Security Advancements at the Monastery

“The only reason for time is so that everything doesn’t happen at once.”
– Albert Einstein

I wanted to write some notes on the installation of Request Tracker (RT); one man’s experience. So everything does not happen at once, I am splitting the posting between need to know links before starting and step-by-step installation instructions.

Let me start off by address what is RT? RT is an enterprise-grade ticketing system which allows for the checking of the status of various tasks. This includes when the tasks were requested, who requested the tasks and why, when the tasks were completed, prioritizing, assigning, notification, etc. RT is an open source ticketing system enabling a group of people to manage tasks, issues, and requests submitted by a community of users. RT has interfaces for command-line, e-mail, IRC and the Web. RT audits all of its operations in a database, making it portable and expandable should the project management tasks grow beyond the capacity of the initial installation machine. Being an issue tracking system at the core, RT is a flexible tool capable of performing tasks unrelated to project management. It can be used as a public task list, an administrative task manager and journal, or a help desk tool (many companies use RT just for help desk issues).

Best Practical has two additional open source packages that may be of interest for integration with RT:

• The RT FAQ Manager (RTFM) is a knowledge management tool that enables an organization to easily capture and share its employees’ knowledge and wisdom. Where RT tracks issues, RTFM tracks articles.
• RT for Incident Response (RTIR) is the premiere open-source incident-handling system, designed with the needs of CERT teams and incident-response teams in mind. It makes IR tasks easier and lets you solve your problems more efficiently.

Sources

There were a few sources very helpful with the installation process. First, the book, “RT Essentials” by Dave Rolsky; Darren Chamberlain; Richard Foley; Jesse Vincent; Robert Spier. There is also the RT Installation Guides available from the Best Practical Solution website. The Wiki will provide up-to-date installation instructions for the various operating systems. Finally the article “Zen and the art of installing Request Tracker 2.0.x” by Jesse Tilly. Unfortunately you do have to register to get the guide and it is a little dated. Still, Jesse manages to make the installation of RT interesting. Plus, any article with “Zen” in the title always requires a look.

Requirements and Resources

Below are a few publicly accessible resources, courtesy of Jesse Tilly. Any mistakes are on me, since I am editing, updating, and combing information:

• RT: RT’s latest release is available at http://www.bestpractical.com/rt/download.html.
  • RT’s Wiki. http://wiki.bestpractical.com/view/HomePage
  • RT-devel mailing list (good place to check on in-progress features and fixes, especially to check on WinRT). http://lists.bestpractical.com/pipermail/rt-devel/
  • RT-user mailing list (good for help with special installation instructions and user issues). http://lists.bestpractical.com/pipermail/rt-users/

• Perl, Perl Modules and CPAN: RT is intrinsically tied to the Perl platform, so it could help your understanding of RT to understand Perl a bit better. For RT 3.0.0 and greater you need Perl 5.8.3 or newer.
  • Perl’s home (which uses RT for issue tracking). http://www.perl.org/
  • The Comprehensive Perl Archive Network (CPAN) is a core part of Perl programming. A tool is included with RT which takes care of the installation of most of the Perl modules automatically. The tool supplied with RT uses Perl’s CPAN system to install modules.
  • A good introduction on modules, found at the CPAN site. http://cpan.org/modules/00modlist.long.html#Introduction

• Web Server: Apache sits at the core of many Web-driven applications. With regards to RT, Apache’s primary application is its Perl modules, giving RT a Web-based front end. You can chhose to user another webserver, but it must have FastCGI support.
  • Apache’s home. http://www.apache.org
  • mod_perl’s home. http://perl.apache.org/ The mod_perl project has two major stable releases: mod_perl 1.x and mod_perl 2.x.
    • mod_perl 1.x is supported release, but this mean you must use Apache 1.3.x, because mod_perl 1.x works only with Apache 1.3.x. mod_perl 1.x must be built with EVERYTHING=1 option (most distribution packages have this option on). For an excerpt, see ManualApache.
    • RT development team does not recommend using development 1.9x versions, because of development status. Also mod_perl 2.x was released and it’s stable branch of the 1.9x development versions, so you wouldn’t get much support from mod_perl users and developers if you use mod_perl 1.9x. RT-3.4.4 and greater doesn’t work with development 1.9x releases.
    • mod_perl 2.0 has been released with major API-changes in mod_perl 2.0-RC3 which lead to incompatibities that also affect RT, see this mailing-list message. So RT-3.4.3 or any prior versions is totally unsupported on mod_perl 2.x.
    • mod_perl 2.x has been marked as supported in RT 3.4.4. There is no mentioning of incomplete support in any way. See this mailing list message. If you experience issues getting mod_perl 2.x+apache 2.x up and running, consider using apache 1.3.x + mod_perl 1.x or FastCGI instead.

• Database backend: RT stores data in a database. Generally, the locations I have worked at use MySQL, though there is interest in evaluating PostgreSQL.
  • MySQL 4.0.18 or later with support for InnoDB.
  • PostgreSQL 7.4 or later.

• Sendmail and sendmail configuration and administration: The key here is to realize that RT uses mail aliases on its host’s configured mail server to route commands through e-mail. As long as your MTA supports these type of aliases, you are fine.

  • sendmail’s home. http://www.sendmail.org

• Configuration management: These articles, books and tools can help you build your own CM process.
  • “Software Release Methodology” by Michael E. Bays, ISBN: 0136365647
  • “Automating the Build Process” by Aspi Havewala, Dr. Dobb’s Journal, issue: August 2000
  • CVS, Revision Control System http://cvshome.org
  • Aegis Configuration Management Tool (like cvs) http://aegis.sourceforge.net/
  • Subversion, yet another CVS replacement http://subversion.tigris.org/
  • Scarab, an issue tracking system, like RT (it is useful to compare) http://scarab.tigris.org/
  • GNU Make, the build engine of the open source world http://www.gnu.org/software/make/make.html
  • Jakarta Ant, the build engine of the Java open source world http://jakarta.apache.org/ant
  • Add more automation to your project with the code generation tool, Swang (http://swang.sourceforge.net).

I am going to end here and leave the installation instruction for a follow up post. Installation under FreeBSD is fairly straight forward. I ran into a snag with the installation under Mac OS X. Under Mac OS X, when you try to configure mod_perl 2.0.3, it will complain about Perl 5.8.8 being built without threads and tell you to build Perl with -Duserthreads. One solution is dropping back to Apache 1.3.x and mod_perl 1.x. While Apache 1.3.x is legacy code, and I tend to want to use the code that is being actively developed, there is an argument for using Apache 1.3.x. A major feature of Apache 2.x is threading. On Windows, where most basic libraries are and must be threadsafe, Apache 2 is really the only choice. Earlier Mac OS X releases did not include a completely thread-safe libc, so threading is still not fully supported in Perl. This is why the Perl version that comes with Mac OS X is not compiled to use threads. Before posting the second half of this blog, I want to split the post between installation instructions for FreeBSD and Mac OS X. I also plan on revisiting the installation of RT under Mac OS X. In case the above explanation and links can be of assistance to anyone interested in installing Request Tracker, I wanted to publish the first half of this posting. Good luck.

Tags: Request Tracker