Linux web hosting and server support tips

Category: Linux server

Upgrading OpenSSH on CentOS 5 server

Upgrading openssh

RHEL5 and CentOS 5 run an older version of ssh, which makes doing a chroot sftp or scp more difficult.

Pre-requisites:=

You need to have following packages and it’s dependencies installed:-

Yum install -y rpm-devel rpm-build pam pam-devel perl openssl-devel tcp-wrappers

Steps:-

It is not recommended to build RPM as root user.

1. Login to server using SSH as a normal user.
2. In your home directory create a file .rpmmacros and add following entires to ot.

%_topdir %(echo $HOME)/rpmbuild

3. Next step is creating the build environment. In your home directory, create following directories:-

$mkdir rpmbuild
$cd rpmbuild
$mkdir BUILD RPMS SOURCES SPECS SRPMS

4. Download the latest openssh from their site. http://filedump.se.rit.edu/pub/OpenBSD/OpenSSH/portable/
5. Once it is downloaded, copy the tarball to the rpmbuild/SOURCES directory that you made.
6. You will also need to extract the tarball and copy over the spec file.

$tar xvf openssh-.tar.gz
$cd openssh-
$cp contrib/redhat/openssh.spec $HOME/rpmbuild/SPECS
$cd ..
$cp openssh-.tar.gz rpmbuild/SOURCES

7. Edit the spec file(HOME/rpmbuild/SPECS/openssh.spec).

Also change

%define no_x11_askpass 0
from 0 to 1. We don’t need the X11 accessories for this.

Do the same with

%define no_gnome_askpass 0
for the same reason. Lastly, comment out the line

%define build6x 0
As we’re not building for RHEL6.

8. Build rpm. In $HOME/rpmbuild/SPECS run the following command:-

$rpmbuild -ba openssh.spec
The above command should build and create several rpms in $HOME/rpmbuild/RPMS/i386

9. In the i386 directory holding the rpms run,

$rpm -Uvh openssh*
It should update openssh, openssh-server, and openssh-clients.

10. It will also create a new file in /etc/ssh called sshd_config.rpmnew. Make sure you have a copy of your old sshd_config. The rest of this will be done as root or with root privilege.

#cd /etc/ssh
#cp sshd_config sshd_config.orig
#mv sshd_config.rpmnew sshd_config

11. Restart the SSH service.

#/etc/init.d/sshd restart or
#service sshd restart

Check the versions of the OpenSSH installed

#rpm -qa | grep openssh

Distributed Denial of service(DDOS)

A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer or network resource unavailable to its intended users. The speciality of the DDOS is that, it relays attacks not from a single network/host like DOS. The DDOS attack will be launched from different dynamic networks which has already been compromised.

Types:-

Ping of death :-
Attacker deliverately sending a ping packet, normally 64 bytes, that is larger than the 65,535 bytes. Many computer systems cannot handle an IP packet larger than the maximum IP packet size of 65,535, and often causes computer systems crash. A ping packet of size greater than 65,535, can be sent if it is fragmented.When a receiving computer reassembles the packet, a buffer overflow occurs, which often causes computer to crash.

Ping of flood:-
An attacker overwhelming the victim’s network with ICMP Echo Request (ping) packets. A flood of ping traffic can consume singificant bandwidth on low to mid-speed networks bringing down a network to a crawl.

Smurf Attack:-
Smurf attack exploits the target by sending repeated ping request to broadcast address of the target network. The ping request packet often uses forged IP address (return address), which is the target site that is to receive the denial of service attack. The result will be lots of ping replies flooding back to the innocent, spoofed host. If number of hosts replying to the ping request is large enough, the network will no longer be able to receive real traffic.

SYN Floods :-
When establishing a session between TCP client and server, a hand-shaking message exchange occurs betwen a server and client. A session setup packet contains a SYN field that identifies the sequence in the message exchange. An attacker may send a flood of connection request and do not respond to the replies, which leaves the request packets in the buffer so that legitimate connection request can’t be accommodated.

Teardrop Attack :-
Teardrop attack exploits by sending IP fragment packets that are difficult to reassemble. A fragment packet identifies an offset that is used to assemble the entire packet to be reassembled by the receiving system. In the teardrop attack, the attacker’s IP puts a confusing offset value in the sebsequent fragments and if the receiving system doesn’t know how to handle such situation, it may cause the system to crash.

Prevetion:-

1. Install Intrusion Detection System (IDS)
2. Implement Sysctl. Prevent ping attacks (ping of death, ping of flood, and smurf attacks) by disabling ping responses on the network machines. Enable IP Spoofing protection, and TCP SYN Cookie Protection.
3. Install advanced firewall and DDoS utilities.
4. Install Apache mod_evasive and mod_security modules to protect against HTTP DDoS attacks.

Mod_security:-
Since DDOS normally targets HTTP. Its always good to have a filtering system for apache . So that the request gets analyzed before web server handles it.

Mod_evasive:-
Detection is performed by creating an internal dynamic hash table of IP Addresses and URIs, and denying any single IP address from any of the following:

1. Requesting the same page more than a few times per second
2. Making more than 50 concurrent requests on the same child per second
3. Making any requests while temporarily blacklisted (on a blocking list)

Note:-
1. Well there are no 100% prevention or protection against DDOS.
2. This steps won’t be enough if the DDOS attack is of very high volume.

How dns works

A DNS client “resolves” an IP address by sending a specially formatted request to a DNS server. The client has to know the address of one or more DNS servers in advance. The reply from the server may be a direct reply with the IP address associated with the hostname, a referral to another DNS server, or a response indicating the requested name can’t be found in DNS.

Typically, the request will ask the server to “recursive“, i.e. if it cannot answer the question from its own local memory, it should go ask other servers on behalf of the client. This behavior helps the local server build up its own cache of addresses frequently looked up.

Another form of query is called iterative query, where a client machine sends the request to a known DNS server , if that DNS server fail to resolve the domain name into a IP, then the client sends the request to another DNS and this process goes on and on until it get the required IP resolution by sending address resolution request to all its known DNS.If every known DNS fail to give the IP, then client goes to the root domain.

When you type a URL into your browser, it uses the following steps to locate the correct website:

A DNS client uses a resolver to request resolution of a host name to an IP address. The resolver is really just a special-purpose application that’s sole function is to act as an intermediary between name servers and various applications that need name resolution, such as Web browsers, e-mail applications, and so on. Here’s an example: Assume you fire up your browser and direct it to connect to www.mysite.com.

1. Your browser checks it’s cache (memory) to see if it knows which IP address the domain name resolves to. If it knows, it will resolve it and display the web page.
2. If the domain name is unable to be resolved, the browser will check your hosts file for a DNS entry.
3. If there’s no entry in the hosts file, the browser will check the default DNS server (specified via your computer’s network settings, /etc/resolv.conf). This is usually your ISP’s DNS server or your employer’s. If the default DNS server has an entry for that domain name, the browser will display the applicable website.
4. If the default name server has no cached results, it sends a DNS query to the root server for the .com domain.
5. The root server responds with the addresses of the name servers that are authoritative for the mysite.com domain.
6. Your ISP’s name server then builds another request for www.mysite.com and submits it to mysite.com’s name server, which responds with the IP address of www.mysite.com.
7. That information is passed back to your resolver, which passes it to your application.

Install SSL certificate in Ubuntu Nginx server

Prerequisites:-

OS: Ubuntu
Web Server: Nginx
Tools: openssl

Assumptions:-

1. You need to login to server using SSH for issuing various commands
2. Name of the domain name which needs the certification: mydomain.com
3. Private key File: mydomain.com.key
4. CSR : mydomain.com.csr 5. Cert FIle :mydomain.com.cert

Steps:-

1. Generate a RSA private key.
2. Generate Certificate Signing Request(CSR) using the private key.
3. Purchase a Valid SSL Certificate from a Certificate Authority(CA). The CSR needs to be provided to CA.
4. Verify that Private Key Matches Certificate
5. Copy the Certificate to server and make necessary changes.

Generate the Private Key

We are generating 2048 bit RSA key. Login to the server and issue following commands
#openssl genrsa -out mydomain.com.key 2048
This will create the key file mydomain.com.key

Generate the CSR

You must use the key file you created above to make the CSR file. Run the following command:-
#openssl req -new -key mydomain.com.key -out mydomain.com.csr

You need to enter the following details while generating CSR:-
Country Name (2 letter code) [GB]:
State or Province Name (full name) [Berkshire]:
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server’s hostname) []:
Email Address []:

Purchase a Valid SSL

You need to purchase a valid SSL certificate from anyone of the CA. You will have to provide the CSR to CA. SO the CA will provide you the mydomain.com.cert.

Verifying that a Private Key Matches a Certificate

In order to SSL work correctly, the certificate and the private key should match. Otherwise the SSL won’t work. You can issue the following commands to check the md5 of the files. The MD5 values of all the files MUST be same.
#openssl x509 -noout -modulus -in mydomain.com.cert | openssl md5
#openssl rsa -noout -modulus -in mydomain.com.key | openssl md5
#openssl req -noout -modulus -in mydomain.com.csr | openssl md5

Install the Certificate

In Nginx server, normally the SSL certificates are placed under “/etc/nginx/certs” Directory. So copy Key, CSR and Cert files to this directory. Now you need edit the vhost file for the mydomain.com and specify the certificate files. In our case the included vhost file is “/etc/nginx/sites-enabled/mydomain.com“. Please check your “nginx.conf” for the locations of vhost files. Now open the “/etc/nginx/sites-enabled/mydomain.com” and add the following entries to the file:-

ssl on;
ssl_certificate /etc/nginx/certs/mydomain.com.cert;
ssl_certificate_key /etc/nginx/certs/mydomain.com.key;

Please make sure that you have placed the above code inside the server ( } Directive. Restart the nginx service. That is all needed. Now the new certificate must be loaded successfully.

Note:-

Always keep a backup of the private key used for creating the SSL Certificate file. This file is needed while you transfer your account or re- install the certificate. If the key is lost, you need to generate a new key, CSR and buy a fresh new SSL certificate.

Case insensitive url Aapche Webserver

How to enable Case-Insensitive url’s ?

Webserver: Apache

OS: Linux

One of our customer had opened ticket. He has a very interesting need. He wants his site urls  to be Case-insensitive . I will explain with examples:- He needs the following urls to work currently he is getting 404 errors for each request.

http://yourdomain.com/Yourpage.html

http://yourdomain.com/YourPage.html

We were unable to add rewrite rules in his htaccess files as we need to write rule for every single file that has a mixture of upper and lower case.

http://yourdomain.com/yourpage.html => This is the correct url

He needs this url http://yourdomain.com/Yourpage.html to load even if they have one spelling mistake or there is one capitalization error. This was found very strange. We have managed to fix the issue by adding an apache module server wide, which neutralise all the the upper case and lower case characters to a single format.

Solution: If you want requested URLs to be valid whether uppercase or lowercase letters are used and with one spelling mistake, “mod_speling” module needs to be enabled in apache.

The mod_speling module is part of the standard Apache distribution but is not enabled by default, so you need to explicitly enable it. When mod_speling is installed, it may be turned on for a particular scope (such as a directory, virtual host, or the entire server) by setting the CheckSpelling directive to On.

For making URL case-insensitive in cPanel:

First run belwow on Cpanel based server : /scripts/easyapache And select ‘Spelling’ from the available module list for apache. Once apache/php are recompiled with this option and easyapache finishes, you can put below code in the .htaccess or in the virtual host entry of the particular domain to apply it to any directory/directories :

< IfModule mod_speling.c > CheckCaseOnly On CheckSpelling On < / IfModule > This helped to fix this particular issue

Verify PHP/cURL is working correctly

Simply, cURL is a command line tool for getting or sending files using URL syntax. It supports a range of common Internet protocols, including HTTP, FTP, SCP, SFTP, TFTP, TELNET, FILE, IMAP, POP3, SMTP and RTSP, etc. The command is designed to work without user interaction.

Usage:-

Basic use of cURL involves simply typing curl at the command line, followed by the URL of the output to retrieve.
To retrieve the google.com homepage, type:
curl www.google.com
What is PHP/CURL?
The module for PHP that makes it possible for PHP programs to access curl-functions from within PHP.

How to verify cURL is working correctly?.

cURL does have very powerfull functions which inturn not used properly may leads to complete breakdown of your server. Because of this most of the hosting companies disable some of these dangerous functions. But for a PHP Programmer cURL is an essential tool and must requires basic functionality atleast. It is very easy to check the PHP/cURL is working normal.

Steps:-

1. Create a php file “check_cURL.php” with following content using any of your favourite editor.

<?php
/**
* Initialize the cURL session
*/
$ch = curl_init();
/**
* Set the URL of the page or file to download.
*/
curl_setopt($ch, CURLOPT_URL,
‘http://news.google.com/news?hl=en&topic=t&output=rss’);
/**
* Create a new file
*/
$fp = fopen(‘rss.xml’, ‘w’);
/**
* Ask cURL to write the contents to a file
*/
curl_setopt($ch, CURLOPT_FILE, $fp);
/**
* Execute the cURL session
*/
curl_exec ($ch);
/**
* Close cURL session and file
*/
curl_close ($ch);
fclose($fp);
?>


2.  Execute the “check_cURL.php” script (I just run “php -q   check_cURL.php” from the terminal)

3.  Check the output file “rss.xml”. If the file contains data, we can conclude curl is working fine.

How does this script works:-

The check_cURL.php is simple php script which when called connects to the url specified(Google in our example) and download its source code. The script then writes its output to downloaded content to the output file(rss.xml in our example).

IPTABLES complete cheatlist

Please note that the iptables rules are stored in the /etc/sysconfig/iptables file. If you view this file, you’ll see all the default rules.

1. Delete Existing Rules

Before you start building new set of rules, you might want to clean-up all the default rules, and existing rules. Use the iptables flush command as shown below to do this.

iptables -F
(or)
iptables –flush
service iptables save

2. Set Default Chain Policies

The default chain policy is ACCEPT. Change this to DROP for all INPUT, FORWARD, and OUTPUT chains as shown below.

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP

When you make both INPUT, and OUTPUT chain’s default policy as DROP, for every firewall rule requirement you have, you should define two rules. i.e one for incoming andone for outgoing.
Change default policy for INPUT/OUTPUT/FORWARD to ACCEPT. All inbound connections will be allowed

iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

3.Block an IP for inbound connection

iptables -A INPUT -s 192.168.1.5 -j DROP
iptables -A INPUT -i eth0 -p tcp -s “$BLOCK_THIS_IP” -j DROP
4.Allow an IP for inbound connection

iptables -A INPUT -s 192.168.1.5 -j ACCEPT

5.Block outbound IP address

iptables -A OUTPUT -d <IP> -j DROP

6.Block outbound PORT

iptables -A OUTPUT -p tcp –dport <PORT> -j DROP

7.Block outbound IP:PORT

iptables -A OUTPUT -p tcp -d <IP> –dport <PORT> -j DROP

8.Allow port 2222 for inbound tcp connections

iptables -A INPUT -p tcp –dport 2222 -j ACCEPT

9.White list an IP

iptables -A INPUT -i eth0 -s <IP> -j ACCEPT

10.Open port 5666

iptables -I INPUT -p tcp -m tcp –dport 5666 -j ACCEPT
11.Allow ALL Incoming SSH

The following rules allow ALL incoming ssh connections on eth0 interface.

iptables -A INPUT -i eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

12.Allow Incoming SSH only from a Sepcific Network

The following rules allow incoming ssh connections only from 192.168.100.X network.

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

In the above example, instead of /24, you can also use the full subnet mask. i.e “192.168.100.0/255.255.255.0″.

13. Allow Incoming HTTP and HTTPS

The following rules allow all incoming web traffic. i.e HTTP traffic to port 80.

iptables -A INPUT -i eth0 -p tcp –dport 80 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 80 -m state –state ESTABLISHED -j ACCEPT

The following rules allow all incoming secure web traffic. i.e HTTPS traffic to port 443.

iptables -A INPUT -i eth0 -p tcp –dport 443 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 443 -m state –state ESTABLISHED -j ACCEPT

14.Combine Multiple Rules Together using MultiPorts

When you are allowing incoming connections from outside world to multiple ports, instead of writing individual rules for each and every port, you can combine them together using the multiport extension as shown below.

The following example allows all incoming SSH, HTTP and HTTPS traffic.

iptables -A INPUT -i eth0 -p tcp -m multiport –dports 22,80,443 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp -m multiport –sports 22,80,443 -m state –state ESTABLISHED -j ACCEPT

15.Allow Outgoing SSH

The following rules allow outgoing ssh connection. i.e When you ssh from inside to an outside server.

iptables -A OUTPUT -o eth0 -p tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

Please note that this is slightly different than the incoming rule. i.e We allow both the NEW and ESTABLISHED state on the OUTPUT chain, and only ESTABLISHED state on  the INPUT chain. For the incoming rule, it is vice versa.

16.Allow Outgoing SSH only to a Specific Network

The following rules allow outgoing ssh connection only to a specific network. i.e You an ssh only to 192.168.100.0/24 network from the inside.

iptables -A OUTPUT -o eth0 -p tcp -d 192.168.100.0/24 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -p tcp –sport 22 -m state –state ESTABLISHED -j ACCEPT

17.Allow Ping from Outside to Inside

The following rules allow outside users to be able to ping your servers.
iptables -A OUTPUT -p icmp –icmp-type echo-request -j ACCEPT
iptables -A INPUT -p icmp –icmp-type echo-reply -j ACCEPT
19.Allow Loopback Access

You should allow full loopback access on your servers. i.e access using 127.0.0.1

iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

20. Allow MySQL connection only from a specific network

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 –dport 3306 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp –sport 3306 -m state –state ESTABLISHED -j ACCEPT

21.Prevent DoS Attack

The following iptables rule will help you prevent the Denial of Service (DoS) attack on your webserver.

iptables -A INPUT -p tcp –dport 80 -m limit –limit 25/minute –limit-burst 1000 -j ACCEPT
In the above example:
-m limit: This uses the limit iptables extension

–limit 25/minute: This limits only maximum of 25 connection per minute. Change this value based on your specific requirement
–limit-burst 1000: This value indicates that the limit/minute will be enforced only after the total number of connection have reached the limit-burst level.

22.Port forwarding using IPTables

Forward port 80 from IP address to another IP

iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to <DESTIP>:80
iptables -t nat -A POSTROUTING -p tcp –dst <DESTIP> –dport 80 -j SNAT –to <SRCIP>
iptables -t nat -A OUTPUT –dst <SRC> -p tcp –dport 80 -j DNAT –to <DESTIP>:80

Removing the above rules
iptables -t nat -D PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to <DESTIP>:80
iptables -t nat -D POSTROUTING -p tcp –dst <DESTIP> –dport 80 -j SNAT –to <SRCIP>
iptables -t nat -d OUTPUT –dst <SRC> -p tcp –dport 80 -j DNAT –to <DESTIP>:80

23.List all the rules in the iptables

iptables  -L

24.Check an IP in the rule

iptables -nL | grep <IP>

25.Save the current iptables rules

iptables-save >  File_name

26.Restore iptable rules from the file

iptables-restore <  File_name

MSSQL support to PHP in cpanel server

To use the MSSQL extension on Unix/Linux, you first need to build and install the FreeTDS library. FreeTDS is a set of libraries for Unix and Linux that allows your programs to natively talk to Microsoft SQL Server and Sybase databases.

You can refer to the following url to get informations about mssql extension and  the functions supported with it.
http://www.php.net/manual/en/book.mssql.php

To get these functions to work, you have to compile PHP with –with-mssql[=DIR] , where DIR is the FreeTDS install prefix. And FreeTDS should be compiled using
–enable-msdblib

Installation instruction:-

(This is not specific to cpanel servers, you can recompile php directly without easyapache in any normal linux servers with ‘–with-mssql=/usr/local/freetds’)

1-. Download freetds source -> www.freetds.org
2-. tar -zxvf freetds-stable-tgz
3-. cd freetds-*
4-. ./configure –prefix=/usr/local/freetds –with-tdsver=8.0 –enable-msdblib  –with-gnu-ld

Note: If you use SQL 2000, 2005, 2008 then tds version = 8.0
if you use SQL 7.0 then tds version = 7.0

5-. make
6-. make install
7-. To check freetds working, run from terminal
7.1 /usr/local/freetds/bin/tsql -S <ip of the server> -U <User SQL>
7.2 If the connection parameters are correct you will be connected to a prompt.
8-. Add the following text in freetds.conf ( /usr/local/freetds/etc )
[TDS]
host = <ip of the Server with Sql>
port = 1433
tds version = 8.0

9-. Add the following line in the file /etc/ld.so.conf and run ldconfig -v:
include /usr/local/freetds/lib

10-. Recompile PHP with –with-mssql=/usr/local/freetds flag.
Create a file called all_php4 or all_php5 in:

‘/var/cpanel/easy/apache/rawopts/’

The file doesnt exist by default, just create it and add this line to the file:
–with-mssql=/usr/local/freetds
Easy apache will check this file ‘/var/cpanel/easy/apache/rawopts/all_php5’ for any additional php configuration option during recompilation.

11-. Run ‘/scripts/easyapache’

Notes:-

1-. If you are running a 64bit OS and get an error about configure: error: ‘Could not find /usr/local/freetds/lib64/libsybdb.a|so’
then you need to do the following:
1.1 Make sure libsybdb.so is available on the server,then
1.2 ln -s /usr/local/freetds/lib/libsybdb.so.5 /usr/lib64/libsybdb.so.5
1.3 ln -s /usr/local/freetds/lib/libsybdb.so.5 /usr/local/freetds/lib64/libsybdb.so
1.4 Run   ldconfig -v

2-. If you are getting an error about configure:’ error: Directory /usr/local/freetds is not a FreeTDS installation directory’
2.1 cp [tds source]/include/tds.h /usr/local/freetds/include
2.2 cp [tds source]src/tds/.libs/libtds.a /usr/local/freetds/lib
2.3 Recompile again.

Reference:-

http://www.freetds.org/userguide/
http://www.php.net/manual/en/book.mssql.php
http://forums.cpanel.net

Flex2gateway 404 error with railo

Railo 3.x comes with BlazeDS 3.2, the Adobe open source amf engine to communicate from a Flex application to a Java backend. But we may need to modify some tomcat configurations files to get it work.  You need to verify that tomcat configurations files are properly configured for flex or not. The following are the settings needed for Flex  services:-

#1. Updating the web.xml file

/opt/railo/tomcat/conf/web.xml

Uncomment the following settings in the web.xml if present or add the following details.

<!– Load the MessageBrokerServlet  –>
<servlet>
<servlet-name>MessageBrokerServlet</servlet-name>
<servlet-class>flex.messaging.MessageBrokerServlet</servlet-class>
<init-param>
<param-name>services.configuration.file</param-name>
<param-value>/WEB-INF/flex/services-config.xml</param-value>
</init-param>
<init-param>
<param-name>messageBrokerId</param-name>
<param-value>MessageBroker</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>

<!– The mappings for the Flex servlet –>
<servlet-mapping>
<servlet-name>MessageBrokerServlet</servlet-name>
/flex2gateway/*
</servlet-mapping>
<servlet-mapping>
<servlet-name>MessageBrokerServlet</servlet-name>
/flashservices/gateway/*
</servlet-mapping>
<servlet-mapping>
<servlet-name>MessageBrokerServlet</servlet-name>
/messagebroker/*
</servlet-mapping>

#2. Updating the uriworkermap.properties file

/opt/railo/tomcat/conf/uriworkermap.properties

Add the following details.

/*.cfm=ajp13
/*.cfc=ajp13
/*.cfml=ajp13
/*.cfres=ajp13
/*.cfchart=ajp13
/*.cfm/*=ajp13
/*.cfml/*=ajp13
/*.cfc/*=ajp13
/*.jsp=ajp13
/*.do=ajp13
/=ajp13
/flex2gateway/*=ajp13
/flashservices/gateway/*=ajp13
/messagebroker/*=ajp13
/=ajp13

Once you’ve updated Tomcat configuration files, restart Tomcat/Railo.

Verify the Flex

Browse to  http:///flex2gateway/  you should get a white page, if you get an error message, this would mean that either you server is not running, the MessageBroker Servlet is not running or there are some configuration mistakes.

Troubleshooting 404 error

Apache 404 error

1.Please understand that if the URL you’re using is this: http://mydomain/flex2gateway , then all your mappings should look like
/flex2gateway*=ajp13
There must no trailing slash on either of them.

2.Also verify the server.xml is updated correctly and hence the domain is  pointing to its  webroot.

3. Most importantly, the mod_jk module needed to be loaded in to apache, then only the connection between tomcat and apache works. So please verify the apache configurations files and verify the mod_jk is enabled. If not add the following details to the apache configuration file.

<IfModule !mod_jk.c>
LoadModule jk_module [modules directory]/mod_jk.so
<!–IfModule>

<IfModule mod_jk.c>
JkMount /*.cfm ajp13
JkMount /*.cfc ajp13
JkMount /*.do ajp13
JkMount /*.jsp ajp13
JkMount /*.cfchart ajp13
JkMount /*.cfm/* ajp13
JkMount /*.cfml/* ajp13
Flex Gateway Mappings
# JkMount /flex2gateway/* ajp13
JkMount /flashservices/gateway/* ajp13
JkMount /messagebroker/* ajp13
JkMountCopy all
JkLogFile [log directory]/mod_jk.log
</IfModule>

ps: Please restart the httpd service.

Tomcat 404 error

The reason mostly is Tomcat servlet “MessageBrokerServlet” is unavailable or not loaded. In that case please verify the tomcat configuration files are updated correctly as mentioned above, ie web.xml and uriworkermap.properties files. Also verify tomcat log files to find out why “MessageBrokerServlet” is not loaded. Sometimes you may need to comment “MessageBrokerServlet” in other web.xml files.

Tomcat log file location:- /opt/railo/tomcat/logs/

ps: You need to restart railo/tomcat if you made any changes to tomcat configuration files.

Joomla jos_session table crashed

You may come across the following error sometime if you are working joomla site.
jtablesession::Store Failed
DB function failed with error number 145
Table ‘./eilmccco_cmsicdc/jos_session’ is marked as crashed and should be repaired SQL=INSERT INTO jos_session ( `session_id`,`time`,`username`,`gid`,`guest`,`clie nt_id` ) VALUES ( ‘ca7331cb8a008d79e24df425257229ea’,’1227636484′,” ,’0′,’1′,’0′ )

This is a very common error. The problem with this error is that you cannot access your site nor the admin page.
The error messages means that the table “jos_session” is crashed or damaged. This table stores your session information.

This issue can be easily fixed by repairing the session table. For doing this the first thing you should do is find out your joomla database. This can be done by checking your joomla configuration.php file.
Now we can try  repairing the table in following ways.

Cpanel
If you are using the Cpanel, then you can repair you joomla database by clicking the “Repair DB” option in the Mysql section of the Cpanel.

phpMyAdmin

If you can access your database though phpMyAdmin, then on the phpMyAdmin interface, select the joomla database and look for the table “jos_session”. Once you selected the “jos_session” (tick the checkbox) and choose “Repair table” from the drop-down you find at the bottom of the list of tables.

SSH access

If you have shell access of your server, the database can be repaired within the Mysql.
Login to the mysql with necessary privileges
#mysql -u <dbuser> -p
mysql> use joomla1;                              [Assume your joomla database name is joomla1]
mysql> REPAIR TABLE jos_session;

If all the above tricks failed, then you must recreate the “jos_session” table

First of all, please take a complete backup of the joomla database.

phpMyAdmin

1 – Go to MySQL phpMyadmin Control Panel

2 – Go and click on “SQL” near the top left corner of the page, and paste the following lines (below) into the empty text area :

DROP TABLE IF EXISTS `jos_session`;
CREATE TABLE `jos_session` (
`username` varchar(150) default ”,
`time` varchar(14) default ”,
`session_id` varchar(200) NOT NULL default ‘0’,
`guest` tinyint(4) default ‘1’,
`userid` int(11) default ‘0’,
`usertype` varchar(50) default ”,
`gid` tinyint(3) unsigned NOT NULL default ‘0’,
`client_id` tinyint(3) unsigned NOT NULL default ‘0’,
`data` longtext,
PRIMARY KEY (`session_id`(64)),
KEY `whosonline` (`guest`,`usertype`),
KEY `userid` (`userid`),
KEY `time` (`time`)
) ENGINE=MyISAM DEFAULT CHARSET=utf8;

3 – Click on “Execute” or “Go” to execute the command.

Thats it. This must fix your concern…

Please let me know your feedback and also if you have any other easy workaround

Page 3 of 3

Powered by WordPress & Theme by Anders Norén