No pain no gain

While Apache is a great server for delivering dynamic content and especially hosting PHP-based websites, it has a high memory footprint and a high overhead when forking new worker processes during high server load. In this article I will describe how you can use the nginx web server as a reverse proxy for your Apache to deliver static files instead of Apache. Nginx has a very small memory footprint and can deliver static files lightning fast.

The idea behind this setup is that nginx will listen on port 80 for incoming connections, identify whether the client requests a static file or a dynamic webpage. In case of a static file it will deliver the file itself. In case of a dynamic request it will forward that request to the Apache server.

Read the rest of this entry »

By default PHP scripts are compiled on each access. This will become a real performance killer once your website hits a certain load. There is a number of Opcode caches available which try to overcome this recompiling issue by storing precompiled versions of your scripts in a cache. This blog entry will explain how to integrate the Alternative PHP Cache (APC) into your PHP5 installation. This tutorial is based on a Debian installation, but it should also work with alternative distributions.

APC ist installed using the PHP Extension Community Library (PECL). Using PECL ist similar to using the PEAR Library. Before you can install APC via PECL, make sure that you have the following packages installed:

aptitude install php5-dev php5-gd

Downloading compiling and installation of APC using PECL ist a breeze. Just run from the command line:

pecl install APC

Now all you need to do is to add the following line to your php.ini file which you should find in /etc/php5/apache2/:

extension=apc.so

Once you restart Apache, caching will be enabled with default settings of APC. By default APC will use 30 MB memory to cache your PHP files. It is a good idea to tailor this setting to your server. This can be done with the following line in php.ini:

apc.shm_size=30

Time for another enhancement for the Apache web server. If you followed my other 2 Apache postings, you will have a secure web server configuration which has SSL enabled and is monitored by the mod_security application level firewall. Now it is time to setup the WebDAV module so that you can use your web server as an external file storage.

Read the rest of this entry »

Now that the basic Apache configuration is working, let’s take some time to harden the installation. The module mod_security is really handy for this task. It is an application level firewall meaning that it will inspect incoming requests to the webserver and try to identify possible attacks like code injection, SQL injection and cross-site-scripting. As handy as this tool might be, it is not meant as a substitute for a secure PHP or Apache configuration, so you still need to take care not to open potential security holes there. If you followed my basic Apache and PHP setup you should be on the safe side, as the most exploited security holes have already been closed.

Read the rest of this entry »

After setting up the mail system, I continued today with the basic webserver setup. This setup includes a basic Apache2 configuration with SSL and name based virtual hosts. PHP5 and MySQL5 are also needed for serving dynamic content.

Read the rest of this entry »