Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Check if we can force client connection reset for revoked user #49

Open
rambo opened this issue Mar 22, 2024 · 2 comments
Open

Check if we can force client connection reset for revoked user #49

rambo opened this issue Mar 22, 2024 · 2 comments

Comments

@rambo
Copy link
Contributor

rambo commented Mar 22, 2024

Which forces connection renegotiation which causes OCSP to be checked.

Reportedly when using LDAP backed automatic cert enrollment revoking a user from the web UI will also reset their connection. If we can do the same via the TAKServer REST api it would be grand.

See also #48 for working around the issue (also since in 4.x WebTAK does not check OCSP we might need to do that anyway).

@rambo
Copy link
Contributor Author

rambo commented Mar 23, 2024

If the client connected recently the reset might not drop them since TAKServer seems to cache OCSP responses for a while (which is a perfectly valid thing to do). So putting them into a separate group that does not see anything could help with that too.

@karppo
Copy link
Contributor

karppo commented Mar 30, 2024

Default group "tak_default" added where all users will be added instead of ANON. pvarki/docker-atak-server@119f21c

We can force client connection reset by first getting the "subscriptionUid" from GET "/Marti/api/subscriptions/all" and then disconnect using DELETE "/Marti/api/subscriptions/delete/${subscriptionUid}"

But.. There is something fucky going on under the hood and the removed user can still connect using winTAK as long the winTAK hasn't been restarted. The user can keep the connection open even after running the the DELETE query to api, which seems to force the connection reset to some degree. The new connections end up being in the ANON group instead of the tak_default group.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants