Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 318 of 808  Not logged in ELOG logo
    icon2.gif   Re: User passwords not configurable with loacl passwordfile, posted by Stefan Ritt on Tue Feb 27 15:32:30 2018 

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

KaterKarlo99 wrote:

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

 

    icon2.gif   Re: User passwords not configurable with loacl passwordfile, posted by KaterKarlo98 on Wed Feb 28 11:38:23 2018 

Hi Stefan,

thanks for the quick reply.

Yes, i've configured user-level access. Here is my cfg:

[global]
port = 9191
Usr = abc
Grp = abc
SMTP host = mail.xy.at
Protect Selection page =  1
Password file = elog_pw.xml
Logfile = elog_log.txt
Logging level = 2
Admin user = User1, Admin
Self register = 2
Restrict edit = 1
Allow password change = 1

[demo]
Theme = default
Authentication = Kerberos
Comment = General Linux Tips & Tricks
Attributes = Author, Type, Category, Subject
Options Type = Routine, Software Installation, Problem Fixed, Configuration, Oth                                                          er
Options Category = General, Hardware, Software, Network, Other
Extendable Options = Category
Required Attributes = Author, Type
Page Title = ELOG - $subject
Reverse sort = 1
Quick filter = Date, Type

And, yes, the password file is r7w accessible for the elogd:
[root@localhost logbooks]# cat elog_pw.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!-- created by MXML on Tue Feb 27 14:54:52 2018 -->
<list>
  <user>
    <name>Admin</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>Admin</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>admin@hell.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
  <user>
    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>User1</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
</list>
 

br, Rainer

 

Stefan Ritt wrote:

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

KaterKarlo99 wrote:

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

 

 

    icon2.gif   Re: User passwords not configurable with loacl passwordfile, posted by KaterKarlo99 on Mon Mar 5 14:10:52 2018 

I'm afraid that there is something wrong because each user will be written with the same (hashed) password to the local password file,
irrespective of the given password within the "new User dialog".

So for instance, every user in my password file lokks like this:

    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>TEST User</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
 

"password encoding" has got the same value for each user after creating them with their own passwords....

That's the main issue i have, because i don't know this password and can't set a known one....

frustrating....

any help would be appreciated

 

 

KaterKarlo98 wrote:

Hi Stefan,

thanks for the quick reply.

Yes, i've configured user-level access. Here is my cfg:

[global]
port = 9191
Usr = abc
Grp = abc
SMTP host = mail.xy.at
Protect Selection page =  1
Password file = elog_pw.xml
Logfile = elog_log.txt
Logging level = 2
Admin user = User1, Admin
Self register = 2
Restrict edit = 1
Allow password change = 1

[demo]
Theme = default
Authentication = Kerberos
Comment = General Linux Tips & Tricks
Attributes = Author, Type, Category, Subject
Options Type = Routine, Software Installation, Problem Fixed, Configuration, Oth                                                          er
Options Category = General, Hardware, Software, Network, Other
Extendable Options = Category
Required Attributes = Author, Type
Page Title = ELOG - $subject
Reverse sort = 1
Quick filter = Date, Type

And, yes, the password file is r7w accessible for the elogd:
[root@localhost logbooks]# cat elog_pw.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!-- created by MXML on Tue Feb 27 14:54:52 2018 -->
<list>
  <user>
    <name>Admin</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>Admin</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>admin@hell.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
  <user>
    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>User1</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
</list>
 

br, Rainer

 

Stefan Ritt wrote:

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

KaterKarlo99 wrote:

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

 

 

 

    icon2.gif   Re: User passwords not configurable with loacl passwordfile, posted by Stefan Ritt on Mon Mar 5 14:29:26 2018 

What happens when you don't use Kerberos authentication?

KaterKarlo99 wrote:

I'm afraid that there is something wrong because each user will be written with the same (hashed) password to the local password file,
irrespective of the given password within the "new User dialog".

So for instance, every user in my password file lokks like this:

    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>TEST User</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
 

"password encoding" has got the same value for each user after creating them with their own passwords....

That's the main issue i have, because i don't know this password and can't set a known one....

frustrating....

any help would be appreciated

 

 

KaterKarlo98 wrote:

Hi Stefan,

thanks for the quick reply.

Yes, i've configured user-level access. Here is my cfg:

[global]
port = 9191
Usr = abc
Grp = abc
SMTP host = mail.xy.at
Protect Selection page =  1
Password file = elog_pw.xml
Logfile = elog_log.txt
Logging level = 2
Admin user = User1, Admin
Self register = 2
Restrict edit = 1
Allow password change = 1

[demo]
Theme = default
Authentication = Kerberos
Comment = General Linux Tips & Tricks
Attributes = Author, Type, Category, Subject
Options Type = Routine, Software Installation, Problem Fixed, Configuration, Oth                                                          er
Options Category = General, Hardware, Software, Network, Other
Extendable Options = Category
Required Attributes = Author, Type
Page Title = ELOG - $subject
Reverse sort = 1
Quick filter = Date, Type

And, yes, the password file is r7w accessible for the elogd:
[root@localhost logbooks]# cat elog_pw.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!-- created by MXML on Tue Feb 27 14:54:52 2018 -->
<list>
  <user>
    <name>Admin</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>Admin</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>admin@hell.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
  <user>
    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>User1</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
</list>
 

br, Rainer

 

Stefan Ritt wrote:

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

KaterKarlo99 wrote:

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

 

 

 

 

    icon2.gif   Re: User passwords not configurable with loacl passwordfile, posted by KaterKarlo99 on Mon Mar 5 14:44:58 2018 

Yeah!!

That did it! I remove the line "Kerberos authentication" and now it works!

Thanks!

Stefan Ritt wrote:

What happens when you don't use Kerberos authentication?

KaterKarlo99 wrote:

I'm afraid that there is something wrong because each user will be written with the same (hashed) password to the local password file,
irrespective of the given password within the "new User dialog".

So for instance, every user in my password file lokks like this:

    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>TEST User</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
 

"password encoding" has got the same value for each user after creating them with their own passwords....

That's the main issue i have, because i don't know this password and can't set a known one....

frustrating....

any help would be appreciated

 

 

KaterKarlo98 wrote:

Hi Stefan,

thanks for the quick reply.

Yes, i've configured user-level access. Here is my cfg:

[global]
port = 9191
Usr = abc
Grp = abc
SMTP host = mail.xy.at
Protect Selection page =  1
Password file = elog_pw.xml
Logfile = elog_log.txt
Logging level = 2
Admin user = User1, Admin
Self register = 2
Restrict edit = 1
Allow password change = 1

[demo]
Theme = default
Authentication = Kerberos
Comment = General Linux Tips & Tricks
Attributes = Author, Type, Category, Subject
Options Type = Routine, Software Installation, Problem Fixed, Configuration, Oth                                                          er
Options Category = General, Hardware, Software, Network, Other
Extendable Options = Category
Required Attributes = Author, Type
Page Title = ELOG - $subject
Reverse sort = 1
Quick filter = Date, Type

And, yes, the password file is r7w accessible for the elogd:
[root@localhost logbooks]# cat elog_pw.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!-- created by MXML on Tue Feb 27 14:54:52 2018 -->
<list>
  <user>
    <name>Admin</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>Admin</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>admin@hell.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
  <user>
    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>User1</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
</list>
 

br, Rainer

 

Stefan Ritt wrote:

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

KaterKarlo99 wrote:

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

 

 

 

 

 

    icon2.gif   Re: MIME-version header duplicated in e-mail messages., posted by Stefan Ritt on Wed Jan 9 11:43:48 2019 

I just checked the current installatin, and just found one MIME-Version in the header, even with attachments:

MIME-Version: 1.0
--------------717E3059287C82F12BC14941
Content-Type: multipart/related;
  boundary="------------4543EB0E5AAC14B461D70512"

No idea where your second header comes from, but sometimes I have seen some SPAM filters adding things to headers.

Stefan

Michal Falowski wrote:

When there are attachments in an entry, logbook is adding additional "MIME-Version" header to e-mail messages.

Spam filter in our university system is mostly giving warnings:

  • X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "MIME-Version"

But sometimes it is not redirecting further the message.

  • Remote Server returned '< #5.6.0 smtp; 554 5.6.0 Bounce, id=27666-07 - BAD HEADER>'

In code I noticed there is always "MIME-Version" header added to the message and additionaly it is added again when a file is attached. I think it is not neccessary to add again this header.

 

icon5.gif   Pinned entry, posted by Giuseppe Cucinotta on Thu Apr 18 12:29:05 2019 

Hi everybody,

sorry if this question has already been posed (I did a quick search but I didn't found anything): elog sorts entry by ID, I wonder if it is possible to pin an entry in order to be always on top of the page independently on its ID.

Thanks

Giuseppe

    icon2.gif   Re: Pinned entry, posted by Stefan Ritt on Tue Apr 23 10:00:48 2019 

This is not directly possible, but you can configure it with a trick. Create an attribute "pinned", make it of type "boolean", and set the start page such that it sorts using the "pinned" attribute:

Atributes = ..., Pinned
Options Pinned = boolean
Start page = ?rsort=Pinned

This move all entries where "Pinned" is true to the top of the list.

Stefan

 

Giuseppe Cucinotta wrote:

Hi everybody,

sorry if this question has already been posed (I did a quick search but I didn't found anything): elog sorts entry by ID, I wonder if it is possible to pin an entry in order to be always on top of the page independently on its ID.

Thanks

Giuseppe

 

ELOG V3.1.5-3fb85fa6