Googolflex!!
  • Home
  • About
  • Contracting

Recent Posts

  • Sprint’s new “Simply ‘Almost’ Everything®” Plans
  • CSS Changes in Flex 4
  • Dotted Underline LinkButton (Flex)

About The Author : jwd

This is John Dusbabek's tech blog. John is a software engineer and Flex developer in Provo, UT, where he lives with his lovely wife and four sons.

Recent Comments

  • Nikos on Flex: Binding to an Interface
  • Iain Hosking on Apache mod_proxy_balancer: No Protocol handler was valid

Archive for February, 2010

Feb
09

MySQL Master-Master Replication

Posted by: jwd | Comments (0)

In my opinion, having dual-writable master MySQL databases (in a replication configuration) is not worth the hassle. There are a host of problems, enough that you should seriously consider what you’re trying to gain when attempting it. However, the master-master replication scheme still has some very good uses when used in an active-passive way. The two most compelling reasons for me are:

1. Keeping a “hot spare”. You have an additional database already configured as a master. This might not seem like much, since you “almost” gain the same thing in a master-slave setup. However, if your master-master includes slave servers, this topology provides a very high degree of fault tolerance. Especially when each master-server pair is geographically separated.

2. Making changes to the database. Certain changes made to the database may require a long time to complete, particularly if you have a very large database. In the master-master setup, you can take one of the servers “offline” (by telling the other master not to replicate its changes), and make the changes necessary. Then bring it back online, after the changes have been made, make it the active master, and let the other master perform the changes.

This could be seen as an added benefit of keeping a “hot spare”.

The good news is that setting this up is identical to setting up master-slave replication, you simply do it twice. Each master is essentially the master of and a slave to the other database. To keep it active-passive, one of the databases will need to be made read-only. Here are the changes you will need to the my.cnf configuration file:

Active Master my.cnf

log_bin = mysql-bin
server_id = 1001
relay_log = mysql-relay-bin
log_slave_updates = 1

Passive Master my.cnf

log_bin = mysql-bin
server_id = 1002
relay_log = mysql-relay-bin
log_slave_updates = 1
read_only = 1  # Notice this line

Then set up the replication user accounts, as described in this post: Simple MySQL Master-Slave Replication

Finally you issue the slave directives, and start the slave process:

Active Master ‘change master’

# Active master is slave to passive host
CHANGE MASTER TO MASTER_HOST='passive.mysql.host',
MASTER_USER='rep_user',
MASTER_PASSWORD='reppassword',
MASTER_LOG_FILE='mysql-bin-000001',
MASTER_LOG_POS=0;

start slave;

Passive Master ‘change master’

# Passive master is slave to active host
CHANGE MASTER TO MASTER_HOST='active.mysql.host',
MASTER_USER='rep_user',
MASTER_PASSWORD='reppassword',
MASTER_LOG_FILE='mysql-bin-000001',
MASTER_LOG_POS=0;

start slave;
Categories : Architecture, Databases, MySQL, Scalability
Comments (0)
Feb
09

Flex Socket Connections : Socket Policy File

Posted by: jwd | Comments (0)

Starting with certain versions in the 9.0’s of Flash player, socket communication in Flex began adding additional security measures. The one I am going to discuss in the post is the socket policy file. In short, the socket policy file is an XML file that is served by default from port 843 and contains information regarding which ports on _this_ server that Flash may connect to. Additionally it allows you to specify from which domains you wish to allow connections.


Loading the Policy File From Flex

The policy file can be explicitly requested by making the call:

Security.loadPolicyFile("host.withpolicyfile.com:843");

Or you can trust it will implicitly make the request when you attempt a socket connection. The policy is valid for a particular IP address over the life of the SWF. A policy request consists of the following line, nothing more:

<policy-file-request/>

And the correct response is the policy file, followed by a null byte. My example policy server file will not be so picky about it’s request, use it at your own risk. Adobe has one that actually checks to see if the request was formatted correctly before sending the response. Furthermore, rather than reading in an actual policy file, my example hard codes it into the policy server.


Policy File Format

Here is a sample policy file, it is provided by Adobe. You can make whatever changes you need to, as I did in mine:

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "/xml/dtds/cross-domain-policy.dtd">

<!-- Policy file for xmlsocket://socks.example.com -->
<cross-domain-policy> 

   <!-- This is a master socket policy file -->
   <!-- No other socket policies on the host will be permitted -->
   <site-control permitted-cross-domain-policies="master-only"/>

   <!-- Instead of setting to-ports="*", administrator's can use ranges and commas -->
   <!-- This will allow access to ports 123, 456, 457 and 458 -->
   <!--allow-access-from domain="swf.example.com" to-ports="123,456-458" /-->
   <allow-access-from domain="*" to-ports="80" />
</cross-domain-policy>


Policy File Server

And here is the Perl code that runs the policy server. You can see it is just a basic socket server. Adobe’s version of this (which I based mine off) allows you to pass in the port as well as the path to the policy file. This is a stripped down version of that server, with most of the essentials hard coded.

use Socket;

my $NULLBYTE = pack('c', 0);
my $port = 843;
my $content ='<?xml version="1.0"?>'."\n" .
'<!DOCTYPE cross-domain-policy SYSTEM "/xml/dtds/cross-domain-policy.dtd">'."\n" .
'<cross-domain-policy>' . "\n" .
   '<site-control permitted-cross-domain-policies="master-only"/>'."\n" .
   '<allow-access-from domain="*" to-ports="80" />'."\n" .
'</cross-domain-policy>'."\n";

socket    (LISTENSOCK, PF_INET, SOCK_STREAM, getprotobyname('tcp'))
          or die "socket() error: $!";
setsockopt(LISTENSOCK, SOL_SOCKET, SO_REUSEADDR, pack('l', 1))
          or die "setsockopt() error: $!";
bind      (LISTENSOCK, sockaddr_in($port, INADDR_ANY))
          or die "bind() error: $!";
listen    (LISTENSOCK, SOMAXCONN)
          or die "listen() error: $!";

while ( my $clientAddr = accept(CONNSOCK, LISTENSOCK)) {
    my ($clientPort, $clientIp)= sockaddr_in($clientAddr);
    my $clientIpStr = inet_ntoa($clientIp);

   # Consume the request
    local $/ = $NULLBYTE;
    my $request = <CONNSOCK>;
    chomp $request;

   # Send the policy file
    print CONNSOCK $content;
    print CONNSOCK $NULLBYTE;
    close CONNSOCK;
}
}


Opening A Port

Remember to open port 843 (in Fedora Core) by adding the following line in /etc/sysconfig/iptables :

-A RH-Firewall-1-INPUT -m state --state NEW -m tcp -p tcp --dport 843 -j ACCEPT

Then reload the iptables:

/etc/init.d/iptables restart
Categories : Actionscript, Application Servers, Flex 3, Perl, client/server
Comments (0)
Feb
08

Simple Flex Socket Client

Posted by: jwd | Comments (2)

Client-server programming is one of my passions, and I enjoy doing it in almost any language. Which makes it fitting that Flex (ActionScript) is one of my favorite languages to develop in, because it truly is a client-side technology which pretty much means it’s open to just about any type of backend server. I suppose you could make that argument with just about any language depending on how it’s being used, but since Flex isn’t processed and returned to the browser as HTML, that makes it a little different in my opinion.

Even in Flex, most applications will connect to a backend server that’s running an HTTP service (which queries the database on behalf of Flex), but I’m even going to depart from that in this post. I’m going to be demonstrating how to make socket calls to another service. You could apply this to making HTTP requests on port 80, make requests directly to a MySQL server running on port 3306. In this particular post, I will keep it simple by demonstrating how to make an HTTP request.


Declaring and initializing the Socket

You declare socket like this:

import flash.net.Socket;

private var socket : Socket;

Inside an initialization method, we will add a listener for the CONNECT event, and the SOCKET_DATA event. The CONNECT event alerts us when the connection has been made, and allows us to send our request. The SOCKET_DATA event is triggered whenever there is data waiting to be read from the socket.

socket = new Socket();
socket.addEventListener( Event.CONNECT, onConnect);
socker.addEventListener( ProgressEvent.SOCKET_DATA, onSocketData);

Connecting and Sending Data

At some point you will need to call connect on the socket, which accepts the URL of the server and the port it will be connecting to. In the onConnect() method, you will write the request using one of the writeXXX() methods, and call flush() which actually sends the data over the wire.

socket.connect(txtUrl.text, 80);

private function onConnect(event : Event) : void {
   var requestString : String = getHttp_1_1Request();
   socket.writeUTFBytes(requestString);
   socket.flush();
}

Reading Data

As not all socket data will be available at once, as in most client programs, you will want to read the data in a loop, using one of the readXXX() methods.

private function onSocketData(event : ProgressEvent) : void {
   while (socket.bytesAvailable) {
      txtResponse.text += socket.readUTFBytes(socket.bytesAvailable);
   }
   socket.close();
}

In general you would be checking for the end of the response you’re expecting (based on protocol), to simplify things I simply close the socket after the while loop exits the first time. If you leave the socket open for too long without reading data, I have noticed that I receive the following error, regardless of whether I have the correct policy file including cross-domain.xml:

Error #2044: Unhandled securityError:. filename.swf text=Error #2048: Security sandbox violation cannot load data from the.host.name

In this example, the raw output received from the socket request will be shown in the text box. You can download the complete source to this example here (where you may also view a screencast demo of this procedure).

Depending on what version of the Flash Player you’re running, this example may not run as-is if the server you are connecting to does not implement the policy-file (served from port 843. I will be discussing this in an upcoming post where I delve into a little more advanced socket programming in Flex, including how and where to deploy a master policy file.

Categories : Application Servers, Architecture, Flex 3, Web Services, client/server
Comments (2)
Feb
08

Book Review: Learning Perl

Posted by: jwd | Comments (1)

Perl is one of those languages I probably don’t care if I ever master, but I have to deal with it from time to time both in web applications and in shell scripting, that I wanted to gain a better understanding of it. For that reason I passed up on getting the highly acclaimed “camel book” and got Learning Perl, 5th edition, by Randal L. Schwartz, Tom Phoenix, and brian d foy, which is a slim 328 pages. I also found the subtitle encouraging, “Making Easy Things Easy & Hard Things Possible”– my early experiences with Perl have not been pleasant ones.

I enjoyed the book more than I expected, and have found it equal to the tasks I need to perform with Perl. It reads much like any “beginning” programming book (without all of the ‘what is a computer?’ nonsense you’d find in a Deitel&Deitel beginner book). My depth of experience with PHP helped me to be a little more comfortable with the syntax, and allowed me to ponder some of the trickier concepts a little more deeply. Like the default variable $_… I’m still thinking about that.

The book has a good introduction to modules, and covers both using cpan to install, and installing from source. Both of which I’ve had to do recently. The chapter on Regular Expressions was especially helpful, and probably one of the best short-tutorials on regular expressions I’ve ever read. Someday I’m going to have to read a book about those, maybe I’ll remember it better, but until then brief explanations like these will be my regex life blood.

The book offers exercises at the end of each chapter, in fact the authors claim this book is the product of their curriculum taught over a number of years. I didn’t work through all of them, but I did a few and I found them helpful. They also include possible solutions to each of them. As a student of computer science, I appreciated their preface to each solution “Here’s one way to do it:”.

All things considered, I enjoyed my experience with this book. If your goal is to become a hard core Perl wizard, you might want to go with the camel book. If your intentions for Perl are more casual, then you probably want this book.

Categories : Book Reviews, Perl
Comments (1)
Feb
06

Simple MySQL Master-Slave Replication

Posted by: jwd | Comments (0)

I’ve been doing a lot of research (not cutting edge type stuff) into MySQL scalability, and the first exercise I went through was configuring a simple master-slave replication setup. It was much simpler than I thought it would be. Here are the steps.


Editing the my.cnf Files

Because of the way replication works in MySQL, you will need to turn on binary logging. Essentially, the slave is going to connect to the master and request the log. After it gets the log (or the parts that it needs) it will replay it, executing the queries to bring it up to date. You also need to give the server an ID. So add these lines to the my.cnf (usually /etc/my.cnf) on the master database:

&lt;mysqld&gt;
log_bin = mysql-bin
server_id = 1001

You can give it any ID you want, you just want it to have a different ID than the slave. In the slave we will add a few additional lines, as well:

&lt;mysqld&gt;
log_bin = mysql-bin
server_id = 1002
relay_log = mysql-relay-bin
log_slave_updates = 1
read_only = 1

Note: Replace the angle brackets above with square brackets. I haven’t figured out how to make my code plugin not treat [mysqld] as another code block definition.

According to Schwartz, et al. in High Performance MySQL (review forthcoming), the only parameter required on a slave is the server_id. The other parameters make it easy to switch the server between being a master or a slave. They also mention the read_only parameter is a good safety precaution but might not be applicable in all cases.


User Account Setup

Replication privileges need to be granted to the replication user on the master. If you want to be able to easily switch your server between master or slave, you can grant these privileges on both servers.

GRANT REPLICATION SLAVE
ON *.*
TO 'rep_user'@'10.0.0.%'
IDENTIFIED BY 'reppassword';

There are certain features that are accessible by granting the REPLICATION CLIENT privilege. You can also limit the replication privileges to only certain databases or tables if so desired. Though it is not recommended, you could also grant access to all hosts, just as you might in any other GRANT statement.


Starting the Replication Procedure

Now that both the master and slave are configured, and correct permissions are granted to the replication user, the slave needs to be “started”. This is done by declaring the master host, and indicating necessary credentials and log file information, and then issuing the ’start slave’ command.

The host and credential information can be declared in the my.cnf file. However there are some advantages to making the declarations as MySQL commands. Specifically you will be able to make changes to these without having to restart the daemon. Here is the command you should issue to configure the slave:

CHANGE MASTER TO MASTER_HOST='master.mysql.host',
MASTER_USER='rep_user',
MASTER_PASSWORD='reppassword',
MASTER_LOG_FILE='mysql-bin-000001',
MASTER_LOG_POS=0;

And then you issue the command to start the slave:

start slave

If you were previously using binary logs on the master, and then cloned the server to create the slave, you might have trouble getting replication started without first deleting the binary log from the slave.

Sources
The MySQL documentation
High Performance MySQL, by Baron Schwartz et al.

Categories : Architecture, Databases, MySQL, Scalability
Comments (0)
Feb
04

Apache mod_proxy_balancer Self Registration : Part 3

Posted by: jwd | Comments (0)

I’ll start off by going over the basic high level architecture for my self registration procedure:

There is a register.php script residing on the load balancer, accessible via HTTP.
There is a deregister.php script residing on the load balancer, accessible via HTTP.
There is a register_with_lb.pl script residing on the web server, in /usr/local/bin/.
There is a deregister_with_lb.pl script residing on the web server, in /usr/local/bin/.
There is a MySQL database that stores the current configuration state, on it are two stored procedures register_lb and deregister_lb.


register.php

No changes were made to register.php as described in this post , though I’m considering some alterations to increase its security.


deregister.php

The biggest difference between register.php and deregister.php (aside from their purpose) is where the insert/delete database code is called from and why. When register.php is called by the web server, it will have already inserted information about itself into the database, including its hash. I made the decision that I did not want the load balancer responsible for inserting servers into the database. It would merely check that the requesting server inserted itself, and then regenerate the balancer_members.conf.

In the case of deregister.php I decided I wanted the server making the call to still be in the database so the script could verify the identity before removing it and regeneration the balancer_members. And since the deregistration SQL is contained within a stored procedure, I needed to make some changes to the script (as compared to register.php) regarding the database.

Specifically, the standard mysql library cannot call stored procedures. So I had to convert it to using mysqli, which is a similar, though more OO approach. The portion of the code that regenerates the balancer_members.conf is similar enough that I won’t re-list it here, but I will show how to connect using mysqli, and how to call a stored procedure.

$mysqli = new mysqli($dbhost, $dbuser, $dbpass, $dbname);
if (mysqli_connect_errno()) {
  printf("Connect failed: %s\n", mysqli_connect_error());
}

$query = "SELECT count(*) as count FROM " . $dbtable . " WHERE ip='" . $_SERVER['REMOTE_ADDR'] . "';";
$result = $mysqli->query($query);
$row = $result->fetch_row();
echo $row[0];

if ($row[0] >= 1) {
  $del_query = "call deregister_lb('" . $_SERVER['REMOTE_ADDR'] . "');";
  $del_result = $mysqli->query($del_query);

  //<code for regenerating the conf file removed here>

  echo exec('echo "' . $file . '" > /etc/httpd/conf.d/balancer_members.conf');
  echo exec("sudo /usr/local/bin/reload_httpd");
}

As you can see, I’m using the actual REMOTE_ADDR to determine the validity of the request.


(de)register_lb.sql Stored Procedure

Here is the code for the deregister_lb stored procedure:

DROP PROCEDURE IF EXISTS deregister_lb $$

CREATE PROCEDURE deregister_lb ( ip VARCHAR(100) )
  BEGIN
    DELETE FROM lb2_members
	WHERE ip=_ip;
  END $$

and also for the register_lb stored procedure:

DROP PROCEDURE IF EXISTS register_lb $$
CREATE PROCEDURE register_lb (
  _hostname VARCHAR(100),
  _ip VARCHAR(40),
  _loadfactor INT,
  _hash VARCHAR(100)
  )

  BEGIN
    DECLARE already_exists INT DEFAULT 0;
    SELECT count(*) INTO already_exists FROM lb2_members WHERE hash=_hash;

    IF already_exists=1 THEN
	  UPDATE lb2_members
	  SET hostname=_hostname, ip=_ip, loadfactor=_loadfactor
	  WHERE hash=_hash;
    ELSE
      INSERT INTO lb2_members (ip, hostname, loadfactor, hash)
	  VALUES (_ip, _hostname, _loadfactor, _hash);
    END IF;
  END $$

Note that I’ve omitted the code that changes the delimiter to $$ instead of a semicolon.


register_with_lb.pl

This perl script uses perl DBI for accessing the database. I had to get that installed on my web server since it wasn’t already. Normally you can install perl packages using the cpan command. In which case you would issue the following commands to install DBI and a MySQL driver for it:

cpan DBI
cpan DBD::mysql

If it’s the first time you’ve run cpan, you will need to go through some configuration. It’s pretty much self explanatory, and I just accepted all of the defaults. Everything installed correctly except for the MySQL driver, which I ended up having to install from source. If I had executed the command:

yum install mysql-devel.i386

first, then my cpan install of DBD::mysql might have worked, but I didn’t realize that until installing from source. In case you ever need to install a perl module from source, particularly the DBD::mysql driver, enter these commands (which I think is basically what cpan does):

yum install mysql-devel.i386 #(only requred in this particular instance)
wget http://www.cpan.org/modules/by-module/DBD/DBD-mysql-4.011.tar.gz
gzip -cd DBD-mysql-4.011.tar.gz | tar xf -
cd DBD-mysql-4.011 #(or whatever version you downloaded)
perl Makefile.PL
make

Here is how you connect to the database and call a stored procedure:

my $dsn = "DBI:mysql:host=mysql.host;database=lb_register";
my $dbh = DBI->connect ($dsn, "lbuser", "lbpasswd")
  or die "Cannot connect to MySQL server\n";

my $sql = "call register_lb('" . $localhost . "', '" . $localip . "', " . $loadfactor . ", '" .  $hash . "')";
$dbh->do($sql);

$dbh->disconnect();

After that, register_with_lb.pl opens a socket to the load balancer and makes an HTTP request over the socket. There are probably easier ways to do this, I just happened to have the socket code lying around and was glad to be able to reuse it. Here’s the gist of it, in case you’re interested:

# Parse the URI.
my $url = URI->new("http://load.balancer.com/register/register.php?hash=" . $hash);

# Parse these in from the command line
$host = $url->host;
$port = $url->port;
$resource = $url->path;
$query = $url->query;

# Initialize the socket
$socket = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host, PeerPort => $port,);
unless ($socket) { die "Error connecting to $host" }
$socket->autoflush(1);

# Format the request
my $request = "GET " . $resource . (($query)?"?" . $query : "") . " HTTP/1.1" . $EOL . "Host: " . $host . $EOL . "User-agent: register_script" . $EOR;

# Use send() to make the request, and output the response.
# Not necessary in this example, but informational.
if ( $socket->send($request) ) {
  while ( <$socket> ) { print }
}

# Close the socket
close $socket;

The above code pretty much sums up deregister_from_lb.pl, since no database calls are made, a call is simply made to the deregister script. The line you would change is as follows:

my $url = URI->new("http://my.balancer.com/register/deregister.php");

Then make the files executable, and copy them to be used by the startup script described in the previous post:

chmod a+x register_with_lb.pl
chmod a+x deregister_with_lb.pl
cp register_with_lb.pl /usr/local/bin/
cp deregister_with_lb.pl /usr/local/bin

I don’t show it here, but right now my IP addresses are hard coded. There are a number of ways you can find out your actual IP address from within perl, I’m just not doing that right now.


Securing the register scripts

As an additional security measure, I’ve restricted access to the /register/ location on the load balancer to the IP address range I expect my web servers to be from, like this:

<Location /register>
  Order Deny,Allow
  Deny from all
  Allow from 10.0.0.
</Location>

And now you have a web server that can register automatically (if you’ve gone through the previous two posts as well) with a mod_proxy_balancer load balancer.


Update

I did some searching around to find a way to determine your IP address from inside the perl script. This is a simple way if your server has a public IP address and reverse DNS set up correctly for that IP address:

use Socket;
use Sys::Hostname;
my $host = hostname();
my $addr = inet_ntoa(scalar(gethostbyname($host)) || 'localhost');

If your slave web servers are on a private network, the above command will return the loopback IP address (127.0.0.1) which isn’t useful for the load balancer (I wonder if it would start an infinite loop and crash the load balancer?). I found a function that prints out the IP address by parsing it out from the results of the ifconfig command.

It seemed a little long to just rip off and copy verbatim. So here’s a link to that code (which is what I’m using now) in case you’d like to use it. Perl script to get IP address.

Categories : Apache Web Server, Architecture, MySQL, Perl, Scalability, Shell Scripting, client/server
Comments (0)
Feb
04

Apache mod_proxy_balancer Running Scripts at Startup/Shutdown : Part 2

Posted by: jwd | Comments (0)

I think I have to break the self-registration into two posts, it took a lot longer than I expected last night. This post deals with getting scripts to run at startup and shutdown on Linux. I did this on Fedora, I imagine the process would be similar on Ubuntu, etc.

This is actually the last thing I did, but I’m ordering it first because it’s a bit more general. My goal was to have a script that I could call as follows to register with my load balancer manually:

service lb_register start|stop|status|restart|reload|force-reload

And then also to register this service to be called at startup and shutdown, to register and deregister with the load balancer respectively.

Let’s start with creating the script. You can find tutorials for creating shell scripts just about anywhere on the web. I found it easier to take an existing script from the /etc/init.d/ directory, clear it out and start from that shell. Ironically the one that I chose was the startup script for Pound, another load balancer (a very good one, I might add). It shouldn’t matter which one you use, since all we’re really after is the format. The basic format is essentially the same for all of them: you have your function definitions at the top, and a case statement at the bottom.

The cases match the option parameters (start and stop are very common, as well as the others listed above in the callout). And the case blocks generally call one or more of the functions. I won’t list the case statement in this post as they are all very similar. There are some important things to note in the function definitions, though.

Here is the definition for my start() function:

start() {
   echo -n $&quot;Registering with the load balancer:&quot;
   ./usr/local/bin/register_with_lb.pl
   touch /var/lock/subsys/lb_register
}

You can see that I call a perl script (which presumably registers with the load balancer). Then I touch a file in the /var/lock/subsys/ directory. This is very important if you want a script to automatically run at shutdown. At shutdown the rc script will check for the presence of this file, if it is there it will call stop(). If it is not there, it assumes the service is stopped already and will not call stop() on the service.

My stop function:

stop() {
   echo -n $&quot;Deregistering with the load balancer: &quot;
   ./usr/local/bin/deregister_with_lb.pl
   rm -f /var/lock/subsys/lb_register
}

This calls the deregister perl script, and then removes the lock file for good housekeeping. There is one more thing about the script itself I want to mention before moving on to the registration. There is a line in the comments of most of the scripts (if not all) in /etc/init.d/ that will look something like this:

# chkconfig: - 85 10

or

# chkconfig: 2345 55 15

These are directives to chkconfig (the command we’ll be getting to in a moment) on how to set this script up. The – or the first grouping of numbers deal with the run levels. It tells chkconfig what levels this script will be turned “on”. It is assumed that it will be “off” in the omitted ones.

The second number is a startup priority, different scripts can have different startup priorities in case there are prerequisite dependencies. In the two examples above, the script containing the bottom directive would run before the script containing the bottom one. The last number is the shutdown priority, which is the same thing only during the shutdown process.

Once you have your script, you will need to run the chkconfig command. To add your script to the startup process:

chkconfig --add lb_register

And should you need to remove it:

chkconfig --del lb_register

If you’ve done everything correctly, register_with_lb.pl will be called at startup, and deregister_with_lb.pl will be called at shutdown. If it doesn’t, check that you’re touching the pid file, and that your scripts are executable. You will also be able to make calls like this to deregister and register manually:

service lb_register start
service lb_register restart
service lb_register stop

I should mention a few sites that helped me out quite a bit:
Linux Init Processes
Introduction to BASH Programming
An interesting script for creating new scripts

Categories : Apache Web Server, Shell Scripting, client/server
Comments (0)
Feb
03

Apache mod_proxy_balancer Self Registration : Part 1

Posted by: jwd | Comments (0)

Load balancers are great, but they become even more powerful when servers have the ability to self-register when they come online, and deregister when they go offline. This is especially true with services such as EC2, when the size of the server group might grow or shrink in response to need. This is a tutorial describing my particular (partially insecure at the moment) solution for allowing self-registration with Apache’s mod_proxy_balancer. Specifically this covers the load balancer side of the equation. Tomorrow I hope to get a post out describing the server side.

Here is my flowchart for how self registration will work:
1. Server comes online.
2. A startup script will register itself with the MySQL database (including hostname, ip, loadfactor, and a hash that it will generate in some way).
3. The server will then call a PHP script on the load balancer: “register/register.php”.
4. The PHP script will verify that a server sent the request.
5. The PHP script will query the database to get the current list of balancer members, and regenerate the balancer_members.conf file.
6. The PHP script will then issue a command to reload Apache’s configuration files.

Deregistration, which my PHP script as presented doesn’t display, will work as follows:
1. Server sends its hash to the PHP script, and shuts down.
2. The PHP script will check the hash against the database.
3. The PHP script will remove the server from the database.
4. The PHP script will repeat steps 5 and 6 above.

First, set up the database and created a user with sufficient privileges.

CREATE DATABASE lb_register;
GRANT ALL ON lb_register.* TO 'lbuser'@'%' IDENTIFIED BY 'password';

CREATE TABLE lb2_members(
ip VARCHAR(20) NOT NULL PRIMARY KEY,
hostname VARCHAR(100) NOT NULL,
loadfactor INT NOT NULL DEFAULT 0,
hash VARCHAR(40) );

Second, create the PHP script.

$dbhost = "mysql.host.com";
$dbuser = "lbuser";
$dbpass = "password";
$dbname = "lb_register";
$dbtable = "lb2_members";

$conn = mysql_connect($dbhost, $dbuser, $dbpass) or die (mysql_error());
mysql_select_db($dbname);

$query = "SELECT count(*) as count FROM " . $dbtable . " WHERE hash='" . $_GET['hash'] . "';";
$result = mysql_query($query);

$row = mysql_fetch_assoc(mysql_query($query));
if ($row['count'] >= 1) {

  $file = "<Proxy balancer://mycluster>" . "\n";
  $member_query = "SELECT hostname, loadfactor FROM " . $dbtable . ";";
  $member_result = mysql_query($member_query);

  while ($row = mysql_fetch_array($member_result, MYSQL_BOTH)) {
    $file .= "   BalancerMember http://" . $row['hostname'] . " ";
    $file .= ($row['loadfactor'] > 1) ? ("loadfactor=" . $row['loadfactor'] . "\n") : "\n";
  }
  $file .= "</Proxy>";

  exec('echo "' . $file . '" > /etc/httpd/conf.d/balancer_members.conf');
  exec("sudo /usr/local/bin/reload_httpd");
}

mysql_close($conn);

You can tell a few things about the server configuration by looking at the script:
1. User apache will need to be able to write to the “/etc/httpd/conf.d/balancer_members.conf” file.
2. User apache will need to be able to execute the script “/usr/local/bin/reload_httpd”.
3. User apache will need sudoer rights.
4. This script was used for debugging, and not by a server that is actually registering… tyou can see that deregistration is not handled yet.

To grant write privileges to apache, I changed the owner of the balancer_members.conf to apache.

 chown apache /etc/httpd/conf.d/balancer_members.conf

This is probably the least secure aspect of my solution, as if the apache user were compromised, then any directives could be written to this file. I’m not sure how big a threat this is, but it’s something that concerns me at least enough to think about this some more (and invite suggestions).

Next is to grant apache privileges to execute “/usr/local/bin/reload_httpd”. We could accomplish this the same as we did above, but then it wouldn’t allow apache to execute what’s inside of the script, which is this:

#!/bin/bash
service httpd reload

unless we give execution rights to apache on service, which we don’t want. What we also don’t want is for apache to be able to write to the file reload_httpd. So what I ended up doing was, as you see in the script, to make root the owner of reload_httpd and remove write privileges for all (so apache couldn’t change it) and then add apache to the sudoers file, granting rights to execute this script without a password.

visudo

is the generally accepted way to edit the sudoers file. And I added this line:

apache ALL=(ALL) NOPASSWD: /usr/local/bin/reload_httpd

I’m open to more secure ways of implementing this aspect as well, as I don’t consider myself a sudo configuration expert. I think this gives apache rights to execute everything from anywhere if he knows the password; but he can also execute the /usr/local/bin/reload_httpd script without a password.

I also had to comment out the line:

#Defaults   requiretty

to allow sudo to function properly from a script not executed in a terminal.

Finally I had to disable proxying for the register script in my balancer.conf file:

ProxyPass /register/ !

And then your server is configured to dynamically update its list of balance members, you can check by going to the balancer-manager if you’ve got that enabled. Next I will discuss how to handle the web server side of things.

Categories : Amazon Web Services, Apache Web Server, Architecture, EC2, Linux, MySQL, Scalability, client/server
Comments (0)
Feb
02

Apache mod_proxy_balancer: No Protocol handler was valid

Posted by: jwd | Comments (1)

Just this afternoon, one of my colleagues and I were discussing our feelings about the “semicolon-class” of bugs that developers will inevitably spin their wheels on from time to time. I’ve had just such an experience the past two evenings with what started out as a simple recipe from the Apache Cookbook, entitled “Load Balancing with mod_proxy_balancer”.

The recipe itself is straightforward, taking up just over a page. I was able to get a basic load balancer working within a few minutes by following the recipe, but for some reason I couldn’t get the balancer-manager site to load correctly. The following directives should configure the balancer-manager:

<Location /balancer-manager>
  SetHandler balancer-manager
  Order Deny,Allow
  Allow from all
</Location>

When I would start the server, however, I got an HTTP 500 error response, with this message in the log:

[Tue Feb 02 12:49:09 2010] [warn] proxy: No protocol handler was valid for the URL /balancer-manager. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.

My searches on Google were fruitless: most people were able to solve the problem by ensuring these lines were added to their httpd.conf:

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so

But they were already included in my conf file, so no dice. Other people solved their problem by loading the mod_proxy_html.so, which doesn’t come on a standard install of Apache. I ended up compiling it from source (learned a lot about compiling Apache shared modules) but that didn’t work for me either.

Eventually I realized that the only time my requests were being proxied to the BalancerMembers was when I was at the URL root, for example tacking on an ‘index.php’ to the URL would generate the same error as trying to access ‘balancer-manager’. And about that time I stumbled upon a user who was able to solve their problem by adding a few rewrite rules… which caused me to finally understand part of my problem.

The reason ‘balancer-manager’ wasn’t loading correctly was because that request was being proxied to the BalancerMember, which didn’t have ‘balancer-manager’ enabled (hence the ‘no protocol handler error’). This still didn’t explain why ‘index.php’ wasn’t working, either, since I knew index.php was on the BalancerMembers.

These discoveries quickly culminated into leading me to my solution, which was a missing trailing-slash in my ProxyPass directive. That’s what was causing my ‘index.php’ to not be proxied. Once I realized the problem was in my ProxyPass– reading the documentation also taught me that there’s a way to keep certain requests from being proxied (which solved my ‘balancer-manager’ issue).

So I present to you, my completed (and functional) balancer.conf. And remember, the trailing slash at the end of the ProxyPass directive IS CRUCIAL!

ProxyPass /balancer-manager !  # Prevents balancer-manager from being proxied.
ProxyPass / balancer://mycluster/
ProxyPassReverse / balancer://mycluster/

<Proxy balancer://mycluster>
  BalancerMember http://10.0.0.10 loadfactor=2
  BalancerMember http://10.0.0.11
  BalancerMember http://10.0.0.12
</Proxy>

<Location /balancer-manager>
  SetHandler balancer-manager
  Order Allow,Deny
  Allow from all
</Location>

I hope this saves someone some time when searching on the particular error message I got. Now I’m off to figure out how to get my web servers to auto register with the balancer-manager. I will blog about it when I figure it out.

Categories : Apache Web Server, Architecture, HTTP Servers, Scalability, client/server
Comments (1)
Feb
02

Some Thoughts on Adobe Catalyst

Posted by: jwd | Comments (5)

I attended a user group presentation on Adobe Catalyst today (2/2/2010), and I thought I’d express some of the thoughts I had, and on code generation in general.

This product seems to spark up a lot of debate, and I think it’s because most conversations are only focusing on two roles (designer vs developer) when there are actually three roles that need to be considered. Those are designer, developer, and (man I hate using this term, but haven’t got a better one) interaction designer. And this is such a touchy area because (putting the science of interaction design aside) in terms of implementation this is where designer and developer overlap.

So there is some overlapping interests in terms of how the application behaves, and there’s only one tool– Catalyst. So who gets to use it? Wrong!! Most hard core developers I know who have tried Catalyst swear they will steer clear of it. Our preferred interaction design implementation tool is the same one we use for developing the rest of our software. In my case that would be Flex Builder. In the designer’s case, it will probably be Catalyst (maybe?).

So if it was so cut and dry, only one tool for this overlapping area, both developer and designer could learn to use Catalyst and get along. I don’t think that’s likely to happen anytime soon. So now the problem becomes one of getting Catalyst and Flex Builder to work nicely together. And I’ve only used Catalyst a little bit, and from what others have told me, making changes in Catalyst and importing them into Flex Builder seems to be pretty smooth. What I haven’t seen is how it goes the other way. If I make changes in Flex Builder, and the artist needs to make some changes in Catalyst– does that work as well?

I don’t know to tell the truth, but until I see how this interaction is going to work out, the jury is still out on whether this overlap of responsibilities is going to work out. I suppose if it were able to compartmentalize all of the Catalyst generated fluff where I could just “use” it and not have to work in it, I think I might be able to live with that. I haven’t seen how this is going to work either, though.

Like I said, I just wanted to get some thoughts out there, and we’ll see how this continues to play out in the coming months. It may be that it ends up being too expensive for my employer to use, in which case it will be business as usual.

Update
Sean Murphy sent me this link that I know my fellow developers will get a kick out of. Warning: If you’re a designer or a print publisher, you’ll probably be wondering, “What was so funny about that?”

Catalyst question in Adobe Forums

Anyway, I’d be very interested in taking a look at his site, I hope he’ll post a link to it. More than anything to see what kinds of projects can be accomplished by Catalyst all by itself in the hands of an experienced artist.

Categories : Catalyst
Comments (5)
Next Page »

Search

Feedburner

Subscribe to

Get the latest updates delivered via email

Calendar

February 2010
M T W T F S S
« Jan   May »
1234567
891011121314
15161718192021
22232425262728

Archives

  • July 2010 (1)
  • June 2010 (2)
  • May 2010 (1)
  • February 2010 (11)
  • January 2010 (3)
  • December 2009 (5)
  • November 2009 (1)
  • August 2009 (8)
  • July 2009 (8)
  • May 2009 (4)
  • April 2009 (1)
  • March 2009 (6)
  • January 2009 (1)
  • November 2008 (4)
  • October 2008 (5)
  • September 2008 (1)
  • August 2008 (5)
  • July 2008 (1)
  • June 2008 (2)
  • May 2008 (8)
  • April 2008 (5)
  • March 2008 (2)
  • February 2008 (3)
  • January 2008 (1)
  • December 2007 (6)
  • November 2007 (9)
  • October 2007 (1)
  • September 2007 (2)

Categories

Tag Cloud

adobe apache Architecture book review C++ centos client server architecture Custom Components database Design error message fedora flash catalyst flex Flex 3 Flex 4 fms iis 6 Interaction Design load balancing master-master master-slave mod_proxy_balancer Monkey Patching MySQL no protocol p2p peer to peer Perl PHP Red5 regex replication self registration selinux Shell Scripting shortcut manager skins socket policy file sockets states stored procedures stratus tools workflow

Coworkers

  • Casey Jackman
  • Sean Murphy

Family

  • Emily & CJ
  • Family Blog
  • Gary Dusbabek

Meta

  • Log in
  • Entries RSS
  • Comments RSS
  • WordPress.org

RSS FlexExamples

  • Styling the text selection format on a Spark TextArea control in Flex 4
  • Setting the scale mode on a Spark Image control in Flex Hero
  • Setting the fill mode on a Spark Image control in Flex Hero
  • Setting a bitmap image fill on a Spark Form container in Flex Hero
  • Setting a bitmap image fill on a Spark FormHeading control in Flex Hero

Spam Blocked

847 spam comments
blocked by
Akismet

Sponsored Links

JUICE Chat

BYU Adobe Users Group


Copyright © 2010 All Rights Reserved
Flexx Theme by iThemes
Powered by WordPress