July 2000 - Zope - Zope lists

RE: [Zope] Interbase DA compiled for Windows?
by R. Herold 31 Jul '00

31 Jul '00

Sorry, > connect to Interbase (kinterbasdb-0.2.1.tar.gz and InterbaseStorage098.tgz), this was meant to be kinterbasdb-0.2.1.tar.gz and _ gvibDA-0.1.tar.gz _ Thanks again, -- Ralf Herold | mailto:ralf.herold@charite.de, PGP mailto:ralf.herold@gmx.net

3 2

Announce: StarRave0.0.16
by ed colmar 30 Jul '00

30 Jul '00

StarRave-0.0.16 .. product announce [ a bow to the high zope council ] [ a bow to the zope mailing list ] StarRave is a zope/python product that manages information related to djs, events, and promoters. Specifically, this product is built for the Rave scene, where there are hundreds of similar websites that do not share any information. StarRave allows these sites to transparently access information stored on any remote StarRave server. A few attempts have been made to house all the data related to raving, but the abundance of overlapping ideas, names, and resources, creates a maintenance bottleneck. StarRave is designed to let each server maintian information related to it's region, or it's record label, or it's event schedule. Currently StarRave is set up in two parts, a "server" and a "host" . The server is the primary interface that most will see. It enters, edits, and displays data, while providing a rich interface. The "host" collects data from server sites, and organizes it all into a tidy xml package. StarRave is compatible with 2.1.x versions of zope with some bugs. starRave is compatible with 2.2.0 versions of zope with some catalog inconsistancies This product still needs work, but runs quite well. Of course all contributions are encouraged. To download StarRave: http://www.zope.org/Members/element/StarRave or http://www.starrave.org:8080/sr/webdav/ StarRave sites in use: http://www.starrave.org:8080/sr/demo/ http://www.trustcrew.org/trustcrew/

1 0

password
by Jonathan Desp 30 Jul '00

30 Jul '00

Hi, the program zpasswd prompt. they said: If this program is called without command-line options, it will prompt for all necessary information. The available options are: -u / --username= Set the username to be used for the superuser -p / --password= Set the password -e / --encoding= Set the encryption/encoding rules. Defaults to SHA-1. OPTIONAL -d / --domains= Set the domain names that the user user can log in from. Defaults to any. OPTIONAL. Filename is not option, and should be the name of the file to store the information in. __________________ What I should write in this source code from zpasswd ? --> """Zope password change system""" __version__='$Revision: 1.8 $ '[11:-2] import sys, string, sha, binascii, whrandom, getopt, getpass, os try: from crypt import crypt except ImportError: crypt = None def generate_salt(): """Generate a salt value for the crypt function.""" salt_choices = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" \ "abcdefghijklmnopqrstuvwxyz" \ "0123456789./" return whrandom.choice(salt_choices)+whrandom.choice(salt_choices) def generate_passwd(password, encoding): encoding=string.upper(encoding) if encoding == 'SHA': pw = '{SHA}' + binascii.b2a_base64(sha.new(password).digest())[:-1] elif encoding == 'CRYPT': pw = '{CRYPT}' + crypt(password, generate_salt()) elif encoding == 'CLEARTEXT': pw = password return pw def write_access(home, user='', group=''): import whrandom pw_choices = "ABCDEFGHIJKLMNOPQRSTUVWXYZ" \ "abcdefghijklmnopqrstuvwxyz" \ "0123456789!" ac_path=os.path.join(home, 'access') if not os.path.exists(ac_path): print '-'*78 print 'creating default access file' acfile=open(ac_path, 'w') pw = '' for i in range(8): pw = pw + whrandom.choice(pw_choices) acfile.write('superuser:' + generate_passwd(pw, 'SHA')) acfile.close() os.system('chmod 644 access') print """Note: The super user name and password are 'superuser' and '%s'. You can change the superuser name and password with the zpasswd script. To find out more, type: %s zpasswd.py """ % (pw, sys.executable) import do; do.ch(ac_path, user, group) def main(argv): short_options = ':u:p:e:d:' long_options = ['username=', 'password=', 'encoding=', 'domains='] usage = """%s [options] filename If this program is called without command-line options, it will prompt for all necessary information. The available options are: -u / --username= Set the username to be used for the superuser -p / --password= Set the password -e / --encoding= Set the encryption/encoding rules. Defaults to SHA-1. OPTIONAL -d / --domains= Set the domain names that the user user can log in from. Defaults to any. OPTIONAL. Filename is not option, and should be the name of the file to store the information in. Copyright (C) 1999 Digital Creations, Inc. """ % argv[0] try: if len(argv) < 2: raise "CommandLineError" optlist, args = getopt.getopt(sys.argv[1:], short_options, long_options) if len(args) != 1: raise "CommandLineError" access_file = open(args[0], 'w') if len(optlist) > 0: # Set the sane defaults username = 'superuser' encoding = 'SHA' domains = '' for opt in optlist: if (opt[0] == '-u') or (opt[0] == '--username'): username = opt[1] elif (opt[0] == '-p') or (opt[0] == '--password'): password = opt[1] elif (opt[0] == '-e') or (opt[0] == '--encoding'): encoding = opt[1] elif (opt[0] == '-d') or (opt[0] == '--domains'): domains = ":" + opt[1] # Verify that we got what we need if not username or not password: raise "CommandLineError" access_file.write(username + ':' + generate_passwd(password, encoding) + domains) else: # Run through the prompts while 1: username = raw_input("Username: ") if username != '': break while 1: password = getpass.getpass("Password: ") verify = getpass.getpass("Vefify password: ") if verify == password: break else: password = verify = '' print "Password mismatch, please try again..." while 1: print """ Please choose a format from: SHA - SHA-1 hashed password CRYPT - UNIX-style crypt password CLEARTEXT - no protection. """ encoding = raw_input("Encoding: ") if encoding != '': break domains = raw_input("Domain restrictions: ") if domains: domains = ":" + domains access_file.write(username + ":" + generate_passwd(password, encoding) + domains) except "CommandLineError": sys.stderr.write(usage) sys.exit(1) # If called from the command line if __name__=='__main__': main(sys.argv) Very truly yours, <><><><><><><><><><><><><><> Jonathan Desp Chairman and CEO, Atomasoft Inc. Matter will become software http://www.atomasoft.com <><><><><><><><><><><><><><>

4 3

RE: [Zope] Starting Zope
by Chris McDonough 30 Jul '00

30 Jul '00

Not to continue offtopic for too much longer, but IMHO, the "only root can bind to ports under 1025" was, and continues to be, a terrible UNIX hack that was possibly reasonable at its time of inception, but that has since *caused* more security holes than it ever helped to prevent. The argument for the hack is backwards compatibility, any other explanation usually ends up as rationalization or circular logic. My $.02. > -----Original Message----- > From: Bill Anderson [mailto:bill@libc.org] > Sent: Sunday, July 30, 2000 5:04 PM > To: zope(a)zope.org > Subject: Re: [Zope] Starting Zope > > > > (Quoting reversed for sake of continuity. > > > On Sun, 30 Jul 2000, Cary O'Brien wrote: > > > > > > Cary O'Brien wrote: > > > > > > > > > Well... > > > > > > > > > > If you are running on Linux you could simply edit the > kernel code to > > > > > elimitate the check on being root to bind to low > ports. That's what > > > > > we did. > > > > > > > > Which is an even worse idea. > > > > > > > > > > Why? On a sufficiently firewalled off box, where the few > logins are > > > completly trusted, what's the diff? If you were worried > about people > > > cracking a user account and getting underneath telnet, > than limit the > > > lifting of the restriction to port 80. If you are concerned that > > > non-root users could launch attacks from low ports at > other machines, > > > assuming that only good guys can come from low ports is > pretty naive. > > > > > > The whole business about not letting anyone but root bind > to low ports > > > makes sense for a public access machine where all the first year > > > engineering students have an account, but for a dedicated > application > > > server it is kind of misdirected. You ought to be running next to > > > nothing but the application, and you had better trust > everyone that > > > you give a login to, and you out to have the thing locked > > > down/firewalled well. So the tiny bit of possible > protection may not > > > be worth the hassle/risks of writing your own suid-wrapper, or the > > > complexity of having a redirect and messing with > site-access so that > > > the port numbers in the zope -- what it is that parameter > -- base or > > > whatever, comes out write. > > > > > > Just for fun - does NT have the same restriction? > > Nitesh Dhanjani wrote: > > > > Interesting argument. However, consider this: if you > completely trust your > > 'firewalled' box, then why not run the web server as root? > One response, > > in your case is the fact that you mention your trust on > users(humans are > > the most easy to compromise, however that argument is a bit > OT). However, > > do you trust all of your webserver code? Do you trust your cgi-bin > > scripts and applications? And by trust I not only mean > harmful intent by > > the authors of software, but unintentional bugs which can > be exploited, > > and will be given the privilege to bind to <1024 ports even > when they run > > as a user with least privileges. > > > Exactly. In addition, relying solely on a firewall is a bad > idea from a security > standpoint. Firewalls can. and do get breached. > > I don't run many services on _any_ of my machines for > security reasons. I certainly don't > want Joe Random User to fire them up either. Consider tftpd, > or telnetd, or rlogin, > rusers, rwho, ruptime, etc.. There are many ways a user can > compromise, not only the > machine he is on, but other machines by having the capability > to bind to ports under 1024. > > Nearly all of them are off topic for this list; thus I would > recommend a number of the > security resources available on the web, such as: > > http://www.rootshell.com > http://www.securityfocus.com > > Just a quick example: A user can upload a custom compiled > version of (insert servie such > as DNS, NIS, telnetd, httpd, etc> that uses his/her local > libraries, bypass /etc/services. > since they can bind to ports under 1025, they can be started > by the user. Whereas, for > example, on other systems, their app would fail. Now, > consider that if they used a version > of, say ftpd, or fingerd, or named, that has known security > openings, they can then > exploit this to get root accounts; the firewall being > bypassed by being local to the > machine. > > Remember, Cary, if you don't think like a cracker/hacker, you > can't stop them. If you > can't see why allowing users (and users' programs) can be a > problem, doing so is an > violaiton of the basic premise of good security: > That which is not specifically allowed, is denied. > > And, BTW, for the record, I handle Unix/Network security for > a company known as > Hewlett-Packard, so I think I have a good idea of the risks > and potnetial exploits ;) > > > > -- > Do not meddle in the affairs of sysadmins, for they are easy to annoy, > and have the root password. > > _______________________________________________ > Zope maillist - Zope(a)zope.org > http://lists.zope.org/mailman/listinfo/zope > ** No cross posts or HTML encoding! ** > (Related lists - > http://lists.zope.org/mailman/listinfo/zope-announce > http://lists.zope.org/mailman/listinfo/zope-dev ) >

1 0

problems with the export
by Fabio Akita 30 Jul '00

30 Jul '00

Something strange happened when I tried to export a site. I tried many times but none worked. Anyone knows what could this be? Here follows the Zope error message: Zope Error Zope has encountered an error while publishing this resource. Error Type: AttributeError Error Value: Astral ---------------------------------------------------------------------------- ---- Troubleshooting Suggestions The URL may be incorrect. The parameters passed to this resource may be incorrect. A resource that this resource relies on may be encountering an error. For more detailed information about the error, please refer to the HTML source for this page. If the error persists please contact the site maintainer. Thank you for your patience. Traceback (innermost last): File D:\Zope\lib\python\ZPublisher\Publish.py, line 214, in publish_module File D:\Zope\lib\python\ZPublisher\Publish.py, line 179, in publish File D:\Zope\lib\python\Zope\__init__.py, line 202, in zpublisher_exception_hook (Object: ElementWithAttributes) File D:\Zope\lib\python\ZPublisher\Publish.py, line 165, in publish File D:\Zope\lib\python\ZPublisher\mapply.py, line 160, in mapply (Object: manage_exportObject) File D:\Zope\lib\python\ZPublisher\Publish.py, line 102, in call_object (Object: manage_exportObject) File D:\Zope\lib\python\OFS\ObjectManager.py, line 450, in manage_exportObject (Object: ElementWithAttributes) File D:\Zope\lib\python\OFS\ObjectManager.py, line 226, in _getOb (Object: ElementWithAttributes) AttributeError: (see above) Regards Fabio Akita - Developer F/Nazca S&S / Adversiting akita(a)fnazca.com.br

1 0

OQL for ZODB - (SQL like for objects Databases)
by Emmanuel DISCORS 30 Jul '00

30 Jul '00

Hi, Is there a tool like SQL for ZODB ? Where to find more to do some query on ZODB objects ? Many Thanks. Emmanuel. -- ================ Emmanuel DISCORS Tel & Fax : 02 54 56 80 61 ================ Conception, Informatique, Réseau ADVL ( Au-Delà de Vos Limites ) Site web : http://www.advl.org/ Archives mOdbc : http://www.advl.org/public/mOdbc/

2 2

Re: [Zope] Starting Zope
by Cary O'Brien 30 Jul '00

30 Jul '00

> Costagliola Giovanni wrote: > > > > Il gio, 27 lug 2000, Oleg Broytmann ha scritto: > > > On Thu, 27 Jul 2000, Costagliola Giovanni wrote: > > > > How can I to start Zope whit a different user than root and cath the > > > > default HTTP port? > > > > > > Use different way - start Zope as root, catch port 80 and drop uid. > > > > > > > I receive an error becouse root hasn't granted the need privileges on > > > > /Zope/var/ directory. > > > > > > This is a different error, not a problem with port 80, ah? > > > > > I see Oleg, more exactly I would start ZServer with an user like 'zope', for > > example, but at the same time I want it links the port 80! > > > > I could use the root user simply but I'll lose my sleep :^) > > > > Can you give me some input? > > If you want to bind to ports <1024 you _must_ be root. ZXope can run as another user (the > -u <user> option), but it must be _started_ as root, if you want to bind to port 80. > Period. > > Sorry, there is no other way, short of making Sope SUID, which is a very, very, very, > very, very, very bad idea. > Well... If you are running on Linux you could simply edit the kernel code to elimitate the check on being root to bind to low ports. That's what we did. -- cary

3 9

Using Zope and Worldpilot on a large site
by Paolo Bizzarri 30 Jul '00

30 Jul '00

Hi Zopers, we would like to use Zope for an ISP, with more than 400.000 customers. Zope would be used with Worldpilot, in order to provide Webmail, Calendar, to do, etc. Has anyone tried the scalability of Zope till this level ? Many thanks in advance Paolo -- Paolo Bizzarri - Responsabile Marketing I3 Icube Srl Sede: Via Ridolfi 15 - 56124 Pisa (PI), Italia E-mail: p.bizzarri(a)icube.it WWW: www.icube.it Tel: (+39) 050 97 02 07 Fax: (+39) 050 31 36 588

2 3

RE: [Zope] OQL for ZODB - (SQL like for objects Databases)
by Chris McDonough 30 Jul '00

30 Jul '00

Indeed it does. As a result, it doesn't help at all for O-R mapping. I've heard that PJE's DataSkins (part of ZPatterns) have features which make them useful for O-R mapping, though I haven't looked at them. > although i haven't looked at the source. chris m's Interbase storage > might be worth a look (it probably stores everything as a BLOB which > might not be helpful).

1 0

RE: [Zope] AW: [Zope] search on www.zope.org
by Chris McDonough 30 Jul '00

30 Jul '00

> I can't argue with that. i get constant key-errors... i'd really like > for someone from digicool to step up and give a reason. I'm > not sure if > its the size of the Catalog, or the internal Splitter giving > errors, or > if its just related to the recent hardware problems on zope.org I just checked in a fix to the catalog on Friday which should prevent these keyerrors. Ethan is going to upgrade Zope.org at some point next week, after which we'll see if my fix holds up.

1 0