Best Practical

2010 RT Training Announcement - Bonus RT Training Session in Moscow, Russia!

Best Practical Solutions is happy to announce that this year there will be an additional training session in May 2010, driven by one of our lead RT developers, Ruslan Zakirov. The course will be held in Moscow, Russia and will be given in Russian. For more details, please read below or visit http://request-tracker.ru (in Russian).

Мастер-класс Request Tracker в Москве, Май 2010

Уникальная возможность лучше познакомиться с системой Request Tracker и узнать то, что Вы еще не знаете. В Москве, в мае пройдет мастер-класс. Это возможности из первых рук, от одного из разработчиков системы, получить ответы на интересующие Вас вопросы. Участие в мастер-классе позволит повысить свою квалификацию и успешно справляться с задачами администрирования и расширения RT под нужды вашей компании.

Заполни анкету прямо сейчас. 15го Марта будет известна стоимость (еще есть возможность повлиять на эту цифру), точные даты и место проведения. Все подробности на странице о мероприятии.

RT 3.8.7 Released

We are happy to announce that RT 3.8.7 is now available. You can
download it from:
http://download.bestpractical.com/pub/rt/release/rt-3.8.7.tar.gz
http://download.bestpractical.com/pub/rt/release/rt-3.8.7.tar.gz.sig

SHA1 sums
9de5860c5c58d40c5f6914cdde807ecc66a68f20 rt-3.8.7.tar.gz
3088fb66f6ecbf57f04cd5aba3684645406c120f rt-3.8.7.tar.gz.sig

This is primarily a bugfix release of RT.
Some important fixes are listed here:

• Stop old DateTime or DateTime::Locales from exploding in Preferences
• Move all JS for hierarchical CFs onto derivative field; remove DerivativeCFs method
• Fix bug on Oracle when selecting against a CLOB
• Call the method on the object, not the username string (Reported by Philip Shore)
• Fix error when using WebExternalAuth and setting user info
• When using WebExternalAuth don't issue a new session cookie on each request
• Fix lost attachments when using WebExternalAuth. WebExternalAuthContinuous can be set back to 1
• Mention missing index that was only added to upgrade scripts
• Fixes for PlainTextMono config option introduced in 3.8.6
• Fixes for updating charts and dashboards
• Delete links from Bulk Update

A more complete changelog is available at the rt-announce mailing list archive.

Session Fixation Vulnerability in RT versions before 3.8.6

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In late September, a customer contacted us to report a session fixation
vulnerability in RT 3.8.5 and all earlier versions back to and including
RT 3.0.0.  Over the course of the past month, we've worked to develop
and release a version of RT not vulnerable to this issue as well as a
"hot patch" to earlier versions of RT which eliminates the vulnerability
with minimal code changes.  RT 3.8.6, released on October 19th, is _not_
vulnerable.

We have been assigned CVE number CVE-2009-3585 for this issue.

This issue could allow a malicious attacker who can operate a server in
the same domain (example.com where RT is rt.example.com) to obtain and
redistribute an RT session identifier to an unsuspecting user before
they log into RT.  When that user logs in, the attacker would then be
able to hijack the user's session.

As part of an internal audit of the session handling code, we found and
fixed an additional, related vulnerability which could allow an attacker
with HTTP access to the RT server to construct a similar attack without
the need for a server within the same domain.

If you are using an external auth source (such as apache) you are
not vulnerable to this attack.  This only applies to RT's built-in
$WebExternalAuth setting.  RT-Authen-ExternalAuth does not protect you
from this attack.

I have attached six patches which should cover all vulnerable versions
of RT 3.  RT 3.6.10 will be released later today and will include a
version of this patch.  As mentioned before, RT 3.8.6 is _not_ vulnerable.

The SHA1s of patches are:
38e0a8ce3480807a5dd6cc4da0eb51183382cddd  RT-3.0.0-session_fixation.v3.patch
de22a6e67d7d9d163a392d92530818f3d28e0af2  RT-3.0.1-3.0.6-session_fixation.v3.patch
03fb855a449393ef93db67b800d396bdbfb38a8f  RT-3.0.7-3.6.1-session_fixation.v3.patch
7e5acff213a735894663f63fac90c95089a5e5d1  RT-3.6.2-3.6.3-session_fixation.v3.patch
9c60e647c848e35cea5a6ffe36bdd1f0a355c91f  RT-3.6.4-3.6.9-session_fixation.v2.patch
ada53ca94fdb4db3b185a7e14405d5a9ef76017f  RT-3.8-session_fixation.patch

RT 3.0.0

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.0-session_fixation.v3.patch

RT 3.0.1-3.0.6

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.1-3.0.6-session_fixation.v3.patch

RT 3.0.7-3.6.1

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.0.7-3.6.1-session_fixation.v3.patch


RT 3.6.2-3.6.3

 $ cd /opt/rt3/share
 $ patch -p1 < RT-3.6.2-3.6.3-session_fixation.v3.patch

RT 3.6.4-3.6.9

 $ cd /opt/rt3/share
 $ patch -p1 < RT-3.6.4-3.6.9-session_fixation.v2.patch

RT 3.8.0-3.8.5

 $ cd /opt/rt3/share
 $ patch -p1 < /path/to/RT-3.8-session_fixation.patch

You should then clear your mason cache. If your RT is installed in /opt/rt3, you
would use this command:

 $ rm -rf /opt/rt3/var/mason_data/obj/*

and restart your webserver, this is often accomplished with

 $ /etc/init.d/httpd restart
   (or)
 $ /etc/init.d/apache restart

I apologize for any inconvenience that this issue may have caused you. 
We go to great lengths to make sure that RT is robust and secure, but, 
as with any software, occasionally we do find defects.  We do our best 
to deal with them quickly and responsibly.

I'd like to thank Mikal Gule and the University of Oslo for bringing
this issue to our attention and working with us to triage it and test
the patches included below.  I'd also like to thank Thomas Goetz, who
also brought a variant of this issue to our attention.

If you require assistance evaluating whether your RT deployment is
vulnerable to this issue or deploying the patch, please don't hesitate to
contact us at sales@bestpractical.com.  While we're not able to provide
commercial support without charge, we'll make every effort to provide
help for this issue as quickly and as inexpensively as possible.

Best,

Jesse Vincent
Best Practical
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEUEARECAAYFAksT+WcACgkQEi9d9xCOQEafCwCYpvl6m0W0W/VQnFhzr8jwHdfX
dgCcDO6fi1XudFJc3jKYowci1VoqwxU=
=cI4e
-----END PGP SIGNATURE-----

Download RT-3.0.0-session_fixation.v3

Download RT-3.0.1-3.0.6-session_fixation.v3 

Download RT-3.0.7-3.6.1-session_fixation.v3 

Download RT-3.6.2-3.6.3-session_fixation.v3 

Download RT-3.6.4-3.6.9-session_fixation.v2 

Download RT-3.8-session_fixation

RTIR 2.4.2 Now Available!

Best Practical Solutions is happy to announce that RT for Incident Response (RTIR) 2.4.2 is now available. RTIR is an open-source incident handling system designed for the workflows of CERT and CSIRT teams around the world.

RTIR 2.4 is designed to work with RT 3.8.1 or newer.

You can download it from:
http://download.bestpractical.com/pub/rt/release/RT-IR-2.4.2.tar.gz
http://download.bestpractical.com/pub/rt/release/RT-IR-2.4.2.tar.gz.sig

SHA1 Sums
d3c677a11df65576b34027783e125e9492495d39 RT-IR-2.4.2.tar.gz 7ab221cde2e7ca1519cf96d240ffd0b7657d0045 RT-IR-2.4.2.tar.gz.sig

This release contains a new feature and several bug fixes.

Features

• Use priority widget from RT 3.8.3 in RTIR

Bug Fixes

• Don't set $$skip to zero in SkipTransaction callback as it may conflict with other users of this callback. Just use return and as well check asap if the txn is already skipped.
• Make proper overriding of WebNoAuthRegexp
• Recheck Constituency cache if $const is _none
• Adjust deserialization of IP from value with leading zeroes
• RT::IR::States without Queue argument never worked properly
• Don't show modify user link if user can not modify the user

2010 RT Training Sessions

Best Practical Solutions provides unparalleled instruction in how to get the most out of RT. We've been teaching users and administrators how to get the most out of RT since 2001. Since 2003, we've offered intensive one-day RT administrator training sessions to the general public.

2010 will bring four different training sessions for RT, with training split across two days. The first day starts off with a tour of RT's web interface and continues with a detailed exploration and explanation of RT's functionality, workflows and configurability. We'll touch on basic administration, but concentrate largely on helping you and your team get the most out of your RT instance.

The second day of training picks up with basic RT administration and covers everything from point-and-click configuration to installation of RT, development best practices and database tuning.

It goes without saying that you'll get the most out of training if you attend both days of the course, but we've designed the material so that you can step out after the first day with a dramatically improved understanding of how to use RT or show up on the second day and get quickly up to speed on how to make RT do your bidding.

A spot at either day costs $995 USD for US Training / 695 EUR for European Training. You can save 25% if you attend both days of training. That's just $1495 USD / 1042.50 EUR!

If you reserve before January 20th for the San Francisco session, February 15th for the Dublin session, March 5th for the Boston session, or September 20th for the Washington DC session, you can save an additional 20% by mentioning the discount code BLOG10. If you buy online, we'll automatically apply the discount.

Each class includes a morning snack, coffee/tea, and an afternoon snack, as well as all training materials.

Day 1 - RT User Training

This intensive day-long tutorial about RT starts with basic day-to-day use and continues with detailed training about advanced RT features including saved searches, dashboards, data analysis and options for automating your workflow.

This session will cover:

* The purpose and general use of RT
* New features in RT 3.8
* Saved Searches and customizing searches
* RT's Dashboards feature
* Customizing RT's workflow to match your own
* Automating common procedures
* How to make simple custom reports based on RT's data
* A short intro to RTFM, the RT FAQ Manager
* General Q&A Session

Day 2 - RT Administration and Development

This intensive day-long session aimed at RT administrators and developers covers everything from installation to backups, interface and backend customizations. You'll learn how to customize RT to meet your organization's unique needs and how to make sure that RT stays fast, reliable and flexible.

This session will cover:

* New features in RT 3.8 RT's system architecture
* A guided tour of the RT source code
* Extension mechanisms you can use to customize RT
* RT Installation, including the basics of Configuration
* Examples of how to optimize RT for your organization
* How to tie RT into your existing authentication infrastructure
* Building your own tools that talk to the RT backend
* Customizing RT's workflow to match your own
* Automating common procedures
* How to write custom reports based on RT's data
* Custom coding, modifications, and callback creation
* A brief preview of RT4
* General Q&A Session

These sessions will be offered in:

San Francisco, CA, USA - February 22 & 23 2010
Dublin, Ireland - March 15 & 16 2010
Boston, MA, USA - April 5 & 6 2010
Washington DC, USA - Oct 25 & 26 2010

If you can't make it to these cities, please drop us a line to request a public training in your area. We haven't yet scheduled training for 2011; your feedback will help us decide where to offer additional sessions.

Private Training
We also offer private training sessions tailored to your organization's needs. For more information about on-site training for your organization, please drop us a line at training@bestpractical.com.

Reservations
We like to keep class sizes relatively intimate. Please register soon or we may not be able to guarantee you a seat.

When you register, please tell us which date(s) you are registering for, and whether you'd like to register for the whole training session or for only a single day.

If you'd like to pay via credit card, please visit Best Practical's online store at https://shop.bestpractical.com/

If you'd prefer to reserve a seat and have us bill you, please write to us at training@bestpractical.com. Be sure to include the full names and email addresses of all attendees you'd like to register for training.

RT 3.8.6 is now available

Best Practical Solutions is happy to announce the release of RT 3.8.6.

For complete instructions on how to install and download this RT release, please read this rt-users mailing list post.

This release contains numerous bug fixes and performance enhancements, as well as a few new features.

Please read UPGRADING for notes on some database updates and how to upgrade your old Custom Field Categories to the new Hierarchical Custom Field system.

Significant changes include:

• A new Hierarchical Custom Field system.
• Performance improvements in the spreadsheet export.
• With the optional Parse::BooleanLogic, we've added better support for Custom Fields in the export.
• Forward all responses to a ticket, rather than just a single transaction.
• Bugfixes for comboboxes and hierarchical custom fields in IE.
• Better error messages when unprivileged users attempt to access administrative areas.
• Complete refactor of autohandler (code that handles Login) (Compatible with RT::Authen::ExternalAuth 0.08).
• Performance improvements when displaying pages with many different users (ticket history, search results).
• Two small memory leak fixes in the Query Builder and html parsing.
• Shredder bugfixes and the ability to limit shredding to users in a particular group using the member_of option.
• New PlainTextMono config option (display wrapped and formatted plain text attachments) that uses css to show history in a monospaced font but still force wrapping (unlike PlainTextPre).
• Display fix for tickets with non-ascii characters in the Subject.

A more complete changelog is available at the above link. Thanks to everyone who helped out by voting and helping to automate the changelog creation for this release!

Net::Google::Code - now with support for Google's Issues API

The Google Code team just announced API support for Google Code Issues. I'm pleased to report that Net::Google::Code, our Perl module for Google Code now has beta-quality support for the Issues API.

If you're interested in trying out (and reporting bugs in) the new code right this minute, grab a copy from the repository.  Once we've put the new code through its paces, we'll merge it back to the master branch and push a new release to CPAN.

We wrote Net::Google::Code (and Net::Trac and Net::Lighthouse) to support SD, our peer-to-peer disconnected issue tracking system. SD lets you take your Google Code (or Trac, Lighthouse, Redmine, RT or Hiveminder) tickets offline, work on them and later synchronize with your upstream issue tracker.

If you're interested in trying out SD and are using Mac OS X or Linux, you can build and install it into ~/sd/bin/sd by running:

         curl http://fsck.com/sd|perl

Right now, SD doesn't yet take advantage of the API announced today. We're very much looking forward to fixing that over the next few days.

Congrats (and thanks) to Jacob, Ali and the rest of the rest of the Google Code team! I'm really excited to see Google Code becoming easier to work with programmatically.  

Jifty's Request Inspector

We're experimenting with mirroring technical articles written by Best Practical engineers. This article is about a component of Jifty, our web framework.

Jifty's RequestInspector plugin provides you with debugging information for HTTP requests. You can examine the SQL queries that were issued in servicing the request, inspect a Devel::NYTProf profile of the request, and more. The information is presented in an (admittedly ugly) admin panel. Here's what our Changelogger's request inspector page looks like:

If we click into one of the requests, we can get an overview of that request.

We can inspect in detail a particular part of a request with another click.

Backend

The frontend is good enough. It gets the job done. But what I am really interested in, and what I had far more fun creating, is the backend that powers this.

RequestInspector is a Jifty plugin. Its job is to manage all of the other plugins that inspect requests (such as SQLQueries, DumpRequestResponse, NYTProf, and Gladiator). RequestInspector informs the plugins of interesting events such as: a new request is beginning, that request finished.

Each plugin produces various kinds of data. That data is completely opaque to RequestInspector. The data can be an object, a number, a code reference, or whatever else. All RequestInspector does is keep track of that data, handing the data to the plugin when it needs to do something with the data.

When a new request begins, RequestInspector calls the inspect_before_request method on each plugin. When the request ends, inspect_after_request is called on each plugin. The interesting bit is that the opaque data is threaded between the return values and parameters of these methods. The return value of inspect_before_request is passed to that plugin's inspect_after_request. inspect_after_request's return value is stored for later rendering. (In what amounts to a global variable — sorry!)

When the user wants to see a request, RequestInspector calls the inspect_render_summary method on each plugin. When the user wants to see the detailed analysis by a particular plugin for a particular request, RequestInspector calls the inspect_render_analysis method on that plugin. It is completely up to the plugin to decide what to render. Both methods receive the data it returned from inspect_after_request for that request.

Benefits

You might wonder why this design is better than, say, a specific data format to which each plugin must adhere.

It is unclear what such a data format would look like. I don't think a single data format could usefully encompass the different kinds of data that these plugins produce. While SQLQueries's data is complex data structure with a lot of information, NYTProf's is basically just a random number used to track the on-disk profile directory.

The format would certainly evolve over time. This means that plugins would have to change as well just to keep up with RequestInspector. With my design, plugins really only need to change when they want to support newer RequestInspector features.

It's simpler for plugins to let them dictate how they want to store whatever they are tracking. It's simpler for the RequestInspector core too, since it is free from having to examine the plugins' data.

Finally, the RequestInspector plugin can get arbitrarily complex and the plugins do not have to care about it. The RequestInspector already lets you filter out URLs you know you will not want to inspect. The individual request inspector plugins do not have to implement that functionality.

In the future, I plan to add a feature to RequestInspector that lets you see which requests took the most amount of database time, or leaked the most amount of memory, etc. All the feature will require of plugins is that they implement an optional inspect_compare_requests method. The method will receive that plugin's data from two requests and returns -1, 0, or 1. So trivial that I should just do it now.. :)

Basically, RequestInspector leverages the Principle of Least Knowledge to keep things simple, easy, and flexible. Shriram Krishnamurthi's Moby Scheme Compiler talk was particularly influential on this design. He described a similar (though simpler) system that he uses to make programming fun and interesting for middle school kids.

RT 3.8.5 Now Available!

RT 3.8.5 is now available. This is a bugfix and security release of RT.

For a description of the bugfix for as well as instructions on how to download and install the patch for 3.8.5, please read this rt-announce mailing list post.

RT 3.6.9 Now Available!

RT 3.6.9 is now available. This is a bugfix and security release of RT.

For a description of the bugfix for as well as instructions on how to download and install the patch for 3.6.9, please read this rt-announce mailing list post.