Digital Rewind

Lucee Locking Down Admin and Allowing CFGRAPH

Wed, 07 Dec 2016 13:00:00 +0000

I was reading through the Lucee Lockdown guide for Apache and Lucee. I locked down the admin fine, but using the following location directive.

<Location /lucee>
  Order Deny,Allow
  Deny from all
  Allow from 999.999.9999.999 888.888.888
</Location>

This allows the 999.999.999.999 ip address and ip adresses that start with 888.888.888 to access the admin fine. You can add any number or ip adn partial ip addresses to this line separated by a space. Unfortunately it breaks the graphs CFCHART generates. To fix this issue you need to add following location directive after the above location directive.

<location /lucee/graph.cfm>
  Order Allow,Deny
  Allow from All
</location>

This enables the graphs and still locks down the admin and can be applied to anything in the folder.

Lucee CFFLUSH problem and solution

Tue, 29 Mar 2016 13:00:00 +0000

Some more notes on switching over from Coldfusion to Lucee server. I have a custom reporting application that is running on Fusebox that I couldn’t get the CFFLUSH code I had to keep the status of the report connection updating. It allowed updates as the report generated and kept Internet Explorer connections from timing out. At first I thought it was a problem with Lucee on Apache, but the following code worked in a plain old cfml page without Fusebox.

<cfflush interval="1" />
<p>
	This page is running!
</p>
LuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLucee
		
<cfset sleep(10000) />

<p>
	This page Finished!
<p>

( The multitude of “Lucee”s are to fill up the buffer to test the CFFLUSH and the sleep() function is to simulate a long running process. There appears to be a minimum you can send back with a flush no matter what the interval is )

Since this works it’s not a Lucee/Apache issue. After reviewing the fusebox4.runtime.cfmx.cfm there is a CFPROCESSINGDIRECTIVE tag for suppressing white space wrapped around the parsed files included by the framework. So the following code in Lucee doesn’t CFFLUSH as expected. It waits for the entire page to run then processes the CFPROCESSINGDIRECTIVE and sends back the data.

<cfprocessingdirective suppresswhitespace="Yes">
<cfflush interval="1" />
<p>
	This page is running!
</p>
		LuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLuceeLucee
		
<cfset sleep(10000) />

<p>
	This page Finished!
<p>
</cfprocessingdirective>

The above code also in Adobe Coldfusion. So to fix it I just removed the CFPROCESSINGDIRECTIVE and everything works as I was expecting. Interestingly enough if you turn on supresswhitespace in the Luceee Administrator and remove the CFPROCESSINGDIRECTIVE then the CFFLUSH still works.

Setup of Lucee REST Web Services on Apache

Tue, 29 Mar 2016 13:00:00 +0000

I was pulling my hair out to get Lucee 4.5 to recognize REST CFCs on my Amazon EC2 server running Apache. I am really writing this up as notes so I can find it later.

Step 1

Go to the /etc/httpd/conf directory on your linux machine and edit the httpd.conf file.

nano httpd.conf

ctrl-w /rest

remove the # from the begining of  

ProxyPassMatch ^/rest/(.*)$ http://127.0.0.1:8888/rest/$1 

ctrl-x

save changes? Y

service httpd restart

Step 2

Create a folder in your Lucee root for you test.

mkdir /var/www/html/api/
cd /var/www/html/api/

nano hello.cfc

<cfcomponent rest="true" restpath="/hello"> 
    <cffunction name="myHello" access="remote" returnType="String" httpMethod="get" restPath="/world">
        <cfset res="Hello World!">
        <cfreturn res>
    </cffunction>
</cfcomponent>

Step 3

For now enable the List services.

Create a new mapping for /test /var/www/html/api/

Step 4

Open a web browser and got to : http://yourserver.com/rest/ and hit enter.

You should see :

Available sevice mappings are:
*/rest/test

Then enter http://yourserver.com/rest/test/hello/world

You Should see:

"Hello World!"

Adding SSL to Apache on EC2 with Amazon Linux

Thu, 03 Mar 2016 13:00:00 +0000

These notes assume you have Apache installed and working on EC2 with Amazon Linux, but it’s fairly similar for other versions of Linux.

Install OpenSSL and the Apache Connector

// for Apache 2.2
yum install openssl mod_ssl
// for Apache 2.4
yum install openssl mod24_ssl
// restart Apache
service httpd restart

Test SSL

https://yoursever.com/

This will bring up the default key that was create when you installed OpenSSL.

Generate Key

cd  /etc/pki/tls/private
openssl genrsa -out domain-name.key 2048
chown root.root domain-name.key
chmod 600 domain-name.key

Generate Request

mkdir ssl under /ec2-user/domain-name/ssl
cd /ec2-user/domain-name/ssl
sudo openssl req -new -key /etc/pki/tls/private/domain-name.key -out domain-name.pem

Once the request has been generated and sent to your certificate authority they will send you back two .crt files. One is the domain cert and one is the bundle cert. You can rename them to domain-name.crt and domain-name-bundle.crt.

// put crt file on the server with correct permissions
cp domain-name.crt /etc/pki/tls/certs/domain-name.crt
chown root.root /etc/pki/tls/certs/domain-name.crt
chmod 600 /etc/pki/tls/certs/domain-name.crt
  
cp domain-name-bundle.crt /etc/pki/tls/certs/domain-name-bundle.crt
chown root.root /etc/pki/tls/certs/domain-name-bundle.crt
chmod 600 /etc/pki/tls/certs/domain-name-bundle.crt

It’s important to change the permissions on the file for Apache and OpenSSL will not work.

Configure Apache SSL

// backup the conf file
cp /etc/httpd/conf.d/ssl.conf /etc/httpd/conf.d/ssl.conf.bkp
// edit the file
nano /etc/httpd/conf.d/ssl.conf


// search for the .key file line below and change the localhost.key

SSLCertificateKeyFile /etc/pki/tls/private/domain-name.key

// search for the .crt file line below and change the localhost.crt

SSLCertificateFile /etc/pki/tls/certs/domain-name.crt

// search for the bundle.crt file line below and point to the new bundle.crt

SSLCACertificateFile /etc/pki/tls/certs/domain-name-bundle.crt

// restart Apache
service httpd restart

This allows one SSL Domain on the server. If you want to have more than one SSL domain on the server it’s a bit more setup. I’ll cover that in a different post.

Virtualbox shared folder CSS Files not Updating

Wed, 03 Feb 2016 19:00:00 +0000

So I was editing a website on my Macbook running Apache2 with Lucee in Virtualbox. For some reason my CSS changes were not updating when I saved them. If I removed all the lines except for the first couple them it worked. Adding more lines would eventually corrupt the file being sent to the browser and no changes were displayed. I found the answer on a Stack Overflow post. in the httpd.conf file for Apache has EnableSendfile on this seems to be incompatible with the Virtualbox file system. Sos switching it to EnaleSendfile off will fix the problem. Below are the instructions for Centos.

nano /etc/httpd/conf/httpd.conf
ctrl-w EnableSendfile # search
# change on to off
ctrl-x # exit
y # to confirm
systemlctl restart httpd

Installing Jekyll on El Capitain 10.11

Wed, 27 Jan 2016 11:35:00 +0000

I am currently moving my blog to Github and Jekyll. On my iMac there were no issues installing Jekyll, but on my MacBook Air it errored trying to install files in /usr/bin/. There was also a single threading warning on my iMac so I updated the gem installer first on my second install. This may have caused the MacBook Air issues. So I am noting this here for my future reference and including a link to the solution at the bottom of this post.

Update gem:

sudo gem update --system

Install Jekyll to /usr/local/bin:

sudo gem install -n /usr/local/bin jekyll

There are also Homebrew install instructions, but I really wanted this setup with a “normal” Mac install since I don’t use Ruby for anything except Jekyll at the moment.

Jekyll Install troubleshooting OSX 10.11

Lucee Fix on Amazon Linux not Starting on Boot

Fri, 15 Jan 2016 11:35:00 +0000

After installing Lucee 4.5.2.018 with the Vivio Technologies installer on Amazon Linux with Apache it won’t automatically start when rebooting the EC2 instance. Even if you select it to start during the install process.

Edit the /etc/rc.d/rc.local file ( It loads after everything else on the machine ) and add the following to the end of the file:

/opt/lucee/lucee_ctl start

I used rc.local since I have other things in there for my instance’s boot process. The installer should put it in /etc/init.d/ folder so that you can use chkconfig.

Check out August Kleimo’s Post on installing Lucee if you want to do it that way.

Lucee Fix for Apache mod_cfml on Amazon Linux

Sun, 27 Dec 2015 11:35:00 +0000

After installing Lucee 4.5.2.018 with the Vivio Technologies installer on Amazon Linux with Apache it wasn’t serving cfml pages. Since Amazon Linux is a bit different the installer doesn’t install the connector correctly.

Here is my fix for the issue on the 64bit version of Amazon Linux after running the lucee-4.5.2.018-pl0-linux-x64-installer.run installer:

#copy the mod_cfml for Apache 2.2 64bit from the lucee directory

cp /opt/lucee/sys/mod_cfml/centos-httpd22-x64/mod_cfml.so /usr/lib64/httpd/modules/

chmod 755 mod_cfml.so 

# Get the Shared Key from  the /opt/lucee/tomcat/conf/server.xml file

<!-- visit modcfml.org for details on mod_cfml configuration options -->
<Valve className="mod_cfml.core"
    loggingEnabled="false"
    maxContexts="200"
    timeBetweenContexts="2000"
    scanClassPaths="false"
    sharedKey="SHARED KEY" />

# Fill in the SHARED KEY and add the Valve to : /etc/httpd/conf/httpd.conf

DirectoryIndex index.cfm index.cfml index.html index.html.var

# add this to the end of httpd.conf
                
LoadModule modcfml_module modules/mod_cfml.so
CFMLHandlers ".cfm .cfc .cfml"
ModCFML_SharedKey "SHARED KEY FROM ABOVE"
# Optional, all for logging and debugging:
# LogHeaders true
# LogHandlers true
# LogAliases true
# VDirHeader false

Hopefully this will help out till the installer is modified.

Links :

mod_cfml

Tomcat Value

Lucee Bug Report

Connecting to EC2 with Transmit for Mac

Thu, 29 Dec 2011 09:05:00 +0000

This example is for connecting Amazon Linux EC2 from a Mac so your mileage may vary.

Click the [+] to add a new site to Transmit:

Then make sure to select sFTP as your protocol. Enter either your instance name given to you by AWS, elastic ip, or the domain used to access it. The user will be ec2-user with no password. During the EC2 setup you should have saved your PEM key file to your local machine. This allows using SSH from the terminal to manage the instance. I usually put them in ~/Documents/ec2-keys/[yourkey].pem. Then go to the Terminal and change directory to the ~/Documents/ec2-keys/ folder in this case and run :

chmod 700 [yourkey].pem
ssh-add -K [yourkey].pem

This will permanently add the key to your profile and then Transmit should connect correctly. If you have a problem make sure you run the chmod command as the PEM file needs to have restricted permissions.

Installing Railo on EC2 with Amazon Linux

Mon, 25 Apr 2011 13:00:00 +0000

After following the comments on Ben’s Blog about running Railo on EC2. I decided to post my notes in case they might help someone. This assumes you know how to setup an account and the firewall on Amazon AWS. There is a GUI on the amazon site to do all this. It can be done pretty easily with a little trial and error.

Setup an EC2 account and launch an Amazon Linux AMI instance with the security settings to have ports :20, 21, 22, 80, 3306,8888 open.
Once it’s launched ssh to your new instance as ec2-user
sudo su - ( logs you in as root )

Update AMAZON LINUX

yum update

Install MYSQL

yum install mysql mysql-server

This installs mysql just follow the prompts.

chkconfig mysqld on

This sets mysql to run on the start of the instance. ( edit the server settings in /etc/my.cnf with nano )

service mysqld start

This starts MYSQL on your instance for the first time.

cd /usr/bin/
./mysql_secure_installation

This file lets you setup the mysql root password and disable other stuff. The default mysql root password is “blank” so you must run this script.

CREATE USER 'remote_user'@'localhost' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON *.* TO 'remote_user'@'localhost';
CREATE USER 'remote_user'@'%' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON *.* TO 'remote_user'@'%';

% lets your user login from anywhere usually this is a bad idea. Set it to your IP address will be connecting remotely from. Localhost setups up the user so your Railo DSN’s can talk to mysql. Change ‘password’ to a secure password you want to use.

Apache

yum install httpd httpd-devel
chkconfig httpd on 
service httpd start

This is similar to how we did mysql. If you navigate to your instance http://[yourinstancename].compute-1.amazonaws.com/ you should get the apache start screen.

Railo

cd /tmp
wget http://railo.viviotech.net/downloader.cfm/id/15/file/railo-3.2.1.000-pl0-linux-x64-installer.run
chmod 777 railo-3.2.1.000-pl0-linux-x64-installer.run
./railo-3.2.1.000-pl0-linux-x64-installer.run

This runs the installer you’ll need the folders below. On the 64bit version the defaults work. Apache is 2.2 for the connector.

/etc/rc.d/init.d/httpd
/usr/lib64/httpd/modules
/etc/httpd/conf/httpd.conf
http://[yourinstancename].compute-1.amazonaws.com:8888
http://[yourinstancename].compute-1.amazonaws.com:8888/railo-context/admin/web.cfm
http://[yourinstancename].compute-1.amazonaws.com:8888/railo-context/admin/server.cfm

Railo will now be running you can get to it by your EC2 name and port 8888 check the server and web admin to make sure the passwords are setup. Configuring a new site on APACHE and RAILO The sites need to be setup in railo and apache we’ll setup a test site so you can see what to do. On you laptop edit your hosts file and add an entry for :

999.999.999.999 mytestdomain.com
999.999.999.999 www.mytestdomain.com

Substitue your EC2 ip for 999.999.999.999

On your EC2 instance :

cd /var/www/
mkdir mytestdomain.com
cd mytestdomain.com
mkdir html
cd html
nano index.cfm
cd ..
cd ..
chmod -R 777 mytestdomain.com
Setup the folder for Apache and Railo. And add a default index.cfm page with hello world in it. This is where your code will go.
nano /opt/railo/tomcat/conf/server.xml

At the end of the file near the example add:

<Host name="www.mytestdomain.com" appBase="webapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
<Context path="" docBase="/var/www/mytestdomain.com/html/" />
</Host>

This will add the webroot to railo.

/opt/railo/railo_ctl restart

This will reboot railo to see the new web folder.

nano /etc/httpd/conf/httpd.conf
ctr-w : index.html ( to find the line ) and add index.cfm to the end of the DirectoryIndex index.html index.html.var index.cfm line.
service httpd restart

Navigate to www.mytestdomain.com and you should be running Railo. This is just a summary of my notes to get everything running. Obviously your mileage will vary and it will help to know a bit about running Apache, MySql, and Railo.

Good Luck.

Notes and stuff

# memory settings for railo
nano /opt/railo/tomcat/bin/setenv.sh 
# restart / start Railo
/opt/railo/railo_ctl restart