Replies: 7 comments 18 replies
-
|
is Blazam docker available? |
Beta Was this translation helpful? Give feedback.
-
|
Much of the code relies on Windows to operate. I've never tried using anything other than Windows with IIS or as the service. I'm not 100% sure, but I believe there would have to be some additional Active Directory functionality written directly within Blazam to be able to run under linux. I've wanted to create some type of containerized version of the app, but I'm not sure that would make running under linux any easier. It's something I can look in to. See if it's technically possible, what kind of code shift would be needed to reach that... etc. |
Beta Was this translation helpful? Give feedback.
-
|
Fairly simple and quick install on Ubuntu server connecting to an existing DB (need to figure out a permission issue with binding to network ports or reverse proxy it through nginx or apache)... looks like everything works, other than connecting to Active Directory, as expected, due to code incompatibility... Will play around with seeing how difficult a core AD code rewrite would be to make it compatible on both platforms. |
Beta Was this translation helpful? Give feedback.
-
|
I've successfully tested password resets using linux compatible code. This is a solid proof of concept as it is one of the more challenging implementations with AD... I would also want to check nested group membership checks and searching (although there is little change expected regarding search). The biggest hurdle will be recreating the Microsoft code that represents AD objects within Blazam while keeping a level of optimization on par with the Microsoft code. Not a trivial task... I will continue to test in an effort to estimate the total workload of converting the entire codebase to linux compatible code. |
Beta Was this translation helpful? Give feedback.
-
|
This is looking like maybe a week or two of development. I'm giving it the green light for at least a beta... |
Beta Was this translation helpful? Give feedback.
-
|
I should clarify, it's a week or two of straight coding, not that it will be ready in a week or two. |
Beta Was this translation helpful? Give feedback.
-
|
I have successfully tested remote pc data collection using Powershell in code, which should be Linux compatible. The last few test I see are AD authentication for Blazam logon, and the various uses of Windows impersonation to run certain code as the provided AD "admin" account (eg: file share check, live remote user session view and management). Impersonation is not going to be available on Linux, so some of those features might only be available when Blazam in installed on Windows. If all that is proven, the migration of Active Directory Object interaction code can continue it's path to Linux compatible code. This will be the bulk of the work to be done. And is what will take ~65 more hours to complete. |
Beta Was this translation helpful? Give feedback.
-
|
waahhh,, thank you so much for your respons. since I am not fully understand with IIS, I am trying to user Blazam service, but I just stuck on this process when access the ip address from web browser. here is my {
"Logging": {
"LogLevel": {
"Default": "Information",
"Microsoft.AspNetCore": "Information",
"Microsoft.Hosting.Lifetime": "Information",
"Microsoft.EntityFrameworkCore.Database.Command": "Warning"
}
},
"EncryptionKey": "xxxxxxxxxxxxx",
"DebugMode": "true",
"ListeningAddress": "*",
"HTTPPort": "80",
"HTTPSPort": "443",
"AllowedHosts": "*",
"DatabaseType": "SQLite", //SQL,SQLite,or MySQL
"ConnectionStrings": {
"SQLite": "Data Source=C:\\Program Files\\Blazam\\blazam.db",
"DBConnectionString": ""
}
}to be honest, I don't have idea for that config, especially for Thank you. |
Beta Was this translation helpful? Give feedback.
-
|
Hello, And thank you for the Linux suggestion... I'm assuming you're doing a manual install... It looks like there is a bug causing the loading screen not to react to certain failures to connect to the DB..
appsetings.json issueYou have... Which is not valid, the SQLite is not needed, simply move the string to the DBConnectionString value like or better yet create the folder Blazam under C:\ProgramData\ and apply write permissions for the service running Blazam... Opening Services and looking under "Log On As" for Blazam will show you the service identity to provide the permission to... Please let me know if I can be of any further assistance. |
Beta Was this translation helpful? Give feedback.
-
|
I should add, you can add /install to the url to your blazam install (eg: http://localhost/install or http://192.168.0.99/install) and that will show the error that is happening under the hood of the loading screen |
Beta Was this translation helpful? Give feedback.
-
|
A major breakthrough today, successful connection from an actual Linux installation... The hurdle was discovering the particular Linux library configuration needed to allow LDAP connections from Blazam to work... This has only been proven for Ubuntu 24, but I would suspect most distro's would be compatible, albeit, maybe not with the install bash script I've been creating... There are still a number of performance optimizations to create for the "Windows Code Replacement" and a bunch of testing and tweaking.. but this is excellent progress. |
Beta Was this translation helpful? Give feedback.
-
|
Hit a major roadblock. I was able to get Basic unencrypted connections to work, but I have been unable to establish an encrypted LDAP connection on Linux. Unless I'm just missing something in Ubuntu that's needed.... I'll table it for now... I need a break and to work on other features and bugs. |
Beta Was this translation helpful? Give feedback.
-
|
Turns out I didn't know Active Directory or Linux as well as I thought. The issue was two-fold. Linux has tighter security requirements than Windows clients, and secondly a self-signed LDAPS certificate does not hold the appropriate Key Usage flags to properly authenticate LDAPS connections. Turns out Windows ignores this certificate violation and established the encrypted channel regardless. Linux rejects it. The solution was to set up a proper AD Certificate Authority and request a domain controller cert, and restart the ADDS service. After that, encrypted Linux connections succeeded. It still requires adding the CA cert to the trust store on Linux. This means I can continue work on this branch and continue the feature pause for all others. |
Beta Was this translation helpful? Give feedback.
-
|
Basically all read functionality is completed, With a noticeable speed improvement, which is nice. Next will be setting attributes, which will take some time to ensure complete reliability. |
Beta Was this translation helpful? Give feedback.
-
|
Current stage is user/group/ou creation, about halfway... then last thing is some update changes and remote computer management which may come with difficult decisions. |
Beta Was this translation helpful? Give feedback.
-
|
Creation of AD objects has been ported to Linux compatible code... Automation rules have been tested and continue to function... Work continues on remote management and stabilizing the new code for the highest reliability... Should have a beta available within a couple of weeks... Additionally, and for others, the published stable code branch has been down-merged to the DirectoryServices.Protocols beta branch "v1-DevBeta", so feature work can continue in parallel with the linux integration... |
Beta Was this translation helpful? Give feedback.
-
A demo of the Linux beta has been published.It's running on Ubuntu Server 2024 with 2 cores of a very weak CPU and 2GB of memory and sits at 4.7GB storage for OS and app... Find the Linux demo at https://beta.blazam.org |
Beta Was this translation helpful? Give feedback.
-
|
Linux has proven to be a challenge for certain remote management features in Blazam... Specifically, the polling, reading, and parsing of Windows Event Logs from a Linux machine using powershell (used for account lockout investigations). Powershell on linux does not contain the code to interact with Windows Event types.... The workaround to this is, well, non-trivial... either A) forward all domain controller windows event logs to a syslog server running on the linux instance hosting Blazam storing them in a separate DB as Blazam... or B) Install SSH on the domain controllers and execute the powershell commands to read the event log through the SSH tunnel, causing the windows domain controller to actually execute the powershell command instead of the linux machine. The SSH method seems the least intrusive in terms of configuration and added network traffic/resource usage... The current release plan will release the Linux flavor without any of these "advanced" features that are not easily portable. In addition to event logs, managing user sessions on computers, as well as other undiscovered incompatibilities will be disabled on Linux... It may be that Blazam will always be limited on Linux... but attempts will be made to bring feature parity. Having said all that, we are incredibly excited about the massive performance improvement, even on Windows, with the Linux compatible code... a few more weeks of bug and stress testing and I could see a Linux release to the public stable branch... |
Beta Was this translation helpful? Give feedback.
-
|
I have yet to set up the Linux code on my production Windows host for Blazam so this may be delayed a week... Want to have two solid weeks of ensuring the Linux changes have no impact on Windows before releasing in the wild... I also need to improve the installation script for Linux... it's not quite complete yet... |
Beta Was this translation helpful? Give feedback.
-
|
Due to my work obligations I have only just begun stress-testing the Linux code branch in a production environment. There was also a major LDAP connection instability that required some experimentation before settling on a connection usage pre-check, keep-alive mechanism, and failure recovery. I still need to improve the LDAP connection pool handling. EG: moving from a global app pool to a "per user" pool. I'm sure at least a couple other instabilities/optimizations will be found before getting the mark of Beta release approval (currently still in beta pre-release aka alpha). |
Beta Was this translation helpful? Give feedback.
-
|
Have had to swap back to Windows-only code twice... One was a false-alarm, a MudBlazor bug manifested in the template user creation wizard. Only realized after code swap. The second was this morning. A user reported being unable to log in, and an IT colleague said they received a "Something horrible has happened" error when trying to view the original user's search result page. I was unable to reproduce the "Something horrible" error. Unconfirmed cause for logon failure.... Revert to Windows-only code allowed user to log in. Did not follow up with colleague. |
Beta Was this translation helpful? Give feedback.
-
|
Logon authentication of LDAP needs some work... and a template is acting weird trying to set a new user's DN to " First,OU=Staff,DC=company,DC=org" instead of "CN=Last, First,OU=Staff,DC=company,DC=org" which implies an issue with the escaping of the comma.... |
Beta Was this translation helpful? Give feedback.
-
|
Per circuit LDAP pools was a terrible idea. Reverted back to a global pool with at least 10 persistent connections waiting for usage. |
Beta Was this translation helpful? Give feedback.
-
|
Resolved a major DN translation issue in the new code for creating new objects and probably other niche applications. Will likely be running Linux beta code on Windows host in my production environment all week. I should be able to find the time to correct any bugs that might pop up.... So far though, seems to be fairly stable, had one slight delay navigating after a long idle period (~3 hours), it is otherwise noticeably faster in all other areas as mentioned earlier/above. If I don't get this ready for official beta release by September, it will likely not come until after October 15th due to my other responsibilities. This is the most impactful code change since the original release of Blazam... and we must tread carefully. |
Beta Was this translation helpful? Give feedback.
-
|
Now that I'm into extended stress testing in my production environment, I've noticed a slow memory leak that can cause some issues after about a day. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Hi,
I am interested about this project, but is there any options to use another Web Server like nginx or apache2?
I'm trying to reduce the usage of windows servers by using a Linux.
The documentation only provides information for using IIS In the Installation Manual.
Thank you!
Beta Was this translation helpful? Give feedback.
All reactions