LAMP

Khalid Baheyeldin of 2bits presented an overview of the Linux Apache MySQL PHP (LAMP) stack at this month's GTALUG meeting. This is a lot to cover in a couple of hours but he managed to get to all the main points nicely. This is not surprising since Khalid deploys LAMP systems professionally so he is very knowledgeable. He even found time to point out alternatives to the various components and still managed to avoid stirring up any preference wars, especially around the choice of programming languages.

Real Users

Many months after I finished building the LAMP server, my customer and I finally migrated the first user site from the Windows server to the Linux server tonight. Not everything happens at Internet speed. :D

There's nothing like having to handle real user requirements show what is missing, but this actually didn't go too badly. I had scripts to create the various configuration files and those all worked correctly. Well almost, if had remembered to install the last change I made to one script months ago. It was only one missing the Apache virtual host container so it was not huge upset.

Tonight's work pointed to where improvements are needed. Eventually I want to have my customer run the scripts with sudo, but there's a few things I need to figure out before that is ready.

Shared Web Hosting

My experience to date setting up Linux and Apache web servers has been with dedicated servers. A server for shared web hosting service presents some new problems I have not had to deal with before, with security between sites at the top of the list.

Many web applications expect to have write access to the file system. Since the applications are running as the Apache user (www-data in Debian), a malicious application could write anywhere that www-data can write, and take over another site. I am researching best practices for setting up shared hosting environments and so far Apache modules suEXEC and suPHP are the common approach. The idea is for Apache to change to the user that owns the files before accessing the data. There are some problems with this approach. One is that the applications can only run as CGI which is not very efficient. Another problem is that the user must be a real user on the system which opens other security concerns.

So far I haven't found a definitive guide for setting a shared hosting server. I bet there is one out there so I'll need to google some more, but I'm done for the day.