2X with Deepnet

I thought it's going to be very straightforward to use deepnet authentication in 2X. However, when I tried to do logon from 2X client, I was stuck by a strange error.

Code[01/0000000C] Account for user \\deepnetsecurity\username not found.

I was confused as this user truely existed in Deepnet application. It could be confirmed by looking through deepnet web-based management console. Also the function "Verify Deepnet user account names" provided by 2X didn't complain anything.

At the end, I turned to seek the help from Deepnet Support, they told me, in this case, the option "Use Principal Name" in application settings must be checked.

You can check the PDF version which has a few figures to help you better understand what I said.

GPRS modem with DualShield(linux version)

Now Deepnet DualShield linux version can send SMS OTP by GPRS modem. You may need to tweak a little to make it work with your particular modem, especially it is USB modem, according to SMSLib Troubleshooting

In my case(using ZTE MF100 USB Modem in Ubuntu 11.04 32bit), it has a port as "/dev/ttyUSB2".

mingfa@water:/dev$ ls -l ttyUSB2
crw-rw---- 1 root dialout 188, 2 2011-06-21 16:01 ttyUSB2

As DualShield is running under a user called "dualshield", you need to add this user into the group "dialout" which the modem belongs to.

sudo useradd -G dialout dualshield

In addition, I have to add the parameter "-Dsmslib.serial.polling \" in the file /etc/init.d/dualshield, otherwise I got a no response exception.

case "$1" in
  start)
    # Start DualShield
    $DAEMON_HOME/bin/jsvc \
    -jvm server \
    -user $TOMCAT_USER \
    -home $JRE_HOME \
    -Dcatalina.home=$CATALINA_HOME \
    -Dcatalina.tmpdir=$CATALINA_TEMP \
    -Djava.io.tmpdir=$TMP_DIR \
    -Djava.library.path=$JRE_HOME/bin \
    -Dsmslib.serial.polling \

 ......

token association with a user in batch mode

You can use CSV file to associate(map) a token to a user in a batch.

In DualShield(v5x)

"domain","loginName","manufacturerCode","productCode","serial"
mydomain,kates,DN,SE,10008000
mydomain,johnnya,DN,SE,10008001

In DUAP(v3x)

LoginName,UserName,Mobile,Description,Email,FromLDAP,AuthMethod,TokenDeviceID
kates,Kate Smith,07912345678,,kate.smith@company.com,,SafeID,10008000
johnnya,johnny Allen, 07912387654,,johnny.allen@company.com,,SafeID,10008001

Upgrade seed file

In DualShield, you may encounter a problem when importing a Deepnet token seed file which came with its previous version v3.x, as they changed the format of token seed file. If the file only contains a few tokens, you can modify it manually, however it is very hard labour if it contains hundred tokens.

Here is the utility to convert from v3x format to v5x format, also the source code, it utilizes pugixml to manipulate the xml file.

The command to run this utility is, seedupgrade infile outfile.

V3x Format

<tokenList>
<tokenInfo>
<method>PocketID</method>
<device>
<manufacturer>Deepnet Security</manufacturer>
<vendor>Deepnet Security</vendor>
<model>CB</model>
<serial>71358472</serial>
</device>
<token><![CDATA[<data>
<deviceID>71358472</deviceID>
<type>CB</type>
<counter>0</counter>
<digits>6</digits>
<secret enc="HEX">08E49538328BAE830E0DB14A82341100BC23B840</secret>
<description>71358472</description>
</data>
]]></token>
</tokenInfo>
</tokenList>

V5x Format

<?xml version="1.0"?>
<data>
 <header>
  <manufacturerCode>DN</manufacturerCode>
  <productCode>ST</productCode>
  <encode>HEX</encode>
  <encrypt>NONE</encrypt>
 </header>
 <tokens>
  <token>
   <serial>71358472</serial>
   <seed>08E49538328BAE830E0DB14A82341100BC23B840</seed>
  </token>
 </tokens>
</data>

Add an additional SMS provider

Deepnet Authentication Server(since v3.4x) has a good design on the support of SMS provider. It is very flexible to do the customization - In theory, you can add any SMS provider you like. It is a very good feature, as the domestic SMS providers are always cheaper than the world famous one like ClickAtell.

Then how? It seems Deepnet has no document to describe the procedures. I can fully understand it, as the template heavily depends on a particular SMS provider. First of all, you have to get the API document of your SMS provider, make sure what protocol they are using, HTTP, SMTP, or SMPP etc.

Next, study the built-in SMS provider templates. You can find them in the folder "$INSTALL_PATH/Tomcat/conf/dgs" ("$INSTALL_PATH/smsproviders" if you are using v5.x).

Congratulations if your provider operates as same as one of the built-in SMS providers, you are lucky.

Assume you are going to use "txtmail.co.nz" as your SMS provider in Deepnet, then copy the built-in provider "gin.xml", and save the new file as txtmail.xml, open the file "txtmail.xml" and change the provider name etc. At the end, the file content shoull look like the following

<?xml version="1.0" encoding="UTF-8"?>
<provider name="txtmail">
 <sms>
  <smtp>
   <email>${to}@txtmail.co.nz</email>
   <format>text</format>
   <from>${from}</from>
   <subject>${subject}</subject>
   <body><![CDATA[${text}]]></body>
  </smtp>
 </sms>
</provider>

Finally, Add an entry in the file "sms_providers.xml",
<provider name="TXTMail" file="txtmail.xml" />

Access the management console of Deepnet, you should see the newly added provider in SMS Gateway Settings.

Here is another example, it has not been tested yet though. mollie.nl can send SMS via HTTP.

The syntax of sending the request is,

http://www.mollie.nl/xml/sms/?username=[username] &password=[password]&originator=[originator]&recipients=[recipient(s)]&message=[message]

And the response looks like the following

<?xml version="1.0" ?>
<response>
    <item type="sms">
        <recipients>1</recipients>
        <success>true</success>
        <resultcode>10</resultcode>
        <resultmessage>Message successfully sent.</resultmessage>
    </item>
</response>

As it is a HTTP protocol, you can refer to the built-in ClickAtell. The response is XML format, so you can use xmlPath to extract the result, otherwise, you may need a regular expression which is complicated. However you can find the regular expression example in the built-in templates. The final mollie template would be

<provider name="Mollie">
 <sms>
  <http>
   <method>GET</method>
   <url>http://www.mollie.nl/xml/sms/</url>
   <query>username=${userName}&password=${password}&originator=${from}&recipients=${to}&message=${body}</query>
   <variables>
    <variable name="flash"/>
    <variable name="dlr_url"/>
   </variables>
   <mappings>
    <mapping name="replace_sms" type="boolean">
     <true>1</true>
     <false>0</false>
    </mapping>
   </mappings>
   <response type="http_body" regexp="true" format="xml">
    <pattern success="true" xmlPath="//response/item/success">true</pattern>
   </response>
  </http>
  <smtp>
   <email>${to}@mobiel.mollie.nl</email>
   <format>text</format>
   <from>${from}</from>
   <subject>username=${userName}&password=${password}&sender=${subject}</subject>
   <body><![CDATA[${text}]]></body>
  </smtp>
 </sms>
</provider>

mollie.nl also supports SMTP. It is quite interesting to see how it does the authentication - credentials in Subject!

changes log nsis plug-in

I tried to use CustomLicense plugin to load the changes log in my update installer, it never worked with NSIS 2.46 (the exported function LoadFile was never called, confirmed by adding a MessageBox in this function). The size of the plugin dll also puzzled me, it is just 4K (4096 bytes, no more, no less).

Couldn't figure out why, so I build it myslef, using "exdll.h" instead of "pluginapi.h". My DLL is much bigger(44K), it works though.

Learning ISA

In this document, we try to use two options(web publishing and server publishing rule) to publish the same MS SharePoint(WSS30) site. It also tries to show how to setup filewall rule to allow ftp (from ISA machine to outside) and RDP(outside to ISA machine).