Alan Storm's questions

Me: New to nginx and FastCGI in general, apologies if this is old hat and obvious, but Googling shows me a lot of people recommending random configuration values, but no one that explains the reasoning behind their decisions.

What's the relationship between an nginx worker_process and a PHP-FPM worker? Do more nginx workers means more PHP-FPM workers, or are they unrelated?

My understanding of how this works on a high level is

1. User requests a web page
2. nginx handles the request, sees it's a PHP page
3. nginx hands request off to PHP-FPM
4. PHP-FPM either handles the request with an existing process, or spawns new ones

What's unclear to me if there's any relationship between PHP-FPM spawning a new child processes, and which nginx worker processes are talking to it. i.e. if you had two identical web server, one with worker_process = 4 and another with worker_process = 8, and they both saw identical web traffic, would one server create more php-fpm child processes than another? Or have I said something so stupid here that it shows I'm missing a fundamental concept? (if so, what?)

Not trying to solve a specific problem -- just trying to learn how to reason about the behavior of nginx and php-fpm so I can contribute to scaling and performance brainstorms/troubleshooting.

Is there a way to extract a vcl configuration file from a running instance of varnish?

That is, I'm debugging varnish on a system I haven't been involved with up until now. There's a lot of confusion from the system owners as to which varnish configuration files have been used to restart and refresh the server. It would be extremely helpful for me to be able to see what VCL configuration file the currently running varnish instance is using. Not the file path (as people are editing these files at will), but the actual contents of the file at the time of varnish's last restart/refresh.

For the first time in a number of years, I'm semi-responsible for helping out with the server administration of a PHP web application (served out using Apache).

We're seeing a number of requests for invalid URLs, which I assume are malware/exploit related probes. Things like

r/www/cache/static/home/img/logos/nuomi_ade5465d.png
cgi-bin/test.sh
cgi-sys/entropysearch.cgi

etc.

I'd like to block these requests, both the stick it to the bad actors, but more importantly clear out my logs. To that end, I have a few questions

1. Will, in general, blocking by IP address work? I know it's been a long time since "IP Address == unique device on Internet", but I'm wondering if these sort of probes generally come from the sort of networks where it'd be safe for me to just block them outright

2. If I can't block by IP address, does anyone maintain a list of URLs that bad actors generally probe for so I can block by URL?

3. Re: #2 -- If I was going to handle this blocking at the server level, which apache module is right for this sort of thing? (MOD_REWRITE, MOD_SECURITY)

4. Is there a better way to block these requests other than by IP or URL?

5. Also, the system is hosted on EC2 -- does amazon offer any help with this sort of thing?

In an nginx configuration file, you might configure a list of SSL ciphers like this

ssl_ciphers                HIGH:!aNULL:!eNULL:!LOW:!ADH:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS;

What's the syntax of this cipher string? That is, I know (or think I know, correct me if I'm wrong) that this string is meant to provide a list of possible SSL ciphers, as well as provide a priority for them. What the documentation is less great at is explaining the format of this string.

Specific questions

• Is the ! a negation? That is, does !DSS means don't use DSS? Or is !DSS the same of a cipher?

• Are the : characters separators? That is is teh above a list of ciphers "HIGH, !aNULL, !eNULL, etc...", or does the : mean something else

• Are HIGH and LOW the same of ciphers, or are they special meta-directives of some kind

• Not pictured above, but I've seen strings like this AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:. Are the - characters part of the cipher name, or do they have a special meaning?

Is there a resource that explains how this string works, or is this a case where the people expected to work with the string are also expected to read the nginx source to figure out how it works?

When setting up an Apache virtual host, I'll occasionally get the following error when attempting to access the site.

Forbidden

You don't have permission to access / on this server.

Is there any method to (or tool that will) tell me why Apache is denying access? (local rule in httpd.conf, file permissions, etc.

I'm not looking for help with a specific configuration, instead I'm looking for a way to have the computer tell me what's wrong with my system and/or configuration.

I'm not a sys-admin, but sometimes I play one at work.

I've inherited a virtual server that had MySQL installed from source. I'm gathering as much information about the install as I can (original people who installed it are, of course, not a resource).

How can I find

1. The default/current location of the MySQL binary files (often stored in a directory named data?)

2. Any default or custom loaded cnf files?

Looking for solutions that are a bit more sophisticated than a find / -iname '*.cnf' :)

I'm giving WiMax a try (Clear Wireless in Portland, if that matters). I opted for the USB stick because I'd like to be able to use it on the go. However, when I'm in my apartment I'd prefer to hooked the USB stick to a central computer and (somehow) use that as a wireless access point.

Is this possible, and if so, what are the high level steps I'd take to accomplish this. Apologies for the vagueness, but it's been nearly a decade since I took a networking class and I'm not quite sure what a more specific question would look like. My brain this should be possible, (computer with USB Stick can get to the internet, therefore it should be able to route other computers to the internet), I'm just not sure if its practical.

I was asked to look over a laptop (OS X, 10.5) that was setup for a new developer, and I discovered that the pear executable was missing. This shop sets PHP up from source, so I navigated to the source tree where they'd compiled things and tried a make install, which failed with

Installing PEAR environment:      /usr/local/lib/php/
dyld: Library not loaded: /b/32_216/rdbms/lib/libclntsh.dylib.10.1
  Referenced from: /Users/username/Source/php-5.2.8/sapi/cli/php
  Reason: image not found
make[1]: *** [install-pear-installer] Trace/BPT trap
make: *** [install-pear] Error 2

So I tried a configure/make clean/make/make install, and hit the same problem.

All of these commands were run with sudo, as the source tree was owned by root.

I tracked the problem down to this command with make -n install-pear

sudo /Users/username/Source/php-5.2.8/sapi/cli/php -n -dshort_open_tag=0 -dsafe_mode=0 -dopen_basedir= -derror_reporting=E_ALL -dmemory_limit=-1 -ddetect_unicode=0 pear/install-pear-no    zlib.phar -d "/usr/local/lib/php" -b "/usr/local/bin"-dshort_open_tag=0 -dsafe_mode=0 -dopen_basedir= -derror_reporting=E_ALL -dmemory_limit=-1 -ddetec
Installing PEAR environment:      /usr/local/lib/php/
dyld: Library not loaded: /b/32_216/rdbms/lib/libclntsh.dylib.10.1
  Referenced from: /Users/username/Source/php-5.2.8/sapi/cli/php
  Reason: image not found
make[1]: *** [install-pear-installer] Trace/BPT trap
make: *** [install-pear] Error 2

What's strange, and possibly a red herring, is when I run the command as a non-root user, I seem to get further in the process

Installing PEAR environment:      /usr/local/lib/php/
[PEAR] Console_Getopt: failed to mkdir /usr/local/lib/php/Console
[PEAR] Archive_Tar: failed to mkdir /usr/local/lib/php/Archive
[PEAR] Structures_Graph: failed to mkdir /usr/local/lib/php/doc/Structures_Graph/docs/html/media
warning: pear/PEAR requires package "pear/Archive_Tar" (recommended version 1.3.2)
warning: pear/PEAR requires package "pear/Structures_Graph" (recommended version 1.0.2)
warning: pear/PEAR requires package "pear/Console_Getopt" (recommended version 1.2.3)
pear/PEAR can optionally use package "pear/XML_RPC" (version >= 1.4.0)
[PEAR] PEAR: failed to mkdir /usr/local/lib/php/OS

(Although it may be that when running as sudo those commands just run silently when they're successful.)

I thought it this might be a $PATH problem when running as sudo, but it seems like everything is similar there.

$ sudo echo $PATH
/usr/local/bin:/sw/bin:/sw/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/X11/bin:/usr/X11R6/bin:/usr/local/instantclient

$ echo $PATH
/usr/local/bin:/sw/bin:/sw/sbin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/X11/bin:/usr/X11R6/bin:/usr/local/instantclient

The /usr/local/instantclient folder is where the missing library is located.

I'm at a bit of a loss as to the next "what do I check" steps are, and was hoping the ServerFault might be able to help me before I punt back to the IT folks.

After nearly a decade (yikes) of hosting my personal websites and applications with a decent shared web hosting provider (the one in pittsburgh) I've decided its time to venture out on my own and try a virtual private server.

The one thing that's been holding me back is I know my shared web host has a number of custom built security/instruction-detection systems setup to deal with problems common to hosting clients who want to run PHP applications. I'm loath to give up that peace of mind, but the extend of my admin skills are doing cause/effect style exploration with configurations, and parsing through logs to see "oh, that's how they f---ed us".

That context set, if I was going to setup an account with a linux based VPS for Apache web hosting

1. What steps would I take to secure the machine?

2. What additional monitoring packages could/should I install?

Does anyone know if Google Chrome Frame will be installable onWindows machines in the dreaded Corporate IT World where machines are locked down with a Khaki Fist?

I suppose that's really two questions

1. Can Windows be locked down to prevent IE from installing plug-ins?

2. Is Google being clever and finding a way around this?

The hard drive in my laptop just died, and it's been about a week since I ran a full backup.

I know there are companies that specialize in data recovery from dead hard disks. I'm curious how they do this. What steps would one of these companies take if I brought in my drive and told them "Hey, this is dead, get me my stuff back"?

I'm looking for a high level answer, as I imagine some of the actual details could fill a book :) I'm not planning on doing this myself, it's more a curiosity about other people's jobs and the voodoo they use.

I've got an original Asus Eee PC Netbook that I'd like to sell. When I've sold old computers in the past, I've typically done a deep/secure/zeroing out style format. How can I do this on a Linux Netbook? I'm looking for

1. The command that will let me do this

2. Advice on how I can do this on a device with (seemingly?) non-removable media

Thanks in advance!