New-formula-starburst

How-To Update Ubuntu Servers to Close Ruby Vulnerabilities

4

It was announced the other day that some arbitrary code execution vulnerabilities were discovered in almost all production versions of Ruby out in the wild. I’m not sure how vulnerable your typical Ruby on Rails application servers would be, but I’m taking no chances. I run this blog, and all my other production sites on Ubuntu. Updating to the latest patched version of ruby was easy:

$ sudo apt-get install build-essential libssl-dev libreadline5-dev zlib1g-dev
$ wget ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p22.tar.gz
$ tar zxvf ruby-1.8.7-p22.tar.gz
$ cd ruby-1.8.7-p22
$ ./configure --prefix=/usr/local --with-openssl-dir=/usr --with-readline-dir=/usr --with-zlib-dir=/usr
$ make
$ sudo make install

And you’re done. The only sorta tricky part there is the ./configure command, which requires those options to tell the compiler to enable Readline and OpenSSL support which are most often needed in a Ruby on Rails environment. To check and make sure it’s working, type these commands and verify that the output looks like this:

$ which ruby
/usr/local/bin/ruby
$ ruby --version
ruby 1.8.7 (2008-06-20 patchlevel 22) [i686-linux]
$ ruby -ropenssl -rzlib -rreadline -e "puts :success"
success

Now, run your tests, restart mongrels, and you’re safe. Phew.

Trouble with Ruby 1.8.7 and Rails

2
I went to download a fresh copy of Ruby the other day, and noticed that they quietly released 1.8.7 and are promoting it as the recommended install now. I haven’t heard much about its compatibility with Rails, but I was curious about the performance enhancements backported from 1.9. So, I downloaded it … and …. bam!
\ FAILSAFE /!\  Thu Jun 12 21:50:31 -0700 2008
  Status: 500 Internal Server Error
  wrong number of arguments (2 for 1)
    /usr/local/lib/ruby/1.8/cgi/session.rb:267:in `respond_to?'
    /usr/local/lib/ruby/1.8/cgi/session.rb:267:in `initialize_without_cgi_reader'
    /usr/local/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/cgi_ext/session.rb:39:in `initialize'
    /usr/local/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/cgi_process.rb:130:in `new'
    /usr/local/lib/ruby/gems/1.8/gems/actionpack-2.0.2/lib/action_controller/cgi_process.rb:130:in `session'
........
A little Googling, and I discover that there is a subsequent patchlevel that addresses this problem. I downloaded 1.8.7-p17 and it seems to get past this one. To compile and install on my Mac:
tar zxvf ruby-1.8.7-p17.tar.gz
cd ruby-1.8.7-p17
./configure --enable-shared --enable-pthread CFLAGS=-D_XOPEN_SOURCE=1
make
sudo make install

So far that seems to work!

DreamHost Your Own Packages and Gems

29

UPDATE SEP 24, 2007: Almost a year later, this is by far the most popular article on my blog. Thanks to everyone who has contributed their feedback and helped make this guide really work. I have updated the article to reflect some new versions of some software and filled in a few holes that may have tripped some people up.

DreamHost has become a pretty popular choice for many people looking for a reliable Ruby on Rails host. I’ve been with DreamHost for about six months now, and I’d say they’re pretty stellar. This blog is hosted on DreamHost, as well as my Wamily project (while we’re in development and light testing—hopefully we’ll outgrow the shared host soon) and things are running well. They also offer a ridiculous amount of disk space and bandwidth for the price.

One of the best things about DreamHost is that they allow you to manage pretty much every aspect of your environment. You have the ability to log in to the server via SSH and compile and install any of your own packages or Ruby gems. DreamHost does have a centrally controlled version of most of the basic things (including Ruby and Rails), but a lot of times they’re a little slow on the upgrade path when the latest new versions come out.

For that reason, and also for practice when I really have to maintain my own server, I’ve decided to manage all of my own versions of Ruby, Rails, and most of my gems.

Here’s a quick how-to be a control freak on DreamHost after the fold …

Log In Using SSH

I use PuTTY for all of my SSH needs. Fire it up and connect to your domain using SSH. After you enter your password, you’re at your home directory (replace nateclark here with your username). Its worth mentioning that you should log in with the same username that your web application runs as (whatever you set in the DreamHost control panel when creating your domain).

[/home/nateclark]$ 

Create a Directory for Compiled Packages and Gems

To keep things neat, I created a directory called .packages under my home directory for any compiled packages. You could download and compile stuff right in your home directory, but that could quickly get cluttered. The . in front of the directory name makes it a hidden directory, so it won’t be listed in a regular ls command. You have to use ls -a to list all directories including hidden ones.

In my ~/.packages directory, I currently have installed my own versions of Ruby 1.8.6, Trac 0.10, Python 2.4.3, ImageMagick 6.3.0, Subversion 1.3.2 and a few other smaller things.

I also have a ~/.gems directory to store all of my own gems.

Set Up Your Paths

Ok, this is the important part—your path variables tell the shell where to look for executables and gems. We’ll set these up in your ~/.bashrc file, which is executed by bash for non-login shells. For regular login shells, you want to use the same path variables, and ~/.bash_profile sets this up. I’ve chosen to source ~/.bashrc at the end of ~/.bash_profile. For Linux newbies, ~ is a shortcut for your home directory.

My ~/.bash_profile looks like this:
# ~/.bash_profile: executed by bash(1) for login shells.

umask 002
PS1='[\h:$PWD]$ '
alias ll="ls -l" 
EDITOR="/usr/bin/vim" 
. .bashrc
And my .bashrc looks like this:
# ~/.bashrc: executed by bash(1) for non-login shells.

export TZ=EST5EDT # Sets my timezone to Eastern U.S. time
export LD_LIBRARY_PATH="$HOME/.packages/lib" 
export PATH="$HOME/.packages/bin:$HOME/.gems/bin:${PATH}" 
export GEM_HOME=$HOME/.gems
export GEM_PATH="$GEM_HOME:/usr/lib/ruby/gems/1.8" 

NOTE: Some people (including me) have had problems with Dreamhost’s shared gems conflicting with gems that you install locally. To force your environment to use ONLY your local gems and not the Dreamhost managed gems at all, change the last line above to:

export GEM_PATH="$GEM_HOME:/usr/lib/ruby/gems/1.8" 
Now that these paths are set, simply log out and log in again to get them to work. Or, you can just source the file at the prompt:
. ~/.bash_profile
To test if it worked, just echo your path. You should see something like this:
$ echo $PATH
  > /home/nateclark/.packages/bin:/home/nateclark/.gems/bin:/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/games
$ echo $GEM_PATH
  > /home/nateclark/.gems:/usr/lib/ruby/gems/1.8

The paths that point to your directories are listed first, and then the DreamHost shared location is next. Sweet.

Configure Your Rails Environment

In your Rails applications, you’ll also have to tell Rails where to look for your gems. Add this line to the top of your config/environment.rb, file:
ENV['GEM_PATH'] = '/home/nateclark/.gems:/usr/lib/ruby/gems/1.8'

Install Your Packages

Ok, now you’re ready to install your packages into your ~/.packages directory. You can do this just like you would manually compile a package normally, with the only difference that you need to use the --prefix=$HOME/.packages option when you configure. For example, here’s how I installed Ruby 1.8.6:

First, install readline. This is required if you ever want to use script/console on your Dreamhosted rails app.

$ cd ~/.packages
$ wget ftp://ftp.cwru.edu/pub/bash/readline-5.2.tar.gz
$ tar zxvf readline-5.2.tar.gz
$ cd readline-5.2
$ ./configure --prefix=$HOME/.packages
$ make
$ make install
Now, download and compile the latest version of Ruby:
$ cd ~/packages
$ wget ftp://ftp.ruby-lang.org/pub/ruby/ruby-1.8.6.tar.gz
$ tar zxvf ruby-1.8.6.tar.gz
$ cd ruby-1.8.6
$ ./configure --prefix=$HOME/.packages --with-readline-dir=$HOME/.packages
$ make
$ make install

Occasionally, Dreamhost will kill a process that is using a lot of CPU or memory and would be bogging down the server. A few times, they have killed my make command. If this happens, just run it again until it completes successfully.

Then, make sure you’re actually using the new version:

$ which ruby
  > /home/nateclark/packages/bin/ruby
$ ruby -v 
  > ruby 1.8.6 (2007-03-13 patchlevel 0) [i686-linux]

Update: Some of you had problems with gem. That’s cause I left out the part about installing rubygems. Oops.

$ cd ~/.packages
$ wget http://rubyforge.org/frs/download.php/20989/rubygems-0.9.4.tgz
$ tar zxvf rubygems-0.9.4.tgz
$ cd rubygems-0.9.4
$ ruby setup.rb config --prefix=$HOME/.packages
$ ruby setup.rb setup
$ ruby setup.rb install

Install Your Gems

Installing gems is just as simple as always. Since your $GEM_HOME is set, all your gems will go into the directory that you specified. For example, install your own version of Rails:
$ gem install rails --include-dependencies
And make sure that you’re using the right one:
$ which rails
  > /home/nateclark/.gems/bin/rails

Thats it! Now you can manage your own versions of pretty much any package, library or gem. Of course with that comes the responsibility of keeping everything patched and up to date.

Let me know if I’ve missed anything. Good luck.