Created attachment 4485 [details] screenshot of the new panel I have read the code of template of httpd and i have seen that some options are present here to set some apache directives directly by db commands but it is not possible to do it trough the server-manager. It is a bug that i want to solve. i mean AllowOverride all or AllowOverride None Options +Indexes Options +FollowSymLinks moreover i saw that ian have made a new option SSLRequireSSL (bug 882) and i have used it to add this directive if the SSL ibay option is set to enabled. it is done to enhance the security. If the redirection fail to https, then the access is forbidden. Here the code change my $ssldb = $properties{'SSL'} || "disabled"; if (("$sslRequireSSL" eq 'enabled') || ("$ssldb" eq 'enabled')) { $OUT .=" SSLRequireSSL\n"; } Further more i would add a php setting (php_admin_flag allow_url_fopen on) used by many programs which need to allow php to download remote files. We could set this option either directly in the php.ini or by a template custom. I propose that this option needs to be in the hand of the admin. It is more secure than allow it for the whole server and more flexible and easy when it is done per ibay through the server-manager. If you think this work is valuable we could add more php settings to the ibay, i mean : php_admin_value memory_limit php_admin_value upload_max_filesize php_admin_value post_max_size and the php_admin_value upload_tmp_dir which has a relevant bug 7011
(In reply to Stephane de Labrusse from comment #54) > (In reply to guest from comment #53)> I don't understand hsf, it is released in sme9, or you are asking that the > contrib smeserver-webhosting will be a part of the core Exactly! ;-)
(In reply to guest from comment #53) > This would be a great contrib to make it into the core for SME Server 9.next I don't understand hsf, it is released in sme9, or you are asking that the contrib smeserver-webhosting will be a part of the core
This would be a great contrib to make it into the core for SME Server 9.next
for the record, the gui is released with a contrib smeserver-webhosting in bug 8280
see documentation modification http://wiki.contribs.org/DB_Variables_Configuration#Apache_server_ibay_specific_.28httpd-e-smith.29
Thanks guys - another one closed as released in Beta 4
To me I think back port to SME8 would be well worthwhile.
(In reply to Terry Fage from comment #47) > = DOCUMENTATION IMPACT: > Ensure db/config settings are documented in relevant section of wiki - Yes > > AllowUrlfOpen : enabled/disabled > MemoryLimit : set a M as unit, eg 64M > UpMaxFileSize : set a M as unit, eg 64M > PostMaxSize : set a M as unit, eg 64M > MaxExecTime: unlimited or set time in second without units, eg 60 > > if ssl is enabled then SSLRequireSSL is written in the virtualhost of the > ibay > > Also suggest warning re security in relation to enabling AllowUrlfOpen Thanks terry for the verification. the AllowUrlfOpen is set only for the ibay and never for the whole server, but this option is needed for php application. Do we backport to sme8 ?
VERIFICATION = Environment: SME9.0b4 ESXi 5.5 VM. = Original problem: Bug 8239 - Add new PHP settings and SSRequireSSL by db command = Resolution: %changelog * Tue Apr 8 2014 stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-9.sme - Perl::critic syntax modifications [SME: 8239] - Add more PHP options to ibays only by db commands [SME: 8239] - Add SSLRequireSSL to ibays when SSL is set to enabled [SME: 8239] = Current version installed: [root@sme9b464 ~]# cat /etc/e-smith-release SME Server release 9.0beta4 [root@sme9b464 ~]# uname -r 2.6.32-431.11.2.el6.x86_64 [root@sme9b464 ~]# rpm -qa e-smith-ibays e-smith-ibays-2.4.0-8.el6.sme.noarch =Testing: Defaults [root@sme9b464 ~]# db accounts show b8239_9b4 b8239_9b4=ibay CgiBin=disabled Gid=5001 Group=admin Name=bug PasswordSet=no PublicAccess=local SSL=disabled Uid=5001 UserAccess=wr-admin-rd-group = Updated version installed: Released in SME9b4 Create an iBay named b8239_9b4 in a SME9b4 install SME9b4 set iBay properties [root@sme9b464 ~]# db accounts setprop b8239_9b4 AllowUrlfOpen enable [root@sme9b464 ~]# db accounts setprop b8239_9b4 MemoryLimit 64M [root@sme9b464 ~]# db accounts setprop b8239_9b4 UpMaxFileSize 32M [root@sme9b464 ~]# db accounts setprop b8239_9b4 PostMaxSize 32M [root@sme9b464 ~]# db accounts setprop b8239_9b4 MaxExecTime unlimited [root@sme9b464 ~]# db accounts setprop b8239_9b4 SSLRequireSSL on [root@sme9b464 ~]# signal-event ibay-modify ibayname [root@sme9b464 html]# db accounts show b8239_9b4 b8239_9b4=ibay AllowUrlfOpen=disable CgiBin=enabled Gid=5001 Group=admin MaxExecTime=unlimited MemoryLimit=64M Name=bug PasswordSet=no PostMaxSize=32M PublicAccess=local SSL=enabled SSLRequireSSL=on Uid=5001 UpMaxFileSiz=32M UserAccess=wr-admin-rd-group [root@sme9b464 ~]# signal-event post-upgrade; signal-event reboot Check php.ini settings using php.info. Settings for custom iBay are as per db settings and are different to those set for the Primary iBay System appears to be stable without errors. No errors were evident in the log files in relation to these changes. = Problem fixed: Features added to SME9 = Verified or Reopen: VERIFIED = DOCUMENTATION IMPACT: Ensure db/config settings are documented in relevant section of wiki - Yes AllowUrlfOpen : enabled/disabled MemoryLimit : set a M as unit, eg 64M UpMaxFileSize : set a M as unit, eg 64M PostMaxSize : set a M as unit, eg 64M MaxExecTime: unlimited or set time in second without units, eg 60 if ssl is enabled then SSLRequireSSL is written in the virtualhost of the ibay Also suggest warning re security in relation to enabling AllowUrlfOpen = Suggested release notes: %changelog * Tue Apr 8 2014 stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-9.sme - Perl::critic syntax modifications [SME: 8239] - Add more PHP options to ibays only by db commands [SME: 8239] - Add SSLRequireSSL to ibays when SSL is set to enabled [SME: 8239]
I will take the verification
wow thanks! .. and it are much more i guess .. because if you look at Vienna the flag counts 6 machines, but in my 1/2 Rack in a data center in Vienna there are currently 17 Machines running on SME :-) 5 of them are mine and the rest are machines of clients i provide Housing and Service for :-) Great ... to use the famouse words out of a commercial : I am loving it! ;-) Well i do code since 1986 .. Assembler86, it was .. then a little basic and the first flat file databases ... from 1997 to 2001 i coded mostly CGI and Perl and since 2001 mostly PHP. I also use SME Servers since then too, was called e-smith :-) and to learning .. if you do it right you never stop learning :-)
i do not know exactly how many servers are disseminated over the world, some people speak about 30 000. see http://batchgeo.com/map/e875e05b857ef93f1ad61ea1e3324fc2 You are welcome to found your place, i started with documentation, after by verification, and now by coding but it is not my day work, then i'm still learning :) if you want to follow the last bug, see a the top right of bugzilla the link 'recent' (http://bugs.contribs.org/buglist.cgi?chfieldto=Now&query_format=advanced&chfieldfrom=2d&order=Last%20Changed) or ask to be in the bug team and you will receive all bugs to your email-box.
Hi Stephane, thanks , also for all the usefull links! .. i love to be part (even only a very tiny one) of this great project! I will try to help wherever i can ... I am solid in PHP and mySQL but Perl & CGI .. that is at least 12 years ago. but i can also help with translations and testing .. By the way, do you have any idea of how much servers out there use any version of SME? even roughly? best Rudi
this is one example of verification template usage http://bugs.contribs.org/show_bug.cgi?id=8264#c8
Hi rudi the purpose of sme server is to have a large base of users in order to find bugs like you have done in bug 8331. For now we are not legion, but skilled, motivated and yes it is fun to play with bugs. Now the only thing accepted is the db command, but once this bug verified, you can ask to get more graphical settings to the ibay panel. I'm quite sure that if people want, ask and do what is needed to get, then things will come If you want to verify this bug, take some minutes to read the help http://wiki.contribs.org/Bugzilla_Help and use the template to answer http://wiki.contribs.org/Bugzilla_Help#Verifying_Bugs the best test will be to install a php application and play with db settings. I have in mind wordpress and the panel of upload) but you can simply use a phpinfo http://wiki.contribs.org/User_talk:Stephdl#phpinfo with a phph application you might have some problem of phpbasedir (i would to solve with bug 7011) see http://wiki.contribs.org/Useful_Commands#PHPBaseDir_per_ibay you have a nice tool with /sbin/e-smith/audittools/logcheck to look in all your logs to find errors http://wiki.contribs.org/Audit_Tools#logcheck all db command see comment 39
(In reply to Terry Fage from comment #38) > Rudi the UI panel in server manager has not been implemented with this bug, > see comments 19 to 28. This bug has introduced the ability to add options > to iBays via db commands Rudi why don't you do a formal verification of > those changes, it would be a great help in getting SME9 out the door.. Hi Stephane .. i am a bit new with this .. what do i need need to do to help? I am going to write a new software that will need most of this features anyway (allow: htaccess; change different Values in the php file, neet file access outside the ibay .. and so on :-)) I will start the project of next week but i can do some testing on the upcoming weekend .. i love this panel :-) please see Bug 8331 i filed to the part function for activating https .. on my two absolute new machines (one has 8.1 and one 9.4, all updates installed, both on naked machines) It shows in the db settings but no forced redirect happening ... best rudi
(In reply to Rudi from comment #35) > hi Stephane, > when will this panel be available? > i have a naked machine with sme9 online that i could und whould like to test > this on!? > best > Rudi Hi rudi For now we have to test this bug which add php settings only with DB command. AllowUrlfOpen : enabled/disabled MemoryLimit : set a M as unit, eg 64M UpMaxFileSize : set a M as unit, eg 64M PostMaxSize : set a M as unit, eg 64M MaxExecTime: unlimited or set time in second without units, eg 60 if ssl is enabled then SSLRequireSSL is written in the virtualhost of the ibay All changes are visible in /etc/httpd/conf/httpd.conf, you can use a phpinfo file to see changes in order to activate changes : adapt 'ibayname' to the name of the ibay db accounts setprop ibayname AllowUrlfOpen enabled signal-event ibay-modify ibayname You could give a great help to the project if you want to verify it....search how it works with a real php program, search in log (/sbin/e-smith/audittools/logcheck), look in httpd.conf.... The bug 8316 is the bug related to the panel but for now it is not planned to add it.
Rudi the UI panel in server manager has not been implemented with this bug, see comments 19 to 28. This bug has introduced the ability to add options to iBays via db commands Rudi why don't you do a formal verification of those changes, it would be a great help in getting SME9 out the door..
ok so it is installed .. but you did not add all the functions posted in the Screenshot right? Only the force https is there and this is translated absolutely wrong to german ... i alreaddy reported thst to the translations if i translate what is written there now in german back to english it says: "allow direct SMTP connection" it should say: "force https connetion" in german: "HTTPs Verbindung erzwingen" And it does not work correct i think .. should it not redierct the user that enters the domain to the https like it does with the connection to Server-manager!? when i set this on SME 9.4 i get a 403 Error on SME 8.1 it does not do anything ..
(In reply to Rudi from comment #35) > hi Stephane, > when will this panel be available? > i have a naked machine with sme9 online that i could und whould like to test > this on!? Have a read through the whole bug - you will see http://bugs.contribs.org/show_bug.cgi?id=8239#c27 http://bugs.contribs.org/show_bug.cgi?id=8239#c29 It should be in smeupdates-testing Try something like yum --enablerepo=smeupdates-testing install e-smith-ibays Please report any bugs here B. Rgds John
hi Stephane, when will this panel be available? i have a naked machine with sme9 online that i could und whould like to test this on!? best Rudi
%changelog * Tue Apr 8 2014 stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-9.sme - Perl::critic syntax modifications [SME: 8239] - Add more PHP options to ibays only by db commands [SME: 8239] - Add SSLRequireSSL to ibays when SSL is set to enabled [SME: 8239] please need build, the patch has been tested, updated and pushed to cvs
Created attachment 4587 [details] e-smith-ibays-2.4.0_add_php_values_and_SSLRequireSSL.patch if you are agreed i would to rewrite my patch like you have suggested in bug 8316, and push it to CVS
(In reply to Stephane de Labrusse from comment #30) > i'm wondering if we could backport to sme8.1 this patch ... Not until this is verified, IMO.
(In reply to Stephane de Labrusse from comment #30) > i'm wondering if we could backport to sme8.1 this patch, since all is > disabled by default we do not risk a lot of stuff, and it could be a nice > enhancement. Yes, open a new bug. It may spend a while in smeupdates-testing to check it really does not affect existing servers.
i'm wondering if we could backport to sme8.1 this patch, since all is disabled by default we do not risk a lot of stuff, and it could be a nice enhancement.
(In reply to chris burnat from comment #27) > Package should appear in smetest shortly for verification. For those who will test, the package is in 'smeupdates-testing'
For those who are willing to verify this bug, here new db commands i introduced. AllowUrlfOpen : enabled/disabled MemoryLimit : set a M as unit, eg 64M UpMaxFileSize : set a M as unit, eg 64M PostMaxSize : set a M as unit, eg 64M MaxExecTime: unlimited or set time in second without units, eg 60 if ssl is enabled then SSLRequireSSL is written in the virtualhost of the ibay All changes are visible in /etc/httpd/conf/httpd.conf, you can use a phpinfo file to see changes in order to activate changes config setprop ibayname AllowUrlfOpen enabled
Fixed in e-smith-ibays-2_4_0-8_el6_sme %changelog * Sat Mar 15 2014 stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-8.sme - Add more PHP options to ibays only by db commands [SME: 8239] - Add SSLRequireSSL to ibays when SSL is set to enabled [SME: 8239] Package should appear in smetest shortly for verification.
(In reply to Stephane de Labrusse from comment #19) > I agree with you but for now we have decided to just test the db command in > first, then after we will test with a UI like you can see in the screenshot. > Yes sorry, I missed that change. Just implementing the db commands for now. > ....i would some help to find good words for menu, i do not > know at all if what i wrote is relevant :) Yes, help can be provided later when the UI is looked at. > ...my bad i'm french.... Nothing bad with French, nothing good with English, we just say things the other way around (as do most languages) eg the dog sat on the seat the seat was sat on by the dog !
Taking this build over next day or two.
(In reply to Charlie Brady from comment #22) > (In reply to Ian Wells from comment #21) > > > I think that the new ibay UI should be based Mojolicious via another bug and > > likely post 9.0 > > I agree. The UI changes would need to be via a different bug, which would be > in SME Future for now. as asked see bug 8280, the bug is done to track for sme future a new UI and the code/work done.
changed the title to refer better to comment 21
(In reply to Ian Wells from comment #21) > I think that the new ibay UI should be based Mojolicious via another bug and > likely post 9.0 I agree. The UI changes would need to be via a different bug, which would be in SME Future for now.
> I agree with you but for now we have decided to just test the db command in > first, then after we will test with a UI like you can see in the screenshot. Actually we have not agreed a UI. Only DB commands for now. I think that the new ibay UI should be based Mojolicious via another bug and likely post 9.0
build asked please e-smith-ibays-2.4.0-8 %changelog * Sat Mar 15 2014 stephane de Labrusse <stephdl@de-labrusse.fr> 2.4.0-8.sme - Add more PHP options to ibays only by db commands [SME: 8239] - Add SSLRequireSSL to ibays when SSL is set to enabled [SME: 8239]
Created attachment 4519 [details] screenshot of new ibay panel hi ray I agree with you but for now we have decided to just test the db command in first, then after we will test with a UI like you can see in the screenshot. as you can see i have removed the phpbasedir because i feel it is for trained users. my bad i'm french so i would some help to find good words for menu, i do not know at all if what i wrote is relevant :) I hope so.
(In reply to Stephane de Labrusse from comment #16) > No remarks, no comments on the patch (comment 15), can i push it to cvs and > ask to a build ? From Comment 5, restated: "I would comment that it may be wise to add a brief but explicit description to the server manager panel of what each setting is for. As you are putting these advanced setting possibilities in the hands of less experienced admins via the GUI panel, then they should be advised (briefly) of their purpose."
(In reply to Stephane de Labrusse from comment #16) > It is weekend time, we have to work :) > > No remarks, no comments on the patch (comment 15), can i push it to cvs and > ask to a build ? Looks OK
It is weekend time, we have to work :) No remarks, no comments on the patch (comment 15), can i push it to cvs and ask to a build ?
Created attachment 4507 [details] e-smith-ibays-2.4.0_add_php_values_and_SSLRequireSSL.patch a patch to add more options for php only by db commands -AllowUrlfOpen option : enabled/disabled -MemoryLimit Add a 'M' after a number value -UpMaxFileSize Add a 'M' a after number value -PostMaxSize Add a 'M' after a number value -MaxExecTime option : disabled or value in second (without unit) or unlimited -SSLRequireSSL in the apache directive if the SSL db command is set to enabled in order to test php otions you can upload or write a file php.php in the html folder of your ibay with this content. After you can use your browser to display it http://the_right_url/ibaysname/php.php <?php phpinfo(); ?>
(In reply to Stephane de Labrusse from comment #13) > If the view of all these settings can disturb, we can do an advanced > settings page but for now i do not know how to do it :) Yes. So first get it working well with the DB vars. Once it is fully working and verified not to have any side-effects the UI can be considered. Mojolicious may make this easy. Before then an advanced tab is possible, let's discuss that once the code is working. So it is not a NO, instead it is a step-by-step approach. Note: the current focus is on getting SME 9 out, not adding features. So the UI part may be best implemented for SME 9.1 using Mojolicious, that work could start soon as an experiment.
(In reply to daniel from comment #11) > I'd rather let all those new options as DB commands only. Exposing this in > the interface will probably confuse a lot of users, without any benefice > (those who know why they should change those settings will probably find how > to do it with DB commands). I disagree but i understand what you are meaning daniel. You are like me a "sysadmin" who search where is the terminal before to think what settings you can or need to change. However there is a lot of people who don't want to know what is a terminal and moreover if they have problem they can come back to "default value" because i would have drop down menus. I would add more that the db command can make errors if the sysadmin forget to add a value without "M", he may have nightmares. If the view of all these settings can disturb, we can do an advanced settings page but for now i do not know how to do it :)
(In reply to daniel from comment #11) > I'd rather let all those new options as DB commands only. Exposing this in > the interface will probably confuse a lot of users, without any benefice > (those who know why they should change those settings will probably find how > to do it with DB commands). I Agree
I'd rather let all those new options as DB commands only. Exposing this in the interface will probably confuse a lot of users, without any benefice (those who know why they should change those settings will probably find how to do it with DB commands).
i can propose a patch for bug 8239 just with db commands even if the UI patch is workable (i will propose a rpm for those who want to see what i would). We will add after if needed. i have added in bug 8239: my $allowurlfopen = $properties{'AllowUrlfOpen'} || "disabled"; my $ssldb = $properties{'SSL'} || "disabled"; (needed because i want to add SSLRequireSSL if ssl is activated) ###php values for each ibay or set "" if not defined my $MemoryLimit = $properties{'MemoryLimit'} || ""; my $maxfileSize = $properties{'UpMaxFileSize'} || ""; my $postmaxSize = $properties{'PostMaxSize'} || ""; my $maxexecutionTime = $properties{'MaxExecTime'} || ""; I have not time to do it this weekend since i'm on holidays back, but i will do it soon.
I don't believe this blocks Bug 7011, it just adds the server-manager part. If these advanced settings are to be added I would prefer a bigger gap between the classic value that should be set, and then these optional advanced ones. I don't have time for a mock-up yet. Maybe when Mojolicious is introduced there would be a better way to hide these in an advanced panel
Created attachment 4488 [details] screenshot of new ibay panel please i would your review on the wording and on the new panel. I need a bit of further tests but all seems in a good way :)
Created attachment 4487 [details] screenshot of new ibay panel ian is it something like that you have in mind ?
(In reply to John Crisp from comment #4) > Two other obvious candidates would be : > > PHPBaseDir > PHPUploadDir (http://bugs.contribs.org/show_bug.cgi?id=7011) indeed if we want to add some php setting and particulary php_admin_value memory_limit php_admin_value upload_max_filesize php_admin_value post_max_size Therefore we need to add php_admin_value max_execution_time Other options given by john are valuable for me
(In reply to Stephane de Labrusse from comment #0) > I have read the code of template of httpd and i have seen that some options > are present here to set some apache directives directly by db commands but > it is not possible to do it trough the server-manager. It is a bug that i > want to solve. Not really a bug, but a new feature. Your goals are good & to be encouraged, many people will benefit from easier usage. This is not a difficult task as such (particularly where there are db commands to be utilised), but developers in the past have not considered it important or necessary to add such setting possibilities in server manager panels, as they are easily configurable by a knowledgable sysadmin using the command line. I would comment that it may be wise to add a brief but explicit description to the server manager panel of what each setting is for. As you are putting these advanced setting possibilities in the hands of less experienced admins via the GUI panel, then they should be advised (briefly) of their purpose.
Two other obvious candidates would be : PHPBaseDir PHPUploadDir (http://bugs.contribs.org/show_bug.cgi?id=7011)
Thanks ian for your comment, i have learnt many new english words :) The idea of a separate "advanced settings" is good i will look tonight in this direction. For all other php_admin_value it is not a Hard work to implement it, just define either the default php.ini value or other value. However we need to define what will be the higher value (probably the apache higher value which is 2G for upload/download) I have in mind that it could give the life easier rather than to set values for the whole server or do custom templates.
I would prefer the panel in two sections, the classic section at the top which ends at Execution of dynamic content (CGI, PHP, SSI) Then introduction of a new section "Advanced Configuration" And then all of the new options including HTTPS At the moment it may appear overwhelming, but having the advanced options are good. I don't know if this is the correct list - it would be good to get more comments.
Created attachment 4486 [details] e-smith-ibays-2.4.0-add-indexes-allowoverride-allowurlfopen-followsymlinks.patch patch to add more settings to ibay panel of the server-manager