Security for Drupal
I just did a session at Drupalcamp LA 2010 and my presentation was on Updating Drupal without Drush. Well recently I was hacked. I can't tell you what site it was, but it wasn't pretty. At least it wasn't anything bad, just spam. Regardless, it freaked me out completely. The reason for the hack was that one of my modules was out of date. There was a security update that I hadn't applied.
Since then I am now hyper vigalant about updating my sites as you should be. It's not hard and it's well worth it. Drupal is a very secure platform to build from IF you take care of it. So, all of you "Drupaleros" (to quote Christefano) please do your updates. I will post my session here when it comes out from UC Irvine.
Setting up a cron job in Webmin Virtualmin GUI on Linode with Lenny
Seriously, It sucks to be the girl with no UNIX experience who needs to set up seemingly simple things like cron jobs. I don't understand the commands or what -0 -q -t means no matter how many times I read the handbook page on Drupal.org. I just want to know the command that works to I can plug it in to the GUI interface wherever I am, or I would even go so far as to run a command via ssh in the command line (shudder).
For the past few weeks I have been working within my first, very own VPS on Linode running Lenny on Debian 5. My friend Christefano helped me set this all up and I also installed webmin virtualmin cause I like that sort of interface. It works for me.
One of the things I have avoided until now is setting up a cron job for the site that I am working on.
Today I decided to tackle it because I need to go live with my site very soon, and my news feeds and backups rely on cron. Not to mention Drupal needs cron for "washing the windows and taking out the trash" so to speak.
So, in case you are running the same sort of set up I am and you are like me a total boob when it comes to cron, here is the command that finally worked for me:
/usr/bin/wget -O - - http://www.yoursite.com/cron.php
I almost jumped out of my skin when this worked.
I hope this helps someone out there.
NB
Update: So if you want to know where to access cron jobs, choose "webmin" and on the left will be a "system" dropdown with schedule cron jobs as a choice. From there you can create a new cron job or edit one.
Changing the Ubercart Tab Titles Product, Attribute, Options, Features
So we needed to change the titles of the tabs in the product/edit form in Ubercart.
Lyle got us started with some code and David Blum finished it up for us. This will change the tab titles in one product type but not all of them:
/**
* Implementation of hook_menu_alter()
*/
function custom_module_menu_alter(&$items) {
$items['node/%node/edit/product']['title callback'] = 'custom_module_tab_callback';
$items['node/%node/edit/product']['title arguments'] = array(1, 'product');
$items['node/%node/edit/attributes']['title callback'] = 'custom_module_tab_callback';
$items['node/%node/edit/attributes']['title arguments'] = array(1, 'attributes');
$items['node/%node/edit/attributes/add']['title callback'] = 'custom_module_tab_callback';
$items['node/%node/edit/attributes/add']['title arguments'] = array(1, 'attributes');
$items['node/%node/edit/options']['title callback'] = 'custom_module_tab_callback';
$items['node/%node/edit/options']['title arguments'] = array(1, 'options');
$items['node/%node/edit/adjustments']['title callback'] = 'custom_module_tab_callback';
$items['node/%node/edit/adjustments']['title arguments'] = array(1, 'adjustments');
$items['node/%node/edit/features']['access callback'] = 'custom_module_tab_access';
$items['node/%node/edit/features']['access arguments'] = array(1);
}
/**
* Callback function to provide new tab titles
*/
function custom_module_tab_callback($node, $item) {
if ($node->type == 'lessons') {
switch ($item) {
case 'product':
return t('Lesson');
case 'attributes':
return t('Types');
case 'options':
return t('Prices');
case 'adjustments':
return t('Advanced');
}
}
else {
switch ($item) {
case 'product':
return t('Product');
case 'attributes':
return t('Attributes');
case 'options':
return t('Options');
case 'adjustments':
return t('Adjustments');
}
}
}
Thank you David Blum and Lyle! You guys ROCK!
Setting up a VPS on Linode with Debian 5.0 and Webmin
I am waiting for my install script to load, so I'm blogging about my experiences with hosting and setting up a VPS.
I have exhausted the resources of shared hosting. I have used several shared hosting companies all with thier plusses and minuses. I started with godaddy.com for just basic websites html/css no scripts just static. They are fine for that. I host all of my domains with godaddy. I Love the DNS manager there. For Drupal, godaddy is a very poor and slow service. One major step up is Hot Drupal. They are AWESOME for small Drupal sites. They are affordable, the customer service is great and Steve is super nice. I recommend them highly for shared hosting for small sites running Drupal. I have NEVER had a problem with them and uptime is excellent and personal service is also way up there.
Lastly, I tried Rackspace CloudSites for my Drupal sites. It worked, but it's still shared hosting and the database clusters do get full so I have gotten error messages "There are no suitable nodes to fulfill your request" and I really don't like that.
Now I am prepared to play with the big dogs. With help from Christefano at Exaltation of Larks and Rain Breaw from Sun Rain Productions, I am setting up my own VPS on Linode. Christefano recomended setting up a Debian 5 server. I trust his judgement and went with that as well.
Here's what I have done so far:
I set up an account on Linode for a Linode 1080. I chose the Debian 5.0 64 bit server with a deployment disk of 48896 MB and a swap disk with 256 MB.
When everything was set up on my dashboard, I clicked on the "boot" button and my linode was running. (hooray)
I floundered a little bit about what to do next. I knew that I wanted to install webmin with these instructions http://webmin.com/vinstall.html but I haven't had to do much SSH and terminal stuff, so I needed a little help to get started with this.
To SSH into your server and install Webmin this is what Christefano said:
To download the install.sh script, you need to log in to the VPS first
using SSH. The way to do this is to open Terminal and enter the
following command:ssh root@IPaddress
Replace "IPaddress" with the IP address to your VPS. If this is the
first time you've used SSH to connect to the VPS, you will see a message
in the Terminal like "Are you sure you want to connect to this server?"
and you can type "yes" and then enter your root password.Once logged in, enter the following commands:
wget http://software.virtualmin.com/gpl/scripts/install.sh
chmod +x install.sh
./install.shIt will take a while (maybe up to 15 minutes) to install everything.
When it's done, you can go to https://IPaddress:10000 and log in as root.
So that's where I am. I will update this post as I go.
Update:
When you log in to your webmin for the first time, you will be presented with a wizard. I got instructions from http://joealdeguer.com/technology-projects/34-web-hosting/83-installing-...
Yes - more RAM - Preload Virtualmin Libraries
Yes - more RAM - email
Yes - more RAM - ClamAV
Yes - more RAM - Spamassassin
Yes - more RAM - MySQL
No - PostgreSQL
Set the password for MySQL. This will be the password for the super administrator on MySQL.
Click Re-check and refresh configuration. If an error comes up Virtualmin is not ready for use. Click the link "List of DNS servers" then add the loopback addess 127.0.0.1. Before Clicking Apply Configuration go into the Networking part to make sure the main IP address is set to static IP!
Go back to virtualmin. Recheck configuration again.
I will update if this works out for me.
Update:
So this is working so far. I had to turn of the spam and virus filtering temporarily (in features and plug ins area) because it was causing a problem. It looks like this does not automatically install PHP, so I will update when I figure this part out.
So far, Awesome and Easy.
Next, I updated the system realizing I should have done this first.
apt-get update
apt-get upgrade --show-upgraded
I also set up the hostname.
echo "squire" > /etc/hostname
hostname -F /etc/hostname
Update: 6/9/10
Not quite done yet.
I didn't have any PHP, so I insalled it using aptitude with this command:
aptitude install php5-mysql php5-dev php5-cli php-apc
[from Christefano]This uses aptitude (an improved package manager) to install the following:
1. the PHP5/MySQL connector, which exposes MySQL to PHP5
2. the PHP5 development tools, which gives you PHP5 development tools in
case you need them to compile PHP extensions in the future
3. the PHP5 command line tool, which makes it possible to run PHP
scripts, including Drush, from the command line
4. the APC opcode cache, which makes PHP code run much, much faster and
with less memory. You'll need this since the VPS currently has barely
enough memory to run the operating system and the Apache/MySQL/PHP stack.
I clicked the create a server button in the virtualmin control panel. I now have a server. Everything ran but the DNS.
I FTP'd into my site using my IP as my host and the username and password I set up for my server when I set it up.
I'm going to edit my php.ini file which is in my /etc/php5/apache2/php.ini from the root and not from your FTP root. You know you are in the wrong place if you don't see the apache directory.
I'm adding these lines to the top:
extension=apc.so
apc.enabled=1
apc.shm_size="64"
Christefano suggested that I install some performance related apache modules so I did this command:
a2enmod expires deflate headers
and then a restart with this:
/etc/init.d/apache2 restart
Then I set the time zone with this command:
dpkg-reconfigure tzdata
choosing "america" and "los Angeles"
There is still more to do, but this is awesome so far.
Update 6/11/10
I had to set up a DNS zone in linode in the DNS tab and set my name servers to ns1.linode.com, ns2..., ns3..., ns4... at godaddy in my dns control panel.
I set up 3 sub servers and repeated the DNS process above for each.
I went to install Open Atrium on my main site and I got an error that I didn't have GD library installed.
ano1 on IRC #drupal-support (i use chatzilla for firefox and #drupal-support is on freenode) helped me by pointing to this tutorial: http://www.cyberciti.biz/faq/ubuntu-linux-install-or-add-php-gd-support-...
Worked like a charm. Thanks ano1 !
Now I have this error:
Database configuration
Your web server does not appear to support any common database types. Check with your hosting provider to see if they offer any databases that Drupal supports.
That is my next issue. I know I have MySQl installed, so why is it not talking to Drupal?
So ano1 rescued me again. Here is the tutorial I followed: http://www.cyberciti.biz/faq/php-not-connecting-to-a-mysql-database-server/
It works!!!
All in all this took me about a week to accomplish. My next project is Drush. If I get that working, I'll let you know.
:-)
*warning* I do not guarantee that this will work for you and am not responsible if it breaks your system. This is for informational purposes only.
L.A. Drupal Presentation on OG + Date +Views
These are my slides from my Drupalcamp LA presentation. If there is a video, I will post it when it's avalable.
Here are the resources from the last slide.
Karen Stevenson's Code
Here you can export her view with her special code included.
http://karen-stevenson.com/node/8
Karen Stevenson's Drupalcon DC 2009
video Making Dates and Calendar's Rock
http://dc2009.drupalcon.org/session/making-dates-and-calendars-rock
Organic Groups Moshe Weitzman
Do it with Drupal 2008 Video
Awesome intro to Organic Groups
http://www.doitwithdrupal.com/2008/sessions/organic-groups
Rain Breaw Views Demystified
Drupalcamp LA 2009 Video and Notes
Awesome overview of Views
http://www.sunrainproductions.com/drupalcampla/views-demystified
Teaching others about Twitter
Recently several people have asked me about Twitter, more specifically, what is twitter. It's hard to explain twitter! I found a great little commercial that really clearly explains it. Here it is.
Twitter in Plain English from leelefever on Vimeo.
Long Beach Cub Scout Pack 23
Cub Scouts organize a large pack which is made up of several dens. Each den has several children. This site allows the pack to have a home page as well as having a home page for each den.
This site also includes a calendar that can be edited by all registered users. This allows the group to maintain a single calendar for all events. All upcoming events are also shown in the sidebar on the left.
Group information can also be private which is important when creating a site that involves children.
Much of the pack information is public which is important to visitors who are interested in joining the pack.
Injectable Thread Lift
Featuring a custom design and a testamonials area that acts as a slide show, this site can easily be maintained by the owner who may insert new testamonials into the slideshow by submitting a simple form.
A custom administrative menu has been created for the owner to update the sidebar area when her class schedule is updated.
Bethany Church, Bellflower, CA
This site was a team build and serves a community of 500 or so members.
Features include custom graphical buttons, a podcast for sermons and a bible verse of the day area on the home page. Two pastors regularly blog on the site.
This site is updated by the secretary of the congregation who updates the home page herself through a simple administrative area.
Pastors also maintain thier own blogs through a simple bloggers log in.
Torrance Police Officer's Association
This site features two user experiences. One is for the officer's who belong to the association and the other for the citizens of the City of Torrance. Access to the site is controlled through a user log in system.
The citizen area emphasizes public safety information as well as events that support the police officer's association such as the Fuller Golf Tournament and the annual Santa float.
The association member site includes an active member's forum, podcast, and voting secure enough for elections.
Each side of the site allows for subscription updates for registered users. Users can also opt in to messaging via mobile phone.






