- Zope - Zope lists

Various security aspects to Zope as an Internet HTTPD server ...
by Bryan J. Smith 14 Jun '99

14 Jun '99

Various security aspects to Zope as an Internet HTTPD server ... [ I am on the Digest, so please respond directly ] [ to me @ mailto:b.j.smith@ieee.org,bjs@crc.com ] I am looking at using Zope as a corporate Internet HTTPD service (i.e. as the main service people hit on the Internet). I am a Zope newbie, but have installed and used it on the port (i.e. 9673, NOT integrated with Apache). I have an idea of my basic configuration along with some security-oriented questions. Proposed configuration: ----------------------- A. Two servers, one in a DMZ behind a firewall and one on the internal corporate network, also behind the firewall (but on a different port not accessable from the outside). B. Users would ONLY UPLOAD TO THE INTERNAL network server. Then, at an X periodical, the internal server's contents would be copied to the external server. So even if the external server's HTTPD site/contents are cracked/replaced, the data will be overwritten ever X minutes with the clean/internal version (very simple to do -- something the FBI should have take note of ;-). C. Not sure if I should keep Zope on its own port (9673, with a simple redirect from Apache on port 80 (//sitename -> //sitename:9673) or integrate it with Apache (security is the issue here). D. Looking to use OpenBSD/i386 as the OS (on both systems, or at least the external server in the firewall DMZ). Questions: ---------- 1. Since Zope runs as a user-level service, does that make it any more secure than Apache? Or is it more securite to integrate it as a bunch of cgi-bin scripts under Apache? Or does anyone see even a more secure setup? 2. Available SSL support? Or is that the commercial Medusa (Zope+SSL) product from Digital creations? 3. Anyone got Zope running under OpenBSD/i386? I really am aiming for the OpenBSD avenue since they are the best when it comes to finding security holes (don't need slick console-side interfaces like with Linux/FreeBSD/NT). If it runs under FreeBSD, it should run under OpenBSD, but just wanted to see if anyone was running it under OpenBSD (or FreeBSD for that matter). Thanx in advance ... -- Bryan "The BS" Smith Software Engineer FL-based Aerospace Company and OpenSource developer/consultant P.S. As a side-note, there are those FrontPage 98 wennies out there who "just-have-to-have" the FP98 extensions on the Apache server. Does that not create a security risk? I (as well as PCWeek) have found using Amaya (the W3C standard HTML 4.0 WYSIWYG) much better and combined with Zope's built-in upload functionality (is that via the HTTP 1.1 protocol??? as well as 2.0 WebDAV support), there is NO REASON to have to support M$'s proprietary extensions on the same server as Zope. Any comments here??? I think even they are SOL on FP2000 since it REQUIRES an NT Server for publishing (no more Apache support?). Bryan J. Smith mailto:b.j.smith@ieee.org,bjs@crc.com Software Engineer http://www.SmithConcepts.com/legal.html =========================================================== "Microsoft's efforts to position Windows NT as an embedded operating system remind one of an elephant entering a track meet." -- PC Week's Peter Coffee

1 0

Authentication challenge on database query bug
by Graham Chiu 14 Jun '99

14 Jun '99

Well, this appears to be a real bug in 1.11pr1 ? 2.x. When doing a database query I would occasionally get an authentication challenge. It was always the same query. If I cancelled the challenge, I got an error message saying that I was not allowed access to RRP, which was one of the fields in my query. Now this was the same bug that Butch Landingin was getting in his SquishDot product which he solved by replacing all NULLs in the TinyTables he was using. I therefore did the same. I removed all NULLs from my RRP field, and now the challenge has disappeared. So, in short, when anonymous queries a table which returns a set containing nulls, Zope mounts an authentication challenge. ------- Regards, Graham Chiu gchiu<at>compkarori.co.nz

1 0

RE: [Zope] Explicitly avoiding acquisition, how?
by Alexander Staubo 14 Jun '99

14 Jun '99

Thanks! Just what I needed, and about time too :-) -- Alexander Staubo http://www.mop.no/~alex/ "`This must be Thursday,' said Arthur to himself, sinking low over his beer, `I never could get the hang of Thursdays.'" --Douglas Adams, _The Hitchhiker's Guide to the Galaxy_ >-----Original Message----- >From: zope-admin(a)zope.org [mailto:zope-admin@zope.org]On Behalf Of >Pavlos Christoforou >Sent: 14. juni 1999 22:07 >To: Alexander Staubo >Cc: Zope Mailing List (E-mail) >Subject: Re: [Zope] Explicitly avoiding acquisition, how? > > >On Mon, 14 Jun 1999, Alexander Staubo wrote: >> >> I'd like to get at an attribute or folder subobject without going >> through implicit acquisition. For example, I'd like to have a DTML >> Method that checks its parent folder if that folder and >_not_ its parent >> folders carry a specific attribute. In other words, I want >to test for >> the _existence_ of an attribute. Same for folder subobjects. > >the aq_base attribute of your object returns the 'unwrapped' object. > >so  gets the object without the acquisition >wrappers. > >Pavlos > > >_______________________________________________ >Zope maillist - Zope(a)zope.org >http://www.zope.org/mailman/listinfo/zope > >(For developer-specific issues, use the companion list, >zope-dev(a)zope.org - http://www.zope.org/mailman/listinfo/zope-dev ) >

1 0

Zope Hosters Welcome Here :-)
by Hadar Pedhazur 14 Jun '99

14 Jun '99

Howdy to everyone out there in Zope land. There have been a flurry of emails recently, and a handful of posts as well, regarding commercial Zope Hosting. While I will likely send a private copy of this post to each of the people who have written to us at Digital Creations, separately, I thought that a general posting might be a good thing to do, and it won't be _too_ long, so I hope that no one will mind me hijacking the bandwidth for this "noble" cause. :-) The following block is a verbatim extract from an email I sent to a potential Zope Hosting Provider this morning. I will leave out the contact details to protect the innocent, but I hope the my response to their request to host Zope will be interesting to others who might be considering the same: *** "Well, we truly believe that the market for Zope hosters will grow significantly in the coming year, and further that there is an opportunity for hosters to more easily layer on value-added options to increase the profitability of the account. Some will be home-grown, and some will be avilable commercially or from the community. Now to the hard part. While we constantly strive to improve Zope, and to make it easier to administer in a multi-virtual domain environment, it still isn't perfect in that regard. Therefore, it takes a fair bit of technical know-how, and a willingness to sweat some tears in order to get it just right for your shop. Luckily, the envrionment that you describe above is nearly ideal for Zope, which will mitigate the above somewhat. This will definitely change in the near future (think months not years), so you could wait. The advantage of not waiting is that there are quite a number of people currently looking to find a reliable Zope Hoster. We have one very high quality hoster available now (http://www.codeit.com) They are so good at Zope hosting, that we host both http://www.zope.org and http://www.digicool.com there. We couldn't be happier with the arrangement. Still, the marketplace likes choices, and the next few hosters to truly give Zope the care and attention that it deserves will gain a fair number of new users in a realtively short period of time (my opinion only!). If there is any other info that we can provide, please don't hesitate to ask. If you do decide to host Zope, we'll help you get it right (up to a point, and then perhaps you should consider a support contract). Also, the zope mailing list is extremely knowledgable and helpful with regard to setting up Zope on all types of platforms. Then, we'll happily list you in the Zope Hosting Providers page, and help drive customers to your site!" *** So, if you're a hoster out there who is struggling with the choice as to whether to dive in and offifially offer Zope or not, I hope I've added a little confusion (I mean fuel) to help you over the hump. From my perspective, people who want to host commercial sites on Zope will want to go with "proven" hosters, and not someone who is simply willing to let them start a long running process and "see how it goes". Therefore, those that host early, will be able to build up a credible reference list and snag the people that will eventually discover the beauty and power of Zope. Dive right in, the water is fine. :-)

2 1

Re: [Zope] (116) unable to connect, fd=3
by Tim Hawes 14 Jun '99

14 Jun '99

Michel Pelletier wrote: > > I wish I knew > > more of its nature. :-/ > > > > Put just this bit of DTML into a method (lets it's called 'themethod') > somewhere in your root Zope folder. > > *Shut down Zope* > > go to 'Zopedir/lib/python' > > do this: > > [michel@aldous python]$ python > Python 1.5.1 (#2, Jan 26 1999, 10:47:10) [GCC 2.7.2.3] on linux2 > Copyright 1991-1995 Stichting Mathematisch Centrum, Amsterdam > >>> import ZPublisher, Main > >>> > ZPublisher.Main('themethod?pin=blah&from=blah(a)blah.com&message=blahblah' > ) > > 'themethod' should be the name of the method containing the errant DTML > code > > 'pin', 'from', and 'message' should be sensable values that make your > code fail through the web also. > > ZPublisher.Main has the effect of calling 'themethod' just like a web > request would. Something is happening to make your pcgi connection fail > with the Zope long running process, and thus you cannot see the error > that the python process is giving you. Since pcgi is not involved in > this little test, you will see the error printed on your terminal. It > could be a syntax error, a core dump, an SMTP error that causes > something to get sent to stderr instead of raising an exception, who > knows. Sniff it out. Well, first thing this morning, I tried it out, and could not reproduce the error. In fact it successfully paged the pin number I used. Here is what I have found: If I start ZPublisher manually within python (import ZPublisher, Main) the page works, if it is started from a connection through the web (Zope.cgi) I get the (116) unable to connect, fd=3 error. Are we getting warmer? -- Tim Hawes tim.hawes(a)ncmail.net

2 3

Explicitly avoiding acquisition, how?
by Alexander Staubo 14 Jun '99

14 Jun '99

I asked this before. Jim? Got two seconds? You should know the answer to this one. I'd like to get at an attribute or folder subobject without going through implicit acquisition. For example, I'd like to have a DTML Method that checks its parent folder if that folder and _not_ its parent folders carry a specific attribute. In other words, I want to test for the _existence_ of an attribute. Same for folder subobjects. -- Alexander Staubo http://www.mop.no/~alex/ "`This must be Thursday,' said Arthur to himself, sinking low over his beer, `I never could get the hang of Thursdays.'" --Douglas Adams, _The Hitchhiker's Guide to the Galaxy_

2 1

Time fields in MSSQL/ODBC (urgent!)
by Alexander Staubo 14 Jun '99

14 Jun '99

I am using the ODBC DA to connect to Microsoft SQL Server 6.5. I've encountered this problem before and never found a solution. Doing a simple select ArticleTime from Articles where ArticleTime is my datetime column, I get: Error Type: ValueError Error Value: Invalid value, 1999-04-29 21:36:00.000, for ArticleTime in record 0 Iirc, DateTime() barfs if a time zone is omitted in the string, so "1999-04-29 21:36:00.000" would not be a valid value, whereas "1999-04-29 21:36:00.000 GMT+1" would be. Now, naturally I can do something like select convert(varchar(12), ArticleTime) + 'GMT+1' as ArticleTimeStr from Articles which will convert the column into a string value, more or less, and I can then feed the string back into DateTime using an External Method. Phew. But of course I'd like to avoid this kind of coding. Anything I can do to make Zope accept these datetime values? -- Alexander Staubo http://www.mop.no/~alex/ "`This must be Thursday,' said Arthur to himself, sinking low over his beer, `I never could get the hang of Thursdays.'" --Douglas Adams, _The Hitchhiker's Guide to the Galaxy_

1 0

using Zope2 for a newbie?
by Daniel Pfile 14 Jun '99

14 Jun '99

Hi there, I've been reading about Zope for a while now, I've had 1.1x running on my main server with rewrite, and Zope2 running on my personal system with the built in server. This afternoon I'm going to start really digging in and learning zope by building a (non important) website with it. I was wondering if it is better to go with Zope1 or Zope2. As far as upgrading goes. I'm a pretty capable unix user with several years experience at that. Before I've done alot of projects with perl and c. I've also done alot with Frontier on Mac and Windows, so the concept of an odb is not new to me. I hope to learn enough zope to dig in and develop some cool stuff. My python skills aren't the best yet, but I am getting better. So I guess my question is, with my background should I bother learning how zope1 works, or just skip to zope2? # Daniel Pfile # clarus(a)cryogen.com # http://www.marietta.edu/~pfiled/ # # Freelance Web Designer and CGI Programer # We are all worms. But I do believe I am a glowworm. -- Winston Churchill

5 5

What I want to do (was RE: URGENT: Can't start up zope)
by Bruce Dillahunty 14 Jun '99

14 Jun '99

I want to toss something into this discussion... I'm a newbie to Zope (just found it last week or so), but it seems like it could be a good way to work on a project I am dealing with... I have quoted some of the below since it applies to some of my questions... > I'd like to play devil's advocate here for a moment > - can you > give me an example of an application where ad-hoc > reports on > _Zope_ object data are a requirement? Why would you > not use Zope's > relational database integration tools (SQL Methods, > etc.), to > deal with this kind of enterprise data? That way any > existing > ad-hoc reporting tools that work with your RDBMS > could be used. > I have a bunch of data that doesn't map well with RDBMS's, etc... text files, html files, even graphics files... these could all easily map to a few discrete types of objects (ZClasses) with certain properties for easy retrieval and searching. I would like a nice web interface (which Zope should handle nicely) for "remote" access to the application. At other times, my requirement for a GUI is going to surpass what can be done with a HTML interface (at least for now)... I want to access the same data and data store (via Zope???) from my own python/GTK or whatever GUI... can this be done? > The real point of supporting an abstract data > storage in Z2 is to > let folks use a backing store that they feel > comfortable with (as > far as stability support, scalability, availability, > etc.), I can see this... right now, as long as its fairly reliable, the standard object store would be fine... if that doesn't play out, then I could use one of the alternatives in the future, but I'm not after the RDBMS part of it... I just want an object store, along with the versioning, etc. that Zope seems to give me. So, any comments? Am I just crazy? Am I looking at the wrong tool, or using it the wrong way? Thanks for any input people have! Bruce === -- Bruce C. Dillahunty Peachbush Enterprises _________________________________________________________ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com

1 0

Large Portal requirements (was: Other web servers?)
by Jimmie Houchin 14 Jun '99

14 Jun '99

At 01:22 PM 6/14/99 -0400, Michel Pelletier wrote: [snip] >> #2: Do I understand correctly that **every** page is built and served >> dynamically? Is there a performance issue here, since static >> html serve the fastest? Much of our content will be static pages, but we need >> ease-of-use for publishing by non-web persons. > >Every page is served 'dynamicly' in that it is pulled from the object >database. However, pages do not need to be rendered if they do not >contain any DTML scripting. When a document is added, the DTML is >compiled for speed, it is not parsed and compiled on every access. > >Zope is much faster than traditional CGI solutions for "dynamicly" >generating content, since the Zope process is running all the time, >there is no fork and exec'ing of an interpreter overhead. > >Also, I have no benchmarks on traditional file serving vs. serving from >the object database, I would venture a wager however that you will not >notice it even under heavy loads. Zope 1.x has been proven to do well >over a million hits a day on modest hardware, and Zope 2.0 will be able >to perform much faster and smoother than that. Given also that it is >written in Python and not (god forbid) Java means that it is very >cross-platform and can run on every platform that python can run on and >that you can compile C python extensions onto. Howabout for database intensive situations like one encounters in some of the larger sites like Altavista, Goto, Yahoo, Amazon, etc. Here are very, very large databases, probably very large indexes, multi-millions of objects, multi-multi-gigabytes to search, index. My concern is because Python does not scale with multiple processor machines, this limits ones ability to throw hardware at the situation since you are limited to the fastest single processor. Do I misunderstand anything. Would Zope be appropriate for these situations? How well would Zope handle it? For example in an article I read concerning the delay in Intel bringing out it's chipset for 8way Pentium III servers. Barnes and Noble was talking about beta-testing an 8way server to speed up their searches. Now I understand that different development models yield different results and I don't know how Barnes and Noble's website is built. I do know that B&N has a very large database with multi-millions of objects with many, many gigs of data. Would Zope be appropriate? I know that my website will have similar and greater requirements concerning database size and searching. Hopefully hits/traffics also will be high. Zope and Python are my first choice. Thanks for any help. Jimmie Houchin [snip]

1 0