Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[neustadt]

Yuhoo, it works!

I was just typing the new post in amule help forum, and rereading the wiki. This time, I gave the notes section more attention removed the remote.conf, as "sugessted" in Note2. And there we go! (nice new frontend btw)

I still wonder about the no password for webserver thing, though. Im 100% sure, that I did not have to type a password on the loginscreen. Nor did I used a saved password by my browser. I know because I used to login from different PCs on our LAN.
Maybe I used the md5sum for space, which equals nothing.

Code: [Select]

echo -n   | md5sum | cut -d ' ' -f 1
d41d8cd98f00b204e9800998ecf8427eBut this doesn't seem to work with 2.1 anymore.
I guess I will unzip my dd /dev/hda image and look for that config file.  

Anyways, thanks for help and whising me good luck. <- That must have been it!  

[MiniMe]

You're welcome

 And to confuse you just a little bit more: for me it works with exactly the same setup I recommended above. Even with the remote.conf (although I don't need it cause amuleweb is started automatically).

cu

[thedude0001]

Well, the fact that you could log into amuleweb without a password on 2.0.3 was a bug, not a feature. And as we try to do it with bugs it was killed ^^

[neustadt]

Reminds me of that old MS joke: "It's a feature not a bug!"

But why must there be a password? My firewall doesn't allow any connections on port 4711, so its not insecure. On the other hand allowing a one letter password for internet connections is very insecure. (I'm asuming it works with only one letter, because my 4 letter password works, which is still quite insecure)
I'd say if amule wants to provide serious security it should allow only 6+ letter passwords, with numbers in it. (Don't know if this is even enough today. I am no crypto guy.)
But allow no passwords for people who don't need it.
To avoid out of the box, no password amule's out there waiting to get abused, one could add a NoPassword flag, which is by default disabled.

ADD:
Btw. In what file are amule's statistics stored? Mine are gone after the upgrade. Can I use a backup of an 2.0.3 file?

[thedude0001]

Well, that's a matter of opinion. The point was that amuleweb let the user login without password in it's default configuration. That should never happen as it is prone to cause some kind of desaster somewhere. We changed that behaviour so users need to set a password to be able to start amuleweb. Once the user is aware of that fact it can't be our responsibility to force n+ letter passwords on him with a cracklib check etc. THAT is a decision each user has to make for himself. We wanted to prevent *accidentially* running amuleweb without password.

amule stats are saven in ~/.aMule/amule.conf (along with all other configuration). It's safe to copy the statistics information into the new file after shutting down amule. It's also safe just to copy the whole file, though it will reset most of your preferences ^^

[neustadt]

We wanted to prevent *accidentially* running amuleweb without password.

Sure I see your point.
But how about allowing NoPassword by flag or allowing the d41d8cd98f00b204e9800998ecf8427e md5sum. Is this hard to implement?
Do you have a bugtracking system so I can add this as a whislist? If this whish has any chances at all.
It would be quite nice in my environment.

[thedude0001]

We sure have a bugtracker at http://bugs.amule.org, you're welcome to add this wishlist item there. I don't think it should be too hard to implement, but then again I'm not much of a coder ^^