Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 732 of 796  Not logged in ELOG logo
ID Date Icon Author Author Email Categorydown OS ELOG Version Subject
  68747   Tue Feb 27 15:11:23 2018 Angy KaterKarlo99katerkarlo99@gmail.comBug reportLinux | Windows3.1.3.1User passwords not configurable with loacl passwordfile

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

  68748   Tue Feb 27 15:32:30 2018 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux | Windows3.1.3.1Re: User passwords not configurable with loacl passwordfile

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

KaterKarlo99 wrote:

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

 

  68749   Wed Feb 28 11:38:23 2018 Reply KaterKarlo98katerkarlo99@gmail.comBug reportLinux | Windows3.1.3.1Re: User passwords not configurable with loacl passwordfile

Hi Stefan,

thanks for the quick reply.

Yes, i've configured user-level access. Here is my cfg:

[global]
port = 9191
Usr = abc
Grp = abc
SMTP host = mail.xy.at
Protect Selection page =  1
Password file = elog_pw.xml
Logfile = elog_log.txt
Logging level = 2
Admin user = User1, Admin
Self register = 2
Restrict edit = 1
Allow password change = 1

[demo]
Theme = default
Authentication = Kerberos
Comment = General Linux Tips & Tricks
Attributes = Author, Type, Category, Subject
Options Type = Routine, Software Installation, Problem Fixed, Configuration, Oth                                                          er
Options Category = General, Hardware, Software, Network, Other
Extendable Options = Category
Required Attributes = Author, Type
Page Title = ELOG - $subject
Reverse sort = 1
Quick filter = Date, Type

And, yes, the password file is r7w accessible for the elogd:
[root@localhost logbooks]# cat elog_pw.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!-- created by MXML on Tue Feb 27 14:54:52 2018 -->
<list>
  <user>
    <name>Admin</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>Admin</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>admin@hell.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
  <user>
    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>User1</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
</list>
 

br, Rainer

 

Stefan Ritt wrote:

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

KaterKarlo99 wrote:

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

 

 

  68750   Mon Mar 5 14:10:52 2018 Reply KaterKarlo99katerkarlo99@gmail.comBug reportLinux | Windows3.1.3.1Re: User passwords not configurable with loacl passwordfile

I'm afraid that there is something wrong because each user will be written with the same (hashed) password to the local password file,
irrespective of the given password within the "new User dialog".

So for instance, every user in my password file lokks like this:

    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>TEST User</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
 

"password encoding" has got the same value for each user after creating them with their own passwords....

That's the main issue i have, because i don't know this password and can't set a known one....

frustrating....

any help would be appreciated

 

 

KaterKarlo98 wrote:

Hi Stefan,

thanks for the quick reply.

Yes, i've configured user-level access. Here is my cfg:

[global]
port = 9191
Usr = abc
Grp = abc
SMTP host = mail.xy.at
Protect Selection page =  1
Password file = elog_pw.xml
Logfile = elog_log.txt
Logging level = 2
Admin user = User1, Admin
Self register = 2
Restrict edit = 1
Allow password change = 1

[demo]
Theme = default
Authentication = Kerberos
Comment = General Linux Tips & Tricks
Attributes = Author, Type, Category, Subject
Options Type = Routine, Software Installation, Problem Fixed, Configuration, Oth                                                          er
Options Category = General, Hardware, Software, Network, Other
Extendable Options = Category
Required Attributes = Author, Type
Page Title = ELOG - $subject
Reverse sort = 1
Quick filter = Date, Type

And, yes, the password file is r7w accessible for the elogd:
[root@localhost logbooks]# cat elog_pw.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!-- created by MXML on Tue Feb 27 14:54:52 2018 -->
<list>
  <user>
    <name>Admin</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>Admin</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>admin@hell.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
  <user>
    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>User1</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
</list>
 

br, Rainer

 

Stefan Ritt wrote:

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

KaterKarlo99 wrote:

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

 

 

 

  68751   Mon Mar 5 14:29:26 2018 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux | Windows3.1.3.1Re: User passwords not configurable with loacl passwordfile

What happens when you don't use Kerberos authentication?

KaterKarlo99 wrote:

I'm afraid that there is something wrong because each user will be written with the same (hashed) password to the local password file,
irrespective of the given password within the "new User dialog".

So for instance, every user in my password file lokks like this:

    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>TEST User</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
 

"password encoding" has got the same value for each user after creating them with their own passwords....

That's the main issue i have, because i don't know this password and can't set a known one....

frustrating....

any help would be appreciated

 

 

KaterKarlo98 wrote:

Hi Stefan,

thanks for the quick reply.

Yes, i've configured user-level access. Here is my cfg:

[global]
port = 9191
Usr = abc
Grp = abc
SMTP host = mail.xy.at
Protect Selection page =  1
Password file = elog_pw.xml
Logfile = elog_log.txt
Logging level = 2
Admin user = User1, Admin
Self register = 2
Restrict edit = 1
Allow password change = 1

[demo]
Theme = default
Authentication = Kerberos
Comment = General Linux Tips & Tricks
Attributes = Author, Type, Category, Subject
Options Type = Routine, Software Installation, Problem Fixed, Configuration, Oth                                                          er
Options Category = General, Hardware, Software, Network, Other
Extendable Options = Category
Required Attributes = Author, Type
Page Title = ELOG - $subject
Reverse sort = 1
Quick filter = Date, Type

And, yes, the password file is r7w accessible for the elogd:
[root@localhost logbooks]# cat elog_pw.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!-- created by MXML on Tue Feb 27 14:54:52 2018 -->
<list>
  <user>
    <name>Admin</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>Admin</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>admin@hell.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
  <user>
    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>User1</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
</list>
 

br, Rainer

 

Stefan Ritt wrote:

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

KaterKarlo99 wrote:

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

 

 

 

 

  68752   Mon Mar 5 14:44:58 2018 Reply KaterKarlo99katerkarlo99@gmail.comBug reportLinux | Windows3.1.3.1Re: User passwords not configurable with loacl passwordfile

Yeah!!

That did it! I remove the line "Kerberos authentication" and now it works!

Thanks!

Stefan Ritt wrote:

What happens when you don't use Kerberos authentication?

KaterKarlo99 wrote:

I'm afraid that there is something wrong because each user will be written with the same (hashed) password to the local password file,
irrespective of the given password within the "new User dialog".

So for instance, every user in my password file lokks like this:

    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>TEST User</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
 

"password encoding" has got the same value for each user after creating them with their own passwords....

That's the main issue i have, because i don't know this password and can't set a known one....

frustrating....

any help would be appreciated

 

 

KaterKarlo98 wrote:

Hi Stefan,

thanks for the quick reply.

Yes, i've configured user-level access. Here is my cfg:

[global]
port = 9191
Usr = abc
Grp = abc
SMTP host = mail.xy.at
Protect Selection page =  1
Password file = elog_pw.xml
Logfile = elog_log.txt
Logging level = 2
Admin user = User1, Admin
Self register = 2
Restrict edit = 1
Allow password change = 1

[demo]
Theme = default
Authentication = Kerberos
Comment = General Linux Tips & Tricks
Attributes = Author, Type, Category, Subject
Options Type = Routine, Software Installation, Problem Fixed, Configuration, Oth                                                          er
Options Category = General, Hardware, Software, Network, Other
Extendable Options = Category
Required Attributes = Author, Type
Page Title = ELOG - $subject
Reverse sort = 1
Quick filter = Date, Type

And, yes, the password file is r7w accessible for the elogd:
[root@localhost logbooks]# cat elog_pw.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!-- created by MXML on Tue Feb 27 14:54:52 2018 -->
<list>
  <user>
    <name>Admin</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>Admin</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>admin@hell.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
  <user>
    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>User1</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
</list>
 

br, Rainer

 

Stefan Ritt wrote:

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

KaterKarlo99 wrote:

Hi!

Tryed windows an linux version. On booth the "Register new User" dialog is not displaying a password line.
so what password is used for the new user? Further the user can't change his password, because he didn't know the old one.

And if an admin user trys to change the password of an other user, a error is displyed that the old password of the admin user is
wrong and nothing happens with the password of the non-admin user.

elog console (admin user awrzkrz changes the password of testuser1):

GET /demo/?cmd=Config&config=TestUser1&cfgpage=1&admin=1&cfg_user=TestUser1&active=1&new_user_name=TestUser1&new_full_name=TEST+User&new_user_email=test%40heaven.org&cmd=Change+password HTTP/1.1
Returned 1032 bytes
GET /demo/?config=TestUser1&newpwd=test1234&newpwd2=test1234 HTTP/1.1
Returned 20 bytes
GET /demo/?cmd=Change%20password&config=awrzkrz&fail=1 HTTP/1.1
Returned 1215 bytes
 

Thanks for help!

 

 

 

 

 

 

  68753   Tue Mar 6 15:08:23 2018 Reply Stefan Rittstefan.ritt@psi.chBug reportWindowsELOG V3.1.3-fd7Re: Problem with special character "&#269;"

Actually unicode characters are converted by your browser into HTML code (such as &#268) where 268 decimal = 10C hex. elog just writes to file what it gets from the browser. When an existing elog entry gets shown by the browser, the code is translated back to the character. Why do you care what is written to the log file? If you use scripts or so to parse your log files, you have to adapt them to correctly decode HTML encoded characters. This is necessary since log files are ASCII and thus encode one charecter in one byte. Your Slovenian characters require two bytes in unicode, so some kind of "special" encoding is necessary.

Stefan

Matej Sedej wrote:

I see the same problem exists on this board as well. Actuall it appears only the attribute fields are affected. The č character was incorrectly written to the log file from the subject field above, but correctly from the body text below.

Matej Sedej wrote:

Hello!

First of all, thank you for this great piece of software! For now it seems to perfectly cover our need to log very basic events, there was a setting for everything we wanted to set.

However we have one problem and that is the saving of the letter "č" (Slovenian) into the log files. That is unicode character U+010C and U+010CD https://unicode-table.com/en/010C/. When writing to the log file it is replaced with "&#268;" and "&#269;". Is there a known fix for this?

Thank you and best regards,

Matej

 

 

  68754   Tue Mar 6 15:29:38 2018 Reply Matej Sedejmatej.sedej@gmail.comBug reportWindowsELOG V3.1.3-fd7Re: Problem with special character "&#269;"

Hello Stefan,

thank you for the reply. The explanation does not solve my problem though. 

1) Could you elaborate, why the body text field CORRECTLY writes the character while the attribute fields write and display the HTML code?

2) If I understand you correctly the problem also contradicts your statement: "When an existing elog entry gets shown by the browser, the code is translated back to the character." and is visible in this very post. The subject field writes and displays it incorrectly, while the body text writes and displays it perfectly OK. See: Č č ?

3) We do not use any scripts. If we were to use a script to replace the HTML code with the actual character, the attribute fields would still display È instead of Č. Also, I have no idea how to write such a script. :)

Thanks,

Matej

Stefan Ritt wrote:

Actually unicode characters are converted by your browser into HTML code (such as &#268) where 268 decimal = 10C hex. elog just writes to file what it gets from the browser. When an existing elog entry gets shown by the browser, the code is translated back to the character. Why do you care what is written to the log file? If you use scripts or so to parse your log files, you have to adapt them to correctly decode HTML encoded characters. This is necessary since log files are ASCII and thus encode one charecter in one byte. Your Slovenian characters require two bytes in unicode, so some kind of "special" encoding is necessary.

Stefan

 

 

ELOG V3.1.5-2eba886