Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
vendors:cisco:uc:ece:chatapiserver-ubuntu [2023/04/12 16:49] – removed - external edit (Unknown date) 127.0.0.1vendors:cisco:uc:ece:chatapiserver-ubuntu [2023/04/12 16:49] (current) – ↷ Page moved and renamed from code:redis to vendors:cisco:uc:ece:chatapiserver-ubuntu gerardorourke
Line 1: Line 1:
 +====== Chat API on Ubuntu ======
 +
 +This page needs reviewing and correcting.
 +The Redhat version is valid and up to date.
 +
 +===== Redis =====
 +
 +  * https://redislabs.com/ebook/appendix-a/a-1-installation-on-debian-or-ubuntu-linux/
 +  * https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-redis-on-ubuntu-16-04
 +  * https://linuxconfig.org/how-to-start-service-on-boot-on-ubuntu-20-04
 +  * https://ubuntu.com/tutorials/install-and-configure-apache#2-installing-apache
 +
 +===== PHP =====
 +
 +  *https://computingforgeeks.com/how-to-install-php-on-ubuntu/
 +  *https://pecl.php.net/package/redis/5.1.1/windows
 +  *https://www.thegeekstuff.com/2014/02/phpredis/
 +
 +===== Redis on Ubuntu =====
 +
 +  *Install PHP Redis Module
 +<code>sudo apt install php-redis</code>
 +
 +  *Install Curl Module
 +<code>sudo apt install php-curl</code>
 +
 +  *Install XML Module
 +<code>sudo apt install php-xml</code>
 +
 +  *Apache Logging
 +<code>/var/log/apache2$</code>
 +
 +  *Enable SSL
 +  *https://techexpert.tips/apache/enable-https-apache/ 
 +  *Create CSR
 +  *https://www.digicert.com/kb/csr-ssl-installation/ubuntu-server-with-apache2-openssl.htm
 +
 +===Certs and Keys ===
 +  *Store the private key in the /etc/ssl/private folder
 +  *Store the CA Cert on the /etc/ssl/certs folder
 +  *Store the signed cert in the above folder
 +  *Update the apache site conf file 
 +
 +==== Enable CORS ====
 +
 +  <code>sudo a2enmod headers</code>
 +
 +==== Load Test =====
 +  * Apache Bench (AB) 
 +    * https://www.digitalocean.com/community/tutorials/how-to-use-apachebench-to-do-load-testing-on-an-ubuntu-13-10-vps
 +    * https://geekflare.com/web-performance-benchmark/
 +
 +
 +<code>
 +eceadmin@ubuntu100:/var/www/api$ ab -n 5000 -c 500 https://api.ubuntu100.lab1.mydomain.com/chatStatus.php?businessHoursId=5000&chatEntryId=1002
 +[1] 124932
 +eceadmin@ubuntu100:/var/www/api$ This is ApacheBench, Version 2.3 <$Revision: 1843412 $>
 +Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
 +Licensed to The Apache Software Foundation, http://www.apache.org/
 +
 +Benchmarking api.ubuntu100.lab1.mydomain.com (be patient)
 +Completed 500 requests
 +Completed 1000 requests
 +Completed 1500 requests
 +Completed 2000 requests
 +Completed 2500 requests
 +Completed 3000 requests
 +Completed 3500 requests
 +Completed 4000 requests
 +Completed 4500 requests
 +Completed 5000 requests
 +Finished 5000 requests
 +
 +
 +Server Software:        Apache/2.4.41
 +Server Hostname:        api.ubuntu100.lab1.mydomain.com
 +Server Port:            443
 +SSL/TLS Protocol:       TLSv1.2,ECDHE-RSA-AES256-GCM-SHA384,2048,256
 +Server Temp Key:        X25519 253 bits
 +TLS Server Name:        api.ubuntu100.lab1.mydomain.com
 +
 +Document Path:          /chatStatus.php?businessHoursId=5000
 +Document Length:        145 bytes
 +
 +Concurrency Level:      500
 +Time taken for tests:   10.642 seconds
 +Complete requests:      5000
 +Failed requests:        0
 +Total transferred:      1865000 bytes
 +HTML transferred:       725000 bytes
 +Requests per second:    469.84 [#/sec] (mean)
 +Time per request:       1064.188 [ms] (mean)
 +Time per request:       2.128 [ms] (mean, across all concurrent requests)
 +Transfer rate:          171.14 [Kbytes/sec] received
 +
 +Connection Times (ms)
 +              min  mean[+/-sd] median   max
 +Connect:        7  997 146.0   1021    1253
 +Processing:     0    9  10.1      6     110
 +Waiting:        0    7   7.7      4      81
 +Total:         92 1006 148.2   1028    1283
 +
 +Percentage of the requests served within a certain time (ms)
 +  50%   1028
 +  66%   1054
 +  75%   1074
 +  80%   1091
 +  90%   1140
 +  95%   1165
 +  98%   1200
 +  99%   1213
 + 100%   1283 (longest request)
 +
 +[1]+  Done                    ab -n 5000 -c 500 https://api.ubuntu100.lab1.mydomain.com/chatStatus.php?businessHoursId=5000
 +
 +</code>
 +
 +==== Example Apache Benmakr against the CCE Business Hours API ====
 +
 +The below has Verbosity set to 4 - so you can see the response for each request.
 +
 +<code>ab -v 4 -A [email protected]:Pa$$w0rd -n 1 -c 1 https://ucce-bizhours1.lab2.purplepi.ie/unifiedconfig/config/businesshour/5001/</code>
 +
 +===== Enable Root SSH ====
 +
 +  *Set root password <code>sudo passwd root</code>
 +  *Edit /etc/ssh/sshd_config
 +<code>PermitRootLogin yes</code>
 +  *restart sshd <code>systemctl restart sshd</code>
 +
 +
 +====== Installing Apache, PHP and Redis on Ubuntu ======
 +
 +The core components are:
 +  *Apache Web Server
 +  *PHP
 +  *Redis - for caching (for X seconds) the API responses 
 +
 +===== Installing Apache =====
 +
 +Reference: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/deploying_different_types_of_servers/setting-apache-http-server_deploying-different-types-of-servers
 +
 +  *Check what packages are currently installed.
 +    *<code>yum list --installed | more</code>
 +    * Install Apache - <code>yum install httpd</code>
 +    * Enable for Auto startup <code>sudo systemctl enable httpd</code>
 +    * Open Firewall on port 80 <code>firewall-cmd --permanent --add-port=80/tcp</code>
 +    * Reload Firewall <code>firewall-cmd --reload</code>
 +    * Start Apache Service <code>sudo systemctl start httpd</code>
 +  * Root Folder is located here: **/var/www/html/**
 +      * Make sure any directories you create have r and x permissions for all.
 +      * Make sure any web files you create have read permissions for all
 +  * View Log files written
 +      * <code>sudo ls -al /var/log/httpd/</code>
 +      * open access logs <code>sudo more /var/log/httpd/access_log</code>
 +      * open error logs <code>sudo more /var/log/httpd/error_log</code>
 +
 +==== Enabling HTTPS ====
 +
 +Reference1: https://www.redhat.com/sysadmin/webserver-use-https\\
 +Reference2: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/5/html/deployment_guide/s1-httpd-secure-server\\
 +
 +Redhat 8 Security guide - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/securing-services_security-hardening#securing-apache-http-servers_securing-http-servers
 +
 +//The mod_ssl configuration file is located at /etc/httpd/conf.d/ssl.conf. For this file to be loaded, and hence for mod_ssl to work, you must have the statement Include conf.d/*.conf in the /etc/httpd/conf/httpd.conf file. This statement is included by default in the default Apache HTTP Server configuration file.
 +//
 +
 +  * Install the SSL for httpd - <code>sudo yum install httpd mod_ssl</code>
 +  * Restart apache - <code>sudo systemctl restart httpd</code>
 +
 +The SSL module install will have created it own SSL Cert with just the hostname and not the FQDN.\\
 +So you will need to create your CSR (and if you want a temp Self Signed Cert).
 +The SSL Conf - **ssl.conf** file is located in **/etc/httpd/conf.d/** directory
 +You must also open the Firewall on port 443 and then reload the Firewall - as per below commands:
 + 
 +<code>
 +sudo firewall-cmd --permanent --add-port=443/tcp
 +sudo firewall-cmd --reload
 +sudo firewall-cmd --list-all
 +</code>
 +
 +=== Create a Self Signed Cert ===
 +<code>openssl req -newkey rsa:2048 -nodes -keyout /etc/pki/tls/private/httpd-tmp.key -x509 -days 30 -out /etc/pki/tls/certs/httpd-tmp.crt</code>
 +Enter the details of your Self Signed Cert - making sure to include the FQDN when asked. Then update the ssl.conf file to utilise this certificate and restart the apache server.
 +<code>
 +SSLCertificateFile /etc/pki/tls/certs/httpd-tmp.crt
 +SSLCertificateKeyFile /etc/pki/tls/private/httpd-tmp.key
 +</code>
 +
 +=== Create a CSR Certificate ===
 +Below command saves the CSR file to the /home/user1/ directory.
 +<code>sudo openssl req -newkey rsa:2048 -nodes -keyout /etc/pki/tls/private/httpd.key -out /home/user1/httpd.csr</code>
 +
 +=== Import Certifcates to Trusted Store ===
 +Copy it to the cert to **/etc/pki/ca-trust/source/anchors/** sub directory, and run the command:
 +<code>sudo update-ca-trust</code>
 +===== Install Redis =====
 +
 +  *install redis - <code>sudo yum install redis</code>
 +  *Enable auto startup - <code>sudo systemctl enable redis</code>
 +  *Start Redis - <code>sudo systemctl start redis</code>
 +  *Check Statis - <code>sudo systemctl status redis</code>
 +
 +===== Install PHP =====
 +
 +Install PHP 7.4 instead of the default PHP 7.2 - (7.2 is the default with RHE 8)
 +<code>sudo yum module reset php</code>
 +<code>sudo yum -y module enable php:7.4</code>
 +
 +  * Install PHP <code>sudo yum install php</code>
 +
 +The core PHP install also by default installed the following modules (some output removed):
 +<code>
 +Installing:
 + php                              x86_64                 7.4
 +Installing dependencies:
 + nginx-filesystem                 noarch                 1:1
 + oniguruma                        x86_64                 6.8
 + php-common                       x86_64                 7.4
 +Installing weak dependencies:
 + php-cli                          x86_64                 7.4
 + php-fpm                          x86_64                 7.4
 + php-json                         x86_64                 7.4
 + php-mbstring                     x86_64                 7.4
 + php-opcache                      x86_64                 7.4
 + php-pdo                          x86_64                 7.4
 + php-xml                          x86_64                 7.4
 +</code>
 +
 +Hence you should not need to install Curl (Common), XML or JSON modules.
 +  * Install PHP Curl Module<code>sudo yum install php-curl</code>
 +  * Install PHP XML Module<code>sudo yum install php-xml</code>
 +  * Install PHP JSON Module<code>sudo yum install php-json</code>  
 +
 +But you will need to install the Redis modules:
 +  * Install PHP REDIS Module<code>sudo yum install php-redis</code>  
 +
 +However this module was NOT available in the repository.... so an alternative approach is to download and install the module manually using the **pecl**  command line:\\
 +
 +  * Install PHP Pear - <code>sudo yum install php-pear</code>
 +  * pecl also requires the **php-devel** module - to be able to compile and install the extension - so we also need to install this@
 +    * <code>sudo install php-devel</code>
 +  * Download the redis php extension from pecl (PHP Extension Community Library - https://pecl.php.net/package/redis
 +  * Copy the extension to the machine (e.g. redis-5.3.7.tgz in this example) and then run the pecl install command as follows:
 +      * <code>sudo pecl install -O redis-5.3.7.tgz</code>
 +
 +However this pecl command didn't work - because of the following error:
 +<code>
 +shtool at '/var/tmp/redis/build/shtool' does not exist or is not executable.
 +Make sure that the file exists and is executable and then rerun this script.
 +</code>
 +
 +No exec privileges was confirmed with the following command:
 +<code>
 +[myuser@servername ~]$ mount -l | grep "/var/tmp"
 +/dev/mapper/vgsystem-lvtmp on /var/tmp type xfs (rw,nosuid,nodev,noexec,relatime,seclabel,attr2,inode64,logbufs=8,logbsize=32k,noquota)
 +</code>
 +
 +To enable exec privilegdes run the following:
 +<code>mount -o remount,exec /var/tmp/</code>
 +
 +Once finished don't forget to REMOVE exec preivildges using this command:
 +<code>mount -o remount,noexec /var/tmp/</code>
 +
 +When running the pecl command - it also failed - as **make** was not installed - so install this using
 +<code>sudo yum install make</code>\\
 +Following by <code>sudo pecl install -O redis-5.3.7.tgz</code>, which now installs successfully!
 +<code>
 +...
 +Build process completed successfully
 +Installing '/usr/lib64/php/modules/redis.so'
 +install ok: channel://pecl.php.net/redis-5.3.7
 +configuration option "php_ini" is not set to php.ini location
 +You should add "extension=redis.so" to php.ini
 +</code>
 +
 +Now revert back **exec** privileges - <code>sudo mount -o remount,noexec /var/tmp/</code> 
 +and edit the php file and restart php.\\
 +
 +However - do not configure the extension via php.ini as per above, since php also checks the following directory after the ini file.
 +**/etc/php.d** and json must be enabled BEFORE redis.
 +
 +So create a new file (chmod a+r) with a higher number than the json file, e.g. 
 +<code>sudo vi 30-redis.ini</code> - with the below as an example on how the file should look like.
 +<code>
 +; Enable redis extension module
 +extension=redis
 +</code>
 +
 +Also edit each of the other extensions in this folder and disable them if not required.
 +
 +
 +
 +
 +<code>sudo vi /etc/php.ini</code>
 +
 +Add the following lines at the end of the file - (note you need to load json BEFORE redis - as it required for redis to work
 +<code>
 +extension=json
 +extension=redis
 +</code>
 +Restart PHP <code>sudo systemctl restart php-fpm</code>
 +
 +==== SE Linux ====
 +By default SELinux does not allow Apache to make socket connections.
 +To enable socket connections - use the following command:
 +<code>sudo /usr/sbin/setsebool -P httpd_can_network_connect=1</code>
 +
 +For More information can be found [[https://fedoraproject.org/wiki/SELinux/apache|here]] and
 +[[https://access.redhat.com/documentation/en-us/reference_architectures/2017/html/configuring_a_red_hat_jboss_eap_7_cluster/creating_the_environment| here]].
 +
 +When using setsebool with the -P to make the boolean change persistent, this updates the policy\\
 +Use <code>sudo semanage boolean -l</code> to inspect the boolean
 +
 +====PHP TIPS ====
 +
 +  *Confirm no warnings or errors on php by using the following <code>php -v</code>
 +  *PHP-specific configuration for httpd - <code>/etc/httpd/conf.d/php.conf</code>
 +  *All info on PHP install - <code>php -i</code>
 +  *Location of php.ini file <code>php -i | grep "Loaded Configuration File"</code>
 +  *If you make changes to the php.ini file - you need to restart php-fpm (note - no need to restart apache) - <code>sudo systemctl restart php-fpm</code>
 +
 +===== Firewall Tips =====
 +The **firewall-cmd --list-all** command shows you all the UDP/TCP ports opened - in below example - you can see only port 80 has been opened.
 +
 +<code>
 +#sudo firewall-cmd --list-all
 +public (active)
 +  target: default
 +  icmp-block-inversion: no
 +  interfaces: eth0
 +  sources:
 +  services: cockpit dhcpv6-client ssh
 +  ports: 80/tcp
 +  protocols:
 +  forward: no
 +  masquerade: no
 +  forward-ports:
 +  source-ports:
 +  icmp-blocks:
 +  rich rules:
 +</code>
 +
 +===== Apache Tips =====
 +
 +  * Check out what Modules are installed <code>httpd -M</code>