David Hrbáč » php http://www.hrbac.cz Just another WordPress weblog Tue, 17 Jan 2012 21:43:41 +0000 en hourly 1 DNSBL for Horde http://www.hrbac.cz/2011/01/dnsbl-for-horde/ http://www.hrbac.cz/2011/01/dnsbl-for-horde/#comments Wed, 05 Jan 2011 09:57:46 +0000 David Hrbáč http://www.hrbac.cz/?p=275 Here we go with a small patch to implement DNSBL for Horde. I have again used PEAR package, this time it is the Net_DNSBL, and as usually CentOS package is in my repos – http://fs12.vsb.cz/hrb33/el5/hrb/stable/i386/repoview/php-pear-Net-DNSBL.html.

The first patch is the important one. We let the attacker to log in, just to make sure he/she owns valid stolen credentials.

--- imp/lib/Auth/imp.php.orig   2011-01-05 10:21:05.224155622 +0100
+++ imp/lib/Auth/imp.php        2011-01-05 10:39:24.699438519 +0100
@@ -146,6 +146,36 @@
             return false;
         }
 
+        # DNSBL START
+        ini_set('include_path', ini_get('include_path').':/usr/share/php');
+        require_once 'Net/DNSBL.php';
+        $dnsbl = new Net_DNSBL();
+        #$remoteIP = '41.206.12.1';
+        $remoteIP = $_SERVER['REMOTE_ADDR'];
+        $dnsbl->setBlacklists(array(
+                'sbl-xbl.spamhaus.org',
+                'bl.spamcop.net',
+                'b.barracudacentral.org',
+                'spam.spamrats.com',
+                'dyna.spamrats.com',
+                'noptr.spamrats.com',
+                'bl.tiopan.com'
+                ));
+        if ($dnsbl->isListed($remoteIP, true)) {
+            $data=$dnsbl->getListingBls($remoteIP);
+            sort($data);
+            $entry = "LOGIN SUCCESS FROM BLACKLISTED IP [$remoteIP] FOR $userID: " . implode(", ", $data);
+            Horde::logMessage($entry, __FILE__, __LINE__, PEAR_LOG_ERR);
+
+            unset($_SESSION['imp']);
+            if (isset($prefs)) {
+                $prefs->cleanup(true);
+            }
+            $this->_setAuthError(AUTH_REASON_BADLOGIN);
+            return false;
+        }
+        # DNSBL END
+
         return true;
     }

The second one is just to log only access from blocked IPs.

--- imp/login.php.orig  2011-01-05 09:08:44.510891298 +0100
+++ imp/login.php       2011-01-05 10:34:26.763968526 +0100
@@ -449,6 +449,33 @@
     'var nomenu = ' . intval(empty($conf['menu']['always'])),
 ));
 
+# DNSBL START
+ini_set('include_path', ini_get('include_path').':/usr/share/php');
+require_once 'Net/DNSBL.php';
+$dnsbl = new Net_DNSBL();
+#$remoteIP = '41.206.12.1';
+$remoteIP = $_SERVER['REMOTE_ADDR'];
+$dnsbl->setBlacklists(array(
+        'sbl-xbl.spamhaus.org',
+        'bl.spamcop.net',
+        'b.barracudacentral.org',
+        'spam.spamrats.com',
+        'dyna.spamrats.com',
+        'noptr.spamrats.com',
+        'bl.tiopan.com'
+        ));
+if ($dnsbl->isListed($remoteIP, true)) {
+    $data=$dnsbl->getListingBls($remoteIP);
+    sort($data);
+    $entry = "BLACKLISTED IP $remoteIP: " . implode(", ", $data);
+    Horde::logMessage($entry, __FILE__, __LINE__, PEAR_LOG_ERR);
+} else {
+    $entry = "Not blacklisted ip $remoteIP" . implode(", ", $data);
+    Horde::logMessage($entry, __FILE__, __LINE__, PEAR_LOG_INFO);
+}
+
+# DNSBL END
+
 // ZMENA
 ini_set('include_path', ini_get('include_path').':/usr/share/php');
]]> http://www.hrbac.cz/2011/01/dnsbl-for-horde/feed/ 0 Captcha for Horde http://www.hrbac.cz/2010/12/captcha-for-horde/ http://www.hrbac.cz/2010/12/captcha-for-horde/#comments Wed, 15 Dec 2010 12:22:54 +0000 David Hrbáč http://www.hrbac.cz/?p=268 Here is small patch to implement captcha on Horde login page. We have implemeteded Text_CAPTCHA_Numeral. Package for Centos is here: http://fs12.vsb.cz/hrb33/el5/hrb/stable/i386/repoview/php-pear-Text-CAPTCHA-Numeral.html. Here is the patch.

--- horde-webmail-1.2.8.orig/imp/login.php	2010-10-25 17:10:05.000000000 +0200
+++ horde-webmail-1.2.8/imp/login.php	2010-11-30 17:36:27.571023703 +0100
@@ -398,6 +398,7 @@
     $t->set('user_vinfo', Horde::callHook('_imp_hook_vinfo', array('vdomain'), 'imp'));
 }
 $t->set('password_tabindex', ++$tabindex);
+$t->set('captch_tabindex', ++$tabindex);
 
 $t->set('change_smtphost', (!empty($conf['server']['change_smtphost'])));
 if ($t->get('change_smtphost')) {
@@ -446,7 +447,16 @@
     'var imp_auth = ' . intval($imp_auth),
     'var nomenu = ' . intval(empty($conf['menu']['always'])),
 ));
-echo $t->fetch(IMP_TEMPLATES . '/login/login.html');
+
+// ZMENA
+ini_set('include_path', ini_get('include_path').':/usr/share/php');
+
+require_once 'Text/CAPTCHA/Numeral.php';
+$numcap = new Text_CAPTCHA_Numeral;
+
+echo str_replace('Vysledek', $numcap->getOperation().' =', $t->fetch(IMP_TEMPLATES . '/login/login.html'));
+$_SESSION['answer'] = $numcap->getAnswer();
+//KONEC ZMENY
 
 if (!empty($recompose_data)) {
     /* Prepare recompose template. */
 
--- horde-webmail-1.2.8.orig/imp/redirect.php	2010-10-25 17:10:05.000000000 +0200
+++ horde-webmail-1.2.8/imp/redirect.php	2010-11-30 17:36:27.555023948 +0100
@@ -91,6 +91,14 @@
 require_once 'Horde/Maintenance.php';
 
 $actionID = (Util::getFormData('action') == 'compose') ? 'login_compose' : Util::getFormData('actionID');
+
+$captch = Util::getFormData('captch');
+if (isset($captch) && isset($_SESSION['answer'])) {
+    if ($captch != $_SESSION['answer']) {
+            _redirect(Auth::addLogoutParameters(IMP::logoutUrl(), AUTH_REASON_FAILED));
+    }
+}
+
 $autologin = Util::getFormData('autologin');
 $imapuser = Util::getPost('imapuser');
 $pass = Util::getPost('pass');
 
--- horde-webmail-1.2.8.orig/imp/templates/login/login.html	2010-10-25 17:10:05.000000000 +0200
+++ horde-webmail-1.2.8/imp/templates/login/login.html	2010-11-30 17:36:27.215029139 +0100
@@ -94,6 +94,12 @@
       <input type="password" tabindex="<tag:password_tabindex />" id="pass" name="pass" style="direction:ltr" />
      </td>
     </tr>
+    <tr>
+     <td class="light rightAlign"><label for="captch"><strong><gettext>Vysledek</gettext></strong></label></td>
+     <td class="leftAlign">
+      <input type="text" tabindex="<tag:captch_tabindex />" id="captch" name="captch" style="direction:ltr" />
+     </td>
+    </tr>
 
 <if:change_smtphost>
     <tr style="height: 1em;">
]]> http://www.hrbac.cz/2010/12/captcha-for-horde/feed/ 0 Benchmarking php with apc, memcached http://www.hrbac.cz/2009/09/benchmarking-php-with-apc-memcached/ http://www.hrbac.cz/2009/09/benchmarking-php-with-apc-memcached/#comments Wed, 23 Sep 2009 07:56:43 +0000 David Hrbáč http://www.hrbac.cz/?p=101 As we are very extensively using techniques to speed up web applications we build or host, I’d like to share some benchmarks. One of our clients is running site on our machines which is using SOAP/WSDL to get data. The application is extremely slow, result are very poor.

Apache is able to server this webapp within cca 23 pages per second, which is bad. Here are the ab results:

[root@webmel4 ~]# ab -n 400 -c 5 http://beta.somedomain.cz/
This is ApacheBench, Version 2.0.41-dev &lt;$Revision: 1.141 $&gt; apache-2.0
Copyright (c) 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Copyright (c) 1998-2002 The Apache Software Foundation, http://www.apache.org/
 
Benchmarking beta.somedomain.cz (be patient)
Completed 100 requests
Completed 200 requests
Completed 300 requests
Finished 400 requests
 
Server Software:        Apache
Server Hostname:        beta.somedomain.cz
Server Port:            80
 
Document Path:          /
Document Length:        45829 bytes
 
Concurrency Level:      5
Time taken for tests:   17.637183 seconds
Complete requests:      400
Failed requests:        0
Write errors:           0
Total transferred:      18473376 bytes
HTML transferred:       18348354 bytes
Requests per second:    22.68 [#/sec] (mean)
Time per request:       220.465 [ms] (mean)
Time per request:       44.093 [ms] (mean, across all concurrent requests)
Transfer rate:          1022.84 [Kbytes/sec] received
 
Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        6    6   0.2      6       9
Processing:   176  212  26.1    207     380
Waiting:      142  172  21.4    169     277
Total:        182  218  26.1    213     386
 
Percentage of the requests served within a certain time (ms)
  50%    213
  66%    221
  75%    225
  80%    230
  90%    252
  95%    272
  98%    290
  99%    325
 100%    386 (longest request)

We decided to implement memcached which means some small code rewrite, which is quite simple.  After that apache serves the pages within the 47 pages per second. Nice but still poor.

[root@webmel4 ~]# ab -n 400 -c 5 http://beta.somedomain.cz/
This is ApacheBench, Version 2.0.41-dev &lt;$Revision: 1.141 $&gt; apache-2.0
Copyright (c) 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Copyright (c) 1998-2002 The Apache Software Foundation, http://www.apache.org/
 
Benchmarking beta.somedomain.cz (be patient)
Completed 100 requests
Completed 200 requests
Completed 300 requests
Finished 400 requests
 
Server Software:        Apache
Server Hostname:        beta.somedomain.cz
Server Port:            80
 
Document Path:          /
Document Length:        11128 bytes
 
Concurrency Level:      5
Time taken for tests:   8.403883 seconds
Complete requests:      400
Failed requests:        0
Write errors:           0
Total transferred:      4579944 bytes
HTML transferred:       4455233 bytes
Requests per second:    47.60 [#/sec] (mean)
Time per request:       105.049 [ms] (mean)
Time per request:       21.010 [ms] (mean, across all concurrent requests)
Transfer rate:          532.13 [Kbytes/sec] received
 
Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        4    5   1.2      6      16
Processing:    45   98  40.8     88     249
Waiting:       37   81  34.0     73     218
Total:         51  104  40.7     94     253
 
Percentage of the requests served within a certain time (ms)
  50%     94
  66%    113
  75%    131
  80%    139
  90%    165
  95%    177
  98%    205
  99%    231
 100%    253 (longest request)

Finally we decided to add apc php cache. Speed up is quite better cca 130 pages per second.

[root@webmel4 ~]# ab -n 400 -c 5 http://beta.somedomain.cz/
This is ApacheBench, Version 2.0.41-dev &lt;$Revision: 1.141 $&gt; apache-2.0
Copyright (c) 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Copyright (c) 1998-2002 The Apache Software Foundation, http://www.apache.org/
 
Benchmarking beta.somedomain.cz (be patient)
Completed 100 requests
Completed 200 requests
Completed 300 requests
Finished 400 requests
 
Server Software:        Apache
Server Hostname:        beta.somedomain.cz
Server Port:            80
 
Document Path:          /
Document Length:        11128 bytes
 
Concurrency Level:      5
Time taken for tests:   3.70608 seconds
Complete requests:      400
Failed requests:        0
Write errors:           0
Total transferred:      4584288 bytes
HTML transferred:       4459266 bytes
Requests per second:    130.27 [#/sec] (mean)
Time per request:       38.383 [ms] (mean)
Time per request:       7.677 [ms] (mean, across all concurrent requests)
Transfer rate:          1457.69 [Kbytes/sec] received
 
Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        6    6   0.2      6       9
Processing:    21   31   8.2     30      83
Waiting:       14   23   7.9     22      76
Total:         27   37   8.2     36      89
 
Percentage of the requests served within a certain time (ms)
  50%     36
  66%     39
  75%     41
  80%     43
  90%     47
  95%     51
  98%     60
  99%     78
 100%     89 (longest request)

So, as you can see, there are ways to speedup the web apps not mentioning that the app itself can be better. We have seen the code and it seems to me that the programmer did not optimize anything within the code.

technologyrequests per secspeed
php22.68100%
php+memcachedphp47.6210%
+memcached+apc130.27574%

Benchmarks were run against CentOS 4.8 machine running:

httpd-2.0.52-41.ent.4.centos4
memcached-1.4.1-2.el4.hrb
php-5.1.6-3.el4s1.10
php-pecl-apc-3.0.19-1.el4.hrb
php-pecl-memcache-3.0.4-3.el4.hrb

You can find non distribution packages within my repos.

]]> http://www.hrbac.cz/2009/09/benchmarking-php-with-apc-memcached/feed/ 2