Web Server - Revision history

imported>Lmperry at 20:47, 15 January 2014

2014-01-15T20:47:52Z

← Older revision		Revision as of 20:47, 15 January 2014
Line 1:		Line 1:
	The web server is based on a ~~[[FreeBSD\|standard FreeBSD 8~~.~~2 installation]]~~ with the following additional configuration.		The web server is based on a Ubuntu 12.04 server machine with the following additional configuration.


	== Apache, etc. ==		== Apache, etc. ==
	~~portmaster devel/git~~ # ~~disable everything but ICONV, CURL~~		## Install packages
	# ~~ftp/curl: disable IPV6, PROXY~~		apt-get install apache2 php5 libapache2-mod-wsgi libapache2-webauth mysql-server php5-mysql php5-gd
	~~portmaster net/rsync~~

	~~portmaster www/apache22 # enable THREADS, SQLITE; disable IPV6, DAV, DAV_FS~~
	~~# for proxying: enable PROXY, PROXY_HTTP~~
	~~# devel/apr1: enable SQLITE; disable IPV6, BDB, GDBM~~
	~~# lang/python27: disable IPV6~~
	~~portmaster www/mod_wsgi3~~
	~~portmaster lang/~~php5-~~extensions # lang/~~php5~~: enable APACHE; disable CGI, IPV6~~


	~~sed~~ -~~E -i~~ -~~e 's/(.*DirectoryIndex) (index.html)/\1 index.php \2/' /usr/local/etc/apache22/httpd.conf~~

	~~cat << EOF >> /usr/local/etc/apache22/httpd.conf~~

	~~<IfModule php5_module>~~		## Configure
	~~AddType application/x-httpd-php .php~~
	~~AddType application/x-httpd-php-source .phps~~
	~~</IfModule>~~
	~~EOF~~

	~~## by hand:~~
	## update AllowOverride for DocumentRoot to 'AllowOverride All'		## update AllowOverride for DocumentRoot to 'AllowOverride All'
	## update Options for DocumentRoot to 'Options FollowSymLinks'		## update Options for DocumentRoot to 'Options FollowSymLinks'
	vim /~~usr~~/~~local~~/etc/~~apache22~~/~~httpd.conf~~		vim /etc/apache2/sites-enabled/000-default
			vim /etc/apache2/sites-enabled/default-ssl

	~~echo 'apache22_enable="YES"' >> /etc/rc.conf~~
	~~/usr/local/etc/rc.d/apache22 start~~

	== WebAuth ==		== WebAuth ==
	~~portmaster security/krb5~~ # ~~disable KRB5_DOC, WANT_HTML~~
	~~fetch -o /etc http~~://~~www~~.stanford.edu/~~dept~~/~~its~~/~~support~~/~~kerberos~~/~~dist/krb5~~.~~conf~~		## Apache config for webauth
			echo 'WebAuthLoginURL https://weblogin.stanford.edu/login/' >> /etc/apache2/conf.d/webauth
	~~portmaster net~~/~~openldap24-sasl-client~~		echo 'WebAuthWebKdcURL https://weblogin.stanford.edu/webkdc-service/' >> /etc/apache2/conf.d/webauth
	~~fetch http~~://~~webauth~~.stanford.edu/~~dist/webauth-3.7.4.tar.gz~~		echo 'WebAuthWebKdcPrincipal service/webkdc@stanford.edu' >> /etc/apache2/conf.d/webauth
	~~tar xf webauth-3.7.4.tar.gz~~		a2enmod webauth
	~~cd webauth~~-~~3.7.4~~		service apache2 restart
	./~~configure --with-krb5=~~/~~usr~~/~~local --with-ldap=~~/~~usr~~/~~local~~
	~~make~~
	~~make check # krb5, wa_keyring, xmalloc skipped; krb5-tgt ABORTED~~
	~~make install~~
	~~cp conf~~/stanford-*.~~conf~~ /~~usr~~/~~local~~/~~etc~~/~~apache22/Includes~~

	## generate keytab on corn; http://webauth.stanford.edu/install-stanford.html		## generate keytab on corn; http://webauth.stanford.edu/install-stanford.html
	ssh gsfr@corn 'wallet -f keytab.cniwww get keytab webauth/cniwww.stanford.edu'		ssh gsfr@corn 'wallet -f keytab.cniwww get keytab webauth/cniwww.stanford.edu'
Line 64:		Line 42:
	sed -E -i "" -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-ldap.conf		sed -E -i "" -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-ldap.conf

	~~/usr/local/etc/rc.d/apache22~~ restart		service apache2 restart

	== MediaWiki ==		== MediaWiki (OLD) ==
	portmaster lang/php5-extensions		portmaster lang/php5-extensions

imported>Gsfr: /* Apache, etc. */

2012-01-27T21:09:12Z

Apache, etc.

← Older revision		Revision as of 21:09, 27 January 2012
Line 27:		Line 27:
	## update AllowOverride for DocumentRoot to 'AllowOverride All'		## update AllowOverride for DocumentRoot to 'AllowOverride All'
	## update Options for DocumentRoot to 'Options FollowSymLinks'		## update Options for DocumentRoot to 'Options FollowSymLinks'
			vim /usr/local/etc/apache22/httpd.conf

	echo 'apache22_enable="YES"' >> /etc/rc.conf		echo 'apache22_enable="YES"' >> /etc/rc.conf

imported>Gsfr at 01:19, 7 July 2011

2011-07-07T01:19:10Z

← Older revision		Revision as of 01:19, 7 July 2011
Line 11:		Line 11:
	# lang/python27: disable IPV6		# lang/python27: disable IPV6
	portmaster www/mod_wsgi3		portmaster www/mod_wsgi3
	portmaster lang/php5-extensions # lang/php5: enable APACHE; disable IPV6		portmaster lang/php5-extensions # lang/php5: enable APACHE; disable CGI, IPV6

imported>Gsfr: /* WebAuth */ streamlined configuration procedure

2011-07-05T02:22:10Z

WebAuth: streamlined configuration procedure

← Older revision		Revision as of 02:22, 5 July 2011
Line 39:		Line 39:
	tar xf webauth-3.7.4.tar.gz		tar xf webauth-3.7.4.tar.gz
	cd webauth-3.7.4		cd webauth-3.7.4
	./configure --with-krb5=/usr/local --with-ldap=/usr/local make		./configure --with-krb5=/usr/local --with-ldap=/usr/local
			make
	make check # krb5, wa_keyring, xmalloc skipped; krb5-tgt ABORTED		make check # krb5, wa_keyring, xmalloc skipped; krb5-tgt ABORTED
	make install		make install
Line 46:		Line 47:
	## generate keytab on corn; http://webauth.stanford.edu/install-stanford.html		## generate keytab on corn; http://webauth.stanford.edu/install-stanford.html
	ssh gsfr@corn 'wallet -f keytab.cniwww get keytab webauth/cniwww.stanford.edu'		ssh gsfr@corn 'wallet -f keytab.cniwww get keytab webauth/cniwww.stanford.edu'

	## scp keytab to /usr/local/etc/apache22/conf/webauth/keytab (must create conf/webauth)		## scp keytab to /usr/local/etc/apache22/conf/webauth/keytab (must create conf/webauth)
	mkdir -p /usr/local/etc/apache22/conf/webauth		mkdir -p /usr/local/etc/apache22/conf/webauth
	~~cd /usr/local/etc/apache22/conf/webauth~~		chown www:www !$
	scp gsfr@corn:keytab.cniwww keytab		scp gsfr@corn:keytabs/keytab.cniwww !$/keytab
			chmod 640 !$

	cd /usr/local/etc/apache22		cd /usr/local/etc/apache22
	openssl req -new -x509 -newkey rsa:2048 -nodes -days 3652 -keyout server.key -out server.crt # self-signed cert; common name is FQDN		openssl req -new -x509 -newkey rsa:2048 -nodes -days 3652 -keyout server.key -out server.crt # self-signed cert; common name is FQDN
	openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr # cert signing request (not required)		openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr # cert signing request (not required)
			chmod 400 server.key

	sed -E -i "" -e 's!#(Include.*httpd-ssl.conf)!\1!' httpd.conf		sed -E -i "" -e 's!#(Include.*httpd-ssl.conf)!\1!' httpd.conf
Line 59:		Line 63:
	sed -E -i "" -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-ldap.conf		sed -E -i "" -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-ldap.conf

	/usr/local/etc/rc.d/apache22 ~~graceful~~		/usr/local/etc/rc.d/apache22 restart

	~~chgrp www conf/webauth~~
	~~chmod 775 conf/webauth~~

	~~chgrp www conf/webauth/keytab~~
	~~chmod 640 conf/webauth/keytab~~

	~~touch conf/webauth/keyring~~
	~~chgrp www conf/webauth/keyring~~
	~~chmod 660 conf/webauth/keyring~~

	~~## enable WebAuthDebug and /webauth-status in Includes/stanford-webauth.conf, then~~
	~~/usr/local/etc/rc.d/apache22 graceful~~

	~~## visit /webauth-status in browser and ensure all check are ok~~

	~~## disable WebAuthDebug and /webauth-status in Includes/stanford-webauth.conf, then~~
	~~/usr/local/etc/rc.d/apache22 graceful~~

	== MediaWiki ==		== MediaWiki ==

imported>Gsfr: /* Apache, etc. */ switched apache from worker to prefork

2011-06-10T18:34:39Z

Apache, etc.: switched apache from worker to prefork

← Older revision		Revision as of 18:34, 10 June 2011
Line 6:		Line 6:
	portmaster net/rsync		portmaster net/rsync

	portmaster www/apache22~~-worker-mpm~~ # enable THREADS, SQLITE; disable IPV6, DAV, DAV_FS		portmaster www/apache22 # enable THREADS, SQLITE; disable IPV6, DAV, DAV_FS
			# for proxying: enable PROXY, PROXY_HTTP
	# devel/apr1: enable SQLITE; disable IPV6, BDB, GDBM		# devel/apr1: enable SQLITE; disable IPV6, BDB, GDBM
	# lang/python27: disable IPV6		# lang/python27: disable IPV6
Line 24:		Line 25:

	## by hand:		## by hand:
	## update AllowOverride for DocumentRoot to 'AllowOverride ~~Options FileInfo AuthConfig~~'		## update AllowOverride for DocumentRoot to 'AllowOverride All'
	## update Options for DocumentRoot to 'Options FollowSymLinks'		## update Options for DocumentRoot to 'Options FollowSymLinks'

imported>Gsfr: /* WebAuth */ adding support for ldap access

2011-06-06T22:30:01Z

WebAuth: adding support for ldap access

← Older revision		Revision as of 22:30, 6 June 2011
Line 34:		Line 34:
	fetch -o /etc http://www.stanford.edu/dept/its/support/kerberos/dist/krb5.conf		fetch -o /etc http://www.stanford.edu/dept/its/support/kerberos/dist/krb5.conf

	~~git clone git~~://~~git~~.~~eyrie~~.~~org~~/~~kerberos~~/webauth.~~git~~		portmaster net/openldap24-sasl-client
	cd webauth		fetch http://webauth.stanford.edu/dist/webauth-3.7.4.tar.gz
	.~~/autogen~~		tar xf webauth-3.7.4.tar.gz
	./configure --~~disable~~-~~mod_webauthldap~~ --with-~~krb5~~=/usr/local		cd webauth-3.7.4
	make		./configure --with-krb5=/usr/local --with-ldap=/usr/local make
	make check # krb5, wa_keyring, xmalloc skipped; krb5-tgt ABORTED		make check # krb5, wa_keyring, xmalloc skipped; krb5-tgt ABORTED
	make install		make install
	cp conf/stanford-~~webauth~~.conf /usr/local/etc/apache22/Includes		cp conf/stanford-*.conf /usr/local/etc/apache22/Includes

	## generate keytab on corn; http://webauth.stanford.edu/install-stanford.html		## generate keytab on corn; http://webauth.stanford.edu/install-stanford.html
Line 54:		Line 54:
	openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr # cert signing request (not required)		openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr # cert signing request (not required)

	sed -E -i -e 's!#(Include.*httpd-ssl.conf)!\1!' httpd.conf ~~# enable ssl for apache~~		sed -E -i "" -e 's!#(Include.*httpd-ssl.conf)!\1!' httpd.conf
	sed -E -i -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-webauth.conf		sed -E -i "" -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-webauth.conf
			sed -E -i "" -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-ldap.conf

	/usr/local/etc/rc.d/apache22 graceful		/usr/local/etc/rc.d/apache22 graceful
Line 76:		Line 77:
	## disable WebAuthDebug and /webauth-status in Includes/stanford-webauth.conf, then		## disable WebAuthDebug and /webauth-status in Includes/stanford-webauth.conf, then
	/usr/local/etc/rc.d/apache22 graceful		/usr/local/etc/rc.d/apache22 graceful


	== MediaWiki ==		== MediaWiki ==

imported>Gsfr: /* Apache, etc. */

2011-04-26T04:57:34Z

Apache, etc.

← Older revision		Revision as of 04:57, 26 April 2011
Line 26:		Line 26:
	## update AllowOverride for DocumentRoot to 'AllowOverride Options FileInfo AuthConfig'		## update AllowOverride for DocumentRoot to 'AllowOverride Options FileInfo AuthConfig'
	## update Options for DocumentRoot to 'Options FollowSymLinks'		## update Options for DocumentRoot to 'Options FollowSymLinks'

			echo 'apache22_enable="YES"' >> /etc/rc.conf
			/usr/local/etc/rc.d/apache22 start

	== WebAuth ==		== WebAuth ==

imported>Gsfr at 04:35, 26 April 2011

2011-04-26T04:35:19Z

← Older revision		Revision as of 04:35, 26 April 2011
Line 41:		Line 41:
	cp conf/stanford-webauth.conf /usr/local/etc/apache22/Includes		cp conf/stanford-webauth.conf /usr/local/etc/apache22/Includes

	# generate keytab on corn; http://webauth.stanford.edu/install-stanford.html		## generate keytab on corn; http://webauth.stanford.edu/install-stanford.html
	ssh gsfr@corn 'wallet -f keytab.cniwww get keytab webauth/cniwww.stanford.edu'		ssh gsfr@corn 'wallet -f keytab.cniwww get keytab webauth/cniwww.stanford.edu'
	# scp keytab to /usr/local/etc/apache22/conf/webauth/keytab (must create conf/webauth)		## scp keytab to /usr/local/etc/apache22/conf/webauth/keytab (must create conf/webauth)
	mkdir -p /usr/local/etc/apache22/conf/webauth; cd /usr/local/etc/apache22/conf/webauth		mkdir -p /usr/local/etc/apache22/conf/webauth
			cd /usr/local/etc/apache22/conf/webauth
	scp gsfr@corn:keytab.cniwww keytab		scp gsfr@corn:keytab.cniwww keytab

Line 54:		Line 55:
	sed -E -i -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-webauth.conf		sed -E -i -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-webauth.conf

	/usr/local/etc/rc.d/apache22 ~~start~~		/usr/local/etc/rc.d/apache22 graceful

	chgrp www conf/webauth		chgrp www conf/webauth
Line 65:		Line 66:
	chgrp www conf/webauth/keyring		chgrp www conf/webauth/keyring
	chmod 660 conf/webauth/keyring		chmod 660 conf/webauth/keyring

			## enable WebAuthDebug and /webauth-status in Includes/stanford-webauth.conf, then
			/usr/local/etc/rc.d/apache22 graceful

			## visit /webauth-status in browser and ensure all check are ok

			## disable WebAuthDebug and /webauth-status in Includes/stanford-webauth.conf, then
			/usr/local/etc/rc.d/apache22 graceful

imported>Gsfr: /* MediaWiki */

2011-04-23T18:56:48Z

MediaWiki

← Older revision		Revision as of 18:56, 23 April 2011
Line 87:		Line 87:
	sed -E -i -e 's/(\$wgAuthRemoteuserMailDomain =).*/\1 "stanford.edu";/' extensions/Auth_remoteuser.php		sed -E -i -e 's/(\$wgAuthRemoteuserMailDomain =).*/\1 "stanford.edu";/' extensions/Auth_remoteuser.php
	sed -E -i -e 's/(.)static( function getCanonicalName.)/\1\2/' extensions/Auth_remoteuser.php		sed -E -i -e 's/(.)static( function getCanonicalName.)/\1\2/' extensions/Auth_remoteuser.php

			## update stanfordmodern1: monospace code; slightly darker box background
			sed -E -i -e $'s!code {!& \\\n\tfont-family: monospace;!' skins/stanfordmodern1/main.css
			sed -E -i -e 's/f9f9f9/e5e5e5/g' skins/stanfordmodern1/main.css

	=== configure [http://www.mediawiki.org/wiki/Manual:Short_URL short URLs] ===		=== configure [http://www.mediawiki.org/wiki/Manual:Short_URL short URLs] ===

imported>Gsfr at 06:02, 21 April 2011

2011-04-21T06:02:52Z

← Older revision		Revision as of 06:02, 21 April 2011
Line 13:		Line 13:


	sed -E -i '' -e 's/(.*DirectoryIndex) (index.html)/\1 index.php \2/' /usr/local/etc/apache22/httpd.conf		sed -E -i -e 's/(.*DirectoryIndex) (index.html)/\1 index.php \2/' /usr/local/etc/apache22/httpd.conf

	cat << EOF >> /usr/local/etc/apache22/httpd.conf		cat << EOF >> /usr/local/etc/apache22/httpd.conf
Line 23:		Line 23:
	EOF		EOF

	## by hand, update AllowOverride for DocumentRoot to 'AllowOverride Options AuthConfig'		## by hand:
			## update AllowOverride for DocumentRoot to 'AllowOverride Options FileInfo AuthConfig'
			## update Options for DocumentRoot to 'Options FollowSymLinks'


	== WebAuth ==		== WebAuth ==
	portmaster security/krb5 # disable KRB5_DOC, WANT_HTML		portmaster security/krb5 # disable KRB5_DOC, WANT_HTML
	fetch -o /etc~~/krb5.conf~~ http://www.stanford.edu/dept/its/support/kerberos/dist/krb5.conf		fetch -o /etc http://www.stanford.edu/dept/its/support/kerberos/dist/krb5.conf

	git clone git://git.eyrie.org/kerberos/webauth.git		git clone git://git.eyrie.org/kerberos/webauth.git
Line 49:		Line 51:
	openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr # cert signing request (not required)		openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr # cert signing request (not required)

	sed -E -i '' -e 's!#(Include.*httpd-ssl.conf)!\1!' httpd.conf # enable ssl for apache		sed -E -i -e 's!#(Include.*httpd-ssl.conf)!\1!' httpd.conf # enable ssl for apache
	sed -E -i '' -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-webauth.conf		sed -E -i -e 's!(WebAuth.* )(conf/webauth/[a-z_]+)!\1etc/apache22/\2!' Includes/stanford-webauth.conf

	/usr/local/etc/rc.d/apache22 start		/usr/local/etc/rc.d/apache22 start
Line 68:		Line 70:
	portmaster lang/php5-extensions		portmaster lang/php5-extensions

	# place a recent copy of MediaWiki in /usr/local/www/apache22/data/cniwiki		## place a recent copy of MediaWiki in /usr/local/www/apache22/data/cniwiki
	# get ~~Auth_remoteuser extension from~~ http://www.~~mediawiki~~.~~org~~/~~wiki~~/~~Extension:AutomaticREMOTE_USER~~		## get Stanford Modern skin: http://www.stanford.edu/dept/its/communications/webservices/wiki/index.php/Stanford_Modern_MediaWiki_Skin
	~~# https:~~//~~techcommons.stanford.edu~~/~~topics~~/~~mediawiki~~/~~mediawiki-installation-instructions~~

	cd /usr/local/www/apache22/data/cniwiki		cd /usr/local/www/apache22/data/cniwiki
	~~cp ~~~/Auth_remoteuser/Auth_remoteuser.php ~~extensions/~~		fetch -o extensions http://svn.wikimedia.org/svnroot/mediawiki/trunk/extensions/Auth_remoteuser/Auth_remoteuser.php
	cp -R ~/MWSkin_StanfordModern/stanfordmodern1* skins/		cp -a ~/MWSkin_StanfordModern/stanfordmodern1* skins/
	chown -R root:wheel .		chown -R root:wheel .
	chmod a+w config		chmod a+w config

	# set up wiki in browser; warning re session.save_path is fine		## set up wiki in browser; warning re session.save_path is fine
	mv config/LocalSettings.php .		mv config/LocalSettings.php .
	chmod 600 LocalSettings.php		chmod 600 LocalSettings.php
	rm -r config		rm -r config

	sed -E -i '' -e 's/(^\$wgDefaultSkin =) .*/\1 "stanfordmodern1";/' LocalSettings.php		sed -E -i -e 's/(^\$wgDefaultSkin =) .*/\1 "stanfordmodern1";/' LocalSettings.php
	sed -E -i '' -e 's/(\$wgAuthRemoteuserMailDomain =).*/\1 "stanford.edu";/' extensions/Auth_remoteuser.php		sed -E -i -e 's/(\$wgAuthRemoteuserMailDomain =).*/\1 "stanford.edu";/' extensions/Auth_remoteuser.php
	sed -E -i '' -e 's/(.)static( function getCanonicalName.)/\1\2/' extensions/Auth_remoteuser.php		sed -E -i -e 's/(.)static( function getCanonicalName.)/\1\2/' extensions/Auth_remoteuser.php

	=== configure [http://www.mediawiki.org/wiki/Manual:Short_URL short URLs] ===		=== configure [http://www.mediawiki.org/wiki/Manual:Short_URL short URLs] ===
Line 114:		Line 115:

	=== WebAuth for editing (OR see below) ===		=== WebAuth for editing (OR see below) ===
			## https://techcommons.stanford.edu/topics/mediawiki/anonymous-read-webauth-editing-mediawiki

	fetch https://github.com/mistermarco/mediawiki-webauth/raw/master/login.php		fetch https://github.com/mistermarco/mediawiki-webauth/raw/master/login.php
	fetch -o extensions/WebAuth.php https://github.com/mistermarco/mediawiki-webauth/raw/master/extensions/WebAuth.php		fetch -o extensions/WebAuth.php https://github.com/mistermarco/mediawiki-webauth/raw/master/extensions/WebAuth.php
Line 129:		Line 132:

	=== WebAuth for viewing (OR see above) ===		=== WebAuth for viewing (OR see above) ===
			## https://techcommons.stanford.edu/topics/mediawiki/mediawiki-installation-instructions

	echo "AuthType WebAuth" >> .htaccess		echo "AuthType WebAuth" >> .htaccess
	echo "Require valid-user" >> .htaccess		echo "Require valid-user" >> .htaccess