Why does Google 2FA (libpam) not work in opensuse - openssh

I have a little problem with google_authenticator_libpam in openSUSE. I have tryied to find the Problem myselfe, but nothing worked. I have tested it on two systems. I installed the package google_authenticator_libpam. After that i editet the file:"/etc/pam.d/sshd"
#%PAM-1.0
auth required pam_google_authenticator.so noskewadj echo_verification_code nullok
auth requisite pam_nologin.so
#auth include common-auth
account requisite pam_nologin.so
account include common-account
password include common-password
session required pam_loginuid.so
session include common-session
session optional pam_lastlog.so silent noupdate showfailed
session optional pam_keyinit.so force revoke
~
And I editet the file: "/etc/ssh/sshd_config" (Added)
ChallengeResponseAuthentication yes
AuthenticationMethods keyboard-interactive,password
And finally i restarted the sshd service.
After those steps the SSH-Promt asks for the Verification key. When I enter the correct key, the log file: "/var/log/message" said "Invalid verification code"
My time is correct too.
Can anyone help me?
~

Related

Cannot access webmasters.dat: No such file or directory

i am trying to access google search console api - tried the sample [https://github.com/googleapis/google-api-python-client/blob/master/samples/searchconsole/search_analytics_api_sample.py][1]
i followed the instructions:
1) Install the Google Python client library, as shown at
https://developers.google.com/webmaster-tools/v3/libraries.
2) Sign up for a new project in the Google APIs console at
https://code.google.com/apis/console.
3) Register the project to use
OAuth2.0 for installed applications.
4) Copy your client ID, client
secret, and redirect URL into the client_secrets.json file included in
this package.
5) Run the app in the command-line as shown below.
Sample usage: $ python search_analytics_api_sample.py
'https://www.example.com/' '2015-05-01' '2015-05-30'
of course for my site and newer dates..
recieved in cmd the warning:
\AppData\Local\Programs\Python\Python38\lib\site-packages\oauth2client_helpers.py:255:
UserWarning: Cannot access webmasters.dat: No such file or directory
in the window opened in the browser got the message:
Error 400: redirect_uri_mismatch The redirect URI in the request,
http://localhost:8080/, does not match the ones authorized for the
OAuth client. To update the authorized redirect URIs, visit:
https://console.developers.google.com/apis/credentials/oauthclient/xxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com?project=xxxxxxxxxxxx
i configured the redirect URI as http://localhost:8080/ but still the same
appreciate any help thanks

Can't create bucket using aws-sdk ruby gem. Aws::S3::Errors::SignatureDoesNotMatch

I have a new computer and I'm trying to set up my AWS CLI environment so that I can run a management console I've created.
This is the code I'm running:
def create_bucket(bucket_args)
AWS_S3 = Aws::S3::Client.new(signature_version: 'v4')
AWS_S3.create_bucket(bucket_args)
end
Which raises this error:
Aws::S3::Errors::SignatureDoesNotMatch - The request signature we calculated does not match the signature you provided. Check your key and signing method.:
This was working properly on my other computer, which I no longer have access to. I remember debugging this same error on the other computer, and I thought I had resolved it by adding signature_version = s3v4 to my ~/.aws/config file. But this fix is not working on my new computer, and I'm not sure why.
To give some more context: I am using aws-sdk (2.5.5) and these aws cli specs: aws-cli/1.11.2 Python/2.7.12 Linux/4.4.0-38-generic botocore/1.4.60
In this case the issue was that my aws credentials (in ~/.aws/credentials) - specifically my secret token - were invalid.
The original had a slash in it:
xx/xxxxxxxxxxxxxxxxxxxxxxxxxx
which I didn't notice at first, so when I double clicked the token to select the word, it didn't include the first three characters. I then pasted this into the terminal when running aws configure.
To fix this, I found the correct, original secret acceess token and set the correct value in ~/.aws/credentials.

Redmine: 422 invalid form authenticity token

I'm using this plugin to enable SSO between my IDP and redmine. Purpose is to avoid re entering username and password when login to the redmine. Both Redmine and the IDP connected to an external LDAP. Problem is after redirecting back to the redmine from my IDP (after entering username & password), It's giving this error.
Redmine version: 2.5.2,
Ruby version: 1.9.3,
Rails version: 3.2.19
Some details for Redmine 3.4.2
If you get an error 422 (Can't verify CSRF token authenticity),
you must go to controller file
/app/controller/aplication_controller.rb
and remove or comment string with code
render_error :status => 422, :message => "invalid form authenticity token."
then add code
redirect_back_or_default(home_path)
So, your code will be like this
# render_error :status => 422, :message => "invalid form authenticity token."
redirect_back_or_default(home_path)
For us, this error appeared when an already logged-on user tried to re-logon (eg. using multiple browser tabs).
The solution is here, patch application_controller.rb:
- render_error "Invalid form authenticity token."
+ redirect_back_or_default home_path
It happened to us when using a reverse-proxy SSO. The configured name in the SSO was not with the same case than the user name within Redmine.
Extract from nginx configuration :
# Pass the user to that stupid Passenger Phusion
# that cannot evaluate variables like $http_x_forwarded_user
passenger_env_var REMOTE_USER nicolasm;
And our user name in Redmine was NicolasM.
Removing security as suggested by other answers is not a long lasting solution.

Bower calls blocked by corporate proxy

I'm trying to use Bower for a web app, but find myself hitting some sort of proxy issues:
D:\>bower search jquery
bower retry Request to https://bower.herokuapp.com/packages/search/jquery failed with ECONNRESET, retrying in 1.2s
bower retry Request to https://bower.herokuapp.com/packages/search/jquery failed with ECONNRESET, retrying in 2.5s
bower retry Request to https://bower.herokuapp.com/packages/search/jquery failed with ECONNRESET, retrying in 6.8s
bower retry Request to https://bower.herokuapp.com/packages/search/jquery failed with ECONNRESET, retrying in 15.1s
bower retry Request to https://bower.herokuapp.com/packages/search/jquery failed with ECONNRESET, retrying in 20.3s
bower ECONNRESET Request to https://bower.herokuapp.com/packages/search/jquery failed: tunneling socket could not be established, cause=Parse Error
Relevant points:
I can browse to https://bower.herokuapp.com/packages/search/jquery and it returns a full json response.
I can use git to clone, both using the git:// protocol and http(s).
I can use NPM directly without these issues
I've tried using Fiddler to determine what's being blocked, but it doesn't detect any calls from the Bower command. I can see calls from NPM commands in Fiddler.
I've searched the Bower issues list, seen similar issues, but they either have no solution or it doesn't seem quite the same as mine.
Any ideas?
Thanks #user3259967
This did the job.
I would like to add that if you are behind a proxy that needs to be authenticated, you can add the username/password to your .bowerrc file.
{
"directory": "library",
"registry": "http://bower.herokuapp.com",
"proxy":"http://<USERNAME>:<PASSWORD>#<PROXY_IP>:<PROXY_PORT>/",
"https-proxy":"http://<USERNAME>:<PASSWORD>#<PROXY_IP>:<PROXY_PORT>/"
}
NOTICE the use of http:// in https-proxy
The solution for me is this config .bowerrc
{
"directory": "vendor",
"registry": "http://bower.herokuapp.com",
"proxy": "http://<user>:<pwd>#proxy.host.br:8080",
"https-proxy": "http://<user>:<pwd>#proxy.host.br:8080",
"strict-ssl": false
}
Using the http protocol in https-proxy plus registry entry with http protocol.
Remember to change 8080 port number to whatever is yours proxy server port.
Are you behind a proxy?
Have you set up environment variables HTTP_PROXY and HTTPS_PROXY?
SET HTTP_PROXY=http://yourproxyserver:yourproxyport
SET HTTPS_PROXY=http://yourproxyserver:yourproxyport
Try changing the registry value in your .bowerrc:
{
"registry": "http://bower.herokuapp.com"
}
I did not have a .bowerrc file to configure my bower settings. I found the settings living in a file called defaults.js. found under "C:\...\bower\node_modules\bower-config\lib\util\defaults.js"
I hope this helps others:
var defaults = {
'cwd': process.cwd(),
'directory': 'bower_components',
'registry': 'http://bower.herokuapp.com',
'shorthand-resolver': 'git://github.com/{{owner}}/{{package}}.git',
'tmp': paths.tmp,
'proxy': '<<http://user:pass#proxy:port>>', // change proxy here or at the top
'https-proxy': '<<http://user:pass#proxy:port>>', // change proxy here or at the top
'timeout': 30000,
'ca': { search: [] },
'strict-ssl': false,
'user-agent': userAgent,
'color': true,
'interactive': null,
'storage': {
packages: path.join(paths.cache, 'packages'),
links: path.join(paths.data, 'links'),
completion: path.join(paths.data, 'completion'),
registry: path.join(paths.cache, 'registry'),
empty: path.join(paths.data, 'empty') // Empty dir, used in GIT_TEMPLATE_DIR among others
}
};
module.exports = defaults;
you can try suggest #thebignet into same issue on GitHub
Set proxy, https-proxy and strict-ssl configuration into .bowerrc File :
{
"proxy" : "http://<host>:<port>",
"https-proxy" : "http://<host>:<port>",
"strict-ssl" : false
}
But you must run Command from terminal:
git config --global url."https://".insteadOf git://
"strict-ssl": false
in .bowerrc did for me
For Win 7.
What worked for me , are below steps as suggested at this link - read #nanowizard answer.
In .bowerrc file, remove any http_proxy / https_proxy settings that
you might have done earlier. This is important.
So final content of this file should look like :-
{
"directory": "app/bower_components"
}
Set environment variables in your pc - http_proxy and https_proxy to your corporate firewall proxy. In case, your corporate proxy requires authentication and if your password contains special characters, convert it to hex form as suggested by this link. As in my case escaping of characters with '\' did not help. Also I had to restart my system.
Note :
http_proxy and https_proxy should contain same proxy address as shown below
http_proxy = http://<user>:<password>#<your company proxy>:<port>
https_proxy= http://<user>:<password>#<your company proxy>:<port> ->Note no 's' in http://...
I am behind corporate firewall and I have to specify domain name too.
None of these answers worked for me. Here is what I did -
Downloaded CNTLM from http://cntlm.sourceforge.net/
Obviously installed it.
Open up cntml.ini and change the following
Domain your_domain_name
Username your_domain_username
Password your_domain_passowrd
PassLM 1AD35398BE6565DDB5C4EF70C0593492 (uncomment this)
PassNT 77B9081511704EE852F94227CF48A793 (uncomment this too)
Proxy http://localhost:8888
Go to services.msc and start the CNTLM Authentication service.
Download Fiddler 4/2 (whatever they call it).
Install this too. This will run in http://localhost:8888
Now whatever program you’re running forward(proxy) it to http://locahost:3128 ( that’s what CNTLM is running.)
In this case specify http.proxy and https.proxy as http://localhost:8888
This will work for other client programs. Just specify proxy as http://localhost:8888
its work for me to change in .bowerrc file
{
"directory": "client/lib",
"registry": "http://bower.herokuapp.com",
"proxy":"http://192.168.1.205:3228",
"https-proxy":"http://192.168.1.205:3228"
}
where client/lib is installation directory where do you want to install
and http://192.168.1.205:3228 is your proxy ip with port. corporate proxy can be different according to oraganization.
In addition to setting the below proxy in .bowerrc:
{
"directory": "app/bower_components",
"proxy":"http://<user>:<password>#proxy.company.com:<proxy-port>",
"https-proxy":"http://<user>:<password>#proxy.company.com:<proxy-port>",
"http-proxy":"http://<user>:<password>#proxy.company.com:<proxy-port>",
"strict-ssl": false,
"registry": "http://bower.herokuapp.com"
}
I am required to run the following commands to fix the issue:
npm cache clean
bower cache clean
bower install
The registry used in the the other answers is now deprecated. Please update it!
{
"proxy":"http://<user>:<password>#proxy.company.com:<proxy-port>",
"https-proxy":"http://<user>:<password>#proxy.company.com:<proxy-port>",
"registry": "https://registry.bower.io"
}
{
"directory": "library",
"registry": "http://bower.herokuapp.com",
"proxy":"http://<USERNAME>:<PASSWORD>#<PROXY_IP>:<PROXY_PORT>/",
"https-proxy":"http://<USERNAME>:<PASSWORD>#<PROXY_IP>:<PROXY_PORT>/"
}
This code worked for me. I am using Win 7 and chrome and also git bash. Here few things need to be cleared. This takes me huge time to find the actual data regarding the user name, password, proxy IP and Port. I will describe it step by step so that every learners can easily grasp the message:
Create a file in the notepad named .bowerrc in the login folder; You can go there by typing at Start>Run>%UserProfile% and press OK.
Type above code in the .bowerrc file with the following changes:
Replace <USERNAME> with your internet connection user ID or login ID
Replace <PASSWORD> with your internet connection password or login password.
Replace <PROXY_IP> and <PROXY_PORT> with the working proxy IP address and its port number.
**Note: There should be no angle brackets.**
Proxy IP should be different than your own IP.
Before using any proxy IP and port you should check it is working by changing your proxy IP and port.
You can go through this link to know the details of proxy settings at description here
From this proxy settings you will get Proxy IP and Port.
Recheck all the input so that all are correct and save and close the file.
Open git bash and change directory to the project file and type command and hit enter, in my case, git bash command:
a#a-PC MINGW32 /d/conFusion
$ bower install
It worked like magic.
In case it helps someone, I had a 'bower blocked by group policy' error.
Solution was to make an exception in CryptoPrevent, a application installed on our company computers to prevent crypto lockers.
For info, in your .bowerrc file you can add a no-proxy attribute. I don't know since when it is supported but it works on bower 1.7.4 and it solve the issue of bower behind a corporate proxy with an internal repository
.bowerrc :
{
"directory": "bower_components",
"proxy": "http://yourProxy:yourPort",
"https-proxy":"http://yourProxy:yourPort",
"no-proxy":"myserver.mydomain.com"
}
Regards
Please make sure there are no special characters in your proxy password. Convert it to hex. It works for me.

Gradle can't resolve dependencies through my http proxy

when I try to run gradle dependencies on my computer I am getting a 407 status code "Proxy Authentication Required."
I created a gradle.properties file in my %GRADLE_HOME% directory. gradle.properties contains the following entries:
systemProp.proxySet='true'
systemProp.http.proxyHost=http-proxy.nwie.net
systemProp.http.proxyPort=8080
systemProp.http.proxyUser=%myUserNameHere%
systemProp.http.proxyPassword=%myPasswordHere%
I can successfully get through my proxy for ruby gems by setting HTTP_PROXY to the following value:
http://%myUserNameHere%:%myPasswordHere%#http-proxy.nwie.net:8080
I am using gradle-1.3, please let me know if there is something I am missing.
Thanks in advance!
UPDATE:
I tried setting systemProp.http.proxyUser to a new value in domain/username format. Below are my current properties file contents:
systemProp.proxySet=true
systemProp.http.proxyHost=http-proxy.nwie.net
systemProp.http.proxyPort=8080
systemProp.http.proxyUser=http-proxy.nwie.net/%USERNAME%
systemProp.http.proxyPassword=%PASSWORD%
I am currently getting the same error message I found initially.
Some dependencies are fetched from servers that run over HTTPS so you need to specify values for https properties as well:
systemProp.https.proxyHost=http-proxy.nwie.net
systemProp.https.proxyPort=8080
systemProp.https.proxyUser=http-proxy.nwie.net/%USERNAME%
systemProp.https.proxyPassword=%PASSWORD%
Is it an NTLM proxy (Usually found in a windows environment with active directory). If so, You may have to specify the domain name with the username in the format domain/username.
Take a look at this link.
http://www.gradle.org/docs/current/userguide/build_environment.html

Resources