apache driver issues

[Will]

    I've fixed just about every issue with the current apache driver.  Also I have consolidated all of the config to /defaults and /domains.  I won't go too much further into the details right now.

 

    The main question I have is that I would like to get rid of the forced redirects.  Example /webmail redirects to webmail. and /kloxo redirects to cp..  So I would like to remove these all together but still put the webmail (choose/horde/roundcube) choice inside the domain config.  I think the forced redirect is a big problem for SSL certificates and users should have the choice of the path for webmail.

 

https://example.com/webmail redirects to http://webmail.example.com.  Then if you want SSL you have to go to https://webmail.example.com.  Since the certificate may have been purchased for example.com, the SSL cert will not be valid.

 

    If we get rid of this then the user's SSL certificate will work fine when going to https://example.com/webmail.  Also the user can still add a redirect in Kloxo.  It might still have to show /webmail at the end, but I think the SSL problem is more important than the asthetics of a URL to go to webmail.  Or there could be another method to add such subdomains, but I don't think the apache driver needs to worry about it, it could be something to add to the addon domains code.  The same goes for the cp. subdomain.  I still have to review the validity of default and disable.

 

    As I have said I have fixed all the problems, but don't want to release it for review until it is fully complete, which is why I need some feedback on this.

 

-Will

[Mustafa Ramadhan - LxCenter]

Many type of certificate based on 'common-name'. Possible 'domain.com', '*.domain.com', '*.com' or just '*'.

For 'domain.com' type have a problem with 'webmail.domain.com'  because only purchase for 'domain.com'.

On my fork, all webserver config just enough /defaults and /domains config (beside /globals for lighttpd and nginx). I hope it's solution for huge domains (more than 2000 domains on server) beside some fixed related to this issue.

Different with 'official' kloxo, my fork using 'template-based' config (inline-php).

-- 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
_/ .:: Mustafa Ramadhan ::.
_/ mustafa....@lxcenter.org
_/ LxCenter Developer
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

--
# http://en.wikipedia.org/wiki/Netiquette
# A: Because it messes up the order in which people normally read text.
# Q: Why is top-posting such a bad thing?
# A: Top-posting.
# Q: What is the most annoying thing in e-mail?
 
# To Unsubscribe, send an e-mail to:
# lxdevel+u...@googlegroups.com
#
# For more options, visit:
# http://groups.google.com/group/lxdevel
 
# At december, 11th 2011: 21 members.
# At januari, 31th 2012: 25 members.

[René]

Getting rid of the redirects for webmail can only be done under one
condition: when webmail sending is always based on smtp with the user's
authentication and when this can be configured in Kloxo (the server, the
port to use). For the IMAP side, the webmail program needs to know what
mailserver to contact. Remember that this redirect was done to get the
user on the right server where the mailserver for his accounts is. Don't
change this without getting your mind around this. It isn't that easy as
you think it is.

--
René

[René]

The same is valid for redirect to cp. If the domain is on a slave then
the subdomain cp. will always point to the master Kloxo, because the
slaves have no web interface users could access. The redirects are there
for something. Don't simply get rid of them but think through the issue.
There might be another solution, but it is not simply removing the
redirects, that's for sure.

--
René

[william...@lxcenter.org]

Ren� - The cp subdomain doesn't actually go directly to kloxo, though.
Also for webmail, doesn't SMTP use mail. for this purpse? In my
proposal, example.com/webmail would work directly, and you could still
create a parked domain and redirect to redirect webmail.example.com to
webmail.example.com/webmail. Also the addon domain code or the
webmail configuration page in Kloxo could handle the addition of the
same exact webmail.example.com redirect. This could even be the
default setting of the webmai configuration page. I am just proposing
that it not be handled directly by the apache driver. I hope this
makes sense. Maybe we can try to discuss this on IRC tomorrow. Also
once I let you test my changes, you may understand a little better.
The current apache driver is broken is so many ways, I just want to
ensure the next release fixes everything and there will be absolutely
no need for a "tricks" or "workarounds". It will simply work!

-Will

Quoting Ren� <hype...@comunica2.net>:

> Ren�

>
>
> --
> # http://en.wikipedia.org/wiki/Netiquette
> # A: Because it messes up the order in which people normally read text.
> # Q: Why is top-posting such a bad thing?
> # A: Top-posting.
> # Q: What is the most annoying thing in e-mail?
>
> # To Unsubscribe, send an e-mail to:
> # lxdevel+u...@googlegroups.com
> #
> # For more options, visit:
> # http://groups.google.com/group/lxdevel
>
> # At december, 11th 2011: 21 members.
> # At januari, 31th 2012: 25 members.
>

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

[René]

On 03/30/2012 02:49 PM, william...@lxcenter.org wrote:
> René - The cp subdomain doesn't actually go directly to kloxo, though.
Well then that is a bug. That is the very reason why cp. sub domain
exists, to point to the master where the Kloxo web interface is
functional. In slaves only the api is functional and the web interface
gives a blank page. So you have to redirect at least to another domain,
but not necessarily a sub domain of the client.

> Also for webmail, doesn't SMTP use mail. for this purpse?

How about authentication? You can use one mail account for outgoing
webmail, but then you cannot recognise users that SPAM, send out too
much (all is that one user and you cannot recognise any more who is
mailing). Then other setting uses the webmail log-in as authentication,
but then the webmail program needs to be set up with the right mail
server otherwise authentication fails. Also for reading/receiving mail
it is important. If the mail server is incorrect, then the IMAP server
is incorrect and authentication will fail. With more then one mailserver
the mail can be stored on a different location and only the IP address
will tell us where. One way is a redirect by subdomin and the only other
way I see is a MX DNS query in the webmail software. It all works nicely
with one mailserver, but when there are more, then webmail programs
don't provide a solution. To my knowledge there is no webmail app. that
does a mx lookup and then connect to the smtp server belonging to the
email address. In the default DNS template you see that webmail sub
redirects to the MX, to mail. subdomain, not the __base__. That's what
you need on webmail level to let it work.

> This could even be the default setting of the webmai configuration
> page. I am just proposing that it not be handled directly by the
> apache driver.

I can live with pre-set redirects done that way, as long as it keeps
working with multi-server set-up.

> I hope this makes sense. Maybe we can try to discuss this on IRC
> tomorrow.

No chance. Travelling by car tomorrow, some 8 hour drive. I have no
voice recognition, nor even a smart phone. Then after that I will be out
of work context, although still available for emergencies.

You decide what you want together with the others, as long as you
extensively test with more then one host. Domain A with webserver on
host X and mail accounts on host Y, domain B with webserver on host Y
and mail accounts on host X, that's how I would test it and the two
other more conventional variations too.

> Also once I let you test my changes, you may understand a little
> better. The current apache driver is broken is so many ways, I just
> want to ensure the next release fixes everything and there will be
> absolutely no need for a "tricks" or "workarounds". It will simply work!

I agree. I did not upgrade to the latest version yet, for fear of more
hassle. I will not upgrade production until this is rock solid or at
least solid enough.

--
René

[william...@lxcenter.org]

The redirect points to the horde installation on the same server that
is serving the user. That wouldn't change in my proposal. So that
won't be an issue.

cp gives a page that lists the links for Kloxo, Webmail, and
PHPMyAdmin. The links are based on the base domain.

examples:
http://example.com:7778
http://webmail.example.com
http://example.com:7778/thirdparty/phpMyAdmin/

also it lists the equivalent https links.

-Will

Quoting Ren� <hype...@comunica2.net>:

> On 03/30/2012 02:49 PM, william...@lxcenter.org wrote:

>> Ren� - The cp subdomain doesn't actually go directly to kloxo, though.

[Mustafa Ramadhan - LxCenter]

Rene, you are right.

On 30/03/2012 15:03, René wrote:

The same is valid for redirect to cp. If the domain is on a slave then the subdomain cp. will always point to the master Kloxo, because the slaves have no web interface users could access. The redirects are there for something. Don't simply get rid of them but think through the issue. There might be another solution, but it is not simply removing the redirects, that's for sure.

-- 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
_/ .:: Mustafa Ramadhan ::.
_/ mustafa....@lxcenter.org
_/ LxCenter Developer
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

[Danny Terweij | LxCenter]

Op 30-3-2012 7:38, Mustafa Ramadhan - LxCenter schreef:

Many type of certificate based on 'common-name'. Possible 'domain.com', '*.domain.com', '*.com' or just '*'.xcenter.org

It depends what the user bought. You can not decide the users choice, you have to think in a different different way.

So just act like that the user have on each domain/subdomain an own certificate.


Regards,
Danny.

[Will]

I want to let you guys test this but I have just found some problems with how the Switch Program works and also found that a certain part of the apache driver only runs on install when there is a real domain already present.  Neither of these are big problems of course, but I am trying for flawless.

 

Also want to give a few things to think about in where I have gone with this driver:

 

Less choices that do the same thing such as using only the following:

mpm_itk is used.

--Does suphp do anything differently?  And I mean differently that really matters.

--No choice for ruid2.  I see no reason to allow a switch.  It is just more complicated to support.

 

All of the non exclusive domains use only the main IP address of the box.  This actually is important as if a client gets an exclusive later, I think a restart was needed as opposed to just a reload.  I could be mistaken, but either way I see no reason for the non-exclusive domains to answer to all of the IP addresses on the box.

 

Webmail subdomain is removed, but /webmail works just fine.  I have to do some more thorough testing though.  Users can create their own redirect to it.  At some other time, a special Parked domain could point to it.

 

Starting/restarting httpd no longers gives any error messages or warnings.  No need to edit /etc/hosts.  This is mainly because of the changes I made to the SSL configuration.  Your main IP address just needs to have a PTR record.  It doesn't have to match, it just needs some sort of record.

 

Well, let me know if there is anything you'd like to discuss about these items.  Maybe I can post instructions to test next weekend.

 

-Will