How do I securely deploy Internet websites in PHP on my IBMi?

Agile Technology Architects LLC
Architects,
Achieving Business Results from the Edge of Chaos

Jim Oberholtzer
CEO/Chief Technical Architect

Securely Deploying Websites in PHP
on IBM i
Zend Webinar – October 5, 2011

Jim Oberholtzer, MSE, CCBCP
Agile Technology Architects, LLC
 31 years experience rising to VP/CIO
 IBM Subject Matter Expert, IBM I
 Agile provides services:
g p
 IBM POWER Systems infrastructure and performance
 Architect configurations and provide second opinion services
 Installation d implementation
I t ll ti and i l t ti
 Performance and system management services
 Agile development techniques
 Get your IT department moving as fast as the business
 Mix hierarchical management techniques with Agile techniques

© Agile Technology Architects
www.atallc.net

Agenda
 IBM i web serving
 Configuring the IBM i Apache Server
 IBM i Work Management for Web Serving
 Networking
 Wrap up

 Note: We will not discuss PHP security/Networking since
that is covered in other webinars etc.

www.atallc.net

IBM i Web Serving
 Two web servers for IBM i
 WebSphere Application Server
 Express edition ships with every IBM i instance
 Full server is a chargeable feature
 Main servers for Java 2 and Enterprise Edition Java environments
 Apache Web server
 Tomcat removed as of 6.1
 Integrated Web Application Server (IAS) replaced it
 IAS includes most of the Java function that might be needed.
 Zend S
Z d Server Utilizes the Apache Server
U ili h A h S

www.atallc.net

IBM i Web Serving
 Primary Web server is Apache
 Licensed Program product xxxx-DG1
 5770-DG1 at V7R1
 Apache level 2.2.11 at V6 (V5R4 at 2.0.63, another reason to upgrade)

 Apache Software Foundation Server project at 2.2.21
 Apache 2.3.14 beta is out
 IBM very carefully tests apache updates
 Free Additional Software with the OS
 PTF groups
 V7: SF99368 / Level 10 (10/3/11)
 V6: SF99115 / Level 22 (10/3/11)
 Tend to come out about every other month
 Order the Java PTF Group at same time (comes with HTTP group)
 V7: SF99572 / 6 (10/3/11)
 V6: SF99562 / 17 (10/3/11)

www.atallc.net

IBM i Web Serving
 Odds are fairly strong xxxx-DG1 is installed
 V7: 5770-DG1 *BASE
 Located on media: B_GROUPx_04
 English 2924 is in Group 1, 2, and 3
 V6R1: 5761-DG1 *BASE and option 1
p
 *BASE is IBM HTTP Server for i5/OS
 Option 1 is Triggered Cache Manager
 Located on media B29xx_02:
 B2924_02 for US English (2924)
 Java is required along with Apache
 V7: 5761-JV1: *BASE, options 8, 9, 11, 12, 13
576 JV : S , opt o s , , 3
 Located on B_GROUPx_05
 Group rules same as DG1
 Option 8 is the 32 bit J2SE (it’s really the one you want)
(it s

www.atallc.net

IBM i Web Serving
 Of course the Zend Server requires DG1 and:
-V6R1-- -V7R1--
 Portable App Solutions Environment 33 5761SS1 5770SS1
 Qshell 30 5761SS1 5770SS1
 IBM Portable Utilities for I5/OS *base 5733SC1 5733SC1
 OpenSSH, OpenSST, Zlib 1 5733SC1 5733SC1

 It’s rare to find installations without all of these
 There are no PTF groups available for these products
 PTFs come with the other groups
 A search of the registered knowledge base did not reveal any
PTFs issued specifically for these products

www.atallc.net

IBM i Web Configuration
 The default IBM i Admin web instance is at port 2001
 http://your.serveraddress.com:2001
http://your serveraddress com:2001

Click here to get to the HTTP
Configuration options
C f

www.atallc.net

 Web administration is found in the first link on this page

www.atallc.net

 An alternative method of getting to the web
administration panels

Click here to get to the HTTP
Configuration options
C f

www.atallc.net

 The default IBM i Admin web instance is at port 2001
 http://your.serveraddress.com:2001
http://your serveraddress com:2001

www.atallc.net

 Web Administration for i
 Select the “Manage” tab
Manage

www.atallc.net


 Manage all HTTP servers
a age a se ve s
 The panel will remember you and where you were last
 Each server is hyperlink to its configuration
 Notice have only one server running at port 80
N i Ih l i
www.atallc.net

 Here’s the main
p g
page to administer
the site
 Notice Tools near
bottom.
bottom
 Config Editor
 Statistics
 Web Log monitor
 If you have SSHD
running
 Install VIM in PASE
 Use PuTTY

www.atallc.net

 Default location for Zend Server is /www/zendsvr
 Directories for configuration, htdocs (the web site) and
logs default here

 This is fine for production
 What about Dev?
 I like /home/userprofile

www.atallc.net

Create Development Web Site…
 Premise:
 Each developer will have a library directory and web address
library, directory,
 Security is your call, but separating the developers makes sense
 Production runs on Port 80/443 as a Virtual Host
 A test version of the instance runs on port 10088
 Notes:
 Zend does not as yet support running multiple copies of the Zend Server
on one system. Reasons are valid, but way beyond the scope of this session
 I have tested and made it work, but in a very lightly loaded system
 The site at port 10088 will be integration testing
 URL, DNS, etc are up to date
 Firewalls are set up properly

www.atallc.net

Development Web Site…
 Step one: Create the base configuration
 Each developer needs a home directory
 /home/iusr0001
 Authority looks like:
 QTMHHTP1
 QTMHHTTP
 Too much authority for a
production system
 Integration should look
like production does
 *PUBLIC could be *USE
ld b

www.atallc.net

 Copy the htdocs directory from the Zend Install
 We modified this to have a couple of examples in it
 DB2 SQL example
 PhPinfo.php etc…..
 The hidden file .htaccess (note the “.” in the first p
( position)
)
 Required for Zend Routing to work
************Beginning of data**************
SetEnv APPLICATION_ENV development This is important for the Zend Framework!
RewriteEngine On
RewriteCond %{REQUEST FILENAME} -s [OR]
%{REQUEST_FILENAME}
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]
************End of Data********************

 Unless specified, forces all the pathnames “-s”, Symbolic Links “-l” and
Directories “-d” into one place.
 This is really part of Apache rewrite rules. See web for too much
information…..
information

www.atallc.net

 Now a CLP that creates each users web container:
CHGVAR &NEWPRF VALUE('iusr' *CAT &USRNBR)
CHGVAR &USRDIR VALUE('/home/' *TCAT &NEWPRF)
CHGVAR &USRDIR1 VALUE(&USRDIR *TCAT '/htdocs')
CRTLIB LIB(&NEWPRF) TYPE(*TEST) TEXT(&USRTEXT) AUT(*EXCLUDE)
MKDIR DIR(&USRDIR) DTAAUT(*EXCLUDE) OBJAUT(*NONE)
CHGVAR &USRDIR1 VALUE(&USRDIR *TCAT '*')
CPY OBJ('/home/iusr0000/htdocs/') TODIR(&USRDIR) SUBTREE(*ALL) +
REPLACE(*YES) OWNER(*KEEP)
(* ) (* )
CHGAUT OBJ(&USRDIR1) USER(QTMHHTP1) DTAAUT(*RWX) OBJAUT(*ALL) SUBTREE(*ALL)
CHGAUT OBJ(&USRDIR1) USER(QTMHHTTP) DTAAUT(*RWX) OBJAUT(*ALL) SUBTREE(*ALL)
CHGAUT OBJ(&USRDIR1) USER(*PUBLIC) DTAAUT(*EXCLUDE) OBJAUT(*NONE) SUBTREE(*ALL)

CRTUSRPRF USRPRF(&NEWPRF) PASSWORD(PASSW0RD) +
PWDEXP(*YES) USRCLS(*PGMR) +
CURLIB(&NEWPRF) TEXT(&USRTEXT) +
SPCAUT(*NONE) PWDEXPITV(30) +
GRPPRF(IUSR) HOMEDIR(&USRDIR) +
MAXSTG(10240000) GRPAUTTYP(*PGP)

CHGOWN OBJ(&USRDIR) NEWOWN(&NEWPRF) SUBTREE(*ALL)
CHGOBJOWN OBJ(&NEWPRF) OBJTYPE(*LIB) NEWOWN(&NEWPRF)

 Only the executable code shown.
 Contact me if you want the full program with error handling
y p g g

www.atallc.net

 Now the APACHE set up
 httpd.conf
httpd conf holds the Apache configuration
 You can use Systems Director Navigator for IBM i

 You could also use:
 http://yoursystemaddress:2001/HTTPAdmin
www.atallc.net

 Click on: Manage, then, HTTP Servers, and in the drop
down, Zendsvr – Apache

 This is where you manage
the server instance
 Set up virtual hosts for:
 Developers
 Test sites
 Different applications
 Go to General Server
Configuration
 Open up tools
 Edit Configuration File

www.atallc.net

 The directive: “UserDir /home/*/htdocs” is what you need
 Apache then uses: http://common1.idevcloud.com:10088/~userprofile
 Once you
press “apply”,
then “OK”
OK
Note
 Restart the the location
server by of the file

using the
button
 You can of
course use
any editor
you wish

www.atallc.net

Virtual Host set up
 Apache can do virtual web sites by name or IP address
 Here I set up two virtual sites both on port 80
 One is for the public web site, one for a customer interface

www.atallc.net

Development Web Site..
 Lets consider some other APACHE directives
 Why does this work?
http://common1.idevcloud.com:10088/phpmyadmin
 And:
http://common1.idevcloud.com:10088/editor
h // 1 id l d 10088/ di
 does not? (hint, if you add the .php suffix it will….)

www.atallc.net

Development Web Site
 Lets consider some other APACHE directives
 Why does this work?
http://common1.idevcloud.com:10088/phpmyadmin
 And:
http://common1.idevcloud.com:10088/adminer
h // 1 id l d 10088/ d i
 does not? (hint, if you add the .php suffix it will….)
 Answer: alias directives.
directives
Alias /phpmyadmin /usr/local/zendsvr/phpMyAdmin
…..
<Directory /usr/local/zendsvr/phpMyAdmin>
Options FollowSymLinks
AllowOverride None
Order allow,deny
Allow from 127.0.0.1
</Directory>

www.atallc.net

Work Management
 Often forgotten portion of managing a web site
 Zend has at least two, sets of distinct jobs that run
two
 Subsystem QHTTPSVR shipped with *BASE
 Add a second memory pool to the subsystem
 Change the routing entry to point to the new memory
 Consider a bit of tuning in the shared pools
 Zendsvr subsystem also shipped with *BASE
BASE
 MySQL has a subsystem and may also use QUSRWRK
 Depends on how started
p
 Menu ZSMENU will start in ZMYSQL subsystem
 MySQL started manually (shown earlier) will start in QUSRWRK
 Memory management critical for performance
M ii lf f
www.atallc.net

Work Management
 Three portions of performance to consider
 Zend Server Settings
 Several parameters in the server can directly affect Zend Performance
 Zend Server Performance is not MySQL or DB/2 performance
 Beyond the scope of this presentation
 DB/2 Performance
 Index strategy / QAQQINI settings extremely important
 Know which query Engine your query is using CQE/SQE
 Index advisor / Job Watcher
 Beyond scope of this presentation
 Work management of several objects
g j
 Zend Server subsystem
 Zend Apache Instance (subsystem QHTTPSVR)
 Data Access jobs (
j (QZDASOINIT and QSQSRVR) )

www.atallc.net

Work Management
 Change QHTTPSVR subsystem to have 2nd memory pool
 Change Shared Pool to reflect change
g g
 Add storage pool to subsystem
 Change routing entry on subsystem
 Restart subsystem jobs
 Change Zend Subsystem
 Same procedure as QHTTPSVR
p Q
 After changes, watch it for a day or so
 Make sure active/wait transitions are zero
 Watch f l i
W h faulting
 May have to add memory
 Activity Level critical since multi threaded jobs are running

www.atallc.net

 WRKSHRPOOL
 Size depends
 Activity needs to
be high enough
for LOTS of
threads
 Smart Paging

 Use F11 to change text
 Most under used part of
Shared
Sh d pools l
 Leave tuning alone for
now

www.atallc.net

Work Management
 Change the subsystem description
CHGSBSD SBSD(QHTTPSVR/QHTTPSVR) POOLS((2 *SHRPOOL1))
SHRPOOL1))
 Change the Routing Entry on the subsystem
 Routing entry determine which pool of memory will be used
 Most common mistake made when tuning (not changing it)
 QHTTPSVR only has one routing entry
 Use:
CHGRTGE SBSD(QHTTPSVR) SEQNBR(10) POOLID(2)
 Need to restart all of the jobs in the subsystem
 Use:
STRTCPSVR SERVER(*HTTP) RESTART(*HTTP) HTTPSVR(ZENDSVR)

www.atallc.net

Work Management
 Zend Subsystem gets same treatment as QHTTPSVR
 Determine which memory to use
 Is there already a shared pool set up that’s usable
 Like jobs go in like memory
 Change the subsystem description to add memory pool
g y p yp
CHGSBSD SBSD(ZENDSVR/ZENDSVR) POOLS((2 *SHRPOOL1))
 Change routing entry

Communications

Server Jobs

 Note that Multiple changes are needed….
 Two different classes are used

www.atallc.net

IBM i Web Serving Networks
 TCP/IP Magic can be used to separate the LANs
 Even on the one network cable
 Can be used to manage TCP/IP traffic from/to the production web
server
 Keeps web serving traffic away from the internal LAN
p g y
 Example:
 Web traffic from firewall comes in on 10.10.10.2 / 255.255.255.252
 Allows Two addresses: 10.10.10.1, 10.10.10.2
 Subnet: 10.10.10.0 Broadcast: 10.10.10.3
S b t 10 10 10 0 B d t 10 10 10 3
 The Web Server is 10.10.10.2
 The firewall is 10.10.10.1
 Corporate LAN is 10.2.2.x Subnet is 255.255.240.0
 There could be as many as 4094 computers/printers/etc on the network
 From 10.2.2.1 to 10.2.15.254
 Traffic on the 10.10.10.x network will not cross over to 10.2.2.x without
a router

www.atallc.net

IBM i Web Serving Network
 Firewall uses
NAT to
translate 10.2.2.x
10 2 2 x Internet
internet to
internal
address 65.32.51.115
65.32.51.110
 IBM I is set to
not route
between
networks 10.2.2.1
10.10.10.1
 Networking Subnet
purists would Subnet
255.255.240.0
have two 255.255.255.252
firewalls and
two interface
cards 10.2.2.2 10.10.10.2

www.atallc.net

IBM i Web Serving Networking
 Setting up packet filter rules
 Need to use System I Navigator
 Found at Network / IP Policies / Packet Rules
 Right click and bring up Packet Rules Configuration:

www.atallc.net

 Set the interfaces alias names:
ADDRESS MyInternalIPAddress IP = 10.10.10.1 TYPE = TRUSTED
ADDRESS MyProdIPAdress IP = 10.2.2.1 TYPE=TRUSTED
ADDRESS MyPublicIPAddress IP = 65.32.51.110 TYPE = BORDER

 Now set the filter rule to allow any outbound but only
y y
port 80 inbound
FILTER SET Set4InternalInterface ACTION = PERMIT DIRECTION = OUTBOUND SRCADDR =
MyInternalIPAddress DSTADDR = * PROTOCOL = * DSTPORT = * SRCPORT = * JRN = OFF
FILTER SET Set4InternalInterface ACTION = PERMIT DIRECTION = INBOUND SRCADDR = *
DSTADDR = MyInternalIPAddress PROTOCOL = TCP DSTPORT = 80 SRCPORT = * JRN = OFF

 If you wanted to assign line names to an interface names,
do it like this:
FILTER_INTERFACE LINE = MYWEBLINE SET = Set4InternalInterface
FILTER_INTERFACE LINE = MYETHLINE SET = Set4InternalInterface

www.atallc.net

 To stop FTP at the packet level:
 Define the service, create the filter assign it to an interface
service filter,
SERVICE FTPControl PROTOCOL = TCP DSTPORT = 21 SRCPORT = *
SERVICE FTPData PROTOCOL = TCP DSTPORT = 20 SRCPORT = *

#
FILTER SET DenyFTP ACTION = DENY DIRECTION = OUTBOUND SRCADDR = * DSTADDR = * SERVICE = FTPControl
JRN = OFF
FILTER SET AllowMeFTP ACTION = DENY DIRECTION = OUTBOUND SRCADDR = 10.2.2.110 DSTADDR = * SERVICE =
FTPControl JRN = OFF

#
FILTER_INTERFACE LINE = MYETHLINE SET = AllowMeFTP
FILTER_INTERFACE LINE = MYWEBLINE SET = DenyFTP
FILTER_INTERFACE LINE = MYETHLINE SET = DenyFTP

 Now you have allowed yourself FTP from your workstation
(10.2.2.110) and denied everyone else
 You have stopped FTP on both the internal and web interface
www.atallc.net

IBM i Web Serving
 Whew!! That was a lot of information in a short time
 We:
 Made sure we had all the parts installed
 Set up individual developers web sites
p p
 Set up some work management
 Put some security on the network

www.atallc.net

Where do you find me?

Agile Technology A hit t LLC
A il T h l Architects,
Achieving Business Results from the Edge of Chaos

Jim Oberholtzer
Jim.oberholtzer@atallc.net
Agile Technology Architects, LLC
21305 W. Glengarry Rd
g y
New Berlin, WI 53146
414/433-4363

www.atallc.net

How do I securely deploy Internet websites in PHP on my IBMi?

Recommended

More Related Content

What's hot (20)

Viewers also liked (6)

Similar to How do I securely deploy Internet websites in PHP on my IBMi? (20)

More from Zend by Rogue Wave Software (20)

Recently uploaded (20)

How do I securely deploy Internet websites in PHP on my IBMi?