Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 693 of 808  Not logged in ELOG logo
icon4.gif   Mail are no longer sent from the logged in user in 2.9.0, posted by Olivier Callot on Wed Mar 23 10:01:01 2011 

We upgraded to Elog 2.9.0-2402 and since then mails sent by Elog when posting an item are from the default account, not from the logged in user's mail address.

The configuration is, for the mail part :

Default Email From = Olivier.Callot@cern.ch

Use Email Subject = ELOG Computing Operations - $Subject ($Site - $System - $Production number)

 

Thanks for telling me which flag/option I have to set to restore the proper mail 'From:' field.

    icon2.gif   Re: Mail are no longer sent from the logged in user in 2.9.0, posted by Stefan Ritt on Fri Apr 1 10:54:29 2011 

Olivier Callot wrote:

We upgraded to Elog 2.9.0-2402 and since then mails sent by Elog when posting an item are from the default account, not from the logged in user's mail address.

The configuration is, for the mail part :

Default Email From = Olivier.Callot@cern.ch

Use Email Subject = ELOG Computing Operations - $Subject ($Site - $System - $Production number)

 

Thanks for telling me which flag/option I have to set to restore the proper mail 'From:' field.

Thanks for reporting this bug. I have fixed it in SVN revision 2407. 

icon4.gif   Elog 2.9.0 buffer overflow crash bug ubuntu linux, posted by John Rouillard on Sun Apr 10 01:49:01 2011 
When running openvas (a nessus fork) against elog 2.9.0 I provoked the following crash:

Apr  9 17:32:06 unixland elogd[1300]: POST / HTTP/1.0#015#012Host: unixland.home
#015#012Content-Length: -800#015#012#015#012XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Apr  9 17:32:06 unixland kernel: [664894.491242] elogd[1300]: segfault at b7713d
2e ip 080b6956 sp bf8d5ea0 error 4 in elogd[8048000+96000]

openvas reports that it was testing for CVE-2002-1212 when the crash occurred.

Startup info:

Apr  9 19:35:54 unixland elogd[21584]: elogd 2.9.0 built Apr  9 2011, 17:49:08 
Apr  9 19:35:54 unixland elogd[21584]: revision 2411

-- rouilj
icon8.gif   Self Register = 3 doesn't work any longer, posted by Olivier Callot on Wed Apr 13 10:51:34 2011 

With the recent Elog 2.9.0 rev 2412 the Self Register = 3 option doesn't work as expected: The user is immediately allowed to login. This is not what this option was doing, which is to wait for an approval by the administrator. Can this behaviour be restored, or should I change the value of the Self Register flag? Thanks

    icon2.gif   Re: Self Register = 3 doesn't work any longer, posted by Stefan Ritt on Fri Apr 15 08:37:21 2011 Capture004.pngCapture005.png

Olivier Callot wrote:

With the recent Elog 2.9.0 rev 2412 the Self Register = 3 option doesn't work as expected: The user is immediately allowed to login. This is not what this option was doing, which is to wait for an approval by the administrator. Can this behaviour be restored, or should I change the value of the Self Register flag? Thanks

Are you sure about that (maybe used an older revision of elogd where this indeed was a problem?). The current V2.9.0-2412 gives me this:

 Capture004.png

If I then log in as the admin user, I see the configuration of the new user, but the account is not activated:

Capture005.png

So the user cannot log in. The config file is:

 

[global]
port = 8080
password file = passwd
smtp host = mail.psi.ch
Self register = 3
Admin user = stefan

[demo1]
Attributes = Project, Category


Can you double check?
 

 

    icon2.gif   Re: Elog 2.9.0 buffer overflow crash bug ubuntu linux, posted by Stefan Ritt on Fri Apr 15 08:49:26 2011 
> When running openvas (a nessus fork) against elog 2.9.0 I provoked the following crash:
> 
> Apr  9 17:32:06 unixland elogd[1300]: POST / HTTP/1.0#015#012Host: unixland.home
> #015#012Content-Length: -800#015#012#015#012XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> 
> Apr  9 17:32:06 unixland kernel: [664894.491242] elogd[1300]: segfault at b7713d
> 2e ip 080b6956 sp bf8d5ea0 error 4 in elogd[8048000+96000]
> 
> openvas reports that it was testing for CVE-2002-1212 when the crash occurred.
> 
> Startup info:
> 
> Apr  9 19:35:54 unixland elogd[21584]: elogd 2.9.0 built Apr  9 2011, 17:49:08 
> Apr  9 19:35:54 unixland elogd[21584]: revision 2411
> 
> -- rouilj

I haven't tried openvas, but added a check for the negative content-length you have in the request
above in SVN revision 2413. Can you try if it still crashes?

- Stefan
    icon2.gif   Re: Self Register = 3 doesn't work any longer, posted by Olivier Callot on Fri Apr 15 11:49:43 2011 

Stefan Ritt wrote:

Olivier Callot wrote:

With the recent Elog 2.9.0 rev 2412 the Self Register = 3 option doesn't work as expected: The user is immediately allowed to login. This is not what this option was doing, which is to wait for an approval by the administrator. Can this behaviour be restored, or should I change the value of the Self Register flag? Thanks

Are you sure about that (maybe used an older revision of elogd where this indeed was a problem?). The current V2.9.0-2412 gives me this:

 Capture004.png

If I then log in as the admin user, I see the configuration of the new user, but the account is not activated:

Capture005.png

So the user cannot log in. The config file is:

 

[global]
port = 8080
password file = passwd
smtp host = mail.psi.ch
Self register = 3
Admin user = stefan

[demo1]
Attributes = Project, Category


Can you double check?
 

 

 HI Stefan,

I tried again and confirm the version number. I never got this pannel saying that my request will be processed by an adminstrator. Maybe the installation was incomplete? Is this pannel outside the standard src files?  I receive the mail as administrator, but the accout is already valid BEFORE I validate it.

This was working in previous versions, i.e. the entry was not created at all. And login wasn't possible.

We went back to 2.8.0 as the server is regularly crashing with 2.9.0 and we have to keep it alive for our running experiment. We are trying to isolate and reproduce the problem...

    icon2.gif   Re: Self Register = 3 doesn't work any longer, posted by Stefan Ritt on Fri Apr 15 12:02:50 2011 

Olivier Callot wrote:

 

I tried again and confirm the version number. I never got this pannel saying that my request will be processed by an adminstrator. Maybe the installation was incomplete? Is this pannel outside the standard src files?  I receive the mail as administrator, but the accout is already valid BEFORE I validate it.

This was working in previous versions, i.e. the entry was not created at all. And login wasn't possible.

We went back to 2.8.0 as the server is regularly crashing with 2.9.0 and we have to keep it alive for our running experiment. We are trying to isolate and reproduce the problem...

Try to use the simple config file, and see what happens there. Maybe it's a config option you use differently in the experiment. If you identify the config option which triggers the problem, I can probably reproduce it and fix it. Concerning crashes of 2.9.0: We have it running stably for our experiments, that's why I released it. But there are major changes since 2.8.0, mainly the Kerberos authentification (actually people from CERN asked for that). So it could be that in your case there are problems I don't see. In that case you have to test with which options in the config file the problems start. If elogd crashes, a stack dump would maybe also be helpful for me.

ELOG V3.1.5-3fb85fa6