January 2000 - Zope - Zope lists

Zope actively being cracked?
by Matthew Marlowe 19 Jan '00

19 Jan '00

Hello, www.deploylinux.net, which uses zope as its backend, was hacked on 3:30pm Tuesday afternoon. We know this because two new users were created in the /etc/shadow file and the following email was sent: From: root <root> Message-Id: <200001182346.PAA16613(a)yoda.colo.jalan.com> To: dz(a)noxiin.com Subject: yoda.colo.jalan.com * shadow detected, no login backdoor * in.rshd (atif) installed! * bLACK pANTHER kit installed @ yoda.colo.jalan.com / 216.33.174.217 The server runs only Zope 2.1, a recent version of sendmail, ftp, and an amanda client over SSH. Everything else was disabled. While identifying the source of the breakin, we noticed that a new file had been created in one of the zope directories, and that the root history logs showed that this file had been executed. Therefore, we are trying to find out if this is an active zope exploit. The server was protected by a firewall on lower level ports other than SMTP, ftp, and http. We've removed the new users and are in the process of resecuring the box. We are interested if anyone else has seen similiar events? Hopefully this info will be beneficial to others in the community. Thanks, M. Marlowe -- Matthew Marlowe http://www.jalan.com/ (p) 909.799.3805 mmarlowe(a)jalan.com Jalan Network Services (f) 909.799.3285 "Quality Web Hosting, Network, Linux, and Solaris Consulting"

4 3

ZServer and VirtualHost
by Cesar A. K. Grossmann 19 Jan '00

19 Jan '00

Hi! Are there a way to serve severeal domains with the same ZServer? I need to have www.domainA.com.br, and www.domainB.com.br, both residing in the same ZServer. The usual, http://zopeserver.mydomain.com.br:8080/DomainA and http://zopeserver.mydomain.com.br:8080/DomainB works, but doesn't satisfy. I'm not using PCGI (I'm with troubles making the PCGI works, something about permissions - I don't wanna address it now). I'm using Zope 2.1.2 in a Conectiva Linux (http://www.conectiva.com.br/, a Red Hat derived brazilian Linux distribution). TIA, and sorry the bad english... -- Cesar A. K. Grossmann - AOLIM CesarAKG - ICQ# 53373705 http://members.xoom.com/ckant/ ...when you are obsessed with the enemy, you become the enemy.

1 0

BIG things at DC
by Rob Page 19 Jan '00

19 Jan '00

Hello everybody! First, thanks again to the Zope community which continues to grow and thrive. We're REALLY looking forward to the Zope track at the upcoming Python conference!! As always, lots of BIG things are underway at Digital Creations. I am thrilled to announce that we're opening a Digital Creations office in downtown Portland, OR. This office will serve at least two purposes: it lets us tap into an awesome talent pool in the Pacific Northwest AND it lets us more easily and affordably provide direct service to our growing ranks of Silicon Valley/southern Cailfornia customers! Naturally, our colleague Amos will be there! In addition, please join me in welcoming Karl Anderson to the Digital Creations team. Karl will also be working out of the Portland office. Karl's doc string: """ I live in Portland, Oregon, and one of the reasons that I like it here is that I'm a bad cook, and my housemates mostly take care of that while I mostly take care of the house LAN. I'm obsessed with bicycles, partly because I think they're an elegant interface between human and machine, but for some reason I'm into making crazed and dangerous cycles with my friends and destroying them on each other. I like to brag (while I can) about being the most popular Karl Anderson on the web, according to Google. """ Karl can be reached at karl(a)digicool.com Welcome Karl! --Rob -- Rob Page V: 540.371.6909 Digital Creations, Inc. F: 703.995.0412 -- ... The Leader in Open Source Web Development ... ... Don't miss Zope! http://www.zope.org ...

1 0

(no subject)
by Jerry.Spicklemire＠IFLYATA.COM 19 Jan '00

19 Jan '00

. . . $%#@! frames, can't clip a !@#%$ bookmark to save your life . . . Oh, sorry, um, use the link below, then click "Related Projects", and then pick any language you want, as long as it's "English", or "Chinese", and then you can see the PostgreSQL on MS NT How-To. http://www.postgresql.org/doxlist.html BTW, There's another handy indexed FAQ/About/How-To at the Cygnus Site, http://sourceware.cygnus.com/cygwin/readme_toc.html Scouts promise to do all this the first time in the future . . .

1 0

SQL Server Adapter
by Jerry.Spicklemire＠IFLYATA.COM 19 Jan '00

19 Jan '00

. . . and here's the How-To , really, no kidding . . . http://www.postgresql.org/doxlist.html

1 0

SQL Server Adapter
by Jerry.Spicklemire＠IFLYATA.COM 19 Jan '00

19 Jan '00

. . . but the CygWin link seems dead, so here . . . http://sourceware.cygnus.com/cygwin/download.html

1 0

ZCatalog + Subclassing Woes
by Stephen Pitts 19 Jan '00

19 Jan '00

I'm implementing search functionality on my site using ZCatalog. Right now, the searching and indexing work fine, and I'm trying to make some custom Z-Classes CatalogAware. All of my Z-Classes inherit from a Z-Class called CentralBase, which contains a DTML method called "edit", which is used as the "action" for all of their management edit forms: <dtml-call "propertysheets.Basic.manage_editProperties(REQUEST)"> <dtml-call "RESPONSE.redirect('editForm')"> To instantly make all of my Z-Classes CatalogAware, I figured that I could just: * recreate CentralBase so that it inherits from CatalogAware (is there a way to modify what Z-Classes a Z-Class subclasses from without recreating it? this is the biggest complaintm that I have with Z-Classes) * modify edit and add "<dtml-call reindex_object>" below the first line * change the add method (called by all of the *addForm methods) to also call "reindex_object" Unfortunately, it wasn't that easy. When I recreated the CentralBase class, it screwed up all of my other Z-Classes. The edit method isn't getting acquired correctly. Cannot locate object at: http://localhost:8080/News/SiteUpdates/Welcome/edit Traceback (innermost last): File /home/smpitts/Zope-2.1.1-src/lib/python/ZPublisher/Publish.py, line 214, in publish_module File /home/smpitts/Zope-2.1.1-src/lib/python/ZPublisher/Publish.py, line 179, in publish File /home/smpitts/Zope-2.1.1-src/lib/python/Zope/__init__.py, line 202, in zpublisher_exception_hook (Object: ElementWithAttributes) File /home/smpitts/Zope-2.1.1-src/lib/python/ZPublisher/Publish.py, line 151, in publish File /home/smpitts/Zope-2.1.1-src/lib/python/ZPublisher/BaseRequest.py, line 334, in traverse File /home/smpitts/Zope-2.1.1-src/lib/python/ZPublisher/HTTPResponse.py, line 521, in debugError NotFound: (see above) Does anyone have any suggestions? -- Stephen Pitts smpitts(a)midsouth.rr.com webmaster - http://www.mschess.org

3 3

SQL Server Adapter
by Jerry.Spicklemire＠IFLYATA.COM 19 Jan '00

19 Jan '00

. . . and here's the How-To . . .

1 0

RE: [Zope] standard_html_header & standard_html_footer
by Brian Lloyd 19 Jan '00

19 Jan '00

> Why are standard_html_header and standard_html_footer reserved names? > I was trying to reduce the clutter in my root folder when I discovered > that Zope wouldn't let me delete these two objects unless I modified > _reserved_names in lib/python/Products/OFS/Application.py. > -- > Stephen Pitts Hi Stephen, The standard header and footer in the root Folder are reserved names that can't be deleted mainly because certain parts of zope (such as the std error template and the "default" content of new DTML Documents and Methods) expect them to be available. If, say, a Zope newbie were to delete them without knowing what the consequences were, they would then find that all of their dtml docs/methods generated with the default content would appear broken (and the error message reporting the error would also probably be broken). Brian Lloyd brian(a)digicool.com Software Engineer 540.371.6909 Digital Creations http://www.digicool.com

4 3

SQL Server Adapter
by Jerry.Spicklemire＠IFLYATA.COM 19 Jan '00

19 Jan '00

Re. non-ODBC access of "a decent PC Database", the current PostgreSQL now runs on MS NT . . .

1 0