January 2012
M T W T F S S
« Dec    
 1
2345678
9101112131415
16171819202122
23242526272829
3031  

Java virtual hosting with multiple FTP users

As we all are familiar with virtual hosting in Apache and we can isolate each users to publish their sites to a folder under thier home directory. So there is no any issue with operating the files copied on the hosting root.

Earlier I had started tomcat from the root account and created Virtual hosting in tomcat and isolate the hosting root according to the users. The issue I had faced is none of the FTP users to modify/delete the files in their hosting root since all the files are owned by the root account because of root user is operating tomcat service.

So I have to gave ssh access to the server and gave sudo command to deploy users newly uploaded files. So it’s a security threat to allow users to have ssh access and permit to operate sudo commands.

After few R&D I decided to run the tomcat service from a normal user who does not have shell access

Solution :

1. create new user and group for tomcat user

 #group add tomcat
  #useradd -g tomcat tomcat

2. Permitting tomcat users to access the Tomcat installation files

 # chown -R tomcat.tomcat /usr/local/apache-tomcat-6.0.29/

3. Start the tomcat daemon within the user account.

    [root@rc-040 public_html]# su - tomcat
    [tomcat@rc-040 ~]$ cd /usr/local/apache-tomcat-6.0.29/bin/
    [tomcat@rc-040 bin]$ sh startup.sh
    Using CATALINA_BASE:   /usr/local/apache-tomcat-6.0.29
    Using CATALINA_HOME:   /usr/local/apache-tomcat-6.0.29
    Using CATALINA_TMPDIR: /usr/local/apache-tomcat-6.0.29/temp
    Using JRE_HOME:        /usr/java/jdk1.6.0_14
    Using CLASSPATH:       /usr/local/apache-tomcat-6.0.29/bin/bootstrap.jar
    [tomcat@rc-040 bin]$ netstat -nlp | grep "java"
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp        0      0 :::8080                     :::*                        LISTEN      1837/java
[tomcat@rc-040 bin]$

You almost done !!! :-)

Creating FTP users and Virtual hosting

a. An example of Virtualhost entry is showing below,

 [root@rc-040 public_html]# vi /usr/local/apache-tomcat-6.0.29/conf/server.xml

b. FTP user creation
1. create new user and set their primary group as tomcat.

 #useradd -g tomcat ftpuser1
        [root@rc-040 public_html]# chown -R ftpuser.tomcat /home/ftpuser/public_html

Setting sticky bit on the web directory where both users would have the same access

 [root@rc-040 public_html]# chmod -R  2777  /home/ftpuser/public_html

That’s it !!!!! Everything set..

Now upload your war file named as “ROOT.war” under the public_html folder and see the application running … :-) There is not need to restart the tomcat to deploy new application, Just like we do with Apache :-)

You will get the sample war file from here “http://tomcat.apache.org/tomcat-5.5-doc/appdev/sample/sample.war” for the initial testing.

Here are the some useful file locations/path if you plan to run the Tomcat as a backend server over the AJP connector in Apache ( Recommended by me :-) )

1. /etc/httpd/modules/mod_jk.so
2. /etc/httpd/conf.d/jk.conf
3. /etc/httpd/conf.d/workers.properties
4. /etc/httpd/conf.d/javasite1.conf

 [root@rc-040 public_html]# ls  /etc/httpd/modules/mod_jk.so
/etc/httpd/modules/mod_jk.so
[root@rc-040 public_html]# cat  /etc/httpd/conf.d/jk.conf
LoadModule jk_module /usr/lib/httpd/modules/mod_jk.so
JkWorkersFile /etc/httpd/conf.d/workers.properties
JkShmFile     /var/log/httpd/mod_jk.shm
JkLogFile     /var/log/httpd/mod_jk.log
JkLogLevel    info
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "
[root@rc-040 public_html]# cat  /etc/httpd/conf.d/workers.properties
# Define 1 real worker using ajp13
worker.list=worker1
# Set properties for worker1 (ajp13)
worker.worker1.type=ajp13
worker.worker1.host=localhost
worker.worker1.port=8009
[root@rc-040 public_html]#

A sample Apache virtualhost entry

[root@rc-040 public_html]# cat /etc/httpd/conf.d/javasite1.conf
<VirtualHost *:80>
ServerName mydomain.com
ServerAlias wwww.mydomain.com
DocumentRoot /home/ftpuser/public_html
DirectoryIndex index.html dplpool/
Alias /  /home/ftpuser/public_html
ErrorLog logs/selfcare-javahost.log
JkMount /*.jsp worker1
#JkMount /   worker1
JkMount /* worker1
</VirtualHost>

Glasshfish error : EMBEDDED Broker start failure:code

You may got the following errors when you start the glasshfish server where files are copied it from some other servers. The error exact look likes as follows.

[#|2012-01-02T03:43:44.999-0500|SEVERE|sun-appserver9.1|javax.resourceadapter.mqjmsra.lifecycle|_ThreadID=10;_ThreadName=main;_RequestID=a405530f-501e-4486-a1d4-92d05f49976e;|MQJMSRA_RA4001: start:Aborting:Exception starting EMBEDDED broker=EMBEDDED Broker start failure:code = 1|#]

Solution

Just delete the “lock” file from the glassfish directory. The location of this file is “imq/instances/imqbroker/lock” under glassfish.

[root@fc-web04 domain1]# rm imq/instances/imqbroker/lock
rm: remove regular file `imq/instances/imqbroker/lock'? y
[root@fc-web04 domain1]# /var/glassfish/bin/asadmin start-domain domain1

Then try to restart the web server.

[root@domain1]# /var/glassfish/bin/asadmin start-domain domain1
Starting Domain domain1, please wait.
Log redirected to /var/glassfish/domains/domain1/logs/server.log.
Redirecting output to /var/glassfish/domains/domain1/logs/server.log
Killed
[root@ domain1]# /var/glassfish/bin/asadmin start-domain domain1
Starting Domain domain1, please wait.
Log redirected to /var/glassfish/domains/domain1/logs/server.log.
Redirecting output to /var/glassfish/domains/domain1/logs/server.log
Domain domain1 is ready to receive client requests. Additional services are being started in background.
Domain [domain1] is running [Sun Java System Application Server 9.1_01 (build b09d-fcs)] with its configuration and logs at: [/var/glassfish/domains].
Admin Console is available at [http://localhost:4848].
Use the same port [4848] for "asadmin" commands.
User web applications are available at these URLs:
[https://localhost:80 https://localhost:443 ].
Following web-contexts are available:
[/web1  /__wstx-services myapp ].
Standard JMX Clients (like JConsole) can connect to JMXServiceURL:
[service:jmx:rmi:///jndi/rmi://web:8686/jmxrmi] for domain management purposes.
Domain listens on at least following ports for connections:
[80 443 4848 3700 3820 3920 8686 ].
Domain does not support application server clusters and other standalone instances.

Automating sFTP download and email alert upon file changes

Here I got a requirement to automate the download which using sftp account with custom ports. This account doesn’t not have any ssh access enabled.

This script can have the following features,

1. Synchronize the remote sftp location to local path
2. Can configure sftp custom port
3. An email alert will send to the specified users when a new file placed in the ftp location.

#!/bin/bash
lftp -e "mirror --delete --only-newer --verbose /FROM/  /var/RKFeeds/;quit" -u username,mypass sftp://secureftp.domain.com:10022

cat /dev/null > /tmp/maildata.log
MAIL_BODY=/tmp/maildata.log
FILES=/var/RKFeeds/FROM/*
for f in $FILES
do

### Searching new file presence
if grep -Fxq "$f" file_list.log
then
 touch /tmp/asd.log
else
  echo "New file" $f " has arrived " >> $MAIL_BODY
fi
done

## Rebuilding file list
FILES=/var/RKFeeds/FROM/*
cat /dev/null > file_list.log
for f in $FILES
do
 # take action on each file. $f store current file name
echo $f  >> file_list.log
done

##### sending mail if mail data file having content
if [[ -s $MAIL_BODY ]] ; then
echo "$MAIL_BODY has data.and mail sending"
sendEmail -f bkp-admins@mydomain.com  -t user2@mydomain.com,lijumathewliju@gmail.com -cc support@mydomain.com, user@mydomain.com  -u "New Feeds has arrived on" $(date +%d-%m-%Y)  -l /var/log/sendEmail  -o message-content-type=auto  message-file=$MAIL_BODY   -s smtpout.mydomain.net:25 -xu info@mydomain.com -xp mysmtppass
else
touch /tmp/asd.log
fi ;

Pls note that the location “/var/RKFeeds/FROM” is the local path where lftp sync the remote folder ” FROM” folder.
sendEmail : Is another smtp email sending program that help you to send email from the command line which using smtp account. So that these emails are not been marked as spam anywhere.

Mysql on Windows : Can’t get hostname for your address

I’m getting this error message while I’m accessing remote mysql database which was running on WAMP.

Simple fix is to add “skip-name-resolve” in my.cnf file which will be shown in MySQL installation directory.

Since the MySQL server is using WAMP environment, You need to put the same line inside [wampmysqld].

The my.cnf file location will be the “C:\wamp\bin\mysql\mysql5.5.8\my.cnf

Eg:

[wampmysqld]
port        = 3306
socket      = /tmp/mysql.sock
key_buffer = 16M
max_allowed_packet = 1M
table_cache = 64
sort_buffer_size = 512K
net_buffer_length = 8K
read_buffer_size = 256K
read_rnd_buffer_size = 512K
myisam_sort_buffer_size = 8M
basedir=c:/wamp/bin/mysql/mysql5.5.8
log-error=c:/wamp/logs/mysql.log
datadir=c:/wamp/bin/mysql/mysql5.5.8/data
skip-name-resolve

IIS: Renewing SSL certificate from .crt and private key file

One of the client migrated a domain to Windows server to Linux which was using a Godaddy UCC certificate.This certificate expired and i have renewed the SSL as most the other domains listed in it hosting on Linux server without using new CSR request. I have download the certificate suitable for IIS from Godaddy account. The download containing “gd_iis_intermediates.p7b” Godaddy intermediate certificate suit for IIS and a “domain.cert” file.

I read the Godaddy support documentation and did everything as it is described. Also getting same error “CertEnroll::CX509Enrollment::p_Install Response: ASN1 bad tag value met. 0x8009310b (ASN: 267)” So that I can’t install the certificate over the IIS MMC console. It’s still showing older expiry date.

See the pasted image here

Then I confirmed that it was not something related to IIS but with the certificate format which Godaddy had provided.After few hours of Googling, it’s found that we can create .pfx file by converting existing certificate provided by the Godaddy. Openssl have very good tool for doing that.

a. How convert a PEM certificate file and a private key to PKCS#12, Format of IIS .pfx
Download both Cert (mydomain.crt) file, CA bundle file (gd_iis_intermediates.p7b) and private key in a linux box. Then execute it from the terminal.

#openssl pkcs12 -export -out mydomain.pfx -inkey privateKey.key -in mydomain.crt -certfile gd_iis_intermediates.p7b

This will generate the a new file (mydomain.pfx) on the same location which could be understandable to IIS. Now you need it to copy to the IIS server and choose the import option

Choose the import certificate option

Browse the .pfx SSL renewal certificate

Bind the new certificate with respective website

Exim :- Useful administrative commands

Most of the Whm/Cpanel based servers are using exim as MTA which has flexible spam filter and support virtual domain and users.

1. Print a count of the messages in the queue:
#exim -bpc

  root@web-012 [~]# exim -bpc
   1

2. Print a listing of the messages in the queue
#exim -bp

  root@web-012 [~]# exim -bp
   carlineshirly@power.alstom.com
 9h  2.0K 1RSHdk-0003zj-07 <> *** frozen ***
          alyssa.campbell@lightwave.com

3. Print a summary of messages in the queue
#exim -bp | exiqsumm

 root@web-012 [~]# exim -bp | exiqsumm
Count  Volume  Oldest  Newest  Domain
-----  ------  ------  ------  ------
    1    2048     29h     29h  interstaterelocation.net
    1    2048      9h      9h  lightwave.com
    1    2457     42h     42h  news.cqi.com
    1    1945     22h     22h  power.alstom.com
---------------------------------------------------------------
    4    8499     42h      9h  TOTAL

4. Print what Exim is doing right now:
#exiwhat

 root@web-012 [~]#  exiwhat
   4123 daemon: -q1h, listening for SMTP on port 25 (IPv6 and IPv4) and for SMTPS on port 465 (IPv6 and IPv4)

5. Display all of Exim’s configuration settings:
# exim -bP
6. Use -f to search the queue for messages from a specific sender:
#exiqgrep -f user@domain.com
7. Use -r to search the queue for messages for a specific recipient/domain:
#exiqgrep -r user@domain.com
8. Start a queue run:
#exim -q -v
9. Start a queue run for just local deliveries:
exim -ql -v
10. Remove a message from the queue:
#exim -Mrm

 root@web-012 [~]# exim -Mrm 1RSHdk-0003zj-07
Message 1RSHdk-0003zj-07 has been removed

11. Deliver a message, whether it’s frozen or not, whether the retry time has been reached or not
#exim -M
12. Remove all frozen messages:
#exiqgrep -z -i | xargs exim -Mrm

root@web-012 [~]# exiqgrep -z -i | xargs exim -Mrm
Message 1RRyxQ-0003FJ-Aq has been removed
Message 1RS60i-00079d-NF has been removed

13. Remove all messages older than 1 days (86400 * 1 = 86400 seconds):
#exiqgrep -o 432000 -i | xargs exim -Mrm
14. Freeze all queued mail from a given sender:
#exiqgrep -i -f luser@example.tld | xargs exim -Mf
15. View a message’s headers
#exim -Mvh
16. View a message’s body:
#exim -Mvb
17. View a message’s logs:
#exim -Mvl

root@server-012[~]# exim -Mvl 1RRn0a-0006pW-LV
2011-11-19 15:39:12 Received from <> R=1RRn0V-0006pI-Vl U=mailnull P=local S=2447
2011-11-19 15:42:21 wdncom.uslec.read.readnews.com [198.186.192.186] Connection timed out
2011-11-19 15:42:21 elian.dancey@wdn.com.client.newsread.com <elian.dancey@news.cqi.com> R=dk_lookuphost T=dk_remote_smtp defer (110): Connection timed out
2011-11-19 16:05:26 wdncom.uslec.read.readnews.com [198.186.192.186] Connection timed out