doc/gutshtml/LON - view

File: [LON-CAPA] / doc / gutshtml / LON
Revision 1.1: download - view: text, annotated - select for diffs
Fri Jun 28 20:30:29 2002 UTC (22 years, 5 months ago) by www
Branches: MAIN
CVS tags: version_2_9_X, version_2_9_99_0, version_2_9_1, version_2_9_0, version_2_8_X, version_2_8_99_1, version_2_8_99_0, version_2_8_2, version_2_8_1, version_2_8_0, version_2_7_X, version_2_7_99_1, version_2_7_99_0, version_2_7_1, version_2_7_0, version_2_6_X, version_2_6_99_1, version_2_6_99_0, version_2_6_3, version_2_6_2, version_2_6_1, version_2_6_0, version_2_5_X, version_2_5_99_1, version_2_5_99_0, version_2_5_2, version_2_5_1, version_2_5_0, version_2_4_X, version_2_4_99_0, version_2_4_2, version_2_4_1, version_2_4_0, version_2_3_X, version_2_3_99_0, version_2_3_2, version_2_3_1, version_2_3_0, version_2_2_X, version_2_2_99_1, version_2_2_99_0, version_2_2_2, version_2_2_1, version_2_2_0, version_2_1_X, version_2_1_99_3, version_2_1_99_2, version_2_1_99_1, version_2_1_99_0, version_2_1_3, version_2_1_2, version_2_1_1, version_2_1_0, version_2_12_X, version_2_11_X, version_2_11_5_msu, version_2_11_5, version_2_11_4_uiuc, version_2_11_4_msu, version_2_11_4, version_2_11_3_uiuc, version_2_11_3_msu, version_2_11_3, version_2_11_2_uiuc, version_2_11_2_msu, version_2_11_2_educog, version_2_11_2, version_2_11_1, version_2_11_0_RC3, version_2_11_0_RC2, version_2_11_0_RC1, version_2_11_0, version_2_10_X, version_2_10_1, version_2_10_0_RC2, version_2_10_0_RC1, version_2_10_0, version_2_0_X, version_2_0_99_1, version_2_0_2, version_2_0_1, version_2_0_0, version_1_99_3, version_1_99_2, version_1_99_1_tmcc, version_1_99_1, version_1_99_0_tmcc, version_1_99_0, version_1_3_X, version_1_3_3, version_1_3_2, version_1_3_1, version_1_3_0, version_1_2_X, version_1_2_99_1, version_1_2_99_0, version_1_2_1, version_1_2_0, version_1_1_X, version_1_1_99_5, version_1_1_99_4, version_1_1_99_3, version_1_1_99_2, version_1_1_99_1, version_1_1_99_0, version_1_1_3, version_1_1_2, version_1_1_1, version_1_1_0, version_1_0_99_3, version_1_0_99_2, version_1_0_99_1, version_1_0_99, version_1_0_3, version_1_0_2, version_1_0_1, version_1_0_0, version_0_99_5, version_0_99_4, version_0_99_3, version_0_99_2, version_0_99_1, version_0_99_0, version_0_6_2, version_0_6, version_0_5_1, version_0_5, version_0_4, stable_2002_july, loncapaMITrelate_1, language_hyphenation_merge, language_hyphenation, conference_2003, bz6209-base, bz6209, STABLE, HEAD, GCI_3, GCI_2, GCI_1, BZ4492-merge, BZ4492-feature_horizontal_radioresponse, BZ4492-feature_Support_horizontal_radioresponse, BZ4492-Support_horizontal_radioresponse

HTML version of GUTS manual. Individual files will still need cleanup.

<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta name=Title content="LON-CAPA on the Linux Filesystem"> <meta name=Keywords content=""> <meta http-equiv=Content-Type content="text/html; charset=macintosh"> <meta name=ProgId content=Word.Document> <meta name=Generator content="Microsoft Word 10"> <meta name=Originator content="Microsoft Word 10"> <link rel=File-List href="LON_files/filelist.xml"> <title>LON-CAPA on the Linux Filesystem</title>  <style>  </style> </head> <body bgcolor=white lang=EN-US link=blue vlink=purple style='tab-interval:.5in'> <div class=Section1> <h1>LON-CAPA on the Linux Filesystem</h1> Scott Harrison, freeware volunteer, sharrison@sourceforge.net June 4, 2002 <pre> Contents 1. Introduction 2. The LON-CAPA Source Files 3. Active Filesystem Directories of Importance 4. The Installation Mechanism 5. Automated Testing 6. Software Packages 7. Security on the Filesystem </pre> <h2><a name="_Toc421867156">1. Introduction</a></h2> LON-CAPA currently consists of 695 files placed in 56 different directories on a linux filesystem. There are also 9 different symbolic links. There are 11 different file ownership/permission categories under which files are securely installed. For the last 2 years, an average of 1 new file per day was included into the LON-CAPA distribution. A conservative estimate is that 10 files were modified each day in the LON-CAPA source tree. In order to maintain a robust build-installation framework consistent with the many changes, all information pertaining to the LON-CAPA installation has been kept in a well-formatted XML-valid document. The XML document "renders" LON-CAPA from a CVS source tree to the Linux filesystem (the XML document can also be used to build RPMs, display documentation, and conduct status-checking reports). There have been few, if any, bugs related to the XML specification of the LON-CAPA software. Thus, throughout the software development and version releases of LON-CAPA, there has most always been a complete, bug-free specification of what files comprise the LON-CAPA software. For more information about this XML-based approach, please visit http://lpml.sourceforge.net/. LON-CAPA is well-supported on RedHat Linux operating systems version 6.2 and version 7.3. LON-CAPA is also known to run well on Mandrake and Debian, however there is no specified installation procedure for these operating systems (a Debian installation procedure is currently under development). There currently do not exist LON-CAPA installations on BSD-UNIX or MacOS/X systems (I remain curious though as to whether a programmer or institution will pioneer this strategy). Given the current level of new LON-CAPA feature requests and frequency of new software versions, we suggest that most users plan on using RedHat so as to reduce high-frequency system administration overhead. LON-CAPA is interdependent with a variety of Linux operating system services and software packages. Thus, a challenge exists to maintain the correct set of software packages (e.g. with RedHat, software packages are called RPMs) with the correct configurations. Past efforts have sought to completely automate the handling of software packages and their configuration. The new existing strategy is to test for proper operation of system services (architecturally termed as "horizontal layers") and make recommendations (to a knowledgeable linux administrator) as to how software packages or configurations should be adjusted. <h2><a name="_Toc421867157">2. The LON-CAPA Source Files</a></h2> Of the 695 files which make up the LON-CAPA distribution, 492 of these files can be thought of as interface widgets or templates. The widgets and templates are organized into ten different file "globs". <![if !supportLists]>1.     <![endif]>Template files for generating new resources (28 files) source-to-target: loncapa/loncom/homework/templates/* -> /home/httpd/html/res/adm/includes/templates/ <![if !supportLists]>2.     <![endif]>Icons for providing a HTML-tabled view of a course map (109 files) source-to-target: loncapa/rat/images/*.gif -> /home/httpd/html/adm/rat/ <![if !supportLists]>3.     <![endif]>Icons to indicate an unexpected result (6 files) source-to-target: loncapa/loncom/html/adm/lonKaputt/*.* -> /home/httpd/html/adm/lonKaputt/ <![if !supportLists]>4.     <![endif]>Logos and general widget icons (108 files) source-to-target: loncapa/loncom/html/adm/lonIcons/*.* -> /home/httpd/html/adm/lonIcons/ <![if !supportLists]>5.     <![endif]>Miscellaneous resources (9 files) source-to-target: loncapa/loncom/html/adm/lonMisc/*.* -> /home/httpd/html/adm/lonMisc/ <![if !supportLists]>6.     <![endif]>XML files which assign unicode numbers to mathematical symbols using <! ENTITY...> type syntax (26 files) source-to-target: loncapa/loncom/MathML/*.ent -> /home/httpd/html/adm/MathML/ <![if !supportLists]>7.     <![endif]>Icons used for the entire LON-CAPA user interface (80 files) source-to-target: loncapa/loncom/html/res/adm/pages/*.gif -> /home/httpd/html/res/adm/pages/ <![if !supportLists]>8.     <![endif]>Icons used for directory indexing (89 files) source-to-target: loncapa/loncom/html/res/adm/pages/indexericons/*.gif -> /home/httpd/html/res/adm/pages/indexericons/ <![if !supportLists]>9.     <![endif]>Icons used for the bookmark portion of the LON-CAPA user interface (23 files) source-to-target: loncapa/loncom/html/res/adm/pages/bookmarkmenu/*.gif -> /home/httpd/html/res/adm/pages/bookmarkmenu/ <![if !supportLists]>10.  <![endif]>Files associated with the scheme of displaying bookmarks (3 files) source-to-target: loncapa/loncom/html/res/adm/pages/bookmarkmenu/*.html -> /home/httpd/html/res/adm/pages/bookmarkmenu/ A second grouping of files are the 124 scripts, documentation files, shared object libraries and other extraneous files for LON-CAPA. A third (and highly important) grouping of files are the 77 mod-perl Apache web handler modules. These modules coordinate how the system interacts with the web interface delivered by the LON-CAPA system. For example, the spreadsheet, search engine, graphing, and homework formatting features of LON-CAPA are all transacted by different Apache web handler modules. More information on the LON-CAPA Apache web handlers can be read about in the section titled "LON-CAPA and the 77 Web Handlers". In addition to the total 695 files of LON-CAPA, 9 symbolic links are also created. 7 of these links exist inside the /etc/rc.d/ directories and are used to facilitate the launching of LON-CAPA network services (i.e. <tt>lonc</tt> and <tt>lond</tt>). Another link makes LON-CAPA resources available in their "raw" format (/home/httpd/html/raw is linked to /home/httpd/html/res). Another link makes /etc/mime.types equivalent with /etc/httpd/conf/mime.types to support backwards compatibility with various software packages for various RedHat releases. <h2><a name="_Toc421867158">3. Active Filesystem Directories of Importance</a></h2> Of the 56 different directory locations where LON-CAPA files are stored, there are about a dozen directory locations of high significance for both operating and understanding the LON-CAPA software <ul type=disc> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/httpd/lonTabs/ tab-formatted reference files; e.g. <tt>hosts.tab</tt> (cross-networked servers) and <tt>spare.tab</tt> (load-balancing servers) </li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/httpd/perl/ perl scripts for managing the LON-CAPA system; e.g. <tt>lond</tt> (remote TCP command interpreter) </li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/httpd/perl/logs/ location where system performance and error logs are kept; e.g. <tt>lonnet.log</tt> (messages from the LON-CAPA web layer); <tt>lonnet.log.1</tt>, <tt>lonnet.log.2</tt> (time-cycled past versions of <tt>lonnet.log</tt>); <tt>lond.pid</tt> (the parent process of all the <tt>lond</tt> children processes) </li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/httpd/html/lon-status/ location where online logs are kept that are viewable over the world-wide web; e.g. <tt>index.html</tt> (a summary file of all the error messages, warning messages, and connection states) and <tt>londchld/*</tt> (files that contain status reports from each <tt>lond</tt> process) </li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/httpd/lib/perl/ location of LON-CAPA non-web mod-perl handlers; e.g. <tt>localauth.pm</tt> (module for handling institution-customized user-password authentication) </li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/httpd/lib/perl/Apache/ location of LON-CAPA web mod-perl handlers; see the section titled "LON-CAPA and the 77 Web Handlers"; e.g. <tt>lonnet.pm</tt> (server-side socket connections) and <tt>lonsearchcat.pm </tt>(the LON-CAPA search catalogue) </li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/httpd/sockets/ lonc-related sockets (client portals for sending data to other machines) </li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/httpd/lonUsers/ Home directories of local users. There is a five-tier structure to the directories: [domain]/[firstletter]/[secondletter]/[thirdletter]/[userid]. For example, a user "fredflint" at MSU would have his information located in lonUsers/msu/f/r/e/fredflint. Or, for example, a user "thelma" at Ohio University would have her information located in lonUsers/ohiou/t/h/e/thelma. Within this directory there are a variety of files which govern the scope of what a user can do within the LON-CAPA system. A passwd file determines the type of authentication mechanism to use. There also are files such as roles.hist (and its database compilation, roles.db) which specify the roles and privileges for a user in the LON-CAPA system. </li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/httpd/lonIDs/ cookie jar, the location where the server can validate browser cookies present in client-side browsers (such as Internet Explorer or Netscape Communicator) </li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/httpd/html/res/DOMAIN/ publication space (or cache) for a domain; e.g. Simon Frasier University resources are specified in the <tt>/home/httpd/html/res/sfu/</tt> directory (note that the 'sfu' abbreviation is defined in <tt>/home/httpd/lonTabs/hosts.tab</tt>) </li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l106 level1 lfo101;tab-stops:list .5in'>/home/USER/ construction space for a user (standard linux user home directory); e.g. <tt>/home/korte/</tt>, <tt>/home/lucasm/</tt>, or <tt>/home/jensen/</tt> </li> </ul> <h2><a name="_Toc421867159">4. The Installation Mechanism</a></h2> <h3><a name="_Toc421867160">4.1 Standard procedure</a></h3> To install LON-CAPA on a running RedHat Linux operating system, the procedure is as described at http://install.lon-capa.org/. The procedure is intentionally limited to an initial one-line command (for simplicity's sake). To summarize: Download the most current <a href="http://install.lon-capa.org/versions/current/loncapa.tar.gz">loncapa.tar.gz</a>. <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> <tt>wget http://install.lon-capa.org/versions/current/loncapa.tar.gz </tt> <tt>tar xzvf loncapa.tar.gz</tt> <tt>cd loncapa</tt> </td> </tr> </table> The UPDATE command will refresh your filesystem with all the latest LON-CAPA software. <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> <tt>./UPDATE</tt> </td> </tr> </table> Upon running the <tt>./UPDATE</tt> command, the user is presented with questions regarding the set up of their LON-CAPA server. For instance, the following is a summary question which verifies the machine-specific configuration variables (that are stored inside <tt>/etc/httpd/conf/loncapa.conf</tt>): <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'><pre> =============================================================================== This is now the current configuration of your machine. 1) Domain Name: msu 2) Machine Name: rawhidel1 3) System Administrator's E-mail Address: harris41@spock.lite.msu.edu 4) Role: library 5) Cache Expiration Time: 86400 6) Server Load: 2.00 7) Everything is correct up above ENTER A CHOICE OF 1-6 TO CHANGE, otherwise ENTER 7: </pre></td> </tr> </table> The formatting and valid ASCII character usage are interactively monitored by the UPDATE script. <h3><a name="_Toc421867161">4.2 XML specification</a></h3> <tt>loncapa/doc/loncapafiles/loncapafiles.lpml</tt> is an XML file that contains all the information pertaining to the LON-CAPA installation. Even though <tt>loncapa/doc/loncapafiles/loncapafiles.lpml</tt> is present in the "doc" directory of the LON-CAPA source tree, it is the most critical file of the software build-installation process. <tt>loncapa/doc/loncapafiles/loncapafiles.lpml</tt> is referenced by many different <tt>loncapa/loncom/build/Makefile</tt> targets. An example entry inside <tt>loncapa/doc/loncapafiles/loncapafiles.lpml</tt> is: <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'><pre> <file> <source>rat/lonwrapper.pm</source> <target dist='default'>home/httpd/lib/perl/Apache/lonwrapper.pm</target> <categoryname>handler</categoryname> <description> Wrapper for external and binary files as standalone resources. Edit handler for rat maps; TeX content handler. </description> <status>works/unverified</status> </file> </pre></td> </tr> </table> LPML is an XML document-type definition which is described at http://lpml.sourceforge.net/. <h3><a name="_Toc421867162">4.3 Makefile</a></h3> <tt>loncapa/loncom/build/Makefile</tt> is the "engine" of the source code tree (i.e. the aforementioned <tt>./UPDATE</tt> script simply calls different <tt>Makefile</tt> targets consecutively). Ordinarily, only software developers bypass the <tt>./UPDATE</tt> script and utilize the <tt>Makefile</tt> targets directly. There are currently 40 targets present in the <tt>Makefile</tt> (each target is invoked with the syntax "<tt>make TARGETNAME</tt>" from the <tt>loncapa/loncom/build/</tt> directory.. Of these targets, there are several targets of common usage. These common targets are described immediately below. make install: this installs configuration files, non-configuration files, configures the Apache <tt>httpd.conf</tt> file, runs a sanity check on the operating system; generally speaking, this target does everything associated with installing and upgrading files on a LON-CAPA filesystem. make rawinstall: this installs configuration files and non-configuration files (without extra bells-and-whistles such as configuring the <tt>httpd.conf</tt> file or running a sanity check). make configinstall: this installs configuration files and is a sub-target of the rawinstall and install targets. make build: this compiles all files that need to be compiled from the LON-CAPA source tree. make test: this runs software functionality tests. <h2><a name="_Toc421867163">5. Automated Testing</a></h2> The goal is to test for proper operation of system services and make recommendations (to a knowledgeable linux administrator) as to how software packages or configurations should be adjusted. The importance of a diagnostic test tool is especially relevant when installing LON-CAPA on non-RedHat Linux systems, or for testing installation procedures for new RedHat version releases. In terms of better developer-to-user interactions, the current experience is that automated testing has helped speed the identification of problems associated with the server configuration and software dependencies. <h3><a name="_Toc421867164">5.1 Standard Procedure for Testing</a></h3> After running the <tt>./UPDATE</tt> command from the <tt>loncapa.tar.gz</tt> LON-CAPA distribution, the user should then run the <tt>./TEST</tt> command to ensure the continuing correct operation of the LON-CAPA software. <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> <tt>./TEST</tt> </td> </tr> </table> Using the TEST command may be an iterative process. It is normal to expect that the <tt>./TEST</tt> command will recommend for users to perform various steps to ensure optimal performance of their LON-CAPA server. <h3><a name="_Toc421867165">5.2 Testing the System Services (MySQL, perl libraries, etc)</a></h3> Two of the most important (yet occasionally tricky) system services to handle are those involving 1) the MySQL database and 2) the dozens of perl software packages needed from http://www.cpan.org/ (as described in <tt>loncapa/doc/otherfiles/perl_modules.txt</tt>). The testing of these system dependencies is performed inside the <tt>loncapa/loncom/build/system_dependencies/</tt> directory. MySQL testing checks for: <ul type=disc> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l9 level1 lfo102;tab-stops:list .5in'>the presence of a MySQL server</li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l9 level1 lfo102;tab-stops:list .5in'>the status of the MySQL server</li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l9 level1 lfo102;tab-stops:list .5in'>the necessary perl modules (such as <tt>DBI</tt>)</li> <li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; mso-list:l9 level1 lfo102;tab-stops:list .5in'>and most importantly, the run-time ability to connect to the MySQL "loncapa" database through the <tt>DBI</tt> interface module.</li> </ul> In the event of failed testing, the user is prompted as to what changes to make to their operating system. LON-CAPA relies on the presence of multiple CPAN (http://www.cpan.org/) perl modules which are not ordinarily distributed with RedHat operating systems. Examples include <tt>Digest-MD5</tt>, <tt>Math-FFT</tt>, <tt>GDTextUtil</tt>, and <tt>Algorithm-Diff</tt>. In the event of missing perl modules, the user is prompted to update their system with either a LON-CAPA-systemperl-*.*-rh72.i386.rpm package or a LON-CAPA-systemperl-*.*-1.i386.rpm package. <h3><a name="_Toc421867166">5.3 Testing the LON-CAPA Web Interface</a></h3> The testing of the LON-CAPA web layer is performed inside the <tt>loncapa/loncom/build/weblayer_test/</tt> directory. Simulated web transactions are conducted; this ordinarily would be considered "black-box" testing. Currently, a test login has been implemented. The machine's host id and domain for LON-CAPA is determined (read from <tt>/etc/httpd/conf/loncapa.conf</tt>). A password is randomly generated and a test user with a name beginning with 'ZXQTEST' is created within the <tt>/home/httpd/lonUsers/</tt> directory. A test login is run by using the LWP::UserAgent perl module. Password encryption that ordinarily occurs by javascript is simulated with the perl Crypt::DES module. In the event of a failed login, the system administrator is prompted with corrective suggestions such as "Are lonc and lond running on the system?". <h3><a name="_Toc421867167">5.4 Testing the Installation Mechanism</a></h3> The testing of the installation is performed inside the <tt>loncapa/loncom/test/</tt> directory. Since a great deal of the installation mechanism relies on the ability to compare the files inside the LON-CAPA source tree with the target filesystem, most of the tests relate to the file comparison utilities. <h2><a name="_Toc421867168">6. Software Packages</a></h2> <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> <tt>./CHECKRPMS</tt> </td> </tr> </table> In addition to the <tt>./TEST</tt> and <tt>./UPDATE</tt> commands, there is a <tt>./CHECKRPMS</tt> command. The <tt>./CHECKRPMS</tt> command first attempts to contact different RedHat RPM mirrors. When successful contact is made, <tt>./CHECKRPMS</tt> compares the RPM version numbers (based on an intelligent method designed by Martin Siegert at Simon Frasier University) and outputs a list of RPMs that the system administrator should update. Updating RPMs is an important task to do for security. Quite often, even those RPMs that are not directly associated with system networking can present security holes (e.g. imlib, zlib, diffutils, and man all have had security updates in the last year). <tt>./CHECKRPMS</tt> relies upon Martin Siegert's <tt>check-rpms</tt> script which exists in the <tt>loncapa/loncom/build/</tt> source directory. For more information on the advanced usage of <tt>check-rpms</tt>: <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> <tt>cd loncapa/loncom/build; perldoc ./check-rpms</tt> </td> </tr> </table> Some advanced usage hints: To automatically update RPMs for a RedHat 6.2 system: <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> <tt>check-rpms -v -r --update -ftp rufus.w3.org/linux/redhat/updates/6.2/en/os </tt> </td> </tr> </table> To automatically update RPMs for a RedHat 6.2 system: <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> <tt>check-rpms -v -r --update -ftp rufus.w3.org/linux/redhat/updates/6.2/en/os </tt> </td> </tr> </table> To download needed RPMs for a RedHat 6.2 system: <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> <tt>check-rpms -v -r -d /var/tmp/rpms -dl -ftp</tt> </td> </tr> </table> <h2><a name="_Toc421867169">7. Security on the Filesystem</a></h2> Multiple processes controlled by multiple entities exist on a LON-CAPA server system. On a typical LON-CAPA library server, many different members of an institution will have author accounts by which they can log onto the server. The goal is to prevent these different user accounts from accessing other user directories (or sensitive information files such as password-files) on a LON-CAPA system. Two things are done to accomplish this on the filesystem. 1) A typical user is a member of only his or her own group. 2) A user's home directory can only be read by the user or root or the web-server processes. The web-server processes are owned by the 'www' user. In order for web-server processes to work with the home directories of each user, the 'www' user is made a member of each user's personal group. For example, on a system with korte, lucasm, and jensen as authors (and thus standard Linux account users with filesystem privileges), www would be a member of the 'korte' group, the 'lucasm' group, and the 'jensen' group as defined in the <tt>/etc/group</tt> and <tt>/etc/group-</tt> files. Several system interactions require the 'www' user to have the ability of the all-powerful 'root' user. (Future plans are for this to be mediated by 'sudo'.) Currently, there are several setuid-root scripts described in <tt>loncapa/doc/loncapafiles/loncapafiles.lpml</tt>. These setuid scripts allow 'www' processes to add new system users, change passwords, and password authentication against shadow passwords. In order to ensure proper access and execution rights to various LON-CAPA software files, multiple file ownership/permission categories are supported in <tt>loncapa/doc/loncapafiles/loncapafiles.lpml</tt> as shown in the table below. <table border=1 cellpadding=0 width="60%" style='width:60.0%;mso-cellspacing: 1.5pt;mso-padding-alt:5.0pt 5.0pt 5.0pt 5.0pt'> <tr> <td style='background:white;padding:5.0pt 5.0pt 5.0pt 5.0pt'> Category Name<o:p></o:p> </td> <td style='background:white;padding:5.0pt 5.0pt 5.0pt 5.0pt'> Permissions (development)<o:p></o:p> </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> interface file </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0644 www:www </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> setuid script </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 6755 root:root </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> handler </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0600 www:www </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> static conf </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0444 root:root </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> conf </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0644 root:root </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> script </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0700 www:www </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> graphic file </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0400 www:www </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> doc </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0644 root:root </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> system file </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0644 root:root </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> root script </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0700 root:root </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> symbolic link </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> root:root </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> standard </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0755 root:root </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> server standard </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0755 www:www </td> </tr> <tr> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> server readonly </td> <td style='padding:5.0pt 5.0pt 5.0pt 5.0pt'> 0700 www:www </td> </tr> </table> During a brand-new installation, in order to make LON-CAPA work on a system with shadow passwords, the system administrator must manually configure and compile a <tt>mod_auth_external</tt> software package. Instructions for this, as currently described on http://install.lon-capa.org/ are: First ensure the existence of a 'www' user. If 'www' does not yet exist on the system, then create: <table border=1 cellpadding=0 bgcolor="#aaaaaa" style='mso-cellspacing:1.5pt; background:#AAAAAA'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> <tt>/usr/sbin/useradd www</tt> </td> </tr> </table> <h3><a name=shadow></a><a name="_Toc421867170">Make a LON-CAPA system work with shadow passwords</a></h3> <table border=1 cellpadding=0 style='mso-cellspacing:1.5pt'> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> Step #<o:p></o:p> </td> <td style='padding:.75pt .75pt .75pt .75pt'> Description<o:p></o:p> </td> </tr> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> 1 </td> <td style='padding:.75pt .75pt .75pt .75pt'> Is your system using shadow passwords? (Note: LON-CAPA will work with either MD5/non-MD5 configured systems). If your system is not using shadow passwords, then do not perform any of the additional steps. If your system is using shadow passwords, then you will need to perform the additional steps below. How to detect: command: <tt>cat /etc/passwd | grep ':x:'</tt> If there is output such as "<tt>root:x:0:0:root:/root:/bin/bash</tt>", then your system is using shadow passwords and you will need to continue with the steps below. </td> </tr> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> 2 </td> <td style='padding:.75pt .75pt .75pt .75pt'> Retrieve the mod_auth_external source by running the following command <tt>wget http://www.wwnet.net/~janc/software/mod_auth_external-2.1.13.tar.gz </tt> </td> </tr> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> 3 </td> <td style='padding:.75pt .75pt .75pt .75pt'> Unpack the mod_auth_external source by running the following command <tt>tar xzvf mod_auth_external-2.1.13.tar.gz</tt> </td> </tr> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> 4 </td> <td style='padding:.75pt .75pt .75pt .75pt'> Go to the <tt>pwauth</tt> directory by running the following command <tt>cd mod_auth_external-2.1.13/pwauth/</tt> </td> </tr> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> 5 </td> <td style='padding:.75pt .75pt .75pt .75pt'> Edit <tt>config.h</tt> and change SERVER_UIDS definition Determine the user id of 'www': <tt>grep ^www /etc/passwd | cut -d':' -f3</tt> Change the line <tt>#define SERVER_UIDS 99 /* user "nobody" */</tt> to be <tt>#define SERVER_UIDS 513 /* user "www" */</tt> where in this example 513 corresponds to the user id of 'www'. </td> </tr> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> 6 </td> <td style='padding:.75pt .75pt .75pt .75pt'> Compile the <tt>pwauth</tt> executable by running the following command <tt>make</tt> </td> </tr> <tr> <td style='padding:.75pt .75pt .75pt .75pt'> 7 </td> <td style='padding:.75pt .75pt .75pt .75pt'> Install <tt>pwauth</tt> by doing the following <tt>cp pwauth /usr/local/sbin/</tt> <tt>chmod 6755 /usr/local/sbin/pwauth</tt> Edit (creating the file) /etc/pam.d/pwauth to have the contents: <pre>         auth       required     /lib/security/pam_pwdb.so shadow nullok         auth       required     /lib/security/pam_nologin.so         account    required     /lib/security/pam_pwdb.so </pre></td> </tr> </table> <![if !supportEmptyParas]> <![endif]><o:p></o:p> </div> <div class=Section2> <![if !supportEmptyParas]> <![endif]><o:p></o:p> </div> </body> </html>