lockout plugin problems

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

lockout plugin problems

Alex-325
Hi,
I'm using a squirrelmail 1.4.23SVN snapshot and having trouble with
the lockout plugin. I had it configured on a test system many months
ago, and I thought it was working properly, but now it's not.

There are no php errors in the logs, and my configtest.php looks okay.
Squirrelmail otherwise works fine. I'm not sure how to further debug
this, and really hoped someone could help. I've configured
locked_out.php with my own text, and it's never printed. I've also
installed and enabled the compatibility plugin. The
lockout_plugin_login_failure_information.pref has old entries in it
where it once worked properly. squirrelmail_access_log has the failed
login entries, but there are no new entries in the
lockout_plugin_login_failure_information.pref file after trying and
failing to login $max_login_attempts times.

I've included my config.php below (using example.com)

$use_lockout_rules = 1;
$reverseLockout = '';
$at = '@';
$obey_x_forwarded_headers = 0;
$max_login_attempts = '6:10:30';
$max_login_attempts_per_IP = '';
$activate_CAPTCHA_after_failed_attempts = '';
$lockout_notification_addresses = '[hidden email]';
$log_violated_lockout_rules = 1;
$log_violated_max_user_logins = 1;
$log_violated_max_IP_logins = 0;
$log_CAPTCHA_enabled = 0;
$lockout_useSendmail = NULL;
$lockout_smtpServerAddress = NULL;
$lockout_smtpPort = NULL;
$lockout_sendmail_path = NULL;
$lockout_sendmail_args = NULL;
$lockout_pop_before_smtp = NULL;
$lockout_encode_header_key = NULL;
$lockout_smtp_auth_mech = NULL;
$lockout_smtp_sitewide_user = NULL;
$lockout_smtp_sitewide_pass = NULL;

Thanks,
Alex

------------------------------------------------------------------------------
-----
squirrelmail-plugins mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [hidden email]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.plugins
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-plugins
Reply | Threaded
Open this post in threaded view
|

Re: lockout plugin problems

Paul Lesniewski
On 11/3/14, Alex <[hidden email]> wrote:
> Hi,
> I'm using a squirrelmail 1.4.23SVN snapshot and having trouble with
> the lockout plugin. I had it configured on a test system many months
> ago, and I thought it was working properly, but now it's not.

What did you change?  Did you diff the two environments?  It's all
about specifics.

> There are no php errors in the logs, and my configtest.php looks okay.

Please show your PHP error level settings and configtest output.

> Squirrelmail otherwise works fine. I'm not sure how to further debug
> this, and really hoped someone could help. I've configured
> locked_out.php with my own text, and it's never printed. I've also
> installed and enabled the compatibility plugin. The
> lockout_plugin_login_failure_information.pref has old entries in it
> where it once worked properly.

Then the best starting point is to try to undo recent changes until it
works, then put each change back in place one at a time until things
break.

Otherwise, try installing a parallel SM install and only activate the
lockout plugin - nothing else.  Then add in your other plugins and
customizations one at a time.

> squirrelmail_access_log has the failed
> login entries, but there are no new entries in the
> lockout_plugin_login_failure_information.pref file after trying and
> failing to login $max_login_attempts times.

Make sure other pref files (normal ones for users) are being written.
Make sure you have error verbosity turned all the way up in php.ini.
Put some debug output in the plugin where it tries to count login
failures.

> I've included my config.php below (using example.com)
>
> $use_lockout_rules = 1;
> $reverseLockout = '';
> $at = '@';
> $obey_x_forwarded_headers = 0;
> $max_login_attempts = '6:10:30';
> $max_login_attempts_per_IP = '';
> $activate_CAPTCHA_after_failed_attempts = '';
> $lockout_notification_addresses = '[hidden email]';
> $log_violated_lockout_rules = 1;
> $log_violated_max_user_logins = 1;
> $log_violated_max_IP_logins = 0;
> $log_CAPTCHA_enabled = 0;
> $lockout_useSendmail = NULL;
> $lockout_smtpServerAddress = NULL;
> $lockout_smtpPort = NULL;
> $lockout_sendmail_path = NULL;
> $lockout_sendmail_args = NULL;
> $lockout_pop_before_smtp = NULL;
> $lockout_encode_header_key = NULL;
> $lockout_smtp_auth_mech = NULL;
> $lockout_smtp_sitewide_user = NULL;
> $lockout_smtp_sitewide_pass = NULL;

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
-----
squirrelmail-plugins mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [hidden email]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.plugins
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-plugins
Reply | Threaded
Open this post in threaded view
|

Re: lockout plugin problems

Alex-325
Hi,

>> I'm using a squirrelmail 1.4.23SVN snapshot and having trouble with
>> the lockout plugin. I had it configured on a test system many months
>> ago, and I thought it was working properly, but now it's not.
>
> What did you change?  Did you diff the two environments?  It's all
> about specifics.

I ended up replacing functions.php for the lockout plugin, and that
fixed it. I thought for sure at one point I had removed and reinstalled
the entire plugin at one point, so can't figure out what changed.

So it's now working, and perhaps this is more of a general php question,
but...

>> There are no php errors in the logs, and my configtest.php looks okay.
>
> Please show your PHP error level settings and configtest output.

I enabled practically every php.ini error/debug setting I could find,
but there's no error output. Where is this information normally
displayed? Among the variables I enabled are:

log_errors = On
log_errors_max_len = 1024
html_errors = On
error_log = /var/log/php-scripts.log
error_reporting = E_ALL
display_errors = On
display_startup_errors = On

This would really help next time I had an error and needed to troubleshoot.

I also tried to add a few print statements in the code, but there were
just too many possible places that it would make it very difficult for me.

Thanks,
Alex

------------------------------------------------------------------------------
-----
squirrelmail-plugins mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [hidden email]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.plugins
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-plugins
Reply | Threaded
Open this post in threaded view
|

Re: lockout plugin problems

Paul Lesniewski
On 11/9/14, Alex Regan <[hidden email]> wrote:

> Hi,
>
>>> I'm using a squirrelmail 1.4.23SVN snapshot and having trouble with
>>> the lockout plugin. I had it configured on a test system many months
>>> ago, and I thought it was working properly, but now it's not.
>>
>> What did you change?  Did you diff the two environments?  It's all
>> about specifics.
>
> I ended up replacing functions.php for the lockout plugin, and that
> fixed it. I thought for sure at one point I had removed and reinstalled
> the entire plugin at one point, so can't figure out what changed.

There should never be a reason to edit such files.  Most important
thing is not to patch files unless you document it clearly and keep
the patch on hand.  To prevent that from happening accidentally, set
permissions on the files that don't allow writing.

> So it's now working, and perhaps this is more of a general php question,
> but...
>
>>> There are no php errors in the logs, and my configtest.php looks okay.
>>
>> Please show your PHP error level settings and configtest output.
>
> I enabled practically every php.ini error/debug setting I could find,
> but there's no error output. Where is this information normally
> displayed? Among the variables I enabled are:
>
> log_errors = On
> log_errors_max_len = 1024
> html_errors = On
> error_log = /var/log/php-scripts.log
> error_reporting = E_ALL
> display_errors = On
> display_startup_errors = On

Test creating an intentional notice/error and check that log file.  If
nothing is going to that log file, check for .htaccess files that
override the log file location.

--
Paul Lesniewski
SquirrelMail Team
Please support Open Source Software by donating to SquirrelMail!
http://squirrelmail.org/donate_paul_lesniewski.php

------------------------------------------------------------------------------
-----
squirrelmail-plugins mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [hidden email]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.plugins
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-plugins