Apache web server magic on IBM i. Alan Seiden Consulting alanseiden.com

Transcription

1 Apache web server magic on IBM i alanseiden.com

2 Alan s PHP on IBM i focus Consultant to innovative IBM i and PHP users PHP project leader, Zend/IBM Toolkit Contributor, Zend Framework DB2 enhancements Award-winning developer Authority, web performance on IBM i 2

3 Founder, Club Seiden club.alanseiden.com 3

4 Contact information Alan Seiden alanseiden.com 4

5 What can Apache serve? Web sites and applications Allows limited access via TCP/IP requests APIs, web services Any kind of file Static or dynamic data 5

6 Apache can be extended via modules 6

7 Requrements, prerequisites 7

8 Ensure that LICPGM is installed 8

9 rzaq9/rzap91pp5770dg1wrapper.htm 9

10 Using Navigator for i 10

11 Minimum Software Requirements Extended base directory support 5770-SS1 Option 3 Host Servers 5770-SS1 Option 12 Qshell 5770-SS1 Option 30 IBM Portable Applications Solutions Environment for i 5770-SS1 Option 33 IBM TCP/IP Connectivity Utilities for i 5770-TC1 IBM Developer Kit for Java 5770-JV1 Option 11 rzaie/rzaieinstallingprereq.htm 11

12 Permissions for administrators *IOSYSCFG Special Authority *CHANGE Authority to the library object QUSRSYS *ALL authority to the following objects: QUSRSYS/QATMHINSTA QUSRSYS/QATMHINSTC Tip: QATMHINSTC is where the instance really goes *USE authority for these command objects: STRTCPSVR, ENDTCPSVR *RX authority for: root (/) /www *RWX authority for directory /www/server_name/ 12

13 Let s create a web server instance 13

14 Using Navigator for i web administrator Start at port 2001 Redirects to secure port

15 Find HTTP and DCM tasks 15

16 Choose web administration 16

17 Web admin menu 17

18 Create new HTTP server 18

19 Proceed with the wizard 19

20 Finish Hit green start button 20

21 It works! Go to Use actual IP or domain name Sample HTML page will appear 21

22 If it didn t work: debug tips DSPMSG QSYSOPR will show error message and job number Check error log in QTMHHTTP s spool files: WRKSPLF SELECT(QTMHHTTP) Common reason for failure: IP/port already allocated 22

23 Detailed troubleshooting 1. DSPMSG QSYSOPR; find startup error ("HTTP Server instance ZENDSVR6 start up failed.") 2. Put cursor on message; press F1 to see details 3, Within detailed message, look for job info (something like /QTMHHTTP/ ZENDSVR6) 4. Copy that info (108846/QTMHHTTP/ZENDSVR6) to your clipboard 5. WRKJOB <the job info> 6. Type "4" to see spool files, the job log of dead job 7. Type "B" to go to the bottom. Then scroll back up till you see a "40" level error. 23

24 See active connections 24

25 Green screen method: NETSTAT NETSTAT *CNN is the shortcut 25

26 26

27 27

28 28

29 29

30 Navigator for i method 30

31 31

32 32

33 33

34 34

35 Configure it 35

36 Modifying Configuration Directives Change listener ports Restricting access Define multiple-domain Virtual Hosts Enable load balancing Other security suggestions More... 36

37 Editor built into the admin GUI 37

38 Other ways to edit GUI editor is safest (no CCSID issues), but Edit as you would any IFS file Configuration file /www/yourserver/conf/httpd.conf Connect to IFS via: Notepad++ Zend Studio or similar editor, and copy/paste/edit from there Edit on your PC and transfer with FTP/SFTP/SSH program (e.g. Filezilla) or IBM i Navigator 38

39 Restart to test any configuration change Restart 39

40 Setup or Change Listeners/Ports # Apache Default server configuration # General setup directives Listen *:80 Allow requests to IP address through port 80 Listen :80 Allow SSL connections to port 8443 as well [Alan] Listen :80 Listen *:8443 https 40

41 Multiple servers in one configuration This example will provide two virtual host configurations under the same web server instance NameVirtualHost <VirtualHost > ServerName DocumentRoot /www/domain1 </VirtualHost> <VirtualHost > ServerName ServerAlias domain2.com *.domain2.com DocumentRoot /www/domain2 </VirtualHost> 41

42 Security tips 42

43 Reverse proxy in front Reverse proxy: a front door that transparently pulls content from another server (i.e. your real server). Benefits: Extra layer of protection Don t reveal the real server s address Give your real server a private address Access from inside only Provide a united front to multiple web servers A single web site can pull from many other sites, transparently A way to add features (e.g. SSL) to web servers when you can t control them directly Caching and content manipulation Some are optimized for this (e.g. Varnish) 43

44 Options for reverse proxy Appliance Runs in your network is a popular one Cloud-based Includes CDN, optimizer, more Your own IBM i partition in the DMZ Easy to administer Separate server (e.g. Linux) if you have the skills 44

45 IBM i reverse proxy configuration LoadModule proxy_module /QSYS.LIB/QHTTPSVR.LIB/QZSRCORE.SRVPGM LoadModule proxy_ftp_module /QSYS.LIB/QHTTPSVR.LIB/QZSRCORE.SRVPGM LoadModule proxy_http_module /QSYS.LIB/QHTTPSVR.LIB/ZSRCORE.SRVPGM LoadModule proxy_connect_module /QSYS.LIB/QHTTPSVR.LIB/QZSRCORE.SRVPGM # URL path /prod/ will pull content from server.200 <Location /prod/> ProxyPass ProxyPassReverse </Location> # URL path /test/ will pull content from server.201 <Location /test/> ProxyPass ProxyPassReverse </Location> 45

46 Restrict access to particular IP addresses Allow from ibm.com Allow from 10.0 Allow from Directive Syntax: Allow from all host env=[!]env-variable [host env=[!]env-variable] Deny from all Directive Syntax: Deny from all host env=[!]env-variable [host env=[!]env-variable] 46

47 Restricting continued This example will allow access to the docroot folder only from connections originating from ibm.com subdomains and from addresses matching 10.0.*.* or *.* <Directory /www/yourserver/htdocs> Order Deny, Allow Deny from all Allow from ibm.com Allow from 10.0 Allow from </Directory> 47

48 Set permissions on directories Secure programmer and QTMHHTTP access after making changes or creating instances. QTMHHTTP is default web server user WRKLNK with option 9 or these commands CHGAUT OBJ( /www/yourserver ) USER(JANPGMR) DTAAUT(*RX) OBJAUT(*NONE) SUBTREE(*ALL) CHGAUT OBJ( /www/yourserver/htdocs ) USER(JANPGMR) DTAAUT(*RWX) OBJAUT(*NONE) SUBTREE(*ALL) CHGAUT OBJ( /www/yourserver/htdocs ) USER(QTMHHTTP) DTAAUT(*RX) OBJAUT(*NONE) SUBTREE(*ALL) 48

49 Other security suggestions Do not divulge information about the server s operating system or Apache version ServerTokens Prod Do not show directory index page <Directory /www/yourwebsite> Options -Indexes Order Allow, Deny Allow from all </Directory> 49

50 Enable Secure Sockets Layer (SSL) 50

51 Types of domain certificates Single domain certificate Multiple domain certificate Wildcard certificate (i.e. *.yourserver.com) Standard (verifies business identity and domain ownership) Extended Validation (additional level of verification) Encryption (128 or 256 bit/sha-1 or SHA-2) 51

52 Enable SSL 52

53 53

54 Digital Certificate Manager (DCM) 54

55 Go into *SYSTEM certificate store 55

56 We want a Server certificate 56

57 Create certificate signing request (CSR) Specify: Minimum 2048 bits Exact Common name 57

58 Submit CSR to a CA vendor many more... 58

59 CA vendor s form Follow the steps required by the Certificate Provider. Be prepared to provide account information including organization details, contact names and information, payment information and domain specific details. In most cases a representative of the certificate issuer will be contacting and verifying information provided to assert the authenticity of the request for the domain being requested. 59

60 Save certs to IFS on IBM i Certificate Factory Magic Certificate (Your Certificate) Intermediate Certificate 1 ** Intermediate Certificate 2 ** Root CA Certificate *** ** You may need to download this certificate from the certificate provider *** Root CA certificate may already exist 60

61 Root Certificates may already be included in the store 61

62 Import root and intermediate certificates Provide paths of CA certs you had copied to IFS 62

63 Import your server certificate 63

64 Assign cert to applications With the certificate imported into the store now its time to assign it to the applications that will use it. Select your new certificate from the list provided Note: Only applications already defined to use SSL will be shown on the list. Once you enable security for a Web Server instance it is then added to the application list showing the servers available for certificate assignment. 64

65 Success! Almost there Restart Web Servers to activate new SSL certificate Restart 65

66 Optional: combine virtual host with SSL # specify IP address the server is running on <VirtualHost xx.xx.xx.xx:443> # server application name set up earlier SSLAppName QIBM_HTTP_SERVER_DEFAULT SSLEngine On SSLCacheDisable </VirtualHost> Listen xx.xx.xx.xx:443 NameVirtualHost xx.xx.xx.xx:443 66

67 It works! How to tell if SSL is working Try in a browser; page should appear Lock icon appears Click the lock for more information 67

68 URL Magic 68

69 Rewrite rules Why change a URL? Use friendly URLs Replace /cgi-bin/lansaweb?procfun+jokpubw+jokpw03+dev with /literature/request Use consistent URLs www. vs. no www Redirect to another URL 69

70 I changed my mind on a URL name I made the name too long /articles-and-publications-by-alan-seiden Now I want to shorten it /articles-and-publications but not break my site for anyone RewriteRule to the rescue Both URLs point to the same place now # Map old directory to new RewriteRule ^articles-and-publications-by-alan-seiden(/)?$ / articles-and-publications/ [R=301,L] 70

71 Search engine optimization trick Some people type www. Some omit it Some web sites will link to me with www and some not alanseiden.com I want search engine credit combined as one site, not split as two # Example used on alanseiden.com # Google and browsers will see www site as the definitive address. # R=301: permanent redirect RewriteCond %{HTTP_HOST} ^alanseiden.com RewriteRule (.*) [R=301,L] 71

72 Redirect to https (SSL) # non-ssl Listen :80 <VirtualHost :80> # redirect to HTTPS RewriteEngine On RewriteRule ^/(.*) [NC,R,L] </VirtualHost> # SSL Listen :443 <VirtualHost :443> SSLEngine On # whatever application name you defined SSLAppName QIBM_HTTP_SERVER_DEFAULT SetEnv HTTPS_PORT 443 DocumentRoot /www/yourserver/htdocs <Directory /www/yourserver/htdocs> Allow from all </Directory> </VirtualHost> 72

73 Hide your underyling technology Which do you prefer? /cgi-bin/lansaweb?procfun+jokpubw+jokpw03+dev or /literature/request Show friendly URLs that call your programs #Map a friendly URL to another internal address (in this case, LANSA for the web) RewriteRule ^/literature/request$ /cgi-bin/lansaweb?procfun+jokpubw+jokpw03+dev [PT,L] 73

74 Let your imagination run free Rewrite rules are powerful and can be complex mod_rewrite.html#rewriterule They use Regular Expressions Experiment here: Regular expression tester 74

75 Performance 75

76 Request-response protocol Client (browser) requests a file; server responds One file at a time (at most 2 6 in parallel) Browser requests HTML file, then as it parses HTML, finds other file names to request (images, css, js...) 76

77 Requests can be blocking in browser Browsers typically limit themselves to 2 6 parallel requests to a given server File requests stack up, blocked by prev. requests Above, even 304 not modified files caused blocking Solution: reduce number of images or improve caching via Expires headers 77

78 Example: Expires headers (caching) For aggressive caching, place these directives in Apache config file Can specify file types ExpiresActive On # A means expire after a month in the client's cache ExpiresByType text/css A ExpiresByType application/x-javascript A ExpiresByType application/javascript A ExpiresByType text/html A ExpiresByType image/png A ExpiresByType image/gif A ExpiresByType image/jpeg A Many options: 78

79 More ways to reduce blocking If many.js or.css files are used: Combine them into fewer files Move contents of smaller.js or.css files inline to your pages, eliminating those external files Page Speed tool will help you decide 79

80 Create a favicon for your site Browsers always look for a file called favicon.ico in your document root Those little icons that appear in the browser Once found, will be remembered by browser If not found, will be requested every time How to create a favicon: 80

81 Keep HTTP connections alive Enable KeepAlive setting in Apache The TCP connection will stay open, waiting for you Good when downloading many images, css, js files You ll reduce the number of three-way handshakes that establish a connection Even more important with longer SSL handshakes 81

82 KeepAlive details Configurable by number of seconds, number of files to be downloaded, before closing connection Recommended settings for average site KeepAlive On KeepAliveTimeout 15 Details: Don t overdo it you are locking out other users from that HTTP job while it s dedicated to you 82

83 Connecting takes time Clues that Keepalive is off Connection: close, Connecting Example bottom right: 3.6 seconds Connecting (longer than average but it really happened) 83

84 What you see when Keep-alive is on Firebug s Net tab shows Connection: Keep- Alive, and, here, timeout=300 seconds (5 minutes) Zero seconds to connect Keep-alive is working! 84

85 Each request passes through several layers 85

86 Compression reduces file size Called gzip or mod_deflate, the same for our purposes Compresses, speeds up html, javascript, css, favicons, anything text-based 86

87 Netflix improved with gzip/deflate Saw 13-25% performance improvement Cut outbound traffic in half That saves money for a busy site such as Netflix Details: It really works! 87

88 My compression test DB2_SQL_example.php Before compression: 31.0kb; loaded in 250ms After compression: 4.4kb; loaded in 109ms. That s 14% of the size and 50% of the time! 88

89 Details of deflate/gzip compression Apache directives (sample) # Load IBM i's module that performs compression LoadModule deflate_module /QSYS.LIB/QHTTPSVR.LIB/QZSRCORE.SRVPGM # Specify content types to compress AddOutputFilterByType DEFLATE application/x-httpd-php application/ json text/css application/x-javascript application/javascript text/html Tutorial on my blog: Apache reference: 89

90 Maximum simultaneous HTTP requests Set ThreadsPerChild in httpd.conf Default: ThreadsPerChild 40 Increase to number of expected HTTP connections 90

91 Load balancer 91

92 Apache as load balancer Variation on reverse proxy shown earlier Send requests to multiple servers Round-robin Ignore dead servers Scaling an application: a single server can farm out requests to other servers High availability Details: ssw_ibm_i_71/rzaie/rzaiemod_proxy_balancer.htm 92

93 Load balancer configuration # All requests (/ root) will be handled by balancer ProxyPass / balancer://mycluster/ stickysession=phpsessionid nofailover=off # Balancer definition <Proxy balancer://mycluster> BalancerMember BalancerMember smax=10 # Less powerful server. Don t send as many requests there BalancerMember smax=1 loadfactor=20 </Proxy> 93

94 Apache is your site s front door Make it look nice and clean Ensure that it is locked Dropping the door metaphor, you can also Improve performance by knowing the directives to use Improve search engine optimization Improve ease of use Offer APIs securely Share your Apache or other web server stories or questions 94

95 Questions 95

96 Contact Alan Seiden Ho-Ho-Kus, NJ Free PHP tips: