Wednesday, October 17, 2007

Solution…(Contribute and mod_security)

I earlier mentioned, at this blog, the problem when you configure Adobe Contribute with a site running on an Apache server with mod_security rules enabled. You get the error message "cannot verify your connection information", even if all your settings are correct.

The mod_security rules block access to any folder called "TMP" and that is what Contribute is creating for its tests.

Here is the solution (please note the security warning at the end of this posting!):

  1. In GoLive, Dreamweaver or a text editor create a .txt file with the following content:
    SecFilterEngine Off
    SecFilterScanPOST Off

  2. Save the file as htaccess.txt.

  3. Upload it to your site's root folder.

  4. Through the FTP interface change the name to .htaccess (note the dot before the name, the entire name is a file extension!)

  5. Now configure your site with Contribute.

  6. When the configuration is done delete the .htaccess file from the server.

This technique will open you up slightly to hackers for approximately 2-3 minutes. I think you must have really bad luck to get hit during exactly those 3 minutes…but the decision is yours!

As far as I know this is the only solution to the Contribute and mod_security problem.

2 comments:

Anonymous said...

Cool. Not exactly what I was looking for but pushed me in the right direction. I was using a htacess file to redirect to a php page. I removed the htacess file, configured the replace it and I'm good. Thank you.

Anonymous said...

I know this thread is a bit old, but I was seeing the same issue and resolved it using a different approach. It seems that the “Contribute cannot verify your connection information” error is Contribute's "go to" error when anything bad happens. Thanks for the in-depth error message, Adobe. In my case, this was happening during the middle of a server migration. The issue was that Contribute basically asks for 3 pieces of information to get you started:

1. The web URL for you site (which should look like http://www.contributeisterrible.com
2. The method you wish to use to connect (Network, FTP, SFTP)
3. The path to your website (on a network, this might look like \\mywebserver.contibuteisterrible.com\wwwroot , whereas on an FTP/SFTP sever, you'd specify the name or IP of the SFTP/FTP server and provide a valid username and password)

Here's the kicker...Contribute seems to care FAR TOO MUCH about the IP addresses returned during this process. So, in my case (IP addresses have been changed to protect the innocent and all that good stuff), my website was still living on 192.168.10.100, but the site files I wanted to start editing were living on 192.168.10.150. Contribute won't allow this.

To see if this is your problem when trying to set up a connection, do the following:

1. Open a command prompt and ping your website's URL and see what IP is returned (in my example, that would be "ping www.contributeisterrible.com")
2. In the same command prompt, ping the server holding your files and see what IP is returned (in my example, that would be "ping mywebserver.contributeisterrible.com")
3. The IP's returned from steps 1 and 2 must be the same...if they aren't, Contribute won't connect to the site
4. If you're trying to set up an "FTP/SFTP" connection, you'll need to know the name of the server holding your web files...this may or may not be the same as the name of your FTP/SFTP server (in most cases, it isn't since many places separate FTP/SFTP away from web content and web application servers)

If for some legitimate reason the IP's are different (for example, you have a webserver with multiple NIC's or IP's, or you're in the middle of a server migration, or you just want to test something, or DNS is configured such that the web URL returns a different IP than the server name), you can rectify the difference by tweaking your HOSTS file (in Win7, it's at C:\Windows\System32\Drivers\etc). Just add entries similar to the following:

192.168.10.100 www.contributeisterrible.com
192.168.10.100 mywebserver.contributeisterrible.com

This will force your computer to see both the server share and the site URL at the same IP address and resolve the issue.

If this doesn't fix ya, well...sorry :(