A. You can easily filter large number of IPs or subnets using pf firewall. PF provides tables to hold large number of IPv4 and IPv6 address. Lookups against a table are very fast and consume less memory and processor time. Tables are created in pf.conf file. Tables can also be populated from text files containing a list of IP addresses and networks.

How do I configure tables to drop large number of IPs?

Open pf.conf file, enter:
# vi /etc/pf.conf
Add following code:
table <blockedips> persist file "/etc/pf.blocked.ip.conf"
ext_if="em1" # interface connected to internet
Add following code to drop and log all ips / subnet listed in /etc/pf.blocked.ip.conf, file
block drop in log (all) quick on $ext_if from <blockedips> to any
Save and close the file. Now create file /etc/pf.blocked.ip.conf file using vi text editor, enter:
vi /etc/pf.blocked.ip.conf
Sample output:

192.168.1.0/24
202.54.1.5
# 202.54.4.5

The file /etc/pf.blocked.ip.conf should contain a list of IP addresses and/or CIDR network blocks, one per line. Any line beginning with # is treated as a comment and ignored by pf. To load new rules, simply type:
# pfctl -nf /etc/pf.conf
# pfctl -f /etc/pf.conf

How do I view all IP address listed in tables?

Type the following command
# pfctl -t blockedips -T show
Sample output:

   58.65.232.0/21
   58.83.12.0/22
   64.28.176.0/20
   64.255.128.0/19
   66.231.64.0/20
   67.213.128.0/20
   69.8.176.0/20

How do I add subnet called 91.196.232.0/22 on the fly?

Use pfctl command itself, to add CIDR or IP on fly, enter:
# pfctl -t blockedips -T add 202.54.11.11
# pfctl -t blockedips -T add 91.196.232.0/22

How do I delete subnet called 91.196.232.0/22 on the fly?

Type the command as follows:
# pfctl -t blockedips -T delete 91.196.232.0/22
Please note that all changes made using pfct are dynamic. You need to update your file on disk to save the changes.

How do I see statistics for each IP / CIDR?

The -v option can display statistics for each table entry (IP/CIDR), enter:
# pfctl -t blockedips -T show -v
Sample output:

   216.243.240.0/20
        Cleared:     Thu Jul 10 03:01:01 2008
        In/Block:    [ Packets: 0                  Bytes: 0                  ]
        In/Pass:     [ Packets: 0                  Bytes: 0                  ]
        Out/Block:   [ Packets: 0                  Bytes: 0                  ]
        Out/Pass:    [ Packets: 0                  Bytes: 0                  ]
   216.255.176.0/20
        Cleared:     Thu Jul 10 03:01:01 2008
        In/Block:    [ Packets: 0                  Bytes: 0                  ]
        In/Pass:     [ Packets: 0                  Bytes: 0                  ]
        Out/Block:   [ Packets: 0                  Bytes: 0                  ]
        Out/Pass:    [ Packets: 0                  Bytes: 0                  ]

How do I view log of dropped IP from default /var/log/pflog file?

Use tcpdump command to read a log file:
# tcpdump -n -e -ttt -r /var/log/pflog
# tcpdump -n -e -ttt -r /var/log/pflog port 80
# tcpdump -n -e -ttt -r /var/log/pflog and host 202.33.1.2
You can also view log in real time, enter:
# tcpdump -n -e -ttt -i pflog0
# tcpdump -n -e -ttt -i pflog0 port 80
# tcpdump -n -e -ttt -i pflog0 host 202.33.1.2

Article copy pasted from here: http://www.cyberciti.biz/faq/opebsd-pf-firewall-block-subnets-ip-address/

Example


ServerName python.dev
ServerAdmin webmaster@python.dev
DocumentRoot "/usr/local/www/apache22/data/sites/python.dev"

Example of index.py

def application(environ, start_response):
status = '200 OK'
output = 'Hee ello 34 World!'

return [output]


restart apache & check http://python.dev

1. Install samba via ports, make install clean
Lets assume that username is “hockey”

2. put in rc.conf

nmbd_enable="YES"

smbd_enable="YES"

3. edit smb.conf

mcedit /usr/local/etc/smb.conf

with

[global]

 workgroup = samba

 server string = SambaServer

 security = user

 hosts allow = 192.168. 192.168.2. 127.

[hockey]

 comment = hockey stuff

 path = /home/hockey

 valid users = hockey

 public = no

 writable = yes

 printable = no

 create mask = 0644

4.

hockey# smbpasswd -a hockey

New SMB password:

Retype new SMB password:

Added user hockey.

5. start samba daemon

/usr/local/etc/rc.d/samba start

7. check ifconfig ip address

open from windows

\\192.168.81.130\hockey\share

username: hockey (without: HOCKEY/)

pass:[password]

done

On top level use command:

\application
    \files
    \tmp

> svn st
M  files
?  tmp

> svn propedit svn:ignore ./

> svn proplist
Properties on '.':
  svn:ignore

> svn propget svn:ignore
tmp

how to delete svn:ignore?
1. just use "svn propedit" again and remove what should be removed
or totally remove properties from dir:
2. svn propdel svn:ignore ./ 

end.

SSH (Secure Shell) can be set up with public/private key pairs so that you don’t have to type the password each time. Because SSH is the transport for other services such as SCP (secure copy), SFTP (secure file transfer), and other services (CVS, etc), this can be very convenient and save you a lot of typing.

SSH Version 2

On the local machine, type the BOLD part. The non-bold part is what you might see as output or prompt.

• Step 1:
  % ssh-keygen -t dsa
  Generating public/private dsa key pair.
  Enter file in which to save the key (~/.ssh/id_dsa): (just type return)
  Enter passphrase (empty for no passphrase): (just type return)
  Enter same passphrase again: (just type return)
  Your identification has been saved in ~/.ssh/id_dsa
  Your public key has been saved in ~/.ssh/id_dsa.pub
  The key fingerprint is:
  Some really long string
  %
• Step 2:
  Then, paste the content of the local ~/.ssh/id_dsa.pub file into the file ~/.ssh/authorized_keys on the remote host.

• RSA instead of DSA
  • If you want something strong, you could try
    % ssh-keygen -t rsa -b 4096
  • Instead of the names id_dsa and id_dsa.pub, it will be id_rsa and id_rsa.pub, etc.
  • The rest of the steps are identical.

That’s it!

FAQ:

• Q: I follow the exact steps, but ssh still ask me for my password!
• A: Check your remote .ssh directory. It should have only your own read/write/access permission (octal 700)
  % chmod 700 ~/.ssh

SSH Version 1

• Step 1:
  % cd ~/.ssh
  % ssh-keygen -t rsa1
  Generating public/private rsa1 key pair.
  Enter file in which to save the key (~/.ssh/identity): (just type return)
  Enter passphrase (empty for no passphrase): (just type return)
  Enter same passphrase again: (just type return)
  Your identification has been saved in ~/.ssh/identity
  Your public key has been saved in ~/.ssh/identity.pub
  The key fingerprint is:
  Some really long string
  %
• Step 2:
  Then, paste content of the local ~/.ssh/identity.pub file into the file ~/.ssh/authorized_keys on the remote host.

Found here: http://www.ece.uci.edu/~chou/ssh-key.html

Maven’s Objectives

Maven’s primary goal is to allow a developer to comprehend the complete state of a development effort in the shortest period of time. In order to attain this goal there are several areas of concern that Maven attempts to deal with:

• Making the build process easy
• Providing a uniform build system
• Providing quality project information
• Providing guidelines for best practices development
• Allowing transparent migration to new features

Feature Summary

The following are the key features of Maven in a nutshell:

• Simple project setup that follows best practices – get a new project or module started in seconds
• Consistent usage across all projects means no ramp up time for new developers coming onto a project
• Superior dependency management including automatic updating, dependency closures (also known as transitive dependencies)
• Able to easily work with multiple projects at the same time
• A large and growing repository of libraries and metadata to use out of the box, and arrangements in place with the largest Open Source projects for real-time availability of their latest releases
• Extensible, with the ability to easily write plugins in Java or scripting languages
• Instant access to new features with little or no extra configuration
• Ant tasks for dependency management and deployment outside of Maven
• Model based builds: Maven is able to build any number of projects into predefined output types such as a JAR, WAR, or distribution based on metadata about the project, without the need to do any scripting in most cases.
• Coherent site of project information: Using the same metadata as for the build process, Maven is able to generate a web site or PDF including any documentation you care to add, and adds to that standard reports about the state of development of the project. Examples of this information can be seen at the bottom of the left-hand navigation of this site under the “Project Information” and “Project Reports” submenus.
• Release management and distribution publication: Without much additional configuration, Maven will integrate with your source control system such as CVS and manage the release of a project based on a certain tag. It can also publish this to a distribution location for use by other projects. Maven is able to publish individual outputs such as a JAR, an archive including other dependencies and documentation, or as a source distribution.
• Dependency management: Maven encourages the use of a central repository of JARs and other dependencies. Maven comes with a mechanism that your project’s clients can use to download any JARs required for building your project from a central JAR repository much like Perl’s CPAN. This allows users of Maven to reuse JARs across projects and encourages communication between projects to ensure that backward compatibility issues are dealt with. We are collaborating with the folks at Ibiblio who have graciously allowed the central repository to live on their servers.

root@hockey(~)# whereis maven
maven: /usr/ports/devel/maven

root@hockey(~)# cd /usr/ports/devel/maven
root@hockey(/usr/ports/devel/maven)# make install clean

……

You may initialize your repository with:
/usr/local/share/java/maven/bin/install_repo.sh ~/.maven/repository

If you are behind a proxy, create a ~/.mavenrc file with something like:
MAVEN_OPTS=”$MAVEN_OPTS -Dmaven.proxy.host=YOUR_PROXY_HOSTNAME
-Dmaven.proxy.port=YOUR_PROXY_PORT”
===>   Registering installation for maven-1.0.2_2
===>  Cleaning for maven-1.0.2_2

done

* More than 500 million active users
* 50% of our active users log on to Facebook in any given day
* Average user has 130 friends
* People spend over 700 billion minutes per month on Facebook

Activity on Facebook

* There are over 900 million objects that people interact with (pages, groups, events and community pages)
* Average user is connected to 80 community pages, groups and events
* Average user creates 90 pieces of content each month
* More than 30 billion pieces of content (web links, news stories, blog posts, notes, photo albums, etc.) shared each month.

Global Reach

* More than 70 translations available on the site
* About 70% of Facebook users are outside the United States
* Over 300,000 users helped translate the site through the translations application

Platform

* More than one million developers and entrepreneurs from more than 180 countries
* Every month, more than 70% of Facebook users engage with Platform applications
* More than 550,000 active applications currently on Facebook Platform
* More than one million websites have integrated with Facebook Platform
* More than 150 million people engage with Facebook on external websites every month
* Two-thirds of comScore’s U.S. Top 100 websites and half of comScore’s Global Top 100 websites have integrated with Facebook

Mobile

* There are more than 150 million active users currently accessing Facebook through their mobile devices.
* People that use Facebook on their mobile devices are twice as active on Facebook than non-mobile users.
* There are more than 200 mobile operators in 60 countries working to deploy and promote Facebook mobile products

So, guess what?
Exactly, this one will output: 2, qTop instead of 3,q

Known Microsoft issue aroung getElementById fixed in IE8.

1. download tar.gz from atlassian site
2. create new user for ex.: “wiki” (better with .cshrc)
3. add “setenv JAVA_HOME /usr/local/jdk1.6.0″ to .cshrc
4. check with echo $JAVA_HOME
5. create new dir in /home/wiki/confluence-data

6. set home directory for confluence
confluence.home = /home/wiki/confluence-data
in [common]/confluence/WEB-INF/classes/confluence-init.properties

7. change port for server (usually 8080 is busy)
<Connector className=”org.apache.coyote.tomcat4.CoyoteConnector” port=”8090″ minProcessors=”5″ …

6. start bin/.startup.sh
7. check sockstat -4
8. open http://192.168.81.128:8090
9. config other option via jira via web interface
[10. choose embedded storage for testing purposes]

done

/usr/local/etc/rc.d/mysql-server stop

2. update /etc/my.cfg with adding new config

default-storage_engine = InnoDB

and uncomment next lines

# Uncomment the following if you are using InnoDB tables
#innodb_data_home_dir = /var/db/mysql/
#innodb_data_file_path = ibdata1:10M:autoextend
#innodb_log_group_home_dir = /var/db/mysql/
# You can set .._buffer_pool_size up to 50 – 80 %
# of RAM but beware of setting memory usage too high
#innodb_buffer_pool_size = 16M
#innodb_additional_mem_pool_size = 2M
# Set .._log_file_size to 25 % of buffer pool size
#innodb_log_file_size = 5M
#innodb_log_buffer_size = 8M
#innodb_flush_log_at_trx_commit = 1
#innodb_lock_wait_timeout = 50

3. start mysql-server again

/usr/local/etc/rc.d/mysql-server start

4. check engine property, after logged into mysql>

show variables like “%engine%”;

done

How to install jira on freebsd manual

1.  First of all you should register on atlassian.com site, select needed version, find url for download. Also this registration needed for obtaining jira license (doesn’t matter if its for evaluation or for parmanent use). In this article I have downloaded Jira 4.2

2. Create separate new user from root on your machine with command:

#adduser

(for example: jira, with shell for example: csh)

login under jira user

su - jira

3. Set patch to JAVA_HOME into .cshrc file, its reqired for installation. (By the way installation java also described on blog, use search if you dont have installed java yet)

setenv JAVA_HOME /usr/local/jdk1.6.0

… and check if everything ok and freebsd knows where file is with command:

echo $JAVA_HOME

(dont forget re-login into new user session to see applied changes to .cshrc file)

4.  Download package and untar it:

wget http://www.atlassian.com/software/jira/downloads/binary/atlassian-jira-enterprise-4.2-standalone.tar.gz

tar -zxvf atlassian-jira-enterprise-4.2-standalone.tar.gz

(so you have it unarchived in directory: /home/jira/atlassian-jira-enterprise-4.2-standalone now)

5. Create new jira-home dir (this dir needed for all content & technical data which jira stores for internal and external needs: search indeces, user attachments), for exampe here:

mkdir /home/jira/jira-data

6. Before jira startup you should specify where jira.home dir is in file:

/home/jira/atlassian-jira-enterprise-4.2-standalone/WEB-INF/atlassian-jira/classes/jira-attlassian.properties

change:

jira.home = /home/jira/jira-data

7. Also before startup check if jira default port 8080 is not used yet by some other listener, for example apache or nginx. If so, you can change it in file:

/home/jira/atlassian-jira-enterprise-4.2-standalone/conf/server.xml

Change lines:

<Server port="8005" shutdown="SHUTDOWN">
......
<Service name="Catalina">
    <Connector port="8090"
......

7. Now start JIRA via running shell script:

./home/jira/atlassian-jira-enterprise-4.2-standalone/bin/startup.sh

If no errors and everything done well – you’ll see next message and directory /home/jira/jira-data will be prefilled by some techical data/files structure.

JIRA Standalone Edition
Detecting JVM PermGen support...
PermGen switch is supported. Setting to 256m
If you encounter issues starting or stopping JIRA Standalone Edition, please see                                          the Troubleshooting guide at http://confluence.atlassian.com/display/JIRA/Insta                                         llation+Troubleshooting+Guide
Using CATALINA_BASE:   /usr/home/jira/atlassian-jira-enterprise-4.1.2-standalone
Using CATALINA_HOME:   /usr/home/jira/atlassian-jira-enterprise-4.1.2-standalone
Using CATALINA_TMPDIR: /usr/home/jira/atlassian-jira-enterprise-4.1.2-standalone

8. Check if jira installed well and service really started with command:

sockstat -4

you should see this:

jira     java       1283  50 tcp4   *:8090                *:*
jira     java       1283  51 tcp4   127.0.0.1:60196       127.0.0.1:54255

9. Now open it in you browser: http://192.168.81.128:8090, and you will see some last configs which needs to be made before finalization installation process: license, mailing option, etc.

Enjoy!

Add user

#adduser

Delete user:

#pw user del myname

Untar tar.gz file:

tar -zxvf file.tar.gz

Put java_home dir manually for user:
add line into shell config:
for ex.: mcedit .cshrc

setenv JAVA_HOME /usr/local/jdk1.6.0

Chown recursively owner for whole directory, example:

chown -R jira:jira atlassian-jira-enterprise-4.1.2-standalone

All list of installed packages with versions

pkg_info

(or find some particular...)
pkg_info | grep mysql
Create symlink

(always mixup source and target meanings for this command …)

ln -s /home/username/dev dev

Turn on slow log queries for mysql

SET GLOBAL log_slow_queries = ‘ON’;
SET GLOBAL long_query_time = 1;

Usually a program is made up of a (sometimes large) number of classes. So the logic and computation is distributed among these classes. However, as more classes are developed in a program, especially during maintenance and/or refactoring, the problem of communication between these classes may become more complex. This makes the program harder to read and maintain. Furthermore, it can become difficult to change the program, since any change may affect code in several other classes.

With the mediator pattern communication between objects is encapsulated with a mediator object. Objects no longer communicate directly with each other, but instead communicate through the mediator. This reduces the dependencies between communicating objects, thereby lowering the coupling.

Checklist

1. Identify a collection of interacting objects that would benefit from mutual decoupling.
2. Encapsulate those interactions in the abstraction of a new class.
3. Create an instance of that new class and rework all “peer” objects to interact with the Mediator only.
4. Balance the principle of decoupling with the principle of distributing responsibility evenly.
5. Be careful not to create a “controller” or “god” object.

Mediator vs Facade

Mediator is similar to Facade in that it abstracts functionality of existing classes. Mediator abstracts/centralizes arbitrary communication between colleague objects, it routinely “adds value”, and it is known/referenced by the colleague objects (i.e. it defines a multidirectional protocol). In contrast, Facade defines a simpler interface to a subsystem, it doesn’t add new functionality, and it is not known by the subsystem classes (i.e. it defines a unidirectional protocol where it makes requests of the subsystem classes but not vice versa).

Three terms always associated with the command pattern are client, invoker and receiver. The client instantiates the command object and provides the information required to call the method at a later time. The invoker decides when the method should be called. The receiver is an instance of the class that contains the method’s code.

Notice: On the diagram described above should  be “The explanation for the Receiver block  – “The actual work to be done by the command (action)”

Using command objects makes it easier to construct general components that need to delegate, sequence or execute method calls at a time of their choosing without the need to know the owner of the method or the method parameters.

http://en.wikipedia.org/wiki/Command_pattern

Also, there is nice example with “switch light on/off”

This is behavorial patterns.

Like an example, with Chain of responsibility pattern could be processed Request in web application. In FrontendRouter  you are passing request through chain of ActionHandlers and if Action is found by some Handler – it could be executed.

Very nice description is located here: http://sourcemaking.com/design_patterns/chain_of_responsibility

Very clear explanation of this pattern is here: http://www.fluffycat.com/PHP-Design-Patterns/Adapter/

Found one nice service for quick drawing sequence diagram.

Very easy to describe main goal of your UML diagram and share with colleagues

participant FrontendController
participant SearchAppLogic
participant SphinxSearch
participant SphinxIndex
FrontendController->SearchAppLogic: search(searchRequestDTO)
SearchAppLogic->SphinxSearch: search(searchRequestDTO)
SphinxSearch->SphinxIndex: search(searchRequestDTO)
SphinxIndex->SphinxSearch: searchResponseDTO
SphinxSearch->SearchAppLogic: searchResponseDTO
SearchAppLogic->FrontendController: searchResponseDTO

Check this out:

Sample on websequencediagrams.com

Recently, I found a lot of really useful frontend products (ready components: here -> sohtanaka.com :) ) built with jQuery, so I decided to switch from PrototypeJS to jQuery. Since my applications don’t use to much javascripts, just maybe for ajax needs I have no need to load both libraries anymore.

On my opinion both libraries have different goals. On this moment prototypejs is more like base library which extends base js functionality, and jQuery is more usefull as practical framework with a lot of opensource and ready for use components. Also, with this switch I hope to receive more experience of usage both libraries because that will give me possibility to compare them and analyze results.
During moving I’ve struggled with next issues:

1. First of all, as lazy server-side developer ;P , I’ve tried to support both libraries on page at the same time of course:

Ploblem with $(element) method, reserved for document.getElementById()in prototype can be solved with:

jQuery.noConflict()

2. Analog for document.getElementById(‘element’)
$(‘#bar’)[0]; // equivalent to document.getElementById(‘bar’);

[to be continue ..., in this post I'll write some small differences which stopped me during switching from prototype to jquery]

Quick fix for that – replace int(11) on bigint(20) in mysql tables.

Real time indexes and other already known benefits of sphinx search engine means – it will be loved by many developers and will be used in many projects from now on for sure. RT indexes feature is critical update, which was expected by many professionals who choose SOLR (lucene) instead of sphinx before.

Lets try to install it and use: (on this moment its beta, so I’m doing installation manually)

1. Download
downloading sphinx-1.10-beta.tar.gz and putting it to /usr/ports/distfiles

2. Cleanup (optional)
If you had previously installed version v.0.9.8, please remove indexes from
/var/data/sphinx
also old configs from
/etc/sphinx.conf
also disable sphinxsearch in
/etc/rc.conf

3. Install

# cd /usr/ports/distfiles
# tar xzvf sphinx-1.10-beta.tar.gz
# cd sphinx-1.10-beta
# ./configure
# make
# make install

4. Test sphinx
- There are test db with two tables in example.sql (in dir sphinx-1.10-beta). So, please run it manually.
- Change /usr/local/etc/sphinx.conf with appropriate mysql configs.
- run sphinx indexer

hockey# /usr/local/bin/indexer --all

Sphinx 1.10-beta (r2420)
Copyright (c) 2001-2010, Andrew Aksyonoff
Copyright (c) 2008-2010, Sphinx Technologies Inc (http://sphinxsearch.com)

using config file ‘/usr/local/etc/sphinx.conf’…
indexing index ‘test1′…
collected 4 docs, 0.0 MB
sorted 0.0 Mhits, 100.0% done
total 4 docs, 193 bytes
total 0.041 sec, 4667 bytes/sec, 96.73 docs/sec
indexing index ‘test1stemmed’…
collected 4 docs, 0.0 MB
sorted 0.0 Mhits, 100.0% done
total 4 docs, 193 bytes
total 0.011 sec, 17371 bytes/sec, 360.03 docs/sec
skipping non-plain index ‘dist1′…
skipping non-plain index ‘rt’…
total 6 reads, 0.000 sec, 0.1 kb/call avg, 0.0 msec/call avg
total 18 writes, 0.000 sec, 0.1 kb/call avg, 0.0 msec/call avg

- try to search:
To query the index from command line, use search utility:

# /usr/local/bin/search test

- run daemon for possibility to use it from other application:

# /usr/local/bin/searchd

- for stopping use

# /usr/local/bin/searchd --stop

- add it to /etc/rc.conf
searchd_enable=”YES”

So, sphinx searhc installed, indexer tested, search tested, search daemon started and stopped.

Done, enjoy.

Base page from handbook: http://www.freebsd.org/doc/en/books/handbook/cvsup.html

hockey# cd /usr/ports/net/cvsup-without-gui/
hockey# make install clean

cd /usr/share/examples/cvsup/

Here you can see examples of config for csvup. Here you should create own file.

vi my-ports-supfile

*default host=cvsup.FreeBSD.org
*default base=/var/db
*default prefix=/usr
*default release=cvs tag=.
*default delete use-rel-suffix
*default compress
ports-all

I didnt update src for my FreeBSD because, with last sources my kernel didn’t want to install correctly. But it should be something like this:

*default host=cvsup.FreeBSD.org
*default base=/var/db
*default prefix=/usr
*default release=cvs tag=RELENG_8_0
*default delete use-rel-suffix
*default compress
src-all

Tag RELENG_8_0 – means it is last stable release plus only critical fixes.

Now, lets update, process will take some time (up to 1 hour):

hockey# /usr/local/bin/cvsup my-ports-supfile

If everything done well, you have fresh and up to date all ports collection. Enjoy.

Build and install FreeBSD kernel

hockey# cd /usr/src/sys/amd64/conf
hockey# mkdir /root/kernels
hockey# cp GENERIC /root/kernels/MYKERNEL
hockey# ln -s /root/kernels/MYKERNEL
hockey# vi /root/kernels/MYKERNEL

device pf
device pflog
device pfsync
 
options         ALTQ
options         ALTQ_CBQ        # Class Bases Queuing (CBQ)
options         ALTQ_RED        # Random Early Detection (RED)
options         ALTQ_RIO        # RED In/Out
options         ALTQ_HFSC       # Hierarchical Packet Scheduler (HFSC)
options         ALTQ_PRIQ       # Priority Queuing (PRIQ)
options         ALTQ_NOPCC      # Required for SMP build

(additionally youcan read about it here – http://www.freebsd.org/doc/en/books/handbook/kernelconfig-building.html)

cd /usr/src
make buildkernel KERNCONF=MYKERNEL
make installkernel KERNCONF=MYKERNEL

I dont know why (maybe I’m paranoid little bit), but after rebuilding kernel sometimes I cannot login with root password anymore, when I’m sure, I definately should. So, I’m changing root password here, and creating new user by using:

passwd
adduser

… so, this is just notice for myself :) , you should not follow it. Also, check if there is “UseDNS No” and “PermitRootLogin yes” in “/etc/ssh/sshd_config”

Configuring PF firewall (packet filter) FreeBSD

First of all, the experience tells me that there are a lot of “not good people” on the web who is always want to grab some info, spam some forms, ddos your site, etc. So, usually I’m managing own list of blocked IP addresses of some bots, ddos botnets, etc. Packet Filter firewall couldn’t protect you from serious DDOS attack, when your site going down, because botnet just simply filling up network with huge amount of fake requests. But, firewall could very effectively protect you from 98% of cases (some stupid attacks with 10K-100K infected pc in botnet). Actually, that is completely different subject for discussion “how”, so lets just create file with blocked IP addresses and include appropriate rules into PF config for supporting this list.
Btw, pf could add/remove blocked IP in runtime (on flight) without rebooting it.

hockey# vi /etc/pf.blocked.ip.conf

4.131.43.125
8.15.172.172
8.19.105.50

Check your ipadress and configure pf.conf example:

hockey# ifconfig
hockey# vi /etc/pf.conf
 
udp_services = "{ ntp }"
tcp_services = "{ smtp, ssh, http }"
local_host="XXX.XXX.XXX.XXX"
 
table <blockedips> persist file "/etc/pf.blocked.ip.conf"
 
interface="re0"
set block-policy return
set skip on lo0
scrub in all
 
block all
block drop in log quick on $interface from <blockedips> to any
pass out on $interface inet from $local_host to any
pass in on $interface inet proto tcp from any to $local_host port $tcp_services
pass in on $interface inet proto udp from any to $local_host port $udp_services
pass in on $interface inet proto icmp from any to $local_host icmp-type echoreq

Including PF into rc.conf, so you can enable or disable PF anytime, plus it will start when FreeBSD starts.

vi /etc/rc.conf
 
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""

More info on this you can find of course in FreeBSD handbook: http://www.freebsd.org/doc/en/books/handbook/firewalls-pf.html

Now, lets try to enable it. Beware, if you did something wrong, for example included own IP into blacklisted IP addresses or mixed up with other configs – PF could block your access to server, and usually this automatically means – long discussions with hoster support or even reinstalling OS.

So, cross fingers, close eyes and …

pfctl -e

For disabling PF use

pfctl -d

Now reboot, and check if everything is ok:

reboot

Done, enjoy.

Installation FreeBSD 8.0 amd64 from rescue system for Hetzner EQ6 server, which has on board:

Intel® Core™ i7-920 Quadcore, incl. Hyper-Threading Technology,
* RAM 12 GB DDR3 RAM
* Hard discs 2 x 1500 GB SATA-II HDD (Software-RAID 1)
* NIC 1 GBit OnBoard connected at 100 MBit
* Backup Space 100 GB

Thats my details grabbed from preinstalled by default Debian-50-lenny-64-minimal:

Debian-50-lenny-64-minimal:~# lshw -short
H/W path         Device     Class      Description
==================================================
/0                          bus        MSI X58 Pro-E (MS-7522)
/0/0                        memory     64KiB BIOS
/0/4                        processor  Intel(R) Core(TM) i7 CPU         920  @ 2.67GHz
/0/4/5                      memory     256KiB L1 cache
/0/4/6                      memory     1MiB L2 cache
/0/4/7                      memory     8MiB L3 cache
/0/23                       memory     System Memory
/0/23/0                     memory     2GiB DIMM 1333 MHz (0.8 ns)
/0/23/1                     memory     2GiB DIMM 1333 MHz (0.8 ns)
/0/23/2                     memory     2GiB DIMM 1333 MHz (0.8 ns)
/0/23/3                     memory     2GiB DIMM 1333 MHz (0.8 ns)
/0/23/4                     memory     2GiB DIMM 1333 MHz (0.8 ns)
/0/23/5                     memory     2GiB DIMM 1333 MHz (0.8 ns)

During reading this article I have used next links:

http://habrahabr.ru/blogs/hosting/91429/ (as base, but didn’t worked for me), or mirror found here:

http://pcvector.ru/t1091/

http://wiki.hetzner.de/index.php/FreeBSD_installieren

Preparation

Visit https://robot.your-server.de/server – Main function (servers) – choose server – Rescue – Choose FreeBSD 64bit – Submit – Remember given password

The rescue system has been activated successfully.
After the next reboot your server will boot from the rescue system.
Then you can access your server, using the user name "root" and the following password: NXlib7R7

For booting for mfsBSD choose tab “Reset” – “Execute a automatic hardware-reset” – Send
mfsBSD is minimal OS running in memory. Wait for 5 minutes before server reboots.

Installing FreeBSD

Check disks first:

[root@rescue ~]# ls /dev/ad*
/dev/ad4        /dev/ad4s1b     /dev/ad4s1f     /dev/ad6s2
/dev/ad4s1      /dev/ad4s1d     /dev/ad6        /dev/ad6s3
/dev/ad4s1a     /dev/ad4s1e     /dev/ad6s1

Remove null sector and tell that FreeBSD will fill whole disk

[root@rescue ~]# fdisk -BI /dev/ad4
******* Working on device /dev/ad4 *******
fdisk: Class not found

Installing loader and creating label for slice:

[root@rescue ~]# bsdlabel -wB /dev/ad4s1

Editing hdd slices:

[root@rescue ~]# bsdlabel -e /dev/ad4s1

For mine tasks I splited it on next slices:

/ – 10Gb
swap – 12Gb (like memory size)
/tmp – 10Gb
/var – 100Gb
/usr – (rest)

# /dev/ad4s1:
8 partitions:
#        size   offset    fstype   [fsize bsize bps/cpg]
a: 10G 16 4.2BSD 0 0
b: 12G * swap 0 0
d: 10G * 4.2BSD 0 0
e: 100G * 4.2BSD 0 0
f: * * 4.2BSD 0 0

Creation file system on disk:

newfs /dev/ad4s1a
newfs /dev/ad4s1b
newfs /dev/ad4s1d
newfs /dev/ad4s1e
newfs /dev/ad4s1f

Since “/” belongs to mfsBSD, lets setup our FreeBSD into direcotry “/mnt”

mount /dev/ad4s1a /mnt
mkdir /mnt/tmp
mkdir /mnt/var
mkdir /mnt/usr
mount /dev/ad4s1d /mnt/tmp
mount /dev/ad4s1e /mnt/var
mount /dev/ad4s1f /mnt/usr

And only now we can run sysinstall

[root@rescue ~]# sysinstall

Custom-
Options-Intall root change on “/mnt” + Package temp change on “/mnt/var/tmp” + Check if Relese Name is set to “8.0-STABLE”-Quit
Partition – done already before
Label – done already before
Media – NFS – “213.133.99.100:/nfs/freebsd/8.0_64″ – “Running multi-user, assume that the network is already configured?”-Yes
Commit

Other images located here:

7.2-RELEASE — 32-bit — 213.133.99.100:/nfs/freebsd/7.2_32
7.2-RELEASE — 64-bit — 213.133.99.100:/nfs/freebsd/7.2_64
7.3-RELEASE — 32-bit — 213.133.99.100:/nfs/freebsd/7.3_32
7.3-RELEASE — 64-bit — 213.133.99.100:/nfs/freebsd/7.3_64
8.0-RELEASE — 32-bit — 213.133.99.100:/nfs/freebsd/8.0_32
8.0-RELEASE — 64-bit — 213.133.99.100:/nfs/freebsd/8.0_64

Then sysinstall will ask what exactly you want to install. Hetzner recommends to install FreeBSD “minimal”. But, since, I want to rebuild kernel with pf support (packet filter – firewall) and I also want to have all ports collection on board – I’ve choosen “Custom” installation and have selected next options:
- base
- kernels
- src
- ports
Press “Ok”, installation process started-15 minutes-Done-”Exit install”

Lets copy kernel in right place, otherwise after reboot system will not find it

[root@rescue ~]# cp -Rp /mnt/boot/GENERIC/* /mnt/boot/kernel/

Also lets run “bsdconfig” for configuring network and mounting disks on start.

[root@rescue ~]# bsdconfig
Welcome to the Hetzner configuration tool for FreeBSD.

Hostname: myservername
 
Changing local password for root
New Password:
Retype New Password:
 
Configuring rc.conf... DONE
Configuring loader.conf... DONE
DONE
Enabling SSH login for root... DONE
Configuring resolv.conf... DONE
Press ENTER to configure your /etc/fstab using vi

/dev/ad4s1a / ufs rw 1 1
/dev/ad4s1b none swap sw 0 0
/dev/ad4s1d /tmp ufs rw 1 1
/dev/ad4s1e /var ufs rw 1 1
/dev/ad4s1f /usr ufs rw 1 1

You can check that “bsdconfig” already configured network with using DHCP in /etc/rc.conf and have prefilled nameservers as well in /etc/resolv.conf

On this moment bsdconfig sets using DHCP in /etc/rc.conf, so it could be changed on real data

# ifconfig_re0="DHCP"
ifconfig_re0="inet XXX.XXX.XXX.XXX netmask XXX.XXX.XXX.XXX"
defaultrouter="XXX.XXX.XXX.XXX"

Now, lets un-mount disks:

umount /mnt/tmp
umount /mnt/var
umount /mnt/usr
umount /mnt

and reboot …

[root@rescue ~]# reboot

After reboot you can login with root and password which you have provided during “bsdconfig”-uring.

Done, enjoy!

p.s. On 29 May 2010 when I tried to update “src” to FREEBSD_8_0 (with cvsup) and tried to rebuild kernel – my system did not startup. So, I back to rebuilding kernel with “src” from Hetzner NFS image and it worked fine.

mail -s "test1" test@test.com < /usr/home/username/test-email.txt

For example if somebody updates some old record – you can create delta index, but select from `main` index and `delta` will return you two records, instead of one (plus normal count of search results).

p.s. Sometimes, I have feeling that sphinx developers just this did that ugly `non-functionality` deliberately! (Theoretically, why it should be so hard? – just have to hardcode into functionality one special case – “if there are two indexes and same document_id presents in both – please return only fresh one! grouping costs a lot, but if use it carefully and see on bright side – how many business value it could bring, why not? wtf?”)

So, I found one nice idea, how to decrease little bit load on server with incremental indexing, which is used on craigslist.

BTW. One more nice presentation how it works inside high-loaded projects.
Meet craigslist: perl+mysql+sphinx+(tons of workarounds :) )

Going, to try implement incremental indexing and show some results later …

On the web you can find a lot of examples how this trick could be workarounded, but I prefer to use browser built-in feature . Rounded corners functionality – is something whats expected very long time ago from browser’s vendors by frontend developers.

Sooner or later this damn IE 9 will go live and this feature promised to be included as well. On moment of this post it already works in next browsers: Opera > 10.5, Firefox > 1.5, Safari & Chrome as well. I’ve tested it. And doesn’t work in any IE <= 8.0.

// Opera, Internet explorer 9 (actually in future should work everywhere)
border-radius:5px;

// Mozilla Firefox
-moz-border-radius:5px;

// Safari & Chrome
-webkit-border-radius:5px;

By the way there is more rich possibilities than `round all corners` with some radius. You can provide any radius value to any corner independently.

• -moz-border-radius-topleft / -webkit-border-top-left-radius
• -moz-border-radius-topright / -webkit-border-top-right-radius
• -moz-border-radius-bottomleft / -webkit-border-bottom-left-radius
• -moz-border-radius-bottomright / -webkit-border-bottom-right-radius

Of course question for now is – what to do if on this moment those css3 features don’t work in 50% live browsers?
In my opinion, answer is – do the same as other companies do – ’start using it and just sit and wait for damn IE9′ :)

First of all, you need java, how to install jdk on FreeBSD check here: How to install JAVA on FreeBSD
How to install Apache Tomcat on FreeBSD & test how it works:

installation:
/usr/ports/www/tomcat6
make install clean

run webserver:
cd /usr/local/apache-tomcat6.0/bin
./startup.sh

now lets check it is started:
sockstat -4
you should see something like this:
root java 71812 32 tcp4 *:8180 *:*
root java 71812 40 tcp4 *:8009 *:*
root java 71812 42 tcp4 127.0.0.1:8005 *:*


now lets try check from http side it it works:
check your ipaddress
ifconfig
and try to get this with browser:

http://192.168.147.131:8180/

You should see now default “Congratulations! Tomcat installed successfully” page
There are two links on left sidebar menu: Status & Tomcat Manager
To have possibility reach those pages – change permissions into file
/usr/local/apache-tomcat6.0/conf/tomcat-users.xml

… and dont forget restart tomcat with:
cd /usr/local/apache-tomcat6.0/bin
./startup.sh
./shutdown.sh


Now, you can check server status (& Complete Server Status with all logs) & check manager section.

Done! (with server installation)

Lets now check some examples how it works inside on example of java servlets + tomcat (will not write now about JSP).
So, actually there are a lot of examples on left sidebar menu as well, like HelloWorld sample, examples how to handle forms, play with cookies.

HelloWorld servlet example:

import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;

public class HelloWorld extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response)
    throws IOException, ServletException
    {
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();
        out.println("<html>");
        out.println("<head>");
        out.println("<title>Hello World!</title>");
        out.println("</head>");
        out.println("<body>");
        out.println("<h1>Hello World!</h1>");
        out.println("</body>");
        out.println("</html>");
    }
}

How to handle forms, example of simple form with two fields – FirstName, LastName and Submit button.

import java.io.*;
import java.util.*;
import javax.servlet.*;
import javax.servlet.http.*;

public class RequestParamExample extends HttpServlet {

    public void doGet(HttpServletRequest request, HttpServletResponse response)
    throws IOException, ServletException
    {
        response.setContentType("text/html");
        PrintWriter out = response.getWriter();
        out.println("<html>");
        out.println("<head>");
        out.println("<title>Request Parameters Example</title>");
        out.println("</head>");
        out.println("<body>");
        out.println("<h3>Request Parameters Example</h3>");
        out.println("Parameters in this request:<br>");
        if (firstName != null || lastName != null) {
            out.println("First Name:");
            out.println(" = " + HTMLFilter.filter(firstName) + "<br>");
            out.println("Last Name:");
            out.println(" = " + HTMLFilter.filter(lastName));
        } else {
            out.println("No Parameters, Please enter some");
        }
        out.println("<P>");
        out.print("<form action=\"");
        out.print("RequestParamExample\" ");
        out.println("method=POST>");
        out.println("First Name:");
        out.println("<input type=text size=20 name=firstname>");
        out.println("<br>");
        out.println("Last Name:");
        out.println("<input type=text size=20 name=lastname>");
        out.println("<br>");
        out.println("<input type=submit>");
        out.println("</form>");
        out.println("</body>");
        out.println("</html>");
    }

    public void doPost(HttpServletRequest request, HttpServletResponse res)
    throws IOException, ServletException
    {
        doGet(request, response);
    }
}

Everything looks clear and simple (specially if you have some knowledge for example in apache + php).

Thats it.

With this post I want to tell you that SOLR – is really easy to install and use, if you even dont have any knowledge in search engine principles, but always wanted to implement fulltext search for your web application.

Recently, I’m playing with sphinx search engine and trying to connect it to one project. Sphinx is great simple SE, but it has some limitations and stuff I dont like. So, I think – it would be nice to have some alternative.

Honestly, saying I did not touch to much SOLR on this moment as well :) , but main public use cases are clear to me, checked, read, and fear of using something java related from php disappeared. :)

Why SOLR is cool? and what do you need for start?
1. Install JAVA (2 hours)
2. Read 1 page of SOLR tutorial and follow all instructions. (… simpler just couldn’t be :) ). (1 hour)
Yes, it needs just 1 hour to create some simple index, do some search query, update/delete items, check SOLR admin web interface and SOLR logs.

(to be continue … , i hope :) )

but:
$command = "identify -format '%m' " . $src;
exec($command, $output, $result);

$result returned (int)127 error.
$output – empty.

Btw, `identify` is part of installed imagemagick’s application.

The problem was – php can’t find application `identify`. Dunno why even till now. So, full path works OK.

$command = "/usr/local/bin/identify -format '%m' " . $src;
exec($command, $output, $result);

cheers

shutdown -h now

or

halt