PacketFence - BTS - Issues

0001870: Web admin page for switches has phantom second page

Wed, 04 Mar 2015 15:05:24 -0500

(This applies to PF 4.6.1, which isn't in the picklist yet.)
When PF has exactly 25 switches defined, the web admin switches page adds footer links for a second page of switches. Advancing to page 2 displays a blank space where switches should be listed, along with a button to add another switch. Deleting a switch (switch count 24) properly displays only one page again.

0001826: Snort suddenly not starting but after a variable spelling change, it works.

Wed, 04 Mar 2015 12:11:29 -0500

Snort suddenly not working after a packetfence service restart. On /var/log/messages, it shows that it has a problem on a variable $DNS_SERVERS and When I run the cat /var/log/messages and got FATAL Error on snort as shown below:

Sep 25 13:00:05 spfcn01 snort[26763]: FATAL ERROR: /usr/local/pf/conf/snort/emerging-trojan.rules(143) Undefined variable in the string: $DNS_SERVERS.

and the I run cat /usr/local/pf/conf/snort.conf and edit the:

var DNS_SERVERS [%%dnsservers%%]

and changed to:

var DNS_SERVERS [%%dns_servers%%]

and then restarted again the packetfence and the result, snort service is now running.

0001829: Admin Guide 4.4.0 clarification on paper pages 31-32

Wed, 04 Mar 2015 12:10:06 -0500

On paper pages 31-32 (PDF pages 35-36), there seems to be confusion in the sample command line text boxes:

For Centos/RHEL:

(box)
# usermod -a -G wbpriv pf
(/box)

Finally, start winbind, and test the setup using ntlm_auth and radtest:

(box)
# service winbind start
# chkconfig --level 345 winbind on
(/box)

For Debian and Ubuntu:

(box)
# usermod -a -G winbindd_priv pf
# ntlm_auth --username myDomainUser
# radtest -t mschap -x myDomainUser myDomainPassword localhost:18120 12
testing123
Sending Access-Request of id 108 to 127.0.0.1 port 18120
User-Name = "myDomainUser"
NAS-IP-Address = 10.0.0.1
NAS-Port = 12
Message-Authenticator = 0x00000000000000000000000000000000
MS-CHAP-Challenge = 0x79d62c9da4e55104
MS-CHAP-Response =
0x000100000000000000000000000000000000000000000000000091c843b420f0dec4228ed2f26bff07d5e49ad9a2974229e5
rad_recv: Access-Accept packet from host 127.0.0.1 port 18120, id=108,
length=20
(/box)

When following this through for CentOS/RHEL, you do not do the ntlm_auth or radtest tests...since it is only in the Debian/Ubuntu textbox!!!

ASSuming that the service and chkconfig work the same under Debian/Ubuntu (which I have personally never used), this order seems to make sense to me:

For Centos/RHEL:

(box)
# usermod -a -G wbpriv pf
(/box)

For Debian and Ubuntu:

(box)
# usermod -a -G winbindd_priv pf
(/box)

Start winbind:

(box)
# service winbind start
# chkconfig --level 345 winbind on
(/box)

Finally, test the setup using ntlm_auth and radtest:

(box)
# ntlm_auth --username myDomainUser
# radtest -t mschap -x myDomainUser myDomainPassword localhost:18120 12
testing123
Sending Access-Request of id 108 to 127.0.0.1 port 18120
User-Name = "myDomainUser"
NAS-IP-Address = 10.0.0.1
NAS-Port = 12
Message-Authenticator = 0x00000000000000000000000000000000
MS-CHAP-Challenge = 0x79d62c9da4e55104
MS-CHAP-Response =
0x000100000000000000000000000000000000000000000000000091c843b420f0dec4228ed2f26bff07d5e49ad9a2974229e5
rad_recv: Access-Accept packet from host 127.0.0.1 port 18120, id=108,
length=20
(/box)

0001841: Issue with Nessus and Net::Nessus::XMLRPC

Wed, 04 Mar 2015 12:05:42 -0500

Some issues with Net::Nessus::XMLRPC upstream module may prevent Nessus scan succeed.

Impacts:
- Issue with SSL communication when a self-signed certificate is being used between PacketFence and the Nessus server (https)
- Issue when trying to export the report

Patch have been submitted but never merged.

0001851: When creating "Routed Networks" provide default values for DHCP leases

Wed, 04 Mar 2015 12:04:44 -0500

When creating a routed network, users are forced to specify DHCP lease times:

Default Lease Time:

Max Lease Time:

Most people will have no idea what values are good for this, so please provide default values. If someone wants a different value, it is very simple to change.

0001857: Add the ability to detect the switch type using SNMP

Wed, 04 Mar 2015 11:30:42 -0500

Admins want a simple way to deploy Packetfence, with the least tweaking necessary to make it work. One way to accomplish this is to auto-detect the type of switch, based on SNMP response. (I believe this is similar to how "Uplink" and "VOIP" detection works.)

Packetfence should send an snmpget of 1.3.6.1.2.1.1.2.0 to the switch. This will return the sysOID of the switch. This number can then be looked up in a table that maps sysOID to device type. (There are several open source tools like (www.nedi.ch) and Observium.org that already have this table.)

Now Packetfence knows what kind of switch it is talking to, without required the admin to specify the type.

http://www.alvestrand.no/objectid/1.3.6.1.2.1.1.2.html [^]

0001842: Implement RADIUS de-authentication for Meru Wireless Controllers

Wed, 04 Mar 2015 11:28:43 -0500

Per a post to the PF-users list by Tim DeNike on 6 March 2014, Meru has added RADIUS de-auth to their firmware starting with System Director 5.3.x. He even posted sample code to use the feature, which I can't use since the directory structure appears to have changed with PF 4.5. Long story short, the existing module keeps telling us to pressure the vendor to implement RADUIS de-auth. We have done our part. Tag, you're it... :-)

0001853: Provide the ability to view logs from the web interface

Wed, 04 Mar 2015 11:24:06 -0500

Packetfence has some very useful log files, including "packetfence.log", "radius.log", and others. These files are very helpful in understanding what is happening with Packetfence.

It would be very useful for users to be able to view these logs in the web interface. A static view of the file will provide this function. However, a real-time scrolling interface could really help admins understand exactly what happens when they plug in a port.

0001858: Display description when adding Triggers to a Violation