Usually when you are trying to do something on linux and have no ideea you usually google it. I was doing it myself recently when i had to put up a new web server with apache 2 and i just decided to change from the standard mod php to fastcgi spawned php and from regular prefork MPM to the worker one.
Well trust me i’ve been crawling all the net for several days and i found so many advices and tips and mini howtos, that in the end all the info got so mixed in my head i was unable to figure it out.
So i started out step-by-step and reading all the readme files and docs of apache and php alike as well as fcgi specs.
I’m publishing this just for the reason of being usefull to other persons like me, rather than just have “YET ANOTHER” howto alongside miriads of others.

But let’s just start

You may or may not know that PHP is considered not to be thread-safe therefore not suitable to be run in multi-threaded envs like apache with worker-mpm. Well i’ve decided to test on my own and see if those statements are true and if i manage to get to see the “PHP has encountered an access violation at memory_address” error. I wouldnt like to dissapoint people at neosmart.net[http://neosmart.net/blog/2008/dont-believe-the-lies-php-isnt-thread-safe-yet/] and i wouldnt want by comments to earn a collective cockpunch but my experience with fcgi’d PHP5 under apache+worker=mpm is the best possible one.

I’m not covering all the apache2 initiald eploy, and even if you didnt installed any of htem yet the command i’ll issue will check dependencies and ask you to install all the other pre-requisites. Pay attention to the fact that when you are trying to install the apache2-mpm-worker package your Debian will want to uninstall the libapache2-mod-php5 one. That’s because the PHP5 module is not compatible with the multithreaded version of apache. It only owrk with standard prefork MPM.

So we are goign to use worker but there’s no more php5 module. Worry not as we will run it as cgi within fastcgi thus freeing apache itself that will only serve static content as images, html files, css etc, while all dynamic php content will be served by php itself.

gw1-livent:~# apt-get install apache2-mpm-worker libapache2-mod-fcgid
Reading package lists… Done
Building dependency tree… Done
The following extra packages will be installed:
apache2.2-common
The following packages will be REMOVED:
apache2-mpm-prefork libapache2-mod-php5
The following NEW packages will be installed:
apache2-mpm-worker libapache2-mod-fcgid
The following packages will be upgraded:
apache2.2-common
1 upgraded, 2 newly installed, 2 to remove and 75 not upgraded.
Need to get 1424kB of archives.
After unpacking 5349kB disk space will be freed.
Do you want to continue [Y/n]?

Just pressing enter will continue with the installation of the necessary packages.
The fastcgi module will be enabled at install time. You should see something like

Setting up libapache2-mod-fcgid (1.10-2) …
Module fcgid installed; run /etc/init.d/apache2 force-reload to enable.

However, if you dont you will need to enable it manual using:

gw1-livent:~# a2enmod fcgid

And you should see the same message “Module fcgid installed; run /etc/init.d/apache2 force-reload to enable.”
Make sure to edit you /etc/apache/mods-enabled/fcgid.conf so it looks like:

<IfModule mod_fcgid.c>
AddHandler fcgid-script .fcgi
SocketPath /var/lib/apache2/fcgid/sock
IPCConnectTimeout 20
</IfModule>

Now that we are done with the fastcgi part we need to reinstall PHP5 which was previously uninstalled.

gw1-livent:~# apt-get install php5-cgi php5-curl php5-gd php5-ldap php5-mysql php5-sqlite php5-xsl

(Feel free to browse the php5 packages and modify the line above to suit your php5 extensions requirements)

In order to make use of the freshly installed php under fastcgi we will need to enable fastcgi/php support per virtualhost basis.
So assuming you have the domain.com this is what the virtualhost configuration should look like:
(You may have other config lines and stuff , i am just giving you an example)

<VirtualHost www.domain.com:80>
ServerName www.domain.com
ServerAlias domain.net
ServerAdmin admin@domain.com
DocumentRoot /var/www/dn

<Directory /var/www/domain>
AddHandler fcgid-script .php
FCGIWrapper /usr/lib/cgi-bin/php5 .php
Options ExecCGI Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
AllowOverride None
Options ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>

ErrorLog /var/log/apache2/domain-error.log
CustomLog /var/log/apache2/domain-access.log combined
LogLevel warn
ServerSignature On
</VirtualHost>

All the trick is done by these lines:

AddHandler fcgid-script .php
FCGIWrapper /usr/lib/cgi-bin/php5 .php
Options ExecCGI

Now you should just restart apache and test out your new domain by using

<?php phpinfo(); ?>

inside a newly created index.php file. (or you can name whatever you want)

I hope this does help you folks
Over and out

Andy

Chapter 1 – Basic configuration

First we should have (i assume you already have) installed the vsftpd daemon and the libpam-mysql and mysql.

#apt-get install vsftpd libpam-mysql mysql-server

Even if the purpose of the howto is to work with mysql stored username we will need to create a local user. Create it and all aditional directories:

#mkdir /home/ftp
#useradd ftpguest -d /home/ftp
#chown ftpguest.nogroup /home/ftp

Next create the mysql ftp virtual user to operate on mysql:

#mysqladmin -u root -p create ftpvuser

Connect to the mysql server to create the database and to create the tables:

#mysql -u root -p
mysql> create database ftpvuser;
Query OK, 1 row affected (0.00 sec)
mysql> use ftpvuser;
Database changed
mysql> CREATE TABLE users (username varchar (20) NOT NULL,
-> password varchar(40) NOT NULL,
-> PRIMARY KEY (username)) TYPE=MyISAM;
Query OK, 0 rows affected, 1 warning (0.00 sec)

then grant permission to an user to this database:

mysql> grant select on ftpvuser.users to ftpguest@localhost identified by ‘YourPassword’;
Query OK, 0 rows affected (0.04 sec)

This next step is necessary only if you are going to setup Chapter 2 configuration for different users with different permissions.

mysql> insert into users (username,password) values (‘normal’,'555555′);
Query OK, 1 row affected (0.00 sec)
mysql> insert into users (username,password) values (‘admin’,'666666′);
Query OK, 1 row affected (0.00 sec)
mysql> insert into users (username,password) values (‘webmaster’,'777777′);
Query OK, 1 row affected (0.00 sec)
mysql>quit;

Next edit if it exists or create the vsftpd pam config under /etc/pam.d/vsftpd:

#nano -w /etc/pam.d/vsftpd

And add these lines:

auth required pam_mysql.so user=ftpguest passwd=YourPassword host=localhost db=ftpvuser table=users usercolumn=username passwdcolumn=password crypt=0
account required pam_mysql.so user=ftpguest passwd=YourPassword host=localhost db=ftpvuser table=users usercolumn=username passwdcolumn=password crypt=0

Now open up your /etc/vsftpd.conf. Edit it as you may see fit and setup all options you like then restart your vsftpd server:

#/etc/init.d/vsftpd stop
#/etc/init.d/vsftpd start

For the record some vsftpd.conf options that you will need to set are:

# comment this line to disable anonymous logins
#anonymous_enable=YES
# enable local access
local_enable=YES
# enable guest access
guest_enable=YES
guest_username=ftpguest
# chroot local users
chroot_local_user=YES

Now test your ftp server quickly. If you cannot login and you get the errror 500 OOPS : cap_set_proc that its because of the SELinux. To fix this problem you will need to load the capability module into your running kernel:

#modprobe capability

To load this module automatically at each server restart add the capability module to your /etc/modules.

If you would like to restrict access to the ftp server and allow it only from certain IP addresses you will need to make use of the tcp_wrappers and enable it in your /etc/vsftpd.conf:

# TCP Wrappers
tcp_wrappers=YES

Deny all incoming connections by default in /etc/hosts.deny by adding:

vsftpd: ALL

Specify the allowed connection in /etc/hosts.allow by adding:

vsftpd: 192.168.0.,210.83.200.200 : setenv VSFTPD_LOAD_CONF /etc/vsftpd/vsftpd.anonymous
vsftpd: ALL : setenv VSFTPD_LOAD_CONF /etc/vsftpd/vsftpd.virtual

Next create the necessary files:

#mkdir /etc/vsftpd/
#nano -w /etc/vsftpd/vsftpd.anonymous

and add to it:

anonymous_enable=YES

then

#nano -w /etc/vsftpd/vsftpd.virtual

and add to it:

anonymous_enable=NO

Note you should add the ftp users into your mysql database using phpmyadmin or by building your own web app to do that. I dont cover this aspect here.

Chapter 2 – Different users with different permissions (optional)

This is a standalone chapter apart form the original configuration. It shows how to create different users with different permissions using vsftpd configuration files. We have performed the mysql users config for this chapter in the previous step adding in the `users` table the users “normal”, “admin” and “webmaster”.

#nano -w /etc/vsftpd.conf

and add to it:

user_config_dir=/etc/vsftpd/vsftpd_user_conf

Now we should allow ordinary users to download/upload. For this we should do the following:

#mkdir /etc/vsftpd/vsftpd_user_conf
#nano /etc/vsftpd/vsftpd_user_conf/normal

with the following content

anon_world_readable_only=NO
write_enable=YES
anon_upload_enable=YES
anon_mkdir_write_enable=YES

Also we need to allow admins to download/upload/delete and so on:

#cp /etc/vsftpd/vsftpd_user_conf/normal /etc/vsftpd/vsftpd_user_conf/admin
#nano -w /etc/vsftpd/vsftpd_user_conf/admin

and make it look like:

# Allow rename and delete the file
anon_other_write_enable=YES
# Users have to be a local user with the same permissions
virtual_use_local_privs=YES
# allows documents attributes modifications
chmod_enable=YES

And the webmaster configuration file:

#cp /etc/vsftpd/vsftpd_user_conf/admin /etc/vsftpd/vsftpd_user_conf/webmaster

Edit the webmaster configuration files to look like:

#FTP home directory at the website’s home directory
local_root=/var/www
# Because the uploaded files are owned by ftpguest
# other users are not allowed to access these files
# and especially the apache user www-data. To fix this
# we specify the local umask to 033
local_umask=033

With all these being said i hope this helps you.
I have been looking long time ago for this kind of setup. I wrote this tutorial like 2 years ago and it used to be on my website before i had to shut it down. Then i lost my db backups and all my tutorials got lost. But i am re-writting them one by one and hopefully even more.

Thank you

I assume you’ve already logged in on your server. Allright. Let’s go to /usr/src.

gw1-livent:~# cd /usr/src/
gw1-livent:/usr/src#

We get the bind9 source.

gw1-livent:/usr/src# apt-get source bind9
Reading package lists… Done
Building dependency tree… Done
Need to get 4347kB of source archives.
Get:1 http://ftp.debian.org etch/main bind9 1:9.3.4-2etch3 (dsc) [897B]
Get:2 http://ftp.debian.org etch/main bind9 1:9.3.4-2etch3 (tar) [4044kB]
Get:3 http://ftp.debian.org etch/main bind9 1:9.3.4-2etch3 (diff) [302kB]
Fetched 4347kB in 1s (2971kB/s)
dpkg-source: extracting bind9 in bind9-9.3.4
dpkg-source: unpacking bind9_9.3.4.orig.tar.gz
dpkg-source: applying ./bind9_9.3.4-2etch3.diff.gz
gw1-livent:/usr/src#

We download the mysql-bind.tar.gz package from sourceforge.net (you may as well pick other mirror as i used Switch)

gw1-livent:/usr/src# wget http://switch.dl.sourceforge.net/sourceforge/mysql-bind/mysql-bind.tar.gz
–18:56:17– http://switch.dl.sourceforge.net/sourceforge/mysql-bind/mysql-bind.tar.gz
=> `mysql-bind.tar.gz’
Resolving switch.dl.sourceforge.net… 130.59.138.20, 2001:620:0:1b::20
Connecting to switch.dl.sourceforge.net|130.59.138.20|:80… connected.
HTTP request sent, awaiting response… 200 OK
Length: 14,019 (14K) [application/x-tar]

100%[==============================================>] 14,019 –.–K/s

18:56:18 (93.41 KB/s) – `mysql-bind.tar.gz’ saved [14019/14019]

gw1-livent:/usr/src#

We unpack it and go into the newly created directory.

gw1-livent:/usr/src# tar zxvf mysql-bind.tar.gz
mysql-bind/
mysql-bind/COPYING
mysql-bind/mysqldb.h
mysql-bind/ChangeLog
mysql-bind/.cvsignore
mysql-bind/mysqldb.c~
mysql-bind/ChangeLog~
mysql-bind/CVS/
mysql-bind/CVS/Entries
mysql-bind/CVS/Root
mysql-bind/CVS/Repository
mysql-bind/mysqldb.c
mysql-bind/README
mysql-bind/README~
mysql-bind/zonetodb.c
gw1-livent:/usr/src# cd mysql-bind
gw1-livent:/usr/src/mysql-bind#

Now we will need to copy the necessary files into the bind9 source directory.

gw1-livent:/usr/src/mysql-bind# cp mysqldb.c ../bind9-9.3.4/bin/named/
gw1-livent:/usr/src/mysql-bind# cp mysqldb.c ../bind9-9.3.4/bin/named/include/
gw1-livent:/usr/src/mysql-bind# cp mysqldb.h ../bind9-9.3.4/bin/named/
gw1-livent:/usr/src/mysql-bind# cp mysqldb.h ../bind9-9.3.4/bin/named/include/

Now we will need to edit some files on the bind9 source before actually compiling it. But before we will need to install some other pre-requisites for this installation. As Debian default install doesnt have some packages that we need we will install them now.

gw1-livent:/usr/src/mysql-bind# apt-get install fakeroot debhelper libmysqlclient15-dev

We will edit the Makefile.in file in /usr/src/bind9-9.3.4/bin/named/ and add some proper values to DBDRIVER_OBJS, DBDRIVER_SRCS, DBDRIVER_INCLUDES and DBDRIVER_LIBS parameters. Now open /usr/src/bind9-9.3.4/bin/named/Makefile.in with your favourite editor and search for:

#
# Add database drivers here.
#
DBDRIVER_OBJS =
DBDRIVER_SRCS =
DBDRIVER_INCLUDES =
DBDRIVER_LIBS =

.. which should at this step look like

#
# Add database drivers here.
#
DBDRIVER_OBJS = mysqldb.@O@
DBDRIVER_SRCS = mysqldb.c
DBDRIVER_INCLUDES =
DBDRIVER_LIBS =

For the next two values we will need to find out mysql configuration values that we will insert.
First let’s find for DBDRIVER_INCLUDES:

gw1-livent:/usr/src/bind9-9.3.4/bin/named# mysql_config –cflags
-I/usr/include/mysql -DBIG_JOINS=1
gw1-livent:/usr/src/bind9-9.3.4/bin/named#

Second DBDRIVER_LIBS …

gw1-livent:/usr/src/bind9-9.3.4/bin/named# mysql_config –libs
-L/usr/lib/mysql -lmysqlclient
gw1-livent:/usr/src/bind9-9.3.4/bin/named#

Now we add these values to the same part in Makefile.in so it looks like:

#
# Add database drivers here.
#
DBDRIVER_OBJS = mysqldb.@O@
DBDRIVER_SRCS = mysqldb.c
DBDRIVER_INCLUDES = -I/usr/include/mysql -DBIG_JOINS=1
DBDRIVER_LIBS = -L/usr/lib/mysql -lmysqlclient

Ok, we are done with this file. We are gonna edit now /usr/src/bind9-9.3.4/bin/named/main.c. Open it in your favorite editor and look for:

#include <dst /result.h>

/*
* Defining NS_MAIN provides storage declarations (rather than extern)
* for variables in named/globals.h.
*/

After #include on a new line add #include “include/mysqldb.h” so it looks like:

#include <dst /result.h>
#include "include/mysqldb.h"

/*
* Defining NS_MAIN provides storage declarations (rather than extern)
* for variables in named/globals.h.
*/

In the same file main.c search for:

/*
* Add calls to register sdb drivers here.
*/
/* xxdb_init(); */

ns_server_create(ns_g_mctx, &ns_g_server);
}

and change it so it looks like

/*
* Add calls to register sdb drivers here.
*/
/* xxdb_init(); */
mysqldb_init();
ns_server_create(ns_g_mctx, &ns_g_server);
}

then search for:

/*
* Add calls to unregister sdb drivers here.
*/
/* xxdb_clear(); */

isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,

and make sure it looks like:

/*
* Add calls to unregister sdb drivers here.
*/
/* xxdb_clear(); */
mysqldb_clear();
isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_MAIN,

Save the file main.c and exit now. We are gonna make one more change in the file mysqldb.c that came in the mysql-bind package since it’s broken.
Open the file /usr/src/bind9-9.3.4/bin/named/mysqldb.c in your favorite text editor and look for the last include line that should look like:

#include <named /mysqldb.h>

Change the line so it looks:

#include “include/mysqldb.h”

As we are done editing the files we can now proceed with the build of bind9-mysql debian packages. Change the directory to /usr/src/bind9-9.3.4

gw1-livent:/usr/src/bind9-9.3.4/bin/named# cd ../../
gw1-livent:/usr/src/bind9-9.3.4#

Build it.

gw1-livent:/usr/src/bind9-9.3.4# dpkg-buildpackage -rfakeroot -b

If you get a message like:

dpkg-buildpackage: source package is bind9
dpkg-buildpackage: source version is 1:9.3.4-2etch3
dpkg-buildpackage: source changed by LaMont Jones
dpkg-buildpackage: host architecture i386
dpkg-buildpackage: source version without epoch 9.3.4-2etch3
dpkg-checkbuilddeps: Unmet build dependencies: bison texlive-latex-base xsltproc
dpkg-buildpackage: Build dependencies/conflicts unsatisfied; aborting.
dpkg-buildpackage: (Use -d flag to override.)

then you will need to install the extra required packages by issuing:

gw1-livent:/usr/src/bind9-9.3.4# apt-get install bison texlive-latex-base xsltproc

The apt-get install process will ask your confirmation regarding the installation of these packages and as soon as you agree it will go downloading and installing them. Assuming you didnt need to do this step or that you didnt even encountered we continue.
After the dpkg-buildpackage is done and successfull you should see at the end among the last few lines:

dpkg-deb: building package `bind9′ in `../bind9_9.3.4-2etch3_i386.deb’.
dpkg-deb: building package `bind9-host’ in `../bind9-host_9.3.4-2etch3_i386.deb’.
dpkg-deb: building package `libbind-dev’ in `../libbind-dev_9.3.4-2etch3_i386.deb’.
dpkg-deb: building package `libbind9-0′ in `../libbind9-0_9.3.4-2etch3_i386.deb’.
dpkg-deb: building package `libdns22′ in `../libdns22_9.3.4-2etch3_i386.deb’.
dpkg-deb: building package `libisc11′ in `../libisc11_9.3.4-2etch3_i386.deb’.
dpkg-deb: building package `liblwres9′ in `../liblwres9_9.3.4-2etch3_i386.deb’.
dpkg-deb: building package `libisccc0′ in `../libisccc0_9.3.4-2etch3_i386.deb’.
dpkg-deb: building package `libisccfg1′ in `../libisccfg1_9.3.4-2etch3_i386.deb’.
dpkg-deb: building package `dnsutils’ in `../dnsutils_9.3.4-2etch3_i386.deb’.
dpkg-deb: building package `lwresd’ in `../lwresd_9.3.4-2etch3_i386.deb’.

That means that all required bind9 debian packages were built and they are available one directory before the bind9 source. Therefore we go up one directory:

gw1-livent:/usr/src/bind9-9.3.4# cd ../
gw1-livent:/usr/src#

and install our fresh built bind9 with mysql backend with all the other bind9 related libraries and utilities:

gw1-livent:/usr/src# dpkg -i bind9_9.3.4-2etch3_i386.deb bind9-doc_9.3.4-2etch3_all.deb bind9-host_9.3.4-2etch3_i386.deb dnsutils_9.3.4-2etch3_i386.deb libbind9-0_9.3.4-2etch3_i386.deb libbind-dev_9.3.4-2etch3_i386.deb libdns22_9.3.4-2etch3_i386.deb libisc11_9.3.4-2etch3_i386.deb libisccc0_9.3.4-2etch3_i386.deb libisccfg1_9.3.4-2etch3_i386.deb liblwres9_9.3.4-2etch3_i386.deb lwresd_9.3.4-2etch3_i386.deb

This is about all about building bind9 with mysql on Debian Etch.

Now you will need a basic structure for your mysql domain database and an example of how to add a domain to your named.conf.

The entry in named.conf will look something like this:

zone “mydomain.com” {
type master;
notify no;
database “mysqldb dbname tablename hostname user password”;
};

You should create a database for the driver and add one table for each domain. The following SQL will create a table for one domain. Change mydomain to something that will represent the domain more clearly.

CREATE TABLE mydomain (
name varchar(255) default NULL,
ttl int(11) default NULL,
rdtype varchar(255) default NULL,
rdata varchar(255) default NULL
) TYPE=MyISAM;

The following is an SQL dump of an example table for a domain. The entries should be familiar to anyone who is familiar with BIND zone files. Change it to match your domain.

INSERT INTO mydomain VALUES (‘mydomain.com’, 259200, ‘SOA’, ‘mydomain.com. www.mydomain.com. 200309181 28800 7200 86400 28800′);
INSERT INTO mydomain VALUES (‘mydomain.com’, 259200, ‘NS’, ‘ns0.mydomain.com.’);
INSERT INTO mydomain VALUES (‘mydomain.com’, 259200, ‘NS’, ‘ns1.mydomain.com.’);
INSERT INTO mydomain VALUES (‘mydomain.com’, 259200, ‘MX’, ‘10 mail.mydomain.com.’);
INSERT INTO mydomain VALUES (‘w0.mydomain.com’, 259200, ‘A’, ‘192.168.1.1′);
INSERT INTO mydomain VALUES (‘w1.mydomain.com’, 259200, ‘A’, ‘192.168.1.2′);
INSERT INTO mydomain VALUES (‘mydomain.com’, 259200, ‘Cname’, ‘w0.mydomain.com.’);
INSERT INTO mydomain VALUES (‘mail.mydomain.com’, 259200, ‘Cname’, ‘w0.mydomain.com.’);
INSERT INTO mydomain VALUES (‘ns0.mydomain.com’, 259200, ‘Cname’, ‘w0.mydomain.com.’);
INSERT INTO mydomain VALUES (‘ns1.mydomain.com’, 259200, ‘Cname’, ‘w1.mydomain.com.’);
INSERT INTO mydomain VALUES (‘www.mydomain.com’, 259200, ‘Cname’, ‘w0.mydomain.com.’);
INSERT INTO mydomain VALUES (‘ftp.mydomain.com’, 259200, ‘Cname’, ‘w0.mydomain.com.’);

With all these being said i really hope this article helps many of you. It took some time to elaborate and make it step by step but it worths. I will also attach the packages built for this tutorial for those that will simply want to get them, install them and have it running.

Note: the downloads below are available only for registered members of Digitalnerds.

Thank you very much for your attention.

The Digitalnerd

Linus Torvalds – the creator of the Linux kernel and its current maintainer – is by all accounts a brilliant human being. He can also be incredibly crass and rude. Case in point is a post he made to the Linux Kernel mailing list (LKML) yesterday, where he offered his opinion on security research and specifically the OpenBSD operating system (which is security centric).

It’s soo rude that it’s ‘funny’ – that is if you’re not an OpenBSD developer or have a particular affection for monkeys.

Torvalds wrote:

Security people are often the black-and-white kind of people that I can’t  stand. I think the OpenBSD crowd is a bunch of masturbating monkeys, in that they make such a big deal about concentrating on security to the point where they pretty much admit that nothing else matters to them.

The gist of Torvalds’ longer argument is that there are more interesting bugs out there than just security bugs. On that topic I heartily agree with the God of Linux. While I am also a contributor to the security bug hype often focusing stories that I write on those issues, as a user I know full well that it’s often the ‘regular’ bugs that are the issues that actually affect me the most.