nickbro

See Home Access Plus+ - Documentation, changing the admin password

Hi all, I've managed to get papercut to sit behind an Application Request Routing IIS server in a sub folder (domain.com/papercut/, instead of papercutdomain.com) It's taken me a good few hours, and it's by no means done, but if anyone wants to have papercut show up as a subfolder on another site, here's my config script for IIS's Application Request Routing to do just that. So install IIS ARR, create a papercut folder in your iis site Turn off compression on that folder then open the web.config that is in that folder in notepad and copy the below code

You would need to edit the source code and rebuild the project for that. Specifically the HAP.AD assembly

Edit the hapConfig.xml file directly on the server with notepad

It'll get written to the Application Event Logs on the server as well, look for source Home Access Plus+

HAP+ doesn't allow brute force, it locks out after 3 failed attempts for 5 minutes

I would suggest getting Kerberos SSO working so internally it auto signs in.

Access to the server shouldn't be possible, however if the server name & encryption key were somehow exposed then the admin password encryption could theoretically be reversed, however if you have properly set HAP+ & the server up then remote access to that server still won't be possible. I've run HAP+ since I built it and my copy has never been compromised. Personally I feel they have setup a phishing site and gotten staff logon credentials via that, which is possible. If you feel that the server name, encryption key and salt's have been exposed, since these are auto generated and not stored in a file that would be near on impossible to achieve, you can change the key and salts by following the instructions on Home Access Plus+ - Documentation, you will need to reset the admin password after you have done this but because this disables the auto generated salts and keys it slightly lowers the security.

Hi @maeday85, unfortunately you won't be able to do what you suggest. As kerberos is a handshake between IIS and the client's browser, it will always authenticate with the local user credentials, or prompt for them. A reserve lookup is performed to get the client's IP to determine if it's an internal device (as specified by the ip range) so it can be authenticated against the local Active Directory (the one HAP+ is installed against)

Just a note, it does say in the docs, use a separate server not a domain controller where possible. Something is wrong is defiantly HAP+ saying 'Help I can't impersonate this user, the server won't allow me to'. This 9/10 points to the local logon rights not existing is gpedit.msc

It shouldn't delete anything they can't. HAP+ basically runs as that user when they are accessing the file shares, we then rely on Windows to do it's job.

The domain admin rights are used for impersonation purposes on the server, it's odd how it works but it needs admin rights. If you find it works without the admin rights then you can keep it using the delegate rights, just share how you did that, because it removes a possible security issue.

Download the booking system plugin from Home Access Plus+ - Home

You have to install it on site, see Home Access Plus+ - Home

Can you paste your hapconfig.xml file, specially the bookingsystem section

your HAP+/IIS install isn't correct, see the links to check IIS is configured correctly

I think if I remember rightly, you set the SMTP settings to nothing, that tells HAP+ to auto discover the SMTP stuff. You can check the event log on the server, it may be logging the SMTP error there. Another option would be to use wireshark on the server to see what SMTP traffic is doing

Have a look at the timetable plugin, if I remember rightly I put shared calendar abilities into that plugin, and you can custom set the colour on each calendar. You can copy the code that's use for that.

Best thing to do is directly edit the hapConfig.xml file. ShowTo="Staff Group, Domain Admins"

The help screen is displayed on first run, only once, users don't see if after that.

That is most odd, as this shouldn't happen as it should use NTFS permissions, even if the link appears it shouldn't work as it's impersonating the user on the server, so basically as far as your file server knows it's the user, not HAP+. Are you running the latest HAP+? Have you turned off ReadWriteChecks in the config?

Turn write checks off, that should stop it

Ok, looks like something which is meant to be a number is not a number, if you want to post your config I can look and see

1. Go into the setup, re enter the Admin AD username and password and save 2. Check you have enabled local logon rights on the server you are running HAP+ on.