Catalyst - Revision history

Psmay: /* On Dreamhost with perlbrew */

2015-01-16T19:49:44Z

On Dreamhost with perlbrew

Psmay: /* Set up document root */

2015-01-16T19:21:49Z

Set up document root

Psmay: /* Locations */

2015-01-16T19:10:12Z

Locations

Psmay: /* Pre-flight */

2015-01-16T19:08:44Z

Pre-flight

Psmay: /* Pre-flight */

2015-01-16T19:05:41Z

Pre-flight

Psmay: /* Set the perl path to be used by the scripts */

2015-01-16T19:02:22Z

Set the perl path to be used by the scripts

Psmay: /* Massive redirection prowess */

2015-01-16T18:58:00Z

Massive redirection prowess

Psmay: /* On Dreamhost with perlbrew */

2015-01-16T15:58:12Z

On Dreamhost with perlbrew

Psmay: /* Massive redirection prowess */

2015-01-15T22:26:18Z

Massive redirection prowess

Psmay at 19:59, 15 January 2015

2015-01-15T19:59:24Z

@@ Line 20: / Line 20: @@
 <syntaxhighlight lang=bash>
 perlbrew use myperl
-cpanm Catalyst::Runtime Catalyst::Devel Catalyst::TraitFor::Request::ProxyBase
+cpanm Catalyst::Runtime Catalyst::Devel \
 </syntaxhighlight>

← Older revision		Revision as of 19:21, 16 January 2015
Line 194:		Line 194:

	=====Set up document root=====		=====Set up document root=====
		+
		+	We create a dispatch.fcgi script (this is apparently a magical name on Dreamhost that is less subject to aggressive process killing). This script is simply a dash-based wrapper around the project's own FastCGI script.
		+
		+	We also create an .htaccess file. This file is set to do two things:
		+
		+	* It redirects any request whatsoever from the client to be handled by the Catalyst project.
		+	** <code>dispatch.fcgi</code> is set to be inaccessible except after at least one rewrite.
		+	* It sets the request header <code>X-Request-Base</code> to the root of whatever is found in the <code>SCRIPT_URI</code> env variable.
		+	** This setting helps <code>Catalyst::TraitFor::Request::ProxyBase</code> change the base URL in such a way that Catalyst won't nullify our efforts to hide the script from the client. (Without it, a client's request to e.g. <code>/dispatch.fcgi/baz</code> is treated the same as <code>/baz</code>, which we don't want.)
		+
		+	With these settings in place, the dispatcher is so well hidden that Catalyst could theoretically be set to handle an action named <code>/dispatch.fcgi</code> without worry of misinterpretation.
		+
		+	These are the only files that should ever appear in the document root. Files to be served in a direct manner can be placed in the project itself (e.g. under its <code>static</code> directory).

	<syntaxhighlight lang=bash>		<syntaxhighlight lang=bash>

@@ Line 117: / Line 117: @@
 =====Locations=====
-These variables are assumed set:
+These variables are assumed set. If they are set correctly, the shell snippets in the rest of this walkthrough should be runnable by pasting, without any changes.
 <syntaxhighlight lang=bash>

@@ Line 113: / Line 113: @@
 ** This module is used here to alter the base URI so that requests to the dispatch script cannot be made directly by the client.
 * If no Catalyst project has been created yet, create one using catalyst.pl (in particular, the copy installed under the desired perl environment).
 =====Locations=====

@@ Line 112: / Line 112: @@
 * Ensure the CPAN module <code>Catalyst::TraitFor::Request::ProxyBase</code> is installed.
 ** This module is used here to alter the base URI so that requests to the dispatch script cannot be made directly by the client.
 =====Locations=====

@@ Line 188: / Line 188: @@
 <syntaxhighlight lang=bash>
-find "$PROJECT_ROOT" -type f -exec perl -p -i -e "s!/usr/bin/env perl!$MYPERL!g" {} \;
+find "$PROJECT_ROOT" -type f -exec perl -p -i -e "s#/usr/bin/env perl#$MYPERL#g" {} \;
 </syntaxhighlight>

@@ Line 98: / Line 98: @@
 (note the trailing slash) results in a default welcome screen. (If the result is a 500, something wasn't set up correctly.)
-====Massive redirection prowess====
+====Well-hidden dispatch====
 With the following methodology, it is possible to:
@@ Line 107: / Line 107: @@
 =====Pre-flight=====
-First, you'll want to make sure you have a minimalist shell such as dash installed locally. This can be used to wrap the true dispatch script and run it elsewhere without adding the overhead (and potential vulnerabilities) of bash. For this discussion, it's installed at
+* Ensure FastCGI is enabled on the domain.
- /home/someuser/bin/dash
+=====Locations=====
-Also, ensure that the domain is enabled for FastCGI.
+These variables are assumed set:
-Finally, note your project's name and location. For this discussion, the project is named <code>Foo</code> and based at
+<syntaxhighlight lang=bash>
- /home/someuser/catalyst-projects/Foo
+=====Main project module=====
-=====Deployment=====
+$PROJECT_MAIN_MODULE must be updated to apply the base-altering trait. Do this in one of two ways:
-Do the following in the document root.
+======Change automatically======
 <syntaxhighlight lang=bash>
-DASH=/home/someuser/bin/dash
+patch "$PROJECT_MAIN_MODULE" <<'EOF'
-PROJECT_FASTCGI_SCRIPT=/home/someuser/catalyst-projects/Foo/script/foo_fastcgi.pl
+@@ -24,2 +24,4 @@
-# Generate an obscure dir name by which to access the dispatcher
+# Apply additional roles to the request class
-OBSCURE_KEY="`uuidgen -r`"
+__PACKAGE__->apply_request_class_roles(qw/
-# FastCGI script
+=====Set the perl path to be used by the scripts=====
-# Set normal-looking permissions
+If applicable, update the scripts in the project to use the perlbrew perl instead of what env says:
-# /(dir)/
+<syntaxhighlight lang=bash>
-mkdir "$OBSCURE_KEY"
+find "$PROJECT_ROOT" -type f -exec perl -p -i -e "s!/usr/bin/env perl!$MYPERL!g" {} \;
-# /(dir)/.htaccess
+=====Set up document root=====
-# /(dir)/dispatch.fcgi
+<syntaxhighlight lang=bash>
-cat >"$SCRIPT" <<EOF
 #!$DASH
 "$PROJECT_FASTCGI_SCRIPT" "\$@"
 EOF
-# /.htaccess
+# .htaccess
-cat >.htaccess <<EOF
+cat >"$DOCUMENT_ROOT/.htaccess" <<EOF
-RewriteEngine On
 RewriteCond %{ENV:REDIRECT_STATUS} ^$
-RewriteRule ^(.*)$ $SCRIPT/\$1
+RewriteRule ^(.*)$ dispatch.fcgi/$1
 EOF
 </syntaxhighlight>

@@ Line 100: / Line 100: @@
 ====Massive redirection prowess====
-For functional security, these features would be desirable:
+With the following methodology, it is possible to:
-* The Catalyst project exists ''outside'' the website directory, so the probability of files being exposed due to misconfiguration is reduced.
+* Store the project separately from the document root, preventing access to material in the event of a misconfiguration.
-** e.g. The website root is /home/someuser/sub.example.com but the project is /home/someuser/projects/Foo
+* Prevent, with caveats, the dispatch script from being requested directly by a client.
-* The dispatch script cannot be accessed directly from the browser.
-** e.g. http://sub.example.com/d/dispatch.fcgi/ is not equivalent to http://sub.example.com/
+=====Pre-flight=====
-** e.g. http://sub.example.com/d/dispatch.fcgi/bar is not equivalent to http://sub.example.com/bar
-* Rewrites exist so that the URL to the dispatch script or its directory is redirected into the dispatcher.
+First, you'll want to make sure you have a minimalist shell such as dash installed locally. This can be used to wrap the true dispatch script and run it elsewhere without adding the overhead (and potential vulnerabilities) of bash. For this discussion, it's installed at
-** e.g. http://sub.example.com/d from the browser is redirected to http://sub.example.com/d/dispatch.fcgi/d internally.
-** e.g. http://sub.example.com/d/ from the browser is redirected to http://sub.example.com/d/dispatch.fcgi/d/ internally.
+ /home/someuser/bin/dash
-** e.g. http://sub.example.com/d/dispatch.fcgi from the browser is redirected to http://sub.example.com/d/dispatch.fcgi/d/dispatch.fcgi internally.
-** e.g. http://sub.example.com/d/dispatch.fcgi/ from the browser is redirected to http://sub.example.com/d/dispatch.fcgi/d/dispatch.fcgi/ internally.
+Also, ensure that the domain is enabled for FastCGI.
-** e.g. http://sub.example.com/d/dispatch.fcgi/bar from the browser is redirected to http://sub.example.com/d/dispatch.fcgi/d/dispatch.fcgi/bar internally.

← Older revision		Revision as of 19:59, 15 January 2015
Line 97:		Line 97:

	(note the trailing slash) results in a default welcome screen. (If the result is a 500, something wasn't set up correctly.)		(note the trailing slash) results in a default welcome screen. (If the result is a 500, something wasn't set up correctly.)
		+
		+	====Massive redirection prowess====
		+
		+	For functional security, these features would be desirable:
		+
		+	* The Catalyst project exists ''outside'' the website directory, so the probability of files being exposed due to misconfiguration is reduced.
		+	** e.g. The website root is /home/someuser/sub.example.com but the project is /home/someuser/projects/Foo
		+	* The dispatch script cannot be accessed directly from the browser.
		+	** e.g. http://sub.example.com/d/dispatch.fcgi/ is not equivalent to http://sub.example.com/
		+	** e.g. http://sub.example.com/d/dispatch.fcgi/bar is not equivalent to http://sub.example.com/bar
		+	* Rewrites exist so that the URL to the dispatch script or its directory is redirected into the dispatcher.
		+	** e.g. http://sub.example.com/d from the browser is redirected to http://sub.example.com/d/dispatch.fcgi/d internally.
		+	** e.g. http://sub.example.com/d/ from the browser is redirected to http://sub.example.com/d/dispatch.fcgi/d/ internally.
		+	** e.g. http://sub.example.com/d/dispatch.fcgi from the browser is redirected to http://sub.example.com/d/dispatch.fcgi/d/dispatch.fcgi internally.
		+	** e.g. http://sub.example.com/d/dispatch.fcgi/ from the browser is redirected to http://sub.example.com/d/dispatch.fcgi/d/dispatch.fcgi/ internally.
		+	** e.g. http://sub.example.com/d/dispatch.fcgi/bar from the browser is redirected to http://sub.example.com/d/dispatch.fcgi/d/dispatch.fcgi/bar internally.