Re: MSP Thin Rails permission issue

[HD Moore <hdm () metasploit com>]

On 11/7/2011 1:30 PM, RDD IT wrote:
> I dug around for awhile and it looks like the following error
> in apps/pro/ui/log/thin.log may be related:
> > > Writing PID to log/thin.pid
> > > Using rails adapter
> > > Exiting!
> /opt/metasploit-4.1.2/ruby/lib/ruby/gems/1.9.1/gems/rails-2.3.5/lib/initializer.rb:902:in
> `read': Permission denied -
> /opt/metasploit-4.1.2/apps/pro/ui/config/database.yml (Errno::EACCES)
>
> I've run all commands as root, so file/directory permissions should not
> be an issue. 

> Does this suggest that the database credentials in database.yml file
> don't align with those created in the postgres install process? Any
> suggestions?

Thanks for the report. We run the "thin" service as a non-root user;
somehow the permissions were modified so that this service can no longer
read the database configuration file. Can you double check and make sure
the 'daemon' user has read access to this file?

The files that 'daemon' should own include:


root@cronus:/opt/metasploit-4.1.3# find . -uid 1
./apps/pro/loot
./apps/pro/ui/scripts
./apps/pro/ui/scripts/ctl.rb
./apps/pro/ui/scripts/ctl.sh
./apps/pro/ui/log
./apps/pro/ui/log/thin.log
./apps/pro/ui/log/production.log
./apps/pro/ui/log/thin.pid
./apps/pro/ui/tmp
./apps/pro/ui/tmp/cache
./apps/pro/ui/tmp/sessions
./apps/pro/ui/tmp/sockets
./apps/pro/ui/tmp/pids
./apps/pro/tasks
./apps/pro/reports
./apps/pro/reports/msfx_loot_texts.jrxml
./apps/pro/reports/msfxv3_webapp_details.jasper
./apps/pro/reports/msfx_services.jrxml
./apps/pro/reports/msfx_fismav1_subreport_hosts.jasper
./apps/pro/reports/msfx_loot.jrxml
./apps/pro/reports/msfxv3_webapp_detail_pages.jrxml
./apps/pro/reports/msfxv3_detail_tags.jasper
./apps/pro/reports/pass.png
./apps/pro/reports/msfxv3_details.jasper
./apps/pro/reports/msfxv3_webapp_detail_vulns.jrxml
./apps/pro/reports/msfx-simple.jrxml
./apps/pro/reports/msfxv3_webapp_detail_forms.jrxml
./apps/pro/reports/msfxv3_detail_services.jasper
./apps/pro/reports/msfx_campaigns_details_web.jrxml
./apps/pro/reports/msfx_pciv1.jasper
./apps/pro/reports/msfx_loot_images.jasper
./apps/pro/reports/msfxv3_detail_sessions.jrxml
./apps/pro/reports/logoExpLargeBlack.png
./apps/pro/reports/msfx_actv1.jrxml
./apps/pro/reports/msfxv3_webapp_detail_forms.jasper
./apps/pro/reports/msfxv3_detail_services.jrxml
./apps/pro/reports/msfxv3_detail_web.jasper
./apps/pro/reports/msfxv3_webapp.jrxml
./apps/pro/reports/msfxv3_detail_creds.jrxml
./apps/pro/reports/msfx_pciv1_subreport_hosts.jrxml
./apps/pro/reports/msfxv3_webapp_details.jrxml
./apps/pro/reports/msfxv3_detail_session_events.jrxml
./apps/pro/reports/msfx_compromised_vulns_table.jasper
./apps/pro/reports/msfxv3.jrxml
./apps/pro/reports/msfx_actv1.jasper
./apps/pro/reports/msfx_auth_tokens.jrxml
./apps/pro/reports/msfx_fismav1.jasper
./apps/pro/reports/logoProLargeBlack.png
./apps/pro/reports/msfx_campaigns_details.jasper
./apps/pro/reports/msfx_pciv1.jrxml
./apps/pro/reports/msfxv3_detail_exploits.jasper
./apps/pro/reports/msfxv3_detail_vulns.jasper
./apps/pro/reports/rapid7_logo_padded.jpg
./apps/pro/reports/msfxv3_detail_sessions.jasper
./apps/pro/reports/msfx_compromised_vulns_table.jrxml
./apps/pro/reports/msfxv3_webapp_detail_vulns.jasper
./apps/pro/reports/msfx_pciv1_subreport_hosts.jasper
./apps/pro/reports/msfx_loot_images.jrxml
./apps/pro/reports/msfx_campaigns_details_targets.jrxml
./apps/pro/reports/msfxv3_detail_tags.jrxml
./apps/pro/reports/msfxv3_detail_exploits.jrxml
./apps/pro/reports/msfx_compromised_hosts.jrxml
./apps/pro/reports/msfxv3_compromised_hosts_table.jasper
./apps/pro/reports/msfx_campaigns_details_targets.jasper
./apps/pro/reports/msfx_loot_texts.jasper
./apps/pro/reports/msfx_fismav1_subreport_hosts.jrxml
./apps/pro/reports/msfx_campaigns_details_email.jrxml
./apps/pro/reports/msfxv3_detail_web.jrxml
./apps/pro/reports/msfxv3_compromised_hosts_table.jrxml
./apps/pro/reports/fail.png
./apps/pro/reports/msfxv3_detail_creds.jasper
./apps/pro/reports/msfxv3_details.jrxml
./apps/pro/reports/msfx_campaigns_details_email.jasper
./apps/pro/reports/msfx_campaigns.jrxml
./apps/pro/reports/msfxv3_detail_vulns.jrxml
./apps/pro/reports/msfx_campaigns_details.jrxml
./apps/pro/reports/msfxv3_detail_session_events.jasper
./apps/pro/reports/msfx_fismav1.jrxml
./apps/pro/reports/msfxv3_webapp_detail_pages.jasper
./apps/pro/reports/msfx_campaigns_details_web.jasper
./apps/pro/export

_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework