Diego Benna's Blog

Install GUI in Ubuntu Server

2011-10-07T14:12:00.001-07:00

We have already discussed how to install ubuntu 9.04 LAMP server .If you are a new user and not familiar with command prompt you can install GUI for your ubuntu LAMP server using the 2 options

1) Install desktop Environment
2) Install Webmin

1) Install desktop Environment
First you nee to make sure you have enabled Universe and multiverse repositories in /etc/apt/sources.list file once you have enable you need to use the following command to install GUI

sudo apt-get update

sudo apt-get install ubuntu-desktop

The above command will install GNOME desktop
If you wan to install a graphical desktop manager without some of the desktop addons like Evolution and OpenOffice, but continue to use the server flavor kernel use the following command

sudo aptitude install --without-recommends ubuntu-desktop

If you want to install light weight desktop install xfce using the following command

sudo apt-get install xubuntu-desktop

If you want to install KDE desktop use the following command

sudo apt-get install kubuntu-desktop

2) Install Webmin in Ubuntu
Webmin is a web-based interface for system administration for Unix. Using any modern web browser, you can setup user accounts, Apache, DNS, file sharing and much more. Webmin removes the need to manually edit Unix configuration files like /etc/passwd, and lets you manage a system from the console or remotely.Currently There is no Webmin package in the Ubuntu repositories.This tutorial will explain how to Install Webmin in Ubuntu Jaunty
You can install webmin for your server web interface to configure apache2,mysql,FTp servers and many more.Now we will see how to install webmin in Ubuntu 9.04

Preparing your system
First you need to install the following packages

sudo aptitude install perl libnet-ssleay-perl openssl libauthen-pam-perl libpam-runtime libio-pty-perl libmd5-perl

Now download the latest webmin using the following command or from here

wget http://prdownloads.sourceforge.net/webadmin/webmin_1.470_all.deb

Now we have webmin_1.470_all.deb package install this package using the following command

sudo dpkg -i webmin_1.470_all.deb

This will complete the installation.

Using the Webmin APT repository
If you like to install and update Webmin via APT, edit the /etc/apt/sources.list file on your system

sudo vi /etc/apt/sources.list

add the line

deb http://download.webmin.com/download/repository sarge contrib

Save and exit the file
You should also fetch and install my GPG key with which the repository is signed, with the commands : cd /root

wget http://www.webmin.com/jcameron-key.asc

sudo apt-key add jcameron-key.asc

You will now be able to install with the commands

sudo apt-get update

sudo apt-get install webmin

All dependencies should be resolved automatically.
Ubuntu in particular don’t allow logins by the root user by default. However, the user created at system installation time can use sudo to switch to root. Webmin will allow any user who has this sudo capability to login with full root privileges.

Now you need to open your web browser and enter the following

https://your-server-ip:10000/

Now you should see similar to the following Screen

After login if you want to configure Apache,Mysql server you need to click on Servers on your lefthand side you should many servers are ready to configure
This is very Easy to configure most of the servers and Enjoy your new Ubuntu Jaunty LAMP Server.

Bandwidth Monitoring Tools For Linux

2011-10-07T14:10:00.001-07:00

Bandwidth in computer networking refers to the data rate supported by a network connection or interface. One most commonly expresses bandwidth in terms of bits per second (bps). The term comes from the field of electrical engineering, where bandwidth represents the total distance or range between the highest and lowest signals on the communication channel (band).

Bandwidth represents the capacity of the connection. The greater the capacity, the more likely that greater performance will follow, though overall performance also depends on other factors, such as latency.

Bandwidthd
BandwidthD tracks usage of TCP/IP network subnets and builds html files with graphs to display utilization. Charts are built by individual IPs, and by default display utilization over 2 day, 8 day, 40 day, and 400 day periods. Furthermore, each ip address’s utilization can be logged out at intervals of 3.3 minutes, 10 minutes, 1 hour or 12 hours in cdf format, or to a backend database server. HTTP, TCP, UDP, ICMP, VPN, and P2P traffic are color coded.
Current Stable Version :- 2.0.1
Project Home Page :- http://bandwidthd.sourceforge.net/

Bmon
bmon is a portable bandwidth monitor and rate estimator running on various operating systems. It supports various input methods for different architectures. Various output modes exist including an interactive curses interface,lightweight HTML output but also formatable ASCII output.

Bwbar
bwbar is a small C-based program for Linux-based machines which produces bandwidth usage statistics for a network interface. It was originally written by H. Peter Anvin, and I (Brian Towne) modified it somewhat to better suit my needs. The original program was released under the GPL. A number of people have asked for the modified program and its source, so I have created this page.
Current Stable Version :- 1.2.3

bwm
This is a very tiny bandwidth monitor (not X11). Can monitor up to 16 interfaces in the in the same time, and shows totals too.
Current Stable Version :- 1.1.0

bwm-ng
small and simple console-based bandwidth monitor.Bandwidth Monitor NG is a small and simple console-based live bandwidth monitor.
Current Stable Version :- 0.6
Project Home Page :- http://www.gropp.org/?id=projects&sub=bwm-ng

Cacti
Cacti is a complete network graphing solution designed to harness the power of RRDTool’s data storage and graphing functionality. Cacti provides a fast poller, advanced graph templating, multiple data acquisition methods, and user management features out of the box. All of this is wrapped in an intuitive, easy to use interface that makes sense for LAN-sized installations up to complex networks with hundreds of devices.
Current Stable Version :- 0.8.7e
Project Home Page :- http://cacti.net/

cbm
cbm — the color bandwidth meter — is a small program to display the traffic currently flowing through your network devices.
Current Stable Version :- 0.1

dstat
Dstat is a versatile replacement for vmstat, iostat, netstat, nfsstat and ifstat. Dstat overcomes some of their limitations and adds some extra features, more counters and flexibility. Dstat is handy for monitoring systems during performance tuning tests, benchmarks or troubleshooting.
Current Stable Version :- 0.7.1
Project Home Page :- http://dag.wieers.com/home-made/dstat/

EtherApe
EtherApe is a graphical network monitor for Unix modeled after etherman. Featuring link layer, ip and TCP modes, it displays network activity graphically. Hosts and links change in size with traffic. Color coded protocols display.
Current Stable Version :- 0.9.9
Project Home Page :- http://etherape.sourceforge.net/

gdesklets
gDesklets is a system for bringing mini programs (desklets), such as weather forecasts, news tickers, system information displays, or music player controls, onto your desktop, where they are sitting there in a symbiotic relationship of eye candy and usefulness. The possibilities are really endless and they are always there to serve you whenever you need them, just one key-press away. The system is not restricted to one desktop environment, but currently works on most of the modern Unix desktops (including GNOME, KDE, Xfce).
Current Stable Version :- 0.36.1
Project Home Page :- http://www.gdesklets.de/

GKrellM
GKrellM is a single process stack of system monitors which supports applying themes to match its appearance to your window manager, Gtk, or any other theme.
Current Stable Version :- 2.3.4
Project Home Page :- http://members.dslextreme.com/users/billw/gkrellm/gkrellm.html

ipband
ipband is a pcap based IP traffic monitor. It tallies per-subnet traffic and bandwidth usage and starts detailed logging if specified threshold for the specific subnet is exceeded. If traffic has been high for a certain period of time, the report for that subnet is generated which can be appended to a file or e-mailed. When bandwidth usage drops below the threshold, detailed logging for the subnet is stopped and memory is freed.
Current Stable Version :- 0.8.1
Project Home Page :- http://ipband.sourceforge.net/

iftop
iftop does for network usage what top does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts. Handy for answering the question “why is our ADSL link so slow”.
Current Stable Version :- 0.17
Project Home Page :- http://www.ex-parrot.com/pdw/iftop/

iperf
Iperf is a tool to measure maximum TCP bandwidth, allowing the tuning of various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, datagram loss.

ipfm
IP Flow Meter (IPFM) is a bandwidth analysis tool, that measures how much bandwidth specified hosts use on their Internet link.
Current Stable Version :- 0.11.5
Project Home Page :- http://robert.cheramy.net/ipfm/

ifstat
ifstat is a tool to report network interfaces bandwith just like vmstat/iostat do for other system counters.
Current Stable Version :- 1.1
Project Home Page :- http://gael.roualland.free.fr/ifstat/

ibmonitor
ibmonitor is an interactive linux console application which shows bandwidth consumed and total data transferred on all
interfaces.
Current Stable Version :- 1.4
Project Home Page :- http://ibmonitor.sourceforge.net/

ipaudit
IPAudit monitors network activity on a network by host, protocol and port.IPAudit listens to a network device in promiscuous mode, and records every connection between two ip addresses. A unique connection is determined by the ip
addresses of the two machines, the protocol used between them, and the port numbers (if they are communicating via udp or tcp).
Current Stable Version :- 0.95

Project Home Page :- http://ipaudit.sourceforge.net/

IPTraf
IPTraf is a console-based network statistics utility for Linux. It gathers a variety of figures such as TCP connection packet and byte counts, interface statistics and activity indicators, TCP/UDP traffic breakdowns, and LAN station packet and byte counts.
Current Stable Version :- 3.0.0

Project Home Page :- http://iptraf.seul.org/

IFStatus
IFStatus was developed for Linux users that are usually in console mode. It is a simple, easy to use program for displaying commonly needed / wanted statistics in real time about ingoing and outgoing traffic of multiple network interfaces that is usually hard to find, with a simple and effecient view. It is the substitute for PPPStatus and EthStatus projects.
Current Stable Version :- 1.1.0

jnettop
Jnettop is a traffic visualiser, which captures traffic going through the host it is running from and displays streams sorted by bandwidth they use.
Current Stable Version :- 0.13.0
Project Home Page :- http://jnettop.kubs.info/wiki/

MRTG
The Multi Router Traffic Grapher (MRTG) is a tool to monitor the traffic load on network links. MRTG generates HTML pages containing PNG images which provide a LIVE visual representation of this traffic.
Current Stable Version :- 2.16.3
Project Home Page :- http://oss.oetiker.ch/mrtg/

moodss
moodss is a graphical monitoring application. It is modular so that the code accessing the monitored objects is completely separate from the application core. The core takes care of managing modules (loading and unloading),displaying modules data through sortable tables and diverse graphical viewers, handling user set threshold conditions with email alerts, recording and browsing data history from a database.moodss can even predict the future, using sophisticated statistical methods and artificial neural networks, and therefore be used for capacity planning.
Current Stable Version :- 21.5
Project Home Page :- http://moodss.sourceforge.net/

monitord
A lightweight (distributed?) network security monitor for TCP/IP+Ethernet LANs. It will capture certain network events and record them in a relational database. The recorded data will be available for analysis through a CGI based interface.
Current Stable Version :- 4.0
Project Home Page :- http://sourceforge.net/projects/monitord/

Netmrg
NetMRG is a tool for network monitoring, reporting, and graphing. Based on RRDTOOL, the best of open source graphing
systems, NetMRG is capable of creating graphs of any parameter of your network.
Current Stable Version :- 0.20
Project Home Page :- http://www.netmrg.net

nload
nload is a console application which monitors network traffic and bandwidth usage in real time. It visualizes the in-and outgoing traffic using two graphs and provides additional info like total amount of transfered data and min/max network usage.
Current Stable Version :- 0.7.2
Project Home Page :- http://www.roland-riegel.de/nload/index.html

ntop
ntop shows the current network usage. It displays a list of hosts that are currently using the network and reports information concerning the IP (Internet Protocol) and Fibre Channel (FC) traffic generated by each host. The traffic is sorted according to host and protocol. Default protocol list (this is user configurable).
Current Stable Version :- 3.3.10
Project Home Page :- http://www.ntop.org

netspeed
Netspeed is just a little GNOME-applet that shows how much traffic occurs on a specified network device (for example eth0). You get the best impression of it, if you look at the screenshots below.
Current Stable Version :- 0.14
Netwatch
Netwatch is a Linux program created to aid in monitoring Network Connections. It is based on a program called “statnet” but has been substantially modified for its Ethernet emphasis. It is a dynamic program which displays the Ethernet status based each the connection’s activity. It has the capability of monitoring hundreds of site statistics simultaneously. The connection’s port number (Well Known Service) and destination address are available as well. There are options which allow router statistics to be measured on simple networks (with one router). External network communication is counted and transfer rates are displayed.
Current Stable Version :- 1.3.0-1
Project Home Page :- http://www.slctech.org/~mackay/netwatch.html

NOCOL
NOCOL is a popular system and network monitoring (network management) software that runs on Unix systems and can
monitor network and system devices. It uses a very simple architecture and is very flexible for adding new network management modules
Current Stable Version :- 4.3.1
Project Home Page :- http://www.netplex-tech.com/nocol/

NeTraMet
NeTraMet is an open-source (GPL) implementation of the RTFM architecture for Network Traffic Flow Measurement,
developed and supported by Nevil Brownlee at the University of Auckland. Nevil also developed a version of NeTraMet
which uses the CoralReef library to read packet headers. This ‘CoralReef NeTraMet meter’ can work with any CoralReef
data source; it has been tested on both CAIDA and NLANR trace files, and on DAG and Apptel ATM interface cards.
Current Stable Version :- 43
Project Home Page :- http://freshmeat.net/projects/netramet/

NetPIPE
NetPIPE is a protocol independent performance tool that visually represents the network performance under a variety of
conditions. It performs simple ping-pong tests, bouncing messages of increasing size between two processes, whether
across a network or within an SMP system. Message sizes are chosen at regular intervals, and with slight perturbations, to provide a complete test of the communication system. Each data point involves many ping-pong tests to provide an accurate timing. Latencies are calculated by dividing the round trip time in half for small messages ( <64 Bytes ).
Current Stable Version :- 3.7.1
Project Home Page :- http://www.scl.ameslab.gov/netpipe/

netperf
Netperf is a benchmark that can be use to measure various aspect of networking performance. The primary foci are bulk
(aka unidirectional) data transfer and request/response performance using either TCP or UDP and the Berkeley Sockets interface. As of this writing, the tests available either unconditionally or conditionally
Current Stable Version :- 2.4.5
Project Home Page :- http://www.netperf.org/netperf/

potion
This is a console utility which will listen on an interface using libpcap, aggregate the traffic into flows and display the top (as many as can fit on your screen) flows with their average throughput. A flow is identified ip protocol, source ip, source port, destination ip, destination port, and type of service flag.
Current Stable Version :- 0.0.4

pktstat
Display a real-time list of active connections seen on a network interface, and how much bandwidth is being used by what. Partially decodes HTTP and FTP protocols to show what filename is being transferred. X11 application names are also shown. Entries hang around on the screen for a few seconds so you can see what just happened. Also accepts filter expressions á la tcpdump.
Current Stable Version :- 1.8.4
Project Home Page :- http://www.adaptive-enterprises.com.au/~d/software/pktstat/

RTG
RTG is a flexible, scalable, high-performance SNMP statistics monitoring system. It is designed for enterprises and service providers who need to collect time-series SNMP data from a large number of targets quickly. All collected data is inserted into a relational database that provides a common interface for applications to generate complex queries and reports. RTG includes utilities that generate configuration and target files, traffic reports, 95th percentile reports and graphical data plots. These utilities may be used to produce a web-based interface to the data.
Current Stable Version :- 0.7.4
Project Home Page :- http://rtg.sourceforge.net/

speedometer
Monitor network traffic or speed/progress of a file transfer. The program can be used for cases like: how long it will take for my 38MB transfer to finish, how quickly is another transfer going, How fast is the upstream on this ADSL line and how fast can I write data to my filesystem.
Current Stable Version :- 2.6
Project Home Page :- http://excess.org/speedometer/

Spong
Spong is a simple system-monitoring package written in Perl. It features client based monitoring, monitoring of network services, results displayed via the Web or console, history of problems, and flexible messaging when problems occur.
Current Stable Version :- 2.7.6
Project Home Page :- http://spong.sourceforge.net/

slurm
slurm started as a pppstatus port to FreeBSD. As I ripped off several functions
Current Stable Version :- 0.3.3

SNIPS
SNIPS (System & Network Integrated Polling Software) is a system and network monitoring software that runs on Unix systems and can monitor network and system devices. It is capable of monitoring DNS, NTP, TCP or web ports, host performance, syslogs, radius servers, BGP peers, etc. New monitors can be added easily (via a C or Perl API).
Current Stable Version :- 1.1
Project Home Page :- http://www.navya.com/software/snips/

tcpflow
tcpflow is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way
that is convenient for protocol analysis or debugging. A program like tcpdump shows a summary of packets seen on the
wire, but usually doesn’t store the data that’s actually being transmitted. In contrast, tcpflow reconstructs the actual data streams and stores each flow in a separate file for later analysis. tcpflow understands TCP sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery.
Current Stable Version :- 0.21
Project Home Page :- http://www.circlemud.org/~jelson/software/tcpflow/

vnstat
vnStat is a network traffic monitor for Linux that keeps a log of daily network traffic for the selected interface(s).vnStat isn’t a packet sniffer. The traffic information is analyzed from the /proc -filesystem, so vnStat can be used without root permissions. However at least a 2.2.x kernel is required.
Current Stable Version :- 1.10
Project Home Page :- http://humdi.net/vnstat/

WMND
Shows a graph of incoming/outgoing traffic, activity indicators for rx/tx and current/maximum rate for rx/tx in bytes or packets.Tailored for use with WindowMaker, it will as well work with any other window manager though.
Current Stable Version :- 0.4.13
Project Home Page :- http://dockapps.org/file.php/id/178

Speed Up Firefox web browser

2011-10-07T14:07:00.001-07:00

Mozilla Firefox is a graphical web browser developed by the Mozilla Corporation. Started as a fork of the browser component (Navigator) of the Mozilla Application Suite, Firefox has replaced the Mozilla Suite as the flagship product of the Mozilla project, stewarded by the Mozilla Foundation and a large community of external contributors.

Mozilla Firefox is a cross-platform browser, providing support for various versions of Microsoft Windows, Mac OS X, and Linux. Although not officially released for certain operating systems, the freely available source code works for many other operating systems, including FreeBSD,OS/2, Solaris, SkyOS, BeOS and more recently, Windows XP Professional x64 Edition.

I am providing some Very Useful Tips to speedup your Firefox.

In your location bar, type about:config

Once it Opens You should see similar to the following screen

Tip1
In the filter bar type network.http.pipelining

You should see the following screen

Normally it says ” false ” under value field , Double click it so it becomes ” true “.
Once you finished this you should see the following screen.

Tip2
In the filter bar again and type network.http.pipelining.maxrequests
Once it Opens You should see the following screen

Default it says 4 under value field and you need to change it to 8
Once you finished this you should see the following screen.

Tip3
Go to the filter bar again and type network.http.proxy.pipelining
Once it Opens You should see similar to the following screen

Normally it says ” false ” under value field , Double click it so it becomes ” true “.
Once you finished this you should see the following screen.

Tip4
Go to the filter bar again and type network.dns.disableIPv6
Once it Opens You should see the following screen

Normally it says ” false ” under value field , Double click it so it becomes ” true “.
Once you finished this you should see the following screen.

Tip5
Go to the filter bar again and type plugin.expose_full_path
Once it Opens You should see the following screen

Normally it says ” false ” under value field , Double click it so it becomes ” true “.
Once you finished this you should see the following screen.

Tip6
Now you need to Create new Preference name with interger value for this got to Right click -> New -> Integer

Once it opens you should see the following screen

Here you need to type nglayout.initialpaint.delay and click ok

Now you need to enter 0 in value filed and click ok

Once you finished this you should see the following screen.

Tip7
Now you need to Create one more Preference name with interger value for this got to Right click -> New -> Integer

Once it opens you should see the following screen

Here you need to type content.notify.backoffcount and click ok

Now you need to enter 5 in value filed and click ok

Once you finished this you should see the following screen.

Tip8
Now you need to Create one more Preference name with interger value for this got to Right click -> New -> Integer

Once it opens you should see the following screen

Here you need to type ui.submenuDelay and click ok

Now you need to enter 0 in value filed and click ok

Once you finished this you should see the following screen.

Some more Tweaks
Enable the spellchecker for inputfields and textareas (default is textareas only)
layout.spellcheckDefault=2
Open lastfm://-links directly in amarok
network.protocol-handler.app.lastfm=amarok
network.protocol-handler.external.lastfm=true

Firefox Memory Leak Fix
Open a new tab. Type “about:config” without quotes into the address bar and hit enter/click Go.

Right-click anywhere, select New, then Integer. In the dialog prompt that appears, type:
browser.cache.memory.capacity
Click OK. Another dialog prompt will appear. This is where you decide how much memory to allocate to Firefox. This depends on how much RAM your computer has, but generally you don’t want to allocate too little (under 8MB), but if you allocate too much, you might as well not do this. A good recommended setting is 16MB. If you want 16MB, enter this value into the dialog prompt:

16384
(Why 16384 instead of 16000? Because computers use base-12 counting. Thus 16 megabytes = 16384 bytes. Likewise, if you want to double that and allocate 32MB, you’d enter 32768.)
Click OK to close the dialog box, then close all instances of Firefox and restart. If your Firefox still uses the same amount of memory, give it a few minutes and it should slowly clear up. If that fails, try a system reboot.

Now your Firefox will now be 3 - 30 times faster in loading pages.

Mount and Unmout ISO images without burning them

2011-10-07T14:04:00.001-07:00

Some times you want to use iSO images without burning them.If you don’t want to waste your CD’s/DVD’s here is the simple possible solutions using these tips you can mount and unmount ISO images without burning them.

I know two possible solutions:
1) Using Nautilus Scripts
2) Using kernel loop module

Now we will see each one in detailed

Using Nautilus Scripts
I am taking this tip from here first you need to download two scripts for mount iso images download from here for unmount iso images download from here
Once you have these two scripts you need to change the permissions using the following commands

sudo chmod +x /home/username/mount.sh
sudo chmod +x /home/username/unmount.sh

Now you need to copy them nautilus scripts

sudo mv /home/username/mount.sh ~/.gnome2/nautilus-scripts/
sudo mv /home/username/unmount.sh ~/.gnome2/nautilus-scripts/

That’s it now you are ready for mounting and unmounting your ISO images.

Example
Mount ISO Image
Now i have one ISO image if you want to mount you need to right click and select scripts ---> mount-iso

Now it will prompt for root password and click ok

You can see the Mounter notification like the following

Here is the Successfully mounted message if you want to open this one click ok

This shows you available contents in mounted ISO image

Unmount ISO Image
Now i have one ISO image if you want to mount you need to right click and select scripts--->unmount-iso

Here is the Successfully Unmounted message

Using loop Kernel Module
First you need to make the directory to put the ISO into using the following command

sudo mkdir /media/isoimage

Now you need to add the loop module to your kernel.
What kernel loop module does?
I want to give brief introduction to kernel loop module.Using the module loop it is possible to mount a filesystem file. squashfs is a “loop” with (de)compression (Compressed Loopback Device) and it is possible to mount a compressed filesystem like a block device and seamlessly decompress its data while accessing it.
Use the following command to load loop module
sudo modprobe loop

Mount ISO Image
If you want to mount you need to use the following command

sudo mount debianetch.iso /media/isoimage/ -t iso9660 -o loop

In the above command you can replace debianetch.iso to your own iso image.
Now you should have your iso file mounted, and accessible from your desktop.

Unmount ISO Image
Unmount ISO Image Using the following command
sudo umount /media/isoimage

Share your Ubuntu Desktop Using Remote Desktop

2011-10-07T14:02:00.001-07:00

vino is VNC server for GNOME.VNC is a protocol that allows remote display of a user’s desktop. This package provides a VNC server that integrates with GNOME, allowing you to export your running desktop to another computer for remote use or diagnosis.
By default ubuntu will come with vino-server so it is very easy to configure to enable remote desktop sharing in your ubuntu machine.If you want to access ubuntu machine remotely you need to login in to your ubuntu system.

Important note:
Remote Desktop will only work if there’s a GNOME login session.Leaving your computer with an unattended GNOME login session is not secure and not recommended.

Some Tips

1) You can lock your screen using System--->Quit

Once you click on quit you should see the following screen here you need to select lockscreen

2) switch off your monitor when computer is left unattended

Configuring Remote Desktop

First you need to go to System -> Preferences -> Remote Desktop

Once it opens you should see the following screen

In the above screen you need to configure remote desktop preferences for sharing and security

For Sharing
you need to tick the box next to the following two options
Allow other users to view your desktop
Allow other users to control your desktop

For Security
you need to tick the box next to the following two options
Ask you for confirmation (If you tick this option some one need to click on allow from remote desktop once it connected if you don’t want you can untick this option)
Require the user to enter this password:

Password: Specify the password

Connecting from Ubuntu Machine
Open your terminal from Applications--->Accessories--->Terminal and enter the following command

vncviewer -fullscreen 192.168.2.23:0

now you should see the following message asking for password enter the password after complete success you can see VNC authentication succeeded message and starting remote desktop

VNC viewer version 3.3.7 - built Jul 4 2006 10:04:48
Copyright (C) 2002-2003 RealVNC Ltd.
Copyright (C) 1994-2000 AT&T Laboratories Cambridge.
See http://www.realvnc.com for information on VNC.
VNC server supports protocol version 3.7 (viewer 3.3)

Password:

VNC authentication succeeded
If you want to quit vncviewer
Press ‘F8′ and select Quit viewer

Connecting from Windows machine
If you are trying to connect from your windows machine you need to install vncviewer of your choice i have installed from here http://www.realvnc.com/download.html.Install this program once you install this you can opem from start--->All programs--->RealVNC--->VNC Viewer 4--->Run VNC Viewer once it opens you should see the following screen here enter the remotemachine ipaddress:0 format and click ok

Now it will prompt for password enter your password and click ok

Now on the remote machine you should see the following screen asking for permission to allow this connection you need to click on allow this will comeup only if you tick “Ask you for confirmation” option under sharing

Once it connected you should see the remote machine desktop like the following screen

How to install Ubuntu Linux from USB Stick

2011-10-07T14:00:00.001-07:00

This tutorial describes how to install Ubuntu by copying the contents of the installation CD to an USB memory stick (aka flash drive) and making the stick bootable. This is handy for machines like ultra portable notebooks that do not have a CD drive but can boot from USB media.

In short here’s what you do:
Prepare the USB flash drive
Boot the computer from your USB flash drive.
Install Ubuntu as you would from a normal boot CD

Prerequisites
A running Ubuntu 8.04 or any ubuntu version installation
A USB device (stick, pen-drive, USB hard disk) that has already been formatted with FAT32 and has enough free space to hold your Ubuntu installation image
A Ubuntu CD image downloaded from the Ubuntu servers or mirrors (*.iso file) or from here

Step 1
On the root directory of your USB device, create a folder “install”
Copy the installer kernel and the initramdisk into this folder (Download source below.You need the files “vmlinux” and “initrd.gz”).
Download source for the installer kernel and initramdisk

For AMD64 Download from here
For i386 Download from here

You need to download the files “vmlinux” and “initrd.gz”.

Step 2
Note: You need to have the installer that fits the architecture of your Ubuntu version you want to install. In other words, you need a amd64 installer if you want to install an amd64 Ubuntu .iso image and the i386 installer for an i386 iso.

Step 3
From the installation iso image you downloaded, copy the folder “isolinux” to the root directory of your USB device (right-click on the .iso file, choose “extract here”). Rename “isolinux” into “syslinux”. Go inside the directroy “syslinux”. There, rename the file “isolinux.cfg” into “syslinux.cfg”.

Step 4
Make the stick bootable: Use fdisk to set the boot flag,
Install syslinux using the following command
sudo aptitude install syslinux
Now use syslinux to install a boot sector on your USB device

sudo syslinux /dev/sdbX

where sdbX is the device name and number of your USB device, check with “sudo mount”. A file called “ldlinux.sys” will be created in the root direcotry of the USB device.

Step 5
Copy the Ubuntu CD image in the root directory of your USB device (Contents of USB you can see as follows).If you are using i386 you need to copy the complete .iso image in to the root directory of your USB device.

How to Install Chromium (Google chrome) in Ubuntu using deb package

2011-10-07T13:58:00.001-07:00

We have already discussed how to install google chrome using wine .Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all Internet users to experience the web. The Chromium codebase is the basis for Google’s Chrome browser.

First you can use this tutorial to install chromium in Ubuntu using PPAs and after that you can try any one of the following methods.

First you need to download .deb package from here using the following command
wget http://media.codeweavers.com/pub/crossover/chromium/cxchromium_0.9.0-1_i386.deb
Now you have cxchromium_0.9.0-1_i386.deb package install this package using the following command

sudo dpkg -i cxchromium_0.9.0-1_i386.deb

Using Ubuntu PPA

First you need edit /etc/apt/sources.list file

gksudo gedit /etc/apt/sources.list

Add the following two lines for Ubuntu 9.04 (Jaunty) Users

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu jaunty main
deb-src http://ppa.launchpad.net/chromium-daily/ppa/ubuntu jaunty main

For ubuntu 9.10 (Karmic) Users add the following two lines

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main
deb-src http://ppa.launchpad.net/chromium-daily/ppa/ubuntu karmic main

For ubuntu 10.04 (Lucid) Users add the following two lines

deb http://ppa.launchpad.net/chromium-daily/ppa/ubuntu lucid main
deb-src http://ppa.launchpad.net/chromium-daily/ppa/ubuntu lucid main

save and exit the file
Now add the GPG key using the following command
sudo apt-key adv --recv-keys --keyserver keyserver.ubuntu.com 0xfbef0d696de1c72ba5a835fe5a9bf3bb4e5e17b5
or For karmic users use the following command

sudo add-apt-key ppa:chromium-daily/ppa

Update source list

sudo apt-get update

Install chromium browser using the following command

sudo apt-get install chromium-browser

This will complete the installation
If you want to open chromium go to Applications->CrossOver Chromium->Chromium
Chromium web browser in action

Large WAR file cannot be deployed in Tomcat 7

2011-10-07T13:23:00.000-07:00

Problem

When uploading a WAR file larger than 50 MB, the Tomcat 7 Manager application reports:
The server encountered an internal error () that prevented it from fulfilling this request.
Exception java.lang.IllegalStateException:
org.apache.tomcat.util.http.fileupload.FileUploadBase$SizeLimitExceededException:
the request was rejected because its size (XXX) exceeds the configured maximum (52428800)

Solution

Go to the web.xml of the manager application (for instance it could be under /tomcat7/webapps/manager/WEB-INF/web.xml.
Increase the max-file-size and max-request-size:

<multipart-config> 
<max-file-size><strong>52428800</strong></max-file-size>
<max-request-size><strong>52428800</strong></max-request-size>
<file-size-threshold>0</file-size-threshold>

</multipart-config>

Linux Web Server and Domain Configuration Tutorial

2011-10-07T00:53:00.000-07:00

Create a web server with Linux, Apache, FTP and bind DNS: This tutorial covers the Linux server configuration required to host a website. The Apache web server, FTP server and DNS configuration are covered. The Apache web server is required to serve the web pages, the FTP server is required for users to upload content and the DNS server is required to resolve the domain names so that a URL entered into a web browser will point to your web server and properly serve the correct pages. The configurations presented will include virtual hosting which will allow a single Linux server to support multiple web site domains.

Web Site Prerequisites:
This tutorial assumes that a computer has Linux installed and running. See RedHat Installation for the basics. A connection to the internet is also assumed. A connection of 128 Mbits/sec or greater will yield the best results. ISDN, DSL, cable modem or better are all suitable. A 56k modem will work but the results will be mediocre at best. The tasks must also be performed with the root user login and password.
No single distribution seems to have an advantage. A Ubuntu, SuSe, Fedora, Red Hat or CentOS distribution will include all of the software you will need to configure a web server. If using Red Hat Enterprise Linux, both the Workstation or the Server edition will support your needs except that the Workstation edition will not include the vsFTP package. It will have to be compiled from source or use sftp.
Software Prerequisites: The Apache web server (httpd), FTP (requires xinetd or inetd) and Bind (named) software packages with their dependencies are all required. One can use the rpm command to verify installation:

Fedora Core 1+, Red Hat Enterprise 4/5, CentOS 4/5:
```
rpm -q httpd bind bind-chroot bind-utils system-config-bind xinetd vsftpd
    
```
RPMs added FC2+: system-config-httpd
RPMs added FC3+: httpd-suexec
Red Hat 9.0
```
rpm -q httpd bind xinetd vsftpd
```
A Red Hat 8.0 wu-ftpd RPM may be installed (Newer version 2.6.2 or later with security fix wu-ftpd-2.6.2-11) or install from source.
Red Hat 8.0
```
rpm -q httpd bind xinetd wu-ftpd
```
Red Hat 7.x:
```
rpm -q apache bind inetd wu-ftpd
```
Use wu-ftpd version 2.6.2 or later to avoid security problems.
SuSE 9.3:
```
rpm -ivh apache2 apache2-prefork bind bind-chrootenv bind-utils vsftpd
```
Note: The apache2-MPM is a generic term for Apache installation options for "Multi-Processing Modules (MPM)s "prefork" or "worker". If you try and only install apache2 you will get the following error:
```
apache2-MPM is needed by apache2-2.0.53-9
```
Also see Apache.org: MPMs

Ubuntu (natty 11.04) / Debian:

apt-get install apache2
         
   apt-get install bind9 
         
   apt-get install vsftpd

Ubuntu (dapper 6.06/hardy 8.04) / Debian:

apt-get install apache2 apache2-common apache2-mpm-prefork apache2-utils
         
   apt-get install bind9 
         
   apt-get install vsftpd

One should also have a working knowledge of the Linux init process so that these services are initiated upon system boot. See the YoLinux init process tutorial for more info.

Apache HTTP Web server configuration:

This tutorial is for the Apache HTTP web server (Version 1.3 and 2.0). See the YoLinux list of Linux HTTP servers for a list of other web servers for the Hyper Text Transport Protocol.
The Apache web server configuration file is: /etc/httpd/conf/httpd.conf
Web pages are served from the directory as configured by the DocumentRoot directive. The default directory location is:

Linux distribution	Apache web server "DocumentRoot"
Red Hat 7.x-9, Fedora Core, Red Hat Enterprise 4/5/6, CentOS 4/5/6	`/var/www/html/`
Red Hat 6.x and older	`/home/httpd/html/`
Suse 9.x	`/srv/www/htdocs/`
Ubuntu (dapper 6.06) / Debian	`/var/www/html`
Ubuntu (hardy 8.04/natty 11.04) / Debian	`/var/www`

The default home page for the default configuration is index.html. Note the pages should not be owned by user apache as this is the process owner of the httpd web server daemon. If the web server process is comprimised, it should not be allowed to alter the files. The files should of course be readable by user apache. Apache may be configured to run as a host for one web site in this fashion or it may be configured to serve for multiple domains. Serving for multiple domains may be achieved in two ways:

Virtual hosts: One IP address but multiple domains - "Name based" virtual hosting.
Multiple IP based virtual hosts: One IP address for each domain - "IP based" virtual hosting.

The default configuration will allow one to have multiple user accounts under one domain by using a reference to the user account: http://www.domain.com/~user1/. If no domain is registered or configured, the IP address may also be used: http://XXX.XXX.XXX.XXX/~user1/. [Potential Pitfall] The default umask for directory creation is correct by default but if not use: chmod 755 /home/user1/public_html
[Potential Pitfall] When creating new "Directory" configuration directives, I found that placing them by the existing "Directory" directives to be a bad idea. It would not use the .htaccess file. This was because the statement defining the use of the .htaccess file was after the "Directory" statement. Previously in RH 6.x the files were separated and the order was defined a little different. I now place new "Directory" statements near the end of the file just before the "VirtualHost" statements.
For users of Red Hat 7.1, the GUI configuration tool apacheconf was introduced for the crowd who like to use pretty point and click tools.
Files used by Apache:

Start/stop/restart script:
- Red Hat/Fedora/CentOS: /etc/rc.d/init.d/httpd
- SuSE 9.3: /etc/init.d/apache2
- Ubuntu (dapper 6.06/hardy 8.04/natty 11.04) / Debian: /etc/init.d/apache2
Apache main configuration file:
- Red Hat/Fedora/CentOS: /etc/httpd/conf/httpd.conf
- SuSE: /etc/apache2/httpd.conf
  (Need to add directive: ServerName host-name)
- Ubuntu (dapper 6.06/hardy 8.04/natty 11.04) / Debian: /etc/apache2/apache2.conf
Apache suplementary configuration files:
- Red Hat/Fedora/CentOS: /etc/httpd/conf.d/component.conf
- SuSE: /etc/apache2/conf.d/component.conf
- Ubuntu (dapper 6.06/hardy 8.04/natty 11.04) / Debian:
  - Virtual domains: /etc/apache2/sites-enabled/domain
    (Create soft link from /etc/apache2/sites-enabled/domain to /etc/apache2/sites-available/domain to turn on. Use command a2ensite)
  - Additional configuration directives: /etc/apache2/conf.d/
  - Modules to load: /etc/apache2/mods-available/
    (Soft link to /etc/apache2/mods-enabled/ to turn on)
  - Ports to listen to: /etc/apache2/ports.conf
/var/log/httpd/access_log and error_log - Red Hat/Fedora Core Apache log files
(Suse: /var/log/apache2/)

Start/Stop/Restart scripts: The script is to be run with the qualifiers start, stop, restart or status.
i.e. /etc/rc.d/init.d/httpd restart. A restart allows the web server to start again and read the configuration files to pick up any changes. To have this script invoked upon system boot issue the command chkconfig --add httpd. See Linux Init Process Tutorial for a more complete discussion.
Also Apache control tool: /usr/sbin/apachectl start
Apache Control Command: apachectl:

Red Hat / Fedora Core / CentOS: apachectl directive Ubuntu dapper 6.06 / hardy 8.04 / natty 11.04 / Debian: apache2ctl directive

Directive	Description
start	Start the Apache httpd daemon. Gives an error if it is already running.
stop	Stops the Apache httpd daemon.
graceful	Gracefully restarts the Apache httpd daemon. If the daemon is not running, it is started. This differs from a normal restart in that currently open connections are not aborted.
restart	Restarts the Apache httpd daemon. If the daemon is not running, it is started. This command automatically checks the configuration files as in configtest before initiating the restart to make sure the daemon doesn't die.
status	Displays a brief status report.
fullstatus	Displays a full status report from mod_status. Requires mod_status enabled on your server and a text-based browser such as lynx available on your system. The URL used to access the status report can be set by editing the STATUSURL variable in the script.
configtest -t	Run a configuration file syntax test.

Apache Configuration Files:

/etc/httpd/conf/httpd.conf: is used to configure Apache. In the past it was broken down into three files. These may now be all concatenated into one file. See Apache online documentation for the full manual.
/etc/httpd/conf.d/application.conf: All configuration files in this directory are included during Apache start-up. Used to store application specific configurations.
/etc/sysconfig/httpd: Holds environment variables used when starting Apache.

Basic settings: Change the default value for ServerName www.<your-domain.com>
Giving Apache access to the file system: It is prudent to limit Apache's view of the file system to only those directories necessary. This is done with the directory statement. Start by denying access to everything, then grant access to the necessary directories.
Deny access completely to file system root ("/") as the default:

Deny first, then grant permissions:

<Directory />
   Options None
   AllowOverride None
</Directory>

Set default location of system web pages and allow access: (Red Hat/Fedora/CentOS)

DocumentRoot "/var/www/html"

<Directory "/var/www/html">
   Options Indexes FollowSymLinks
   AllowOverride None
   Order allow,deny
   Allow from all
</Directory>

Grant access to a user's web directory: public_html

Enabling Red Hat / Fedora Linux, Apache public_html user directory access: This will allow users to serve content from their home directories under the subdirectory "/home/userid/public_html/" by accessing the URL http://hostname/~userid/

File: /etc/httpd/conf/httpd.conf

LoadModule userdir_module modules/mod_userdir.so

...
...

<IfModule mod_userdir.c>
    #UserDir disable             - Add comment to this line
    #
    # To enable requests to /~user/ to serve the user's public_html
    # directory, remove the "UserDir disable" line above, and uncomment
    # the following line instead:
    UserDir public_html          # Uncomment this line
</IfModule>

...
...

<Directory /home/*/public_html>
    AllowOverride FileInfo AuthConfig Limit
    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    <Limit GET POST OPTIONS>
        Order allow,deny
        Allow from all
    </Limit>
    <LimitExcept GET POST OPTIONS>
        Order deny,allow
        Deny from all
    </LimitExcept>
</Directory>

Change to a comment (add "#" at beginning of line) from Fedora Core default UserDir disable and assign the directory public_html as a web server accessible directory.
OR
Assign a single user the specific ability to share their directory:

<Directory /home/user1/public_html>
   AllowOverride None
   order allow,deny
   allow from all
   Options Indexes Includes FollowSymLinks
</Directory>

Allows the specific user, "user1" only, the ability to serve the directory /home/user1/public_html/

Also use SELinux command to set the security context: setsebool httpd_enable_homedirs true Directory permissions: The Apache web server daemon must be able to read your web pages in order to feed their contents to the network. Use an appropriate umask and file protection. Allow access to web directory: chmod ugo+rx -R public_html.
Note that the user's directory also has to have the appropriate permissions as it is the parent of public_html.
Default permissions on user directory: ls -l /home
drwx------ 20 user1 user1 4096 Mar 5 12:16 user1
Allow the web server access to operate the parent directory: chmod ugo+x /home/user1
d-wx--x--x 20 user1 user1 4096 Mar 5 12:16 user1
One may also use groups to control permisions. See the YoLinux tutorial on managing groups.

Enabling Ubuntu's Apache public_html user directory access: Ubuntu has broken out the Apache loadable module directives into the directory /etc/apache2/mods-available/. To enable an Apache module, generate soft links to the directory /etc/apache2/sites-enabled/ by using the commands a2enmod/a2dismod to enable/disable Apache modules.
Example:
- [root@node2]# a2enmod
  A list of available modules is displayed. Enter "userdir" as the module to enable.
- Restart Apache with the following command: /etc/init.d/apache2 force-reload
Note: This is the same as manually generating the following two soft links:
- ln -s /etc/apache2/mods-available/userdir.conf /etc/apache2/mods-enabled/userdir.conf
- ln -s /etc/apache2/mods-available/userdir.load /etc/apache2/mods-enabled/userdir.load
Man page: a2enmod/a2dismod [Potential Pitfall]: If the Apache web server can not access the file you will get the error "403 Forbidden" "You don't have permission to access file-name on this server." Note the default permissions on a user directory when first created with "useradd" are:

drwx------ 3 userx userx
You must allow the web server running as user "apache" to access the directory if it is to display pages held there.
Fix with command: chmod ugo+rx /home/userx

drwxr-xr-x 3 userx userx

SELinux security contexts:

Fedora Core 3 and Red Hat Enterprise Linux 4 introduced SELinux (Security Enhanced Linux) security policies and context labels. To view the security context labels applied to your web page files use the command: ls -Z The system enables/disables SELinux policies in the file /etc/selinux/config SELinux can be turned off by setting the directive SELINUX. (Then reboot the system):

SELINUX=disabled

or using the command setenforce 0 to temporarily disable SELinux until the next reboot. When using SELinux security features, the security context labels must be added so that Apache can read your files. The default security context label used is inherited from the directory for newly created files. Thus a copy (cp) must be used and not a move (mv) when placing files in the content directory. Move does not create a new file and thus the file does not recieve the directory security context label. The context labels used for the default Apache directories can be viewed with the command: ls -Z /var/www
The web directories of users (i.e. public_html) should be set with the appropriate context label (httpd_sys_content_t).
Assign a security context for web pages: chcon -R -h -t httpd_sys_content_t /home/user1/public_html
Options:

-R: Recursive. Files and directories in current directory and all subdirectories.
-h: Affect symbolic links.
-t: Specify type of security context.

Use the following security contexts:

Context Type	Description
`httpd_sys_content_t`	Used for static web content. i.e. HTML web pages.
`httpd_sys_script_exec_t`	Use for executable CGI scripts or binary executables.
`httpd_sys_script_rw_t`	CGI is allowed to alter/delete files of this context.
`httpd_sys_script_ra_t`	CGI is allowed to read or append files of this context.
`httpd_sys_script_ro_t`	CGI is allowed to read files and directories of this context.

Set the following options: setsebool httpd-option true
(or set to false)

Policy	Description
`httpd_enable_cgi`	Allow httpd cgi support.
`httpd_enable_homedirs`	Allow httpd to read home directories.
`httpd_ssi_exec`	Allow httpd to run SSI executables in the same domain as system CGI scripts.

Then restart Apache:

Red Hat/Fedora/Suse and all System V init script based Linux systems: /etc/init.d/httpd restart
Red Hat/Fedora: service httpd restart

The default SE boolean values are specified in the file: /etc/selinux/targeted/booleans
For more on SELinux see the YoLinux Systems Administration tutorial.

Virtual Hosts:

The Apache web server allows one to configure a single computer to represent multiple websites as if they were on separate hosts. There are two methods available and we describe the configuration of each. Choose one method for your domain:

Name based virtual host: (most common) A single computer with a single IP adress supporting multiple web domains. The web browser using the http protocol, identifies the domain being addressed.
IP based virtual host: The virtual hosts can be configured as a single multi-homed computer with multiple IP addresses on a single network card, with each IP address representing a different web domain. This has the appearance of a web domain supported by a dedicated computer because it has a dedicated IP address.

Configuring a "name based" virtual host:

A virtual host configuration allows one to host multiple web site domains on one server. (This is not required for a dedicated linux server which hosts a single web site.)

NameVirtualHost XXX.XXX.XXX.XXX

<VirtualHost XXX.XXX.XXX.XXX>
   ServerName www.your-domain.com          - CNAME (bind DNS alias www) specified in Bind configuration file (/var/named/...)
   ServerAlias your-domain.com             - Allows requests by domain name without the "www" prefix.
   ServerAdmin user1@your-domain.com
   DocumentRoot /home/user1/public_html
   ErrorLog logs/your-domain.com-error_log
   TransferLog logs/your-domain.com-access_log
</VirtualHost>

Notes:

You can specify more than one IP address. i.e. if web server is also being used as a firewall/gateway and you have an external internet IP address as well as a local network IP address.
NameVirtualHost XXX.XXX.XXX.XXX NameVirtualHost 192.168.XXX.XXX <VirtualHost XXX.XXX.XXX.XXX 192.168.XXX.XXX> ... ..
See the YoLinux Tutorial on configuring a network gateway/firewall using iptables and NAT.
Use your IP address for XXX.XXX.XXX.XXX, actual domain name and e-mail address.
One can use DNS views to provide different local network DNS results.
Note that I configure Apache for both requests http://www.domain-name.com and http://domain-name.com.

Once virtual hosts are configured, your default system domain (/var/www/html) will stop working. Your default domain now must be configured as a virtual domain.

<Directory "/var/www/html">

   ...  This part remains the same
   ..

</Directory>

# Default for when no domain name is given (i.e. access by IP address)

<VirtualHost *:80>
   ServerAdmin user1@your-domain.com
   DocumentRoot /var/www/html
   ErrorLog logs/error_log
   TransferLog logs/access_log
</VirtualHost>

# Add a VirtualHost definition for your domain which was once the system default.

<VirtualHost XXX.XXX.XXX.XXX>
   ServerName www.your-domain.com
   ServerAlias your-domain.com
   ServerAdmin user1@your-domain.com
   DocumentRoot /var/www/html
   ErrorLog logs/error_log
   TransferLog logs/access_log
</VirtualHost>

   ...
   ..

Forwarding to a primary URL. It is best to avoid the appearance of duplicated web content from two URLs such as http://www.your-domain.com and http://your-domain.com. Supply a forwarding Apache "Redirect".

<VirtualHost XXX.XXX.XXX.XXX>
   ServerName www.your-domain.com   - Note that no aliases are listed
   ...
   ...
</VirtualHost>

# Add a VirtualHost definition to forward to your primary URL

<VirtualHost XXX.XXX.XXX.XXX>
   ServerName your-domain.com
   ServerAlias other-domain.com
   ServerAlias www.other-domain.com
   Redirect permanent / http://www.your-domain.com.com/
</VirtualHost>

   ...
   ..

Note:

See the YoLinux.com Apache "Redirect" Tutorial

More virtual host examples.

When specifying more domains, they may all use the same IP address or some/all may use their own unique IP address. Specify a "NameVirtualHost" for each IP address.
After the Apache configuration files have been edited, restart the httpd daemon: /etc/rc.d/init.d/httpd restart (Red Hat) or /etc/init.d/apache2 restart (Ubuntu / Debian)

Apache virtual domain configuration with Ubuntu Dapper/Hardy:

Ububntu separates out each virtual domain into a separate configuration file held in the directory /etc/apache2/sites-available/. When the site domain is to become active, a soft link is created to the directory /etc/apache2/sites-enabled/.

Example: /etc/apache2/sites-available/supercorp

<VirtualHost XXX.XXX.XXX.XXX>
        ServerName supercorp.com
        ServerAlias www.supercorp.com
        ServerAdmin webmaster@localhost

        DocumentRoot /home/supercorp/public_html/home
        <Directory "/">
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /home/supercorp/public_html/home>
                Options Indexes FollowSymLinks MultiViews
                IndexOptions SuppressLastModified SuppressDescription
                AllowOverride All
                Order allow,deny
                allow from all
        </Directory>

        ScriptAlias /cgi-bin/ /home/supercorp/cgi-bin/
        <Directory "/home/supercorp/cgi-bin/">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog /var/log/apache2/supercorp.com-error.log

        # Possible values include: debug, info, notice, warn, error,
        # crit, alert, emerg.
        LogLevel warn
        CustomLog /var/log/apache2/supercorp.com-access.log combined
        ServerSignature On
</VirtualHost>

Enable domain:

Create soft link:
- Manually: ln -s /etc/apache2/sites-available/supercorp /etc/apache2/sites-enabled/supercorp
- Use Ubuntu scripts a2ensite/a2dissite. Type command and it will prompt you as to which site you would like to enable or disable.
Restart Apache:
- apache2ctl graceful
  or
- /etc/init.d/apache2 restart
  or
- /etc/init.d/apache2 reload

Also note that Apache modules can also be enabled/disabled with scripts a2enmod/a2dismod. Man pages:

a2ensite/a2dissite (Ubuntu: Apache 2 enable/disable site)
apache2ctl

Configuring an "IP based" virtual host:

One may assign multiple IP addresse to a single network interface. See the YoLinux networking tutorial: Network Aliasing. Each IP address may then be it's own virtual server and individual domain. The downside of the "IP based" virtual host method is that you have to possess multiple/extra IP addresses. This usually costs more. The standard name based virtual hosting method above is more popular for this reason.

NameVirtualHost *              - Indicates all IP addresses

<VirtualHost *>
   ServerAdmin user0@default-domain.com
   DocumentRoot /home/user0/public_html
</VirtualHost>

<VirtualHost XXX.XXX.XXX.101>
   ServerAdmin user1@domain-1.com
   DocumentRoot /home/user1/public_html
</VirtualHost>

<VirtualHost XXX.XXX.XXX.102>
   ServerAdmin user1@domain-2.com
   DocumentRoot /home/user2/public_html
</VirtualHost>

The default block will be used as the default for all IP addresses not specified explicitly. This default IP (*) may not work for https URL's.

CGI: (Common Gateway Interface)

CGI is a program executable which dynamically generates a web page by writing to stdout. CGI is permitted by either of two configuration file directives:

ScriptAlias:
- Red Hat 7.x-9, Fedora core: ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
- Red Hat 6.x and older: ScriptAlias /cgi-bin/ "/home/httpd/cgi-bin/"
- Suse 9.x: ScriptAlias /cgi-bin/ "/srv/www/cgi-bin/"
- Ubuntu (dapper/hardy/natty) / Debian: ScriptAlias /cgi-bin/ "/usr/lib/cgi-bin/"
or

Options +ExecCGI:

<Directory /var/www/cgi-bin>
Options +ExecCGI
</Directory>

The executable program files must have execute privileges, executable by the process owner (Red Hat 7+/Fedora Core: apache. Older use nobody) under which the httpd daemon is being run.

Configuring CGI To Run With User Privileges:

The suEXEC feature provides Apache users the ability to run CGI and SSI programs under user IDs different from the user ID of the calling web-server. Normally, when a CGI or SSI program executes, it runs as the

NameVirtualHost XXX.XXX.XXX.XXX

<VirtualHost XXX.XXX.XXX.XXX>
   ServerName node1.your-domain.com                         - Allows requests by domain name without the "www" prefix.
   ServerAlias your-domain.com www.your-domain.com          - CNAME (alias www) specified in Bind configuration file (/var/named/...)
   ServerAdmin user1@your-domain.com
   DocumentRoot /home/user1/public_html/your-domain.com
   ErrorLog logs/your-domain.com-error_log
   TransferLog logs/your-domain.com-access_log
  
   SuexecUserGroup user1 user1
   <Directory /home/user1/public_html/your-domain.com/>
      Options +ExecCGI +Indexes
      AddHandler cgi-script .cgi
   </Directory>
</VirtualHost>

ERROR Pages:

You can specify your own web pages instead of the default Apache error pages:

ErrorDocument 404 /Error404-missing.html

Create the file Error404-missing.html in your "DocumentRoot" directory.

Handle all errors with a forwarding page:

ErrorDocument 400 /error.shtml
ErrorDocument 401 /error.shtml
ErrorDocument 403 /error.shtml
ErrorDocument 404 /error.shtml
ErrorDocument 500 /error.shtml

Sample file error.shtml (in your "DocumentRoot" directory).

Page does not found!

PHP:

If the appropriate php, perl and httpd RPM's are installed, the default Red Hat Apache configuration and modules will support PHP content. RPM Packages (RHEL4):

php: HTML-embedded scripting language
php-pear: PEAR is a framework and distribution system for reusable PHP components.
php-mysql: MySQL database support.
php-ldap: Lightweight Directory Access Protocol (LDAP) support

Apache configuration:

Add php default page index.php to apache config file: /etc/httpd/conf/httpd.conf

...

DirectoryIndex index.html index.htm index.php

...

PHP Configuration File:

RHEL4 - PHP 4.3: /etc/php.ini
Ubuntu Daper 6.06/6.11: /etc/php5/apache2/php.ini

[PHP]
engine = On
...
...
display_errors = Off
include_path = ".:/php/includes"
...
...
memory_limit = 32M   ; Default is typically 8MB which is too low.
...
...

[MySQL]
...
...
mysql.default_host = superserver    ; Hostname of the computer
mysql.default_user = dbuser
...

Small portion of file shown. Note that changes will not take effect until the apache web server daemon is restarted.

Test you PHP capabilities with this test file: /home/user1/public_html/test.php

<?php
   phpinfo();
?>

OR (older format)

<?
   phpinfo();
?>

Test: http://localhost/~user1/test.php For more info see YoLinux list of PHP information web sites.

Running Multiple instances of `httpd`:

The Apache web server daemon (httpd) can be started with the command line option "-f" to specify a unique configuration file for each instance. Configure a unique IP address for each instance of Apache. See the YoLinux Networking Tutorial to specify multiple IP addresses for one NIC (Network Interface Card). Use the Apache configuration file directive Listen XXX.XXX.XXX.XXX, where the IP address is unique for each instance of Apache.

Apache Man Pages:

httpd - Apache Hypertext Transfer Protocol Server
apachectl - Apache HTTP Server Control Interface
ab - Apache HTTP server benchmarking tool
htdigest - manage user files for digest authentication
htpasswd - Manage user files for basic authentication
logresolve - Resolve IP-addresses to hostnames in Apache log files
rotatelogs - Piped logging program to rotate Apache logs

Also see the local online Apache configuration manual: http://localhost/manual/.

Apache Red Hat / Fedora Core GUI configuration:

GUI configuration tool:

Red Hat EL 4/5, Fedora 2-10: /usr/bin/system-config-httpd
Red Hat 8/9, Fedora Core 1: /usr/bin/redhat-config-httpd

Adding web site login and password protection: See the YoLinux tutorial on web site password protection.
Log file analysis:
Scanning the Apache web log files will not provide meaningfull statistics unless they are graphed or presented in an easy to read fashion. The following packages to a good job of presenting site statistics.

Analog - Also see Report Magic for Analog
Webalizer
AWStats - (requires PERL)

Web site statistic services:

eXTReMe Tracking

Load testing your server:

PureLoad - JAVA load testing and reporting tool.
WebPerformance Trainer - Load Testing Tools.

Apache Links:

CgiWrap - setuid wrapper that allows users to install and execute their own cgi scripts that get executed as their own userid
WWWThreads.org - Commercial product - Advanced Web Conferencing Software
Configuring https (mod_ssl):

Log file analysis using Analog:

Installation:

Red Hat / Fedora: yum install analog
Ubuntu / Debian: apt-get install analog

Installation packages also available from the Analog downloads page.
Configuration file: /etc/analog.cfg

LOGFILE /var/log/httpd/your-domain.com-access_log* http://www.your-domain.com
UNCOMPRESS *.gz,*.Z "gzip -cd"
SUBTYPE *.gz,*.Z
#
OUTFILE /home/user1/public_html/analog/Report.html
#
HOSTNAME "YourDomain.com"
HOSTURL  http://www.your-domain.com

....
...
..

REQINCLUDE pages                  # Request page stats only
ALL ON
LANGUAGE US-ENGLISH

One can view the settings which be used with your configuration file (also good for debugging): analog -settings Make Analog images available to the users report: ln -s /usr/share/analog/images/* /home/user1/public_html/analog Log file location:

Red Hat / Fedora: /var/log/httpd/
Ubuntu / Debian: /var/log/apache2/

The Directive ALL ON turns on all of the following:

Analog Directive	Description
`MONTHLY ON`	one line for each month
`WEEKLY ON`	one line for each week
`DAILYREP ON`	one line for each day
`DAILYSUM ON`	one line for each day of the week
`HOURLYREP ON`	one line for each hour of the day
`GENERAL ON`	the General Summary at the top
`REQUEST ON`	which files were requested
`FAILURE ON`	which files were not found
`DIRECTORY ON`	Directory Report
`HOST ON`	which computers requested files
`ORGANISATION ON`	which organisations they were from
`DOMAIN ON`	which countries they were in
`REFERRER ON`	where people followed links from
`FAILREF ON`	where people followed broken links from
`SEARCHQUERY ON`	the phrases and words they used...
`SEARCHWORD ON`	...to find you from search engines
`BROWSERSUM ON`	which browser types people were using
`OSREP ON`	and which operating systems
`FILETYPE ON`	types of file requested
`SIZE ON`	sizes of files requested
`STATUS ON`	number of each type of success and failure

Cron job to handle multiple domains: /etc/cron.daily/analog

#!/bin/sh
cp /opt/etc/analog-domain1.com.cfg      /etc/analog.cfg
/usr/bin/analog
cp /opt/etc/analog-domain2.com.cfg      /etc/analog.cfg
/usr/bin/analog

...

Links:

Measuring Web Server Performance:

See the YoLinux.com web server benchmarking tutorial.

FTPd and FTP user account configuration:

Many FTP programs exist. This example covers the popular vsftpd (Red Hat default 9.0, Fedora Core, Suse) and wu-ftpd (Washington University) program which comes standard with RedHat (last shipped with RedHat 8.0 but can be installed on any Linux system). (RPM: wu-ftpd) There are other FTP programs including proFtpd (supports LDAP authentication, Apache like directives, full featured ftp server software), bftpd, pure-ftpd (free BSD and optional on Suse), etc ...
For hostile environments set up a chrooted environment for an sftp encrypted connection and the rssh restricted shell for OpenSSH. See the YoLinux.com internet security tutorial for Linux sftp and rssh configuration
FTPd and SELinux: To allow FTPd daemon access and FTP access to users home directories:

setsebool -P allow_ftpd_full_access=1
Other wise you will get an error in /var/log/messages:

SELinux is preventing the ftp daemon from writing files outside the home directory (./public_html).
setsebool -P ftp_home_dir 1

Follow with the command service vsftpd restart FTPd configuration tutorials:

# vsFTPd: Configuration
# WU-FTPd: Configuration
# FTP Clients: Links

vsFTPd and FTP user account configuration:

The vsFTPd ftp server was first made available in Red Hat 9.0. It has been adopted by Suse and OpenBSD as well. This is currently the recomended FTP daemon for use on FTP servers.
Enable vsftpd:

Red Hat/Fedora Core/CentOS: VsFTPd is a stand alone service and by the default Fedora Core installation, not controlled by xinetd as is the wu-ftpd default installation.
Thus start service: service vsftpd start (or: /etc/init.d/vsftpd start)
Configure vsftpd to start upon system boot: chkconfig --add vsftpd
SuSE: By default, the vsftpd is an xinetd controlled service. To enable FTP server services edit the file /etc/xinetd.d/vsftpd and change:
disable = yes
to:
disable = no
Restart the xinetd daemon: /etc/init.d/xinetd restart
Note: vsftpd can also be run as a stand-alone service to achieve a faster response time.
Ubuntu (dapper/hardy/natty) / Debian:
- Install: apt-get install vsftpd
- VsFTPd is a stand alone service.
  - Start: /etc/init.d/vsftpd start
  - Stop: /etc/init.d/vsftpd stop
  - Restart: /etc/init.d/vsftpd restart
    (Use this command after making configuration file changes)

For more on starting/stopping/configuring Linux services, see the YoLinux tutorial on the Linux init process and service activation.

Configuration files:

vsFTPd configuration file:

Fedora Core / Red Hat: /etc/vsftpd/vsftpd.conf
S.u.S.e. / Ubuntu (dapper/hardy/natty) / Debian: /etc/vsftpd.conf

Default for Fedora Core 3:

anonymous_enable=YES - Anonymous FTP allowed by default if you comment this out. Default directory used: /var/ftp

local_enable=YES - Uncomment this to allow local users to log in with FTP.
Must also set SELinux boolean: setsebool -P ftp_home_dir 1

write_enable=YES - Uncomment this to enable any form of FTP write or upload command.

local_umask=022 - Default is 077. Umask 022 is used by most other ftpd's.

#anon_upload_enable=YES - Uncomment to allow the anonymous FTP user to upload files.
Requires the above global write enabled. Directory must also be writable by user.
#anon_mkdir_write_enable=YES - Uncomment this to allow the anonymous FTP user to be able to create new directories.

dirmessage_enable=YES - Activate directory messages.
Messages given to remote users when they enter certain directories
xferlog_enable=YES - Activate logging of uploads/downloads.

connect_from_port_20=YES - PORT transfer connections originate from port 20 (ftp-data)

#chown_uploads=YES - Uploaded anonymous files set to a specified owner. (not root)
#chown_username=whoever

#xferlog_file=/var/log/vsftpd.log - Specify logfile explicitly. Default is /var/log/vsftpd.log

xferlog_std_format=YES - Output to log file in standard ftpd xferlog format

#idle_session_timeout=600 - Set timing out for an idle session.

#data_connection_timeout=120 - Set timing out for an idle data connection. Port 20

#nopriv_user=ftpsecure - Run ftp server as an isolated and unprivileged user.

# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it, may confuse older FTP clients.
#async_abor_enable=YES

#ascii_upload_enable=YES - Improve performance by disabling ASCII mode. Disables command "ascii" and "SIZE /big/file".
#ascii_download_enable=YES

#ftpd_banner=Welcome to YoLinux - Customize the login banner string.

#deny_email_enable=YES - Disallow specified anonymous e-mail addresses. Used to combat certain DoS attacks.
#banned_email_file=/etc/vsftpd.banned_emails (Ubuntu default. Red Hat: /etc/vsftpd/banned_emails)

#chroot_list_enable=YES - List users chroot()'d to their home directory. If "NO", list users not chroot()'d.
#chroot_list_file=/etc/vsftpd.chroot_list (Ubuntu default. Red Hat: /etc/vsftpd/chroot_list)

ls_recurse_enable=YES - Allow "ls -R" recursive directory list. Default is disabled.

pam_service_name=vsftpd

userlist_enable=YES - (Ubuntu Default) Deny users specified in file /etc/vsftpd.user_list
If "userlist_enable=NO" then allow specified users.
Red Hat: /etc/vsftpd/user_list
#deny_email_enable=YES - Disallow specified anonymous e-mail addresses. Used to combat certain DoS attacks.

listen=YES - Enable for standalone mode as opposed to an xinetd service.
Must set SELinux boolean: setsebool -P ftpd_is_daemon 1
tcp_wrappers=YES

Restart the FTP service if the config file is changed: service vsftpd restart (or: /etc/init.d/vsftpd restart) [Potential Pitfall]: vsftp does NOT support comments on the same line as a directive. i.e.:

directive=XXX # comment

vsftp.conf man page

Specify list of local users chrooted to their home directories:
- Red Hat: /etc/vsftpd/vsftpd/chroot_list
- Ubuntu: /etc/vsftpd/vsftpd.chroot_list
(Requires: chroot_list_enable=NO)
user1 user2 ... user-n
If userlist_enable=YES, then specify users not to be chroot'd..

Specify list of users:
- Red Hat: /etc/vsftpd/user_list
- Ubuntu: /etc/vsftpd.user_list
(Deny list of users requires: userlist_enable=YES)
Also see PAM configuration below.
root bin daemon adm lp sync shutdown halt ...
If userlist_enable=NO, then specify valid users.

PAM configuration file Fedora Core 3: /etc/pam.d/vsftpd

#%PAM-1.0
auth       required     pam_listfile.so item=user sense=deny file=/etc/vsftpd.ftpusers onerr=succeed
auth       required     pam_stack.so service=system-auth
auth       required     pam_shells.so
account    required     pam_stack.so service=system-auth
session    required     pam_stack.so service=system-auth

This causes PAM to check /etc/vsftpd.ftpusers for users who are denied. This duplicates /etc/vsftpd.user_list. Speciy user in both files as PAM is independent of vsftpd configuration. PAM authentication configuration file: ftpusers

Red Hat: /etc/vsftpd/ftpusers
Ubuntu: /etc/vsftpd.ftpusers

root
bin
daemon
adm
lp
sync
shutdown
halt
...
...
...
user6     - Users to deny
user8
...
...

Logrotate configuration file: /etc/logrotate.d/vsftpd.log

/var/log/xferlog {
    # ftpd doesn't handle SIGHUP properly
    nocompress
    missingok
}

Sample vsFTPd configurations:

Anonymous download FTP server configuration: /etc/vsftpd/vsftpd.conf

# Access rights
anonymous_enable=YES          - Turn on anonymous FTP
chown_uploads=YES             - Uploaded files owned by an assigned user
chown_username=ftp            - Uploaded files owned by this assigned user
local_enable=NO
write_enable=NO               - No upload of files system changes allowed
anon_upload_enable=NO
anon_mkdir_write_enable=NO
anon_other_write_enable=NO
# Security
anon_world_readable_only=YES
connect_from_port_20=YES
force_dot_files=NO
guest_enable=NO
hide_ids=YES
pasv_min_port=50000
pasv_max_port=60000
# Features
xferlog_enable=YES
ls_recurse_enable=NO
ascii_download_enable=NO
async_abor_enable=YES
# Performance
one_process_model=NO
idle_session_timeout=120
data_connection_timeout=300
accept_timeout=60
connect_timeout=60
max_per_ip=4
anon_max_rate=50000

pam_service_name=vsftpd
userlist_enable=YES
#enable for standalone mode
listen=YES
tcp_wrappers=YES

Anonymous logins use the login name "anonymous" and then the user supplies their email address as a password. Any password will be accepted. Used to allow the public to download files from an ftp server. Generally, no upload is permitted.

Web hosting configuration: /etc/vsftpd/vsftpd.conf

# Access rights
anonymous_enable=NO
local_enable=YES                              - Allow users to ftp to their home directories
write_enable=YES                              - Allow users to STOR,  DELE, RNFR, RNTO, MKD, RMD, APPE and SITE
local_umask=022
# Security
connect_from_port_20=YES
force_dot_files=NO
guest_enable=NO                               - Don't remap user name
ftpd_banner=Welcome to Super Duper Hosting    - Customize the login banner string.
chroot_local_user=YES                         - Limit user to browse their own directory only
chroot_list_enable=YES                        - Enable list of system / power users
chroot_list_file=/etc/vsftpd.chroot_list      - Actual list of system / power users
hide_ids=YES
pasv_min_port=50000
pasv_max_port=60000
# Features
xferlog_enable=YES
ls_recurse_enable=NO
ascii_download_enable=NO
async_abor_enable=YES
dirmessage_enable=YES                         - Message greeting held in file .message or specify with message_file=...
# Performance
one_process_model=NO
idle_session_timeout=120
data_connection_timeout=300
accept_timeout=60
connect_timeout=60
max_per_ip=4
#
pam_service_name=vsftpd
userlist_enable=YES
#enable for standalone mode
listen=YES
tcp_wrappers=YES

Specify list of local users chrooted to their home directories: /etc/vsftpd/vsftpd.chroot_list
Ubuntu typically: /etc/vsftpd.chroot_list
(Requires: chroot_list_enable=NO)

user1
user2
...
user-n

If userlist_enable=YES, then specify users not to be chroot'd..

[Potential Pitfall]: Mispelling a directive will cause vsftpd to fail with little warning.
File: .message

A NOTE TO USERS UPLOADING FILES:
   File names may consist of letters (a-z, A-Z), numbers (0-9),
   an under score ("_"), dash ("-") or period (".") only.
   The file name may not begin with a period or dash.

Test if vsftp is listening: netstat -a | grep ftp

[root]# netstat -a | grep ftp
tcp        0      0 *:ftp                       *:*                         LISTEN

Links:

WU-FTPd and FTP user account configuration:

The wu-ftpd FTP server can be downloaded (binary or source) from http://www.wfms.org/wu-ftpd/ (at one time: http://wu-ftpd.org).
There are three kinds of FTP logins that wu-ftpd provides:

anonymous FTP - one logs in with the username 'anonymous'
real FTP - log in with a real username and password and has access to the entire disk structure.
guest FTP - one logs in with a real user name and password, but the user is chroot'ed to his home directory and cannot escape from it. They are constrained to their home directory which also means that they don't have access to /bin/ls and other commands on the server. Thus a local minimalist environment must be set up.

This tutorial covers "guest" FTP configuration.

The file /etc/ftpaccess controls the configuration of ftp.

# Don't allow system accounts to log in over ftp
   deny-uid %-99 %65534-
   deny-gid %-99 %65534-

   class   all   real,guest  *
   email webmaster@your-domain.com
   loginfails 5

   readme  README*    login
   readme  README*    cwd=*
   message /welcome.msg            login
   message .message                cwd=*

   compress        yes             all
   tar             yes             all
   chmod           no              guest,anonymous
   delete          no              anonymous    # delete files permission?
   overwrite       no              anonymous    # overwrite files permission?
   rename          no              anonymous    # rename files permission?
   delete          yes             guest        # delete files permission?
   overwrite       yes             guest        # overwrite files permission?
   rename          yes             guest        # rename files permission?
   umask           no              guest        # umask permission?

   log transfers anonymous,real inbound,outbound

   shutdown /etc/shutmsg

   passwd-check rfc822 warn

   # Must also create message file /etc/pathmsg of the guest directory.
   # In this case it refers to /home/user1/public_html/etc/pathmsg.
   path-filter  guest /etc/pathmsg  ^[-A-Za-z0-9_\.]*$  ^\.  ^-
   limit all 2
   noretrieve passwd .htaccess core    - Do not allow users to download files of these names
   limit-time * 20
   byte-limit in 5000                  - Limit file size
   guestuser *      - Set system user default to be categorized as a "guest". A "real" user can roam the system. Guestuser is chrooted.
   realgroup regularuserx regularusery - Assign real user privileges to members of groups "regularuserx" and "regularusery". 
                                         Visibility of the whole file system and subject to regular UNIX file permissions
   realuser user4                      - Assign real user privileges to user id "user4". 

   restricted-uid user1 user2 user3    - Restricts FTP to the specified directories
   guest-root /home/user1/public_html user1
   guest-root /home/user2/public_html user2
   guest-root /home/user3/public_html user3

Note:

user1, user2 and user3 refer to login accounts. Use the appropriate login name.
The above configuration disables anonymous FTP which allows anyone to perform an FTP login with the id anonymous and an email address as a password. To enable anonymous FTP, change the class directive to:

class all real,guest,anonymous *

GUI FTP configuration tools:
- /usr/bin/kwuftpd
- /sbin/linuxconf
  (Note: Linuxconf is no longer included with Red Hat 7.3 and later)

Red Hat Linux assigns users a user id and group id which is the same. This means that it does not matter if you use a realuser or realgroup directive as they will act the same.

Red Hat Linux 7.1 and later uses the xinet daemon to manage ftp connections. Thus xinetd must be running and configured to support ftp. The configuration file is /etc/xinetd.d/wu-ftpd. The command chkconfig wu-ftpd on will make the ftp server available. See xinet configuration for more info.

Allow overide of deny-uid and/or deny-gid:

allow-uid user-to-allow
     allow-gid group-to-allow

Optional configuration:
- Create a group ftpchroot
- Add users to this group
- Use directive: guestgroup ftpchroot

[Potential Pitfall]: Flakey ftp behavior, timeouts, etc?? FTP works best with name resolution of the computer it is communicating with. This requires proper /etc/resolve.conf and name server (bind) configuration, /etc/hosts or NIS/NFS configuration.

File /home/user1/public_html/etc/pathmsg:

A NOTE TO USERS UPLOADING FILES:
   File names may consist of letters (a-z, A-Z), numbers (0-9),
   an under score ("_"), dash ("-") or period (".") only.
   The file name may not begin with a period or dash.
   You have tried to upload a file with an inappropriate name.

The whole point of the chroot directory is to make the user's home directory appear to be the root of the filesystem (/) so one could not wander around the filesystem. Configuration of /etc/ftpaccess will limit the user to their respective directories while still offering access to /bin/ls and other system commands used in FTP operation.
As root:

cd /home/user1
   mkdir public_html
   chown $1.$1 public_html
   touch .rhosts             - Security protection
   chmod ugo-xrw .rhosts

Man Pages:

Server:

ftpd - Internet File Transfer Protocol server

File Formats:

/etc/ftpaccess - Configuration file for ftpd
/etc/ftpservers - ftpd virtual hosting configuration file. (optional)
/etc/ftphosts - allow or deny access to certain accounts from various hosts. (optional)
/etc/ftpconversions - ftpd conversions database (for tar and compression)
/var/log/xferlog - FTP server logfile
ftp - File Transfer Client program

Configuration files: (RH 8.0+)

PAM configuration file: /etc/pam.d/ftp

#%PAM-1.0
auth       required     pam_listfile.so item=user sense=deny file=/etc/ftpusers onerr=succeed
auth       required     pam_stack.so service=system-auth
auth       required     pam_shells.so
account    required     pam_stack.so service=system-auth
session    required     pam_stack.so service=system-auth

Xinetd configuration file: /etc/xinetd.d/wu-ftpd

service ftp
{
        disable = no
        socket_type             = stream
        wait                    = no
        user                    = root
        server                  = /usr/sbin/in.ftpd
        server_args             = -l -a
        log_on_success          += DURATION USERID
        log_on_failure          += USERID
        nice                    = 10
}

Note: wu-FTPd is controlled by xinetd and not a stand alone service like vsFTPd.

Logrotate configuration file: /etc/logrotate.d/ftpd
/var/log/xferlog { nocompress }

More information:

WU-FTPD release
dkftpbench - FTP benchmark program to give you an idea as to how many simultaneous dialup clients a server can support.
FTP and text file type conversions: End Of Line Characters - by Peter Benjamin

Man pages on related FTP commands and files:

chroot - Run with a special root directory
ftpcount - Show number of concurrent users.
ftpshut - close down the ftp servers at a given time
ftprestart - Restart previously shutdown ftp servers
ftpwho - show current process information for each ftp user
privatepw - Change WU-FTPD Group Access File Information (admin command)

Other FTP daemons:

FTP4All
CrushFTP - Java/cross platform
WS_FTP

FTP Pitfalls:

If you get the following error:

ftp> ls
227 Entering Passive Mode (208,188,34,109,208,89)
ftp: connect: No route to host

This means you have firewall issues most probably on the FTP server itself. Start by removing the firewall "iptables" rules: iptables -F Add rules until you discover what is causing the problem.

Passive mode:

Passive mode can also help one past the rules:

ftp> passive
Passive mode on.

This toggles passive mode on and off. When on, FTP will be limited to ports specified in the vsftpd configuration file: vsftpd.conf with the parameters pasv_min_port and pasv_max_port

Firewall connection tracking module:

# cat /etc/sysconfig/iptables-config | grep ip_nat_ftp
IPTABLES_MODULES="ip_conntrack_ftp"

NAT firewall modules:

You can also try adding ip_nat_ftp to the list of autoloaded modules: (This will also load the dependancy: ip_conntrack_ftp.)

# cat /etc/sysconfig/iptables-config | grep ip_nat_ftp
IPTABLES_MODULES="ip_nat_ftp"

Then restart the firewall: /etc/init.d/iptables condrestart FTP will change ports during use. The ip_conntrack_ftp module will consider each connection "RELATED". If iptables allows RELATED and ESTABLISHED connections then FTP will work. i.e. rule: /etc/sysconfig/iptables

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

FTP fails because it can not change to the users home directory:

Error:

[user1@nodex ~]$ ftp node.domain.com
Connected to XXX.XXX.XXX.XXX.
530 Please login with USER and PASS.
530 Please login with USER and PASS.
KERBEROS_V4 rejected as an authentication type
Name (XXX.XXX.XXX.XXX:user1):
331 Please specify the password.
Password:
500 OOPS: cannot change directory:/home/user1
Login failed.
ftp> bye

This is often a result of SELinux preventing the vsftpd process from accesing the user's home directory. As root, grant access with the following command: setsebool -P ftp_home_dir 1 Followed by: service vsftpd restart Test your vsftpd SELinux settings: getsebool -a | grep ftp

allow_ftpd_anon_write --> off
allow_ftpd_full_access --> off
allow_ftpd_use_cifs --> off
allow_ftpd_use_nfs --> off
allow_tftp_anon_write --> off
ftp_home_dir --> on
ftpd_disable_trans --> off
ftpd_is_daemon --> on
httpd_enable_ftp_server --> off
tftpd_disable_trans --> off

FTPd SELinux man page

FTP Linux clients:

gftp: GUI GTK+ Multithreaded client. File transfer directory browsing and compare. Multiple protocols: FTP, FTPS (control connection only), HTTP, HTTPS, SSH and FSP protocols. Proxy support. Comes with Red Hat / Fedora Core.
KFTPgrabber: GUI KDE based client.simultaneous FTP sessions in separate tabs. Ability to limit upload and download speed.
kbear: GUI KDE based client. Connect to multiple servers, transfer files, directory browsing, file content browsing. Comes with S.U.S.e. Linux.
ftp: (/usr/kerberos/bin/ftp) kerberos enabled console ftp client. (RPM package FC3: krb5-workstation)

Basic user security:

When hosting web sites, there is no need to grant a shell account which only allows the server to have more potential security holes. Current systems can specify the user to have only FTP access with no shell by granting them the "shell" /sbin/nologin provided with the system or the "ftponly" shell described below. The shell can be specified in the file /etc/passwd of when creting a user with the command adduser -s /sbin/nologin user-id
[Potential Pitfall]: Red Hat 7.3 server with wu-ftp server 2.6.2-5 does not support this configuration to prevent shell access. It requires users to have a real user shell. i.e. /bin/bash It works great in older and current Red Hat versions. If it works for you, use it, as it is more secure to deny the user shell access. You can always deny telnet access. You should NOT be using this problem ridden version of ftpd. Use the latest wu-ftpd-2.6.2-11 which supports users with shell /opt/bin/ftponly
[Potential Pitfall]: Ubuntu Dapper/Hardy - Setting the shell to the preconfigured shell /bin/false will NOT allow vsftp access. One must create the shell "ftponly" as defined below to allow vsftp access with no shell.

Disable remote telnet login access allowing FTP access only: Change the shell for the user in /etc/passwd from /bin/bash to be /opt/bin/ftponly.

...
user1:x:502:503::/home/user1:/opt/bin/ftponly
...

Create file: /opt/bin/ftponly.
Protection set to -rwxr-xr-x 1 root root
with the command: chmod ugo+x /opt/bin/ftponly
Contents of file:

#!/bin/sh
#
# ftponly shell
#
trap "/bin/echo Sorry; exit 0" 1 2 3 4 5 6 7 10 15
#
Admin=root@your-domain.com
#System=`/bin/hostname`@`/bin/domainname`
#
/bin/echo
/bin/echo "********************************************************************"
/bin/echo "    You are NOT allowed interactive access."
/bin/echo
/bin/echo "     User accounts are restricted to ftp and web access."
/bin/echo
/bin/echo "  Direct questions concerning this policy to $Admin."
/bin/echo "********************************************************************"
/bin/echo
#
# C'ya
#
exit 0

The last step is to add this to the list of valid shells on the system.
Add the line /opt/bin/ftponly to /etc/shells.
Sample file contents: /etc/shells

/bin/bash
/bin/bash1
/bin/tcsh
/bin/csh
/opt/bin/ftponly

See man page on /etc/shells. An alternative would be to assign the shell /bin/false or /sbin/nologin which became available in later releases of Red Hat, Debian and Ubuntu. In this case the shell /bin/false or /sbin/nologin would have to be added to /etc/shells to allow them to be used as a valid shell for FTP while disabling ssh or telnet access.

Set file quotas to limit user account.

For more on Linux security see the: YoLinux.com Internet web site Linux server security tutorial

Domain Name Server (DNS) configuration using Bind version 8 or 9:

Two of the most popular ways to configure the program Bind (Berkeley Internet Domain software) to perform DNS services is in the role of (1) ISP or (2) Web Host.

In an ISP configuration for clients (web surfers) conected to the internet, the DNS server must resolve IP addresses for any URL the user wishes to visit. (See DNS caching server)
In a purely web hosting configuration, Bind will only resolve for the IP addresses of the domains which are being hosted. This is the configuration which will be discussed and is often called an "Authoritative-only Nameserver".

When resolving IP addresses for a domain, Internic is expecting a "Primary" and a "Secondary" DNS name server. (Sometimes called Master and Slave) Each DNS name server requires the file /etc/named.conf and the files it points to. This is typically two separate computer systems hosted on two different IP addresses. It is not necesary that the Linux servers be dedicated to DNS as they may run a web server, mail server, etc.
Note on Bind versions: Red Hat versions 6.x used Bind version 8. Release 7.1 of Red Hat began using Bind version 9 and the GUI configuration tool bindconf was introduced for those of you that like a pretty point and click interface for configuration.
Installation Packages:

Red Hat / Fedora Core / CentOS: bind, bind-chroot, bind-libs, bind-utils, system-config-bind
- bind-chroot: Security jail for operation of bind.
- bind-utils: Utility commands like nslookup, host, dig
- system-config-bind: GUI config tool system-config-bind and related configuration files (/etc/security/console.apps/bindconf).
- caching-nameserver: We will not be covering this as it is not required for web hosting. This is used by internet providers so their clients can cache the DNS entries of the sites they are visiting.
Ubuntu (dapper/hardy/natty) / Debian: bind9

Configuration files:

Red Hat / Fedora / CentOS:

File	Description	Directory	Chrooted Directory
named.conf	Primary/Secondary DNS server configuration. (See default file `/usr/share/doc/bind-9.X.X/sample/etc/named.conf`)	/etc/	/var/named/chroot/etc/
named.root.hints	Configuration for recursive service. Required for all zones. (See default file `/usr/share/doc/bind-9.X.X/sample/etc/named.root.hints`)	/etc/	/var/named/chroot/etc/
named	Red Hat system variables.	/etc/sysconfig/	no change
rndc.key	Primary/Secondary DNS server configuration.	/etc/	/var/named/chroot/etc/
Zone files	Configuration files for each domain. Create this file to resolve host name internet queries i.e. define IP address of web (www) and mail servers in the domain.	/var/named/	/var/named/chroot/var/named/

Debian / Ubuntu:

File	Description	Directory	Chrooted Directory
named.conf named.conf.options named.conf.local	Primary/Secondary DNS server configuration.	/etc/bind/	/var/bind/chroot/etc/bind/
rndc.key	Primary/Secondary DNS server configuration.	/etc/	/var/bind/chroot/etc/
Zone files	Configuration files for each domain.	/var/bind/data/	/var/bind/chroot/var/bind/data/

Primary server (master):

File: named.conf

Red Hat / Fedora Core / CentOS: /etc/named.conf (chroot dir: /var/named/chroot/etc/named.conf) and /etc/sysconfig/named for system variables. Ubuntu / Debian: /etc/bind/named.conf Place local definitions in /etc/bind/named.conf.options and /etc/bind/named.conf.local Simple example: (no views)

options {                                     - Ubuntu stores options in /etc/bind/named.conf.options
        version "Bind";                       - Don't disclose real version to hackers
        directory "/var/named";               - Specified so relative path names can be used. Full path names still allowed.
        allow-transfer { XXX.XXX.XXX.XXX; };  - IP address of secondary DNS
        recursion no;
        auth-nxdomain no;                     - conform to RFC1035. (default)
        fetch-glue no;                  - Bind 8 only! Not used by version 9
};

zone "localhost" {
        type master;
        file "/etc/bind/db.local";
};
zone "0.0.127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
};

zone "your-domain.com"{                 - Ubuntu separates the zone definitions into /etc/bind/named.conf.local 
        type master;                    - Specify master, slave, forward or hint
        file "data/named.your-domain.com"; 
        notify yes;                     - slave servers are notified when the zone is updated.
        allow-update { none; };         - deny updates from other hosts (default: none)
        allow-query { any; };           - allow clients to query this server (default: any)
};
zone "your-domain-2.com"{
        type master;
        file "data/named.your-domain-2.com";
        notify yes;
};

Note:

The omission of zone ".". Required if providing a recursive service.
Ubuntu includes the separated file of zone directives using the directive:
include "/etc/bind/named.conf.local";

BIND Views: The BIND naming service can support "views" which allow various sub-networks (i.e. private internal or public external networks) to have a different domain name resolution result.

If no views are specified then use the configuration shown above.
The match-up between the "view" and the view client which receives the DNS information is specified by the match-clients statement.
If even one view is specified, then ALL zones MUST be associated with a "view".
Bind 9 allows for views which allow different zones to be served to different types of clients, localhost, private networks and public networks. This maps to the three view names "localhost_resolver", "internal" and "external":
- localhost_resolver: Supports name resolution for the system (localhost) using BIND. Support for use of bind also has to be configured in /etc/nsswitch.conf
- internal: User specified Local Area Network (LAN). If not used to support a local private LAN, remove (or comment out) this view.
- external: The general public internet defined as client "any".
If you are only setting up a caching name server, then only specify the view "localhost_resolver" (delete all other views).
In order to support a DNS for internet domains using views, one will have to configure an "external" view

Typical Red Hat Enterprise 5 example: (Bind 9.3.4 with three "views")

options
{
        directory "/var/named"; // the default
        dump-file               "data/cache_dump.db";
        statistics-file         "data/named_stats.txt";
        memstatistics-file      "data/named_mem_stats.txt";

};
logging
{
    //  By default, SELinux policy does not allow named to modify the /var/named
    //  directory, so put the default debug log file in data/ :
 
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
};
view "localhost_resolver"
{
    //  This view sets up named to be a localhost resolver ( caching only nameserver ).
    //  If all you want is a caching-only nameserver, then you need only define this view:
    match-clients           { localhost; };
    ...
};
view "internal"
{
    // This view will contain zones you want to serve only to "internal" clients
    // that connect via your directly attached LAN interfaces - "localnets" .
    // For local private LAN. Not covered in this tutorial.
    // Delete this view if web hosting with no local LAN.
    match-clients           { localnets; };
    ...
};
key ddns_key
{
        algorithm hmac-md5;
        secret "use /usr/sbin/dns-keygen to generate TSIG keys";
};
view    "external"
{
    // This view will contain zones you want to serve only to "external" 
    // public internet clients. This is covered below.
    match-clients           { any; };
    ...
    .. 
};

Default configuration files: Red Hat may supply the default configuration in: /usr/share/doc/bind-9.X.X/sample/etc/named.conf

cp /usr/share/doc/bind-9.X.X/sample/etc/named.conf /var/named/chroot/etc
cp /usr/share/doc/bind-9.X.X/sample/etc/named.root.hints /var/named/chroot/etc
chcon -u system_u -r object_r -t named_conf_t /var/named/chroot/etc/named.conf /var/named/chroot/etc/named.root.hints

view "localhost_resolver": If supporting a caching DNS server (not required to support a web domain) you will also need the files:

cp /usr/share/doc/bind-9.X.X/sample/etc/named.rfc1912.zones /var/named/chroot/etc
cp /usr/share/doc/bind-9.X.X/sample/var/named/localdomain.zones /var/named/chroot/var/named
also from /usr/share/doc/bind-9.X.X/sample/var/named/: localhost.zones, named.local, named.zero, named.broadcast, named.ip6.local, named.root

view "external": (master) - details -

view    "external"
{
/* This view will contain zones you want to serve only to "external" clients
 * that have addresses that are not on your directly attached LAN interface subnets:
 */
        match-clients           { any; };
        match-destinations      { any; };
        allow-transfer { XXX.XXX.XXX.XXX; };  - IP address of secondary DNS

        recursion no;
        // you'd probably want to deny recursion to external clients, so you don't
        // end up providing free DNS service to all takers

        // all views must contain the root hints zone:
        include "/etc/named.root.hints";

        // These are your "authoritative" external zones, and would probably
        // contain entries for just your web and mail servers:

        zone "your-domain.com" {
                type master;
                file "/var/named/data/external/named.your-domain.com";
                notify yes;
                allow-update { none; };
        };
 
        // You can also add the zones as a separate file like they do in Ubuntu by adding the following statement
        include "/etc/named.conf.local";      
};

DNS key:
Use the following command /usr/sbin/dns-keygen to create a key. Add this key to the "secret" statement as follows:

key ddns_key
{
        algorithm hmac-md5;
        secret "XlYKYLF5Y7YOYFFFY6YiYYXyFFFFBYYYYFfYYYJiYFYFYYLVrnrWrrrqrrrq";
};

Man Pages:

named.conf

Forward Zone File: /var/named/named.your-domain.com

Red Hat 9 / CentOS 3: /var/named/named.your-domain.com Red Hat EL4/5, Fedora 3+, CentOS 4/5: [Chrooted] /var/named/chroot/var/named/data/named.your-domain.com Red Hat EL4/5, Fedora 3+, CentOS 4/5: /var/named/data/named.your-domain.com Ubuntu / Debian: /etc/bind/data/named.your-domain.com

$TTL 604800         - Bind 9 (and some of the later versions of Bind 8) requires $TTL statement. Measured in seconds. This value is 7 days.
your-domain.com.    IN      SOA  ns1.your-domain.com.  hostmaster.your-domain.com. (
   2000021600 ; serial     - Many people use year+month+day+integer as a system.
   86400 ; refresh         - How often secondary servers (in seconds) should check in for changes in serial number. (86400 sec = 24 hrs)
   7200 ; retry            - How long secondary server should wait for a retry if contact failed.
   1209600 ; expire        - Secondary server to purge info after this length of time.
   86400 ) ; default_ttl   - How long data is held in cache by remote servers.
       IN A       XXX.XXX.XXX.XXX  - Note that this is the default IP address of the domain. 
                                     I put the web server IP address here so that domain.com points to the same servers as www.domain.com
;
; Name servers for the domain
;
       IN NS         ns1.your-domain.com.
       IN NS         ns2.your-domain.com.
;
; Mail server for domain
;
       IN MX    5    mail               - Identify "mail" as the node handling mail for the domain. Do NOT specify an IP address!
;
; Nodes in domain
;
node1  IN A          XXX.XXX.XXX.XXX    - Note that this is the IP address of node1
ns1    IN A          XXX.XXX.XXX.XXX    - Optional: For hosting your own primary name server. Note that this is the IP address of ns1
ns2    IN A          XXX.XXX.XXX.XXX    - Optional: For hosting your own secondary name server. Note that this is the IP address of ns2
mail   IN A          XXX.XXX.XXX.XXX    - Identify the IP address for node mail.
       IN MX    5    XXX.XXX.XXX.XXX    - Identify the IP address for mail server named "mail".
;
; Aliases to existing nodes in domain
;
www    IN CNAME      node1              - Define the webserver "www" to be node1.
ftp    IN CNAME      node1              - Define the ftp server to be node1.

DNS record types and format:

DNS record Description and Format

SOA

Start of Authority: Primary domain server and contact info
Note that there is a period following the primary domain server and contact email.
Note that the email address is in the form where the first period represents the "@" symbol of the email address.

your-domain.com in SOA ns1.your-domain.com.  webmaster.your-domain.com.

@ in SOA ns1.your-domain.com.  webmaster.your-domain.com.

[Potential Pitfall]: Incorrect specification of the primary name server may result in the following message in /var/log/messages:

view localhost_resolver: received notify for zone 'your-domain.com': not authoritative

SOA attribute	Description
serial	Never use a value greater than 2147483647 for a 32 bit processor. Increment to a higher value to indicate an update to the slave server.
refresh	Time increment (seconds) between update checks of the serial number with the primary server
retry	Time elapsed before a slave will contact the primary server if a connection failed
expire	Time till primary server information is considered invalid and should be refreshed if there is a new DNS query
minimum	Time for DNS servers should hold domain information in their cache before purging

IN Indicate Internet.

NS Specify the Authoratative Name servers for the domain.

A Specify the IP address associated with the host name.
Format: hostname IN A XXX.XXX.XXX.XXX
Note that in my example, no hostname is specified for the first record. This will define the default for the domain.

CNAME Specify an alias for the host name.

MX Mail exchange record. Specify a priority number for the primary and back-up mail servers. The lowest number indicates the default mail server for the domain

PTR Used to specify the reverse DNS lookup

MX records for 3rd party off-site mail servers:

your-domain.com.    IN MX  10 mail1.offsitemail.com.
your-domain.com.    IN MX  20 mail2.offsitemail.com.

Append to the above example file.

Initial configuration: Note that Red Hat may supply the default zone configuration in: /usr/share/doc/bind-9.X.X/sample/var/named/

cp /usr/share/doc/bind-9.X.X/sample/var/named/localhost.zone /var/named/chroot/var/named/data/
cp /usr/share/doc/bind-9.X.X/sample/var/named/localdomain.zone /var/named/chroot/var/named/data/
cp /usr/share/doc/bind-9.X.X/sample/var/named/named.broadcast /var/named/chroot/var/named/data/
cp /usr/share/doc/bind-9.X.X/sample/var/named/named.ip6.local /var/named/chroot/var/named/data/
cp /usr/share/doc/bind-9.X.X/sample/var/named/named.zero /var/named/chroot/var/named/data/
cp /usr/share/doc/bind-9.X.X/sample/var/named/named.local /var/named/chroot/var/named/data/
cp /usr/share/doc/bind-9.X.X/sample/var/named/named.root /var/named/chroot/var/named/data/
cd /var/named/chroot/var/named/data/
chcon -u system_u -r object_r -t named_cache_t localhost.zone localdomain.zone named.broadcast named.ip6.local named.zero named.root named.local

A file suffix of "zone" is also common i.e. your-domain.com.zone

Secondary server (slave):

File: named.conf

Red Hat / Fedora Core / CentOS: /etc/named.conf Ubuntu / Debian: /etc/bind/named.conf Simple example with no views:

options {                               - Ubuntu stores options in /etc/bind/named.conf.options
        version "Bind";                 - Don't disclose real version to hackers
        directory "/var/named";
        allow-transfer { none; };       - Slave is not transfering updates to anyone else
        recursion no;
        auth-nxdomain no;               - conform to RFC1035. (default)
        fetch-glue no;                  - Bind 8 only! Not used by version 9
};
zone "localhost" {
        type master;
        file "/etc/bind/db.local";       - Ubutu: /etc/bind/db.local, Red Hat: /var/named/named.local
};
zone "0.0.127.in-addr.arpa" {
        type master;
        file "/etc/bind/db.127";
};

zone "your-domain.com"{
        type slave;          
        file "named.your-domain.com";   - Specify slaves/named.your-domain.com for RHEL4/5 chrooted bind
        masters { XXX.XXX.XXX.XXX; };   - IP address of primary DNS
};
zone "your-domain-2.com"{
        type slave;          
        file "named.your-domain-2.com";
        masters { XXX.XXX.XXX.XXX; };
};

view "external": (slave)

view    "external"
{
        match-clients           { any; };
        match-destinations      { any; };
        allow-transfer { none; };  - Slave does not transfer to anyone, slave receives
        recursion no;
        include "/etc/named.root.hints";

        zone "your-domain.com" {
                type slave;
                file "/var/named/slaves/external/named.your-domain.com";
                notify no;                  - Slave does not notify, slave is notified by master
                masters { XXX.XXX.XXX.XXX; }; - State IP of master server
        };
};

Note: RHEL4/5, CentOS 4/5, Fedora 3+ use chrooted directory structure permissions which require the use of the slaves subdirectory /var/named/slaves

Slave Zone Files: These are transfered from master to slave and chached by slave. There is no need to generate a zone file on the slave.
Additional Information:

[Potential Pitfall]: Ubuntu dapper/hardy/natty - Path names used can not violate Apparmor security rules as defined in /etc/apparmor.d/usr.sbin.named. Note that the slave files are typically named "/var/lib/bind/named.your-domain.com" as permitted by the security configuration.
[Potential Pitfall]: Ubuntu dapper/hardy/natty - Create log file and set ownership and permission for file not created by installation:

touch /var/log/bindlog
chown root.bind /var/log/bindlog
chmod 664 /var/log/bindlog

[Potential Pitfall]: Error in /var/log/messages:

transfer of 'yolinux.com/IN' from XXX.XXX.XXX.XXX#53: failed while receiving responses: permission denied

Named needs write permission on the directory containing the file. This condition often occurs for a new "slave" or "secondary" name server where the zone files do not yet exist. The default (RHEL4/5, CentOS 4/5, Fedora Core 3+, ...):

drwxr-x--- 4 root named 4096 Aug 25 2004 named
drwxrwx--- 2 named named 4096 Sep 17 20:37 slaves

Fix: In named.conf specify that the slaves to go to slaves directory /var/named/chroot/var/named/slaves with the directive:

file "slaves/named.your-domain.com";

Bind Defaults:

Uses port 53 if none is specified with the listen-on port statement.
Bind will use random ports above port 1024 for queries. For use with firewalls expecting all DNS traffic on port 53, specify the following option statement in /etc/named.conf
query-source address * port 53; query-source-v6 port 53;
Logging is to /var/log/messages

After the configuration files have been edited, restart the name daemon.

/etc/init.d/named restart

(Note: Ubuntu / Debian restart: /etc/init.d/bind9 restart) Bind zone transfers work best if the clocks of the two systems are synchronised. See the YoLinux SysAdmin Tutorial: Time and ntpd
File: /var/named/named.your-domain.com This is created for you by Bind on the slave (secondary) server when it replicates from Primary server.

DNS GUI configuration:

Red Hat EL 4/5, Fedora 2-10: /usr/bin/system-config-bind
Red Hat 8/9, Fedora Core 1: /usr/bin/redhat-config-bind

Test DNS:

Must install packages:

Red Hat / Fedora Core / SuSE: bind-utils
Ubuntu (dapper/hardy/natty) / Debian: bind9-host

Test the name server with the host command in interactive mode:

host  node.domain-to-test.com your-nameserver-to-test.domain.com

Note: The name server may also be specified by IP address.

or
Test the name server with the nslookup command in interactive mode:

nslookup
   > server your-nameserver-to-test.domain.com
   > node.domain-to-test.com
   > exit

Test the MX record if appropriate:

nslookup -querytype=mx domain-to-test.com
   
   OR

   host -t mx domain-to-test.com

Test using the dig command:

dig @name-server domain-to-query

   OR

   dig @IP-address-of-name-server domain-to-query

Test your DNS with the following DNS diagnostics web site: DnsStuff.com

Extra logging to monitor Bind:

Add the following to your /etc/named.conf file.

logging {
        channel bindlog {
                           file "/var/log/bindlog"  versions 5 size 1m;     - Keep five old versions of the log-file (rotates logs)
                           print-time yes;
                           print-category yes;
                           print-severity yes;
                        };
/*      If you want to enable debugging, eg. using the 'rndc trace' command,
 *      named will try to write the 'named.run' file in the $directory (/var/named).
 *      By default, SELinux policy does not allow named to modify the /var/named directory,
 *      so put the default debug log file in data/ :
 */
        channel default_debug {
                file "data/named.run";
                severity dynamic;
        };
        category xfer-out { bindlog; };         - Zone transfers
        category xfer-in  { bindlog; };         - Zone transfers
        category security { bindlog; };         - Approved/unapproved requests

//      The following logging statements, panic, insist and response-checks are valid for Bind 8 only. Do not user for version 9.
        category panic { bindlog; };            - System shutdowns
        category insist { bindlog; };           - Internal consistency check failures
        category response-checks { bindlog; };  - Messages
};

Chroot Bind for extra security:

Note: Most modern Linux distributions default to a "chrooted" installation. This technique runs the Bind name service with a view of the filesystem which changes the definition of the root directory "/" to a directory in which Bind will operate. i.e. /var/named/chroot. The following example uses the Red Hat RPM bind-8.2.3-0.6.x.i386.rpm. Applies to Bind version 9 as well. The latest RedHat bind updates run the named as user "named" to avoid a lot of earlier hacker exploits. To chroot the process is to create an even more secure environment by limiting the view of the system that the process can access. The process is limited to the chrooted directory assigned. The chroot of the named process to a directory under a given user will prevent the possibility of an exploit which at one time would result in root access. The original default RedHat configuration (6.2) ran the named process as root, thus if an exploit was found, the named process will allow the hacker to use the privileges of the root user. (no longer true) Named Command Sytax:

named -u user -g group -t directory-to-chroot-to

Example:

named -u named -g named -t /opt/named

When chrooted, the process does not have access to system libraries thus a local lib directory is required with the appropriate library files - theoretically. This does not seem to be the case here and as noted above in chrooted FTP. It's a mystery to me but it works???? Another method to handle libraries is to re-compile the named binary with everything statically linked. Add -static to the compile options. The chrooted process should also require a local /etc/named.conf etc... but doesn't seem to??? Script to create a chrooted bind environment:

#!/bin/sh
cd /opt
mkdir named
cd named
mkdir etc
mkdir bin
mkdir var
cd var
mkdir named
mkdir run
cd ..
chown -R named.named bin etc var

You can probably stop here. If your system acts like a chrooted system should, then continue with the following:

cp -p /etc/named.conf etc
cp -p /etc/localtime  etc
cp -p /bin/false bin
echo "named:x:25:25:Named:/var/named:/bin/false" > etc/passwd
echo "named:x:25:" > etc/group
touch  var/run/named.pid 

if [ -f /etc/namedb ]
then
   cp -p /etc/namedb etc/namedb
fi

mkdir dev
cd dev

# Create a character unbuffered file.
mknod -m ugo+rw null c 1 3     

cd ..
chown -R named.named bin etc var

Add changes to the init script: /etc/rc.d/init.d/named

#!/bin/bash
#
# named           This shell script takes care of starting and stopping
#                 named (BIND DNS server).
#
# chkconfig: - 55 45
# description: named (BIND) is a Domain Name Server (DNS) \
# that is used to resolve host names to IP addresses.
# probe: true

# Source function library.
. /etc/rc.d/init.d/functions

# Source networking configuration.
. /etc/sysconfig/network

# Check that networking is up.
[ ${NETWORKING} = "no" ] && exit 0

[ -f /etc/sysconfig/named ] && . /etc/sysconfig/named 

[ -f /usr/sbin/named ] || exit 0

[ -f /etc/named.conf ] || exit 0

RETVAL=0

start() {
        # Start daemons.
        echo -n "Starting named: "
        daemon named -u named -g named -t /opt/named   # Change made here
 RETVAL=$?
  [ $RETVAL -eq 0 ] && touch /var/lock/subsys/named
 echo
 return $RETVAL
}
stop() {
        # Stop daemons.
        echo -n "Shutting down named: "
        killproc named
 RETVAL=$?
 [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/named
        echo
 return $RETVAL
}
rhstatus() {
 /usr/sbin/ndc status
 return $?
} 
restart() {
 stop
 start
} 
reload() {
 /usr/sbin/ndc reload
 return $?
}
probe() {
 # named knows how to reload intelligently; we don't want linuxconf
 # to offer to restart every time
 /usr/sbin/ndc reload >/dev/null 2>&1 || echo start
 return $?
}  

# See how we were called.
case "$1" in
 start)
  start
  ;;
 stop)
  stop
  ;;
 status)
  rhstatus
  ;;
 restart)
  restart
  ;;
 condrestart)
  [ -f /var/lock/subsys/named ] && restart || :
  ;;
 reload)
  reload
  ;;
 probe)
  probe
  ;;
 *)
         echo "Usage: named {start|stop|status|restart|condrestart|reload|probe}"
  exit 1
esac

exit $?

                    

Note: The current version of bind from the RedHat errata updates and security fixes (http://www.redhat.com/support/errata/) runs the named process as user "named" in the home (not chrooted) directory /var/named with no shell available. (named -u named) This should be secure enough. Proceed with a chrooted installation if your are paranoid.
See:

Securing DNS: How to use chroot bind features

Chrooted DNS configuration:
Modern releases of Linux (i.e. Fedore Core 3, Red Hat Enterprise Linux 4) come preconfigured to use "chrooted" bind. This security feature forces even an exploited version of bind to only operate within the "chrooted" jail /var/named/chroot which contains the familiar directories:

/var/named/chroot/etc: Configuration files
/var/named/chroot/dev: devices used by bind:
- /dev/null
- /dev/random
- /dev/zero
(Real devices created with the mknod command.)
/var/named/chroot/var: Zone files and configuration information.

These directories are generated and configured by the Red Hat/Fedora RPM package "bind-chroot". If building from source you will have to generate this configuration manually:

mkdir -p /var/named/chroot
mkdir /var/named/chroot/dev
mknod /var/named/chroot/dev/null c 1 3
mknod /var/named/chroot/dev/zero c 1 5
mknod /var/named/chroot/dev/random c 1 8
chmod 666 -R /var/named/chroot/dev
mkdir -p /var/named/chroot/etc
ln -s /var/named/chroot/etc/named.conf /etc/named.conf
mkdir -p /var/named/chroot/var/named
ln -s /var/named/chroot/var/named/named.XXXX /var/named/named.XXXX
ln -s /var/named/chroot/var/named/named.YYYY /var/named/named.YYYY
...
mkdir -p /var/named/chroot/var/named/slaves
mkdir -p /var/named/chroot/var/named/data
mkdir -p /var/named/chroot/var/run
mkdir -p /var/named/chroot/var/tmp
chown -R named:named /var/named/chroot
chown -R root:named /var/named/chroot/var/named

Load Balancing of servers using Bind: DNS Round-Robin

This will populate name servers around the world with different IP addresses for your web server www.your-domain.com

www0   IN  A       XXX.XXX.XXX.1
            www1   IN  A       XXX.XXX.XXX.2
            www2   IN  A       XXX.XXX.XXX.3
            www3   IN  A       XXX.XXX.XXX.4
            www4   IN  A       XXX.XXX.XXX.5
            www5   IN  A       XXX.XXX.XXX.6

            www    IN  CNAME   www0.your-domain.com.
                   IN  CNAME   www1.your-domain.com.
                   IN  CNAME   www2.your-domain.com.
                   IN  CNAME   www3.your-domain.com.
                   IN  CNAME   www4.your-domain.com.
                   IN  CNAME   www5.your-domain.com.
                   IN  CNAME   www6.your-domain.com.

Also see lbnamed: lbnamed load balancing named

Bind/DNS Links:

Internet Software Consortium (ISC) Home Page - ISC Bind Home
Bind FAQ, pitfalls and answers
Zytrax Bind 9 manual - Bind for rocket scientists
comp.protocols.tcp-ip.domains FAQ - HTML version
More on load balancing and round robin schemes
LDP DNS-HOWTO
DNS Security best practices - Cricket Liu (coauthor of DNS and Bind)
DNS Security Paper - Craig Rowland
GraniteCanyon.com: Free DNS hosting - If you don't want to set it up, have someone do it for you.
EveryDNS.net - Free DNS
DNS2GO - Domain hosting for DHCP clients.
Secondary.com - Free secondary names server hosting (five or fewer domains)
TZO.com - Dynamic, secondary DNS services.
OpenDNS.com - Can allow forwarding to OpenDNS servers.
Add to "options" section: forwarders { 208.67.222.222; 208.67.222.220; };
DynDNS.org
Command: ipcheck.py -i eth0 DynDNS-user-id password node.dnsalias.net
Then add script update.dyndns.ip to directory /etc/cron.daily/ to update IP.
This host must also be allowed access through any firewall rules.
DynDNS.com - Dynamic DNS for those with dynamic IP addresses. (i.e. dial-up game servers etc.)

Domain name registration:

Domain Name Registrars:
- NetworkSolutions.com
- Register.com
- Registrar.GoDaddy.com - Domain name registration for only $8.95/year!!!
- Dotster.com - Domain name registration for only $14.95/year
- DomainsNext.com - $11.95/year
- EasyDNS.com - $25.00/year
- Aplus.net - Domain Registration $7.95/year - Not good
- Gandi.net - European
AfterNic.com - Domain name exchange and auction.
BuyDomains.com - Buy a domain name that a squatter is holding.

Note that the Name registrations policies for the registrars are stated at ICANN.org.

You must renew with the same registrar within five days BEFORE the expiration date. There is no rule for afterwards.
Most free a domain name 30 days after it expires.

Web Server Load Balancing:

Load balancing becomes important if your traffic volume becomes too great for either your server or network connection or both. Multiple options are available for load balancing.

DNS round-robin: Discussed above, this uses DNS to point users to random server in a list of appropriate servers. This spreads the load among the servers in the list.
Use a Linux Virtual Server to Create a Load Balance Cluster. See next section below.
Run a reverse proxy. See nginx ("engine X"). From a single external internet network connection, route http, smtp, imap or pop3 traffic to various servers on an internal network. Results are pushed back to the nginx proxy for routing to the internet (no caching).
Run the Apache httpd web server module "mod_proxy" to offload processing of dynamic content to another web server. This acts as a reverse proxy, routing external traffic to various servers on an internal network.

Using a Linux Virtual Server to Create a Load Balance Cluster:

You can use a single Linux server to forward requests to a cluster of servers using iptables for IP masquerading and IPVsadm to scale your load. The load balancing server receiving and routing the requests is called the "Linux Virtual Server" (LVS). The LVS receives the requests which are passed to the real servers which process and reply to the request. This reply is forwarded to the client by the LVS.
This feature is available with the Linux 2.4/2.6 kernel. (If compiling kernel: Networking Options + IP: Virtual Server Configuration)
Configuration: This example will load balance http traffic to three web servers and ftp traffic to a fourth server.

Enable Forwarding: (Also see YoLinux Networking Tutorial: Enable Forwarding)
```
echo "1" > /proc/sys/net/ipv4/ip_forward
              
```

Enable IP Masquerading:
```
iptables -t nat -P POSTROUTING DROP
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
    
```
For more on IP Masquerading, iptables and subnet addresses, see the YoLinux network gateway tutorial.

Enable virtual server:
- Create virtual service and choose scheduler for http (80) and ftp (21):
```
ipvsadm -A -t 66.218.88.103:80 -s wlc
ipvsadm -A -t 66.218.88.103:21 -s wrr
    
```
  Command directives:
  - A: Add a virtual service defined by IP address, port number, and protocol.
  - -t: Use TCP service host:port
  - -s: scheduler:
    rr: Robin Robin: distributes jobs equally amongst the avail- able real servers.
    
    wrr: Weighted Round Robin.
    
    lc: Least-Connection: assigns more jobs to real servers with fewer active jobs.
    
    wlc: (Default) Weighted Least-Connection: assigns more jobs to servers with fewer jobs and relative to the real server's weight.
    
    lblc, lblcr, dh, sh, sed, nq. See man page.
- Configure load balancing cluser.
```
ipvsadm -a -t 66.218.88.103:80 -r 176.168.1.1:80 -m
ipvsadm -a -t 66.218.88.103:80 -r 176.168.1.2:80 -m -w 2
ipvsadm -a -t 66.218.88.103:80 -r 176.168.1.3:80 -m
ipvsadm -a -t 66.218.88.103:21 -r 176.168.1.4:21 -m
    
```
  Command directives:
  - -r: Real server.
  - -m: Use masquerading also known as network address translation (NAT)
  - -w: Weight is an integer specifying the capacity of a server rela- tive to the others in the pool. The valid values of weight are 0 through to 65535. The default is 1.

Links:

LinuxVirtualServer.org
iptables - Administration tool for IPv4 packet filtering and NAT
ipvsadm - Administer the routing table on a Linux Virtual Server.

Managing Web Server Daemons:

To view if these services are running, type ps -aux and look for the httpd, inetd and named services (daemons). These are background processes necessary to perform the server tasks.

root       681  0.0  0.5  2304  744 ?        S    Sep09   0:01 named
   nobody   28123  0.0  1.1  3036 1420 ?        S    Oct06   0:00 httpd
   nobody   28186  0.0  0.7  3044  896 ?        S    Oct06   0:00 httpd
   root       385  0.0  0.1  1136  232 ?        S    Sep09   0:00 inetd

A new installation will most likely NOT start the named background process which may be started manually after configuration.
See the YoLinux Init Process Tutorial for more information.
The inetd (or xinetd) background process is the Internet daemon which starts FTP when an ftp request is made.

Sys Admin Script:

Script to prepare an account: (Red Hat/Fedora)

#!/bin/sh
# Author Greg Ippolito
# Requires: /opt/etc/AccountDefaults/pathmsg favicon.ico  mwh-mini_tr.gif etc.
#           /opt/bin/ftponly
#   You must be root to run this script.
#
if [ $# -eq 0 ]
then
   echo "Enter user id as a command argument"
else if [ -r /home/$1 ]
then
   echo "User's home directory already exists"
else
   echo "1)  Create user."
   adduser -m $1

   echo "2)  Set user Password."
   passwd $1

   echo "3)  Add read access to user directory so apache can read it."
   cd /home
   chmod ugo+rx $1
   cd $1

   echo "4)  Create web directories."
   mkdir public_html
   chown $1.$1 public_html
   chcon -R -h -u system_u -r object_r -t httpd_sys_content_t public_html
   cd public_html
   mkdir images
   chown $1.$1 images
   chcon -R -h -u system_u -r object_r -t httpd_sys_content_t images

   # Block potential for unauthenticated logins
   cd ../
   touch .rhosts
   chmod ugo-xrw .rhosts

   echo "5)  Create default web page"
   sed "/HEADING/s!HEADING!$1!" /opt/etc/AccountDefaults/default-index.html > index.html
   cp -p /opt/etc/AccountDefaults/favicon.ico .
   cp -p /opt/etc/AccountDefaults/default-logo.gif ./images
   cp -p /opt/etc/AccountDefaults/robots.txt .
   chown $1.$1 index.html favicon.ico robots.txt
   chcon -R -h -t httpd_sys_content_t index.html favicon.ico robots.txt
   chcon -R -h -t httpd_sys_content_t images/default-logo.gif

   echo "6)  Edit /etc/passwd file - change user shell to /opt/bin/ftponly"
   cp -p  /etc/passwd /etc/passwd-`date +%m%d%y`
   sed "/^$1/s!/bin/bash!/opt/bin/ftponly!" /etc/passwd-`date +%m%d%y` > /etc/passwd

#wu-ftp# Requires: /etc/ftpaccess guestuser restrict-uid
#wu-ftp#   echo "7)  Add user to /etc/ftpaccess file"
#wu-ftp#   cp -p  /etc/ftpaccess /etc/ftpaccess-`date +%m%d%y`
#wu-ftp#   sed "/^guestuser/s!guestuser !guestuser $1 !" /etc/ftpaccess-`date +%m%d%y` > /etc/ftpaccess
#wu-ftp#   sed "/^restricted-uid/s!restricted-uid !restricted-uid $1 !" /etc/ftpaccess-`date +%m%d%y` > /etc/ftpaccess
#wu-ftp#   echo "guest-root /home/$1/public_html $1" >> /etc/ftpaccess

   echo "7)  Add user to vsftpd chroot list
   cat `echo $1` >> /etc/vsftpd/vsftpd.chroot_list

   echo "8)  Setting Disk Quotas to default 50Mb limit:"
#  Use user johndoe as a prototype.
   edquota -p johndoe $1

   echo "9)  Admin Follow-up:"
   echo "     Modify quota.user if different than default"
   echo "     Make changes to Bind names services on dns1 and dns2 if necessary"
   echo "       Change /etc/http/conf/httpd.conf or 
   echo "       add config to /etc/http/conf.d/ if using a new domain name"
   echo "       Add e-mail aliases to mail server if necessary"
fi
fi

FYI: Sample robots.txt files:

Useful links and resources:

Linux Init Process - YoLinux.com tutorial
Setting up an Apache redirect - YoLinux.com tutorial
Apache Documentation
LDP HowTo Guides:
- DNS-HOWTO - DNS administration - Nicolai Langfeldt
- Securing-Domain-HOWTO
- ISP-Setup-RedHat - Using Linux to host an ISP - Anton Chuvakin
- Linux Networking Overview HOWTO - Daniel Lopez Ridruejo
- Virtual-Services-HOWTO - DNS, FTP, Apache, Mail (POP, Qmail, Sendmail), Syslogd and Samba
- WWW-HOWTO - Setting up Apache services
- WWW-mSQL-HOWTO
List of Internet Exchanges - An Internet Exchange (IX) is a junction between multiple principle Internet communication lines. A colo hosted at or close to an IX will have your best ability to handle traffic and your lowest latencies.
Setting up a mail server - YoLinux Tutorial

Joomla

2011-10-07T00:39:00.000-07:00

Joomla! is a free, open source content management system for publishing content on the world wide web and intranets. The system includes features such as page caching to improve performance, RSS feeds, printable versions of pages, news flashes, blogs, polls, website searching, and language internationalization. Joomla is licensed under the GPL, and is the result of a fork of Mambo.

The name Joomla is properly written with an exclamation mark as that is part of the name, but this is commonly omitted.

It is written in the PHP programming language and uses the MySQL database by default.

History

Joomla came into being as the result of a fork of Mambo by the development team on August 17, 2005. At that time, the Mambo name was trademarked by Miro International Pty Ltd, who formed a non-profit foundation with the stated purpose to fund the project and protect it from lawsuits. The development team claimed that many of the provisions of the foundation structure went against previous agreements made by the elected Mambo Steering Committee, lacked the necessary consultation with key stake holders, and included provisions that violated core open source values.

The development team created a web site called OpenSourceMatters to distribute information to users, developers, web designers, and the community in general. The project team leader Andrew Eddie, aka “MasterChief” wrote an open letter to the community which appeared on the announcements section of the public forum at mamboserver.com.

A thousand people had joined the opensourcematters.org web site within a day, most posting words of encouragement and support. The web site received the slashdot effect as a result. Miro CEO Peter Lamont gave a public response to the development team in an article entitled “The Mambo Open Source Controversy – 20 Questions With Miro”.

This event stirred deeply held feelings in the free software community regarding what shall constitute “open source”. Forums at many other open source projects were active with postings for and against the actions of both sides.

In the two weeks following Eddie’s announcement teams were re-organized and the community continued to grow. Eben Moglen and the Software Freedom Law Center (SFLC) assisted the Joomla! core team beginning in August 2005, as indicated by Moglen’s blog entry from that date and a related OSM announcement. The SFLC continue to provide legal guidance to Joomla! project.

On August 18, 2005, Andrew Eddie called for community input on suggested names for the project. The development team indicated that it would make the final decision for the project name based on community input. The name the development team chose was not in the list of suggested names provided by the community as it was chosen with consultation from a professional brand consultancy under the pay of Open Source Matters.

On September 1, 2005 the new name, “Joomla”, which is the English spelling of the Swahili (Arabic:جملة ,and Urdu: جملہ ) word jumla meaning “all together” or “as a whole” was announced.

On September 7, 2005, the development team called for logo submissions from the community, invited the community to vote on the logo preferred, and announced the community’s decision on September 22, 2005. Following the logo selection, Brand Guidelines, a Brand Manual, and set of Logo Resources were published on October 2, 2005 for the community’s use.

The first release of Joomla (Joomla 1.0.0) was announced on September 16, 2005. This was a re-branded release of Mambo 4.5.2.3 combined with other bug and moderate-level security fixes. Joomla version 1.5 was released on January 22, 2008. Joomla won the Packt Publishing Open Source Content Management System Award in 2006 and 2007.

Features

The Joomla package consists of many different parts, which are built to be as modular as possible, allowing extensions and integrations to be made easily. An example of such are extensions called “Plugins”. (Previously known as “Mambots”.) Plugins are background extensions that extend Joomla with new functionality. The WikiBot, for example, allows the author of Joomla content to use “Wikitags” in Joomla articles which will auto-create dynamic hyperlinks to Wikipedia articles when displayed. There are over 2,900 extensions for Joomla available via the Extensions Directory.

In addition to Plugins, more comprehensive extensions are available. “Components” allow webmasters to perform such tasks as build a community by expanding user features, backup a website, translate content and create URLs that are more friendly to search engines. “Modules” perform such tasks as displaying a calendar or allowing custom code like Google AdSense etc to be inserted within the base Joomla code.

Since it has been around longer, there are more extensions available for Joomla 1.0 than for Joomla 1.5, although native 1.5 extensions are becoming increasingly available. Some of the older 1.0 extensions can be used with version 1.5 if it is set to legacy mode.

Joomla permits administrators to set global configuration parameters that affect all articles. Every page conforms to these parameters by default, but a page can have its own setting for each parameter. For example, you can elect to show the article author, hide the author, or simply go with the global “show author” parameter.

Community

Joomla has an official and many unofficial communities. As of February 2008, the official Joomla forum has more than 260,000 threads and over 1.2 million posts from more than 170,000 registered members in 40 languages. Unofficial sites are published in many languages, often with Joomla extensions that are region specific. Bi-directional text support for the Hebrew and Arabic languages, for example, can be found on 3rd party community portals. Unofficial web developers also build extensions and web templates for commercial sale and offer freelance customization services. Usually a template is distributed as a zip file which can be installed using the Joomla installer.

Talend Cache Management

2011-05-14T02:22:00.000-07:00

Background : Talend Open Studio can read/write from/to many different sources, so it is generally easy for a good data integration architect to design solution that "cache" recordsets in db tables, temporary files etc.
However this adds additional steps, sometimes even additional architecture components such as a database, adding complexity to the job itslef.
Sometimes it would be easy to have a simple buffer in memory to store temporary information, maybe populated incrementally with a number of iterations.Or it would be nice to be able to dump this buffer to disk and re-load it whenever needed.

The solution

A couple of components that handle the cache management tasks, both in memory and on disk.
They are easy to use in any Talend Data Integration job, allowing temporary or persistent data storage. Cache files and memory buffers can be loaded incrementally using loops.
It is also possible to "init" a chache form a previously stored file and incrementally append new records.
Storing data in memory can quickly use up the java heap, also because this release of the routines is not yet optimized. Currently there is no data compression involved, this could be included in a future release.I succesfully managed to load a 6 Million records table (4 fields) in memory, but you should account for concurrent processes that also may use heavily the heap.

Current version

Version : 0.2
Release Date : May 11 2011
Status : Beta

Example

The job tCacheDemo demomstrates the usage of the two components

The Cache Load Loop subJob loads the cache buffer in memory and generates a set of cache files.
To demonstrate the incremental load capabilities, a Loop is used to process multiple times a data source (in this examples an RSS feed, any recordset would work).

tLoop_1 This step simply performs 100 iterations.

tRSSInput_1 A sample data source returning 10 records.In the demo job it is configured to read a xml file "news.rss", being a local copy of a Google news RSS Feed.

tCacheOutput_1 This component is set to cache data both on disk and in memory. The global buffer variable name is an arbitrary name that was set to "cache".
The Cache file name is set to context.baseDir+"/cache"+((Integer)globalMap.get("tLoop_1_CURRENT_VALUE"))+".dat" to demonstrate the ability to change the file name at each iteration.Finally the append to file option is unchecked to reset the cache files at each run. Feel free to play around with these settings.
This component is a "DATA_AUTOPROPAGATE" component, meaning that the same flow that arrives in input can also be retrieved in output, allowing the component to be used as a "middle" step in a flow.

The "Record count" subJob simply uses a tJava component to output the two record counters available in the tCacheOutput component, one being the number of records processed in the current iteration and the other being the number of records stored in the memory cache.

tJava_1 Simply outputs a string in the console, the code is

System.out.println("Iteration records : "+((Integer)globalMap.get("tCacheOutput_1_NB_LINE"))+" Record in memory cache : "+((Integer)globalMap.get("tCacheOutput_1_NB_CACHE_LINE")) );

Finally the Cache read subjob is activated once all the iterations are terminated (via a "subjob OK" trigger link, originating from tLoop_1) and starts the output to the tLogRow component. In a real world application this would be connected to a destination table, a tBufferOutout or another flow consumer.

tCacheInput_1 By setting this component to read from the memory "cache" buffer, all the records stored with the 100 iterations are returned.
An optional check is set to remove from memory the buffer once it is read. You can decide to leave data in memory if you need to process it again (also with another tCacheInput component).
It is possible to alternatively set the cache source to one of the cache files generated.

Downloads

Download tCacheInput

Download tCacheOuput

Download sample Job Rimember to configure the baseDir context variable, this will be the location for the cache files and the sample input data

Download sample data

http://www.powerupbi.com/talend/tCache.html

Autoincrement key in PostgreSQL and MySQL

2011-05-05T02:08:00.000-07:00

I'm switching from MySQL to PostgreSQL and was wondering how I can do autoincrement values. I saw in the PostgreSQL docs a datatype "serial".This is equivalent to AUTOINCREMENT in MySQL.

CREATE TABLE foo (
id SERIAL,
bar varchar);

INSERT INTO "foo" (bar) values ('blah');
INSERT INTO "foo" (bar) values ('blah');

SELECT * FROM foo;

1,blah

2,blah

AUTOINCREMENT IN MySQL

The AUTO_INCREMENT attribute can be used to generate a unique identity for new rows:

CREATE TABLE animals (
     id MEDIUMINT NOT NULL AUTO_INCREMENT,
     name CHAR(30) NOT NULL,
     PRIMARY KEY (id)
) ENGINE=MyISAM;

INSERT INTO animals (name) VALUES
    ('dog'),('cat'),('penguin'),
    ('lax'),('whale'),('ostrich');

SELECT * FROM animals;

Which returns:

+----+---------+
| id | name    |
+----+---------+
|  1 | dog     |
|  2 | cat     |
|  3 | penguin |
|  4 | lax     |
|  5 | whale   |
|  6 | ostrich |
+----+---------+
No value was specified for the AUTO_INCREMENT column, so MySQL assigned sequence numbers automatically.

You can also explicitly assign NULL or 0 to the column to generate sequence numbers.

You can retrieve the most recent AUTO_INCREMENT value with the LAST_INSERT_ID() SQL function or the mysql_insert_id() C API function.

These functions are connection-specific, so their return values are not affected by another connection which is also performing inserts.

Use a large enough integer data type for the AUTO_INCREMENT column to hold the maximum sequence value you will need.

When the column reaches the upper limit of the data type, the next attempt to generate a sequence number fails.

For example, if you use TINYINT, the maximum permissible sequence number is 127.

For TINYINT UNSIGNED, the maximum is 255.

Note For a multiple-row insert, LAST_INSERT_ID() and mysql_insert_id() actually return the AUTO_INCREMENT key from the first of the inserted rows.

This enables multiple-row inserts to be reproduced correctly on other servers in a replication setup.

For MyISAM and BDB tables you can specify AUTO_INCREMENT on a secondary column in a multiple-column index.

In this case, the generated value for the AUTO_INCREMENT column is calculated as MAX(auto_increment_column) + 1 WHERE prefix=given-prefix.

This is useful when you want to put data into ordered groups.

CREATE TABLE animals (
    grp ENUM('fish','mammal','bird') NOT NULL,
    id MEDIUMINT NOT NULL AUTO_INCREMENT,
    name CHAR(30) NOT NULL,
    PRIMARY KEY (grp,id)
) ENGINE=MyISAM;

INSERT INTO animals (grp,name) VALUES
    ('mammal','dog'),('mammal','cat'),
    ('bird','penguin'),('fish','lax'),('mammal','whale'),
    ('bird','ostrich');

SELECT * FROM animals ORDER BY grp,id;

Which returns:

+--------+----+---------+
| grp    | id | name    |
+--------+----+---------+
| fish   |  1 | lax     |
| mammal |  1 | dog     |
| mammal |  2 | cat     |
| mammal |  3 | whale   |
| bird   |  1 | penguin |
| bird   |  2 | ostrich |
+--------+----+---------+
In this case (when the AUTO_INCREMENT column is part of a multiple-column index), AUTO_INCREMENT values are reused if you delete the row with the biggest AUTO_INCREMENT value in any group.

This happens even for MyISAM tables, for which AUTO_INCREMENT values normally are not reused.

If the AUTO_INCREMENT column is part of multiple indexes, MySQL will generate sequence values using the index that begins with the AUTO_INCREMENT column, if there is one.

For example, if the animals table contained indexes PRIMARY KEY (grp, id) and INDEX (id), MySQL would ignore the PRIMARY KEY for generating sequence values.

As a result, the table would contain a single sequence, not a sequence per grp value.

To start with an AUTO_INCREMENT value other than 1, you can set that value with CREATE TABLE or ALTER TABLE, like this:

mysql> ALTER TABLE tbl AUTO_INCREMENT = 100;

Installing m2eclipse in Eclipse 3.6 (Helios) with the Eclipse Marketplace

2011-04-29T09:35:00.001-07:00

The Eclipse Marketplace makes it easy to install m2eclipse and m2eclipse (Extras) in Eclipse 3.6 (Helios). To open the Eclipse Marketplace, go to the Eclipse Help menu and select Eclipse Marketplace... as shown in Figure 2.1, “Opening the Eclipse Marketplace”.

Figure 2.1. Opening the Eclipse Marketplace

The first time you open the Eclipse Marketplace, you will be asked to select a Marketplace. Select the Eclipse Marketplace as shown in Figure 2.2, “Selecting the Eclipse Marketplace”.

Figure 2.2. Selecting the Eclipse Marketplace

2.2.1. Installing Maven Integration for Eclipse (Core)

Maven Integration for Eclipse is separated into two components: the Core of Maven Integration for Eclipse and an optional package of extra, unsupported components. To install the core component of Maven Integration for Eclipse, open the Eclipse Marketplace, select the Search tab, and search for "Maven Integration" as shown in Figure 2.3, “Selecting Maven Integration for Eclipse from Eclipse Marketplace”. Click on the Install button to the right of the second item listed in Figure 2.3, “Selecting Maven Integration for Eclipse from Eclipse Marketplace”.

Figure 2.3. Selecting Maven Integration for Eclipse from Eclipse Marketplace

Once you click on Install, Eclipse will download a list of available components from the remote update site and present you with a list of available features in the Maven Integration for Eclipse plugin as shown in Figure 2.4, “Selecting the Core m2eclipse Feature for Installation”. Select the single, required component named "Maven Integration for Eclipse (Required)", and click on the Finish button.

Figure 2.4. Selecting the Core m2eclipse Feature for Installation

Eclipse will then ask you to agree to the licenses for Maven Integration for Eclipse in the Review Licenses step shown in Figure 2.5, “Agreeing to Software License During m2eclipse Installation”. Maven Integration for Eclipse is distributed under the Eclipse Public License version 1.0. If you agree with the conditions of this license, select "I accept the terms of the license agreement" and click on the Finish button.

Figure 2.5. Agreeing to Software License During m2eclipse Installation

During the installation process, Eclipse may warn you that the software you are installing contains "unsigned content". If you see the dialog shown in Figure 2.6, “Ignoring Warning During m2eclipse Installation”, click on OK to continue the installation process.

Figure 2.6. Ignoring Warning During m2eclipse Installation

Once m2eclipse has been installed, Eclipse will prompt you to either restart or apply changes to a running Eclipse. At this stage of the installation, you should click on Restart Now to restart your Eclipse instance. After a successful restart, Maven Integration for Eclipse will be installed.

Figure 2.7. Restarting Eclipse after m2eclipse Installation

2.2.2. Installing Maven Integration for Eclipse (Extras) Prerequisites

The Maven Integration for Eclipse extra components provide support for additional tools like the Web Tools Project (WTP), Subversion integration via Subclipse, and integration with Mylyn. The following sections provide guidance for users installing some of the prerequisites for m2eclipse extra components.

2.2.2.1. Installing Subclipse in the Eclipse Marketplace

To install Subclipse in the Eclipse Marketplace, open the Marketplace, select the Search tab, and search for "Subclipse" to see the dialog shown in Figure 2.8, “Selecting Subclipse from the Eclipse Marketplace”. Click on Install next to the Subclipse search result item.

Figure 2.8. Selecting Subclipse from the Eclipse Marketplace

Select the appropriate Subclipse components, agree to the software license for Subclipse, and restart your Eclipse installation after the installation process is completed.

2.2.2.2. Installing Mylyn in the Eclipse Marketplace

To install Mylyn in the Eclipse Marketplace, open the Marketplace, select the Search tab, and search for "Mylyn" to see the dialog shown in Figure 2.9, “Selecting Mylyn from the Eclipse Marketplace”. Click on Install next to the Mylyn search result item.

Figure 2.9. Selecting Mylyn from the Eclipse Marketplace

Select the appropriate SMylyn components, agree to the software license for Mylyn, and restart you Eclipse installation after the installation process is completed.

2.2.3. Installing Maven Integration for Eclipse (Extras)

To install the extra components for Maven Integration for Eclipse, open the Eclipse Marketplace, select the Search tab, and search for Maven Integration to see the search results shown in Figure 2.10, “Selecting Maven Integration for Eclipse (Extras) from the Eclipse Marketplace”. CLick on Install next to the "Maven Integration for Eclipse (Extras)" search result item.

Figure 2.10. Selecting Maven Integration for Eclipse (Extras) from the Eclipse Marketplace

Once you have clicked on Install, Eclipse will download the list of available plugin components from the remote update site. The list of available components will then be displayed in the Confirm Select Features step as shown in Figure 2.11, “Selecting m2eclipse (Extras) Components to Install”. The components available in the Maven Integration for Eclipse (Extras) site are:

M2Eclipse Extensions Development Suppport (Optional): Install this component if you want to develop custom pages in the POM Editor, create custom actions in the Maven popup menu, provide custom templates in the POM XML editor, or make other customizations to m2eclipse.
Maven Integration for WTP (Optional): If you are developing applications using the Eclipse Web Tools Project, this component will adapt the Maven classpath container and other Maven resources to the WTP standards.
Maven issue tracking configurator for Mylyn 3.x (Optional): Maven can be configured to work with Mylyn a comprehensive issue and time tracking plugin which currently ships with the Eclipse IDE.
Maven SCM handler for Subclipse (Optional): Subclipse is a popular Subversion plugin for Eclipse hosted by the Tigris community. If you want to use Maven with Subclipse, this component will provide the necessary integration between the two plugins.
Maven SCM handler for Team/CVS (Optional): This component provides integration between the m2eclipse plugin and the CVS support built into Eclipse.
Maven SCM Integration (Optional): This component is required if you installed one of the previous plugins (Subclipse or Team/CVS)
Project configurators for commonly used maven plugins (temporary): This is a temporary project which contains project configurators for commonly used Maven Plugins.

Figure 2.11. Selecting m2eclipse (Extras) Components to Install

Once you have selected the features you wish to install, click Next. Clicking Next will bring you to the Review Licenses step as shown in Figure 2.12, “Agreeing to Software License During m2eclipse (Extras) Installation”. The m2eclipse Extras is distributed under the Eclipse Public License version 1.0. If you agree to this open source license, select "I accept the terms of the license agreement" and click on "Finish".

Figure 2.12. Agreeing to Software License During m2eclipse (Extras) Installation

During the installation process for the m2eclipse Extras, you may receive some warning that "you are installing software that contains unsigned content". If you see the dialog shown in Figure 2.13, “Ignoring Warning During m2eclipse (Extras) Installation”, click OK to continue the installation process.

Figure 2.13. Ignoring Warning During m2eclipse (Extras) Installation

Once the installation process is finished, Eclipse will prompt you to apply the changes or restart your Eclipse instance with a dialog shown in Figure 2.14, “Restarting Eclipse after m2eclipse (Extras) Installation”. To complete the installation of m2eclipse (Extras), restart your Eclipse instance.

Figure 2.14. Restarting Eclipse after m2eclipse (Extras) Installation

Use Jetty to run Maven web applications in NetBeans

2011-04-21T06:38:00.000-07:00

Jetty is a great web server. It is fast to start up and that makes it very useful during development. Jetty has a Maven plugin we can use in our Maven web application project. This way we can use Jetty to test our JSP files. We can change the JSP file and hit the Refresh button of our browser to see the result immediately. We can even compile a Java class file and Jetty will restart so we can test the result in our browser.
Let's see how we can do this in NetBeans. We go to File | New Project, select Maven Project and click the Next button.
In the next dialog window we select Maven Webapp Archetype and click the Next button.
Now we can fill in the values for our project and press the Finish button.
NetBeans creates a new project for us. To add Jetty Maven plugin we must open the pom.xml file for our project. In the build section we must add the following code:


 
  org.mortbay.jetty
  maven-jetty-plugin
  6.1.14
  
   5

At line 6 we define how often Jetty will scan the source directories to look for changes. Because we add this definition we can change JSP files and see the result in our web browser without restarting the server.
Okay, we have defined Jetty for our project, but how can we run Jetty in NetBeans? We go to File | Project Properties and select the Actions category. We must look for the action Run project and select it. In the Execute goals field we add jetty:run. This will start Jetty if we run our project. We can close the dialog window.
Now we go to Run | Run Project to start Jetty. In the Output window of NetBeans we see the following text:

Starting jetty 6.1.14 ...
2009-02-11 10:20:20.610::INFO:  jetty-6.1.14
2009-02-11 10:20:20.982::INFO:  No Transaction manager found - if your webapp requires one, please configure one.
2009-02-11 10:20:21.335::INFO:  Started SelectChannelConnector@0.0.0.0:8080
Started Jetty Server
Starting scanner at interval of 5 seconds.

At line 3 we see Started SelectChannelConnector@0.0.0.0:8080 this means Jetty is available at port 8080. We open a web browser and open http://localhost:8080/webappjetty/ and we see the following:
We go back to NetBeans and open the file index.jsp. We add the following to the file:

It works!

We switch back to our web browser and reload the page and we get:

DataNucleus AccessPlatform 3.0

2011-04-20T03:03:00.000-07:00

The DataNucleus AccessPlatform provides persistence and retrieval of data to a range of datastores using a range of APIs, with a range of query languages. Software for persistence typically only caters for one type of datastore, or one API. DataNucleus is unique in that it supports all standardised persistence APIs for a very wide range of datastores . DataNucleus is the only persistence software certified JDO compliant. DataNucleus is continually innovating and pushing capabilities forward, as well as continually pushing forward the JDO spec. DataNucleus gives you the power to swap persistence API, and datastore when you want to. In fact it allows JPA mapping data to be used with JDO persistence, and vice versa - another unique feature of DataNucleus. Time to take advantage of this power ...

DataNucleus - Tutorial for JDO

An application can be JDO-enabled via many routes depending on the development process of the project in question. For example the project could use Eclipse as the IDE for developing classes. In that case the project would typically use the DataNucleus Eclipse plugin. Alternatively the project could use Ant, Maven or some other build tool. In this case this tutorial should be used as a guiding way for using DataNucleus in the application. The JDO process is quite straightforward.

Step 0 : Download DataNucleus AccessPlatform
Step 1 : Design your domain/model classes as you would do normally
Step 2 : Define their persistence definition using Meta-Data.
Step 3 : Compile your classes, and instrument them (using the DataNucleus enhancer).
Step 4 : Generate the database tables where your classes are to be persisted.
Step 5 : Write your code to persist your objects within the DAO layer.
Step 6 : Run your application.
Step 7 : Things to add.

The tutorial guides you through this. You can obtain the code referenced in this tutorial from SourceForge (one of the files entitled "datanucleus-samples-tutorial-*").

Parancoe 3 web framework

2011-04-20T02:59:00.000-07:00

Parancoe is a project aiming to simplify the release of web applications promoting the convention over configuration philosophy and the DRY principle. This project is promoted by the JUG Padova, and everybody can partecipate.
Parancoe is a Java meta-framework aggregating in an useful way Hibernate/JPA, Spring 2, Spring MVC and, for the AJAX support, DWR.
Parancoe purpose is to give to developers a set of libraries ready to build standard web applications (which in most cases are just crud applications) without worrying of long and harmful configurations files. Parancoe will be composed of a full MVC stack.
Parancoe is open source and is released under the Apache License, Version 2.0.
Are you interested in the parancoe word meaning? A “parancoa” is a scaffolding in the dialect of the Venice (Italy) area.

Lot of time I don’t post something…
But the development of Parancoe is not death. I’m working at the next major release: Parancoe 3.0!
Some of the changes:

The persistence (generic DAOs) has its own independent project now: Lambico. It’s more evolved and robust.
Parancoe now uses Spring 3.0, with it latest evolution and improvements.
The suggested style for developing the controllers is the REST one.
The validation is JSR 303 – Bean Validation (according to Spring MVC 3.0).
We have a new subproject called Parancoe – Validation, for introducing some useful validator, ready for use. (what about a “new password” validator?)

You can start trying Parancoe 3 using the snapshots: Parancoe artifacts are already in our Maven snapshot repository.
For starting a new project based on Parancoe 3, use the “Parancoe Advanced Archetype”, typing the following command:


mvn -DarchetypeGroupId=org.parancoe \
    -DarchetypeArtifactId=parancoe-advancedarchetype \
    -DarchetypeVersion=3.0-SNAPSHOT \
    -DarchetypeRepository=https://oss.sonatype.org/content/repositories/snapshots \
    -Darchetype.repository=https://oss.sonatype.org/content/repositories/snapshots \
    -Darchetype.interactive=false \
    -DgroupId=org.myorg \
    -DartifactId=myapp \
    -Dpackage=org.myorg.padt \
    -Dversion=1.0-SNAPSHOT \
    --batch-mode \
    --update-snapshots \
    org.apache.maven.plugins:maven-archetype-plugin:2.0-alpha-4:generate

project page: http://www.parancoe.org/

25 Beautiful Minimalist Designs

2011-02-18T01:00:00.000-08:00

"Simplify, simplify, simplify."
It's one of Thoreau's most enduring witticisms, and with good reason. When faced with the ever-increasing barrage of information that is modern life, many people find solace in minimalism. This trend has taken an especially strong hold on the Web.
Minimalism and simplification draw attention to important page elements. Using lots and lots of empty space makes content stand out. The overall effect is calming and sophisticated, a welcome break from the typical gauntlet of advertisements and traffic and television and whatever else screams incessantly for your attention.
For your inspiration, here are 25 beautiful minimalist designs. Some are charming, some powerful, some stunning, but they’re all linked by the same idea: simplicity, simplicity, simplicity.

Miguel Ripoll

26000 Vodka

Weather Flash

FRKT

Cascading Style S--t

The Big Word Project

WordPress AntiVirus

For a Beautiful Web

Have You Flossed Today?

Tajloro

jeromeM

min-style

Delicious Design Studio

Plush Department

Troiani Design

Get and Give

Black Estate

The Unexpected Pit Bull

Go Go Gunner

A Woman in the Mirror

zupadupa

Organic SEO

The How To Stretching Zone

Made By On

Popmatik

Website Design & Development

2011-02-18T00:58:00.000-08:00

Website Design, Development, and E-Commerce

With my experience in graphic design, website development, and e-commerce programming, you can be confident that whatever your project demands, I can deliver on time and on budget. View the Web Design Process and request a no cost, no obligation Web Design Quote now!
contact me: diego.benna@gmail.com

Here you can see one of my recent work for the study of landscape architecture, panGea: www.pangeaprogetti.it

Increasing Permgen size in your Web Server

2011-02-16T10:09:00.000-08:00

In previous posts , we had talked about Increasing the Heap size of your server

Here will talk about the Permgen space , how it is different from heap size and why just increasing the heap size will not help you in getting rid of this error

Java.lang.OutOfMemoryError: PermGen space

The permanent generation should not be ignored, because you need enough memory allocated to it to hold all classes in all of your applications including the JSP’s. So if you have an application which uses a good number of third party libraries , has lot of files , you will definitely need a lot of Permgen space. If you are running two applications on the same server , definitely allocate some good chunk of memory to your Perm gen.

How to increase PermGen?

When you add this line in your catalina.bat or catalina.sh

export JAVA_OPTS=-Xms128m -Xmx192m

It only increase heap size. This is how it would look like (assuming your default PermGen is 64MB)

PermGen does not change

To increase PermGen , it would be

export JAVA_OPTS=-Xms128m -Xmx192m -XX:MaxPermSize=256m

See how the size of PermGen has increased.

Perm Gen increased

This was done on Tomcat 6.0.14

How to increase heap size in Tomcat 6

2011-02-16T10:02:00.000-08:00

Most of us who have worked with Apache-Tomcat in productions systems, would have faced out of memory errors sometimes or other. It is not that it always happens in tomcat but let us look at why does this occur and how to solve it.

Understanding Java Virtual Machine

A Java Virtual Machine on 32-bit operating systems typically has a maximum heap size of 64Mb. The JVM heap space is where all Java objects are stored, as well as memory used by the garbage collector. Sun recommends increasing this value for server applications.

Large server applications often experience two problems with these defaults. One is slow startup, because the initial heap is small and must be resized over many major collections. A more pressing problem is that the default maximum heap size is unreasonably small for most server applications.

64MB is the heap size in tomcat as well by default and is too less for real world systems. When your application runs and you are able to analyze the app, this is what you would see

heap size in tomcat

How to increase the heap size?

On windows :

Go to catalina.bat and set this

set JAVA_OPTS=-Xms128m -Xmx192m

On linux :

export CATALINA_OPTS="-Xms16m -Xmx256m";

-Xms – is the minimum or initial size of your heap
-Xmx – is the maximim size

export JAVA_OPTS="-Xms128m -Xmx256m";

On linux , you can also set in setenv.shin the bin folder. The catalina.sh script has logic to call into this script.

Note that CATALINA_OPTS is a better place than JAVA_OPTS. The former is only used when actually starting the Tomcat instance. JAVA_OPTS is also used to start JVMs that only interact with Tomcat (for example the JVM instance that is used to send the shutdown-message to a running Tomcat instance).

You can have a look at this article High Performance in Tomcat. Although this article is pretty old (dates back to Tomcat 4) , it still has lot of good points.
Once you have set the heap , how to check heap size ?

How to check heap size in linux

The output of jmap -heap <pid>.
Some more information can be found here http://wiki.apache.org/tomcat/OutOfMemory

Round Web 2.0 Button with a Metal Ring, Glass effect

2011-02-12T08:06:00.000-08:00

In this Gimp tutorial we will create a round web 2.0 button/icon with a metal ring around it. This button is very handy for download icons and such, and it can easily be customized, especially with gradients.

FINAL IMAGE PREVIEW

This is what we’re going to create, we will also look at some variations of the button afterwards.

Step 1

Create a new image with a white background. I made mine 600×400.
Now create a new layer and name it “ring”.
Use the Ellipse Select Tool to create a circle that measures 250×250.

Step 2

Set your FG and BG color to a dark gray (333333) and white (ffffff).
Use the Blend Tool to create a gradient from the top of the selection to the bottom of it.
The gradient should be Reversed, the shape set to Radial, the Offset should be set to 20, and Adaptive Supersampling should be enabled.

The offset simply makes it so that we get more white on the top of the button, while Adaptive Supersampling makes it smoother. Our image should look like this now:

Step 3

Shrink the selection by 25px. (Select->Shrink)

Use the Blend Tool to create a gradient from the bottom of the selection to the top of it.
Use the same settings as last time.

Step 4

Create a new layer and name it “sphere”. Shrink the selection by 5px (Select->Shrink), then fill the selection with a blue color (216eda) using the Bucket Fill tool.

Now set your FG color to cyan (4feeff).
Create a radial gradient a little bit above the bottom of the selection and approximately 120px up.
The Gradient should be set to FG to Transparent, it should not be reversed, set the Offset to 20, and make sure Adaptive Supersampling is disabled.

That should give us this result:

Step 5

Set your FG color to white (ffffff). We’re going to use the Paintbrush tool to add a little white at the bottom of the button.
Set the opacity of the brush to 70%, use a large fuzzy brush (Circle Fuzzy 19) and set the scale to 10.
Position the brush so that half of it is inside the selection, then click just once with the mouse.

That should give us a gentle touch of white like this:

Step 6

We’re going to create an inner shadow, to do this we first need to create a new layer and name it “inner shadow”.
Now grow the selection by 1px. Select->Grow.

Then we fill the selection with black (000000) using the Bucket Fill tool.
Next go to Select->Feather.
Feather the selection by 20.

Now hit the Delete button on the keyboard.
Also, we don’t need the selection anymore so get rid of it by going to Select->None.

Next, duplicate the layer so that the inner shadow becomes stronger.

Step 7

Create a new layer and name it “gloss”.
Create a selection where you want the gloss to be.

Set your FG color to white (ffffff).
Create a gradient from the top of the selection to the bottom of it.
The Gradient should be set to FG to Transparent, the Shape to linear, Offset to 0.

Now reduce the opacity of the gloss layer to 75 so that it blends in more smoothly with the rest of the button.

Step 8

Time to add some text, select a font you like and write something on the button, these kinds of buttons are very good for adding short words like GO! or a symbol such as a downwards arrow for a download button.
I simply added the letter Z. The font is Verdana Bold size 100.

Next we give the text an outline.
To do that go to Filters->Light and Shadow->Drop shadow.
Set Offset X and Offset Y to 0.

That should give us a nice dark outline around the text like this:

Step 9

Almost done know, we just need to give the whole button an outline, and soften it a little.
Select the layer named “ring”, and then give it a drop shadow with the same settings as we used on the text.

Now we need to soften the button a little bit just where the inner shadow meets the metal ring.
We have two layers with inner shadow, so we need to merge them into one. In the Layer Dialog, select the top layer with inner shadow, right-click and choose Merge Down.
Next we’re going to give the inner shadow layer a Gaussian blur of 2. (Filters->Blur->Gaussian Blur)

That’s it, the button is done:

Variations

It’s also very easy to make variations of this button by using gradients instead of all that
blue and cyan we made in step 4 and step 5.
Here is the button with the gradient called Deep Sea, the gradient was created
from the bottom of the selection and 450px up.

Here is the same gradient from the top of the selection to almost the bottom of it, and with the gloss shaped differently.

Here it is with the gradient Incandescent from the top of the selection to the bottom of it.

That’s it, it’s the end of the tutorial, tell us what you think in the comments.

CSS: Clearing Floats with Overflow

2011-02-12T02:45:00.000-08:00

One of the common problems we face when coding with float based layouts is that the wrapper container doesn’t expand to the height of the child floating elements. The typical solution to fix this is by adding an element with clear float after the floating elements or adding a clearfix to the wrapper. But did you know you can also use the overflow property to fix this problem? It’s not a new CSS trick either. It’s been documented before long long ago. Today I would like to revisit the topic along with a few tips.

View Demo Clear Floats

Demo 1:

The demo below shows the issue with floating child elements where the parent container doesn’t expand. To fix this problem, you can simply add the CSS property overflow:auto (or overflow:hidden) to the wrapper container. This is perhaps the simplest way to clear floats.

.container {
 overflow: auto;
}

Demo 2:

Overflow:auto can also be used to prevent content from wrapping around the floated element. Let’s say you are designing a comment list. You would, most likely, have an avatar floating on the left and the comment to the right. To prevent the comment from wrapping around the avatar just add overflow:hidden to the comment container. The advantage of using overflow here is that I don’t have to set a float or width to the comment container. The container automatically aligns after the floated avatar image.

.image {
 float: left;
}

.text {
 overflow: hidden;
}

Drawbacks (see demo)

Although it is a nice trick to clear floats there are some drawbacks:

Using overflow:auto will cause a scrollbar if your content is extending the boundary of the container. For example, if you have a long unbreaking text (ie. long url text) or a large image that is bigger then the container a scrollbar will show.
To avoid a scrollbar from showing you should use overflow:hidden. Again, there is a drawback to this method as well. Using overflow:hidden will hide any content that exceeds the boundry of the container.

Word-wrap

To solve the long unbreaking text issue, simply add word-wrap:break-word to the container and it will force the text to wrap onto a new line.

.container img {
 max-width: 100%;
 height: auto;
}

Max-width

To prevent large images from extending the boundar, add max-width:100% and it will resize the image to the max width of the container.

.container {
 word-wrap: break-word;
}

Light Painting in Gimp

2011-02-12T02:40:00.000-08:00

This is my second Gimp Tutorial. The original tut was made by Fabio Sasso in his wonderful site Abduzeedo. He has done the light painting tuts for Photoshop,Pixelmator,Firework and i decided to try the tuts with gimp. It took me an hour trying to find the right combination of effects and blend modes in gimp, and i did it! Here is my tuts;

If u don't have Gimp.You can download it here.It's free!

P/S : Click the image for larger view.

P/s: The original Photoshop tutorial can be found HERE. You also can find the Firework and Pixelmator tutorial version too in Abduzeedo site.

1.Open the background image.you can download it from here.

2.Now get an image of The Beatles Abbey Road cd.Drag the The Beatles Abbey Road CD cover photo to the image .

3.Resize it to larger image using scale tool.

4.Use Path Tool(P) and create paths around the guy in the photo.

after that created a new layer and named it as Guy 1.Dont forget to chose your foreground color white and black..

5.Then Select>From Path(shift+v).it will select the path that you make using the Path tool.

Go to Edit>Strokes Path.Strokes Line is 11 px,Solid Color and Line style>Dash preset>Line and dont forget to click antialising.and then clik Stroke.Use the image below for reference and values.Click the image for large view.

6.The next thing is go to Select >None(Ctrl+D).

7.Repeat the steps 4 until steps 6 to other guy.

hide the The Beatles Abbey Road cd layer and u'll see the stroke line at the guy 1 layer.

8.Change the layer mode to soft light.Apply a Gaussian Blur with 2 radius.And then duplicate the guy 1 layer 4 times.After that create a new layer and rename it as rectangle.

9.At the rectangle layer,create a rectangle using the rectangle select tool(m).

10.The next things is go to Select>Border.Chose 5 pixel for border selection

11.Fill the border selection white our foreground color(white).Go to Edit>Fill with FG Color.

12.See those blue guides? Those are Guides.Just add a guide so we can align the rectangles like I did in the image below.. I like using them because it really help me.If you want to turn them on and off, go to View > Shows Guides

13.Duplicate the rectangle and align them.

After that merge down all the copy rectangle layer to one single rectangle layer.

14.Resize the rectangle a little bit smaller like the image below

15.Use the Perspective tool(shift+p)to adjust the perspective of the rectangles.

15.Change the rectangle layer mode to soft light and then duplicate it 3 times.Finished!

Final result!

Download the Gimp Xcf file here

Gimp Tutorial: Awesome Bokeh Effect in Gimp

2011-02-12T02:36:00.001-08:00

It was fun to to follow Abduzeedo tutorial for making bokeh digital effect in Photoshop (i'm using photoshop and gimp) and i really excited when i managed to do similiar effect in Gimp. So i decided to make a Gimp tut for this one..it's been over a months since my last tutorial and i think after this i'll make more Gimp tuts..Click More Inside The Post to read the tutorial.

P/s: This tutorial has been converted from the original Photoshop tutorial into Gimp. The original Photoshop tutorial can be found HERE in Abduzeedo site.

Before you try this tutorial,please download my Eclipse brush where i made it by myself. You can download the brush by click HERE. After download it, paste the brush to Gimp folder. And i'm using Gimp 2.6 for this one.

P/S : Click the image for larger view.

Create new document. I'll used 1600 x 1200. Fill the background with blackcolour .

Then create new layer.I renamed it as dark violet.

Choose a dark purple. I'm using #b10993.

Select gradient tool, Radial for the shape and low the opacity to 50. Click the image for larger view.

Now create a new layer and i renamed it as eclipse.

Select the brush tool. and I'll using my Eclipse brush. Use white color for the brush.Then Select brush dynamic options and for the values use the image below.

Now we'll paint some ellipses at the eclipse layer.

Go to Filters>Blur>Gaussian Blur. For this first layer use 40 pixels for the Horizontal and 40 pixels for the Vertical.

Create another layer ( I named it eclipse 2 ) and start painting again.

Go to Filters>Blur>Gaussian Blur. For this second layer use 10 pixels for the Horizontal and 10 pixels for the Vertical

Create another layer and repeat the previous step, this time however i'll Apply the Gaussian Blur to this layer as well, but use only 1 pixel for the Radius.

And then create a new layer and i named it as Clouds.Fill it with white. Go to Render>Clouds>Different Clouds.and apply to the layer. I use 4 for the Detail, Randomize and Tileable.After that changes the layer mod to Overlay.

Create another layer and named it gradient.

Using the gardient tools select Full Saturation Spectrum Gradient , 100 for the opacity and Linear for the shape.

Apply the gradient to the layer. Change the layer mod to Overlay.U'll see a nice effect there.

Go to layer eclipse 3 and change the layer mod to Grain merge.

Last,go to layer 2 and change the layer mod to Hard Light

Finish!

Result

Below is my result using Photoshop..You will noticed that Gimp is a great free editing software ever because it can achieve almost the same as Photoshop result.

hope u like it..i take no credit of this awesome effect.credit all to Fabio Sasso for the inspiring idea.

I also included the Xcf file.
Click here to download the Xcf file used for this tutorial

UPDATED: 2 FEBRUARY 2009

I HAVE MADE NEW BOKEH .GBR BRUSH SO FEEL FREE TO DOWNLOAD IT HERE. THIS IS MY NEW RESULT USING THE BRUSH. MADE IN GIMP 2.6.4.

Install Tomcat 6 on Ubuntu 10.04 by apt-get

2011-02-10T01:53:00.000-08:00

Apache Tomcat is a web container that allows you to serve Java Servlets and JSP (Java Server Pages) web applications.

The Tomcat 6.0 packages in Ubuntu support two different ways of running Tomcat. You can install them as a classic unique system-wide instance, that will be started at boot time and will run as the tomcat6 unpriviledged user. But you can also deploy private instances that will run with your own user rights, and that you should start and stop by yourself. This second way is particularly useful in a development server context where multiple users need to test on their own private Tomcat instances.

System-wide installation

To install the Tomcat server, you can enter the following command in the terminal prompt:

sudo apt-get install tomcat6

This will install a Tomcat server with just a default ROOT webapp that displays a minimal "It works" page by default.

Configuration

Tomcat configuration files can be found in /etc/tomcat6. Only a few common configuration tweaks will be described here, please see Tomcat 6.0 documentation for more.

Changing default ports

By default Tomcat 6.0 runs a HTTP connector on port 8080 and an AJP connector on port 8009. You might want to change those default ports to avoid conflict with another server on the system. This is done by changing the following lines in /etc/tomcat6/server.xml:

<Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" 

               redirectPort="8443" /&rt;
...

<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /&rt;

Changing JVM used

By default Tomcat will run preferably with OpenJDK-6, then try Sun's JVM, then try some other JVMs. If you have various JVMs installed, you can set which should be used by setting
JAVA_HOME in /etc/default/tomcat6:

JAVA_HOME=/usr/lib/jvm/java-6-sun

Declaring users and roles

Usernames, passwords and roles (groups) can be defined centrally in a Servlet container. In Tomcat 6.0 this is done in the /etc/tomcat6/tomcat-users.xml file:

Using Tomcat standard webapps

Tomcat is shipped with webapps that you can install for documentation, administration or demo purposes.

Tomcat documentation

The tomcat6-docs package contains Tomcat 6.0 documentation, packaged as a webapp that you can access by default at http://yourserver:8080/docs. You can install it by entering the following command in the terminal prompt:

sudo apt-get install tomcat6-docs

Tomcat administration webapps

The tomcat6-admin package contains two webapps that can be used to administer the Tomcat server using a web interface. You can install them by entering the following command in the terminal prompt:

sudo apt-get install tomcat6-admin

The first one is the manager webapp, which you can access by default at http://yourserver:8080/manager/html. It is primarily used to get server status and restart webapps.


	Access to the manager application is protected by default: you need to define a user with the role "manager" in `/etc/tomcat6/tomcat-users.xml` before you can access it.

The second one is the host-manager webapp, which you can access by default at http://yourserver:8080/host-manager/html. It can be used to create virtual hosts dynamically.


	Access to the host-manager application is also protected by default: you need to define a user with the role "admin" in `/etc/tomcat6/tomcat-users.xml` before you can access it.

For security reasons, the tomcat6 user cannot write to the /etc/tomcat6 directory by default. Some features in these admin webapps (application deployment, virtual host creation) need write access to that directory. If you want to use these features execute the following, to give users in the tomcat6 group the necessary rights:

sudo chgrp -R tomcat6 /etc/tomcat6
sudo chmod -R g+w /etc/tomcat6

Tomcat examples webapps

The tomcat6-examples package contains two webapps that can be used to test or demonstrate Servlets and JSP features, which you can access them by default at http://yourserver:8080/examples. You can install them by entering the following command in the terminal prompt:

sudo apt-get install tomcat6-examples

Using private instances

Tomcat is heavily used in development and testing scenarios where using a single system-wide instance doesn't meet the requirements of multiple users on a single system. The Tomcat 6.0 packages in Ubuntu come with tools to help deploy your own user-oriented instances, allowing every user on a system to run (without root rights) separate private instances while still using the system-installed libraries.


	It is possible to run the system-wide instance and the private instances in parallel, as long as they do not use the same TCP ports.

Installing private instance support

You can install everything necessary to run private instances by entering the following command in the terminal prompt:

sudo apt-get install tomcat6-user

Creating a private instance

You can create a private instance directory by entering the following command in the terminal prompt:

tomcat6-instance-create my-instance

This will create a new my-instance directory with all the necessary subdirectories and scripts. You can for example install your common libraries in the lib/ subdirectory and deploy your webapps in the webapps/ subdirectory. No webapps are deployed by default.

Configuring your private instance

You will find the classic Tomcat configuration files for your private instance in the conf/ subdirectory. You should for example certainly edit the conf/server.xml file to change the default ports used by your private Tomcat instance to avoid conflict with other instances that might be running.

Starting/stopping your private instance

You can start your private instance by entering the following command in the terminal prompt (supposing your instance is located in the my-instance directory):

my-instance/bin/startup.sh


	You should check the `logs/` subdirectory for any error. If you have a java.net.BindException: Address already in use:8080 error, it means that the port you're using is already taken and that you should change it.

You can stop your instance by entering the following command in the terminal prompt (supposing your instance is located in the my-instance directory):

my-instance/bin/shutdown.sh

References

See the Apache Tomcat website for more information.
Tomcat: The Definitive Guide is a good resource for building web applications with Tomcat.
For additional books see the Tomcat Books list page.

Diego Benna's Blog

Install GUI in Ubuntu Server

Bandwidth Monitoring Tools For Linux

Speed Up Firefox web browser

Mount and Unmout ISO images without burning them

Share your Ubuntu Desktop Using Remote Desktop

How to install Ubuntu Linux from USB Stick

How to Install Chromium (Google chrome) in Ubuntu using deb package

Large WAR file cannot be deployed in Tomcat 7

Problem

Solution

Linux Web Server and Domain Configuration Tutorial

Grant access to a user's web directory: public_html

SELinux security contexts:

Virtual Hosts:

Configuring a "name based" virtual host:

Apache virtual domain configuration with Ubuntu Dapper/Hardy:

Configuring an "IP based" virtual host:

CGI: (Common Gateway Interface)

Configuring CGI To Run With User Privileges:

ERROR Pages:

Page does not found!

PHP:

Running Multiple instances of httpd:

Apache Man Pages:

Apache Red Hat / Fedora Core GUI configuration:

Configuration files:

Man Pages:

Configuration files: (RH 8.0+)

More information:

Man pages on related FTP commands and files:

Other FTP daemons:

Passive mode:

Firewall connection tracking module:

NAT firewall modules:

FTP fails because it can not change to the users home directory:

Configuration files:

Primary server (master):

Secondary server (slave):

Test DNS:

Extra logging to monitor Bind:

Chroot Bind for extra security:

Load Balancing of servers using Bind: DNS Round-Robin

Bind/DNS Links:

Domain name registration:

Joomla

History

Features

Community

Talend Cache Management

Autoincrement key in PostgreSQL and MySQL

Installing m2eclipse in Eclipse 3.6 (Helios) with the Eclipse Marketplace

2.2.1. Installing Maven Integration for Eclipse (Core)

2.2.2. Installing Maven Integration for Eclipse (Extras) Prerequisites

2.2.2.1. Installing Subclipse in the Eclipse Marketplace

2.2.2.2. Installing Mylyn in the Eclipse Marketplace

2.2.3. Installing Maven Integration for Eclipse (Extras)

Use Jetty to run Maven web applications in NetBeans

It works!

DataNucleus AccessPlatform 3.0

Parancoe 3 web framework

25 Beautiful Minimalist Designs

Website Design & Development

Increasing Permgen size in your Web Server

How to increase PermGen?

How to increase heap size in Tomcat 6

Understanding Java Virtual Machine

A Java Virtual Machine on 32-bit operating systems typically has a maximum heap size of 64Mb. The JVM heap space is where all Java objects are stored, as well as memory used by the garbage collector. Sun recommends increasing this value for server applications.

How to increase the heap size?

How to check heap size in linux

Round Web 2.0 Button with a Metal Ring, Glass effect

FINAL IMAGE PREVIEW

Step 1

Step 2

Step 3

Step 4

Step 5

Step 6

Step 7

Step 8

Running Multiple instances of `httpd`: