Cherokee Web Server

Stefan de Konink | 1 Sep 2011 01:09

Re: File download fails with gzip compression enabled on SSL


If you want to help out it would be very helpeful to check:

will this work when you set gzip to 'no compression' (so you do apply
gzip, just don't use any compression)
if so, what is the smallest file you can make it break?

Stefan

headers

Brian Myers | 1 Sep 2011 19:19

Django and Cherokee again...

Hi all,

Italo Maia has been very helpful. The key pieces seem to be that:

1) You need to do a source build of uwsgi. I had abandoned uwsgi because the PPA is broken on Ubuntu 10.04 LTS.

And 2) you need to set the information source to "Remote Host", not "Local Interpreter", and take charge of starting and respawning the uwsgi process yourself. I've tried every permutation of "Local Interpreter" I can think of, and could never get it to work. Cherokee would not spawn the process and would not connect to a process it hadn't spawned.

Italo has a web page that outlines all of this stuff, but you have to have Google translate it (unless you read Portuguese); it's here: http://dpaste.org/nKfyU/.

Currently I'm trying to get a properly formatted version of the upstart script. With that, I'll have the correct parameters to uwsgi and be able keep it running.

It might be a good idea to translate Italo's page and add it to the Cherokee docs, or add a link to it.

Thanx again Italo and everyone else,

Brian

_______________________________________________
Cherokee mailing list
Cherokee <at> lists.octality.com
http://lists.octality.com/listinfo/cherokee

headers

Hugo Vazquez Carames | 3 Sep 2011 13:03

Common CGI Options" the "Check file" and "Rule" -> "Check local file"

Hi,

I'm wondering if in a high loaded server is better to have in "Handler" ->  
"Common CGI Options" the "Check file" enabled or not, and in "Rule" ->  
"Check local file" enabled or not...  I would like to uncheck both for  
performance reasons, but I'm not sure to if there's any impact on  
security...

Anyone can help me?

-- 
---------------------

Hugo Vázquez Caramés

"El trabajo que nunca se empieza es el que tarda más en finalizarse" (J.  
R. R. Tolkien)

"La mayoría de las personas gastan más tiempo y energías en hablar de los  
problemas que en afrontarlos" (Henry Ford)

"Lo imposible es el fantasma de los tímidos y el refugio de los cobardes"  
(N. Bonaparte)

========================================================
PENTEST Consultores
Tel: 93 3962070 / Fax: 93 3962001
e-mail: hvazquez <at> pentest.es
========================================================
  Gane credibilidad y confianza, visite http://www.pentest.es

Este e-mail es confidencial y destinado únicamente a la persona a la cual  
va dirigido. Si Ud. no es el destinatario al cual va dirigido este e-mail  
o lo recibe por error, queda advertido que cualquier uso,  
difusión,impresión o copia de este mensaje está estrictamente prohibido.  
Si lo ha recibido por error, por favor, notifíquelo al remitente del  
mensaje

This email is confidential and intended solely for the use of the  
individual to whom it is addressed. If you are not the intended  
recipient,be advised that you have received this email in error and that  
any use,dissemination, forwarding, printing or copying of this email is  
strictly prohibited. If you have received this email in error please  
notify it to sender.

headers

Alvaro Lopez Ortega | 3 Sep 2011 14:00

Re: Common CGI Options" the "Check file" and "Rule" -> "Check local file"

Hello Hugo,

2011/9/3 Hugo Vazquez Carames <hvazquez <at> pentest.es>

I'm wondering if in a high loaded server is better to have in "Handler" -> "Common CGI Options" the "Check file" enabled or not,

Well, that would have quite a big impact on what information are passed to the *CGI. The option points the server whether it's executing the content of a file (CGI, a PHP file through FastCGI) or it's just passing the requested URL to a backend server (uWSGI, SCGI, FastCGI, etc) without even checking whether the file exists. Imagine a Django/RoR app, for instance. In that case you do not want the server to check any local file, simply because they do not exist.

and in "Rule" -> "Check local file" enabled or not... I would like to uncheck both for performance reasons, but I'm not sure to if there's any impact on security...

I'm confused about this one. It depends on the rule. Most likely you want keep it enabled, but I could not tell you for sure without knowing a little more about the specific case.

Anyway, if you are worried about performance AND it's a production system you aren't developing on AND you can spend a few hundled Mb of RAM on it, I'd strongly recommend you to enable "I/O-cache". That will have a very positive impact on the overall server performance.

Cheers!

--
Greetings, alo
http://www.octality.com/

_______________________________________________
Cherokee mailing list
Cherokee <at> lists.octality.com
http://lists.octality.com/listinfo/cherokee

headers

Hugo Vazquez Carames | 3 Sep 2011 14:25

Re: Common CGI Options" the "Check file" and "Rule" -> "Check local file"

Hi Alvaro,

my "I/O cache" is enabled: I did it as soon I saw it 

My concern is about the impact on checking for the existence of a file on  
every request... that means that for every PHP request, there will be a  
disk access...?? My system has been designed to serve a minimum of 10k  
request/second serving php -actually it can support more than this-. I  
have no logs, and I have all I can running from memory/cached, etc.   
Having the "Check file" in my FastCGI handler, makes me think about  
Cherokee doing a disk access in every request...Is that right? But not  
having the "Check file" enabled, maybe would allow an attacker to pass  
requests to FastCGI of non-existent files, forcing the FastCGI to do a lot  
of disk access, and maybe, creating a denial of service condition...

So, summarizing: what could happen if i disable the "Check file" in my  
FastCGI handler working with php-cgi?

And also, what could happen if I disable the "Rule" -> "Check local file"  
in a "Extensions" rule -extensions: php,tpe-?

Kind Regards,

On Sat, 03 Sep 2011 14:00:44 +0200, Alvaro Lopez Ortega  
<alvaro <at> octality.com> wrote:

> Hello Hugo,
>
> 2011/9/3 Hugo Vazquez Carames <hvazquez <at> pentest.es>
>
>> I'm wondering if in a high loaded server is better to have in "Handler"  
>> ->
>> "Common CGI Options" the "Check file" enabled or not,
>>
>
> Well, that would have quite a big impact on what information are passed  
> to
> the *CGI. The option points the server whether it's executing the  
> content of
> a file (CGI, a PHP file through FastCGI) or it's just passing the  
> requested
> URL to a backend server (uWSGI, SCGI, FastCGI, etc) without even checking
> whether the file exists. Imagine a Django/RoR app, for instance. In that
> case you do not want the server to check any local file, simply because  
> they
> do not exist.
>
> and in "Rule" -> "Check local file" enabled or not...  I would like to
>> uncheck both for performance reasons, but I'm not sure to if there's any
>> impact on security...
>>
>
> I'm confused about this one. It depends on the rule. Most likely you want
> keep it enabled, but I could not tell you for sure without knowing a  
> little
> more about the specific case.
>
> Anyway, if you are worried about performance AND it's a production system
> you aren't developing on AND you can spend a few hundled Mb of RAM on it,
> I'd strongly recommend you to enable "I/O-cache". That will have a
> very positive impact on the overall server performance.
>
> Cheers!
>

-- 
---------------------

Hugo Vázquez Caramés

"El trabajo que nunca se empieza es el que tarda más en finalizarse" (J.  
R. R. Tolkien)

"La mayoría de las personas gastan más tiempo y energías en hablar de los  
problemas que en afrontarlos" (Henry Ford)

"Lo imposible es el fantasma de los tímidos y el refugio de los cobardes"  
(N. Bonaparte)

========================================================
PENTEST Consultores
Tel: 93 3962070 / Fax: 93 3962001
e-mail: hvazquez <at> pentest.es
========================================================
  Gane credibilidad y confianza, visite http://www.pentest.es

Este e-mail es confidencial y destinado únicamente a la persona a la cual  
va dirigido. Si Ud. no es el destinatario al cual va dirigido este e-mail  
o lo recibe por error, queda advertido que cualquier uso,  
difusión,impresión o copia de este mensaje está estrictamente prohibido.  
Si lo ha recibido por error, por favor, notifíquelo al remitente del  
mensaje

This email is confidential and intended solely for the use of the  
individual to whom it is addressed. If you are not the intended  
recipient,be advised that you have received this email in error and that  
any use,dissemination, forwarding, printing or copying of this email is  
strictly prohibited. If you have received this email in error please  
notify it to sender.

headers

Stefan de Konink | 3 Sep 2011 14:39

Re: Common CGI Options" the "Check file" and "Rule" -> "Check local file"

On Sat, 3 Sep 2011, Hugo Vazquez Carames wrote:

> My concern is about the impact on checking for the existence of a file on 
> every request... that means that for every PHP request, there will be a disk 
> access...??

No for every file every five minutes a disk access is made. I/O-cache 
caches the diskaccess (stat).

Stefan

headers

Mateusz Pawlowski | 6 Sep 2011 00:06

Re: [Discussion] The naming of Final vs Non-Final in Cherokee-Admin

On Mon, 2011-08-29 at 15:29 +0200, Alvaro Lopez Ortega wrote:

> 
> 
> We could try to try something slightly more descriptive like: "Stop on
> match" and "Continue on match".

Spot on! +2 ;)

--

-- 
Mateusz Pawlowski <js <at> yllq.net>

headers

David | 6 Sep 2011 07:29

Re: [Discussion] The naming of Final vs Non-Final in Cherokee-Admin

I think any succinct language here will likely lead to some form of ambiguity, and as previously mentioned, the only way around this is to use something lengthier. The problem with this is that you end up likely repeating yourself as terms become verbose. I think simplicity in the terms is best (eg something like Final vs Pass-Through) and have something as close as possible (because IMHO there's no one right answer).

Maybe provide something like tooltips and easily accessible documentation. I could see having the something like the current Final/Non-Final button in the left-hand listing, but also have another tab against each rule which could describe the differences.

My 2 cents worth :)

-- David

_______________________________________________
Cherokee mailing list
Cherokee <at> lists.octality.com
http://lists.octality.com/listinfo/cherokee

headers

Steffen Schneider | 7 Sep 2011 00:19

Internal redirection based on subdomain

Hey,

I'm having a tough time setting up an internal redirection based on
the subdomains:

sub.domain.com -> domain.com/sub

I've managed to set up an external redirection just fine, but that's
not excatly what I need :-/
It would be more of a "rewrite", so the browser keeps showing "sub.domain.com".

There must be a way to do this, as with any other webserver,
would somebody enlighten me on this one?

Thanks a lot!
--
Steffen
(still on 1.2.2 / Debian)

headers

Alvaro Lopez Ortega | 7 Sep 2011 07:42

Re: Internal redirection based on subdomain

Hello Steffen,

On Wed, Sep 7, 2011 at 12:19 AM, Steffen Schneider <sts <at> indoblo.com> wrote:

I'm having a tough time setting up an internal redirection based on
the subdomains:

sub.domain.com -> domain.com/sub

I've managed to set up an external redirection just fine, but that's
not excatly what I need :-/
It would be more of a "rewrite", so the browser keeps showing "sub.domain.com".

There must be a way to do this, as with any other webserver,
would somebody enlighten me on this one?

You have to use the ^-replacements. Please, this documentation page for details - specially the “Global redirections” section.

Cheers!

--
Greetings, alo
http://www.octality.com/

_______________________________________________
Cherokee mailing list
Cherokee <at> lists.octality.com
http://lists.octality.com/listinfo/cherokee

Mon	Tue	Wed	Thu	Fri	Sat	Sun

			1	2	3	4
5	6	7	8	9	10	11
12	13	14	15	16	17	18
19	20	21	22	23	24	25
26	27	28	29	30

5	May 2013
35	April 2013
3	March 2013
55	February 2013
16	January 2013
60	December 2012
22	November 2012
31	October 2012
13	September 2012
7	August 2012
8	July 2012
22	June 2012
7	May 2012
28	April 2012
23	March 2012
63	February 2012
116	January 2012
82	December 2011
71	November 2011
83	October 2011
79	September 2011
66	August 2011
50	July 2011
83	June 2011
99	May 2011
106	April 2011
112	March 2011
174	February 2011
217	January 2011
209	December 2010
137	November 2010
230	October 2010
164	September 2010
120	August 2010
89	July 2010
255	June 2010
241	May 2010
175	April 2010
120	March 2010
163	February 2010
152	January 2010
215	December 2009
173	November 2009
258	October 2009
276	September 2009
299	August 2009
176	July 2009
224	June 2009
203	May 2009
199	April 2009
140	March 2009
92	February 2009
198	January 2009
143	December 2008
222	November 2008
254	October 2008
78	September 2008
152	August 2008
57	July 2008
71	June 2008
49	May 2008
63	April 2008
83	March 2008
43	February 2008
21	January 2008
47	December 2007
12	November 2007
51	October 2007
24	September 2007
25	August 2007
47	July 2007
46	June 2007
29	May 2007
38	April 2007
9	March 2007
46	February 2007
73	January 2007
88	December 2006
33	November 2006
86	October 2006
84	September 2006
88	August 2006
64	July 2006
29	June 2006
53	May 2006
64	April 2006
92	March 2006
72	February 2006
77	January 2006