Apache web server magic on IBM i. seidengroup.com

Transcription

1 Apache web server magic on IBM i seidengroup.com

2 Speaker: Alan Seiden Principal at Seiden Group Mentor CIOs and development teams Deliver modern technical solutions IBM Champion Host and sponsor of CIO Summit Club Seiden: The next generation Open source advocate & contributor

3 About Seiden Group Team of experts who: Mentor IBM i teams, IT Directors, CIOs Consult on projects and process Develop applications Troubleshoot

4 About Club Seiden! Forum for younger developers with a passion for open source, IBM i and collaboration!!

5 Contact information Alan Seiden alanseiden.com 9

6 What can Apache serve? Web sites and applications Allows limited access via TCP/IP requests APIs, web services Any kind of file Static or dynamic data 11

7 Apache can be extended via modules 12

8 Requirements & Prerequisites 13

9 Ensure that LICPGM is installed 14

10 15

11 Using Navigator for i 16

12 Minimum Software Requirements Extended base directory support 5770-SS1 Option 3 Host Servers 5770-SS1 Option 12 Qshell 5770-SS1 Option 30 IBM Portable Applications Solutions Environment for i 5770-SS1 Option 33 IBM TCP/IP Connectivity Utilities for i 5770-TC1 IBM Developer Kit for Java 5770-JV1 Option

13 Permissions for Administrators *IOSYSCFG Special Authority *CHANGE Authority to the library object QUSRSYS *ALL authority to the following objects: QUSRSYS/QATMHINSTA QUSRSYS/QATMHINSTC Tip: QATMHINSTC is where the instance really goes *USE authority for these command objects: STRTCPSVR, ENDTCPSVR *RX authority for: root (/) /www *RWX authority for directory /www/server_name/ 18

14 Let s create a web server instance 20

15 Using Navigator for i web administrator Start at port 2001 Redirects to secure port

16 Find HTTP and DCM tasks 22

17 Choose web administration 23

18 Web admin menu 24

19 Create new HTTP server 25

20 Proceed with the wizard 26

21 Finish Hit green start button 27

22 It works! Go to Use actual IP or domain name Sample HTML page will appear 28

23 If it didn t work: debug tips DSPMSG QSYSOPR will show error message and job number Check error log in QTMHHTTP s spool files: WRKSPLF SELECT(QTMHHTTP) Common reason for failure: IP/port already allocated 29

24 Detailed troubleshooting DSPMSG QSYSOPR find startup error ("HTTP Server instance ZENDSVR6 start up failed.") Put cursor on message press F1 to see details Within detailed message, look for job info (something like /QTMHHTTP/ZENDSVR6) Copy that info (108846/QTMHHTTP/ZENDSVR6) to your clipboard WRKJOB [the job info] Type "4" to see spool files, the job log of dead job Type "B" to go to the bottom. Then scroll back up till you see a "40" level error. 30

25 See active connections 31

26 Green screen method: NETSTAT NETSTAT *CNN is the shortcut 32

27 33

28 34

29 35

30 36

31 Navigator for i method 37

32 38

33 39

34 40

35 41

36 Configure it 42

37 Modifying Configuration Directives Change listener ports Restricting access Define multiple-domain Virtual Hosts Enable load balancing Other security suggestions More... IBM i HTTP Server Directive Finder Apache site Module Listing Apache site Directive Index 43

38 Editor built into the admin GUI 44

39 Other ways to edit GUI editor is safest (no CCSID issues), but Edit as you would any IFS file Configuration file /www/yourserver/conf/httpd.conf Connect to IFS via: Notepad++ Zend Studio or similar editor, and copy/paste/edit from there Edit on your PC and transfer with FTP/SFTP/SSH program (e.g. Filezilla) or IBM i Navigator 45

40 Restart to test any configuration change Restart 46

41 Setup or Change Listeners/Ports # Apache Default server configuration # General setup directives Listen *:80 Allow requests to IP address through port 80 Listen :80 Allow SSL connections to port 8443 as well [Alan] Listen :80 Listen *:8443 https 47

42 Multiple servers in one configuration This example will provide two virtual host configurations under the same web server instance # Note: NameVirtualHost directive has no effect since i 7.2 NameVirtualHost <VirtualHost > ServerName DocumentRoot /www/domain1 </VirtualHost> <VirtualHost > ServerName ServerAlias domain2.com *.domain2.com DocumentRoot /www/domain2 </VirtualHost> 48

43 Security tips 49

44 Reverse Proxy in front Benefits: Extra layer of protection Don t reveal the real server s address Give your real server a private address Access from inside only Provide a united front to multiple web servers A single web site can pull from many other sites, transparently A way to add features (e.g. SSL) to web servers when you can t control them directly Caching and content manipulation Some are optimized for this (e.g. Varnish) Reverse Proxy A front door that transparently pulls content from another server (i.e. your real server).! 50

45 Options for reverse proxy Appliance Runs in your network is a popular one Cloud-based Includes CDN, optimizer, more Your own IBM i partition in the DMZ Easy to administer Separate server (e.g. Linux) if you have the skills 51

46 IBM i reverse proxy configuration LoadModule proxy_module /QSYS.LIB/QHTTPSVR.LIB/QZSRCORE.SRVPGM LoadModule proxy_ftp_module /QSYS.LIB/QHTTPSVR.LIB/QZSRCORE.SRVPGM LoadModule proxy_http_module /QSYS.LIB/QHTTPSVR.LIB/ZSRCORE.SRVPGM LoadModule proxy_connect_module /QSYS.LIB/QHTTPSVR.LIB/QZSRCORE.SRVPGM # URL path /prod/ will pull content from server.200 <Location /prod/> ProxyPass ProxyPassReverse </Location> # URL path /test/ will pull content from server.201 <Location /test/> ProxyPass ProxyPassReverse </Location> 52

47 Restrict access to particular IP addresses (v2.2) Allow from ibm.com Allow from 10.0 Allow from Directive Syntax: Allow from all host env=[!]env-variable [host env=[!]env-variable] Deny from all Directive Syntax: Deny from all host env=[!]env-variable [host env=[!]env-variable] 53

48 Restrict access to particular IP addresses (v2.4) Require host ibm.com Require ip 10.0 Require ip Directive Syntax: Require [not] entity-name [entity-name] Require all denied Please note: Mixing 2.2 and 2.4 style directives can lead to unexpected results! Use upgrade Guide: 54

49 Restricting continued (v2.2) This example will allow access to the docroot folder only from connections originating from ibm.com subdomains and from addresses matching 10.0.*.* or *.* <Directory /www/yourserver/htdocs> Order Deny, Allow Deny from all Allow from ibm.com Allow from 10.0 Allow from </Directory> 55

50 Restricting continued (v2.4) This example will allow access to the docroot folder only from connections originating from ibm.com subdomains and from addresses matching 10.0.*.* or *.* <Directory /www/yourserver/htdocs> Require host ibm.com Require ip </Directory>

51 Set permissions on directories Secure programmer and QTMHHTTP access after making changes or creating instances. QTMHHTTP is default web server user WRKLNK with option 9 or these commands CHGAUT OBJ( /www/yourserver ) USER(JANPGMR) DTAAUT(*RX) OBJAUT(*NONE) SUBTREE(*ALL)! CHGAUT OBJ( /www/yourserver/htdocs ) USER(JANPGMR) DTAAUT(*RWX) OBJAUT(*NONE) SUBTREE(*ALL)! CHGAUT OBJ( /www/yourserver/htdocs ) USER(QTMHHTTP) DTAAUT(*RX) OBJAUT(*NONE) SUBTREE(*ALL)! 57

52 Other security suggestions Do not divulge information about the server s operating system or Apache version ServerTokens Prod Do not show directory index page <Directory /www/yourwebsite> Options -Indexes Order Allow, Deny Allow from all </Directory> 58

53 Enable Secure Sockets Layer (SSL) 59

54 Types of domain certificates Single domain certificate Multiple domain certificate Wildcard certificate (i.e. *.yourserver.com) Standard (verifies business identity and domain ownership) Extended Validation (additional level of verification) Encryption (128 or 256 bit/sha-1 or SHA-2) 60

55 Enable SSL 61

56 62

57 Digital Certificate Manager (DCM) 63

58 Go into *SYSTEM certificate store 64

59 We want a Server certificate 65

60 Create certificate signing request (CSR) Specify: Minimum 2048 bits Exact Common name 66

61 Submit CSR to a CA vendor many more... 67

62 CA vendor s form Follow the steps required by the Certificate Provider. Be prepared to provide account information including: organization details contact names and information payment information domain specific details. In most cases a representative of the certificate issuer will be contacting and verifying information provided to assert the authenticity of the request for the domain being requested. 68

63 Save certs to IFS on IBM i Manually copy cert files to IFS Files to save on IFS: Certificate (Your Certificate) Intermediate Certificate 1 ** Intermediate Certificate 2 ** Root CA Certificate *** Save certs to any IFS folder. ** You may need to download this certificate from the certificate provider *** Root CA certificate may already exist Ex.: /Certificates 69

64 Root Certificates may already be included in the store 70

65 Import root and intermediate certificates Provide paths of CA certs you had saved to IFS.. 71

66 Import your server certificate 72

67 Assign cert to applications With the certificate imported into the store now its time to assign it to the applications that will use it. NOTE Only applications already defined to use SSL will be shown on the list. Once you enable security for a Web Server instance it is then added to the application list showing the servers available for certificate assignment. Select your new certificate from the list provided 73

68 Success! Almost there Restart Web Servers to activate new SSL certificate Restart It worked! See lock in browser 74

69 Optional: combine virtual host with SSL # specify IP address the server is running on <VirtualHost xx.xx.xx.xx:443> # server application name set up earlier SSLAppName QIBM_HTTP_SERVER_DEFAULT SSLEngine On SSLCacheDisable </VirtualHost> Listen xx.xx.xx.xx:443 NameVirtualHost xx.xx.xx.xx:443 75

70 It works! How to tell if SSL is working Try in a browser; page should appear Lock icon appears Click the lock for more information 76

71 URL Magic 77

72 Rewrite rules Why change a URL? Use friendly URLs Replace /cgi-bin/lansaweb?procfun+jokpubw+jokpw03+dev with /literature/request Use consistent URLs www. vs. no www Redirect to another URL 78

73 I changed my mind on a URL name I made the name too long /articles-and-publications-by-alan-seiden Now I want to shorten it /articles-and-publications but not break my site for anyone RewriteRule to the rescue Both URLs point to the same place now # Map old directory to new RewriteRule ^articles-and-publications-by-alan-seiden(/)?$ /articlesand-publications/ [R=301,L] 79

74 Search engine optimization trick Some people type www. Some omit it Some web sites will link to me with www and some not alanseiden.com I want search engine credit combined as one site, not split as two # Example used on alanseiden.com # Google and browsers will see www site as the definitive address. # R=301: permanent redirect RewriteCond %{HTTP_HOST} ^alanseiden.com RewriteRule (.*) [R=301,L] 80

75 Redirect to https (SSL) # non-ssl Listen :80 <VirtualHost :80> # redirect to HTTPS RewriteEngine On RewriteRule ^/(.*) [NC,R,L] </VirtualHost> # SSL Listen :443 <VirtualHost :443> SSLEngine On # whatever application name you defined SSLAppName QIBM_HTTP_SERVER_DEFAULT SetEnv HTTPS_PORT 443 DocumentRoot /www/yourserver/htdocs <Directory /www/yourserver/htdocs> Allow from all </Directory> </VirtualHost> 81

76 Hide your underyling technology Which do you prefer? /cgi-bin/lansaweb?procfun+jokpubw+jokpw03+dev or /literature/request Show friendly URLs that call your programs #Map a friendly URL to another internal address (in this case, LANSA for the web) RewriteRule ^/literature/request$ /cgi-bin/lansaweb?procfun+jokpubw+jokpw03+dev [PT,L] 82

77 Let your imagination run free Rewrite rules are powerful and can be complex They use Regular Expressions Experiment here: Regular expression tester 83

78 Performance 84

79 Request-response protocol Client (browser) requests a file; server responds One file at a time (at most 2 6 in parallel) Browser requests HTML file, then as it parses HTML, finds other file names to request (images, css, js...) 85

80 Requests can be blocking in browser Browsers typically limit themselves to 2 6 parallel requests to a given server File requests stack up, blocked by prev. requests Above, even 304 not modified files caused blocking Solution: reduce number of images or improve caching via Expires headers 86

81 Example: Expires headers (caching) For aggressive caching, place these directives in Apache config file Can specify file types: ExpiresActive On # A means expire after a month in the client's cache ExpiresByType text/css A ExpiresByType application/x-javascript A ExpiresByType application/javascript A ExpiresByType text/html A ExpiresByType image/png A ExpiresByType image/gif A ExpiresByType image/jpeg A Many options: 87

82 More ways to reduce blocking If many.js or.css files are used: Combine them into fewer files Move contents of smaller.js or.css files inline to your pages, eliminating those external files Google PageSpeed tool will help you decide 88

83 Create a favicon for your site Browsers always look for a file called favicon.ico in your document root Those little icons that appear in the browser Once found, will be remembered by browser If not found, will be requested every time (and cause 404 s) How to create a favicon: 89

84 Keep HTTP connections alive Enable KeepAlive setting in Apache The TCP connection will stay open, waiting for you Good when downloading many images, css, js files You ll reduce the number of three-way handshakes that establish a connection Even more important with longer SSL handshakes 90

85 KeepAlive details Configurable by number of seconds, number of files to be downloaded, before closing connection Recommended settings for average site KeepAlive On KeepAliveTimeout 15 Details: Don t overdo it you are locking out other users from that HTTP job while it s dedicated to you 91

86 Connecting takes time Clues that Keepalive is off.. Connection: close, Connecting 3.6 seconds Connecting (longer than average but it really happened) 92

87 What you see when Keep-alive is on Firebug s Net tab shows Connection: Keep-Alive, and, here, timeout=300 seconds (5 minutes) Zero seconds to connect Keep-alive is working! 93

88 Each request passes through several layers 94

89 Compression reduces file size Called gzip or mod_deflate, the same for our purposes Compresses, speeds up HTML, JavaScript, CSS, favicons, anything text-based 95

90 Netflix improved with gzip/deflate Saw 13-25% performance improvement Cut outbound traffic in half That saves money for a busy site such as Netflix Details: It really works! 96

91 My compression test Before compression: 31.0kb; loaded in 250ms After compression: 4.4kb; loaded in 109ms. That s 14% of the size and 50% of the time! 97

92 Details of deflate/gzip compression Apache directives (sample) # Load IBM i's module that performs compression LoadModule deflate_module /QSYS.LIB/QHTTPSVR.LIB/QZSRCORE.SRVPGM # Specify content types to compress AddOutputFilterByType DEFLATE application/x-httpd-php application/json text/css application/x-javascript application/javascript text/html Tutorial on my blog: Apache reference: 98

93 Maximum simultaneous HTTP requests Set ThreadsPerChild in httpd.conf Default: ThreadsPerChild 40 Increase to number of expected HTTP connections 99

94 Load balancer 100

95 Apache as load balancer Variation on reverse proxy shown earlier Send requests to multiple servers Round-robin Ignore dead servers Scaling an application: a single server can farm out requests to other servers High availability Details: 101

96 Load balancer configuration # All requests (/ root) will be handled by balancer ProxyPass / balancer://mycluster/ stickysession=phpsessionid nofailover=off # Balancer definition <Proxy balancer://mycluster> BalancerMember BalancerMember smax=10 # Less powerful server. Don t send as many requests there BalancerMember smax=1 loadfactor=20 </Proxy> 102

97 Apache is your site s front door Make it look nice and clean Ensure that it is locked Dropping the door metaphor, you can also Improve performance by knowing the directives to use Improve search engine optimization Improve ease of use Offer APIs securely Share your Apache or other web server stories or questions 104

98 Questions 106

99 Contact Alan Seiden Seiden Group Ho-Ho-Kus, NJ Free tips and strategy newsletter: