Monday, January 18, 2010

Securing Bugzilla public domain HowTos?

Info is under modification

Bugzilla with Windows IIS HowTos?

Lets go on with following steps for the same:

* N.B. This is based on Windows Enterprise Server 2003 R2 , IIS, Bugzilla-3.2 Release Notes: Active Perl 5.8.8 build 822, MySQL Server 5.1 and Bugzilla 3.2 stable.

** The same procedure can be followed for Bugzilla 3.4.5 with Windows Server 2008 also. { If you've any issues on windows 2008 then please drop your comments here or into the bugzilla mailing lists. }


1. Make sure the Windows server is installed with IIS. [Please confirm it under Add/Remove Windows Components -> Application Server -> IIS -> WWWeb(must), SMTP, IIS Services Manager(must) are enabled, and available]

2. Copy/Extract the required bugzilla stable (in this case bugzilla-3.2) to the C:\Inetpub\wwwroot. [in this case C:\Inetpub\wwwroot\bugzilla-3.2].

3. ActivePerl as per the minimum requirements of Bugzilla releases that you are interested. [in this case we've ActivePerl V5.8.8 build 822]. During installing if it prompts for CGI - IIS integration please accept those settings. After installation is over please update the path of perl's bin directory manually in Environment Variable section or Windows Server's Advance properties pages if this path is not updated with the ActivePerl installer.

3-1. start -> run -> inetmgr OR start -> programs -> Administrative Tools -> IIS Manager
3-2. IISSERVER (local computer) -> Web Service Extensions ->
3-2-1. You'll see All Unknown CGI Extensions, All Unknown ISAPI Extensions,
Perl CGI Extension, Perl ISAPI Extention, PerlEx ISAPI Extension
3-2-2. Add another web service extension namely Perl scripts (if not exists)
Verify these properties will show as follows:
File Name Status
------------------------------ --------
# Perl CGI Extension: C:\Perl\bin\perl.exe "%s" %s Allowed
# Perl ISAPI Extention: C:\Perl\bin\perlis.dll Allowed
# Perl script: C:\Perl\bin\perl.exe Allowed
# PerlEx ISAPI Extension: C:\Perl\bin\perlEx30.dll Allowed

If any above settings are not ok, please rectify those as mentioned above.

4. Install MySQL Server (with gui tools if possible) in the windows server machine or in the some remote machine (may be windows or linux) as per the minimum requirements of Bugzilla releases you are using.

5. For testing connectivity with the MySQL server from the Windows Server please install the MySQL client in Windows Server machine. This is optional not a must but will be help full for
debugging. Please make sure about mysql root user/password if not created/remembered please
reset it as per the MySQL administration.

6. login as root to your mysql server command prompt to create a login/user account from your localhost(127.0.0.1) or remotehost(let 192.168.1.100 this is the windows server ip, and remote mysql server ip = 192.168.1.120, so to MySQL server 192.168.1.100 is remotehost, from where bugzilla will connect to the database - say 'bug_db_name' in this case) as follows: {Bugzilla will use this account for future transactions}

mysql>
GRANT ALL ON bug_db_name.* FROM 'bug_user'@'localhost' IDENTIFIED BY 'passwordB';
or
GRANT ALL ON bug_db_name.* FROM 'bug_user'@'192.168.1.100' IDENTIFIED BY 'passwordB';

FLUSH PRIVILEGES;
EXIT;

7. Now verify if the mysql user login (i.e. bug_user/passwordB) is working fine as follows:
c:\>mysql -u bug_user -p
passwordB
mysql> getting mysql prompt seems user-login is created successfully.

exit;

8. Now change your current directory to "C:\Inetpub\wwwroot\bugzilla-3.2" and execute checksetup.pl as follows:

C:\Inetpub\wwwroot\bugzilla-3.2> perl checksetup.pl

if it will prompt for any REQUIRED perl modules to install then please install those as per the checksetup.pl screen output. {ppm install Email::Send / CGI / etc.}
Make sure to install the MySQL perl module i.e. mysql driver for perl as per bugzilla release notes.

On, completion of required modules installation it will try to connect to the database, but will fail and prompt for verify the mysql user, database, password.

Edit the localconfig file with Notepad text editor and modify the settings as per our requirement:
$webservergroup = '';
$db_driver = 'mysql';
$db_host = '192.168.1.120' or '127.0.0.1' or 'localhost';
$db_name = 'bug_db_name';
$db_user = 'bug_user';
$db_pass = 'passwordB';

9. Now rerun the checksetup.pl again it will create the database into the MySQL server on successful settings and connectivity.

C:\Inetpub\wwwroot\bugzilla-3.2> perl checksetup.pl

10. If database creation will successful it will asks for administrator e-mail and password etc .
Please enter and remember these settings for future.


11. Open the IIS Services Manager Window:

R-Click on Web Sites -> New Web Site -> Next -> OurBugzillaSite ->
Select All Unssigned or 192.168.1.100 ip for this Web site:
80 as port. [ If you want to access bugzilla through other port please mentioned here]

N.B. If it will be accessed on port 80 make sure other web sites (Default Web Site) should not use the same port.

Next -> Path (Browse to C:\Inetpub\wwwroot\bugzilla-3.2)
Next -> Enable Read, Execute(such as ISAPI application CGI)
Next -> Finished

12. For more settings R-Click-Properties on OurBugzillaSite and make sure about following settings:

Home Directory TAB:
Local Path = C:\Inetpub\wwwroot\bugzilla-3.2
Read is enabled
Execute permissions: Scripts and Executables
Application pool: default at this moment( actually we will use our custom pool)
Click on Configuration... button -> Add
Executable: C:\Perl\bin\perl.exe -x"C:\Inetpub\wwwroot\bugzilla-3.2" -wT "%s" %s
Extension: .cgi [If this extension is exists, then modified as per this section]
Verbs: All Verbs
Script engine enabled
Verify that file exists
Press OK.
Documents TAB:
Enable default content page - enabled
Add index.cgi
Press OK

13. For more security settings for application pool R-Click on
Application Pool -> New -> Application Pool
create a new pool as 'ourbugzillapool'
R-Click on 'ourbugzillapool'
Play with its Predefied identity to Network Service/Local Service/Local System
In case of bugzilla browsing issues.

Please make sure to update the bugzilla web site's application pool to
'ourbugzillapool'

14. Finally restart IIS service for bugzilla and browse from localhost(the windows server)

15. Try then from remote system and modify the bugzilla Parameters and rest of the settings as per your requirement.

Thats all folks
Himadri Sekhar Das
Kolkata / India
das.himuinkol@gmail.com

Friday, April 17, 2009

Multiple Bugzilla databases with a single installation

Dear All, Let me drop some comments in connection with my findings about Single Bugzilla but Multiple Databases

The Bugzilla guide is not wrong at all as mentioned previously. VirtualHost with Directory directive will work fine as these are related to Apache(2) web-server only. So Apache(2) and Bugzilla both need to be configure for the same. No Alias is needed at all or there is no need to make a soft link[e.g. ln -s xyz bugzilla] to the alreadey installed 'bugzilla' directory. Yes believe it first and then lets goon.

The bugzilla can be installed and configured later in two ways as follows:
1) Single Bugzilla with Multiple Databases
2) Multiple Bugzilla with Multiple Databases (in a single server) [There may be some other successful combinations]

Lets grab it in a little bit details:
Prerequisites :
There must be/exist a successful installation of bugzilla with MySQL, perl and Apache2-cgi [ GNU/Linux System, but windows system may also works in similar way - with IIS/Apache etc.], Perl etc. etc.

1) How to configure Single Bugzilla instance with Multiple Databases: {GNU/Linux} [Login into your Bugzilla Server using ssh/putty/shell as 'root'
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
A ) Make your web server ready:
- Let assume your old bugzilla database instance is accessible as [URL] http://bugzilla1.com [Local DNS server was configured in such way, if not assume it as http://192.168.1.11 instead http://bugzilla1.com]

- We are going to set up VirtualHost in Apache2 [ the old and new both URL but single instance of bugzilla]

- Let our new bugzilla [single instance] database will be accessible as http://bugzilla2.com

- So lets configure the Apache2 now
- check if the virtual.conf file is exists or not into the path /etc/apache2/conf.d [ if exists rename it by 'mv virtual.conf backup.virtual.conf' command else create new one and keep only following: NameVirtualHost * into this file and save and exit]
- go to the path /etc/apache2/sites-available and create two new file as bugzilla1.com, bugzilla2.com and enter the following 'VirtualHost' entries into the files


&ltVirtualHost *&gt
ServerName bugzillaN.com #[ N should be substitute by 1 and 2 as per this description, i.e. your bugzilla server's instance URL ]
SetEnv PROJECT bugzillaN
ServerAdmin your-email-id #[ the web server admin's email-id]
DocumentRoot "/.../bugzilla-3.2" #[ your only bugzilla installation/extraction path, this should be same for both file bugzilla1.com and bugzilla2.com for single instace of bugzilla]
AddHandler cgi-script cgi

&ltDirectory /&gt
Options FollowSymLinks
AllowOverride None
< /Directory >

&ltDirectory "/.../bugzilla-3.2" &gt #[ "/.../buhzilla-3.2" will be your bugzilla extracted directory i.e. the DocumentRoot from where the index.cgi page will be served]
Options FollowSymLinks MultiViews ExecCGI
AllowOverride All
Order allow,deny
allow from all
< /Directory >

ErrorLog /var/log/apache2/bugzillaN-error.log
LogLevel warn
CustomLog /var/log/apache2/bugzillaN-access.log combined
< / VirtualHost >

- Save the files and exit
- Now to enable these two site execute following command a2ensite bugzillaN.apt [ if you get no error your almost done]
- Now reload the apache2 daemon by following command /etc/init.c/apache2 reload [if no error, Congrats your web server is ready to listen request for http://bugzilla1.com [ with PROJECT=bugzilla1] and for http://bugzilla2.com [ with PROJECT=bugzilla2], apache will forward these environment variable to the bugzilla script index.cgi and rest will be handled by bugzilla instance.
-----------------------------------------------------------------------------------------------

B ) Make your bugzilla instance ready:
- go into the bugzilla installation/extracted directory [ assume it is /tmp/buhzilla-3.2, by cd /tmp/buhzilla-3.2 ]

- export the bugzilla1 environment variables [ by # export PROJECT=bugzilla1]
- execute the checksetup.pl script by command ./checksetup.pl or pl checksetup.pl
- the checksetup.pl will create localconfig.bugzill1 [bugzilla database configuration file for http://bugzilla1.com]
- edit this file and set db_user='bugzilla1User', db_name='bugzilla1_db', db_pass='bugzilla1Pass', and $webservergroup = '' and save and exit
- rerun the checksetup.pl by ./checksetup.pl
- It will throw an error about database connection is not possible [ Don't worry just keep patience, its normal]
- create MySQL login/user/credential for the bugzilla1User as follows [ #mysql -u root -p,
enter mysql root user password when it prompts, your prompt will be like this mysql > ,
- type following two SQL query at you mysql > prompt as follows
- mysql > GRANT SELECT, INSERT, UPDATE, DELETE, INDEX, ALTER, CREATE, LOCK TABLES, CREATE TEMPORARY TABLES, DROP, REFERENCES ON bugzilla1_db.* TO bugzilla1User@localhost IDENTIFIED BY 'bugzilla1Pass';
- mysql > FLUSH PRIVILEGES;

- no error!! congrats mysql user/login/credential created successfully. now exit from mysql as mysql > exit;
- rerun the checksetup.pl by[b] ./checksetup.pl[/b] [All databases related to bugzilla1.com will be created and you've to enter administrator e-mail, Real name, password etc. [ Repeat the above steps for bugzilla2.com after exporting the PROJECT=bugzilla2 ]

- Now Create the template folders for the sites bugzilla1.com and bugzilla2.com as follows [cp -r /tmp/bugzilla-3.2/template/en/default /tmp/bugzilla-3.2/template/en/bugzilla1 and cp -r /tmp/bugzilla-3.2/template/en/default /tmp/bugzilla-3.2/template/en/bugzilla2 respectively. ]
- you are 98% done. Congrats Folks
- Now set your local DNS so that you can access your sites by http://bugzilla1.com and http://bugzilla2.com [ if you don't want to set DNS right now jutst make similar entries into you local hosts file /etc/hosts 192.168.1.11 bugzilla1.com and
192.168.1.11 bugzilla2.com
- Now Try With Your Browser and configure you bugzilla settings/preferences/base URL etc. ....

- Reboot the system and check whether everything works fine.

-- That All Folks
[Himadri Sekhar Das,
APT Software Avenues Pvt. Ltd.
Kolkata, INDIA
contact: das.himuinkol@gmail.com]

PS: Dont forget to drop your comments and suggestions if any
REFs: http://www.bugzilla.org/docs/3.2/en/html/multiple-bz-dbs.html
http://www.debian-administration.org/articles/18

How To Upgrade Bugzilla to 3.2 or latest?

Dear All,

If you guys want to upgrade the bugzilla (I did it from 3.0.1) to bugzilla 3.2 (the latest stable version as on, 25th JAN, 2009 and before the next one 3.4) please spent 2 to 4 hours around with me.

Prerequisits:

1) Existing bugzilla host should work properly ( for earlier bugzilla's I've no experience), with successful pinging to www.google.com (seams accessing of Internet is OK)

2) Take a backup of all database and bugzilla stufs [i.e. the old bugzilla folder and mysql folder etc. or dumping everything to a SQL script file using 'MYSQL Administrator' tool]. So that we can revert it back to the current configuration and let our organization be running cooool with previous one.

Lets Jump into:

1) From client browser login into the existing bugzilla server as Admin, and make notes of all the 'Parameters' settings you are currently using for your organization's setup.

2) Login into the Bugzilla server as 'root'-user through putty (windows ssh client) or into the direct bugzilla host. Your console prompt would be like 'root@bugzilla ~#' and use following commands.

3) cd
4) ls
5) cp -r bugzilla backup.bugzilla.301 [as my old bugzilla version was 3.0.1]
6) wget http://ftp.mozilla.org/pub/mozilla.org/webtools/bugzilla-3.2.tar.gz or explore the latest release download URL (try several times if Internet connection/DNS resolution fails/for looking for mirrors)
7) tar -xvf bugzilla-3.2.tar.gz [it will extract every thing into a new directory namely 'bugzilla-3.2', please verify with 'ls' command]
8) cd bugzilla-3.2 [to verify about the extracted files by 'ls' command]



9) mysql -u root -p
[enter your mysql 'root' login password if you have any]. Your prompt should be like 'mysql>'

10) show databases; [for checking]
11) change you existing 'bugs' bugs-db user's password by [if you are using the default, i.e. 'bugs'] -- this is required to stop checksetup.pl to asks for a change/check mysql db_* settings, because we don't want to corrupt existing installation.

mysql> GRANT SELECT, INSERT, UPDATE, DELETE, INDEX, ALTER, CREATE, LOCK TABLES,
-> CREATE TEMPORARY TABLES, DROP, REFERENCES ON bugs.* (existing db)
-> TO bugs@localhost (existing 'bugs' user/login) IDENTIFIED BY 'bugspasswd' (resetting to new password);
or GRANT ALL on bugs.* TO bugs@localhost IDENTIFIED BY 'bugspasswd';

mysql> FLUSH PRIVILEGES;

-- please don't use the inline-comment I used like (existing db), (existing ...), (resetting ...) but

mysql> GRANT ALL on bugs.* TO bugs@localhost IDENTIFIED BY 'bugspasswd';


mysql> FLUSH PRIVILEGES;

12) now create new login for Bugzilla-3.2 testing only as follows:

mysql> GRANT ALL ON bugs320.*
-> TO bugs320@localhost IDENTIFIED BY 'bugs320passwd';

mysql> FLUSH PRIVILEGES;

mysql> exit;

13) Double check wheather bugs and bugs320 login are working fine otherwise you've to repeat step 11 and 12 carefully.

root@bugzilla ....# mysql -u bugs -p [login should be successful]
root@bugzilla ....# mysql -u bugs320 -p [login should be successful]

if you use 'show databases;' SQL you'll see only 'information_schema' database only for 'bugs320' login

mysql> exit;

14) root....# cd ../bugzilla [your existing bugzilla folder, as we don't want to do any changes to your Apache or webserver in this session]
15) rm -rf *, if asks for yes/no press y
16) ls [for verify - you'll see no files]
17) cp -r ../bugzilla-3.2/* .
18) ls [you will see all 3.2 bugzilla files here]

--now be ready to run checksetup.pl script and upgrate existing 'perl' installation to support bugzilla-3.2 features

19) open another consele namely tty2 by pressing alt+F2 and login as 'root'-user
20) pwd [will show you /root, the home of 'root'-usr]
21) ls -al [ you'll see '.cpan' empty-directory ]
22) not needded but make a backup of .cpan by following command so that we can revert it back if required as follows

cp -r .cpan backpup.cpan [a non hidden directory]
23) now switch to tty1 by pressing alt+F1
24) root..../bugzilla# /usr/bin/perl checksetup.pl
25) you may loss some information due to screen scrolling but don't worried as we'll bypass it as per our requirements
25-a) ..../bugzilla# /usr/bin/perl checksetup.pl > test
26) switch to tty2 by pressing alt+F2
27) cat ..../bugzilla/test | less [we can use page-up,page-doun]

28) Look for the section namely 'REQUIRED MODULE'
like 'CGI' and Email::MIME and some OPTIONAL MODULE ALSO, but REQUIRED modules are mandatory

29) switch to tty3 by pressing alt+F3 and login as 'root'-user
30) cd .cpan [ as u r in /root/.cpan now]
31) ls [no files or directory are present till now]
32) /usr/bin/perl install-module.pl CGI or Email::MIME may give error and asking for install CPAN module to upgrade first. [if you faced any error similar judt empty the /root/.cpan directory otherwise CPAN will fail to download or installation -- its better to empty the /root/.cpan directory by rm -rf * [be sure you are in /root/.cpan] and if asks press 'y'

33) /usr/bin/perl install-module.pl CPAN

if mirror resolution fails you've to repeat the step 33) untill CPAN is completly downloaded (not partially) -- if it will take long time to download you think more than 5 minutes or it seems stucks due to some Internet connectiviey just press ctrl+c or ctrl+z and repeate the step 33)

--cheers download is successfully completed now

*34) If you see

--- Checking if your kit is complete...
Looks good
...Writing make file for CPAN
-- NOT OK
Running make test
can't test without successfull make
Running make install
make had returned bad status, install seems impossible
----

Don't be worried but we'll do it (install CPAN and all following perl modules ) manually

PS: if you follow the sereen you'll see some other modules shuld be installed along with the checksetup.pl recommended and CPAN is a must and first downloadable module otherwise following download of rest modules will not be possible

35) /usr/bin/perl install-module.pl Test::Harness/Email::MIME/CGI
36) /usr/bin/perl install-module.pl Authen::SASL
if asks auto install the optional modules form CPAN [y] .. press 'y'
if asks for some missing modules please download those modules firs and then Authen::SASL (like Digest::MD5;Digest::HMAC_MD5 - all thease optional modules)

37) /usr/bin/perl install-module.pl Authen::Radius [if you want to use radius server for authentication]

38) /usr/bin/perl install-module.pl mod_perl2
if it asks for path to 'apxs' --press enter
if it asks for apache home directory -- press ctrl+c or ctrl+z

-- as we are not going to make any change with the existing apache/apache2 right now -- if you are confident you can proceed --

39) /usr/bin/perl install-module.pl --all [if you wish some more modules to install - goon with your own RnD]

if so ... it may ask you for configure pg-config [prostgre database] , just say 'no'/ctrl+c as we'll use and happy with MySQL

40) Lets move for manual installation of the downloaded perl modules by switching to tty3/putty (another console)

41) root@bugzilla~/.cpan# ls [you will see the directory 'build']
42) cd build [and do 'ls', all downloaded modules are here]
43) for each modules you've to repeat the following steps
cd [module's directory]

a) /usr/bin/perl Makefiel.PL ==> Writing Makefile for module - cool.gif
b) make
c) make test ==> ok, ok, ok, .. RESULT PASS (100%, 95%, 99% whatever)
d) make install

repeate step 43) and a, b, c, d for following modules

Test::Harness,CPAN,CGI,Email::MIME, - Digest::HMAC, Digest::HexDump, Authen::Radius, Authen::SASL [look for any warning it displays for prerequisite]

Radius server hostname and port - just press enter if you don't know, all these modules can be reconfigure if required in future

ref: http://www.bugzilla.org/docs/tip/en/html/parameters.html

for Authen::SASL
-- auto-commit [I've no idea yet so put 'no']
-- parameters for the 'perl' 'Build.PL' command[] - press enter [no idea yet]
& repeat these two steps or as pre your knowledge base for make, make test and make install

NB: in case of perl module download failure repeat wget several times to completely download the required modules.

If you think you've issues with GCC then download the GCC-complete-tar-file from "http://gcc.gnu.org/releases.html" and build and install manually or install it by commands like yum, yast, apt-get etc.


44) if you are ok with existing Apache don't install mod_perl2 or if you are confident enough then install it

45) Now switch to tty1 [we are ready to run checksetup.pl script]
46) /usr/bin/perl checksetup.pl
47) it will prompt to change your 'localconfig' file for db_user, db_pass, db_name, webservergroup etc.

48) keep a backup of localconfig as backup.localconfig and edit the localconfig file with your suitable editor [vi]

49) change followings
webservergroup='', db_name='bugs320', db_user='bugs320', db_pass='bugs320password', db_driver='mysql' rest are ok ... save the file and exit

50) /usr/bin/perl checksetup.pl
51) if it prompts as follows:
-- 'creating database bugs320 ....
InnoDB is disabled in your MySQL installation
Bugzilla requires it to be enable it .... do followigs to enable it

vi /etc/mysql/my.cnf [or vi /etc/my.cnf or vi manual-install-path/etc/my.cnf etc.]

/InnoDB -- vi search, and look following lines for 'skip_innodb' and just comment this line and save the file my.cnf and exit

NB: InnoDB (enables foreign-key related things between tables) installation and configuration may vary according to the MySQL version and installation package types

52) restart the mysql daemon (/etc/init.d/mysql restart or the-manual-mysql-installation-directory/mysql restart etc.) or just reboot the HOST by init 6
53) let HOST be ready again and login and 'root'-user again
54) cd .../bugzilla
55) /usr/bin/perl checksetup.pl

56) it will ask you for administration email,name and password for bugzilla-3.2
57) YES YOU ARE READY now to test your installation

58) Check your installation from client's browser and check everything is working or not by login as administrator

59) Yes, folks I know that your are happy now - yes everything is working fine
60) Time to use the existing bugs database instead of bugs320 -- so do followings
61) vi the 'localconfig' file and change the db_name, db_user, and db_pass to yor previous [bugs/bugs/bugspassword -- as u changed at earley steps]

62) /usr/bin/perl checksetup.pl
63) ==> Converting ...., Adding foreign key ... done at last
64) Recheck from your client browser wheather every thing is working fine or not
65) You may need to re-configure the 'Parameters' section only [as you did backup note - at step

Lets Jump into: section 1) ] from your previous settings.

66) That's ALL FOLKS


Warm regards and cheerio for now
Himadri Sekhar Das
APT / Kolkata/ India
das.himuinkol@gmail.com
www.aptsoftware.com

Ref: http://www.bugzilla.org, debian.org, almworks.com