Your message dated Sun, 31 Jan 2010 14:14:47 +0000
with message-id <[email protected]>
and subject line Re: Bug#307633: request-tracker3.4: RT_SiteConfig.pm installs
with incorrect permissions
has caused the Debian Bug report #307633,
regarding request-tracker3.4: RT_SiteConfig.pm installs with incorrect
permissions
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
307633: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=307633
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: request-tracker3.4
Version: 3.4.1-2
Severity: normal
/etc/request-tracker3.4/RT_SiteConfig.pm installs as rw by root only
causing "Can't locate /etc/request-tracker3.4/RT_SiteConfig.pm in @INC"
error when trying to run rt-setup-database
-- Package-specific info:
Changed files:
etc/logcheck/ignore.d.server/request-tracker3_4
etc/logcheck/ignore.d.workstation/request-tracker3_4
etc/request-tracker3.4/RT_SiteConfig.pm
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.11.4
Locale: LANG=en_GB, LC_CTYPE=en_GB (charmap=ISO-8859-1)
Versions of packages request-tracker3.4 depends on:
ii apache2 2.0.53-5 next generation, scalable, extenda
ii apache2-mpm-prefork [apache2 2.0.53-5 traditional model for Apache2
ii exim [mail-transport-agent] 3.36-16 An MTA (Mail Transport Agent)
ii libapache-dbi-perl 0.94-2 Connect apache server to database
ii libapache-mod-perl 1.29.0.3-4 integration of perl with the Apach
ii libapache-request-perl 1.1-0.1 Generic Apache Request Library
ii libapache-session-perl 1.60-2 Perl modules for keeping persisten
ii libcache-cache-perl 1.04-1 Managed caches of persistent infor
ii libcache-simple-timedexpiry- 0.21-1 Perl module to cache and expire ke
ii libclass-returnvalue-perl 0.52-1 A return-value object that lets yo
ii libdbd-mysql-perl 2.9003-4 A Perl5 database interface to the
ii libdbd-pg-perl 1.32-2 a PostgreSQL interface for Perl 5
ii libdbi-perl 1.46-6 Perl5 database interface by Tim Bu
ii libdbix-searchbuilder-perl 1.26-1 Encapsulate SQL queries and rows i
ii libexception-class-perl 1.20-1 a module that allows you to declar
ii libfcgi-perl 0.67-1 FastCGI Perl module
ii libfreezethaw-perl 0.43-2 converting Perl structures to stri
ii libhtml-mason-perl 1:1.26-1 HTML::Mason Perl module
ii libhtml-parser-perl 3.45-2 A collection of modules that parse
ii libhtml-scrubber-perl 0.08-1 Perl extension for scrubbing/sanit
ii liblocale-maketext-fuzzy-per 0.02-1 Maketext from already interpolated
ii liblocale-maketext-lexicon-p 0.49-1 Lexicon-handling backends for "Loc
ii liblog-dispatch-perl 2.10-1 Dispatches messages to multiple Lo
ii libmailtools-perl 1.62-1 Manipulate email in perl programs
ii libmime-perl 5.417-1 Perl5 modules for MIME-compliant m
ii libmldbm-perl 2.01-1 Store multidimensional hash struct
ii libmodule-versions-report-pe 1.02-1 Report versions of all modules in
ii libparams-validate-perl 0.76-1 validate parameters to Perl method
ii libregexp-common-perl 2.120-1 Provide commonly requested regular
ii libterm-readkey-perl 2.21-1.3 A perl module for simple terminal
ii libtest-inline-perl 0.16-1 Embed tests and code examples in P
ii libtext-autoformat-perl 1.12-3 Perl module for automatic text wra
ii libtext-quoted-perl 1.8-1 Extract the structure of a quoted
ii libtext-template-perl 1.44-1.1 Text::Template perl module
ii libtext-wrapper-perl 1.000-2 Simple word wrapping routine
ii libtime-modules-perl 2003.1126-2 Various Perl modules for time/date
ii libtree-simple-perl 1.14-1 A simple tree object
ii libxml-rss-perl 1.05-1 Perl module for managing RSS (RDF
ii perl 5.8.4-8 Larry Wall's Practical Extraction
ii rt3.4-clients 3.4.1-2 Mail gateway and command-line inte
ii sysklogd [system-log-daemon] 1.4.1-16 System Logging Daemon
-- no debconf information
--- End Message ---
--- Begin Message ---
On Wed, May 04, 2005 at 12:50:37PM +0100, Katherine Spice wrote:
> Dear Stephen,
>
> >>/etc/request-tracker3.4/RT_SiteConfig.pm installs as rw by root only
> >>causing "Can't locate /etc/request-tracker3.4/RT_SiteConfig.pm in @INC"
> >>error when trying to run rt-setup-database
> >
> > This is not a bug, it was done this way by design. The file
> > RT_SiteConfig.pm contains, at least, the username and password for the
> > RT database so it is preferable that only root can read it. If you
> > want to make this file readable by other users (such as www-data for
> > running in cgi mode) then you have to do so yourself.
> >
> > It is done this way so that the sysadmin knows that the database
> > access parameters are readable by other users. For instance, if you
> > have php installed on the system anyone running a php script could
> > read the database access details if the file is readable by www-data.
> >
> > We give full instructions as to how to install and configure RT in the
> > files /usr/share/doc/request-tracker3.4/README.Debian and
> > /usr/share/doc/request-tracker3.4/INSTALL.Debian. These instructions
> > are all based on being run as root.
>
> I take your point about this being a design issue for security reasons,
> but I still think that having the script throw an error like the one
> above isn't a good thing to do. If one follows the instructions provided
> with the package, the database admin user at least will have knowledge
> of the password, and so I see no real reason to deny that user the
> ability to run the setup script - in fact I'd say that the package is
> more useful if setup doesn't require root access, as on a multi-user
> system, the root user can install the package, and then delegate all
> configuration to the DBA.
>
> Additionally, the INSTALL.Debian.gz makes no explicit mention of a
> necessity to run this as root (though it admittedly does infer it by
> using a # prompt on the command line). As the script can certainly be
> run successfully as a non-root user I'd suggest that a small wrapper or
> modification to the rt-setup-database script could provide a useful
> error message, rather than the less than helpful perl "Can't locate..."
> error. Or a debconf question at install asking how to set the
> permissions would make the issue more explicit.
Thanks for your further comments. In fact, in RT3.6 and above this has
been solved upstream. request-tracker3.4 is now very old, and is no
only available in oldstable, so I don't see the value of keeping this
bug open.
Thanks for the original report and sorry that it's lingered for so
long!
--
Dominic Hargreaves | http://www.larted.org.uk/~dom/
PGP key 5178E2A5 from the.earth.li (keyserver,web,email)
--- End Message ---
