SSL on alternative ports

There are penalties to trying to be too clever.

Having already set up an SSL VirtualHost for one client on my main PHP webserver, I decided to set up a second under a port other than the standard :443. This worked, and allowed for more than one SSL certificate to be used on that server without using additional IP's.

Unfortunately I soon began getting complaints from a few folks that the pages in question wouldn't load for them. Turns out several of them were coming from the same public library and another from a University account. So it appears that there are a significant number of people accessing sites from behind restrictive firewalls where SSL on an alternative port won't work.

Now I'll have to use additional IP's, something name-based VirtualHosting and HTTP 1.1 was designed to get around. Well, I tried. :-)

Net::UPS Patch

Perl is such a great environment because when you need to do something like develop an interface to the UPS XML services, and you start mucking around with LWP and wonder why their service doesn't expect POST to have key=>value pairs, you suddenly realize someone has written Net::UPS and the problem has already been solved.

The 0.4 version of Net::UPS, however, doesn't deal with the new "your prices may vary" warning UPS attaches to every query as a warning. The following simple patch, similar but somewhat simpler and more general, than one already submitted to the module's author, works to remedy the situation:

--- /usr/local/lib/perl5/site_perl/5.8.8/Net/UPS.orig Fri Jan 12 20:56:28 2007
+++ /usr/local/lib/perl5/site_perl/5.8.8/Net/UPS.pm Fri Jan 12 20:54:10 2007
@@ -307,7 +307,10 @@
KeyAttr => [],
ForceArray => ['RatedPackage', 'RatedShipment']);
if ( my $error = $response->{Response}->{Error} ) {
- return $self->set_error( $error->{ErrorDescription} );
+ $self->set_error( $error->{ErrorDescription} );
+ if ( $error->{ErrorSeverity} eq 'Hard' ) {
+ return $self->set_error( $error->{ErrorDescription} );
+ }
}
my @services;
for (my $i=0; $i < @{$response->{RatedShipment}}; $i++ ) {

One last OpenBSD/qmail thought for the night...

As mentioned here http://forum.qmailrocks.org/showthread.php?t=3205 and probably other places I didn't find when searching, there is an nosuid entry which prevents setuid programs from operating under the /var directory. This could be disabled; I got around it by moving the entire /var/qmail directory

mv /var/qmail /usr/local/qmail
ln -s /usr/local/qmail /var/qmail

Also useful...

cr.yp.to seems to be unreachable tonight. A couple mirror links for application downloads:

http://blogs.sun.com/BableOn/entry/virtual_email_server_qmail_vpopmail

http://public.www.planetmirror.com/pub/djbdns/daemontools/?fl=

had to stick this somewhere to remember it...

Shell script to set up qmail users in OpenBSD 4.0

#!/bin/sh

groupadd nofiles
useradd -G nofiles -d /var/qmail/alias -s /nonexistent alias
useradd -G nofiles -d /var/qmail -s /nonexistent qmaild
useradd -G nofiles -d /var/qmail -s /nonexistent qmaill
useradd -G nofiles -d /var/qmail -s /nonexistent qmailp
groupadd qmail
useradd -G qmail -d /var/qmail -s /nonexistent qmailq
useradd -G qmail -d /var/qmail -s /nonexistent qmailr
useradd -G qmail -d /var/qmail -s /nonexistent qmails