SystemD FastCGI multiple processes

Of late, many mainstream distributions have been switching to SystemD as their init system. This includes Debian (since Debian 8) and Ubuntu (since Ubuntu 15.04). In the traditional SysV init system we used to have stuff like spawn-fcgi or custom scripts for starting a FastCGI process and having the web server connect to it over Unix or TCP sockets. Such kind of usage decreased when PHP FPM was introduced since it’s safe enough to assume that 90% (probably more) of the FastCGI deployments are just launching PHP interpreters using whatever mechanism is there (spawn-fcgi or custom scripts). PHP FPM does this for you now and it’s pretty good at it.

FastCGI is just a protocol, it can be used by any application. For custom applications which do not support starting their own FastCGI processes and listening on a socket we have to use external mechanisms. SystemD has a couple of good features which can help reduce the amount of custom work needed in terms of process monitoring, socket paths, file ownership, etc.

Continue reading “SystemD FastCGI multiple processes”

Group based HTTP basic authentication using Nginx and MySQL with help of Lua

Recently I moved from Apache to Nginx on one of my servers due to increase in traffic. But I was using HTTP Basic authentication with group based authorization on Apache in this manner:

However, there’s no AuthGroupFile  in nginx. But LUA, a programming language is supported in nginx. So here’s how I used LUA and MySQL for achieving this:

Now the real magic comes in the authenticate.lua  script, I’m posting the code below which is available in Github as well:

The group authentication script looks for users and groups in a table called http_users. Since this is a script you can modify the way users are searched for in the database or change the database altogether!
The lua modules required to run this script are: resty.mysql, resty.session, resty.string and cjson. Though the passwords are stored in the database as a SHA224 hash, the comparison of the password is done by the database itself. I did not convert the password to hash before sending it to database, so you may want to review this in case you are using remote database. I’m using local database over Unix socket so it doesn’t matter much.

The table and triggers I have for the same:

The triggers are required to convert the INSERT  or UPDATE statements into SHA224. I’m using MySQL’s SET data type to ensure that the group value is fixed. The same values can be used by Nginx in $user_group  variable before specifying the access_by_lua_file  directive.

A networking insight into the past

Back in 2007-2008, when I was just starting out with Linux geekery I had an ISP connection which was working fine for almost a year. Previously I was a Windows user and the hardware I used to run Windows XP was a Pentium 3 with 384 MB RAM.

Now I don’t know whether it was the hardware or issues with Windows itself that caused me so much frustration sufficient to make me move to Linux. After switching to Linux, things had become smooth so it was probably not the hardware. Perhaps the hardware was insufficient to run XP although it was slightly better than the recommended hardware specification at that time.

So yeah, this ISP had installed a telephone wire into my house and provided me an ADSL modem. In those days, it was rather uncommon to have multiple devices at home at least in India, so they had a policy of allowing only one PC at a time to use the Internet. My networking knowledge was pretty limited at that time so I never thought about how or why it was like that.

Then dad’s workplace assigned him a laptop and that’s when there were two devices at home that required Internet. Again due to limited knowledge of networking and Linux, I got a long LAN cable so that dad’s laptop could be wired to the modem having a single Ethernet port. A couple of times this plugging/unplugging; we got tired of it and then bought an unmanaged switch. That helped solve the cabling issue, but still two computers couldn’t use the Internet at the same time. I used to log out when my dad wanted to use Internet and vice versa. The switch model worked because the modem provided by the ISP was in bridge mode as per the settings I found out by poking around.

Both the machines were Windows XP initially. Then I switched to Linux and configured a simple DHCP based Ethernet connection to use Internet and it worked fine. The wizards helped me and the authentication mechanism was to login to the ISP using a Web page you got redirected to once you opened some site after acquiring a lease. But one day, all of a sudden the Internet stopped working on my Linux box. A quick observation was that it worked fine in Windows. Numerous calls to the ISP’s call center and as usual a clueless response by them (this continues even today to some extent) but they eventually sent their technician who couldn’t solve the problem either. Then we switched ISP.

Over the seven years after this I have learned a lot of Linux and Networking and worked in real life scenarios. But today while chatting with my friend Nikhil about ISPs and their reviews, I recalled this issue and now I can make sense why it wasn’t working. Reason is simple, routers generally contain Embedded Linux. In DHCP there’s a field mentioning what OS or which client is it (like a Web browser sends user agent to every website). This cunning ISP wanted to make money by selling their own routers and charging more for allowing multiple computers to use Internet at the same time so they decided to block all Linux DHCP clients (probably excluding their own) because every Linux box is a potential NAT box! It is possible to use Windows as a NAT box as well, but then they had no choice. If they blocked windows nobody would use their services 😂😂

CloudFlare Dynamic DNS using OpenWRT

I use dynamic DNS for my home internet connection so that I can access the machines from anywhere on the internet. And I use OpenWRT on my router. Earlier I was using Namecheap for managing DNS but I switched to CloudFlare for performance and security reasons of the website.

Unfortunately CloudFlare doesn’t support updating IP via shell script — well, it sort of does but the JSON stuff gets very messy with quoting in shell scripts, so I wrote a Lua script to update my IP whenever my PPPoE connection starts up; I have dropped the script in /etc/ppp/ip-up.d  so it gets executed by pppd whenever my connection comes up. You can run this script via cron or put it /etc/hotplug  if you wish to. This script uses LuaSocket, LuaSec, JSON4Lua and libubus-lua libraries that are easily installable on an OpenWRT router with 4 MB flash memory.

Now I can have the benefits of CloudFlare without losing out on DDNS :D. Here’s the code:

Suggestions? Post in comments or fork on GitHub.

The Proxy ARP method of routing subnets to solve the docker networking problem

Recently I discovered something called Proxy ARP. I had seen this earlier in sysctl options but never understood it and why would someone need it, until one day I worked in a networking setup which used this to route traffic from the machine to the Internet. It’s an interesting technique and can solve a big problem when you want to use the currently popular tool, docker in your LAN subnet that has DHCP without having to do some other stuff like port forwarding when trying to give access to others.

Continue reading “The Proxy ARP method of routing subnets to solve the docker networking problem”