NGINX reverse proxy in front of Apache: hardened, high performance dedicated server setup

== Overview ==
[[Image:DP HTOP.jpg|thumb|200px|NGINX reverse proxy in front of Apache-HTOP screenshot]]
Apache is a reliable HTTP server that still holds more than 66%, according to 
[http://w3techs.com/technologies/overview/web_server/all '''W3Techs'''],
of the web server market,
but Apache was not designed with performance or scalability in mind.

When the traffic is too high, it generate a lot of Apache processes and consume too much memory and generate many high CPU processes.This situation cause server to crash.

You can speed up your current HTTP server by installing a reverse proxy server in front of it. A reverse proxy fetches resources from one or more servers and returns them to the client as if they originated from the proxy server itself.

We will use web server [http://wiki.nginx.org/Main '''Nginx'''], Apache serve all dynamic content and Nginx handle all static files without consuming lots of system resources, combining the benefits of both servers.

== Hardware ==
Dedicated Server EX 4 http://www.hetzner.de/en/hosting/produkte_rootserver/ex4
*Intel® Core™ i7-2600 Quadcore 
*RAM 16 GB DDR3 RAM
*Hard disks 2 x 3 TB SATA 6 Gb/s HDD 7200 rpm
*NIC1 GBit OnBoard connected at 100 MBit
*Traffic 10TB/monthly

Operating System:
*Debian-60-squeeze-64-minimal (Hetzner image)


==Basic server setup - LAMP==
====Debian OS - upgrade to latest packages====
     <nowiki># apt-get update </nowiki>
     <nowiki># apt-get upgrade </nowiki>


====Packages installation====

=====Apache=====

     <nowiki># apt-get install apache2
    # a2enmod rewrite
    # /etc/init.d/apache2 restart</nowiki>



configuration:
     <nowiki># nano /etc/apache2/sites-enabled/000-default
      (default webroot directory: /var/www/) </nowiki> 


check configuration:
     <nowiki># apachectl -t </nowiki> 


After enabling, disabling, or modifying any part of your Apache configuration, you will need to reload or restart the Apache configuration again with command:
     <nowiki># /etc/init.d/apache2 reload</nowiki> or 
     <nowiki># /etc/init.d/apache2 restart</nowiki>


----


=====PHP=====
     <nowiki># apt-get install php5 php-pear php5-suhosin php5-mysql</nowiki>


configuration: edit '''/etc/php5/apache2/php.ini'''
Make sure that the following values are set, and relevant lines are uncommented (comments are lines beginning with a semi-colon (;)):
 <nowiki>max_execution_time = 60
memory_limit = 128M
error_reporting = E_COMPILE_ERROR|E_RECOVERABLE_ERROR|E_ERROR|E_CORE_ERROR
display_errors = Off
log_errors = On
error_log = /var/log/php5.log
register_globals = Off</nowiki>


To apply PHP configuration changes Apache need to be restarted:
     <nowiki># /etc/init.d/apache2 restart</nowiki>


----


=====MySQL=====
     <nowiki># apt-get install mysql-server</nowiki>
During the installation, you will be prompted for a password. Choose something secure and record it for future reference. At this point, MySQL should be ready to configure and run. While you shouldn't need to change the configuration file, note that it is located at '''/etc/mysql/my.cnf''' for future reference.



----


=====ProFTPD=====


     <nowiki># apt-get install proftpd</nowiki>
select: standalone mode


configuration:
     <nowiki># nano /etc/proftpd/proftpd.conf </nowiki> 


check configuration:
     <nowiki># proftpd -t </nowiki> 


After modifying any part of your ProFTPD configuration, you will need to restart the ProFTPD service:
     <nowiki># /etc/init.d/proftpd restart</nowiki>



----


=====Postfix=====


     <nowiki># apt-get install postfix</nowiki>
select: internet site


configuration:
     <nowiki># nano /etc/postfix/main.cf </nowiki> 
     <nowiki># nano /etc/postfix/master.cf </nowiki>


After modifying any part of your Postfix configuration, you will need to restart service:
     <nowiki># /etc/init.d/postfix restart</nowiki>



----


====List of all installed packages for new installation====
     <nowiki># dpkg --get-selections > all-installed-software.log
    # dpkg --set-selections < all-installed-software.log 
    # dselect (select i -install) </nowiki>



References:
*http://www.debian.org/
*http://httpd.apache.org/docs/2.2/
*http://dev.mysql.com/doc/
*http://www.php.net/docs.php
*http://www.proftpd.org/docs/
*http://www.postfix.org/documentation.html
*http://library.linode.com/lamp-guides/debian-6-squeeze
*http://www.cyberciti.biz/tips/linux-get-list-installed-software-reinstallation-restore.html

==Advanced server setup - NGINX==

====Installation====

Using http://www.dotdeb.org/instructions/ repo for Nginx 1.0.11 last stable
For the main Dotdeb repository add these two lines to: 
/etc/apt/sources.list file

     <nowiki># deb http://packages.dotdeb.org stable all
    # deb-src http://packages.dotdeb.org stable all</nowiki>


Then fetch the appropriate GnuPG key
     <nowiki># wget http://www.dotdeb.org/dotdeb.gpg
    # cat dotdeb.gpg | sudo apt-key add -</nowiki>


     <nowiki># apt-get update    
    # apt-get install nginx</nowiki>

====Configuration====


Stop the Nginx server if it was started automatically by the package manager and create a new '''nginx.conf''' configuration file – installed in '''/etc/nginx/''' by default – by pasting the following and adjusting the paths to those of your installation:

 <nowiki>user www-data; #change to the same user apache runs as
worker_processes 8; #change to the number of your CPUs/Cores
worker_rlimit_nofile 8192;

error_log /var/log/nginx/error.log;
pid /var/run/nginx.pid;

events {
  worker_connections 1024;
  use epoll;
  accept_mutex off;
}

http {
  server_names_hash_bucket_size 64;
  include /etc/nginx/mime.types;
  default_type application/octet-stream;
  access_log /var/log/nginx/access.log;
  sendfile on;
  tcp_nopush on;
  keepalive_timeout 65;

  # reverse proxy options
  proxy_redirect off;
  proxy_set_header Host $host;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

  # gzip compression options
  gzip on;
  gzip_http_version 1.0;
  gzip_comp_level 6;
  gzip_min_length 0;
  gzip_buffers 16 8k;
  gzip_proxied any;
  gzip_types text/plain text/css text/xml text/javascript application/xml application/xml+rss application/javascript application/json;
  gzip_disable "MSIE [1-6]\.";
  gzip_vary on;

  # include virtual hosts configuration
  include /etc/nginx/virtual.d/*.conf;
}</nowiki>



Nginx should run as the same user Apache runs, to avoid file permission problems. 

Besides the proxy setup this configuration file includes some generic performance tuning, such as use epoll as the event model method, which works effectively on Linux 2.6+ kernels. This works in tandem with the next line, accept_mutex off, to improve performance a bit more. Enabling sendfile allows nginx to use the kernel’s sendfile support to send files to the client regardless of their contents. This can help with large static files, such as images, that have no need for a multiple request/confirmation system to be served. Enabling gzip compression for static files can make a big performance difference. The lines starting with gzip enable compression for common web files, such as .css and .js files, on supported browsers.

====Apache reverse proxy forward module(mod_rpaf)====
If you check the Apache access log files you should see that all incoming requests are coming from 127.0.0.1. To fix this you need to install mod_rpaf, the reverse proxy add forward module for Apache. 

     <nowiki># apt-get install libapache2-mod-rpaf</nowiki>


check content of  /etc/apache2/mods-enabled/rpaf.conf :
 <nowiki>
<IfModule mod_rpaf.c>
RPAFenable On
RPAFsethostname On
RPAFproxy_ips 127.0.0.1
</IfModule></nowiki>


restart apache:
     <nowiki># /etc/init.d/apache2 restart</nowiki>

====Apache configuration (behind Nginx)====

Nginx now acts as the front-end web server – waiting for requests on port 80 – you need to configure Apache to listen on a different port (8080 in this case) and preferably only on localhost, open the file '''/etc/apache2/ports.conf''' and change the line 
'''Listen 80 to Listen 127.0.0.1:8080''', 
if you use name-based virtual hosts you should have a line '''NameVirtualHost *:80''' in the same file. Change that to '''NameVirtualHost *:8080'''.

If you have configured Keep-Alive support in Apache you should disable it since it is already enabled in Nginx. Change '''KeepAlive On''' to '''KeepAlive Off''' in '''/etc/apache2/apache2.conf''' . You can also disable the '''mod_deflate''' module since Nginx already provides gzip compression.


References:
*http://wiki.nginx.org/
*http://tumblr.intranation.com/post/766288369/using-nginx-reverse-proxy
*http://www.djm.org.uk/wordpress-nginx-reverse-proxy-caching-setup/
*http://www.djm.org.uk/fauna-flora-nginx-reverse-proxy-results/
*http://syslog.tv/2011/09/30/nginx-config-for-reverse-proxying-wordpress-wp-super-cache-and-keeping-the-load-off-apache2/

==WordPress, MediaWiki, phpBB tweaks==
====WordPress====
'''WordPress Nginx proxy cache integrator'''
Enable your blog to work properly with an nginx frontend static proxy cache. ASTRONOMICAL performance is yours!
http://wordpress.org/extend/plugins/nginx-proxy-cache-integrator/

====MediaWiki====


Fix for mediawiki problem double /docs/docs , the right setting in LocalSettings.php is
$wgServer = 'http://dangerousprototypes.com';

it was: $wgServer = 'http://dangerousprototypes.com/docs';
from http://www.cyberciti.biz/faq/mediawiki-fix-internal-server-host-names-redirect-using-wgserver/
this not work properly.

====phpBB====

http://www.phpbb.com/kb/article/fixing-incorrect-cookie-settings/

==Hardening==

====sysctl.conf security hardening====
http://www.cyberciti.biz/faq/linux-kernel-etcsysctl-conf-security-hardening/

====/tmp, /var/tmp directory hardening====
*http://www.modmysite.com/security-server-administration/10725.htm
*http://www.mokonamodoki.com/mounting-tmp-and-var-tmp-as-a-separate-file-system

====RootKit hunter====
*http://www.debian-tutorials.com/security/how-to-install-and-use-rkhunter

====CSF firewall & LFD====
http://blog.eukhost.com/webhosting/features-and-installation-procedure-of-csf-configserver-security-firewall/
====Securing SSH server====
*http://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html

====Log analysis====
*http://library.linode.com/server-monitoring/logwatch/debian-5-lenny

====FTP hardening====
*http://www.cyberciti.biz/tips/linux-installing-configuring-proftpd-ftp-server.html

====Apache mod_security====
*http://www.pc-freak.net/blog/tightening-php-security-on-apache-2-2-with-modsecurity2-on-debian-lenny-linux/

==Monitoring==

====AWS EC2====
     <nowiki># </nowiki>
     <nowiki>#</nowiki> 
=====Nagios=====
=====Munin=====

==Backups!!!==
====Second HDD synchronization====
====Database dump====
====Offsite encrypted backups - Jungle Disk ====
Offsite encrypted backups on AWS EC3 or Rackspace Cloud Files

== Troubleshooting ==