Ghosts (?) Changing User Features.

[fcjoe]

I'm stumped. It seems my Release 7.1.2_GA_3268.UBUNTU10_64 UBUNTU10_64 FOSS edition is developing ghosts. For the last several weeks two preferences seem to be randomly changed for just a few lucky users.

(1) The Default font family of html mail editor would change from Arial to Andale Mono; (what an UGLY face!)

(2) The draft auto save interval would change to 5 seconds.

Now I believe you can't change #2 through the user interface, so there goes the "stupid user" hypothesis. And an autosave every 5 seconds would frustrate our typists who kept typing ahead of the almost-constant save process.

And of course, it only happened to people in the Administration. People who sign the paychecks and things like that, so I *have* to care. And then it started happening to me.

I suppose all I can ask is if anyone has seen this. I have no clue as to where to begin to track this down. The clients are Vista and Win 7. The browsers were IE7, IE8, and Firefox. That's no help, either.

Anybody have any suggestions? Thanks for reading.

Joe K.

[bofh]

Ghosts`?

ok i got a solution for them - worked for me

First you need this:





and than use that :





Im sorry could not withstand

No seriously now
When did thatchange happen? Immidieate after upgrade ?
Did it happen to a certain COS or Systemwide?
Find anything in the logs?
Whats teh default cos values of these settings?

Of course this sounds concerning - those are stored within ldap so in case its a real change going on (hey sometimes ife overlooked settingschanges myself) this could mean:
1.you got someone who got rights to change cos /account settings (like a domain admin)
2.you got a security breach
3.not nessesarly 2 something else is changing ldap
4.crash within ldap /aka ldap db problem
5. new unknown weerd bug - lucky didnt happen to me yet but ill keep an eye on it - specially the 5 seconds draft save sounds server killing


EDIT: if you got a few older backups you cold also setup a virtual host on your workstation - only linux and openldap
and dump from there ldap database using text ldif format
then compare /aka search for new entries so you can narrow down exact date when these things happend and where exactly (where within ldap tree/cos ...)
also shows you the total "damage" and may see other things happend you didnt even reckognize yet

EDIT2: i see your problem because of the usergroup.
i would suggest to play with open cards - tell em - you cant determine now if its a seriouse issue or just a simple error but you gonna take that really seriously cause it should really not happen - from my experience it could be a desater to say like ah thats nothing just a little bug and turn out later its a real security threat

i know its likly its nothing but im used to expect the worst case and look first for that - 99% of the time it turns out errors like this are something ife overlooked and absolute harmless but the 1% i had ... sometimes real ass saving to expect that one

[eswing]

I am having the same issue were it seems this attribute will get changed to 15 seconds for some users. There is not way for the user to change this from the web client that I can find, so wondering how it is getting changed. Could it be from a certain web browser or something like that?