http://nocat.net/wiki/), > >I suppose. The RADIUS features would be useful, and the "many eyeballs" > >logic might help people re-integrate the changes into the source. > >I'd also be curious to find out why your company is moving away from it. > > Reasons to move away from it: > > - It's still buggy and under heavy use (300+ people arriving home between > 5:30-6:30 pm and logging in) it tends to die. > - Sometimes it gets stuck in the login loop - successful login throws you > back to the login screen. > > And the big kicker: > > - When we got hit by the Welchia worm, we realized that the only way to > protect the local network, which was getting slammed regardless of whether > the person authenticated or not, was to do MAC authentication at the AP. > > Our business is selling to apartment complexes, not as hotspots, which also > contributed. And again, all the NoCat work was done by contractors - when > something breaks, there's no programmers around who can fix it. I have a > feeling if we hired two guys for 40 hours a week, in two months we could > have all the serious bugs stamped out and a few minor ones, but my boss > won't have it. Oh well. > > As for posting it, I've gotten a half dozen requests already. When I get to > work, I'll grab the tarball and docs and throw them up on our site and/or > the wiki. > > > Rob Nelson > Network Administrator, Capitol Broadband > C: 919-369-1874 > rob@capband.net > > > _______________________________________________ > NoCat mailing list > NoCat@lists.nocat.net > http://lists.nocat.net/mailman/listinfo/nocat > From joshmccormack at travelersdiary.com Fri Oct 3 17:26:03 2003 From: joshmccormack at travelersdiary.com (joshmccormack@travelersdiary.com) Date: Fri, 3 Oct 2003 11:26:03 -0500 (CDT) Subject: [NoCat] Re: Heavily modified version of NoCat In-Reply-To: <20031003151403.19760.67119.Mailman@mouse> Message-ID: >Date: Fri, 03 Oct 2003 07:51:36 -0400 >To: Sameer Verma >From: Rob Nelson >Subject: Re: [NoCat] Heavily modified version of NoCat >Cc: noCat@lists.nocat.net > > > >And the big kicker: > >- When we got hit by the Welchia worm, we realized that the only way to >protect the local network, which was getting slammed regardless of whether >the person authenticated or not, was to do MAC authentication at the AP. > > >Rob Nelson >Network Administrator, Capitol Broadband >C: 919-369-1874 >rob@capband.net > Couldn't you have set up NoCatAuth to point to a locally cached version of the windows update when the worm tried to download it? I think I've seen something about someone in ... was it Texas? who did this. Josh From rob at capband.net Fri Oct 3 19:37:25 2003 From: rob at capband.net (Rob Nelson) Date: Fri, 03 Oct 2003 14:37:25 -0400 Subject: [NoCat] Heavily modified version of NoCat In-Reply-To: <001001c389c0$d9134230$0500a8c0@Home> References: <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <5.2.1.1.0.20031003074736.0221be60@mail.capband.net> Message-ID: <5.2.1.1.0.20031003143707.00b94738@mail.capband.net> >So... what did replace it with? Just curious. MAC authentication on the AP, to a RADIUS server at our head-end. Rob Nelson Network Administrator, Capitol Broadband C: 919-369-1874 rob@capband.net From rob at capband.net Fri Oct 3 19:38:23 2003 From: rob at capband.net (Rob Nelson) Date: Fri, 03 Oct 2003 14:38:23 -0400 Subject: [NoCat] Re: Heavily modified version of NoCat In-Reply-To: References: <20031003151403.19760.67119.Mailman@mouse> Message-ID: <5.2.1.1.0.20031003143727.022b5640@mail.capband.net> >Couldn't you have set up NoCatAuth to point to a locally cached version of >the windows update when the worm tried to download it? I think I've seen >something about someone in ... was it Texas? who did this. The problem is that in the meantime it's trying to find other hosts who might be infected, and often at a rate that FAR exceeds our bandwidth, making it impossible for them to download any updates. Hell, we couldn't even SSH into the nocat when this happened, sometimes. Rob Nelson Network Administrator, Capitol Broadband C: 919-369-1874 rob@capband.net From karl.gaissmaier at kiz.uni-ulm.de Fri Oct 3 21:00:55 2003 From: karl.gaissmaier at kiz.uni-ulm.de (Karl Gaissmaier) Date: Fri, 03 Oct 2003 22:00:55 +0200 Subject: [NoCat] Heavily modified version of NoCat References: <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <5.2.1.1.0.20031003074736.0221be60@mail.capband.net> <001001c389c0$d9134230$0500a8c0@Home> Message-ID: <3F7DD577.7E5847CA@kiz.uni-ulm.de> Hi NoCat Users, Dennis schrieb: > > So... what did replace it with? Just curious. I'm also interested in products able to do what NoCat promised to do. I tried to use NoCat here at Ulm University with a lot of bug/feature fixes applied, but now when I try to go to production I stumble again over major design flaws using NoCat for many users (~500). First big problem: - there is no persistency for the currently authenticated users, and the gateway isn't running stable. I'm still looking for the reasons why the gateway will crash on heavy load. I think it's the old perl problem with signal's, maybe. Next week we will run nocat under perl 5.8.0 with defered signal handling, perhaps this helps Second big problem - the local redirect when a capture arise is directed to a postforking server perl script. It would be better if we could redirect to a matured web server and do the redirect within mod_redir or mod_alias, anyway. This would also solve the problem with proxy servers configured at the clients. Third big problem - most of us use the "same machine" approach, but for this scenario the design is to difficult. The same machine approach could be easily done with: a.) a session database on disk (persistency!) b.) cgi login script's as a writer to the session database (locking) c.) a daemon reading the session database (locking) and doing what must be done with the filter rules I started already this project for my University. The project name is WebCap and I hope I can release it before Christmas 2003. A long time you'll say, but my primary job is a Network Administrator and not an application programmer :-( When I've alpha releases I will post it again on this list if someone is interested. Regards Charly -- Karl Gaissmaier University of Ulm, Germany Email:karl.gaissmaier@kiz.uni-ulm.de KIZ, Service Group Network From rob at capband.net Fri Oct 3 21:19:29 2003 From: rob at capband.net (Rob Nelson) Date: Fri, 03 Oct 2003 16:19:29 -0400 Subject: [NoCat] Heavily modified version of NoCat In-Reply-To: <3F7DD577.7E5847CA@kiz.uni-ulm.de> References: <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <5.2.1.1.0.20031003074736.0221be60@mail.capband.net> <001001c389c0$d9134230$0500a8c0@Home> Message-ID: <5.2.1.1.0.20031003161604.01f2d0a8@mail.capband.net> >First big problem: >- there is no persistency for the currently authenticated > users, and the gateway isn't running stable. I'm still > looking for the reasons why the gateway will crash > on heavy load. I think it's the old perl problem > with signal's, maybe. Next week we will run nocat under > perl 5.8.0 with defered signal handling, perhaps this helps Charley We fixed this by not logging out older users. THe long-term plan, before we abandoned it, was to set up a watchdog program, or perhaps a subroutine that runs every so often (again, i'm not a programmer!) that references some info about the last time a user accessed the net and the expiration time. Never got that far, but I think it's the best way to handle persistence in a non-accounting usage. If you're doing accounting, however, you don't have room for that. >Third big problem >- most of us use the "same machine" approach, but for > this scenario the design is to difficult. The same > machine approach could be easily done with: > a.) a session database on disk (persistency!) > b.) cgi login script's as a writer to the session > database (locking) > c.) a daemon reading the session database (locking) > and doing what must be done with the filter rules That's why we added postgres support. One, it let us write the sessions to a local database. Two, if the user changed IP's and reauthenticated, but the auth service (RADIUS) couldn't be reached, we could use their cached credentials. Every night Nocat was supposed to verify the sessions versus RADIUS and kick out suspended accounts. Rob Nelson Network Administrator, Capitol Broadband C: 919-369-1874 rob@capband.net From jbarrett at pogozone.com Fri Oct 3 21:36:52 2003 From: jbarrett at pogozone.com (Jacob S. Barrett) Date: Fri, 03 Oct 2003 13:36:52 -0700 Subject: [NoCat] More NoCatAuth 0.82 + RADIUS Patch woes... In-Reply-To: <20031003084145.48175.qmail@web11007.mail.yahoo.com> References: <20031003084145.48175.qmail@web11007.mail.yahoo.com> Message-ID: <3F7DDDE4.4020602@pogozone.com> Aime wrote: > All, > Did someone find something about simultaneous login > yet ? It works if you never kill nocat. If you kill nocat then the gateway doesn't notify the RADIUS server that the session has ended. I started but never finished the script the FreeRADIUS uses to double check on a session when it detects simultaneous use. It is pretty easy I just haven't had time or a need to do it yet. -- Jacob S. Barrett Chief Technology Officer PogoZone LLC email: jbarrett@pogozone.com web: www.pogozone.com voice: 360-676-8772 fax: 360-733-3941 address: 114 W. Magnolia Street Suite 417 Bellingham, Washington 98225 From karl.gaissmaier at kiz.uni-ulm.de Fri Oct 3 21:53:25 2003 From: karl.gaissmaier at kiz.uni-ulm.de (Karl Gaissmaier) Date: Fri, 03 Oct 2003 22:53:25 +0200 Subject: [NoCat] Heavily modified version of NoCat References: <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <5.2.1.1.0.20031002215739.00bcf788@mail.capband.net> <5.2.1.1.0.20031003074736.0221be60@mail.capband.net> <001001c389c0$d9134230$0500a8c0@Home> <5.2.1.1.0.20031003161604.01f2d0a8@mail.capband.net> Message-ID: <3F7DE1C5.EE6DE2A1@kiz.uni-ulm.de> Hi Rob, Rob Nelson schrieb: > > >First big problem: > >- there is no persistency for the currently authenticated > > users, and the gateway isn't running stable. I'm still > > looking for the reasons why the gateway will crash > > on heavy load. I think it's the old perl problem > > with signal's, maybe. Next week we will run nocat under > > perl 5.8.0 with defered signal handling, perhaps this helps > > Charley > > We fixed this by not logging out older users. THe long-term plan, before we > abandoned it, was to set up a watchdog program, or perhaps a subroutine > that runs every so often (again, i'm not a programmer!) that references > some info about the last time a user accessed the net and the expiration > time. Never got that far, but I think it's the best way to handle > persistence in a non-accounting usage. If you're doing accounting, however, > you don't have room for that. My software will do a normal cgi session handling. - the user authenticates via against a cgi script via radius/ldap/pam/... and the cgi scripts generates a session id (sid). The sid is sent back via cookies or renew urls. Whenver the client renews, the triple (sid, ip, mac) is checked against the session database. If it match, the expiration time is adjusted. There is also a button for explicit logout, then the cgi script sets the session information for this sid to logout. The cgi scripts never do anything with iptables or anything else for what you need root privileges. The daemon script is running under root and the inter process communication between the cgi scripts and the daemon is done via mtime or signature changes on the session database. Whenever the daemon reads the sesion database (after there was a change) or after every expiration interval, the daemon checks if there are expired sid's and removes them (and performs accounting at this moment). The daemon checks the filter rules against the session database und adjusts the filter rules according to the session database. The daemon is responsible for accounting if it is necessary, but this is easy. The session database holds the starttime and the daemon deletes clients from the dbm. That's my plan. The session database module is already finished with stable locking (CGI::Session was no help due to bad locking) and the rest will be coded with HTML::Template, Config::General, Proc::Reliable and CGI::Application. All you need is on CPAN, I will just deliver the glue. > > >Third big problem > >- most of us use the "same machine" approach, but for > > this scenario the design is to difficult. The same > > machine approach could be easily done with: > > a.) a session database on disk (persistency!) > > b.) cgi login script's as a writer to the session > > database (locking) > > c.) a daemon reading the session database (locking) > > and doing what must be done with the filter rules > > That's why we added postgres support. One, it let us write the sessions to > a local database. Two, if the user changed IP's and reauthenticated, but > the auth service (RADIUS) couldn't be reached, we could use their cached > credentials. Every night Nocat was supposed to verify the sessions versus > RADIUS and kick out suspended accounts. I've a very stable radius service (Radiator: www.open.com.au, the best software I've ever puchsed with the best support I've ever seen, and most important, it's pure perl and they accept patches!) running on two Sun Boxes with HA Software. Everything here dealing with dialin and public access here is authenticated against this beast. I've still all AP's configured to MAC address authentication against this radius server. The DEFAULT rule allows all MAC's, only some black sheeps are in front of the DEFAULT rule with an implicit 'Reject', so I can block these clients already before they hit the IP Layer (the same problem you had is also virulent here!). Regards Charly -- Karl Gaissmaier University of Ulm, Germany Email:karl.gaissmaier@kiz.uni-ulm.de KIZ, Service Group Network From ANDY at ceplus.de Sat Oct 4 13:43:00 2003 From: ANDY at ceplus.de (Andreas Moehrlein) Date: Sat, 4 Oct 2003 14:43:00 +0200 Subject: [NoCat] NoCat crashes Message-ID: <3F4E3313@leto.ceplus.de> I found a 2 situations where NoCat (0.82 with RADIUS Auth/Acct) crashes: 1. Using a external RADIUS Authentication server, the "sub recv_paket" hangs within can_read or recv. This never occures when you authenticate locally. The gateway process seems to "hang" within Radius Auth and doesn't respond any more. 2. When you do login from a wireless client and from a second workstation you permanently refresh the URL http://x.x.x.x:5280/status while logging in, the gateway process seems to be dead - but I found there is a second bin/gateway process running. If you kill the second gateway NoCat continues working ... Has anybody else the same problem with such a behaviour ? Andy From niallm at enigma.ie Fri Oct 3 13:09:59 2003 From: niallm at enigma.ie (Niall Richard Murphy) Date: Fri, 3 Oct 2003 13:09:59 +0100 Subject: [NoCat] status of nocat? In-Reply-To: <005101c38937$f7d95d50$0300a8c0@natuamia> References: <005101c38937$f7d95d50$0300a8c0@natuamia> Message-ID: <20031003120959.GA43106@enigma.ie> On Fri, Oct 03, 2003 at 05:53:16AM +0700, Brynjar Hauksson wrote: Brynjar and others, > I???m a bit worried about the progress of the Nocat system and there are some questions I???d really like to get answered: It's clear that the founders of NoCat have a lot on their hands at the moment; otherwise I expect they'd have had the time to do all that's necessary, or hand the authority over to other people to do same. Accordingly, we have a choice between waiting until they've got enough time again, setting up an interim patched distribution, or (dreaded word) forking. My personal preference is setting up an interim patched distribution and then getting those changes back into the main tree at some future stage. At the moment, for people who need to use NoCat, there is quite a lot of work involved in bringing it up to speed with 'best current practice'. This work has to be done individually by everyone again, each time. With only a small amount of effort on everyone's behalf, we can save a lot of effort in the future. Rob/Schuyler - What do you think? Any volunteers? Niall -- Enigma Consulting Limited: Security, UNIX and telecommunications consultants. Address: Floor 2, 45 Dawson Street, Dublin 2, Ireland. 802.11 deployment in Dublin: http://www.enigma.ie/wardrive/ From ryan at muppethouse.com Sat Oct 4 21:35:21 2003 From: ryan at muppethouse.com (Ryan Shea) Date: Sat, 04 Oct 2003 16:35:21 -0400 Subject: [NoCat] Redirect Proxy Server In-Reply-To: <3F4E269D@leto.ceplus.de> References: <3F4E269D@leto.ceplus.de> Message-ID: <3F7F2F09.4030005@muppethouse.com> Maybe I wasn't clear. The iptables rule I mentioned is on my firewall rather than my NoCat gateway - so creating this redirect rule is complely transparent and the NoCat authentication works without any problem. -Ryan Andreas Moehrlein wrote: >Ryan, > >with that solution you have access to squid and everything works fine - but >there is no authentication from NoCat !!! > >Andy > > > >>I found a solution that works for me. My network basically looks like this: >> >>[wireless segment] (((((< [nocat gateway] -- [nocat auth / iptables firewall / squid proxy] >> >> >-- [internet router] > > >>Configuring browsers is a pain, so what I decided to do was to was just >>redirect all traffic bound for port 80 to 3128 on my squid server / >>firewall. The iptables rule is like the one below. >> >>-A PREROUTING -s 10.0.10.0/255.255.255.0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 >> >>I didn't modify the nocat gatway at all to get this to work. I hope >>this is helpful. >> >>-Ryan >> >> >> > > > From joshmccormack at travelersdiary.com Sun Oct 5 04:31:44 2003 From: joshmccormack at travelersdiary.com (Josh McCormack) Date: Sat, 04 Oct 2003 23:31:44 -0400 Subject: [NoCat] *bsd & nocatauth Message-ID: <3F7F90A0.5020008@travelersdiary.com> I'm interested in getting nocatauth along with an implementation of ipsec to work on the smallest system possible. I'm concerned about needing to run Perl (it's big), but we'll get to that later. I've been looking at small Linux distros and saw this today: SnapGear's embedded Linux distribution represents state-of-the-art embedded Linux technology for deeply embedded microprocessors with or without MMU (memory management unit) http://www.snapgear.org/about.html The *BSD family seems to have some really tiny distros for routers, that don't seem too tough to add to for extra functionality, and they handle the ipsec stuff very well it seems. See http://www.bsdrouter.org/ I take it from the NoCatAuth stuff found at http://www.pogozone.net/projects/nocat/ that it's possible to run NoCatAuth on the BSDs. Any more detailed info on that, issues to be aware of, particular BSDs (net, open, free) it will or won't work on? Josh From ulrich.schwarz at rz.uni-ulm.de Sun Oct 5 09:18:41 2003 From: ulrich.schwarz at rz.uni-ulm.de (ulrich schwarz) Date: Sun, 5 Oct 2003 10:18:41 +0200 Subject: [NoCat] NoCat crashes In-Reply-To: <3F4E3313@leto.ceplus.de> References: <3F4E3313@leto.ceplus.de> Message-ID: <1065341921.3f7fd3e11af8f@imap.rz.uni-ulm.de> Zitat von Andreas Moehrlein : > I found a 2 situations where NoCat (0.82 with RADIUS Auth/Acct) crashes: > > 1. Using a external RADIUS Authentication server, the "sub recv_paket" hangs > > within can_read or recv. > This never occures when you authenticate locally. The gateway process seems > to "hang" within Radius Auth and doesn't respond any more. > > 2. When you do login from a wireless client and from a second workstation > you permanently refresh the URL http://x.x.x.x:5280/status while logging > in, the gateway process seems to be dead - but I found there is a second > bin/gateway process running. > If you kill the second gateway NoCat continues working ... hi andy, interesting... at what rate per second do you reload the statuspage when you say "permanently"? which OS and, more interesting, which version of perl do you use? BTW: there's not only a second gateway process, they are lots of children under heavy use. greets, ulric -- ulrich schwarz, computing center, university of ulm, germany From karl.gaissmaier at kiz.uni-ulm.de Sun Oct 5 11:06:20 2003 From: karl.gaissmaier at kiz.uni-ulm.de (Karl Gaissmaier) Date: Sun, 5 Oct 2003 12:06:20 +0200 Subject: [NoCat] NoCat crashes In-Reply-To: <3F4E3313@leto.ceplus.de> References: <3F4E3313@leto.ceplus.de> Message-ID: <200310051206.20433.karl.gaissmaier@kiz.uni-ulm.de> Hi Andreas, On Saturday 04 October 2003 14:43, Andreas Moehrlein wrote: > I found a 2 situations where NoCat (0.82 with RADIUS Auth/Acct) crashes: > > 1. Using a external RADIUS Authentication server, the "sub recv_paket" > hangs within can_read or recv. > This never occures when you authenticate locally. The gateway process seems > to "hang" within Radius Auth and doesn't respond any more. hmmm, I don't have the radius patches applied and then the gateway speaks never with the radius server. This happens only within the login cgi. Therefore this can't be the reason for the gateway crashes at least here at Ulm University. > > 2. When you do login from a wireless client and from a second workstation > you permanently refresh the URL http://x.x.x.x:5280/status while logging > in, the gateway process seems to be dead - but I found there is a second > bin/gateway process running. > If you kill the second gateway NoCat continues working ... as Ulric already said, the gateway is a postforking server. Whenever you connect to port 5280 an additional process is forked. After 'HandleTimeout' sec's this additional process stopps if there was a problem with the connection (SIGALRM). The parent gateway process gets a SIGCHLD and the dead child count increases. In the main loop of the parent these waiting to death childs gets reaped. Anything looks properly and defensive coded. Again, I think it's inherently a problem with perl signal handling. Regards Charly -- Karl Gaissmaier KIZ/Infrastructure, University of Ulm, Germany Email:karl.gaissmaier@kiz.uni-ulm.de Service Group Network From karl.gaissmaier at kiz.uni-ulm.de Sun Oct 5 11:09:37 2003 From: karl.gaissmaier at kiz.uni-ulm.de (Karl Gaissmaier) Date: Sun, 5 Oct 2003 12:09:37 +0200 Subject: [NoCat] Redirect Proxy Server In-Reply-To: <3F7F2F09.4030005@muppethouse.com> References: <3F4E269D@leto.ceplus.de> <3F7F2F09.4030005@muppethouse.com> Message-ID: <200310051209.37452.karl.gaissmaier@kiz.uni-ulm.de> Hi Ryan, On Saturday 04 October 2003 22:35, Ryan Shea wrote: > Maybe I wasn't clear. The iptables rule I mentioned is on my firewall > rather than my NoCat gateway - so creating this redirect rule is > complely transparent and the NoCat authentication works without any > problem. Hmmm, I didn't understand your drawing. It would be nice if you could try again to describe your solution how you solved the problem with proxy servers. What happens with your logouts if they come via the web proxy? You don't have the Client MAC address to logout? Do you igore MAC addresses? Regards Charly -- Karl Gaissmaier KIZ/Infrastructure, University of Ulm, Germany Email:karl.gaissmaier@kiz.uni-ulm.de Service Group Network From nocat at planetsphinx.com Sun Oct 5 18:07:28 2003 From: nocat at planetsphinx.com (Mike Cannon) Date: Sun, 5 Oct 2003 12:07:28 -0500 (CDT) Subject: [NoCat] More NoCatAuth 0.82 + RADIUS Patch woes... In-Reply-To: <3F7C9D3C.8010409@pogozone.com> References: <3F71031A.4070602@icasolution.com.au> <3F71B210.1080707@pogozone.com> <3F71C756.5000101@pogozone.com> <1237.199.3.116.26.1064520010.squirrel@www.planetsphinx.com> <3F7379B8.5060307@pogozone.com> <9939.204.96.220.49.1065129290.squirrel@www.planetsphinx.com> <3F7C9D3C.8010409@pogozone.com> Message-ID: <1538.192.168.13.3.1065373648.squirrel@www.planetsphinx.com> > Mike Cannon wrote: >> Now to figure out why it's allowing multple radius authentications for >> nocat.. hrmmm... > > Do you mean simultaneous use? Or is it sending the auth request to the > radius server more than one time? Simultaneous use.. 2 users online, authenticated with the same username and password... Mike C From jbarrett at pogozone.com Sun Oct 5 19:58:10 2003 From: jbarrett at pogozone.com (Jacob S. Barrett) Date: Sun, 05 Oct 2003 11:58:10 -0700 Subject: [NoCat] *bsd & nocatauth In-Reply-To: <3F7F90A0.5020008@travelersdiary.com> References: <3F7F90A0.5020008@travelersdiary.com> Message-ID: <3F8069C2.8020908@pogozone.com> Josh McCormack wrote: > I take it from the NoCatAuth stuff found at > http://www.pogozone.net/projects/nocat/ that it's possible to run > NoCatAuth on the BSDs. Any more detailed info on that, issues to be > aware of, particular BSDs (net, open, free) it will or won't work on? These patches are specific to FreeBSD's IPFW firewall implementation. With the patches it runs like a champ on FreeBSD. Sorry I can't give you any details on NoCat support for the other BSDs, but with the proper firewall scripts it will run on pretty much anything. -- Jacob S. Barrett Chief Technology Officer PogoZone LLC email: jbarrett@pogozone.com web: www.pogozone.com voice: 360-676-8772 fax: 360-733-3941 address: 114 W. Magnolia Street Suite 417 Bellingham, Washington 98225 From jbarrett at pogozone.com Sun Oct 5 20:05:52 2003 From: jbarrett at pogozone.com (Jacob S. Barrett) Date: Sun, 05 Oct 2003 12:05:52 -0700 Subject: [NoCat] RADIUS and Simultaneous-Use Message-ID: <3F806B90.4010104@pogozone.com> This is a MIME-formatted message. If you see this text it means that your E-mail software does not support MIME-formatted messages. --=_pogo02.pogozone.net-18935-1065381035-0001-2 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit A few people have been asking for this and although I haven't had time to test it here is what I have going so far. Simultaneous-Use works with the RADIUS patches already provided, but with one problem. If the NoCat gateway is terminated before it notifies the RADIUS server that the sessions are close the next time a user tries to log in they will be denied. FreeRADIUS provides a script that it calls to "double check" the NAS to see if the session is really still active before denying the authorization. Attached are the components to get FreeRADIUS to work with NoCat (since nocat isn't a standard NAS). 1) Place the checkrad script somewhere on your RADIUS server. You can name it anything you want really if you don't want to confuse it with the script from FreeRADIUS. 2) Apply the checkrad.patch either against the installed FreeRADIUS checkrad script (/usr/local/sbin/checkrad on FreeBSD) or the source checkrad.pl.in and make install. 3) Add lines similar to the ones in clients.conf.sample into FreeRADIUS's clients.conf file. Check the "exec|/usr/local/nocat/bin/checkrad" line to reference the script you installed in step 1. Now when an authorization request is going to be denied for a user it checks the open sessions for that user. It will execute the FreeRADIUS checkrad script passing in the type line in the clients.conf. The patch adds a section to that script that executes any script after the "exec|". So now our script in step one will get called and check nocat. As always, if you make mods to these please post them back to the list so I can put them into the RADIUS patches. These will show up in the next patch set when I find time. -Jake -- Jacob S. Barrett Chief Technology Officer PogoZone LLC email: jbarrett@pogozone.com web: www.pogozone.com voice: 360-676-8772 fax: 360-733-3941 address: 114 W. Magnolia Street Suite 417 Bellingham, Washington 98225 --=_pogo02.pogozone.net-18935-1065381035-0001-2 Content-Type: text/plain; name=checkrad; charset=iso-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="checkrad" #!/usr/bin/perl require HTTP::Request; require LWP::UserAgent; my $debug = true; # 192.168.0.1 0 foo 01058159212184670 my ($nas, $user, $session) = @ARGV; my $request = HTTP::Request->new(GET => "http://$nas:5280/status"); my $ua = LWP::UserAgent->new; my $response = $ua->request($request); #my $pattern = qr/foo/g; foreach ($response->content) { print "DEBUG: $_" if $debug; #exit 0 if /$pattern/; exit 0 if /$session/; } exit 1; --=_pogo02.pogozone.net-18935-1065381035-0001-2 Content-Type: text/plain; name="checkrad.patch"; charset=iso-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="checkrad.patch" --- checkrad.pl.in.old Sun Oct 5 11:42:15 2003 +++ checkrad.pl.in Sun Oct 5 11:42:22 2003 @@ -1161,6 +1161,20 @@ ($login eq "$ARGV[3]\@$realm") ? 1 : 0; } +sub exec_extern +{ + my ($extern) = ($ARGV[0] =~ /^exec\|(.*)/); + my @args = @ARGV; + shift @args; + + print LOG " exec extern $extern " . join(' ', @args) . "\n" if ($debug); + $ret = system($extern, @args) >> 8; + print LOG " exec extern returned $ret\n" if ($debug); + $ret = 2 if ($ret > 1); + + return $ret; +} + ############################################################################### @@ -1230,6 +1244,8 @@ $ret = &bay_finger; } elsif ($ARGV[0] eq 'cisco_l2tp'){ $ret = &cisco_l2tp_snmp; +} elsif ($ARGV[0] =~ /^exec\|/){ + $ret = &exec_extern; } elsif ($ARGV[0] eq 'other') { $ret = 1; } else { --=_pogo02.pogozone.net-18935-1065381035-0001-2 Content-Type: text/plain; name="clients.conf.sample"; charset=iso-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="clients.conf.sample" # # SAPMLE: clients.conf - client configuration directives # ####################################################################### client 192.168.0.1 { secret = nocat shortname = nocat nastype = exec|/usr/local/nocat/bin/checknocat.pl } --=_pogo02.pogozone.net-18935-1065381035-0001-2-- From rob at nocat.net Sun Oct 5 20:42:24 2003 From: rob at nocat.net (Rob Flickenger) Date: Sun, 5 Oct 2003 12:42:24 -0700 Subject: [NoCat] status of nocat? In-Reply-To: <20031003120959.GA43106@enigma.ie> Message-ID: <0B1FA63D-F76C-11D7-AD71-000393843BC2@nocat.net> On Friday, October 3, 2003, at 05:09 AM, Niall Richard Murphy wrote: > On Fri, Oct 03, 2003 at 05:53:16AM +0700, Brynjar Hauksson wrote: > > Brynjar and others, > >> I???m a bit worried about the progress of the Nocat system and there >> are some questions I???d really like to get answered: > > It's clear that the founders of NoCat have a lot on their hands at the > moment; Indeed. At the moment, Schuyler is in Europe and I'm about to head to CA for a week. But generally speaking, yeah, we've been pretty busy with other projects. We've had a couple of volunteers to help integrate patches and keep the momentum going, but it seems like we're all just too busy to really keep up with the contributions as well as we could. I believe Schuyler has been working on NoCatSplash with the thought that it will eventually replace NoCatAuth. Since it doesn't use perl, it will probably eliminate the heavy load problems mentioned earlier. It works fine for open mode right now, but the full authentication mechanism isn't implemented yet. Unfortunately, I think the perl version is about as tight as it's ever going to be. We've also been kicking around the idea of eliminating the PGP requirements, and just going with a straight SSL (or other crypto) implementation. The fewer external dependencies, the easier it will be for people to install and run the thing. But keep in mind that the landscape of the problem has changed in the last couple of years. It seems like there is a lot of interest in using it to build private networks (RADIUS back end, accounting, running SameMachine, etc.) and frankly, that's not what we had in mind when we designed it. We tried to design it so that many people could roll out their own gateways without coordinating with each other, all using the same Auth server, without betraying the trust model. That way, new gateways could come online, and users could trust that they weren't giving away their credentials to a possibly rogue gateway. We also assumed that people wouldn't run open gateways unless they could identify who was on the other end (which, two years and several million open APs later) is decidedly *not* the case. If you assume that you own all of the gateways and the authentication server (and that you're talking to an established RADIUS store), then the problem looks very different. Hell, with the hardware Via and others are cranking out now, you could conceivably throw SSL on each gateway and call it a day. Funny what a couple of years under Moore's law will do to a problem. So, to stem this rambling email, here are my recommendations: * NoCatSplash will eventually rule them all. But that will take a while. If you're going to work on NoCat, that's the one to throw time at. I think we're at our limits of what perl can do for us on a large scale. * In the meantime, there are a bunch of patches that seem to work, but haven't been integrated into the main tree yet, Schuyler is out for at least a week, and I'm not the man to do it. Are they in the nightly, and just not out in a release yet? Kurt? Tom? Little help? * If you want to run NoCatAuth the simplest way possible (even with a guardian watchdog (init) that restarts the gateway if it dies), try pebble: http://nycwireless.net/pebble/ I hope to regroup with Schuyler after he gets back and see where we want to go next with it. You're certainly correct, ten months between minor releases is a LONG time. Pity we're not paid to make releases. =) --Rob From kstar at cpan.org Sun Oct 5 23:54:50 2003 From: kstar at cpan.org (Kurt Starsinic) Date: Sun, 5 Oct 2003 18:54:50 -0400 Subject: [NoCat] status of nocat? In-Reply-To: <0B1FA63D-F76C-11D7-AD71-000393843BC2@nocat.net> References: <20031003120959.GA43106@enigma.ie> <0B1FA63D-F76C-11D7-AD71-000393843BC2@nocat.net> Message-ID: <20031005225450.GC4822@verizon.net> On Oct 05, Rob Flickenger wrote: > On Friday, October 3, 2003, at 05:09 AM, Niall Richard Murphy wrote: > > >On Fri, Oct 03, 2003 at 05:53:16AM +0700, Brynjar Hauksson wrote: > > > >Brynjar and others, > > > >>I???m a bit worried about the progress of the Nocat system and there > >>are some questions I???d really like to get answered: > > > >It's clear that the founders of NoCat have a lot on their hands at the > >moment; > > Indeed. At the moment, Schuyler is in Europe and I'm about to head to > CA for a week. But generally speaking, yeah, we've been pretty busy > with other projects. We've had a couple of volunteers to help > integrate patches and keep the momentum going, but it seems like we're > all just too busy to really keep up with the contributions as well as > we could. Yes, I'm one of said volunteers. I've been busy with Real Life, but also I've had a large number of NoCat patches I've been trying to reconcile with each other. I'm trying to get an upload done soon. - Kurt From tfd at vodafone.es Mon Oct 6 13:41:12 2003 From: tfd at vodafone.es (Toni dlF. Diaz) Date: Mon, 06 Oct 2003 14:41:12 +0200 Subject: [NoCat] NoCat SameMachine: How To? In-Reply-To: <23e7923fe2.23fe223e79@optonline.net> References: <23e7923fe2.23fe223e79@optonline.net> Message-ID: <1065444072.1470.43.camel@flame> English version is already available: http://blyx.com/public/wireless/nocatbox/nocatbox-howto-en.pdf Toni Blyx.com El mar, 23-09-2003 a las 16:53, pachai@optonline.net escribi=C3=B3: > >>>Eric CARCAILLON =20 > >>>I wrote a doc but it is in French.... >=20 > >>>From: "Toni dlF. Diaz" > >>> I wrote a doc in spanish and I'm working to translate it to english >=20 > It seems to me, if both of these documents get translated into English, > we can compare them - they should turn out identical, right? >=20 > Seriously, we would be greatful for either or both >=20 >=20 >=20 > _______________________________________________ > NoCat mailing list > NoCat@lists.nocat.net > http://lists.nocat.net/mailman/listinfo/nocat From ANDY at ceplus.de Mon Oct 6 17:52:00 2003 From: ANDY at ceplus.de (Andreas Moehrlein) Date: Mon, 6 Oct 2003 18:52:00 +0200 Subject: [NoCat] NoCat crashes Message-ID: <3F4E418D@leto.ceplus.de> > >interesting... at what rate per second do you reload the statuspage when you >say "permanently"? 2-5 times /sec > >which OS and, more interesting, which version of perl do you use? SuSE 8.2, Perl v5.8.0 > >BTW: there's not only a second gateway process, they are lots of children >under heavy use. Yes - but those ones are not permanently in the process list. Andy From karl.gaissmaier at kiz.uni-ulm.de Tue Oct 7 08:52:17 2003 From: karl.gaissmaier at kiz.uni-ulm.de (Karl Gaissmaier) Date: Tue, 07 Oct 2003 09:52:17 +0200 Subject: [NoCat] Some hints about the crashes, question to the original authors Message-ID: <3F8270B1.5070800@kiz.uni-ulm.de> Dear NoCatAuth maintainers, I'm in the process of tracing the crashes. Yesterday we had a SEGV signal, now we added use sigtrap qw(stack-trace untrapped); in the code, perhaps we can get a significant pattern when and what crashes the gateway. and I changed in Gateway.pm $SIG{CHILD} = 'IGNORE'; # reaping is done by OS and disabled the reaper code in it # See if any kids have expired, reap zombies #if ( $kids ) { # 1 until ( wait == -1 ); # $kids = 0; #} Additionally I've detected one piece of code looking suspicious in Gateway.pm for me: sub accept_child { my ($self, $listen) = @_; my $r = read( $listen, my $msg, 500_000 ); # arbitrary limit if ($r) { # The child process has news about a peer. I don't know why the coders didn't just use: sub accept_child { my ($self, $listen) = @_; { local $/ = undef; # slurp mode my $msg = <$listen>; # reading notification from child via pipe } # check the msg and error conditions The read function is implemented with fread(3) or read(2) and will restart if signal's interrupt this library func. There is a lot of mem management reserving 500_000 bytes during read() and shrinking it to the correct length. If this call is restarted by a signal, perhaps something in the universe goes wrong (everything is only hard- and software, and already my mother told me not to play with it) and perhaps we catch a SEGV. Who coded this read() function in Gateway.pm? Perhaps he could tell us something about the background why he has choosen this approach? Be aware, these are only guesses and no certainty! Regards Charly -- Karl Gaissmaier KIZ/Infrastructure, University of Ulm, Germany Email:karl.gaissmaier@kiz.uni-ulm.de Service Group Network Tel.: ++49 731 50-22499 From karl.gaissmaier at kiz.uni-ulm.de Tue Oct 7 08:49:23 2003 From: karl.gaissmaier at kiz.uni-ulm.de (Karl Gaissmaier) Date: Tue, 07 Oct 2003 09:49:23 +0200 Subject: [NoCat] NoCat crashes In-Reply-To: <3F4E418D@leto.ceplus.de> References: <3F4E418D@leto.ceplus.de> Message-ID: <3F827003.9080203@kiz.uni-ulm.de> Hi Andi, Andreas Moehrlein schrieb: >>interesting... at what rate per second do you reload the statuspage when you >>say "permanently"? ... > 2-5 times /sec ... > >>which OS and, more interesting, which version of perl do you use? ... > SuSE 8.2, > Perl v5.8.0 > > >>BTW: there's not only a second gateway process, they are lots of children >>under heavy use. > > > Yes - but those ones are not permanently in the process list. hmmm, how to you start the gateway process? If you start it with -D Flag, you will see 2 permanent running processes. Could you send the putput of ps with the gateway processes to see if they are related (pid's, ppid's). Regards Charly -- Karl Gaissmaier KIZ/Infrastructure, University of Ulm, Germany Email:karl.gaissmaier@kiz.uni-ulm.de Service Group Network Tel.: ++49 731 50-22499 From clunymark at yahoo.co.uk Tue Oct 7 11:09:29 2003 From: clunymark at yahoo.co.uk (Mark) Date: Tue, 07 Oct 2003 11:09:29 +0100 Subject: [NoCat] Clients always redirected to login page References: Message-ID: <3F8290D9.7020307@yahoo.co.uk> After I was running a NoCatAuth test environment successfully I have tried to get NoCat running on our public internet access point. The problem: Although the configuration is the same as in the test environment, Clients are getting redirected to the login page instead of the desired URL after a successful login. I have already checked the logfiles and the iptables ruleset without finding anything useful to solve the problem. I am running NoCat on SuSE linux 8.1 and authserver and gateway are running on the same machine in both environments. Any Ideas? Mark From schuyler at oreilly.com Tue Oct 7 14:19:21 2003 From: schuyler at oreilly.com (Schuyler Erle) Date: Tue, 7 Oct 2003 06:19:21 -0700 Subject: [NoCat] Some hints about the crashes, question to the original authors In-Reply-To: <3F8270B1.5070800@kiz.uni-ulm.de> References: <3F8270B1.5070800@kiz.uni-ulm.de> Message-ID: <20031007131921.GB15487@oreillynet.com> * On 7-Oct-2003 at 1:06AM PDT, Karl Gaissmaier said: > > There is a lot of mem management reserving 500_000 bytes during > read() and shrinking it to the correct length. > If this call is restarted by a signal, perhaps something in the > universe goes wrong (everything is only hard- and software, > and already my mother told me not to play with it) and perhaps > we catch a SEGV. > > Who coded this read() function in Gateway.pm? > Perhaps he could tell us something about the background > why he has choosen this approach? That was me, and I have no excuse. You're absolutely right - do { local $/; <$fh> } is a much more sensible approach. This is some great work you've done, Charly - I say try the change and see if it still segfaults. I really think you're on to something here. SDE From karl.gaissmaier at kiz.uni-ulm.de Tue Oct 7 23:13:22 2003 From: karl.gaissmaier at kiz.uni-ulm.de (Karl Gaissmaier) Date: Wed, 08 Oct 2003 00:13:22 +0200 Subject: [NoCat] Some hints about the crashes, question to the original authors References: <3F8270B1.5070800@kiz.uni-ulm.de> <20031007131921.GB15487@oreillynet.com> Message-ID: <3F833A81.C8A2D90E@kiz.uni-ulm.de> Dies ist eine mehrteilige Nachricht im MIME-Format. --------------53FF6C6C9CC6FAA686621567 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Hi Erle, Schuyler Erle schrieb: ... > > Who coded this read() function in Gateway.pm? > > Perhaps he could tell us something about the background > > why he has choosen this approach? > > That was me, and I have no excuse. You're absolutely right - do { > local $/; <$fh> } is a much more sensible approach. This is some great > work you've done, Charly - I say try the change and see if it still > segfaults. I really think you're on to something here. hmmm, I tried it a little bit further and created a stress test script, playing with this construct. After running this test more than 1 hour with 500 simultaneous childs I could not reproduce this SEGV or any other strong behavior. The stress test script is attached. The only thing I've seen is, that the reaper code with the wait doesn't come back as expected, even if you 'IGNORE' the SIGCHLD. Perhaps we should further investigate in it, but I think this wait isn't useful at all (at least on a modern OS) with SIGCHLD on IGNORE. I disabled the reaper code already in my production version. After IGNORE on SIGCHLD und disabling the reaper my gateway is now running more than 36h without interruption (knocking on wood!). I'll post further knowledge to this list if I've more facts. Regards Charly BTW: No reason for excusion about your code, thanks for NoCatAuth!! even if it is a little bit outdated nowadays (for my needs). I learned a lot dealing with it about captive gateways. I'll write a shrink wrapped one with the 'same machine' approach, what makes things really easy in comparison to your more general approach. -- Karl Gaissmaier University of Ulm, Germany Email:karl.gaissmaier@kiz.uni-ulm.de KIZ, Service Group Network --------------53FF6C6C9CC6FAA686621567 Content-Type: application/x-perl; name="crashtest.pl" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="crashtest.pl" #!/usr/bin/perl # Karl Gaissmaier karl.gaissmaier@kiz.uni-ulm.de # Use it on your own risk! # This is a stress program in order to check the behavior # with a lot of childs talking back to the parent # via a pipe. # This piece of code shall localize problems we've seen # with NoCatAuth under moderate/heavy load and is of no # application without relation to NoCatAuth. use strict; use warnings; use sigtrap qw(stack-trace untrapped normal-signals error-signals); # cmdline arg defines how many kids to produce, permanently my $nr_kids = shift or die "Usage: $0 nr_of_childs\n"; print "try to have $nr_kids kids concurrently running\n"; use Time::HiRes qw( usleep ); use IO::Select; # used for the IO::Handle pool use IO::Pipe; my $pool = IO::Select->new or die "Can't create select pool: $!\n"; my @ready_fhs; my $sel_timeout = 10; my $zombies; #$SIG{CHLD} = sub { $zombies++ }; $SIG{CHLD} = 'IGNORE'; # main loop while (1) { create_kids(); print "waiting for can_read or timeout\n"; @ready_fhs = $pool->can_read($sel_timeout); foreach my $fh (@ready_fhs) { accept_kids_message($fh); } # reaper # if ($zombies) { # print "Reaping dead child(s)\n"; # 1 until ( wait == -1 ); # $zombies = 0; # print "Reaping finished\n"; # } } sub create_kids { # $registered is identical with # running childs my $registered = $pool->count; print "back from can_read, pool has $registered FH(s)\n"; # restart random number of childs up to $nr_kids for ( 1 .. int rand $nr_kids - $registered ) { # double check not to start more childs as $nr_kids my $registered = $pool->count; last if $registered >= $nr_kids; # create new pipe my $pipe = IO::Pipe->new or die "Can't create a pipe: $!\n"; # fork a child talking back to parent via pipe my $pid = fork; if ( defined($pid) and $pid > 0 ) { # parent print "child with pid $pid forked\n"; $pipe->reader or die "Can't bless to reader: $!\n"; $pool->add($pipe) or die "Can't add pipe to pool: $!\n"; } elsif ( defined($pid) and $pid == 0 ) { # child $pipe->writer or die "Can't bless to writer: $!\n"; # produce some randomness writing to parent usleep int rand(3_000_000); # produce some randomness in message length print $pipe "$$ " x int rand(10) or die "Can't write to pipe: $!\n"; exit; # child finished } else { warn "Can't fork: $!\n"; last; } } } sub accept_kids_message { my $pipe = shift; # this is the test whether this construct out from Gateway.pm is # fault-prone with a lot of signals my $r = read( $pipe, my $msg, 500_000 ); if ($r) { # process childs notify print "Got message from: $msg\n"; } elsif ( not defined $r ) { warn "Can't read from child: $!"; } $pool->remove($pipe) or die "Can't remove pipe from pool: $!\n"; $pipe->close or die "Can't close pipe: $!\n"; } # vim: cindent sw=2 sts=2 sm --------------53FF6C6C9CC6FAA686621567-- From eb2bjx at hispavista.com Thu Oct 9 01:04:23 2003 From: eb2bjx at hispavista.com (eb2bjx@hispavista.com) Date: Thu, 09 Oct 2003 02:04:23 +0200 Subject: [NoCat] Help with throttling (HTB) Message-ID: This is a multi-part MIME message --_===463255992====hispavista.com===_ Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable X-MIME-Autoconverted: from 8bit to quoted-printable by hv143.hispavista.com id CAA24628 Hi all, Ive been experimenting with HTB to manage nocat traffic. My connection is a 256Kbits/128Kbits ADSL. When loading the attached script, I get the following error messages: HTB: quantum of class 10010 is small. Consider r2q change. HTB: quantum of class 10011 is small. Consider r2q change. HTB: quantum of class 10012 is small. Consider r2q change. HTB: quantum of class 10020 is small. Consider r2q change. HTB: quantum of class 10021 is small. Consider r2q change. HTB: quantum of class 10022 is small. Consider r2q change. I've searching documentation but I'm not a HBT guru....in my opinion there is something wrong with some defined traffic rates. I attach my script. Any help? Thanks! -------------------------------------------------------------------------= ------------------------------- =BFQuieres conocer tu futuro? Te leemos las cartas de forma personalizada= en el 906 150 305 http://www.miwebcam.com/dialers/hispatarot/ -------------------------------------------------------------------------= ------------------------------- =BFConoces eBay, el mayor centro de compra y venta en internet? M=F3viles, port=E1tiles, pda=B4s, cd=B4s, c=E1maras digitales, videocamar= as... =A1Compra ahora a los mejores precios! http://ebay.hispavista.com/ --_===463255992====hispavista.com===_ Content-Type: text/plain Content-Disposition: attachment; filename="throttle.fw" Content-Transfer-Encoding: base64 IyEvYmluL3NoDQojIw0KIw0KIyB0aHJvdHRsZS5mdzogU2V0IHRoZSBiYW5kd2lkdGggcG9s aWN5LCBiYXNlZCBvbiBGV01BUksNCiMNCiMgU2V0IHlvdXIgbGltaXRzIGluIHRoZSBkZWZp bmVzIGF0IHRoZSB0b3AuICBTb21lZGF5IHRoaXMgd2lsbCBiZQ0KIyBpbnRlZ3JhdGVkIGlu dG8gdGhlIG5vY2F0LmNvbmYuLi4NCiMNCiMjDQoNCiMgTm90ZTogeW91ciBQQVRIIGlzIGlu aGVyaXRlZCBmcm9tIHRoZSBnYXRld2F5IHByb2Nlc3MNCiMNCg0KIyBOb3RlOiBhbGwgbnVt YmVycyBhcmUgaW4ga2JpdCwgb21pdCB0aGUga2JpdCBvciBlbHNlIGZhaWx1cmUhDQoNCklu dGVybmFsRGV2aWNlPWV0aDENCkV4dGVybmFsRGV2aWNlPWV0aDANCg0KIyBPdXRib3VuZCB0 cmFmZmljDQoNCiMgT3V0Ym91bmQgTWluaW11bXMNCg0KIyBEZWZpbmUgdGhlIG1pbmltdW0g ZGF0YXJhdGVzIHRoYXQgZWFjaCBjbGFzcyBvZiB1c2VyIHdpbGwgYmUgYWJsZSB0byBnZXQN CiMgd2hlbiB0aGUgc3lzdGVtIGlzIGZ1bGx5IGxvYWRlZC4gIE5vdGUgdGhhdCB0aGUgc3Vt IG9mIHRoZXNlIHZhbHVlcyBzaG91bGQNCiMgYmUgZXF1YWwgdG8geW91ciBvdXRib3VuZCBi YW5kd2lkdGguICBJZiBhIHBhcnRpY3VsYXIgY2xhc3MgaXMgbm90IHVzaW5nDQojIGl0cyBi YW5kd2lkdGgsIGl0IHdpbGwgYmUgZ2l2ZW4gdG8gdGhlIG90aGVyIGNsYXNzZXMgYmFzZWQg b24gdGhlDQojIHByaW9yaXRpemF0aW9uIHNjaGVtZSwgYW5kIG9uIHRoZSBtYXhpbXVtIGxp bWl0cyBvZiB0aGUgb3RoZXIgY2xhc3Nlcy4NCg0KT1dORVJfTE9XX01JTl9VUD0yMCAgICAg IyBNaW5pbXVtIHJhdGUgZm9yIG93bmVyJ3MgbG93IHByaW9yaXR5IHRyYWZmaWMNCk9XTkVS X0hJR0hfTUlOX1VQPTUwICAgICMgTWluaW11bSByYXRlIGZvciBvd25lcidzIGhpZ2ggcHJp b3JpdHkgdHJhZmZpYw0KDQpDT09QX0xPV19NSU5fVVA9MTUgICAgICAjIE1pbmltdW0gcmF0 ZSBmb3IgY29vcCBsb3cgcHJpb3JpdHkgdHJhZmZpYw0KQ09PUF9ISUdIX01JTl9VUD0zNSAg ICAgIyBNaW5pbXVtIHJhdGUgZm9yIGNvb3AgaGlnaCBwcmlvcml0eSB0cmFmZmljDQoNClBV QkxJQ19MT1dfTUlOX1VQPTAgICAgICMgTWluaW11bSByYXRlIGZvciBwdWJsaWMgbG93IHBy aW9yaXR5IHRyYWZmaWMNClBVQkxJQ19ISUdIX01JTl9VUD0wICAgICMgTWluaW11bSByYXRl IGZvciBwdWJsaWMgaGlnaCBwcmlvcml0eSB0cmFmZmljDQoNCiMgT3V0Ym91bmQgdHJhZmZp YyBjYXBzDQoNCiMgVGhpcyBzZWN0aW9uIGFsbG93cyB0aGUgY2FwcGluZyBvZiBvdXRib3Vu ZCB0cmFmZmljLiAgV2l0aCB0aGlzIGZpbHRlciwNCiMgdXNlcnMgYXJlIGd1YXJhbnRlZWQg YXQgbGVhc3QgdGhlIG1pbmltdW0gcmF0ZSwgYW5kIGF0IG1vc3QgdGhlIG1heCByYXRlLg0K IyBubyBudW1iZXIgaGVyZSBzaG91bGQgZXhjZWVkIHlvdXIgYWN0dWFsIGRhdGEgcmF0ZSB0 byB0aGUgbmV0d29yay4NCg0KT1dORVJfTE9XX01BWF9VUD0zMCAgICAgIyBNYXhpbXVtIHJh dGUgZm9yIG93bmVyJ3MgbG93IHByaW9yaXR5IHRyYWZmaWMNCk9XTkVSX0hJR0hfTUFYX1VQ PTcwICAgICMgTWF4aW11bSByYXRlIGZvciBvd25lcidzIGhpZ2ggcHJpb3JpdHkgdHJhZmZp Yw0KDQpPV05FUl9NQVhfVVA9NzAgICAgICAgICAjIG1heGltdW0gdG90YWwgcmF0ZSBmb3Ig dGhlIG93bmVyLiBTaG91bGQgYmUgYXQgbGVhc3QNCiAgICAgICAgICAgICAgICAgICAgICAg ICMgdGhlIG1heCBvZiB0aGUgaGlnaCBhbmQgbG93IHByaW9yaXR5LCBhbmQgbGVzcyB0aGVu DQogICAgICAgICAgICAgICAgICAgICAgICAjIHRoZWlyIHN1bS4NCg0KQ09PUF9MT1dfTUFY X1VQPTIwICAgICAgIyBNYXhpbXVtIHJhdGUgZm9yIGNvb3AgbG93IHByaW9yaXR5IHRyYWZm aWMNCkNPT1BfSElHSF9NQVhfVVA9NTAgICAgICMgTWF4aW11bSByYXRlIGZvciBjb29wIGhp Z2ggcHJpb3JpdHkgdHJhZmZpYw0KDQoNCkNPT1BfTUFYX1VQPTUwICAgICAgICAgICMgTWF4 IHRvdGFsIHJhdGUgZm9yIGNvb3AuIFNpbWlsYXIgdG8gT1dORVJfTUFYX1VQDQoNClBVQkxJ Q19MT1dfTUFYX1VQPTAgICAgICMgTWF4aW11bSByYXRlIGZvciBwdWJsaWMgbG93IHByaW9y aXR5IHRyYWZmaWMNClBVQkxJQ19ISUdIX01BWF9VUD0wICAgICMgbWF4aW11bSByYXRlIGZv ciBwdWJsaWMgaGlnaCBwcmlvcml0eSB0cmFmZmljDQoNCg0KUFVCTElDX01BWF9VUD0wICAg ICAgICAgIyBNYXggdG90YWwgcmF0ZSBmb3IgcHVibGljLiBTaW1pbGFyIHRvIE9XTkVSX01B WF9VUA0KDQoNCiMgSW5ib3VuZCBUcmFmZmljDQoNCiMgVGhpcyBzZWN0aW9uIGNvbmZpZ3Vy ZXMgdGhlIGluYm91bmQgdHJhZmZpYyBzaGFwaW5nLiAgQXQgdGhpcyBwb2ludCwgdGhlcmUg YXJlDQojIG9ubHkgdGhyZWUgY2xhc3NlcyBvZiBzZXJ2aWNlIGZvciBpbmJvdW5kOiBvd25l ciwgY29vcCwgYW5kIHB1YmxpYy4NCg0KIyBNaW5pbXVtIFJhdGVzDQoNCiMgTm90ZTogdGhl IHN1bSBvZiB0aGUgbWluaW11bSBkb3dubG9hZCByYXRlcyBzaG91bGQgYmUgZXF1YWwgdG8g eW91ciBhY3R1YWwNCiMgaW5ib3VuZCBkYXRhIHJhdGUuICBBZ2FpbiwgYW55IHVudXNlZCBi YW5kd2lkdGggd2lsbCBiZSBkaXZpZGVkIGFzIHBlciB0aGUNCiMgcnVsZXMgZGVmaW5lZC4N Cg0KT1dORVJfTUlOX0RPV049MTUwICAgICAgICAgICAgICAjIE1pbmltdW0gaW5ib3VuZCBi YW5kd2lkdGggZm9yIHRoZSBvd25lcg0KDQpDT09QX01JTl9ET1dOPTEwMCAgICAgICAgICAg ICAgICMgTWluaW11bSBpbmJvdW5kIGJhbmR3aWR0aCBmb3IgdGhlIGNvb3AgdXNlcg0KDQpQ VUJMSUNfTUlOX0RPV049MCAgICAgICAgICAgICAgICMgTWluaW11bSBpbmJvdW5kIGJhbmR3 aWR0aCBmb3IgcHVibGljIHVzZXJzDQoNCiMgTWF4aW11bSBSYXRlcw0KDQojIFRoZXNlIGFy ZSB0aGUgaGFyZCBjYXBzIHRoYXQgd2lsbCBiZSBwdXQgYmFuZHdpZHRoLg0KDQpPV05FUl9N QVhfRE9XTj0yNTAgICAgICAgICAgICAgICMgTWF4aW11bSBpbmJvdW5kIGJhbmR3aWR0aCBm b3IgdGhlIG93bmVyDQoNCkNPT1BfTUFYX0RPV049MTgwICAgICAgICAgICAgICAgIyBNYXhp bXVtIGluYm91bmQgYmFuZHdpZHRoIGZvciBjb29wIHVzZXJzDQoNClBVQkxJQ19NQVhfRE9X Tj0wICAgICAgICAgICAgICAgIyBNYXhpbXVtIGluYm91bmQgYmFuZHdpZHRoIGZvciBwdWJs aWMgdXNlcnMNCg0KDQojIE1pc2Mgb3B0aW9ucyBmb3Igb3duZXJzLCBjb29wLCBhbmQgcHVi bGljLiAgbm90IGN1cnJlbnRseSB1c2VkLg0KDQpPV05FUl9PUFRJT05TPSIiDQoNCg0KQ09P UF9PUFRJT05TPSIiDQoNCg0KUFVCTElDX09QVElPTlM9IiINCg0KIyBMb3cgcHJpb3JpdHkg ZGVzdCBwb3J0cw0KDQojIGFsbCB0cmFmZmljIGdvaW5nIHRvIHRoZXNlIHBvcnRzIHdpbGwg YmUgZGVjbGFyZWQgbG93IHByaW9yaXR5Lg0KTE9XX1BSSU9SSVRZX1BPUlRTPSI2ODgxIDY4 ODIgNjg4MyA2ODg0IDY4ODUgNjg4NiA2ODg3IDY4ODggNjg4OSA2MzQ2IDYzNTcgNjM0OCIN Cg0KDQojIE1hdGggc2VjdGlvbjogQ2FsY3VsYXRlcyBldmVyeXRoaW5nIG91dCBzbyB0aGF0 IGl0IHdpbGwgd29yayBwcm9wZXJseS4NCg0KIyBkZWZpbmUgdGhlIHB1YmxpYyBtaW5pbXVt IG91dGJvdW5kIGJhbmR3aWR0aA0KUFVCTElDX01JTl9VUD0kKCgkUFVCTElDX0xPV19NSU5f VVAgKyAkUFVCTElDX0hJR0hfTUlOX1VQKSkNCg0KIyBkZWZpbmUgdGhlIGNvb3AgbWluaW11 bSBvdXRib3VuZCBiYW5kd2lkdGgNCkNPT1BfTUlOX1VQPSQoKCRDT09QX0xPV19NSU5fVVAg KyAkQ09PUF9ISUdIX01JTl9VUCkpDQoNCiMgZGVmaW5lIHRoZSBvd25lciBtaW5pbXVtIG91 dGJvdW5kIGJhbmR3aWR0aA0KT1dORVJfTUlOX1VQPSQoKCRPV05FUl9MT1dfTUlOX1VQICsg JE9XTkVSX0hJR0hfTUlOX1VQKSkNCg0KDQojIHRoZSB0b3RhbCBkb3dubG9hZCBzcGVlZCBz aG91bGQgYmUgdGhlIHN1bWUgb2YgYWxsIHRoZSBtaW5pbXVtcy4gIFVudXNlZCBiYW5kd2lk dGggd2lsbA0KDQojIGJlIHNoYXJlZCBhcyBwZXIgdGhlIGNlaWxpbmdzDQpUT1RBTF9ET1dO PSQoKCRQVUJMSUNfTUlOX0RPV04gKyAkQ09PUF9NSU5fRE9XTiArICRPV05FUl9NSU5fRE9X TikpDQoNCg0KIyBUb3RhbCBvdXRib3VuZCBiYW5kd2lkdGgNClRPVEFMX1VQPSQoKCRQVUJM SUNfTUlOX1VQICsgJENPT1BfTUlOX1VQICsgJE9XTkVSX01JTl9VUCkpDQoNCg0KTUVUSE9E PSJzZnEgcXVhbnR1bSAxNTE0YiBwZXJ0dXJiIDE1Ig0KTUVUSE9EX0hJR0g9InByaW8gYmFu ZHMgNCBwcmlvbWFwIDIgMyAzIDMgMiAzIDEgMSAyIDIgMiAyIDIgMiAyIDIiDQoNCg0KIyMN CiMgTm93LCB0aGUgcnVsZXMNCiMjDQoNCiMNCiMgRmlyc3QsIGZsdXNoIGFueSBleGlzdGlu ZyByb290IHF1ZXVlcw0KIw0KdGMgcWRpc2MgZGVsIGRldiAkSW50ZXJuYWxEZXZpY2Ugcm9v dCBoYW5kbGUgMToNCnRjIHFkaXNjIGRlbCBkZXYgJEV4dGVybmFsRGV2aWNlIHJvb3QgaGFu ZGxlIDE6DQoNCiMNCiMgU3BlY2lmeSB0aGUgcXVldWUgZGlzY2lwbGluZSBmb3IgYm90aCBp bnRlcmZhY2VzDQojDQp0YyBxZGlzYyBhZGQgZGV2ICRJbnRlcm5hbERldmljZSByb290IGhh bmRsZSAxOiBodGIgZGVmYXVsdCAxDQp0YyBxZGlzYyBhZGQgZGV2ICRFeHRlcm5hbERldmlj ZSByb290IGhhbmRsZSAxOiBodGIgZGVmYXVsdCAxMQ0KDQojDQojIFNwZWNpZnkgdGhlIHJv b3QgY2xhc3MgKGZpbGxpbmcgYWxsIGJhbmR3aWR0aC4pDQojIEFsbCBvdGhlciBjbGFzc2Vz IGRlc2NlbmQgZnJvbSB0aGVzZS4NCiMNCnRjIGNsYXNzIGFkZCBkZXYgJEludGVybmFsRGV2 aWNlIFwNCiAgICBwYXJlbnQgMTogY2xhc3NpZCAxOjEgaHRiIHJhdGUgJFRPVEFMX0RPV05c a2JpdCBjZWlsICRUT1RBTF9ET1dOXGtiaXQNCg0KdGMgY2xhc3MgYWRkIGRldiAkRXh0ZXJu YWxEZXZpY2UgXA0KICAgIHBhcmVudCAxOiBjbGFzc2lkIDE6MSBodGIgcmF0ZSAkVE9UQUxf VVBca2JpdCBjZWlsICRUT1RBTF9VUFxrYml0DQoNCiMjDQojIERlZmluZSB0aGUgdXNlciBj bGFzc2VzDQojIw0KDQojDQojIE93bmVyIGNsYXNzDQojDQp0YyBjbGFzcyBhZGQgZGV2ICRJ bnRlcm5hbERldmljZSBcDQogICAgcGFyZW50IDE6MSBjbGFzc2lkIDE6MTAgaHRiIHJhdGUg JE9XTkVSX01JTl9ET1dOXGtiaXQgXA0KICAgIGNlaWwgJE9XTkVSX01BWF9ET1dOXGtiaXQg cHJpbyAxDQoNCnRjIGNsYXNzIGFkZCBkZXYgJEV4dGVybmFsRGV2aWNlIFwNCiAgICBwYXJl bnQgMToxIGNsYXNzaWQgMToxMCBodGIgcmF0ZSAkT1dORVJfTUlOX1VQXGtiaXQgXA0KICAg IGNlaWwgJE9XTkVSX01BWF9VUFxrYml0IHByaW8gMQ0KDQp0YyBjbGFzcyBhZGQgZGV2ICRF eHRlcm5hbERldmljZSBcDQogICAgcGFyZW50IDE6MTAgY2xhc3NpZCAxOjExIGh0YiByYXRl ICRPV05FUl9ISUdIX01JTl9VUFxrYml0IFwNCiAgICBjZWlsICRPV05FUl9ISUdIX01BWF9V UFxrYml0IHByaW8gMQ0KDQp0YyBjbGFzcyBhZGQgZGV2ICRFeHRlcm5hbERldmljZSBcDQog ICAgcGFyZW50IDE6MTAgY2xhc3NpZCAxOjEyIGh0YiByYXRlICRPV05FUl9MT1dfTUlOX1VQ XGtiaXQgXA0KICAgIGNlaWwgJE9XTkVSX0xPV19NQVhfVVBca2JpdCBwcmlvIDINCg0KIw0K IyBDb29wIGNsYXNzDQojDQoNCnRjIGNsYXNzIGFkZCBkZXYgJEludGVybmFsRGV2aWNlIFwN CiAgICBwYXJlbnQgMToxIGNsYXNzaWQgMToyMCBodGIgcmF0ZSAkQ09PUF9NSU5fRE9XTlxr Yml0IFwNCiAgICBjZWlsICRDT09QX01BWF9ET1dOXGtiaXQgcHJpbyAyDQoNCnRjIGNsYXNz IGFkZCBkZXYgJEV4dGVybmFsRGV2aWNlIFwNCiAgICBwYXJlbnQgMToxIGNsYXNzaWQgMToy MCBodGIgcmF0ZSAkQ09PUF9NSU5fVVBca2JpdCBcDQogICAgY2VpbCAkQ09PUF9NQVhfVVBc a2JpdCBwcmlvIDINCg0KdGMgY2xhc3MgYWRkIGRldiAkRXh0ZXJuYWxEZXZpY2UgXA0KICAg IHBhcmVudCAxOjIwIGNsYXNzaWQgMToyMSBodGIgcmF0ZSAkQ09PUF9ISUdIX01JTl9VUFxr Yml0IFwNCiAgICBjZWlsICRDT09QX0hJR0hfTUFYX1VQXGtiaXQgcHJpbyAxDQoNCnRjIGNs YXNzIGFkZCBkZXYgJEV4dGVybmFsRGV2aWNlIFwNCiAgICBwYXJlbnQgMToyMCBjbGFzc2lk IDE6MjIgaHRiIHJhdGUgJENPT1BfTE9XX01JTl9VUFxrYml0IFwNCiAgICBjZWlsICRDT09Q X0xPV19NQVhfVVBca2JpdCBwcmlvIDINCiMNCiMgUHVibGljIGNsYXNzDQojDQoNCnRjIGNs YXNzIGFkZCBkZXYgJEludGVybmFsRGV2aWNlIFwNCiAgICBwYXJlbnQgMToxIGNsYXNzaWQg MTozMCBodGIgcmF0ZSAkUFVCTElDX01JTl9ET1dOXGtiaXQgXA0KICAgIGNlaWwgJFBVQkxJ Q19NQVhfRE9XTlxrYml0IHByaW8gMw0KDQp0YyBjbGFzcyBhZGQgZGV2ICRFeHRlcm5hbERl dmljZSBcDQogICAgcGFyZW50IDE6MSBjbGFzc2lkIDE6MzAgaHRiIHJhdGUgJFBVQkxJQ19N SU5fVVBca2JpdCBcDQogICAgY2VpbCAkUFVCTElDX01BWF9VUFxrYml0IHByaW8gMw0KDQp0 YyBjbGFzcyBhZGQgZGV2ICRFeHRlcm5hbERldmljZSBcDQogICAgcGFyZW50IDE6MzAgY2xh c3NpZCAxOjMxIGh0YiByYXRlICRQVUJMSUNfSElHSF9NSU5fVVBca2JpdCBcDQogICAgY2Vp bCAkUFVCTElDX0hJR0hfTUFYX1VQXGtiaXQgcHJpbyAxDQoNCnRjIGNsYXNzIGFkZCBkZXYg JEV4dGVybmFsRGV2aWNlIFwNCiAgICBwYXJlbnQgMTozMCBjbGFzc2lkIDE6MzIgaHRiIHJh dGUgJFBVQkxJQ19MT1dfTUlOX1VQXGtiaXQgXA0KICAgIGNlaWwgJFBVQkxJQ19MT1dfTUFY X1VQXGtiaXQgcHJpbyAyDQoNCiMjDQojIEFkZCB0aGUgcXVldWUgbWFuYWdlbWVudCBydWxl cw0KIyMNCg0KIyBzZXR1cCB0aGUgaW5ib3VuZCB0cmFmZmljIHNoYXBpbmcNCg0KdGMgcWRp c2MgYWRkIGRldiAkSW50ZXJuYWxEZXZpY2UgcGFyZW50IDE6MTAgJE1FVEhPRA0KdGMgcWRp c2MgYWRkIGRldiAkSW50ZXJuYWxEZXZpY2UgcGFyZW50IDE6MjAgJE1FVEhPRA0KdGMgcWRp c2MgYWRkIGRldiAkSW50ZXJuYWxEZXZpY2UgcGFyZW50IDE6MzAgJE1FVEhPRA0KDQojIHNl dHVwIHRoZSBsb3cgcHJpb3JpdHkgb3V0Ym91bmQgc3R1ZmYNCg0KdGMgcWRpc2MgYWRkIGRl diAkRXh0ZXJuYWxEZXZpY2UgcGFyZW50IDE6MTIgaGFuZGxlIDEyOiAkTUVUSE9EDQp0YyBx ZGlzYyBhZGQgZGV2ICRFeHRlcm5hbERldmljZSBwYXJlbnQgMToyMiBoYW5kbGUgMjI6ICRN RVRIT0QNCnRjIHFkaXNjIGFkZCBkZXYgJEV4dGVybmFsRGV2aWNlIHBhcmVudCAxOjMyIGhh bmRsZSAzMjogJE1FVEhPRA0KDQojIHNldHVwIHRoZSBoaWdoIHByaW9yaXR5IG91dGJvdW5k IHFkaXNrcw0KdGMgcWRpc2MgYWRkIGRldiAkRXh0ZXJuYWxEZXZpY2UgcGFyZW50IDE6MTEg aGFuZGxlIDExOiAkTUVUSE9EX0hJR0gNCnRjIHFkaXNjIGFkZCBkZXYgJEV4dGVybmFsRGV2 aWNlIHBhcmVudCAxOjIxIGhhbmRsZSAyMTogJE1FVEhPRF9ISUdIDQp0YyBxZGlzYyBhZGQg ZGV2ICRFeHRlcm5hbERldmljZSBwYXJlbnQgMTozMSBoYW5kbGUgMzE6ICRNRVRIT0RfSElH SA0KDQojIw0KIyBGaW5hbGx5LCBmaWx0ZXIgZWFjaCBmd21hcmsgdG8gdGhlIGFib3ZlIGRl ZmluZWQgY2xhc3Nlcw0KIyMNCg0KdGMgZmlsdGVyIGFkZCBkZXYgJEludGVybmFsRGV2aWNl IHByb3RvY29sIGlwIHBhcmVudCAxOiBwcmlvIDEgaGFuZGxlIDEgZncgY2xhc3NpZCAxOjEw DQp0YyBmaWx0ZXIgYWRkIGRldiAkSW50ZXJuYWxEZXZpY2UgcHJvdG9jb2wgaXAgcGFyZW50 IDE6IHByaW8gMSBoYW5kbGUgMiBmdyBjbGFzc2lkIDE6MjANCnRjIGZpbHRlciBhZGQgZGV2 ICRJbnRlcm5hbERldmljZSBwcm90b2NvbCBpcCBwYXJlbnQgMTogcHJpbyAxIGhhbmRsZSAz IGZ3IGNsYXNzaWQgMTozMA0KDQp0YyBmaWx0ZXIgYWRkIGRldiAkRXh0ZXJuYWxEZXZpY2Ug cHJvdG9jb2wgaXAgcGFyZW50IDE6IHByaW8gMSBoYW5kbGUgMSBmdyBjbGFzc2lkIDE6MTAN CnRjIGZpbHRlciBhZGQgZGV2ICRFeHRlcm5hbERldmljZSBwcm90b2NvbCBpcCBwYXJlbnQg MTogcHJpbyAxIGhhbmRsZSAyIGZ3IGNsYXNzaWQgMToyMA0KdGMgZmlsdGVyIGFkZCBkZXYg JEV4dGVybmFsRGV2aWNlIHByb3RvY29sIGlwIHBhcmVudCAxOiBwcmlvIDEgaGFuZGxlIDMg ZncgY2xhc3NpZCAxOjMwDQoNCiMgZGVmYXVsdCBhbGwgdHJhZmZpYyB0byBvd25lciBjbGFz cy4NCnRjIGZpbHRlciBhZGQgZGV2ICRFeHRlcm5hbERldmljZSBwcm90b2NvbCBpcCBwYXJl bnQgMTogcHJpbyAyIHUzMiBtYXRjaCBpcCBkc3QgMC4wLjAuMC8wIGNsYXNzaWQgMToxMA0K DQojIGRlZmF1bHQgYWxsIHRyYWZmaWMgdG8gaGlnaCBwcmlvcml0eQ0KdGMgZmlsdGVyIGFk ZCBkZXYgJEV4dGVybmFsRGV2aWNlIHByb3RvY29sIGlwIHBhcmVudCAxOjEwIHByaW8gMTAg dTMyIG1hdGNoIGlwIGRzdCAwLjAuMC4wLzAgY2xhc3NpZCAxOjExDQp0YyBmaWx0ZXIgYWRk IGRldiAkRXh0ZXJuYWxEZXZpY2UgcHJvdG9jb2wgaXAgcGFyZW50IDE6MjAgcHJpbyAxMCB1 MzIgbWF0Y2ggaXAgZHN0IDAuMC4wLjAvMCBjbGFzc2lkIDE6MjENCnRjIGZpbHRlciBhZGQg ZGV2ICRFeHRlcm5hbERldmljZSBwcm90b2NvbCBpcCBwYXJlbnQgMTozMCBwcmlvIDEwIHUz MiBtYXRjaCBpcCBkc3QgMC4wLjAuMC8wIGNsYXNzaWQgMTozMQ0KDQojIGZpbHRlciB0cmFm ZmljIG9mZiB0byB0aGUgbG93IHByaW9yaXR5IHF1ZXVlcy4NCmZvciBwb3J0IGluICRMT1df UFJJT1JJVFlfUE9SVFM7IGRvDQogICAgIyBmaWx0ZXIgYmFzZWQgb24gZGVzdCBwb3J0cw0K ICAgIHRjIGZpbHRlciBhZGQgZGV2ICRFeHRlcm5hbERldmljZSBwcm90b2NvbCBpcCBwYXJl bnQgMToxMCBwcmlvIDEgdTMyIG1hdGNoIFwNCiAgICAgICAgaXAgZHBvcnQgJHBvcnQgMHhm ZmZmIGZsb3dpZCAxOjEyDQogICAgdGMgZmlsdGVyIGFkZCBkZXYgJEV4dGVybmFsRGV2aWNl IHByb3RvY29sIGlwIHBhcmVudCAxOjIwIHByaW8gMSB1MzIgbWF0Y2ggXA0KICAgICAgICBp cCBkcG9ydCAkcG9ydCAweGZmZmYgZmxvd2lkIDE6MjINCiAgICB0YyBmaWx0ZXIgYWRkIGRl diAkRXh0ZXJuYWxEZXZpY2UgcHJvdG9jb2wgaXAgcGFyZW50IDE6MzAgcHJpbyAxIHUzMiBt YXRjaCBcDQogICAgICAgIGlwIGRwb3J0ICRwb3J0IDB4ZmZmZiBmbG93aWQgMTozMg0KDQog ICAgIyBmaWx0ZXIgYmFzZWQgb24gc291cmNlIHBvcnRzDQogICAgdGMgZmlsdGVyIGFkZCBk ZXYgJEV4dGVybmFsRGV2aWNlIHByb3RvY29sIGlwIHBhcmVudCAxOjEwIHByaW8gMSB1MzIg bWF0Y2ggXA0KICAgICAgICBpcCBzcG9ydCAkcG9ydCAweGZmZmYgZmxvd2lkIDE6MTINCiAg ICB0YyBmaWx0ZXIgYWRkIGRldiAkRXh0ZXJuYWxEZXZpY2UgcHJvdG9jb2wgaXAgcGFyZW50 IDE6MjAgcHJpbyAxIHUzMiBtYXRjaCBcDQogICAgICAgIGlwIHNwb3J0ICRwb3J0IDB4ZmZm ZiBmbG93aWQgMToyMg0KICAgIHRjIGZpbHRlciBhZGQgZGV2ICRFeHRlcm5hbERldmljZSBw cm90b2NvbCBpcCBwYXJlbnQgMTozMCBwcmlvIDEgdTMyIG1hdGNoIFwNCiAgICAgICAgaXAg c3BvcnQgJHBvcnQgMHhmZmZmIGZsb3dpZCAxOjMyDQpkb25lDQoNCiMgcHJpb3JpdGl6ZSBh Y2tzIGFib3ZlIGFsbCBlbHNlDQp0YyBmaWx0ZXIgYWRkIGRldiAkRXh0ZXJuYWxEZXZpY2Ug cHJvdG9jb2wgaXAgcGFyZW50IDExOiBwcmlvIDEgdTMyIFwNCiAgICBtYXRjaCBpcCBwcm90 b2NvbCA2IDB4ZmYgXA0KICAgIG1hdGNoIHU4IDB4MTAgMHhGRiBhdCBuZXh0aGRyKzEzIFwN CiAgICBmbG93aWQgMTE6MQ0KDQp0YyBmaWx0ZXIgYWRkIGRldiAkRXh0ZXJuYWxEZXZpY2Ug cHJvdG9jb2wgaXAgcGFyZW50IDIxOiBwcmlvIDEgdTMyIFwNCiAgICBtYXRjaCBpcCBwcm90 b2NvbCA2IDB4ZmYgXA0KICAgIG1hdGNoIHU4IDB4MTAgMHhGRiBhdCBuZXh0aGRyKzEzIFwN CiAgICBmbG93aWQgMjE6MQ0KDQp0YyBmaWx0ZXIgYWRkIGRldiAkRXh0ZXJuYWxEZXZpY2Ug cHJvdG9jb2wgaXAgcGFyZW50IDMxOiBwcmlvIDEgdTMyIFwNCiAgICBtYXRjaCBpcCBwcm90 b2NvbCA2IDB4ZmYgXA0KICAgIG1hdGNoIHU4IDB4MTAgMHhGRiBhdCBuZXh0aGRyKzEzIFwN CiAgICBmbG93aWQgMzE6MQ0KDQojIyMNCiMjIE5vdywgdGhlIGlwdGFibGVzIHJ1bGVzDQoj IyMNCg0KaXB0YWJsZXMgLUEgT1VUUFVUIC10IG1hbmdsZSAtcCB0Y3AgLS1kcG9ydCAyMiAt aiBUT1MgLS1zZXQtdG9zIE1pbmltaXplLURlbGF5DQppcHRhYmxlcyAtQSBPVVRQVVQgLXQg bWFuZ2xlIC1wIHRjcCAtLWRwb3J0IDgwIC1qIFRPUyAtLXNldC10b3MgTWF4aW1pemUtVGhy b3VnaHB1dA0KaXB0YWJsZXMgLUEgT1VUUFVUIC10IG1hbmdsZSAtcCB0Y3AgLS1kcG9ydCA0 NDMgLWogVE9TIC0tc2V0LXRvcyBNYXhpbWl6ZS1UaHJvdWdocHV0DQoNCiMNCiMgRW5kZQ0K Iw0K --_===463255992====hispavista.com===_-- From shubhobiswas at hotmail.com Thu Oct 9 01:23:43 2003 From: shubhobiswas at hotmail.com (Shubho Biswas) Date: Wed, 08 Oct 2003 20:23:43 -0400 Subject: [NoCat] Gnu Privacy Guard Message-ID: When installing the pre-requisite gnupg for authservice installation, do I need to create/import keys? Ie: do I need to do gpg --gen-key or gpg --import path/to/pgp/keyring/pubring.pkr ? I've tried without and I'm having problems authenticating. I've also tried generating a key but I'm not sure if it needs to be done the same way as make pgpkey where we're not supposed to insert a passphrase. Any advice? Thanks in advance. Shubho _________________________________________________________________ Add photos to your messages with MSN 8. Get 2 months FREE*. http://join.msn.com/?page=features/featuredemail From ulrich.schwarz at rz.uni-ulm.de Thu Oct 9 08:37:09 2003 From: ulrich.schwarz at rz.uni-ulm.de (ulrich schwarz) Date: Thu, 9 Oct 2003 09:37:09 +0200 Subject: [NoCat] Gnu Privacy Guard In-Reply-To: References: Message-ID: <1065685029.3f85102538463@imap.rz.uni-ulm.de> Shubho Biswas wrote: > When installing the pre-requisite gnupg for authservice installation, do I > need to create/import keys? Ie: do I need to do > > gpg --gen-key > or > gpg --import path/to/pgp/keyring/pubring.pkr > > ? > > I've tried without and I'm having problems authenticating. I've also tried > generating a key but I'm not sure if it needs to be done the same way as > make pgpkey where we're not supposed to insert a passphrase. Any advice? > > Thanks in advance. > > Shubho hi shubho, as far as i remember, running make includes the procedure of generating the keypair. it is important _not_ to enter a passphrase. also, you can run make pgpkey (or something similar, see the docs) to perform this seperately. HTH, ulric From tfd at vodafone.es Wed Oct 8 12:00:21 2003 From: tfd at vodafone.es (Toni dlF. Diaz) Date: Wed, 08 Oct 2003 13:00:21 +0200 Subject: [NoCat] NoCatAuth Howto v1.3 (spanish & english) Message-ID: <1065610821.5420.18.camel@flame> He actualizado el NoCatBOX HowTo. Se han a=C3=B1adido varias opciones que hab=C3=ADa olvidado y la configuraci=C3=B3n del MySQL Server para almacenar= los usuarios. Version en castellano http://blyx.com/public/wireless/nocatbox/nocatbox-howto-es.pdf Version en ingl=C3=A9s http://blyx.com/public/wireless/nocatbox/nocatbox-howto-en.pdf =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D I have updated the NoCatBOX HowTo. Several options have been added since I forgot to add them previously. The configuration for MySQL Server to store users has been added too. English Version: http://blyx.com/public/wireless/nocatbox/nocatbox-howto-en.pdf Spanish version: http://blyx.com/public/wireless/nocatbox/nocatbox-howto-es.pdf Toni Blyx.com From tfd at vodafone.es Mon Oct 6 13:35:35 2003 From: tfd at vodafone.es (Toni dlF. Diaz) Date: Mon, 06 Oct 2003 14:35:35 +0200 Subject: [NoCat] NoCat SameMachine: How To? In-Reply-To: <23e7923fe2.23fe223e79@optonline.net> References: <23e7923fe2.23fe223e79@optonline.net> Message-ID: <1065443735.1470.40.camel@flame> English version is already available: http://blyx.com/public/wireless/nocatbox/nocatbox-howto-en.pdf Toni Blyx.com El mar, 23-09-2003 a las 16:53, pachai@optonline.net escribi=C3=B3: > >>>Eric CARCAILLON =20 > >>>I wrote a doc but it is in French.... >=20 > >>>From: "Toni dlF. Diaz" > >>> I wrote a doc in spanish and I'm working to translate it to english >=20 > It seems to me, if both of these documents get translated into English, > we can compare them - they should turn out identical, right? >=20 > Seriously, we would be greatful for either or both >=20 >=20 >=20 > _______________________________________________ > NoCat mailing list > NoCat@lists.nocat.net > http://lists.nocat.net/mailman/listinfo/nocat From ryan at muppethouse.com Thu Oct 9 19:28:08 2003 From: ryan at muppethouse.com (Ryan) Date: Thu, 09 Oct 2003 14:28:08 -0400 Subject: [NoCat] Redirect Proxy Server In-Reply-To: <200310051209.37452.karl.gaissmaier@kiz.uni-ulm.de> References: <3F4E269D@leto.ceplus.de> <3F7F2F09.4030005@muppethouse.com> <200310051209.37452.karl.gaissmaier@kiz.uni-ulm.de> Message-ID: <3F85A8B8.1020803@muppethouse.com> This is a multi-part message in MIME format. --------------090102030906020007030009 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Karl, What I did was quite simple. Here is an image of my layout. All I have is one entry in the IPTables ruleset on the Linux Router / NoCat Auth server that says: -A PREROUTING -s 10.0.10.0/255.255.255.0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 3128 That means that all traffic that comes from the 10.0.10.0/24 network destined for TCP port 80 should be redirected, essentially nat'd to port 3128. This redirection is done on the Linux router and the machine on the wireless segment doesn't have a clue that this is occuring. I didn't add any new or strange rules on the NoCat gateway. I did not have to configure any browsers. All web traffic from that network goes through my proxy server. -Ryan Karl Gaissmaier wrote: >Hi Ryan, > >On Saturday 04 October 2003 22:35, Ryan Shea wrote: > > >>Maybe I wasn't clear. The iptables rule I mentioned is on my firewall >>rather than my NoCat gateway - so creating this redirect rule is >>complely transparent and the NoCat authentication works without any >>problem. >> >> > > >Hmmm, I didn't understand your drawing. It would be >nice if you could try again to describe your solution >how you solved the problem with proxy servers. > >What happens with your logouts if they come via >the web proxy? You don't have the Client MAC address >to logout? Do you igore MAC addresses? > >Regards > Charly > > --------------090102030906020007030009 Content-Type: image/png; name="wireless.png" Content-Transfer-Encoding: base64 Content-Disposition: inline; filename="wireless.png" iVBORw0KGgoAAAANSUhEUgAAAcUAAAJkCAMAAABXt8pgAAADAFBMVEXy8vIAAADy8vLy8vLy 8vLy8vJ/f38AAAB/f39/f39/f38AAADy8vLy8vIAAADy8vIAAADy8vIAAABycnJycnJycnJy cnJ/f38AAACMjIx/f3////8AAAAAAAAAAAAAAADy8vIAAABMTEwAAAAAAAAAAAB/f3+/v79/ f38AAADy8vIAAAAAAAB/f3+D/wD///9/f39/f3+/v7+/v78AAAAAAAAAAAAAAAAAAAD///// //////////////////////////////8AAAAAAAD////MzMzMzMzMzMzMzMzMzMzMzMzMzMzM zMzMzMzMzMzMzMzMzMyvr2Z/fwClpUylpUyvr2avr2YAf39JSUkAf38Af38Af38Af38Af38A AAB8fHxJSUlJSUlJSUkKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoK CgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoK CgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoK CgoKCgoKCgoKCgoKCgoKCgoKCgpJSUm/v7////8AAAD///////////9JSUn///////////// //////////////+D/wAAAACD/wAKCgoWFhYAAAD//wAAKFAAN20ARYoAVKgAYsUAceIAgP8a jP8zmf9Npv9ms/+Av/+ZzP+z2f/M5v8AADMAAFUAAHcAAJkAALsAAN0AAP8XF/8tLf9ERP9b W/9xcf+IiP+fn/+1tf/MzP8aADMmAE0zAGZAAIBNAJlZALNmAMxzAOaAAP+OHf+dOv+rV/+6 df/Ikv/Xr//mzP8zADNNAE1mAGaAAICZAJmzALPMAMzmAOb/AP//Hf//Ov//V///df//kv// r///zP8zABpNACZmADOAAECZAE2zAFnMAGbmAHP/AID/HY7/Op3/V6v/dbr/ksj/r9f/zOZD GCZUAAAAAWJLR0QbAmDUpAAAAAlwSFlzAAAOwwAADsMBx2+oZAAAFTJJREFUeNrt3UvWojoX gOHsTk2AFis9O4wkAyir8dOzwfxYZ4g/5ALBKyhIgu9eZ5UKQT15vpBkc1FpTWQfiir4bUWJ Y+XSxDcUbyheyNyURnJ3xbsET1yWlie2V3xY/Y9WLC1PbK74tOrvrXy2AY67KL6s9psC8uEb EqsryuIyssp7EisqyuJSstq7EispyuJysur7EisoyuKSsvo7Ex8qyuJWK5u8N/GB4rKKlrfY ibQUu+KiUUxNcXE1y6bFiXcUt69kGDdX/EYVw7ix4ncqGEYUUUykemHcUPF7lQvjZorfrFoY UUQxkYqFEUUUE6lWGFFEMZFahXF9xe/XKYpHUIQRRRSvKrM/33eXGhXNtTirKLpq3Kky9/zs 4yimUoFAvq+YVNXh+J5iatUG4xuK6VUajIsVU6wyGBcqpllhMC5STLW6YDyCIowLFNOtKxSP oAjjbMWkawrGeYpp1xOKR1CEcZZi6rWEIoooopiNYvqVBCOKKKKIIoooorhAMYcqghFFFFFE EcWUFFvT/1tJ1T+YVi+9QXh5XapC8fuKhWU4tUX/UBZLa1lqdVVKaIzfVyxPffHGNP0mp2qx YlWguL+iahylBewo+0uqyqbW+tI0hX8P/7QSaWozPrqPsBuOpRb/ShGKa4xu+o6xrnR1st2i VSyU0WWpVHGxr4enlVZlOz66j1C1npaiLe6gWPzRqidplf5TOMW+nfX9nXKq4WnjRjLDow58 k1Io7qFY1W5Q0w1zuiapw0Wq4bf4ZHxaSV1VenwMH1GruBSKeyiqRtlOztSqH+EMimMqNjzV pizaMnr0H9HtjGWyAYjfn/XXZR09BsV2RGmjs1uNTB/tQ1HJZAMUv6/4x/dzZfMnUiz/KPWn dh2ff9qWSlsv/zh8hKqjUo1RKH5f0fh9obKjmqFnKxo7o5fxqakb6XM84XH8iDIq1U04UPy+ 4r6BIoq/oMixfhRRRBFFFAkUD6bIdRoooogiiqspci0xiiAmosg9NlAEMRFF7lp0CEXuA4fi 06hB/JriZtVV/68G8WuKa1RYfQ/xfyNjDeLWiitUWV3fQwyMddcsaxA3Vvy80m72nhaxro0Z QWsQt1X8+Ccs6v9dMdbOsAv3tA7X38wxBPE9xY+r7orR7kItYg/Yr7GgGG6sOF6UNq8ar3eQ k9Zm4TyiW2JcvMATfp/oU8VBcp7idUdnRka3JmJ7aeivx0FmFcX5g4v6ZsBipn1fxGZe704B 3E3xytHEryK3GV0iiDspDjFxHOX0nacoflFx7nU4t72dMW99HxB3VzTmY0YUE1CcOqKYiOL7 1XqmKaJIrKn4TsXa0eoZxJwV3ZTj/PcckaK4s+LCqg3zxl7RTBeBmIliPRxejBRDYgDFHRXn V249HJUyJlbsDy36Y4sg7qU496ZGw/k1pkf8+/c8SaDWbv1jSBCTUPSIdu5/peiW1pPzqFD8 ruKS44w+gXOjODjWIO6kOPPYRkjF6buKwfH+0SkQt1ecU8mTc2q84o3Xo0P9IH5DcX5afEC8 0xi1fnCkGMS0FMNs8e/5geLdY1YofkdxXkWHW70/VWR/up/igqoWvUwRxO8pzq5scfm3893h DYg7K86sbnHdopnbGEH8ruKsChe9TBHEbyvOqHLRU0UBMTnFV5du+NVxW5TlbydPQk8e7pZA cY6jvDLp/ezBKccoC9+pW666/+7HgPVgrULxkwYZmTi+sWN8UP7J38lDpudBW1zaIOWxybXi DdnzykbxS4o3vddkza3is9J396jvB4orhVecP+9HMT1FP7gxekkqFcUEFc0qirIoUExUcVEj RHGLbhHFQyi+ObxBMQHF6JSb9xojimkonlE8hKLFO6OYtaLpGDvE8993OkYU91d03eK5b49v 7lJRTEXRWEQUM1a0c/5+n4pi5opn9qj5K1rCcNaGQTEzRT+4cZ3i+a3GiGIaiu4GG3agimKm im622F+0cUYxX0WXubEpOBTzVewHNOGgxvLhDYp7K7puMSC+1xhRTELRNsXJxAPF3BTPk0v3 d1W8FS1uP+3+l3hZ0L2UKlqhTk1rrt6gkr7IwzfNStGkoji7pcpMxTZaUVS6rKfrq6aq2mrx p++rGHao5tp1T8WqbcruedFU9jKEqu2r1b50ZSppirGctq9dQbvdqW9MVXOS4Z1q/7Lfuii1 XdG/Z6vsyNyWCj8s0y1WKlpmSzbKSKUat7Q20b3y01GM0d6ZMa7eFo1p+vqsXLtp3RP7ry3T 1ioqp91ribZzG41LTHjZPVetGt9Tx58XvoHzDMvayrS6NUV9MrVbWp50USaoeB7ucHv+l4Bi dWr7ytRKXK36JyrUs2lds3TltHst43bjRtGSYeuyGF53bVGVUSnfFqvJlj3qqWxV2+nZpd3f QatSUxyOLbqWmMAetbENx7dFddsWta6bsZx2r7uCfrvQgEWPS8a22D0f2mLXL17qoZQK/WL/ NzIsa/u6KOpCn9rCL+1fJahofDY8OlBs9lF0f/lim8up77rqoV88taFfLBo3jHTltHtdD9vZ /1xHOCwZ+0Xf1Ox7qlr6n2ZypWqJx6jDsqrtutWy2ylXUvqlRkxSisPgxh5e/GdbpFncGLeZ L8qbg9Xtw7Q6ScXezu9WDYqvoilTVTw7xbeu1iB3k4hivzc14azUpR0jirsrunNu/rmjxP/e Gt5w5duuiuEkxn+2SzTvns74jatQxSY1l4nLqz61kurRqmLTnngDxTA2DYOcJBV1mEK8Ew8H UNXiTVJV9HtTvw81b2RvtlQMGUx72yPdTdf8pNElS1s3h7SJVZdodYv8FHNIpPr0bLSq397/ krObS/r/6jGDKpPCqSv259xEPye9/GoNe9eidw1fKIYMpq/kIQUTkqXtmEi1L2zaM0qTRinS 1hfwmaCrNI//z4ybyLRwqoohFW70xMzMbozRQOXN5tg1rucVFDKYUYJ03LuG7KhPpKqQ9hwL TVKk/l8Vv5fcLLnNxsrqO9jVFe/9uO0CRT8y3awthgymS2peKYa26BKprqnZ7+1aZJxI1TfN 9LothpJDBlWmhTNQvDcBmaHoJn3yWTz9iJDBdEnNK8XQL9pEqku02rRn37e5fnFIpOqwcOgy r1KuVeNLDhlUmRZOXvH+NHKWYs/40eCm33yV/5u336UxVau/G1soPkoGzFJU8iHiWvP+t98l tOg8FR82xdmNUYbbYybQFn80d7OiomzZNaL4VPFs0993Fc/nJYquc3w/fq45rnys3zzs/syM jnFUDEPV6q34OcdUFXE8gGIYquK4h+KHg3sJQ1RRsaO86fgz4xyV1teRMK5RKnJU7zfI33BU qX0hm0OND/bjmKGic+yTxyGTg2OOijooDrvXwZE8QD6KevAbJ/+PEnN3Tp/6wbScSvNrDWPU CdEDx8vlIv2/v+uYqKIezku8zHG0hJffdVTJfrMwuinH5Oic/epPHu5QCX+3qeM0D8A4JxfF kJJzjsP88bPDjyju1j32jmpywAPFjBQjx/FnMtmjZqc4Dlet4UmEtpij4nDEyileZig+uagK xf2bYz81RDFTxSgLMEsxYF5cxHthFBNxlFmnM8r93xNHMY3ukdFN1orRGR0o5qsYzuhAMW9F rZkvHkExvlaV3E2+igSKKBIoEigSKKJIoEigSKCIIoEigSKBIooEigSKBIooEigSKBIoEiii SKBIoEigiCKBIoEigSKKBIoEigSKKBIoEigSKKJIoEigSKCIIoEigSKBIoEiigSKBIoEiigS KBIoEiiiSKBIoEigiCKBIoEigSKKBIoEigSKKBIoEigSKBIookigeJCQ6N/blSJNOV1UoJis 4uOVpllQHsW926KcpHJPdFHqsgiKrdZV24ZVXesML2sUE1SsKvFUui7reI/aVlUbVkn/sqcV g2KCitF/xhOJNrXqH9SkQN8g19y1bqQoOcY6irZFDm1R6/I0tEXXWJVujdFZKNY25LJyyAbv eQlf9oM/2FGxaoppv6hr4ztCu0rXfb/Y94m5tMVcFD9qiweeL4q0besUXQ2Nj5fJ49MF8xUf vpfI/SXTbdr+26L4TLHpQsZH+yRe8XjBAsVH72Ufm4ffo0ERRRRRpF/csV/0GRpff6emNVcp 0qovMS4aynZD07bKVDGHMeoyxTaSKSpd1lcp0rqo49nkULapVD9t/GXF6yn6jordbFBCbrTt KtD0L5pS+8mKaXXfPIesqRS+bbalck3SZVG7eaSp18mpZrNHtX/ktfb/t9d/H1/do6pWSZQb tWH6QxfuhZ/yX2Vz+rq+1HU1ZlG7Ql3RVXKq2Yxupu9/o/jF0Y10SBJyo11bVGXXvk5t2Heq pk+Bq+vMqsduxyxq98fQbb1KThXFNxR1O7TFrl+81H2X51OkLm+qT+WYNR2Qul1nrzhkUYvT Sa+TU81UUe+rWA39oqql69/0SXyK1KZNte3wQtZ0UPRj1CGLaiR+9TP9oh76RS1k4LIco9aT 2HGM+kuKax/T6LqZMdZW5JjGl44vbtkWPzq++BuKK/WLzxU/6xdRfK24zhj1heJHY1QUf07x Tk47PrG4a95tuWBbFHdRfJjTHiyvzyOesS394pf7xZDTboo4wVY1p0HR5ld9ntsmVV3ee8N8 eD5j1A2PaSxSHHLalUxOFK4me1QxPkXXn9NYnnrNDfPhnMn4xujG1vrVicL25ZgRHRb15xe7 vPeG+fBs9qhji1z/WP+yParPabu2GFrk2BbHlPnQFnVRF5vmw7MZ3bxQ/PoYtWpPEvWOcb84 dI+hXxxO+N8qH56b4iZnT705X1y2C847j5rDOXDv5VHnb9CUmSraBpmL4vCVyd08UlxrdGPf ZJszGVHc8MhUNMsPigNvPV3JkalM5ovyZIzKkant2mLuV6HKmIqJ18ucsU1x993uFZPPx09c Ef58EDokt+X+IYwFALLcCcXVFN1RCHGz9n7OIKemGuf1lTTusuGiqcZEt2+6ISnuswISL+n/ 9Zch+61O/iTyrsyYZm9nHMtC8YViOFzomoU7BTycFW7z2G3t6tAt9WeMm9BgjU92j8nzaEkb 5dLb6CRyt3l8Pw4UP22L0c4tnAKuontlmLapXAEl0yS5ntxQQ929xUacS5e7N+yYM3hGcYli E1Lgvi3aPLaum5u26M8THwvFB7LCEnt4Q2mZtks9vXmO/wwU11N0p4BH/WLXgxWN683k1FbR XabcxCUUivrFYYltw3XcL0aKY5q9nXH8GMUVyY82X0QRRQJFFAkUCRQJFFEkUCRQJFAkUESR QJFAkUARRQJFAkUCRRQJFAkUCRRRJFAkUCRQRJFAkUCRQBFFAkUCRQJFAkUUCRQJFAkUUSRQ JFAkUESRQJFAkUARRQLFTePJL9KgmA1eNQSaOSle4d3EL1OqbAirB4qvf/QLxUQMQ0u7Azkl rMKv/KCYnKHFmry8dhwKu9copmh45ehdZdId2ie+tKCYJuKkkQWx2HCUjclRTAzxSkequBne 7GZRTEfxyXRCQtu8PwERFNNEvBmOVtXjSSSKqTbFyLN6FSgmruhmjg9aJ4rJD27iAU6fC9DT yQeKaSoOEwe5NfRt8j64oJjOHjVilNEmzPsHy5v2KCim1C/KmI2ZTvDvTfHHFsseNbHRzU0e VR73lb5xCv1iemPUMWF6fzg6OLqCjG4SnWnInAni9BgkiinOF18d679O46CY7Kz/zg710U4W xcRzN5NOkgxctoozAkUUUUQRRRRRRPFYjCimoygg5q/4NiNnMibGKBhmr/hGc/y9C24yudpG MMxecX6D/NFLGI9zFWrFVahZUY7n20wOb+jfjUzvziDcneEAisESwPwVNYooosguFUUUUWSX ejRFGFFEMQ3F/2BEEUV2qSjSGFFEMW/Fq10oinkq/jdxlP9gzHGP2rsJjTF/xdgRxTxHN5Zx cGSXmrNicEQxb0XvyC41z/niyNg70hizV+wdUcxf0UqiCCOKKKK4FiOKNEYUd1MUQTFzRTvV nzgKink2Rh07opitYuSIYq67VB078rvEOSsGRxQzZ9Q/n0s9hKJ15Lr+7BV//PTifM9H5azw QyhyQApFFNmloojizylOfiLsFeOzwijuKPiM7dXL35FUCRu+Wvj4xa/tdFVOhnbF/efyuD2j mODAReT26VOqH3BUmRlO2t1wxc2vj2YTVJT5JWSukaCY3iwwaoQz25mgmFRDnJSbv68UFJND DCVli7dG8VuIoU/UMKamKEtLy4Zvj+I3EPvyomFMTFG230JQTA4x1Q9BEcWsFeVQH4MijNkq ikYRxd9mVL+GeEhGFFHMs2IFRRRRTKNaBUUUUUyjUgVFFFFMo0oFRRRRHCrSX9okO/3pHOnS KrWb4fWT3/r8QyimVHWC4hEqTlA8QrUJikeoNEHxCFUmKB6hwgTFI1SXoHiEyhIUj1BVgiKK v6OYdkUJiij+imLq1SQooogiirkoJl9JKB6ikgTFA1QRiiiiiCKKv86oqCAUD1dBgiKKKM7Y sHpVtkIxfUXZHAFFFFF8tqGUrUjlf67m0jRFv7hs6rAiLPz88hkUN1Ssja78XW3LUqni0j0v lBlWDAtpiwkrGj3cm7juvrJqwzK/YliIYsKK0WO47HC8b7hcLUQxA0UVvd+wQjG6yUqxvafY opiPYmOULv8o9ae+UgwL+wIoJq7YzSe0LhrpBzMTxbDQFkAxQcWvBooooghiDooc60eR74ji wRFRRBHF31PkDH8U+YKJKHLlG4p8v0QUua4fRRQTUeR+NyiimIgi94E7hCL3ZEQRxUQUucvt IRS54/QhFLn7+yEU+SWGQyim9bNAwq+iZF91/M7Uh9UnO9Zi+HB+820NSNnt9xcP87N9ml/R RDHfKuV3iVFEMYlKPRoiiihmWq2HQ0QRxTwr9niIKKKYZdUeEBFFFHOs3CMi/pziIRHTUfxS /aJ4gPo9JmJCit+o4YMipqS4vI4FxPQUl9ayLNzgsIgZK9rzLQTF5BSX1LMshjkuYmKK82ta FtMcGDE1xbknNspinCMjJqc4z1GWusuhERNUXP47RPLbDTFRxVeVLkvLHx0xTcXn9S7L2I9v mKrik7q/v2JhcRT3dHxyaYXcL681ins7Rgry+uoYudlAaxRTkZQlIIs3QJFAkUCRQBFFAkUC RQJFFAkUCRQJFFEkUCRQJFBEkUCRQJFAEUUCRQJFAkUUCRQJFAkUCRRRJFAkUCRQRJFAkUCR QBFFAkUCRQLF34n/A4n7PrAeqCMoAAAAAElFTkSuQmCC --------------090102030906020007030009-- From rob at capband.net Thu Oct 9 20:09:00 2003 From: rob at capband.net (Rob Nelson) Date: Thu, 09 Oct 2003 15:09:00 -0400 Subject: [NoCat] Redirect Proxy Server In-Reply-To: <3F85A8B8.1020803@muppethouse.com> References: <200310051209.37452.karl.gaissmaier@kiz.uni-ulm.de> <3F4E269D@leto.ceplus.de> <3F7F2F09.4030005@muppethouse.com> <200310051209.37452.karl.gaissmaier@kiz.uni-ulm.de> Message-ID: <5.2.1.1.0.20031009150818.022208f0@mail.capband.net> Just a note, the 1980's called, they want their laptop back! Where oh where did you find that old-school laptop diagram in visio? Absolutely hilarious :) Rob Nelson Network Administrator, Capitol Broadband C: 919-369-1874 rob@capband.net From ryan at muppethouse.com Thu Oct 9 20:50:11 2003 From: ryan at muppethouse.com (Ryan) Date: Thu, 09 Oct 2003 15:50:11 -0400 Subject: [NoCat] Redirect Proxy Server In-Reply-To: <5.2.1.1.0.20031009150818.022208f0@mail.capband.net> References: <200310051209.37452.karl.gaissmaier@kiz.uni-ulm.de> <3F4E269D@leto.ceplus.de> <3F7F2F09.4030005@muppethouse.com> <200310051209.37452.karl.gaissmaier@kiz.uni-ulm.de> <5.2.1.1.0.20031009150818.022208f0@mail.capband.net> Message-ID: <3F85BBF3.5040704@muppethouse.com> I wish there were a good free source of quality visio stencils out there. That one is from the standard "logical network diagram" stencil I believe. The funny part is that my gateway is on a laptop that came out when Duran Duran was the greatest thing since sliced bread - so the picture is strangely appropriate. -Ryan Rob Nelson wrote: > Just a note, the 1980's called, they want their laptop back! > > Where oh where did you find that old-school laptop diagram in visio? > Absolutely hilarious :) > > Rob Nelson > Network Administrator, Capitol Broadband > C: 919-369-1874 > rob@capband.net From robert at maknet.net Fri Oct 10 00:22:03 2003 From: robert at maknet.net (RM) Date: Thu, 9 Oct 2003 19:22:03 -0400 Subject: [NoCat] nocat startup problem Message-ID: <008601c38ebc$25f45030$04280c0a@pinkpig> This is a multi-part message in MIME format. ------=_NextPart_000_0083_01C38E9A.9EBEFB90 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable when i start the gateway i get those error of cant resolve hostname = etc.... what do those mean?=20 so did the gateway start correctly and is running? bin/gateway [2003-10-09 10:06:55] Resetting firewall. [2003-10-09 10:06:55] Detected InternalDevice 'dc0' [2003-10-09 10:06:55] Detected ExternalDevice 'fxp0' [2003-10-09 10:06:55] Detected LocalNetwork '10.12.42.0/24' net.inet.ip.forwarding: 0 -> 1 0 entries flushed from NAT table 0 entries flushed from NAT list 1: can't resolve hostname: port 1: syntax error in "rdr" 1: can't resolve hostname: port 1: syntax error in "rdr" [: 207.69.188.185: unexpected operator 1:ioctl(add/insert rule): File exists [2003-10-09 10:06:58] Binding listener socket to 0.0.0.0 thanks in advance ------=_NextPart_000_0083_01C38E9A.9EBEFB90 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
when i start the gateway i get those = error of=20 cant resolve hostname etc....
what do those mean?
so did the gateway start correctly = and is=20 running?
 
bin/gateway
[2003-10-09 10:06:55] = Resetting=20 firewall.
[2003-10-09 10:06:55] Detected InternalDevice = 'dc0'
[2003-10-09=20 10:06:55] Detected ExternalDevice 'fxp0'
[2003-10-09 10:06:55] = Detected=20 LocalNetwork '10.12.42.0/24'
net.inet.ip.forwarding: 0 -> 1
0 = entries=20 flushed from NAT table
0 entries flushed from NAT list
1: can't = resolve=20 hostname: port
1: syntax error in "rdr"
1: can't resolve hostname: = port
1: syntax error in "rdr"
[: 207.69.188.185: unexpected=20 operator
1:ioctl(add/insert rule): File exists
[2003-10-09 = 10:06:58]=20 Binding listener socket to 0.0.0.0
 
 
thanks in advance
 
------=_NextPart_000_0083_01C38E9A.9EBEFB90-- From Jared.Shields at ucen.ucsb.edu Fri Oct 10 02:27:40 2003 From: Jared.Shields at ucen.ucsb.edu (Jared Shields) Date: Thu, 9 Oct 2003 18:27:40 -0700 Subject: [NoCat] NoCat on wired connections Message-ID: <59D5B082B9CED311808B009027DE9B98B1DD94@zilla.bookstore.ucsb.edu> This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C38ECD.B20333A0 Content-Type: text/plain; charset="iso-8859-1" I tried looking through the archives and a bit of the documentation about the system but didn't find much info about using wired connections through the NoCat gateway. We have a mixed public access network here, 2 Air Ports and up to 75-100 wired connections available for public access (or at least we will once we can get an auth system in place.) Can NoCat handle wired connections in the same manner as wireless? (clients will get DCHP addresses, forced to go to the log in web page, authenticate, and then get released to the various levels of access) Any tips on how to do this or overcome the challenges that might present themselves would be greatly appreciated. Jared Shields jared.shields@ucen.ucsb.edu ------_=_NextPart_001_01C38ECD.B20333A0 Content-Type: text/html; charset="iso-8859-1"
I tried looking through the archives and a bit of the documentation about the system but didn't find much info about using wired connections through the NoCat gateway.  We have a mixed public access network here, 2 Air Ports and up to 75-100 wired connections available for public access (or at least we will once we can get an auth system in place.) 
 
Can NoCat handle wired connections in the same manner as wireless? (clients will get DCHP addresses, forced to go to the log in web page, authenticate, and then get released to the various levels of access)
 
Any tips on how to do this or overcome the challenges that might present themselves would be greatly appreciated.
 
Jared Shields
 
 
------_=_NextPart_001_01C38ECD.B20333A0-- From chs at 23.org Fri Oct 10 08:28:12 2003 From: chs at 23.org (CHS) Date: Fri, 10 Oct 2003 00:28:12 -0700 (PDT) Subject: [NoCat] memory stick wifi card? Message-ID: Hey guys, anyone know about the availability of a memory stick wifi card? does such a beast exist? where can I get one, and for how much? Much appreciated! --Christian ---- -- http://www.23.org/~chs/ -- AIM/AOL: bdsmchs ----------------------------------------------------------------------------- "Among the many misdeeds of the British rule in India, history will look upon the act of depriving a whole nation of arms, as the blackest." Mahatma Gandhi ----------------------------------------------------------------------------- From rob at capband.net Fri Oct 10 13:46:52 2003 From: rob at capband.net (Rob Nelson) Date: Fri, 10 Oct 2003 08:46:52 -0400 Subject: [NoCat] NoCat on wired connections In-Reply-To: <59D5B082B9CED311808B009027DE9B98B1DD94@zilla.bookstore.ucs b.edu> Message-ID: <5.2.1.1.0.20031010084617.00bbd0b8@mail.capband.net> At 06:27 PM 10/9/2003 -0700, Jared Shields wrote: >I tried looking through the archives and a bit of the documentation about >the system but didn't find much info about using wired connections through >the NoCat gateway. We have a mixed public access network here, 2 Air >Ports and up to 75-100 wired connections available for public access (or >at least we will once we can get an auth system in place.) > >Can NoCat handle wired connections in the same manner as wireless? >(clients will get DCHP addresses, forced to go to the log in web page, >authenticate, and then get released to the various levels of access) > >Any tips on how to do this or overcome the challenges that might present >themselves would be greatly appreciated. You should be fine, Nocat just works with two interfaces. We used NoCat as a gateway for our wireless network, but the server had no wireless cards in it itself. Rob Nelson Network Administrator, Capitol Broadband C: 919-369-1874 rob@capband.net From nocat at lists.nocat.net Fri Oct 10 14:23:45 2003 From: nocat at lists.nocat.net (Gerry Gosselin) Date: Fri, 10 Oct 2003 09:23:45 -0400 Subject: [NoCat] memory stick wifi card? In-Reply-To: ; from chs@23.org on Fri, Oct 10, 2003 at 12:28:12AM -0700 References: Message-ID: <20031010092345.A27639@nuclearcrayon.net> Christian, I just looked into this yesterday actually with the announcement of the Treo 600 release. SanDisk makes 2 CF cards that do it. One does wifi, the other provides memory & wifi! They also make an SD card that does wifi. All 802.11b. I called them yesterday and a rep said that in November they are releasing the SD wifi card with memory as well. Also in November they will release Palm OS 5.x drivers for all above said cards. Currently I only saw drivers for PocketPC and Windows. Although I was hunting more for Palm drivers and didn't look into the Windows end, it would appear that one of those PCMCIA -> CF adapters would allow the CF/Wifi card to work as a wireless NIC. Only thing to be concerned about is that they aren't as strong as a normal PCMCIA wifi card. They are meant to use much less power and that translates directly to less performance according to a table I saw comparing different Wifi NICs to these SD/CF wifi cards. There are many other manufacturers other than SanDisk and prices seem to be all over the place but between $70 and $130, of course depending on whether you get the one with memory on board too. To clarify the ones with memory means that it acts 256MB CF or SD card like normal, PLUS has 802.11b wifi built in. Haven't seen any 802.11g ones yet ;) -Gerry On Fri, Oct 10, 2003 at 12:28:12AM -0700, CHS wrote: > > Hey guys, anyone know about the availability of a memory stick wifi card? > does such a beast exist? where can I get one, and for how much? > > Much appreciated! > > --Christian From chs at 23.org Fri Oct 10 17:38:27 2003 From: chs at 23.org (CHS) Date: Fri, 10 Oct 2003 09:38:27 -0700 (PDT) Subject: [NoCat] memory stick wifi card? In-Reply-To: <20031010092345.A27639@nuclearcrayon.net> References: <20031010092345.A27639@nuclearcrayon.net> Message-ID: On Fri, 10 Oct 2003, Gerry Gosselin wrote: > There are many other manufacturers other than SanDisk and prices > seem to be all over the place but between $70 and $130, of course > depending on whether you get the one with memory on board too. To > clarify the ones with memory means that it acts 256MB CF or SD card like > normal, PLUS has 802.11b wifi built in. Haven't seen any 802.11g ones > yet ;) Thanks for the help. unfortunately, while I already knew about the availability of CF-based wifi cards, what I'm really looking for is one in the memory stick format for my sony clie palmos5 device. ---- -- http://www.23.org/~chs/ -- AIM/AOL: bdsmchs ----------------------------------------------------------------------------- "Among the many misdeeds of the British rule in India, history will look upon the act of depriving a whole nation of arms, as the blackest." Mahatma Gandhi ----------------------------------------------------------------------------- From jstaerk at usegroup.de Fri Oct 10 19:04:36 2003 From: jstaerk at usegroup.de (=?ISO-8859-1?Q?Jochen_St=E4rk?=) Date: Fri, 10 Oct 2003 20:04:36 +0200 Subject: [NoCat] Is there a Client? Message-ID: <3F86F4B4.7050408@usegroup.de> Hi List, is there something like a NoCat-Client that could autmatically log me into a nocat network (saves some seconds on the PWD-dialogue) or refresh my login so I don't need the Javascript-window? thanks, Jochen From armadilo at gothpunk.com Sat Oct 11 00:37:03 2003 From: armadilo at gothpunk.com (Roadknight Mobility Labs (Steve Okay)) Date: Fri, 10 Oct 2003 16:37:03 -0700 Subject: [NoCat] memory stick wifi card? In-Reply-To: Message-ID: On Friday, Oct 10, 2003, at 09:38 US/Pacific, CHS wrote: > On Fri, 10 Oct 2003, Gerry Gosselin wrote: > >> There are many other manufacturers other than SanDisk and prices >> seem to be all over the place but between $70 and $130, of course >> depending on whether you get the one with memory on board too. To >> clarify the ones with memory means that it acts 256MB CF or SD card >> like >> normal, PLUS has 802.11b wifi built in. Haven't seen any 802.11g ones >> yet ;) > > Thanks for the help. unfortunately, while I already knew about the > availability of CF-based wifi cards, what I'm really looking for is > one in > the memory stick format for my sony clie palmos5 device. Sony has been planning one for some time now, but the last updates I heard on it a couple months ago had it being pushed off down the road at least 4-6 months, possibly for good. I doubt the thing will see the light of day. The past couple Clies have either had 802.11b built in or an option as a CF slot. Socket has announced their 802.11b SDIO card, so you'd would think that Sony would followup with a MS-based one, but in the time it was supposed to come out, several Clies have been released with 802.11b built-in. HTH, 'dillo From chettawan at iec.co.th Mon Oct 13 07:00:24 2003 From: chettawan at iec.co.th (Chettawan Senapant.) Date: Mon, 13 Oct 2003 13:00:24 +0700 Subject: [NoCat] chown can solve "Internal Server Error" Message-ID: <004201c3914f$4c0907d0$5001a8c0@chettawan> ImNob3duIC1SIGFwYWNoZTphcGFjaGUgL3Vzci9sb2NhbC9ub2NhdC9hdXRoc2Vydi9wZ3AiIE1h eSBiZSB5b3UgZm9yZ2V0IHRvIGRvIHRoaXMgbGlrZSBtZS4NCg== From ulrich.schwarz at rz.uni-ulm.de Mon Oct 13 12:54:08 2003 From: ulrich.schwarz at rz.uni-ulm.de (ulrich schwarz) Date: Mon, 13 Oct 2003 13:54:08 +0200 Subject: [NoCat] extant iptables rules Message-ID: <1066046048.3f8a92600a87a@imap.rz.uni-ulm.de> hello everyone, watching NoCat for some time in production, we have observed that iptables rules are not removed when the client logs out (quite seldomly). so we created a little script to be run as a cron-job in order to fix this. works fine here. regards, ulric -- ulrich schwarz, computing center, university of ulm, germany #!/bin/bash export MTABLE=/tmp/mangle_rules.txt export MACTABLE=/tmp/mangle_MACs.txt export NCTABLE=/tmp/nocat_MACs.txt export EXTANT=/tmp/extant.txt export PATH="$PATH:/sbin" # be able to be run as a cron-job # write rules in table mangle to file iptables -n -t mangle -L NoCat | \ perl -wane 'print "@F[3,6,9]\n" if /MAC/' > $MTABLE # pick the MACs and sort them perl -we '@macs = <>; @macs = map {(split)[1] ."\n"} @macs; print sort @macs' $MTABLE > $MACTABLE # get user's MACs known by NoCat by reading the status-page and processing it lynx -dump localhost:5280/status | \ perl -wne 'print if s/.*((([\da-f]){2}:){5}[\da-f]{2})$/$1/i' | \ sort > $NCTABLE # detect differences between iptables and NoCat date echo "extant MACs in table mangle (unknown by NoCat):" diff -Nau $NCTABLE $MACTABLE | \ perl -wne 'if ( /^\+0/ ) {(s/^\+0/0/); print}' | \ tee $EXTANT if [ ! -s "$EXTANT" ] then echo "[none] - everything seems to be alright." echo exit fi echo "Clearing those sloppinesses..." perl -we ' my @mtable = qx(cat $ENV{MTABLE}); my %mtable; my @extant; my @line; foreach (@mtable) { @line = split; $mtable{$line[1]} = [ $line[0], $line[2] ]; } @extant = qx(cat $ENV{EXTANT}); chomp @extant; foreach my $mac (@extant) { print "Processing MAC: $mac\n"; $mtable{$mac}[1] = "Member" if $mtable{$mac}[1] =~ /0x2/; $mtable{$mac}[1] = "Public" if $mtable{$mac}[1] =~ /0x3/; print "Executing command" . qq(/usr/local/nocat/bin/access.fw deny $mac $mtable{$mac}[0] $mtable{$mac}[1]\n); qx(/usr/local/nocat/bin/access.fw deny $mac $mtable{$mac}[0] $mtable{$mac}[1]); } ' echo From karl.gaissmaier at kiz.uni-ulm.de Mon Oct 13 16:54:18 2003 From: karl.gaissmaier at kiz.uni-ulm.de (Karl Gaissmaier) Date: Mon, 13 Oct 2003 17:54:18 +0200 Subject: [NoCat] Patch: stable-01.patch against the crashes Message-ID: <3F8ACAAA.7090009@kiz.uni-ulm.de> This is a multi-part message in MIME format. --------------010102010905070807080009 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Name: stable-01.patch Affected Files: bin/gateway lib/NoCat/Gateway.pm Version: Patch against 0.82 Severity: important on linux if you hate crashes Description: Hopefully solves the problem with crashed gateways. I changed the sigchld handling in Gateway.pm I've seen, that the gateway on heavy load hangs in the system call 'wait4' and not as expected in the 'do_select'. Since the parent doesn't rely on the exit status of the child processes, we can totally 'IGNORE' SIGCHLD signals and let the operating system do the job with reaping childs. This was a try here at Ulm University, and the gateway is stable since more then one week running, even under stress tests. I'm not totally convinced if this helps in all circumstances, but anyway this is the proper solution for handling childs if the parent is not interested in the exit status. Regards Charly -- Karl Gaissmaier KIZ/Infrastructure, University of Ulm, Germany Email:karl.gaissmaier@kiz.uni-ulm.de Service Group Network Tel.: ++49 731 50-22499 --------------010102010905070807080009 Content-Type: text/plain; name="stable-01.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="stable-01.patch" diff -Naur NoCatAuth-nightly/bin/gateway NoCatAuth-mod/bin/gateway --- NoCatAuth-nightly/bin/gateway Sat Mar 8 02:56:51 2003 +++ NoCatAuth-mod/bin/gateway Mon Oct 13 12:35:37 2003 @@ -7,6 +7,7 @@ use lib "$FindBin::Bin/../lib"; use NoCat; use strict; +use sigtrap qw(stack-trace untrapped error-signals); # Gracefully handle termination signals. $SIG{INT} = sub { exit }; diff -Naur NoCatAuth-nightly/lib/NoCat/Gateway.pm NoCatAuth-mod/lib/NoCat/Gateway.pm --- NoCatAuth-nightly/lib/NoCat/Gateway.pm Mon Mar 10 17:50:51 2003 +++ NoCatAuth-mod/lib/NoCat/Gateway.pm Mon Oct 13 12:40:41 2003 @@ -96,7 +96,8 @@ return unless $self->bind_socket; local $SIG{PIPE} = "IGNORE"; - local $SIG{CHLD} = sub { $kids++ }; + local $SIG{CHLD} = 'IGNORE'; # the OS does the dirty job + #local $SIG{CHLD} = sub { $kids++ }; local $SIG{HUP} = sub { $hup++ }; # Reset history. @@ -135,11 +136,13 @@ $hup = 0; } + # changed by kg, let the OS do the dirty job + # # See if any kids have expired, reap zombies - if ( $kids ) { - 1 until ( wait == -1 ); - $kids = 0; - } + #if ( $kids ) { + # 1 until ( wait == -1 ); + # $kids = 0; + #} } # loop forever } --------------010102010905070807080009-- From karl.gaissmaier at kiz.uni-ulm.de Mon Oct 13 17:07:49 2003 From: karl.gaissmaier at kiz.uni-ulm.de (Karl Gaissmaier) Date: Mon, 13 Oct 2003 18:07:49 +0200 Subject: [NoCat] Patch: alarm-03.patch Message-ID: <3F8ACDD5.5010308@kiz.uni-ulm.de> This is a multi-part message in MIME format. --------------050705040008090004070009 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit Name: alarm-03.patch Affected Files: lib/NoCat/Gateway.pm Version: Patch against 0.82 or later Severity: unimportant, works wihout applying this patch Description: handling a new connection on the gateway port is guarded with a timeout to prevent DoS and lurking processes. The alarm handling is a little bit improved with this patch. In difference to alarm-02.patch, a small chance for a race condition is eliminated through the introduction of an additional scope level. Obsoletes: alarm-02.patch and or alarm-01.patch -- Karl Gaissmaier KIZ/Infrastructure, University of Ulm, Germany Email:karl.gaissmaier@kiz.uni-ulm.de Service Group Network Tel.: ++49 731 50-22499 --------------050705040008090004070009 Content-Type: text/plain; name="alarm-03.patch" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="alarm-03.patch" --- NoCatAuth-mod/lib/NoCat/Gateway.pm Mon Mar 10 17:50:51 2003 +++ NoCatAuth-new/lib/NoCat/Gateway.pm Mon Oct 6 12:53:48 2003 @@ -278,20 +279,26 @@ $self->log( 8, "Connection to " . $sock->sockhost . " from $peerhost" ); - # Set the UNIX alarm clock. - alarm( $self->{HandleTimeout} ) if $self->{HandleTimeout}; - - # Wrap the call to handle() in eval{}, so we catch the - # exception when the alarm goes off. - # - # Then turn the alarm off, Schuyler, you moron! - eval { - $self->handle( $peer ); - alarm 0 if $self->{HandleTimeout}; - }; + { + local $SIG{ALRM} = 'IGNORE'; # inhibit race condition + # + # Wrap the call to handle() in eval{}, so we catch the + # exception when the alarm goes off. + # + eval { + # ALRM signal handler only for this eval block + local $SIG{ALRM} = sub {die "timeout in handling connection\n"}; + + # Set the UNIX alarm clock. + alarm( $self->{HandleTimeout} ) if $self->{HandleTimeout}; + $self->handle( $peer ); + alarm 0; + }; + alarm 0; - # Note the warning if the call to handle() threw an exception. - $self->log( 1, "$peerhost: $@" ) if $@; + # Note the warning if the call to handle() threw an exception. + $self->log( 1, "peer $peerhost: $@" ) if $@; + } } sub check_expired { --------------050705040008090004070009-- From michael at mapu.com Mon Oct 13 18:00:30 2003 From: michael at mapu.com (Michael Klatsky) Date: Mon, 13 Oct 2003 13:00:30 -0400 Subject: [NoCat] Nocat .82, patched with Radius/throttle patch Message-ID: <3F8ADA2E.5060705@mapu.com> Good afternoon all: I have successfully patched am testing NoCatAuth .82, with the following patches: NoCatAuth-0.82+RADIUS-20030802.patch throttle-per-public-user-04.patch Almost everything works well. 2 issues I've noticed so far: 1) The javascript pop-up, upon a successful authenticate, comes up with correct window including the logout message and button. At this point the main browser window shows the redirect message. After the appropriate redirect time (5 secs in this case), the main window continues on to the correct redirect page (yahoo.com in this case). Then, very quickly, the pop-up window redirects itself to an error 404, stating (not the real url)"The requested URL /cgi-bin/450; URL=https://authtester.auth.net/cgi-bin/login was not found on this server.". This is the message from the webserver on the auth server. Any help pointing me towards fixing this would be most apprciated. 2) To temporarily go around the above, I am using the login_ok_nopopup.html page, however- how does one logout using this method? This has probably already been answered but I just can't seem to find it. Again- thanks for any help. Sincerely, Michael Klatsky From robert at maknet.net Mon Oct 13 21:32:50 2003 From: robert at maknet.net (RM) Date: Mon, 13 Oct 2003 16:32:50 -0400 Subject: [NoCat] need help, configuring nocat Message-ID: <005d01c391c9$2c306910$04280c0a@pinkpig> This is a multi-part message in MIME format. ------=_NextPart_000_005A_01C391A7.A4E801A0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hello, all I've setup nocat on my machine with slackware 9. I installed the = authserv and gateway on the same machine. After i installed everything = and launched the gateway everything worked. My laptop was able to get a = dhcp IP and then go thru the gateway with the default options in the = nocat.conf file.... so i guess it uses the auth.nocat.net server, and = after i click skip im able to surf the net. But now im trying to = configure my own authserver. So in /usr/local/nocat/gw/nocat.conf i have = these options HomePage http://10.12.40.1 GatewayMode Captive=20 DocumentRoot /usr/local/nocat/gw/htdocs TrustedGroups Any AuthServiceAddr 10.12.41.1=20 AuthServiceURL https://$AuthServiceAddr/cgi-bin/login LogoutURL https://$AuthServiceAddr/logout.html LocalNetwork 10.12.41.0/24 Theres other options also but i never touched those. When i changed it = to captive and gave it a authserviceaddr of 10.12.41.1 nothing works = anymore. When i try to surf any page , IE returns no page found. BUT if i change GatewayMode to Open and comment out AuthServiceAddr i = get i believe is either the splash.html or status.html=20 because it says "Welcome to the NoCat network" and there's a login = button and it also says "There are currently 0 users connected, The last = connection was at:none." After i press the login button im able to surf the net... Can anyone help me out? its something with my authserv i think but i = cant figure it out again this is a slackware 9 install with apache/dhcp installed. I = beleive SSL is installed also cuz the default apache page says=20 "The SSL/TLS-aware apache webserver was successfully installed on this = website." apache interface to OpennSSL (mod_ssl) any help or suggestions would be great!! Thanks in Advanace Rob=20 ------=_NextPart_000_005A_01C391A7.A4E801A0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Hello, all
 
        = I've setup=20 nocat on my machine with slackware 9. I installed the authserv and = gateway on=20 the same machine. After i installed everything and launched the gateway=20 everything worked. My laptop was able to get a dhcp IP and then go thru = the=20 gateway with the default options in the nocat.conf file.... so i guess = it uses=20 the auth.nocat.net server, and after i click skip im able to surf the = net. But=20 now im trying to configure my own authserver. So in=20 /usr/local/nocat/gw/nocat.conf i have these options
 

HomePage http://10.12.40.1

GatewayMode Captive

DocumentRoot /usr/local/nocat/gw/htdocs

TrustedGroups Any

AuthServiceAddr 10.12.41.1

AuthServiceURL https://$AuthServiceAddr/= cgi-bin/login

LogoutURL https://$AuthServiceAddr/lo= gout.html

LocalNetwork=20 10.12.41.0/24

Theres other options also but i never = touched=20 those. When i changed it to captive and gave it a authserviceaddr of = 10.12.41.1=20 nothing works anymore. When i try to surf any page , IE returns no page=20 found.
 
BUT if i change GatewayMode to Open and = comment out=20 AuthServiceAddr i get i believe is either the splash.html or status.html =
because it says "Welcome to the NoCat = network" and=20 there's a login button and it also says "There are currently 0 users = connected,=20 The last connection was at:none."
After i press the login button im able = to surf the=20 net...
 
Can anyone help me out? its something = with my=20 authserv i think but i cant figure it out
 
again this is a slackware 9 = install with=20 apache/dhcp installed. I beleive SSL is installed also cuz the default = apache=20 page says
"The SSL/TLS-aware apache webserver was = successfully installed on this website."
apache interface to OpennSSL = (mod_ssl)
 
any help or suggestions would be=20 great!!
 
Thanks in Advanace
Rob 
 
 
------=_NextPart_000_005A_01C391A7.A4E801A0-- From jstaerk at usegroup.de Tue Oct 14 12:43:57 2003 From: jstaerk at usegroup.de (=?ISO-8859-1?Q?Jochen_St=E4rk?=) Date: Tue, 14 Oct 2003 13:43:57 +0200 Subject: [NoCat] Nocat .82, patched with Radius/throttle patch In-Reply-To: <3F8ADA2E.5060705@mapu.com> References: <3F8ADA2E.5060705@mapu.com> Message-ID: <3F8BE17D.3030601@usegroup.de> Michael Klatsky wrote: > Good afternoon all: > > I have successfully patched am testing NoCatAuth .82, with the > following patches: > > NoCatAuth-0.82+RADIUS-20030802.patch > throttle-per-public-user-04.patch > > Almost everything works well. > > 2 issues I've noticed so far: > > 1) The javascript pop-up, upon a successful authenticate, comes up > with correct window including the logout message and button. At this > point the main browser window shows the redirect message. After the > appropriate redirect time (5 secs in this case), the main window > continues on to the correct redirect page (yahoo.com in this case). > Then, very quickly, the pop-up window redirects itself to an error > 404, stating (not the real url)"The requested URL /cgi-bin/450; > URL=https://authtester.auth.net/cgi-bin/login > was not found on this server.". > > This is the message from the webserver on the auth server. Any help > pointing me towards fixing this would be most apprciated. Hi Michael, maybe this is not in throttle-per-public-user-04.patc, i'm using nocat just with the radius-patch and have the same problem. bye, Jochen From jstaerk at usegroup.de Tue Oct 14 12:50:02 2003 From: jstaerk at usegroup.de (=?ISO-8859-1?Q?Jochen_St=E4rk?=) Date: Tue, 14 Oct 2003 13:50:02 +0200 Subject: [NoCat] need help, configuring nocat In-Reply-To: <005d01c391c9$2c306910$04280c0a@pinkpig> References: <005d01c391c9$2c306910$04280c0a@pinkpig> Message-ID: <3F8BE2EA.4000607@usegroup.de> Hi Robert, > > authserver. So in /usr/local/nocat/gw/nocat.conf i have these options > > HomePage http://10.12.40.1 > > GatewayMode Captive > Why not Passive? AFAIU passive means the same as captive, but works through NAT. > Theres other options also but i never touched those. When i changed it > to captive and gave it a authserviceaddr of 10.12.41.1 nothing works > anymore. When i try to surf any page , IE returns no page found. That may be because IE is redirected to https://10.12.41.1/cgi-bin/login. Can you point your browser to https://10.12.41.1/ to see if a apache with ssl is running there? > > BUT if i change GatewayMode to Open and comment out AuthServiceAddr i > get i believe is either the splash.html or status.html > because it says "Welcome to the NoCat network" and there's a login > button and it also says "There are currently 0 users connected, The > last connection was at:none." > After i press the login button im able to surf the net... AFAIK, because of architectural reasons, the gateway has to be, and the authserv can not be a standalone HTTP(S) server. So, to run an network, you may not have another http-server on the gateway machine listening to port 80, but you need apache and mod_ssl on port 443 of your authserv. > > Can anyone help me out? its something with my authserv i think but i > cant figure it out > try and have a look in /var/log/httpd/error_log if in doubt. > again this is a slackware 9 install with apache/dhcp installed. I > beleive SSL is installed also cuz the default apache page says > "The SSL/TLS-aware apache webserver was successfully installed on this > website." > apache interface to OpennSSL (mod_ssl) by the way: you can start apache in ssl mode with apachectl startssl, if you just do a apachectl start, there may be problems. bye, Jochen From jbarrett at pogozone.com Tue Oct 14 16:14:37 2003 From: jbarrett at pogozone.com (Jacob S. Barrett) Date: Tue, 14 Oct 2003 08:14:37 -0700 Subject: [NoCat] Nocat .82, patched with Radius/throttle patch In-Reply-To: <3F8ADA2E.5060705@mapu.com> References: <3F8ADA2E.5060705@mapu.com> Message-ID: <3F8C12DD.80607@pogozone.com> Michael Klatsky wrote: > I have successfully patched am testing NoCatAuth .82, with the following > patches: > NoCatAuth-0.82+RADIUS-20030802.patch Great! > 2 issues I've noticed so far: > 1) The javascript pop-up, upon a successful authenticate, comes up with > correct window including the logout message and button. At this point > the main browser window shows the redirect message. After the > appropriate redirect time (5 secs in this case), the main window > continues on to the correct redirect page (yahoo.com in this case). > Then, very quickly, the pop-up window redirects itself to an error 404, > stating (not the real url)"The requested URL /cgi-bin/450; > URL=https://authtester.auth.net/cgi-bin/login > was not found on this server.". > This is the message from the webserver on the auth server. Any help > pointing me towards fixing this would be most apprciated. This is a problem that my patches introduce. I haven't had a chance to track it down since I use the login_ok_nopopup.html. I think the changes I made to fix the redirect bug that was found months ago is the culprit here. I don't think I properly updated the login_ok.html file. I will look into it more. Also, check some of the previous posts, I think there might be a solution in one of them, I can't remember. > 2) To temporarily go around the above, I am using the > login_ok_nopopup.html page, however- how does one logout using this > method? This has probably already been answered but I just can't seem to > find it. One doesn't. Your session will end when the ARP times out, your Session-Timeout (RADIUS) has been reached, or when your Idle-Timeout is reached (not done). I added the nopopup to get rid of the annoying popup reauth thing. :) -- Jacob S. Barrett Chief Technology Officer PogoZone LLC email: jbarrett@pogozone.com web: www.pogozone.com voice: 360-676-8772 fax: 360-733-3941 address: 114 W. Magnolia Street Suite 417 Bellingham, Washington 98225 From jbarrett at pogozone.com Tue Oct 14 16:29:22 2003 From: jbarrett at pogozone.com (Jacob S. Barrett) Date: Tue, 14 Oct 2003 08:29:22 -0700 Subject: [NoCat] Nocat .82, patched with Radius/throttle patch In-Reply-To: <3F8ADA2E.5060705@mapu.com> References: <3F8ADA2E.5060705@mapu.com> Message-ID: <3F8C1652.2030803@pogozone.com> Try these patches to renew_pasv.html and renew.html. I think they will fix the problem with the 404 errors. Index: renew_pasv.html =================================================================== RCS file: /cvsroot/NoCatAuth/htdocs/renew_pasv.html,v retrieving revision 1.1.1.1 diff -u -r1.1.1.1 renew_pasv.html --- renew_pasv.html 23 Jun 2003 03:02:53 -0000 1.1.1.1 +++ renew_pasv.html 14 Oct 2003 15:20:11 -0000 @@ -1,7 +1,7 @@ NoCat login agent - +