Steve Lineberry

This past weekend I moved all php sites on our server from IIS to Apache. They are still on the same server just now that server is running two different webservers. I thought I had done enough testing on apache before I moved production but this was not the case. Quickly I learned after moving to production that the exec calls to rebuild thumbnails in my gallery2 installations were failing. I had setup PHP to run as an apache module and for some reason it would build the thumbnails once, and if they had to be rebuilt, it would hang apache. This was not good. Especially since on this site’s pictures homepage it changes the thumbnail every 2 hours.

So I decided to try running PHP as a CGI. Under this config everything worked great, except it was really slow. That’s because when running PHP in cgi mode it loads and unloads the php-cgi.exe file for each request. This was acceptable for the meantime but not for the long run.

When I was running the PHP sites on IIS I was using FastCGI. This method of running PHP is the only way to run production level sites on IIS. Since that worked so well for me I decided to try to run it under Apache. The reason FastCGI works better than regular CGI is that it will load a certain number of php-cgi.exe instances into memory and when a request comes in, it just uses an instance loaded into memory instead of loading a new php-cgi.exe instance. It can also add more instances if needed and remove some when not needed.

I was very happy with FastCGI under IIS but I had a TIME getting it working correctly under Apache. It didn’t take me long to get it to serve PHP pages, but I was having that dang thumbnail problem again. This time instead of locking up apache, I was getting the broken thumbnail image that gallery2 generates if it fails to create one. I knew it was a problem with running exec to imagemagick or ffmpeg beacuse GD worked fine creating the thumnails. After a very long time I finally figured out it was because I didn’t pass in the PATH environment into FastCGI. That’s because FastCGI doesn’t get ANY enviroment variables unless you pass them in and gallery2 was trying to exec to cmd and the FastCGI php instances didn’t know where to look for that program.

So finally, here is the excerpt from my httpd.conf

ScriptAlias /php/ "c:/php/"
LoadModule fastcgi_module "c:/php/mod_fastcgi-2.4.2-AP20.dll"

AddHandler php-fastcgi .php
Action php-fastcgi "/php/php-cgi.exe"
FastCgiServer "c:/php/php-cgi.exe" -processes 5 -initial-env PATH 
FastCgiConfig -maxClassProcesses 10 -maxProcesses 10 -minProcesses 5 -processSlack 1

I initially tried to type in the PATH variable to pass it in and that didn’t work. Only by typing in PATH and no = worked because that would pass in the Apache PATH variable.

So my parents were able to find an XBOX 360 to give me for Christmas. Here’s how it went down. They’d been checking best buy and other gaming places with no luck. On the 23rd of Dec. my dad went to Hanes Mall in Winston-Salem to get some things. He stopped by at several gaming places in the mall and one said their next shipment was in January, the other said April. But one of the places informed my dad that Sears, Toys R Us and Best Buy all received shipments recently. My dad went to sears and they said that they sold out in an hour and a half YESTERDAY. So my dad decided to go to Best Buy thinking that it opened at 10 he’d get there a little before it opened and maybe be able to get one. He gets to Best Buy and they are aready open (holiday hours) and my dad walks in and walks up to the XBOX 360 table near the front door and asks when they will receive their next shipment. They said they have one, it’s the LAST ONE. So my dad was able to get the last XBOX 360 console system (not the core system) at the Best Buy in Winston-Salem, 2 days before Christmas.

Check out my status in the games i’m playing below.

Windows 2003 Server provides lots of different out of the box firewall options. There is always the basic firewall either used on the NIC card or though routing and remote access. If you have routing and remote access installed, you can also use inbound and outbound filters. There is a third one that is often overlooked. That’s using IPSEC Security policies as a firewall. I personally use this one for my complex firewall requirement for the network card interface connected to my Untrusted Wireless Network.

I have only 3 simple rules for that network

1. Don’t Allow Clients in the Untrusted Wireless Network to connect to anything on the server, not even ping

2. Allow Clients on the Untrusted Wireless Network to connect to the VPN PPTP port and protocol (TCP 1723, IP 47)

3. Allow all connections from my Gateway Router (the DI-604 connected to our Roadrunner) because that router port maps to the server, and the server makes the connection to the correct client/service.

I basically send a range of ports from the router to my server because my router has a limited number of port map entries, and then the server uses port tunnel to connect the ports from the router to the correct clients. The reason I do it this way is because I can use netbios or DNS names in port tunnel and not have to resort to IP addresses only, like in the router config. This way if a computer changes IP addresses on my network, the port map still works.

Ok, the first thing you need to do is create a new IPSEC policy. Goto Administrative tools, and then Local Security Policy or Domain Controller Security Policy. Right click on IP Security Policies and click “Create IP Security Policy”. I named mine Packet Filter.

Next we will need to add the Block action to block certain traffic. Right click on “IP Security Policies” and click “Manage IP filter lists and filter actions”. Click the “Manager Filter Actions” tab. Click Add, go through the wizard with the defaults, name it block, and select block as the filter action. Ok out of everything.

Now right click on our new Security Policy and click properties. Click add, and go ahead and add the already created filter lists, All ICMP Traffic, and All IP Traffic both with the Permit filter action. I selected LAN for the network type on all of my filter lists.

Next you will want to click Add again, but this time click the add button to add a new IP security rule, click through the menu and then click add again to add a new IP filter list. Name it and click Add. Lets create the All Untrusted Wireless Traffic first. I used the settings below. My Untrusted Wireless Network ranges from 192.168.1.1 to 192.168.1.255. Select the source address as a specific IP subnet. The IP address of 192.168.1.0 with a subnet mask of 255.255.255.0 will match every IP address in my Untrusted Wireless Network range. For the destination address I typed in the specific IP address of the network card that is connected to the untrusted network. For the protocol select Any. Finish the wizard and hit ok. Make sure your new IP filter list is selected in the list and click next. Select our new Filter Action of Block and finish the wizard.

Next we’ll create the Untrusted Wireless VPN IP filter list. Using the same precedure above to create a IP filter list, use the same settings above for the source and destination but this time use these settings below for the protocol. Notice I added two IP filters to this IP filter list. That’s because PPTP VPN requires a TCP port of 1723 and it uses it’s own protocol called GRE, that is IP Protocol 47. When selecting the protocal for this one, select other, and type in 47. Assign this new IP filter list the Permit filter action.

Lastly, we need to assign this IP Security Policy. Right click on the policy and click assign.

That’s it. Now all your traffic from your router should be allowed while no traffic from any wireless client is allowed except for if they are using VPN to connect to the server. I used the network monitor to determine that the source IP address from my router to my server was actually the routers external IP address (the one assigned by Roadrunner). That’s why I don’t need an extra policy specifing the internal IP address of my router to be allowed. If your router behaves differently, just add a ip filter list that matches your routers specific IP address and set the action to permit. Notice that you don’t have to worry about ordering the IP filter lists, it does that automatically for you.

This does not control what your wireless clients can and can’t do on the internet. This just prevents someone from hacking your less secure wireless network and then hacking your server to get access to the trusted network. So if someone does hack your wireless network, all they will be able to do is get internet access, they will think they are the only computer on the network and will be completely unaware of the trusted network unless they happen to be scanning IP addresses on the VPN port 1723. Then they will be suspecious but still will be unable to gain access to your trusted network.