Topic: OCS Inventory problem

[Bud]

guys please help

i have installed ocs as per http://wiki.contribs.org/OCS_Inventory on sme 8.1

my problem is getting wan access to ocs

when i do " http://mydyndns.org/ocs " i get an error " https://mydyndns.org/ocs " Forbidden - You don't have permission to access /ocs/ on this server.

please can you assist

[Stefano]

Topic splitted.

Bud, reopening a 3 years old topic is not a good idea..

and telling us "it doesn't work" withour any kind of log/error message is quite useless too

[mmccarn]

If you can access the ocsinventory console from the LAN but not the WAN I'd guess that there is a default 'allow from' in httpd.conf that isn't set as you expect.

Take a look at /etc/httpd/conf/httpd.conf:
* find the section dealing with ocs
* see if there is an 'allow from' declaration
* if there is, find the template fragment that generates the content related to ocs, and see if you need to create a custom template fragment or set a db variable to make changes.

This link may help:
http://wiki.contribs.org/Template_Tutorial#Detailed_generic_troubleshooting_.26_configuration_steps

Before doing that, consider why the developers set default access as they did -- is the access restriction based on SME Server's general 'security first' approach, or are there known security problems with exposing ocsinventory's admin interface to the world (in which case you might want to use an ssh tunnel or a vpn)

Here are some notes on using putty to tunnel into https on your SME server:
http://forums.contribs.org/index.php/topic,39153.msg179103.html#msg179103

[Bud]

Good day Stefano
Sorry to upset you buddy, like i said all is working with ocs from the lan side however i am just having an issue from the wan side.

mmccarn thank you very much for your help, much appreciated

my httpd.conf file ocs section is the following

=============================

<Directory /var/lib/ocsinventory-reports/download>
  Options None
  Options +Indexes
  Options +Includes
  AllowOverride None
  order deny,allow
  deny from all
    allow from 127.0.0.1 192.168.0.0/255.255.255.0
  php_admin_value open_basedir /var/lib/ocsinventory-reports/download:/tmp
</Directory>

<Directory /usr/share/ocsinventory-reports/ocsreports>
  SSLRequireSSL on
  AddType application/x-httpd-php .php .php3 .phtml
  Options None
  Options +Indexes
  Options +Includes
  order deny,allow
  deny from all
  allow from 127.0.0.1 192.168.0.0/255.255.255.0
  php_admin_value open_basedir /usr/share/ocsinventory-reports:/tmp:/var/lib/mysql/mysql.sock:/var/lib/ocsinventory-reports/:/etc/ocsinventory/ocsinventory-reports
  php_admin_value post_max_size 100M
  php_admin_value upload_max_filesize 100M
  php_admin_value memory_limit 100M
  php_value max_execution_time -1
#  php_value max_input_time -1
</Directory>

================================

can i change it to say the following?

<Directory /var/lib/ocsinventory-reports/download>
  Options None
  Options +Indexes
  Options +Includes
  AllowOverride None
  order deny,allow
  deny from all
    allow from all
  php_admin_value open_basedir /var/lib/ocsinventory-reports/download:/tmp
</Directory>

<Directory /usr/share/ocsinventory-reports/ocsreports>
  SSLRequireSSL on
  AddType application/x-httpd-php .php .php3 .phtml
  Options None
  Options +Indexes
  Options +Includes
  order deny,allow
  deny from all
  allow from all
  php_admin_value open_basedir /usr/share/ocsinventory-reports:/tmp:/var/lib/mysql/mysql.sock:/var/lib/ocsinventory-reports/:/etc/ocsinventory/ocsinventory-reports
  php_admin_value post_max_size 100M
  php_admin_value upload_max_filesize 100M
  php_admin_value memory_limit 100M
  php_value max_execution_time -1
#  php_value max_input_time -1
</Directory>

any help greatly appreciated 

[Stefano]

as mmccarn said, opening OCS to wan can be a security issue..

[mmccarn]

You could set 'allow from all', but I'd recommend against it. 

I'm a bit worried about /var/lib/mysql/mysql.sock  in your 'open_basedir' - I can't imagine it's a good idea to have a webapp running that provides remote read/write access to your mysql socket...

[stephdl]

as mmccarn said, opening OCS to wan can be a security issue..

could you consider to allow your lan from the wan with an openvpn access, it is simple, secure and you will not need to trick the ocs contrib http://wiki.contribs.org/OpenVPN_Bridge

but by the way, that ocs contrib is old, but someone has done a howto (in french) to upgrade ocs inventory

https://smeserver.wordpress.com/contribs/ocs/
with some more things interesting
https://smeserver.wordpress.com/contribs/glpi/
https://smeserver.wordpress.com/contribs/ocs-to-glpi/

that could be a good training to upgrade the contrib, if someone wants to start the work.

[stephdl]

that could be a good training to upgrade the contrib, if someone wants to start the work.

as I can see, remi has released some updates to ocsinventory, do they are workable with our smeserver-ocsinventory ????? (use a virtual environment)

ftp://rpmfind.net/linux/remi/enterprise/6/remi/x86_64/ocsinventory-2.1.2-3.el6.remi.noarch.rpm