linuxbuddies.com » Apache

Disable/Enable safe_mode/register_globals value

Riyesh — Sun, 18 Jan 2009 04:55:40 +0000

You can disable/enable safe_mode either using .htaccess, php.ini or httpd.conf file. Selecting the right way depends on your php-apache configuration.
If php is compiled as a dso module for apache, you will have to use .htaccess method

If php-apache relationship is CGI, then php.ini file is used to disable safe_mode value

If none of the above works, contact your hosting provider and ask them to disable safe_mode through the servers httpd.conf file. It can be done in your VirtualHost configuration inside httpd.conf file.

.htaccess Code

php_admin_value safe_mode Off [OR]
php_flag safe_mode Off

edit php.ini ( use this command to find php.ini file location – “php -i | grep php.in” )

safe_mode = Off

edit httpd.cof

php_admin_value safe_mode Off

Verify your settings

Create phpinfo page file and put it on the document root and access the page to see if the defult value has been overrided with your defult value.

phpinfo sample.

example
vi phpinfo.php

phpinfo();
?>

You may use register_globals keyword instead of safe_mode to change values of register_globals variable [off/on values are accepted]

Collecting User IP!

Riyesh — Sat, 03 Jan 2009 07:14:44 +0000

A sample BASH CGI script for collecting IPs of your colleagues in your network.

Prerequisites
1) apache/cgi configuration
2) a Mysql installation

Then create script “getip.sh” under “/var/www/cgi-bin/” ( set location of cgi-bin directory as per the apache configuration)

#!/bin/bash
#Getting IP address CGI-BASH-script
#Jadu Saikia http://unstableme.blogspot.com/

#MySQL settings

# MHOME= ( location of mysql binary)
MHOME=/usr/local/mysql/bin
HOST=127.0.0.1
USER=root
PASS=”"
DB=mydb

OWNER=$(echo “$QUERY_STRING” |awk -F “=” ‘{print $NF}’)
IP=$REMOTE_ADDR
#QUERY_STRING = Query information that follows the ? in the URL that referenced this script.
#REMOTE_ADDR = IP address of the remote host making the request

#HTML Output
echo “Content-type: text/html”
echo “”
echo “YOUR IP

I am collecting the IPs

”;
 echo “IP: $IP
”
echo “You Are IP is : $OWNER
”
 
$MHOME/mysql -u$USER -h$HOST –password=$PASS -e “INSERT INTO mydb.ips(rdate,ip,owner) VALUES(NOW(),’$IP’,'$OWNER’)” $DB
 
echo “

”;

Then

Create MySql Database for storing the data.

logon to mysql

mysql -u root -p password

create database and table

create database mydb

use mydb

create table mydb.ips ( rdate DATE, ip VARCHAR(20) NOT NULL PRIMARY KEY, owner VARCHAR(25));

exit

Suppose the IP of the box where you are running the cgi is “172.22.22.188″ (your local ip).

Now construct the urls for your colleagues this way:

http://172.22.22.188/cgi-bin/getip.sh?owner=alexm
http://172.22.22.188/cgi-bin/getip.sh?owner=nsarma
…
…

And send them the individual urls in mail with a request to click the url (just to help you collecting the ips in the mysql table)

Once they click, your database table will be automatically populated with datas like this:

mysql> select * from mydb.ips;
+————+—————+

———+
| rdate | ip | owner |
+————+—————+———+
| 2007-01-02 | 172.22.22.111 | alexm |
| 2007-01-03 | 172.22.22.92 | nsarma |
+————+—————+———+
2 rows in set (0.00 sec)

Finished.

Installing Tomcat

Riyesh — Fri, 02 Jan 2009 06:21:29 +0000

Required packages

Apache
OpenSSL
j2sdk
jakarta-tomcat
jakarta-ant
jakarta-tomcat-connectors(mod_jk)

Configure Environment Variables

Edit and add the lines below to “/etc/profile”

JAVA_HOME=/usr/local/java/java
CATALINA_HOME=/usr/local/tomcat
PATH=$JAVA_HOME/bin:$PATH:$HOME/bin:/sbin:/usr/sbin
CLASSPATH=$CATALINA_HOME/bin/bootstrap.jar:$JAVA_HOME/lib/tools.jar:$CATALINA_HOME/common/lib/servlet.jar:/usr/local/pgsql/share/java/postgresql.jar:../lib/struts.jar:.

Now add the PATH JAVA_HOME CATALINA_HOME & CLASSPATH if any aren’t in the export line

export PATH USER LOGNAME MAIL HOSTNAME HISTSIZE INPUTRC JAVA_HOME CATALINA_HOME CLASSPATH

Install Java

mkdir /usr/local/java
cd /usr/local/java
sh jdk-1_5_0_04-linux-i586.bin

The jdk directory is then extracted

mv jdk-1_5_0_04 /usr/local/java
ln -s jdk-1_5_0_04 java

Now the java directory will be in /usr/local/java/java. I do it like this so I can keep all my different JDKs/JREs in one directory and then just change the symbolic link to point to the current one.

Install Jakarta TOMCAT (Tomcat4 or Tomcat5 can be used)

tar xvfz jakarta-tomcat-4.1.29.tar.gz
mv jakarta-tomcat-4.1.29 /usr/local/
cd /usr/local
ln -s jakarta-tomcat-4.1.29 tomcat

Install Jakarta ANT

tar xvfz jakarta-ant-1.6.0
mv jakarta-ant-1.6.0 /usr/local
cd /usr/local
ln -s jakarta-ant-1.6.0 ant
ln -s /usr/local/ant/bin/ant /usr/local/bin/ant

Install OPENSSL

tar xvfz openssl-0.9.7d.tar.gz
mv openssl-0.9.7d /usr/local/src/
cd /usr/local/src/openssl-0.9.7d
./config
make
make test
make install
#This will install in /usr/local/ssl

Install APACHE

tar xvfz httpd-2.0.48.tar.Z
cd httpd-2.0.48
./configure –prefix=/usr/local/apache2 –enable-so –enable-rewrite \
–enable-ssl –with-ssl=/usr/local/ssl –enable-proxy
make
make install
#(places in /usr/local/apache2)

Build/Install MOD_JK Connector

cd /usr/local/src/jakarta-tomcat-connectors-jk-1.2.5-src/jk/native
./buildconf.sh
./configure –with-apxs=/usr/local/apache2/bin/apxs
make
cp apache-2.0/mod_jk.so /usr/local/apache2/modules

Configure Apache for mod_jk

I put these lines in http.conf just before NameVirtualHost

LoadModule jk_module modules/mod_jk.so

Finished.

MySql Replication

Riyesh — Sat, 27 Dec 2008 01:09:11 +0000

Mysql Replication is used to get a mirror copy of master server to slave. All changes made in server is updated on slave. This can be achieved by the following steps. one thing to be notify is the master and salvemay contain the same version of mysql.

changes in master

edit /etc/my.cnf
[mysqld]
log-bin = mysql-bin
server-id = 1
restart the mysql service

enter the following commands in mysql

grant all on *.* to user@slaveip identified by ‘userpassword’ with grant option;
grant replication slave on *.* to ‘username’@masterip identified by ‘userpassword’;
show master status;

changes in slave

vi /etc/my.cnf
[mysqld]
log-bin = mysql-bin
server-id = 2
restart the mysql service

enter the following commands in mysql

grant all on *.* to username@localhost identified by ‘userpassword’;
change master to master_host=’server ip’;
change master to master_user=’username’;
change master to master_password=’userpassword’;
change master to master_log_file=’mysql-bin’;
change master to master_log_pos=561; (by command show master status; in master )

to update data from master by using the command

load data from master;

APC mem Cache installation

Riyesh — Tue, 23 Dec 2008 13:27:24 +0000

APC MM cache is an most commonly used php accelerators

Please follow the steps to install APC mem Cache

1. cd /usr/local/src
2. wget http://pecl.php.net/get/APC-3.0.14.tgz
3. tar -xzvf APC-3.0.14.tgz
4. cd APC-3.0.14

checking the location of phpize and php-config paths

finding the Phpize binary location

whereis phpize

output looks like:

phpize: /usr/bin/phpize /usr/local/bin/phpize

whereis php-config

output looks like:

php-config: /usr/bin/php-config /usr/local/bin/php-config

5. execute the command to create the module

/usr/bin/phpize ( or the path you got )

6. compile the APC by running following command

./configure –enable-apc –enable-apc-mmap –with-apxs=/usr/local/apache/bin/apxs –with-php-config=/usr/bin/php-config
make
make test
make install

Take note of where it copies apc.so file i.e.

/usr/lib/php/extensions/no-debug-non-zts-20020429/apc.so

10. Now locate php.ini type:

php -i | grep php.ini

11. Edit php.ini

Add these entries in the dynamic module section ( please note the extention path can be varied )

extension=”/usr/lib/php/extensions/no-debug-non-zts-20020429/apc.so”
apc.shm_size = 32

restart webserver . Check the php info page you can see the apc module listed .

FFmpeg Installation

Riyesh — Tue, 23 Dec 2008 12:40:06 +0000

1. Create a directory to do our work

mkdir ~/ffmpeg
cd ~/ffmpeg

2. Get all the source files

wget http://www3.mplayerhq.hu/MPlayer/releases/codecs/essential-20061022.tar.bz2
wget http://rubyforge.org/frs/download.php/9225/flvtool2_1.0.5_rc6.tgz
wget http://easynews.dl.sourceforge.net/sourceforge/lame/lame-3.97.tar.gz
wget http://superb-west.dl.sourceforge.net/sourceforge/ffmpeg-php/ffmpeg-php-0.5.0.tbz2
wget http://downloads.xiph.org/releases/ogg/libogg-1.1.3.tar.gz
wget http://downloads.xiph.org/releases/vorbis/libvorbis-1.1.2.tar.gz

3. Extract all the source files

bunzip2 essential-20061022.tar.bz2; tar xvf essential-20061022.tar
tar zxvf flvtool2_1.0.5_rc6.tgz
tar zxvf lame-3.97.tar.gz
bunzip2 ffmpeg-php-0.5.0.tbz2; tar xvf ffmpeg-php-0.5.0.tar
tar zxvf libogg-1.1.3.tar.gz
tar zxvf libvorbis-1.1.2.tar.gz

4. Create the codecs directory & import them

mkdir /usr/local/lib/codecs/
mv essential-20061022/* /usr/local/lib/codecs/
chmod -R 755 /usr/local/lib/codecs/

5. Install SVN/Ruby (Depends on OS, this is for RHEL/CentOS)

yum install subversion
yum install ruby
yum install ncurses-devel

6. Get the latest FFMPEG/MPlayer from the subversion

svn checkout svn://svn.mplayerhq.hu/ffmpeg/trunk ffmpeg
svn checkout svn://svn.mplayerhq.hu/mplayer/trunk mplayer

7. Compile LAME

cd ~/ffmpeg/lame-3.97
./configure
make
make install

8. Compile libOGG

cd ~/ffmpeg/libogg-1.1.3
./configure
make
make install

9. Compile libVorbis

cd ~/ffmpeg/libvorbis-1.1.2
./configure
make
make install

10. Compile flvtool2

cd ~/ffmpeg/flvtool2_1.0.5_rc6
ruby setup.rb config
ruby setup.rb setup
ruby setup.rb install

11. Compile MPlayer

cd ~/ffmpeg/mplayer
./configure
make
make install

12. Compile FFMPEG

cd ~/ffmpeg/ffmpeg
./configure –enable-libmp3lame –enable-libogg –enable-libvorbis –disable-mmx –enable-shared
echo ‘#define HAVE_LRINTF 1′ >> config.h
make
make install

13. Finalize the codec setups

ln -s /usr/local/lib/libavformat.so.50 /usr/lib/libavformat.so.50
ln -s /usr/local/lib/libavcodec.so.51 /usr/lib/libavcodec.so.51
ln -s /usr/local/lib/libavutil.so.49 /usr/lib/libavutil.so.49
ln -s /usr/local/lib/libmp3lame.so.0 /usr/lib/libmp3lame.so.0
ln -s /usr/local/lib/libavformat.so.51 /usr/lib/libavformat.so.51

14. Compile FFMPEG-PHP

cd ~/ffmpeg/ffmpeg-php-0.5.0
phpize
./configure
make
make install

15. Install FFMPEG-PHP (make sure the php.ini path is correct.)

echo ‘extension=/usr/local/lib/php/extensions/ no-debug-non-zts-20020429/ffmpeg.so’ >> /usr/local/Zend/etc/php.ini

16. Restart Apache to load FFMPEG-PHP (Depends on OS, this is for RHEL/CentOS)

service httpd restart

17. Verify if it works

php -r ‘phpinfo();’ | grep ffmpeg

If you get a few lines such as
ffmpeg
ffmpeg support (ffmpeg-php) => enabled
ffmpeg-php version => 0.5.0
ffmpeg.allow_persistent => 0 => 0

Then everything is installed and working. FFMPEG, FFMPEG-PHP, MPlayer, MEncoder, flv2tool, LAME MP3 encoder & libOGG.

Apache SSL certificate Creation

Riyesh — Mon, 22 Dec 2008 05:39:51 +0000

Hi.. Guys

Please follow the steps to install SSL certificate on Apache

# cd /usr/local/apache

# mkdir cert
# cd cert

1. Generate your own Certificate Authority (CA)

# openssl genrsa -out ca.key 4096
# openssl req -new -x509 -days 365 -key ca.key -out ca.crt

2.Generate a server key and request for signing (csr)

# openssl genrsa -out server.key 4096
# openssl req -new -key server.key -out server.csr

3.Sign the certificate signing request (csr) with the self-created certificate authority (CA) that you made earlier

# openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

Edit /usr/local/apache/conf/httpd.conf

ServerName xxx.xxx.xxx.xxx:443
Listen xxx.xxx.xxx.xxx:443
LoadModule ssl_module modules/mod_ssl.so

SSLEngine on
SSLCertificateFile /usr/local/apache/cert/server.crt
SSLCertificateKeyFile /usr/local/apache/cert/server.key

# /usr/local/apache/bin/apachectl restart

To do the same with a Passphrase follow below

# cd /usr/local/apache
# mkdir cert
# cd cert
# openssl genrsa -des3 -out ca.key 4096
# openssl req -new -x509 -days 365 -key ca.key -out ca.crt
# openssl genrsa -des3 -out server.key 4096
# openssl req -new -key server.key -out server.csr
# openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt

Rest of the configuration remains same

Autoresponder Plugin in Squirrelmail

Riyesh — Mon, 22 Dec 2008 05:38:31 +0000

1.Download the compatibility plugin and Local Auto Responder plugin from http://squirrelmail.org

2.Extract it to the Squirrelmail – plugins directory

cd /var/www/html/squirrelmail/plugins

# tar xzf compatibility-2.0.9-1.0.tar.gz
# cd compatibility

3.Patch it to your squirrelmail version

# patch -p0 < patches/compatibility_patch-1.4.11.diff
patching file ../../functions/strings.php

4.Configure the Squirrelmail to include the plugin

# cd ../../config
# ./conf.pl

5.Extract Local Auto Responder Plugin

# cd ../plugins/
# tar xzf local_autorespond_forward-3.0-1.4.0.tar.gz
# cd local_autorespond_forward

6.Compile suid_backend module

# cd suid_backend/
# ./configure –enable-webuser=nobody

Here my Apache is running as user “nobody”.That user should have the permission to play
with the directories under this.

# make
# make install

7.Copy the sample config.php

# cd ..
# cp config.sample.php config.php

8.Edit the config.php to use “suid” instead of “ftp” for Maildir and “.forward” files

edit config.php

$laf_backend = ’suid’;

9.Configure the Squirrelmail to include the plugin

# cd ../../config
# ./conf.pl

10.Verify the Squirrelmail’s ATTACHMENT DIR and DATA DIR. Verify the permission also

edit /var/www/html/squirrelmail/config/config.php

$attachment_dir = ‘/var/local/squirrelmail/attach/’;

11.Create it if doesn’t exist

# mkdir /var/local/squirrelmail/attach
# chown nobody.nobody /var/local/squirrelmail/attach
# chmod 755 /var/local/squirrelmail/attach

Finish…… you can go now…

Thanks,

Riyesh

Linux buddy

How to disable directory browsing in Apache

Riyesh — Mon, 22 Dec 2008 05:29:38 +0000

One of the “must do’s” on setting a secure apache webserver environment is to disable directory browsing. As a default Apache will be compiled with this option enabled, but its always a good idea to get rid of this setting unless its really necessary.

If you are on an RPM installation of Apache you will find the apache configuration file probably here:

/etc/httpd/conf/httpd.conf

If you are using apache from the source tar balls probably you will find the configuration file here:

/usr/local/apache/conf/httpd.conf

Edit the httpd.conf file and scroll until you find a line like this:

Options All Indexes FollowSymLinks MultiViews

To disable directory browsing carefully remove the line that says: Indexes and leave the line like this:

Options All FollowSymLinks MultiViews

Restart your apache webserver and thats it