cedric-anne
commented
1 year ago Hi,
Maybe something like:
AliasMatch "^/(plugins/glpiinventory/(index\.php)?)$" "var/www/glpi/$1"Closed Chico0008 closed 1 year ago
cedric-anne
commented
1 year ago Hi,
Maybe something like:
AliasMatch "^/(plugins/glpiinventory/(index\.php)?)$" "var/www/glpi/$1"
Chico0008
commented
1 year ago Tried putting the AliasMatch you suggest before the first Directory setting
my agent got this error now
[Wed Apr 5 16:41:39 2023][error] [http client] communication error: 403 Forbidden
cedric-anne
commented
1 year ago What was your previous GLPI version?
Chico0008
commented
1 year ago First i got 10.0.6, but changed to 10.0.7-dev because a bug in 10.0.6 prevented my agent to bring their inventory (but they could connect) i had the same warning but didn't changes apache conf before bringing official 10.0.7
previous apache conf (but with the warning)
<VirtualHost *:80>
ServerName glpi.mydom.lan
DocumentRoot /var/www/glpi
ErrorLog ${APACHE_LOG_DIR}/glpi/error.log
CustomLog ${APACHE_LOG_DIR}/glpi/access.log combined
<Directory /var/www/glpi/plugins/glpiinventory>
Options Indexes FollowSymLinks
AllowOverride All
Require all granted
</Directory>
<Directory /var/www/glpi>
Options FollowSymlinks
AllowOverride All
AuthType GSSAPI
AuthName "glpi.mydom.lan"
GssapiCredStore keytab:/etc/user_sso.krb.keytab
GssapiUseSessions On
GssapiLocalName On
Require valid-user
</Directory>
</VirtualHost>It's ok, the first / was missing in the path of the Aliasmatch
AliasMatch "^/(plugins/glpiinventory/(index\.php)?)$" "/var/www/glpi/$1"
thanks for your help
FredVRA
commented
1 year ago I have a similar configuration, my site is in HTTPS, the agents no longer communicate with the server since the GLPI 10.0.7 update from GLPI 10.0.6. the agent log shows this error:
[error] [http client] authentication required, no credentials available
and the log apache:
"POST /plugins/glpiinventory HTTP/1.1" 401 4039 "-" "GLPI-Agent_v1.4"
I have the same error with: AliasMatch "^/(plugins/glpiinventory/(index\.php)?)$" "/var/www/glpi/$1"
Fore more details, I created a post here: https://forum.glpi-project.org/viewtopic.php?pid=501085#p501085
Thanks for your help
Code of Conduct
Is there an existing issue for this?
Version
10.0.7
Bug description
Since updating to 10.0.7, i had a warning saying Web server root directory configuration is not safe as it permits access to non-public files. See installation documentation for more details.
after several search, i found that now in apache conf you must expose glpi/public instead of /glpi fine
but : in my original config file i had a directory for glpi/ with sso, and a 2nd directory poiting to glpi/plugins/glpiinventory, without SSO so my agent could connect and bring back their inventory
with the new conf i had a document root to glpu/public directory to glpu/public with sso, works fine, no warning kept my directory to glpi/plugins/glpiinventory, but my agent can't connect anymore
what is the correct apache configuration to have my agent connect, bring back their inventory now ? whithout having to re-deploy/re-conf all the agent
here's my current apache conf
Relevant log output
No response
Page URL
No response
Steps To reproduce
No response
Your GLPI setup information
Informations sur le système, l'installation et la configuration
Server
Operating system: Linux s-web 5.15.0-69-generic #76-Ubuntu SMP Fri Mar 17 17:19:29 UTC 2023 x86_64 PHP 8.1.2-1ubuntu2.11 apache2handler (Core, FFI, PDO, Phar, Reflection, SPL, SimpleXML, Zend OPcache, apache2handler, bz2, calendar, ctype, curl, date, dom, exif, fileinfo, filter, ftp, gd, gettext, hash, iconv, intl, json, ldap, libxml, mbstring, mysqli, mysqlnd, openssl, pcre, pdo_mysql, posix, readline, session, shmop, sockets, sodium, standard, sysvmsg, sysvsem, sysvshm, tokenizer, xml, xmlreader, xmlwriter, xsl, zip, zlib) Setup: max_execution_time="30" memory_limit="128M" post_max_size="8M" safe_mode="" session.save_handler="files" upload_max_filesize="2M" Software: Apache/2.4.52 (Ubuntu) (Apache/2.4.52 (Ubuntu) Server at glpi.viry.net Port 80 ) Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Server Software: Ubuntu 22.04 Server Version: 10.6.12-MariaDB-0ubuntu0.22.04.1 Server SQL Mode: STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION Parameters: dbglpi@localhost/glpi Host info: Localhost via UNIX socket PHP version (8.1.2-1ubuntu2.11) is supported. Sessions configuration is OK. Allocated memory is sufficient. mysqli extension is installed. Following extensions are installed: dom, fileinfo, json, simplexml. curl extension is installed. gd extension is installed. intl extension is installed. libxml extension is installed. zlib extension is installed. The constant SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES is present. Database engine version (10.6.12) is supported. No files from previous GLPI version detected. The log file has been created successfully. Write access to /var/www/glpi/files/_cache has been validated. Write access to /var/www/glpi/config has been validated. Write access to /var/www/glpi/files/_cron has been validated. Write access to /var/www/glpi/files has been validated. Write access to /var/www/glpi/files/_dumps has been validated. Write access to /var/www/glpi/files/_graphs has been validated. Write access to /var/www/glpi/files/_lock has been validated. Write access to /var/www/glpi/files/_pictures has been validated. Write access to /var/www/glpi/files/_plugins has been validated. Write access to /var/www/glpi/files/_rss has been validated. Write access to /var/www/glpi/files/_sessions has been validated. Write access to /var/www/glpi/files/_tmp has been validated. Write access to /var/www/glpi/files/_uploads has been validated. Web server root directory configuration is not safe as it permits access to non-public files. See installation documentation for more details. The following directories should be placed outside "/var/www/glpi": ‣ "/var/www/glpi/files" ("GLPI_VAR_DIR") ‣ "/var/www/glpi/config" ("GLPI_CONFIG_DIR") You can ignore this suggestion if your web server root directory is "/var/www/glpi/public". Sessions configuration is secured. OS and PHP are relying on 64 bits integers. exif extension is installed. ldap extension is installed. openssl extension is installed. Following extensions are installed: bz2, Phar, zip. Zend OPcache extension is installed. Following extensions are installed: ctype, iconv, mbstring, sodium. Write access to /var/www/glpi/marketplace has been validated. Timezones seems loaded in database.GLPI constants
Libraries
LDAP directories
Server: 's-dc-hdv.viry.net', Port: '389', BaseDN: 'DC=viry,DC=net', Connection filter: '(&(objectClass=user)(objectCategory=person)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))', RootDN: 'CN=glpi,OU=droits eleves,OU=Comptes de services,DC=viry,DC=net', Use TLS: noneSQL replicas
Notifications
Plugins list
datainjection Name: Data Injection Version: 2.12.1 State: Enabled Install Method: Manual formcreator Name: Form Creator Version: 2.13.4 State: Enabled Install Method: Manual glpiinventory Name: GLPI Inventory Version: 1.1.0 State: Enabled Install Method: Manual oauthimap Name: Oauth IMAP Version: 1.4.1 State: Enabled Install Method: ManualAnything else?
No response