Archive for the 'System Administration' Category

Securing your open blue dragon settings file

Wednesday, June 17th, 2009

After installing Open Blue Dragon on Tomcat and hooking it up to Apache, I did some poking around and found I was able to pull up my bluedragon.xml configuration file directly in my browser. Now, this may not happen in all configurations (there are many ways to setup a J2EE web application), but it my case, running through Apache and having copied Blue Dragon’s WEB-INF directory to my webroot, I was able to browse this file. In case you didn’t know, all OpenBD’s settings are stored in a single xml file (which I find very convenient, by the way).

It didn’t work when going directly through Tomcat, i.e. browsing on port 8080 would not pull it up, I think Tomcat is smart enough to know not to serve files from the WEB-INF directory. But browsing through Apache on port 80 bypasses Tomcat for anything thats not a .cfm or .cfc file, so it would happily return the xml file. Datasource passwords are stored encrypted but the administrator password is clear text. Its easy to lock this down, just add this to your Apache config file:

<Location "/WEB-INF/">
deny from all
</Location>

‘Failed to retrieve style path’ error when adding a Verity collection

Friday, May 1st, 2009

When trying to create a Verity collection on a freshly setup ColdFusion8 installation today I received this error:

Unable to create collection MyCollection.
An error occurred while creating the collection: com.verity.api.administration.ConfigurationException: Failed to retrieve style path. (-6044)

Turns out the Verity installation did not complete correctly. I could tell by looking in the {cf-root}/verity/verity-install.log file. This problem is fixed by simply uninstalling and reinstalling verity.

In the {cf-root}/verity directory you’ll find a script named uninstall-verity.sh (on linux) or uninstall-verity.bat (on windows). Just run that and then run the install-verity.* file and you should be back in business.

Missing library errors when installing ColdFusion on Linux

Wednesday, April 29th, 2009

I was installing ColdFusion 7.02 on a client’s CentOS 5.2 Linux server the other day and received an error when running the installer. Note that this OS is NOT supported by Adobe for this version of ColdFusion. This is a fairly old version of CF being installed on a pretty current version of CentOS. The error was:

[root@server tmp]# ./coldfusion-702-linux.bin
Preparing to install...
Extracting the JRE from the installer archive...
Unpacking the JRE...
Extracting the installation resources from the installer archive...
Configuring the installer for this system's environment...
awk: error while loading shared libraries: libdl.so.2: cannot open shared object file: No such file or directory
dirname: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
/bin/ls: error while loading shared libraries: librt.so.1: cannot open shared object file: No such file or directory
basename: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
dirname: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
basename: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
Launching installer
grep: error while loading shared libraries: libc.so.6: cannot open shared object file: No such file or directory
/tmp/install.dir.3348/Linux/resource/jre/bin/java: error while loading shared libraries: libpthread.so.0: cannot open shared object file: No such file or directory

There is a hard coded value in the installer thats causing things to get messed up. Fixing this is fairly easy, you can modify the installer like this:

cp coldfusion-702-linux.bin coldfusion-702-linux.bin.backup
cat coldfusion-702-linux.bin.backup | sed "s/export LD_ASSUME/#xport LD_ASSUME/" > coldfusion-702-linux.bin

That comments out the offending line in all places in the installation script.

More discussion on this here:
http://www.billmitchell.org/coldfusion/centos5/mx7_apache.php
http://www.talkingtree.com/blog/index.cfm/2006/12/6/Running-ColdFusion-MX-7-on-Fedora-Core-6-Linux

You will probably run into more issues installing CF7 on this version of CentOS but it can be done. I also had to upgrade the connector to work with Apache 2.2 (when CF7 came out the connector was designed to run on Apache 2.0). The Adobe KB article that discusses this is here: http://kb.adobe.com/selfservice/viewContent.do?externalId=8001e97&sliceId=1. Their example didn’t quite work for me because its defaulting to the version of Java thats on your OS, which won’t work unless its a Sun 1.4.2x version. So I just used the JRE that is bundled with ColdFusion to install the new connector:

/opt/coldfusionmx7/runtime/jre/bin/java -Dtrace.ci=1 -jar ../../runtime/lib/wsconfig.jar \
        -server coldfusion \
    -ws apache \
        -dir /etc/httpd/conf \
        -bin /usr/sbin/httpd \
        -script /etc/rc.d/init.d/httpd \
        -coldfusion -v

I thought that was the last hurdle but when we tried to log in to the ColdFusion administrator we got an error about “The Graphing service is not available”. The message in the log file was “Unable to initialize Graphing service: java.lang.UnsatisfiedLinkError: /opt/coldfusionmx7/runtime/jre/lib/i386/libawt.so: libXp.so.6: cannot open shared object file: No such file or directory”. This was fixed by installing the libXp library:

yum install libXp

Fix for time off by half hour in Railo / BlueDragon on Tomcat

Saturday, April 11th, 2009

If you’ve installed Railo or OpenBD on Tomcat on Windows, you may have run into an issue where the times are off by 30 minutes or more. This issue will crop up in the timestamps displayed in Tomcat log files, as well as in your ColdFusion date values. ( #now()# for example).

This was very odd to me, I’ve encountered issues where time is off by +/- 1 hour many times before, due to daylight savings or timezone values, but never have I seen it off by half an hour.

But dumping out GetTimeZoneInfo() definitely shows that it is a timezone issue. Here is the output of GetTimeZoneInfo() on BlueDragon:

Blue Dragon - GetTimeZoneInfo() output

You can see the UTC offset is 4 hours and 30 minutes. Which is not correct for me - I’m in Central timezone, and we are currently in daylight savings, so my offset should be -5 hours. Hence my times being off by +30 minutes. BlueDragon isn’t showing us which timezone it actually thinks we are in, but we can get that by reaching down into Java:

<cfset tzobj = CreateObject("java","java.util.TimeZone")>
I think I am in this timezone: #tzobj.getDefault().getID()#

This displays: I think I am in this timezone: America/Caracas

A quick Google search shows me that America/Caracas does indeed have a -4:30 GMT offset. I had forgotten that not all locations have an offset of whole hours, some do include a 30 minute offset (it would be confusing to live there!)

Here is the output from GetTimeZoneInfo() on Railo:
GetTimeZoneInfo() output on Railo 3.1

The Railo output includes the timezone name, and we can see Railo thinks its in the America/Caracas timezone, too. So this tells me its definitely a Tomcat/JVM issue, and not just an issue with BlueDragon.

Google tells me there are several issues that can cause Java to not be able to correctly detect the timezone of the system its running on. None of them look like they have an easy fix. It is odd that the JVM got set to America/Caracas. Its supposed to set itself to GMT if it can’t detect the timezone. If someone has some more insight into this I’d like to hear it.
(more…)

Problems connecting to MySQL locally - try localhost instead of %

Sunday, August 24th, 2008

I’m setting up mysql locally on my laptop this weekend, and ran into a snag that cost me at least an hour. To mimic a web app I am running locally, I needed to connect to mysql with a specific username and password. But no matter what I did, I always got this error:

MySQL: access denied for user: username (Using password: YES)

I got this when connecting via the command line client and via ColdFusion. Finally after some googling I came across this blog post suggesting to change the privilege details to allow connecting from ‘localhost’ instead of ‘%’. The % indicates a wildcard and should allow connections from any host. But for some reason this was not working for me. Changing it to ‘localhost’ fixed the problem and allowed me to connect. I think it may have had something to do with the fact that I checked a box when installing that would only allow connections from the localhost.

I used this SQL to fix the host setting after connecting to the ‘mysql’ database:

update user set Host=’localhost’ where User=’myUserName’

Deleting all your .svn directories

Wednesday, July 2nd, 2008

Sometimes its necessary to delete all the .svn folders from your subversion working copy.

Here is a simple way to do it on Linux:

rm -rf `find . -name .svn`

That might not work if you have hundreds or thousands of folders, as it might be too many arguments for the rm command. I still like it because its simple. But a more robust way would be:

find . -name .svn -prune -exec rm -rf {} \;

This calls rm on each file separately.

I haven’t tried the following, but on Windows you may be able to:

Create a cleanSVN.cmd file in the root containing these lines:

for /f “tokens=* delims=” %%i in (’dir /s /b /a:d *svn’) do (
rd /s /q “%%i”
)

You could also try browsing to the files in Windows Exporer and then:
Right click on the folder and click Search..
Enter .svn as the filename to search for.
Click “More advanced options” and select:
- Search hidden files and folders
- Search subfolders
Press search button and delete the folders you find appropriate.

The Windows tips came from Axel’s blog at http://www.axelscript.com/2008/03/11/delete-all-svn-files-in-windows/

Require subversion comments - a perl pre-commit hook

Monday, June 16th, 2008

We’ve been having some issues with people committing to the subversion server without entering a comment. Its easy to to require a comment using a “pre-commit” hook, which is a script that runs before someone’s changes are committed to the repository. A sample commit hook is supplied with subversion that you can enable to require comments. The problem is it doesn’t report back any error message (users will just get a generic “commit failed” in their svn client), and there is no provision for making sure the comment is a minimum length.

I tried to modify the example script, but I’m pretty bad with shell scripting. I looked for a perl one, which I knew I could easily modify, but couldn’t find any. So I whipped this one up:
(more…)

Book Review - Apache Security

Thursday, October 11th, 2007

A few months ago I decided to go on a book binge and acquired a stack of books about two feet tall. It includes classics such as The Pragmatic Progammer and Practices of an Agile Developer, as well as some on Java, Asterisk, Extreme Programming, Linux Firewalls, and a NASCAR book thrown in for good measure.

I’ve gotten through a couple, and will be posting reviews of a few of them. This week I finished Apache Security, from O’Reilly. I found this book while browsing the programming section of Borders (the programming section of my local Borders is amazing!), and I’ve found it to be a real gem.
(more…)

Problems installing the ColdFusion connector on Linux/Apache

Thursday, April 5th, 2007

Some people have encountered problems during the ColdFusion MX 7 install on Linux/Apache. When you first start the ColdFusion server, you may see something like this:

Configuring the web server connector (Launched on the first run of the ColdFusion MX 7 start script)
Running apache connector wizard...
=======================================
There was an error while running the connector wizard
Connector installation was not successful

(more…)

Upgrading the ColdFusion JVM - on Linux and Windows

Saturday, February 24th, 2007

Unless you’ve been living on a desert island for the last year, you’ve probably heard that you’ll need to upgrade ColdFusion’s JVM (java virtual machine) before March 11th 2007. Thats when daylight savings time takes effect this year. Since the dates have shifted in 2007, anything that is aware of daylight savings time will require an update. This includes your operating system (Windows, Linux, OSX, etc.), and Java since it has its own internal timezone tables.

And if you use NTP (network time protocol) to set the time on your servers from an internet time server, don’t think you’re immune. NTP simply syncs your internal UTC (universal time) clock with a UTC clock on the internet. Your timezone tables then determine your actual local time, based on your UTC offset, which changes during daylight savings time.

Updating ColdFusion’s JVM is very easy. The version of java that ColdFusion ships with is 1.4.2_09. You can see this if you login to your CF Administrator, then click on SYSTEM INFORMATION at the top of the page.

CF Administrator - Java details
(more…)