Of VFS, Access Rights and LDAP Integration

mike_a 2011-01-03 15:48:51 UTC #1

Hello All,

I'm using LDAP to store my egroupware user accounts, and I'm using pam_ldap to integrate my Linux servers with the LDAP repository, however I cannot integrate VFS and file system access rights to complete the final piece of integration. I understand that VFS cannot store ACL rights, but shouldn't/couldn't it be possible to integrate VFS with the file system ACL when possible?

Ralf_Becker_6 2011-01-05 08:53:57 UTC #2

VFS default backend sqlfs stores ACL rights and file ownership, by using a sql table to store these metadata.

The filesystem backend, which can optionally be used to mount parts of the servers filesystem into EGroupware’s VFS, can not store ACL or ownership, as that would require the webserver to run as root. As this is securitywise not desired, it was never implemented.

EPL version now have a backend that can mount Samba Shares into the VFS. That backend can use username and password of the EGroupware sessions to authenticate with Samba. If you have a Samba PDC administrated via EGroupware (using LDAP) or authenticate agains Active Directory, users access the Samba share or their homedirectories with there own access rights. This works as Samba runs with root rights to archive that.

Ralf

----------------------------------------------------------

  Hello All,

  I'm using LDAP to store my egroupware user accounts, and I'm using pam_ldap to 
integrate my Linux servers with the LDAP repository, however I cannot integrate VFS and file
system access rights to complete the final piece of integration. I understand that VFS cannot
store ACL rights, but shouldn’t/couldn’t it be possible to integrate VFS with the file
system ACL when possible?

View this message in context: [of VFS, Access Rights and LDAP Integration
Sent from the egroupware-users mailing list archive ->
http://egroupware.219119.n3.nabble.com/of-VFS-Access-Rights-and-LDAP-Inte
gration-tp2185671p2185671.html] at Nabble.com.

Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate

database storage, standardize their database environment, and,
should the need arise,
upgrade to a full multi-node Oracle RAC database
without downtime or
disruption
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing

list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

–

-- 
Ralf Becker
Director Software Development
 
Stylite GmbH 
[open style of IT] 
 
Morschheimer Strasse 15 
67292 Kirchheimbolanden
 
fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de 
 
www.stylite.de
www.egroupware.org
________________________________________________
 
Geschäftsführer Andre Keller,
Gudrun Müller, Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951
--
Ralf Becker
Director Software Development

Stylite GmbH
[open style of IT]

Morschheimer Strasse 15
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de 

www.stylite.de
www.egroupware.org
________________________________________________

Geschäftsführer Andre Keller,
Gudrun Müller, Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951

Mgr_Peter_Tuharsky_M 2011-01-05 12:58:55 UTC #3

Hi, all, hi Ralf,

I’m sending the actual holiday file for Slovakia (SK) for 2011.

Sincerely
Peter

Mgr_Peter_Tuharsky_M 2011-01-05 13:17:46 UTC #4

Hi,

I have a problem with session files. Previously they were stored in
/var/lib/egroupware/sessions

However, thay no longer are after migration to 1.8.001

The configuration option in Setup app: “Enter the full path for users
and group files. Examples: /files, E:\FILES” is set to
/var/lib/egroupware/files

In the EGw Admin - Site settings, it dosen’t matter, whether I select
the place to store cookies as “document root” or “egroupware directory”.
The cookies are not stored in the directory. Cookies are ON of course.

I’m quite puzzled. Where should the cookies be stored?

Peter

mike_a 2011-01-05 15:37:18 UTC #5

Hi Ralf and egw community:

I'm a lowly hack and simple startup and can't afford the EPL version. Even if I could someday afford it, I'm not sure that I would ever purchase the EPL because licensing goes against my deeply held philosophical beliefs. That isn't to say that I won't funnel money back into the community should I ever become profitable.

Please forgive my ignorance for a moment and bear with my example. Wouldn't it be possible to specify a file system admin that exists in LDAP and likewise has rights to the file system, create a 'persistent' LDAP connection as the file system admin in PHP, and then write files and manage file system privileges as that admin?

Peace,

mike

Ralf_Becker_6 2011-01-06 00:20:03 UTC #6

Hi Peter,

please add at least the next 5 years and then post it to the developers list.

Thanks

Ralf

Ralf_Becker_6 2011-01-06 00:22:50 UTC #7

Hi Peter,

cookies and session files are two different things. Cookies are stored by your browser somewhere on the client.

Session files are now stored in there default location (defined in your php.ini or compiled in php), as setting something different made to many problems in the past.

Ralf

Ralf_Becker_6 2011-01-06 00:26:45 UTC #8

As I wrote before, to be able to change eg. file ownership requires root rights and running the webserver with root rigths is no good idea security wise. Therefore it has never been implemented. Samba is an alternative and secure way to archive that.

Ralf

----------------------------------------------------------

  Hi Ralf and egw community:

  I'm a lowly hack and simple startup and can't afford the EPL version. Even if I could 
someday afford it, I’m not sure that I would ever purchase the EPL because licensing goes
against my deeply held philosophical beliefs. That isn’t to say that I won’t funnel money back
into the community should I ever become profitable.
  Please forgive my ignorance for a moment and bear with my example. Wouldn't it be 
possible to specify a file system admin that exists in LDAP and likewise has rights to the file
system, create a ‘persistent’ LDAP connection as the file system admin in PHP, and then write
files and manage file system privileges as that admin?
  Peace,

   

  mike
View this message in context: [Re: of VFS, Access Rights and LDAP Integration
Sent from the egroupware-users mailing list archive ->
http://egroupware.219119.n3.nabble.com/of-VFS-Access-Rights-and-LDAP-Inte
gration-tp2185671p2199211.html] at Nabble.com.

Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate

database storage, standardize their database environment, and,
should the need arise,
upgrade to a full multi-node Oracle RAC database
without downtime or
disruption
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing

list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

–

-- 
Ralf Becker
Director Software Development
 
Stylite GmbH 
[open style of IT] 
 
Morschheimer Strasse 15 
67292 Kirchheimbolanden
 
fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de 
 
www.stylite.de
www.egroupware.org
________________________________________________
 
Geschäftsführer Andre Keller,
Gudrun Müller, Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951
--
Ralf Becker
Director Software Development

Stylite GmbH
[open style of IT]

Morschheimer Strasse 15
67292 Kirchheimbolanden

fon +49 (0) 6352 70629-0
fax +49 (0) 6352 70629-30
mailto: rb@stylite.de 

www.stylite.de
www.egroupware.org
________________________________________________

Geschäftsführer Andre Keller,
Gudrun Müller, Ralf Becker
Registergericht Kaiserslautern HRB 30575
Umsatzsteuer-Id / VAT-Id: DE214280951

Mgr_Peter_Tuharsky_M 2011-01-14 09:53:33 UTC #9

Thanks, Ralf, I see the session files there in /var/lib/php
However, why then I cannot see number of logged in users (says “0”), nor
the sessions list (is empty)? I can only see the sessions chronology
(access log).

Peter

piscue 2011-01-14 13:11:07 UTC #10

I had same issue with sessions.

I’ve declared a sessions path to old path in my apache’s virtualhost file:

php_value session.save_path /var/lib/egroupware/sessions

Also, maybe can work declaring /var/lib/php on open_basedir (but I
didn’t tried):

php_admin_value open_basedir
/usr/share/egroupware:/var/lib/egroupware:/tmp:/usr/share/php:/usr/local/zend/share/pear:/usr/bin/zip:/usr/share/jpgraph:/usr/bin/tnef:/var/lib/php

Thanks, Ralf, I see the session files there in /var/lib/php
However, why then I cannot see number of logged in users (says “0”), nor
the sessions list (is empty)? I can only see the sessions chronology
(access log).

Peter

Hi Peter,

cookies and session files are two different things. Cookies are stored by your browser somewhere on the client.

Session files are now stored in there default location (defined in your php.ini or compiled in php), as setting something different made to many problems in the past.

Ralf

Von: “Peter Tuhársky” tuharsky@misbb.sk
An: “discussions and questions from users and for users of eGroupWare” egroupware-users@lists.sourceforge.net
Datum: Wed, 05 Jan 2011 14:17:46 +0100

Hi,

I have a problem with session files. Previously they were stored in
/var/lib/egroupware/sessions

However, thay no longer are after migration to 1.8.001

The configuration option in Setup app: “Enter the full path for users
and group files. Examples: /files, E:\FILES” is set to
/var/lib/egroupware/files

In the EGw Admin - Site settings, it dosen’t matter, whether I select
the place to store cookies as “document root” or “egroupware directory”.
The cookies are not stored in the directory. Cookies are ON of course.

I’m quite puzzled. Where should the cookies be stored?

Peter

Learn how Oracle Real Application Clusters (RAC) One Node allows customers
to consolidate database storage, standardize their database environment,
and,
should the need arise, upgrade to a full multi-node Oracle RAC database
without downtime or disruption
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

Protect Your Site and Customers from Malware Attacks
Learn about various malware tactics and how to avoid them. Understand
malware threats, the impact they can have on your business, and how you
can protect your company and customers by using code signing.
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

–
:wq

Protect Your Site and Customers from Malware Attacks
Learn about various malware tactics and how to avoid them. Understand
malware threats, the impact they can have on your business, and how you
can protect your company and customers by using code signing.
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

Mgr_Peter_Tuharsky_M 2011-01-14 13:27:46 UTC #11

Ralf,

I don’t think it is possible. The Easter in Slovakia is planned in
cooperation of the state and church, it has no exact rigid date that
would do for years. I’ll however try to get the info…

Peter

cbahiana 2011-01-14 13:47:38 UTC #12

Same thing for me: session files are there, at
/var/lib/egroupware/sessions/, but “Show sessions” is empty.

Egroupware 1.6.003
Ubuntu server 9.10
PHP 5.2.10-2ubuntu6.7
Suhosin Patch 0.9.7
Using memcached

open_basedir is set through vhost: php_admin_value open_basedir
/usr/share/egroupware:/var/lib/egroupware:/tmp:/usr/share/php:

I also see about session:
Registered save handlers files user memcache
Registered serializer handlers php php_binary wddx

Could memcached be the culprit?

I had same issue with sessions.

I’ve declared a sessions path to old path in my apache’s virtualhost file:

php_value session.save_path /var/lib/egroupware/sessions

Also, maybe can work declaring /var/lib/php on open_basedir (but I
didn’t tried):

php_admin_value open_basedir

/usr/share/egroupware:/var/lib/egroupware:/tmp:/usr/share/php:/usr/local/zend/share/pear:/usr/bin/zip:/usr/share/jpgraph:/usr/bin/tnef:/var/lib/php

Thanks, Ralf, I see the session files there in /var/lib/php
However, why then I cannot see number of logged in users (says “0”), nor
the sessions list (is empty)? I can only see the sessions chronology
(access log).

Peter

Hi Peter,

cookies and session files are two different things. Cookies are stored
by your browser somewhere on the client.

Session files are now stored in there default location (defined in your
php.ini or compiled in php), as setting something different made to many
problems in the past.

Ralf

Von: “Peter Tuhársky” tuharsky@misbb.sk
An: "discussions and questions from users and for users of eGroupWare"
egroupware-users@lists.sourceforge.net

Datum: Wed, 05 Jan 2011 14:17:46 +0100

Hi,

I have a problem with session files. Previously they were stored in
/var/lib/egroupware/sessions

However, thay no longer are after migration to 1.8.001

The configuration option in Setup app: “Enter the full path for users
and group files. Examples: /files, E:\FILES” is set to
/var/lib/egroupware/files

In the EGw Admin - Site settings, it dosen’t matter, whether I select
the place to store cookies as “document root” or “egroupware
directory”.

The cookies are not stored in the directory. Cookies are ON of course.

I’m quite puzzled. Where should the cookies be stored?

Peter

Learn how Oracle Real Application Clusters (RAC) One Node allows
customers

to consolidate database storage, standardize their database
environment,

and,
should the need arise, upgrade to a full multi-node Oracle RAC database
without downtime or disruption
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

Protect Your Site and Customers from Malware Attacks
Learn about various malware tactics and how to avoid them. Understand
malware threats, the impact they can have on your business, and how you
can protect your company and customers by using code signing.
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

–
:wq

Protect Your Site and Customers from Malware Attacks
Learn about various malware tactics and how to avoid them. Understand
malware threats, the impact they can have on your business, and how you
can protect your company and customers by using code signing.
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

–
[]s,
Carlos Bahiana

cbahiana 2011-01-14 14:05:18 UTC #13

Just a complement:

egw_sessions is empty

[]s,
Carlos Bahiana

Same thing for me: session files are there, at
/var/lib/egroupware/sessions/, but “Show sessions” is empty.

Egroupware 1.6.003
Ubuntu server 9.10
PHP 5.2.10-2ubuntu6.7
Suhosin Patch 0.9.7
Using memcached

open_basedir is set through vhost: php_admin_value open_basedir
/usr/share/egroupware:/var/lib/egroupware:/tmp:/usr/share/php:

I also see about session:
Registered save handlers files user memcache
Registered serializer handlers php php_binary wddx

Could memcached be the culprit?

I had same issue with sessions.

I’ve declared a sessions path to old path in my apache’s virtualhost file:

php_value session.save_path /var/lib/egroupware/sessions

Also, maybe can work declaring /var/lib/php on open_basedir (but I
didn’t tried):

php_admin_value open_basedir

/usr/share/egroupware:/var/lib/egroupware:/tmp:/usr/share/php:/usr/local/zend/share/pear:/usr/bin/zip:/usr/share/jpgraph:/usr/bin/tnef:/var/lib/php

Thanks, Ralf, I see the session files there in /var/lib/php
However, why then I cannot see number of logged in users (says “0”), nor
the sessions list (is empty)? I can only see the sessions chronology
(access log).

Peter

Hi Peter,

cookies and session files are two different things. Cookies are stored
by your browser somewhere on the client.

Session files are now stored in there default location (defined in your
php.ini or compiled in php), as setting something different made to many
problems in the past.

Ralf

Von: “Peter Tuhársky” tuharsky@misbb.sk
An: "discussions and questions from users and for users of eGroupWare"
egroupware-users@lists.sourceforge.net

Datum: Wed, 05 Jan 2011 14:17:46 +0100

Hi,

I have a problem with session files. Previously they were stored in
/var/lib/egroupware/sessions

However, thay no longer are after migration to 1.8.001

The configuration option in Setup app: “Enter the full path for users
and group files. Examples: /files, E:\FILES” is set to
/var/lib/egroupware/files

In the EGw Admin - Site settings, it dosen’t matter, whether I select
the place to store cookies as “document root” or “egroupware
directory”.

The cookies are not stored in the directory. Cookies are ON of course.

I’m quite puzzled. Where should the cookies be stored?

Peter

Learn how Oracle Real Application Clusters (RAC) One Node allows
customers

to consolidate database storage, standardize their database
environment,

and,
should the need arise, upgrade to a full multi-node Oracle RAC
database

without downtime or disruption
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

Protect Your Site and Customers from Malware Attacks
Learn about various malware tactics and how to avoid them. Understand
malware threats, the impact they can have on your business, and how you
can protect your company and customers by using code signing.
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

–
:wq

Protect Your Site and Customers from Malware Attacks
Learn about various malware tactics and how to avoid them. Understand
malware threats, the impact they can have on your business, and how you
can protect your company and customers by using code signing.
http://p.sf.net/sfu/oracle-sfdevnl

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

–
[]s,
Carlos Bahiana

–

Mgr_Peter_Tuharsky_M 2011-01-21 09:49:32 UTC #14

Since this seems as bug, I reported it. #2809