Ngnix is the fastest http server and we are using the power of cgi scripts to boost the php compilation speed. Obviously the combination of Nginx+ php-cgi [...]]]> Earlier I had tried to boost the php based web application using Nginx weberver using php-cgi module. It’s also showing better performance compare to older Apache-Php module.

Ngnix is the fastest http server and we are using the power of cgi scripts to boost the php compilation speed. Obviously the combination of Nginx+ php-cgi module performs much better for small high speed websites. But this new technology php-fpm would also helpful to manage the different cgi requests effectively.

In this post, I am using the power of php-fpm and APC which would accelerate the pages response time much more faster. Here you need to understand the role of diff application.

1. Nginx : It’s a fastest, light weight http webserver which is good for server static pages/files.
2. Php-fpm (FastCGI Process Manager) : This is the manager for administrating cgi process.
3. APC [Alternative PHP Cache]: This program will caches all the php request which had being executed recently and serves it when it requested next time until the cache expires. So it’s saves the execution time as well as server processing power.
4. Memcache : It is used for caching mysql queries which is frequently executed by php.

Let’s start the server preparation.,

I would not recommend to do it on any existing production servers since this process requires php re-installation. So try it on fresh server ( Here i uses CentOS6.2 (64 bit).

Installing PHP-FPM from Remi Repository.

Let’s completed the basic LAMP setup on new server and install the Remi- repository suit to your platform. You may get the install document from here, skip Apache,

2. Installing Nginx from Repository

Here we need to use the repository provided by the Ngnix website. Create a repository file under “/etc/repos.d/” to grab it. Create a file named “/etc/yum.repos.d/nginx.repo” and add the following content.

Installing Nginx using yum.

3. Installing APC and memcache

Add the APC extenion in /etc/php.ini file eg: extension = apc.so. You may configure it’s value by adding/modifying the values in ” /etc/php.d/apc.ini” file as well.

We have completed the half part of the setup.

Next we need to re-tune the Nginx for servicing Php pages along with zip compression enabled. This is the virtual host file for serving joomla site. You may download the files from here

Note : You may need to change the ip address [174.28.17.98:80] and the web location [ /home/mydomain/public_html] according to your setup.

Now test the Nginx config and restart the service,

Whola !!! That’s it.

After some googling, it is found that default “wait_timeout” value is good enough. We may need to reduce it [...]]]> Most of the database intensive applications are worring about the default values of these variables obviously. Developers used to inform me that they need to extend the wait_timeout value in order to complete the query execution.

After some googling, it is found that default “wait_timeout” value is good enough. We may need to reduce it to boost the server performance which will helpful to minimize the “sleep” process loaded in memory. Increasing number of sleeping process will reduces the server performance gradually. So always keep the default value and make it reduce until the program/application does not create any sleeping process which would helpful to improve the performance noticeable. Slow_log_query is another possible reason to have many sleeping process.

interactive_timeout : interactive time out for mysql shell sessions in seconds like mysqldump or mysql command line tools.
wait_timeout” : the amount of seconds during inactivity that MySQL will wait before it will close a connection on a non-interactive connection in seconds.

How to change the these variables

a. changing values at run time
Log in to the mysql console and set the variable.

b. Using my.cnf : Add the following values in /etc/my.cnf” and restart the mysql server.

Pls note that “wait_timeout” would be helpful to clear the sleeping process as “interactive_timeout” does not make any performance improvement since it affect the command line sessions. Obviously increasing the values of connect_timeout, net_read_timeout and net_write_timeout would help to skip the timeout errors when lengthy queries are being executed.

How to kill the MySQL Sleeping process

Most of the cases I used to take tiny pieces of information from different blog sites and customize and modify it for my purpose. [...]]]> Here I found some good trick to enable Nagios sms notification free for Indian users using one of the sms free service offered by way2sms website. have a look at way2sms.com.

Most of the cases I used to take tiny pieces of information from different blog sites and customize and modify it for my purpose. This website (brijin.net) has the python script to send sms using way2sms. I’m thanking to that blog owner .

Action involved are,

1. Register new account with way2sms.com.
2. Configure python script
3. Add the new nagios command for enabling sms notification for service and host failure.
4. Update the contact information.

1. Create an account with way2sms.com

Register your moble and this service company send you the login details over sms. You need this login information in python script to send sms. This script just does the normal web login to send sms.

2. Install python script

Create a script under “/usr/local/nagios/libexec/send_sms.py“. You may need to update the following fields in the script
br["username"] = “” #YOUR MOBILE NUMBER HERE
br["password"] = “” #YOUR PASSWORD HERE

Here is the script content.

Now you need to install python-mechanize in order to work this script. so you need to install python package installer program “eazy_install” which shipped with setuptools.

Now you need to verify the packages are correctly installed.

Sending test sms

So your installation looks good.

3. Updating “/usr/local/nagios/etc/objects/commands.cfg” file
Open the file and append the following lines at the end of file

4. Update your contact information (/usr/local/nagios/etc/objects/contacts.cfg)

You may need to add 3 lines in it.

service_notification_commands notify-service-by-email,notify-service-by-sms
host_notification_commands notify-host-by-email,notify-service-by-sms
pager 9744209638

My sample contact will look like this.

[root@nagios ~]# service nagios restart
Running configuration check…done.
Stopping nagios: done.
Starting nagios: done.
[root@nagios ~]#

Then simply restart Nagios service. For the testing purpose you may set one incorrect service name which was not defined in nrpe commands list. So that you get a notification sms and have the test easily.

Cool !!! Now you have ABSOLUTELY FREE nagios sms alert facility.

You may also use this script for sending sms if any critical systems/process reached the threshold limit like backup failure, intruder detention found etc. etc.

nJnoy

But the real headache of this system is, all the users can access any of system files and also has shell access to the server [...]]]> As we all know, most system users can have sftp access to Linux box by default along with ssh access. So that we can transfer the files securely over it.

But the real headache of this system is, all the users can access any of system files and also has shell access to the server which will open a door to a authorized stranger to know about the server roles and can grab the imp. files he wants.

Drawback : What I found is sftp system doesn’t have any log facility ie no record if any file transactions which done over it. So that we can’t trace out what are happening once the sftp session started. Also most of the latest

Redhat/CentOS OS still using the older openssh version which doesn’t support chroot ssh setup.

What I’m planning to do is,

1. Install a new openssh server and run it over on a new port for only sftp access
2. Set a chroot restriction to all users.
3. It won’t harm any production servers.

1. Installing openssh package

1. Download openssh package from http://www.openssh.org/portable.html

Now all the openssh files are copied under “/var/opt/openssh” folder. Next we need to create a startup script for as a service.

[root@fc-web01 ~]# vi /etc/init.d/opensshd
Which having the following lines,

2. Modifying SSH config file

You may need to add the following line at the bottom of ‘ /var/opt/openssh/etc/sshd_config” file

Note: You must have define new ssh port in this file (Eg. Port 22222 ) you may need to delete/comment the line start with “#Subsystem sftp /var/opt/openssh/libexec/sftp-server ”

3. User configuration

Adding users with disabled shell access

So user has full permissions only on these three folders.

The above commands created the ‘sftuser1‘ user which is a member of ‘sftp” group. Also root user is take the ownership of users home directory. So that users can’t create/execute any command against on his home directory but can create any new files in it. My requirement is to provide sftp space to a use who can upload and download files to a server securely.

Let’s start new ssh server.

To verify it’s running,

That’s it –> . Start sharing secure ftp space. You also need to open the port 22222 which may require to update the your firewall/network rules.

There is one imp. fix you will have to do.
You need to add a line “DenyUsers sftpuser1″ on your primary ssh server config file (/etc/ssh/sshd_config) which is running on the default port (22) and then restart the sshd service as well.

NB: I see that you can access this ftp through Filezilla easily but Global scape FTP won’t support to connect it.

Open Dovecot op3/IMAP config file and change the line to “disable_plaintext_auth = no”.

But this mechanism is quite [...]]]> Most of us don’t like to share access certain links/pages which containing some sensitive matters. So we need to setup a mechanism to limit this access of of this area. Apache have a password a authentication mechanism to limit the access to a location which commonly called “Basic authentication“.

But this mechanism is quite annoying as it’s showing a popup to enter login details even though we access it from the office. To ellumincate this issue, we may place the auth in conjunction with network. So that Apache will not ask you logins if you are accessing from a network which know to Apache.

Here is the sample Apache entry to achieve this,

Here allow directive open the access to listed IP’s. You may use CIDR to limit the no. of hosts to access. Pls note the text “Satisfy any” did the magic.

Cheers .. it’s a smaller tip.