ID |
Date |
Icon |
Author |
Author Email |
Category |
OS |
ELOG Version![down down](down.png) |
Subject |
267
|
Fri Apr 4 08:58:16 2003 |
| Stefan Ritt | stefan.ritt@psi.ch | Bug report | | | Re: Password Problem | > I noticed that when I put in a password such as <test1> a person can login
> with the password <test2> or any other number at the end. Is the
> encryption not able to tell the difference between numbers? The encrypted
> passwords even look the same in the password file. Is this a bug?
This is really strange. Encryption only works on ASCII characters and does
not distinguish between letters and digits. When I try to reporoduce that,
the system distinguishes well between "test1" and "test2". The first gives
encrypted "dGVzdDE=" and the second gives "dGVzdDI=", note the different "E"
and "I". So I have no clue right now what is wrong in your installation. If
running under Linux, you can compile elogd after adding "-DHAVE_CRYPT" and "-
lcrypt" to the Makefile to use the standard Linux crypt() function, but I
would rather like to understand what is wrong in your case.
- Stefan |
268
|
Fri Apr 4 09:01:11 2003 |
| Stefan Ritt | stefan.ritt@psi.ch | Question | | | Re: Login user problem | > When I use the <Login user => option to specify what users I want to be
> able to login into the different logbooks it does not seem to work. Is
> there something else you are supposed to do to restrict what logbooks users
> can log into?
First, you need version 2.3.4 or later, second, you need a "password file =
xxx" entry in your elogd.cfg to turn on user-level password access. If both
is true and you still don't succeed, send me your elogd.cfg.
- Stefan |
269
|
Fri Apr 4 19:46:56 2003 |
| Byron | cryogaze@easystreet.com | Question | | | Re: Login user problem | > > When I use the <Login user => option to specify what users I want to be
> > able to login into the different logbooks it does not seem to work. Is
> > there something else you are supposed to do to restrict what logbooks
users
> > can log into?
>
> First, you need version 2.3.4 or later, second, you need a "password file =
> xxx" entry in your elogd.cfg to turn on user-level password access. If both
> is true and you still don't succeed, send me your elogd.cfg.
>
> - Stefan
Ok, I installed the latest version and this is fixed. Thanx! |
270
|
Fri Apr 4 19:49:32 2003 |
| Byron | cryogaze@easystreet.com | Bug report | | | Re: Password Problem | > > I noticed that when I put in a password such as <test1> a person can
login
> > with the password <test2> or any other number at the end. Is the
> > encryption not able to tell the difference between numbers? The
encrypted
> > passwords even look the same in the password file. Is this a bug?
>
> This is really strange. Encryption only works on ASCII characters and does
> not distinguish between letters and digits. When I try to reporoduce that,
> the system distinguishes well between "test1" and "test2". The first gives
> encrypted "dGVzdDE=" and the second gives "dGVzdDI=", note the
different "E"
> and "I". So I have no clue right now what is wrong in your installation. If
> running under Linux, you can compile elogd after adding "-DHAVE_CRYPT"
and "-
> lcrypt" to the Makefile to use the standard Linux crypt() function, but I
> would rather like to understand what is wrong in your case.
>
> - Stefan
Ok, try it with the passwords <hello1> and <hello2>. Then when you go to log
in, put in the password of <hello> with any single number after it and let me
know if the problem shows up for you because that is the password I was
using. When I look at it encrypted in the passwd file they look the same. I
also installed the latest version today which is newer than the one I was
using before and it still does it. I appreciate your time.
Byron |
271
|
Sat Apr 5 00:33:36 2003 |
| Michael Doerner | michael@tw.co.nz | Question | | | elogd under Apache, login screen always reappears | Hi,
I am new to elog so please bear with me if this sounds like a stupid
question...
I would like to run elogd under Apache because I don't want to open another
port (eg. 8080) on the firewall for incoming http traffic. I followed the
special instructions for that sort of setup but the user logon screen always
comes up again, even after using a valid username/password.
I am testing on a Redhat 7.2 based distribution (called SME server) in a
test domain (tuxhome.co.nz).
"Apache modules mod_proxy.c and mod_alias.c are activated", Yes.
There seems to be a problem here with the Apache Redirect statement. When I
try with
Redirect permanent /elog http://www.tuxhome.co.nz/elog/
ProxyPass /elog/ http://www.tuxhome.co.nz:8080/
Mozilla responds "Redirection limit for this URL exceeded" and IE6 says
"cannot find server or DNS error" so I have commented out the redirect
statement for now.
I might misunderstand the required URL statement in elogd.cfg
"URL = http://your.proxy.host/subdir/" ?
which I understand it would have to be
URL = http://www.tuxhome.co.nz/elog/ for my above example?
Maybe someone could help me with an example that includes all 3 of the
statements together, the redirect + proxypass from httpd.conf plus the URL
from elogd.conf?
Thanks for any help.
Michael |
272
|
Mon Apr 7 22:50:17 2003 |
| Stefan Ritt | stefan.ritt@psi.ch | Bug report | | | Re: Password Problem | > Ok, try it with the passwords <hello1> and <hello2>. Then when you go to
log
> in, put in the password of <hello> with any single number after it and let
me
> know if the problem shows up for you because that is the password I was
> using. When I look at it encrypted in the passwd file they look the
same. I
> also installed the latest version today which is newer than the one I was
> using before and it still does it. I appreciate your time.
Ok, I finally found the problem: Whenever a password has a length which can
be divided by three (like 6 or 9), the last two characters are completely
ignored. This problem will be fixed in version 2.3.5. Is has to be noted
that all existing passwords with the mentioned length have to be re-entered
after the upgrade from 2.3.4 to 2.3.5. Since one cannot log in with the old
password on those cases, a "Forgot password?" links has been added to the
login screen, which can be used to create a new password and send it to the
registered email address. |
273
|
Mon Apr 7 23:00:48 2003 |
| Stefan Ritt | stefan.ritt@psi.ch | Comment | | | Passwords might have changed for logbook "Forum" | A problem (elog:272) with certain passwords has been fixed in version
2.3.5 of ELOG. This forum runs the updated version, which can cause login
problems. All users with a password length of 3,6,9,12,... characters
cannot login with their old password anymore. They have to click
on "Forgot password?" in the login screen to have the system create a new
password for them and send it to their registered email address. In case
no email address has been registered, one can send me directly an email
(stefan.ritt@psi.ch). After one receives the new password via
email, one can log in again and change the password to the old one, which
then gets registered correctly. I apologize for any inconvenience.
- Stefan |
274
|
Tue Apr 8 08:57:20 2003 |
| Stefan Ritt | stefan.ritt@psi.ch | Question | | | Re: elogd under Apache, login screen always reappears | > I would like to run elogd under Apache because I don't want to open another
> port (eg. 8080) on the firewall for incoming http traffic. I followed the
> special instructions for that sort of setup but the user logon screen always
> comes up again, even after using a valid username/password.
>
> I am testing on a Redhat 7.2 based distribution (called SME server) in a
> test domain (tuxhome.co.nz).
> "Apache modules mod_proxy.c and mod_alias.c are activated", Yes.
> There seems to be a problem here with the Apache Redirect statement. When I
> try with
> Redirect permanent /elog http://www.tuxhome.co.nz/elog/
> ProxyPass /elog/ http://www.tuxhome.co.nz:8080/
> Mozilla responds "Redirection limit for this URL exceeded" and IE6 says
> "cannot find server or DNS error" so I have commented out the redirect
> statement for now.
> I might misunderstand the required URL statement in elogd.cfg
> "URL = http://your.proxy.host/subdir/" ?
> which I understand it would have to be
> URL = http://www.tuxhome.co.nz/elog/ for my above example?
>
> Maybe someone could help me with an example that includes all 3 of the
> statements together, the redirect + proxypass from httpd.conf plus the URL
> from elogd.conf?
> Thanks for any help.
This Forum runs on "midas.psi.ch" under RH 7.1, Apache 1.3.22, port 8000, and
it contains in httpd.conf:
Redirect permanent /elogdemo http://midas.psi.ch/elogdemo/
ProxyPass /elogdemo/ http://midas.psi.ch:8000/
elogd.cfg contains:
URL = http://midas.psi.ch/elogdemo/
As you can see, it works fine with all browsers, so I have no clue what is
wrong in your case. You might want to look at your /var/log/httpd/access_log
and /var/log/httpd/error_log to see what's going on. If you run elogd
interactively with the "-v" flag, you see directly the communication between
elogd and the browser which also might help.
- Stefan |
|