Ask MetaFilter questions tagged with webserver

Cool things to do with my virtual machine?

teraspawn — Wed, 09 Jan 2013 09:05:54 -0800

I've just signed up for a virtual server, and I'm looking for ideas of fun things to use it for. I'm intending to run a web server, an instance of OwnCloud and a PyScrabble server from it. Is there anything else I should consider?

How to backup remote web server and email on servers?

Brandon Blatcher — Fri, 17 Aug 2012 10:40:40 -0800

Backing up a web server and the email on it to a local machine, how to do? If one is hosting a remote and a private webserver with two websites on it, along with email for various accounts, how does one back up all of the files on the webserver and said email accounts, to a local machine? No need for database backups, they're taken care of my the hosting company. But we're responsible for our files and email accounts.

Ideally, this would be automated and the email would retain the folder structure of the various accounts.

There's no place like localhost... please help me get back there...

sodium lights the horizon — Wed, 23 May 2012 10:12:21 -0800

Just installed Apache on a new machine, and now any calls to localhost goes to one of my VirtualServers instead of the docroot. Help! I've read a dozen promising looking posts on various sites, but none of them seem to touch my problem...

I have a dev machine here (win7 / apache 2.2.21) which is supposed to be serving three things - localhost, site1.dev and site2.dev . No matter what I do, any attempt to browse the url http://localhost is serving me site1.dev instead.

Here's what looks like the relevant bits of my httpd.conf (irrelevant bits snipped ([...]).

[...]

Listen *:80

[...]

ServerName localhost:80
DocumentRoot "W:/wamp/www/"
<Directory "W:/wamp/www/">
   Options Indexes FollowSymLinks
   AllowOverride all
# onlineoffline tag - don't remove
   Order Deny,Allow
   Deny from all
   Allow from 127.0.0.1
</Directory>

[...]

NameVirtualHost *:80

<virtualHost *:80>
   ServerName site1.dev
   DocumentRoot "W:\wamp\www\site1"
</VirtualHost>

<virtualHost *:80>
   ServerName site2.dev
   DocumentRoot "W:\wamp\www\site2"
</VirtualHost>

Any suggestions as to what I'm getting wrong?

Please help me configure and secure my Ubuntu-based combined home file server/public web server/VNC server!

dilettanti — Fri, 07 Oct 2011 15:20:21 -0800

Please help me configure and secure my Ubuntu-based combined home file server/public web server/VNC server! I am building a low-ish power home file server, which will likely run Ubuntu 11.04 or 11.10 (possibly server edition), and I should be able to set up a basic samba share easily enough. But I would also like to use the same computer to serve a few basic webpages, and I would like to provide ssh and ideally VNC or RDP-like access from outside the LAN. I can probably get the basic software set up, but I'm a n00b when it comes to NAT stuff, firewalls, and security issues generally. I would also appreciate help with setting up dynamic DNS. My primary goals are, in order of priority: (1) to have my personal files stored centrally on a machine I physically and logically control at home; (2) to have those files accessible by me (and only me) from anywhere (and accessible without authentication by anyone on my home LAN); (3) to host low-traffic, personal, non-commercial, publicly accessible websites on my own server; and (4) to be able to remote into the server via VNC, RDP, or some similar method/protocol - all to the extent I can do so without opening myself to significant data security risks. I'd also love to host my own mail/SMTP server at some point, but I don't plan on tackling that anytime soon.

To achieve goal (1), I was planning on setting up a dedicated HDD (possibly a RAID array, but I'm leaning toward just rsync-ing the primary HDD nightly to another disk) as a samba share with no authentication. That should be accessible by the five Windows computers in our household and any other computer on our LAN. This setup should be fairly straightforward (though I welcome comments on any common pitfalls).

To complete goal (2), I plan to configure ssh to allow limited users access from outside the LAN, which would allow sftp or scp. I currently have ssh access to a NAS box at home, which I accomplished by forwarding port 22 to the NAS. I initially plan to replace the NAS with this new server, and simply continue to have port 22 forwarded, but am not well educated on the security risks of doing so (though I haven't experienced any problems so far - that I know of). The challenge is with DNS: I don't have a static IP address WAN-side, so I need to find a way to do dynamic DNS. See also Goal 3:

Goal (3) is where I start having real trouble. Given a static IP address, I can configure apache and just fine, and I've been using the free ZoneEdit for DNS for websites hosted on a server with a static IP address. But I'd like to get rid of that server account and move everything to a home server, and (a) I don't have a static IP address WAN-side, (b) I don't know anything about setting up dynamic DNS updating on the server, (c) I don't know how a dynamic IP address will affect the apache config (is listening on ports 80 and 443 enough? do I have to mess with the hosts file?), and (d) I have no idea what security risks I will face running apache on a home webserver with ports 80/443 forwarded to it. Any good suggestions or links for dynamic DNS (preferably free), and how to get it to work locally? I am happy to use DNS services like ZoneEdit, and do not need to run my own DNS (or do I??). Do I have to do anything with BIND? Because I don't understand BIND at all. Or DNS generally, really. Websites are very low-traffic and non-commercial. I currently have four domain names I use.

Goal (4): I assume I can install OpenVPN and use TightVNC, xrdp, ThinLinc, or something similar that does not go through a fixed third-party server or require subscription. Ideal solution would be something with a portable client that I could run from my work computer, on which I have very limited privileges (but I can run PortableApps apps, for example). I've never set up anything like these programs, but I can probably get through it. But to the extent I need to tunnel them through ssh, I don't know how to do that at all. Is that set up in the VNC/rdp config file (e.g., by just setting an option flag to use ssh)? Or is it more complicated than that? And will I run into NAT issues? I would rather not use something like Hamachi that requires an account on a proprietary server elsewhere. Any good suggestions for what to use? Know of any good tutorials? The more functionality the better: I'd love to be able to transfer files, remote audio playback, mouse/keyboard integration, etc.

Security concerns: the server will be directly connected to a D-Link DIR-655 router, which currently has near-default security settings (it is password protected, with web admin disabled, but that's about it). I have no other firewall or security hardware. Do I need to set up a firewall on the Ubuntu server? Suggestions on which one to use, and how to set it up? For what it's worth, I've not been able to make sense of any iptables documentation, so I'll need a dummy's guide to anything like that. Other security measures I need to take, e.g., beefing up the /etc/hosts file or running other protective software?

The hardware I have for the server should be adequate for my needs: I got an AMD E-350 APU (mobo) with 8 Gb DDR3 RAM, which should be plenty of CPU and more than enough memory. If I run linux, I'll probably set up a large, dedicated swap partition. I'll be running the OS on a separate HDD from the shared drives to minimize wear to the shared drives. The server will be connected to the LAN through a gigabit connection to the router.

As far as software is concerned, I am much more comfortable with linux than Windows for server-related functions (and Ubuntu more than other distros), and Ubuntu is free, so I am inclined to run some version of Ubuntu, but I am open to other suggestions, e.g., if running WHS with a virtualized linux webserver, say, is a vastly superior option for some reason.

A couple of limitations: I cannot have a separate, dedicated web server (whether in a DMZ or otherwise) - Comcast's terms of service for our home internet service prohibit running a dedicated web server, but I believe they do not forbid serving non-commercial web pages from a machine not solely dedicated to that purpose. Additionally, I would rather not incur the expense of building an additional server. So if possible, I would like to keep the web server on the same machine as the file server. Finally, I am a lawyer with no formal CS training or education, and have no real understanding of routing, TCP/IP, DNS, or the general operation of the intarwebs. As far as I know, "packets" are what ketchup (or catsup) come in. So while I can navigate the linux command line, I'm a dummy when it comes to the important stuff.

Do you have any security tips for me or good links that a n00b like me can make sense of? Suggestions for remote access packages, or for how to configure them for security and ease of use? Any pointers or pitfalls to watch for in setting up a webserver on a machine that also holds all my important personal data? Am I crazy to even try? And, of course, much of this may depend on me getting a dynamic DNS system set up, so I would greatly appreciate tips or suggestions in that arena.

Thanks in advance for your help!

Advice on website hosting

a womble is an active kind of sloth — Sat, 24 Sep 2011 10:39:20 -0800

Who do you recommend for small-scale web hosting? I'm looking to change internet hosting and wondering what the hive-mind recommends. I currently have shared linux hosting on GoDaddy (and subsequently a website with some mysql databases, and a wordpress blog, as well as domain names registered with GoDaddy). The reason that I need new hosting is because I now need admin access to linux for some software that I want to install (postgresql and postgis).

I've heard a few anti-recommendations for GoDaddy from friends (and seen quite a few online) but I can't personally fault it aside from my wordpress blog running very slowly. I do find that moving from their cheapest web-hosting to a virtual server is quite an increase in price. As I have very little knowledge about how much it should cost, I'm wondering if paying for ~$30 for 1 GB RAM, 15GB storage and 500 GB/mo bandwidth is good value.

Part of the reason I am considering staying with GoDaddy is because I thought it would be easier to move my current site/blog to the new server but it turns out that I can't migrate any of it anyway, so I have to set up everything from scratch.

Also, although I'm becoming more familiar with how the various pieces fit together, I'm also not sure I can do it all using just ssh access. Is it worth paying extra for something like plesk or cPanel for managing such a server?

The general objective of this site is to showcase some aspects of my academic research. At the moment it receives a low level of traffic, but I would expect this to slowly grow so bandwidth limitations are not an issue!

How can I get IIS's Directory Browser to sort numbers like numbers, and not alphabetically?

John Kenneth Fisher — Tue, 06 Sep 2011 11:55:30 -0800

How can I get IIS's Directory Browser to sort numbers like numbers, and not alphabetically? Is there a way (or a third-party module I can use instead) that will let IIS's Directory Browsing module sort numbers like 1,2,3,4,5... instead of 1,10,11,12...19,2,20,21... ?

If you're not sure what I mean, I have a screenshot here.

IIS7 on Windows 7 Pro, if it matters.

How do I manage a single database with multiple web servers?

vraxoin — Thu, 28 Jul 2011 15:41:10 -0800

How do I ensure data integrity when using multiple load-balancing servers? I'm sure this is a simple question for some of you, but this is a new area for me. The basic setup is this: I've got a single database server that's used to create giant lists of emails to be sent out (not spam! I promise!). In order to increase throughput, I intend to create multiple load balance servers on my rackspace cloud. So basically each of these servers will do nothing but query the database and get a bunch of information about what to send, then send it, then report back to the db about what's been sent. The question is this: what's the most effective means for keeping the load balanced servers from stepping on each others' toes, datawise (i.e., how do I stop two servers from accidentally grabbing the same data between the SELECT and UPDATE queries)? I'm sure there's a simple answer to this, but I don't know what it is.

How can I manually backup/restore an entire WHM/cPanel account?

ofcourseican — Thu, 17 Feb 2011 10:54:47 -0800

I'm looking for a manual alternative to the WHM's built in "Copy an account..." function. I'm wondering how to manually carry out the WHM "Copy an account from another server" function. I'm decent with the command line and am comfortable (though admittedly n00bish) writing a script to do this. My purpose is to avoid having to rely upon WHM's black box and know how to perform this type of backup/restore myself. (I'm also not 100% sure that this black box function will backup/restore *everything*.)

What I'd like to do is make complete backups of a small server (CentOS) that I have, so that if it ever dies, I can restore said backups onto another CentOS server (if the server burns to the ground, the built-in WHM option won't be much use, heh). I'd love to just be able to copy/paste files from the backup to the new server, but I know I'll have to do some permissions tweaking. What I'd like to do is get the tweaking down to a minimum so that I can restore the server as quickly as possible if worst comes to worst.

The account I want to back up has several users attached to it, custom software installed under it (which I can re-install if need be) and a fairly complicated permissions system setup for a data repository that said users utilize on a daily basis. It also has several mySQL databases, and I've already got cron scripts that back up the raw data and mySQL databases to a location offsite from the server, but I really want to get something more complete in place so that I'm not scurrying around trying to re-create user accounts and such if I ever need to perform a restoration.

Another thing I have set up is an rsync between a server that is an exact duplicate of the original one, so that all of the raw data is synced up between the two servers under the same user account. I set up the second server identically to the first one, created the same user accounts under the main WHM account, installed the custom software, then just set up an rsync to mirror the primary server's data to the secondary server. Whenever I visit the secondary server to check up on it, everything functions on it just like it does on the primary server. What I don't want to have to do in an emergency (unless I absolutely have to) is go through a long process of replicating the exact user account setup on a brand new server, then copying in the data from a backup. I'd rather have all of the settings and user accounts and data in a tarball and then be able to dump that tarball on the new server, restart a few services and be up and running. I know it'll be more complex than that, but I really just want to minimize my downtime in an emergency.

I've tried googling, but my google-fu has failed me so far in finding manual alternatives to the built-in WHM solution. Step-by-step instructions (even if slightly simplified) would be perfect, but I'll take anything I can get.

Thanks!

Bizarre Apache/PHP issue.

signalnine — Sat, 29 Jan 2011 12:08:49 -0800

I have a really weird Apache/PHP problem. Ubuntu 8.04 LTS Server, fairly typical webhosting setup. One of our sites returns 404s randomly through the day, typically late at night, but sometimes in the morning. It'll do this for an hour or two and then start working all on it's own. The other sites are fine. If it helps, this site is a CakePHP deal. I'm 99% sure it's not anything in cron because although it typically happens around 1am-4am, the times are very inconsistent. Once it happened for 15 minutes in the middle of the day, sometimes it happens around 7am for about an hour. In a browser, it will load part of the page, then 404.

The apache log looks like this:
[28/Jan/2011:02:38:58 -0700] "GET / HTTP/1.0" 404 9444 "-" "mon.d/http.monitor"

The few times I've caught it while it's happening, load does not seem to be very high, maybe a little higher than average, but nothing above 1.0.

I'm pretty stumped here, any help would be appreciated.

pound is not playing nice. :(

wayland — Wed, 08 Dec 2010 19:29:42 -0800

Can you help me use pound as a reverse proxy and load balancer? I have a server running Debain with Hiawatha Webserver and Pound installed. I have hiawatha listening on port 8080. "wget 127.0.0.1" downloads the page i currently have up there, so I know for sure that hiawatha is working. I'm trying to get Pound to listen at port 80 and pass on hiawatha, i.e., proxy to port 80.

Here is pound.cfg.

It's not working at the moment. "wget 127.0.01:80" gets "Connecting to 127.0.0.1:80... failed: Connection refused." It's not an issue with port 80 because hiawatha works fine if I configure it to listen at port 80 and stop pound. I'm also pretty sure it's not a firewall or port forwarding problem. I have restarted pound since I changed to configuration file.

I want to maybe eventually use load balancing. The big thing right now, though, is that I want to be able to have some other web application (like Diaspora or etherpad) listening at a port that is not port 80 and to be able to proxy it over to a domain name. If I can't this simple configuration to work, though, something tells me that won't work either. I would be forever grateful if you could tell me (a) what I'm doing wrong or (b) a different, simple way to do what I'm trying to do. Thanks!

CMS for web presence

Slap*Happy — Thu, 07 Oct 2010 20:30:48 -0800

I need a web presence for articles and pictures, and a way for readers to comment on both. I know a lot about web servers, and squat/all about web design, and I don't have oodles of free time... help me pick a CMS. I have a static IP, and some serious unix-fu. I don't have a lot of web design chops, and even less time to learn some. I need to put a few articles online, with comments on them enabled, and an image gallery, with same. Maybe a few dozen articles, and not even that many pics. It doesn't need to be amazing, but it should look good with factory defaults and a small amount of tweaking... the last thing I need in my life right now is a crash course in CSS and Dreamweaver.* I understand that a good CMS will do what I want, but there are a lot of them out there... which one will do the best job with the least hassle?

(*A crash course in CSS and Dreamweaver will likely be another AskMeFi question in the future...)

How can I use .htaccess to shorten URLs?

Aquaman — Tue, 23 Feb 2010 15:15:37 -0800

I need some specific help with my .htaccess file. I'm new to the Rewrite module and can't quite figure out what I need to do to serve my pages (which live inside some nested directories) up with a nice short URL. So I've got all my new web pages in a directory a few levels deep, i.e.:

domain.com/newstuff/pages/page_title.php

and I'd like their URLs to display in the browser address bar as:

domain.com/page_title.php

Also, I'd like users (and my internal links) to be able to use the short form as well. I've already got redirects set up to forward the latter to the former, but the URL reflects that (showing the long form in the address bar), and I'd like it to be nice & short, consistently. Any advice would be greatly appreciated!

Giant but simple database - how to build

mtstover — Fri, 05 Feb 2010 05:53:17 -0800

What is best method to create a non-techy local interface for a 40M+ record database that I'd like to host on my web server? I'd like to regularly import new data, crunch it, and export specific CSV reports (which will be much smaller than 40M rows). The data will be essentially a 40M row record of address files. I will receive new data every month. I want to query it and export reports that will be a 70K row DB. Ideally these could be automated and output to a webserver.

I will also want an easy way to just look at and play with the data a bit. I am familiar with MS Access in running basic reports, etc, and would love to be able to use that to play with the data (rather than getting fancy with SQL all the time).

I have a webserver with mySQL setup and running.

I plan on using an Elancer to set this up for me and get it running with sample data. What should I ask them to do?

I thought WAMPserver was, like, for idiots. I feel like an idiot so why doesn't it work?

Foam Pants — Tue, 21 Jul 2009 11:49:39 -0800

I am following a tutorial on how to install WAMPserver and Wordpress on my Windows machine to kickstart my learning of CM systems and PHP. A crucial component won't install and I don't know nuthin' about how to fix the problem. I found This tutorial on installing and configuring WAMPserver, which is ideal for a dunderhead like myself who can barely compute. When I get to the part where they tell you to go to SQLitemanager, I realized that it wasn't in my WAMPserver menu. I have unistalled and reinstalled twice and it doesn't show up. I have tried to duplicate their instructions using a SQLite Manager plugin for Firefox but it isn't working. I have searched for evidence of other people having the same problem but came up empty-handed. I am at a loss to find a solution. Am I looking for the answers in the wrong places? This is being installed on a machine without windows server software.

redirecting Coldfusion without software installed

Foam Pants — Thu, 04 Jun 2009 16:56:48 -0800

My new webserver doesn't have Coldfusion so I am hosting my .cfm pages on another server. Can I redirect traffic to these new addresses using a .htaccess file or do I have to have the software installed to even get a redirect on a .cfm page? How would you do it?

SSL Client Certificates

banshee — Fri, 15 May 2009 08:45:51 -0800

Please help a noob with client-side SSL certificates. What is the process for generating SSL client certs? What kind of information is needed? Who generates them? I have a web server SSL cert installed (IIS), when users try to connect they are prompted to choose their client certificate from a list. (This is the behavior I want). The web server SSL certificate was issued by Entrust.net

Wait a minute Mr. Postman!

siclik — Wed, 06 May 2009 11:10:16 -0800

Why are some random automated messages suddenly not being delivered through our email server? We have a linux server over at The Planet running WHM/cPanel. We've never had issues with our email until recently. Two recent events have led me to believe that some emails are not getting through:

1.) An example email address on our troubled server is siclik@example.com. I have Ooma as my personal VoIP provider and have yet to receive a voice mail notification email (or password reminder email) at siclik@example.com. When I use siclik@hotmail.com, notifications arrive immediately. I've triple checked that I've entered my email address correctly.

2.) Our accountant told me just today that he's not receiving end-of-the-day automated credit card batch confirmations through his accountant@example.com email address.

Our server is running SpamAssassin, however I've added both Ooma and the credit card company to the spam filter's white list, so emails should be going through, right?

Anyone have experience with this and willing to share some knowledge?

this webpage is for loading and unloading only. no bookmarking

cayla — Sat, 25 Apr 2009 07:26:49 -0800

Is there anyway with apache redirect's (mod_rewrite with a 301 rule) for the underlying web page to detect the redirect and run some JS or PHP (or anything really) to say, 'HEY USER!!! Ya you! Change your bookmarks please!'? I would like to change the domain name for a website I have and I can handle the actual rewrite rules just fine, but I would really like people to notice when they have been redirected so I can eventually phase out the old domain name.

Ideally, this could be bit of inline text above the banner for the web page. (Maybe I could make it blood red or blinking if I was feeling evil....)

I do *not* want to use pop-ups. Not web page pop-ups nor notification pop-ups. (You know, those 'OK or Cancel' ones). That would be annoying.

PS - I am aware that changing the domain name will kill page rank, etc. It is a very low traffic site and I am not concerned about that at all.

And now that I logically follow that through... It being low traffic, I guess this is a slightly moot question, but now that I am stumped it is going to bug me until I find an answer.

Need a book recommendation for J2EE

smurdah — Fri, 17 Apr 2009 10:46:47 -0800

I'd like to learn more about design patterns and designing a maintainable infrastructure for a J2EE web application. Do you have any book recommendations?

www-wrong

le morte de bea arthur — Wed, 07 Jan 2009 05:56:48 -0800

How do I prevent Firefox from adding 'www' and '.com' to local URLs? I have a web server on my local network that I access via http://test/

Whenever I forget to turn on this server (or if it goes into standby or whatever), Firefox first tries the corrrect URL, then tries http://www.test.com. I find this more annoying that I probably should.

Any idea how I can prevent this second-guessing by Firefox? It's got to be in about:config somewhere, but I'm blessed if I can find it.

Failing that, how do I learn to be less anal?

Quantifying the Slashdot Effect

evariste — Fri, 24 Oct 2008 16:54:19 -0800

I'm trying to figure out if a server I'm working on can withstand being linked to by very high traffic websites. Can anyone tell me the basic traffic characteristics of, say, a front page link from: Drudge Report, Yahoo! Buzz, Huffington Post, Slashdot, Reddit, or Digg? I'm using ab (ApacheBench) and I'd like to have some idea of how many requests, and at what level of concurrency, I should be trying to make this server capable of pushing out. Thanks! I already know what to do (log and observe, cache cache cache, tune and tweak db and web server configuration, etc) and am experienced in that process. I just need some typical numbers to help me figure out when I'm done!

How do i get a VM to share a local folder?

muddylemon — Sat, 27 Sep 2008 14:05:11 -0800

How do I get a vmware machine to mount a folder on it's host machine? I'm trying to emulate something we do at work on a home machine. I'm a web developer, and have a great sysadmin to work his black magic at work, and am at a loss at how to get it working at home.
At work we have VMware machines that emulate our web server enviroment on our dev machines. We run the virtual and map local.whatever.com in the hosts file to the virtual machine as a web server. The directory that holds the files for local.whatever.com is on the drive of the host machine, so we can do our development there, test in local.whatever.com, and life is good.
So, on a home machine, I've setup an ubuntu server, apache, etc. I have my router forwarding http traffic to it, it's working fine.
What i'd like it to do is: mount a folder on the home machine as the root of a site, set up apache to serve files from there. There's a setting in the vmware workstation for shared folders, but besides enabling and disabling there doesn't seem to be any useful options.
The only alternate solution I've thought of is setting up the folder inside the VM, setting up SVN on it, and just transferring from a local folder to the one inside the VM with SVN. It might be a better solution, but I'd like to at least know how to get the original plan to work. Any ideas?
env info: machine is running XP, VM is running ubuntu server, apache2, php, mysql, etc.

VMWare: Web server on guest OS, accessed from Host?

weston — Fri, 26 Sep 2008 10:40:26 -0800

VMWare Fusion as dev server: How can I set things up so I can access a web server running under the guest OS (Red Hat Enterprise Linux 5) from the host machine? Bonus points if it can be done without plugging into an ethernet network. I've got a web app that will eventually be deployed under Red Hat Enterprise Linux 5, and the client sent me a VMWare image of the production machine so I could test in an environment as similar to theirs as possible (I usually just run the AMP stack under OS X, but they're using older versions of each piece of software, and are unlikely to upgrade soon because of some legacy apps, and we all know php installations vary wildly anyway, so this seems to make sense).

Since I've got VMWare Fusion, I figured this'd be a snap, but there appear to be two challenges:

1) Red Hat Enterprise Linux appears to be expecting an wired Ethernet connection by default. I'm primarily doing work on a MacBook Pro with connectivity done by WiFi. Having to plug in would suck... but this might be the part where getting WiFi to work under Linux would suck more.

2) I'm not sure what tack to take for the general network settings for VMWare (probably "Bridged" or "Host Only"?) and corresponding appropriate TCP/IP settings for the guest OS.

I'd love it if someone could post or point to a comprehensive explanation for making this work, but if you can help with either point #1 or point #2 (or offer any other advice), that'd be great too.

Thanks!

Using Apache to (almost) bypass Apache?

holgate — Sun, 14 Sep 2008 12:18:20 -0800

Is there a simple way to use Apache's ProxyPass directive so that everything apart from a directory beneath the webroot gets passed on to another server? If not, can it be done another way? I'm wanting to combine lighttpd with Apache to take some load of a server, but unlike the standard ProxyPass setup, I'd like the httpd.conf to direct things like this:

http://mysite.com/ -> lighttpd running on port 81
http://mysite.com/foo/ -> Apache running on port 80

Is that possible with ProxyPass? If not, can it be done another way, perhaps by swapping the ports and putting it in the lighttpd config?

Apache2, mod_php, suexec security confusion.

odinsdream — Tue, 10 Jun 2008 06:58:46 -0800

Apache2 security theory; mod_php versus CGI php and the use of suExec: What is the non-theoretical problem with running Apache2 with mod_php and thus without using suexec on a dedicated system? I'm setting up a typical LAMP environment. I've used phpsecinfo to evaluate my current environment and implemented all of the recommended changes except for two, Group ID and User ID.

The distribution is the most recent Ubuntu Server with the mostly-default Apache2 configuration, and the mostly-default PHP installation, with the exception of the changes recommended by phpsecinfo.

These warnings indicate that my group and user ID numbers are below 100 (33 to be specific), and therefore may be a problem. I am not sure how to interpret this.

I followed the documentation links and was about to implement SuExec when I realized that this meant doing a lot of other reconfiguration, like not using mod_php, and that meant changing a lot of other things, etc.

This is not a shared system. It will only be used to host one company's applications through several virtual hosts. The applications will be PHP-based, and most frequently will use the Symfony framework. Apache currently runs as www-data, whose shell is /bin/false. SSH access to the system is by public-key authentication only and is further restricted at the daemon level to only specific real users.

What do I need to do to run this securely? Resources, guides and real-world examples would be greatly appreciated.