How do I securely deploy Internet websites in PHP on my IBMi?
2 likes1,403 views
The document is a presentation by Jim Oberholtzer from Agile Technology Architects, focusing on securely deploying PHP websites on IBM i systems, specifically using Apache and Zend servers. It covers topics such as web server configurations, performance management, and the use of virtual hosts, along with instructions for setting up development environments. Additionally, it emphasizes the importance of managing network traffic and optimizing system performance for effective web serving.
![Development Web Site…
Copy the htdocs directory from the Zend Install
We modified this to have a couple of examples in it
DB2 SQL example
PhPinfo.php etc…..
The hidden file .htaccess (note the “.” in the first p
( position)
)
Required for Zend Routing to work
************Beginning of data**************
SetEnv APPLICATION_ENV development This is important for the Zend Framework!
RewriteEngine On
RewriteCond %{REQUEST FILENAME} -s [OR]
%{REQUEST_FILENAME}
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ index.php [NC,L]
************End of Data********************
Unless specified, forces all the pathnames “-s”, Symbolic Links “-l” and
Directories “-d” into one place.
This is really part of Apache rewrite rules. See web for too much
information…..
information
© Agile Technology Architects
www.atallc.net](https://image.slidesharecdn.com/securelydeployingwebsitesinphponibmi-111013043926-phpapp01/85/How-do-I-securely-deploy-Internet-websites-in-PHP-on-my-IBMi-18-320.jpg)
How do I securely deploy Internet websites in PHP on my IBMi?
- 1. Agile Technology Architects LLC Architects, Achieving Business Results from the Edge of Chaos Jim Oberholtzer CEO/Chief Technical Architect Securely Deploying Websites in PHP on IBM i Zend Webinar – October 5, 2011
- 2. Jim Oberholtzer, MSE, CCBCP Agile Technology Architects, LLC 31 years experience rising to VP/CIO IBM Subject Matter Expert, IBM I Agile provides services: g p IBM POWER Systems infrastructure and performance Architect configurations and provide second opinion services Installation d implementation I t ll ti and i l t ti Performance and system management services Agile development techniques Get your IT department moving as fast as the business Mix hierarchical management techniques with Agile techniques © Agile Technology Architects www.atallc.net
- 3. Agenda IBM i web serving Configuring the IBM i Apache Server IBM i Work Management for Web Serving Networking Wrap up Note: We will not discuss PHP security/Networking since that is covered in other webinars etc. © Agile Technology Architects www.atallc.net
- 4. IBM i Web Serving Two web servers for IBM i WebSphere Application Server Express edition ships with every IBM i instance Full server is a chargeable feature Main servers for Java 2 and Enterprise Edition Java environments Apache Web server Tomcat removed as of 6.1 Integrated Web Application Server (IAS) replaced it IAS includes most of the Java function that might be needed. Zend S Z d Server Utilizes the Apache Server U ili h A h S © Agile Technology Architects www.atallc.net
- 5. IBM i Web Serving Primary Web server is Apache Licensed Program product xxxx-DG1 5770-DG1 at V7R1 Apache level 2.2.11 at V6 (V5R4 at 2.0.63, another reason to upgrade) Apache Software Foundation Server project at 2.2.21 Apache 2.3.14 beta is out IBM very carefully tests apache updates Free Additional Software with the OS PTF groups V7: SF99368 / Level 10 (10/3/11) V6: SF99115 / Level 22 (10/3/11) Tend to come out about every other month Order the Java PTF Group at same time (comes with HTTP group) V7: SF99572 / 6 (10/3/11) V6: SF99562 / 17 (10/3/11) © Agile Technology Architects www.atallc.net
- 6. IBM i Web Serving Odds are fairly strong xxxx-DG1 is installed V7: 5770-DG1 *BASE Located on media: B_GROUPx_04 English 2924 is in Group 1, 2, and 3 V6R1: 5761-DG1 *BASE and option 1 p *BASE is IBM HTTP Server for i5/OS Option 1 is Triggered Cache Manager Located on media B29xx_02: B2924_02 for US English (2924) Java is required along with Apache V7: 5761-JV1: *BASE, options 8, 9, 11, 12, 13 576 JV : S , opt o s , , 3 Located on B_GROUPx_05 Group rules same as DG1 Option 8 is the 32 bit J2SE (it’s really the one you want) (it s © Agile Technology Architects www.atallc.net
- 7. IBM i Web Serving Of course the Zend Server requires DG1 and: -V6R1-- -V7R1-- Portable App Solutions Environment 33 5761SS1 5770SS1 Qshell 30 5761SS1 5770SS1 IBM Portable Utilities for I5/OS *base 5733SC1 5733SC1 OpenSSH, OpenSST, Zlib 1 5733SC1 5733SC1 It’s rare to find installations without all of these There are no PTF groups available for these products PTFs come with the other groups A search of the registered knowledge base did not reveal any PTFs issued specifically for these products © Agile Technology Architects www.atallc.net
- 8. IBM i Web Configuration The default IBM i Admin web instance is at port 2001 http://your.serveraddress.com:2001 http://your serveraddress com:2001 Click here to get to the HTTP Configuration options C f © Agile Technology Architects www.atallc.net
- 9. IBM i Web Configuration Web administration is found in the first link on this page © Agile Technology Architects www.atallc.net
- 10. IBM i Web Configuration An alternative method of getting to the web administration panels Click here to get to the HTTP Configuration options C f © Agile Technology Architects www.atallc.net
- 11. IBM i Web Configuration The default IBM i Admin web instance is at port 2001 http://your.serveraddress.com:2001 http://your serveraddress com:2001 © Agile Technology Architects www.atallc.net
- 12. IBM i Web Configuration Web Administration for i Select the “Manage” tab Manage © Agile Technology Architects www.atallc.net
- 13. IBM i Web Configuration Manage all HTTP servers a age a se ve s The panel will remember you and where you were last Each server is hyperlink to its configuration Notice have only one server running at port 80 N i Ih l i © Agile Technology Architects www.atallc.net
- 14. IBM i Web Configuration Here’s the main p g page to administer the site Notice Tools near bottom. bottom Config Editor Statistics Web Log monitor If you have SSHD running Install VIM in PASE Use PuTTY © Agile Technology Architects www.atallc.net
- 15. IBM i Web Configuration Default location for Zend Server is /www/zendsvr Directories for configuration, htdocs (the web site) and logs default here This is fine for production What about Dev? I like /home/userprofile © Agile Technology Architects www.atallc.net
- 16. Create Development Web Site… Premise: Each developer will have a library directory and web address library, directory, Security is your call, but separating the developers makes sense Production runs on Port 80/443 as a Virtual Host A test version of the instance runs on port 10088 Notes: Zend does not as yet support running multiple copies of the Zend Server on one system. Reasons are valid, but way beyond the scope of this session I have tested and made it work, but in a very lightly loaded system The site at port 10088 will be integration testing URL, DNS, etc are up to date Firewalls are set up properly © Agile Technology Architects www.atallc.net
- 17. Development Web Site… Step one: Create the base configuration Each developer needs a home directory /home/iusr0001 Authority looks like: QTMHHTP1 QTMHHTTP Too much authority for a production system Integration should look like production does *PUBLIC could be *USE ld b © Agile Technology Architects www.atallc.net
- 18. Development Web Site… Copy the htdocs directory from the Zend Install We modified this to have a couple of examples in it DB2 SQL example PhPinfo.php etc….. The hidden file .htaccess (note the “.” in the first p ( position) ) Required for Zend Routing to work ************Beginning of data************** SetEnv APPLICATION_ENV development This is important for the Zend Framework! RewriteEngine On RewriteCond %{REQUEST FILENAME} -s [OR] %{REQUEST_FILENAME} RewriteCond %{REQUEST_FILENAME} -l [OR] RewriteCond %{REQUEST_FILENAME} -d RewriteRule ^.*$ - [NC,L] RewriteRule ^.*$ index.php [NC,L] ************End of Data******************** Unless specified, forces all the pathnames “-s”, Symbolic Links “-l” and Directories “-d” into one place. This is really part of Apache rewrite rules. See web for too much information….. information © Agile Technology Architects www.atallc.net
- 19. Development Web Site… Now a CLP that creates each users web container: CHGVAR &NEWPRF VALUE('iusr' *CAT &USRNBR) CHGVAR &USRDIR VALUE('/home/' *TCAT &NEWPRF) CHGVAR &USRDIR1 VALUE(&USRDIR *TCAT '/htdocs') CRTLIB LIB(&NEWPRF) TYPE(*TEST) TEXT(&USRTEXT) AUT(*EXCLUDE) MKDIR DIR(&USRDIR) DTAAUT(*EXCLUDE) OBJAUT(*NONE) CHGVAR &USRDIR1 VALUE(&USRDIR *TCAT '*') CPY OBJ('/home/iusr0000/htdocs/') TODIR(&USRDIR) SUBTREE(*ALL) + REPLACE(*YES) OWNER(*KEEP) (* ) (* ) CHGAUT OBJ(&USRDIR1) USER(QTMHHTP1) DTAAUT(*RWX) OBJAUT(*ALL) SUBTREE(*ALL) CHGAUT OBJ(&USRDIR1) USER(QTMHHTTP) DTAAUT(*RWX) OBJAUT(*ALL) SUBTREE(*ALL) CHGAUT OBJ(&USRDIR1) USER(*PUBLIC) DTAAUT(*EXCLUDE) OBJAUT(*NONE) SUBTREE(*ALL) CRTUSRPRF USRPRF(&NEWPRF) PASSWORD(PASSW0RD) + PWDEXP(*YES) USRCLS(*PGMR) + CURLIB(&NEWPRF) TEXT(&USRTEXT) + SPCAUT(*NONE) PWDEXPITV(30) + GRPPRF(IUSR) HOMEDIR(&USRDIR) + MAXSTG(10240000) GRPAUTTYP(*PGP) CHGOWN OBJ(&USRDIR) NEWOWN(&NEWPRF) SUBTREE(*ALL) CHGOBJOWN OBJ(&NEWPRF) OBJTYPE(*LIB) NEWOWN(&NEWPRF) Only the executable code shown. Contact me if you want the full program with error handling y p g g © Agile Technology Architects www.atallc.net
- 20. Development Web Site… Now the APACHE set up httpd.conf httpd conf holds the Apache configuration You can use Systems Director Navigator for IBM i You could also use: http://yoursystemaddress:2001/HTTPAdmin © Agile Technology Architects www.atallc.net
- 21. Development Web Site… Click on: Manage, then, HTTP Servers, and in the drop down, Zendsvr – Apache This is where you manage the server instance Set up virtual hosts for: Developers Test sites Different applications Go to General Server Configuration Open up tools Edit Configuration File © Agile Technology Architects www.atallc.net
- 22. Development Web Site… The directive: “UserDir /home/*/htdocs” is what you need Apache then uses: http://common1.idevcloud.com:10088/~userprofile Once you press “apply”, then “OK” OK Note Restart the the location server by of the file using the button You can of course use any editor you wish © Agile Technology Architects www.atallc.net
- 23. Virtual Host set up Apache can do virtual web sites by name or IP address Here I set up two virtual sites both on port 80 One is for the public web site, one for a customer interface © Agile Technology Architects www.atallc.net
- 24. Development Web Site.. Lets consider some other APACHE directives Why does this work? http://common1.idevcloud.com:10088/phpmyadmin And: http://common1.idevcloud.com:10088/editor h // 1 id l d 10088/ di does not? (hint, if you add the .php suffix it will….) © Agile Technology Architects www.atallc.net
- 25. Development Web Site Lets consider some other APACHE directives Why does this work? http://common1.idevcloud.com:10088/phpmyadmin And: http://common1.idevcloud.com:10088/adminer h // 1 id l d 10088/ d i does not? (hint, if you add the .php suffix it will….) Answer: alias directives. directives Alias /phpmyadmin /usr/local/zendsvr/phpMyAdmin ….. <Directory /usr/local/zendsvr/phpMyAdmin> Options FollowSymLinks AllowOverride None Order allow,deny Allow from 127.0.0.1 </Directory> © Agile Technology Architects www.atallc.net
- 26. Work Management Often forgotten portion of managing a web site Zend has at least two, sets of distinct jobs that run two Subsystem QHTTPSVR shipped with *BASE Add a second memory pool to the subsystem Change the routing entry to point to the new memory Consider a bit of tuning in the shared pools Zendsvr subsystem also shipped with *BASE BASE MySQL has a subsystem and may also use QUSRWRK Depends on how started p Menu ZSMENU will start in ZMYSQL subsystem MySQL started manually (shown earlier) will start in QUSRWRK Memory management critical for performance M ii lf f © Agile Technology Architects www.atallc.net
- 27. Work Management Three portions of performance to consider Zend Server Settings Several parameters in the server can directly affect Zend Performance Zend Server Performance is not MySQL or DB/2 performance Beyond the scope of this presentation DB/2 Performance Index strategy / QAQQINI settings extremely important Know which query Engine your query is using CQE/SQE Index advisor / Job Watcher Beyond scope of this presentation Work management of several objects g j Zend Server subsystem Zend Apache Instance (subsystem QHTTPSVR) Data Access jobs ( j (QZDASOINIT and QSQSRVR) ) © Agile Technology Architects www.atallc.net
- 28. Work Management Change QHTTPSVR subsystem to have 2nd memory pool Change Shared Pool to reflect change g g Add storage pool to subsystem Change routing entry on subsystem Restart subsystem jobs Change Zend Subsystem Same procedure as QHTTPSVR p Q After changes, watch it for a day or so Make sure active/wait transitions are zero Watch f l i W h faulting May have to add memory Activity Level critical since multi threaded jobs are running © Agile Technology Architects www.atallc.net
- 29. WRKSHRPOOL Size depends Activity needs to be high enough for LOTS of threads Smart Paging Use F11 to change text Most under used part of Shared Sh d pools l Leave tuning alone for now © Agile Technology Architects www.atallc.net
- 30. Work Management Change the subsystem description CHGSBSD SBSD(QHTTPSVR/QHTTPSVR) POOLS((2 *SHRPOOL1)) SHRPOOL1)) Change the Routing Entry on the subsystem Routing entry determine which pool of memory will be used Most common mistake made when tuning (not changing it) QHTTPSVR only has one routing entry Use: CHGRTGE SBSD(QHTTPSVR) SEQNBR(10) POOLID(2) Need to restart all of the jobs in the subsystem Use: STRTCPSVR SERVER(*HTTP) RESTART(*HTTP) HTTPSVR(ZENDSVR) © Agile Technology Architects www.atallc.net
- 31. Work Management Zend Subsystem gets same treatment as QHTTPSVR Determine which memory to use Is there already a shared pool set up that’s usable Like jobs go in like memory Change the subsystem description to add memory pool g y p yp CHGSBSD SBSD(ZENDSVR/ZENDSVR) POOLS((2 *SHRPOOL1)) Change routing entry Communications Server Jobs Note that Multiple changes are needed…. Two different classes are used © Agile Technology Architects www.atallc.net
- 32. IBM i Web Serving Networks TCP/IP Magic can be used to separate the LANs Even on the one network cable Can be used to manage TCP/IP traffic from/to the production web server Keeps web serving traffic away from the internal LAN p g y Example: Web traffic from firewall comes in on 10.10.10.2 / 255.255.255.252 Allows Two addresses: 10.10.10.1, 10.10.10.2 Subnet: 10.10.10.0 Broadcast: 10.10.10.3 S b t 10 10 10 0 B d t 10 10 10 3 The Web Server is 10.10.10.2 The firewall is 10.10.10.1 Corporate LAN is 10.2.2.x Subnet is 255.255.240.0 There could be as many as 4094 computers/printers/etc on the network From 10.2.2.1 to 10.2.15.254 Traffic on the 10.10.10.x network will not cross over to 10.2.2.x without a router © Agile Technology Architects www.atallc.net
- 33. IBM i Web Serving Network Firewall uses NAT to translate 10.2.2.x 10 2 2 x Internet internet to internal address 65.32.51.115 65.32.51.110 IBM I is set to not route between networks 10.2.2.1 10.10.10.1 Networking Subnet purists would Subnet 255.255.240.0 have two 255.255.255.252 firewalls and two interface cards 10.2.2.2 10.10.10.2 © Agile Technology Architects www.atallc.net
- 34. IBM i Web Serving Networking Setting up packet filter rules Need to use System I Navigator Found at Network / IP Policies / Packet Rules Right click and bring up Packet Rules Configuration: © Agile Technology Architects www.atallc.net
- 35. IBM i Web Serving Network Set the interfaces alias names: ADDRESS MyInternalIPAddress IP = 10.10.10.1 TYPE = TRUSTED ADDRESS MyProdIPAdress IP = 10.2.2.1 TYPE=TRUSTED ADDRESS MyPublicIPAddress IP = 65.32.51.110 TYPE = BORDER Now set the filter rule to allow any outbound but only y y port 80 inbound FILTER SET Set4InternalInterface ACTION = PERMIT DIRECTION = OUTBOUND SRCADDR = MyInternalIPAddress DSTADDR = * PROTOCOL = * DSTPORT = * SRCPORT = * JRN = OFF FILTER SET Set4InternalInterface ACTION = PERMIT DIRECTION = INBOUND SRCADDR = * DSTADDR = MyInternalIPAddress PROTOCOL = TCP DSTPORT = 80 SRCPORT = * JRN = OFF If you wanted to assign line names to an interface names, do it like this: FILTER_INTERFACE LINE = MYWEBLINE SET = Set4InternalInterface FILTER_INTERFACE LINE = MYETHLINE SET = Set4InternalInterface © Agile Technology Architects www.atallc.net
- 36. IBM i Web Serving Network To stop FTP at the packet level: Define the service, create the filter assign it to an interface service filter, SERVICE FTPControl PROTOCOL = TCP DSTPORT = 21 SRCPORT = * SERVICE FTPData PROTOCOL = TCP DSTPORT = 20 SRCPORT = * # FILTER SET DenyFTP ACTION = DENY DIRECTION = OUTBOUND SRCADDR = * DSTADDR = * SERVICE = FTPControl JRN = OFF FILTER SET AllowMeFTP ACTION = DENY DIRECTION = OUTBOUND SRCADDR = 10.2.2.110 DSTADDR = * SERVICE = FTPControl JRN = OFF # FILTER_INTERFACE LINE = MYETHLINE SET = AllowMeFTP FILTER_INTERFACE LINE = MYWEBLINE SET = DenyFTP FILTER_INTERFACE LINE = MYETHLINE SET = DenyFTP Now you have allowed yourself FTP from your workstation (10.2.2.110) and denied everyone else You have stopped FTP on both the internal and web interface © Agile Technology Architects www.atallc.net
- 37. IBM i Web Serving Whew!! That was a lot of information in a short time We: Made sure we had all the parts installed Set up individual developers web sites p p Set up some work management Put some security on the network © Agile Technology Architects www.atallc.net
- 38. Where do you find me? Agile Technology A hit t LLC A il T h l Architects, Achieving Business Results from the Edge of Chaos Jim Oberholtzer [email protected] Agile Technology Architects, LLC 21305 W. Glengarry Rd g y New Berlin, WI 53146 414/433-4363 © Agile Technology Architects www.atallc.net