Hello out there, I'm looking for someone with some more Zope "Zen" to help me figure out how to add support for legacy CGI scripts (specifically Mailman 1.1) to Zope. To recap, I know and understand how to get Apache to play nicely with Zope. What I'm trying to do is remove the need for Apache by allowing ZServer to serve CGI scripts itself. The motivation is to allow me to run Mailman 1.1 on my Zope site without having to have Apache (or any other web server) configured and running. First, am I really the first person to try running CGI scripts from ZServer? I have found some hints here and there of people doing somewhat similar things, but I haven't yet found a product for easily adding legacy CGI scripts to a Zope site. It seems most people run Zope behind Apache. Is ZServer really slow or buggy or something? Second, is Mailman going to be integrated with Zope? It seems like a natural fit. It would be nice to move away from the pipermail archiving and use the Zope object database for archiving messages instead. Third, thanks to code from Eric Walstad and Chris Withers (author of PathHandler), I have hacked up an external method that sort of works. It attempts to add to Zope the functionality of ScriptAlias in Apache. But I'm running into some problems with the HTTP header. The attached code simply ignores the HTTP header sent by the Mailman CGI script, letting Zope do its thing. But this becomes a problem when Mailman wants to set cookies for authentication. Can anyone help me figure out how to convince Zope to let the CGI script send both the HTTP header and message body? Thanks, Fred Here's my external method. It is called by a Path Handler object. Some notes: 1) REQUEST['PATH_INFO'] seems to be brain dead 2) the path_to_handle key is inserted by the PathHandler product 3) this is written for Linux; I'm not sure how Windows handles os.popen 4) I don't understand why sometimes this function gets called with one argument and sometimes with two -- I always just ignore the second argument import os, os.path, string def testing(self, second=None): if self.REQUEST.has_key('path_to_handle'): script = self.REQUEST['path_to_handle'][0] if script: script_path = '/home/mailman/cgi-bin/%s' % script if os.path.isfile(script_path): ENV = '' if len(self.REQUEST['path_to_handle']) > 1: ENV = ENV + 'PATH_INFO=/%s' % string.join(self.REQUEST['path_to_handle'][1:],'/') elif self.REQUEST['PATH_INFO'][-1] == '/': ENV = ENV + 'PATH_INFO=/' ENV = ENV + ' HTTP_HOST=%s' % self.REQUEST['HTTP_HOST'] ENV = ENV + ' SERVER_NAME=%s' % self.REQUEST['SERVER_NAME'] f = os.popen("/usr/bin/env %s %s" % \ (ENV, script_path)) header = 1 while header: if (f.readline() == '\n'): header = 0 output = f.read() # grab the output of the CGI here status = f.close() else: return '%s: CGI script not found.' % script else: return 'No CGI script specified.' else: return 'No path to handle.' return output + '<hr>' + str(self.REQUEST.keys()) + '<hr>' + str(self.REQUEST)
From: "Fred Wilson Horch" <fhorch@ecoaccess.org> Sent: Friday, November 17, 2000 2:22 AM Subject: [Zope] Running Mailman CGI under Zope ZServer
<...snip...>
First, am I really the first person to try running CGI scripts from ZServer? I have found some hints here and there of people doing somewhat similar things, but I haven't yet found a product for easily adding legacy CGI scripts to a Zope site. It seems most people run Zope behind Apache. Is ZServer really slow or buggy or something?
<...other good stuff snipped...> I have a similar question. I am planning and building a site in which about 50% of the content needs to be accessed using SSL only (it's personal information and we are using 128-bit SSL). Since I am only the database&web-guy and not a sysadmin-guy (yet :), I had one of my colleagues configure Apache and Zope using the "Apache & ZServer" how to. This works well and Apache serves Zope pretty well and we can even use SSL (there are some issues to be resolved that I suspect are due to misconfiguration on our server). However, I can always access Zope directly using port 8080 (or whatever port where ZServer is listening to) without SSL. This is aboviously not the intended behaviour. Is there a way to prevent this? I know there is ZServerSSL but isn't the whole point of using Apache that it is a better and more robust web-server than Zserver? (apart from the fact that we need to serve a lot of static content as well). What are the main resons for serving Zope behind Apache? Thanks for any input, Sincerley, /dario - -------------------------------------------------------------------- Dario Lopez-Kästen Systems Developer Chalmers Univ. of Technology dario@ita.chalmers.se ICQ will yield no hits IT Systems & Services
On Fri, 17 Nov 2000, Dario Lopez-Kästen wrote:
one of my colleagues configure Apache and Zope using the "Apache & ZServer" how to. This works well and Apache serves Zope pretty well and we can even use SSL (there are some issues to be resolved that I suspect are due to misconfiguration on our server). However, I can always access Zope directly using port 8080 (or whatever port where ZServer is listening to) without SSL.
This is aboviously not the intended behaviour. Is there a way to prevent this? I know there is ZServerSSL but isn't the whole point of using Apache
Look at z2.py options to set IP to listen on. If Zope and Apache are on the same machine, you can set 127.0.0.1, so Zope won't be accesible from other hosts. If they are on separate machines, then probably they are in the same LAN - so you can use some other address not accessible from outside your LAN. ololo@zeus.polsl.gliwice.pl /--------------------------------------\ | `long long long' is too long for GCC | \--------------------------------------/
how to. This works well and Apache serves Zope pretty well and we can even use SSL (there are some issues to be resolved that I suspect are due to misconfiguration on our server). However, I can always access Zope directly using port 8080 (or whatever port where ZServer is listening to) without SSL.
This is aboviously not the intended behaviour. Is there a way to prevent this? I know there is ZServerSSL but isn't the whole point of using Apache that it is a better and more robust web-server than Zserver? (apart from the fact that we need to serve a lot of static content as well).
What are the main resons for serving Zope behind Apache?
A lot of Zope sites (including www.zope.org itself) actually use Apache only as a proxy server, i.e. Apache doesn't SERVE the content, but just relays requests to ZServer (you'd need the SiteAccess product on the Zope part for this configuration option). So you can have different Zope servers serve parts of the same web site, use Apache to set up virtual servers, or easily set up SSL for parts of your site. Apache can then also be used to serve static parts of your web site, like large documents or images. Also, Apache can be used to cache Zope requests. ZServer (with or without Apache as a proxy) is definitely faster than any other option (FastCGI, ...). Regarding your problem: Set up a simple packet filter firewall (most Linux distros have scripts for that, e.g. SuSE has "firewals") and don't allow access to port 8080. Cheers Joachim.
Joachim Werner <joe@iuveno.de> said:
Apache can then also be used to serve static parts of your web site, like large documents or images. Also, Apache can be used to cache Zope requests.
I use Squid, not Apache as a reverse web proxy in front of Zope. I did a bit of testing, and you can very well serve your static content from Zope in this setup - I am planning to assign caching control properties to parts of the document structure and make Zope 'kick' Squid for a refresh when cached documents are edited. Initial experiments got me 500 requests per second on cached documents - Zope wasn't touched at all.
Regarding your problem: Set up a simple packet filter firewall (most Linux distros have scripts for that, e.g. SuSE has "firewals") and don't allow access to port 8080.
Something like % ipchains -A input -S 0/0 -d 0/0 8080 -p tcp -j REJECT should totally block port 8080. If you work from 1.2.3.4, you can do: % ipchains -I input -S 1.2.3.4/32 -d 0/0 8080 -p tcp -j ACCEPT and your machine is the only one that can get to this port. If you want to have this done automagically, create /etc/ipchains.conf: % cat >/etc/ipchains.conf <<EOF -I input -S 1.2.3.4/32 -d 0/0 8080 -p tcp -j ACCEPT -A input -S 0/0 -d 0/0 8080 -p tcp -j REJECT EOF and execute '/sbin/ipchains-restore </etc/ipchains.conf' from /etc/rc.d/boot.local (or similar). Disclaimers: I haven't tested these rules; you should have a kernel that does packet filtering; you're not worth the root password if you let someone else tell you firewalling rules without understanding /exactly/ what they do ;-) -- Cees de Groot http://www.cdegroot.com <cg@cdegroot.com> GnuPG 1024D/E0989E8B 0016 F679 F38D 5946 4ECD 1986 F303 937F E098 9E8B
Second, is Mailman going to be integrated with Zope? It seems like a natural fit. It would be nice to move away from the pipermail archiving and use the Zope object database for archiving messages instead.
I wrote once my own Python Product for Zope that simply imported the important methods and wrote my own little scripts on top. It is really easy. The only difficulty is to keep the Mailman database permissions straight, since they adjust to the executing user after every access. So the best is to run Zope and Mailman from the same account. Regards, Stephan -- Stephan Richter CBU - Physics and Chemistry Student Web2k - Web Design/Development & Technical Project Management
participants (6)
-
Aleksander Salwa -
cg＠cdegroot.com -
Dario Lopez-K�sten -
Fred Wilson Horch -
Joachim Werner -
Stephan Richter