login always results in "403 Forbidden"

ullix · 2024-06-17T13:39:14+00:00

After using tvheadend with Kodi for over a decade I was forced to reinstall on a new computer, and then could no longer log in with localhost:9981. Every att...

Flole

That won't help when trying to authenticate against a pumpkindb instance with Tvheadend credentials.

HD

It's possible to let tvheadend website use another port. If removing pumpkindb can't be an option maybe this is? You just stop tvheadend and restart with extra option like this:
sudo /usr/bin/tvheadend -f -p /run/tvheadend.pid -u hts -g video --http_port 9985

Saen Acro

@HD
Because you already redirected to "/extjs.html", I suspect that you limit access to user.
Clear cookies for site
NMAP is not good as build-in command
sudo netstat -lpnt |grep 9981
Solution is to found where is data files and delete filters you made in access for user.

ullix

I am getting more and more confused.

What is this pumpkin thingy, and what do I need it for? My tvheadend worked the last 10 years just fine without needing it, so what is it doing now?

And if I don't need it, how can I get rid of it? I don't find it anywhere on my system.

I have now (multiple times) purged all tvheadend. So the most recent one is 4.3-2337. Is there anywhere an installation guide covering this version, made for the simple-minded user?

davep

If I understand correctly, nmap reports that port 9981 is open on your device. Nmap then looks up the service name for port 9981 in its internal database (nmap/nmapblob/master/nmap-services) and reports that as pumpkindb. In other words TVH has ports 9981 and 9982 open as expected and your authorisation problem has some other cause.

DaveH

davep If I understand correctly, nmap reports that port 9981 is open on your device. Nmap then looks up the service name for port 9981 in its internal database (nmap/nmapblob/master/nmap-services)) and reports that as pumpkindb. In other words TVH has ports 9981 and 9982 open as expected and your authorisation problem has some other cause.

Hmm, pumpkindb appears to be a fairly new project. Somebody needs to raise an issue with nmap to change their allocation of the port to pre-existing tvh, and raise an issue with pumpkindb to suggest they pick another 'random' port. : (

ullix

Are you saying that pumpkindb is part of tvheadend, and must run in order for tvh to run?

davep

No, nmap has its own database of which service uses which port, so when it sees 9981 in use it falsely reports that pumpkindb has it. In fact what it is seeing is TVH running.

ullix

OK, so at least this question is cleared, thank you!
Will the suggestion by @HD solve this for me or is there yet another problem possible?

P.S. I am still looking for an installation guide. Anyone?

davep

Untested by me but I believe it should work.

davep

DaveH Unfortunately pumpkindb has the official allocation of port 9981 - see https://www.iana.org/assignments/service-names-port-numbers

HD

Striving to be a bit more comprehensive and certainly not to confuse you even more, some extra remarks.
If you decide to use port 9985 you must allow traffic through this port first with:
sudo ufw allow 9985/tcp

The one and only aim of using a non-default port for tvheadend website is to avoid pumpkindb traffic on the same port in your setup., nothing else. If this works for you and want to make it permanent, edit /etc/default/tvheadend with your favorite editor:
change systemd options from:
OPTIONS="-u hts -g video"
to:
OPTIONS="-u hts -g video --http_port 9985
And restart tvheadend:
sudo systemctl restart tvheadend
From now on tvheadend will auto use port 9985 for its website at server startup.

ullix

So tvheadend has simply missed the registration of their port numbers? Very unfortunate.
In the meantime I have filed a bug report at nmap: nmap/nmap2869
I think I know what they will have to say...

ullix

I have now purged everything tvh* on my computer and installed tvheadend_4.3-2337~ge855f62e6~jammy_amd64.deb
Then I checked nmap:

$ nmap server -p1-65000 Starting Nmap 7.80 ( https://nmap.org ) at 2024-06-22 09:26 CEST Host is up (0.000094s latency). Not shown: 64991 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 111/tcp open rpcbind 8080/tcp open http-proxy 8090/tcp open opsmessaging 9981/tcp open pumpkindb 9982/tcp open unknown 32989/tcp open unknown 40851/tcp open unknown
9981 is pumpkindb, and 9982 is unknown.

Now using netstat as suggested by @Saen Acro
$ sudo netstat -lpnt |grep 998 tcp 0 0 0.0.0.0:9982 0.0.0.0:* LISTEN 378280/tvheadend tcp 0 0 0.0.0.0:9981 0.0.0.0:* LISTEN 378280/tvheadend

Yes, netstat knows!

Now calling tvheadend with http://localhost:9981/extjs.html: The result is exactly the same 403-Forbidden as before :-(((

DeltaMikeCharlie

When you installed TVH, were you asked for a username and password to create?

ullix

Yes, on every recent installation. And I always used name and pw so simple that I was sure to be typing it correctly.

ullix

I now followed the instructions of @HD, very carefully, letter by letter. And then connected to http://localhost:9981/extjs.html

What a beautiful picture of tvheadend on my monitor! Thank you everybody!

davep

Good to hear you got it working at last.

There was another thread a few weeks ago where a user couldn't connect to a new installation, and it seemed that a 'superuser' file was in the wrong place. I wonder if you had the same issue? The thread is at https://tvheadend.org/d/8657-cannot-login-to-tvheadend-web-interface/7

ullix

My excitement was a bit premature :-(. In a ruthless mood I rebooted my computer. And now I am back to "403 forbidden". What can I do to make it permanent?

P.S. @davep The "superuser" file has the correct content. It was at the supposedly wrong place; however, moving it to the right place did NOT solve the issue. I have now copied it to both places, but no benefit.

davep

You'll need to restart TVH with @HD 's instructions, then look at the users tab (Configuration -> User -> Access Entries). If there are no entries then create a user and give them a password. If the setup script created the user but didn't set the password correctly then it may be possible to just change the password.