php|architect - The site for PHP professionals » apache

Modsecurity: Why it matters to PHP

Orlando Medina — Fri, 09 Jul 2010 13:00:14 +0000

There is a new book released that should be in the libraries of web application developers everywhere. The title? ModSecurity Handbook:The Complete Guide to the Popular Open Source Web Application Firewall by Ivan Ristic. What is ModSecurity in the first place? Why does it matter to you? What makes this book important to the practice of web application design?

ModSecurity is a web application firewall. It can live in and out of the Apache web server environment, one of the most popular web servers around. ModSecurity is infinitely customizable and extremely powerful. The philosophy of ModSecurity can be summed up in a few words. Look, and only modify if I tell you to. It sports a custom rule engine that makes it extremely powerful. The syntax takes a little bit of work to wrap your head around, but the learning curve is not terrible. It’s an efficient system that aims to cut out unnecessary logic and expressions and focus solely on the job of security. That being said, the rule language is rich and extensible. It is quite possible to make use of external scripts (such as php) to do specific security tasks. Additionally, the use of Lua is extremely useful. According to the author, the rule system will cover about 80% of the needs for most tasks. The last 20% or so where you need a ‘real’ programming language is covered by Lua and its tight integration with ModSecurity. Now, as a disclaimer, ModSecurity is not an excuse to make you a lazy programmer. You still need to use good, secure programming practices to make your clients’ applications secure as well as useful.

Now, the book. Why is this book so important? It is THE source for ModSecurity if you care at all about the application. This book covers everything from download and install to configuration and to creating your own rule sets. Additionally, this book was written by the author that created ModSecurity, Ivan Ristic. The book reads like your best programmer friend sitting right next to you guiding you as to what to do step by step. I am going to be extremely honest with you though, ModSecurity isn’t the easiest thing in the world to implement at first glance, but the rewards are well worth it. This book teaches you step by step how to reap those rewards and build a reasonably secure system for your clients. Seeing the steps on how to block basic attacks such as XSS attacks, and brute force attacks were intriguing and educational. It made me think about how I could implement these same techniques into my programming. Additionally, the comprehensive reference manual was a great touch and welcome addition. A lot of books just give tutorials, but sometimes a simple paragraph or bullet point is needed to explain a component.

The book itself takes some time and digestion. I am convinced that this book needs more than one read to get all the benefits from it. That being said, the additional reads will make you a better programmer and put you ahead the pack. Feisty Duck publishes a hardcopy of the book and a digital version.

Bing Powered 404 for non-WordPress websites

Cal Evans — Thu, 17 Jun 2010 11:00:47 +0000

Ok, after my last post on using the Bing Search Wrapper for handing 404 errors in WordPress I had several people tell me that while they liked the idea, they didn’t want to install WordPress just so they can have intelligent 404 errors. Several other people pinged me and suggested a way that you could use the Bing Search API to handle 404′s without WordPress. As a public service, I am going to try and bridge the gap between these two groups. Going on leads provided by friends, I have hammered out a solution that works with Apache and PHP.

Step 1: Write a 404 Handler page.

This technique is predicated on the fact that Apache lets you define your own pages for handling every error. In this example We will define a script, name it 404.php and place it in the web root.

You will notice that this is a very plain, black and white page. Feel free to decorate it to taste. The one on my personal site actually designed using my WordPress template so it matches my blog. (you can see it by clicking here, http://calevans.com/bing-rocks)

If you want to skip this step, here is a simple one, just copy and paste it. Make sure you put in your domain name and your Bing App Id

setQuery('')
     ->setWebCount(10)
     ->setSource('web')
     ->setSite('YOUR DOMAIN GOES HERE')
     ;

   $raw    = $o->search();
   $result = json_decode($raw);

?>






calevans dot com 404 page



 I'm sorry, we couldn't find what you are looking for.
However, here are the top 10 links from Bing for this site. I hope one of them is what you are looking for.

SearchResponse->Web->Results as $value) {
           printf('%s',$value->Url,$value->Title);
       }
?>

Step 2: Configure Apache

If you are not familiar with Apache config files, this one is going to be a bit tricky. The only generic advice I can give you is, back everything up, they are only text files. Unless you delete things without backups, it’s really hard to do permanent damage. Oh and if you do manage to do permanent damage, I am not responsible.

My Apache is configured with name based virtual hosts. As such I have a separate Apache conf file for each domain and all the settings go in those files. As such, inside my tag I place the line:


ErrorDocument 404 /404.php

Now restart Apache and you too can type in:
http://example.com/bing-rocks
and get something that looks like this:


Or, if you are lucky enough to have a designer like the lovely and talented Kathy Then you may have something that looks like this:



Apache CouchDB hits 0.11.0, drops "alpha" and "beta"
Carl Anderson — Tue, 30 Mar 2010 12:30:49 +0000
Today, Noah Slater, release manager of the Apache CouchDB project, announced the release of CouchDB 0.11.0.  CouchDB is a document-oriented database and is one of the poster children of the NoSQL movement.
The latest release of CouchDB has a long list of changes, including:

Added support for building a Windows installer as part of “make dist”
Added optional “raw” binary collation for faster view builds where Unicode collation is not important
Improved view information objects
Improved speed and concurrency of config lookups
Various improvements to the Futon UI

CouchDB 0.11.0 is the first release of the software that does not carry the “alpha” or “beta” tag.  Whether this means the product can be considered production-ready is up to you, but the CouchDB wiki lists quite a number of projects already using the software.
I recently sat down and started playing with CouchDB, trying to wrap my head around this new way of “doing databases.”  The CouchDB Wiki is a good place to start, although I found that it seems to presume a decent amount of prior knowledge (a definite hindrance to me, since I lack some of that prior knowledge!).
There’s also an online version of O’Reilly’s CouchDB: The Definitive Guide, and I found this useful to get myself started—although you should note that a few places were a tad out-of-date relative to the latest release (at least, that’s how it appeared to me).  Nothing critical, though.
If you haven’t yet tried CouchDB, I recommend you do so; it’s definitely a different way of doing things than traditional relational databases, and it takes some getting used to, but it feels very natural after a while.  Of course, it’s not necessarily going to outright replace your existing SQL-based data stores, but for the right project, it’ll surely be useful.
You can download CouchDB 0.11.0 from the CouchDB downloads page.  You’ll also find a list of the changes incorporated in 0.11.0 there.



PHP on IBM i servers
Marco Tabini — Wed, 17 Mar 2010 14:30:13 +0000
Zeev Suraski, co-founder and CTO of Zend, has been interviewed on the TEC 2010 conference’s blog about the involvement of Zend with the IBM i operating system and its renewed PHP support. IBM i is one of the three operating systems officially supported on IBM Power Systems, the others being AIX and Linux.
The proposed solution involves the (now complete) porting of Zend Studio IDE and of the full-stack platform Zend Server as packages for the IBM i platform. Zend Server is a complete stack of products that comprises Apache as the web server, PHP as the script engine and a set of database drivers for it.
In particular, this Zend Server edition is notable for its capability of totally replacing the older Zend Core and Zend Platform products for IBM i, and will be shipped in its Community Edition in the maintenance updates of IBM i, along with Zend Studio and the IBM products. Zend Server Community Edition will be freely available with one year of support, and the correspondent enterprise edition will also be immediately available for upgrading. The full edition comprehends caching and monitoring features, and is intended for use in production servers.
On the technical side, Zend Server does not require more than one Apache instance running at the same time (unlike the older products providing PHP for IBM i), happily integrating with the existing IBM i Apache installation. It also includes an IBM i-specific toolkit for the management in the PHP environment of RPG queues, data queues and spooled files. Thanks to the optimization and integration work, the overall performance on IBM i is now widely improved from the era of Zend Core and Zend Platform, up to a 3x factor.