Hello All,
This thing just came to notice when we upgraded our Internet Explorer to
IE8. The search box that populates using <meta-g> pulls up at the very
bottom of the page in IE8.
The same box works normally and shows up at the top of the page in IE7 or
Firefox 3.X.X.
In IE8, when I enable the compatibility mode, the box works normally & shows
up at the top of the page.
Although, I've not tried this solution, but I understand that adding this
meta tag at the top of any html/jsp page should help circumnavigate this
issue :
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />
However, I am not sure which page to add this so that the search box works &
appears at the top of the page.
Any help...
Hi Sergiu,
problem is solved. Sorry for the annoyance. Today I have been told
that the xwiki database was imported from a previous xwiki instance and
not created from the scratch. So we decided to make a xwiki
installation from the scratch and this worked like a charm. Having a
look at the
log would also probably have helped us. There were a lot of exceptions
thrown by Hibernate (but I am not sure that they are all related to my
problem).
Thanks to everyone and have a beautiful day,
christian
--
Canoo - Your Solution Provider for Rich Internet Applications
Christian Ribeaud
Canoo Engineering AG
Kirschgartenstrasse 5
CH-4051 Basel
Tel: +41 61 228 94 44
Fax: +41 61 228 94 49
christian.ribeaud(a)canoo.com
http://www.canoo.com/
On Aug 15, 2009, at 7:58 PM, Sergiu Dumitriu wrote:
> Christian Ribeaud wrote:
>> Hi Sergiu,
>>> Thanks for the message. Unfortunately I won't be able to look at
>>> it more until tonight. After a first look, indeed it seems to be a
>>> real problem, which I can't explain right now.
>> No problem. I would really be happy if we could use XWiki.
>>> Can you first try to use the MySQL5Dialect dialect in the
>>> hibernate configuration file?
>> $ /usr/local/mysql5/bin/mysql -V outputs:
>> /usr/local/mysql5/bin/mysql Ver 14.12 Distrib 5.0.51, for redhat-
>> linux-gnu (i686) using EditLine wrapper
>>> Also, what version of the mysql connector are you using?
>> I found 'mysql-connector-java-3.0.11-stable-bin.jar' in
>> '<TOMCAT_HOME>/lib' directory (Tomcat6).
>> If XWiki does not install any other, this is the one which is used.
>
> Version 3 doesn't work well with XWiki. Can you try putting http://repo2.maven.org/maven2/mysql/mysql-connector-java/5.1.6/mysql-connec…
> in webapps/xwiki/WEB-INF/lib and restart the server?
>
>> Do you think that this could be a file permissions issue? On the
>> server where XWiki is running, I have less permissions than
>> on my computer.
>
> No, it correctly retrieves the number of users, and everything else
> seems to work, so it's not a permission issue.
>
> --
> Sergiu Dumitriu
> http://purl.org/net/sergiu/
>
I have installed for testing the M3 and tried to login immediately with
Admin/admin but it says, Wrong user name!!!! I tried to see if anything
was written and nothing. Did the password or user name change?
Hi all,
I have been trying for the last day to put the TODO app in my wiki and it
kept on failing to show the mytodo list in the panel. I use Oracle for
backend so I thought it was that the problem. Here is the panel's code
corrected to work in my case (XWiki 1.9.3, Tomacat 6, Oracle XE 11):
#panelheader('My Todos')
#set ($hql = ", BaseObject as obj, StringProperty as prop1,
LargeStringProperty as prop2 where obj.name=doc.fullName and
obj.className='XWiki.TodoClass' and obj.name <> 'XWiki.TodoClassTemplate'
and obj.id=prop1.id.id and prop1.id.name='Status'
and prop1.value <> 'Finished' and obj.id=prop2.id.id
and prop2.id.name ='Assignee' and prop2.value like '$context.user'
order by doc.date desc")
#foreach ($todo in $xwiki.searchDocuments($hql, 5, 0))
* [$todo]
#end
#panelfooter()
The big difference is the LargeStringProperty (Instead of StringProperty
used in the XAR) and the like instead of = used to match the value.
For the LargeStringProperty it is strange for me that someone chose a CLOB
to store user names but... maybe because of the class hierarchy involved in
the user name. Then again, how can this work even without oracle?
For the like, well, oracle atleast will not even bother checking a string
against a stream. Yes the words are phonetically close but.... oracle
doesn't care about phonetics.
I hope others out there will enjoy this helpful app.
Hello!
I want to run different xwiki-versions (currently 1.7.2 and new 1.9.3) on one host in one tomcat-container (but different folders: webapps/xwiki172 and webapps/xwiki193) against one Oracle-DB (but different users: xwiki and xwiki2).
The user xwiki is used by version 1.7.2 and is running fine, the version 1.9.3 is configured to use the DB-User xwiki2.
It seems not to be possible, when I point to http://[...]:8081/xwiki193, I get:
2009-08-17 15:17:46,757 [http://[...]:8081/xwiki193/bin/view/Main/] [http-8081-Processor23] ERROR store.XWikiHibernateBaseStore
java.sql.SQLException: ORA-00955: name is already used by an existing object
at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:112)
at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:331)
at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:288)
at oracle.jdbc.driver.T4C8Oall.receive(T4C8Oall.java:745)
at oracle.jdbc.driver.T4CStatement.doOall8(T4CStatement.java:207)
at oracle.jdbc.driver.T4CStatement.executeForRows(T4CStatement.java:957)
at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1170)
at oracle.jdbc.driver.OracleStatement.executeUpdateInternal(OracleStatement.java:1623)
at oracle.jdbc.driver.OracleStatement.executeUpdate(OracleStatement.java:1588)
at org.apache.commons.dbcp.DelegatingStatement.executeUpdate(DelegatingStatement.java:225)
at org.apache.commons.dbcp.DelegatingStatement.executeUpdate(DelegatingStatement.java:225)
at com.xpn.xwiki.store.XWikiHibernateBaseStore.updateSchema(XWikiHibernateBaseStore.java:492)
at com.xpn.xwiki.store.XWikiHibernateBaseStore.updateSchema(XWikiHibernateBaseStore.java:308)
at com.xpn.xwiki.store.XWikiHibernateBaseStore.updateSchema(XWikiHibernateBaseStore.java:254)
at com.xpn.xwiki.store.XWikiHibernateBaseStore.checkHibernate(XWikiHibernateBaseStore.java:563)
at com.xpn.xwiki.store.XWikiHibernateBaseStore.execute(XWikiHibernateBaseStore.java:1024)
at com.xpn.xwiki.store.XWikiHibernateBaseStore.executeRead(XWikiHibernateBaseStore.java:1068)
at com.xpn.xwiki.store.migration.hibernate.XWikiHibernateMigrationManager.getDBVersion(XWikiHibernateMigrationManager.java:
at com.xpn.xwiki.store.migration.AbstractXWikiMigrationManager.<init>(AbstractXWikiMigrationManager.java:68)
at com.xpn.xwiki.store.migration.hibernate.XWikiHibernateMigrationManager.<init>(XWikiHibernateMigrationManager.java:51)
[...]
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(Unknown Source)
at java.lang.Thread.run(Thread.java:619)
2009-08-17 15:17:46,809 [http://[...]:8081/xwiki193/bin/view/Main/] [http-8081-Processor23] WARN util.JDBCExceptionReporter
2009-08-17 15:17:46,809 [http://[...]:8081/xwiki193/bin/view/Main/] [http-8081-Processor23] ERROR util.JDBCExceptionReporter
com.xpn.xwiki.XWikiException: Error number 3001 in 3: Cannot load class com.xpn.xwiki.store.migration.hibernate.XWikiHibernateMigra
Wrapped Exception: Error number 0 in 3: Exception while hibernate execute
Wrapped Exception: could not execute query
at com.xpn.xwiki.XWiki.createClassFromConfig(XWiki.java:1005)
at com.xpn.xwiki.XWiki.initXWiki(XWiki.java:728)
at com.xpn.xwiki.XWiki.<init>(XWiki.java:670)
at com.xpn.xwiki.XWiki.getMainXWiki(XWiki.java:317)
at com.xpn.xwiki.XWiki.getXWiki(XWiki.java:388)
at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:135)
at com.xpn.xwiki.web.XWikiAction.execute(XWikiAction.java:115)
at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:431)
at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:236)
at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1196)
at org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:414)
[...]
It looks a little bit like jira-XWIKI-2009 which is noticed to be fixed.
Is this possible? How to do?
hp-ux 11.23
java 1.6.0.03
tomcat 5.5.20
oracle 10.2.0.3
Thanx a lot!
Michael
******
Plantschen oder Grog? Der Arcor-Wetterdienst weiss Bescheid!
Wassertemperaturen für den Urlaub jetzt checken: www.arcor.de/rd/wetter_wasser
Currently writing special pages to extend functionality of MediaWiki,
but considering using XWiki instead.
Experimenting with XWiki Enterprise by attempting install of xwiki-
enterprise-web-1.9.3.war:
In Apache Tomcat 5.5.23
Using PostgreSQL 8.4.0 -- Succeeds
Or HSQLDB 1.8.0.7 -- Succeeds
But MySQL 5.0.45 -- Fails.
MySQL is required for XWiki Enterprise Manger, so I need to use MySQL.
I get this error in the browser:
javax.servlet.ServletException: Error number 3 in 0: Could not
initialize main XWiki context Wrapped Exception: Error number 3001 in
3: Cannot load class
com.xpn.xwiki.store.migration.hibernate.XWikiHibernateMigrationManager
from param xwiki.store.migration.manager.class Wrapped Exception:
Error number 0 in 3: Exception while hibernate execute Wrapped
Exception: Could not create a DBCP pool. There is an error in the
hibernate configuration file, please review it.
I get this additionally in catalina.out:
** BEGIN NESTED EXCEPTION **
java.net.ConnectException
MESSAGE: Connection refused
STACKTRACE:
java.net.ConnectException: Connection refused
I have installed mysql-connector-java-5.0.8-bin.jar in /var/lib/
tomcat5/webapps/xwiki/WEB-INF/lib.
I have modified /var/lib/tomcat5/webapps/xwiki/WEB-
INF.hibernate.cfg.xml as follows:
<!-- MySQL configuration.
Uncomment if you want to use MySQL and comment out other
database configurations.
Note that the database will be created automatically if it
doesn't already exist.
We need to set the sql_mode to a less strict value, see
XWIKI-1945
-->
<property name="connection.url">jdbc:mysql://localhost/xwiki?
useServerPrepStmts=false&useUnicode=true&\
characterEncoding=UTF-8&sessionVariables=sql_mode=''</property>
<property name="connection.username">xwiki</property>
<property name="connection.password">PASSWORD</property>
<property name="connection.driver_class">com.mysql.jdbc.Driver</
property>
<property name="dialect">org.hibernate.dialect.MySQLDialect</
property>
<property
name
=
"connection
.provider_class">com.xpn.xwiki.store.DBCPConnectionProvider</property>
<property name="connection.pool_size">2</property>
<property name="statement_cache.size">2</property>
<mapping resource="xwiki.hbm.xml"/>
<mapping resource="feeds.hbm.xml"/>
I created an xwiki database and granted privileges in MySQL as follows:
$ mysql -u root -p
mysql> create database xwiki;
mysql> grant all privileges on xwiki.* to xwiki(a)127.0.0.1 identified
by 'xwiki';
mysql> grant all privileges on xwiki.* to xwiki@localhost identified
by 'xwiki';
OR
mysql> create database xwiki;
mysql> grant all privileges on xwiki.* to xwiki(a)127.0.0.1 identified
by 'SAMEASROOT';
mysql> grant all privileges on xwiki.* to xwiki@localhost identified
by 'SAMEASROOT';
Note that PASSWORD in the hibernate.cfg.xml file was set to either
'xwiki', or to the same password as for the root MySQL user, with the
thought that perhaps the Hibernate configuration assumed an empty root
MySQL user password, and that, somehow, this might help.
I then modified /var/lib/tomcat5/webapps/xwiki/WEB-
INF.hibernate.cfg.xml as follows, since this is what the installation
instructions actually show, that is, omitting some MySQL parameters:
<!-- MySQL configuration.
Uncomment if you want to use MySQL and comment out other
database configurations.
Note that the database will be created automatically if it
doesn't already exist.
We need to set the sql_mode to a less strict value, see
XWIKI-1945
-->
<property name="connection.url">jdbc:mysql://localhost/xwiki</
property>
<property name="connection.username">xwiki</property>
<property name="connection.password">PASSWORD</property>
<property name="connection.driver_class">com.mysql.jdbc.Driver</
property>
<property name="dialect">org.hibernate.dialect.MySQLDialect</
property>
<property
name
=
"connection
.provider_class">com.xpn.xwiki.store.DBCPConnectionProvider</property>
<property name="connection.pool_size">2</property>
<property name="statement_cache.size">2</property>
<mapping resource="xwiki.hbm.xml"/>
<mapping resource="feeds.hbm.xml"/>
I have tried many permutations and scoured installation instructions,
FAQ, and archives. I definitely need some help here.
>If your attachment is an image, it's most probably a browser cache issue.
>Can you try force-refreshing your browser (ctrl-shift-R) in Firefox and see
>what happens?
My document is not an image but it was a browser cache issue.
Thank you for the help
Hello,
1. I am wondering if any users running XWiki on Tomcat 5.5 have set up a SecurityManager policy. The documentation isn't really clear on this, other than "it's an issue" that may not be resolved. The one "comment" on XWiki.org that has a security policy is close but not quite clear. I couldn't figure out the part about Log4J.
- is a policy necessary?
- without one, are there any inherent security risks using XWiki/Tomcat "out of the box"?
- what about Tomcat's default "users" and "roles"?
2. Are there any security risks using the default "xwiki" installation location in webapps? ie. if it's there and someone realizes you're running XWiki, couldn't they then direct their attacks specifically at MySQL / Tomcat / XWiki, looking for holes? I tried installing the WAR to a different location, and failed miserably. Does it matter?
3. Is anyone using XWiki over SSL? Anything special we need to do for that, other than getting a certificate?
As you can tell, I'm not familiar with Tomcat and not a security guru. I'm just the one who has to make sure our setup "out of the box" is secure against exploits.
We're running on Ubuntu, with MySQL. Yes, the server will be behind a firewall, and the MySQL passwords have been changed.
I think what would help in the online documentation is a "security checklist" that rounds up all the various bits that I found on various pages.
Thanks,
Trevor
Hi,
On Mar 6, 2009, at 11:02 AM, Helmut Lehner wrote:
> Hi Vincent
>
>> I don't know if there's much we can do here since the tinymce-based
>> wysiwyg will have saved the content of the page in HTML in your case
>> and the converter cannot distinguish this from someone typing HTML in
>> the page.
>
> I get this code editing a page in WYSIWYG-Mode with Syntax 1.0 and
> only the headings are html. The rest is wiki syntax. This behavior
> started somwhere around Version 1.5 i think. before headings were
> created correctly in wiki syntax (as the rest).
>
>
>> If you have an idea of how to do it let us know. For me you'll need
>> to
>> correct the 1.0 content for your pages that have this problem.
>
> I know how to correct this i just wanted to mention that this could
> be a problem not only for me but for every user who creates pages in
> syntax 1.0 in WYSIWYG and converts them to syntax 2.0 afterwards.
Yes it's a problem. One thing that can be done is to write/provide a
small velocity/groovy script that scans all wiki pages and replaces
the heading with the wiki syntax.
> The best thing would be to make the tiny mce editor create headings
> again in wiki syntax:)
That will not solve the problem for all page contents which have now
HTML for headings.
> The next best thing would be to convert html headings like the ones
> created (without class, or style information) to headings in xwiki
> syntax 2.0 because i think there are fewer headings created
> intentionally in html with that code than by accident through that
> editor bug.
I think I'd prefer the script solution since otherwise that'll make
the converter heavier and with some hacks.
WDYT?
Thanks
-Vincent
Dear all,
I encounter the following problem.
I have a link to an attachement using the 2.0 syntax :
[[document>>attach:docAdmin.doc]]
But when I add a new version to the attachement, the link permits to
download he previous version.
It is the same problem inside the attachment panel, it displays version 1.2
but give access to the 1.1 version.
I can only download my new 1.2 version using the history view of the
attachment.
I use XWiki Enterprise 1.9.2. Is there a bug for this case ? Could you
reproduce it ?
Regards,
Maxime
I found it, the Administration button at the right top corner was not
obvious this time :-O I have installed previous versions of xwiki and it
was obvious to me. Nothing has changed but I didn't see it. Maybe it
should change color (RED/BOLD) for some blind people like me.
I had the same problem with my first attempts of XWiki installation. As a
trial I used the xwiki user in oracle and it worked. For my installations I
have to always use xwiki oracle user in order to get passed this point. Can
you try it
hi all
anyone have u success integrate liferay with xwiki?
liferay have their own wiki, but i believe xwiki more mroe advanced in feature
i want to make both tech use one LDAP server
--
Frans Thamura
Meruvian.
Center of Java and Enterprise OpenSource
Meruvian bukan hanya membuat anak SMK menjadi bisa tapi SAKTI, malah
saktinya SAKTI Mandraguna.
Mobile: +62 855 7888 699
Blog & Profile: http://frans.thamura.info
We provide services to migrate your apps to Java (web), in amazing
fast and reliable.
Hi,
i was just wondering how embedded documents work. The Syntax Help gives no
example.
I don't know but is it just the include macro?
Thanks
hel.
-----
semantic-web.hel.at
hel(a)hel.at
--
View this message in context: http://n2.nabble.com/Embedded-documents-tp3423459p3423459.html
Sent from the XWiki- Users mailing list archive at Nabble.com.
Dear friends,
I request help on a few changes that we are making to our internal XWiki
installation.
We run XWiki 1.7 over a tomcat 6.0.18 & mysql 5 installation.
I see that the blog application has publication date feature which I believe
runs as a scheduled job. Is there a possibility to add publication date to a
page created in any other space. On the face of it, pages created in both
blog space or any other space appear to be the same. So there should be some
possibility that we can add scheduled publication dates to pages without
making major changes to the present XWiki installation.
Also, can we extend the category & sub category feature to any page outside
the Blog space.
Any help on this would be greatly appreciated.
Also, if I may suggest a name for the new skin, I would suggest 'sparrow'.
It kind of rhymes with 'arrow' & the bird is small, light & even the colors
seem to match.
Thank you all...
The XWiki development team is pleased to announce the release of XWiki
Enterprise 2.0 Milestone 3.
Go grab it at http://www.xwiki.org/xwiki/bin/view/Main/Download
This is the third and last milestone for the 2.0 version.
The main goal of 2.0 is to make XWiki fully XWiki 2.0 syntax.
Main changes from 2.0 Milestone 2:
* Lots of improvements and new features in the new WYSIWYG editor
* Lots of improvements and bugfixes in the rendering engine and
the syntax converter
* Upgrade to SmartGWT 1.2
* New experimental network event distribution module
* Several blog application improvements
* Several tags application bug fixes
* Translations updated for de, fr, lv, nl, ru
For more information see the Release notes at:
http://www.xwiki.org/xwiki/bin/view/Main/ReleaseNotesXWikiEnterprise20M3
Thanks
-The XWiki dev team
Hi Florian,
I discovered this horrible problem as well when I upgraded to "XWiki
Enterprise 1.9.21179", the page I was editing was unrecoverable and
luckily I still had my old version of the xwiki running on a different
server so I copied it back from there. I turned off the section editing
to prevent my users from losing their pages. You can do this in the
xwiki.cfg file, by setting xwiki.section.edit=0:
#-# This parameter will activate the sectional editing
xwiki.section.edit=1
Good luck,
Regan
>
> 1.) I have troubles with my wysiwyg Editor:
> I have a bigger artivle with severyl headlines. Therefor I can click
on
> the
> pen symbol tot he right of teh articel to open only a part oft he
> article.
> If I do this and store the article the parts above of the articles are
> away!
> Then I have to restore the old version than the old text is again
shown
> but
> not the new one. What can be the reason for that? If I use the editor
> without wysiwyg the same result!
Hello,
I have a few questions about how to contribute to the dutch
application_resource file.
Yesterday I have added some translations to the dutch translation of the
XE resources
at the I10n.wiki.org site. Is there any documentation about this site? I
am unsure about
what some functions do and the effects they may have on others. For
instance the link
'Import/reimport default language file', Admin actions like 'Import' and
'Prepare'. Also
I noticed that when I get the dutch translation as a application
resource file, it only has
the resources filled in if a dutch translation exists. This seems
logical, but as long as not
all strings have a dutch translation, my xwiki contains lots of empty
strings. Is there a
way to build a resource file with dutch translations where available,
and the default
english strings when not? Another thing that is not clear to me is the
functionality around
reviewing and validation. If I find a translation that is incorrect of I
thing there is a better
one, can I just change it, or should I somehow make a review request to
somebody
authorized to accept or reject the change? Is there any way to know who
is contributing
to the same translation in order to achieve some common ideas about how
to translate
xwiki terms?
Thanks,
Henk
--
==
Henk F. Schouten, ICT-architect, Dienst ICT
room: SL 2.32, phone (31) 70 4457611, email: H.F.Schouten(a)hhs.nl
De Haagse Hogeschool, Johanna Westerdijkplein 75, 2521 EN the Hague (NL)
G'day one and all,
I'm looking at using xwiki for our intranet and was wondering how existing
taxonomies can be implemented/imported into xwiki
Regards,
Stephen....
Hi!
We have a problem with the new "Import Office Content" functionality in
XWiki Enterprise 1.9.2.22089.
The problem exists with Internet Explorer 6.0.2800.1106; with Firefox
3.0.7 everything is working fine ....
After copy&paste of some word content into the import office panel some
xml tags are visible in the imported text:
<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office"
/>
To reproduce:
1. In Edit mode, selected Import Office Content.
2. In Office Importer, select Clipboard, copy&paste some word text and
select Import. (filter styles / don't filter styles doesn't matter)
3. Preview / Save and view
What is the problem that only Internet Explorer is affected ?
Thanks in advance
Matthias Gsottberger
... done
http://jira.xwiki.org/jira/browse/XWIKI-4161
thanks
Matthias
>Coukd you provide a sample file in a JIRA bug report so that we can
>check it out ?
>Ludovic
>
>>Matthias.Gsottberger at o2.com a écrit :
>> Hi!
>>
>> We have a problem with the new "Import Office Content" functionality in
>> XWiki Enterprise 1.9.2.22089.
>> 3.0.7 everything is working fine ....
>>
>> After copy&paste of some word content into the import office panel some
>> xml tags are visible in the imported text:
>>
>> <?xml:namespace prefix = o ns =
"urn:schemas-microsoft-com:office:office"
>> />
>>
>>
>> To reproduce:
>> 1. In Edit mode, selected Import Office Content.
>> 2. In Office Importer, select Clipboard, copy&paste some word text
and
>> select Import. (filter styles / don't filter styles doesn't matter)
>> 3. Preview / Save and view
>>
>>
>> What is the problem that only Internet Explorer is affected ?
>>
>>
>> Thanks in advance
>>
>> Matthias Gsottberger
>>
>> _______________________________________________
>> users mailing list
>> users at xwiki.org
>> http://lists.xwiki.org/mailman/listinfo/users
>>
>>
This might be useful for those wanting to do server administration functions
(start/stop tomcat, reboot, stats, etc) out of an Xwiki doc (make sure your
doc is password protected or more, if it allows people to reboot your
server!; Anything needing root or tomcat user would use /etc/sudoers to
grant specfic permissions to specific programs needed by user
tomcat-ssh-slave):
Input:
> ==== Use Groovy Script run server processes and display result ====
> See [[SshHelperClass?viewer=code]], [[
> http://blog.asyd.net/2008/12/xwiki-cest-decidemment-magique/]]
> ==== Call parseGroovyFromPage("Groovy.SshHelperClass") ====
{{velocity}}
#set( $sshHelper = $xwiki.parseGroovyFromPage("Groovy.SshHelperClass") )
$sshHelper.openSession("127.0.0.1", "22", "tomcat-ssh-slave",
> "/usr/share/tomcat6/.ssh/id_dsa", "")
{{/velocity}}
> ==== Output from 'uname -a'====
##{{velocity}}$sshHelper.runCommand("uname -a"){{/velocity}}##
> ==== Output from 'free' ====
##{{velocity}}$sshHelper.runCommand("free"){{/velocity}}##
> ==== Output from 'ps -l U tomcat-ssh-slave U tomcat U apache' ====
##{{velocity}}$sshHelper.runCommand("ps -l h U tomcat-ssh-slave U tomcat U
> apache"){{/velocity}}##
> ==== Output from 'df -H' ====
##{{velocity}}$sshHelper.runCommand("df -H"){{/velocity}}##
> ==== Output from 'top -b -n 1' ====
##{{velocity}}$sshHelper.runCommand("top -b -n 1"){{/velocity}}##
> ==== Close the connection and exit tomcat-ssh-slave shell ====
warning: if something breaks above, hopefully this will get called otherwise
> we
get a left-over sub-process tomcat-ssh-slave
##{{velocity}}$sshHelper.close(){{/velocity}}##
Output:
> Use Groovy Script run server processes and display result
>
> See SshHelperClass ,
>> http://blog.asyd.net/2008/12/xwiki-cest-decidemment-magique/
>
> *Call parseGroovyFromPage("Groovy.SshHelperClass")*
>
> *Output from 'uname -a'*
>
> Linux ce 2.6.27.29-170.2.78.fc10.x86_64 #1 SMP Fri Jul 31 04:16:20 EDT
>> 2009 x86_64 x86_64 x86_64 GNU/Linux
>
> *Output from 'free'*
>
> total used free shared buffers cached
>
> Mem: 1928992 1778932 150060 0 47272 532128
>
> -/+ buffers/cache: 1199532 729460
>
> Swap: 3866616 78776 3787840
>
> *Output from 'ps -l U tomcat-ssh-slave U tomcat U apache'*
>
> 5 S 92 18792 18788 0 80 0 - 22060 select ? 0:00 sshd:
>> tomcat-ssh-slave@notty
>
> 0 R 92 18879 18792 1 80 0 - 22453 - ? 0:00 ps -l h U tomcatssh-slave U
>> tomcat U apache
>
> 0 S 91 31695 1 0 80 0 - 463955 futex_ ? 7:47 /usr/java/default/bin/java
>> -server -Xms160m -Xmx1024m -XX:PermSize=160m -XX:MaxPermSize=320m ...
>
> *Output from 'df -H'*
>
> Filesystem Size Used Avail Use% Mounted on
>
> /dev/mapper/VolGroup00-LogVol00 242G 26G 204G 12% /
>
> /dev/sda1 200M 15M 175M 8% /boot
>
> tmpfs 988M 353k 988M 1% /dev/shm
>
> *Output from 'top -b -n 1'*
>
> top - 11:17:20 up 2 days, 16:21, 3 users, load average: 0.78, 0.68, 0.56
>
> Tasks: 150 total, 2 running, 148 sleeping, 0 stopped, 0 zombie
>
> Cpu(s): 7.7%us, 1.7%sy, 0.0%ni, 90.2%id, 0.3%wa, 0.1%hi, 0.1%si, 0.0%st
>
> Mem: 1928992k total, 1794420k used, 134572k free, 47304k buffers
>
> Swap: 3866616k total, 78776k used, 3787840k free, 532356k cached
>
> ...
>
>
Special Installation Instructions
To make this run (Fedora Linux):
1. sudo yum install trilead-ssh2 trilead-ssh2-javadoc
2. sudo ln -s /usr/share/java/trilead-ssh2-213.jar
/usr/share/java/tomcat6/trilead-ssh2.jar
3. Make sure "tomcat" user exists in /etc/passwd, and create an additional
uid=92 gid=92 account "tomcat-ssh-slave":
• tomcat:x:91:91:Apache Tomcat:/usr/share/tomcat6:/bin/sh
° "tomcat" user created as "disabled" by installing tomcat6-6.0.18-6.2.fc10
• tomcat-ssh-slave:x:92:92:User for SSH Subprocesses From
Tomcat:/home/tomcat-ssh-slave:/bin/bash
° create this using fedora admin utility 'system-config-users' or by
hand-editing /etc/passwd...
4. sudo passwd -u tomcat
• unlock tomcat account temporarily
5. sudo passwd tomcat
• set password for tomcat account
6. Login to "tomcat" account using SSH from current account terminal.
7. ssh-keygen -t dsa
• Leave "empty for no passphrase" for decrypting the DSA-key produced by
ssh-keygen, although it can be specified as last parameter for
sshHelper.openSession("localhost", "22", "tomcat-ssh-slave",
"/usr/share/tomcat6/.ssh/id_dsa", "").
8. From the "tomcat" account, run "ssh tomcat-ssh-slave(a)127.0.0.1"
• answer Yes: "Are you sure you want to continue connecting (yes/no)? yes"
• enter password for tomcat-ssh-slave set above via system-config-users.
• exit the connection.
• The purpose of this step is to test the account, and init
/usr/share/tomcat6/.ssh/known_hosts
9. sudo cp /usr/share/tomcat6/.ssh/id_dsa.pub
tomcat-ssh-slave/.ssh/authorized_keys
10. From the "tomcat" account, do "ssh tomcat-ssh-slave(a)127.0.0.1" again
• verify that login happens w/o password prompt, which is what happens when
authorized_keys is set to the
public key of the account accessing SSH.
• exit from tomcat-ssh-slave account. It's now ready to run out of tomcat.
11. passwd -l tomcat
• lock the tomcat account from further logins, now that it's been setup and
the dsa public/private keys have been generated.
1. *TODO:* remove password from user tomcat-ssh-slave ('!!' in passwd field
of /etc/shadow) password not needed for login
2. *TODO:* alternately, is there a local customization to ensure certs only
used for login to the account? I know this can be done globally in
/etc/ssh/sshd_config: "PasswordAuthentication no" and "PermitEmptyPasswords
no"
3. *TODO:* for user tomcat-ssh-slave, integrate "limited command processing"
by replacing /bin/sh as login shell with /usr/local/bin/tomcat-ssh-shell (or
equiv):
#!/bin/sh -noprofile
###############################################################################
#
# File: sshslave-shell
# RCS: $Header: $
# Description: Shell to allow execution of remote commands from a tomcat
server.
# For security purposes, this "login" is limited in commands it can
# perform, and runs as a separate user from the tomcat server, separating
# the ability to directly modify tomcat state from the functionality
provided
# by user tomcat-ssh-slave. This shell is run as the "login shell" (via
# /etc/passwd) for account tomcat-ssh-slave, which is accessed via SSH.
# The account is preferably a nonprivileged user account with pid>500, Home
# directory /home/tomcat-ssh-slave must exist, with correct permisssions.
# /home/tomcat-ssh-slave contains scripts referred to via
fully qualified
# filenames in this script. The directory would also store the accounts'
# .ssh settings, keys, etc. Secure, password-less access to the
tomcat-ssh-slave
# account can be achieved by having tomcat's SSH public identity
/usr/share/tomcat6/.ssh/id_dsa.pub
# installed as /home/tomcat-ssh-slave/.ssh/authorized_keys (and
keeping id_dsa secret)
# This would prevent use of tomcat-ssh-slave "account" from being used by
anything
# other than preauthorized accounts.
#
# Here's some example commands:
#
# ssh -x tomcat-ssh-slave(a)127.0.0.1 cleanlog
# ssh -x tomcat-ssh-slave(a)127.0.0.1 getlog
# ssh -x tomcat-ssh-slave(a)127.0.0.1 setdbglvl 'INFO'
# ssh -x tomcat-ssh-slave(a)127.0.0.1 getdbglvl
# ssh -x tomcat-ssh-slave(a)127.0.0.1 tomcat-restart
# ssh -x tomcat-ssh-slave(a)127.0.0.1 apache-restart
# ssh -x tomcat-ssh-slave(a)127.0.0.1 tomcat-start
# ssh -x tomcat-ssh-slave(a)127.0.0.1 apache-start
# ssh -x tomcat-ssh-slave(a)127.0.0.1 top
# ssh -x tomcat-ssh-slave(a)127.0.0.1 ps
# ssh -x tomcat-ssh-slave(a)127.0.0.1 df
# ssh -x tomcat-ssh-slave(a)127.0.0.1 free
# ssh -x tomcat-ssh-slave(a)127.0.0.1 reboot
# Author: Niels P. Mayer
# Created: Monday 8/10/2009
# Modified:
# Language: Shell-script
# Package: N/A
# Status: Production
#
# (C) Copyright 2009, Niels Mayer, all rights reserved.
#
###############################################################################
# make sure nothing funny goes on
PATH="/bin:/usr/bin"
# make sure they rsh or ssh in with a single command
if [ -z "$1" ] || [ "$1" != "-c" ]
then
echo You must use ssh -c to access this account
exit 1
else
shift
SSHSLAVE_COMMAND="$@"
fi
# only let them run specific commands, eg.
# ssh -x tomcat-ssh-slave(a)127.0.0.1 cleanlog
# ssh -x tomcat-ssh-slave(a)127.0.0.1 getlog
# ssh -x tomcat-ssh-slave(a)127.0.0.1 setdbglvl 'INFO'
# ssh -x tomcat-ssh-slave(a)127.0.0.1 getdbglvl
# ssh -x tomcat-ssh-slave(a)127.0.0.1 tomcat-restart
# ssh -x tomcat-ssh-slave(a)127.0.0.1 apache-restart
# ssh -x tomcat-ssh-slave(a)127.0.0.1 tomcat-start
# ssh -x tomcat-ssh-slave(a)127.0.0.1 apache-start
# ssh -x tomcat-ssh-slave(a)127.0.0.1 top
# ssh -x tomcat-ssh-slave(a)127.0.0.1 ps
# ssh -x tomcat-ssh-slave(a)127.0.0.1 df
# ssh -x tomcat-ssh-slave(a)127.0.0.1 free
# ssh -x tomcat-ssh-slave(a)127.0.0.1 reboot
case ${SSHSLAVE_COMMAND} in
cleanlog \
getlog \
getdbglvl \
tomcat-restart \
apache-restart \
tomcat-start \
apache-start \
top \
ps \
df \
free \
reboot \
) #single argument commands -- exact match to SSHSLAVE_COMMAND
exec "/home/tomcat-ssh-slave/${SSHSLAVE_COMMAND}"
;;
setdbglvl* \ #e.g., setdbglvl 'INFO' ... multiple argument command.
Beware command injection.
)
exec `echo "/home/tomcat-ssh-slave/${SSHSLAVE_COMMAND}" | cut -f1 -d" "`
`echo "${SSHSLAVE_COMMAND}" | cut -f2- -d" "`
;;
* )
exec echo You are not authorized to do that.
;;
esac
Niels
http://nielsmayer.com