ejabberdctl command inside a script gives error "Connection attempt from disallowed node" - linux

I'm running ejabberd-14.12 on a Debian 7.6 server, single node.
I've installed ejabberd with the interactive .run package.
I've started ejabberd (logged as root) with:
# /opt/ejabberd-14.12/bin/ejabberdctl start
The log tells that:
ejabberd_app:start:69 ejabberd 14.12 is started in the node ejabberd#localhost
Then, I can see the erlang cookie in my /root directory:
-r-------- 1 root root 20 ago 9 00:00 .erlang.cookie
If I try to create a user in command line mode, everything is ok:
# /opt/ejabberd-14.12/bin/ejabberdctl register foo myhost.lchat.local foopwd
And the user is created (I can see it on the web gui).
If the same command is embedded inside a .sh script (with the full command path), and launched by a daemon (owned by root), it generates an error in the ejabberd error.log:
[error] <0.435.0> ** Connection attempt from disallowed node 'ctl-ejabberd#localhost' **
I believe that it's a security issue, in order to avoid commands from unauthorized users.
What can I do to have the command accepted also from script ?

The error means the environment is not using the same cookie for connecting from the command Erlang node to the primary ejabberd node.
I guess the script run as another user (despite being own by root). The user that will run the script need to have the same .erlang.cookie file in its home directory.
Note: you should not run a server as root, ejabberd or any other type of network server. This is against security best practices.

Related

Jenkins connection closed after authentication succesful

Trying to configure linux node to my windows master Jenkins, throwing below error after authentication is succesful
SSH connection reports a garbage before a command execution.
Check your .bashrc, .profile, and so on to make sure it is quiet.
The received junk text is as follows:
/usr/bin/id: cannot find name for group ID ******
null
Looking at the error it looks SSH is failing because the group doesn't exist in the destination Linux node.
Verify that the groups of the SSH user on the Jenkins Windows master using which SSH is happening to Linux node
Ensure that the SSH user exists on the Linux node and it is a member of the groups that appeared in Windows.
If there are any missing groups in Linux node as compare to Windows Master then you need to create them.
Do let me know the result for next step of troubleshooting.

Errors setting up Ruby development environment: nodejs not found, could not connect to server

I'm a new developer-in-training attempting to set up my Ruby development environment on a Windows machine using Ubuntu. I'm following the instructions here:
https://gorails.com/setup/windows/10
I've made it to the last few steps of the process, which is where I'm started to get errors:
# Navigate to the C: drive on Windows. Do this every time you open the Linux console.
cd /mnt/c
# Create a code directory at C:\code for your Rails apps to live (You only need to do this once)
mkdir -p code
#### If you want to use Postgres
# Note that this will expect a postgres user with the same username
# as your app, you may need to edit config/database.yml to match the
# user you created earlier
rails new myapp -d postgresql
#### or if you want to use SQLite (not recommended)
# rails new myapp
#### Or if you want to use MySQL
# rails new myapp -d mysql
# Then, move into the application directory
cd myapp
# If you setup MySQL or Postgres with a username/password, modify the
# config/database.yml file to contain the username/password that you specified
# Create the database
rake db:create
rails server
On the step to set up Postgres:
rails new myapp -d postgresql
I receive this error about setting up nodejs:
/home/event/.rbenv/versions/2.6.5/lib/ruby/gems/2.6.0/gems/railties-6.0.1/lib/rails/app_loader.rb:53: warning: Insecure world writable dir /home/event/.rbenv/versions/2.6.5 in PATH, mode 040777
sh: 1: node: not found
sh: 1: nodejs: not found
Node.js not installed. Please download and install Node.js https://nodejs.org/en/download/
Even after I go to the URL provided and install NodeJS, that error still shows up when I attempt to repeat the process. Is this just a matter of it not existing in the correct path and I need to relocate it?
Also, I've attempted to proceed with the other steps despite that error. When I enter this command, the second last one in the article referenced above:
rake db:create
I receive this error:
could not connect to server: No such file or directory
Is the server running locally and accepting
connections on Unix domain socket "/var/run/postgresql/.s.PGSQL.5432"?
Couldn't create 'myapp_development' database. Please check your configuration.
rake aborted!
ActiveRecord::NoDatabaseError: could not connect to server: No such file or directory
Is the server running locally and accepting
connections on Unix domain socket "/var/run/postgresql/.s.PGSQL.5432"?
Caused by:
PG::ConnectionBad: could not connect to server: No such file or directory
Is the server running locally and accepting
connections on Unix domain socket "/var/run/postgresql/.s.PGSQL.5432"?
Tasks: TOP => db:create
(See full trace by running task with --trace)
I've searched around about this with little success, and attempted to decipher what the error messages mean; but at my current level of knowledge it just seems beyond me. Appreciate any insight anyone has to share on this!

Switching users from root in a Rundeck job (Cannot create session: Already running in a session)

I am trying to test a scheduled job on Rundeck by running specific commands on a 16.04 Ubuntu box, and one of those will be to switch the user from root to nodeworker.
the sequence is:
Accessing the right directory as root
cd /var/www/... (Runs with no issues)
Switching to user nodeworker, no password needed
su nodeworker
running the command git pull origin master
I tried running it with sudo su - nodeworker -c "command here", same issue, that did not work either. I ended up tailing the auth.log to find that su is giving an error for starting a session when the root session is existing, and I have no idea of a fix for it:
pam_systemd(su:session): Cannot create session: Already running in a session
And I found this issue reported for Debian, https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=825949
same here with rundeck user. it's used to work but not anymore. Workaround solution is creating the user (system type) manually before install the rundeck

How can I let jprofiler find the PID of running tomcat server?

I extracted the jprofiler tar.gz on a remote linux server. After trying the bin/jpenable command I got:
'No unprofiled JVMs found.'
So I went looking for the PID of the running tomcat server and I think I found it in the var/run directory. A file called tomcat7.pid
So I went back to the source folder of jprofiler and tried: jpenable --pid=[the id that was in the pid file I mentioned earlier]
as specified on page 277 of the following document: http://resources.ej-technologies.com/jprofiler/help/doc/help.pdf and got:
No JVM with PID [the pid] found that is running as the same user.
So since the user I'm logged in as is ubuntu I tried to log in with user tomcat7 but even after giving up the correct password (which we changed with sudo) I remain logged in as ubuntu (as confirmed by whoami command) and the problem above persists.
How do I get this jprofiler to find the jvm I need it to??
Fixed.
We run tomcat as a service so we needed to add agentpath on startup of the jvm. Added the following to /usr/share/tomcat7/bin/setenv.sh :
-agentpath:/opt/jprofiler/jprofiler7/bin/linux-x64/libjprofilerti.so=port={port we want}
Then enabled that port on aws.

run shiny server as non-root

I installed shiny server in a virtual machine (ubuntu server 14.04.4 in VirtualBox)
shiny-server --version
Shiny Server v1.4.2.786
Node.js v0.10.40
All in all the server runs nicely and starts apps as intended.
The only thing I'm missing and failing to achieve is that shiny server is running as an unprivileged user. I even completely set up a new VM and shiny server to make sure no trial config changes still take effect.
I changed my config to not contain any folders one needs root permissions for:
$ cat /etc/shiny-server/shiny-server.conf
# Instruct Shiny Server to run applications as the user "shiny"
run_as shiny;
# Define a server that listens on port 3838
server {
listen 3838;
# Define a location at the base URL
location / {
# Host the directory of Shiny Apps stored in this directory
# site_dir /srv/shiny-server;
site_dir /home/shiny/shiny_sitedir/apps;
# Log all Shiny output to files in this directory
# log_dir /var/log/shiny-server;
log_dir /home/shiny/shiny_sitedir/logs;
# When a user visits the base URL rather than a particular application,
# an index of the applications available in this directory will be shown.
directory_index on;
}
}
# privileges of shiny user
uid=1000(shiny) gid=1000(shiny) groups=1000(shiny),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),110(lpadmin),111(sambashare)
# owner of /etc/shiny-server
-rw-r--r-- 1 root root shiny-server.conf
# trying to start shiny server as user shiny without sudo
$ start shiny-server
start: Rejected send message, 1 matched rules; type="method_call", sender=":1.6" (uid=1000 pid=1134 comm="start shiny-server ") interface="com.ubuntu.Upstart0_6.Job" member="Start" error name="(unset)" requested_reply="0" destination="com.ubuntu.Upstart" (uid=0 pid=1 comm="/sbin/init ")
The server log tells me the same I see from the htop output that shiny server runs as root. (A side note: shiny server still uses /var/log/shiny-server.log instead of /home/shiny/shiny_sitedir/logs, which annoys me as well)
[...] [INFO] shiny-server - Shiny Server v1.4.2.786 (Node.js v0.10.40)
[...] [INFO] shiny-server - Using pidfile /var/run/shiny-server.pid
[...] [INFO] shiny-server - Using config file "/etc/shiny-server/shiny-server.conf"
[...] [WARN] shiny-server - Running as root unnecessarily is a security risk! You could be running more securely as non-root.
[...] [INFO] shiny-server - Starting listener on 0.0.0.0:3838
The shiny server documentation http://docs.rstudio.com/shiny-server/#running-shiny-server-with-root-privileges ships out a list of requirements to be fulfilled for non-root usage. Actually it defines states in which the shiny server needs to run as root:
If user_apps or user_dirs is enabled for any location. In order to host applications as various users, Shiny Server must have root privileges.
check. My shiny-server.conf neither uses user_apps nor user_dirs
If your configuration uses run_as to spawn applications as multiple different users.
check. run_as defines shiny as the only user
If you're running any server on a privileged port (a port in the range of 1-1024).
check. shiny server listens on port 3838
Although I think the installation fulfils the requirements shiny server still runs as root.
How do I force shiny server to run as shiny user or even an user not part of the sudoers group?
Does the shiny-server.conf need to locate anywhere else?
How would I make shiny-server aware of this new location then?
Do I need to change anything in /opt/shiny-server/config/ or any permissions on /etc/shiny-server/?
Edit after a comment by #warmoverflow I moved /etc/init/shiny-server.conf to ~/.init. Now, shiny server does not start automatically at boot up. But neither does start shiny-server succeed, because upstart is not aware of the ~/.init folder. From some forum posts it seems that dbus needs start, which it usually does by starting a graphical environment. As I'm running Ubuntu server this doesn't happen. Creating the two files mentioned in the upstart manual http://upstart.ubuntu.com/cookbook/#session-init doesn't help either, because the jobs fail to start.
Does anybody have a hint how to proceed or where I could find some information?
If your only goal is to ensure that shiny-server is running as non-root, and you are okay with start shiny-server using sudo (even if it's started with sudo, it can be running as a non-root user).
Edit /etc/init/shiny-server.conf, and
Add the following two lines at the beginning
setuid shiny
setgid shiny
Change the 3rd last line to
exec shiny-server --pidfile=/home/shiny/shiny-server.pid >> /home/shiny/shiny-server.log 2>&1
Note that Shiny has two default log file locations.
/var/log/shiny-server.log contains the logs for the server itself, and is defined in /etc/init/shiny-server.conf
/var/log/shiny-server/ is the folder that contains log files for your applications, and is defined in /etc/shiny-server/shiny-server.conf.
Once you made the changes above and also changed the run_as user, start shiny-server again with sudo start shiny-server, and you'll notice that shiny-server is in fact running as the non-root user, and the warning in the log file will be gone too.
I'm running Shiny Server v1.4.4.801 (Node.js v0.10.46). On this version shiny initialization is done via systemd.
To run shiny as a non-root one have to edit /etc/systemd/system/shiny-server.service file.
Add setuid shiny and setgid shiny commands to ExecStart like this:
ExecStart=/bin/bash -c 'setuid shiny; setgid shiny; /opt/shiny-server/bin/shiny-server --pidfile=/var/run/shiny-server.pid >> /var/log/shiny-server.log 2>&1'
Now, one can start shiny server by typing systemctl start shiny-server.service.
Type systemctl enable shiny-server.service to autostart shiny-server on reboot.
Here's another way to do this with systemd, if you're willing to run shiny server on a higher port number (> 5000).
Run systemctl edit shiny-server.service and add:
[Service]
User=shiny
Group=shiny
UMask=027
Then systemctl stop shiny-server.service and edit /etc/shiny-server/shiny-server.conf and change it to listen 8383;.
If you haven't already, do:
chown -R shiny:shiny /var/log/shiny-server* /etc/shiny-server
chmod -R u+rwX,g+rX,o-rwx /var/log/shiny-server* /etc/shiny-server
Start the service and it should be running as the service account user/group.

Resources