Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 345 of 807  Not logged in ELOG logo
New entries since:Thu Jan 1 01:00:00 1970
ID Date Icon Author Author Emaildown Category OS ELOG Version Subject
  67324   Wed Aug 29 14:35:45 2012 Agree Szu-Ching Pecknerspeckner@nd.eduQuestionLinuxlatestRe: secure way to allow users create logbook

Stefan Ritt wrote:

Szu-Ching Peckner wrote:

I don't think there is a good secure way so far, but would like to have your opinion. 

If I want user to create logbook for themselves, what's the best way to do it? I guess Execute $attribute = <command> may work, have it write to cfg file, but obviously it impose security problem. Is there a good and secure way to allow user to create logbook themselves?

Actually there is no good secure way. What I usually do is to give users admin rights on individual logbooks, then they can change the config of that logbook. Many times adding some attribute is as good as creating new logbooks. Like if you need two logbooks "home" and "work", you can create an attribute "type" and let the type be "home" or "work". With conditional attributes you can make the logbook behave differently for the two values of "type" and get most functionality of two separate logbooks.

- Stefan 

 Thanks, that is good option. 

  67326   Wed Aug 29 18:16:37 2012 Reply Szu-Ching Pecknerspeckner@nd.eduQuestionLinuxlatestRe: secure way to allow users create logbook

Stefan Ritt wrote:

Szu-Ching Peckner wrote:

I don't think there is a good secure way so far, but would like to have your opinion. 

If I want user to create logbook for themselves, what's the best way to do it? I guess Execute $attribute = <command> may work, have it write to cfg file, but obviously it impose security problem. Is there a good and secure way to allow user to create logbook themselves?

Actually there is no good secure way. What I usually do is to give users admin rights on individual logbooks, then they can change the config of that logbook. Many times adding some attribute is as good as creating new logbooks. Like if you need two logbooks "home" and "work", you can create an attribute "type" and let the type be "home" or "work". With conditional attributes you can make the logbook behave differently for the two values of "type" and get most functionality of two separate logbooks.

- Stefan 

 Is there a way to set user permission based on certain attribute? can Allow command = <user list> based on attribute?
for example, say type home, user1 can read, user2 can write, user3 can not access type home, but can access type work. 

In short, is access control available when I use type to get functionality of separate logbooks? If so, how is this access control done? 

 

 

  67330   Thu Aug 30 22:47:50 2012 Reply Szu-Ching Pecknerspeckner@nd.eduQuestionLinuxlatestRe: secure way to allow users create logbook

Stefan Ritt wrote:

Szu-Ching Peckner wrote:

Stefan Ritt wrote:

Szu-Ching Peckner wrote:

I don't think there is a good secure way so far, but would like to have your opinion. 

If I want user to create logbook for themselves, what's the best way to do it? I guess Execute $attribute = <command> may work, have it write to cfg file, but obviously it impose security problem. Is there a good and secure way to allow user to create logbook themselves?

Actually there is no good secure way. What I usually do is to give users admin rights on individual logbooks, then they can change the config of that logbook. Many times adding some attribute is as good as creating new logbooks. Like if you need two logbooks "home" and "work", you can create an attribute "type" and let the type be "home" or "work". With conditional attributes you can make the logbook behave differently for the two values of "type" and get most functionality of two separate logbooks.

- Stefan 

 Is there a way to set user permission based on certain attribute? can Allow command = <user list> based on attribute?
for example, say type home, user1 can read, user2 can write, user3 can not access type home, but can access type work. 

In short, is access control available when I use type to get functionality of separate logbooks? If so, how is this access control done? 

Actually I never tried that. Using conditional attributes, you could try that out, but no guarantee that it works. Like

 

Options type = home{1}, work{2}

{1}Login user = you, me

{2}Login user = me, other

 

You could play with "login user", "Allow command" and "Deny command".

 

/Stefan 

 Thanks for reply Stefan. 

I tried it, didnt work. I think its expected it didn't work though, or maybe I didn't try it right. 
==============
[logbook1]
Login user = user1
Options Type = Home{1}, Work{2}
{1} Login user = user2

This will make user2 unable to login logbook1 at all

============
[logbook1]
Login user = user1, user2
Options Type = Home{1}, Work{2}
{1} Login user = user1
{2} Login user = user2

user1 can login, can search Work type entries, create new entry with Work type.  

==============

[logbook1]
Login user = user1, user2
Options Type = Home{1}, Work{2}
{1} Deny New = user1

user1 can still create entries for Home type. I think it's because when user1 login, command New is available for user1, so when user1 click on New, doesn't matter what type user1 choose, submit button is available. If I have Deny New = user1 under logbook1, New is not available, that means user1 can't create entry for Work type either. 

===============

seems to me under current code, access control has to be done based on logbook, not attribute.  Do you agree?

if that's the case, we may have a lot of logbook because of access control we want to implement. So there is another question:
selection page show all logbooks. Is there a way to make selection page and tabs show logbooks based on user access?
For example, we have 20 logbooks, user1 has acces to 3, when user1 login, selection page only shows that 3 logbooks for user1, and only 3 tabs for user1. 

 
I thought about using group to get logbooks more organized, however I will still face the situation that one group may have 20 logbooks. 

Or what would you do to handle this situation? (I asked selection page question earlier in another entry). Maybe we should discuss on that entry? Message ID: 67319 

Thanks again. 

 

 

 

 

 

 

 

  67342   Tue Sep 18 17:57:47 2012 Question Szu-Ching Pecknerspeckner@nd.eduQuestionLinuxlatestadmin user access admin page, not config page

 We have multiple logbooks. Each user is admin user for his/her own logbook. 

I want user be able to modify config file, but no access to user setting, such as see user list, change password, new user, remove user. 

[logbook1]
Admin user = user1
Login user = user1, user2
Allow Config = user1
List Menu commands = Admin, Config

user1 click on Admin, it opens config file, when user1 click on save, user1 is brought to Config page, which has select user list on top, Change password, Remove user, New user buttons on bottom. Is there a way that admin user has access to config file, but no access to user info at all (not even presented to them).  Is there a way after user1 click save, page doesn't go to that config page?

I could put 
Deny Change password =
Deny Remove user
Deny New user

so when user1 click on those buttons, user1 will get command not allowed. However I would rather have user1 not even see that page. 

 

 

  66009   Wed Oct 22 12:44:48 2008 Entry soren poulsensoren.poulsen@cern.chBug reportLinux2.7.5Elogd crashes

Hi

 

I am experiencing trouble with Elog crashing. I think it crashes during input operations (new entries are being added).

Are there any preferred methods to troubleshoot this ? Any log files I could look at ?

For now, I let "monit" supervise the process and restart it if it crashes. But I would like to get to the root cause of the problem.

Soren Poulsen

CERN

  66011   Thu Oct 23 08:12:06 2008 Reply soren poulsensoren.poulsen@cern.chBug reportLinux2.7.5Re: Elogd crashes

Dear Stefan,

Thanks for your reply.

I started running elog in February and it never failed. Then it started failing regularly towards the end of September. There were no system changes until then, except the daily automatic Yum updates (SLC4). Then I upgraded to the latest version (tar ball of 2.7.5). Then yesterday it crashed again. I saw that it crashed around the time when a user was doing something - inputting new data. I can monitor when it crashes and correlate it with user activity. But it is not easy to reproduce since I don't know exactly what the user is typing.

It would be necessary to record the user input forms and then replay them against a known server state. But that is not so easy.

I will think about doing something else - maybe running inside a debugger as you suggest.

Soren

Stefan Ritt wrote:

 

soren poulsen wrote:

Hi

 I am experiencing trouble with Elog crashing. I think it crashes during input operations (new entries are being added).

Are there any preferred methods to troubleshoot this ? Any log files I could look at ?

For now, I let "monit" supervise the process and restart it if it crashes. But I would like to get to the root cause of the problem.

Soren Poulsen

CERN

 

Dear Soren,

sorry for the trouble, but it's very hard to diagnose this remotely. This forum here runs fine for many months, so in principle Elog should be stable (at least the current version 2.7.5). If you have an older version, please upgrade. If you have a way to reproduce the problem reliably, you can send me your config file and explain step-by-step how you make Elog crash. Then I can try to reproduce it here. Otherwise the only chance I see is to run elog from inside the debugger, and once it crashes record the stack trace and send it to me. If you don't know how to use the gnu debugger, I'm sure you find someone at CERN who knows. 

Best regards,

   Stefan

 

  66341   Mon May 4 11:22:40 2009 Question soren poulsensoren.poulsen@cern.chQuestionLinux2.7.5-2172Using preset text files

Hi,

I am trying the Preset text option from the documentation: like:

Attributes = Author, Type
Options Type = Network check{1}, System check{2}

{1} Preset text = network.txt
{2} Preset text = system.txt

I have two questions:

1. Where are the preset text files searched from ? I guess I could put them in the logbook (and specify a relative path like in this example) but it appeared only to work when I specifiy an abcolute path. That is even better in my case.

2. How do I specify line feeds in the file ? I tried Linux and Windows new line characters - but I always end up with just  one line in my e-log. I would really like a multi-line form.

Soren

 

  66342   Mon May 4 11:25:15 2009 Reply soren poulsensoren.poulsen@cern.chQuestionLinux2.7.5-2172Re: Using preset text files

soren poulsen wrote:

Hi,

I am trying the Preset text option from the documentation: like:

Attributes = Author, Type
Options Type = Network check{1}, System check{2}

{1} Preset text = network.txt
{2} Preset text = system.txt

I have two questions:

1. Where are the preset text files searched from ? I guess I could put them in the logbook (and specify a relative path like in this example) but it appeared only to work when I specifiy an abcolute path. That is even better in my case.

2. How do I specify line feeds in the file ? I tried Linux and Windows new line characters - but I always end up with just  one line in my e-log. I would really like a multi-line form.

Soren

 

 Dear Soren,

 

Just use HTML (and call the file network.html to remember).

 

ELOG V3.1.5-3fb85fa6