The instructions for securing elogd using an SSL proxy are incomplete.
http://midas.psi.ch/elog/adminguide.html#secure
http://midas.psi.ch/elogs/contributions/11

If you follow these instructions, elogd will still listen for and accept non-SSL connections on it's own TCP port bypassing the SSL proxy.

(True, the elogd TCP port number is somewhat secret, so there is some security-by-obscurity here).

To secure the elogd TCP port against connections that bypass the SSL proxy, elogd has to be started
with the "-n localhost" command line options.

To add this option, one has to edit /etc/init.d/elogd. I do not know if this change will be lost when the elog rpm package is updated.

It would be better if this option could have been specified through elogd.conf.

The "-n" command line option is not documented here
http://midas.psi.ch/elog/adminguide.html#config
but is visible if you run "elogd -h".

P.S. Even with "-n localhost", users of the local machine can bypass the SSL proxy.

K.O.

> The instructions for securing elogd using an SSL proxy are incomplete.
> http://midas.psi.ch/elog/adminguide.html#secure
> http://midas.psi.ch/elogs/contributions/11
> 
> If you follow these instructions, elogd will still listen for and accept non-SSL connections on it's own TCP port bypassing the SSL proxy.
> 
> (True, the elogd TCP port number is somewhat secret, so there is some security-by-obscurity here).
> 
> To secure the elogd TCP port against connections that bypass the SSL proxy, elogd has to be started
> with the "-n localhost" command line options.
> 
> To add this option, one has to edit /etc/init.d/elogd. I do not know if this change will be lost when the elog rpm package is updated.
> 
> It would be better if this option could have been specified through elogd.conf.
> 
> The "-n" command line option is not documented here
> http://midas.psi.ch/elog/adminguide.html#config
> but is visible if you run "elogd -h".
> 
> P.S. Even with "-n localhost", users of the local machine can bypass the SSL proxy.
> 
> K.O.

I added the option "interface" to the config file. So you could do

[global]
...
interface = localhost


It was not there originally since most people who care about security use a firewall. The firewall (either locally or one another machine), opens only port 443 for the secure connection and 
not the non-secure one (typically 80 or 8080). This way this has not been an issue in the past. As you guessed correctly the -n option would be overwritten by an rpm package update, so 
that's why I added the "interface" option.

Hi there,

Here's a bit of a special scenario. There's no server-side check the user is logged in upon posting, but it rather seems the server relies on the post data sent from the form.

An example of this can be triggered on a write restricted elog, by hitting on New and logging out in another tab. Then posting, from the first tab, will post as if the user was logged on. Hitting back and posting again also works.

Cheers

Yes the credentials are stored in the form where you enter your text. This has following reason: In a shared environment (several people sitting around a computer) we want to identify who submits an elog entry, but not bother the person to enter his/her password every few minutes. So in our experiment I set the time-out to 15 min, meaning after 15 minutes of inactivity a user gets logged out. If the user accesses ELOG every ten minutes or so, he/she stays logged in for a whole shift, which is what you want. Now the problem is that one starts an elog entry, waits twenty minutes, then wants to submit it, but you are bought back to the login screen and your entry is gone. Therefore I store the credentials (encrypted) in the form, so that the form can even be submitted after 20 minutes. Users at our lab are pretty happy with this solution.

In fact there is no way you can 100% ensure that the logged in user submits an entry without asking for his/her password during the submit. Even if the time span above is only very short, it still can happen that someone starts an entry, leaves the room, and someone else submits it. So people got used to the good practice not to leave any unfinished elog entry open when they go or leave the browser (to another tab for example). If I would implement to password request during the submit, there would be two problems: 1) Users will heavily complain and 2) I have to store the form data temporary (together with some optional attachments) on the server side, start a password query, and only if that succeeds submit the entry. This is somehow complicated to implement since I cannot use the normal elog database. Then I have to care about dangling entries (like if the password was wrong I should delete the temporary data???) and so on.

I plan for the future a kind of "draft" mode, where entries can be stored as "drafts" (like in most email systems). You get an auto-save every few minutes, and can work on the draft before actually submitting it. In that case your password query could be implemented more easily. But implementing the draft mode needs a change of the database system, so I have to find time to do that.

Best regards,

Stefan 

I attempted to install the newest version of elog on our site elog server from an old old version.  Around 2008 I believe.  I then received an application failed to initialize properly 0xc0150002 after installing the newest version.  I then tried installing the Feb 2013 version and received the same message.  Panicked, I rolled back our server to its state yesterday.  I would like to update our elog software, anyone know why I am receiving this error??

 Hi Norm. I have not much experience with windows, but I can give you my two cent on how to proceed:

• Check the old elogd version. It is shown at the bottom of your elog web page (this forum shows ELOG V2.9.2-2475).
• Copy your logbook data to a different PC, maybe your office PC.
• Then compile the latest elog on your office PC, run it with the copied data and access it as http://localhost:8080 (or whatever port number you are using)
• If it is still crashing: re-compile it using "make debug" and run it from a debugger (I don't know any C-debugger for Windows). Post the precise error message.

Afrikaans Albanian Arabic Armenian Azerbaijani Basque Belarusian Bulgarian Catalan Chinese (Simplified) Chinese (Traditional) Croatian Czech Danish Detect language Dutch English Estonian Filipino Finnish French Galician Georgian German Greek Haitian Creole Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Korean Latin Latvian Lithuanian Macedonian Malay Maltese Norwegian Persian Polish Portuguese Romanian Russian Serbian Slovak Slovenian Spanish Swahili Swedish Thai Turkish Ukrainian Urdu Vietnamese Welsh Yiddish ⇄ Afrikaans Albanian Arabic Armenian Azerbaijani Basque Belarusian Bulgarian Catalan Chinese (Simplified) Chinese (Traditional) Croatian Czech Danish Dutch English Estonian Filipino Finnish French Galician Georgian German Greek Haitian Creole Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Korean Latin Latvian Lithuanian Macedonian Malay Maltese Norwegian Persian Polish Portuguese Romanian Russian Serbian Slovak Slovenian Spanish Swahili Swedish Thai Turkish Ukrainian Urdu Vietnamese Welsh Yiddish

Detect language » English

 

Good luck!

Andreas Luedeke wrote:

Norm wrote: I attempted to install the newest version of elog on our site elog server from an old old version.  Around 2008 I believe.  I then received an application failed to initialize properly 0xc0150002 after installing the newest version.  I then tried installing the Feb 2013 version and received the same message.  Panicked, I rolled back our server to its state yesterday.  I would like to update our elog software, anyone know why I am receiving this error??  Hi Norm. I have not much experience with windows, but I can give you my two cent on how to proceed: Check the old elogd version. It is shown at the bottom of your elog web page (this forum shows ELOG V2.9.2-2475). Copy your logbook data to a different PC, maybe your office PC. Then compile the latest elog on your office PC, run it with the copied data and access it as http://localhost:8080 (or whatever port number you are using) If it is still crashing: re-compile it using "make debug" and run it from a debugger (I don't know any C-debugger for Windows). Post the precise error message.   Afrikaans Albanian Arabic Armenian Azerbaijani Basque Belarusian Bulgarian Catalan Chinese (Simplified) Chinese (Traditional) Croatian Czech Danish Detect language Dutch English Estonian Filipino Finnish French Galician Georgian German Greek Haitian Creole Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Korean Latin Latvian Lithuanian Macedonian Malay Maltese Norwegian Persian Polish Portuguese Romanian Russian Serbian Slovak Slovenian Spanish Swahili Swedish Thai Turkish Ukrainian Urdu Vietnamese Welsh Yiddish ⇄ Afrikaans Albanian Arabic Armenian Azerbaijani Basque Belarusian Bulgarian Catalan Chinese (Simplified) Chinese (Traditional) Croatian Czech Danish Dutch English Estonian Filipino Finnish French Galician Georgian German Greek Haitian Creole Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Korean Latin Latvian Lithuanian Macedonian Malay Maltese Norwegian Persian Polish Portuguese Romanian Russian Serbian Slovak Slovenian Spanish Swahili Swedish Thai Turkish Ukrainian Urdu Vietnamese Welsh Yiddish Detect language » English   Good luck!

 Thanks for the reply.  I just got back from a business trip and I will try this ASAP.  Thanks and I will be posting the error message.

Andreas Luedeke wrote:

Norm wrote: I attempted to install the newest version of elog on our site elog server from an old old version.  Around 2008 I believe.  I then received an application failed to initialize properly 0xc0150002 after installing the newest version.  I then tried installing the Feb 2013 version and received the same message.  Panicked, I rolled back our server to its state yesterday.  I would like to update our elog software, anyone know why I am receiving this error??  Hi Norm. I have not much experience with windows, but I can give you my two cent on how to proceed: Check the old elogd version. It is shown at the bottom of your elog web page (this forum shows ELOG V2.9.2-2475). Copy your logbook data to a different PC, maybe your office PC. Then compile the latest elog on your office PC, run it with the copied data and access it as http://localhost:8080 (or whatever port number you are using) If it is still crashing: re-compile it using "make debug" and run it from a debugger (I don't know any C-debugger for Windows). Post the precise error message.   Afrikaans Albanian Arabic Armenian Azerbaijani Basque Belarusian Bulgarian Catalan Chinese (Simplified) Chinese (Traditional) Croatian Czech Danish Detect language Dutch English Estonian Filipino Finnish French Galician Georgian German Greek Haitian Creole Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Korean Latin Latvian Lithuanian Macedonian Malay Maltese Norwegian Persian Polish Portuguese Romanian Russian Serbian Slovak Slovenian Spanish Swahili Swedish Thai Turkish Ukrainian Urdu Vietnamese Welsh Yiddish ⇄ Afrikaans Albanian Arabic Armenian Azerbaijani Basque Belarusian Bulgarian Catalan Chinese (Simplified) Chinese (Traditional) Croatian Czech Danish Dutch English Estonian Filipino Finnish French Galician Georgian German Greek Haitian Creole Hebrew Hindi Hungarian Icelandic Indonesian Irish Italian Japanese Korean Latin Latvian Lithuanian Macedonian Malay Maltese Norwegian Persian Polish Portuguese Romanian Russian Serbian Slovak Slovenian Spanish Swahili Swedish Thai Turkish Ukrainian Urdu Vietnamese Welsh Yiddish Detect language » English   Good luck!

 Andreas,

We do not have the current revision at the bottom of any of the pages.  Is there another way I can find out the current revision I'm using?

Thanks!