To install do:
sudo apt-get install igal
Then use the igal --help command
for parameters. Basically cd to the directory you have placed your gallery photos, and then
run the command. Here’s an example:
igal -r -f -y 200 -p 9 -w 3 --bigy 600 --www --title "Mallternative Advertisement Candidate Photos"
Here’s the result:
http://piercechristie.com/mallternative/ad_photos/
(To cut to the meat of the matter, scroll to “STEPS I DID”) Security is a matter of trust, and access to my stuff is granted on a need-to-know basis, and (you) don’t need to know. ;) It makes perfect sense. You see, if you can’t see my files, I’m more inclined to trust you to leave them alone. And we can be friends.
Consider, for example, the case of me running Wordpress on a shared server. It’s frequently recommended that after installing and setting up Wordpress we change the permissions on wp-config.php to 600. Why? With permissions of 644 It would be readable by other user accounts on a shared server. Since wp-config contains sensitive database information that would be an insecure situation. Of course, one could always change permissions and then change them back if and when one needs to edit the file.
I’m going to digress a bit for some background on file permissions in Linux/BSD/Unix. Permissions can be symbolic , like drwxr-xr-x or octal, like 755. By the way, the “d” in the front of drwxr-xr-x tells us it’s a directory (folder). If it were a file, it would be a “-”.
Here’s a table I made to help me remember :
| read | write | execute |
| r | w | x |
| 4 | 2 | 1 |
To see information about the files in the current directory, including permissions, type
ls -la
The Wikipedia entry has a more complete explanation.
Setting permissions on all folders to 755 and on all files to 644 is emphatically recommended by many Wordpress blog owners. Contrarily, the Wordpress Codex says to make all the files in your wp-content directory writable by using the following two steps:
1. Go to your WordPress main directory, with a command like cd wordpress/
2. Enter chmod -R 777 wp-content
The Codex also says if you use Permalinks you should change permissions of .htaccess to make sure that WordPress can update it when you change settings or add some new Page (which requires update of the file to work when Permalinks are enabled).
1. Go to the main directory of WordPress
2. Enter chmod 666 .htaccess
I’m not doing that yet, though. I read that with a modern setup where the server (Apache, etc) runs as the user (setuid user) you can keep your wp-content directory 755. Also I read that you should simply set .htaccess temporarily to 666 while WP updates it when you change settings or create a Page.
STEPS I DID to my blog to tighten up the ol’ security belt
First, make sure I (the user) own everything in the blog directory.
cd to your blog directory (or your web root if you like)
cd my/blog
and issue the following command to find files not owned by you (please replace the word “me” with your username):
find . ! -user me
Maybe do
sudo chown -R me .
If you are hosted on Textdrive, and you find a file called .textdrive in your web root, don’t worry. It’s put there on purpose by admins to annoy you so ignore it. (Not really, but it’s leaverite. And you probably can’t change it anyway.)
So now to find all directories (folders) under the current folder and set their permissions to 755
find . -type d -exec chmod 755 '{}' \;
The following command is modified from the command recommended in the Wordpress Codex here. Note that that document indicates cryptically that
You have to omit to use this command for /wp-includes/.
However, I wonder whether they meant to refer to /wp-content/, which is the folder mentioned elsewhere as being the only folder needing different permissions, those being 777 ! World-writeable?!
It seems that some or most of the files in /wp-includes have read-only permissions, 444 or -r–r–r– !
I felt that it couldn’t hurt to leave the permissions as strict as possible, while I wanted to change the permissions recursively, and not have to issue a bunch of separate commands I administer several blogs, and I’m going to have to duplicate this a few times. I did a little research:
man find
And I decided to find all files (not directories) under the current directory that are writeable by either the group or the world (other) or both and change their permission mode to 644. This will include the wp-includes directory but will leave more restricted permissions alone, instead of arbitrarily changing every file’s permissions (Please take note that this is the proper command for FreeBSD and probably will but might not be exactly right for Linux; please research for yourself) :
find . -type f -perm +066 -exec chmod 644 '{}' \;
After Wordpress is set up and running properly, and before it is attacked by someone who owns an account on your shared server,
chmod 600 wp-config.php
May 26, 2008 — Until I “fixed” this problem, on this Wordpress 2.5.1 blog hosted on textdrive, If I typed “FTP” and “server” in the main text field of the “New Post” page, and then published or saved my post, I got “Precondition Failed”
Try this on your wordpress blog.
Make a new post.
Type anything in the title field.
Type the words
“FTP” and “server” in the main text field you can type any other content too, but put those two words together and you will not be able to save your post. (edit: It appears that the only word that I really had trouble was “FTP ” - with the space after and without the quotes. I have heard of people having problems with words commonly found in porn spam and also some seemingly-innoccuous words such as “picture”)
Try to publish your test post.
Do you get the “Precondition Failed” error?
Precondition Failed The precondition on the request for the URL /blog/wp-admin/post.php evaluated to false.
Update - I think it’s mod_security that causes that message. See
this Wordpress Support Page
Also see this Joyent help page
I tried creating a .htaccess file in my public_html directory using the rules suggested there. According to that, you can disable MOD_SECURITY with the following in your .htaccess file:
SecFilterEngine Off
This made it so that at one point I was able to post the word “FTP” alone in a post, which was impossible before. However, I didn’t want to completely disable MOD_SECURITY if I didn’t have to, so,
I tried this in my .htaccess instead, as Joyent suggested at the url above:
SecFilterEngine On
SecFilterSelective "REQUEST_URI" "/blog/wp-admin/post.php" "allow,nolog"
SecFilterSelective "POST_PAYLOAD" "FTP ,FTP,SSH ,SSH" "allow,nolog"
(Note that the above code consists of three lines, and the lines begin with SecFilt…. I will have to make a few adjustments to the theme CSS to make my blog wider . . .)
And that one worked! I don’t think I need the post.php entry so I may remove that line. Anyway it worked.
I am told that MOD_SECURITY is used for spam filtering, and there are many recommendations to disable mod_security as a workaround for this type of problem. However I don’t know. I am rather experimenting here. I’m glad I didn’t have to completely disable it.
I’m tempted to think that overall rules (on my server) are too strict or need tweaking. Or that I need to make a custom filter of my own. However, one would think that one could blog the word “FTP” server without having to rewrite apache rules. When the 3rd and 5th blog posts I made failed, I started thinking “What’s the use? I got me a blog that I can’t post on!”
So here are some suggestions for some rules to put in your .htaccess file so that MOD_SECURITY will be generally functional, and allow apache to allow posts about FTP SSH, etc…
Status: MOD_SECURITY enabled. Blog works. All good.
To implement this solution on your own blog, edit (or create, if it doesn’t exist) a file called .htaccess in the web root of your blog and add the above code to it. .htaccess files define per-directory rules for the apache web server. The .htaccess file which I added to fix my blog is in the folder which contains my Wordpress folder. I think that if you put the file in your actual blog folder it will work as well.
Ubuntu comes with a nice set of programs preinstalled. One of them is Gnome-Terminal. By default, gnome-terminal opens too narrow a window for me. Right away after installing Ubuntu I find myself typing (or pasting) lots of commands and I prefer to be able to fit a decent-sized command at the command-line without it wrapping to the next line. Read on to learn how to make an easy shortcut button for a custom-sized Gnome Terminal.
I learned that the window size can be specified when calling Terminal - Just go:
gnome-terminal --geometry 150x22
The “geometry” refers to the size of the program window. It is expressed in characters rather than pixels. I have a small-screen laptop and I like the above parameters. I use that command as a launcher button in my panel. To do that, right-click your panel at a place where you want the launcher-button. Click “Add to Panel”. Click “Custom Application Launcher”. For ‘Type’, Choose “Application”. Type Terminal or whatever you want to call it under “Name” and paste the above command into the “Command:” area. Modify the “150×22″ to suit your needs. “150″ is the width and “22″ the height. Then click “OK” and you’ve got yourself a custom gnome-terminal button! Of course, it’s easy to change the parameters of your new button by right-clicking it and choosing “Properties” to modify them. The properties, I mean.
Here’s my Zoneminder 1.23.3 install log. I put together this HOWTO so I could share the method I used but I mainly took the notes for when I want to know how to install zoneminder on Ubuntu 7.10 again. I’m sure it’s incomplete. Look at the documentation at the official web site for more help. By the way, for those who don’t know, Zoneminder is a video security surveillance system that runs on Linux and provides web access and automatic motion-detection with unlimited cameras. All you need is cheap cameras, and a decent computer. More information on Zoneminder is available on http://zoneminder.com. Also see this page, although for my situation, some of the tweaking described there was unnecessary. And this wiki has a good explanation of how to set up MYSQL for zoneminder
I’m using a bttv card, real cheap on ebay, for a capture card. 4 ports on it. I think it’s bt878. My computer is a 3 GHz sony vaio desktop. Basically I just plugged in the capture card, removed the modem, and connected my monitor and keyboard, along with the network cable. . . Let’s move on . . .
Install Ubuntu 7.10 - Server Edition
You will need “LAMP SERVER” and “SSH SERVER” when you install your ubuntu server.
After installing the basic server, I went ahead and installed ubuntu-desktop. I intended originally to use this machine as a Desktop as well as a server, so:
$ sudo apt-get install ubuntu-desktop
LAMP stands for Linux, Apache, MYSQL, and PHP. Those are pretty good abbreviations. I suggest everyone know what they stand for. MYSQL is a database server. Zoneminder uses a MYSQL database. When installing the LAMP option you will be asked to create a MYSQL root password. Write that down. You are going to need it later to create MYSQL a login for Zoneminder.
-Later I disabled startup of X, for a headless system. See instructions later in this document.
This is how I got it:
Download and install a necessary library (alt link)
and
the zoneminder package for ubuntu 7.10 (alt link)
–Note: You have to do the following to configure Apache properly for Zoneminder:
sudo ln -s /etc/zm/apache.conf /etc/apache2/conf.d/zoneminder.conf
Then I set up my network using the ubuntu gui network applet. I’m sure there’s an easier way, but I simply set up a static IP address (google “local IP addresses” for more info) and for gateway I put in the local address of my DSL modem (router) which happens to be 192.168.0.1 Commonly your netmask will be 255.255.255.0.
I set up OPENDNS on my server too, by following the instructions here:
(link)
One action I recommend is to set up apache to listen on a custom port. In my Ubuntu 7.10 I did it this way.
$ sudo nano /etc/apache2/ports.conf
–write the port you want to use instead of port 80, which is the traditional port for a webserver. If your server is not to be used by the entire Tubes, which is true in my case as it’s a private video surveillance box, you can avoid not a few script-kiddie-type attacks by locating your server off the beaten path so to speak.
Here’s what my /etc/apache2/ports.conf looks like:
Listen 31290
<IfModule mod_ssl.c>
Listen 443
</IfModule>
While you’re at it, you might as well tell your ssh server to listen on a custom port as well, thus avoiding lots of potential attempted logins from script-kiddies and hackers all over the Tubes.
$ sudo nano /etc/ssh/sshd_config
Just place the port number you wish to use after the word Port under where it says “# What ports, IPs and protocols we listen for”
Mine says:
Port 32644
Leave the rest of the stuff alone in there and save the file.
My server is behind a NAT router, otherwise known as an Actiontec GT701-WG DSL modem. To make the server available to the Tubes, it will be necessary to forward http traffic from the internet directly to the server machine on my network. This sounds difficult but is really easy and can be done through the router or DSL modem’s web configuration interface. Simply log in and go to the page where you get to forward ports. Then forward ports. Since everyone’s router is different, and since if you don’t have a NAT router, I will leave this part up to you. If you have trouble, google the model name or number of your router, along with “forward port” and you will find some helpful information.
This is so that users can always access your server using a url instead of an IP address which is dynamically-updated and may change, thereby rendering your server inaccessible.
To configure my dynamic DNS entry I first created an account at dyndns.org. See
https://www.dyndns.com/support/kb/using_ddclient_with_dyndns_services.html
I set up a hostname such as myubuntuserver.dyndns.org under “host services” and chose “Host with IP address”
Then I entered the external IP address of my server. Once this account was set up I ssh’d into my server and -
Install ddclient
$ sudo apt-get install ddclient
–debconf attempts to configure using wizardry in the install script. If your zm server is connected directly to the Tubes, you can fill in the blanks as you go along and the resulting /etc/ddclient.conf file will most likely be effective. However, I discovered a web-based configurator at dyndns.org which helped by generating a suggested /etc/ddclient.conf(Wizardry again, but pretty well done.)
Here is the resulting /etc/ddclient.conf - you can use it if you replace the email address, PASSWORD, and LOGIN, and the hostname near the bottom. This works for me. My server is behind an actiontec DSL modem/router.
## ddclient configuration file
daemon=600 # check every 600 seconds
syslog=yes # log update msgs to syslog
mail-failure=whoever@gmail.com # Mail failed updates to user
pid=/var/run/ddclient.pid # record PID in file.
## Detect IP with our CheckIP server
use=web, web=checkip.dyndns.com/, web-skip='IP Address'
## DynDNS username and password here
login=LOGIN
password=PASSWORD
## Default options
protocol=dyndns2
server=members.dyndns.org
## Dynamic DNS hosts
myhost.dyndns.org
I discovered that due to an unknown memory leak, I got freezes of my whole machine - first firefox crashed, then X. Workaround! Disable X! I decided to place this server upstairs in another part of the building for security, anyway, so using it as a Desktop box is not going to happen, and I don’t need to figure out why it broke.
As recommended on ubuntuforums.org to set “Do not run Xserver at boot” - I did this-
$ sudo mv /etc/rc2.d/S30gdm /etc/rc2.d/D30gdm
$ sudo /etc/init.d/gdm stop
to shut down the X server
Wow! With no X-server running the load average dropped from upwards of 1 and sometimes 9 to less than .4! Zoneminder works great!
You access the control panel with a browser- at http://localhost/zm or replace “localhost” with the IP address of the Zonealarm server. You probably should set up your Zoneminder to use authorization - users will have to log in to see or use the system. The second system option, ZM_OPT_USE_AUTH found under “Options” will allow you to set that up. Please remember to have your password memorized before turning this on. I FORGOT mine, and it was a good thing that I remembered my MYSQL password, so I could reset the Zoneminder password.
Addendum:
Until recently, I had not discovered why my monitors would not properly display camera output at 640×480 resolution. I found recommendations to increase shared memory size. Check here for how. But remember to reboot. And reboot after setting the resolution in your Zoneminder monitor to 640×480. The “ipcrm” command is supposed to be helpful for this but a reboot did the trick for me.
Please feel free to comment below here. Your thoughts are welcome.
Try this on your wordpress blog.
Make a new post.
Type anything in the title field.
Type the words
“ftp” and “server” in the main text field you can type any other content too, but put those two words together and you will not be able to save your post.
Try to publish your test post.
Do you get the “Precondition Failed” error?
Update - I think it’s mod_security that causes that message. See
here
UPDATE:
See my newest post on this problem.
Wow. Here’s how I installed my blog software on my web site here in about twenty minutes.
I followed the instructions here at the wordpress wiki to install Wordpress 2.5 on my shared textdrive.com server. Here’s the standard instructions. It’s easy either way. I’ve installed WP three times now this year, and it’s never taken more than a few minutes to get the bare bones operating. . . Of course, setting up your theme or template and customizing your blog can never be all finished, but it sure is fun to learn CSS with the help of the google and the wordpress wiki.
And here’s more good news! The themes repository will soon be running a subversion database so your theme can be installed and updated in a similar, easy way! See http://themes.wordpress.net
Update:
The second painless upgrade I just performed on this wordpress blog
using subversion and instructions for which are here
required about five minutes including a quick database and theme backup. Now I am proudly and safely running Wordpress 2.6.1.