Links2Linux Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
To configure apache for a single domain is easy. To configure apache with multiple virtual hosts for a single webmaster is easy, too.

But if you need to host several domains for several different users this can be much more difficult. The biggest problem is to offer PHP functionality while keeping the system secure and fast.

====== Scenario ======
  *  One server, many users and one or more domains for each user.
  *  The users should be able to use php-scripts for their webpages.
  *  A user must not be able to access data from other users.
  *  php-scripts should be able to use system tools so that applications like gallery or a CMS will work.

====== Problem ======
  *  php scripts will be executed with privileges of the user apache is running as. This is bad because then every user can access the same data including the home directories of any user.

====== Possible solutions ======
===== mod_chroot  =====
Ths apache module [[http://core.segfault.pl/~hobbit/mod_chroot/|mod_chroot]] can be used to chroot() an apache process into a virtual hosts DocRoot.

Disadvantages: 
  *  system tools have to be copied into every chroot because the apache process can access nothing more that its own DocRoot. 
    *  This can mean much work for the admin.
    *  It uses more diskspace
    *  It will complicate TPE (trusted path execution) or makes it unpossible to use reducing system security
    *  chrooting to a vhost only works with the Apache2 module

=====  PHP safe_mode  =====
The [[http://de2.php.net/features.safe-mode|PHP safe_mode]] may be used to tell PHP to not allow access to files not owned by the same user as the script itself, restrict several php functions such as system() exec() fopen() etc.

Disadvantages:
  *  opening files owned by the user is not possible if apache is still running as a different user
  *  using system wide php classes or libraries is not possible because they are not owned by the user
  *  some php applications may not work anymore

=====  suPHP  =====
With [[http://www.suphp.org/Home.html|suPHP/mod_suphp]] any php script is executed with uid of the owner of the script.

Disadvantages:
  *  for every http request a new php-cgi process will be started through the suphp wrapper which will do set(e)uid()/set(e)gid() before serving the request. This makes it terrible slow. It will work for a page with a low number of hits, but high traffic webpages will be too slow and it will kill your webservers performance.

=====  mod_become  =====
Using [[http://www.snert.com/Software/mod_become/index.shtml|mod_become]] there is no need for suPHP anymore making it possible to use mod_php instead of php-cgi. It will setuid()/setgid() the apache process before serving a request.

Disadvantages:
  *  Slow as suPHP
  *  Static html pages are slow, too
  *  Apache must be recompiled with -DBIG_SECURITY_HOLE

====== Conclusion so far ======
If its secure and fast, it has limitations. If it is secure and has no limitations, its slow.

Now what? Impossible to do that? Wait. There might be another solution:

======  **The** solution?  ======
=====  mod_fastcgi  =====
This module can be used to pre-fork cgi processed and let them running instead of starting up a new process for every request.

[[http://www.debianhowto.de/howto-archiv/de/apache2-phpfcgi-sarge/c_apache2-phpfcgi-sarge.html|Apache2, php5-fcgi, php4-fcgi, mod_fastcgi HowTo]] (german)

======  Benchmarking  ======

For testing we install apache and all other needed stuff into a default debian sarge chroot.

Hardware:

Intel(R) Celeron(R) CPU 2.00GHz with 512MB of RAM

===== Preparation =====
We use a tool called [[http://hammerhead.sourceforge.net/|hammerhead]] to stress our apache.

The tool [[http://www.vanheusden.com/httping/|httping]] will be used to test apache's response time

Benchmarking with hammerhead:

I tried to find a hammerhead config that will get most out of the webserver, but will not stress the hammering machine too much.

There are two different scenarios:
  *  for static pages
<code>
NStatic HTML page
RGET /static/ HTTP/1.0
E<html><head><title>testpage</title></head><body>this is a test</body></html>
</code>
  *  for php pages
<code>
NDynamic page (PHP)
RGET /php/ HTTP/1.0
E<html><head><title>testpage</title></head><body>this is a test</body></html>
</code>

The corresponding testpages will be created like that:
<code>
  -  cd /var/www/
/var/www# mkdir static php
/var/www# echo "<html><head><title>testpage</title></head><body>this is a test</body></html>" > static/index.html
/var/www# echo "<?php echo '<html><head><title>testpage</title></head><body>this is a test</body></html>'; ?>" > php/index.php
/var/www# 
</code>

Config will be the same for all tests:
<code>
Scenario_file ./scns/{static,php}.scn
Log_filename /dev/null
Report_Log /dev/stdout
Load_images off
Sessions 30
Sequence_probability 100
Sleep_time 20
Run_time 120
Machine_Name <webserver:port>
Seed 123456789
</code>

This means 30 threads will hammer the webserver for two minutes. Each thread will wait 20 msec between requests.

Each test is run five times and the best result is taken (Avg. resp./sec).

=====  Apache plain or with mod_php4  =====
Installation/configuration:

<code>
 aptitude install apache php4</code>

=====  Apache with php4-cgi  =====
Installation/configuration:

<code>
 aptitude install apache php4-cgi
 apache-modconf apache enable mod_actions</code>

A file named php4-cgi is placed in /etc/apache/conf.d with the following content:

<code>
<IfModule mod_actions.c>
<code>
  Action application/x-httpd-php /cgi-bin/php4</code>
</IfModule>
</code>

Restart apache.

=====  Apache with suPHP  =====
Installation/configuration:

<code>
 aptitude install apache suphp</code>

A file named //suphp// is placed in ///etc/apache/conf.d// with the following content

<code>
suPHP_Engine on
suPHP_ConfigPath /etc/php4/cgi/

AddType application/x-httpd-php .php
AddHandler x-httpd-php .php
</code>


This enables the suPHP engine in a global context.

Restart apache.

suPHP will refuse to run scripts as user root. The following is done to be sure suPHP finds
a smooth environment where it feels comfortable and will run our php testscript as another user.

<code>
adduser suphp-test
[[...]]
  -  cd /var/www/php/
/var/www/php# chown suphp-test:suphp-test . index.php
/var/www/php# l
total 12
drwxr-xr-x  2 suphp-test suphp-test 4096 2005-07-06 14:50 .
drwxr-xr-x  4 root       root       4096 2005-07-06 15:54 ..
-rw-r--r--  1 suphp-test suphp-test   94 2005-07-06 15:56 index.php
/var/www/php#
</code>

To test the setup you can place a line like //system("touch foo");// into the test script and check that
there is a file called //foo// after executing the script that is owned by user //suphp-test//

=====  Apache with mod_become  =====
Installation/configuration:

=====  Apache with mod_fastcgi  =====
Installation/configuration:

<code>
 aptitude apache libapache-mod-fastcgi</code>

Answer "yes" to the suEXEC question!

<code>
 aptitude install libkrb53 libzzip-0-12 php4-cli php4-common</code>

Install self build php4-cgi version with fastcgi enabled (needs -common and -cli, too):

<code>
 dpkg -i php4-common_4.3.10-15.fastcgi.0_i386.deb
 dpkg -i php4-cgi_4.3.10-15.fastcgi.0_i386.deb
 dpkg -i php4-cli_4.3.10-15.fastcgi.0_i386.deb</code>

Make aptitude not want to remove those packages:

<code>
 aptitude unmarkauto php4-cgi</code>

Enable mod_actions:

<code>
 apache-modconf apache enable mod_actions</code>

Add user fcgi-test

<code>
  adduser fcgi-test</code>

Now create the fast-cgi starter script:

<code>
 vi /var/www/fcgi-bin/php-fcgi-starter</code>

Content of /var/www/fcgi-bin/php-fcgi-starter:

<code>
  - !/bin/sh
PHPRC="/etc/php4/cgi/"
export PHPRC
PHP_FCGI_CHILDREN=4
export PHP_FCGI_CHILDREN
exec /usr/lib/cgi-bin/php4
</code>

Filesystem structure for the vhost is as follows:

<code>
/var/www/
/var/www/htdocs
/var/www/htdocs/static
/var/www/htdocs/static/index.html
/var/www/htdocs/php
/var/www/htdocs/php/index.php
/var/www/fcgi-bin
/var/www/fcgi-bin/php-fcgi-starter
</code>

Set correct permissions:

<code>
  -  cd /var/www/
/var/www# chown fcgi-test:fcgi-test fgci-bin fcgi-bin/php-fcgi-starter htdocs/php htdocs/php/index.php
/var/www# chmod 0755 php-fcgi-starter
/var/www# 
</code>

A new vhost is configured in a file ///etc/apache/conf.d/test-vhost.conf//:

<code>
NameVirtualHost *:10086

<VirtualHost *:10086>
<code>
  ServerAdmin me@domain.de
  ServerName www.domain.de
  DocumentRoot /var/www/htdocs
  DirectoryIndex index.php index.html index.htm
  User fcgi-test
  Group fcgi-test
  <Directory />
    Options FollowSymLinks
    AllowOverride None
  </Directory>
  <Directory /var/www>
    Options FollowSymLinks
    AllowOverride AuthConfig
    Order allow,deny
    allow from all
  </Directory>
  ScriptAlias /cgi-bin/ /var/www/fcgi-bin/
  <Directory "/var/www/fcgi-bin">
    AllowOverride None
    Options +ExecCGI -MultiViews -Indexes
    Order allow,deny
    Allow from all
  </Directory></code>
</VirtualHost>
</code>

=====  Apache2 with mod_fastcgi  =====
TODO

=====  Results  =====
{| border="1" cellpadding="2"
|+Apache 1.3.33, Average requests/sec
|-
! Config || Test 1-5 !! Best of 5 !! Average
|-
! static
| 645/686/663/652/686 || 686 || 666
|-
! mod_php
| 409/406/407/408/397 || 409 || 405
|-
! php4-cgi
| 034/034/033/034/035 || 035 || 034
|-
! suPHP
| 029/032/029/031/030 || 032 || 030
|-
! mod_fastcgi/php4-cgi
| 388/391/386/370/384 || 391 || 383
|}

{| border="1" cellpadding="2"
|+Apache 2.0.54, MPM prefork, Average requests/sec
|-
! Config / Results
! Test 1-5 !! Best of 5 !! Average
|-
! static
| 807/823/835/842/808 || 842 || 823 
|-
! mod_php
| 425/423/420/414/423 || 425 || 421
|}


{| border="1" cellpadding="2"
|+Apache 2.0.54, MPM worker, Average requests/sec  (1GB RAM now)
|-
! Config / Results
! Test 1-5 !! Best of 5 !! Average
|-
! mod_fastcgi/suexec/php-fcgi (dynamic server)
| 1.52/1.47/1.33/1.78/1.55 || 1.78 || 1.53 
|-
! mod_fastcgi/suexec/php-fcgi (static, 1 server)
| 238/252/164/236/265 || 265 || 231
|-
! mod_fastcgi/suexec/php-fcgi (static, 2 servers)
| 247/246/257/264/275 || 275 || 258
|-
! mod_fastcgi/suexec/php-fcgi (static, 3 servers)
| 269/233/258/230/242 || 269 || 246 
|-
! mod_fastcgi/suexec/php-fcgi (static, 4 servers)
| 260<nowiki>////</nowiki> ||  || 
|-
! mod_fastcgi/suexec/php-fcgi (static, 5 servers)
| <nowiki>////</nowiki> ||  || 
|-
! mod_fastcgi/suexec/php-fcgi (static, 10 servers)
| <nowiki>////</nowiki> ||  || 
|-
! mod_fastcgi/suexec/php-fcgi (static, 15 servers)
| <nowiki>////</nowiki> ||  || 
|}

--[[user:mschiff|mschiff]] 01:55, 12 Jul 2005 (CEST)
Links2Linux Wiki

User Tools

Site Tools

Page Tools
