[webdev] aolserver notes

[Tom Hull <thull@xxxxxxxxxxx>]

I'm most of the way through installing aolserver-3.4.2 on the test
box. A couple of notes thus far:

 * My previous installs have been 3.3.1. Not a lot of difference
   thus far. There's also a 4.X that looks a little unripe; I'm
   not sure openacs is really past 3.3.

 * The aolserver.com website has been moved to sourceforge.net,
   which has resulted in a number of glitches in the doc. Beware.

 * There is a fork of aolserver, cf. http://www.opennsd.org/
   This was created by openacs people, but doesn't appear to
   have made a lot of progress. At some point someone ought
   to compare these, but right now it doesn't look promising.

 * The SSL question: This is normally handled by a plug-in module
   called nsssl. Unfortunately, nsssl depends on something called
   BSAFE, a product from RSA Security. I don't have it, so wasn't
   able to build it. Some doc says that aolserver.com has binary
   modules that we can download, but they don't seem to have made
   the transition to sourceforge.net.

 * There is also an alternative called nsopenssl. I have the code
   for it, but haven't done anything with it yet.

 * Virtual hosting: there's a module called nsvhr, which is
   mentioned in the doc but not on aolserver.com. However,
   there is a howto at:

     http://www.theashergroup.com/tag/articles/nsvhr/

   I haven't spent enough time to get a handle on this. (There
   is also something called vhost; they also make a passing
   comment about squid, a program I know nothing of, but it
   seems like one of the main reasons for having a proxy server
   would be to mux multiple webservers.)

   Also, note that apache and aolserver can both run on the
   same machine; the problem is which one gets to listen to
   port 80. You should be able to configure aolserver to run
   on some other port, then enter the port number in the first
   url you use to get to the server, and keep that port for
   all of the internal links in the website. Which is probably
   the cheapest way just to rig something up for local testing.

 * This url also has a note on using ssh for nscp (the control
   port used for debugging). I've never used nscp, but it seems
   like it could be real useful.

 * One thing that the doc mentions that I'm not planning on
   doing anytime soon is chrooting aolserver. Something to
   look into later, but for now it seems likely to introduce
   more problems than it's worth.

 * Haven't gotten to openacs yet, but one question that will
   crop up (soon) is whether to store user passwords in plain-
   text or encrypted. Not sure what all the issues are, but
   the real question is whether it's possible to get the
   plaintext back from the encrypted, since we will surely
   have to be able to remind users of their forgotten
   passwords. If anyone can research this, that would be
   a big help.

More later.

-- 
/*
 *  Tom Hull * thull at kscable.com * http://www.tomhull.com/
 */