Re: [rt-users] Query for Service downtime

2009-05-04 Thread jul
Hello
Uday Dey a écrit :
 Hi,


   I am trying to generate a report for fetching the instance name,
 the related services and what is the downtime for each one of them.

   I have figured out something like this:

   select t.id, t.queue, t.owner, substr(t.subject,1,20) subject,
 t.timeworked, t.status, t.timeleft, t.told, t.started, t.resolved,
 t.lastupdatedby, t.creator, t.created from tickets t, queues q where
 t.status='resolved' and t.subject like upper('%down%') and
 q.name='client_name' and q.id=t.queue;

 But it's not solving my purpose fully. I am getting the date on
 which the services went down and the date on which it got resolved. All
 in all I am not getting the respective Downtime for each of the
 services. I had a plan of fetching the difference in time of when the
 tickets were opened and when the tickets were resolved. That would give
 me the downtime but I have no idea how to implement that. Any help on
 this regard will greatly appreciated.


1) add a custom field down-duration
1') find a sample of scrips playing with custom field
2) on resolve compute time duration custom field.
If needed include this perl module (isn't it already available in scrips
environment ?)
http://search.cpan.org/~drolsky/DateTime-0.47/lib/DateTime.pm#Datetime_Subtraction
3) query on the customfield, and you'll even be able to graph it.

Alternative solution:
Use nagios, and make him mail to RT with a link to the service status when
down.

Generaly I am quite uneasy with ticketing solutions used for monitoring
downtime services, and CRM used for tickting... I believe in the almighty
dogma that one application is best used for its initial purpose except
when dealing with physicists.



This should take between an half and a full day depending of your
knwoledge in perl and murphy's law.

-- 
Julien Tayon // digital craftsman // making things simpler (when possible)

The wages of sin are death; but after they're done taking out taxes,
it's just a tired feeling:


___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] How to add Company logo

2009-05-04 Thread jul
Quick and dirty way :
replace bp_logo.gif with your logo (even if is a png) (look in the css for
its  emplacement. Browser actually don't really care about the extension.

Less dirty modify the css.

RT has a semi rigid fixed layout, so I dearly advise to choose a logo of
the size of RT logo. Unless you want to hire an html/css pro for days
trying to desesperatly makes «things right» while offsets propagate in
your layout.

I changed the logo, I kept the (c) notice for 2 reasons :
1) I promote RT as an efficient solution, and I am proud of promoting
efficiency (egotic reason)
2) podlach : BestPractical should be granted the merit of the solution
3) there could be legal reason, but I don't care, it is free software and
it is comes with the territory to recognize others works :)

So choose the (c)ool attitude, it won't lessen your merits :)

Have fun

___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


[rt-users] requestors group access

2009-05-04 Thread Vaclav Vobornik
Good morning,
I have a specific question from one of our customers. Let's say, there 
is a Sybase team we support: Peter, John, and Maria (unprivileged users).
When Peter creates a ticket, only Peter can see it after he logs in to 
the RT. The same when John creates a ticket - only he sees it.
I'd like they can see all the tickets one of them is a requestor - but 
only within their Sybase group. E.g. When Maria creates a ticket, also 
Peter and John could see a status in the same way like Maria.

Is there any solution already in place, please?

Many thanks

-- 
Vaclav Vobornik
ZIT 12.2.3 System Design  Development
C O M M E R Z B A N K A G
Myslikova 31
CZ-11000 Prague

___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


[rt-users] Why are extracted custom fields not available in Autoreply template

2009-05-04 Thread Todd Chapman
All,

I have a scrip that runs first and extracts custom fields on ticket
created. The Autoreply scrip runs second, but if I use
$Ticket-FirstCustomFieldValue('foo') in the Autoreply template I
don't get the value that was extracted in the first scrip. What am I
missing? Do I need to get the first scrip to commit somehow before the
second runs?

Thanks!

-Todd
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] requestors group access

2009-05-04 Thread Ken Crocker

Vaclav,

   Create a User-defined group called Sysbase-Users. Then go to 
Configuration-Queue-(select Queue Sybase or whatever)-Group Rights 
and grant the following privileges to group Sysbase-Users:


   * CreateTicket
   * SeeQueue
   * ShowTicket
   * ShowOutgoingEmail
   * ShowTicketComments * Your technical support team may NOT want
 them to have this right.

   Make sure the Users for Sysbase tickets are in that User group 
and there you have it. All members of that group will be able to create 
and look at ALL tickets in the Queue you select. Oh, also be sure that 
those users are Privileged users, otherwise you will not be able to 
add them to a group that has privileges. Hope this helps.



Kenn
LBNL

On 5/4/2009 1:51 AM, Vaclav Vobornik wrote:

Good morning,
I have a specific question from one of our customers. Let's say, there 
is a Sybase team we support: Peter, John, and Maria (unprivileged users).
When Peter creates a ticket, only Peter can see it after he logs in to 
the RT. The same when John creates a ticket - only he sees it.
I'd like they can see all the tickets one of them is a requestor - but 
only within their Sybase group. E.g. When Maria creates a ticket, also 
Peter and John could see a status in the same way like Maria.


Is there any solution already in place, please?

Many thanks

  
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com

[rt-users] full name in recipient address?

2009-05-04 Thread Razvan Cosma
 Hello,
RT sends emails only to u...@domain, while almost everyone uses first last
u...@domain, and replying with the full name would look a lot nicer. Is
this possible using the current template variables?
Also, auto-completion starting from name not just e-mail in the one-time
cc: field would be very good to have, is it interesting enough to submit a
bug report for it?
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com

Re: [rt-users] Why are extracted custom fields not available in Autoreply template

2009-05-04 Thread Ken Crocker
Todd,


I've run into that same problem. For some reason, when RT executes 
transactions, the RT base transactions seemed to override any scrip 
based changes that had a stage of TransactionCreate. When I turned on 
TransactionBatch in my SiteConfig and set the Stage for the scrips 
to TransactionBatch it resolved my problem. Hope this helps.


Kenn
LBNL

On 5/4/2009 9:14 AM, Todd Chapman wrote:
 All,

 I have a scrip that runs first and extracts custom fields on ticket
 created. The Autoreply scrip runs second, but if I use
 $Ticket-FirstCustomFieldValue('foo') in the Autoreply template I
 don't get the value that was extracted in the first scrip. What am I
 missing? Do I need to get the first scrip to commit somehow before the
 second runs?

 Thanks!

 -Todd
 ___
 http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

 Community help: http://wiki.bestpractical.com
 Commercial support: sa...@bestpractical.com


 Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
 Buy a copy at http://rtbook.bestpractical.com

   

___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


[rt-users] Canned replies are missing after the upgrade

2009-05-04 Thread Asif Iqbal
Hi

I just realized the canned replies are missing since the upgrade from
rt-3.4.5 to rt-3.8.2. I have the old instance backed up. How do I revive
them?

Thanks

-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com

Re: [rt-users] Why are extracted custom fields not available in Autoreply template

2009-05-04 Thread Ruslan Zakirov
Message from the template is generated during Prepare step.

On Mon, May 4, 2009 at 8:14 PM, Todd Chapman t...@chaka.net wrote:
 All,

 I have a scrip that runs first and extracts custom fields on ticket
 created. The Autoreply scrip runs second, but if I use
 $Ticket-FirstCustomFieldValue('foo') in the Autoreply template I
 don't get the value that was extracted in the first scrip. What am I
 missing? Do I need to get the first scrip to commit somehow before the
 second runs?

 Thanks!

 -Todd
 ___
 http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

 Community help: http://wiki.bestpractical.com
 Commercial support: sa...@bestpractical.com


 Discover RT's hidden secrets with RT Essentials from O'Reilly Media.
 Buy a copy at http://rtbook.bestpractical.com




-- 
Best regards, Ruslan.
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] Why are extracted custom fields not available in Autoreply template

2009-05-04 Thread Todd Chapman
Thanks Ruslan. Is there a reason for that?

On Mon, May 4, 2009 at 1:06 PM, Ruslan Zakirov ruslan.zaki...@gmail.com wrote:
 Message from the template is generated during Prepare step.

 On Mon, May 4, 2009 at 8:14 PM, Todd Chapman t...@chaka.net wrote:
 All,

 I have a scrip that runs first and extracts custom fields on ticket
 created. The Autoreply scrip runs second, but if I use
 $Ticket-FirstCustomFieldValue('foo') in the Autoreply template I
 don't get the value that was extracted in the first scrip. What am I
 missing? Do I need to get the first scrip to commit somehow before the
 second runs?

 Thanks!

 -Todd
 ___
 http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

 Community help: http://wiki.bestpractical.com
 Commercial support: sa...@bestpractical.com


 Discover RT's hidden secrets with RT Essentials from O'Reilly Media.
 Buy a copy at http://rtbook.bestpractical.com




 --
 Best regards, Ruslan.

___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] Canned replies are missing after the upgrade

2009-05-04 Thread Asif Iqbal
On Mon, May 4, 2009 at 12:57 PM, Asif Iqbal vad...@gmail.com wrote:

 Hi

 I just realized the canned replies are missing since the upgrade from
 rt-3.4.5 to rt-3.8.2. I have the old instance backed up. How do I revive
 them?


Found it under local/html dir. Thanks



 Thanks

 --
 Asif Iqbal
 PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
 A: Because it messes up the order in which people normally read text.
 Q: Why is top-posting such a bad thing?





-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com

Re: [rt-users] full name in recipient address?

2009-05-04 Thread Ruslan Zakirov
Careful patch for RT is welcome. There is already extension for
automcompletion of emails, most probably it's better to extend it with
more options.

On Mon, May 4, 2009 at 8:31 PM, Razvan Cosma razvan.co...@gmail.com wrote:
  Hello,
 RT sends emails only to u...@domain, while almost everyone uses first last
 u...@domain, and replying with the full name would look a lot nicer. Is
 this possible using the current template variables?
 Also, auto-completion starting from name not just e-mail in the one-time
 cc: field would be very good to have, is it interesting enough to submit a
 bug report for it?


 ___
 http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

 Community help: http://wiki.bestpractical.com
 Commercial support: sa...@bestpractical.com


 Discover RT's hidden secrets with RT Essentials from O'Reilly Media.
 Buy a copy at http://rtbook.bestpractical.com




-- 
Best regards, Ruslan.
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com

Re: [rt-users] Why are extracted custom fields not available in Autoreply template

2009-05-04 Thread Ruslan Zakirov
I think it's done to generate list of recipients.

On Mon, May 4, 2009 at 9:10 PM, Todd Chapman t...@chaka.net wrote:
 Thanks Ruslan. Is there a reason for that?

 On Mon, May 4, 2009 at 1:06 PM, Ruslan Zakirov ruslan.zaki...@gmail.com 
 wrote:
 Message from the template is generated during Prepare step.

 On Mon, May 4, 2009 at 8:14 PM, Todd Chapman t...@chaka.net wrote:
 All,

 I have a scrip that runs first and extracts custom fields on ticket
 created. The Autoreply scrip runs second, but if I use
 $Ticket-FirstCustomFieldValue('foo') in the Autoreply template I
 don't get the value that was extracted in the first scrip. What am I
 missing? Do I need to get the first scrip to commit somehow before the
 second runs?

 Thanks!

 -Todd
 ___
 http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

 Community help: http://wiki.bestpractical.com
 Commercial support: sa...@bestpractical.com


 Discover RT's hidden secrets with RT Essentials from O'Reilly Media.
 Buy a copy at http://rtbook.bestpractical.com




 --
 Best regards, Ruslan.





-- 
Best regards, Ruslan.
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] Canned replies are missing after the upgrade

2009-05-04 Thread Ruslan Zakirov
I think you're talking about RTFM and I believe you should upgrade it too.

On Mon, May 4, 2009 at 8:57 PM, Asif Iqbal vad...@gmail.com wrote:
 Hi

 I just realized the canned replies are missing since the upgrade from
 rt-3.4.5 to rt-3.8.2. I have the old instance backed up. How do I revive
 them?

 Thanks

 --
 Asif Iqbal
 PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
 A: Because it messes up the order in which people normally read text.
 Q: Why is top-posting such a bad thing?



 ___
 http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

 Community help: http://wiki.bestpractical.com
 Commercial support: sa...@bestpractical.com


 Discover RT's hidden secrets with RT Essentials from O'Reilly Media.
 Buy a copy at http://rtbook.bestpractical.com




-- 
Best regards, Ruslan.
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] how to run new rt cli in cron

2009-05-04 Thread Tom Lahti
 How do I by pass the password prompt? Is there another user I can use 
 instead where I don't have to feed a password thru cronjob?

You do not need an expect script or to feed the password to the CLI's 
STDIN at all.  All you need is to arrange for the environment variables 
RTUSER, RTSERVER and RTPASSWD to be set in your environment before 
calling the CLI, like so:

#!/bin/sh

export RTUSER=someone
export RTPASSWD=Something
export RTSERVER=https://rt.server.com/

/opt/rt3/bin/rt show ticket/123

--

If you are parsing the output of the CLI, you're better off using the 
REST interface instead.  The CLI's output changes from version to 
version, which will throw off your parse.  The REST output won't change.

See http://wiki.bestpractical.com/view/REST

--
Tom Lahti



___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] requestors group access

2009-05-04 Thread Ruslan Zakirov
I usually suggest to use Cc for that. On create you add group X to the
Cc list of the ticket. In RT4 I hope you'll be able to have role
co-workers and it would be clear. In RT3 you have to sacrifice Cc.

You can replace requestor with his group.

All this can be implemented with set of scrips.

To define user's main group I suggest you to use Organization field
each user has, for example Organization is X then group is X
organization. Something like that.

Hope somebody will finally do it and publish as extension or I'll have
to write it myself.

On Mon, May 4, 2009 at 12:51 PM, Vaclav Vobornik
vaclav.vobor...@commerzbank.com wrote:
 Good morning,
 I have a specific question from one of our customers. Let's say, there
 is a Sybase team we support: Peter, John, and Maria (unprivileged users).
 When Peter creates a ticket, only Peter can see it after he logs in to
 the RT. The same when John creates a ticket - only he sees it.
 I'd like they can see all the tickets one of them is a requestor - but
 only within their Sybase group. E.g. When Maria creates a ticket, also
 Peter and John could see a status in the same way like Maria.

 Is there any solution already in place, please?

 Many thanks

 --
 Vaclav Vobornik
 ZIT 12.2.3 System Design  Development
 C O M M E R Z B A N K A G
 Myslikova 31
 CZ-11000 Prague

 ___
 http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

 Community help: http://wiki.bestpractical.com
 Commercial support: sa...@bestpractical.com


 Discover RT's hidden secrets with RT Essentials from O'Reilly Media.
 Buy a copy at http://rtbook.bestpractical.com




-- 
Best regards, Ruslan.
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] Query for Service downtime

2009-05-04 Thread Tom Lahti
 services. I had a plan of fetching the difference in time of when the 
 tickets were opened and when the tickets were resolved. That would give 
 me the downtime but I have no idea how to implement that. Any help on 
 this regard will greatly appreciated.

That's not really downtime, I wouldn't think, unless the tickets are 
both opened and resolved automatically.  Are they?

If either is done by a human, then its not system downtime.  It's time 
to whenever-the-human-felt-like-doing-RT-stuff.

--
Tom Lahti
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


[rt-users] Template formating is broken

2009-05-04 Thread Asif Iqbal
All my templates from RT 3.4.5 looks broken with RT 3.8.2

For example a template like this



Please send a blank email to rtrlist-subscr...@example.net to join this
mailing
list. This will notify the list owner to approve/disapprove your
subscription.

Similarly, there's rtrlist-unsubscr...@example.net.

You'll receive a follow-up email when sending such request. Simply
follow the instructions.



Shows exactly like this on rt 3.4.5.

But on rt 3.8.2 it shows like this

Template RTRlist Sub/Unsub: Content changed from ' Please send a blank
email to rtrlist-subscr...@example.net to join this mailing list. This
will notify the list owner to approve/disapprove your subscription.
Similarly, there's rtrlist-unsubscr...@example.net. You'll receive a
follow-up email when sending such request. Simply follow the instructions'
to  Please send a blank email to rtrlist-subscr...@example.net to join
this mailing list. This will notify the list owner to approve/disapprove
your subscription. Similarly, there's rtrlist-unsubscr...@example.net.
You'll receive a follow-up email when sending such request. Simply follow
the instructions.


As you can see, not only the format is corrupted but the same content is
showing up twice. Once with single quotes and once within double quotes


-- 
Asif Iqbal
PGP Key: 0xE62693C5 KeyServer: pgp.mit.edu
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com

[rt-users] stop strangers from emailing other people's tickets

2009-05-04 Thread allen+rtlist
Running into a problem where a bad person (unprivileged and unknown
by RT) can send an email to the RT system with someone else's ticket
ID in the subject. RT will recognize the (guessed) ticket ID, and
permanently append the message (which may contain spam or nastiness)
to somebody's ticket, even though the sender is not a valid party
listed on the ticket.

So some troublemaker can send 1 email with a random ticket ID, or
100,000 emails with all possible ticket ids and attack users' tickets.

We want to allow people to create tickets by email and we do want RT
users to be automatically created if they don't already exist. Is
there a way, though, to deny permission for unprivileged users to
reply to a ticket unless they are the Requestor or Cc?

I have set Group Rights this way:

   Everyone: CreateTicket, ModifySelf
   Unprivileged: none
   Privileged: [many, including ReplyToTicket]
   Requestor: ReplyToTicket, SeeQueue, ShowTicket

but the above permissions do not seem to make any difference in the
ability of strangers being able to pollute random tickets with
messages.

It also seems that if an attacker forged his From address to appear to
come from one of our privileged email addresses (like
supp...@yourdomain), a permissions-only approach would not really make
much of a barrier.

Should some combination of permissions be able to work, or does
preventing this abuse require a Scrip?

Do any of you with RT installations ever run into situations where
someone mail bombs or attacks your users' tickets by email in this
way?

What advice can you give?

Allen
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com


Re: [rt-users] stop strangers from emailing other people's tickets

2009-05-04 Thread Kenneth Marshall
On Mon, May 04, 2009 at 12:38:20PM -0700, allen+rtl...@crystalfontz.com wrote:
 Running into a problem where a bad person (unprivileged and unknown
 by RT) can send an email to the RT system with someone else's ticket
 ID in the subject. RT will recognize the (guessed) ticket ID, and
 permanently append the message (which may contain spam or nastiness)
 to somebody's ticket, even though the sender is not a valid party
 listed on the ticket.
 
 So some troublemaker can send 1 email with a random ticket ID, or
 100,000 emails with all possible ticket ids and attack users' tickets.
 
 We want to allow people to create tickets by email and we do want RT
 users to be automatically created if they don't already exist. Is
 there a way, though, to deny permission for unprivileged users to
 reply to a ticket unless they are the Requestor or Cc?
 
 I have set Group Rights this way:
 
Everyone: CreateTicket, ModifySelf
Unprivileged: none
Privileged: [many, including ReplyToTicket]
Requestor: ReplyToTicket, SeeQueue, ShowTicket
 
 but the above permissions do not seem to make any difference in the
 ability of strangers being able to pollute random tickets with
 messages.
 
 It also seems that if an attacker forged his From address to appear to
 come from one of our privileged email addresses (like
 supp...@yourdomain), a permissions-only approach would not really make
 much of a barrier.
 
 Should some combination of permissions be able to work, or does
 preventing this abuse require a Scrip?
 
 Do any of you with RT installations ever run into situations where
 someone mail bombs or attacks your users' tickets by email in this
 way?
 
 What advice can you give?
 
 Allen

Allen,

We run all of our RT E-mail into an anti-spam system with a
quarantine function, before we pass it to RT. The means that
attacks such as the above end up populating the quarantine,
but do not actually pollute the tickets. Emptying the quarantine
is a click away. It works quite well since it is not based on
the guessed header, but the content of the message.

Alternatively, if you could set up a secured channel for your
valid E-mail addresses to communicate with RT from your priviledged
servers, that might work as well.

Good luck,
Ken
 ___
 http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users
 
 Community help: http://wiki.bestpractical.com
 Commercial support: sa...@bestpractical.com
 
 
 Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
 Buy a copy at http://rtbook.bestpractical.com
 
___
http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users

Community help: http://wiki.bestpractical.com
Commercial support: sa...@bestpractical.com


Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
Buy a copy at http://rtbook.bestpractical.com