ZoneMinder Forums

Hey all,

I just got ZoneMinder working (with a WebCam via MJPG_Streamer & Cambozola) last night. I can now click on a Monitor on the ZoneMinder console which pops up a new window showing my feed. After a couple minutes the feed stops updating & I have to refresh (F5) the page.

I believe the issue occurs in conjuction with the following error Does anyone have any idea on what the problem is here?

FYI: I get quite a few warnings (about 1 per second) showing:

Do you have authentication enabled? If so, change AUTH_RELAY to plain and see if the issue persists. AUTH_RELAY can be found in the options page on the System tab

Thanks for the advice, I will try that. I found the same suggestion (although not from quite the same symptom) in this bug report

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=666980

It looks like switching to PLAIN or NONE has some security risks associated with it. Can you enlighten me on these and comment on whether or not there is a way to mitigate such issues?

Thanks,
Sean

Yes of course, plain text simply means that your user credentials are passed in the clear with no encryption. These requests are within the HTTP URI which anyone can see with a packet sniffer. None means there is no authentication between your request and the process on the server, which is going to allow for any requests sent to be interpreted by the daemon as a valid request. Thus, none is the worse solution as there could be a vulnerability exploit on your server. Hash is by far the best choice for security because your user credentials are encrypted, but since the hash is time sensitive it needs to be renewed, and your front end is not renewing this key and times out hence why you are seeing the stream stop. Security is only needed if your server is directly accessible from the internet. Please keep in mind, the back end is still processing the images from your camera, it is merely your front end that is not refreshing the stream. Modect, Mocord and Record will still function as documented. One thing I have read and have had not had a chance to experiment with is the auth string. This would be the AUTH_HASH_SECRET in the options configuration. For example, lets say I wanted to view a camera of mine, the usual url (with hash) is:
If you notice the auth, connkey and rand, these are the hashes used to connect to your camera to provide a secure exchange of the user credentials. This will time out eventually, but if I change the URI to:
Just replace MYSECURITYSTRING with the value of AUTH_HASH_SECRET


I need to point out that the security functions work, what appears to be broken is the refresh of the hash strings after a certain time period. If you are using firefox, you may want to try a number of addons that auto refresh a page, that may work as well.

Side note: I did read that bug report and it appears valid. Time expires on the hash string and the socket is closed. There does not appear to be a function to have the feed move from one socket to the next, it must be validated first. I would say this is anticipated, holding a socket open could be a security risk. A new request must be generated for a new socket to be opened. I would say this is not a bug but thats just me...

Thanks for the info.

I'll need to reread it and do some experimentation when I get home.

All in all, this "issue" sounds like a bug in the Zoneminder system. Is there any inertia to fix this so that Hashed user data doesn't cause problems?

Sean

I switched AUTH_RELAY to "plain" which caused me to get a failure to authenticate error.

I then switched AUTH_RELAY to "none" but found that the feed (frontend) locked up with the same timeout error.

It appears (so far) that "none" and "hashed" behave the same way (regarding this error).

Thanks,
Sean