Open geraldurbas opened 11 months ago
Thanks for taking the time to share your feedback. Although for what it's worth, we've been providing an OTRS appliance for at least 10 years, using the package from the Debian repos.
This is the first I'm hearing some of these issues, so I've done a bit of reading.
It turns out that some of the "issues" you refer to are the result of conscious Debian decisions to lock things down to harden security. As you are hopefully already aware, security isn't a binary on/off thing and almost all security hardening introduces user limitations. FWIW there is a Debian bug which covers the arguments (from both sides). The changes made do limit the ability of OTRS to do things that it wants to do, but it also reduces the chances of something really bad happening if a bad actor gets access to your OTRS/Znuny app.
When we set it up, we run the otrs.SetPermissions.pl
script - which I would have assumed resolved the issues?! Clearly that is not the case - at least for you...
It is also noted in Debian readme (/usr/share/doc/otrs2/README.Debian
):
OTRS package manager:
---------------------
otrs2 includes by default a package manager. This will not work with the Debian
package, because to have it work, we need to relax too many file permissions.
Also have a look here:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=475737
But if you are aware of the security issues and you realy need the integrated
package manager, then execute the following:
chmod g+w -R /usr/share/otrs/
chmod g+w -R /var/lib/otrs/
chgrp www-data -R /var/lib/otrs/
chgrp www-data -R /usr/share/otrs/
Note that the bug URL is the same as the link I provided above.
I'm guessing that you didn't follow (or probably even find) those instructions?
As for a non working cron job, I'm almost certain that is just a bug. We tweak the cron job as part of the install, but perhaps things have changed with Znuny and we missed something?
Could you please clarify the problems any further? Details on how to reproduce the specific issues you note would be very warmly welcomed (i.e. which url/page, what options/config needs to be done to make the issues appear). I'm particularly interested in getting more detail on these 2 as they seem like particularly easy ones to address (if I can understand them better):
- Many Perl Packages are missing; but are available in Debian (wrong / missing dependencies)
- Missing MySQL Settings
I am particularly curious about the "missing mysql settings" as there was one pivotal setting that we were having issues applying (it appeared to work, but was then causing error messages in mysql and making mysql-admin commands fail). It turned out that the Znuny docs were wrong - but we spoke with them about that and they have since fixed it. AFAIK, we're applying all the recommendations from Znuny?!
I do agree with you re improving documentation. I was of the understanding, that running the setPermissons
script would have applied settings as desired, although adding a note re enabling the "package manager" is probably a good idea. It's perhaps worth even considering a first boot script to make that super easy (and also note the security implications as well). At then end of the day, we want our servers to be as secure as possible, but sometimes compromising a little security for convenience and/or usability is a good move.
Armed with some clear info of what is actually wrong, we would almost certainly be able to patch and/or work around any issues. Plus if there are default packaging shortcomings, then we could assist the packager to improve the package (and then we all win).
We could consider moving to an upstream install, but unless there is a really clear reason why that is "better" I would prefer to avoid it. It will increase maintenance - for both us and users.
Regardless, thanks again for your feedback.
ping @geraldurbas - could you please help out with more info?
Hi JedMeister, Sorry - missed your mention.
Finally we went the way with TK LAMP Base and a manual Znuny setup. Migration requirement was to get from OTRS final version to Znuny 6.5. My target was "only" to show Znuny to the customer, and to test the migration.
And often TK Images tuns out to be "ready"
You're correct, i didnt find the Chmods in the Debian readme. These should correct some problems. But not the Debian aproach. I guess in some months Znbuny 6.5 is incorporated.
Missing Perl Modules Luckily i didn't delete the CT, unfortunately i cant tell after my review from apt Log which Perl Libraries were missing. Found libcrypt-openssl-x509-perl, libdbd-odbc-perl, libcql-parser-perl, libauthen-ntlm-perl and libical-parser-perl and libsoap-lite-perl near the installation time. These may be required, or only recommended.
In install docs is a Jq library mentioned to be installed via cpanm install Jq maybe outdated > this library seems to installed via some dependency from above.
https://doc.znuny.org/znuny_lts/releases/installupdate/install.html
Used from OTRS & Znuny this Check script /opt/otrs/bin/otrs.CheckModules.pl --all lists missing Modules. Practically with apt install command.
Mysql From https://doc.znuny.org/znuny_lts/releases/installupdate/install.html Cant remember if the Check script prints this
The recommended Mysql configs make sense for me, no security risk. [mysql] max_allowed_packet=256M [mysqldump] max_allowed_packet=256M [mysqld] innodb_file_per_table innodb_log_file_size = 256M max_allowed_packet=256M character-set-server = utf8 collation-server = utf8_general_ci
Sorry form my late and not so helpful answer. sincerly
@geraldurbas - thanks for taking to time to circle back and respond. I really appreciate it.
Armed with your additional info, I'll have a closer look when I get a chance and at the very least, should be able to improve things. Thanks again for your initial report.
As far I understand, the TK Image concept are meant to be pre productive images. But this OTRS Package is only capable as a preview. First look is working, but a more scratchy technical review shows problems.
This Issue is not related to the TK Image "itself" - its working; But the chosen install style won’t become an "easygoing" future Znuny install.
After a short fact finding mission related to a OTRS migration, I discovered some problems with the default Debian Package for otrs2 Errors discovered:
I recommend noting this in the Image description to be more accurate and give more/less Power users a hint.
(My plan is to figure out if a OTRS/Znuny installation over a LAMP Image is a working approach; or it's better to go with clean D11 images; and leave a note here)