[Bug 855532] New: nconf has a misleading config file for apache2
https://bugzilla.novell.com/show_bug.cgi?id=855532 https://bugzilla.novell.com/show_bug.cgi?id=855532#c0 Summary: nconf has a misleading config file for apache2 Classification: openSUSE Product: openSUSE 13.1 Version: Final Platform: Other OS/Version: openSUSE 13.1 Status: NEW Severity: Minor Priority: P5 - None Component: Other AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: wagner-thomas@gmx.at QAContact: qa-bugs@suse.de Found By: --- Blocker: --- User-Agent: Opera/9.80 (Windows NT 6.1; WOW64) Presto/2.12.388 Version/12.16 Per default nconf does not have any access restriction to it's webinterface. In /etc/apache2/conf.d/nagios-nconf.conf some Auth* stuff is present (but commented out). These Auth* lines points to nagios' htpasswd file. This suggest that uncommenting this section will enable user authentication of nconf's webinterface against nagios' config. However, the line "Require valid-user" is missing which leads to an apache2 ERROR 500. Of course, this is no show-stopper, but IMHO, if there is a "ready-to-uncomment" config, it should work. As nconf requires nagios anyway, these section could be enabled by default. Reproducible: Always Steps to Reproduce: 1. have a working apache2 2. install nconf 3. access nconf via http://localhost/nconf => it's working 4. find that in /etc/apache2/conf/nconf.d some Auth* stuff point to nagios' user config is present 5. uncommenting these lines result in an apache2 server error 6. uncommenting the lines an adding "Require valid-user" works -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=855532 https://bugzilla.novell.com/show_bug.cgi?id=855532#c Xiyuan Liu <xyliu@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |xyliu@suse.com AssignedTo|bnc-team-screening@forge.pr |lrupp@suse.com |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=855532 https://bugzilla.novell.com/show_bug.cgi?id=855532#c1 Lars Vogdt <lrupp@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Priority|P5 - None |P4 - Low Status|NEW |CLOSED CC| |lrupp@suse.com Found By|--- |Community User Resolution| |FIXED --- Comment #1 from Lars Vogdt <lrupp@suse.com> 2013-12-23 15:33:35 CET --- Thanks for the analysis of the problem! I added the Require valid-user line now together with a small explanation for the user to uncomment the lines to secure the installation. As upstream let's nconf "unsecured" per default (as the output is just placed in /srv/www/nconf/output/ this should not be a real problem) and I can not make a real estimate which authentication method the enduser is using, I like to leave the lines commented out for now. I hope this also makes sense in your eyes. Updated package containing the fix should be available in the Build Service repository soon. Closing here as fixed. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply@novell.com