How to reset password of user in TWiki

Simply go to /twiki/data/.htpasswd and replace the password field with the result from "htpasswd -d" ( Force CRYPT encryption of the password).  htpasswd is an Apache's tool.

apache with security

Ubuntu Linux

#### installation

• apt-get install apache2-mpm-itk
• apt-get install acl
• set acl in /etc/fstab
  
  e.g. LABEL=cloudimg-rootfs   /        ext4   defaults,acl    0 0

#### instructions for setting up new virtual host

useradd --home /vhdocs/your_web --shell /bin/false your_web

# default permissions

chown -R ubuntu.your_web your_web

chmod -R o-rwx your_web
chmod -R g+rx your_web

chmod -R g-w your_web

setfacl -R -d -m "g:developers:rwx" your_web
setfacl -R -d -m "g:your_web:r-x" your_web

# allow read/write/execute to developers

setfacl -R -m "g:developers:rwx" your_web

# allow write to certain directories

setfacl -R -m "g:your_web:rwx" writable_dir

# everytime after deployment

setfacl -R -m "g:developers:rwx" *

cd /vhdocs/ ; git init

how to limit number of connections to server per second with iptables

# 2 hits per second per ip address

iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 80 -i eth0 -m state --state NEW -m recent --update --seconds 1 --hitcount 2 -j DROP

iptables -A INPUT -p tcp --dport 443 -i eth0 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 443 -i eth0 -m state --state NEW -m recent --update --seconds 1 --hitcount 2 -j DROP

iptables slow down http and https

With:

-P INPUT DROP
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT

Websites on the server will response very slowly.

But if you add:

 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

 Websites will response fast as usual.

undefined symbol: ap_cache_cacheable_hdrs_out

After enabling mod_mem_cache, I encountered these errors when restarting apache:

* Restarting web server apache2
 * We failed to correctly shutdown apache, so we're now killing all running apache processes. This is almost certainly suboptimal, so please make sure your system is working as you'd expect now!
 ... waiting apache2: Syntax error on line 204 of /etc/apache2/apache2.conf: Syntax error on line 2 of /etc/apache2/mods-enabled/mem_cache.load: Cannot load /usr/lib/apache2/modules/mod_mem_cache.so into server: /usr/lib/apache2/modules/mod_mem_cache.so: undefined symbol: ap_cache_cacheable_hdrs_out
   ...fail!

Just put:

LoadModule cache_module /usr/lib/apache2/modules/mod_cache.so

before:

# Include module configuration:

in:

/etc/apache2/apache2.conf

And it's fixed!

grep out the process called httpd without including the grep command itself in the output

ps auxw | grep "[h]ttpd" # grep out the process called httpd without including the grep command itself in the output (via climagic)

how to set up vsftpd with pam authentication for name-based virtual hosting

I was surprised how vsftpd didn't work out of the box to support authentication without unix system account.  It took me 2 days to research and did trial and error before I could make it work.  Here is the result.

system: debian

# apt-get install libpam-pwdfile
# mkdir /etc/vsftpd
# cd /etc/vsftpd
# htpasswd -c passwd_ftp a_sample_website

Here I assume that the root directory of your virtual host is /vhdocs/a_sample_website/.

# cd /etc/pam.d
# vi vsftpd

Make sure it looks exactly like this:

# Standard behaviour for ftpd(8).
auth    required        pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed

# Note: vsftpd handles anonymous logins on its own.  Do not enable
# pam_ftp.so.

# Standard blurb.
#@include common-account
#@include common-session

#@include common-auth
#auth   required        pam_shells.so

# Customized login using htpasswd file
auth    required pam_pwdfile.so pwdfile /etc/vsftpd/passwd_ftp
account required pam_permit.so

Then edit vsftpd's config file:

# vi /etc/vsftpd.conf

It is a long config file.  I will tell you only required lines:

write_enable=YES
local_umask=022
chroot_local_user=YES
# addtitional settings by chaitat
virtual_use_local_privs=YES
connect_from_port_20=YES
guest_enable=YES
guest_username=ftp
user_sub_token=$USER
local_root=/vhdocs/$USER
hide_ids=YES

Restart vsftpd:

# /etc/init.d/vsftpd restart

Modify files' owner:

# chown -R ftp.nogroup /vhdocs/a_sample_website

--
unsigned_nerd

.htaccess and .htpasswd

sample .htaccess and .htpasswd

.htaccess

AuthUserFile /var/www/tmp/.htpasswd
AuthName "My Private Directory"
AuthType Basic
require valid-user

.htpasswd

admin:$apr1$Y5J7envl$dYoDhqywTT.mD4L6MQIAU/

how to fix apache warning message: Could not determine the server's fully qualified domain name

Could not determine the server's fully qualified domain name

Newly installation of Apache gave this warning message.  We can fix it by adding this line to your httpd.conf:

# ServerName is to be specified to avoid warning during reload
ServerName MYSERVER

MYSERVER is your host's domain name.

Apache "Options MultiViews"

#เราเอง เกลียด option MultiViews ของ Apache

พื้นฐานความคิดของ MultiViews น่าจะอ่านได้ที่นี่:

http://httpd.apache.org/docs/current/content-negotiation.html

Content Negotiation กล่าวสั้นๆคือเป็นกระบวนการของ Apache ที่จะช่วยเหลือ client ที่สร้าง request มาร้องขอข้อมูลโดยที่คำร้องที่ client ส่งมานั้นอาจจะไม่สมบูรณ์แต่ Apache ก็จะช่วยเดาให้และส่งข้อมูลออกไป ตัวอย่างเช่น client ร้องขอไฟล์ (หรือ directory) hello แต่ Apache ตรวจดูบน VirtualHost แล้วไม่พบไฟล์นี้ พบแต่ hello.php ดังนั้น Apache จึงส่ง output จาก hello.php ไปให้ client แทน

ดูเผินๆก็คงเห็นว่ามันฉลาดดี หาไม่เจอก็เลือกเอาอันที่ใกล้เคียงตอบกลับไปให้... แต่ทว่า เราเองไม่ชอบส่ิงอันใดที่มันไม่ชัดเจน คาดเดาลำบาก ดู url เสร็จต้องมาเดาชื่อไฟล์ต่อ แล้วถ้ามันมี hello.php, hello.pl, hello.cgi, hello.jpg อยู่ใน directory เดียวกันหละ จะเอาอย่างไร

โดยปกติเราจึงมักที่จะ disable option MultiViews นี้ไปเสีย

Apache crashes due to error log file size

Apache will crash if your error log or access log's file size reaches 2GB which is the maximum file size of Apache in Linux.

When this problem occurs, you can just delete that file and restart Apache.

You might also consider switching Apache log from normal log into zwrotatelog which will consume a bit more of your server's resource!

how to print to standard error in php

php has a function to print message to standard error which normally will be in the log file set by apache.

this function is error_log($message). Example:

<?php
error_log('some error message');
?>

References:
http://php.net/manual/en/function.error-log.php

php in macosx 10.5 (leopard)

MacOSX 10.5 (Leopard) is shipped with PHP and Apache installed but disabled.  These 2 articles describe how to enable it:

• http://www.procata.com/blog/archives/2007/10/28/working-with-php-5-in-mac-os-x-105/
  
• http://foundationphp.com/tutorials/php_leopard.php
  

But if you are kind of lazy, you can use this instead:

• http://www.mamp.info/en/mamp.html
  

Apache user in Ubuntu Linux

Apache user (or web user) in Ubuntu Linux is: www-data

Normally, for any system, you can know which user is by:

$ ps aux | grep apache

root 5721 0.0 0.1 23324 1528 ? Ss Aug01 0:00 /usr/sbin/apache2 -k start
www-data 5798 0.0 0.0 23324 444 ? S Aug01 0:00 /usr/sbin/apache2 -k start
www-data 5799 0.0 0.0 23324 444 ? S Aug01 0:00 /usr/sbin/apache2 -k start
www-data 5800 0.0 0.0 23324 444 ? S Aug01 0:00 /usr/sbin/apache2 -k start
www-data 5801 0.0 0.0 23324 444 ? S Aug01 0:00 /usr/sbin/apache2 -k start
www-data 5802 0.0 0.0 23324 444 ? S Aug01 0:00 /usr/sbin/apache2 -k start
unsigned_nerd 15968 0.0 0.0 3008 776 pts/1 R+ 01:37 0:00 grep apache

You see? It is "www-data" in Ubuntu Linux...

What is it in your system?