I just see your [global] part of elogd.cfg, could you send me the complete file?

What you also could try is to delete all cookies stored in your browser. The way
cookies are formed changed between 2.5.2 and 2.5.3, so the system could be
confused by old cookies.

- Stefan

The elogd.cfg is attached in the previous message as attachement 3. Sorry it is a
little bit buried between pictures.
The reason I put the picture of the global elogd.cfg is to show that the not logged
user has access to elogd.cfg which is some kind of trouble...

> I just see your [global] part of elogd.cfg, could you send me the complete file?
> 

Hi I tried to remove the cookies and it still did not ask for password under 2.5.4.
Has the password file format changed between 2.5.2 and 2.5.3 ?

> What you also could try is to delete all cookies stored in your browser. The way
> cookies are formed changed between 2.5.2 and 2.5.3, so the system could be
> confused by old cookies.
> 
> - Stefan

Ok, now I see your problem. You defined a "Guest menu commands" which explicitly allows
not-authorized access (that's what it's for). If you only want to allow authorized
access, remove the "guest menu commands" from the logbook sections and also from the
[global] section.

Please note that if an option is not preent in a logbook section, it is looked for in
the [global] section. I see that most of your logbooks have similar settings. Just put
them into the [global] section, and override it in the logbook section if they are
different.

Thank you, I misunderstood how the "Guest menu commands" worked I thought I had to specify
a limited set of commands to actually limit guest users.

Thanks again for your wonderful work on this program too.

Regards,

Alexandre

> Ok, now I see your problem. You defined a "Guest menu commands" which explicitly allows
> not-authorized access (that's what it's for). If you only want to allow authorized
> access, remove the "guest menu commands" from the logbook sections and also from the
> [global] section.
> 
> Please note that if an option is not preent in a logbook section, it is looked for in
> the [global] section. I see that most of your logbooks have similar settings. Just put
> them into the [global] section, and override it in the logbook section if they are
> different.

Have you configures user-level access via

password file = anyfile.pwd

Can your elogd server write to that file?

If yes, can you please post your config file?

Stefan

Hi Stefan,

thanks for the quick reply.

Yes, i've configured user-level access. Here is my cfg:

[global]
port = 9191
Usr = abc
Grp = abc
SMTP host = mail.xy.at
Protect Selection page =  1
Password file = elog_pw.xml
Logfile = elog_log.txt
Logging level = 2
Admin user = User1, Admin
Self register = 2
Restrict edit = 1
Allow password change = 1

[demo]
Theme = default
Authentication = Kerberos
Comment = General Linux Tips & Tricks
Attributes = Author, Type, Category, Subject
Options Type = Routine, Software Installation, Problem Fixed, Configuration, Oth                                                          er
Options Category = General, Hardware, Software, Network, Other
Extendable Options = Category
Required Attributes = Author, Type
Page Title = ELOG - $subject
Reverse sort = 1
Quick filter = Date, Type

And, yes, the password file is r7w accessible for the elogd:
[root@localhost logbooks]# cat elog_pw.xml
<?xml version="1.0" encoding="ISO-8859-1"?>
<!-- created by MXML on Tue Feb 27 14:54:52 2018 -->
<list>
  <user>
    <name>Admin</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>Admin</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>admin@hell.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
  <user>
    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>User1</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
</list>
 

br, Rainer

password file = anyfile.pwd

I'm afraid that there is something wrong because each user will be written with the same (hashed) password to the local password file,
irrespective of the given password within the "new User dialog".

So for instance, every user in my password file lokks like this:

    <name>TestUser1</name>
    <password encoding="SHA256">3c2QQ0KjIU1OLtB29cl8Fplc2WN7X89bnoEjaR7tWu.</password>
    <full_name>TEST User</full_name>
    <last_logout>0</last_logout>
    <last_activity>0</last_activity>
    <email>test@heaven.org</email>
    <inactive>0</inactive>
    <email_notify/>
  </user>
 

"password encoding" has got the same value for each user after creating them with their own passwords....

That's the main issue i have, because i don't know this password and can't set a known one....

frustrating....

any help would be appreciated

password file = anyfile.pwd

What happens when you don't use Kerberos authentication?

password file = anyfile.pwd