Apache performance tuning and security tuning

MaxKeepAliveRequests

It's actually the maximum number of requests to serve on a TCP connection. If you set it up to 100, clients with keepalive support will be forced to reconnect after downloading 100 items. Default in Apache is 100, you can increase it if you have enough memory on the system. If you are serving a page which contain high number of images then keeping is high is better because then it utilize the alive connections to serve the image requests.

KeepAliveTimeout

KeepAliveTimeout determines how long to wait for the next request. Set this to a low value, perhaps between two to five seconds. If it is set too high, child processed are tied up waiting for the client when they could be used for serving new clients.

MaxRequestsPerChild

The MaxRequestsPerChild directive sets the limit on the number of requests that an individual child server process will handle. After MaxRequestsPerChild requests, the child process will die. It's set to 0 by default, the child process will never expire. It is appropriate to set this to a value of few thousands. This can help prevent memory leakage, since the process dies after serving a certain number of requests. Don't set this too low, since creating new processes does have overhead.

Proper user of MPM (Multi-Processing Module)

This I have already explain at this URLConfiguring Apache/Tomcat for serving Maximum number of requests

Security tweaks

1. ServerTokens
This directive configures what you return as the Server HTTP response
Header. The default is 'Full' which sends information about the OS-Type and compiled in modules.
# Set to one of:  Full | OS | Minimal | Minor | Major | Prod
where Full conveys the most information, and Prod the least, you can also set it to "ProductOnly" which is best

ServerTokens ProductOnly

2. ServerSignature
Optionally add a line containing the server version and virtual host
# Set to one of:  On | Off | EMail
You can Set to "EMail" to also include a mailto: link to the ServerAdmin, better to set it to Off

ServerSignature Off

3. TraceEnable 
This Allow TRACE method to enable/disabled
# Set to one of:  On | Off | extended
Set to "extended" to also reflect the request body, best it to make it Off

TraceEnable Off

Why nginx usually throws 403, Forbidden?

A. This problem is mostly because user (who is running the nginx) doesn't have the access of that resource.

Opne file /etc/nginx/nginx.conf
------------------
user www-data;
worker_processes 4;
pid /var/run/nginx.pid;

events {
        worker_connections 768;
        # multi_accept on;
}
server {
    listen          80;
    server_name     www.healthcaremagic.com;
    access_log  /var/log/nginx/localhost.access.log;
    index           index.html;
    root            /var/www/
}

--------------------
Try these:
1. Open nginx.conf, locate user directive (change as per who has the access, may be www-date is good)
2. Nginx master process would be running using the user who start the nginx service may be the root, but nginx will use another user to create threads to serve the contents, which is configured in nginx.conf file. Note that this user only need to have read access of the directory which are set using root directive.
2. Go to directory which you set as root in location context (which is /var/www in above example) and check the access, ls -al should show
3. You can change the ownership of files and direcotry using command "chown -R usergroup.username directoryName"

Create user in mysql

Create an admin user who can access anything from anywhere

mysql> grant all privileges on *.* to 'admin'@'%' identified by 'password';

Create an user who can access any database from a network colcation

mysql> grant all privileges on *.* to 'admin'@'192.168.%' identified by 'password';

*If somehow this doesn't work, execute this
update mysql.user set Host='192.168.%' where User='admin';

Create an user who can only access from localhost
mysql> grant all privileges on *.* to 'admin'@'localhost' identified by 'password';

Create an user who can access only one fix database
mysql> grant all privileges on dbname.* to 'admin'@'localhost' identified by 'password';

Here is the description of every word in the above command

grant all privileges - its granting permission(so it creates user also)
on dbname.* - its dbname and table name access restriction (*.* means all db, dbname.* means only one datase)
to 'admin'@'localhost' - its first quoted string is username, and 2nd quoted string is host access, who can connect to the mysql db, in the current only, only localhost host users would be allowed to connect
identified by 'password'; - its the password which is required to connect the mysql db server

Note : 
Here do not get confused with "bind-address" configuration in mysql configuraiton file, which actually provides binding access, click here to read more about "bind-address" and access point

Secure your website with SSL - guidelines and experience

1.
First generate the key file
$ openssl genrsa -des3 -out server.key 2048
It will ask for a pass phrase, which will be further used to start the web server, so save it properly

2.
Now generate the CSR (Certificate Signing Request) file
$ openssl req -new -key server.key -out server.csr

This ask informations like, Location, Company Name, Common Name. Its better to ignore the "challenge password". Be careful with entering common name, which has to be your domain name.

If you serve your users with www.example.com, common name should be "www.example.com". Once certificate is issued for www.example.com, it won't be valid for example.com. If you want to secure with and without www, there is a certain preference you'll have to choose at the time of buying the certificate. If you want to secure all subdomains, there will be different prerefernece as well. Depending of number of sub domains you are looking for to make secure, cost will also vary. As of today verisign charges $ 400 USD for one domain, $ 600 for with and without www, and around $ 1500 USD for securing infinite sub domains.

3. Now use this CSR and avail the certificates which is crt file from any CA (certificate authority) company like verisign(costliest), go daddy cheapest (may be $ 10 USD)

4. Once you buy the SSL certificate, the product management will guide you on how to get the certificates. Its very simple.

5. In case of verisign, they will take average of 2 to 4 days for the entire process execution, as they will validate "CSR Verification", "Proof of Organization" and "Proof of Domain Registration".
They would ask company registration certificates also as a part of process. But if you buy from go daddy, no verification process, only based on CSR file they will issue you the certificates within a minute.

6. At the time of downloading the certificates makes sure that you also download the intermediate certificate. Intermediate certificates are connecting the certificate chains. In few browsers(without having intermediate certificate), some users might face unwanted error message.

7. Deploying the certificates, copy these 3 files at the following places and restart Apache

$ cp server.key /etc/ssl/private/
$ cp example.com.crt /etc/ssl/certs/
$ cp intermediate.crt /etc/ssl/certs/


8. Now change in apache
Enable the ssl module, if you are on debian(Ubuntu, RedHat) systems then you can use command a2enmod ssl.
Go to virtual host configuration and write these lines

SSLEngine on
SSLProtocol -all +TLSv1 +SSLv3

SSLCertificateKeyFile /etc/ssl/private/server.key
SSLCertificateFile /etc/ssl/certs/example.com.crt
SSLCertificateChainFile /etc/ssl/certs/intermediate.crt
     
$ /etc/init.d/apache2 restart (It will ask for the pass phrase that you created at step 1)
- and its Done :)
8. To validate everything done properly or not there are several websites to check one is, http://www.sslshopper.com/ssl-checker.html

How to setup replication (Master Slave) in MySQL

I'll start the article by assuming that there are two MySQL server ready and we just need to do the configuration setup to start the replication.

Go to Master Server

1. Make all the tables engine = innodb 

As only innodb engines have binary logging feature which is essentially used for replication. Binary logging must be enabled on the master because the binary log is the basis for sending data changes from the master to its slaves. If binary logging is not enabled, replication will not be possible. MyIsam does not support binary logging.

Use following command to convert all the tables to InnoDB

mysql > SELECT CONCAT('ALTER TABLE ', table_name, ' ENGINE=InnoDB;') as ExecuteTheseSQLCommands

FROM information_schema.tables WHERE table_schema = 'db_name' 

ORDER BY table_name DESC;

2. Start binary logging on Master and Assign server Id (Server ID assigning is necessary, If you omit server-id (or set it explicitly to its default value of 0), a master refuses connections from all slaves).

edit the file /etc/mysql/my.cnf

[mysqld]

log-bin=mysql-bin

server-id=101

*For the greatest possible durability and consistency in a replication setup using InnoDB with transactions, you should use innodb_flush_log_at_trx_commit=1 and sync_binlog=1 in the master my.cnf file.

3. Create a slave user on Master DB

mysql> grant REPLICATION SLAVE on *.* to 'slave'@'IP_ADDRSS_OF_SLAVE' identified by 'slavePassword';

mysql> flush privileges;

4. Restart Master DB

and check 

mysql> show master status;

You can also check if mysql-bin log files are getting created on not, where you have given path of data to be stored, may be at /var/lib/mysql

5. Take a dump of database

 mysqldump -uroot -proot --single-transaction --master-data --databases db1,db2 > all_db.sql

And transfer the file on slave Machine

Go to slave Machine

6. Assign Server Id on slave DB

[mysqld]

server-id=102

7. Restart Slave DB

8. Import the dump file in database

mysql -uroot -proot < all_db.sql

9. Make this slave listen to Master

mysql> CHANGE MASTER TO MASTER_HOST='MASTE_HOST_IP_ADDRESS',MASTER_USER='slave',MASTER_PASSWORD='slavePassword';

mysql> flush privileges;

10. slave start

mysql > slave start;

mysql > show slave status;

DONE :)

Some troubleshoots and points:

1. You can configure on slave mysql configuration that which all database or even which all tables you want to replicate or do not want to replicate
   http://dev.mysql.com/doc/refman/5.0/en/replication-options-slave.html
2. If replication fails due to data consistency issue means, data already exist in slave and master is still trying to push (may be due to several kind of issue), you can change the slave configuration to move ahead

mysql > change MASTER TO MASTER_LOG_POS=desired_position;
mysql > change MASTER TO Master_Log_File='mysql-bin._desired_bin_log_file'

Reference : http://dev.mysql.com/doc/refman/5.0/en/replication-howto.html

Using POP on multiple clients or mobile devices

Using POP on multiple clients or mobile devices

If you have configured the email on outlook and on Blackberry/Android/iPhone/Gmail too, and on one of the client you are not able to receive the email, this article is useful to you.

Essentially POP (Post office protocol) is a one-way download of your messages that allows you to access your mail with a mail program like Outlook Express or Apple Mail. POP only offers one-way communication, which means that actions you take in the mail program. You should know two things "recent mode" and "Leave a copy of message on server".

What is 'recent mode?'

If you're accessing Gmail on multiple clients through POP, Gmail's 'recent mode' makes sure that all messages are made available to each client, rather than only to the first client to access new mail.

Recent mode fetches the last 30 days of mail, regardless of whether it's been sent to another POP1 client already.

Setting up 'recent mode'

In your POP client settings, replace 'username@gmail.com' in the 'Username' or 'Email' field with 'recent:username@gmail.com'

Once you enable recent mode, please be sure to configure your POP client to leave messages on the server according to the instructions below:

• Outlook or Outlook Express: on the Advanced tab, check the box next to 'Leave a copy of messages on the server.'
• Apple Mail: on the Advanced tab, remove the check next to 'Remove copy from server after retrieving a message.'
• Thunderbird: on the Server Settings tab, check the box next to 'Leave messages on server.'

* This is an exact copy the URL https://support.google.com/mail/bin/answer.py?hl=en&answer=47948

Updating and installing package on debian machine

Its very simple :)
APT (Advance Package Tool) is a free user interface which is used in debian machine to install/remove/update any software. For the same in Red Hat machine is "yum".

How to search a package and Install?

Points :

1. $ apt-cache search "Is the command to search a package"
2. $ apt-get install "Is the command to install a package"
3. apt-cache - query the APT cache
4. apt-cache search/madison are two important commands you should know
5. $ apt-cache search - "Performs a full text search on all available package lists for the POSIX regex pattern given"
6. $ apt-cache madison - "Command attempts to mimic the output format and a subset of the functionality of the Debian archive management tool, madison. It displays available versions of a package in a tabular format"
7. sudo apt-get install =version - "Is the command to install a package with a certain version"
8. dpkg -s - "Is the command to about the package"

Example :

$ apt-cache search mysql-server
cacti - Frontend to rrdtool for monitoring systems and services
phpbb2-conf-mysql - Automatic configurator for phpbb2 on MySQL database
torrentflux - web based, feature-rich BitTorrent download manager
mysql-server - MySQL database server (meta package depending on the latest version)
mysql-server-5.0 - MySQL database server binaries

$ apt-cache madison mysql-server
mysql-server | 5.0.96-0ubuntu3 | http://us.archive.ubuntu.com hardy-security/main Packages
mysql-server | 5.0.96-0ubuntu3 | http://us.archive.ubuntu.com hardy-updates/main Packages
mysql-server | 5.0.51a-3ubuntu5 | http://us.archive.ubuntu.com hardy/main Packages

Now if you want to install a certain version package, you should use
$ apt-get install mysql-server=5.0.96-0ubuntu3

Command to know about the package
$ dpkg -s mysql-server

References

1. http://manpages.ubuntu.com/manpages/natty/man8/apt-cache.8.html

2. http://manpages.ubuntu.com/manpages/hardy/man8/apt-get.8.html