Adrian Ling - Apache, PHP-FPM & Nginx: How to Build a Secure, Fast and Powerful Web-Server

Apache, PHP-FPM & Nginx Reverse-Proxy

How to Build a Secure, Fast & Powerful Webserver with emphasis on Web Security.

(Practical Guide Series Book #3)

Adrian Ling Kong Heng

Copyright 2015

Copyright 2015 Adrian Ling Kong Heng. All rights reserved.

No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording or by any information storage or retrieval system without prior written permission from the copyright owner and the publisher.

Acknowledgements

I am grateful to God who enabled me to write this book, and to whom I owe my very existence.

Special thanks to my beautiful wife and my 2 wonderful kids for supporting me and giving me the time and space to write.

And of course, this book would not have been possible without the great folks who created the Apache Web-Server, the PHP Programming Language (and PHP-FPM) and the Nginx Web-server. Hats off to the countless other programmers and developers who continually work on these great software to make them even better, faster and more secure with each passing day.

Disclaimer and Terms of Use Agreement

The author and publisher of this eBook and the accompanying materials have used their best efforts in preparing this eBook. The author and publisher makes no representation or warranties with respect to the accuracy, applicability, fitness, or completeness of the contents of this eBook. The information provided in this book is provided on an As Is basis, without warranty and is strictly for educational purposes. Therefore, if you wish to apply the ideas contained in this EBook, you take full responsibility for your actions.

The author and publisher disclaim any warranties (expressed or implied), merchantability, or fitness for any particular purpose. The author and publisher shall in no event be held liable to any party for any direct, indirect, punitive, special, incidental or other consequential damages arising directly or indirectly from any use of this material, which is provided as is, and without warranties.

The author and publisher do not warrant the performance, effectiveness or applicability of any sites listed or linked to in this eBook. All links are for information purposes only and are not warranted for content, accuracy or any other implied or explicit purpose.

Table of Contents

Introduction

The traditional/typical way of running PHP on the webserver is via mod_php (or mod_suphp) which is essentially running the PHP-engine within the Apache webserver itself. It requires the least configuration andit basically just work out of the box.

(Note: In this book, I'll use the term webserver to denote the Apache httpd server unless specifically stated otherwise)

So, why use PHP-FPM if mod_php (mod_suphp) works without any fuss? What are the advantages of PHP-FPM?

There are many, but they can be boiled down to these 3 main benefits:

• Better Memory management

• Better Isolation and Security: Apache and PHP-FPM are independent of each other.

• Scalability you can run Apache and PHP-FPM on separate servers.

So, what is PHP-FPM? It is basically PHPs implementation of the FastCGI application/protocol. The FPM stands for F astCGI P rocess M anager.

Essentially, the PHP engine has its own process manager (pm) to manage the php processes on its own, independent of the Apache webserver.

What this means is that if you ever need to scale up quickly, you can easily do it by running the Apache webserver and PHP-FPM on separate servers. You can have a single Apache webserver on the front-end and multiple PHP-FPM servers on the backend. Apache will then redirect requests to the multiple backend PHP-FPM servers.

Ok, enough chatter about the virtues of PHP-FPM. Let me give you a quick overview of what this book covers and what you will learn from it.

In this book, we will build and configure 2 fictitious hosting accounts/domains : ponyvps.com and donkeyvps.com. The examples given will be based on these 2 fictitious domains.

All the sample configuration files will be given so that you can create a similar setup on your PC/Laptop or your VPS server.

What you'll need to follow along:

If you want to follow along the various configuration steps, you will need either:

1. A VPS Server or

2. A Laptop/PC running Linux (CentOS)

You can get a 1GB RAM VPS quite cheaply between USD $5 - $10/mth. Some hosting companies provide yearly plans which will be even cheaper. I will provide a resource page in the Summary chapter where you can check out some of the VPS offerings by various hosting companies.

Here's a quick overview of the chapters in this book:

Introduction : You're reading this now.

Chapter 1. The 'LAMP' stack

The 'LAMP' is the acronym for 'Linux', 'Apache', 'MySQL' and 'PHP'. Nearly all modern webservers will have the LAMP stack. In this chapter, I'll provide a quick overview of each of these software components. This is a short chapter which you can skip if you already know about it.

Chapter 2. Understanding Apache Handlers / PHP SAPI

This chapter is important as it provides the background knowledge on the various PHP SAPI (Server API) and how it interfaces with Apache via the Handlers. Knowing this info will help you understand and makes configuring Apache + PHP-FPM much easier.

Chapter 3. Installing & Configuring Apache + php-fpm in CentOS

This is the meat and potatoes of the book. We will setup PHP-FPM on a CentOS from scratch. Well look at the various configuration files related to PHP-FPM and Apache ( httpd.conf, php.ini, php-fpm.conf, etc).

Chapter 4. Boost Performance with Opcode Cache

PHP is an 'interpreted' language, in other words, each piece of PHP code needs to be parsed and interpreted by the PHP engine before it can display the results. Opcode Caches are performance enhancing extensions for PHP.

In this chapter, we will look at the Zend Opcache since it has been adopted by PHP as its official opcode cache engine. The other 2 popular opcode caches are the Xcache and the APC (Alternative PHP Cache).

Chapter 5. Securing Apache

The default Apache configuration shipped by your distro is quite 'permissive' - i.e. the security settings are quite lax to ensure that the Apache server will 'work' out of the box. In this chapter, we'll look at some of the ways we can secure our Apache server from hackers.

Chapter 6. Securing PHP (php.ini)

Although PHP is an interpreted language, it is quite powerful. You can use PHP to run system calls/commands to list files, delete files, etc. The default PHP settings allow a web-user to create a simple php page (3 lines of code) to view your servers /etc/password file or access another user's private files. Unbelievable? I will show you how it can be done.

Chapter 7. Performance Tuning & Benchmark

In this chapter, we'll look at various ways to tune Apache, PHP (php.ini) and php-fpm (php-fpm.conf) for maximum performance. We will use the Apache Bench (ab) software tool to simulate real-world traffic/load to your server by sending N number of concurrent requests to your server.

Chapter 8: Installing Nginx server as Reverse-Proxy

Nginx is an upcoming webserver that is gaining popularity with many high-traffic sites. You can run to replace Apache (as a normal Web server) or you can run it as a 'Reverse Proxy' server - often used to boost the performance of high-traffic websites on Apache.

According to a recent Netcraft survey, Nginx served or proxied nearly 18% of the world's busiest website in April 2014. This chapter will guide you through the setting up of Nginx as the reverse proxy to speed up our Apache powered website

Chapter 9: Conclusion & Summary