Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG, Page 353 of 807  Not logged in ELOG logo
ID Date Icon Author Author Email Category OS ELOG Version Subjectdown
  66282   Thu Mar 26 21:34:24 2009 Reply Brett Virenbv@bnl.govQuestionLinux | Windows2.7.5Re: Problems with SSL and Synchronization

Brett Viren wrote:


Please make this 3. We (Daya Bay experiment) are just starting to set up Elog and will really want this feature!


I came up with a work-around for the lack of support for mirroring and SSL. You can put Elog behind an Apache proxy. Apache can serve through SSL for normal user access. The Elog server can "hosts allow" localhost and any mirrors and deny all others.

This still leaves the mirroring account subject to sniffing, which could be bad if mirrors are allowed to change content on the master, but it will greatly minimize the potential exposure of passwords. This could even be removed by only allowing localhost and mirroring over SSH tunnels.

-Brett.
  66584   Mon Nov 9 09:32:19 2009 Reply Diogo Alvesdiogomiguelalves@gmail.comQuestionLinux | Windows2.7.5Re: Problems with SSL and Synchronization

Stefan Ritt wrote:

 

Mark Langkau wrote:

I installed ELOG on a Linux server (CentOS 5.2) and a WinXP laptop.

- If I set both servers to non-SSL, I can synchronize with no problems.

- If I set both servers to use SSL, synchronization fails with "Error code: ssl_error_rx_record_too_long" 

- If I set one to ssl and the other non-ssl, synchronization fails with "Remote server is not an ELOG server"

Is anyone synchronizing or mirroring two ELOG servers with SSL? When either or both servers are set to use SSL, I can use either site. but I can't synchronize.

 

Synchronization with SSL does not yet work. I have to find some time to implement it. Since you are already the second one mentioning this, it slipped higher on my to-do list  

 Count me also in for the to-do list climbing :-D

  66800   Sat May 1 18:02:30 2010 Reply Anthony Palladinoap4ax@virginia.eduQuestionLinux | Windows2.7.5Re: Problems with SSL and Synchronization

Stefan Ritt wrote:

 

Mark Langkau wrote:

I installed ELOG on a Linux server (CentOS 5.2) and a WinXP laptop.

- If I set both servers to non-SSL, I can synchronize with no problems.

- If I set both servers to use SSL, synchronization fails with "Error code: ssl_error_rx_record_too_long" 

- If I set one to ssl and the other non-ssl, synchronization fails with "Remote server is not an ELOG server"

Is anyone synchronizing or mirroring two ELOG servers with SSL? When either or both servers are set to use SSL, I can use either site. but I can't synchronize.

 

Synchronization with SSL does not yet work. I have to find some time to implement it. Since you are already the second one mentioning this, it slipped higher on my to-do list  

 

 

Hi Stefan, we would also like to see synchronization with SSL working. Hopefully now this task can slip even higher on your to-do list.   It is a real pain to get to the elog from outside PSI, when elogd is running inside PSI (which it must be when working as an online logbook with MIDAS). We would very much ike to mirror it on a server outside PSI.

  1502   Mon Nov 7 09:16:47 2005 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux2.6.0Re: Problems with ELOG and Internet Explorer

Elaine Cristina Franchini dos Anjos wrote:
We are facing a problem when using the Internet Explorer browser to edit
logbooks entries. The error occurs when we use the preview option.

After this, the connection becomes slow to display the preview and returns
"Server Not Found - Page cannot be displayed" or "Internal Server error" as result.
If we try to turn back to the edit page the browser retuns
"This page has been expired".

It happens at any time even we edit simple entries in Internet Explorer,
but never occurs in other browsers.

Software versions that are running :

Elog version 2.6.0-beta
Fedora Core release 1 (Yarrow)
Apache/2.0.54 (Unix) mod_ssl/2.0.54 OpenSSL/0.9.7g
(Elog is running under apache proxy)

Is there any bug report about this or there is something else
that I need to configure ?


I tried on this forum with Internet Explorer 6.0 and could not reproduce the problem, and I never heared anybody else mentioning this problem. Can you reproduce the problem on the forum?
  1504   Mon Nov 7 18:55:57 2005 Reply Elaine Cristina Franchini dos Anjoselaine@ccuec.unicamp.brQuestionLinux2.6.0Re: Problems with ELOG and Internet Explorer
Hi Stefan,


Quote:

I tried on this forum with Internet Explorer 6.0 and could not reproduce the problem, and I never heared anybody else mentioning this problem. Can you reproduce the problem on the forum


I couldn't reproduce the problem in this forum too, and I'm using Internet Explorer to edit this entry now... :-D

I did some new tests and at this time I tried to submit new entries using the ELOG default port
without proxy, because I realized that this Forum doesn't use https (maybe uses proxy).

I edited and used preview many times and the ELOG worked fine without errors in IE.
So, I think my problem is something configured in the proxy or https that Internet Explorer
doesn't work very well in this circumstance.

Do you know problems like this ?
Is there anybody else using ELOG under https ?

My proxy configuration :


Quote:


1) http (default port 80):

# Redirect to ELOG - Logbook

Redirect permanent /elog https://antares.ccuec.unicamp.br:9696


2) https (I need to use other different port number) :

<VirtualHost 143.106.80.30:9696>
# Here be standard configuration for the Virtual Host
ServerName antares.ccuec.unicamp.br:9696
ServerAdmin suporte@ccuec.unicamp.br

# This be the path to the elog directory
# (This didn't seem to make any difference, but it be a good
# idea nonetheless)
DocumentRoot "/www/elog"

# Here be the setup for the SSL component of the Virtual Host
SSLEngine On
SSLCertificateFile /www/apache/conf/ssl.crt/server.crt
SSLCertificateKeyFile /www/apache/conf/ssl.key/server.key

# Here be the setup options for the Proxy module
ProxyRequests Off
ProxyPreserveHost On

# This be the root of the new Virtual Host, and it should be
# redirected to the port the elogd server is listening to
# (8081 on our poop deck).
<Location />
<Location />
ProxyPass http://antares.ccuec.unicamp.br:8081/
ProxyPassReverse http://antares.ccuec.unicamp.br:8081/
SSLRequireSSL
</Location>

ErrorLog /www/apache/logs/error_log
TransferLog /www/apache/logs/access_log </VirtualHost>


Thanks in advance.

Elaine
  1505   Tue Nov 8 08:17:22 2005 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux2.6.0Re: Problems with ELOG and Internet Explorer

Elaine Cristina Franchini dos Anjos wrote:
I edited and used preview many times and the ELOG worked fine without errors in IE. So, I think my problem is something configured in the proxy or https that Internet Explorer doesn't work very well in this circumstance.


Have a look at your URL = ... statement in elogd.cfg
It should probably read
URL = https://antares.ccuec.unicamp.br:9696

ELOG uses redirection internally. To determine it's own address, it uses the URL statement. If you use Apache as an proxy together with https, you have to specify the URL under which you usually access ELOG from outside. If this is wrong, ELOG might try to redirect to http:// or something which might not be possible.

A good way to debug this is to run ELOG with the -v flag and carefully watch the HTTP traffic. You will see Location: ... statements which redirect the browser, then the browser will access the redirected URL (if it's correct), or you will see nothing (in case the browser tries to access a non-existing URL).
  1594   Fri Jan 13 18:43:08 2006 Reply Elaine Cristina Franchini dos Anjoselaine@ccuec.unicamp.brQuestionLinux2.6.0Re: Problems with ELOG and Internet Explorer
Hi Stefan,

I couldn't solve this problem yet...
I have been tried a lot of configurations, but our Elog doens't work well in IE with https Crying
It works very well to read, list, find the messages, delete, and so on...
But all users have problems with edit and preview commands when they are using IE + https.

When we use Elog in IE without https, everything works fine. ?)

We are using :
httpd-2.0.54
Fedora Core release 1 (Yarrow)
elog-2.6.0


The redirect directive in httpd.conf:
<VirtualHost xxx.xxx.xx.xx>
    ServerAdmin our.email.address
    DocumentRoot /www/apache/htdocs
    ServerName our.server.name

    # Rules to new  elog 2.6.0 
    Redirect / https://our.server.name:9898

    ErrorLog logs/error_log
    CustomLog logs/access_log common
</VirtualHost>



The proxy directives in ssl.conf:
(We used the http://midas.psi.ch/elogs/contributions/11 message like reference.
Thanks a lot for the contribution!!! Happy)
<VirtualHost xxx.xxx.xx.xx:9898>
   # Here be standard configuration for the Virtual Host
   ServerName our.server.name:9898
   ServerAdmin our.email.address
   RequestHeader set Front-End-Https "On"

   # This be the path to the elog directory
   # (This didn't seem to make any difference, but it be a good
   #  idea nonetheless)
   DocumentRoot "/www/src/elog-2.6.0"

   # Here be the setup for the SSL component of the Virtual Host
   SSLEngine On
   SSLCertificateFile /www/apache/conf/ssl.crt/server.crt
   #SSLCertificateKeyFile /www/apache/conf/ssl.key/server.pem
   SSLCertificateKeyFile /www/apache/conf/ssl.key/server.key

   # Here be the setup options for the Proxy module
   ProxyRequests Off
   ProxyPreserveHost On

   # This be the root of the new Virtual Host, and it should be
   # redirected to the port the elogd server is listening to
   # (8082 on our poop deck).

   <Location />
        ProxyPass  http://our.server.name:8082/
        ProxyPassReverse  http://our.server.name:8082/
        SSLRequireSSL
   </Location>

   ErrorLog /www/apache/logs/error_log
   TransferLog /www/apache/logs/access_log
</VirtualHost>

And the URL is configured in elogd.cfg like your suggestion (Thanks ! Happy)
URL = https://our.server.name:9898

The elgod.cfg is attached to this message to add more details about our configuration.

Thanks in advance.

Regards,

Elaine


Stefan Ritt wrote:

Elaine Cristina Franchini dos Anjos wrote:
I edited and used preview many times and the ELOG worked fine without errors in IE. So, I think my problem is something configured in the proxy or https that Internet Explorer doesn't work very well in this circumstance.


Have a look at your URL = ... statement in elogd.cfg
It should probably read
URL = https://antares.ccuec.unicamp.br:9696

ELOG uses redirection internally. To determine it's own address, it uses the URL statement. If you use Apache as an proxy together with https, you have to specify the URL under which you usually access ELOG from outside. If this is wrong, ELOG might try to redirect to http:// or something which might not be possible.

A good way to debug this is to run ELOG with the -v flag and carefully watch the HTTP traffic. You will see Location: ... statements which redirect the browser, then the browser will access the redirected URL (if it's correct), or you will see nothing (in case the browser tries to access a non-existing URL).
Attachment 1: elogd.cfg
[global]

###################################################################
# This [global] section contains settings common to all logbooks
# If an individual logbook setting should be the same in all
# logbooks, it can be copied into this section. If it is present
# in this section and in a logbook section, the one in the logbook
# section has precedence. 
####################################################################

# Server TCP port under which the server is listening.
Port = 8082

# Switches on (1) and off (0) logbook tabs
Logbook tabs = 1

# Determines size of logbook tabs
Tab cellpadding = 2

# Language can be english, french, spanish, german, dutch, brazilian
;Language = english 
Language = brazilian

# Main Tab, if present, brings you back to main page
Main Tab = Main Page


# Specifies the root directory for ELOG resources like help files, themes,
# icons and user HTML files
;;resource dir = /www/elog
resource dir = /www/src/elog-2.6.0

# Optional Welcome Title can be customized, GIF image has to be in same directory as elogd.cfg
;Welcome Title = <font size=5 color=white>Welcome to<p><img src="elog.gif"><p>Please select logbook

Welcome Title = <font size=4 color=white>Bem-vindo ao Elog <img align=middle width=60 height=40 src=welcome.jpg> Eletronic logbooks</font<font size=2 color=white><p> Esses logbooks contém informações sobre instalações e alterações de softwares de cada máquina servidora. 
Para criar novos logbooks ou forum, por favor <a href=elaine@ccuec.unicamp.br>entre em contato. </a></font> # Following string is used as the title for the logbook selection page. # Used by most browsers also for bookmark names. ;Page title = ELOG Demo Page title = ELOG - $subject # The selection page can be completely customized with a user written page # Outcomment following line if wanted #Selection page = select.html # Specifies the logging level. The higher this value, the more information # is logged. Default is 2: # 1: Log only logins and logouts # 2: Log also write accesse # 3: Log also read accesses Logging level = 3 # To log all user login/logout activity, outcomment following line ;;Logfile = /www/elog/logs/elogd.log Logfile = /www/src/elog-2.6.0/logs/elogd.log # The SMTP host is used for Email notifications. Ask you system administrator #SMTP host = mail.your.domain SMTP host = apolo.ccuec.unicamp.br # URL used for the URL link in email notification. Only uncomment if the internal # URL is incorrect #URL = http://host.your.domain/ URL = https://antares.ccuec.unicamp.br:9898 # User and Group under which the elogd daemon is started under Unix # Logfiles generate by the daemon are owned by this user #User = nobody #Group = nobody Usr = elog Grp = elog #--------------------------- # Access control #--------------------------- # Password file containg a number of users in the form: # # <login name1>:<password1>:<full name1> # <login name2>:<password2>:<full name2> # <login name3>:<password3>:<full name2> # ... # Password should be initially empty and changed via the # "Change password" button ;;Password file = /www/elog/logbooks/auth/passwd.dssof Password file = /www/src/elog-2.6.0/logbooks/auth/passwd.dssof # Password (cookie) expiration in hours, zero for current browser session #Login expriation = 1 Login expiration = 0 # Define Admin User Admin user = admin # Allow "delete" command only to user "admin" #Allow delete = conny, stefan Allow delete = admin # Don't accept any connection from bad host ;Hosts deny = bad.guy.com # # Alternative access control with a global password, change password # with "elogd -l Demo1 -r <password>. The one below is "secret". The # browser opens a box and asks for the user name (don't care) and # the password "secret" in this case. # #Read password=c2Vjc=== # Separate password for write access, change with # "elogd -l Demo1 -w <password> #Write password=c2Vjc=== # Expires after browser session #Write password expiration = 0 # Admin password for "config" and "delete" commands, change with # "elogd -l Demo1 -a <password> #Admin password=c2Vjc=== # Expires after one day #Admin password expriation = 24 # Created for initialize the password file. If you want # to make available the "Self Registration" for a new # user, remove the comments ! # 0 - disables self registration # 1 - users can silently register # 2 - causes elogd to send an email notification to the admin user(s) # 3 - used to only send an email notification to tha admin users(s), # which then can validate the account and commit it by hitting the URL given # in the email notification. Self register = 0 #--------------------------- # General options #--------------------------- # If another theme is created, it must be placed under the themes/ directory Theme = default # Comment as displayed in the logbook selection page ;Comment = First Demo Logbook # Logbook directory, must be created manually ;Data dir = logbooks/demo # Page title as used by browsers as bookmark names, default is # "ELOG - $logbook" Page title = $logbook ELogbook # Determine number of possible attachments, max. is ten, min is zero Number Attachments = 2 # Date format as passed to the strftime() function and used to display # the entry date ;Date format = %A, %B %d, %Y Date format = %B %d, %Y # Optionally, a user defined welcome page can be used as the starting page # for each logbook. It should contain at least some buttons/links to display # and enter messages #Welcome page = demo1.html # The default behavior is to display the last message in a logbook. This # can be changed with the following command. A few examples are given #Start page = last10 #Start page = ?cmd=New #Start page = ?cmd=Search&mode=summary&type=routine # Optional page displayed after submission of a message #Submit page = submit.html # Comment displayed on top of the message entry field ;Message comment = Please enter your message here: Message comment = Por favor, entre com sua mensagem aqui: # Commands dispalyed in the menu bar of the message page ;Menu commands = New, Edit, Delete, Reply, Download, Find, Last day, Last 10, Copy To, Move To, Config, Change password, Logout, Help ;Menu commands = List, New, Edit, Reply, Delete, Duplicate, Download, Find, Last day, Last 10, Copy To, Config, Admin, Change password, Logout, Help Menu commands = List, New, Edit, Reply, Delete, Duplicate, Download, Find, Copy To, Config, Admin, Change password, Logout, Help ;Lista da versão anterior ;List Menu commands = List, New, Edit, Reply, Delete, Duplicate, Download, Find, Last Day, Copy to, Config, Admin, CVS Import, Login, Logout, Help Edit Menu commands = List, New, Edit, Reply, Delete, Duplicate, Download, Find, Last Day, Copy to, Config, Admin, CVS Import, Login, Logout, Help # Commands dispalyed in the menu bar of the search result page #Find Menu commands = New, Edit, Delete, Reply, Find, Last day, Last 10, Copy To, Move To, Config, Change password, Logout, Help # Text displayed at bottom of page #Bottom text = bottom.html # URL for site-specific help file, must be either present in the same # directory as elod.cfg or point to an external Web server Help URL = http://midas.psi.ch/elog/config.html # Charactes per line for message entry ;;Message width = 76 ######################################################## # Group of logbooks ######################################################## # Group Rede CorpNet Group Rede CorpNet = Acesso Residencial, Alphas, Antivírus, Backup, Cluster Web, Cluster EA, EAD, FTP, Impressão, Listas, LogCorp, Mail Acadêmico, Proxy Reverso, Sistemas Informação, SmartCard Group Cluster Web = aquarius, athena, lvs1, lvs2, polaris, sirius, sparta, vega Group Mail Acadêmico = faunus, hercules Group Cluster EA = icarus, osiris, artemis, arcadia Group EAD = serveread, mirror-ead Group Alphas = mozart, pascal, turing Group FTP = zeus Group LogCorp = logcorp Group Antivírus = terra Group SmartCard = smart01, smart02 Group Sistemas Informação = plutao, protocolo, sig01, zeta Group Proxy Reverso = netuno Group Listas = phoenix Group Impressão = creta Group Backup = emporium Group Acesso Residencial = olimpo # Group Rede CCnet Group Rede CCnet = Desenv EA, Desenv Sist Inf, Laboratório, LDAP, LogCCUEC, Servidoras CCUEC, Instalação Group Desenv Sist Inf = desenv02, desenv03, desenv05, ares, magda, minerva, nyx Group Desenv EA = eros Group LogCCUEC = logccuec Group Servidoras CCUEC = apolo, mercurio Group LDAP = sol, toe, andromeda Group Laboratório = pegasus Group Instalação = hefesto, quiron # Group Rede Sist Group Rede Sist = Banco de Dados, LogSist, Servidoras de Aplicação, Serviços Group Banco de Dados = proddb01 Group LogSist = logsist Group Servidoras de Aplicação = web01, web02, web03, sedna Group Serviços = prod02, prod03, prod04, prod05 # Group Testes Group Testes = Demo, Demo2, Forum # Group for DCNET logbooks Group Switches = maq1, maq2 ; Group for DTTEC logbooks Group Windows = dttec1, dttec2 # Define Top Groups Top group dcnet = Switches Top group dssof = Rede CorpNet, Rede CCNet, Rede Sist, Testes Top group dttec = Windows # Show initial page with top groups Show top groups = 1 ######################################################## # Logbook attributes ######################################################## # DSSOF logbooks attributes Attributes = Author, Author Email, Type, Category, Subject, Data Inicio, Data Fim, Last Revision, Alias # Define data type Type Data Inicio = date Type Data Fim = date # Attributes which are required Required Attributes = Subject, Category, Type, Data Inicio, Data Fim # Predefined options for attribute "type" Options Type = Hardware, Rede, Sistema Operacional, Software , Banco de Dados, Produtos # Predefined options with multiple selections : # This list allows for "Multiple Options", meaning that an attribute can have several values # simultaneously. When entering an entry with MOptions, each value from the list is represented # by a checkbox. Unlike with normal options, multiple checkboxes can be checked for an entry. # The attribue value then becomes ;MOptions Category = General, Hardware, Software, Network, Other
... 971 more lines ...
  1606   Wed Jan 18 13:31:32 2006 Reply Stefan Rittstefan.ritt@psi.chQuestionLinux2.6.0Re: Problems with ELOG and Internet Explorer
Have you tried another browser, like Firefox? Do you have the same problems with Firefox? Can you try the following:

Start elogd manually with the "-v" flag, like
elogd -c <your config path> -v -p 8080
and watch the output carefully. When you submit an entry, elogd does redirection. You will see that in the HTTP header you have an entry like
...
Location: https://...
...
This location is taken from the URL statement of your config file. If it's wrong (like if you mixed http:// and https://), your browser will try to load the page from a non-existion location.
ELOG V3.1.5-3fb85fa6