GD Starsign Crypto USB Token
Dear All,
My GD Starsign Crypto USB Token no longer works after the upgrade to Yosemite. Anyone with the same problem? Hints on how to solve this issue?
Thanks in advance for your Help.
first, i apologize for the late response.
Safenet support says that:
" the Ikey Java sample delivered with Ikey 1000 SDK 2.2.0 was for Internet Explorer works only with J2RE 1.3.0, but does not work with J2RE 1.4.0. If you choose to rebuild the Java sample, then you must have Microsoft SDK for Java 4.0 in order to use the make file that was provided by SafeNet. These samples are not distributed and supported by SafeNet any more. "
Not very comprehensible if you read the description of the problem
Edited by: fuimens on May 25, 2009 5:01 AM
Similar Messages
-
Why Hit "No Token Present" error even the USB token has been inserted?
Hi,
I am totally new to programming with cryptographic token.
When i try to login my secure token after inserted it into the USB port, my program throws "No Token Present" error.
I confirmed that the USB token is inserted properly because i can login the token with the Token Admin app installed on my system.
I have also installed the Provider successfully dynamically in my code.
Can anyone give me some idea or solution?
Thanks very much.
I program based on JDK 6 update 7 on Windows XP SP2 and the USB Secure Token (ST 2) is from SecureMetrics.
The error message is as shown as below:
Please kindly help to take a look at my code.
Use Provider: SunPKCS11-FeitianPKCS
Version: 1.600000
Info: SunPKCS11-FeitianPKCS using library D:\Develop\JavaPKCS11\ST2pkcs11v10.dll
Services: 0
{color:#999999}{color:#ff0000}javax.security.auth.login.LoginException: No token{color}{color}{color:#ff0000} present{color}{color:#ff0000}
{color}at sun.security.pkcs11.SunPKCS11.login(SunPKCS11.java:1044)
// Main code
String configName = "D:\\Develop\\JavaPKCS11\\pkcs11.cfg";
Provider p = new sun.security.pkcs11.SunPKCS11(configName);
Security.addProvider(p);
Provider[] ps = Security.getProviders();
System.out.printf("Total providers %d\n\n", ps.length);
for (int i=0; i<ps.length;i++) {
System.out.printf("Provider[%d]: %s\n",i, ps.getName());
//Create the provider we defined
Provider p = Security.getProvider("SunPKCS11-FeitianPKCS");
System.out.printf("\nUse Provider: %s\n", p.getName());
System.out.printf("Version: %f\n", p.getVersion());
System.out.printf("Info: %s\n", p.getInfo());
//List all the services it supports
System.out.printf("Services: %d\n", p.getServices().size());
Set ss = p.getServices();
Iterator ii = ss.iterator();
Service s;
while (ii.hasNext()) {
s = (Service) ii.next();
System.out.printf("Service: %s - %s - %s \n", s.getType(), s.getAlgorithm(), s.getClassName());
try {
MyGuiCallbackHandler mcb = new MyGuiCallbackHandler();
Subject token = new Subject();
AuthProvider aprov = (AuthProvider) p;
//Login the token
aprov.login(token, mcb);
Config:
name = FeitianPKCS#11
library = D:\Develop\JavaPKCS11\ST2pkcs11v10.dllHi Martin,
Thanks very much for your kind help and sharing of experience.
Below is my complete code and also the exceptions that i get.
Program output + exceptions
Java PKCS#11 Demo
Load library success
Total providers: 10
Provider[0]: SUN
Provider[1]: SunRsaSign
Provider[2]: SunJSSE
Provider[3]: SunJCE
Provider[4]: SunJGSS
Provider[5]: SunSASL
Provider[6]: XMLDSig
Provider[7]: SunPCSC
Provider[8]: SunMSCAPI
Provider[9]: SunPKCS11-FeitianPKCS
Use Provider: SunPKCS11-FeitianPKCS
Version: 1.6
Info: SunPKCS11-FeitianPKCS using library D:\\Develop\\JavaPKCS11\\ngp11v211.dll
javax.security.auth.login.LoginException: No token present
at sun.security.pkcs11.SunPKCS11.login(SunPKCS11.java:1044)
at javapkcs11.Main.main(Main.java:112)Main.java
// Main.java
package javapkcs11;
import java.security.*;
import java.security.Provider.*;
import javax.security.auth.*;
import java.util.*;
import java.lang.*;
import javax.crypto.*;
import javax.crypto.spec.*;
//import sun.misc.*;
* @author
public class Main {
/** Creates a new instance of Main */
public Main() {
* @param args the command line arguments
public static void main(String[] args) {
System.out.println("Java PKCS#11 Demo\n\n");
//Load the configuration file
if (Main.configProvider())
System.out.println("Load library success\n\n");
else {
System.out.println("Load library failed\n\n");
return;
//List all the providers
Provider[] ps = Security.getProviders();
System.out.println("Total providers: " + ps.length);
for (int i=0; i<ps.length;i++) {
// System.out.printf("Provider[%d]: %s\n",i, ps.getName());
System.out.println("Provider[" + i + "]: " + ps[i].getName());
//Create the provider we defined
Provider p = Security.getProvider("SunPKCS11-FeitianPKCS");
//System.out.printf("\nUse Provider: %s\n", p.getName());
System.out.println("\nUse Provider: " + p.getName() );
//System.out.printf("Version: %f\n", p.getVersion());
System.out.println("Version: " + p.getVersion() );
//System.out.printf("Info: %s\n", p.getInfo());
System.out.println("Info: " + p.getInfo() );
//List all the services it supports
//System.out.printf("Services: %d\n", p.getServices().size());
Set ss = p.getServices();
Iterator ii = ss.iterator();
Service s;
while (ii.hasNext()) {
s = (Service) ii.next();
// System.out.printf("Service: %s - %s - %s \n", s.getType(), s.getAlgorithm(), s.getClassName());
System.out.println("Service: " + s.getType() + " " + s.getAlgorithm() + " " + s.getClassName());
try {
char pin[] = "99999999".toCharArray();
MyGuiCallbackHandler mcb = new MyGuiCallbackHandler();
Subject token = new Subject();
AuthProvider aprov = (AuthProvider) p;
//Login the token
aprov.login(token, mcb);
} catch (Exception e) {
e.printStackTrace();
public static boolean configProvider() {
//Here defines the path of configuration file, you could change it
String configName = "D:\\Develop\\JavaPKCS11\\pkcs11.cfg";
try {
Provider p = new sun.security.pkcs11.SunPKCS11(configName);
Security.addProvider(p);
} catch (Exception e) {
e.printStackTrace();
return false;
return true;
}PKCS11 Configname = FeitianPKCS
library = D:\\Develop\\JavaPKCS11\\ngp11v211.dll
slot = 3 -
Pkcs#11: store data in usb token
Hi,
can the pkcs#11 be used to store data on a usb token? For example storing an id?
ThanksHi,
can the pkcs#11 be used to store data on a usb token? For example storing an id?
Thanks -
Pkcs#11:store data in usb token (marked as q)
Hi,
can the pkcs#11 be used to store data on a usb token? For example storing an id?
Thanks
PS: What is this "mark as question" thing?
Edited by: uig on Oct 26, 2007 1:51 AMThanks.
for the sake of the record I fixed this by specifying a METHOD_DATA and DIRECTORY in sqlnet.ora like in
ENCRYPTION_WALLET_LOCATION=
(SOURCE=(METHOD=HSM)(METHOD_DATA=
(DIRECTORY=/app/oracle/admin/SID1/wallet)))
where the directory exists, as opposed to just
ENCRYPTION_WALLET_LOCATION=(SOURCE=(METHOD=HSM))
as it says in the doco...
I have a new issue, which I'll start a new thread for. -
Hyper-V 2012 R2 USB Token for guest
I have a piece of software that uses a USB token for licensing purposes. I'm attempting to virtualize the server with the software, but I can't get the USB token over to the VM. I've seen guides about mounting USB drives to VMs, but the token doesn't present itself as a drive. When plugged in, Windows goes through the normal procedure for recognizing a new device and then places it under "other devices" in the device manager. Is there a way I can make this device available to the VM Guest?
This topic first appeared in the Spiceworks CommunityHi Andre,
I would suggest you to install the supported Linux guest OS on hyper-v , please refer to following link:
http://technet.microsoft.com/en-US/library/dn531030.aspx
Best Regards
Elton Ji
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place. -
A new type of activeKey USB token problems.
My activeKey USB token worked until recently. I did this: https://discussions.apple.com/thread/2526943 and I installed the package: http://smartcardservices.macosforge.org. Once I renewed, the usb key doesn't show up in my keychain. This isn't a cache thing, as we tested a coworker's activKey which worked, then we updated it and it also doesn't show up in the key chain.
Linux pcscd daemons don't pick it up either.
Oooh, quick note: my company apparently had to do something recently because the activKeys weren't working on Windows 7. Is there a new type of activeKey that's been installed onto the card? (This stuff is mostly black magic to me.)
Any help?I have exactly the same problem - tried deleting the cache - tried reinstalling the smart card services - no success yet
This is a real problem as it leaves me dead for native Mac OS/X to access certain corporate web sites - have to use Parallels / Windows instead :-( -
How to "convert" a PC/SC spec Smart Card (usb token) to a Java Card?
Hi experts,
I've got a usb token from OEM and the only thing they told me is that the token is manufactured according to PC/SC spec. OEM didn't say anything about the proccessor, memory, etc. I'm no expert in hardware. But according to what I read on the web, a Java Card must have JCVM in the on-card memory. I'm wondering if there is a way to initialize a JCVM in this PC/SC usb token?
Any help will be much appreciated!
Z.Zen"PC/SC compatible" is about software on the card as much as "PC compatible" is about the software in your computer. PC/SC deals with sending bytes to and from the token whereas JavaCard deals with working with those byte packets. Unless the token is a JavaCard, there's not much you can do. You need to get the ATR of the token via PC/SC, maybe that gives more information.
-
Detecting when the user is inserting a USB token
Dear Forum,
From a Java GUI application I'm trying to detect when a USB token (CrypToken from Marx) is inserted.
When I run the program below with the USB token inserted it works fine. If I start the program and then inserts the USB token I keep getting a ProviderException.
Any help is greatly appreciated.
Kind regards,
Morten Bruun
The exception I get:
java.security.ProviderException: Initialization failed
at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:186)
at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:76)
at tryout.TestInsertToken.getProvider(TestInsertToken.java:38)
at tryout.TestInsertToken.actionPerformed(TestInsertToken.java:47)
at javax.swing.Timer.fireActionPerformed(Unknown Source)
at javax.swing.Timer$DoPostEvent.run(Unknown Source)
at java.awt.event.InvocationEvent.dispatch(Unknown Source)
at java.awt.EventQueue.dispatchEvent(Unknown Source)
at java.awt.EventDispatchThread.pumpOneEventForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
at java.awt.EventDispatchThread.run(Unknown Source)
Caused by: java.security.ProviderException: slotListIndex is 0 but token only has 0slots
at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:171)
... 12 moreMy test program looks like this:
package tryout;
import java.awt.FlowLayout;
import java.awt.event.ActionEvent;
import java.awt.event.ActionListener;
import java.security.Provider;
import javax.swing.JFrame;
import javax.swing.JLabel;
import javax.swing.SwingUtilities;
import javax.swing.Timer;
public class TestInsertToken extends JFrame implements ActionListener {
private Timer timer;
private JLabel label;
TestInsertToken() {
this.setLayout(new FlowLayout());
this.setDefaultCloseOperation(EXIT_ON_CLOSE);
label = new JLabel("Insert token");
this.add(label);
timer = new Timer(1000, this);
timer.start();
this.setSize(300, 200);
this.setVisible(true);
private Provider getProvider() {
try {
return new sun.security.pkcs11.SunPKCS11("pkcs11.cfg");
} catch (Exception e) {
System.out.println("Got exception: " + e.getMessage());
e.printStackTrace();
return null;
public void actionPerformed(ActionEvent e) {
Provider provider = getProvider();
if(provider != null) {
this.label.setText("USB token detected: " + provider.getName());
this.timer.stop();
public static void main(String[] args) {
SwingUtilities.invokeLater(new Runnable() {
public void run() {
new TestInsertToken();
}Edited by: Hr.Bruun on Nov 10, 2008 2:13 PMThanks for replying, Andy!
I know that if I point my gateway at 2013, I should be fine. You mentioned that in this article:
http://social.technet.microsoft.com/Forums/sharepoint/en-US/f622ff81-0d97-44d3-9051-f22c381fe188/exchange-2010-and-um-on-exchange-2013?forum=exchangesvrunifiedmessaging
"Once the SIP connection is pointed to 2013, it will handle both the 2013 and 2010 Mailboxes in the Dial Plan" which I found and which was helpful.
But, in the TechNet walkthrough:
http://technet.microsoft.com/en-us/library/dn169226(v=exchg.150).aspx
And the checklist too:
http://technet.microsoft.com/en-us/library/dn169228(v=exchg.150).aspx
It's having us move the UM enabled users before we repoint the IP gateway, which is one of the final steps. Since we're just in pilot mode right now, we'd prefer to not re-point that just yet. Do you expect it shouldn't work? Is TechNet wrong or
am I misreading it or missing something else? -
I am using below code to sign a pdf using itextsharp version 5.5.1.0 . It works fine. But itextsharp 5.5.1.0
is having AGPL and i think it cannot be used in my application freely. But by using version below 4.1.6 which has GPL licence the same code does not work. So is there any alternative?
using System;
using System.Windows.Forms;
using System.IO;
using System.Security;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using iTextSharp.text.pdf;
using iTextSharp.text.pdf.security;
namespace SignPdf
public partial class Form1 : Form
public Form1()
InitializeComponent();
private SecureString GetSecurePin(string PinCode)
SecureString pwd = new SecureString();
foreach (var c in PinCode.ToCharArray()) pwd.AppendChar(c);
return pwd;
private void SignWithThisCert(X509Certificate2 cert)
string SourcePdfFileName = textBox1.Text;
string DestPdfFileName = textBox1.Text + "-Signed.pdf";
Org.BouncyCastle.X509.X509CertificateParser cp = new Org.BouncyCastle.X509.X509CertificateParser();
Org.BouncyCastle.X509.X509Certificate[] chain = new Org.BouncyCastle.X509.X509Certificate[] { cp.ReadCertificate(cert.RawData) };
IExternalSignature externalSignature = new X509Certificate2Signature(cert, "SHA-1");
PdfReader pdfReader = new PdfReader(SourcePdfFileName);
FileStream signedPdf = new FileStream(DestPdfFileName, FileMode.Create); //the output pdf file
PdfStamper pdfStamper = PdfStamper.CreateSignature(pdfReader, signedPdf, '\0');
PdfSignatureAppearance signatureAppearance = pdfStamper.SignatureAppearance;
//here set signatureAppearance at your will
signatureAppearance.Reason = "Because I can";
signatureAppearance.Location = "My location";
signatureAppearance.SignatureRenderingMode = PdfSignatureAppearance.RenderingMode.DESCRIPTION;
MakeSignature.SignDetached(signatureAppearance, externalSignature, chain, null, null, null, 0, CryptoStandard.CMS);
//MakeSignature.SignDetached(signatureAppearance, externalSignature, chain, null, null, null, 0, CryptoStandard.CADES);
MessageBox.Show("Done");
private void Form1_Load(object sender, EventArgs e)
private void button1_Click_1(object sender, EventArgs e)
//Sign with certificate selection in the windows certificate store
X509Store store = new X509Store(StoreLocation.CurrentUser);
store.Open(OpenFlags.ReadOnly);
X509Certificate2 cert = null;
//manually chose the certificate in the store
X509Certificate2Collection sel = X509Certificate2UI.SelectFromCollection(store.Certificates, null, null, X509SelectionFlag.SingleSelection);
if (sel.Count > 0)
cert = sel[0];
else
MessageBox.Show("Certificate not found");
return;
SignWithThisCert(cert);hi.
you may return to the iTextshap version to 5.3.3, it works fine to sign a PDF using external USB token.
free C#
Excel component being evaluated, any other recommendation is appreciated.
Thanks and Regards.
But version 5.3.3 is also having AGPL licence, As i said in question
version below 4.1.6 has GPL licence. -
How to sign PDF with a smart card or USB token in C# through IAC ?
Hi,
My goal is to apply a certification signature (MDP) to a PDF document with a smart card (Belgium identity card) from a C# application.
I start Acrobat through IAC.
The JavaScript object apparently can only sign with PKCS12 file (.pfx)...
To sign a PDF with a smart card I need to develop a plug-in if I am right?
The samples in the SDK are to get a certificate from the windows certificate store or to write a Third party handler.
I already get the certificate context (an HCRYPPROV object from windows certificate store)
How can I create a signature field but mostly sign it? With DigSig I guess, but I’m lost in the API… does
I have to use DigSigSignDoc ?
Syntax : void DigSigSignDoc(PDDoc pdDoc, CosObj sigField, ASAtom filterKey)
The filterKey value for the windows certificate store is “Adobe.PPKMS” but how can I choose my certificate?
I also have to build a signature reference dictionary i guess?
What does i have to do and in which order? I can't find any documentation on this.
There is a more simple way?
Thank you,
Goffin
FabianHi,
-download the JDK sample "sdkAddSignature.js"
-change the sign methode like this :
Sign = app.trustedFunction (
function( sigField, DigSigHandlerName )
try {
app.beginPriv();
//the diSigHandler is "Adobe.PPKLite"
var myEngine = security.getHandler(DigSigHandlerName);
var ids = myEngine.digitalIDs;
//choose an id which is installed in the microsoft store
var oCert = ids.certs[3];
// for (var i=0; i<ids.certs.length; i++)
// console.println("certificat n°"+ i + " " +ids.certs[i]);
var oParams = {cPassword:"0000" , oEndUserSignCert:oCert }
if(myEngine.login({cPassword:"0000",oParams:oParams,bUI:false}))
console.println("OK");
else
console.println("Error");
console.println("sigfield :" + sigField);
sigField.signatureSign({oSig: myEngine,oInfo: { password: "0000",reason: ACROSDK.sigReason,location: ACROSDK.sigLocation,contactInfo: ACROSDK.sigContactInfo}});
app.endPriv
} catch (e) {
console.println("An error occurred: " + e);
-perform some test using the javascript debugger
-and finally use IAC to execute the script -
How can reload pkcs#11 (digital signature) ?
Hi Iam working on DigitalSignature.
Iam using Aladdin eToken pro32k
Initially Iam able to load usb tokens through application and sign the pdf documents.
1) Iam giving right password and able to do sign on pdf document through crypto usb token.
After this i didn't disconnected my usb token and try to sign another pdf doc but at this time
Iam giving wrong password(PIN) to usb token but it is going to sign successfully.
Here is the code for load a usbtoken through application.
// The cfg file contains name = GNFCeToken
//library = c:\WINDOWS\system32\eTpkcs11.dll
String configName = "C:/pkcs11.cfg";
Provider provider = new sun.security.pkcs11.SunPKCS11(configName);
Security.addProvider(provider);
KeyStore keyStore = null;
keyStore = KeyStore.getInstance("PKCS11",provider);
keyStore.load(null,tokenPassword);
provider = keyStore.getProvider();
For signing a pdf doc second time I need to reload the usb token every time.
So how can I reload usb token through programatically?
Any replys will appriciate greatly."Registering" the credentials is something that is vendor middleware specific. It has nothing to do with Java code. An example of a passing mention of it is on this page: http://www.bestoken.com/support.html - "But the main function for it is that it can detect plug/unplug of
hardware, and automatically read the certificates in hardware and
register it to certificate storage section of the system." Some middlewares can do it automatically if you enable the option, some you must do it manually all the time.
Well, it looks like the MSCAPI support works a little smoother with software-based credentials. I wrote the following test:
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.cert.X509Certificate;
import java.util.Enumeration;
public class CAPITest {
public static void main(String[] args){
try {
KeyStore ks = KeyStore.getInstance("Windows-MY");
ks.load(null, null) ;
Enumeration en = ks.aliases() ;
while (en.hasMoreElements()) {
String alias = (String) en.nextElement();
X509Certificate c = (X509Certificate) ks.getCertificate(alias);
PrivateKey key = (PrivateKey) ks.getKey(alias, null);
if (key != null) {
System.out.println(c.getSubjectDN().getName() + " has private key");
else {
System.out.println(c.getSubjectDN().getName());
} catch (Exception ex) {
ex.printStackTrace();
}When I ran it I got a listing of 9 certs, 4 having private keys. No password popups or anything. 3 of the certs were on a currently inserted smartcard. When I removed the smartcard and ran it again I got a dialog belonging to my middleware asking me to insert my smartcard but even after I did, the OK button was disabled and I couldn't proceed.
You've mentioned eToken a few times. If that is the only hw token you are supporting then I would reccommend using the SunPKCS11 provider directly rather than letting Microsoft CAPI get in the way. Using the SunPKCS11 provider will sidestep the certificate registration issue.
You mention " The problem i am facing is say a system is used by 1000 user with there own eToken" as a possible use situation. Is this some sort of kiosk machine with a single shared account or each user has their own user account? If each user has their own account then their credentials won't mix. If they're all using the same account then again, I think you're better off using the SunPKCS11 provider and going directly to the eToken pkcs11 interface. That way you limit the list of certs to whatever is on the currently inserted token (which you should further inspect and limit to ones that have the digitial signature key usage bit set). -
Does Java Card require a USB CCID-compliant smart card reader?
Hi experts,
Does Java Card require a USB CCID-compliant smart card reader? I'm currently working with PC/SC usb token and it requires usb CCID-compliant smart card reader, which seems very inconvenient for my clients and I'm wondering if Java Card has the same issue? (I'm thinking about switching the project to Java Card)
Any help will be much appreciated!
Z.ZenHi,
You will still need to install drivers for some card readers to function correctly. I know some work out of the box on Windows and OS X (10.5+ at least) ships with the pcsclite CCID driver from the Muscle card project. When I view my reader in Windows device manager the Manufacturer is "USB CCID Compliant".
The only real difference between what you are doing with the USB CCID token and Java Card is that the card and reader are separate in the Java Card option where as the USB token has the reader and chip in one package.
Cheers,
Shane -
Hello everyone
today I am working on a mounted on a Red Hat Enterprise PKI
Linux Server release 5.5 (Tikanga) is Easycert 5.2.2.15. We need to know what are the necessary data that we have to go to the PKI so it can generate certificates of users in Active Directory for use with a USB Token (ACOS5-64 CHIP CRYPTO) functioning as Smart
Card to make the login of users on computers.
On the other hand also we need to know the necessary settings between the third party pki and the domains controllers (Windows 2012).
Greetings and I hope for you response.
TechCach> It is for Windows 2012.
nothing changed since Windows Server 2003. Here is a KB article:
http://support2.microsoft.com/kb/281245
> Is
the
scenario
supported
by
microsoft?
yes, of course. See KB article above.
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell FCIV tool. -
Issues using 887 when authenticating with MER on a Fibre connection
Hello All
I've been battling for a week now to get the config correct for Cisco 887VA.
I understand Sky use MER to authenticate, however, in order to create the PPP connection, I am using PPPoE without passing any authentication, other than the username|password through option 61 (and vendor information on option 60).
I have Wiresharked the provided Sky router SR102 to obtain DHCP option 60 and 61 information and have entered these as hex values in the dialer interface.
I have also spoofed the SR102 MAC address on the dialer interface.
I have created a sub interface on e0, using dot1q to tag traffic to VLAN 101
I can indeed see traffic on interface e0.101 but the dialer receives NO ip address.
I can also see the modem is connected and in sync.
Am I correct in assuming the e0.101 interface is equivalent to the WAN connection on a seperate modem?
Config is below - please ignore local IPs, etc
version 15.1
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
hostname ******-ADSL
boot-start-marker
boot-end-marker
no logging buffered
enable secret 5 *********
aaa new-model
aaa authentication login default local
aaa authorization exec default local
aaa session-id common
memory-size iomem 10
clock timezone BST 0 0
clock summer-time BST recurring last Sun Mar 2:00 last Sun Oct 3:00
crypto pki token default removal timeout 0
crypto pki trustpoint TP-self-signed-1112313640
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1112313640
revocation-check none
rsakeypair TP-self-signed-1112313640
crypto pki certificate chain TP-self-signed-1112313640
certificate self-signed 01 nvram:IOS-Self-Sig#1.cer
ip source-route
ip cef
ip domain name vdsl.******.net
ip name-server 8.8.8.8
no ipv6 cef
multilink bundle-name authenticated
archive
log config
hidekeys
username admin privilege 15 secret 5 *********
controller VDSL 0
no ip ftp passive
ip ssh authentication-retries 5
ip ssh version 2
interface Ethernet0
no ip address
interface Ethernet0.101
encapsulation dot1Q 101
pppoe-client dial-pool-number 1
interface ATM0
no ip address
shutdown
no atm ilmi-keepalive
interface FastEthernet0
no ip address
interface FastEthernet1
no ip address
interface FastEthernet2
no ip address
interface FastEthernet3
no ip address
interface Vlan1
ip address 1.1.1.1 255.255.0.0
ip flow ingress
ip flow egress
ip nat inside
ip virtual-reassembly in
interface Dialer1
mac-address ****.****.**38
mtu 1492
ip dhcp client request classless-static-route
ip dhcp client client-id hex <<HEX STRING>>
ip dhcp client class-id hex <<HEX STRING>>
ip address dhcp
no ip redirects
no ip proxy-arp
ip flow ingress
ip nat outside
no ip virtual-reassembly in
encapsulation ppp
ip route-cache policy
dialer pool 1
dialer-group 1
ppp ipcp dns request accept
ppp ipcp route default
ppp ipcp address accept
no cdp enable
router ospf 1
router-id 1.1.0.1
network 1.1.0.1 0.0.0.0 area 0
default-information originate
ip forward-protocol nd
ip http server
ip http access-class 1
ip http authentication local
ip http secure-server
ip flow-cache timeout inactive 10
ip flow-cache timeout active 5
ip flow-export version 9
ip flow-export destination 1.1.1.1 9991
ip flow-export destination 1.1.1.1 9991
ip nat inside source list NATACL interface Dialer1 overload
ip access-list standard NATACL
permit 1.0.0.0 0.255.255.255
logging esm config
access-list 1 permit 1.0.0.0 0.255.255.255
dialer-list 1 protocol ip permit
control-plane
banner motd ^CCCCCCCCC
*****************AUTHORISED USERS ONLY*****************
^C
line con 0
password 7 ***************
line aux 0
password 7 ***************
line vty 0 4
session-timeout 10
exec-timeout 0 0
timeout login response 300
transport input ssh
scheduler max-task-time 5000
end
Many thanksChris,
Just wondering if you managed to get anywhere with this, or just gave up? I'm a Sky Fibre user, sadly using the bundled "Sky Hub" (aptly named, as I consider "Layer 1 Network Hubs" to be just as gash as this ), and have battled with the MER DHCP-based authentication before.
Previously, I was experimenting using a Cisco Linksys E2400 (or E4200, I forget) running Tomato USB Firmware and was getting frustrated with the hex settings.
I notice in your configs you posted the following strings, which look like they are trying to send the DHCP Vendor ID/Options that MER needs:
ip dhcp client client-id hex <<HEX STRING>>
ip dhcp client class-id hex <<HEX STRING>>
For your specified <<HEX STRING>> were you also appending the necessary "0x3d" (61) to your custom-generated User+Pass hex (i.e. full string reads "0x3d<<USER+PASS HEX>>")?
Sources as below, but curious if this could fix it?
Sources
http://www.skyuser.co.uk/forum/technical-discussion/46464-skys-mer-why-does-not-work-other-routers-22.html
https://www.cm9.net/skypass/index.cgi -
Port Forwarding for RDP 3389 is not working
Hi,
I am having trouble getting rdp (port 3389) to forward to my server (10.20.30.20). I have made sure it is not an issue with the servers firewall, its just the cisco. I highlighted in red to what i thought I need in my config to get this to work. I have removed the last 2 octets of the public IP info for security .Here is the configuration below:
TAMSATR1#show run
Building configuration...
Current configuration : 11082 bytes
version 15.2
no service pad
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
hostname TAMSATR1
boot-start-marker
boot system flash:/c880data-universalk9-mz.152-1.T.bin
boot-end-marker
logging count
logging buffered 16384
enable secret
aaa new-model
aaa authentication login default local
aaa authentication login ipsec-vpn local
aaa authentication login ciscocp_vpn_xauth_ml_1 local
aaa authorization console
aaa authorization exec default local
aaa authorization network groupauthor local
aaa session-id common
memory-size iomem 10
clock timezone CST -6 0
clock summer-time CDT recurring
crypto pki token default removal timeout 0
crypto pki trustpoint TP-self-signed-1879941380
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1879941380
revocation-check none
rsakeypair TP-self-signed-1879941380
crypto pki certificate chain TP-self-signed-1879941380
certificate self-signed 01
3082024B 308201B4 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 31383739 39343133 3830301E 170D3131 30393136 31393035
32305A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 38373939
34313338 3030819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100BD7E 754A0A89 33AFD729 7035E8E1 C29A6806 04A31923 5AE2D53E 9181F76C
ED17D130 FC9B5767 6FD1F58B 87B3A96D FA74E919 8A87376A FF38A712 BD88DB31
88042B9C CCA8F3A6 39DC2448 CD749FC7 08805AF6 D3CDFFCB 1FE8B9A5 5466B2A4
E5DFA69E 636B83E4 3A2C02F9 D806A277 E6379EB8 76186B69 EA94D657 70E25B03
542D0203 010001A3 73307130 0F060355 1D130101 FF040530 030101FF 301E0603
ip dhcp excluded-address 10.20.30.1 10.20.30.99
ip dhcp excluded-address 10.20.30.201 10.20.30.254
ip dhcp excluded-address 10.20.30.250
ip dhcp pool tamDHCPpool
import all
network 10.20.30.0 255.255.255.0
default-router 10.20.30.1
domain-name domain.com
dns-server 10.20.30.20 8.8.8.8
ip domain name domain.com
ip name-server 10.20.30.20
ip cef
no ipv6 cef
license udi pid CISCO881W-GN-A-K9 sn
crypto vpn anyconnect flash:/webvpn/anyconnect-dart-win-2.5.3054-k9.pkg sequence 1
ip tftp source-interface Vlan1
class-map type inspect match-all CCP_SSLVPN
match access-group name CCP_IP
policy-map type inspect ccp-sslvpn-pol
class type inspect CCP_SSLVPN
pass
zone security sslvpn-zone
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp policy 20
encr aes 192
authentication pre-share
group 2
crypto isakmp key password
crypto isakmp client configuration group ipsec-ra
key password
dns 10.20.30.20
domain tamgmt.com
pool sat-ipsec-vpn-pool
netmask 255.255.255.0
crypto ipsec transform-set ipsec-ra esp-aes esp-sha-hmac
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
crypto ipsec profile VTI
set security-association replay window-size 512
set transform-set TSET
crypto dynamic-map dynmap 10
set transform-set ipsec-ra
reverse-route
crypto map clientmap client authentication list ipsec-vpn
crypto map clientmap isakmp authorization list groupauthor
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap
interface Loopback0
ip address 10.20.250.1 255.255.255.252
ip nat inside
ip virtual-reassembly in
interface Tunnel0
description To AUS
ip address 192.168.10.1 255.255.255.252
load-interval 30
tunnel source
tunnel mode ipsec ipv4
tunnel destination
tunnel protection ipsec profile VTI
interface FastEthernet0
no ip address
interface FastEthernet1
no ip address
interface FastEthernet2
no ip address
interface FastEthernet3
no ip address
interface FastEthernet4
ip address 1.2.3.4
ip access-group INTERNET_IN in
ip access-group INTERNET_OUT out
ip nat outside
ip virtual-reassembly in
no ip route-cache cef
ip route-cache policy
ip policy route-map IPSEC-RA-ROUTE-MAP
duplex auto
speed auto
crypto map clientmap
interface Virtual-Template1
ip unnumbered Vlan1
zone-member security sslvpn-zone
interface wlan-ap0
description Service module interface to manage the embedded AP
ip unnumbered Vlan1
arp timeout 0
interface Wlan-GigabitEthernet0
description Internal switch interface connecting to the embedded AP
switchport mode trunk
no ip address
interface Vlan1
description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$
ip address 10.20.30.1 255.255.255.0
ip nat inside
ip virtual-reassembly in
ip tcp adjust-mss 1452
ip local pool sat-ipsec-vpn-pool 10.20.30.209 10.20.30.239
ip default-gateway 71.41.20.129
ip forward-protocol nd
ip http server
ip http access-class 23
ip http authentication local
ip http secure-server
ip http timeout-policy idle 60 life 86400 requests 10000
ip dns server
ip nat inside source list ACL-POLICY-NAT interface FastEthernet4 overload
ip nat inside source static tcp 10.20.30.20 3389 interface FastEthernet4 3389
ip nat inside source static 10.20.30.20 (public ip)
ip route 0.0.0.0 0.0.0.0 public ip
ip route 10.20.40.0 255.255.255.0 192.168.10.2 name AUS_LAN
ip access-list extended ACL-POLICY-NAT
deny ip 10.0.0.0 0.255.255.255 10.20.30.208 0.0.0.15
deny ip 172.16.0.0 0.15.255.255 10.20.30.208 0.0.0.15
deny ip 192.168.0.0 0.0.255.255 10.20.30.208 0.0.0.15
permit ip 10.20.30.0 0.0.0.255 any
permit ip 10.20.31.208 0.0.0.15 any
ip access-list extended CCP_IP
remark CCP_ACL Category=128
permit ip any any
ip access-list extended INTERNET_IN
permit icmp any any echo
permit icmp any any echo-reply
permit icmp any any unreachable
permit icmp any any time-exceeded
permit esp host 24.153. host 66.196
permit udp host 24.153 host 71.41.eq isakmp
permit tcp host 70.123. host 71.41 eq 22
permit tcp host 72.177. host 71.41 eq 22
permit tcp host 70.123. host 71.41. eq 22
permit tcp any host 71..134 eq 443
permit tcp host 70.123. host 71.41 eq 443
permit tcp host 72.177. host 71.41. eq 443
permit udp host 198.82. host 71.41 eq ntp
permit udp any host 71.41. eq isakmp
permit udp any host 71.41eq non500-isakmp
permit tcp host 192.223. host 71.41. eq 4022
permit tcp host 155.199. host 71.41 eq 4022
permit tcp host 155.199. host 71.41. eq 4022
permit udp host 192.223. host 71.41. eq 4022
permit udp host 155.199. host 71.41. eq 4022
permit udp host 155.199. host 71.41. eq 4022
permit tcp any host 10.20.30.20 eq 3389
evaluate INTERNET_REFLECTED
deny ip any any
ip access-list extended INTERNET_OUT
permit ip any any reflect INTERNET_REFLECTED timeout 300
ip access-list extended IPSEC-RA-ROUTE-MAP
deny ip 10.20.30.208 0.0.0.15 10.0.0.0 0.255.255.255
deny ip 10.20.30.224 0.0.0.15 10.0.0.0 0.255.255.255
deny ip 10.20.30.208 0.0.0.15 172.16.0.0 0.15.255.255
deny ip 10.20.30.224 0.0.0.15 172.16.0.0 0.15.255.255
deny ip 10.20.30.208 0.0.0.15 192.168.0.0 0.0.255.255
deny ip 10.20.30.224 0.0.0.15 192.168.0.0 0.0.255.255
permit ip 10.20.30.208 0.0.0.15 any
deny ip any any
access-list 23 permit 70.123.
access-list 23 permit 10.20.30.0 0.0.0.255
access-list 24 permit 72.177.
no cdp run
route-map IPSEC-RA-ROUTE-MAP permit 10
match ip address IPSEC-RA-ROUTE-MAP
set ip next-hop 10.20.250.2
banner motd ^C
UNAUTHORIZED ACCESS TO THIS NETWORK DEVICE IS PROHIBITED.
You must have explicit permission to access or configure this device. All activities performed on this device are logged and violations of this policy may result in disciplinary and/or legal action.
^C
line con 0
logging synchronous
line aux 0
line 2
no activation-character
no exec
transport preferred none
transport input all
line vty 0
access-class 23 in
privilege level 15
logging synchronous
transport input telnet ssh
line vty 1 4
access-class 23 in
exec-timeout 5 0
privilege level 15
logging synchronous
transport input telnet ssh
scheduler max-task-time 5000
ntp server 198.82.1.201
webvpn gateway gateway_1
ip address 71.41. port 443
http-redirect port 80
ssl encryption rc4-md5
ssl trustpoint TP-self-signed-1879941380
inservice
webvpn context TAM-SSL-VPN
title "title"
logo file titleist_logo.jpg
secondary-color white
title-color #CCCC66
text-color black
login-message "RESTRICTED ACCESS"
policy group policy_1
functions svc-enabled
svc address-pool "sat-ipsec-vpn-pool"
svc default-domain "domain.com"
svc keep-client-installed
svc split dns "domain.com"
svc split include 10.0.0.0 255.0.0.0
svc split include 192.168.0.0 255.255.0.0
svc split include 172.16.0.0 255.240.0.0
svc dns-server primary 10.20.30.20
svc dns-server secondary 66.196.216.10
default-group-policy policy_1
aaa authentication list ciscocp_vpn_xauth_ml_1
gateway gateway_1
ssl authenticate verify all
inservice
endHi,
I didnt see anything marked with red in the above? (Atleast when I was reading)
I have not really had to deal with Routers at all since we all access control and NAT with firewalls.
But to me it seems you have allowed the traffic to the actual IP address of the internal server rather than the public IP NAT IP address which in this case seems to be configured to use your FastEthernet4 interfaces public IP address.
There also seems to be a Static NAT configured for the same internal host so I am wondering why the Static PAT (Port Forward) is used?
- Jouni
Maybe you are looking for
-
How to identify whether a TransientVO value has been changed or not on jsff
Hi I have a TransientVO view object dragged onto jsff page. Is there any way to identify in backing bean or in Application Module to identify whether there is any attribute value has been modified or not? Thanks in advance !!
-
recently i have downloaded many video converter softwares. After that whenever i open my emails, I am not able to load the pages. Only it opens to inbox and when i click any mail in inbox, it opens the mail and immediately close that automatically wi
-
Can quicktime pro capture video stream?
Can QT pro record video streams off the internet? I thought it was only able to capture embedded video files. Video streams aren't donwloaded into cache, so they have to be saved as they're received. Could someone clarify? Thank you.
-
Photoshop: Character styles API
Hello, Is there any way how I can access Character styles of a text layer (i.e. bolded out words etc.) via either Extendscript or via com-object - I can't figure it out, can I change only the Layer style itself? Thank you very much!
-
BI Publisher Desktop in Word 2010 - add-in active but no menu or toolbar
I have installed BI Publisher Desktop. In Word 2010, I can see the add-in is active. But i do not see the familiar BI Publisher menu items or toolbar items. I am just getting used to Word2010 and the new ribbon toolbar concept. (I formerly used BI Pu