Thoughts Electrique

For a current hosting server I’m using the Plesk control panel 9.0.1 for Ubuntu 8.04. Since version 9 Plesk allows the usage of Postfix as an MTA and PHP via FastCGI. This is very nice and much more secure than the old model using mod_php.

The Problem

One problem with the current Plesk version (as with most Plesk versions :/) is that it has some nasty bugs. For example mod_rewrite doesn’t work with the FastCGI configuration. The problem is that the generated virtual host configuration has a small but important problem. The generated host looks something like this:

<VirtualHost 88.198.164.10:80>
  ServerName   playground.himberger.de:80
  ServerAlias  www.playground.himberger.de

  <IfModule mod_fcgid.c>
    <Files ~ (\.php)>
      SetHandler fcgid-script
      FCGIWrapper /usr/bin/php5-cgi .php
      Options ExecCGI
      allow from all
    </Files>
  </IfModule>
</VirtualHost>

The issue with this configuration is the line “Options ExecCGI“. This line enables the execution of CGI scripts for this particular directory but overrides all the Options set earlier. These are in parts needed for mod_rewrite. To fix this the line should be “Options +ExecCGI“. Sadly changing the configuration doesn’t help because at the next opportunity Plesk will regenerate the config file and your change is gone.

Luckily there is a way around this…

(more…)

I’ve been experiencing some serverdowns at a client who uses 1und1 CentOS 5 Servers. After some investigation I discovered that cronjobs were still running although the server appeared to be down. Checking the syslogs showed me a bunch of failed DHCP requests which remebered me of the fact that 1und1 uses DHCP to configure the server machines. I don’t think this is a good idea so I changed the setup to static IPs.

Since 1und1 puts every server behind a dedicated firewall the setup is not as easy as you think. I’ll document it here because It may be useful for other people and certainly for myself after a couple of months.

Configure a static IP address

Open the file /etc/sysconfig/network-scripts/ifcfg-eth0 and edit it to look like the following:

DEVICE=eth0
BOOTPROTO=none
TYPE=Ethernet
ONBOOT=yes
HWADDR=$YOURMACADDRESS
NETMASK=255.255.255.255
IPADDR=$YOURIP
GATEWAY=10.255.255.1

Save the file.

Configure static routes

This is the tricky part. Configuring a default gateway using the GATEWAY= setting is not enough. You have to setup the routes yourself. To do so create a new file /etc/sysconfig/network-scripts/route-eth0 with the following contents:

10.255.255.1 dev eth0
default via 10.255.255.1 dev eth0

Now you only have to reload the networking configuration via

service network reload

and you are done!

This post helped me a lot with the solution.

As you may remember from my last blogpost I’m currently setting up a new hosting Server. Since this server will also host some OpenCms and JEE sites I need to set up a Servlet Container. In almost all of my projects until today Tomcat was successfully used for this purpose. Be it stand alone or embedded in a JEE application server (e.g. JBoss).

I must admit that I always had some kind of a love-hate relationship with Tomcat. The classloader had some bad issues when reloading a webapplication too often and often killed the complete server. Taking down all of the other webapplications too. Although this has gotten a lot better recently it’s still bothering me a bit.

Since I had some time after my last project I started investigating other open source alternatives. I often heard of Jetty, praised for it’s speed and simplicity, it seemed like a great alternative and I played around with it a bit. I really liked it since it was simple to use and easy to deploy but as I started to google for things like performance measurements or how to use it with a security manager I didn’t really found a lot of documentation (compared to Tomcat) and the performance doesn’t really doesn’t seem to differ from Tomcats.

So I’m once again going the Tomcat route. It has a big community and is even used in military and government organizations. It’s really not a technology decision (although I think Tomcat is solid) but more political thinking.

It will also save me some time which I can invest in trying out other technologies. Meow…

Since I’m currently setting up a new server for hosting purposes I want to share some of my favourite sysadmin tools and practices.

The first featured tool is the shoreline firewall or shorewall. You can find the project at: http://www.shorewall.net/

Shorewall basically is a set of nice configuration files for iptables. Another benefit of shorewall is that it has no runtime part. You just fire up the tool, it configures your iptables and quits. This reduces the load and increases security. Additionally to the technical features there is one thing that makes shorewall really stand out: It has extensive, well-written and understandable documentation. You rarely find a use-case which is not already described in the documentation.

Read on to find out how to set up shorewall in minutes.

(more…)

The forbidden fruit

I recently discovered runkit for PHP and thought it could be a solution for a few problems I ran into during my work on various projects.

At heart runkit allows you do to stuff with PHP you shouldn’t, but eventually want to, do. In my case this is basically Sandboxing and redefining (even PHP-internal) functions. It really adds some cool stuff to your PHP toolbox. Have a look at the function reference for the complete list.

Sadly enough the runkit PECL package does not work on Debian Etch (because Etch uses PHP 5.2.0+) so I had to build the package myself. Read on to find out how to build and install runkit on Debian etch and things to keep in mind when using runkit.

Important: If you are unsure of using runkit have a look at The sections The Caveat and Final Remarks before you walk through the hassle of installing it.

(more…)