Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 1641
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: mktime() [function.mktime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 5531
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: mktime() [function.mktime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 5531
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: mktime() [function.mktime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 5531
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: mktime() [function.mktime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 5531
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: mktime() [function.mktime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 5531
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/system/lib-story.php on line 324
Warning: mktime() [function.mktime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 5531
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/system/lib-story.php on line 324
Warning: mktime() [function.mktime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 5531
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/system/lib-story.php on line 324
Warning: mktime() [function.mktime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 5531
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/system/lib-story.php on line 324
Warning: mktime() [function.mktime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 5531
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 4396
Warning: strftime() [function.strftime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/system/lib-story.php on line 324
Warning: mktime() [function.mktime]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 5531
Warning: date() [function.date]: It is not safe to rely on the system's timezone settings. You are *required* to use the date.timezone setting or the date_default_timezone_set() function. In case you used any of those methods and you are still getting this warning, you most likely misspelled the timezone identifier. We selected 'America/Chicago' for 'CDT/-5.0/DST' instead in /usr/local/www/nat.guyton.net/geeklog-1.4.0sr2/public_html/lib-common.php on line 1143 Nat's Geeklog - Computer Tech Stuff
This started out as a project to take Apache NTLM authentication and offload it to cookie authentication, because the NTLM auth was flaky and would sometimes croak on random pages, given that NTLM authentication was being done for each keepalive. Upon completion of this project, it is determined that ANY authentication process, be it NTLM, Kerberos, RSA SecurID, or other method that can be performed against apache can be used, and offload credentials to cookie authentication. Without further ado, let's look at how it works:
User visits Application Webserver
Application Webserver receives no authentication cookie, redirects user to Authentication Webserver with Application Webservers called URL as the query string.
The user visits the Authentication Webserver and authenticates by whatever means (NTLM, Kerberos, RSA, Basic Auth, other)
Authentication Webserver stores user credentials and the original URL on the Application Server that the user was trying to reach in a randomly named file, and directs Web Client back to the Application Webserver with information about how to get the random data file.
Web Client sends credentials data file info to the Application Webserver
Application Webserver fetches credentials data file from Authentication Webserver, after which the Authentication Webserver deletes credentials file. (Note that credentials are not entrusted to the client and pass from the authentication server to the application server directly.) Application Server generates cookie value associates userid with it, saving for 12 hours.
Application Webserver sends Web Client the authentication cookie lasting 12 hours along with a redirect to the original URL the client called.
Client visits original URL with authentication cookie, server uses the value to look up the userid and populates the REMOTE_USER environment variable, and the user is able to proceed.
After the cookie expires, whatever URL the Web Client hits next will trigger this whole process again
Wednesday, July 08 2009 @ 11:14 AM CDT
Contributed by: nat
Views: 290
Apache 2.2's load balancer is pretty neat. However, to get persistence to work properly, you have to be careful. Here we are setting the balancer manager to watch a client cookie called BALANCEID, and each member has a particular route string tied to it that is set in the cookie. It's important to note that the cookie format must be: something.routestring, ie, nat.server1. If it is justserver1, it will not work.
Now there's the issue of the client cookie being set. What if you are load balancing a third party app or webserver and can't easily get the cookie set on the client? No problem! While it didn't work in 2.2.3 (in particular, the BALANCER_ROUTE_CHANGED var being set), when I tried in 2.2.11, I was able to set the cookie myself based on which balancer member was selected:
# Set session cookie if BALANCER_ROUTE_CHANGED, containing BALANCER_WORKER_ROUTE env variable, which is set to the route above
# Note that cookie value should be a session id, followed by a period, followed by the route.
# Since session id cookie usually not advised to be mutable, best create own cookie with anything you want
# for the session part, just make sure to have a period and route part last
### Used for setting cookie
LoadModule headers_module modules/mod_headers.so
Header add Set-Cookie "BALANCEID=balancer.%{BALANCER_WORKER_ROUTE}e; path=/;" env=BALANCER_ROUTE_CHANGED
# Just give some debug info in the header, don't use once you have it working
Header add X-Var "BALANCER_ROUTE_CHANGED=%{BALANCER_ROUTE_CHANGED}e" env=BALANCER_ROUTE_CHANGED
Header add X-Var "BALANCER_WORKER_ROUTE=%{BALANCER_WORKER_ROUTE}e" env=BALANCER_WORKER_ROUTE
Header add X-Var "BALANCER_SESSION_ROUTE=%{BALANCER_SESSION_ROUTE}e" env=BALANCER_SESSION_ROUTE
Presto! Session persistence, all handled at the reverse proxy load balancer level.
Normally most webservers these days that hold sensitive information allow SSL ciphers of 128 bit or higher. However, it would be nice to redirect older browsers to a different page, suggesting that they upgrade their browser to one supporting decent encryption.
This can be done in Apache with mod_rewrite and enabling lower strength ciphers. Read on to see example configuration code...
Apache's mod_rewrite can be used to do time-sensitive redirects... handy if you have to make a scheduled change at an inconvenient time. But even better, what if you need to get to the original site? This example also includes a url /backdoor that sets a 15 min cookie, redirects to the main page, and an exclusion to not redirect anyone who has that cookie set. Cool stuff.
RewriteEngine On
# Start redirecting after this datetime
RewriteCond %{TIME_YEAR}%{TIME_MON}%{TIME_DAY}%{TIME_HOUR}%{TIME_MIN} >200904040900
# Don't redirect certain paths
RewriteCond %{REQUEST_URI} !^/favicon.ico
RewriteCond %{REQUEST_URI} !^/webservices
RewriteCond %{REQUEST_URI} !^/backdoor
# Don't redirect if backdoor cookie is active
RewriteCond %{HTTP_COOKIE} !backdoor
# Do the rewrite
RewriteRule .* http://mynewhostname/ [R,L]
# Allow back door access to old site (this site) - hit /backdoor and they get a cookie for
# 15 mins such that they won't be redirected while it is active.
RewriteRule ^/backdoor http://myoldhostname/ [CO=backdoor:yes:myoldhostname:15:/]
One of my passions is automated monitoring and correction of network and server problems. I have the most experience with SiteScope (primarily a commercial website monitoring tool that has branched out to include protocols, application stacks, and whatever custom stuf you want) and Nagios, which is free and open source, and very very configurable.
I would LOVE to form a company implementing these or similar monitoring tools. I've done this a lot at work, and a little bit on the side for a few friends and their companies.
I've been looking around, and it seems that in addition to Nagios, two other contenders are Zenoss and Cacti. I've heard good things about Zenoss, specifically how it is easier to set up than Nagios. I think I may check it out, though I am a fan of Nagios's flexibility.
We had a requirement from a client whose windows website we were migrating to UNIX that the new site be able to handle mixed case tickers, ie, /pwc, /Pwc, /PWC, /pwC, etc. Using mod_rewrite, it was doable:
# Take any mixed or uppercase ticker and set to lower
RewriteMap lowercase int:tolower
RewriteRule ^(/[A-Z]...?)$ ${lowercase:$1} [R,L]
RewriteRule ^(/.[A-Z]..?)$ ${lowercase:$1} [R,L]
RewriteRule ^(/..[A-Z].?)$ ${lowercase:$1} [R,L]
RewriteRule ^(/...[A-Z])$ ${lowercase:$1} [R,L]
This case conversion will be true for any 3 or 4 char URI with an uppercase letter. (It would probably be better to replace the "." above with [a-zA-Z], as it's likely intended for only chars to replace. Above will transform /a/BB as well, which is probably not desired.)
Apache 2.0's rewrite module can do some powerful things. Here is how to deliver different content based on if a client IP Address begins with 10. or not:
RewriteEngine On
RewriteCond %{REMOTE_ADDR} !^10.*
RewriteRule ^/test/(.*)$ /public/test/$1
Internal IP addresses go to /test, but people from non 10. IP addresses will read from /public/test which would still look like /test to them. Note that you can visibly send them to /public/test by adding [R] to the end of the RewriteRule line.
Another example is making public IP addresses authenticate while allowing internal IP addresses in without having to type in a password:
Both internal and external users navigate to /test, but only external ones have to log in. Log files only record /test as well.
Note that for this example I had to softlink "auth" to its own parent directory (see below) - an Alias did not work. I think this is because mod_rewrite needs an actual file or directory to point to.
www$ ls -l
total 16
lrwxrwxrwx 1 root other 1 Oct 19 15:10 auth -> ./
-rw-r--r-- 1 root other 36 Feb 23 2005 index.html
drwxr-xr-x 2 root other 512 Oct 19 14:47 test/
Lately I've been playing Diablo 2 a lot. It came out in the year 2000, and is still selling on shelves today. Nicely enough, Blizzard has released patches over time that have added items and special game events for really high level characters, not to mention changing the dynamics of skill points. OK, OK, I'm geeking out here.
The main reason I started playing was because I did not want to buy a new laptop to play some of the newer games. One day I'll break down, but it's not necessary just yet... At any rate, it's a lot of fun playing online!
Following along in my mod_perl2 notes, I wanted to document how to get CGI::Ajax working with mod_perl2. I hit a couple of snags along the way that are worth noting. First, the generated javascript for my functions was calling httpd? + vars, rather than my URI /modperl_handler/ajax? + vars. This was frustrating, but I determined that it was grabbing httpd from $0, so I changed it locally and the script worked after that. The second snag I hit was because I was instantiating my CGI module globally instead of locally, and I would get segfaults now and then. Instantiating it inside the handler was the right way to go. Here is a working example:
package AjaxTest;
use CGI;
use CGI::Ajax;
use Apache2::RequestRec();
use Apache2::RequestIO();
use Apache2::Const -compile => qw(OK);
sub handler {
my ($r) = @_;
my $cgi = new CGI; # had this outside the handler and was getting segfaults
# Have to redefine $0 for CGI::Ajax because it's used to call further URLs from
# javascript ajax functions. (otherwise it did "httpd?"...)
local $0 = $ENV{"REQUEST_URI"};
$0 =~ s/?.*//;
# Start Ajax stuff
my $pjx = new CGI::Ajax("test_ajax" => &test_ajax);
# Don't compress javascript (1 for user fcns only, 2 for all)
$pjx->JSDEBUG(1);
# Send stderr to web logs
$pjx->DEBUG(1);
print $pjx->build_html( $cgi, &base_page);
return Apache2::Const::OK;
}
sub base_page {
return "Ajax mod_perl testmod_perl 2.0.2 on apache 2.2.2 rocks! <p><div id="test">Change me</div><p>nn";
}
sub test_ajax {
my $time = time();
return "Test successful; $time<p>";
}
1;