Mail.log 403 Forbidden

Hi, folks.

What does 403 Forbidden mean in this log?

Jan 26 17:26:43 rtracker postfix/smtpd[2263]: connect from
kliper.pop-sp.rnp.br[200.133.192.62]
Jan 26 17:26:44 rtracker postfix/smtpd[2263]: 0C43224FC1:
client=kliper.pop-sp.rnp.br[200.133.192.62]
Jan 26 17:26:44 rtracker postfix/cleanup[2268]: 0C43224FC1:
message-id=4B5F41D2.5060807@pop-sp.rnp.br
Jan 26 17:26:44 rtracker postfix/qmgr[2112]: 0C43224FC1:
from=wpereira@pop-sp.rnp.br, size=762, nrcpt=1 (queue active)
Jan 26 17:26:45 rtracker postfix/local[2269]: 0C43224FC1:
to=rt@rtracker.rt.pop-sp.rnp.br, relay=local, delay=1,
delays=0.05/0.01/0/0.98, dsn=4.3.0, status=deferred (temporary failure.
Command output: Connecting to
https://rtracker.rt.pop-sp.rnp.br/rt//REST/1.0/NoAuth/mail-gateway at
/usr/bin/rt-mailgate-3.6 line 102, <> line 1. An Error Occurred
================= 403 Forbidden This is /usr/bin/rt-mailgate-3.6
exiting because of an undefined server error at /usr/bin/rt-mailgate-3.6
line 150, <> line 1. )
Jan 26 17:26:45 rtracker postfix/qmgr[2112]: 0C43224FC1:
from=wpereira@pop-sp.rnp.br, size=762, nrcpt=1 (queue active)
Jan 26 17:26:45 rtracker postfix/local[2269]: 0C43224FC1:
to=rt@rtracker.rt.pop-sp.rnp.br, relay=local, delay=1.3,
delays=1.1/0/0/0.25, dsn=4.3.0, status=deferred (temporary failure.
Command output: Connecting to
https://rtracker.rt.pop-sp.rnp.br/rt//REST/1.0/NoAuth/mail-gateway at
/usr/bin/rt-mailgate-3.6 line 102, <> line 1. An Error Occurred
================= 403 Forbidden This is /usr/bin/rt-mailgate-3.6
exiting because of an undefined server error at /usr/bin/rt-mailgate-3.6
line 150, <> line 1. )
Jan 26 17:27:44 rtracker postfix/smtpd[2263]: disconnect from
kliper.pop-sp.rnp.br[200.133.192.62]

Wagner Pereira

PoP-SP/RNP - Ponto de Presen�a da RNP em S�o Paulo
CCE/USP - Centro de Computa��o Eletr�nica da Universidade de S�o Paulo
http://www.pop-sp.rnp.br
Tel. (11) 3091-8901

Does anyone have a link that will let me know if I can go from 3.4.4 to 3.8.4 directly? System is Ubuntu v6.06 LTS + Postgresql 7.4

Also any advice about moving from Postgresql to Mysql either before or after the upgrade?

Thanks!
-TM

Does anyone have a link that will let me know if I can go from 3.4.4 to 3.8.4 directly? System is Ubuntu v6.06 LTS + Postgresql 7.4

Also any advice about moving from Postgresql to Mysql either before or after the upgrade?

Thanks!
-TM

Hi Tim,

We went from 3.4.5pre1 to 3.8.5, RHEL3 -> RHEL5, PostgreSQL 7.4 ->
PostgreSQL 8.4. It went pretty smoothly following the documented
upgrade steps. The more tedious part was double checking any local
modifications to validate whether they were still needed and to
be certain that the functionality still worked post upgrade.

Moving from PostgreSQL -> MySQL will need a little bit more work.
I think that there is a wiki article and possibly some tools to
help with this process. I do have a question for you. Why are you
moving from PostgreSQL to MySQL instead of updating to the current
PostgreSQL release? For one thing, PostgreSQL will allow you to
use full text indexing to dramatically improve the performance of
full content searching within your tickets and RTFM articles.
This functionality is also available with the Oracle backend. Is
there some problem you are trying to address?

Cheers,
Ken

Moving from PostgreSQL -> MySQL will need a little bit more work.
I think that there is a wiki article and possibly some tools to
help with this process. I do have a question for you. Why are you
moving from PostgreSQL to MySQL instead of updating to the current
PostgreSQL release? For one thing, PostgreSQL will allow you to
use full text indexing to dramatically improve the performance of
full content searching within your tickets and RTFM articles.
This functionality is also available with the Oracle backend. Is
there some problem you are trying to address?

Just to note that I assume you’re talking about
http://wiki.bestpractical.com/view/PostgreSQLFullText which isn’t
a standard part of RT yet; I wondered for a while after reading your
message whether I’d missed something!

It’s a shame that the API for SearchBuilder isn’t such that you can
configure to treat certain columns as full-text-searchable ones rather
than have to manually hack it in; makes deployment a little more
fiddly.

But thanks for mentioning it because I didn’t realise that this work
had been done and it’s something we’re interested in!

Dominic Hargreaves, Systems Development and Support Team
Computing Services, University of Oxford

signature.asc (197 Bytes)

Moving from PostgreSQL -> MySQL will need a little bit more work.
I think that there is a wiki article and possibly some tools to
help with this process. I do have a question for you. Why are you
moving from PostgreSQL to MySQL instead of updating to the current
PostgreSQL release? For one thing, PostgreSQL will allow you to
use full text indexing to dramatically improve the performance of
full content searching within your tickets and RTFM articles.
This functionality is also available with the Oracle backend. Is
there some problem you are trying to address?

Just to note that I assume you’re talking about
http://wiki.bestpractical.com/view/PostgreSQLFullText which isn’t
a standard part of RT yet; I wondered for a while after reading your
message whether I’d missed something!

It’s a shame that the API for SearchBuilder isn’t such that you can
configure to treat certain columns as full-text-searchable ones rather
than have to manually hack it in; makes deployment a little more
fiddly.

But thanks for mentioning it because I didn’t realise that this work
had been done and it’s something we’re interested in!


Dominic Hargreaves, Systems Development and Support Team
Computing Services, University of Oxford

Hi Dominic,

Yes, that is patch. I actually wrote it based on the Oracle
patch that is also in the wiki. If you take a look, the patch
is almost ridiculously simply and changes next to nothing in
the code because I could leverage the fact that creating a
full text search query cleaned up the strings without the need
to do it in the RT code base. We run it here and it is worth
its weight in gold the first time several users issue a fulltext
search simultaneously on anything but the smallest database. I
suspect that it is not in the default RT because it is not
globally available on all backends. To support that, they would
need to stitch in some other search engine to support those
functions – a much, much more complicated option both in lines
of code to write and support. As far as “fiddly” goes, many
other pieces of a base RT install were way more so than the
full text search piece. :slight_smile:

Regards,
Ken

Just to note that I assume you’re talking about
http://wiki.bestpractical.com/view/PostgreSQLFullText which isn’t
a standard part of RT yet; I wondered for a while after reading your
message whether I’d missed something!

It’s a shame that the API for SearchBuilder isn’t such that you can
configure to treat certain columns as full-text-searchable ones rather
than have to manually hack it in; makes deployment a little more
fiddly.

But thanks for mentioning it because I didn’t realise that this work
had been done and it’s something we’re interested in!

Yes, that is patch. I actually wrote it based on the Oracle
patch that is also in the wiki. If you take a look, the patch
is almost ridiculously simply and changes next to nothing in
the code because I could leverage the fact that creating a
full text search query cleaned up the strings without the need
to do it in the RT code base. We run it here and it is worth
its weight in gold the first time several users issue a fulltext
search simultaneously on anything but the smallest database. I
suspect that it is not in the default RT because it is not
globally available on all backends. To support that, they would
need to stitch in some other search engine to support those
functions – a much, much more complicated option both in lines
of code to write and support. As far as “fiddly” goes, many
other pieces of a base RT install were way more so than the
full text search piece. :slight_smile:

Indeed. In some senses it is a small change, but my general concern
is that it is changing the behaviour in a supposedly general
library to behave specially if a particular table name is encountered.
Since we run multiple RT instances using a common software deployment
infrastructure (all our software is installed as Debian packages, even
where local modifications have been made) we like to reduce the
occurrence of this sort of thing as much as possible.

I don’t agree with your assertion that an FTS search engine would have
to be put in place to deal with other database types; the functionality
would just vary between databases. It would probably also want to be an
opt-in configuration option.

It’s non-trivial to cleanly integrate either way, but it’s an
interesting area. We have some user demand for this so the next time
we review our services internally it may be that we can put some
resources into going in that direction (if, indeed, Best Practical
don’t already have any drivers in that area).

Dominic.

Dominic Hargreaves, Systems Development and Support Team
Computing Services, University of Oxford

signature.asc (197 Bytes)

Just to note that I assume you’re talking about
http://wiki.bestpractical.com/view/PostgreSQLFullText which isn’t
a standard part of RT yet; I wondered for a while after reading your
message whether I’d missed something!

It’s a shame that the API for SearchBuilder isn’t such that you can
configure to treat certain columns as full-text-searchable ones rather
than have to manually hack it in; makes deployment a little more
fiddly.

But thanks for mentioning it because I didn’t realise that this work
had been done and it’s something we’re interested in!

Yes, that is patch. I actually wrote it based on the Oracle
patch that is also in the wiki. If you take a look, the patch
is almost ridiculously simply and changes next to nothing in
the code because I could leverage the fact that creating a
full text search query cleaned up the strings without the need
to do it in the RT code base. We run it here and it is worth
its weight in gold the first time several users issue a fulltext
search simultaneously on anything but the smallest database. I
suspect that it is not in the default RT because it is not
globally available on all backends. To support that, they would
need to stitch in some other search engine to support those
functions – a much, much more complicated option both in lines
of code to write and support. As far as “fiddly” goes, many
other pieces of a base RT install were way more so than the
full text search piece. :slight_smile:

Indeed. In some senses it is a small change, but my general concern
is that it is changing the behaviour in a supposedly general
library to behave specially if a particular table name is encountered.
Since we run multiple RT instances using a common software deployment
infrastructure (all our software is installed as Debian packages, even
where local modifications have been made) we like to reduce the
occurrence of this sort of thing as much as possible.

That is reasonable. I made some trade-offs in my patch that could
be revisited if others were interested in modularizing the functionality.

I don’t agree with your assertion that an FTS search engine would have
to be put in place to deal with other database types; the functionality
would just vary between databases. It would probably also want to be an
opt-in configuration option.

I agree that using database specific functions for FTS would work,
unfortunately not all backends support FTS which was why I suggested
that an external search engine would be needed. I think an opt-in
configuration would be the way to go. I submitted my patch in the
vein of the Oracle patch to try and add a base for Best Practical
to draw on should they move in that direction.

It’s non-trivial to cleanly integrate either way, but it’s an
interesting area. We have some user demand for this so the next time
we review our services internally it may be that we can put some
resources into going in that direction (if, indeed, Best Practical
don’t already have any drivers in that area).

Dominic.

That would be cool.

Regards,
Ken

What does 403 Forbidden mean in this log?

Command output: Connecting to
https://rtracker.rt.pop-sp.rnp.br/rt//REST/1.0/NoAuth/mail-gateway at
/usr/bin/rt-mailgate-3.6 line 102, <> line 1. An Error Occurred
================= 403 Forbidden This is /usr/bin/rt-mailgate-3.6
exiting because of an undefined server error at /usr/bin/rt-mailgate-3.6
line 150, <> line 1. )

HTTP code 403 means ‘permission denied’ – you’re trying to access an
URL that’s not within the web tree the server is configured to serve.

If you look in the Apache error log it probably says something along
the lines of ‘client denied due to server configuration’.

I suspect the problem may be the double slash here:

https://rtracker.rt.pop-sp.rnp.br/rt//REST/1.0/NoAuth/mail-gateway
^^^
You should be able to paste that URL into a web browser and test the
effect of editing that pretty easily. You probably won’t get anything
displayed in the browser, but look at the Apache log files to see if
you get a 2xx or 301 HTTP code (ie Success!)

Then its a matter of finding where in the RT configuration you’ve got
an excess ‘/’ character.

Cheers,

Matthew

Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW

Matthew,

Yes, I am already able to access the RT via web interface:
https://rtracker.rt.pop-sp.rnp.br/rt/

That’s interesting: when I try to access
https://rtracker.rt.pop-sp.rnp.br/rt/REST/1.0

I get:

RT/3.6.7 401 Credentials required

But, listen: this Best Practical REST’s page seems very geek to me!
Sincerely, I am not sure if I can do something of that. : (

Thank you a lot.

Wagner Pereira

PoP-SP/RNP - Ponto de Presen�a da RNP em S�o Paulo
CCE/USP - Centro de Computa��o Eletr�nica da Universidade de S�o Paulo
http://www.pop-sp.rnp.br
Tel. (11) 3091-8901

Matthew Seaman escreveu:> On 28/01/2010 12:14, Wagner Pereira wrote:

Matthew,

I tried to change the /usr/local/bin/rt-mailgate-3.6 line 102,
eliminating the slash before REST, in line #102, but it is still the
same thing. The same log.

OK. Can you access your RT instance via a web browser in the normal
way?

What happens if you try following the instructions at the top of
http://wiki.bestpractical.com/view/REST ? ie. Go to:

https://rtracker.rt.pop-sp.rnp.br/rt/REST/1.0

Cheers,

Matthew

PS. Can you keep the rt-users mailing list in the loop please? It’s to
your advantage as there will be more people potentially able to help.

Matthew,

Yes, I am already able to access the RT via web interface:
https://rtracker.rt.pop-sp.rnp.br/rt/

That’s interesting: when I try to access
https://rtracker.rt.pop-sp.rnp.br/rt/REST/1.0

I get:

RT/3.6.7 401 Credentials required

Uh, yes. You should go to https://rtracker.rt.pop-sp.rnp.br/rt/ and log
in as usual, then edit the URL bar to go to
https://rtracker.rt.pop-sp.rnp.br/rt/REST/1.0

But, listen: this Best Practical REST’s page seems very geek to me!
Sincerely, I am not sure if I can do something of that. : (

Ah. Is the REST interface what you actually want then? It’s designed
for people to write programs that interact with RT, which does imply a
certain degree of “geek”.

Cheers,

Matthew

Dr Matthew J Seaman MA, D.Phil. 7 Priory Courtyard
Flat 3
PGP: http://www.infracaninophile.co.uk/pgpkey Ramsgate
Kent, CT11 9PW

Dr. Matthew, from Black Earth Consulting : )

Now I’ve made that:

You should go to https://rtracker.rt.pop-sp.rnp.br/rt/ and log in as
usual, then edit the URL bar to go to
https://rtracker.rt.pop-sp.rnp.br/rt/REST/1.0

And I obtained this:

RT/3.6.7 200 Ok

Invalid object specification: ‘’

id:

What does this suggest me?

Wagner Pereira

PoP-SP/RNP - Ponto de Presen�a da RNP em S�o Paulo
CCE/USP - Centro de Computa��o Eletr�nica da Universidade de S�o Paulo
http://www.pop-sp.rnp.br
Tel. (11) 3091-8901

Matthew Seaman escreveu:> On 28/01/2010 13:01, Wagner Pereira wrote:

Matthew,

Yes, I am already able to access the RT via web interface:
https://rtracker.rt.pop-sp.rnp.br/rt/

That’s interesting: when I try to access
https://rtracker.rt.pop-sp.rnp.br/rt/REST/1.0

I get:

RT/3.6.7 401 Credentials required

Uh, yes. You should go to https://rtracker.rt.pop-sp.rnp.br/rt/ and log
in as usual, then edit the URL bar to go to
https://rtracker.rt.pop-sp.rnp.br/rt/REST/1.0

But, listen: this Best Practical REST’s page seems very geek to me!
Sincerely, I am not sure if I can do something of that. : (

Ah. Is the REST interface what you actually want then? It’s designed
for people to write programs that interact with RT, which does imply a
certain degree of “geek”.

Cheers,

Matthew