Awstats mod - uses dynamic pages (non static)

I hope someone is still looking into getting it working with suexec?

 

Since the update to 2.0.11 screwed up my test box due to some sort of db corruption which I still am yet to figure out why, I've moved to a new test server which now has suexec enabled and getting the same security errors you were originally getting.

PHP:

[2007-03-27 12:40:46]: uid: (10001/web24_georgev) gid: (10001/10001) cmd: awstats.pl
[2007-03-27 12:40:46]: command not in docroot (/home/admispconfig/ispconfig/web/ispc.awstats/awstats.pl)


So I'll be able to look into it now. I'm pretty sure we were almost getting it working on your machine. Just needed some more mods to it but now that it's been a while, I'd have to retrace our steps to get that far.

Will let you know when I worked out a suexec version or mods.

 

again line 119 of /root/ispconfig/scripts/shell/awstats.php

eh, ignore the subject i wasnt aware enough when reading your post .)

I have another question:
i'd like to use this way of awstats for another server without ISPconfig. How did you make that awstats.model.conf is taken as main configuration file? in default Awstats installation this file is ignored by default..

 

That's correct, I took advantage of that file not being processed by awstats as being a global config file and then created multiple site files which "Include" the master file (awstats.model.conf). this way I set all the defaults in awstats.model.conf and site specific in the site files.
when awstats runs, it looks inside the site files and then sees it need to use the awstats.model.conf file as well and does it even though it's used by all sites.

You just have to remember to remove settings that have been used in the site files from the awstats.model.conf otherwise you have duplicate entries.

 

I am processing our chat conversation logs to undo anything we did, but can you give me some hints what to delete that was done by the basic isntallation?

 

I don't know what was done. I remember created a new site or used your base site to run the cgi, without access or a copy of the httpd.conf etc. I have no idea now.

 

I know what we did, because I read throug hte chatlogs, I was asking about what the base install does, but I think I figured it out after reading through your install script...

 

new script is not creating conf.files!

Hello DJTREMORS,
please, have you tried functionality of new script?, i just created new webpage and /etc/awstats/*.conf file for the page wasnt created
(i started both cron scripts manually.. )
i have not installed whole thing , just unpacked "awstats.php"

so when i go to http://....../stats it's making message like :

Error: Couldn't open config file "awstats.www.soundsphere-punkers.com.conf" nor "awstats.conf" after searching in path "/home/admispconfig/ispconfig/web/ispc.awstats,/etc/awstats,/usr/local/etc/awstats,/etc,/etc/opt/awstats": No such file or directory

- Did you use the correct URL ?
Example: http://localhost/awstats/awstats.pl?config=mysite
Example: http://127.0.0.1/cgi-bin/awstats.pl?config=mysite
- Did you create your config file 'awstats.www.soundsphere-punkers.com.conf' ?
If not, you can run "/home/admispconfig/ispconfig/web/ispc.awstats/tools/awstats_configure.pl" from command line, or create it manually.

Check config file, permissions and AWStats documentation (in 'docs' directory).

 

its working

It was probably hallucination, it works now

there is only one weird thing, it makes conf files like

Include "/etc/awstats/awstats.model.conf"
LogFile="/var/www/web7/log/web.log"
SiteDomain="www.soundsphere-punkers.com"
SiteDomain="www.soundsphere-punkers.com"
AllowAccessFromWebToFollowingAuthenticatedUsers="web7_admin "

Why the line "SiteDomain is created twice ?

 

thanks for that. Don't know how I got duplicated lines added to the script but it's fixed now.

Edit the awstats.php script and remove the duplicate in line 142
vi /root/ispconfig/scripts/shell/awstats.php

PHP:

                if ( !@is_file($stats_path."/../awstats.".$web_real_name.".conf") ) {
                        exec( "echo 'Include \"/etc/awstats/awstats.model.conf\"' > /etc/awstats/awstats.".$web_real_name.".conf" );
                        exec( "echo 'LogFile=\"".$logfile."\"' >> /etc/awstats/awstats.".$web_real_name.".conf" );
                        exec( "echo 'SiteDomain=\"".$web_real_name."\"' >> /etc/awstats/awstats.".$web_real_name.".conf");
                        exec( "echo 'AllowAccessFromWebToFollowingAuthenticatedUsers=\"".$ht_user_list."\"' >> /etc/awstats/awstats.".$web_real_name.".conf");
                }
                $message .= exec("/home/admispconfig/ispconfig/web/ispc.awstats/awstats.pl -config=".$web_real_name." -Logfile=".$logfile." -update")."\n";



I don't think it would've caused problems as it's been working for me but I've still updated the current .tgz on my site.

 

root user

Thank you!

i have one more question .)
i'd like to have one user "root" added to each site, to allow administrator see the statistics. What should i do to have root added to
AllowAccessFromWebToFollowingAuthenticatedUsers="root webx_user..."
for each site automatically by script
?

 

I've modified and uploaded a new version which does implement admin passwords for all sites.

What you need to do is edit the awstats.php and add this line after the "if($verify == 0){" check

PHP:

if($verify == 0){

#
# Admin Password
#
# Set this to your admin password
$admin_username="";
$admin_password="";
if (empty($admin_password)|| empty($admin_username) )
        die("Set your admin username and password!\n");
$admin_password_crypted=crypt($admin_password);

$web_home = $path_httpd_root;

PS: remember to set a username and password or the script will not run and will error. I will most likely not add an admin if it's empty but it's 12am here and I have 4 hours before work.

then further down change the lines embedded below

PHP:

                     $user_password = exec("cat ".$mod->system->server_conf["shadow_datei"]." | grep '$user:' | grep -w $user |cut -f2 -d:");
                     $ht_file .= "$user:$user_password\n";
                     $ht_user_list.="$user ";
                   }
                   $ht_file .= "$admin_username:$admin_password_crypted\n";
                   $ht_user_list.="$admin_username ";
                } else {
                  //$ht_file .= "admin:\$1\$TAVCXZlv\$NAjnpdNgAfPMNT4/A61Z.0\n";
                  $ht_file .= "$admin_username:$admin_password_crypted\n";
                }

                unset($users);


take note the lines with $admin_username and $admin_password_crypted are what your looking for.

I've checked this and it works for me. Please test it for yourself and I highly suggest not to use "admin" as the user, too typical used and only a dictionary attack is needed as the user is already guessed.

 

Im getting the following error message:

Premature end of script headers: awstats.pl

Any idea why?
I've tried chmod 777 of /home/admispconfig/ispconfig/web/ispc.awstats/ or changing owner to www-data without success.

 

This usually means the script crashed out and/or has a bug. It's not necessarily means that it's a permissions problem.

check your website logs as it usually shows the error message in it. it should show something in the errors log file.

 

Yup.

This is the error.log saying:
[Fri Apr 06 23:29:38 2007] [error] [client x.x.x.x] Premature end of script headers: awstats.pl

I dont see any reason why it fails.

 

My only best guess is that it could be possible that some perl dependencies are missing for awstats would work.

can you try running this and see if it errors or just outputs the help usage screen?

PHP:

root@ispc:~ # perl /home/admispconfig/ispconfig/web/ispc.awstats/awstats.pl
----- awstats 6.5 (build 1.857) (c) 2000-2005 Laurent Destailleur -----
AWStats is a free web server logfile analyzer to show you advanced web
statistics.
AWStats comes with ABSOLUTELY NO WARRANTY. It's a free software distributed
with a GNU General Public License (See LICENSE file for details).

Syntax: awstats.pl -config=virtualhostname [options]

  This runs awstats in command line to update statistics of a web site, from
   the log file defined in AWStats config file (with -update option), or build
   a HTML report (with -output option).
.
.
.
.
etc.


what do you get?

 

Did you save awstats.pl with Unix linebreaks instead of Windows linebreaks?

 

he downloaded from a link on my website and not ftp. it's a sandbox he's deploying on so i doubt thats the issue.

if anything it's missing dependencies from perl or something similar which we'll find out if he can call it from command line or not.

hopefully get some answers.

now back to my Joomla deployment tool...

 

joomla

great, man!
you are working on everything i'd like to have on my server,
hope will contribute something back to you one day .)

 

can you please provide some quick details how to get rid of this isntall if I want to?

I tried the following:

- deleting of awstats files from /home/adminispcfg...
- deleting /etc/awstats/*
- removing the cronjob

still when trying to access either the old webalizer stats via: http://testdomain.com/stats I get redirected to a site trying to open the awstats... which of course fails.

I can't find this redirect :-( looked into /etc/apache2/apache2.conf and /etc/apache2/vhost/Vhostsfile.... and there is no redirect, also checked the .htaccess files, right now I have no clue what else to remove...

###edit###
found it, the redirect was here: /var/www/web1/web/stats/.htaccess