Subject: [Pkg-cacti-maint] Bug#660853: cacti: External auth does not work behind a reverse proxy (HTTP_REMOTE_USER contains login, not REMOTE_USER)

From: Thierry Murgue <[email-masked]>
Date: Wed, 22 Feb 2012 12:53:01 +0100

Package: cacti
Version: 0.8.7g-1+squeeze1
Severity: normal

Please consider to check non only REMOTE_USER, PHP_AUTH_USER and REDIRECT_REMOTE_USER, but also HTTP_* variants.
Behind a reverse-proxy Debian GNU/Linux with apache2 squeeze (see configuration just below), authentication information are stored
in HTTP_REMOTE_USER, not in REMOTE_USER.

<Location /cacti>
 ... Some auth directives
 RewriteEngine    on
 RewriteCond  %{LA-U:REMOTE_USER}    (.+)
 RewriteRule . - [E=RU:%1]
 RequestHeader set REMOTE_USER %{RU}e
 
 ProxyPass http://#HOST#/cacti
 ProxyPassReverse http://#HOST#/cacti
</Location> 

Here is a patch, if you decide to insert these checks.

-- System Information:
Debian Release: 6.0.4
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-5-xen-686 (SMP w/1 CPU core)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages cacti depends on:
ii  apache2                2.2.16-6+squeeze6 Apache HTTP Server metapackage
ii  apache2-mpm-prefork [h 2.2.16-6+squeeze6 Apache HTTP Server - traditional n
ii  dbconfig-common        1.8.46+squeeze.0  common framework for packaging dat
ii  debconf [debconf-2.0]  1.5.36.1          Debian configuration management sy
ii  libapache2-mod-php5    5.3.3-7+squeeze8  server-side, HTML-embedded scripti
ii  libphp-adodb           5.10-1            The ADOdb database abstraction lay
ii  mysql-client-5.1 [virt 5.1.49-3          MySQL database client binaries
ii  php5                   5.3.3-7+squeeze8  server-side, HTML-embedded scripti
ii  php5-cli               5.3.3-7+squeeze8  command-line interpreter for the p
ii  php5-mysql             5.3.3-7+squeeze8  MySQL module for php5
ii  php5-snmp              5.3.3-7+squeeze8  SNMP module for php5
ii  rrdtool                1.4.3-1           time-series data storage and displ
ii  snmp                   5.4.3~dfsg-2      SNMP (Simple Network Management Pr
ii  ucf                    3.0025+nmu1       Update Configuration File: preserv

Versions of packages cacti recommends:
ii  iputils-ping                3:20100418-3 Tools to test the reachability of 
ii  logrotate                   3.7.8-6      Log rotation utility
ii  mysql-server                5.1.49-3     MySQL database server (metapackage
ii  mysql-server-5.1 [mysql-ser 5.1.49-3     MySQL database server binaries and

Versions of packages cacti suggests:
pn  php5-ldap                     <none>     (no description available)

-- debconf information excluded

---

From: sean finney <[email-masked]>
Date: Thu, 23 Feb 2012 03:07:11 +0100

Hi Thierry,

> in HTTP_REMOTE_USER, not in REMOTE_USER.
<snip>
 
> Here is a patch, if you decide to insert these checks.

This sounds like something that should go upstream to the cacti authors.
Could you report a bug at bugs.cacti.net?  Thanks!

	sean

---

From: [email-masked] (Debian Bug Tracking System)
Date: Mon, 23 Apr 2012 16:51:11 +0000

Processing commands for [email-masked]:

> #
> # bts-link upstream status pull for source package cacti
> # see http://lists.debian.org/debian-devel-announce/2006/05/msg00001.html
> #
> user [email-masked]
Setting user to [email-masked] (was [email-masked]).
> # remote status report for #660853 (http://bugs.debian.org/660853)
> # Bug title: cacti: External auth does not work behind a reverse proxy (HTTP_REMOTE_USER contains login, not REMOTE_USER)
> #  * http://bugs.cacti.net/view.php?id=2209
> #  * remote status changed: assigned -> resolved
> #  * remote resolution changed: open -> fixed
> #  * closed upstream
> tags 660853 + fixed-upstream
Bug #660853 [cacti] cacti: External auth does not work behind a reverse proxy (HTTP_REMOTE_USER contains login, not REMOTE_USER)
Added tag(s) fixed-upstream.
> usertags 660853 - status-assigned resolution-open
Bug#660853: cacti: External auth does not work behind a reverse proxy (HTTP_REMOTE_USER contains login, not REMOTE_USER)
Usertags were: status-assigned resolution-open.
Usertags are now: .
> usertags 660853 + status-resolved resolution-fixed
Bug#660853: cacti: External auth does not work behind a reverse proxy (HTTP_REMOTE_USER contains login, not REMOTE_USER)
There were no usertags set.
Usertags are now: resolution-fixed status-resolved.
> thanks
Stopping processing here.

Please contact me if you need assistance.
-- 
660853: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660853
Debian Bug Tracking System
Contact [email-masked] with problems

---

From: [email-masked]
Date: Mon, 23 Apr 2012 17:18:51 -0000

#

thanks

---

From: [email-masked] (Debian Bug Tracking System)
Date: Tue, 01 May 2012 11:06:11 +0000

Your message dated Tue, 01 May 2012 11:03:27 +0000
with message-id <[email-masked]>
and subject line Bug#660853: fixed in cacti 0.8.8a-1
has caused the Debian Bug report #660853,
regarding cacti: External auth does not work behind a reverse proxy (HTTP_REMOTE_USER contains login, not REMOTE_USER)
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

Subject: cacti: External auth does not work behind a reverse proxy (HTTP_REMOTE_USER contains login, not REMOTE_USER)
From: Thierry Murgue <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Wed, 22 Feb 2012 12:53:01 +0100

Package: cacti

<Location /cacti>
 ... Some auth directives
 RewriteEngine    on

-- System Information:
Debian Release: 6.0.4
  APT prefers stable

Subject: Bug#660853: fixed in cacti 0.8.8a-1
From: Paul Gevers <[email-masked]>
To: [email-masked]
Date: Tue, 01 May 2012 11:03:27 +0000

Source: cacti
Source-Version: 0.8.8a-1

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive:

cacti_0.8.8a-1.debian.tar.gz
  to main/c/cacti/cacti_0.8.8a-1.debian.tar.gz
cacti_0.8.8a-1.dsc
  to main/c/cacti/cacti_0.8.8a-1.dsc
cacti_0.8.8a-1_all.deb
  to main/c/cacti/cacti_0.8.8a-1_all.deb
cacti_0.8.8a.orig.tar.gz
  to main/c/cacti/cacti_0.8.8a.orig.tar.gz

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Paul Gevers <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Tue, 01 May 2012 09:57:18 +0200
Source: cacti
Binary: cacti
Architecture: source all
Version: 0.8.8a-1
Distribution: unstable
Urgency: low
Maintainer: Cacti Maintainer <[email-masked]>
Changed-By: Paul Gevers <[email-masked]>
Description: 
 cacti      - web interface for graphing of monitoring systems
Closes: 406766 660853 668261 669339
Changes: 
 cacti (0.8.8a-1) unstable; urgency=low
 .
   * New upstream release.
     - Now includes plugin architecture (Closes: #406766)
     - Don't use define_syslog_variables() (Closes: #668261)
     - Allow external auth behind proxy (Closes: #660853)
   * Update patches, remove last two now applied upstream
   * Update d/watch to prevent selection of PIA tar ball
   * Repaired old entries in d/changelog where non-ascii characters got mangled
   * Remove d/s/local-options as they are for, well, local options
   * Make link to cacti.sql instead of copying data again
   * Remove unnecessary directories from dirs as they are generated as needed
   * Clean up of debian rules for short-hand dh
     - Moved permission and ownership fixes to override_dh_fixperms
     - Use 644 and 755 instead of 640 and 750 as per policy (except for rra)
     - Remove lib/adodb on clean (instead of build)
     - Use debian/cacti.install to define which files to install where
   * d/post(rm|inst) now also (un)registers with ufcr and clean-up of long
     obsolete /etc/cacti/default-poller
   * Append error output of poller to poller-error.log i.s.o overwriting
     (Closes: #669339) and make sure the ownership/permissions are right
   * Update README.Debian with info about plugin architecture
Checksums-Sha1: 
 629e4960f30c45da87bcebb1636154ce3aeaaf67 1322 cacti_0.8.8a-1.dsc
 e66f5fde96b28b273a9e62f79f8a7bb8827812c2 2273280 cacti_0.8.8a.orig.tar.gz
 91aecb129c1dbfa380c349beb878c252e1aa80b3 41575 cacti_0.8.8a-1.debian.tar.gz
 4af2f686edd1c6c6464f32b3fe6bbe5a9aa08250 2085000 cacti_0.8.8a-1_all.deb
Checksums-Sha256: 
 0024c17686e514ef5fc5ad582bf8effa51d0a956979891a713905ae805e6a70c 1322 cacti_0.8.8a-1.dsc
 9fea2b6c438ebf2740b5982a6ff7cfd2816e48ea88a347ef0ef238c7b4875955 2273280 cacti_0.8.8a.orig.tar.gz
 c78b72b275cb33a39aec12123b0394dd94f34013e1d521f183444c5e78e816e7 41575 cacti_0.8.8a-1.debian.tar.gz
 0213644df6b270f106793fc12d6fb7d411d161973d13b6c0733bbfbfca820728 2085000 cacti_0.8.8a-1_all.deb
Files: 
 fe96f1ebcd414c92905a3e335a14b492 1322 web extra cacti_0.8.8a-1.dsc
 a4da682dab9a88a2e0edb1728bf531ae 2273280 web extra cacti_0.8.8a.orig.tar.gz
 592243b9ec0a0d4d23bc368bedc7f2dc 41575 web extra cacti_0.8.8a-1.debian.tar.gz
 4d992176253dc660897b893d1f0e818f 2085000 web extra cacti_0.8.8a-1_all.deb