Guide to Web Hosting in CIS. Contents. Information for website administrators. ITEE IT Support

Transcription

1 Contents CIS Web Environment... 2 Cis-web... 2 Cis-content... 2 MySQL... 3 Applying for web hosting... 3 Frequently Asked Questions... 4 Code Snippets... 6 LDAP authentication BN : June 2010

2 CIS Web Environment The CIS web environment is comprised of 2 Virtual Servers running FreeBSD (cis-web and ciscontent) that combined provide the web hosting solution to CIS. Both servers are subject to normal UniSA requirements and reside with in the university network. Figure 1: CIS Web Environment provides an overview of the university environment and where cisweb and cis-content sit with in this environment. Both servers reside behind the university firewall with cis-web having rules for incoming web connections. Cis-web and cis-content are production servers, meaning changes to the servers will be tightly controlled and researched before being approved or rejected. These servers are not intended to be used as a development environment as they support critical web sites including the CIS and ACRC sites. Figure 1: CIS Web Environment Cis-web Cis-web is CIS s only outward facing ITEE IT managed server. Cis-web provides apache and php for websites and serves web content from cis-content. Cis-web is enabled to handle http and https requests and has a verified SSL certificate for sub domains of cis.unisa.edu.au. Cis-web is not designed for direct user logins and is only directly accessible by ITEE IT support. Cis-content Cis-content is host to all the CIS web content and MySQL databases and accessible by site owners and editors with their uninet credentials. Owners and Editors will be given access via a local group to the content and logs for their site. Although site content is located on cis-content it is executed on cis-web when a page is loaded. Cis-content is not accessible from outside the university and is purely a content server for cisweb. 2 BN : June 2010

3 MySQL Cis-content is host for numerous instances of MySQL which are each running many databases. This allows greater control over the databases hosted on cis-content and also for ITEE IT to provide segregation between ITEE IT managed instances and databases, site owner management of databases and course administered MySQL instances and databases. Each instance of MySQL runs on a unique port and has its own set of user tables and databases. Therefore users must ensure they are trying to connect to the correct MySQL instance for their database. This is achieved by specifying a socket file or port number in the connection string. When allocating a database for a website ITEE IT support will provide to the site admin all of the details on connecting to the database including usernames, passwords, socket file locations and port numbers. Applying for web hosting Once you have read and understood this document you need to fill out the CIS web Hosting form available from the Project web hosting page in the CIS Help Desk. 3 BN : June 2010

4 Frequently Asked Questions Q. Why is my PHP script having issues connecting to my MySQL instance? A. You need to specify the correct port number for your instance of MySQL in your connection string. Also you will need to check or, if you do not have permissions, have ITEE IT support check if the user you are trying to connect as has the correct access to the database. Q. Why can't I connect from the MySQL Client on my PC to the database? A. Although theoretically possible ITEE IT support has only tested and will only grantee a connection to the MySQL databases from cis-web for web sites or via the command line on cis-content for site editors. Q. Why won't my PHP scripts work on cis-content even though that is where my web content is hosted? A. Cis-content does not and will not have PHP installed. PHP is available from cis-web for serving web pages. Neither of these servers are a development environment; they are both production servers and only provide the infrastructure to support the serving of web sites. Users can test their sites and scripts but they must do so through normal use of the web server. Q. Can I have additional apache modules installed? A. You will need to raise a service call via itee-helpdesk@unisa.edu.au specifying the modules required and detailed reasons for these modules. You will need to also provide version numbers where appropriate. There is no grantee that your request will be approved as this is a production environment and all modules are tested to ensure there are no conflicts.. If your request is not approved an alternative solution will be negotiated. Q. Can I get additional ports open for my web application? A. You will need to raise a service call via itee-helpdesk@unisa.edu.au specifying the port and protocol required and detailed reasons for opening these ports. There is no grantee that your request will be approved as this is a production environment and network related requests are assessed by the University s Security and Identity Coordinator. If your request is not approved an alternative solution will be negotiated. Q. Can I get help with my code from the ITEE IT support? A. No, ITEE IT support will provide support for the infrastructure and software maintained and installed on the servers but will not provide support for your code. However we have included some code snippets in this document to get you started. Your supervisor, tutors, lectures and peers may 4 BN : June 2010

5 be of help to you in solving code related problems. Additionally you have access to the web logs for your site to help diagnose problems. 5 BN : June 2010

6 Code Snippets The following are snippets of code for use with CIS hosted websites. You will need to do further research to complete your configurations. The examples are not necessarily complete solutions and are intended as examples only unless explicitly stated otherwise. LDAP authentication To provide authentication via UniSA accounts to staff and students you need to authenticate using ldap. The following code will need to be placed in your.htaccess file in the directory you wish to secure or in your.htaccess file inside directory tags. Please read the apache documentation on.htaccess files for further information on the directives that are available to you. AuthBasicProvider ldap AuthType Basic Auth Name is just the description of authentication needed that the user will see in the authentication pop up in their browser, for example Staff only. Please provide your Uninet credentials. You will need to edit the text in quotations to be something meaningful in relation to your site and users, keep it brief and to the point. AuthName "Some Meaningful text here describing the authentication needed" The following 2 lines are the username and password for authentication to query LDAP. CIS IT support have provided the account and password. The following lines need to be exact. AuthLDAPBindDN cn=cisbind,ou=serviceaccounts,ou=cis,ou=iee,ou=staff,dc=uninet,dc=unisa,dc=edu,dc =au AuthLDAPBindPassword yhf-8kfu AuthLDAPURL is the location of the ldap server. In the university environment the ldap servers can be reached via uninet.unisa.edu.au and port The following line needs to be exact. AuthLDAPURL ldap://uninet.unisa.edu.au:3268/dc=uninet,dc=unisa,dc=edu,dc=au?samaccountn ame?sub?(objectclass=user) The following line can be repeated for as many groups as you need to authenticate. Groups need to be listed by their Active Directory distinguished names. The example below requires users to be in the CIS-AllStaff group. require ldap-group CN=CIS- AllStaff,OU=GROUPS,OU=Staff,DC=UniNet,DC=Unisa,DC=edu,DC=au 6 BN : June 2010