Percussion CM System (Rhythmyx) and SQL Server Express on Amazon EC2

I am in the process of installing Percussion Rhythmyx 7.0.3 on an EC2 instance in Amazon's AWS cloud. This is a running log of the process that should serve as a how-to for even the most novice Percussion admin.

Amazon AWS EC2 AMI
I created a medium instance using the AMI with Windows Server 2008 R2 Datacenter Ed, IIS and SQL Server Express pre-installed. (Anything smaller than medium will be very slow.)

Windows_Server-2008-R2_SP1-English-64Bit-SQL_2008_R2_SP2_Express-2013.07.10 (ami-86c6baef)

I reserved 40gb storage for the primary drive. (This may have been shortsighted.)

Configure the Amazon Firewall
These are my firewall settings:


Port 80 is open to the world. The rest are locked down to the IP address of my machine at home.
Ports 20-22 are for FTP/sFTP.
Ports 1024-2048 are the fixed range for passive FTP connect mode.
Port 1433 is SQL Server
Port 3389 is Remote Desktop
and 9992-9998 is for CM System.
The read-me notes say that the 6 sequential ports after the main CM port are reserved.



Create the Database
To install CM System to SQL Server Express, you have to first create an empty database for the installer to use.
The SQL Server Management Studio is installed with dbo rights for the administrator, so just login with windows authentication.


Right click on [Databases] in the tree and choose [New Database...]. I called my database "rxMaster".


Since this is a test instance, I like to restrict the log file growth so it doesn't grow out of control...


and I set auto shrink to true under options.


Click [OK] to create.

Create the Percussion User and Set Permissions
Since this is for test use, these permissions are going to be wide open. Please lock everything down for production use.

Open [Security] in the Object Explorer tree and right click on [Logins]. Choose [New Login...]


Under the General tab, I used the login name "Percussion". Choose "SQL Server Authentication" and enter a password. Uncheck "Enforce password policy" to keep the password from expiring. Finally, choose "rxMaster" as the default database.


Under User Mapping, check "rxMaster" under "Users mapped to this login:" and in the default column, type "dbo". Choose "db_owner" for the "Database role membership for: rxMaster".


Click [Ok] to create the user

Enable SQL Server Authentication
I have heard that mixed-mode authentication with SQL Server poses security problems, but I was unable to get CM to install using a local Windows account.

Right click on the server (the topmost node in the object explorer) and choose [Properties]. Click the radio button beside "SQL Server and Windows Authentication mode"




Windows Firewall on the Windows Server
The Windows Firewall on this AMI should already be configured to allow SQL Server to operate... but it doesn't hurt to double check that it is allowed. (I am not sure whether this affects local app to app communications.)


In order to reach your installation from outside the server, create an inbound rule to allow TCP ports 9992-9998. To create this rule, double click [New Rule] on the upper right hand corner of the "Windows Firewall with Advanced Security"


SQL Server Configuration Manager
These steps are very important. If these options are not set, you will get the dreaded generic "Failed to establish connection to the database" error.

Under [SQL Native Client 10.0 Configuration] --> [Client Protocols], ensure that TCP/IP is Enabled. (It is by default in this AMI)


Under [SQL Server Network Configuration] --> [Protocols for MSSQLSERVER] ensure that TCP/IP is Enabled. (It is by default in this AMI.)


Double click TCP/IP above and ensure that [Listen All] is "Yes". (Again, it is by default in this AMI)

INSTALL PERCUSSION CM SYSTEM 7.0.3

Follow the Percussion Installation Guide until you get to the Repository setup.
note: I chose not to install FastForward.
For SQL Server Express, this is how your entry should look:

If you receive the "Failed to establish connection to the database" error when clicking [Next], double check all of the preceding instructions.

Choose rxMaster as the Database


Accept the remaining defaults. Continue past the port warning.
When the installation is complete, click [Done]


I received no error messages, so this is the end of the install. Consult the Installation Guide p.52 to see what warnings and errors look like.

Starting CM System

CM System creates an auto-start windows service to run the CM server, but the server does not start automatically after install.The Rhythmyx Administration Manual covers the start-up process.

In Windows Services, find the entry "Percussion Rhythmyx Server". Right click and [Start]


A message will pop up saying a program is trying to display a message:


Click [View the message] if you want to see the console window while CM system starts up.
If everything runs properly, you should see the JBoss started message at the bottom:


Logging Into CM System 
On the rhythmyx server, you should be able to reach the login prompt here:
http://127.0.0.1:9992/Rhythmyx/

Use the default username and password credentials: admin1/demo
The password demo can be used for all of the default accounts.

Note: The usernames and passwords are stored as plain text in the database. For testing this is fine, but for production, use LDAP or some other authentication method.

Install Java
After logging in for the first time, you will be prompted to download and install Java 1.5.0_12. I tend to stick with this version unless other development efforts require a more recent version. As I have upgraded through the years - especially early versions of 1.6.0_xx, I had strange security problems and other compatibility problems crop up. Of course, being out of date, this version is vulnerable to exploits...

Note: If you run into bizarre problems, ensure that you do not have multiple versions of Java installed.

Installation Complete!
Once Java is installed, you are ready to start building your sites


Questions or comments are welcome!

[Edit 8/29/2013 to include server-side Windows Firewall configuration step]
[Edit 11/12/2013 I had an interesting side conversation with S.A. that I thought might be useful for others. An edit of the conversation is provided below.]

Hi Brain. I like to thank you for your blog post on installing Percussion CM on Amazon cloud. I have a couple of questions. Do I need a licensed copy of Percussion or is there a trial available? Also do you know if there is an Amazon ec2 instance that comes with Percussion already installed?
S.A. • Oct 22, 8:25 AM

I am not aware of an EC2 instance with Percussion pre-installed. And no... [as far as I know] They don't offer a demo version of CM System... [When I contacted them, I was told that I had to buy a $5000 developer license for CM system.]
Brien Oct 23, 2:46 AM

Hey thanks for the message. I did download CM1, and tried to install it on an AMI. I am stuck on an error message about Rhythmyx not being available. You don't think I am running into a license issue do you? The install wizard did not prompt me for a license. I think I am little confused about the products they offer. There is CMS, CM1, Rhythmyx. You seem to know quite a bit about them. What is the difference between these products?
S.A. • Oct 23, 5:08 AM

Their product lines are indeed confusing. Once upon a time, they only produced one content management system called Rhythmyx. A few years ago they changed the name of Rhythmyx to CM system. They simultaneously released a new product line called CM1, which is a light version of CM system intended for smaller businesses.

Make sure that Windows firewall is configured to allow all of the ports that I mentioned in my blog. I believe CM1 uses MySQL by default. Make sure that it is running and reachable. [That is the only thing I can think of to check. I made this post while re-tooling my skill set for a project bid that fell through, so I'm afraid I have stopped my re-discovery of Percussion for now.] Percussion has a very active forum full of helpful people. If you have not already, join that forum and post your questions there.
Brien Oct 23, 12:06 PM

It's 2013... Time to Cancel my MySpace Account

Time to say goodbye to MySpace? Go here: https://new.myspace.com/settings/profile

I'm in the process of tidying my online presence. Imagine my surprise when out of nowhere, my ancient, disused MySpace profile drifted into the top ten of natural search results for my name! I suppose this is a sign that MySpace is improving its overall visibility as a social network since their relaunch in June 2013. Good for them! Still, I have my hands full with Facebook, LinkedIn, Twitter and Google+, so it is time to say goodbye.

The new look is very inviting. I wish I were interested enough to ride the learning curve, but I just want to cancel my account.

I spent a few minutes clicking around, looking for the exit before turning to Google. Most of the "cancel myspace account" results on Google like were for the old layout. Fortunately, I found "Delete Your Account" on AskMySpace.com

The page is pretty short, but if you just want to cut to the chase, you can delete your account here:
https://new.myspace.com/settings/profile

No hard feelings, MySpace. Maybe we'll hook up down the road.

ColdFusion Publishing on Demand from Subversion to Load Balanced Coldfusion Servers

As with previous blogs, this entry is a note-to-self that I thought others might find useful.

[Edit: Jan 16, 2012 Good grief... I wrote this in 2009 and left it in draft because I didn't complete the last 5% of the post. *shakes head*]

This is our web production environment.

We develop on our local machines and stage on a common internal server in California. Code revisions are stored on a subversion server (VisualSVN Server) located in our DMZ. Our production environment consists of two load-balanced ColdFusion servers hosted by Rackspace in Dallas, TX.

Our publication process is simple:

1. Export from svn to a temp folder on Prod1.
2. Backup Existing Production copy, and rename temp folder to production folder. 
3. Synchronize Prod1 with Prod2.

The tedium of doing this process manually pushed me to automate. I am not familiar with Ant, so I turned to DOS batch files. 

Step1: Export from Subversion

Slik Subversion: Windows Command-Line SVN

Working with batch files means finding tools that support command-line operation. I found Slik Subversion, a free full-featured windows command line client for svn. The help file was very useful in building the export command I needed:

C:\Program Files\SlikSvn\bin>svn help export
export: Create an unversioned copy of a tree.
usage: 1. export [-r REV] URL[@PEGREV] [PATH]
       2. export [-r REV] PATH1[@PEGREV] [PATH2]

  1. Exports a clean directory tree from the repository specified by
     URL, at revision REV if it is given, otherwise at HEAD, into
     PATH. If PATH is omitted, the last component of the URL is used
     for the local directory name.

  2. Exports a clean directory tree from the working copy specified by
     PATH1, at revision REV if it is given, otherwise at WORKING, into
     PATH2.  If PATH2 is omitted, the last component of the PATH1 is used
     for the local directory name. If REV is not specified, all local
     changes will be preserved.  Files not under version control will
     not be copied.

  If specified, PEGREV determines in which revision the target is first looked up.

Valid options:
  -r [--revision] ARG      : ARG (some commands also take ARG1:ARG2 range)
                             A revision argument can be one of:
                                NUMBER       revision number
                                '{' DATE '}' revision at start of the date
                                'HEAD'       latest in repository
                                'BASE'       base rev of item's working copy
                                'COMMITTED'  last commit at or before BASE
                                'PREV'       revision just before COMMITTED
  -q [--quiet]             : print nothing, or only summary information
  -N [--non-recursive]     : obsolete; try --depth=files or --depth=immediates
  --depth ARG              : limit operation by depth ARG ('empty', 'files',
                            'immediates', or 'infinity')
  --force                  : force operation to run
  --native-eol ARG         : use a different EOL marker than the standard
                             system marker for files with the svn:eol-style
                             property set to 'native'.
                             ARG may be one of 'LF', 'CR', 'CRLF'
  --ignore-externals       : ignore externals definitions

Global options:
  --username ARG           : specify a username ARG
  --password ARG           : specify a password ARG
  --no-auth-cache          : do not cache authentication tokens
  --non-interactive        : do no interactive prompting
  --trust-server-cert      : accept unknown SSL server certificates without
                             prompting (but only with '--non-interactive')
  --config-dir ARG         : read user configuration files from directory ARG
  --config-option ARG      : set user configuration option in the format:
                                 FILE:SECTION:OPTION=[VALUE]
                             For example:
                                 servers:global:http-library=serf

Since this code will be executed by SYSTEM, I need to explicitly pass the username and password. I want to make sure svn doesn't throw any user prompts (--non-interactive) and it should overwrite anything that is already there (--force). (In truth, the --force isn't necessary since I wipe out the temp folder before export, but it eliminated a point of failure while I was building this process.)

"C:\Program Files\SlikSvn\bin\svn.exe" export --force --username cfauto --password somepass --non-interactive "http://subversion.mysite.com/svn/main/webapp/trunk" "D:\inetpub\webroot\_microsites\thiswebapp_

Tighten Security

To reduce security risk created by having an exposed plain-text password, I created a user, cfauto, on the VisualSVN Server that has read-only rights to the thiswebapp repository and nothing else.

Escaping % in DOS

When I was testing the svn command-line export above, I used my personal credentials. I couldn't figure out why it wasn't working until I noticed the percent symbols in my password (some%xyz%pass). In DOS, variables are bracketed by percent symbols (e.g. %variablename%). When a DOS variable is undefined, it is treated as a blank rather than throwing an error, so in my password, %xyz% was treated as a variable, causing some%xyz%pass to be rendered as somepass at execution time. To escape the percent symbol in DOS, use %%. Rewriting my password as some%%xyz%%pass worked perfectly.

Step 2: Move into Production

Best Practices: Backup and Swap

This is rudimentary and (some might say) common sense, but I think it is worth mentioning since I had to figure this out on my own when I started years ago. When you deploy to production:

1. Deploy to a temp folder xxxx_
2. Rename your existing production folder xxxx to xxxx-old
3. Rename your temp folder xxxx_ to the production folder name xxxx

Exporting a project takes time. If you wipe out your existing production folder, then export directly to production, you risk bizarre errors as users visit your web app before all of the files are in place. Renaming folders is effectively instantaneous.
I like having the existing production folder renamed to xxxx-old. If there is a problem with deployment and you need to roll-back, all you have to do is rename xxxx-old to xxxx and you're done. You don't have to wait for a previous-version export from subversion.

Step 3: Synchronize Secondary Servers with Primary

Backup and Swap in a Load Balanced Environment (optimal scenario)

When working in a load-balanced environment, optimally, you should:

1. Export to a temp folder
2. Synchronize the temp folder to all servers
3. Trigger Backup and Swap on all servers simultaneously

In practice this is tricky. Whatever mechanism you use, you have to be sure that the temp folder has copied completely to all servers before triggering the backup and swap routine. The best solution I can think of is a scheduled process on each machine that performs the backup and swap steps on all temp folders (marked with an underscore). Running this "optimal" process manually could be accomplished with remote execution, but I haven't thought this through. (A good topic for another post.)

Sync Short-Cut for a non-HA Environment

Since our apps don't have a high-availability requirement, I just let our sync software work directly with the production environment on Prod2 (slave). Instead of copying the temp files over, I do the backup and swap on Prod1 and copy the finished product to Prod2. Prod1 and Prod2 are connected by a gigabit LAN, so copying from Prod1 to Prod2 is orders of magnitude faster than deploying from a repository located in another state. The apps we have typically sync in 5 seconds or less.

FreeFileSync: GUI File Synchronization for Windows (with command-line controls)

FreeFileSync is a fantastic free tool for keeping files in sync on a LAN. (I use version 3.3, and it does not support FTP at this time.) Two cautionary notes with FreeFileSync:

1. I have had problems when syncing large files. We have several videos that are 150mb and larger. Occasionally, the secondary copies of large files will have some corruption. The file size is correct, but the videos will stop playing in the middle. If I copy the file again using windows explorer, it works.
2. Upgrading can break your rules.

The interface for FreeFileSync is easy and intuitive. It supports UNC paths, and the creation of batch jobs. The project is very active and new features added all the time. As of this writing, the most recent version is 3.21.

Scheduling the Sync

(To Be Continued...)

ISAPI Rewrite 3.0 Lite and IIS 7.5 Problems Bypassed With Microsoft URL Rewrite

I have used both free and purchased licenses of  Helicon Tech's ISAPI Rewrite product for years. The Apache mod_rewrite (httpd / htaccess) syntax took some getting used to, but support staff (especially Anton Yaroslav) are fantastic. The forums are very active and have volumes of answered questions.

Unfortunately, their product's future took a bit of a blow today in my shop when I ran into problems installing ISAPI Rewrite 3.0 Lite (0086) on a 64-bit Windows 2008 R2 Server running IIS 7.5.7600.16385. When I would look at the site using the Helicon ISAPI Manager, it would say:

"No properties available for this node."

I found this thread in the forums:
http://www.helicontech.com/forum/13011-No_properties_available_for_this_node.html

... which addressed this issue for people running version 0069. Support said that the problem was resolved in version 0070, but I was running version 0086 and it still wasn't working. I downloaded 0070 to see if that might help, and it didn't. The final word from Helicon was to buy their $100 APE product because it works better with IIS 7.5. That news sent me Googling for other solutions.

Microsoft URL Rewrite Filter Module

Imagine my surprise when I discovered that Microsoft had a free URL Rewrite product of their own! (It was a relief, but also sad that it might spell the end of my long-standing relationship with Helicon.)

Using Microsoft URL Rewrite

Available here: http://www.iis.net/downloads/microsoft/url-rewrite

This is my first install of URL Rewrite, so I thought I'd create this post as a way to remember what I did.

Once installed, a new icon called "URL Rewrite" will appear in the IIS section of the IIS Manager

I want to write a rule in the mod_rewrite syntax that I am familiar with, so double click URL Rewrite, and then click "Import Rules" in the right-side menu to open the mod_rewrite rules dialog.

 

My goal was to force HTTP to HTTPS for all sites on the server, so I used this mod_rewrite code:
http://forums.iis.net/t/1149780.aspx

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Pasting that code into the "Rewrite rules:" window produced converted rules instantly.

Right click on the line and choose "Rename" to rename the rule. (You can also do this after creating the rule.)

On first test, the filter did not appear to be working. The same thread that discussed using mod_rewrite code also covered the problem I was having: http://forums.iis.net/t/1149780.aspx

Under SSL Settings, "Require SSL" has to be unchecked. When it is checked, the http request won't make it to the ISAPI filter to be redirected.

 

After that, it worked like a charm!

Reference:

Microsoft URL Rewrite Filter Module for IIS 7.x
http://www.iis.net/download/URLRewrite
Apache mod_rewrite home
http://httpd.apache.org/docs/current/mod/mod_rewrite.html
IIS.net "http redirect" thread:
http://forums.iis.net/t/1149780.aspx
IIS.net Configuration Reference: ISAPI Filters
http://www.iis.net/ConfigReference/system.webServer/isapiFilters

Helicon ISAPI Rewrite 3.0 download page (most recent version)
http://www.helicontech.com/download-isapi_rewrite3.htm
Version 0086 x64
http://www.helicontech.com/download/isapi_rewrite/ISAPI_Rewrite3_0086_Lite_x64.msi
Version 0070 x64
http://www.helicontech.com/download/isapi_rewrite/ISAPI_Rewrite3_0070_Lite_x64.msi

eWallet: Clearing Recently Used Wallets

This isn't exactly a web development post, but it really bothers me that eWallet has a "Recently Used Wallets" section that doesn't have any sort of aging. After a period of disuse, wallets should fall out of the "Recently Used" category, no?

The Ilium tech support section offers this unhelpful response:
http://www.iliumsoft.com/site/support/kb/idx.php/18/504/article/

Uninstalling and reinstalling eWallet?! Give me a break.

On Windows 7, just go to
%localappdata%\Ilium_Software,_Inc\

The only entry should be a single subfolder that has a name like:
eWallet.exe_StrongName_1234567890abcdefghijklmnopqrstuv

Click into that subfolder and you should see folders arranged by version number. Open the most recent.
For example, if you see


choose 7.2.0.30586

In the most recent version folder, you will find user.config, which contains (among other things) Recently Used Wallets. The user.config file is an XML document with plain English labels, so it is not hard to navigate. Look for "RecentWallets" and delete the offending string elements.


The next time you restart eWallet, the entries will be gone!

Notepad++ for ColdFusion

Update 10/30/2013:
The nppColdFusion plug-in no longer works as of Notepad++ 6.x.x. The notepad++ folks changed the way plugins hook into the app. Ben Blumel stopped developing nppColdFusion in May 2012. If you use the installer links and instructions below for the earlier Notepad++ version, everything still works.

I have been a devoted user of Textpad for several years as a quick alternate to Dreamweaver, but have been frustrated lately with its 60+ second load time when using network paths. I was reading an article about Adobe Edge today and noticed a number of people mentioning Notepad++ in the comments, so I decided to check it out. Tweaking it for my needs was not 'out of the box'. So this is a recap of what I did:

Download the following:
Notepad++ 5.9.3
Download Page:http://notepad-plus-plus.org/download/v5.9.3.html
Installer: http://download.tuxfamily.org/notepadplus/5.9.3/npp.5.9.3.Installer.exe

nppColdFusion plug-in (Ben Blumel)
Download Page: https://bitbucket.org/bbluemel/nppcoldfusion/downloads
Archive: https://bitbucket.org/bbluemel/nppcoldfusion/downloads/nppColdFusion-0.7.1.zip

sqlLite dll (Required by nppColdFusion)
Download Page: http://sqlite.org/download.html
Archive: http://sqlite.org/sqlite-dll-win32-x86-3070701.zip

Installation

• Install Notepad++ (this is straightforward)
• Extract nppColdFusion.dll from nppColdFusion-0.7.1.zip and place it in the %programfiles%\Notepad++\plugins folder
• Extract nppColdFusion.db3 and nppColdFusion.xml from nppColdFusion-0.7.1.zip (/Config folder) and place them in the %appdata%\Notepad++\plugins\config folder
• Extract sqllite3.dll from sqllite-dll-win32-x86-3070701.zip and place it in the %programfiles%\Notepad++ folder
• Open (or Restart) Notepad++

At this point your Notepad++ installation has ColdFusion code hints and coloring. 




...but if you're like me, you might like to see a directory tree on the left.

Configuration (Directory Tree)

• Click [Plugins] --> [Plugin Manager] --> [Show Plugin Manager]
• If you are behind a proxy, open a CMD.exe window as administrator and execute the following:
• C:\Program Files (x86)\Notepad++\updater\gup -options
• Enter proxy and port information and click [Ok]
• In Plugin Manager, click settings. 
• For authenticating proxy, enter proxy address in the format: username:password@proxyaddress and click [OK]
• Scroll down to "Explorer" and check it. Click [Install]
• When prompted, click [Ok] to restart Notepad++. When Notepad++ comes up, the file tree is hidden by default.
• Click [Plugins]. Notice that [Explorer] is now an option

• Click [Plugins]-->[Explorer]-->[Explorer...] and the file tree appears

Enjoy!

Windows Aero Preview Thumbnails for Firefox Tabs

One of the cooler toys that came with Windows Vista/Windows 7 was the app preview from the task bar.

Mouse over an open program like windows explorer and a preview of the app appears in thumbnail form. This feature is especially handy with apps like Internet Explorer, which can have many tabs open simultaneously. A preview window opens for each tab in IE.


By default, Firefox does not enable this feature; it only displays one thumbnail with the current page running. Frustrated by this limitation, I stopped using tabs so each page would open in a separate window. Each window appeared as a separate thumbnail, but losing the tabs within Firefox felt a little too... last decade. Fortunately a quick google search pulled up the solution.

Firefox can enable the windows aero thumbnails for each tab through a configuration option. In the address bar, type about:config.





In the filter, type browser.taskbar.
 
Double-click on the browser.taskbar.previews.enable line (bold above) to toggle the value to true.

I had to restart Firfox to get the change to work, but now it shows thumbnails for all open tabs just like IE.

Enjoy!