Zope

kwa29@DJKWA ~/Zope/Zope-2.9.3> ./bin/mkzeoinstance.py /home/kwa29/Zope/Zope-2.9.3/zs14080 14080

mkzopeinstance.py --dir=

kwa29@DJKWA ~/Zope/Zope-2.9.3> ./bin/mkzopeinstance.py --dir=zc14180
kwa29@DJKWA ~/Zope/Zope-2.9.3> ./bin/mkzopeinstance.py --dir=zc14280

#<zodb_db main>
# Main FileStorage database
#    <filestorage>
#      path $INSTANCE/var/Data.fs
#    </filestorage>
#    mount-point /
#</zodb_db>

<zodb_db temporary>
    # Temporary storage database (for sessions)
    <temporarystorage>
      name temporary storage for sessioning
    </temporarystorage>
    mount-point /temp_folder
    container-class Products.TemporaryFolder.TemporaryContainer
</zodb_db>

<http-server>
  # valid keys are "address" and "force-connection-close"
  address 14180
  # force-connection-close on
</http-server>

# ZEO client storage:
#
<zodb_db main>
   mount-point /
   <zeoclient>
      server localhost:14080
      storage 1
      name zeostorage
      var $INSTANCE/var
   </zeoclient>
</zodb_db>

WARNING ZEO.zrpc (4955) CW: error connecting to ('localhost', 14080): ECONNREFUSED

INFO Zope Ready to handle requests

yum install httpd mod_ssl mod_python mod_security mod_dav_svn

##
## Server-Pool Size Regulation (MPM specific)
##

# prefork MPM
# StartServers: number of server processes to start
# MinSpareServers: minimum number of server processes which are kept spare
# MaxSpareServers: maximum number of server processes which are kept spare
# ServerLimit: maximum value for MaxClients for the lifetime of the server
# MaxClients: maximum number of server processes allowed to start
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule prefork.c>
StartServers       8
MinSpareServers    5
MaxSpareServers   20
ServerLimit      256
MaxClients       150
MaxRequestsPerChild  4000
</IfModule>

# worker MPM
# StartServers: initial number of server processes to start
# MaxClients: maximum number of simultaneous client connections
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadsPerChild: constant number of worker threads in each server process
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule worker.c>
StartServers         2
MaxClients         150
MinSpareThreads     25
MaxSpareThreads     75
ThreadsPerChild     25
MaxRequestsPerChild  0
</IfModule>

#
# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports, in addition to the default. See also the <VirtualHost>
# directive.
#
# Change this to Listen on specific IP addresses as shown below to
# prevent Apache from glomming onto all bound IP addresses (0.0.0.0)
#

Listen 192.168.100.2:80
#Listen 192.168.100.2:443
#
LoadModule access_module modules/mod_access.so
LoadModule auth_module modules/mod_auth.so
LoadModule auth_anon_module modules/mod_auth_anon.so
LoadModule auth_dbm_module modules/mod_auth_dbm.so
LoadModule auth_digest_module modules/mod_auth_digest.so
LoadModule ldap_module modules/mod_ldap.so
LoadModule auth_ldap_module modules/mod_auth_ldap.so
LoadModule include_module modules/mod_include.so
LoadModule log_config_module modules/mod_log_config.so
LoadModule logio_module modules/mod_logio.so
LoadModule env_module modules/mod_env.so
LoadModule mime_magic_module modules/mod_mime_magic.so
LoadModule cern_meta_module modules/mod_cern_meta.so
LoadModule expires_module modules/mod_expires.so
LoadModule deflate_module modules/mod_deflate.so
LoadModule headers_module modules/mod_headers.so
LoadModule usertrack_module modules/mod_usertrack.so
LoadModule setenvif_module modules/mod_setenvif.so
LoadModule mime_module modules/mod_mime.so
LoadModule dav_module modules/mod_dav.so
LoadModule status_module modules/mod_status.so
LoadModule autoindex_module modules/mod_autoindex.so
LoadModule asis_module modules/mod_asis.so
LoadModule info_module modules/mod_info.so
LoadModule dav_fs_module modules/mod_dav_fs.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule negotiation_module modules/mod_negotiation.so
LoadModule dir_module modules/mod_dir.so
LoadModule actions_module modules/mod_actions.so
LoadModule speling_module modules/mod_speling.so
LoadModule userdir_module modules/mod_userdir.so
LoadModule alias_module modules/mod_alias.so
LoadModule rewrite_module modules/mod_rewrite.so

# Commenter pour eviter une attaque
LoadModule proxy_module modules/mod_proxy.so
#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
#LoadModule proxy_connect_module modules/mod_proxy_connect.so

LoadModule cache_module modules/mod_cache.so
LoadModule suexec_module modules/mod_suexec.so
LoadModule disk_cache_module modules/mod_disk_cache.so
LoadModule file_cache_module modules/mod_file_cache.so
LoadModule mem_cache_module modules/mod_mem_cache.so

# Déactivation du CGI
#LoadModule cgi_module modules/mod_cgi.so

#
# Load config files from the config directory "/etc/httpd/conf.d".
#
Include conf.d/*.conf

#
# ExtendedStatus controls whether Apache will generate "full" status
# information (ExtendedStatus On) or just basic information (ExtendedStatus
# Off) when the "server-status" handler is called. The default is Off.
#
#ExtendedStatus On
#
ServerAdmin djkwa29@xxxxxxx

#
# ServerName gives the name and port that the server uses to identify itself.
# This can often be determined automatically, but we recommend you specify
# it explicitly to prevent problems during startup.
#
# If this is not set to valid DNS name for your host, server-generated
# redirections will not work.  See also the UseCanonicalName directive.
#
# If your host doesn't have a registered DNS name, enter its IP address here.
# You will have to access it by its address anyway, and this will make
# redirections work in a sensible way.
#
#ServerName www.example.com:80
#ServerName kwa29.servebeer.com
#
# UseCanonicalName: Determines how Apache constructs self-referencing
# URLs and the SERVER_NAME and SERVER_PORT variables.
# When set "Off", Apache will use the Hostname and Port supplied
# by the client.  When set "On", Apache will use the value of the
# ServerName directive.
#
UseCanonicalName Off
#
# To enable a cache of proxied content, uncomment the following lines.
# See http://httpd.apache.org/docs-2.0/mod/mod_cache.html for more details.
#

<IfModule mod_disk_cache.c>
   CacheEnable disk /
   CacheRoot "/var/cache/mod_proxy"
</IfModule>
<IfModule mod_deflate.c>
    #SetOutputFilter DEFLATE
    DeflateFilterNote ratio

    BrowserMatch ^Mozilla/4 gzip-only-text/html

    # Netscape 4.06-4.08 have some more problems
    BrowserMatch ^Mozilla/4\.0[678] no-gzip

    # MSIE masquerades as Netscape, but it is fine
    # BrowserMatch \bMSIE !no-gzip !gzip-only-text/html

    # NOTE: Due to a bug in mod_setenvif up to Apache 2.0.48
    # the above regex won't work. You can use the following
    # workaround to get the desired effect:
    BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html

    SetEnvIfNoCase Request_URI \.(?:gif|jpe?g|png|Z)$ no-gzip dont-vary
    SetEnvIfNoCase Request_URI \.(?:exe|t?gz|zip|bz2|sit|rar|bin)$ no-gzip dont-vary
    SetEnvIfNoCase Request_URI \.pdf$ no-gzip dont-vary
    SetEnvIfNoCase Request_URI /(?:file|download)$ no-gzip dont-vary
    SetEnvIfNoCase Request_URI (?:image_large|image_medium|image_small)$ no-gzip dont-vary

    # Make sure proxies don't deliver the wrong content
    Header append Vary User-Agent env=!dont-vary
</IfModule>

LoadModule security_module modules/mod_security.so

<IfModule mod_security.c>
    # Turn the filtering engine On or Off
    SecFilterEngine On

    # The audit engine works independently and
    # can be turned On of Off on the per-server or
    # on the per-directory basis
    SecAuditEngine RelevantOnly
    # Make sure that URL encoding is valid
    SecFilterCheckURLEncoding On
    # Unicode encoding check
    SecFilterCheckUnicodeEncoding On
    # Only allow bytes from this range
    SecFilterForceByteRange 1 255
    # Cookie format checks.
    SecFilterCheckCookieFormat On
    # The name of the audit log file
    SecAuditLog logs/audit_log
    # Should mod_security inspect POST payloads
    SecFilterScanPOST On

    # Default action set
    #SecFilterDefaultAction "deny,log,status:406"
    SecFilterDefaultAction "deny,log,msg:'Common attacks',status:403"

    # Web Proxy GET Request
    SecFilter "^GET (http|https|ftp)\:/"
    # Web Proxy HEAD Request
    SecFilter "^HEAD (http|https|ftp)\:/"
    # Proxy POST Request
    SecFilter "^POST (http|https|ftp)\:/"
    # Proxy CONNECT Request
    SecFilterSelective THE_REQUEST "^CONNECT "
    # Only accept request encodings we know how to handle.
    SecFilterSelective REQUEST_METHOD "!^(GET|HEAD)$" chain
    #SecFilterSelective HTTP_Content-Type "!(^application/x-www-form-urlencoded$|^multipart/form-data;)"
    # Do not accept GET or HEAD requests with bodies
    SecFilterSelective REQUEST_METHOD "^(GET|HEAD)$" chain
    SecFilterSelective HTTP_Content-Length "!^$"
    # Restrict which request methods can be used
    #SecFilterSelective REQUEST_METHOD "!^(GET|HEAD|POST)$"
    # Restrict protocol versions.
    SecFilterSelective SERVER_PROTOCOL "!^HTTP/(0\.9|1\.0|1\.1)$"
    # Require Content-Length to be provided with every POST request.
    SecFilterSelective REQUEST_METHOD "^POST$" chain
    SecFilterSelective HTTP_Content-Length "^$"
    # Don't accept transfer encodings we know we don't know how to handle
    SecFilterSelective HTTP_Transfer-Encoding "!^$"

    ## -- PHP attacks --------------------
    SecFilterSignatureAction "log,deny,msg:'PHP attack'"
    # Possible code execution attack (targets valid PHP streams constructs)
    SecFilterSelective ARGS_NAMES "^php:/"
    # phpBB attack
    SecFilterSelective ARG_highlight "(\x27|%27|\x2527|%2527)"

    ## -- SQL Injection Attacks --------------------
    SecFilterSignatureAction "log,deny,msg:'SQL Injection attack'"
    # Generic
    SecFilterSelective ARGS "delete[[:space:]]+from"
    SecFilterSelective ARGS "drop[[:space:]]+database"
    SecFilterSelective ARGS "drop[[:space:]]+table"
    SecFilterSelective ARGS "drop[[:space:]]+column"
    SecFilterSelective ARGS "drop[[:space:]]+procedure"
    SecFilterSelective ARGS "create[[::space:]]+table"
    #SecFilterSelective ARGS "update.+set.+="
    SecFilterSelective ARGS "insert[[:space:]]+into.+values"
    #SecFilterSelective ARGS "select.+from"
    SecFilterSelective ARGS "bulk[[:space:]]+insert"
    #SecFilterSelective ARGS "union.+select"
    SecFilterSelective ARGS "or.+1[[:space:]]*=[[:space:]]1"
    SecFilterSelective ARGS "alter[[:space:]]+table"
    #SecFilterSelective ARGS "or 1=1--'"
    #SecFilterSelective ARGS "'.+--"

    # MySQL
    SecFilterSelective ARGS "into[[:space:]]+outfile"
    SecFilterSelective ARGS "load[[:space:]]+data
    SecFilterSelective ARGS "/\*.+\*/"

    ## -- Command execution --------------------
    SecFilterSignatureAction "log,deny,msg:'Command execution attack'"
    #SecFilterSelective ARGS_VALUES "^(uname|id|ls|rm|kill)"
    #SecFilterSelective ARGS_VALUES "^(ls|id|pwd|wget)"
    #SecFilterSelective ARGS_VALUES ";[[:space:]]*(ls|id|pwd|wget)"
    # Common windows extensions that could be bad, comment out what you can use
    SecFilterSelective REQUEST_URI "(\.cmd|\.bat|\.htw|\.ida|\.idq|\.htr|\.idc|\.printer|\.ini|\.pol|\.dat|\.cfg|\.idx|\.dll|\.inf|\.mdb|\.mde|\.msi|\.reg|\.scr)"

</IfModule>

LoadModule python_module modules/mod_python.so

# Override type-map handler for /var/www/manual
<Directory "/var/www/manual/mod/mod_python">
        <Files *.html>
                SetHandler default-handler
        </Files>
</Directory>

<LocationMatch /cgi-bin/trac\.f?cgi>
  &n