<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	>

<channel>
	<title>Excalibur Partners, LLC</title>
	<atom:link href="http://www.excalibur-partners.com/feed" rel="self" type="application/rss+xml" />
	<link>http://www.excalibur-partners.com</link>
	<description></description>
	<pubDate>Fri, 11 Jul 2008 16:17:29 +0000</pubDate>
	<generator>http://wordpress.org/?v=2.5.1</generator>
	<language>en</language>
			<item>
		<title>Hot Adding a SCSI Device</title>
		<link>http://www.excalibur-partners.com/archives/33</link>
		<comments>http://www.excalibur-partners.com/archives/33#comments</comments>
		<pubDate>Fri, 11 Jul 2008 16:17:29 +0000</pubDate>
		<dc:creator>Admin</dc:creator>
		
		<category><![CDATA[Linux]]></category>

		<category><![CDATA[RAID]]></category>

		<guid isPermaLink="false">http://www.excalibur-partners.com/?p=33</guid>
		<description><![CDATA[When hot adding a SCSI device, such as a hard drive, you might have noticed that it doesn&#8217;t show in /dev. You can either reboot, which defeats the purpose of hot adding the device, or notify Linux to rescan the SCSI bus.
If you know the host adapter number use this command replacing 0 with the [...]]]></description>
			<content:encoded><![CDATA[<p>When hot adding a SCSI device, such as a hard drive, you might have noticed that it doesn&#8217;t show in /dev. You can either reboot, which defeats the purpose of hot adding the device, or notify Linux to rescan the SCSI bus.</p>
<p>If you know the host adapter number use this command replacing 0 with the host adapter.<br />
<code>echo "- - -" &gt; /sys/class/scsi_host/host0/scan</code></p>
<p>Otherwise rescan all the host adapters with this command.<br />
<code>for f in /sys/class/scsi_host/host*; do echo "- - -" &gt; $f/scan; done</code></p>
<p>Now your SCSI device should show up in the /dev list.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.excalibur-partners.com/archives/33/feed</wfw:commentRss>
		</item>
		<item>
		<title>Patching Postfix for mySQL and Quotas</title>
		<link>http://www.excalibur-partners.com/archives/16</link>
		<comments>http://www.excalibur-partners.com/archives/16#comments</comments>
		<pubDate>Sun, 20 Apr 2008 16:33:40 +0000</pubDate>
		<dc:creator>Admin</dc:creator>
		
		<category><![CDATA[Linux]]></category>

		<category><![CDATA[Postfix]]></category>

		<guid isPermaLink="false">http://www.excalibur-partners.com/?p=16</guid>
		<description><![CDATA[If you are hosting email for more than one domain you might want to look into virtual hosting. With virtual hosting most choose to use database vs files to store the mailbox information. Not only does this allow a more flexible configuration, but the ability to use a web interface such as Postfix Admin. Out [...]]]></description>
			<content:encoded><![CDATA[<p>If you are hosting email for more than one domain you might want to look into virtual hosting. With virtual hosting most choose to use database vs files to store the mailbox information. Not only does this allow a more flexible configuration, but the ability to use a web interface such as Postfix Admin. Out of the box Fedora Core 8 Postfix RPM does not support mySQL or quota support. However a simple recompile and install of the resulting package will get you up and running.<span id="more-16"></span></p>
<p>First we need to download the postfix SRPM<br />
<code>cd ~<br />
wget http://download.fedoraproject.org/pub/fedora/linux/releases/8/Fedora/source/SRPMS/postfix-2.4.5-2.fc8.src.rpm<br />
</code></p>
<p>Next setup the RPM build area<br />
<code>fedora-buildrpmtree</code></p>
<p>Install the SRPM into the rpmbuild directory<br />
<code>rpm -ivh postfix-2.4.5-2.fc8.src.rpm</code></p>
<p>Now download the quota patch<br />
<code>cd ~/rpmbuild/SOURCES<br />
wget http://vda.sourceforge.net/VDA/postfix-2.4.5-vda-ng.patch.gz<br />
gunzip postfix-2.4.5-vda-ng.patch.gz</code></p>
<p>Let&#8217;s enable mysql and quota support<br />
<code>cd ~/rpmbuild/SPECS<br />
vim postfix.spec<br />
Line 2:<br />
-%define MYSQL 0<br />
+%define MYSQL 1<br />
Line 82:<br />
Patch10: postfix-2.4.5-open_define.patch<br />
+Patch11: postfix-2.4.5-vda-ng.patch<br />
Line 140:<br />
%patch10 -p1 -b .open_define<br />
+%patch11 -p1 -b .vda-ng</code></p>
<p>Now we can build the modified RPM and install it<br />
<code>rpmbuild -ba postfix.spec<br />
sudo rpm -ivh ~/rpmbuild/RPMS/`uname -p`/postfix-2.4.5-2.`uname -p`.rpm</code></p>
]]></content:encoded>
			<wfw:commentRss>http://www.excalibur-partners.com/archives/16/feed</wfw:commentRss>
		</item>
		<item>
		<title>SMF and MediaWiki Bridge</title>
		<link>http://www.excalibur-partners.com/archives/26</link>
		<comments>http://www.excalibur-partners.com/archives/26#comments</comments>
		<pubDate>Tue, 12 Feb 2008 20:13:30 +0000</pubDate>
		<dc:creator>Admin</dc:creator>
		
		<category><![CDATA[Apache]]></category>

		<category><![CDATA[Linux]]></category>

		<guid isPermaLink="false">http://www.excalibur-partners.com/archives/26</guid>
		<description><![CDATA[After testing out both bridges currently available for SMF and MediaWiki I decided to write my own. Let me first go through what I liked and didn&#8217;t like about the existing bridges.
First Bridge:
http://www.mediawiki.org/wiki/Extension:SMF_Authentication
This bridge allows for auto authentication by using the smf_api.php. Due to the number of files required I did not test this bridge. [...]]]></description>
			<content:encoded><![CDATA[<p>After testing out both bridges currently available for SMF and MediaWiki I decided to write my own. Let me first go through what I liked and didn&#8217;t like about the existing bridges.<span id="more-26"></span></p>
<p><strong>First Bridge:</strong><br />
<a href="http://www.mediawiki.org/wiki/Extension:SMF_Authentication">http://www.mediawiki.org/wiki/Extension:SMF_Authentication</a></p>
<p>This bridge allows for auto authentication by using the smf_api.php. Due to the number of files required I did not test this bridge. I didn&#8217;t want to deal with the hassle when upgrading software down the road. Especially because SMF 2.0 database tables are different and I wasn&#8217;t sure if the smf_api.php would be updated.</p>
<p>From looking at the code if a user is demoted from the administrator position it does not remove him from the wiki sysop group. It is also lacking the ability to declare an SMF group that is only allowed to edit the wiki.</p>
<p><strong>Second Bridge:</strong><br />
<a href="http://www.mediawiki.org/wiki/Extension:SMF/Users_Integration">http://www.mediawiki.org/wiki/Extension:SMF/Users_Integration</a></p>
<p>This bridge does not do anything with auto authentication. It does allow you to specify a SMF group that is allowed to edit the wiki. Another plus is that it is a single file. The downside is the configuration does not use the values from SMF&#8217;s Settings.php. You have to specify the database tables and permissions. It also doesn&#8217;t set wiki sysop privileges for SMF administrators.</p>
<p>I did test this one out and found a small issue where they did not disable the change password option in the wiki. This only requires a change of true to false, which must have been an oversight. Neither of these two bridges check to make sure the users are activated and not banned before logging them in.</p>
<p><strong>My Bridge:<br />
</strong><a href="http://www.mediawiki.org/wiki/Extension:SMF_Auth_Integration">http://www.mediawiki.org/wiki/Extension:SMF_Auth_Integration</a><strong></strong></p>
<p>The SMF and MediaWiki integration I built only requires one file placed in the wiki extensions directory. To get started you only need to configure the relative path to your SMF forum and the forum&#8217;s version. The version will either be 1.1 or 2.0 (which only applies to charter members as 2.0 has not been released). In the default configuration the wiki login is separate from the forum. It will assign and remove sysop privileges to SMF administrators and allow you to lock down editing to an SMF group. You can even supply additional groups to be granted wiki sysop privileges.</p>
<p>For the auto authentication I have decided not to use the smf_api.php file for the above reasons. When you click login / logout the wiki redirects you to the SMF page and then back to the wiki. A couple of gotchas are that you must be using SMF database sessions (default setting). You also need to configure SMF to make sure local storage of cookies are disabled. You might not need to do this if your wiki is inside your forum folder.</p>
<p>There are two known issues. The first involves the wiki&#8217;s limitation with user names containing an underscore. The wiki converts underscores to spaces. For example john_doe would become John doe. The workaround I implemented was to look for both the user name with spaces and underscores. The first registered SMF user name is used. If you happen to have a conflict you&#8217;ll need to change the later registered user name.</p>
<p>The second is when wgSMFLogin is disabled. If you register a new account from the wiki you will not be redirected back to the wiki as SMF does not have support for this in their code.</p>
<p>You can download the bridge from <a href="http://wgnrs.dynalias.com/smf/Auth_SMF.php">http://wgnrs.dynalias.com/smf/Auth_SMF.php</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.excalibur-partners.com/archives/26/feed</wfw:commentRss>
		</item>
		<item>
		<title>Patching Apache&#8217;s Suexec Module Improved</title>
		<link>http://www.excalibur-partners.com/archives/22</link>
		<comments>http://www.excalibur-partners.com/archives/22#comments</comments>
		<pubDate>Sat, 05 Jan 2008 22:18:52 +0000</pubDate>
		<dc:creator>Admin</dc:creator>
		
		<category><![CDATA[Apache]]></category>

		<category><![CDATA[Linux]]></category>

		<guid isPermaLink="false">http://www.excalibur-partners.com/archives/22</guid>
		<description><![CDATA[This tutorial improves on my last tutorial Patching Apache&#8217;s Suexec Module by adding in alternate docroots and a trusted uid/gid to check when the uid/gid mismatch. This is an added security measure over just ignoring the uid/gid check or using / as the docroot. If you haven&#8217;t read my previous tutorial the following quote should [...]]]></description>
			<content:encoded><![CDATA[<p>This tutorial improves on my last tutorial <a href="http://www.excalibur-partners.com/archives/12">Patching Apache&#8217;s Suexec Module</a> by adding in alternate docroots and a trusted uid/gid to check when the uid/gid mismatch. This is an added security measure over just ignoring the uid/gid check or using / as the docroot. If you haven&#8217;t read my previous tutorial the following quote should bring you up to speed.<span id="more-22"></span></p>
<blockquote><p>
Apache’s suexec module is useful for running CGI and SSI scripts as a defined user. However all scripts must be located under the compiled in docroot and the uid/gid of the user running the script must match the script’s uid/gid.</p>
<p>This can be a problem if you have a shared CGI app like awstats as unless you make each user a copy the uid/gid will not match. Not to mention that the docroot on Fedora is /var/www so if you want to store your virtual hosts elsewhere your out of luck. Not to worry recompiling apache isn’t as hard as you might think.</p>
<p>Since we are modifying suexec there is always the potential that the modifications may cause a security hole. <strong>Proceed at your own risk!!</strong>
</p></blockquote>
<p>The patch allow you to specify three docroots. The default /var/www, one for virtual hosts (in my case /home), and one for shared scripts (most are stored in /usr/share). It also allows for the specification of a trusted uid/gid. Basically if the uid/gid of the suexec user doesn&#8217;t match the uid/gid of the file it will check to see if it matches the trusted uid/gid. If it does the execution will continue, otherwise it will log an error. This is great for shared scripts like awstats.</p>
<p>First we need to grab the httpd SRPM from FC5 updates<br />
<code>cd ~<br />
wget http://mirrors.kernel.org/fedora/core/updates/5/SRPMS/httpd-2.2.2-1.3.src.rpm</code></p>
<p>Next we setup the RPM build area<br />
<code>fedora-buildrpmtree</code></p>
<p>Install the SRPM into the rpmbuild directory<br />
<code>rpm -ivh httpd-2.2.2-1.3.src.rpm</code></p>
<p>Grab the suexec patch<br />
<code>cd rpmbuild/SOURCES<br />
wget http://www.excalibur-partners.com/wp-content/uploads/2008/01/httpd-222-suexec.patch</code></p>
<p>Configure the docroots and trusted UID/GID<br />
<code>cd ~/rpmbuild/SPECS<br />
vim httpd.spec<br />
Line 192:<br />
 --with-suexec-docroot=%{contentdir} \<br />
+ --with-suexec-docroot-virtual=/home \<br />
+ --with-suexec-docroot-shared=/usr/share \<br />
+ --with-suexec-trust-uid=500 --with-suexec-trust-gid=500 \</p>
<p>Modify the httpd.spec to include the patch<br />
<code>vim httpd.spec<br />
Line 48:<br />
 Patch73: httpd-2.2.3-CVE-2007-3304.patch<br />
+ Patch80: httpd-2.2.2-suexec.patch<br />
Line 131:<br />
 %patch73 -p1 -b .cve3304<br />
+ %patch80 -p1 -b .suexec</code></p>
<p>Now we can build the modified RPM<br />
<code>rpmbuild -ba httpd.spec</code></p>
<p>Instead of reinstalling apache I recommend just extracting and replacing the suexec file<br />
<code>cd ~/rpmbuild<br />
rpm2cpio RPMS/`uname -p`/httpd-2.2.2-1.3.src.rpm | cpio -imVd ./usr/sbin/suexec<br />
sudo cp -p /usr/sbin/suexec /usr/sbin/suexec.orig<br />
sudo cp ./usr/sbin/suexec /usr/sbin/suexec<br />
sudo chown root:apache /usr/sbin/suexec<br />
sudo chmod 4510 /usr/sbin/suexec</code></p>
]]></content:encoded>
			<wfw:commentRss>http://www.excalibur-partners.com/archives/22/feed</wfw:commentRss>
		</item>
		<item>
		<title>Slow Browsing of Network Drives</title>
		<link>http://www.excalibur-partners.com/archives/21</link>
		<comments>http://www.excalibur-partners.com/archives/21#comments</comments>
		<pubDate>Sun, 16 Dec 2007 21:53:55 +0000</pubDate>
		<dc:creator>Admin</dc:creator>
		
		<category><![CDATA[Vista]]></category>

		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://www.excalibur-partners.com/archives/21</guid>
		<description><![CDATA[One frustrating thing I noticed after using Vista was what seemed to be a compatibility issue with Windows 2003 Server 64bit Edition. Browsing network shares and folders on the server from the Vista machine was painfully slow. It would take five plus seconds to just display a directory listing or open a text file. After [...]]]></description>
			<content:encoded><![CDATA[<p>One frustrating thing I noticed after using Vista was what seemed to be a compatibility issue with Windows 2003 Server 64bit Edition. Browsing network shares and folders on the server from the Vista machine was painfully slow. It would take five plus seconds to just display a directory listing or open a text file. After an hour or so of searching Google I found the answer.<span id="more-21"></span></p>
<p>The fix involves changing two settings from the command prompt. You need to run the command prompt as an administrator. You can do this by right-clicking and selecting run as administrator. Type in the following commands<br />
<code>netsh int tcp set global autotuninglevel=disabled<br />
netsh int tcp set global rss=disabled</code></p>
<p>You will need to restart your machine afterwards. The difference is night and day. I wonder what the reasoning was for not having Vista set like this out of the box?</p>
<p>If you are unhappy with the changes you can restore the default settings with<br />
<code>netsh int tcp set global autotuninglevel=normal<br />
netsh int tcp set global rss=enabled</code></p>
]]></content:encoded>
			<wfw:commentRss>http://www.excalibur-partners.com/archives/21/feed</wfw:commentRss>
		</item>
		<item>
		<title>Useful Mdadm Commands</title>
		<link>http://www.excalibur-partners.com/archives/19</link>
		<comments>http://www.excalibur-partners.com/archives/19#comments</comments>
		<pubDate>Sun, 16 Dec 2007 21:43:41 +0000</pubDate>
		<dc:creator>Admin</dc:creator>
		
		<category><![CDATA[Linux]]></category>

		<category><![CDATA[RAID]]></category>

		<guid isPermaLink="false">http://www.excalibur-partners.com/archives/19</guid>
		<description><![CDATA[Below is a collection of commands for mdadm that I have found useful. Use these at your own risk.
Create RAID
mdadm --create /dev/md0 --level=5 --raid-devices=4 /dev/sd[bcde]1
mkfs.ext3 /dev/md0
Remove disk from RAID
mdadm --fail /dev/md0 /dev/sda1
mdadm --remove /dev/md0 /dev/sda1
Copy the partition structure (when replacing a failed drive)
sfdisk -d /dev/sda &#124; sfdisk /dev/sdb
mdadm --zero-superblock /dev/sdb
Add a disk to a RAID [...]]]></description>
			<content:encoded><![CDATA[<p>Below is a collection of commands for mdadm that I have found useful. <strong>Use these at your own risk.</strong><span id="more-19"></span></p>
<p>Create RAID<br />
<code>mdadm --create /dev/md0 --level=5 --raid-devices=4 /dev/sd[bcde]1<br />
mkfs.ext3 /dev/md0</code></p>
<p>Remove disk from RAID<br />
<code>mdadm --fail /dev/md0 /dev/sda1<br />
mdadm --remove /dev/md0 /dev/sda1</code></p>
<p>Copy the partition structure (when replacing a failed drive)<br />
<code>sfdisk -d /dev/sda | sfdisk /dev/sdb<br />
mdadm --zero-superblock /dev/sdb</code></p>
<p>Add a disk to a RAID array (to replace a removed failed drive)<br />
<code>mdadm --add /dev/md0 /dev/sdf1</code></p>
<p>Check RAID status<br />
<code>cat /proc/mdstat<br />
mdadm --detail /dev/md0</code></p>
<p>Reassemble a group of RAID disks<br />
<code>mdadm --assemble /dev/md0 /dev/sdb1 /dev/sdc1 /dev/sdd1 /dev/sde1</code></p>
<p>Steps to emulate mdrun (which has been depreciated)<br />
<code>mdadm --examine --scan --config=partitions > /tmp/mdadm.conf<br />
mdadm --assemble --scan --config=/tmp/mdadm.conf</code></p>
<p>Convert a RAID 1 array to RAID 5 (follow the steps to add a disk after running this command)<br />
<code>mdadm --create /dev/md0 --level=5 -n 2 /dev/sda1 /dev/sdb1</code></p>
<p>Add a disk to an existing RAID and resize the filesystem<br />
<code>mdadm --add /dev/md0 /dev/sdg1<br />
mdadm --grow /dev/md0 -n 5<br />
fsck.ext3 -f /dev/md0<br />
resize2fs /dev/md0</code></p>
<p>Stop and remove the RAID device<br />
<code>mdadm --stop /dev/md0<br />
mdadm --remove /dev/md0</code></p>
]]></content:encoded>
			<wfw:commentRss>http://www.excalibur-partners.com/archives/19/feed</wfw:commentRss>
		</item>
		<item>
		<title>RAID Explained</title>
		<link>http://www.excalibur-partners.com/archives/20</link>
		<comments>http://www.excalibur-partners.com/archives/20#comments</comments>
		<pubDate>Sun, 16 Dec 2007 21:39:55 +0000</pubDate>
		<dc:creator>Admin</dc:creator>
		
		<category><![CDATA[Linux]]></category>

		<category><![CDATA[RAID]]></category>

		<guid isPermaLink="false">http://www.excalibur-partners.com/archives/20</guid>
		<description><![CDATA[RAID, which stands for &#8220;redundant array of independent&#8221; disks provides a way to group disks into one volume and/or provide fault tolerance. There are three way to implement RAID: hardware, a combination of hardware/software, and software only.
Hardware RAID uses an add in card (PCI, PCI Express, PCI-X). The card has on-board memory and a processor [...]]]></description>
			<content:encoded><![CDATA[<p>RAID, which stands for &#8220;redundant array of independent&#8221; disks provides a way to group disks into one volume and/or provide fault tolerance. There are three way to implement RAID: hardware, a combination of hardware/software, and software only.<span id="more-20"></span></p>
<p>Hardware RAID uses an add in card (PCI, PCI Express, PCI-X). The card has on-board memory and a processor to compute the RAID calculations. The RAID is stored in the controllers proprietary format and most likely you will need to use their drivers. The price is around $300-400 for a 4 port SATA card. The CPU load is basically non-existent with this setup.</p>
<p>Hardware/software RAID uses an add in card as well. However the card doesn&#8217;t contain memory or a RAID processor. It instead off-loads the RAID calculations to the CPU. The data is still in a proprietary RAID format and most likely you&#8217;ll need to use the card&#8217;s RAID drivers. These run around $100-150 for a 4 port card. Personally I think this form of RAID is pointless unless it is used for RAID 1 or 0 for reasons explained below.</p>
<p>Software RAID is proprietary to the software format. In linux you can move the drives easily between systems and linux distros provided the kernel support is the same. I&#8217;ve moved between Debian and Ubuntu without an issue. All the RAID calculations are performed by the CPU. However with today&#8217;s processors this will most likely not be an issue. The advantage to software RAID is the support as it is widely used.</p>
<p>No matter which implementation you choose make sure to test all possible scenarios before putting the RAID into production. Practice failing a drive, replacing it, and rebuilding the array. If you are going the software RAID route VMWare allows easy and fast testing. You can create multiple 1 GB drives which will rebuild much faster than 500GB real drives.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.excalibur-partners.com/archives/20/feed</wfw:commentRss>
		</item>
		<item>
		<title>Installing Debian/Ubuntu on an Existing RAID/LVM</title>
		<link>http://www.excalibur-partners.com/archives/18</link>
		<comments>http://www.excalibur-partners.com/archives/18#comments</comments>
		<pubDate>Thu, 13 Dec 2007 04:26:24 +0000</pubDate>
		<dc:creator>Admin</dc:creator>
		
		<category><![CDATA[Linux]]></category>

		<category><![CDATA[RAID]]></category>

		<guid isPermaLink="false">http://www.excalibur-partners.com/archives/18</guid>
		<description><![CDATA[I like to test all the possible scenarios before putting a server into production. One of these tests was whether I could reinstall linux without disturbing the RAID arrays. Unfortunately the Debian and Ubuntu installers do not make this easy. When you reach the partitioning stage it will just show you the physical drives with [...]]]></description>
			<content:encoded><![CDATA[<p>I like to test all the possible scenarios before putting a server into production. One of these tests was whether I could reinstall linux without disturbing the RAID arrays. Unfortunately the Debian and Ubuntu installers do not make this easy. When you reach the partitioning stage it will just show you the physical drives with the linux raid partitions and not the md devices. Here are the steps that worked for me.<span id="more-18"></span></p>
<p>When starting the installer proceed until you reach the network configuration screen where it asks for the hostname. At this point you&#8217;ll want to switch to another virtual terminal (alt+f2). Run the following commands<br />
<code>modprobe raid1<br />
modprobe dm_mod<br />
mdrun</code></p>
<p>Mdrun might return command not found as it has been depreciated in later linux releases. Don&#8217;t worry we can use mdadm instead.<br />
<code>mdadm --examine --scan --config=partitions > /tmp/mdadm.conf<br />
mdadm --assemble --scan --config=/tmp/mdadm.conf</code></p>
<p>Let&#8217;s verify that the RAID arrays were found and started.<br />
<code>cat /proc/mdstat</code></p>
<p>If you are using LVM we can now scan and activate the volumes.<br />
<code>lvscan<br />
vgchange -a y</code></p>
<p>Now you can return to the installer with alt+f1. When you reach the partitioning stage select manual and assign the RAID / LVM volumes mount points.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.excalibur-partners.com/archives/18/feed</wfw:commentRss>
		</item>
		<item>
		<title>Patching Apache&#8217;s Suexec Module</title>
		<link>http://www.excalibur-partners.com/archives/12</link>
		<comments>http://www.excalibur-partners.com/archives/12#comments</comments>
		<pubDate>Fri, 30 Nov 2007 20:38:49 +0000</pubDate>
		<dc:creator>Admin</dc:creator>
		
		<category><![CDATA[Apache]]></category>

		<category><![CDATA[Linux]]></category>

		<guid isPermaLink="false">http://wgnrs.dynalias.com/wordpress/archives/12</guid>
		<description><![CDATA[Apache&#8217;s suexec module is useful for running CGI and SSI scripts as a defined user. However all scripts must be located under the compiled in docroot and the uid/gid of the user running the script must match the script&#8217;s uid/gid. 
This can be a problem if you have a shared CGI app like awstats as [...]]]></description>
			<content:encoded><![CDATA[<p>Apache&#8217;s suexec module is useful for running CGI and SSI scripts as a defined user. However all scripts must be located under the compiled in docroot and the uid/gid of the user running the script must match the script&#8217;s uid/gid. </p>
<p>This can be a problem if you have a shared CGI app like awstats as unless you make each user a copy the uid/gid will not match. Not to mention that the docroot on Fedora is /var/www so if you want to store your virtual hosts elsewhere your out of luck. Not to worry recompiling apache isn&#8217;t as hard as you might think.<span id="more-12"></span></p>
<p>Since we are modifying suexec there is always the potential that the modifications may cause a security hole. <strong>Proceed at your own risk!!</strong></p>
<p>First we need to grab the httpd SRPM from FC5 updates<br />
<code>cd ~<br />
wget http://mirrors.kernel.org/fedora/core/updates/5/SRPMS/httpd-2.2.2-1.3.src.rpm</code></p>
<p>Next we setup the RPM build area<br />
<code>fedora-buildrpmtree</code></p>
<p>Install the SRPM into the rpmbuild directory<br />
<code>rpm -ivh httpd-2.2.2-1.3.src.rpm</code></p>
<p>Grab the suexec no UID/GID check patch<br />
<code>cd rpmbuild/SOURCES<br />
wget http://www.excalibur-partners.com/wp-content/uploads/2007/11/suexec_nocheck.patch</code></p>
<p>Modify the docroot<br />
<code>cd ~/rpmbuild/SPECS<br />
vim httpd.spec<br />
Line 192:<br />
- --with-suexec-docroot=%{contentdir} \<br />
+ --with-suexec-docroot=/ \</code></p>
<p>Modify the httpd.spec to include the patch<br />
<code>vim httpd.spec<br />
Line 48:<br />
 Patch73: httpd-2.2.3-CVE-2007-3304.patch<br />
+ Patch80: suexec_nocheck.patch<br />
Line 131:<br />
 %patch73 -p1 -b .cve3304<br />
+ %patch80 -p1 -b .nocheck</code></p>
<p>Now we can build the modified RPM<br />
<code>rpmbuild -ba httpd.spec</code></p>
<p>Instead of reinstalling apache I recommend just extracting and replacing the suexec file<br />
<code>cd ~/rpmbuild<br />
rpm2cpio RPMS/`uname -p`/httpd-2.2.2-1.3.src.rpm | cpio -imVd ./usr/sbin/suexec<br />
sudo cp -p /usr/sbin/suexec /usr/sbin/suexec.orig<br />
sudo cp ./usr/sbin/suexec /usr/sbin/suexec<br />
sudo chown root:apache /usr/sbin/suexec<br />
sudo chmod 4510 /usr/sbin/suexec</code></p>
]]></content:encoded>
			<wfw:commentRss>http://www.excalibur-partners.com/archives/12/feed</wfw:commentRss>
		</item>
		<item>
		<title>Virtual Web Site Hosting</title>
		<link>http://www.excalibur-partners.com/archives/9</link>
		<comments>http://www.excalibur-partners.com/archives/9#comments</comments>
		<pubDate>Sun, 04 Nov 2007 18:24:08 +0000</pubDate>
		<dc:creator>Admin</dc:creator>
		
		<category><![CDATA[Apache]]></category>

		<category><![CDATA[Linux]]></category>

		<guid isPermaLink="false">http://wgnrs.dynalias.com/wordpress/archives/9</guid>
		<description><![CDATA[A common practice is to use one apache server to host websites for multiple domain names. Apache supports virtual servers out of the box making this easy to setup. This tutorial is based on Fedora Core 5, but should apply to most other linux distros.
To get started you need to have a folder to store [...]]]></description>
			<content:encoded><![CDATA[<p>A common practice is to use one apache server to host websites for multiple domain names. Apache supports virtual servers out of the box making this easy to setup. This tutorial is based on Fedora Core 5, but should apply to most other linux distros.<span id="more-9"></span></p>
<p>To get started you need to have a folder to store the data for each virtual website. On my system I have a created a new user for each website following the pattern.<br />
<code>/home/*/public_html/</code></p>
<p>For example to add jsmith. Note that the /home/jsmith folder must have execute permissions and the public_html folder must have read permissions for apache.<br />
<code>useradd jsmith<br />
cd /home/jsmith<br />
mkdir public_html<br />
chown jsmith:jsmith public_html<br />
chmod 711 .<br />
chmod 755 public_html</code></p>
<p>Lets open up the apache config and add the required sections.<br />
<code>vim /etc/httpd/conf/httpd.conf</code></p>
<p>Scroll down to the end of the file and you will see the virtual hosting section. The first thing we must do is let apahce know what IPs and ports it will be serving for virtual hosts. The * wild card is supported. The line below states that apache will server requests for port 80 on all incoming IPs.<br />
<code>NameVirtualHost *:80</code></p>
<p>Now we set the individual settings for each virtual host. If you are a hosting provider you probably will want a catchall host to display if the user goes to the server&#8217;s IP or hostname. To do this we use the _default_ attribute.<br />
<code>&lt;VirtualHost _default_:80&gt;<br />
   ServerAdmin email@domain.com<br />
   DocumentRoot /var/www/html<br />
   ServerName www.domain.com<br />
&lt;/VirtualHost&gt;</code></p>
<p>On the rest of your virtual hosts I recommend to fill in a ServerAlias. Lets say your site is http://www.jsmith.com/. Without a ServerAlias if a visitor points his/her browser to http://jsmith.com/ they will get the default host instead of http://www.jsmith.com/.<br />
<code>&lt;VirtualHost *:80&gt;<br />
   ServerAdmin email@jsmith.com<br />
   DocumentRoot /home/jsmith/public_html<br />
   ServerName www.jsmith.com<br />
   ServerAlias jsmith.com *.jsmith.com<br />
&lt;/VirtualHost&gt;</code></p>
<p>Make sure to verify the apache config first<br />
<code>apachectl configtest</code></p>
<p>If it comes back syntax OK you are ready to reload the config<br />
<code>service httpd reload</code></p>
<p>or start up the apache server if it is not already running.<br />
<code>service httpd start</code></p>
]]></content:encoded>
			<wfw:commentRss>http://www.excalibur-partners.com/archives/9/feed</wfw:commentRss>
		</item>
	</channel>
</rss>
