PHP (5.4)

Packages and Extensions

Assuming you are using Debian, you will likely want the following for certain:

• php-apc php-pear php5-cgi php5-mysqlnd php5-dev php5-fpm php5-dbg
  • if using dotdeb, remember to use php5-apc instead of php-apc

These may be desirable depending on what software you are using.

• php5-curl php5-gd php5-geoip php5-enchant php5-imagick php5-imap php5-memcached php5-xmlrpc php5-pspell aspell-en php5-imap php5-mapscript spawn-fcgi

You can run 'spawn-fcgi' alongside fpm. In practice, chances are if you have a large enough site that merits its own fastcgi master process, you should probably make an fpm configuration for it specifically. I'm describing it for posterity, anyhow.

/etc/php5/cgi/php.ini

The following is a list of key settings to change from the default.

Security

• Set engine = off
  • Prefer to be explicit. We should not under any circumstance be running under apache
• short_open_tag = Off
  • Less relevant lately than it used to be. Short open tags and asp tags can cause issues with scanners looking for attempts to upload php code.
• expose_php = Off
  • No reason for it to be on. Security, obscurity, and all that - there is no reason to give attackers help.
• cgi.force_redirect = 1
  • Just like to be explicit with some things
• cgi.fix_pathinfo = 0
  • Security. Otherwise php is perfectly happy to execute things that shouldn't be.
• pcre.recursion_limit=100000
  • Not giving any specific suggestions for this, but be aware of ReDOS attacks when using regular expressions.
• mail.add_x_header = Off
  • While I do try to move everything off of the mail function, just in case, I turn this off.
• mysql.allow_local_infile = Off
  • No. Just no.
• mysqli.allow_local_infile = Off
  • ---- this setting too.
• session.cookie_httponly = 1
  • This not being the default ought to be reported as a security bug
• url_rewriter.tags = ""
  • My hat of php sessions know no limit. A lot of assumptions that programmers often make about php sessions are not actually true.
• open_basedir = /home
• upload_tmp_dir = /home/ptmp
• soap.wsdl_cache_dir = /home/ptmp
  • Because we have things locked down fairly well inside /home proper, we can make use of a temp directory inside /home. It's not as good as a per-user temporary directory, but php doesn't let us do that yet.

Performance

• realpath_cache_size = 256k
  • Another optimization.
• Consider:
  • ignore_user_abort = On
  • Depending on what CMS you are running and its magnitude. It may be necessary for some programs that have long-running maintenance tasks which do not call the function.
• max_execution_time = 300
• max_input_time = 300
  • Generally just to permit longer-running tasks. Consider the software you are using.
• memory_limit = 512M
  • PHP uses a ridiculous amount of memory for some things, though it has improved in this arena. This is only a limit - it's not how much it uses. Generally you do this for very large uploads.
• variables_order = "EGPCS"
  • Some broken software (phpBB, I'm looking at you...) requires $_ENV
• post_max_size = 32M
  • Or however large of uploads you wish to allow. Make sure max memory size is four times this.
• upload_max_filesize = 32M
  • See above.
• default_socket_timeout = 6
  • Don't waste people's time, if we have a problem.
• date.timezone = America/New_York
• date.timezone = America/Chicago
• date.timezone = America/Los_Angeles
  • Some software complains if this is not set, so may as well. Obviously, pick whatever is appropriate for you.
• mysqlnd.net_cmd_buffer_size = 4096
  • Some queries are going to be large, and there's little benefit to allocating less than a page.
• mysqlnd.net_read_buffer_size = 262144
  • Good for any server hosting communities.

Development

• error_reporting = E_ALL
  • Yay, all finally means all!
• log_errors_max_len = 4096
  • Haven't had many cutoffs, but just in case
• ignore_repeated_errors = On
  • This is just being sane.
• track_errors = On
  • Even if you don't do development, I find having access to this useful for some of php's more borked functions.
• html_errors = Off
  • We're not showing this crap to the user...
• error_log = php_errors.log
  • We're going to be setting this per-user in their .user.ini anyhow
• mysqlnd.collect_memory_statistics = On
  • Handy!

FPM

Best to make a script to automate adding sites to the common pool, in my opinion. The following helps facilitate this.

cd /etc/php5/fpm
mv php.ini php.ini.old
ln -sv ../cgi/php.ini php.ini   
mv pool.d/www.conf /root/fpmpool.conf

Or wherever you want to put your pool template.

fpmpool.conf

• Pool name is USERNAME
  • Will be replaced via sed in our setup script
• user = $pool
• group = $pool
• listen = /var/run/$pool-fpm.sock
• listen.backlog = 2048
  • 128 is an insanely low limit. If you have an active site, you -will- hit this.
  • 2048 is just a placeholder, here, though I've rarely passed 256, even for a large forum.
• listen.owner = $pool
• listen.group = www-data
• listen.mode = 0660
• pm.max_children = 4
• pm.start_servers = 2
• pm.min_spare_servers = 2
• pm.max_spare_servers = 4
  • Tune these as per necessary, but 2 is enough for most sites.
• pm.max_requests = 20000
  • Don't set this below 10,000 - php's fastcgi implementation is extremely efficient, but restarting processes never is. In basic benchmarks, the original default (500) cut performance by more than half. That is, PHP was sometimes able to serve over 500 pages in less time than it takes to restart the process.
• ping.path = /ping
  • Easy uptime monitoring.
• ;access.log = /home/$pool/logs/php-access.log
  • Recomment leaving this commented out save for testing, especially on a large site.
• access.format = "%R - %u %t \"%m %r%Q%q\" %s %f %{mili}d %{kilo}M %C%%"
• slowlog = /home/$pool/logs/php-slow.log
• request_slowlog_timeout = 3s
  • Your mileage may vary, but at least on a server with SSDs, I get very few hits here, unless something is going wrong.
• php_admin_value[error_log] = /home/$pool/logs/php-errors.log
• php_admin_flag[log_errors] = on
  • Again, if you know your software has issues, you may wish to disable this on a large site.

spawn-fcgi

FPM is great and all, but unfortunately all pools run under the same process use the same shared memory. If you run a lot a communities, this can be a major problem, if you don't want to be arsed with setting up a unique config and spawn for each.

You'll need to edit the below init script as you add/remove sites from this. It has been rock-solid reliable for me, however, even for very large communities. FPM is quickly obsoleting it, but the shared memory issue may still be a dealbreaker for you. As mentioned, however, you can setup multiple master fpm processes instead, and generally only larger sites are going to need their own shared memory pools.

In my own case, I have largely been phasing this out.

chmod 755 /etc/init.d/spawn-php-fcgi 
insserv spawn-php-fcgi

/etc/init.d/spawn-php-fcgi

#! /bin/sh

### BEGIN INIT INFO
# Provides:          php-fastcgi
# Required-Start:    $remote_fs $network
# Required-Stop:     $remote_fs $network
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: starts the php fastcgi daemons
# Description:       starts a set of php daemons
### END INIT INFO

# In order to make sense of Apparmor, don't look at symlinks.
PHP_CGI=/usr/bin/php5-cgi
KPHP=php5-cgi

# Each of these is a space separated list, based on username
BIGUSERS=""
MIDUSERS=""
TINUSERS=""

umask 022
export PHP_FCGI_MAX_REQUESTS=20000

startbig () {
   echo -n "Starting Large PHP FastCGI Processes: \n"
   export CHILDREN=16
   for USER in $BIGUSERS
   do
       /usr/bin/env - /usr/bin/spawn-fcgi -u $USER -C $CHILDREN -s /var/run/$USER.fcgi.sock -- $PHP_CGI
       chgrp www-data /var/run/$USER.fcgi.sock
       chmod 660 /var/run/$USER.fcgi.sock
   done
}

startmid () {
   echo -n "Starting Midsized PHP FastCGI Processes: \n"
   export CHILDREN=4
   for USER in $MIDUSERS
   do
       /usr/bin/env - /usr/bin/spawn-fcgi -u $USER -C $CHILDREN -s /var/run/$USER.fcgi.sock -- $PHP_CGI
       chgrp www-data /var/run/$USER.fcgi.sock
       chmod 660 /var/run/$USER.fcgi.sock
   done
}

starttin () {
   echo -n "Starting Tiny PHP FastCGI Processes: \n"
   export CHILDREN=2
   for USER in $TINUSERS
   do
       /usr/bin/env - /usr/bin/spawn-fcgi -u $USER -C $CHILDREN -s /var/run/$USER.fcgi.sock -- $PHP_CGI
       chgrp www-data /var/run/$USER.fcgi.sock
       chmod 660 /var/run/$USER.fcgi.sock
   done
}

stopbig () {
   echo -n "Stopping Large PHP FastCGI Processes: \n"
   for USER in $BIGUSERS
   do
       /usr/bin/killall -u $USER -v -w -- $KPHP
   done
}

stopmid () {
   echo -n "Stopping Midsized PHP FastCGI Processes: \n"
   for USER in $MIDUSERS
   do
       /usr/bin/killall -u $USER -v -w -- $KPHP
   done
}

stoptin () {
   echo -n "Stopping Tiny PHP FastCGI Processes: \n"
   for USER in $TINUSERS
   do
       /usr/bin/killall -u $USER -v -w -- $KPHP
   done
}

case "$1" in
   start)
     startbig
     startmid
     starttin
 ;;
   stop)
     stopbig
     stopmid
     stoptin
 ;;
   restart|reload)
     stopbig
     startbig
     stopmid
     startmid
     stoptin
     starttin
 ;;
   *)
     echo "Usage: php-fastcgi {start|stop|restart}"
     exit 1
 ;;
esac
exit 0

Debian Wheezy

Initial: Designing a Server - IPMI Installation

---

Core: Network - OpenSSH - Packages - sysctl.conf - Iptables - Security - User Management

---

Stack: Unbound - MySQL - Nginx - PHP (5.4)

---

Mail

Mail Setup - Mail Tables - OpenDKIM - Mail and DNS - Spamassassin - ClamAV - Postfix - Dovecot - Reputation Management

---

Logs and Security: Logging - Logcheck - Backups - AppArmor