Linux server discussion

[Hescominsoon]

This is a fork of this thread. I want to get that thread back on topic..

ya, lighttp, mysql and dnsmasq. I'm trying to get rid of large scale applications in favor of things that should run faster and handle a larger scale of simultaneous clients. Not to mention cutting out the cpanel licensing and headaches.

I am learning quite a bit about tuning apache right now. I've been playing with module disabling/deletion, turning off the pre-fork mode and going purely multithreaded, and tweaking other settings. The cga server was my first chance of tweaking and now my own webhosting server is another tweaking learning tool..

 

[Atown]

is it easy to set something up for colo?? i found a place in seattle that will colo me for free

 

[vibrokatana]

is it easy to set something up for colo?? i found a place in seattle that will colo me for free

Depends on how much you like remote administration.

You will need to know how to fully setup and administer the system using the command line. Just note that you are responsible for any hardware issues and may experience downtimes from several days to weeks if something fails. Colo is pretty much dirt cheap if you can cut the middle man and know the contacts, you may want to look into the pipe they will give you and how much bandwidth you will get.

I have about had it with apache. It is big, bloated, annoying to configure and has subpar performance due to it reading files like .htaccess every stinking time someone requests a page. I had heard about lighttpd awhile ago and decided I would look into it, the benchmarks make apache look like a sick dog, but you loose some features.

MySQL seems to have pretty good performance under light load, it is pretty funny to see every word press site that gets hit by dig drop like a dead horse though. Firebird looked pretty interesting, but you have less market share so your rather limited with what will run on it. Oracle and PostgreSQL require rather beefy machines for their advantages to be seen. MsSQL just makes me laugh, do a update from an as400 to a database and watch queries start failing left and right.

My other beef: bind, I have a special cron job restarting that service every 2 hours because it always ends up failing over and over again, grrr! It's only real benefits come with large numbers of clients, dnsmasq might fulfill the needs somewhat better for a webserver IMO but I still need to look over the configuration to see if it can be authoritive.

 

[Hescominsoon]

From a security standpoint rereading .htaccess and .htpsswrd everytime is great. Since i am establishing a secure webhosting environment i'll take the performance hit..

is it easy to set something up for colo?? i found a place in seattle that will colo me for free

yes it is..you don't HAVE to use CLI. You can install webmin(i do all of my high level admin stuff through webmin) but you still really need to know how to do cli stuff. What host is this that's hosting you for free? I might be in the market for another colo host.

 

[vibrokatana]

From a security standpoint rereading .htaccess and .htpsswrd everytime is great. Since i am establishing a secure webhosting environment i'll take the performance hit..

The smarter thing to do would be to cache it, only querying it once every 5-10 minutes would improve performance by a good percentage on sites with heavy load. Lighttpd caches all the stuff at runtime and can dynamically reload the configuration as needed, much better design IMO.

 

[vibrokatana]

yes it is..you don't HAVE to use CLI. You can install webmin(i do all of my high level admin stuff through webmin) but you still really need to know how to do cli stuff. What host is this that's hosting you for free? I might be in the market for another colo host.

CLI administration is a major major boon because invariably all the fancy GUIs will blow up and leave you to figure out how to fix things. Familiarity with the underlying systems will help, especially when unintentional configuration errors leave you bashing your head against the wall.

Ya, I wouldn't mind, I even have an extra 1U server lying around. It's only a 2x p3 1GHz, but that would make an awesome server (provided it doesn't give up the ghost randomly).

My main complaint against control panels are that they provide a rather blatant security target. By eliminating a pretty backend people are forced to rely on stuff like SQL injection or brute force attacks. You could always block out the ports on the firewall and use a socks proxy over ssh to access it and effectively make it invulnerable, but most people leave services out in the open.

 

[Atown]

Its seattle Community Colocation http://www.seaccp.org/

its for linux enthusiast, npos, etc. whats CLI? and yeah VK thats pretty much the unit im going to be tossing in there

 

[vibrokatana]

lighttp is beautiful out of the box, at least the config file doesn't look like Frankenstein, *cough* apache, comments don't span 10 pages. The config files are lua scripts I think, it was a dependency and the formatting looks similar (I only glanced over the language a few weeks ago).

There is a nifty module that automatically fetches files based on the domain name from the document root, seksi for those people who host more then one domain. PHP takes all of 20 seconds to install by uncommenting a few lines, it goes through fastcgi instead of a native module, you could probably add in more scripting languages just by adding in a descriptor of the end tag and the path to the executable.

I think I may just use a managed DNS from my registrar, then I only really have to setup MySQL. Only allow ports 80 for HTTP, the SSL port, and port 22 for SSH. Throw in denyhosts to protect from bruteforcers, SElinux seems to be enabled so that will have fun. Security is almost too easy For backup I will use rdiff-backup, incremental backups made almost too easy.

See setting up linux servers isn't hard at all [/sarcasm]

 

[vibrokatana]

Its seattle Community Colocation http://www.seaccp.org/

its for linux enthusiast, npos, etc. whats CLI? and yeah VK thats pretty much the unit im going to be tossing in there

Ya, I saw a few of those, you have to be non profit though. Most of my stuff is considered "for profit" in the broadest sense.

CLI/GUI______________
Command Line Interface
Graphical User Interface

 

[Atown]

It would be for a club thats an NPO, along with a minor personal sub-domain relating to the club and my bloging about it

 

[Hescominsoon]

The smarter thing to do would be to cache it, only querying it once every 5-10 minutes would improve performance by a good percentage on sites with heavy load. Lighttpd caches all the stuff at runtime and can dynamically reload the configuration as needed, much better design IMO.

from a performance standpoint yes..but not from a security standpoint.

I run all php, ruby, cgi, perl..etc etc as the domain's user inside of a cgi/fastcgi user NOT as the apache or root user. This can cause problems with older scripts but so far i haven't run into any issues with anything modern....

 

[Hescominsoon]

CLI administration is a major major boon because invariably all the fancy GUIs will blow up and leave you to figure out how to fix things. Familiarity with the underlying systems will help, especially when unintentional configuration errors leave you bashing your head against the wall.

Ya, I wouldn't mind, I even have an extra 1U server lying around. It's only a 2x p3 1GHz, but that would make an awesome server (provided it doesn't give up the ghost randomly).

My main complaint against control panels are that they provide a rather blatant security target. By eliminating a pretty backend people are forced to rely on stuff like SQL injection or brute force attacks. You could always block out the ports on the firewall and use a socks proxy over ssh to access it and effectively make it invulnerable, but most people leave services out in the open.

webmin doesn't use sql, runs in https mode natively upon installation among other things. there has not been a major security incident for webmin in a while. I often use it's modules to configure my firewall(via shorewall) as well.

It's interesting this time it wasn't webmin that blew up but the system itself after a kernel update went bad. Also with webmin..unlike just about every other panel..it does not populate your system with non-standard packages. If it needs apache it installs the apache that comes with your distro..same for postgres and mysql..etc etc. It only uses it's own packages for itself. This has and dies significantly reduce the chance webmin can hose your system. Frankly i have yet to run into a webmin problem that was not soled by a yum erase webmin followed by a yum install webmin.. Best of all..it's free(and hte virtual hosting module called virtualmin is free too). I do use the pro(paid) version of virtualmin though to help support hte project.

 

[vibrokatana]

from a performance standpoint yes..but not from a security standpoint.

maybe, only a few systems modify the .htaccess like mad to the point where you would need it IMO.

I run all php, ruby, cgi, perl..etc etc as the domain's user inside of a cgi/fastcgi user NOT as the apache or root user. This can cause problems with older scripts but so far i haven't run into any issues with anything modern....

Pretty common practice. It also sends out mail as the user executing and not nobody, which makes tracking spamming offenders easier.

 

[vibrokatana]

webmin doesn't use sql, runs in https mode natively upon installation among other things. there has not been a major security incident for webmin in a while. I often use it's modules to configure my firewall(via shorewall) as well.

The iptables config looked easy enough so I just left it in there, if something blows up I can give it the recovery console. https doesn't really stop anyone from hacking into something, it only prevents (to a certain degree) people from sniffing the connection and grabbing the plaintext.

 

[Hescominsoon]

The iptables config looked easy enough so I just left it in there, if something blows up I can give it the recovery console. https doesn't really stop anyone from hacking into something, it only prevents (to a certain degree) people from sniffing the connection and grabbing the plaintext.

exactly..that's part of a secure server.. It is amazing how many unsecured or badly misconfigured webhosting server are really out there though. Just a few basic steps can really make all the difference in the world. I am now observing the selinux warnings about what webmin is tripping so i can 1. report them to webmin for future releases and 2. write rules so i can run selinux in active mode instead of permissive..<G.

 

[vibrokatana]

exactly..that's part of a secure server.. It is amazing how many unsecured or badly misconfigured webhosting server are really out there though. Just a few basic steps can really make all the difference in the world. I am now observing the selinux warnings about what webmin is tripping so i can 1. report them to webmin for future releases and 2. write rules so i can run selinux in active mode instead of permissive..<G.

I was sorta hoping they would release selinux policies for certain packages. I've really only seen a few out there. The original idea behind selinux was that programs would be broken by it, but that targeted policies would be written to support broken programs and eventually phase out the issues. While it is a pretty bad pain for certain programs the extra layer of security is very nice and has been proven to stop a few exploits.

 

[Atown]

let me ask you, would a community colo like the one im visiting be less secure?? and also HCS if u looked at the link does it look... i unno..... look pro i guess? technically i could get 2 ip's if i can justify it which would be kool

 

[vibrokatana]

let me ask you, would a community colo like the one im visiting be less secure?? and also HCS if u looked at the link does it look... i unno..... look pro i guess? technically i could get 2 ip's if i can justify it which would be kool

Visit the location, if you aren't stopped at the door and presented with hefty security and see cameras everywhere chances are they aren't paying much attention to it.

 

[Atown]

yeah i have to go there myself and install it

 

[vibrokatana]

technically i could get 2 ip's if i can justify it which would be kool

You can host as many sites on 1 IP as you want, having more won't increase your speed in most cases. The main reason for having unique IPs is that search engines tend to rank shared IPs lower.