In my attempt to host pictures on my websites, I tried out multiple things. From evaluating different products (CMFPhotoAlbum, CMFPhoto, ATPhoto) to installing add-on components to modifying source code. I learnt a lot of things during those two days (nights)  when I was trying to get it working. I initially thought about just posting a note here, but then I thought I won't do justice to the entire content and let my thoughts trail off here. So now I have decided to write up an article on my experiences and learning so that someone else can benefit from it and not waste so much time in doing the same thing.

In a nutshell, the lessons I learnt are:

1. Plone can handle photos natively since v 2.1. Just change the view from standard to thumbnail.
   
2. You need PIL / JPEG support installed on your linux computer / python compilation for it work
3. There is bug in the ArcheTypes product in the way plone renders the image using the image_view or atct_album_image viewing method. More on that later.
4. If you are stuck anywhere, ask the experts. Open source community is so much helpful and forthcoming, it would be a waste not to ask for help.
   

Firefox was known to use up more memory than IE, especially if you opened a lot of tabs at the same time. But suddenly it now acting as a memory hog (at least on my computer) with the memory utilization going as high as 260MB with just 4 tabs open and funny thing is it does not go down if I close all but one tab. It acts like a runaway process and keeps on eating up memory and CPU till the time it becomes unusable. I then have to close the window and open a new session for my PC to be usable again.

Is this a vulnerability in Firefox that could be exploited I know not. I am not an expert in reading code and finding out bugs, but I know enough to identify a problem when I see one. I intend to submit this to the maintainers of Firefox after I do a little bit more research to ascertain that it is not a problem with my computer.

In the end, I think it was just too easy. I searched over the internet on ways to prevent comment spam. Some of the ways I came across were:

1. Change the label of the link from "Comments" to something else. From what I understand, spambots look for specific words and go in and dump spam. The changed label should be inituitive enough to let human readers understand that it is the link to leave comments but hard enough for the bot not to understand.
2. Employ Turing test to defeat the bots. Turing test is used on many websites nowadays to distinguish man from machine. But the latest advances in technology can also defeat this approach with OCR technology embedded in it. So can a person determined enough to hire cheap labour to dump spam.
3. Do not allow unmoderated comments. Moderate the comments so that the comments do not appear on the website / weblog without your approval. I found a link to this article when I searched for ways to moderate comments. The technique described in the article applies to CoreBlog running on Plone or Zope, but can be extended to almost any software. In fact most of the weblogging sites give options to moderate comments.

In the end, I chose the third option. For the first two, I would have needed to hack and program and spend a lot of time and effort, which I don't have to spare. The third one was quite easy and I could do it within 15-20 minutes while reading the article itself. To moderate the comments in Coreblog2 running on Plone and / or Zope the workflow needs to be modified. Coreblog2 inherits the default workflow from Plone / Zope which allows unmoderated comments to be displayed on the website.

The details of the steps are given in the article so I won't repeat the same here.

Don't you just hate it when you break something when trying to carry out some maintenance or clean-up. Two days back I shot myself in the foot and didn't even realise it till today when I came to post on my weblog after six days.

As I have mentioned earlier, I was under attack by Spambots who posting comments with links to porn sites on my weblog. I thought I had taken care of that. But some smart guy outfoxed me by putting a trackback to my website. When I went to delete it, I inadvertently deleted the entire comments folder (place holder) in my weblog (CoreBlog2.0.8b running on Plone 2.5.1). When I posted a new blog entry earlier today, I found out that I could save the entry but it would give me an error that related comments. The error looked like:

Exception Type
KeyError
Exception Value
'comments' 

I am not a programming guy and I tried very hard to read the code all over the place to understand and find out if I had deleted some key file. I even compared it with my other website and did not find anything wrong there. I spent almost 3 hours trying to find out what was wrong. I even though about raising a ticket with the CoreBlog team and re-installing the CoreBlog software. But that would have been done later today when I reached home. Till that time, my website would be partially inaccessible and I didn't like the sound of it.

So when I again compared my working website and this one, I focused my attention to the weblog object inside the Plone website. I noticed that the comments object is missing from there. I knew that it was a folder, but whenever I tried to add from the ZMI, all I could do was add a weblog entry with the name comments. Although that was fixing the website, it was not the optimum solution that I was looking for. Next thing I did was to check the Portal Types section and saw that the only allowed object type under Coreblog was a new CoreBlog Entry. I added CoreBlogCommentFolder as an allowed type and then came back to the weblog on Plone (it does not work through ZMI though) and added a CoreBlogCommentFolder.

This has fixed my problem and brought my website back up till the time I break it again.

How easy it is to lose focus of the end objective once you hit a problem? Very very easy if you ask me. As I had posting in my articles over in the Linux category on my attempts to get wireless working on first Ubuntu Desktop and then Fedora Core, I suddenly realised the getting the wireless to work is not what I want. I wanted to test Ubuntu and check it's feasibility in running webserver and support for my current website.

Once I realised that, I stopped my efforts to make wireless work and concentrated on the task at hand. That is to get Ubuntu to run Zope and Plone on my hardware (Dell Latitude D400). Well, Ubuntu desktop was no problem, The installation and setup ran like a charm and the OS was up and running in no time. But I faced major hurdles in getting the Ubuntu Server running. As I have mentioned earlier, the server won't boot up on my laptop and when I tried it using VMWare, it booted up, but the X server was not starting at all. I checked everything I knew and finally gave up.

The Fedora Project has released it's latest offering Fedora Core 6 (FC6) on 24th October. I downloaded it and instead of upgrading my FC4 to FC5, I decided it would be worth my while to upgrade it directly to FC6. Well the installation was easy if lengthy, but a different set of challenges awaited me.

More on that later.

The Fedora project released their newest offering of the linux operating system last week. Roughly 7 months after their last release of Fedora Core 5 which is phenomenal as compared to "You Know Who". The cumulative upgrade is also good apart from the eye-candy changes with respect to the content  and applications included in the OS package. The newer kernel is XEN enabled by default. I understand that XEN was included in Fedora from its Core 3 release, but I never really paid attention to it.

This time it caught my attention during installation with the application support & inclusion to XEN virtualisation. It caught more than my eye when the computer refused to boot up. FC6 uses a PAE (Physical Address Extension) enabled kernel (version 2.6.18-1.2798) and somehow it fails to identify the limitation of the CPU that it is being installed on if the CPU does not have PAE. On booting, the kernel went in to panic with the following message

KERNEL PANIC: Cannot execute a PAE-enabled kernel on a PAE-less CPU!

I tried really hard to recover from this. Even reinstallting the OS and going into GRuB command line to try and load another kernel. But it failed. I could install FC5 and then upgrade to FC6 from there without any issues. The FC5 and earlier versions do not enable PAE. I am yet to check out how FC5 would behave if I put in the same PAE enabled kernel on it. Probably it would faile too.

Anyway, I did not like the idea of giving up on solving this and upgrading from FC5 to FC6. Because, if this is a kernel issue, then I would definitely face this issue sooner of later when I upgraded my kernel so I got books from the library and search on the internet for whatever I could for the kernel and the bug (?) that was troubling me. On searching exhaustively with no results, I finally found something which I felt would work. I knew that I had to set a kernel option. But which one and what?

I found one list on XEN which talked about the same issue that I was facing and it noted that a workaround to the problem I was facing was to use

swiotlb=force

as a kernel parameter when booting. Although it talks about DomU, I was ready to try it on my computer. So I started the installation in rescue mode and at the kernel prompt, I gave this as a kernel parameter and the kernel did not panic. The FC6 went through first boot steps and got me to configure everything and then promptly hung.

It took a reboot to get the computer back on track and start working smoothly. After that it has been working quite nicely and I have done some testing on it that I will post here.

I will also post a detailed installation write-up here in the Technology section.

My website runs on Zope + Plone / Apache / Fedora core 4. I am in the process of upgrading the OS to FC6 from FC4. As I have mentioned in my article in the Linux / Technology section, FC6 comes with Zope and Plone included. Till FC5 you had to download Zope and Plone and install and configure it. I had incorrectly mentioned in my earlier article that Zope takes the native root user and password for management. It is not so. You have to create a user account even before you start Zope for the first time. Zope starts without any problems if you try to start it before creating an account. However when you open the browser and go to the Zope page (http://localhost:8080) Zope tells you that you have not created any users and you must create one in order to manage the site. To create an account to manage zope run the following commands from the command shell from root login or su.

#cd /var/lib/zope/bin
#./zopectl adduser <username> <password>

Once the user account is created, you can start the zope instance from the same place with the following command.

#./zopectl start

In the previous versions and combinations, I had tried to make the zope as a service and start at the time Linux started. Since I am not a Linux expert, I could not do it at that time easily without writing a script. This time Zope is tightly integrated with the OS and it is included in the Service Manager (System --> Administration --> Server Settings --> Services) as a service. You can either start zope from there. You can also check the box next to zope so that it starts up every time I reboot my box.

Once you create the user and can get to the management screen, you can add a Plone site and you are on your way to create a great website.

I finished upgrading my web server to better hardware and latest OS and web server just yesterday. Installation of FC6 was seamless once I found out that I could not run XEN on my computer because of CPU limitations. My CPU does not have PAE on which XEN requires to operate. So finally I figured out that not installing virt-manager solves my problem by installing a non-XEN kernel (Duh!!). So once that problem was out of the way, I moved on to the next task of migrating my web server to the new box.

Migrating a Plone website from one box to another is very well documented. However, there are some things to watch out for which I will post here shortly. After a lot of research and trouble-shooting, I finally managed to get the Zope and Plone working on my box. Since Apache is much more secure, robust and modular in management, I use Apache server as a front-end to my website and use URL re-writing to have Apache forward those to Zope.

Last week I moved my website to the new box and copied the re-write configuration from the old httpd.conf file to the new one and switched off the old one. I did not test Apache functionality trusting that it would work in the new setup, if it worked in the old setup. On trying to access the URL, the browser refused to serve the page instantly throwing up a Error 503 on the screen. At first I thought, it was the new Apache server which did not understand the re-write commands from older (2.0.54) version and tried to find out what had changed. I checked forums, website and even Apache release and change notes, but could not find anything that could possibly solve my problem. I worked for around 4 hours on a wild goose chase and then gave up. As the site traffic had also returned to normal, the urgency to upgrade was also not there till yesterday when my son kept on switching off the box as it was accessible to him.

So I started my work again yesterday; this time on a fresh FC6 installation inside a VMWare and worked through the Virtual Hosting Monster and re-write tutorial from the Zope book just to make sure, I was doing everything correctly. The VHM was working correctly, but as soon as switched on Apache URL re-write I started getting the same errors. So it was not my configuration file or version issue with Apache. I again searched for the same and this time I was a bit more successful. One of the forums posts mentioned something about the permissions being correct and it lit a light in my head and I knew the problem was not with Apache but with permissions issue. I checked my error log (which I admit I should have done earlier, but since I am not really "expert" in Linux, I didn't do it. Partly because I never thought of it and mostly because I didn't know the location. Anyway.) and found the following entries in the error_log.

[Tue Nov 14 16:03:53 2006] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Tue Nov 14 16:04:20 2006] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Tue Nov 14 16:22:17 2006] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Tue Nov 14 16:26:44 2006] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Tue Nov 14 16:26:47 2006] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Tue Nov 14 16:28:08 2006] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Tue Nov 14 16:28:12 2006] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Tue Nov 14 16:45:43 2006] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Tue Nov 14 16:47:14 2006] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed
[Tue Nov 14 16:47:17 2006] [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:8080 (*) failed

I checked the permissions on all the folder and didn't find anything that would have caused any problems. Suddenly a thought came to my mind to check the security level issue as I had faced issues with security level (firewall) in the past. The only difference this time being, I disable Linux firewall as I have hardware firewall. So I opened up the Security Configuration screen and started reviewing the SELinux policy settings. As I have already mentioned I am not an expert in Linux, I started experimenting with the SELinux policy for HTTPD Service by enabling one setting at a time and checked if Apache URL re-writing worked or not. The second option I chose to "Allow HTTPD scripts and modules to connect to the network" did the trick and the re-writing started flowing correctly.

I made the similar change in my production web server and happily it started working and I was able to move the website to the new server and switch off the old one. Because I am not an expert in Linux and these things are not documented anywhere, I thought I would add my two cents to the documentation and make Linux a better OS and usable to non-techie guys like me. Now that SELinux is an integral part of Linux (at the Fedora and Ubuntu flavours) I am sure many more people will face this same issue. I hope this will help them to save time and effort that I had to spend to get this issue resolved. If there is a better way of doing this out there, please direct me to it so that I can update my piece and knowledge.