[ ISG home page ] [ who we are ] [ send us email ] [ search ] [ FAQ ]
Topics:
There are several course WEB services at UCB. Our recommendation to EECS instructors is:
In addition, if you wish to communicate on-line with the students and post password-protected content:
For a summary of the course WEB services at UCB, see WEB servers for courses below.
To edit the WEB pages, instructors logon to an Instructional UNIX login
server such as
Instructors and TAs may create a home page for a class, and we will add a
reference to it from the
list of courses
on the Instructional WEB site. The site files can be editted by
logging into the associated account on the Instructional UNIX computers
(
To login to the instructor account:
We will reset the UNIX "LDAP" password for instructors so they can login
to the UNIX account at a workstation in our labs as well as over the
network (using 'ssh' from UNIX or 'putty' from Windows). You need
this password to login to a course WEB site using the "Login..." buttons
under
http://inst.eecs.berkeley.edu.
Instructors and TAs can also use their own "SSH" passwords to login to
the instructor account. (This password does not allow you to login
at a workstation; you need the "LDAP" password for that.) You can
generate an SSH public key and send it to us so we can install your SSH
public key there.
We will install it in the instructor account (using
Please ask
inst@eecs.berkeley.edu
if you need help logging in.
Course WEB sites must meet several requirements:
Course WEB sites have a specific UNIX directory structure:
To support these requirements, authors of course WEB sites should follow
these practices:
The WEB files for each semester should be stored under public_html
in a subdirectory that has a standard 4-char lowercase name such as
fa04, su04 or sp05.
(The definition is [fa|sp|su][0-9][0-9].)
This is required for the automated maintenance of these sites.
For directories, the "1"s in "711" set the execute ("x") bit but not the
read ("r") bit. The "x" bit on a directory allows access to a
specific file within the directory, but it does not allow a listing of
all the files. By default, the WEB server looks for an "index.html"
file and can read that under "711", but it can't list the directory if
there is no "index.html" file.
For ways to add security, please
see Restricting Access to your WEB Site below.
Note that old WEB sites may contain homework solutions or other information
that the current instructor may not wish to reveal. In that case, we
recommend that the current instructor block access to the old WEB site with
a UNIX command such as
Adding links to Class newsgroups:
Basic Class WEB page:
The EECS Instructional WEB server:
EECS Instructional Support
manages computer accounts for EECS courses. These are known as
instructor or master accounts. The instructor accounts
on our UNIX computers store the files that are displayed via the EECS
Instructional WEB server
(http://inst.eecs.berkeley.edu).
cory.eecs.berkeley.edu using
SSH,
or at a workstation in an
Instructional UNIX lab.
(inst.eecs.berkeley.edu does not allow direct logins.)
cory.eecs.berkeley.edu, etc) or by other
publishing techniques.
We encourage instructors to store their class WEB sites in the instructor's
UNIX account. That makes the WEB site accessible via
http://inst.eecs.berkeley.edu,
and it means we'll retain the data on tapes for the future. We store the
tapes for up to 5 years.
login to argus.eecs.berkeley.edu
type the command ~kevinm/bin/sshkey-maker
open the Putty program
generate a public key (see putty.doc)
email the public key to inst@eecs.berkeley.edu
/share/b/adm/bin/sshkey-installer) and respond to you.
Permissions to class WEB sites:
the "Spring 2005" site goes in ~cs123/public_html/sp05
the "Fall 2005" site goes in ~cs123/public_html/fa05
% cd ~cs164
% ls -lad public_html public_html/*
drwxr-xr-x 7 cs164 cs164 4096 Jul 13 16:16 public_html
-rwxr-xr-x 1 cs164 cs164 1229 Jul 8 11:44 public_html/index.html
-rwxr-xr-x 1 cs164 cs164 1205 Jul 13 16:07 public_html/archives.html
drwxr-xr-x 11 cs164 cs164 4096 Jul 13 16:12 public_html/fa04
drwxr-xr-x 12 cs164 cs164 4096 Jul 13 16:16 public_html/fa02
drwxr-xr-x 14 cs164 cs164 4096 Jul 13 16:14 public_html/sp04
drwxr-xr-x 9 cs164 cs164 4096 Jul 8 11:36 public_html/sp05
drwxr-xr-x 2 cs164 cs164 4096 Jul 8 11:43 public_html/fa05
-rwxr-xr-x 2 cs164 cs164 4096 Jul 8 11:43 public_html/fa05/index.html
~cs123/public_html/common
~cs123/public_html/sp05/common -> ../common
~cs123/public_html/fa05/common -> ../common
References would be relative, ie <a href='./common/lec1.pdf'>. That way,
it will be clear in the future that these files were outside of the
semester package, and the entire 'common' subdirectory could be copied
into the semester directory to make it work again elsewhere.
cp -rp ~cs123/public_html/sp05 ~cs123/public_html/fa05
and this UNIX command edits the file that redirects to it:
(echo ':g/sp05/s//fa05/'; echo ':x') | edit ~cs123/public_html/index.html
~cs123/public_html/fa05/index.html
could simply contain:
<META HTTP-EQUIV='Refresh' CONTENT='0;URL=http://myserver.berkeley.edu/~mysite'>
This index.html will remain unchanged on the Instructional server
in future semesters, so we will always have a reference to where
the WEB site was located.
You typically set the permissions with these UNIX commands, for example:
% chmod 711 public_html
% chmod 711 public_html/sp05
% chmod 755 public_html/index.html
% chmod 755 public_html/sp05/index.html
This allows everyone in the world to read those files, including
people who are using a WEB browser and those who are simply logged into
an Instructional computer. If you want users to be able to list the
files in a directory:
- run "chmod 755 directory-name" to set the read bit
- do not put an "index.html" file in the directory
chmod 500 ~cs123/public_html/fa04
You can include a WEB link to the class newsgroup with this HTML code
(using "cs152" as an example):
/share/b/pub/sample.class.html
is an HTML file that may be used as a template for a new home page.
Please notify the Instructional Group
(inst@eecs.berkeley.edu)
if you have a new class home page that you would like us to install.
WEB services for courses:
There are several UCB WEB servers that EECS instructors can use to post
course materials. Here is a summary.
|
A home page can be stored in a student's home directory on the Instructional UNIX computers and it will be accessible through the Instructional WEB server. (inst.eecs.berkeley.edu).
You can't login directly to the Instructional WEB server, so you should login to an Instructional UNIX login server such as cory.eecs.berkeley.edu or to a UNIX workstation in one of our labs. Then these commands
http://inst.eecs.berkeley.edu/~your-username(replace your-username with your own user name, of course).
See below for a more complete sample home page (formatted with HTML commands) that you could save as "index.html". The student's home directory, the "public_html" directory and the "index.html" file must all be world readable.
For example, for the user "jdoe" who has an Instructional account, this is how the directory and file permissions might look:
% cd ~jdoe/public_html % ls -al drwx--x--x 2 jdoe 512 Feb 2 10:38 ./ drwxr-x--x 42 jdoe 2560 Feb 2 10:37 ../ -rwxr--x-x 1 jdoe 2221 Feb 2 10:37 index.html
You can set the permsssions that way with these UNIX commands:
% chmod 711 ~jdoe ~jdoe/public_html % chmod 755 ~jdoe/public_html/index.html
You can set the permsssions for all files and directories under the "jdoe" public_html directory with these UNIX commands:
% find ~jdoe/public_html -type d -exec chmod 711 {} \;
% find ~jdoe/public_html -type f -exec chmod 755 {} \;
This will allow everyone in the world to read those files, including people
who are using a WEB browser and who are logged into any Instructional
computer. For ways to add security, see
Restricting Access to your WEB Site below.
The URL to access the home page would be:
http://inst.EECS.Berkeley.EDU/~jdoeThat URL can be used from any WWW client, such as Firefox, Internet Explorer and Lynx. Note that the EECS Instructional home page will not include references to individual student home pages, but students can request that service from the CSUA.
If you want users to be able to list a directory:
- run "chmod 755 directory-name" to set the read bit - do not put an "index.html" file in the directoryNote that the "1"s in "711" set the execute ("x") bit on the directories but not the read ("r") bit. The "x" bit on a directory does not allow a listing, but it does allow access to a specific file within the directory. By default, the WEB server looks for an "index.html" file and can read that under "711", but it can't list the directory if there is no "index.html" file.
|
|
% chmod 711 ~/public_html % chmod 755 ~/public_html/index.html
The timer before jumping is set by the "0" in this line:
|
|
% chmod 755 ~/public_html/archives.html
|
|
% chmod 711 ~/public_html % chmod 755 ~/public_html/index.html
The http://inst.eecs.berkeley.edu WEB server will display that file using the URL http://inst.eecs.berkeley.edu/~yourlogin.
You can see examples of other people's HTML code by selecting the "Page Source" option that is available in most WEB browsers. Many people use a graphical WEB page editor such as Netscape Composer or Microsoft FrontPage (see Publishing, below), but there is no shame in rolling up your sleeves and coding it by hand!
Your WEB site files are under the "public_html" directory in your UNIX home directory. Your file called "public_html/index.html" is your default home page on our WWW server (http://inst.eecs.berkeley.edu).
There are 3 ways create and update you WEB pages: edit on UNIX, edit on Windows and copy with FTP:
|
If you are getting an error message from a WEB page or CGI program that you are displaying via http://inst.eecs.berkeley.edu, you may find clues about the problem by searching for either your login name, the WEB page name or the program name in the Server Access and Error Logs.
Here are some common errror conditions and solutions:
"Internal Server Error" error
Login to a server such as torus.cs.berkeley.edu (a Solaris X86 system that is like inst.eecs) and run the CGI program on the UNIX command line. If you get an error, there may be a bug in your CGI (typically Perl) code.
If you created or copied your file on a Microsoft Windows system, the file may have newlines or other characters that don't work on UNIX. You can convert the Windows file to UNIX format with the UNIX command (for example):
dos2unix windows-file.cgi unix-file.cgi
Next, you can redirect the output to a file with commands such as
./unix-file.cgi >! test.html
chmod 644 test.html
and then read the "test.html" file as a URL via http://inst.eecs. If that file fails, then there is probably a bug in your HTML text output.
Finally, if your CGI is in Perl, you can get the WEB server to pass the real error message to the screen from your CGI program by using the "CGI" Perl module. Put these CGI lines at the start of your Perl program:
use CGI;
use CGI::Carp 'fatalsToBrowser'; # echo fatal error messages to browser
See http://search.cpan.org/author/JHI/perl-5.8.0/lib/CGI.pm for documentation about the Perl CGI module.
Be sure that the permissions on your CGI program and all directories above it are set with
chmod go+rx,go-w file_name
chmod go+x,go-w directory_name
That is readable and executable by the group and all other users but writable *only* by the owner. The restriction that it can't be group or world writable is a security feature of the Apache server. See Restricting Access to your WEB Site if you would like to set more restrictive permissions.
Also be sure that the owner of the HTML file or CGI program is the same as the owner of the WEB site. For example, in the URL http://inst.eecs.berkeley.edu/~jdoe/test.html, the file "test.html" must be owned by user "jdoe". This restriction is also a security feature of the Apache server.
To enable the "include" directive, the html file must have world-executable permissions. The UNIX command "chmod 755 *.html" will set those permissions on all files ending in "html" in the current directory. The UNIX command "/share/b/bin/fix-html" (on the Instructional systems) will update your entire Instructional WEB site with these permissions.
For example, if you have the files "index.html", "header.html" and "hello.cgi" in your public_html directory and you wish to include the html code from "header.html" and from "hello.cgi" in your "index.html" file, enter these lines in "index.html":
<!--#include virtual="header.html"--><!--#include cgi="hello.cgi"-->
and make "index.html" (and "hello.cgi") executable with the commnd:
% chmod 755 ~/public_html/index.html ~/public_html/hello.cgi
PHP commands can be run in 2 ways through the http://inst.eecs.berkeley.edu server:
To see the options that are configured into the PHP Apache module, go to: http://inst.eecs.berkeley.edu/~inst/php-info.php
#!/usr/local/bin/phpIt will invoke the 'suexec' module, and the commands in the CGI program will have permission to perform any operations that you are allowed to do (such as reading and writing files that are only accessible by you). For an example, run: http://inst.eecs.berkeley.edu/~inst/php-suexec.cgi
You cannot login directly to the inst.eecs WEB server, but you can test your /usr/local/bin/php programs on pentagon.cs, which is configured the same as on inst.eecs.
To see the options that are configured into the local PHP progam, see /usr/local/lib/php.ini.
"MySQL Functions" (includes mysql_connect, mysql_open, etc) "MySQL Functions (PDO_MYSQL)" (for MySQL v4.1.3 and above) "MySQL Improved Extensions" (for MySQL v4.1.3 and above)
Only the CGI method has permission to write a file into your home directory. The PHP source code for the 2 examples can be read from an Instructional UNIX account at:
~inst/public_html/php-info.php ~inst/public_html/php-suexec.cgiNote that there is a problem with mixing the .php and .cgi methods indiscriminantly. Session variables created by one method cannot be referenced by the other. This is because the /var/tmp/sess_... file created by session-variable used in a .php script has a different owner from the one created by a .cgi script. [thanks to Prof Hilfinger for this]
For basic instructions,
see
http://www.boutell.com/gd/manual2.0.11.html#basics
For more information,
see http://www.boutell.com/gd/.
For Perl and shell scripts, be sure the command on the first line exists on the WEB server. These are the most likely choices:
Perl scripts will generally run the same on the different UNIX operating systems, but compiled programs (such as in C++) will not.
CGI example:
Here is an example of simple CGI script called hello.cgi,
written in the csh shell and in Perl:
|
#!/bin/csh
echo "Content-type: text/html"
|
#!/usr/sww/bin/perl
print "Content-type: text/html\n\n";
|
Here are the UNIX commands to enable this script, located in the public_html/ directory of the user "jdoe":
% cd ~jdoe/public_html % chmod 755 hello.cgi % chown jdoe hello.cgi % ls -al hello.cgi -rwxr-xr-x 1 jdoe users 7682 Dec 1 10:10 hello.cgi
The URL to reach this CGI would be: http://inst.eecs.berkeley.edu/~jdoe/hello.cgi
Also, you can execute that CGI program from within an html file by inserting the line:
<!--#exec cgi="hello.cgi"-->
Processing forms with CGI scripts:
You can display a form on your WEB site and pass the user's data to a CGI
program. Here is an example of an HTML form
and CGI program.
Security with CGI scripts:
Debugging CGI scripts:
You cannot login directly to the inst.eecs.berkeley.edu WEB server,
so if you need to debug a problem with a CGI program:
If you are writing your scripts in Perl, please use /usr/sww/bin/perl, so it is the same version that you are using where you are testing it.
The CGI program will run with the permissions of the owner of the account through which it is accessed. All the files that the WEB server reads or runs must be world-readable or world-executable, since the WEB server runs as a generic unprivileged user. For a way to prevent local users from reading your WEB files, see Restricting Access to your WEB Site below.
There are security risks in running CGI scripts. For example, there was a security advisory for a guestbook CGI script about a hole that will allow anyone to run any command in your account as you. (You can prevent that by not allowing people to enter HTML messages, by turning off $allow_html in the script.)
<HTML> <META HTTP-EQUIV="Refresh" CONTENT="5;url=https://inst.eecs.berkeley.edu/~inst/SSLonly/index.html"> <HTML> This site will jump to a new site in 5 seconds.A benefit of this method is to display a timed message, warning people to update their bookmarks, etc.
RewriteEngine On RewriteBase /~inst RewriteRule ^(.*) http://foo.com/~bar/$1 [R,L] =permanentThis would rewrite any URL such as http://inst.eecs/~inst/somefile.html to be http://foo.com/~bar/somefile.html, regardless of what the "somefile.html" part of the URL is. This means that users can type any URL within your site and get through, which is not true with the META refresh method.
More info on this is in the Apache docs under mod_rewrite.
For more information about adding access control individual subdirectories, please see
Here is an example of UNIX commands to control access by computer to all the
files in a directory called "restricted". Access is resricted to the CS and
EECS subnets and a single computer on the HIP subnet (136.152.91). A
computer called "transcend.cs" is also excluded.
cd ~/public_html
ls -lad restricted
drwx--x--x 2 mylogin mygroup 5120 Feb 13 17:06 restricted
cd ~/public_html/restricted
ls -la .htaccess
-rw-r--r-- 2 mylogin mygroup 5120 Feb 13 17:06 .htaccess
Access to all files in the "restricted" directory will be limited to the
entries in .htaccess. Files in the directory should be readable
by everyone on the local computer. For example, for a file called
"private.html" in the ~/public_html/restricted directory, set the permissions
using:
Note that, to allow the Web server to read your files, the files in
~/public_html/restricted will be readable by anyone on any computer that
can access your home directory. This is true for all of your WWW-accessible
files.
Here is an example of UNIX commands to set up access controlled
by password to all the files in a directory called "restricted".
cd ~/public_html
ls -lad restricted
drwx--x--x 2 mylogin mygroup 5120 Feb 13 17:06 restricted
cd ~/public_html/restricted
ls -la .htaccess .htpasswd
-rw-r--r-- 2 mylogin mygroup 5120 Feb 13 17:06 .htaccess
-rw-r--r-- 2 mylogin mygroup 5120 Feb 13 17:06 .htpasswd
The {encrypted_passwd} can be generated using the program
/share/b/bin/passwd2crypt (on the Instructional UNIX systems) or our
.htpasswd File Generator.
WEB browser users will be prompted for a password if they access the directory,
and only the users listed in .htpasswd will be able to read any of
the files in the directory.
Note that, to allow the Web server to read your files, the files in
~/public_html/restricted will be readable by anyone on any computer that
can access your home directory. This is true for all of your WWW-accessible
files. For a way around this, see below,
Using a CGI script to restrict access by UNIX
file permissions.
The server is https://inst.eecs.berkeley.edu.
Information that you display publically via University computers may not
include the names of a student without an "informed consent" from the student.
Restricting access to WEB pages, say to the EECs or BERKELEY.EDU domains, is
not sufficient: informed consent is still required. This is a requirement
by federal law. An example of "informed consent" is:
Other topics:
Allow access only to certain computers:
To allow access only to certain computers, create the file .htaccess
in the desired directory under your ~/public_html directory. Access to all
files in that directory will be controlled by the .htaccess file.
UNIX command
Purpose
1.
mkdir ~/public_html/restricted
create the subdirectory
2.
cat > ~/public_html/restricted/.htaccess << EOF
<Limit GET>
order allow,deny
allow from cs.berkeley.edu eecs.berkeley.edu 136.152.91.1
deny from transcend.cs.berkeley.edu
</Limit>
EOF
create the .htaccess file
3.
chmod ugo=x,u+rw ~/public_html/restricted
chmod ugo=r,u+rw ~/public_html/restricted/.htaccess
set permissions, check the results
chmod ugo=rx,u+w ~/public_html/restricted/private.html
Access will be restricted to browsers being run on the "cs.berkeley.edu" and
"eecs.berkeley.edu" subnets and to the computer at address 136.152.91.1.
Allow access only to certain people:
You can add password protection to a WEB site by creating a file called
.htpasswd in the subdirectory that contains
the WEB page (under your ~/public_html directory).
UNIX command:
Purpose
1.
mkdir ~/public_html/restricted
create the subdirectory
2.
/share/b/bin/passwd2crypt
create an encrypted password
3.
cat > ~/public_html/restricted/.htpasswd << EOF
user1:{encrypted_passwd}
user2:{encrypted_passwd}
EOF
OR
go to our .htpasswd File Generator
create the .htpasswd file
4.
cat > ~/public_html/restricted/.htaccess << EOF
AuthType Basic
AuthName "My Restricted WEB site"
AuthUserFile /{full path to your home dir}/public_html/restricted/.htpasswd
Require valid-user
EOFcreate the .htaccess file
5.
chmod ugo=x,u+rw ~/public_html/restricted
chmod ugo=r,u+rw ~/public_html/restricted/.htaccess
chmod ugo=r,u+rw ~/public_html/restricted/.htpasswd
set permissions, check the results
Limitations of using .htaccess and .htpasswd files:
Using a CGI script to restrict access by UNIX file permissions:
chmod 755 index.html (executable, so WEB server can run 'include's)
chmod 700 maybePERL.cgi (only readable/executable by the owner)
chmod 600 file1.txt (only readable/writeable by the owner)
This will allow users to read the files through your WEB site, and
you can limit them by prompting for a password from your CGI program.
But users who are logged in directly onto our UNIX computers (such
as cory.eecs) will not be able to read the files.
Security using SSL:
SSLRequireSSL
Users who try to access any files in that directory through one of our
non-SSL unabled servers will get an "access denied" error.
AuthType Basic
AuthName "access is restricted to users on my list using SSL"
AuthUserFile /home/aa/staff/inst/public_html/restrict_demo/.htpasswd
Require valid-user
SSLRequireSSL
The last 2 lines make it ask for a password and require an SSL browser.
Instructions for creating the .htpasswd are in the
Allow access only to certain people section, above.
Usage Policies for Information Servers
"Informed Consent" Required for Displaying Student Identities
"I, (student name), consent to have my name posted on (webpage title &
url), a paper copy template of which is attached to this consent form.
My name may be posted on this webpage from (date) to (date). I understand
that my consent to have my name posted on this webpage is not a condition
of my participation in (name of the class), nor will it be used as a basis
for grading my performance therein."
Please refer to the Policy Analysts at the Office of the Registrar, 127 Sproul
Hall, for further clarification about the requirement for "informed consent".
General References about WWW utilities
These are public documents that have more about the WWW and the HTML
language used in writing home pages (these may not always be available):
Last modified: Tuesday, July 29, 2008
inst@inst.eecs.berkeley.edu