*s.sock missing when logged in as user from ZM front end

[d777]

Hi,
Have struggled a lot to understand why live feed is not working on my install.
Have found out that if user auth is disabled - live feed works.
If I enable user auth and hence login into zm with my user, it does not create the *s sock file. It seems somewhere in the code it uses the zm logged in user to create it. This thing runs under apache. Yes I have it zm installed under 2.4/linux.
Have had no time to debug and such, but am sure and confirmed this is a bug.
Hopefully this is not a duplicated one - if someone has a patch on 12.8.1 (this is what I have installed) let me know.

Cheers/

[d777]

Hi,
Have struggled a lot to understand why live feed is not working on my install.
Have found out that if user auth is disabled - live feed works.
If I enable user auth and hence login into zm with my user, it does not create the *s sock file. It seems somewhere in the code it uses the zm logged in user to create it. This thing runs under apache. Yes I have it zm installed under 2.4/linux.
Have had no time to debug and such, but am sure and confirmed this is a bug.
Hopefully this is not a duplicated one - if someone has a patch on 12.8.1 (this is what I have installed) let me know.

Cheers/

Hi everyone - I think this is a basic issue and am surprised no-one has reported this yet.
I know I am doing reverse proxing and all that but this sits in the core code which I think it tried to open up a sock under the zm auth user not under the user (apache in this case) that runs the process for.
No-one in here had ran into this issue?

[bbunge]

Assume you mean when "OPT_USE_AUTH" is disabled it works? By "live feed" do you mean viewing a monitor? Would also be great if you gave us some info on the Linux version you are using and the specs of your server as well as the cameras you are using. It is possible that MySQL is running out of memory or your PHP memory limits need to be increased.

Bill

[d777]

Assume you mean when "OPT_USE_AUTH" is disabled it works? By "live feed" do you mean viewing a monitor? Would also be great if you gave us some info on the Linux version you are using and the specs of your server as well as the cameras you are using. It is possible that MySQL is running out of memory or your PHP memory limits need to be increased.

Bill

1. yes when OPT_USE_AUTH is set, and loggin in with a user, live feed (viewing the monitor) does not work - I can see in the logs that's looking for *s.sock file that's not being created.
2. Mysql/php are not the issue as I can get the live feed if I disable the auth.
3. I am on arm, and belive me I know the low level linux stuff. To be honest , the specs should not matter here as its working, flying, when opt_use_auth is off.
The problem I am way to busy to come down and debug it.
If you have it installed (12.8.1) try it, and see it yourself - hit your url: ... zm/index.php?view=montage - you will get a broken image.
If you try it and see no error , then I can get deep into it.
But thanks for reply.

[asker]

I use 1.28.1 with OPT_AUTH and I don't have any problems with broken images.
There is a thread somewhere on the same problem you are talking about, but no specific resolution. (found it: here: https://bugs.launchpad.net/ubuntu/+sour ... ug/1159361 --> but for an older version)
Also see if this helps: https://github.com/ZoneMinder/ZoneMinder/issues/328

Bottom line, I don't think its a 1.28.1 issue. It seems to be a configuration issue related to how you've set up Apache or some other ZM config issue

You may have to do deeper digging.
A good way is to watch your logs very closely -

Code: Select all

tail -f /var/log/syslog /var/log/apache2/error.log

Also, what bbunge said is right - please provide exact details on
a) OS
b) How you installed ZM
c) What post config you did

[d777]

Also, what bbunge said is right - please provide exact details on
a) OS
b) How you installed ZM
c) What post config you did[/quote]

a)I built 1.28.1 from source on my arm/fedora box
b) cmake ./make/make install
c)no post config.
I've tailed the logs, no trace of bad stuff - will maybe turn in debug for it and discover what I think is happening.
Explain me this: with auth on, live feed shows broken image, it I take it off(using zm console) , I can see live feed. Why are you pointing me to cgi/apache config issues as these guys in those threads are talking about? If it was cgi/apache misconfigured, no_auth would also be broken, right? unless I miss something.

[asker]

b) cmake ./make/make install
c)no post config.

If you did cmake/make/make install you must have done post config to set up Apache, set up the DB. etc. To the best of my knowledge cmake does not auto set up the environment, only package install does (I did cmake install last night on a Ubuntu machine). So you are possibly skimming on details.

I've tailed the logs, no trace of bad stuff - will maybe turn in debug for it and discover what I think is happening.
Explain me this: with auth on, live feed shows broken image, it I take it off(using zm console) , I can see live feed. Why are you pointing me to cgi/apache config issues as these guys in those threads are talking about? If it was cgi/apache misconfigured, no_auth would also be broken, right? unless I miss something.

I actually am not obliged to explain anything to you. I'm a user just like you and trying to collaboratively figure out what is wrong. If you are looking for a ready answer, ZoneMinder is either not an option for you, or you can choose to pay the maintainers to offer you dedicated support (http://www.zoneminder.com/support)

With that out of the way, and if you are interested in hearing someone else's perspective without the attitude:

a) The fact that I am running 1.28.1 with OPT_AUTH and there are no issues implies this is not a zone minder bug for 1.28.1. It therefore must be either a configuration you did post cmake install, or, there is a platform specific bug in Fedora (I don't know ,for example, if you have SELinux set in enforcing mode - and if disabling that makes a difference)

b) The reason I pointed you to that thread is because people were facing the same problem as you with another version of ZoneMinder. And if you actually read through that thread, people reported the same thing - works without Auth and does not work with Auth

c) I posted another link, where knnniggett requested the folks facing this problem change the authentication method and report --> if you try, it may help or at least debug

d) Finally, to your question of why video streaming works without auth and not with auth --> When you enable authentication, you need to pass the auth token within the URL header or Apache will reject the request. When you disable authentication, Apache does not reject it. I did not suggest cgi-bin configuration was broken. I suggested some setting in Apache was broken that was making auth redirects fail. And for that, you need to show what you have in apache2.conf to start. And monitoring both apache error logs and syslog while it happens often offers insight

[d777]

asker - you may be right on the auth redirects.
Yes, of course i had to do the mysql and apache config post zm install.
My setup involves also a 2 point proxy to get to the internal zm, so I think you gave me good pointers on the apache config which may fail me on the headers.
I'll take this homework and get back to the forum, maybe will help someone else down the road with my complicated setup.
So at this point I am not blaming zm - happy
Thanks for you time replying to my issues.
btw asker - what;s your network path when you access zm from outside your network - just curios: normally you do reverse proxy/proxypass to get inside?

[asker]

d777, yes,my guess is the problem may be around authredirects.
However, it seems ZM uses its own auth - I've been looking at their code and does not use Apache auth.

No,I don't use any reverse proxies - I just have a straight ddns mapping to my IP address.

I think you may get more insight if knnigggett happens to see this thread.

[d777]

asker - did more digging but nothing strikes out.
I'm seeing zm user going it, zm auth with it, then I am logged it.
Then if I access the live feed or getting into zone editor - all show broken images.
This is due to the fact that zm is trying to open up *s.sock which does not get created. All that is silent , as I was expecting to see some error message on creating s.sock in the first place.
As said, I've doing proxy pass from outside to the internal server that has zm. Normal zm flows work fine, the console, can start/stop zm from the console remotely, so all these work.
I can relate this error to the proxy stuff I am doing, but there is no indication of the misconfig in there. headers are fine.
Can you ping knnigggett to see if he has some thoughts on this - definitely I'd have to look at the code to see how zm is using its own passed in auth user and what's its ties to when zm creates the s.sock.

[asker]

d777,

Would you mind posting detailed logs when you have OPT_AUTH enabled and trying to stream?

[knight-of-ni]

Since you've chosen to build zoneminder from source yourself, we really need to see:
a) how you called cmake (and any parameters you used)
b) the build output of the entire process

Specifically, we need to see if it detected the gnutls and/or openssl dev libraries.

Note that authentication is working just fine when using the Fedora rpms found in zmrepo.
I'd rather you use the rpms than build from source because it minimizes the number of "how exactly did you build zonemidner" questions that need to be asked. It also benefits you due to an easier install. win-win.

Oh nevermind the rpm speach... I see you are using ARM Fedora, which I don't have in my repo.
Are you building on a Raspberry Pi 2? Someday I may add rpms for that hardware.

[knight-of-ni]

Alright, the wheels continue to spin on this one.
Here is a different approach to building zoneminder. The end result will be an rpm.
Before going down this path, verify the the RPMFusion repo is available for your architecture.
I believe ARM 7 hardware is supported, but ARM 6 may not be.

Configure your hardware for an rpm build environment. You can follow this guide:
http://wiki.centos.org/HowTos/SetupRpmBuildEnvironment

Download the Fedora Source RPM from zmrepo:
http://zmrepo.zoneminder.com/f/21/SRPMS/

Build an rpm for your ARM platform:

Code: Select all

rpmbuild -ba zoneminder-1.28.1-1.fc21.src.rpm

Do NOT run this as root!

Initially, it is going to complain (a lot) about missing build dependencies. You need to find & install all the packages it complains about. This is where the RPMFusion repo is needed. Let me know if you need help.

Doing it this way guarantees you have all the packages needed for zoneminder to build with all features enabled. Authentication is one of those features.

Once you get the hang of building rpms, you may find that you won't ever want to build anything from source.

[d777]

knnniggett - thanks for sharing all the info.
So I am on arm7, and before deciding to build from source I did search but could not find any arm7 zm rpm.
When I built is I just did: 'cmake .' - no other options.
I think I saw checking on for gnutsl/openssl stuff, if not, I recall I had to go off and yum install gnutls. openssl libs were already installed.
OK - I take you know zm inside out - when you pass in zm auth user into the mix - what's this user used for other than authentication in front? Is it passed into the ssl context if run under https?
Thanks for the pointers - I saw you have /f/20/SRPMS/ and so I will give it a try tonight building and installing the rpm stuff and get back here. rpmbuild may save me from other cases where and rpm is not present - would not mind building from source also.
So what's bothering me is that it let me in trough ZM and then fails me as stated many times above.

[knight-of-ni]

So what's bothering me is that it let me in trough ZM and then fails me as stated many times above.

The authentication that appears to be broken is the authentication hash, which is used between zoneminder's different applications. Normal user logins into the console don't use this function, which is why you can login just fine.

Authentication hashing is controlled by ZM_AUTH_RELAY, ZM_HASH_SECRET, and ZM_HASH_IPS. It uses the MD5 function on your system to generate a hash, which is based on your login, your ip address, and the hash_secret. Both the gnutls and openssl libraries contain an MD5 function.

Note, however, it won't be good enough to just install an MD5 package onto your system after zoneminder has already been built. Zoneminder needs the development header files (gnutls-dev and/or openssl-dev) to be present at build time.

Lastly, this is completely independent of HTTPS. ZoneMinder should run fine with your web server configured for HTTPS, but the issue you are experiencing doesn't really have anything to do with that.