For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

winddlover_9858's avatar
winddlover_9858
Icon for Nimbostratus rankNimbostratus
Oct 12, 2009

Firepass logon prompt customization

Hi All,

 

 

I am trying to customize Firepass logon page via webdav. I don't want to use index.html as it will break pre-logon check. What I am doing is to edit .inc file and put the required inforamation in it and uploaded to sandbox folder on Firepass.

 

 

All it is working well. The only issue is that I want to customize the logon box

 

including adjusting font size and put frame outside to make it a bit nice.

 

 

However, it seems no option to do it by changing inc file. Could someone advice me if there is another way to do this rather than editing index.htm?

 

 

BIG-IP Access Policy Manager (APM)
remote access
security

3 Replies

  • Jared_Townsley_'s avatar
    Jared_Townsley_
    Historic F5 Account
    Oct 30, 2009
    External logon pages can be used in conjunction with pre-logon sequences.

     

    Replacing the index.htm file however is not compatible with pre-logon sequences.
  • Mike_61719's avatar
    Mike_61719
    Icon for Cirrus rankCirrus
    Nov 02, 2009

    Posted By Jared Townsley on 10/30/2009 11:03 AM

     

     

    External logon pages can be used in conjunction with pre-logon sequences.

     

    Replacing the index.htm file however is not compatible with pre-logon sequences.

     

     

     

    How does one do this? The F5 tier 2 guys must not know how lol
  • Jared_Townsley_'s avatar
    Jared_Townsley_
    Historic F5 Account
    Nov 06, 2009
    A pre-logon sequence can contain an "External Logon Page" ending (instead of "Logon Page") that redirects users to an external server with two HTTP POST variables. The two variables are "client_data" and "post_url." The client_data contains encoded results of the pre-logon inspection. The post_url contains the URL that the external logon page must use to POST back to FirePass.

    In order to use this feature the external page must do a HTTP POST to FirePass containing client_data, username, password, tzoffsetmin=1, and mrhlogonform=1. As a security precaution, the value of client_data can only be submitted to FirePass once. It is also recommended to check the contents of post_url to make sure you are posting back to a legitimate FirePass.

    Here is an example of an External Logon Page written in PHP and HTML: 

     
    // verify post_url is valid 
   if(!preg_match("/^(http[s]?:\/\/)([^\/\<\>]+)\/([^\<\>]*)$/i", $HTTP_POST_VARS["post_url"], $host)) { 
     echo(htmlentities($HTTP_POST_VARS["post_url"])." is not a valid URL"); 
     exit; 
   } 
   // only POST to our firepass 
   if ($host[2] != "10.10.190.10") { 
     echo(htmlentities($host[2]). " is not an authorized FirePass host."); 
     exit; 
   } 
 php?> 
  
  
  
  action="" method="post">  
   "> 
    
    
   Username: 
 
   Password: