Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 407 of 808  Not logged in ELOG logo
icon5.gif   Subst variables and Execute, posted by soren poulsen on Wed Jul 21 16:26:17 2010 

Hi

 

I am trying to use this line from the documentation:

Execute new = echo "New message wiht ID $message id of type $type from $long_name on $remote_host" >> /tmp/elog.log

It does not seem to have the intended effect (of printing a line with the message id, etc in the file /tmp/elog.log
)

How can I make this line work ?

Soren
    icon2.gif   Re: Subst variables and Execute, posted by Stefan Ritt on Wed Jul 21 16:38:05 2010 

soren poulsen wrote:

Hi

 

I am trying to use this line from the documentation:

Execute new = echo "New message wiht ID $message id of type $type from $long_name on $remote_host" >> /tmp/elog.log

It does not seem to have the intended effect (of printing a line with the message id, etc in the file /tmp/elog.log
)

How can I make this line work ?

Soren

Have you started the server with the "-x" flag as written in the documentation? 

    icon2.gif   Re: Subst variables and Execute, posted by soren poulsen on Thu Jul 22 10:17:29 2010 

Stefan Ritt wrote:

soren poulsen wrote:

Hi

 

I am trying to use this line from the documentation:

Execute new = echo "New message wiht ID $message id of type $type from $long_name on $remote_host" >> /tmp/elog.log

It does not seem to have the intended effect (of printing a line with the message id, etc in the file /tmp/elog.log
)

How can I make this line work ?

Soren

Have you started the server with the "-x" flag as written in the documentation? 

 Thanks a lot for replying despite the heat. Yes, I executed with the "-x" flag.

It is just a quoting problem, I guess. This line works:

Execute new = echo New message with ID $message id of type $type from $long_name on $remote_host >> /tmp/elog.log

It evaluates to:

SHELL "echo New message with ID 24706 of type elogtype from Soren Poulsen on 137.138.22.11 >> /tmp/elog.log"
 

So next step is to replace "new" with "edit" and "delete".

That works as well.

Soren

 

 

    icon2.gif   Re: drop in replacement for FCKeditor?, posted by Andreas Luedeke on Thu Jul 22 15:51:50 2010 

Bill Pier wrote:

Stefan Ritt wrote:

Bill Pier wrote:

Is it possible to use a drop-in replacement for the FCKeditor? 

What is a drop-in replacement? 

 A configuration option to specify a different/alternate javascript based editor.

 There is an firefox addon "It's all text" that allows you to call your own editor for all textarea fields in the browser.

If you then choose "plain" or "ELCode" encoding in ELOG for a new entry or to modifiy an existing entry, you can use your favourite editor to edit the entry by an new "EDIT" button associated with the textarea input field. It works simply by temporary files.

Not really a "drop-in" replacement, but similar.

 

icon4.gif   More adventures with SSL, posted by Chuck Brost on Thu Jul 22 16:59:00 2010 

Stefan,

Everything has been working great since we last spoke (Version 2.7.8), until InfoSec decided to change how the Certs were created.  Now they come with a little bit of code in the .key file before the Hash.. when I put the new .CRT and .KEY in the SSL folder I am asked on starting Elogd to provide a "PEM PassPhrase".  As you can expect, if you do not enter one, or the incorrect one, it does not just turn off SSL, it exits the program.  The key begins like this in the new versions:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,ACF4A8B263EAA51D

(that little encode piece on the end is not the actual one in the key.  I am assuming it is a passphrase key so it will know what the right passphrase is that should be entered.

We are assuming that this is the "Install password" they have set up to use to install the certs on all of the IIS servers we have.  If that is indeed the case.. Does elog save this passphrase somewhere?  does Elog save it in the registry? does it save it encrypted? Or with access security permissions set on the keys?  I have a feeling that the answer to most of this is probably "no", but to know where we go from here, that is the place to start.

Thanks

Chuck

    icon2.gif   Re: Subst variables and Execute, posted by soren poulsen on Mon Jul 26 11:41:44 2010 

soren poulsen wrote:

Stefan Ritt wrote:

soren poulsen wrote:

Hi

 

I am trying to use this line from the documentation:

Execute new = echo "New message wiht ID $message id of type $type from $long_name on $remote_host" >> /tmp/elog.log

It does not seem to have the intended effect (of printing a line with the message id, etc in the file /tmp/elog.log
)

How can I make this line work ?

Soren

Have you started the server with the "-x" flag as written in the documentation? 

 Thanks a lot for replying despite the heat. Yes, I executed with the "-x" flag.

It is just a quoting problem, I guess. This line works:

Execute new = echo New message with ID $message id of type $type from $long_name on $remote_host >> /tmp/elog.log

It evaluates to:

SHELL "echo New message with ID 24706 of type elogtype from Soren Poulsen on 137.138.22.11 >> /tmp/elog.log"
 

So next step is to replace "new" with "edit" and "delete".

That works as well.

Soren

 

 

There is sometimes a problem with substitutions like "Execute delete = echo $message id".

It seems the problem is that if you delete a logbook entry that is not created with the current logbook attributes, the substitution variables are replaced with the variable name, and not the variable value.

In this example, according to the log file it becomes SHELL "message id" instead of SHELL "234", if the logbook entry is 234.

Soren

    icon2.gif   Re: More adventures with SSL, posted by Stefan Ritt on Wed Jul 28 16:38:07 2010 

Chuck Brost wrote:

Stefan,

Everything has been working great since we last spoke (Version 2.7.8), until InfoSec decided to change how the Certs were created.  Now they come with a little bit of code in the .key file before the Hash.. when I put the new .CRT and .KEY in the SSL folder I am asked on starting Elogd to provide a "PEM PassPhrase".  As you can expect, if you do not enter one, or the incorrect one, it does not just turn off SSL, it exits the program.  The key begins like this in the new versions:

-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,ACF4A8B263EAA51D

(that little encode piece on the end is not the actual one in the key.  I am assuming it is a passphrase key so it will know what the right passphrase is that should be entered.

We are assuming that this is the "Install password" they have set up to use to install the certs on all of the IIS servers we have.  If that is indeed the case.. Does elog save this passphrase somewhere?  does Elog save it in the registry? does it save it encrypted? Or with access security permissions set on the keys?  I have a feeling that the answer to most of this is probably "no", but to know where we go from here, that is the place to start.

Thanks

Chuck

The pass phrase should not be stored anywhere for security reasons. Actually ELOG cannot stored it encrypted, because strong encryption is a one-way encryption which cannot be reverted, so ELOG would have to store it in plain text, which is not good. Actually all SSL web servers have this problem. See for example:

http://www.akadia.com/services/ssh_test_certificate.html

In Step 3 they tell you how to remove the pass phrase for Apache. The same holds true for ELOG.

    icon2.gif   Re: Subst variables and Execute, posted by Stefan Ritt on Wed Jul 28 17:08:55 2010 

soren poulsen wrote:

There is sometimes a problem with substitutions like "Execute delete = echo $message id".

It seems the problem is that if you delete a logbook entry that is not created with the current logbook attributes, the substitution variables are replaced with the variable name, and not the variable value.

In this example, according to the log file it becomes SHELL "message id" instead of SHELL "234", if the logbook entry is 234.

Soren

I tried to reproduce it, but it always worked for me. So I need a step-by-step instruction from you on how to reproduce the problem, ideally starting from the demo logbook from the distribution. Only if I can reproduce the problem, I will be able to fix it. 

ELOG V3.1.5-3fb85fa6