What is mod_security?

Posted by Berin Loritsch Wed, 25 Jul 2007 23:09:00 GMT

It’s an Apache plugin designed to drastically cut down on spam. We’re talking referrer spam, comment spam, etc. It checks URL parts, submitted content, etc. I was quite surprised to find out about it, because I didn’t sign up for it. It was preconfigured with my host, TextDrive. I found out because I was writing a blog entry dealing with OpenID, and my personal plans for using it. When I submitted the article the server responded with a mysterious “Precondition Failed” message. I was sure Typo was to blame for it. Apparently there was something (I couldn’t tell you what right now) that caused mod_security to kick in and reject my post.

Rather than trying to find out what the protected words are, particularly since they will likely change, I’m going to try and have mod_security lifted only for the content editing portion of Typo. I really want it’s protection for comment spam and referrer spam. If it’s an all or nothing proposition (remember that Rails apps are proxied through Apache, and the .htaccess file is not read), then I will have to live with the mod_security restrictions.

I may have to resort to doing everything through the blog web service. We’ll see how it goes. So, if any of you types a comment and instead of seeing it on my blog you see some ominous “Precondition Failed” message it’s because you are trying to spam me! No seriously, it’s because you hit on a keyword that a bunch of spammers use.

Getting Typo 4.1.1 Installed on a Shared Host

Posted by Berin Loritsch Fri, 20 Jul 2007 12:52:00 GMT

Every shared host has their own procedures for getting a Rails app up and running.  The instructions that TextDrive has for installing a Rails application does a great job for them.  However there are a few gotchas that you need to be aware of.  First and foremost the installed version of Rails at TextDrive does not match what Typo 4.1.1 needs.  Not to mention that the quotas installed for users are pretty limiting for RAM usage.  You can't run gem update or install because it exceeds the memory allowed for a user (you can run gem list --local, but that's about it).  That means you can't use the preferred method for Typo installation!  Such a pain, but all is not lost.

Preparing the Typo Package

Typo needs Rails version 1.2.2 to function properly.  It needs at least 1.2.0, but I did find issues with 1.2.3 and I didn't have time to figure out what they where.  So, how do we publish an application that needs a different version of Rails than our host provides?  Thankfully the Rails folks already have a solution for that, which was designed to let you play with "EdgeRails" (or the latest trunk).  First, let's make sure you have the appropriate version of Rails installed on your local machine:

gem uninstall rails
gem install rails --version '= 1.2.2'

Now that the right version of rails is installed on your machine, we have to install it into the typo distribution.  Download the tarball from the Typo website, and unpack it on your machine:

tar xzf typo-4.1.1.tgz

With the command line, navigate into the distribution directory. The following command is probably a good idea no matter where you are publishing--particularly on a shared host. You don't have control over when your ISP decides to upgrade or change things. We are going to "Freeze" the version of rails to the gems you just installed on your machine.

rake rails:freeze:gems

Now you can repack the tar file. Go ahead and delete the old tarball before you pack it. The Rails app will have paths that are too long for the "old" style tar so you can't use the 'o' option. The following worked well:

tar czf typo-4.1.1.tgz typo-4.1.1

All you have to do at this point is upload the tarball to your account on your ISP. Unpack the tarball

Setting up the Database

The next step is to get the database up and running. Do whatever you need with your ISP to create a database for typo, and run the appropriate SQL script provided in the typo/db directory to set up the database schema. Next you'll have to configure the database.yml. The Typo team was good enough to provide an example configuration file. You just need to edit it to connect to your ISP's database instance. Just for safe keeping, do change the database name to the same thing for the development, test, and production configurations.

As a way to test the database connection, and to ensure everything is configured properly, you'll need to run the migrate task.

RAILS_ENV=production rake db:migrate

There's just a couple things left to do now.

Configure The Application

We need to make things easier on ourselves, so whether your ISP lets you set environment variables for running tasks or not, you'll want to uncomment the line to force the rails environment to production in the config/environment.rb file:

ENV['RAILS_ENV'] = 'production'

Also, because shared hosting is usually pretty limiting on your memory allocations, you'll want to disable any plugins that generate thumbnails. Find the line where the config/environment.rb file specifies plugins and edit it to look like this:

  config.plugins = [ 'localization',
    'typo_textfilter_tmcode' ]

Finally, most ISP instructions include changing the public/dispatch.* files so that the hashbang line has an explicit reference to your ISP's ruby interpreter. There's no guarantee that the env will find the ruby interpreter, and it removes one thing the machine has to do to get the app running.

Assuming the rest of the instructions from your ISP worked to get the app visible to the world, you will be able to go into the blog, create your username/password and manage the blog. I highly recommend keeping the sidebar simple. Only use static text, archives, syndication, and tags (and categories if you want) plugins when you have to share your host. The Magnolia and Flickr plugins generate thumbnails which look nice, but you'll run out of memory quick and the fastcgi process will die.

The Master of My Domain

Posted by Berin Loritsch Fri, 20 Jul 2007 01:07:00 GMT

I’ve grown tired of being at the mercy of someone else’s opinion of blog hosting. I’ve grown tired of JRoller, and having my identity and my content out of my control. I’ve finally got my new blog software hosted on my own ISP. If there is something wrong I’m the one to blame. The good news is that I’m not going to have a service one day and then have it revoked the next.

I’ll post the details of how I got Typo working on TextDrive, because it was an ordeal. I’ll just do it in an article of its own. So why Typo and not one of the other blog applications? Partly, because I wanted to do something with Ruby on Rails but mostly because it was the most complete blogging tool I could find for the platform. I needed RSS feeds, XMLRPC support for blog posting clients, tagging, AJAX support, etc. Typo had all that out of the box.

All that remains is to properly customize my theme. I’m taking the opportunity to change everything. The blog is now “Software Artisan” to reflect the evolution of how I approach software projects. It will still be the eclectic view into my life, but instead of neatly compartmentalizing everything, I’m tagging it. I hope to get some really cool stuff here in the future. I’m debating whether I should just make a clean break from my past, or if I should attempt to import my old articles. I may import as many as fit on my old feed, and let the rest simply disappear. It’s a new blog, with a new history. It’s my content.

Yoroshiku Onegai Shimasu (Please be kind to me)