Forums

Resolved
0 votes
I ran into a weird condition where the /etc/zarafa/ldap.cfg file had its permissions changed to '-rw------- root root' instead of '-rw-r----- root zarafa' which is what it is supposed to be. Once this was unreadable to zarafa, on the next HUP (restart) of the zarafa-server process it failed to load. This resulted in the following symptoms:

- Zarafa was running
- The users app said 'Object not found'
- The groups app worked just fine
- Could not log in to the /webapp web interface or Zarafa in general.

I'm trying to track this down and putting this out there in case anyone else's server has this permission condition. To validate run the following:

ls -la /etc/zarafa/ldap.cfg

It should show 'zarafa' as the group owner and '-rw-r-----' as the permission structure. If not you need to fix this but please do this for me as well:

Record the time and date of the file change and see if you have anything correlated in the /var/log/messages to the timestamp of the ldap.cfg file and post those events here.

To repair this problem run the following:

chmod 640 /etc/zarafa/ldap.cfg
chgrp zarafa /etc/zarafa/ldap.cfg

Then restart all your Zarafa services. At a minimum I know that the zarafa-licensed (for business) and the zarafa-server service need to be restarted but I restarted them all when I ran into this issue.
Thursday, June 29 2017, 06:36 PM
Share this post:

Accepted Answer

Monday, July 03 2017, 12:39 AM - #Permalink
Resolved
0 votes
I think the underlying issue is that somewhere along an upgrade, Zarafa made their services run as user 'zarafa' where-as earlier edition ran as 'root'. So this file (/etc/zarafa/ldap.cfg) may not be the issue so much as /etc/zarafa/server.cfg and the 'run_as_user' parameter.

Changing /etc/zarafa/ldap.cfg might be fine...if your Zarafa instance is running as root.

If you upgrade, and you find that Zarafa now runs as it's own user instead of root:

ps afxwu | grep zarafa-server


You'll need to make changes to a bunch of config files, attachment folders etc. or change the default and run Zarafa as root.

From a security perspective, running the Zarafa services as root is less desirable.

B.
The reply is currently minimized Show
Responses (6)
  • Accepted Answer

    Robert
    Robert
    Offline
    Saturday, July 01 2017, 10:41 PM - #Permalink
    Resolved
    0 votes
    Hi Dave,

    I can confirm that I also have '-rw------- root root' instead of '-rw-r----- root zarafa', though Zarafa works just fine. The time stamp is 11th March 2016 (yes, 2016). My logs unfortunately do not go that far in the past.

    Should I still change the permissions, even though everything is running OK?

    Thanks.

    Best wishes,

    Robert
    The reply is currently minimized Show
  • Accepted Answer

    Sunday, July 02 2017, 05:37 AM - #Permalink
    Resolved
    0 votes
    Thanks for your reply Robert. Have you restarted Zarafa recently? If you do restart it, does it fail to come up again? If so, run:

    chmod 640 /etc/zarafa/ldap.cfg
    chgrp zarafa /etc/zarafa/ldap.cfg

    ...and try restarting it again.
    The reply is currently minimized Show
  • Accepted Answer

    Robert
    Robert
    Offline
    Sunday, July 02 2017, 08:17 AM - #Permalink
    Resolved
    0 votes
    Hi Dave,

    I restart Zarafa every day due to the database backup. Did not experience any problem so far.

    Best wishes,

    Robert
    The reply is currently minimized Show
  • Accepted Answer

    Robert
    Robert
    Offline
    Friday, July 07 2017, 10:37 AM - #Permalink
    Resolved
    0 votes
    Hi Ben,

    Thanks for your answer.

    ps afxwu | grep zarafa-server

    revealed, that zarafa runs as root on my server, even though I changed the permission Dave mentioned. I fully agree, that running zarafa as root is not preferred.

    What is the easiest way to change it to run zarafa as zarafa user? I have the newest zarafa version installed (business).

    Thanks a lot.

    Best wishes,

    Robert
    The reply is currently minimized Show
  • Accepted Answer

    Friday, July 07 2017, 12:54 PM - #Permalink
    Resolved
    0 votes
    The reply is currently minimized Show
  • Accepted Answer

    Robert
    Robert
    Offline
    Friday, July 07 2017, 01:55 PM - #Permalink
    Resolved
    0 votes
    Dear Ben,

    Thanks. Feel more safe not :-).

    Best wishes,

    Robert
    The reply is currently minimized Show
Your Reply