Wayne Graham's Blog - Server

Thumpers!

Wed, 21 May 2008 09:37:00 -0500

Just received two of Sun's 24TB Sun Fire x4500 Thumper boxes! The plan (at least right now) is to run SMB and NFS shares so the folks in our media studios can actually put their info on something a bit more stable than the local macs. We have a triple-speed network switch between the Macs and our server room (though they I haven't seen any computers here that can actually handle data that fast), but it should be pretty zippy. We'll also be able to consolidate the storage (hopefully) of our institutional repository and staff file storage. We're also getting a 10Gig switch put in this December so we can surf Internet2 at super speed (or at least the folks working in the Integrated Graphics Lab will be able to send their jobs to the super computers faster)!

Subversion with mod_security

Tue, 06 Mar 2007 16:35:00 -0500

I ran into a bit of an issue while setting up a new subversion server today. On that box we're running mod_security on all vhosts to add another layer of security to our web apps. I got everything configured with the the security, but when I was testing, I kept getting 403 errors when I attempted to get the files in anything other than a web browser. After scratching my head for a while, I looked at the Apache logs, and noticed that mod_rewrite was causing the issue with lines like this:


[Tue Mar 06 13:46:46 2007] [error] [client xxx.xxx.xxx.xxx] mod_security: Access denied with code 403. Pattern match "!(^$|^application/x-www-form-urlencoded$|^multipart/form-data)" at HEADER("Content-Type") [severity "EMERGENCY"] [hostname "svn.example.com"] [uri "/test"]

I stumbled on Charl van Niekerk's entry on this. One of the comments suggested that the following is the bare minimum to run mod_security on a vhost running subversion:


SecFilterSelective REQUEST_METHOD "^(PROPFIND|PROPPATCH)$" allow
SecFilterSelective REQUEST_METHOD "^(REPORT|OPTIONS)$" allow
SecFilterSelective REQUEST_METHOD "^(MKACTIVITY|CHECKOUT)$" allow
SecFilterSelective REQUEST_METHOD "^(PUT|DELETE|MERGE)$" allow

This should be in the first directives in your mod_security call:




    # Enable ModSecurity
    SecFilterEngine On

    # Allow SVN requests
	SecFilterSelective REQUEST_METHOD "^(PROPFIND|PROPPATCH)$" allow
	SecFilterSelective REQUEST_METHOD "^(REPORT|OPTIONS)$" allow
	SecFilterSelective REQUEST_METHOD "^(MKACTIVITY|CHECKOUT)$" allow
	SecFilterSelective REQUEST_METHOD "^(PUT|DELETE|MERGE)$" allow

	...
	# rest of your directives

If you run a Subversion repository and have run into this issue, these security filters should help!

MS Access via JDBC

Fri, 02 Feb 2007 15:23:00 -0500

We recently made the move from an IIS Windows web server to an Apache *nix based web server as part of our efforts to consolidate our library's server infrastructure. And for reasons I won't expound upon, we had one MS Access DSN that didn't get migrated to MSSQL and that needed to be used still. Since ColdFusion uses a Windows only driver for MS Access, I needed to figure out a way around this. I found a couple of JDBC drivers for Access (Easysoft's JDBC-ODBC Bridge and HXTT's Access Pure Java JDBC Drivers), but these seemed to be a bit on the expensive side for the short amount of time that I'd need to keep Access in production. I did notice on Easysoft's website that they were using the JdbcOdbc bridge, so after a little bit more digging, I found the syntax to use configure ColdFusion to use MS Access through the JdbcOdbc Bridge; the JDBC URL is


	jdbc:odbc:Driver={Microsoft Access Driver (*.mdb)};DBQ=/path/to/datasource.mdb;DriverID22;

and the Driver Class


	sun.jdbc.odbc.JdbcOdbcDriver

For the very basic inserting of data from a seldom-used web form into a single table, this band aid fix has been doing pretty good!

RedHat Support Kudos

Thu, 14 Dec 2006 16:04:00 -0500

It's been a while since I've posted anything, so I figured this would be a good point to start on... To start the process of standardizing our server platform in the library, we recently purchased a couple of servers to run RedHat on. I was going through the process yesterday of activating the subscriptions, and a funny thing happened...the second subscription got appended to the first as an extension instead of a new subscription. I looked all over the place trying to figure out where the subscription had gone to, and read, and reread the directions (there's not really that much to it). I had deleted and re-added the system (in an effort to clear the entitlements) so many times I lost count. I finally broke down and decided to give RedHat a call. I have to say this was perhaps one of the best service calls I've ever had with a software vendor. After my last several experiences with software vendors (we just put in a new media center for college students), I had pretty low expectations. I figured I'd be on the phone for most of the morning trying to convince someone that I did in fact have two, three-year subscriptions and not one, three-year with a three-year extension. Things started off normal enough for these things...a labyrinth of options to choose from. After I got the options to get to technical support, someone actually picked up the phone on the second ring! After I explained what I had done, he looked at my account and immediately knew what had happened. He said that he wasn't able to help, but would transfer me to someone who could. Now this is what surprised me, instead of me getting transferred to the folks that could help me, he actually talked to those people, explained what the problem was, and then connected me so I could talk to those people. By the time I actually spoke with the account rep, she already knew what the problem was and what needed to be done to fix the problem instead of me rehashing my story over and over again. I wish more companies handled issues like this...my five minute problem literally took five minutes to resolve. Too many times in the recent past I've gotten the run-around for what I believed a rather straight-forward issue. It's very refreshing to have this kind of experience with a software vendor!

Cygwin to the Rescue!

Wed, 14 Dec 2005 15:53:00 -0500

I had a local SVN repository that had a lot of large images in it (scans of letters to- and from- Thomas Jefferson) that I needed to remove from the repository on my local machine but keep the files. Normally, this is an export issue, however, we're talking about 800 hundred images that are around 40MB a piece. Needless to say this was going to take more time than I was willing to dedicate to the task. This is where Cygwin came into play. I basically wanted to delete all of the .svn folders that Subversion creates when you add something to a repository. So, with a single line, I was able delete the folders for an operation that would have taken a few hours to complete with the export task. So, in case you ever find yourself needed a script like this, here you go (assuming you're in the directory you want to start deleting in):


find . -type d -name ?*.svn? -print0 | xargs -0 rm -rdf

This also works wonders for deleting .DS_Store files that tend to get onto your servers when you have Mac users (just be sure to change the -type flag to f).

Server Hiccup

Sun, 21 Aug 2005 20:15:00 -0500

Last night I deployed our new site interface for the library. It's the first major redesign of the site's look and feel since 1999. There's still a lot to do, but I think it's a significant update to what we had. After spending most of the morning cleaning up old folders, updating the Google search index, and making some final tweaks, I went in to work to upgrade or ILL system (ILLiad). Everything had been going smoothly with the site deployment; I had feared something going awry since the server the site is on is in desperate need of replacement. I wasn't sure how ColdFusion was going to handle the changes to the root I needed to make, but editing the XML files was relatively painless. [More]