Difference between revisions of "MythWeb"

From MythTV Official Wiki
Jump to: navigation, search
(tried to clean up this page, but peew! ... needs more than just 5 mins ...)
Line 220: Line 220:
 
  </Directory>
 
  </Directory>
  
----
+
=== Possible Problems ===
 
 
Possible Problems:
 
  
 
/var/log/apache2/error_log show "RewriteEngine" messages
 
/var/log/apache2/error_log show "RewriteEngine" messages
Line 234: Line 232:
 
  # a2enmod rewrite
 
  # a2enmod rewrite
 
  # /etc/init.d/apache2 force-reload
 
  # /etc/init.d/apache2 force-reload
 
----
 
  
 
== Securing Mythweb - Other Linux Flavors ==
 
== Securing Mythweb - Other Linux Flavors ==
 
 
=== Create a Password File ===
 
=== Create a Password File ===
 
You will need to create an htdigest password file -- a suggested location is /etc/httpd/conf, but it should be a location that gets backed up regularly.  
 
You will need to create an htdigest password file -- a suggested location is /etc/httpd/conf, but it should be a location that gets backed up regularly.  

Revision as of 22:38, 31 January 2011

Synopsis

MythWeb TV listings
MythWeb recorded items

MythWeb provides a frontend for scheduling and managing recordings on your MythBox from a web browser located on another machine. Provided the security is set up correctly on your MythBox you can access your machine from anywhere on the internet, or even your mobile phone as long as you have a compatible browser. Of course it is just as useful to browse your myth content from your laptop while your partner is watching their favorite programme.

Mythweb also has some unique capabilities that are only available through the web interface such as allowing for the change of key bindings and other settings.

Indeed, many functions you might want to perform on your MythBox are faster or easier through MythWeb. (How much this is true, of course, depends to some degree on what version you're running).

Usage

Once MythWeb is installed, you can simply access MythWeb from any web browser.

URL for accessing mythweb from browser on same machine as MythTV use

     http://localhost:80/mythweb
     or 
     http://127.0.0.1:80/mythweb

URL for remote access to MythTV from home network use

     http://192.168.0.100:80/mythweb (replace 192.168.0.100 with your local IP address)
     or
     http://mythtv-hostname:80/mythweb (you can use the computername you assigned to the MythTV PC)

URL for remote access to MythTV from Internet use

     http://45.45.45.45:80/mythweb (45.45.45.45 is your WAN IP.)
     (If you don't know your WAN IP, use www.whatismyip.com to figure this out)

However, you will not be able to remotely access your MythTV machine until you open the port to your PC. You need to enter your home router and enable port forwarding. You need to manually change some settings in your router that let it know that you want traffic from outside the home network to enter your home network. And you want that outside traffic to be sent directly to 192.168.0.100 (the IP address of the MythTV backend) on port number 80 (which is the default port for the apache HTTP server).

Also note that your ISP may block all traffic on port 80 b/c they do not want residential customers to be running HTTP servers. So you may need to change the default port 80 to some other number (ex: 8080). Then don't forget to change your router's settings to forward port the incoming port 8080 to the internal network's port 80.

In addition, most users have dynamically assigned IP addresses from their ISP. This means that your ISP can change your WAN IP at any time and if this occurred while your away from your home, you would not know what the new IP address is and therefore you would not be able to access your MythTV PC remotely.

The way to prevent this from happening is to use dynamic DNS. Google it. There are many free choices which will allow you to map any changes that your ISP makes to your home IP address. This will allow you to maintain a connection to your home computer regardless if any changes to your IP address were made.

Lastly, don't forget that you still need to modify your home computer's configuration to grant your remote computer access. This means that you may need to change a few files. Notably, if you're accessing a linux systems (ubuntu/kubuntu/etc), change these files: /etc/hosts.allow and /etc/hosts.deny.

Installation

See MythWeb INSTALL for details on how to install, especially on Linux. (Note this is hard linked to the 0.22-fixes version of this document). For installing on Mac OSX, please see MythWeb_on_Mac_OS_X_Backend.

MythWeb is currently being rewritten to support streaming of content via Flash.

Key Features

MythWeb upcoming recordings
MythWeb details of a programme

TV

Programme Listing

Special Searches

Upcoming Recordings

Recording Schedules

Schedule Manually

Custom Schedule

Recorded Programmes

Music

Browse your Music Collection and download to your local machine for direct playback

Video

Browse your Video collection and download to your local machine

Weather

MythWeb weather

Get weather reports as per MythWeather.

Status

Show the Backend Status Logs such as how much disk space and tuners that are recording

Statistics

Show key statistics such as Top Recorded Shows

Logs

Show the Server Logs

Settings

Configure MythWeb and some of the MythTV settings.

MythWeb session settings

MythTV global defaults

MythTV channel info

MythTV key bindings

MythTV settings table


Favicons For Your Server

One contributed favicon is File:Favicon.jpg (it's really a .ico file; see the page).

Here is another favicon.


Grease Monkey Scripts

To enhance your MythWeb experience:

Securing Mythweb

If your web server is accessible from the internet it is important that you secure MythWeb with some kind of authentication. This guide will take you through setting up simple password authentication. Please see the Apache [1] for more specifics or more secure methods.

There are several ways to secure MythWeb with all webservers; on Apache2:

  • Modify the Apache configuration to require password authentication [Apache2 preferred method]
  • Modify the MythWeb .htaccess file to require password authentication
  • Setup an SSH tunnel for remote access to MythWeb (assuming that you do not open your MythWeb server to the internet except for port-forwarding SSH from your router/firewall)

These instructions assume Fedora Core, with Myth Web installed in the default path /var/www/html/mythweb

MythWeb password authentication

MythWeb password authentication is configured in the configuration files of the apache2 service and read at runtime rather than with each web-request as with .htaccess; for this reason this is more efficient from a computer resource point of view. For this reason this is the method that is recommended by Apache. There are at least two methods of configuring password authentication within Apache2 config files; Authentication with either the Basic or Digest modules.

Basic Authentication sends the submitted username and password in clear-text over the network; Digest uses a more secure method of sending the details encrypted over the network. In both cases the content of the pages sent to the web browser are unencrypted as is typical with non-financial web-pages.

Basic & Digest authentication is described here (for Ubuntu) [[2]]

MythWeb .htaccess

The simplest option is to edit /var/www/html/mythweb/.htaccess and read the comments there about what to uncomment to secure MythWeb. This option does not require Apache to be restarted, but is slightly less efficient than adding the options to the Apache config.

You may use either AuthType Basic or AuthType Digest -- "Basic" is more compatible, "Digest" is more secure. If you use "Basic", you must use htpasswd to create users. If you use "Digest", you must use htdigest to create users.

Securing Web - openSUSE 10.2

Geeko head48.png


These steps are for openSUSE 10.2 The instructions are written using "htpasswd2" instead of "htdigest2" because that is what I got to work. I'm sure you could use "htdigest2", I'm just now sure how. These steps should work fine though.

You will need to install Apache2, PHP5.1 (or preferrably PHP5.2), Mythweb

MythTV openSUSE RPMS will install the mythweb files into /srv/www/htdocs/mythweb


Configure Apache2


In YasT under Network Services->HTTP Server.

Under "Server Modules" make sure you have "env" and "rewrite" modules enabled

Under "Main Hosts" select "Directory /srv/www/htdocs "

Change Options to FollowSymLinks

Change AllowOveride to All

save and exit


Start Apache2 Web Server


YasT->System->System Services

Select apache2 and enable

save and exit

Setup Security

1. create a new password file with htpasswd2

WARNING: the "-c" will wipe out the file if it already exists

/usr/bin/htpasswd2 -c /etc/apache2/conf.d/httpd-passwords userid

You will be prompted to put in a password for the userid

2. create any additional user IDs (no "-c")

/usr/bin/htpasswd2 /etc/apache2/conf.d/httpd-passwords another_userid

3. Find the user:group that apache2 is running as

cat /etc/apache2/uid.conf

The file will probably look similar to this:

User wwwrun
Group www

4. Change the ownership of the password file (change "wwwrun:www" to match the "User:Group" from the previous step)

chown wwwrun:www /etc/apache2/conf.d/httpd-passwords

5. If the .htaccess exists, which it probably does if you have mythweb installed, back it up. This is just in case you mess it up and it need to start over.

cd /srv/www/htdocs/mythweb/
cp ./.htaccess ./.htaccess.orig

6. Open .htaccess for modification with vi - or whatever floats your boat

vi ./.htaccess

7. The following lines should be present but commented. Remove the "#" from the start of each line, modify them to fit your setup, and save the file. Changes are immediate. Pay special attention to the bolded lines

AuthType           Basic
AuthName           "MythTV"
AuthUserFile       /etc/apache2/conf.d/httpd-passwords
Require            valid-user
BrowserMatch       "MSIE"      AuthDigestEnableQueryStringHack=On

Save the file and authentication should begin immediately.

8. If you don't want to bother with authentication when you are on the same network, add the following lines and authentication will be bypassed (assuming 192.168.1.0 is your local network).

Allow from 192.168.1.
Satisfy any

If you aren't sure what your network is, if you are using a router purchased from a store, you could probably get away with specifying "Allow from 192.168.". This would also cover you if you move your box from one location to another using a different third octet in the IP. With this in place, though, you should not be prompted now for authentication while on the local network.

UPDATE: I'm not 100% sure that this last step works. I tested from a remote site and was able to access MythWeb without being prompted for a password. The remote site also used the 192.168.1 network range. After removing the last two entries above, it prompted right away.

NOTE: I had the same problem with the last step not working, but after a lot of digging it turned out that there were conflicting authentication configurations in the main apache config file and in the sites-enabled/default files. These are the settings which worked for me.

<Directory>
  AuthType Basic
  AuthName "MythTV"
  AuthUserFile /etc/apache2/conf.d/httpd-passwords
  Require valid-user
  Order deny,allow
  Deny from all
  Allow from 192.168.0 127
  Satisfy Any
</Directory>

Possible Problems

/var/log/apache2/error_log show "RewriteEngine" messages

[Mon Jul 23 21:35:19 2007] [alert] [client 192.168.0.187] /srv/www/htdocs/mythweb/.htaccess:\
Invalid command 'RewriteEngine', perhaps misspelled or defined by a module not included in the server\  
configuration

Install the apache2 rewrite module

# a2enmod rewrite
# /etc/init.d/apache2 force-reload

Securing Mythweb - Other Linux Flavors

Create a Password File

You will need to create an htdigest password file -- a suggested location is /etc/httpd/conf, but it should be a location that gets backed up regularly.

htdigest -c /etc/httpd/conf/httpd-passwords MythTV MYUSER1

Create additional users as needed:

htdigest /etc/httpd/conf/httpd-passwords MythTV MYUSER2

Please make sure you DO NOT use the -c after the initial user, as this will overwrite the file and start from scratch.

Modify ownership of the file to match the user and group Apache is running as -- try

grep -A 2 ^User /etc/httpd/conf/httpd.conf 
chown apache.apache /etc/httpd/conf/httpd-passwords
chmod 640 /etc/httpd/conf/httpd-passwords

Modify .htaccess

nano /var/www/html/mythweb/.htaccess

The following lines should be present but commented after the initial installation. Make a backup copy of your existing conf file. Afterwards open the file and either remove the "#" (or copy the section before) from the start of each line, modify them to fit your setup, and save the file.

    AuthType           Digest
    AuthName           "MythTV"
    AuthUserFile       /etc/httpd/conf/httpd-passwords
    Require            valid-user
    BrowserMatch       "MSIE"      AuthDigestEnableQueryStringHack=On

Adding the following optional lines will enforce authentication from anywhere outside your local network (assuming 192.168.1.0 is your local network):

    Allow from 192.168.1.
    Satisfy any

Authentication should begin working immediately.

It may happen, that you'll get an error because you need to activate the auth_digest module.

sudo a2enmod auth_digest

Apache Configuration

This method is slightly more efficient than the .htaccess method, but is complicated by the fact that you must restart Apache and mis-configuring the Apache configuration file will keep Apache from restarting.

Apache password file

We will start with creating an Apache password file. I put this in /etc/httpd/conf, as I back up this directory every night to one of my other systems.

htpasswd -c /etc/httpd/conf/httpd-passwords MYUSER1

Create additional users as needed:

htpasswd /etc/httpd/conf/httpd-passwords MYUSER2

Please make sure you DO NOT use the -c after the initial user, as this will overwrite the file and start from scratch.

Modify ownership of the file as follows:

chown apache.apache /etc/httpd/conf/httpd-passwords
chmod 640 /etc/httpd/conf/httpd-passwords

Editing Apache Config

Now edit /etc/httpd/conf/httpd.conf, and add the following section:

<Directory "/var/www/html/mythweb">
    Options Indexes FollowSymLinks
    AuthType Basic
    AuthName "MythTV"
    AuthUserFile /etc/httpd/conf/httpd-passwords
    require user MYUSER1 MYUSER2 MYUSER3
    Order allow,deny
    Allow from all
</Directory>

Modify the password file location and required users per your needs.

If you have created a link from your music storage area to /var/www/html/mythweb/music, you can add the following to separately secure web access to this:

#MythWeb music configuration
<Directory "/var/www/html/mythweb/music">
    Options Indexes FollowSymLinks
    AuthType Basic
    AuthName "MythTV-Music"
    AuthUserFile /etc/httpd/conf/httpd-passwords
    Require user MYUSER4 MYUSER5
    Order allow,deny
    Allow from all
</Directory>

Again, tailor your password file and users to your needs. You can even use separate password files if you wish!

Securing only the "settings" section

It is also possible to improve security on MythWeb without requiring every user to enter a username and password. Standard users will still be able to do things such as delete recordings, edit video metadata, etc, but you can at least restrict their access to dangerous pages such as the settings section. This is done on Apache by using the "LocationMatch" directive:

<LocationMatch .*web/settings>
        AuthType        Digest
        AuthName        "MythTV"
        AuthUserFile    /etc/mythtv/mythweb-digest
        Require         valid-user
        BrowserMatch    "MSIE"  AuthDigestEnableQueryStringHack=On
        Order           Allow,Deny
        Satisfy         Any
</LocationMatch>

It should also be possible to restrict any individual action on Mythweb using the right regular expression in the LocationMatch.

Restart Apache

Now restart Apache, and you're done:

service httpd restart

(this may be different on your distro)

Other options

You can do a lot more with these configuration sections, such as secure by ip address, and more. Please see the Apache docs[3].

Questions: email me at johanreinalda at yahoo dot com. Preferred is an email to Myth Users list, however. Here's the configuration I used to allow users on my LAN to access MythWeb without a password, and require outside users to authenticate via pw

<Directory "/var/www/html/mythweb">
  Options Indexes FollowSymLinks
  AuthType Basic
  AuthName "MythTV"
  AuthUserFile /etc/httpd/conf/httpd-passwords
  Require valid-user
  Order allow,deny
  Allow from 192.168.1.
  Satisfy any
</Directory>

NOTE: I have found that "Allow from 192.168.1." does not work correctly when your webserver is behind a router, as any traffic forwarded over the router will appear to originate from 192.168.1.1 (or whatever your router's IP is). This will cause ANY outside traffic to satisfy the "Any" requirement. -- craftyguy

Troubleshooting

Incompatible protocol version

After updating mythtv and mythplugins you may find that mythweb gives an error like

Error at /var/www/localhost/htdocs/mythweb/includes/mythbackend.php, line 172: 
   Incompatible protocol  version (mythweb=40, backend=41)

Fatal Error at /var/www/localhost/htdocs/mythweb/includes/mythbackend.php, line 39: 
  Unable to connect to mythbackend, is it running? 

The version numbers may be different, but the point is that they don't match between mythtv and mythweb. The problem is that even if you build and install the latest mythplugins, this does not install mythweb. You must copy the latest mythweb code to the directory from which it is served by the web server. For example:

cp -r mythplugins/mythweb/* /var/www/html/

If you install or upgrade MythWeb and your web browser gives you garbage instead of a pretty page

Find the apache/htdocs/mythweb/.htaccess file and comment out (with a # sign) the three lines which begin php_value zlib.. (This note doesn't actually belong here, but I didn't want it to get lost, since I had to rummage in the mailing list to find it again. --Baylink 22:10, 7 October 2006 (UTC))

Mythweb fails to detect wap/wml devices when secured

If MythWeb is secured it will use the logged in username to record the mythweb settings including the template/skin. This is great if you are browsing mythweb from different PCs but will bypass the detection of mobile (wap/wml) devices. A simple workaround is to ensure you setup a different userid to authenticate with from your phone. --Lwoggardner 12:08, 14 October 2006 (UTC)

The user settings are stored in the table mythweb_sessions. To reset the stored session information for a particular user, simply delete the record for that user:

DELETE FROM mythweb_sessions WHERE id = 'user:<username>'

In a contribution to the mythtv-users list on 4 December 2008, Michael T. Dean suggested that the following may also fix the issue:

http://<hostname>/mythtv/?RESET_TMPL=true JanCeuleers 19:41, 4 December 2008 (UTC)

Database connection issues

If you have edited your .htaccess db values to match your mysql.txt file and still cannot connect to database you may have mysql database problems. Try:

GRANT ALL ON mythconverg.* TO mythtv@localhost IDENTIFIED BY 'mythtv'
WITH GRANT OPTION
FLUSH PRIVILEGES;

Streaming Music via Mythweb

If Streaming Music over Mythweb is not working check to confirm that there is a link to your music directory in mythweb/data. If your music is stored in /mythtv/music and your web directory is /var/www/html/mythweb then you would need to add a link like.

ln -s /mythtv/Music /var/www/html/mythweb/data/music

Then confirm that it worked

ll /var/www/html/mythweb/data

MythVideo error on Mythweb

Error:

Could not create a symlink to /content/dvd, the local MythVideo directory for this hostname (hostname).
Please create a symlink to your MythVideo directory at data/video in order to use the video portions of MythWeb.

I could fix this by deliting the symlink /var/www/html/mythweb/data/video with this command "rm /var/www/html/mythweb/data/video". This would allow mythweb to pull up the video page without the artwork. but when i would refreshed it i would get the error. Notes:

My Video Directory: /content/dvd

This is related to permissions in the /content folder. So i did this

chown -R mythtv:apache /content
chmod -R 755 /content


I had the same problem and found out that the symlink was not created properly. If you create a new symlink in the mythweb data folder (www/mythweb/data) to your video folder and video cover folder everything works fine. The error should tell you which file to link to using the following command

ln -s target_file video
ln -s target_file video_covers

where target file is the location of your video and video_cover folders respectively.

Time Stamp is off by an hour

Arizona does not follow daylight savings time. PHP can't read the system timezone causing the Mythweb time to be an hour fast. The following needs to be set in php.ini:
[Date] ; Defines the default timezone used by the date functions
date.timezone = America/Phoenix

If your timezone has daylight saving which moves from year to year, you might experience this problem. This is because PHP does not use the system timezone information but has its own timezone database built in. System timezone information is easily updated (e.g. yum update tzdata) and if your system clock is wrong you probably should. The compiled-in data of PHP is not easily updated and reflects what the developers of PHP thought was correct when it was coded at some time in the past. The times in the MythTV database may be correct even though they show incorrectly in MythWeb. This happened in timezone Australia/Sydney in March/April 2008 when the daylight saving change was moved back by one week - MythWeb times were one hour out for the week and then corrected themselves.

To resolve future issues with daylight savings timezones being altered it may be neccessary to update or install the php timezone database. The following process was used successfully to install the php timezonedb with Ubuntu 7.10 (Gutsy).

sudo apt-get install php-pear
sudo pecl install timezonedb

Thumbnails are not generated

Check this fix and make sure that

allow_url_fopen = On

in your php.ini.

Errors showing Backend Status page

If you receive errors such as:

Error at /var/www/localhost/htdocs/mythweb/modules/status/handler.php, line 29:
file_get_contents() [function.file-get-contents]: URL file-access is disabled in the server configuration

when you open the "Backend Status" page, then you need to enable/install the curl plugin for php.

For Ubuntu/Debian:

sudo apt-get install php5-curl

For Fedora/Redhat:

yum install curl curl-devel

The error should be resolved after a restart of the web server.

Alternatively you can enable fopen in your php configuration file, but this is not recommended due to potential security issues with fopen.

To do this, find the following line:

allow_url_fopen = Off

and change it to:

allow_url_fopen = On

Channel Icons are not appearing

If you do not see channel icons in the listings page, there are two possible problems:

1) The option is not enabled
  • Click the "Settings" button (a picture of a key & wrench), click the "MythWeb" button on the left, click the "MythWeb Defaults" tab, and verify that there is a check in the box for "Show the channel icons"
2) The channel icons have not been retrieved
  • Run mythtv-setup, select "Channel Editor", select "Icon Download", and then select "Download all icons" from the list. Further information on channel icons is available in the Channel_icons page.

SELinux issues

If you get an error something like:

                       Error

Unable to connect to the master backend at 127.0.0.1:6543.
Is it running?

you are sure the backend is running, and you are running Fedora or some other distribution which uses selinux, this may be the problem - selinux does not allow apache to talk to mysql in the default policy. Try

setsebool httpd_can_network_connect=1

to test this theory, and to make it permanent:

setsebool -P httpd_can_network_connect=1

If that doesn't work, try:

setenforce permissive

to test this theory, and make the change permanent, if you wish, via /etc/sysconfig/selinux:

SELINUX=permissive
# or SELINUX=disabled

Internal Server Error when attempting to stream a recorded program

If you receive an "Internal Server Error" page when you click either the 'stream' or the 'download' icons next to a recorded program, the issue will likely be described in the Apache error log file. If the error is the following:

[error] (13)Permission denied: exec of '/var/www/localhost/htdocs/mythweb/mythweb.pl' failed

then check the permissions on the mythweb.pl file to make sure that it has execute permissions enabled.

Alternative Skins

MythWeb uses the concept of skins to give the user the power to edit/change the look and feel. The skins are based on CSS files that can be customized.

Following list of available skins can be install additionally to the default one:

To install the skins, extract them to the mythweb/skins/ directory.

See Also