年別アーカイブ: 2008年

Apache, security

FedoraのApacheにテスト用のSSL（自己署名証明書）を設定

コメントする
Chromeに対応するためには、subjectAltNameを設定した自己署名証明書を作成する必要があります。
subjectAltNameが設定されていない証明書はChromeで NET::ERR_CERT_COMMON_NAME_INVALID エラーを参照してください。

あらかじめ用意されているテスト用の仮の鍵と証明書をバックアップする。

# cd /etc/pki/tls
# mv private/localhost.key private/localhost.key.bk
# mv certs/localhost.crt certs/localhost.crt.bk

サーバ鍵を作成する。

# openssl genrsa -out private/test.key 2048

これでパスフレーズなしのサーバ鍵が作成される。

テスト用に自己証明書を作成。

# openssl req -new -x509 -days 3650 -sha256 -key /etc/pki/tls/private/test.key -out /etc/pki/tls/certs/test.crt
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:JP
State or Province Name (full name) [Berkshire]:Tokyo
Locality Name (eg, city) [Newbury]:Chiyoda-ku
Organization Name (eg, company) [My Company Ltd]:Pistolfly Co., Ltd.
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:test.pistolfly.jp
Email Address []:webmaster@pistolfly.jp
# apachectl restart

あとは、/etc/httpd/conf.d/ssl.confにバーチャルホストを設定して、
・サーバ鍵と証明書のパス
・その他バーチャルホストの設定
を行う。

Apache, Mac

MacPortsのApache2にテスト用のSSL（自己署名証明書）を設定

コメントする
Chromeに対応するためには、subjectAltNameを設定した自己署名証明書を作成する必要があります。
subjectAltNameが設定されていない証明書はChromeで NET::ERR_CERT_COMMON_NAME_INVALID エラーを参照してください。

SSLのテスト用に、MacPortsでインストールしたApacheにSSLの設定をした。
conf/httpd.conf

# Secure (SSL/TLS) connections
Include conf/extra/httpd-ssl.conf

秘密鍵と証明書ファイルのパスの設定を確認。（デフォルトのまま使用することにする。）
conf/extra/httpd-ssl.conf

#   Server Certificate:
#   Point SSLCertificateFile at a PEM encoded certificate.  If
#   the certificate is encrypted, then you will be prompted for a
#   pass phrase.  Note that a kill -HUP will prompt again.  Keep
#   in mind that if you have both an RSA and a DSA certificate you
#   can configure both in parallel (to also allow the use of DSA
#   ciphers, etc.)
SSLCertificateFile "/opt/local/apache2/conf/server.crt"
#SSLCertificateFile "/opt/local/apache2/conf/server-dsa.crt"
#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.  Keep in mind that if
#   you've both a RSA and a DSA private key you can configure
#   both in parallel (to also allow the use of DSA ciphers, etc.)
SSLCertificateKeyFile "/opt/local/apache2/conf/server.key"
#SSLCertificateKeyFile "/opt/local/apache2/conf/server-dsa.key"

秘密鍵の作成。

$ cd /opt/local/apache2/conf/
$ sudo openssl genrsa -out server.key 2048
Generating RSA private key, 2048 bit long modulus
.......................+++
..+++
e is 65537 (0x10001)

自己証明書を作成。

$ sudo openssl req -new -x509 -days 3650 -sha256 -key server.key -out server.crt
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Tokyo
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:*.example.com
Email Address []:
Mac, PHP

MacPortsでxdebugをインストール

コメントする 
$ sudo port install php5-xdebug
Password:
--->  Fetching php5-xdebug
--->  Attempting to fetch xdebug-2.0.3.tgz from http://www.xdebug.org/files/
--->  Verifying checksum(s) for php5-xdebug
--->  Extracting php5-xdebug
--->  Configuring php5-xdebug
--->  Building php5-xdebug with target all
--->  Staging php5-xdebug into destroot
--->  Installing php5-xdebug 2.0.3_0
    ***************************************************************************
    * To enable the xdebug extension in php, add or edit the following
    * lines in /opt/local/etc/php.ini:
    *
    * zend_extension="/opt/local/lib/php/extensions/no-debug-non-zts-20060613/xdebug.so"
    *
    * Once the extension is installed, you can get a list of the available
    * configuration settings with the following command:
    *
    * % php --ri xdebug
    *
    * For more information and details about configuration settings, see
    * http://www.xdebug.org/docs/
    ***************************************************************************
--->  Activating php5-xdebug 2.0.3_0
--->  Cleaning php5-xdebug

php.iniに以下を追加。

zend_extension="/opt/local/lib/php/extensions/no-debug-non-zts-20060613/xdebug.so"
Mac, PostgreSQL

LeopardにmacportsでPostgreSQL8.2をインストール

コメントする 
$ sudo port install postgresql82
--->  Fetching postgresql82
--->  Attempting to fetch postgresql-8.2.9.tar.bz2 from http://ftp8.us.postgresql.org/postgresql/source/v8.2.9
--->  Attempting to fetch postgresql-8.2.9.tar.bz2 from http://ftp9.us.postgresql.org/pub/mirrors/postgresql/source/v8.2.9
--->  Verifying checksum(s) for postgresql82
--->  Extracting postgresql82
--->  Configuring postgresql82
--->  Building postgresql82
--->  Staging postgresql82 into destroot
--->  Installing postgresql82 8.2.9_0
To use the postgresql server, install the postgresql82-server port
--->  Activating postgresql82 8.2.9_0
--->  Cleaning postgresql82
$ sudo port install postgresql82-server
Password:
--->  Fetching postgresql82-server
--->  Verifying checksum(s) for postgresql82-server
--->  Extracting postgresql82-server
--->  Configuring postgresql82-server
--->  Building postgresql82-server with target all
--->  Staging postgresql82-server into destroot
--->  Creating launchd control script
###########################################################
# A startup item has been generated that will aid in
# starting postgresql82-server with launchd. It is disabled
# by default. Execute the following command to start it,
# and to cause it to launch at startup:
#
# sudo launchctl load -w /Library/LaunchDaemons/org.macports.postgresql82-server.plist
###########################################################
--->  Installing postgresql82-server 8.2.9_0
To create a database instance, after install do
 sudo mkdir -p /opt/local/var/db/postgresql82/defaultdb
 sudo chown postgres:postgres /opt/local/var/db/postgresql82/defaultdb
 sudo su postgres -c '/opt/local/lib/postgresql82/bin/initdb -D /opt/local/var/db/postgresql82/defaultdb'
To tweak your DBMS, consider increasing kern.sysv.shmmax by adding an increased kern.sysv.shmmax .. to /etc/sysctl.conf
--->  Activating postgresql82-server 8.2.9_0
--->  Cleaning postgresql82-server

$ sudo mkdir -p /opt/local/var/db/postgresql82/defaultdb
$ sudo chown postgres:postgres /opt/local/var/db/postgresql82/defaultdb
$ sudo su postgres -c '/opt/local/lib/postgresql82/bin/initdb -D /opt/local/var/db/postgresql82/defaultdb'
Password:
The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.
The database cluster will be initialized with locale ja_JP.UTF-8.
The default database encoding has accordingly been set to UTF8.
fixing permissions on existing directory /opt/local/var/db/postgresql82/defaultdb ... ok
creating subdirectories ... ok
selecting default max_connections ... 30
selecting default shared_buffers/max_fsm_pages ... 2400kB/20000
creating configuration files ... ok
creating template1 database in /opt/local/var/db/postgresql82/defaultdb/base/1 ... ok
initializing pg_authid ... ok
initializing dependencies ... ok
creating system views ... ok
loading system objects' descriptions ... ok
creating conversions ... ok
setting privileges on built-in objects ... ok
creating information schema ... ok
vacuuming database template1 ... ok
copying template1 to template0 ... ok
copying template1 to postgres ... ok
WARNING: enabling "trust" authentication for local connections
You can change this by editing pg_hba.conf or using the -A option the
next time you run initdb.
Success. You can now start the database server using:
    /opt/local/lib/postgresql82/bin/postgres -D /opt/local/var/db/postgresql82/defaultdb
or
    /opt/local/lib/postgresql82/bin/pg_ctl -D /opt/local/var/db/postgresql82/defaultdb -l logfile start
Mac, MySQL

MacPortsでMySQL5をインストール

コメントする 
$ sudo port install mysql5 +server
--->  Fetching mysql5
--->  Verifying checksum(s) for mysql5
--->  Extracting mysql5
--->  Configuring mysql5
--->  Building mysql5 with target all
--->  Staging mysql5 into destroot
--->  Creating launchd control script
###########################################################
# A startup item has been generated that will aid in
# starting mysql5 with launchd. It is disabled
# by default. Execute the following command to start it,
# and to cause it to launch at startup:
#
# sudo launchctl load -w /Library/LaunchDaemons/org.macports.mysql5.plist
###########################################################
--->  Installing mysql5 5.0.67_0+server
******************************************************
* In order to setup the database, you might want to run
* sudo -u mysql mysql_install_db5
* if this is a new install
******************************************************
--->  Activating mysql5 5.0.67_0+server
--->  Cleaning mysql5

自動起動を設定。

$ sudo launchctl load -w /Library/LaunchDaemons/org.macports.mysql5.plist

mysql データベースを設定。

$ sudo -u mysql mysql_install_db5
Installing MySQL system tables...
080902 12:32:58 [Warning] option 'max_join_size': unsigned value 18446744073709551615 adjusted to 4294967295
080902 12:32:58 [Warning] option 'max_join_size': unsigned value 18446744073709551615 adjusted to 4294967295
080902 12:32:58 [Warning] Setting lower_case_table_names=2 because file system for /opt/local/var/db/mysql5/ is case insensitive
OK
Filling help tables...
080902 12:32:58 [Warning] option 'max_join_size': unsigned value 18446744073709551615 adjusted to 4294967295
080902 12:32:58 [Warning] option 'max_join_size': unsigned value 18446744073709551615 adjusted to 4294967295
080902 12:32:58 [Warning] Setting lower_case_table_names=2 because file system for /opt/local/var/db/mysql5/ is case insensitive
OK
To start mysqld at boot time you have to copy
support-files/mysql.server to the right place for your system
PLEASE REMEMBER TO SET A PASSWORD FOR THE MySQL root USER !
To do so, start the server, then issue the following commands:
/opt/local/lib/mysql5/bin/mysqladmin -u root password 'new-password'
/opt/local/lib/mysql5/bin/mysqladmin -u root -h macbook.local password 'new-password'
Alternatively you can run:
/opt/local/lib/mysql5/bin/mysql_secure_installation
which will also give you the option of removing the test
databases and anonymous user created by default.  This is
strongly recommended for production servers.
See the manual for more instructions.
You can start the MySQL daemon with:
cd /opt/local ; /opt/local/lib/mysql5/bin/mysqld_safe &
You can test the MySQL daemon with mysql-test-run.pl
cd mysql-test ; perl mysql-test-run.pl
Please report any problems with the /opt/local/lib/mysql5/bin/mysqlbug script!
The latest information about MySQL is available on the web at
http://www.mysql.com
Support MySQL by buying support/licenses at http://shop.mysql.com

rootユーザのパスワード設定や匿名アカウント、testデータベースの削除などが以下で実行されるらしい。

$ /opt/local/lib/mysql5/bin/mysql_secure_installation

しかし、実行してみたが、匿名アカウントもtestデータベースも残っていたので、
MySQL :: MySQL 5.1 リファレンスマニュアル :: 2.10.3 最初の MySQL アカウントの確保
を参考に、自分でやる。
mysqlコマンドや、rubyのmysqlアダプタをインストールするときにオプションで指定するmysql-configへのパスを通すため、.bash_profileなどで$PATHに
/opt/local/lib/mysql5/bin
を追加しておく。

Ruby, Ruby on Rails

Rails2.1でタイムゾーンを扱う

コメントする

mad.ly - Rails 2.1 Time Zone Support: An Overview --- Rails2.1のタイムゾーンサポートを詳しく解説している。サンプルのアプリもあり分かりやすい。後述する内容も書いてある。
Ruby On Rails ピチカート街道 - Rails 2.1・その１２(DBに登録してあるUTC日付データを簡単変換) - --- コントローラで、以下のようにしてタイムゾーンを設定し直せる。

Time.zone = 'Tokyo'

Class: ActiveSupport::TimeZoneクラスを使用すると、Rails2.1のタイムゾーンサポートで設定したタイムゾーンを考慮したTimeオブジェクトの作成やUTCへの変換が簡単にできる。

# 設定したタイムゾーンでローカルのTimeを作成
t = Time.zone.local(2008, 9, 1, 0, 0)
#=> Mon, 01 Sep 2008 00:00:00 JST +09:00
# UTCに変換
utc = Time.zone.local_to_utc(t)
#=> Sun Aug 31 15:00:00 UTC 2008
Mac, PHP

Leopardにmacportsでphp5をインストール

1件のコメント 
$ sudo port install php5 +postgresql +apache2 +pear
--->  Fetching curl
--->  Attempting to fetch curl-7.18.2.tar.bz2 from http://curl.haxx.se/download/
--->  Verifying checksum(s) for curl
--->  Extracting curl
--->  Configuring curl
--->  Building curl with target all
--->  Staging curl into destroot
--->  Installing curl 7.18.2_0
--->  Activating curl 7.18.2_0
--->  Cleaning curl
--->  Fetching gd2
--->  Attempting to fetch gd-2.0.35.tar.bz2 from http://www.libgd.org/releases/
--->  Verifying checksum(s) for gd2
--->  Extracting gd2
--->  Applying patches to gd2
--->  Configuring gd2
--->  Building gd2 with target all
--->  Staging gd2 into destroot
--->  Installing gd2 2.0.35_1
--->  Activating gd2 2.0.35_1
--->  Cleaning gd2
--->  Fetching libmcrypt
--->  Attempting to fetch libmcrypt-2.5.8.tar.bz2 from http://downloads.sourceforge.net/mcrypt
--->  Verifying checksum(s) for libmcrypt
--->  Extracting libmcrypt
--->  Configuring libmcrypt
--->  Building libmcrypt with target all
--->  Staging libmcrypt into destroot
--->  Installing libmcrypt 2.5.8_0
--->  Activating libmcrypt 2.5.8_0
--->  Cleaning libmcrypt
--->  Fetching mhash
--->  Attempting to fetch mhash-0.9.9.tar.bz2 from http://downloads.sourceforge.net/mhash
--->  Verifying checksum(s) for mhash
--->  Extracting mhash
--->  Configuring mhash
--->  Building mhash with target all
--->  Staging mhash into destroot
--->  Installing mhash 0.9.9_0
--->  Activating mhash 0.9.9_0
--->  Cleaning mhash
--->  Fetching php5
--->  Attempting to fetch php-5.2.6.tar.bz2 from http://www.php.net/distributions/
--->  Verifying checksum(s) for php5
--->  Extracting php5
--->  Configuring php5
--->  Building php5 with target all
--->  Staging php5 into destroot
Warning: php5 requests to install files outside the common directory structure!
--->  Installing php5 5.2.6_1+apache2+macosx+pear
If this is your first install, you might want
cd /opt/local/apache2/modules
/opt/local/apache2/bin/apxs -a -e -n "php5" libphp5.so
* copy  /opt/local/etc/php.ini-dist to  /opt/local/etc/php.ini
--->  Activating php5 5.2.6_1+apache2+macosx+pear
--->  Cleaning php5

variantsの+postgresqlが間違ってた。
variantsを確認。

$ port variants php5
php5 has the variants:
	universal
	darwin_6
	darwin_7
	macosx
	apache: for Apple Apache
	apache2: for current Apache
	fastcgi: add fastcgi binary
	gmp: Add GNU MP functions
	dbase: Add dBase file format support
	imap: enable operation with IMAP protocol
	pspell: Add pspell spell-checking functions
	tidy: add Tidy support
	mssql: add support for MS-SQL server
	snmp: use Apple snmp
	macports_snmp: use MacPorts snmp
	mysql3: build MySQL 3 support
	mysql4: build MySQL 4 support
	mysql5: build MySQL 5 support
	oracle: Add Oracle oci8 database functions with the Oracle Instant Client
	postgresql82: provide postgresql82 support
	postgresql83: provide postgresql83 support
	sqlite: build sqlite support
	ipc: build IPC support
	pcntl: provide process control
	pear: add pear stuff
	readline: Add GNU readline functions
	sockets: Add socket communication functions
	t1lib: Add PostScript Type 1 font support with t1lib

正しくは、+postgresql83。
改めてインストール。ついでにmysql5とsqliteを追加。（MySQL5を先にインストールしておく。）

$ sudo port install php5 +postgresql83 +mysql5 +sqlite +apache2 +pear
--->  Fetching mysql5
--->  Attempting to fetch mysql-5.0.67.tar.gz from http://distfiles.macports.org/mysql5
--->  Verifying checksum(s) for mysql5
--->  Extracting mysql5
--->  Configuring mysql5
--->  Building mysql5 with target all
--->  Staging mysql5 into destroot
--->  Installing mysql5 5.0.67_0
--->  Activating mysql5 5.0.67_0
--->  Cleaning mysql5
--->  Fetching php5
--->  Verifying checksum(s) for php5
--->  Extracting php5
--->  Configuring php5
--->  Building php5 with target all
--->  Staging php5 into destroot
Warning: php5 requests to install files outside the common directory structure!
--->  Installing php5 5.2.6_1+apache2+macosx+mysql5+pear+postgresql83+sqlite
If this is your first install, you might want
cd /opt/local/apache2/modules
/opt/local/apache2/bin/apxs -a -e -n "php5" libphp5.so
* copy  /opt/local/etc/php.ini-dist to  /opt/local/etc/php.ini
--->  Activating php5 5.2.6_1+apache2+macosx+mysql5+pear+postgresql83+sqlite
Error: Target org.macports.activate returned: Image error: Another version of this port (php5 @5.2.6_1+apache2+macosx+pear) is already active.
Error: Status 1 encountered during processing.

最初のインストールが残っていたので、activateできなかったみたい。
いったんアンインストールしてインストールしなおす。

$ sudo port uninstall php5
--->  The following versions of php5 are currently installed:
--->  	php5 @5.2.6_1+apache2+macosx+mysql5+pear+postgresql83+sqlite
--->  	php5 @5.2.6_1+apache2+macosx+pear (active)
Error: port uninstall failed: Registry error: Please specify the full version as recorded in the port registry.

php5が複数あるからフルで指定しないとアンインストールできないらしい。

$ sudo port uninstall php5 @5.2.6_1+apache2+macosx+pear
--->  Deactivating php5 5.2.6_1+apache2+macosx+pear
--->  Uninstalling php5 5.2.6_1+apache2+macosx+pear

アンインストールできたので、インストールしなおす。

$ sudo port install php5 +postgresql83 +mysql5 +sqlite +apache2 +pear
--->  Activating php5 5.2.6_1+apache2+macosx+mysql5+pear+postgresql83+sqlite
--->  Cleaning php5

インストールは終わっていたようで、activateだけされた。
インストール時のメッセージにある通り、apxsでapacheにphp5モジュールを追加する。

$ cd /opt/local/apache2/modules/
$ sudo /opt/local/apache2/bin/apxs -a -e -n "php5" libphp5.so
Password:
[activating module `php5' in /opt/local/apache2/conf/httpd.conf]

添付されているサンプルからphp.iniをコピー。

$ sudo cp /opt/local/etc/php.ini-dist /opt/local/etc/php.ini

/opt/local/apache2/conf/httpd.confに以下を追加。

Include conf/extras-conf/mod_php.conf