6,534
edits
Changes
VEx->CTx, VE->container
<pre>This document describes creating a "secure shared web hosting service" on « HN (Host Node) » It is « NOT » about per VE container shared web hosting.</pre>
{{roughstub}}
== The problem ==
One of the problems with shared webhosting web hosting (i.e. different people with each his/her own webpages) is that modern script languages such as PHP, Python, or Perl are too powerful. For example take the following PHP script:
<pre>
=== Minimal server ===
Create an VEx CTx with your favorite distro. Give it an internal IP-address in one of the ranges 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. Then strip away all unnecessary init.d scripts so only the bare minimum is started. That means as a minimum syslogd and ssh so the account holder can upload his/her files through SCP/SFTP in his/her own minimal server. For this to work you need to set up [[Using NAT for VE container with private IPs|destination NAT on CT0]] from high numbered ports to port 22 on the given private IP address:
<pre>
=== MySQL server ===
Most webhosting accounts use MySQL, but if you prefer another database server, go ahead. Create a new VEx CTx with a lot more resources and again an internal IP-address. Now configure the accounts. As an extra security measure you can use the internal IP-address as well.
==== MySQL socket sharing ====
You can also share the socket of an VEx CTx running MySQL, which is alot faster than TCP/IP.
e.g.:
<pre>
==== Refreshing links to MySQL socket ====
Sharing the MySQL socket works really well until the MySQL database is restarted or the VE container running MySQL is restarted. When this happens, the socket file is removed and recreated. In most cases, a different inode will be used, causing existing hard links to the mysql.sock file to no longer work. The solution is to relink these sockets.
There are more elegant solutions to this problem, but the following script is a decent hack that can be run via a cron job every minute or two. It will loop through all containers between START_CTID and STOP_CTID and make sure that the links point to the correct socket. If they do not, the link will be recreated.
oldDirectory=`pwd`
# Check to see if MySQL VE container socket exists
if [ -S "${MYSQL_SOCK_FILE}" ]; then
# Get inode of MySQL VE container socket
mysql_inode=`ls -i ${MYSQL_SOCK_FILE} | awk '{ print $1;}'`
cd $PRIVATE
for i in * ; do
# The current VE container to process
veid=$i
# Check if VE container should be processed
if [ $veid -ne $MYSQL_CTID -a $veid -ge $START_CTID -a $veid -le $STOP_CTID ]; then
# Get this VEcontainer's socket
vesock=${PRIVATE}/${veid}${MYSQL_SOCK_DIR}/${MYSQL_SOCK}
mkdir -p ${PRIVATE}/${veid}${MYSQL_SOCK_DIR}
# Check to see if this VE container has a socket already
if [ -S "${vesock}" ]; then
# Get inode of this VE container socket
ve_inode=`ls -i ${vesock} | awk '{ print $1;}'`
=== Proxy webserver ===
Because we have only one public IP-address, we need an trick to access every minimal server based on the hostname in the HTTP request. For SSH we used different ports, but that is not an option for websites. Again we create an VEx CTx with an internal IP-address. On this server we install Lighttpd as well, because the proxying is very simple. First we must forward port 80 to this server:
<pre>
=== Other applications ===
Create for other applications as mail, make sure that the minimal servers use this one for sending mail from webpages, DNS etc. VEx CTx as needed. The resulting server is shown in the figure above.
[[Category:HOWTO]]
