Skip to main content

Posts

Showing posts from August, 2009

Railo 3.1 Install on Linux -- Caucho security note

Now that Railo 3.1 is out, I think we will see a jump in commercial usage.  I have done a few installs on production machines now, and wanted to point out a security note.

By default when you install Railo 3.1 (with caucho) on Linux (prob the same for OSX), it adds the following to your apache httpd.conf file:

<code>
LoadModule caucho_module /usr/lib/httpd/modules/mod_caucho.so

ResinConfigServer localhost 6800
CauchoConfigCacheDirectory /tmp
CauchoStatus yes
</code>

The bottom one is the problem -- it enables CauchoStatus by default.  That means that you can open up a web browser to http://your.host.com/caucho-status and see status info, but there is a lot of detailed info there, including the names of each of the hosts you configured in resin, so people can snoop and see all the railo-enabled sites on that machine.  This might also give a would-be-attacker the info they need to plan a DOS attack, SQL injection attack, etc.. especially since they can see how the server is …

Upgrading CentOS 4 or RHEL 4 to use PHP5

This seemingly simple task was more work than I expected.  Here are some of my notes in the hopes that this helps somebody.  If it does, and you want to donate to my cause, or just encourage me to keep blogging about stuff like this, email me :)

Ok, there are a bunch of sites out there, that helped me get 75% of the way.  Download the RPMs, try to install, and error, dependancies i've never seen before.

This tutorial got me 75% of the way:

http://www.lampdeveloper.co.uk/linux/installing-php-525-suhosin-php-eaccelerator-on-centos-4-with-yum.html

(By the way centos 4 and RHEL4 are pretty much the same, but this is focusing on the specifics for RHEL4)

All said and done, here are the RPMs I ended up needing (to get to 90% success)

php-5.1.6-3.el4s1.10.i386.rpm
php-cli-5.1.6-3.el4s1.10.i386.rpm
php-common-5.1.6-3.el4s1.10.i386.rpm
php-gd-5.1.6-3.el4s1.10.i386.rpm
php-ldap-5.1.6-3.el4s1.10.i386.rpm
php-mysql-5.1.6-3.el4s1.10.i386.rpm
php-pdo-5.1.6-3.el4s1.10.i386.rpm
php-pear-1.4.11-1.el4s1.1.n…

CF United 09 Presentation Files - Google App Engine and Flex

Ok folks, here are my preso files for my CF United 2009 talk on Google App Engine and Flex.  Is this the final version?  Sure.  Until I change it.  I shall resist doing that...

;

Here is the powerpoint presentation download: 294_Andrew_Schwabe_Google_App_Engine_Flex.ppt

Here is the full download (warning, this is big!) Contains all 4 google app engine java projects, all 4 flex projects and the powerpoint file.  The download is big because of all the jar files.  I will try to have a USB key with me so if you want a super fun time instant copy instead of downloading it, I should be able to do that.

Full download (94MB, zipped): CFun09_GAE_Files.zip

For those of you web surfers interested -- demo 4 project includes a fix for allowing Flex app using AMF to retrieve Google Account information (using ajax and a custom auto servlet) so your Flex apps can determine if you are logged in, and get your user identifier if you are logged in.

Mac OSX 10.5.4 on Dell XPS m1330

Yes, it violates Apple's license, so I am classifying this as "experimentation" aka lab fun.

I have managed to get a reasonably usable Mac OSX installed on my dell.  I've tried various distributions, but had limited success.  If you follow my blog, you have seen that I had good success putting Mac OSX on my Dell Mini 9.  That uses the new Dell EFI emulation, and works 100% -- very nice.  The dell XPS was a bit more work to get going.

My first attempt on the Dell Mini was using a Mac OSX dvd made for the MSI Wind netbook.  It was easy but had some issues, and almost worked.

Out of frustration of not being able to get anything stable on my XPS m1330, I popped in the MSI Wind DVD into the XPS and it installed with minimal headache!  When it was done, a bunch of things didn't work, as was expected.

I then downloaded and ran the Dell Post Installer from here: http://www.insanelymac.com/forum/index.php?showtopic=97966

(self explanatory on how to use)

And only recently …