Ruby on Major Hayden

Quickly post gists to GitHub Enterprise and github.com

major@mhtx.net (Major Hayden) — Fri, 08 Aug 2014 21:13:07 +0000

The gist gem from GitHub allows you to quickly post text into a GitHub gist. You can use it with the public github.com site but you can also configure it to work with a GitHub Enterprise installation.

To get started, add two aliases to your ~/.bashrc:

alias gist="gist -c"
alias workgist="GITHUB_URL=https://github.mycompany.com gist -c"

The -c will copy the link to the gist to your keyboard whenever you use the gist tool on the command line. Now, go through the login process with each command after sourcing your updated ~/.bashrc:

source ~/.bashrc
gist --login
(follow the prompts to auth and get an oauth token from github.com)
workgist --login
(follow the prompts to auth and get an oauth token from GitHub Enterprise)

You’ll now be able to use both aliases quickly from the command line:

cat boring_public_data.txt | gist
cat super_sensitive_company_script.sh | workgist

Getting apache, PHP, and memcached working with SELinux

major@mhtx.net (Major Hayden) — Thu, 08 Sep 2011 03:55:00 +0000

I’m using SELinux more often now on my Fedora 15 installations and I came up against a peculiar issue today on a new server. My PHP installation is configured to store its sessions in memcached and I brought over some working configurations from another server. However, each time I accessed a page which tried to initiate a session, the page load would hang for about a minute and I’d find this in my apache error logs:

[Thu Sep 08 03:23:40 2011] [error] [client 11.22.33.44] PHP Warning:
Unknown: Failed to write session data (memcached). Please verify that
the current setting of session.save_path is correct (127.0.0.1:11211)
in Unknown on line 0

I ran through my usual list of checks:

netstat showed memcached bound to the correct ports/interfaces
memcached was running and I could reach it via telnet
memcached-tool could connect and pull stats from memcached
double-checked my php.ini
tested memcached connectivity via a PHP and ruby script - they worked

Even after all that, I still couldn’t figure out what was wrong. I ran strace on memcached while I ran a curl against the page which creates a session and I found something significant - memcached wasn’t seeing any connections whatsoever at that time. A quick check of the lo interface with tcpdump showed the same result. Just before I threw a chair, I remembered one thing:

SELinux.

A quick check for AVC denials showed the problem:

# aureport --avc | tail -n 1
4021. 09/08/2011 03:23:38 httpd system_u:system_r:httpd_t:s0 42 tcp_socket name_connect system_u:object_r:memcache_port_t:s0 denied 31536

I’m far from being a guru on SELinux, so I leaned on audit2allow for help:

# grep memcache /var/log/audit/audit.log | audit2allow

#============= httpd_t ==============
#!!!! This avc can be allowed using one of the these booleans:
# httpd_can_network_relay, httpd_can_network_memcache, httpd_can_network_connect

allow httpd_t memcache_port_t:tcp_socket name_connect;

The boolean we’re looking for is httpd_can_network_memcache. Flipping the boolean can be done in a snap:

# setsebool -P httpd_can_network_memcache 1
# getsebool httpd_can_network_memcache
httpd_can_network_memcache --> on

After adjusting the boolean, apache was able to make connections to memcached without a hitch. My page which created sessions loaded quickly and I could see data being stored in memcached. If you want to check the status of all of the apache-related SELinux booleans, just use getsebool:

# getsebool -a | grep httpd | grep off$
allow_httpd_anon_write --> off
allow_httpd_mod_auth_ntlm_winbind --> off
allow_httpd_mod_auth_pam --> off
allow_httpd_sys_script_anon_write --> off
httpd_can_check_spam --> off
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_relay --> off
httpd_can_sendmail --> off
httpd_dbus_avahi --> off
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> off
httpd_execmem --> off
httpd_read_user_content --> off
httpd_setrlimit --> off
httpd_ssi_exec --> off
httpd_tmp_exec --> off
httpd_unified --> off
httpd_use_cifs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off

If you’re interested in SELinux, a good way to get your feet wet is to head over to the CentOS Wiki and review their SELinux Howtos

Idiot’s guide to OAuth logins for Twitter

major@mhtx.net (Major Hayden) — Thu, 20 May 2010 01:26:07 +0000

It certainly shouldn’t be difficult, but I always have a tough time with OAuth. Twitter is dropping support for basic authentication on June 30th, 2010. I have some automated Twitter bots that need an upgrade, so I’ve been working on a quick solution to generate tokens for my scripts.

I formulated a pretty simple script using John Nunemaker’s twitter gem that will get it done manually for any scripts you have that read from or update Twitter:

#!/usr/bin/ruby
require 'rubygems'
require 'twitter'

# These credentials are specific to your *application* and not your *user*
# Get these credentials from Twitter directly: http://twitter.com/apps
application_token = '[this should be the shorter one]'
application_secret = '[this should be the longer one]'

oauth = Twitter::OAuth.new(application_token,application_secret)

request_token = oauth.request_token.token
request_secret = oauth.request_token.secret
puts "Request token => #{request_token}"
puts "Request secret => #{request_secret}"
puts "Authentication URL => #{oauth.request_token.authorize_url}"

print "Provide the PIN that Twitter gave you here: "
pin = gets.chomp

oauth.authorize_from_request(request_token,request_secret,pin)
access_token = oauth.access_token.token
access_secret = oauth.access_token.secret
puts "Access token => #{oauth.access_token.token}"
puts "Access secret => #{oauth.access_token.secret}"

oauth.authorize_from_access(access_token, access_secret)
twitter = Twitter::Base.new(oauth)
puts twitter.friends_timeline(:count => 1)

When you run the script, it will give you a request token, request secret and a URL to visit. When you access the URL, you’ll be given a PIN. Type the PIN into the prompt and you’ll get your access token and secret. This is what you can use to continue authenticating with Twitter, so be sure to save the access token and secret.

From then on, you should be able to login with a script like this:

#!/usr/bin/ruby
require 'rubygems'
require 'twitter'

application_token = '[this should be the shorter one]'
application_secret = '[this should be the longer one]'

oauth = Twitter::OAuth.new(application_token,application_secret)

oauth.authorize_from_access(access_token, access_secret)
twitter = Twitter::Base.new(oauth)
puts twitter.friends_timeline(:count => 1)

I hope this helps!

Rotating rails logs when using Phusion Passenger

major@mhtx.net (Major Hayden) — Fri, 26 Jun 2009 15:09:54 +0000

I found a great post on Overstimulate about handling the rotation of rails logs when you use Phusion Passenger. Most of the data for your application should end up in the apache logs, but if your site is highly dynamic, you may end up with a giant production log if you’re not careful.

Toss this into /etc/logrotate.d/yourrailsapplication:

/var/www/yourrailsapp/log/*.log {
 daily
 missingok
 rotate 30
 compress
 delaycompress
 sharedscripts
 postrotate
 touch /var/www/yourrailsapp/tmp/restart.txt
 endscript
}

For a detailed explanation, see the post on Overstimulate.

Writing a Ruby on Rails application without using a database

major@mhtx.net (Major Hayden) — Fri, 09 Jan 2009 17:00:44 +0000

Some of you may be wondering “why would you want to use Rails without a database?” There are several situations why a database would not be needed, and I’ve run into quite a few of them. One of the specific cases was when I wanted to write a web interface for an application that only had a REST interface available to the public.

If you find yourself needing to write a Rails application without a database, just do the following:

For Rails 1.0 and up:

config/environment.rb:

config.frameworks -= [ :active_record ]

test/test_helper.rb

class Test::Unit::TestCase
 self.use_transactional_fixtures = false
 self.use_instantiated_fixtures = false
 def load_fixtures
 end
end

For Rails 2.1 and up: Comment out both of the lines that begin with ActiveRecord::Base in config/initializers/new_rails_defaults.rb:

if defined?(ActiveRecord)
 # Include Active Record class name as root for JSON serialized output.
 # ActiveRecord::Base.include_root_in_json = true

 # Store the full class name (including module namespace) in STI type column.
 # ActiveRecord::Base.store_full_sti_class = true
end

For more details, review the full article on rubyonrails.org.

Viewing documentation for your ruby gems

major@mhtx.net (Major Hayden) — Thu, 06 Nov 2008 00:14:57 +0000

I stumbled into this four line ruby script that will serve up all of the rdoc documentation for your server’s currently installed gems:

#!/usr/bin/env ruby
require "rubygems/server"
options = {:gemdir => Gem.dir, :port => 4242, :daemon => true}
Gem::Server::run(options)

Thanks to Daniel for the ruby code!