Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 211 of 796  Not logged in ELOG logo
ID Date Icon Authordown Author Email Category OS ELOG Version Subject
  1632   Thu Jan 26 15:07:11 2006 Reply Stefan Rittstefan.ritt@psi.chBug reportLinux2.6.0Re: ELOG v2.6.0 (Linux) crashes while using " Forgot password?"

Dimitrios Tsirigkas wrote:
Is there going to be a fix for that version as well?


A fix is always for all versions, since I have a common code base. Have you tried Version 2.6.1?
  1635   Fri Jan 27 13:52:34 2006 Reply Stefan Rittstefan.ritt@psi.chQuestion 2.6.0b5Re: Quicklink does not work for one field

mark james wrote:
OK. But where do I get this from? The "latest version of 19 Jan is still 1622.


If you can compile it yourself, you get it from Subversion (see here). Otherwise you have to wait for the next release.
  1637   Fri Jan 27 23:18:07 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux2.6.1 CVSRe: Running elog as ordinnary user

G. Vandemoortele wrote:
I've configured elog with some commands running a shell :

Preset R-Date = $shell(/usr/bin/date +"%Y/%m/%d %H:%S")
; for testing :
Preset $text = $shell(whoami && set)
Preset $text = Some fixed text

That worked well when elog was started by root (and falling to user elog),
but later, I moved all the elog tree to /home/my_name/.elog,
(I'd like to start it only when I'm logged, it's only for personnal data)
changed all the attributes/permissions ($chown -R my_name:my_group .elog)
and none of these commands still works ! I use the -x option to allow
shell substitution.

More surprisingly, even the fixed text doesn't work (???)


First of all, you could use

Preset R-Date = $date

instead of the shell command. Secondly, the command

Preset $text = $shell(whoami && set)

is wrong. Replace it by

Preset text = $shell(whoami && set)

without the "$".


G. Vandemoortele wrote:
By the way, I also seen that it is necessary to set Usr and Grp to "elog"
via the config file even when it's started by root, because otherwise,
you always get the strings 'Falling back to default group "elog"' and
Falling back to default user "elog" in the output of the shell substitutions.


There is a good reason for that. If you run elogd as root, this can open a dangerous hole into your system. If there would be any bug in elog, an attacker could gain root access easily. By falling back to a non-root user, the damage can be minimized. As a precaustion, elog falls back to Usr and Grp "elog" if that setting is missing in the config file.

When you run elog under your user name, this fallback is not necessary. Why you got the message 'Falling back' is a mystery to me. I tried to reproduce that, so I run under a non-root account with following config:
[global]
port = 1234

[demo]
Attributes = Subject
Preset Subject = $shell(date +"%Y/%m/%d %H:%S")
and correctly got the date in the "Subject" field with ELOG V2.6.1-1640.
  1639   Sat Jan 28 12:54:03 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux2.6.1 CVSRe: Running elog as ordinnary user

G. Vandemoortele wrote:
Started via root (# /usr/sbin/elogd -c /home/gv/.elog/elogd.cfg -x), it works,
but via "gv" ($ /usr/sbin/elogd -c /home/gv/.elog/elogd.cfg -x), it doesn't.


I tried with your config file, and it works fine (see attached screendump). So I have no clue right now why it is not working in your case.
Attachment 1: screendump.png
screendump.png
  1642   Mon Jan 30 12:27:08 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux2.6.1Re: Running ELOG under Apache

Dimitrios Tsirigkas wrote:
Sorry if this has been asked elsewhere and I'm missing it. I want to stop users from accessing my elog by loading the URL: http://mycomputerURL:8080 and only make it accessible through http://mycomputerURL/elog. The end goal would be to use Apache to control access. I followed the instructions under "Running elogd under Apache" in the admin guide, but what that did was simply to redirect browsers trying to load ttp://mycomputerURL/elog to http://mycomputerURL:8080.


If you want to have user-level access control, you need to do that with the config option
Password file = ...

Then, if you have the
URL = http://mycomputerURL/elog

statement in your config file, you get redirected from elogd after each login automatically to that URL. If you physically want to block the 8080 port, you have to do that on the operating system level, like with iptables or ipchains.
  1650   Mon Feb 6 08:27:40 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionOther2.6.1Re: compiling elog 2.6.1 on solaris platform

Angus Au wrote:
ld: fatal: library -lutil: not found


The util library was added recently because of the new shell substitution functionaly, which requires the forkpty() function call. If you know in which library the forkpty is available on solaris, the makefile could be adjusted accordingly. If the forkpty is not available at all, we have to disable the shell substitution under solaris via conditional compilation.
  1651   Mon Feb 6 12:52:09 2006 Reply Stefan Rittstefan.ritt@psi.chBug reportOther2.6.1Re: [261] problem with month selection
> I have several date-fields defined in my logboek. But when I click the icon and select another month the pop-up 
> window get's filled  with the contants of the logboek instead of the date-selection.

Ups, that problem must have been there for quite some time now. I fixed it in the current SVN version.
  1652   Mon Feb 6 12:54:25 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux2.6.1Re: elog allows me to create user "blahblah "

Dimitrios Tsirigkas wrote:
By the way, it is also possible to create a user that doesn't have a password! Shouldn't that be forbidden?


Well, some people want that!
ELOG V3.1.5-fe60aaf