- main - earth.li

Re: [ALUG] Apache front for Tomcat/Cocoon
by Richard Lewis 25 Sep '04

25 Sep '04

On Friday, Sep 24, 2004, at 16:59 Europe/London, Martijn Koster wrote: > I've not needed to setup a reverse proxy, but the mod_proxy > documentation page says you need a: > > ProxyRequests Off > <Proxy *> > Order deny,allow > Allow from all > </Proxy> > ProxyPass /foo http://foo.example.com/bar > ProxyPassReverse /foo http://foo.example.com/bar > > Do you have an Allow like that? > I do now! Thanks very much, its all working now. On Friday, Sep 24, 2004, at 17:02 Europe/London, Andrew Savory wrote: > > On 24 Sep 2004, at 16:42, Richard Lewis wrote: >> I've got two Cocoon (2.1) webapps running under Tomcat (4.1) on my >> server (Debian, j2sdk1.4-sun, Apache 2.0). My network service >> provided has given me two aliases for the machine which I want to >> point to the two webapps. > > For shame, Richard, for shame. This is not the cocoon-users mailing > list, you know ;-) I tried them but no one answered :-( Anyway ALUG people are much more often correct about things than anywhere else ;-) > > Dump Tomcat, run both sites through Jetty (you really -don't- want to > run two Cocoon instances, look at mount-table.xml for the quickest way > to mangle your Cocoon urlspace safely. Follow the wiki docs, they are > very good. (Actually, its just one Cocoon instance). Is Jetty really better, I thought the documentation said that Jetty was provided for a test environment rather than production? Thanks for your help, Richard

2 1

Apache front for Tomcat/Cocoon
by Richard Lewis 24 Sep '04

24 Sep '04

Hello ALUG, Thanks for your help with getting Tomcat going as a non-privileged daemon. The reason I was trying to do that was because it was suggested as part of a solution for this problem: I've got two Cocoon (2.1) webapps running under Tomcat (4.1) on my server (Debian, j2sdk1.4-sun, Apache 2.0). My network service provided has given me two aliases for the machine which I want to point to the two webapps. As I understand it, I can use virtual hosting and mod_proxy with Apache to re-direct requests which use these two aliases to the webapps running on port 8080. My Apache and Tomcat set up is as follows: apache2/mods-enabled directory: php4.conf -> /etc/apache2/mods-available/php4.conf php4.load -> /etc/apache2/mods-available/php4.load proxy.conf -> ../mods-available/proxy.conf proxy_connect.load -> ../mods-available/proxy_connect.load proxy_http.load -> ../mods-available/proxy_http.load proxy.load -> ../mods-available/proxy.load userdir.conf -> /etc/apache2/mods-available/userdir.conf userdir.load -> /etc/apache2/mods-available/userdir.load ============================================================== apache2/sites-enabled directory: cursus.uea.ac.uk -> ../sites-available/cursus.uea.ac.uk studios.uea.ac.uk -> ../sites-available/studios.uea.ac.uk ============================================================== apache2/sites-available directory: cursus.uea.ac.uk -> /var/webapps/cursus/cursus.apache.conf studios.uea.ac.uk -> /var/webapps/studio/studio.apache.conf ============================================================== apache2/httpd.conf: <Files *.apache.conf> Order deny,allow Deny from all </Files> NameVirtualHost *****:80 ============================================================== /var/webapps/cursus/cursus.apache.conf: <VirtualHost ****:80> ServerName www.cursus.uea.ac.uk ServerAlias cursus.uea.ac.uk ServerAlias www.cursus ProxyRequests off ProxyPass / http://localhost:8081/cocoon/cursus/ ProxyPassReverse / http://localhost:8081/cocoon/cursus/ ProxyPass /styles http://localhost:8081/cocoon/cursus/styles ProxyPassReverse /styles http://localhost:8081/cocoon/cursus/styles </VirtualHost> ============================================================== /var/webapps/cursus/studios.apache.conf: <VirtualHost ****:80> ServerName www.studios.uea.ac.uk ServerAlias studios.uea.ac.uk ServerAlias www.studios ProxyRequests Off ProxyPass / http://localhost:8082/cocoon/studio/ ProxyPassReverse / http://localhost:8082/cocoon/studio/ </VirtualHost> ============================================================== /var/webapps/tomcat/conf/server.xml: [snippet] <Connector className="org.apache.coyote.tomcat4.CoyoteConnector" port="8081" minProcessors="5" maxProcessors="75" enableLookups="true" acceptCount="100" debug="0" connectionTimeout="20000" proxyName="www.cursus.uea.ac.uk" proxyPort="80" useURIValidationHack="false" disableUploadTimeout="true" /> <Connector className="org.apache.coyote.tomcat4.CoyoteConnector" port="8082" minProcessors="5" maxProcessors="75" enableLookups="true" acceptCount="100" debug="0" connectionTimeout="20000" proxyName="www.studios.uea.ac.uk" proxyPort="80" useURIValidationHack="false" disableUploadTimeout="true" /> The problem is that when the user requests the URL http://cursus.uea.ac.uk/ or http://www.studios.uea.ac.uk/ the server returns 403 'Forbidden'. $ tail log/apache2/error.log gives: [Fri Sep 24 16:22:17 2004] [error] [client ****] client denied by server configuration: proxy:http://localhost:8081/cocoon/cursus/ Accessed using the :808[012] suffix, the webapps both work fine (though the network firewall will stop access from outside). If anyone could help me I would be very grateful indeed as I've been puzzeling over this for days and really can't think of anything else that might sort the problem. Thanks in advance, Richard

4 3

Re: [ALUG] Tomcat daemon
by Richard Lewis 24 Sep '04

24 Sep '04

On Friday, Sep 24, 2004, at 13:08 Europe/London, Martijn Koster wrote: > On Fri, 2004-09-24 at 12:59, Richard Lewis wrote: >> Hello ALUG, >> >> I'm trying to write an init script to get Tomcat (4.1) to start at >> boot. (On Debian). >> >> I've created a file: >> /var/webapps/tomcat/bin/tomcat.sh >> ===================================== >> >> export TOMCAT_BIN=/var/webapps/tomcat/bin > > Try adding: > >> #!/bin/sh > D'oh! OK, thanks for that - it now picks up tomcat.sh and the daemon starts fine. I've just found one more problem though: it won't stop!! # /etc/init.d/tomcat stop doesn't return any errors but I had a look and found that the directory /var/run/tomcat was empty; it seems its left no process id file. Is this why it can't stop? Also, # ps -Al inclues: 0 S 103 5156 1 4 85 0 - 77414 schedu pts/0 00:00:21 java which must be the tomcat process. Might it be confused because the process is called 'java' not 'tomcat'? Thanks for any help. Cheers, Richard

2 3

Tomcat daemon
by Richard Lewis 24 Sep '04

24 Sep '04

Hello ALUG, I'm trying to write an init script to get Tomcat (4.1) to start at boot. (On Debian). I've created a file: /var/webapps/tomcat/bin/tomcat.sh ===================================== export TOMCAT_BIN=/var/webapps/tomcat/bin export JAVA_HOME=/usr/lib/j2sdk1.4-sun case "$1" in start) $TOMCAT_BIN/startup.sh ;; stop) $TOMCAT_BIN/shutdown.sh ;; restart) $TOMCAT_BIN/shutdown.sh $TOMCAT_BIN/startup.sh ;; *) echo "Usage: tomcat.sh {start|stop|restart}" ;; esac exit 0 ===================================== which works when I run it (e.g. # /var/webapps/tomcat/bin/tomcat.sh start). So far, so good. Next I created a new init script from /etc/init.d/skeleton: ===================================== #!/bin/sh set -e export JAVA_HOME=/usr/lib/j2sdk1.4-sun PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin DAEMON=/var/webapps/tomcat/bin/tomcat.sh NAME=tomcat DESC="Tomcat 4.1 Servlet Engine" PIDFILE=/var/run/tomcat/$NAME.pid SCRIPTNAME=/etc/init.d/$NAME # Gracefully exit if the package has been removed. test -x $DAEMON || exit 0 case "$1" in start) echo -n "Starting $DESC: $NAME" start-stop-daemon --start --quiet --pidfile $PIDFILE \ --chuid tomcat:tomcat --exec $DAEMON --user tomcat --group tomcat echo "." ;; stop) echo -n "Stopping $DESC: $NAME" start-stop-daemon --stop --quiet --pidfile $PIDFILE \ --exec $DAEMON --user tomcat --group tomcat echo "." ;; restart|force-reload) echo -n "Restarting $DESC: $NAME" start-stop-daemon --stop --quiet --oknodo --pidfile \ $PIDFILE --exec $DAEMON --user tomcat --group tomcat sleep 1 start-stop-daemon --start --quiet --pidfile \ $PIDFILE --chuid tomcat:tomcat --exec $DAEMON --user tomcat --group tomcat echo "." ;; *) # echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2 echo "Usage: $SCRIPTNAME {start|stop|restart|force-reload}" >&2 exit 1 ;; esac exit 0 ===================================== but # /etc/init.d/tomcat start returns: Starting Tomcat 4.1 Servlet Engine: tomcatstart-stop-daemon: Unable to start /var/webapps/tomcat/bin/tomcat.sh: Exec format error Similarly, # start-stop-daemon --start --pidfile /var/run/tomcat/tomcat.pid --chuid tomcat:tomcat --exec /var/webapps/tomcat/bin/tomcat.sh --user tomcat --group tomcat returns: start-stop-daemon: Unable to start /var/webapps/tomcat/bin/tomcat.sh: Exec format error Removing --chuid, --user or --group doesn't make any difference either. Does anyone know how I can make this work? Cheers, Richard

2 1

ssh & cvs
by Paul 23 Sep '04

23 Sep '04

Hi Folks After discussing a small problem about ssh and cvs with Brett last night, it was suggested I post the problem here... I am attempting to set up a cvs server behind a firewall using ssh for security. The port forwarding works and has been tested from the outside, as does cvs access. At the moment, I have set up a usr account for each person requiring write access to the cvs repository.. However, I do not want to allow remote users to have shell access on the cvs server. Is there a simple way I can disable shell accounts for selected users and still have ssh & cvs working with some degree of security ? Regards, Paul. -- Pieces of seven, pieces of seven - A parroty error. "To err is human...to really f*** things up requires the root password."

7 27

Software Patents
by Ted.Harding＠nessie.mcc.ac.uk 22 Sep '04

22 Sep '04

Hi Folks, This morning's "You and Yours" on Radio 4 had quite an interesting item on the US "patent piracy" scam, and the considerations which the EU are applying to the issue. Though not primarily about software patenting, this topic did come up. What was interesting was the indication that the EU is considering applying more of a "real technological invention needed" criterion as compared with the US practice whereby a firm can apparently slap a patent on anything provided only that no-one has thought of doing that before. While US lawyers do seem to regard this as a joke, none the less the lack of proper investigation by the Patent Authorities means that it happens, with the result that it's simply not possible in the US for people without million-dollar funding to fight a patent and it's more in their interests to accept a costly but affordable licensing agreement with the "patent" holder. The program is not yet up for "Listen Again", but should be by tomorrow. Visit http://www.bbc.co.uk/radio4/youandyours/ Best wishes tgo all, Ted. -------------------------------------------------------------------- E-Mail: (Ted Harding) <Ted.Harding(a)nessie.mcc.ac.uk> Fax-to-email: +44 (0)870 094 0861 [NB: New number!] Date: 22-Sep-04 Time: 13:17:57 ------------------------------ XFMail ------------------------------

1 0

Security, what does one need in reality?
by Chris Green 21 Sep '04

21 Sep '04

Since we are soon to get an 'always on' broadband connection with a fixed IP address (it's not ADSL, it's wireless but that doesn't affect things really) I'm looking into what new things I will be able to do and the security thereof. I have already resurrected an old machine and have installed ipCop on it, that's fine and will block most external access. However I do want to allow *some* access, in particular I want:- ssh access to the ipcop box, this will allow some administration and will also allow access (via another ssh connection) to my Linux server machine on the GREEN side. Access to an IMAP server on the Linux server on the GREEN side by port mapping through the ipCop box. (I know a separate ORANGE subnet is really the way to go but that means yet another machine I have to administer etc. which I want to avoid) In the real world how vulnerable will these two be? Will I get incessant hacking at the open SSH port on the ipCop box trying to guess the password or will it just be the occasional port scan? Assuming the password is secure enough (i.e. unguessable enough and not published on the internet somewhere) will I be basically OK? I may be able to limit the SSH access in particular to only certain client IP addresses but I want the IMAP to be accessible from anywhere. The IMAP server will probably only have two or three accounts on it and I will have control over passwords (though not where they're kept maybe). Does anyone here have any experience of how vulnerable in reality such systems are? I'm not after Fort Knox, I just want things to be reasonably safe. -- Chris Green (chris(a)areti.co.uk) "Never ascribe to malice, that which can be explained by incompetence."

6 10

Graphical 'diff' with proper X cut and paste
by Chris Green 21 Sep '04

21 Sep '04

I'm looking for a graphical (GUI/X) diff command which allows proper X cut and paste. I've found xdiff (well, one of them, there are a couple) and mgdiff but neither allows one to select lines from the display and to paste them elsewhere. They both expect you're trying to merge the diff'ed files into an output file so the select actions only decide whether what you have selected goes into the output file or not. What I need to do is to be able to see differences between two files and paste them into a third file which is (probably) open in a different window. I can't find a diff utility which allows me to do this. Does anyone have any recommendations? It needs to be fairly 'generic unix' as I want it to run on a Solaris box. I'm quite happy to compile stuff but I'm not happy if the program needs lots of specialist libraries. -- Chris Green (chris(a)areti.co.uk)

5 5

FIPS and Windows
by Ted.Harding＠nessie.mcc.ac.uk 21 Sep '04

21 Sep '04

Hi Folks (andapologies for cross-posting) I've always had a good experience with 'fips' when using it to back Windows into a suitably restricted space prior to installing Linux. However, on these occasions it has been effectively a virgin preinstalled Windows with which I have done little or nothing. I'm now wondering about using 'fips' to resize some Windows partitions amongst themselves, this being a Win installation which has been actively used for years, and has a lot of user files and extra installed software, so this situation is beyond my experience. The situation is possibly complicated by the fact that the Windows partitions are not all distinct primary partitions: some are "logical" partitions within an "extended" partition. (In effect the aim of the exercise is to increase the size of C: at the expense of "E:", "F:" and "G:" and to re-allocate space amongst the latter, in the presence of a partition "D:" which is on a different drive and would have comwe out as "G:" were it not for a re-assignment of drive letters under software control ... If anyone has experience of going down this road I'd value hearing about it! (Sorry, too, for being somewhat off-topic!) Best wishes to all, Ted. -------------------------------------------------------------------- E-Mail: (Ted Harding) <Ted.Harding(a)nessie.mcc.ac.uk> Fax-to-email: +44 (0)870 094 0861 [NB: New number!] Date: 20-Sep-04 Time: 18:14:51 ------------------------------ XFMail ------------------------------

4 3

Eye Candy
by Wayne Stallwood 20 Sep '04

20 Sep '04

Adam's last post got me thinking about the use of Eye Candy in software. What do the group think are good and bad examples of effects or eye candy. For example ( this is going to be a popular one I feel ) I absolutely hate the dog that appears when searching for a file in Windows XP (Spot I think it's called), it adds nothing to the search functionality and just wastes some screen estate. On the same OS I quite like the transparent mail notification that appears when Outlook 2003 receives a new mail (if you haven't seen it, it pops up above the system tray with a brief summary of the incoming mail over the active windows but transparent enough to still see the active window through it) It's pretty handy as it usually catches my eye and appears for long enough and with enough information for me to make a judgement as to whether it's a mail I need to deal with now or leave for later.

11 19