G-Loaded Journal

Speed up Apache by including htaccess files into httpd.conf

George Notaras — Mon, 28 Nov 2011 05:12:59 +0000

It is widely known that, if virtual hosts in Apache (httpd) are configured to permit vhost administrators override specific configuration options at the directory level using htaccess files, the web server consumes valuable time in order to check whether an htaccess file exists in every directory included in the requested path and parse it. On the other hand, many popular web applications utilize htaccess files, especially those residing in the DocumentRoot, in order to implement pretty URLs or HTTP redirections, which is extremely convenient since the virtual host owner does not have to edit httpd’s configuration directly. So, I had the idea to include the htaccess file of the DocumentRoot directory on the filesystem into the virtual host’s configuration.

Suppose we have the /home/example.org/public_html/ directory on the filesystem, which serves as the document root of our virtualhost. The relevant httpd configuration for that vhost would look like this:


  ServerName example.org:80
  ...
  DocumentRoot /home/example.org/public_html
  
    AllowOverride All
    ...
  
  ...

In order to prevent the htaccess lookups on the filesystem without losing the htaccess functionality – at least at the DocumentRoot level- I transformed the configuration to the following:


  ServerName example.org:80
  ...
  DocumentRoot /home/example.org/public_html
  
    AllowOverride None
    Include /home/example.org/public_html/.htaccess
    ...
  
  ...

Let’s see what we have accomplished with this:

httpd does not waste any time looking for and parsing htaccess files resulting in faster request processing,
the virtual host administrator can still override the configuration options of the document root manually or through the web interface of the web application.

Seems like a win-win situation performance and functionality wise.

But, as usual, there is no win-win situation without a downside. In this case, the above trick weakens the server’s security. Let’s see how.

Although the configuration of a directory can be set in both httpd.conf and the directory’s htaccess file, not all directives can be used in both contexts. htaccess files support a subset of the directives that can be used in the Directory context within httpd.conf. By including the htaccess file in httpd’s configuration the vhost admin is no longer restricted to that subset of directives.

This means that by implementing the above configuration the virtual host administrator is granted more privileges regarding the configuration of the virtual host. This also means that a potential attacker, that would exploit a vulnerability of the web application, would be granted the same privileges once he got write access to that htaccess file.

So, although this trick may seem like a good idea at first, it is in fact a rather bad idea and should never be used in production, unless you trust the virtual host administrator and the web application. I do not intend to use such a configuration and I do not recommend it. There are by far better ways to speed up Apache.

Your comments and suggestions are welcome.

Speed up Apache by including htaccess files into httpd.conf, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

The new amateuristic release strategy of Firefox

George Notaras — Wed, 28 Sep 2011 07:05:26 +0000

I have been using Firefox since it was called Phoenix (version 0.5). I’ve witnessed all the effort that has been put into making this web browser a success. It is still the only web browser I can fully trust. Suddenly, earlier this year, the Mozilla Foundation decided to change the release strategy of the project for obvious marketing reasons and release several major versions within a short period of time. It was inevitable that such a change of release cycles would introduce numerous incompatibility issues with the available extensions. Such problems should have been solved before switching release strategies.

Today I happened to browse the tech section of Digg and stumbled upon this news item about the release of Firefox 7. Some of the comments pretty much summarize my feelings about the new release strategy:

- Wtf I just installed 6….
- I just installed 5.
- Once the version number is up to 50 in a short amount of time, it will become a joke, and future releases will be ignored.
- Firefox is killing themselves is what they’re doing. People use Firefox for the plugins, every new version installation kills all plugins. After I install this, there’s technically no reason for me to use Firefox over Chrome anymore. Why doesn’t Mozilla understand this???
- Pro tip: People aren’t switching from Firefox to Chrome because it’s got a “better” version number, guys.

I would add that it is not necessary to go through all the numbers from 5 to 14 to catch up with Chrome in terms of major version numbers. These could be just skipped and go straight to 14!

PS: The Firefox extension of a software I had paid for had stopped working since the FF3 -> FF4 upgrade. A workaround was released by the company for FF4, but as soon as FF5 came out it stopped working again. I’ll be straight. I’d rather use Internet Explorer or Chrome or Opera instead of asking the company for a workaround every time the Mozilla folks roll out a new major release of Firefox.

The new amateuristic release strategy of Firefox, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

WordPress is getting better

George Notaras — Tue, 27 Sep 2011 23:48:18 +0000

The first time I used WordPress back in September 2005 I considered it to be the content publishing platform of choice as far as a personal or business website was concerned. It was easy to set up and publish content and, also, easy to customize, even with ugly hacks. Today I still consider WordPress to be the overall best choice, despite the fact it still does not excel in any particular sector. Although I am not a pro, I have enough experience to say it’s the engine with the most acceptable trade-off between ease of use, security, features, ease of customization and being a solid base for development upon it. It is also one of those open-source projects that can create business opportunities for software engineers, system administrators, web designers, internet advertisers and marketers. The huge and active community of users and developers have boosted this project over the years. It proves that, if an open-source project is surrounded by a big active community and has good marketing (like WordPress had all these years) it can fly and create business opportunities in many sectors. During the last days I spent much time trying some of the features that have been implemented in the newer releases of WordPress and also various plugins. I must admit that today, by using WordPress, it is just a matter of some hours to have a high performance, good looking and feature rich small web site from scratch with minimal cost.

WordPress is getting better, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

How to configure mod_gnutls to use the RC4 cipher to mitigate the SSL/TLS vulnerability

George Notaras — Tue, 27 Sep 2011 20:40:45 +0000

It’s been a while since the details of an SSL/TLS vulnerability have been released to the public. Since then, security experts have worked on the issue and have released a whitepaper describing how to mitigate the attack, known as BEAST (Browser Exploit Against SSL/TLS).

From the security researchers’ article:

The problem lies in the way that block ciphers are used in SSL/TLS. Block ciphers are generally operated in one of several modes that define how encrypted blocks are manipulated to ensure complete confidentiality. Cipher Block Chaining, or CBC mode, is used in SSL for all block ciphers, including AES and Triple-DES. The BEAST attack relies on a weakness in the way CBC mode is used in SSL and TLS. Non-CBC cipher suites, such as those using the RC4 stream encryption algorithm, are not vulnerable.

There have been several suggested mitigations that can be put into play from the perspective of the client, such as reorganizing the way the data is sent in the encrypted stream. Servers can protect themselves by requiring a non-CBC cipher suite. One such cipher suite is rc4-sha, which is widely supported by clients and servers.

Researchers have concluded that the RC4 (Alleged RC4) based cipher suites are not vulnerable to the BEAST attack, while CBC (Cipher Block Chaining mode) based cipher suites are. This involves both the TLS 1.0 and the SSL 3.0 protocols. On the contrary, TLS 1.1 and 1.2 have not been found to be vulnerable, but their use is very limited since they haven’t been adopted by the majority of HTTP clients and servers yet.

So, the use of RC4 based ciphers is all that is left for the moment. The security experts have released a list of cipher suites that is suitable for use in the configuration of the mod_ssl module for httpd:

SSLHonorCipherOrder on
SSLCipherSuite !aNULL:!eNULL:!EXPORT:!DSS:!DES:RC4-SHA:RC4-MD5:ALL

They have also released a one-liner list of ciphers suitable for use in the relevant fields of the Local Group Policy Editor in Windows Server boxes.

However, there is no info about configuring the mod_gnutls module for apache to use RC4 based ciphers, so, as a dedicated user of mod_gnutls, I decided to release this tip. All you have to do is set the preferred ciphers in the GnuTLSPriorities directive. In this example we use the TLS 1.0 protocol:

GnuTLSPriorities NONE:+VERS-TLS1.0:+ARCFOUR-128:+RSA:+SHA1:+COMP-NULL

Visiting a secure web site that has been configured using any of the methods described above and by checking the information of the secure connection to that website, you should see the following message:

Firefox message about using RC4 encryption cipher

This means that everything is working correctly.

As always, comments and suggestions are welcome and appreciated.

How to configure mod_gnutls to use the RC4 cipher to mitigate the SSL/TLS vulnerability, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

Mozilla Thunderbird speed up

George Notaras — Fri, 09 Sep 2011 12:25:13 +0000

Mozilla Thunderbird is of those pieces of software I could say I am a fan of, but since I upgraded from TB3 to TB5 and recently to TB6, I’ve been experiencing various problems with the application’s overall speed and responsiveness. Using Thunderbird almost felt as if it was reading its data from the internet. Working with it had become an unpleasant experience, until I found some tips about how to make it more responsive. It seems that versions 5 and 6 try to use hardware acceleration to render the application’s user interface and, apparently, this does not work very well with my hardware. Anyway, here is what you have to do in order to restore Thunderbird 6 responsiveness to that of version 3.

Open TB’s Config Editor (tools/options/advanced/general-tab/config-editor-button). Search for the following settings and double-click on them to set them to TRUE.

gfx.direct2d.disabled
layers.acceleration.disabled

Also, open the Add-on Manager (tools/add-ons/plugins) and disable all plugins that do not need to be enabled in your email client. Note that the plugins are a different thing than the extensions. I disabled them all in my TB.

Finally, restart Thunderbird.

This has worked for me. Thunderbird 6 now feels as responsive as TB3 was.

Mozilla Thunderbird speed up, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

PHP syntax error caused 48-hour web site downtime

George Notaras — Tue, 14 Jun 2011 11:50:50 +0000

Today I realized my web site had been serving an empty HTML document for the last 2 days on every HTTP request no matter what the path was. When I initially noticed the issue, I was a bit worried, but, after taking a closer look at the Apache error log, I found out about a PHP syntax error causing the issue. A couple of days ago I had edited a WordPress plugin on my live web site and, apparently, I made a typo which led to a syntax error and an empty document being served on every request. But, I recall I had checked the website after the modification of the plugin but I hadn’t noticed any issues! Actually, this happened because I had forgot to clear the cache, so when I checked the site after the modification of the plugin, it seemed OK. My modification didn’t change the visual representation of the web site, so, having forgot to turn off caching, there was no way for me to find out about the typo. Lesson learned: never modify the code of a live web site, but, if you have to do it, always turn-off caching before doing so.

PHP syntax error caused 48-hour web site downtime, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

Why free should not always mean cost-free

George Notaras — Sat, 14 May 2011 06:11:15 +0000

More and more I realize that there is a misconception about free software. Many people tend to believe that free software actually means software that should not cost any money. They somehow find natural and fair the fact that some people may work voluntarily in order to produce software, which the rest can use to make money without having any legal obligation to contribute either money or effort back upstream.

As I see it, free software should be free from cost for all to use and build upon, BUT using or building upon free software to make a profit should not be cost-free. That’s a straightforward and very fair model. Also, it seems to be the only realistic concept that could drive money back to those who invested their time and effort producing free software. I know that currently there is no free software license that makes a distinction between commercial and non-commercial use and thus be the solid ground for such a software production ecosystem. But, who knows… maybe we see one in the near future. Such a software license would make a difference in the way we perceive the “doing business with free software” concept that people talk about these days.

For content and media, there are the Creative Commons licenses, some of which make it possible for creators to provide their work for free, while at the same time they still reserve the right to selectively make their work available for commercial purposes under different terms. That’s the beauty of those licenses. They are made to solve real problems and that’s why I highly respect them.

Why free should not always mean cost-free, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

Running supervisor 3 on CentOS 5

George Notaras — Thu, 12 May 2011 04:56:52 +0000

It’s been a long time since the last time I checked the available software for managing long running processes. Software in this particular area has evolved and, after some research and testing on a virtual machine, I tried to install supervisord in a CentOS 5.6 box. Unfortunately, no RPM package exists for the latest 3.X version, so I decided to go through the procedure to rebuild the supervisor RPM from the Fedora development tree, since v3.X has some really cool features I cannot do without.

If you haven’t built an RPM package before, you will need to go through a simple procedure in order to prepare an RPM building environment. It is highly recommended that you build your packages in a separate box, dedicated to this kind of work, and also use a typical user and not root for building. So, let’s get the source RPM of supervisord from a Fedora Rawhide mirror:

wget ftp://ftp.cc.uoc.gr/mirrors/linux/fedora/linux/development/rawhide/source/SRPMS/supervisor-3.0-0.4.a10.fc16.src.rpm

The simplest way to build an RPM for our CentOS release is to use the --rebuild option of rpmbuild:

rpmbuild --rebuild supervisor-3.0-0.4.a10.fc16.src.rpm

Wait a few seconds for it to finish and then your binary RPM package will be in ~//RPMS/....

To satisfy dependencies, you will also need the package python-meld3. So, download and rebuild it:

wget ftp://ftp.cc.uoc.gr/mirrors/linux/fedora/linux/development/rawhide/source/SRPMS/python-meld3-0.6.7-4.fc16.src.rpm
rpmbuild --rebuild python-meld3-0.6.7-4.fc16.src.rpm

Having built RPM packages for supervisor and python-meld3, you can now transfer them to a testing box and install them:

yum localinstall /path/to/supervisor.rpm /path/to/python-meld3
yum install python-elementtree

We also installed elementtree as this is a dependency missing from the supervisor spec file (note to self: file a bug report).

Finally, try to start supervisord:

/etc/init.d/supervisord start

Surprisingly, it complains about the missing elementtree!

Starting supervisord: Traceback (most recent call last):
  File "/usr/bin/supervisord", line 5, in ?
    from pkg_resources import load_entry_point
  File "/usr/lib/python2.4/site-packages/pkg_resources.py", line 2479, in ?
    working_set.require(__requires__)
  File "/usr/lib/python2.4/site-packages/pkg_resources.py", line 585, in require
    needed = self.resolve(parse_requirements(requirements))
  File "/usr/lib/python2.4/site-packages/pkg_resources.py", line 483, in resolve
    raise DistributionNotFound(req)  # XXX put more info here
pkg_resources.DistributionNotFound: elementtree

Checking the requirements file at: /usr/lib/python2.4/site-packages/supervisor-3.0a10-py2.4.egg-info/requires.txt there are no special version requirements:

meld3 >= 0.6.5
elementtree
[iterparse]
cElementTree >= 1.0.2

After some investigation on the supervisor-users mailing list, I found a message that indicated that setuptools.setup() should be used instead of distutils.core.setup() in the setup.py script.

So, the dependency resolution depends on the way the package has been installed! I didn’t even bother to patch setup.py… Knowing that the dependencies are correctly installed, I commented out the elementtree line and also the meld3 line as this caused the same error.

So, my /usr/lib/python2.4/site-packages/supervisor-3.0a10-py2.4.egg-info/requires.txt file looks like this:

#meld3 >= 0.6.5
#elementtree
[iterparse]
cElementTree >= 1.0.2

Now supervisor starts without errors:

# /etc/init.d/supervisord start
Starting supervisord:                                      [  OK  ]
# cat /var/log/supervisor/supervisord.log
2011-05-12 02:56:08,221 CRIT Supervisor running as root (no user in config file)
2011-05-12 02:56:08,267 INFO RPC interface 'supervisor' initialized
2011-05-12 02:56:08,267 CRIT Server 'unix_http_server' running without any HTTP authentication checking
2011-05-12 02:56:08,271 INFO daemonizing the supervisord process
2011-05-12 02:56:08,272 INFO supervisord started with pid 21337

This is what it takes to run supervisord 3 in CentOS 5 or RHEL 5. If you have any comments and suggestions, please let me know in the comments below.

Running supervisor 3 on CentOS 5, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

ntfs-3g and ntfsprogs projects merge

George Notaras — Fri, 15 Apr 2011 14:35:41 +0000

The fact that the developers of two projects with common goals decided to get along together is news in the Free Software world. What we usually hear are the announcements of new forks. I was very glad to read that the developers of two projects, ntfs-3g and ntfsprogs, which are open source tools that can be used to access and maintain the NTFS filesystem, decided to combine their efforts and made their first merged release. The merge has many benefits: no duplicate effort, easier code maintenance, more focused and coordinated effort and probably the most important one, common and more confident user base. I hope more projects follow their example.

ntfs-3g and ntfsprogs projects merge, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

The Read-It-Later extension

George Notaras — Sat, 02 Apr 2011 10:46:13 +0000

I just discovered the Read-It-Later addon for the Firefox browser. This is one of the most fantastic plugins I’ve seen in a while. From what I see, there have been about 4 million downloads already. This means I am too late, but as they say “better late than never“! This extension makes it possible to maintain a queue of unread content locally or remotely. It is also possible to save the text locally and read it at a later time even if you are offline. Really cool.

Here is a list of the features:

Save pages to a reading list to read when you have time.

Offline reading mode lets you read the items you’ve saved for later on the plane, train, or anywhere without an internet connection.

Sync your list to all of your computers, at work or home.

Sync your list to Read It Later apps for iPhone, iPod, iPad, Android and more.

After reading, bookmark pages on your preferred bookmarking service or share them with friends.

Click to Save Mode lets you quickly batch a reading list just by clicking on interesting links.

Text view strips away images, ads, and layout from articles and presents them in an easy to consume way.

Until today I have been keeping content that I wished to read at a later time in the browser’s bookmark system or I left yet another tab open or stored the URL in a text file. This plugin seems that it will provide a decent solution and eliminate the trouble. I haven’t used the remote service yet and I am not sure if I will ever do. The local “read queue” works really well.

The Read-It-Later extension, unless otherwise expressly stated, is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Unported License. Terms and conditions beyond the scope of this license may be available at www.g-loaded.eu.

G-Loaded Journal

Speed up Apache by including htaccess files into httpd.conf

Related Articles

The new amateuristic release strategy of Firefox

Related Articles

WordPress is getting better

Related Articles

How to configure mod_gnutls to use the RC4 cipher to mitigate the SSL/TLS vulnerability

Related Articles

Mozilla Thunderbird speed up

Related Articles

PHP syntax error caused 48-hour web site downtime

Related Articles

Why free should not always mean cost-free

Related Articles

Running supervisor 3 on CentOS 5

Related Articles

ntfs-3g and ntfsprogs projects merge

Related Articles

The Read-It-Later extension

Related Articles