Matthew Williams - CFDev (and admin!)

!@#@!#@! script kiddies

Mon, 21 Sep 2009 14:40:00 -0500

Well, I finally got hacked. This is a first for me, and proves that my Linux skills are just not quite as up there as my windows admin skills. And what was the vector? The lack of queryparams inside CFshopkart. The only upside is that there were no transactions inside the cart, and no sensitive data to steal. But the defacement did muck about with several system files. Bah.

Completely off topic, but humans are just a lost cause

Tue, 04 Aug 2009 13:42:00 -0500

Last night I had an argument with some lady that's some damn stupid, that it bares repeating. Every now and then the missus and I have a brain lapse and take the kids to Chuck E Cheese. They enjoy it, but I don't know of many parents that do ;). At any rate, I was put in charge of holding a twin and following one of the older kids around. At the time I was shadowing our two year old. My daughter decided to play some skeeball. Now, I don't mind skeeball. It's fairly fun, and I used to enjoy a good round in my youth. We show up at the lanes (they have maybe 6?) to find a youth and her grandmum... least, that's seemed to be the correct age grouping. This pair was using the middle lanes, and grammy's purse was occupying a third. The purse isn't actually beside grammy, it's another lane over yet (why? beats me). Beside the purse, some dude is using the ball drop area to hold his cup of coins whilst playing the basketball game. So, that leaves my daughter and I the lane next to grammy. Alright, we shoot in our coin, and the two year old gives it a fair try. She didn't get a single ball up the lane but I threw the missed balls back up the ramp for her. And for the first time in my life, actually hit one of those blasted 100k holes. Sweeeet. Anyway, we finish up at 300k points, grab our tickets and start walking away. And that's when the fun started... Ignorant Woman: "Excuse me, you're taking my tickets" Me: "No ma'am, these are our tickets" IW: "No, you're taking my tickets" Me: "Ma'am, these are our tickets. They came from this machine" IW: "No, they're mine." Me: "Ma'am, you're tickets come out beside you. Look." IW: "No, those are her tickets. Your's must be broken" Me: "Ma'am... look at the machine. You can see where they're connected. These are our tickets." IW: "No, those are my tickets" And it's at this point I realized that Ron White is correct. You can get a face lift, a boob job, cosmetically address imperfections. But you can't fix stupid. My brain just tripped a circuit. I found myself thinking, "wait... we're arguing about the equivalent of 25 cents... maybe 20 tickets? WTF??". So I said to the ignorant woman, "you know what? You can have the tickets. Allie, (the two year old this woman was effectively taking tickets from) give her the tickets." And damn, if she didn't do me proud. My two year old just threw the tickets at this woman's feet and we just walked away. Honestly, I was thinking on it later, and my point would have been proved by putting another quarter in the machine. It would have spit another ticket or two out as your "freebie". However, this just wasn't a teachable moment. At this point I'm just happy we didn't get thrown out of chuck's (well... am I really happy about that? hmmm), but damn I hate ignorant folks.

I want to love you linux, but why must you make it so damn hard!

Wed, 22 Jul 2009 17:24:00 -0500

After reading a blog entry about another CF guy moving over to Linode, I got to asking myself "what the heck is a linode"? Well, it's a XEN based VPS that's really, really freakin' cheap! I signed up for their 1080 plan (which is way more traffic then I'll likely see), and decided it was time to move from shared hosting to my own VPS. The reasons abound, one of which being I'm going to be fielding all of the hosting/billing for future projects for Meteorsite, LLC. I'd also planned on moving to Railo/Resin to do this hosting, and it seemed like a great fit. Oh, and I was also planning on using GroundWorks with Nagios to monitor all our various and sundry hosting solutions (to also get that crap off my own home network ;) ). Things went great at first. I got GroundWorks installed, but then I realized that GroundWorks wants to gloom onto and possess MySQL and Apache. Well, that's a pain in the ass and had to go. I only really wanted Nagios anyway. I'll generate the nagios configs on my local machine and just migrate them over. Fine, and done. Next step, configure a mail server with some sort of web front end. My old host used Plesk and that seemed to also include Horde. Great! I can deal with Horde. I usually pull everything into google mail for online viewing anyway, but I like having that option. So... I found 1, 2, a ton of tutorials on installing Horde on Ubuntu. The only problem is, not a damn one worked. Postfix would install correctly, but in the end I could never get IMAP (dovecot or courrier) to talk nice-nice to Postfix. Three tutorials, and several hours later, I decided to start looking for a one touch install type system. Since I'll be hosting sites later it made sense to find a Plesk/CPanel/Helm type open source solution. And behold, I started my quest towards making ISPconfig work. There is at least 10 hours of my life I'm never getting back. Good lord... after about 50 steps, I just could not get ISPconfig to authenticate against IMP. And as soon as I changed the authentication method, I couldn't get back into the system. No matter what I tried, I could not get it to work. In between all of this, it's likely that I blew away my VPS about 20 times. And then, I found Citadel and Easy Host Control Panel. I tried Citadel first, and currently have EHCP running on a test machine. Citadel (and EHCP) just worked. One installer, and that's it. Yes, you have to answer questions, but they're of the variety of "what's your system DNS" and "what's your mysql root passwor". Each have domain management for mail. Citadel really does far more than I require, and I think for hosting other sites, EHCP makes more sense, but at least I have something up and running! Yay. I do, however, still want my weekend back.

You learn something new every day!

Wed, 22 Jul 2009 11:10:00 -0500

I had to complete a disaster recovery project this week. We do this annually for one of our clients (yay for preparedness!) for one of their ColdFusion sites. I've got a run book and all that and was prepared to reinstall ColdFusion and copy in their EAR to redeploy the application. Until I had a conversation with a coworker: Him> Did they restore your data yet? Me> Yep, I'm just getting ready to reinstall ColdFusion and- Him> Re-install? Isn't everything already there? Me> Well, yeah, but. Wait... huh. I bet I could just run the jrunsvc command, and.. So it turns out, if you don't need search, .NET, LiveCycle or ODBC services, you can just restore ColdFusion from a a backup to your file system. All you really need (minus those other pieces) is to run the jrunsvc command to install a new ColdFusion service in the the services console and to run the wsconfig.jar to connect IIS to JRun (or, if you restore the website from a file, all of that is already there). My runbook went from something like 30 steps down to about 4. Color me happy. And when you think about it, it makes sense. Since it's all built atop Java (minus the other services) there's no reason to go through the installer. You can probably install those other components but I don't really need them, so I don't care to find out how at present. But still, this is a handy little tid bit.

FarCry 5.2 + Railo 3.1.0.16 + Resin + Apache + MySQL + CentOS - Addendum 1

Sat, 11 Jul 2009 00:38:00 -0500

I had an "Ah HA!" moment when I got home tonight. I copied in my FarCry core folder from my known good Ubuntu Railo/FarCry install over to my CentOS install and still had issues. I tried several iterations of this, and then I had a think. I pulled up the Railo admin on my Ubuntu install, and noticed I had it at .012. And then it hit me... I was actually in a discussion about this with others on the google groups. I thought I had tried it at 3.1.0.016, but I think I did not complete the upgrade step. So, I copied the .012 install of Railo over to the CentOS box and it worked! Huzzah! So, it appears that .012 remains the most supported version at this point in time. I'm hosting a copy of this file on my site, but please be gentle! I don't want to hear it from my host that ya'll are killing my server. You can grab the file here.

FarCry 5.2 + Railo 3.1.0.16 + Resin + Apache + MySQL + CentOS - Part 3

Fri, 10 Jul 2009 14:52:00 -0500

In this installment we're going to be installing FarCry, and tweaking our Apache settings a bit. To let ya'll know upfront, there's still a few issues with FarCry and functions that are named the same as internal Railo functions. I know these changes were placed into trunk at one point, but it doesn't seem like they migrated over to the 5.1.6 release. That's OK, I've got a fairly stable pull of the core trunk files from a few weeks back that I'll be linking on the site this evening. I'll verify that this fixes the odd "function cannot be named" stuff going on. The current trunk files are not allowing the overview page to come up, but then again this is trunk we're talking about... life on the bleeding edge sometimes leads to a paper cut ;). [More]

FarCry 5.2 + Railo 3.1.0.16 + Resin + Apache + MySQL + CentOS - Part 2

Fri, 10 Jul 2009 01:55:00 -0500

Right... part 2. We're going to install Railo in this section. It's going to be a much smaller ride than part 1 ;). But first, some knowledge. I've learned that:

I'm not a fan of CentOS. I prefer the debian distros. Why? I've not really ever had a need to play with SELinux, or IPTables. Why does that matter? Both of these things have caused me grief whilst putting this together as both are enabled by default in both the _64 and i386 builds of 5.3.
You must turn off IPTables on each boot of the system. I'm sure there's a way to make this automatic, but I really haven't tracked it down yet. Yes, it would not be an issue if I just set it up... surely this will be a blog posting down the line, but I don't require it for now.
I had originally done the write up for part 1 with an _64 build. Everything was great until I got to the point where I needed to build mod_caucho. I could not find a way to successfully build that, and it appeared to be an issue with apsx. I didn't really want to spend my entire day chasing down rabit holes, so I switched to the i386 build. It's at this point that I learned that SELinux was preventing Apache from talking to Caucho. Again, not wanting to chase my tail endlessly, I just disabled SELinux for now.
Use PUTTY! I can never get copy/paste to play nice between my VM command line screen and windows. So, I'll just minimize the VM and use PUTTY to terminal (over SSH) into virtual box. In this way, you can also keep several screens up at one time.

[More]

Where the heck do ya'll find the time?

Thu, 09 Jul 2009 15:10:00 -0500

I just can't seem to get into the swing of this blog post a day deal. Heck, I barely have enough time to even get enough sleep throughout a day. How the heck do ya'll bang out so many blog posts over the course of a week? Even though it appears that no one cares about my FarCry railo install piece, it'll likely take me about 8-10 hours of total setup time to get a working install done. I don't really mind if no one sees it... I'm doing this because I have to have a working install within the next few weeks to satisfy a customer project. Maybe I need to start aiming for the lower hanging fruit or something?

FarCry 5.2 + Railo 3.1.0.16 + Resin + Apache + MySQL + CentOS - Part 1

Wed, 08 Jul 2009 16:39:00 -0500

Woah... not such a catchy title, but it's descriptive, non? This all began as a quest to be able to provide a VPS solution to the lowest bidder situation. Their host provides CentOS machines at a fairly reasonable price, but that price would not include the cost of a ColdFusion license. My framework of choice is FarCry, and lately the Daemonites have taken great strides in keeping the framework compatible with Railo. This is the thorny path towards creating a Linux virtual machine with FarCry, MySQL, Railo, and Apache (oh... and SES URLs). We'll start by just getting the basics of the system running and in place.

Everything I'm doing is as the root user... yes, not cool, but this just development. Typically, you should really use sudo to do all of this.
Grab a VMware image of CentOS 5.2. You can find one here: http://www.vmware.com/appliances/directory/1309. VMplayer can be found here: http://www.vmware.com/download/player/
Turn off IPTABLES for testing... yes, not the best idea for production, but this is development. I could not figure out why the heck Apache wasn't serving pages outside the local install, and it was the firewall blocking it. In production, you should really turn this feature on. I'm not addressing how to do so for this excercise.
- /etc/init.d/iptables save /etc/init.d/iptables stop
Enable RPMforge packages. This will allow us to install phpMyAdmin through yum.
- http://wiki.centos.org/AdditionalResources/Repositories/RPMForge (source)
- Download either i386 or _64 RPM dependant on your OS type version
  - http://apt.sw.be/redhat/el5/en/i386/RPMS.dag/rpmforge-release-0.3.6-1.el5.rf.i386.rpm
  - http://apt.sw.be/redhat/el5/en/x86_64/RPMS.dag/rpmforge-release-0.3.6-1.el5.rf.x86_64.rpm
- Import GPG key rpm --import http://dag.wieers.com/rpm/packages/RPM-GPG-KEY.dag.txt
- Install it (replace the RPM with the name) rpm -i rpmforge-release-0.3.6-1.el5.rf.*.rpm
We need to install apache (well, not NEED, but we're not using Tomcat here)
- http://www.railo.ch/blog/index.cfm/2008/11/12/Installing-ResinRailo-on-CentOS (source)

yum install httpd httpd-devel openssl-devel

We need to install MySQL
- http://www.ozzu.com/unix-linux-forum/centos-and-apache-php-mysql-t69484.html (source)
- vi /etc/yum.repos.d/CentOS-Base.repo
- change enable=1 for centosplus

yum install mysql-server mysql

I installed PHP/PHPmyadmin - just for DB administration
- enter a value in $cfg['blowfish_secret'] = '<something>';
- vi /etc/httpd/conf.d/phpmyadmin.conf
- change the allow line to (yes, yes... but this is a test environ) to Allow from all
We need to install a JVM... this part just sucks. Unlike other distros, no precompiled version really meets our needs.

http://j2eeinaction.blogspot.com/2009/02/install-java-6-on-centos-52.html (source)
Go to http://java.sun.com/javase/downloads/index.jsp (grab the JDK!). You can browse to a download link and post that into your VM as something like the following
wget http://cds.sun.com/is-bin/INTERSHOP.enfinity/WFS/CDS-CDS_Developer-Site/en_US/-/USD/VerifyItem-Start/jdk-6u14-linux-x64-rpm.bin?BundledLineItemUUID=CXFIBe.pePAAAAEioR0Hk1t8&OrderID=CgtIBe.pcWUAAAEilh0Hk1t8&ProductID=tPxIBe.oz2IAAAEhmh0zLjfT&FileName=/jdk-6u14-linux-x64-rpm.bin
rename that long ugly file to jdk.rpm.bin
mv <stupid long name> jdk.rpm.bin
chmod 700 jdk.rpm.bin ./jdk.rpm.bin /usr/sbin/alternatives --config java

Start Apache and MySQL at reboot

And that's it. You have Apache serving pages at http://yoursite/ and phpMyAdmin at http://yoursite/phpmyadmin. Next up on the chopping block, adding Railo into the mix.

Fedex interactions... you are a bleeding pain

Wed, 08 Jul 2009 16:14:00 -0500

There has been some talk on CF-Talk lately about interacting with the Fedex WSDL/services. There's not really much in the way of examples that I could easily find on how to use this WSDL... and I've still not gotten over my hate of working with CFHTTP and authorize.net. I was hopping to not have to deal with that pain again, and it seems I won't! So, we have this link to a most excellent (and free!) CFC here. You'll still need to step through the hoops to get a developer code from Fedex, but once you do...

This example (provided by the original author) includes a handy select box. This is great for me, and saves a TON of time playing with the XML. PS.... I forgot to close the code block... I'm thinking BlogCFC could use a rich text editor.

Addendum to FarCry and IONIC rewriting

Wed, 01 Jul 2009 16:27:00 -0500

I tried to use IONIC and FarCry. I really did. I spent several days/weeks (eh, I have 5 kids man... I've rather lost track of the exact time) trying to make this filter work the new friendly URLs created by FarCry. The previous blog posting appeared to work, except... several areas of the admin became unworkable. Mostly areas like the library picker. Also, I ran into the odd issue where you'd want to append URL variables not working. Jeff Coughlin and I also posted to the IONIC boards hoping for some assistance (guidance?) but in the end, it's still just broken. Heck, I even tried various version of the filter. In any case, it just never worked 100% and I've since given up. So, where does that leave us? You can either switch to Apache. Or, you can start using the Helicon rewriting filter. There IS a free version of this filter, BUT... the downside is you're limited to either one website or ALL websites. The per server license for the full blown suite is about $99, but I hate having to pay for this filter for some reason. I'm just cheap, I suppose. Or, maybe it's due to everyone thinking the "ColdFusion" types are already pricey to begin with? At any rate, the free version works for me. Failing that I'm planning to switch to Apache for those cases where I need multiple site support.

Google brought down my house of cards

Wed, 01 Jul 2009 16:15:00 -0500

For almost three years now we've been running ColdFusion (well, really JRun) session based replication and failover on all of our hosted ColdFusion environs. Things were great! And then, we let google in the door to index our content. Things went from "great", to "why is this always down??". I spent far too much time looking at JVM settings, JRun settings, etc., but never really came up with a concrete answer as to what was happening. Ultimately, we'd see a deluge of errors about the failure of session replication in the log files and a complete breaking of failover and sometimes even the JRun -> IIS connector. Whilst searching for the session replication errors, I came across Sean Corfields postings across various blogs that replication just does not scale well, and that it remains a broken feature. Up until a few months ago, I'd argue this to be untrue. However, it appears that replication works... if you can manage to keep the amount of crap you throw into shared memory scopes down to a minimum. It's been 4 days since I've disabled session replication, and my servers have remained standing for an equal amount of time. We've been getting indexed by google (and others), and things are sailing along with nary a blip. Next stop, creating a guide for users that want/need session based failover that can be accomplished in code. Otherwise known as, "Help me Sean Corfield, you're my only hope!" ;).

Add bulk file uploads to FarCry 5.x

Mon, 04 May 2009 13:05:00 -0500

If you look in the content administration section of the FarCry admin, you'll find a handy little flex tool for uploading multiple images. Sadly, there is no matching tool for uploading bulk documents. Have no fear, as the source will set you free! The flex UI component that pulls off the Image uploads is also available from the Daemonites at http://svn1.cvsdude.com/modius/farcry/flexUI/multipleImageUploader/trunk/. It is, however, a tad out of date. And unless you know flex... it's a bit of a pain as well to get it up and running. However, I've included a handy little zip that contains a complete working flex project if you should so choose. So, I changed the flex UI piece to be named "Multiple Files Upload" and also changed the default CFM files being called (you can pass values in) to the correct file upload pieces. The files you'll need are:


farcry\core\webtop\admin\bulkfileUpload.cfm
farcry\core\webtop\admin\multipleFilesUploader.cfm
farcry\core\webtop\admin\ui\swf\multipleUploaderFile.swf

You'll also need to add a link to the webtop in your customadmin\customadmin.xml like (this goes into the current "content" section):

Reload your application, and that's it. You should now have the ability to upload multiple flies (.pdf, .doc, .zip only... you can modify the flex/swf to accept other attachments as well). UPDATE: I added a new URL param, fileList and extension. You can now control the file list through the multipleFilesUploader.cfm. Updated the zip to reflect this. Files

FarCry 5.1 and the Ionic ISAPI rewrite filter for friendly URLs

Thu, 19 Feb 2009 01:05:00 -0500

The 5.1 version of the framework got a big 'ol kick in the pants (especially for a point release) with the entire friendly URL engine undergoing a rewrite (hah). I upgraded one my works in progress for Meteorsite from the 5.02 to 5.1 recently and noticed that my older friendly URLs were no longer being built by the buildlink tag, but they still worked when called with the older /go/ syntax. Hmm... time to investigate. It turns out, you no longer need to prefix the friendly URL with a search term any longer. No more /go/ or /this/ or /something/ is required. Now, mysite.com/lets-start-this-party will work. Hey, I think it's cool at least, and the VP of marketing at my last job would have loved not having to prefix everything with a /go/. The magic behind all of this some rather nifty REGEX string to manipulate the URL, and a new piece in the framework that verifies that friendly URLs are working (which broke my current FUs). Once you manage to pass the FU check (http://yoursite.com/pingFU returns a success), your FUs will work as desired. The REGEX and setup instructions can be found on the FarCry WIKI. Everything was all good until... well, we're on windows, and not running Apache or the the Helicon rewrite filter. Instead, we're running the Ionic filter, and it seems the rewrite rule just doesn't work all that well based on what's in the docs. So began my quest to make that #@$#$ rewrite rule work for the Ionic filter. So, let's first run through how to install the Ionic filter. Installing the Ionic filter

If you just want to test with a single website, grab the IONIC 1.2.15. If you want to use this on multiple sites on the same machine, grab 2.0a. It really doesn't matter as the script works on both.
Inside the zip, you'll find a lib folder. The two different code branches have diffrerent DLLs names and INI names.
- 1.2.15: Doesn't matter where you put it, just not in the webroot. Put the IsapiRewrite4.dll and IsapiRewrite4.ini file in a separate folder (good to only have them in there by themselves).
- 2.0a: Again, put it where you want, but not in the webroot (for 2 of 3 files). Put the IirfGlobal.ini and Iirf.dll in the same folder. Place a Iirf.ini in your webroot.
The script I send should be used in either case for either Iirf.ini, or IsapiRewrite4.ini. Don't touch the IirfGlobal.ini, it only takes the options already in the file.
Windows permissions seem to be the biggest gotcha here. The files all seem to need, at minimum, IIS_WPG and IUSER_. Mine also have Users, SYSTEM, and Administrators if it just the first two don't work for you.
Open up the IIS Admin tool.
Click on web service extensions, and add a new extension for "Ionic Rewriter" (doesn't matter, but I think you need to be consistant here) and choose the appropriate DLL (depending on 1.2.15, 2.0a). Be sure to check the box to set for allowed.
Depending on the level you want to filter at (all sites, just one site) right click and get properties. Click on the ISAPI Filters tab and add the appropriate DLL and click apply or OK (doesn't matter).
Restart the IIS admin (should restart all of the various services too).

My current rewrite script - constantly evolving


# Firstly, let's make sure that the URL is not an admin
# function.  The "!" does not work here
# So it was removed.  Added [L] to stop processing other
# rules for recursion issues. If you have .xxx files that 
# take a URL param, add it here
RewriteCond %{HTTP_URL} (^/farcry|^/webtop|^/flex2gateway|^/flashserviReces|^/cfide|\.cfm|\.swf|\.xml)($|/)
RewriteRule ^(.*)$ $1 [L]

# Next, if it doesn't match the above, let's to see if
# there's a "?" in the string and rewrite it to be
# a "&".  This is to catch cases like 
# /something/?this=here.  We stop processing here to
# prevent going all circular in our logic by using the "[L]".
RewriteCond %{HTTP_URL} (.*)(\?)(.*) 
RewriteRule (.*)(\?)(.*) /index.cfm?furl=$1&$3 [L]

# This was junked as the first rule replaced it, but 
# leaving it here just in case commented out
#RewriteCond %{HTTP_URL} (^\.index.cfm)
#RewriteRule ^(.*)$ $1

# Last, failing all else, rewrite the string to the 
# normal furl sequence.  Removed the checking
# for a space from the WIKI sequence as it breaks for IONIC.
RewriteRule ^([a-zA-Z0-9\/\-\%:\[\]\{\}\|\;\<\>\?\,\*\!\@\#\$\(\)\^_`~]*)$ /index.cfm?furl=$1

Be sure to follow all of the directions in that WIKI entry, in addition to what I've provided here. At this point, it works for everything that I've thrown at it. Going to /cfide, or /farcry works. Going to the normal .cfm files works, and my flash players all work. I've run into the odd issue where I've tried to reference the application.url.conjurer URL, but I've since switched to buildlink to replace calls to that variable. The other odd issue is that the first condition was having case sensitivity issues.

Cool FarCry 5.1 feature you may have missed

Thu, 12 Feb 2009 12:07:00 -0500

I'm not even sure when I noticed this, but there's a now a Country and State formtool type (fttype). The Meteorsite project needed a tours page that includes state information. I'm fairly sure that it's going to just be North America for now, but we can always hash that out later. The Country type is pretty well defined out of the box, but the State type only includes information relevant to the Auzzie's (which makes sense, really). So, let's extend our new state type and include the provinces from Canada, and the US states. Copy the /farcry/core/packages/formtools/state.cfc to your local /farcry/projects/packages/formtools/state.cfc. You'll need to change the extend to farcry.core.packages.formtools.state in the state.cfc. The following is the additions to the getState function.

And, there you go. Ready made dropdowns to capture state information. You'd set the cfproperty to call this like the example below. You can specify a delimited list of country codes in ftCountries to grab from, or leave the property blank to grab all states in the getStates funtion.