..a dose of zero-day know-hows ..

Showing posts with label mambo. Show all posts
Showing posts with label mambo. Show all posts

9/24/2007

How to Reset ALL Mambo 4.x - 4.6.x/Joomla 1.0.x-12 User Passwords in 1(10) Sweep(s)

This article explains how to assign an automatically generated passwords to Mambo 4.x/Joomla 1.0.x-12 User Database table. You will need PHPMyAdmin or a similar MySQL Client to be able to be able to execute the following.

Goal: Generate a new set of Passwords to All Mambo/Joomla Users and have a spreadsheet copy of this new set of passwords with corresponding usernames.

Note: The steps below aims to be verbose, so there are other possible ways to do this in a quicker way with less steps, but the broken down concept will always be similar to this,

Step 1.) Run this query (PHPMyAdmin recommended):

SELECT *, SUBSTRING(MD5(RAND()), -8) as password2 from mos_users;

Step 2.) Export the Results to an sql file (With Drop Database Option checked.)

NOTE: (To Export custom query results from PHPMyAdmin, use the "Export" button found in the "Query results operations" and NOT the "Export" link from the top tabs.)

Step 3.) Add a `password2` column to mos_users:

ALTER TABLE `mos_users` ADD COLUMN `password2` TEXT NOT NULL AFTER `params`;

Step 4.) Import the SQL File Generated from STEP 1 into mos_users table

Step 5.) Run the following query against mos_users table:

SELECT *, MD5(password2) as password3 from mos_users;

Step 6.) Export the Results to an sql file.

Step 7.) Add a `password3` column to mos_users:

ALTER TABLE `mos_users` ADD COLUMN `password3` TEXT NOT NULL AFTER `password2`;

Step 8.) Import the SQL File Generated from STEP 5 into mos_users table

Step 9.) Now drop the current password column

ALTER TABLE `mos_users` DROP COLUMN `password`;

Step 10.) Rename password3 column as password.

CHANGE COLUMN `password3` `password` TEXT NOT NULL;

NOTE: The `password 2 column is the unhashed plaintext 8 character passwords. You might want to jot the result of the following query down or save it as CSV for future reference:

SELECT username, password2 from mos_users;

The resultset from the query above will be the copy of username and unhashed passwords. Once copied, you can safely drop the password2 column by:

ALTER TABLE `mos_users` DROP COLUMN `password2`;

11/26/2006

Basic: Preparing Solaris 10 to run Mambo CMS

Brief Backgrounder on Solaris 10:

Solaris 10 is the latest OS offered by Sun Microsystems. Unlike its predecessors – Solaris 9 and previous releases, this version of Solaris is free for use with no restriction of any kind. It also has a twin named OpenSolaris which is essentially an exact replica except that it is available in source and as the named implies, yes OpenSolaris is open source. More info here and here.

Preparing Solaris 10:

Preparing Solaris 10 environment to run Mambo is basically having to set up Apache, MySQL and PHP environment and nothing else, as you might know the system requirements of Mambo is any system that can run certain versions of Apache, MySQL and PHP – click here for details. Solaris 10 is bundled with Apache 2 and MySQL 5 already, its just a matter of configuring these which we will discuss in detail later. PHP 5 is a little different story though as we will need a source distribution to compile this ourselves. PHP 5 needs to be a module for Apache, it has to support MySQL so bear with as we dig deeper.

Configuring Apache:

The configuration file for Apache should be located in “/etc/apache2/”. From a fresh installation it is named as httpd.conf-example under the same directory. You have to rename it to httpd.conf so Apache will recognize it.

# mv /etc/apache2/httpd.conf-example /etc/apache2/httpd.conf

Using your text editor (gedit or vi), edit httpd.conf to your liking, take note of the following directives as you may need to set this as neccessary:

ServerName – The IP address or hostname of your machine (ex. 127.0.0.1 or example.com)

Listen – the port where Apache will listen to (ex. 80)

Next, is invoke the terminal and enable the service using the following command:

# svcadm enable apache2

Test Apache by opening the browser and pointing it to http://localhost.

Note that depending with your Desktop GUI, invoking the Terminal is done differently. Under the Java Desktop System 3, you do this by right clicking the desktop and selecting Open Terminal. Under CDE, you do this by clicking the Tools menu (the arrow on top of Performance Meter) and clicking console.

Configuring MySQL:

The MySQL database tables need to be created 1st. It will be the physical representation of your would-be MySQL tables as you create them. Moreover, the physical storage for your MySQL databases. Invoke the terminal and do the following command:

# /usr/sfw/bin/mysql_install_db

You should see several messages. MySQL Daemon by default does not allow root to run it. In such case a user needs to be set up specifically to run the MySQL server. Proper permissions are also mandatory. Invoke the terminal and issue the following commands:

# groupadd mysql
# useradd –g mysql mysql
# chown root /var/mysql
# chgrp –R mysql /var/mysql
# chmod –R 770 /var/mysql

What the above commands do are:
  1. Creates a group called MySQL,

  2. Creates a User named MySQL and makes it a member for the MySQL Group,

  3. Sets the ownership of the MySQL data directory to root,

  4. Sets the group of the MySQL data directory to MySQL group and

  5. Sets Read write access for the Group and Owner designated to the MySQL data directory while leaving others with no access.

Next is to set the MySQL Configuration File: Using the terminal, create a copy of a sample MySQL configuration file to the /etc directory as follows:

# cp /usr/sfw/share/mysql/my-medium.cnf /etc/my.cnf

Now to start the MySQL Daemon, use the following command:

# cd /usr/sfw/sbin/
# ./mysqld_safe --user=mysql &

To set the MySQL Password, the following commands need to be executed:

# cd /usr/sfw/bin
#./mysqladmin –u root password new-password
#./mysqladmin –u root –h localhost password new-password

To start the MySQL Daemon automically when Solaris starts, you need to bootstrap the startup files to rcs.d, rc1.d, rc2.d and rc3.d under the /etc directory. Issue the following commands using the terminal:

# ln /etc/sfw/mysql/mysql.server /etc/rcS.d/k00mysql
# ln /etc/sfw/mysql/mysql.server /etc/rc0.d/K00mysql
# ln /etc/sfw/mysql/mysql.server /etc/rc1.d/K00mysql
# ln /etc/sfw/mysql/mysql.server /etc/rc2.d/K00mysql
# ln /etc/sfw/mysql/mysql.server /etc/rc3.d/S99mysql

Compiling PHP 5

If you have gone this far without errors - congratulations, but we are still at the half. Since we will need to compile PHP from source, we will need to set Solaris for compiling environment and will install a bunch of applications.

Note that the variable $PATH which is an array of location where Solaris searches for applications is not set properly on a fresh installation. Consider setting up your path as follows
On TCSH:
# setenv PATH {$PATH}: /opt/csw/bin:/usr/sfw/bin:/usr/dt/bin:/usr/css/bin
On SH:
# set PATH=$PATH:/opt/csw/bin:/usr/sfw/bin:/usr/dt/bin:/usr/css/bin
# export PATH

A default install of PHP requires the following:

  • gcc
  • make
  • flex
  • m4
  • autoconf
  • automake
  • perl
  • gzip
  • GNU tar
  • GNU sed

However a standard install of Solaris is already bundled with most of the listed above, what you'll need is only autoconf, automake and GNU sed, you can download them directly by invoking the following commands from the terminal (you should be in a directory where you intend to store the packages). The full is at http://www.sunfreeware.com/programlistintel10.html

# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/autoconf-2.60-sol-10-x86-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/8/automake-1.5-sol8-intel-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/sed-4.1.5-sol10-x86-local.gz

Note that the Automake version is for Solaris 8 but should also work, links to the Solaris 9 and 10 versions are dead on the time of this writing as reffered here.

Once you have downloaded the above packages, uncompress them using gunzip

# gunzip *.gz

Then install them using pkgadd -d

# pkgadd -d autoconf-2.60-sol-10-x86-local.gz
# pkgadd -d automake-1.5-sol8-intel-local.gz
# pkgadd -d sed-4.1.5-sol10-x86-local.gz

After successfully doing the steps above which have set up a compiling environment for PHP, there are still a few applications that needs to be installed similar to the procedure above. The following applications are needed for a fully functional and optimal Mambo installation later: Download the following files from http://www.sunfreeware.com/programlistintel10.html or use wget for direct download

# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/zlib-1.2.3-sol10-x86-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/xpm-3.4k-sol10-intel-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/freetype-2.2.1-sol10-x86-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/freetype-2.2.1-sol10-x86-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/fontconfig-2.2.98-sol10-intel-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/expat-1.95.5-sol10-intel-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/libiconv-1.11-sol10-x86-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/libpng-1.2.12-sol10-x86-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/jpeg-6b-sol10-intel-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/openssl-0.9.8d-sol10-x86-local.gz
# wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/curl-7.15.4-sol10-x86-local.gz
#wget ftp://ftp.sunfreeware.com/pub/freeware/intel/10/ncurses-5.5-sol10-x86-local.gz

Install the above application in exact order as downloaded to stay safe. Certain dependencies might not be fullfilled if installed in random..

..TO BE CONTINUED

11/25/2006

Setting up Mambo on Fedora Core 6

Brief Backgrounder on Fedora Core:

Fedora Core is a Linux Distro for basic servers pretty much how its commercial father(Red Hat) is (although it could{It is!} be a really great desktop OS too) . It is sponsored by Red Hat and is run by a "Board of Directors" composed of folks from the community and Red Hat itself called Fedora Project Board. Its one of the multi-disc'd linux distros where you'll find a full-pack of open source programs for various applications, and is pretty sleek and secure. More about it here

Now on Mambo:

Mambo like Fedora Core is provided as an open source software. It is a Content Management System (CMS) which in brief - lets you set up a basic site in minutes. It is a PHP/MySQL CMS. Key features are great WYSIWYG editor letting you in-line edit content, Articles are saved using yet another open source database (MySQL), and general lay-out that is governed by templates and is easily customizable plus lots more for you to find out. There are also add-ons you could plug it in with to expand functionality. It could be used as a catalogue, portal, virtual department store etc., at our company, we're even using as a access-based knowledgebase.. the possibility is limitless.

Fedora Core 6 and Mambo 4.6:

..got a Server OS and a CMS? combine them and you'll have your own site running and it will be a matter of getting a name for your IP, or if not, a development environment. This article will discuss only in brief, but if you as a reader wants a detailed explanation on something all you have to do is to post a comment.

Preparing Fedora Core 6 run Mamb0 4.6.1

All the required software to run Mambo 4.6.1 is bundled already with Fedora Core 6, so probably if you decided to install a Full Fedora Core 6 package, you don't have to worry about installing these using the Packager Manager or Yum. Basically if you have PHP, MySQL, and Apache on the server, then all you have to do is configure these. Let me outline a list of all required packages to get Fedora Core 6 operate PHP5, MySQL5 and Apache2 properly:
  • MySQL
  • httpd
  • libdbi-dbd-mysql
  • mod_pearl
  • mysql-connector-odbc
  • mysql-server
  • perl-DBD-MySQL
  • php
  • php-mysql
  • php-pecl-apc
  • unixODBC
  • libdbi
  • libdbi-drivers
  • mx
  • perl-BSD-Resource
  • perl-DBI
  • php-cli
  • php-common
  • php-pdo
Its not that many actually, basically its just to set up an Apache, MySQL, PHP and Pearl for Mambo under Fedora. You wont even have to download these one by one as listed. All you have to do is use Download Manager and check the key applications to install and Fedora will figure out the dependencies for you.

Supposing you installed Fedora Core using a standard set up. Invoke the Package Manager (from GNOME desktop) by clicking Applications -> Add/Remove Software. Install the following the applications and their optional packages if they are not checked:
  • Servers
    • MySQL Database
      • php-mysql
    • Web Servers
      • mod_perl
      • php_mysql
      • php
      • php_pecl_apc
The 1st level list is the Application Category, the 2nd level is the Application itself, while the third are the Optional Packages. Upon selecting an application by checking the corresponding checkbox, there are a number of optional packages that are already checked by default, you could leave them as is but you have to make additional optional packages available as outlined above. Make sure these Optional packages are installed as well together with the default ones upon application selection. Hit apply and let Package Manager figure out the dependencies for you. A few prompts and you'll get a confirmation when its done. It might take a while though.

Once through, invoke the terminal by clicking Applications -> Accessories -> Terminal. Start the MySQL and Apache Services using the following commands on the Terminal:
Start MySQL Daemon

Start Apache HTTPD Server


You can now download the latest Mambo Stable version from here. Depending on the format of the Mambo installer, you have to uncompress it on the "/var/www/html" folder which is the directory where Apache publishes files also termed as DocumentRoot. For ex. if you unzipped a folder named Mambo-4.6.1 under the /var/www/html directory, its live address would be http://example.com/Mambo-4.6.1. Otherwise, if you uncompressed the Mambo files directly to /var/www/html folder with no other folders, the live address would be http://example.com/ or http://localhost for local viewing.

NOTE: The default configuration of Apache 2 for Fedora Core 6 is to run the HTTPD instance under the user Apache. This means you will have to chown and chgrp the folder and files under the "var/www/html" to user apache using the following command:
Change user to Apache

Change group to Apache


This is of course after you have uncompressed the Mambo files under the directory above. Also, all files needs to be owned by user apache so the HTTPD server can serve them as content.

Open your browser and point it to http://localhost and you should see the Mambo installation page. For further details on installation click here. We try our best to periodically add and update content so bear with us or join to help.. ;)