Apache2 on Michael’s Domain

Apache forward proxy

Fri, 31 Jul 2020 00:00:00 +0000

Anyway: What is a forward proxy (and what is a reverse proxy for that matter)? If the proxy is a forward proxy, the server thinks the proxy is the client. If the proxy is a reverse proxy, the client thinks the proxy is the server.

1000 times too slow

Thu, 01 Dec 2016 00:00:00 +0000

Helsinki University has outsourced parts of its IT infrastructure to Microsoft. Even if outsourcing is cheaper in the short term than generating equivalent services locally, the net effect is likely negative due to the lost jobs, know how and independence. It doesn’t need a conspiracy to explain this self-destructive behavior, just bad decision criteria, which do not include long term and externalized costs.In its push to upgrade to newer Windows versions, Microsoft ended extended support for Windows XP on April 8, 2014 and the university obeyed by denying network access to XP machines. The argument was that XP was becoming a security risk. At the same time, Windows XP accounted still for about 20% of all Windows installations on this planet ( https://www.statista.com/statistics/218089/global-market-share-of-windows-7/ ). Even in October 2015, well above 100 Million computers did still run Windows XP ( https://en.wikipedia.org/wiki/Usage_share_of_operating_systems and https://www.statista.com/statistics/218089/global-market-share-of-windows-7/ ) without any catastrophic consequences.The ban of Windows XP was a problem, since four of our devices, that we need for research, are still running Windows XP. And there is no way to upgrade the OS without upgrading the equipment (which would cost thousands or tens of thousands of Euros and therefore is mostly impossible in the present tight financial situation of the university). And of course, the software that is needed to operate the devices is not compatible with Windows 7. As a consequence, we can neither remotely operate this machinery nor do automated backups. Even taking the data for analysis to another computer requires the Adidas network .I had contacted IT support well before the extended support of Windows XP ended and asked them to find a solution. Apparently there were different possible solutions and IT support did start to implement them, but because of personnel fluctuations, the project had to be “restarted” several times and different support professionals had different opinions on how to solve this problem. With the big “fire and hire” action at the university, the whole project disintegrated again. This autumn I again discussed our needs with the IT staff, but did not receive any concrete help so far.This Tuesday, I finally wanted to know how difficult it really is to connect a Windows XP machine to the network in a way that would not compromise security, but enable file distribution, backup and remote control. I went to the Institute’s garbage place where broken electronic equipment is gathered and took three old 10/100 NICs and a few ethernet cables. One card and one cable were still functioning and I dropped the NIC into a Ubuntu 16.04 computer and connected it via ethernet cable to one of the XP machines.After manually assigning an IP to the NIC and installing samba onto the Ubuntu machine, I was able to mount the samba share as a drive on the Windows XP machine. Then I just made the samba share available via a web page. All this took about one hour. Not being an IT professional, I spend maybe an additional three hours researching how to do it (samba setup, apache setup, configuration of a secondary NIC, which is not automatic on Ubuntu). This setup fulfills all of our requirements, didn’t cost anything and was implemented within one day.A write-up of the technical details will follow once I get around documenting what I did. Agility is perhaps what is mostly missing when I look at many of our university’s IT projects. Notably I think of switching to Drupal as content management system for the university’s web pages. Sadly, our faculty is still using Dreamweaver to create its web presence and as a consequence many web pages are never updated.

Let's encrypt duplicated my log files

Wed, 19 Oct 2016 00:00:00 +0000

I have not been keeping log files for my web server until the beginning of 2016, when I needed to trace access to certain files (I started to use awstats , mostly because I was familiar with it since I had used it years ago when my site was still running on a Red Hat server). In March 2016 I luckily started to use Let’s Encrypt . I had used another “free” service before, which got recently into big trouble as they apparently had not control over their own security. When I looked at my Apache server’s log files (on Ubuntu 14.04), I noticed that apache did double logging (to both the individual vhost’s log file and a common log file). I realized that Let’s Encrypt specifies into every vhost’s configuration file an Import directive which sources /etc/letsencrypt/options-ssl-apache.conf. And this file in turn specifies common access.log and error.log files for all vhosts in the /var/log/apache2/ directory. I uncommented the five lines associated with this logging and the duplicate logging stopped (originally, I had thought, that this letsencrypt directive was only used for the initial Let’s Encrypt setup for the cert generation).

Configuring and starting Apache2 via Yast2

Wed, 04 Apr 2007 00:00:00 +0000

Yast is of of course as unfriendly when it comes to error messages as any other Linux program. I tried to start up Apache2 using Yast2 and there were only 3 fields in the configuration wizard to fill in: server name, administrator e-mail and listening port. I filled in as server name “Suse Linux”. When Yast2 wanted to do the configuration, the error message was: Error: cannot adjust apache2 service Cool. Had I started apache manually (sudo /etc/init.d/apache2 start), I had noticed the following line among the error messages: Starting httpd2 (prefork) Syntax error on line 11 of /etc/apache2/sysconfig.d/global.conf: ServerName takes one argument, The hostname and port of the server Obviously “Suse Linux” was taken as two arguments. So I went back to the graphical interface and changed the value to “Suse_Linux” and this time it worked.

Getting the web interface for BackupPC working with Apache2 under Suse 9

Fri, 20 Feb 2004 00:00:00 +0000

BackupPC has been working without me noticing it. Now I want set up the web interface.First I downloaded apach2-mod_perl and perl-Tie-IxHash (there are Suse rpms) and installed them.Directories/files that I duplicated (this is only necessary if you need to run two instances of the Apache server):cp -a /etc/apache2 /etc/apache2backuppcchmod -R 775 /var/log/apache2backuppc/cp -a /var/log/apache2 /var/log/apache2backuppcchown -R backuppc:users /var/log/apache2backuppc/ cp /var/run/httpd2.pid /var/run/httpd2backuppc.pidchmod 644 /var/run/httpd2backuppc2.pidchown backuppc:users /var/run/httpd2backuppc.pid cp -a /etc/sysconfig/apache2 /etc/sysconfig/apache2backuppcchmod 644 /etc/sysconfig/apach2backuppcchown backuppc:users /etc/sysconfig/apache2backuppccp /etc/init.d/apache2 /etc/apache2backuppcThen I edited the following files:/etc/sysconfig/apache2backuppc Change APACHE_ACCESS_LOG to a new location!!!!/etc/apache2backuppc/listen.conf Change from 80 to 8080/etc/apache2backuppc/uid.conf Change wwwrun/www to backuppc/users/etc/apache2backuppc/httpd.conf1. Change all appearances of the apache2 directories into apache2backuppc2. Change to AllowOverride Indexes AuthConfigThe following command starts up Apache2 as user backuppc and listening to the port 8080: /usr/sbin/httpd2-prefork -f /etc/apache2backuppc/httpd.conf For some reason it doesn’t yet start up automatically at system boot.For the web interface running in mod_perl mode I switch off the cgi script to be executed as user backuppc:chmod u-s /srv/www/cgi-bin/BackupPC_Admin Anyway I don’t know whether apache2 supports mod_perl, because I don’t get the mod_pel listed when I query:/usr/sbin/httpd2-prefork -l But this is maybe due to the fact that I run apache2 and not apache???I insert the following into /etc/apach2backuppc/mod_info.conf:LoadModule perl_module /usr/lib/apache2/mod_perl.so PerlModule Apache2 SetHandler perl-script PerlResponseHandler ModPerl::Registry PerlOptions +ParseHeaders Options +ExecCGI Order deny,allow Deny from all Allow from localhost AuthName "Backup Admin" AuthType Basic AuthUserFile /etc/apache2/conf.d/passwd Require valid-user Now I have to create a .htaccess file in the cgi-bin directory with the following contect:AuthGroupFile /etc/apache2/conf.d/group AuthUserFile /etc/apache2/conf.d/passwd AuthType basic AuthName "access" require valid-user Then I have to create the password file (use the -a flag to add a user!): /usr/sbin/htpasswd2 -c /etc/apache2/conf.d/passwd backuppc >New password: ******* >Re-type new password: ******* >Adding password for user backuppc Then I restarted. It didn’t work. So I changed to permissions of the cgi script:chmod 750 /srv/www/cgi-bin/BackupPC_Adminls -al /srv/www/cgi-bin/BackupPC_Admin should give as result rwxr-x—Now it works! At least I get the Administration web page loaded into my browser. But without the need to authenticate myself. And I cannot administer anything.So I added to /etc/apache2backuppc/default-server.conf:/srv/www/cgi-bin/BackupPC_Admin Setenv REMOTE_USER backuppc and I changed: AllowOverride None into: AllowOverride Indexes AuthConfig And I change as well: AllowOverride None into: AllowOverride Indexes AuthConfig I don’t know what of the above is really necessary. But now authentication is working and when I type into the “Host or User name” field localhost, the script at leat tries to access the correct pages, but fails with the error:Only privileged users can view information about host localhost. The reason appears to be that I have set up wrongly the hosts configuration file for backuppc (in my case located at /mnt/backup/conf/hosts. You have to give the correct users…We use an external hard drive to backup. Because we don’t want to have it switched on all the time we have to mount it every time we want to do a backup. The regular mount command:sudo mount /dev/sdc1 /media/sdc1 is sufficient. However the backup directory’s owner on sdc1 needs to be backuppc. We also have to restart the backuppc daemon, because if it starts up during boot (when the external drive is not connected), it cannot find the path to the backup directory:su /etc/init.d/suse-backuppc stop /etc/init.d/suse-backuppc start /etc/init.d/suse-backuppc reload I think the reload might not be necessary. Maybe one doesn’t have to restart at all and only reloading does the job…Then you can check whether backuppc works correctly. You have to be user backuppc to be able to so: /usr/local/backuppc/bin/BackupPC_serverMesg status info /usr/local/backuppc/bin/BackupPC_serverMesg status jobs /usr/local/backuppc/bin/BackupPC_serverMesg status hosts