[WEB4LIB] Lobbying for a dedicated web server

[Michael McDonnell]

Andrew Darby wrote:

>1. do the initial setup of a LAMP (Linux/Apache/MySQL/PHP) environment,
>with the security to their liking
>  
>
The security issues with LAMP applications do not relate greatly to 
installation.  Ongoing maintenance and choice or auditing of 
applications is more important.  LAMP environments are some of the 
hardest to assure.   Mostly because of the PHP part (lots of useful but 
poorly written software exists in the PHP world).  This is generally 
true of web applications today, but PHP apps are suffering the most in 
my opinion.

>and 2. integrate this box into their backup routine (i believe they do a
>middle of the night chron job)
>  
>
This should require a one time setup and may involve a fee if the backup 
software is commercially licensed.

They might worry about how much effort would be required on their part 
should you request the restoration of files from backup.  That is an 
issue worth discussing with them.  How would it work?  Could you do it 
yourself?  What type of backup is it (only good for disaster recovery?  
good for restoring files from any given day in the last week? month? year?)

>there should be little or no overhead on their part.  By gum, it would
>be one less thing for them to worry about!
>
The security issue gives them one MORE thing to worry about.  If you 
install a PHP app and an exploitable bug is found in it your box could 
be compromised.  If your OS is not patched at least daily (or maybe even 
if it is) then any exploit against your PHP application might lead to a 
compromise of your box.  If your box is compromised it puts the entire 
network at risk.

They will want to see assurance that you have the core competencies to 
administer a Unix system to their liking.

>My recollection from a
>previous incarnation, is that Apache servers are pretty stable, and
>don't require much (if any) maintenance . . .
>  
>
True, but if this last year is anything to go by you will need to 
upgrade apache every few months to avoid denial of service bugs.

Its the PHP applications that you have to worry about.  This can be a 
problem in some cases and PHP apps may rely on other PHP apps or 
libraries.  When a bug if found in an underlying PHP library, the apps 
that depend on it may not get updated.  This has been the case with apps 
that are based on, or use, PHPNuke and similar offshoots.

I find that many PHP apps are worth using because they solve a good 
problem.  Occaisionally I disable PHP apps despite their usefulness 
because "they are all rotten inside." :-)

>And as a bonus, in the unlikely event we do something stupid and crash
>the server, the campus at large is insulated.  (We currently have full
>access to the library folder on the existing server.)
>  
>
This argument won't hold much water.  A crash is one thing, but they'll 
be worried about your server being compromised and taken over by a worm 
or a criminal.  In that case the whole network will be at risk if your 
box is compromised.

>Any thoughts, suggestions, etc.?
>  
>
Don't let the impediments disuade you, but worry over them and let that 
guide you toward good planning.

>Thanks,
>
>Andrew Darby
>
>
>
>
>
>
>  
>


-- 
Michael McDonnell, GCIA
Winterstorm Solutions, Inc.
michael at winterstorm.ca