Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 693 of 808  Not logged in ELOG logo
New entries since:Thu Jan 1 01:00:00 1970
ID Date Icon Author Author Email Categorydown OS ELOG Version Subject
  67032   Wed Mar 23 10:01:01 2011 Warning Olivier CallotOlivier.Callot@cern.chBug reportLinux2.9.0Mail are no longer sent from the logged in user in 2.9.0

We upgraded to Elog 2.9.0-2402 and since then mails sent by Elog when posting an item are from the default account, not from the logged in user's mail address.

The configuration is, for the mail part :

Default Email From = Olivier.Callot@cern.ch

Use Email Subject = ELOG Computing Operations - $Subject ($Site - $System - $Production number)

 

Thanks for telling me which flag/option I have to set to restore the proper mail 'From:' field.

  67039   Fri Apr 1 10:54:29 2011 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2.9.0Re: Mail are no longer sent from the logged in user in 2.9.0

Olivier Callot wrote:

We upgraded to Elog 2.9.0-2402 and since then mails sent by Elog when posting an item are from the default account, not from the logged in user's mail address.

The configuration is, for the mail part :

Default Email From = Olivier.Callot@cern.ch

Use Email Subject = ELOG Computing Operations - $Subject ($Site - $System - $Production number)

 

Thanks for telling me which flag/option I have to set to restore the proper mail 'From:' field.

Thanks for reporting this bug. I have fixed it in SVN revision 2407. 

  67044   Sun Apr 10 01:49:01 2011 Warning John Rouillardrouilj+elog@cs.umb.eduBug reportLinux2.9.0Elog 2.9.0 buffer overflow crash bug ubuntu linux
When running openvas (a nessus fork) against elog 2.9.0 I provoked the following crash:

Apr  9 17:32:06 unixland elogd[1300]: POST / HTTP/1.0#015#012Host: unixland.home
#015#012Content-Length: -800#015#012#015#012XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Apr  9 17:32:06 unixland kernel: [664894.491242] elogd[1300]: segfault at b7713d
2e ip 080b6956 sp bf8d5ea0 error 4 in elogd[8048000+96000]

openvas reports that it was testing for CVE-2002-1212 when the crash occurred.

Startup info:

Apr  9 19:35:54 unixland elogd[21584]: elogd 2.9.0 built Apr  9 2011, 17:49:08 
Apr  9 19:35:54 unixland elogd[21584]: revision 2411

-- rouilj
  67047   Wed Apr 13 10:51:34 2011 Angy Olivier CallotOlivier.Callot@cern.chBug reportAll2.9.0Self Register = 3 doesn't work any longer

With the recent Elog 2.9.0 rev 2412 the Self Register = 3 option doesn't work as expected: The user is immediately allowed to login. This is not what this option was doing, which is to wait for an approval by the administrator. Can this behaviour be restored, or should I change the value of the Self Register flag? Thanks

  67048   Fri Apr 15 08:37:21 2011 Reply Stefan Rittstefan.ritt@psi.chBug reportAll2.9.0Re: Self Register = 3 doesn't work any longer

Olivier Callot wrote:

With the recent Elog 2.9.0 rev 2412 the Self Register = 3 option doesn't work as expected: The user is immediately allowed to login. This is not what this option was doing, which is to wait for an approval by the administrator. Can this behaviour be restored, or should I change the value of the Self Register flag? Thanks

Are you sure about that (maybe used an older revision of elogd where this indeed was a problem?). The current V2.9.0-2412 gives me this:

 Capture004.png

If I then log in as the admin user, I see the configuration of the new user, but the account is not activated:

Capture005.png

So the user cannot log in. The config file is:

 

[global]
port = 8080
password file = passwd
smtp host = mail.psi.ch
Self register = 3
Admin user = stefan

[demo1]
Attributes = Project, Category


Can you double check?
 

 

  67049   Fri Apr 15 08:49:26 2011 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2.9.0Re: Elog 2.9.0 buffer overflow crash bug ubuntu linux
> When running openvas (a nessus fork) against elog 2.9.0 I provoked the following crash:
> 
> Apr  9 17:32:06 unixland elogd[1300]: POST / HTTP/1.0#015#012Host: unixland.home
> #015#012Content-Length: -800#015#012#015#012XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
> 
> Apr  9 17:32:06 unixland kernel: [664894.491242] elogd[1300]: segfault at b7713d
> 2e ip 080b6956 sp bf8d5ea0 error 4 in elogd[8048000+96000]
> 
> openvas reports that it was testing for CVE-2002-1212 when the crash occurred.
> 
> Startup info:
> 
> Apr  9 19:35:54 unixland elogd[21584]: elogd 2.9.0 built Apr  9 2011, 17:49:08 
> Apr  9 19:35:54 unixland elogd[21584]: revision 2411
> 
> -- rouilj

I haven't tried openvas, but added a check for the negative content-length you have in the request
above in SVN revision 2413. Can you try if it still crashes?

- Stefan
  67050   Fri Apr 15 11:49:43 2011 Reply Olivier CallotOlivier.Callot@cern.chBug reportAll2.9.0Re: Self Register = 3 doesn't work any longer

Stefan Ritt wrote:

Olivier Callot wrote:

With the recent Elog 2.9.0 rev 2412 the Self Register = 3 option doesn't work as expected: The user is immediately allowed to login. This is not what this option was doing, which is to wait for an approval by the administrator. Can this behaviour be restored, or should I change the value of the Self Register flag? Thanks

Are you sure about that (maybe used an older revision of elogd where this indeed was a problem?). The current V2.9.0-2412 gives me this:

 Capture004.png

If I then log in as the admin user, I see the configuration of the new user, but the account is not activated:

Capture005.png

So the user cannot log in. The config file is:

 

[global]
port = 8080
password file = passwd
smtp host = mail.psi.ch
Self register = 3
Admin user = stefan

[demo1]
Attributes = Project, Category


Can you double check?
 

 

 HI Stefan,

I tried again and confirm the version number. I never got this pannel saying that my request will be processed by an adminstrator. Maybe the installation was incomplete? Is this pannel outside the standard src files?  I receive the mail as administrator, but the accout is already valid BEFORE I validate it.

This was working in previous versions, i.e. the entry was not created at all. And login wasn't possible.

We went back to 2.8.0 as the server is regularly crashing with 2.9.0 and we have to keep it alive for our running experiment. We are trying to isolate and reproduce the problem...

  67051   Fri Apr 15 12:02:50 2011 Reply Stefan Rittstefan.ritt@psi.chBug reportAll2.9.0Re: Self Register = 3 doesn't work any longer

Olivier Callot wrote:

 

I tried again and confirm the version number. I never got this pannel saying that my request will be processed by an adminstrator. Maybe the installation was incomplete? Is this pannel outside the standard src files?  I receive the mail as administrator, but the accout is already valid BEFORE I validate it.

This was working in previous versions, i.e. the entry was not created at all. And login wasn't possible.

We went back to 2.8.0 as the server is regularly crashing with 2.9.0 and we have to keep it alive for our running experiment. We are trying to isolate and reproduce the problem...

Try to use the simple config file, and see what happens there. Maybe it's a config option you use differently in the experiment. If you identify the config option which triggers the problem, I can probably reproduce it and fix it. Concerning crashes of 2.9.0: We have it running stably for our experiments, that's why I released it. But there are major changes since 2.8.0, mainly the Kerberos authentification (actually people from CERN asked for that). So it could be that in your case there are problems I don't see. In that case you have to test with which options in the config file the problems start. If elogd crashes, a stack dump would maybe also be helpful for me.

ELOG V3.1.5-3fb85fa6