<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>A new request with request id 8207 has been created by koha-devel-request@lists.koha-community.org. Short info on the request is : <br><br>Title : Koha-devel Digest, Vol 200, Issue 25<br>Category : <br>Description : <div>Send Koha-devel mailing list submissions to<br> koha-devel@lists.koha-community.org<br><br>To subscribe or unsubscribe via the World Wide Web, visit<br> https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel<br>or, via email, send a message with subject or body 'help' to<br> koha-devel-request@lists.koha-community.org<br><br>You can reach the person managing the list at<br> koha-devel-owner@lists.koha-community.org<br><br>When replying, please edit your Subject line so it is more specific<br>than "Re: Contents of Koha-devel digest..."<br><br><br>Today's Topics:<br><br> 1. Thoughts on retiring libapache2-mpm-itk?<br> (dcook@prosentient.com.au)<br> 2. Re: Thoughts on retiring libapache2-mpm-itk? (Chris Cormack)<br> 3. Re: Thoughts on retiring libapache2-mpm-itk?<br> (dcook@prosentient.com.au)<br> 4. Re: Thoughts on retiring libapache2-mpm-itk?<br> (dcook@prosentient.com.au)<br><br><br>----------------------------------------------------------------------<br><br>Message: 1<br>Date: Tue, 26 Jul 2022 12:05:39 +1000<br>From: <dcook@prosentient.com.au><br>To: "'Koha Devel'" <koha-devel@lists.koha-community.org><br>Cc: "'Fridolin SOMERS'" <fridolin.somers@biblibre.com>, "'Tomas Cohen<br> Arazi'" <tomascohen@theke.io><br>Subject: [Koha-devel] Thoughts on retiring libapache2-mpm-itk?<br>Message-ID: <065001d8a094$3f1c8fb0$bd55af10$@prosentient.com.au><br>Content-Type: text/plain; charset="utf-8"<br><br>Hi all,<br><br> <br><br>I was looking at BibLibre's ERM sandbox, and I noticed that the Nginx<br>reverse proxy was using HTTP/2. It got me thinking about Apache httpd and<br>HTTP/2.<br><br> <br><br>Apparently, Apache has an optional mod_http2 module, but it is said to work<br>better with mpm_event and mpm_worker than mpm_prefork.<br><br> <br><br>But because we use mpm_itk (in order to declare "AssignUserID kohadev-koha<br>kohadev-koha" per VirtualHost) we're tied to using mpm_prefork. <br><br> <br><br>Yet. Koha mostly runs in Starman these days. We don't necessarily get that<br>much benefit from AssignUserID anymore. The main problem would be<br>permissions for the CGI scripts that we don't proxy. So maybe we wait until<br>after we're proxying everything through Apache and Apache is just a reverse<br>proxy to Starman and a static asset server. Because at that point. there's<br>no reason it couldn't just run under the "www-data" user.<br><br> <br><br>I mean we could try testing mod_http2 with mpm_prefork anyway I suppose. And<br>there's always the old "if it ain't broke, don't fix it". <br><br> <br><br>I suppose I just think it's funny that HTTP/3 exists (although it's not<br>widely supported on FOSS servers yet) but we haven't even moved from<br>HTTP/1.1 to HTTP/2. <br><br> <br><br>Frido, curious if you have any comments on HTTP/2 since I'm guessing you set<br>up that Nginx reverse proxy?<br><br> <br><br>David Cook<br><br>Senior Software Engineer<br><br>Prosentient Systems<br><br>Suite 7.03<br><br>6a Glen St<br><br>Milsons Point NSW 2061<br><br>Australia<br><br> <br><br>Office: 02 9212 0899<br><br>Online: 02 8005 0595<br><br> <br><br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <http://lists.koha-community.org/pipermail/koha-devel/attachments/20220726/c6eb016d/attachment-0001.htm><br><br>------------------------------<br><br>Message: 2<br>Date: Tue, 26 Jul 2022 15:03:20 +1200<br>From: Chris Cormack <chris@bigballofwax.co.nz><br>To: dcook@prosentient.com.au<br>Cc: Koha Devel <koha-devel@lists.koha-community.org>, Tomas Cohen<br> Arazi <tomascohen@theke.io><br>Subject: Re: [Koha-devel] Thoughts on retiring libapache2-mpm-itk?<br>Message-ID:<br> <CA+95qVT7NUbmjzK2xQJk8j629P3oUJGZz_ivCOP9NdyGoz=QDA@mail.gmail.com><br>Content-Type: text/plain; charset="UTF-8"<br><br>HI David<br><br>On Tue, 26 Jul 2022 at 14:07, <dcook@prosentient.com.au> wrote:<br>><br>> Hi all,<br>><br>><br>><br>> I was looking at BibLibre’s ERM sandbox, and I noticed that the Nginx reverse proxy was using HTTP/2. It got me thinking about Apache httpd and HTTP/2.<br>><br>><br>><br>> Apparently, Apache has an optional mod_http2 module, but it is said to work better with mpm_event and mpm_worker than mpm_prefork.<br>><br>><br>><br>> But because we use mpm_itk (in order to declare “AssignUserID kohadev-koha kohadev-koha” per VirtualHost) we’re tied to using mpm_prefork.<br>><br>><br>><br>> Yet… Koha mostly runs in Starman these days. We don’t necessarily get that much benefit from AssignUserID anymore. The main problem would be permissions for the CGI scripts that we don’t proxy. So maybe we wait until after we’re proxying everything through Apache and Apache is just a reverse proxy to Starman and a static asset server. Because at that point… there’s no reason it couldn’t just run under the “www-data” user.<br>><br>><br>That's not entirely true, plack runs on a unix socket as a user, with<br>potentially multiple sites on a single server. So having only the<br>right apache sites being able to talk to the right sockets by them<br>both being the same user is a very important thing.<br><br>For example<br><br> starman worker -M FindBin --max-requests 50 --workers 2<br>--user=demo-koha --group demo-koha --pid /var/run/koha/demo/plack.pid<br>--daemonize --access-log /var/log/koha/demo/plack.log --error-log<br>/var/log/koha/demo/plack-error.log -E deployment --socket<br>/var/run/koha/demo/plack.sock /etc/koha/plack.psgi<br><br>So you need to find some way to achieve this, without mpm_itk or<br>accept the big step backwards in site segregation.<br><br>><br>> I mean we could try testing mod_http2 with mpm_prefork anyway I suppose. And there’s always the old “if it ain’t broke, don’t fix it”.<br>><br>><br>> I suppose I just think it’s funny that HTTP/3 exists (although it’s not widely supported on FOSS servers yet) but we haven’t even moved from HTTP/1.1 to HTTP/2.<br>><br>><br>><br>> Frido, curious if you have any comments on HTTP/2 since I’m guessing you set up that Nginx reverse proxy?<br>><br>Chris<br><br><br>------------------------------<br><br>Message: 3<br>Date: Tue, 26 Jul 2022 13:23:37 +1000<br>From: <dcook@prosentient.com.au><br>To: "'Chris Cormack'" <chris@bigballofwax.co.nz><br>Cc: "'Koha Devel'" <koha-devel@lists.koha-community.org>, "'Tomas<br> Cohen Arazi'" <tomascohen@theke.io><br>Subject: Re: [Koha-devel] Thoughts on retiring libapache2-mpm-itk?<br>Message-ID: <066b01d8a09f$24425200$6cc6f600$@prosentient.com.au><br>Content-Type: text/plain; charset="utf-8"<br><br>Hi Chris,<br><br>I said "the main problem" would be the CGI scripts. Not the only problem. I did think about the permissions for the Unix sockets but I disagree about "the right apache sites being able to talk to the right sockets...is a very important thing". I think having them be writable by "www-data" is an easy and reasonable thing to do, so not even really a problem. <br><br>Consider it another way. Let's say you were using TCP sockets instead of Unix sockets. They wouldn't be writeable by only a particular Apache site. They'd be writeable by anything that can make a TCP connection. I think that we're using Unix sockets for the performance improvement - not for security. <br><br>What's the perceived risk? <br><br>We're hard-coding the Unix socket locations into Apache configuration, so I only see two risks:<br><br>1) A Koha sysadmin makes a typo and sends the wrong VirtualHost to the wrong Unix socket, which is unlikely due to koha-create automation (but then input credentials won't match up with the backend database so there should be no unauthorized behaviour and worst case someone is viewing the wrong read-only site)<br><br>2) Someone hacks Apache (but then your per-Koha permissions at the Starman level will still protect instances from each other's files)<br><br>Multithreaded servers like Tomcat don't have any way of using multiple users for multiple sites. I reckon there are lots of people out in the world using mpm_event and mpm_worker as well. I'd be curious how BibLibre implement their Nginx reverse proxy too.<br><br>David Cook<br>Senior Software Engineer<br>Prosentient Systems<br>Suite 7.03<br>6a Glen St<br>Milsons Point NSW 2061<br>Australia<br><br>Office: 02 9212 0899<br>Online: 02 8005 0595<br><br>-----Original Message-----<br>From: Chris Cormack <chris@bigballofwax.co.nz> <br>Sent: Tuesday, 26 July 2022 1:03 PM<br>To: dcook@prosentient.com.au<br>Cc: Koha Devel <koha-devel@lists.koha-community.org>; Tomas Cohen Arazi <tomascohen@theke.io><br>Subject: Re: [Koha-devel] Thoughts on retiring libapache2-mpm-itk?<br><br>HI David<br><br>On Tue, 26 Jul 2022 at 14:07, <dcook@prosentient.com.au> wrote:<br>><br>> Hi all,<br>><br>><br>><br>> I was looking at BibLibre’s ERM sandbox, and I noticed that the Nginx reverse proxy was using HTTP/2. It got me thinking about Apache httpd and HTTP/2.<br>><br>><br>><br>> Apparently, Apache has an optional mod_http2 module, but it is said to work better with mpm_event and mpm_worker than mpm_prefork.<br>><br>><br>><br>> But because we use mpm_itk (in order to declare “AssignUserID kohadev-koha kohadev-koha” per VirtualHost) we’re tied to using mpm_prefork.<br>><br>><br>><br>> Yet… Koha mostly runs in Starman these days. We don’t necessarily get that much benefit from AssignUserID anymore. The main problem would be permissions for the CGI scripts that we don’t proxy. So maybe we wait until after we’re proxying everything through Apache and Apache is just a reverse proxy to Starman and a static asset server. Because at that point… there’s no reason it couldn’t just run under the “www-data” user.<br>><br>><br>That's not entirely true, plack runs on a unix socket as a user, with potentially multiple sites on a single server. So having only the right apache sites being able to talk to the right sockets by them both being the same user is a very important thing.<br><br>For example<br><br> starman worker -M FindBin --max-requests 50 --workers 2 --user=demo-koha --group demo-koha --pid /var/run/koha/demo/plack.pid --daemonize --access-log /var/log/koha/demo/plack.log --error-log /var/log/koha/demo/plack-error.log -E deployment --socket /var/run/koha/demo/plack.sock /etc/koha/plack.psgi<br><br>So you need to find some way to achieve this, without mpm_itk or accept the big step backwards in site segregation.<br><br>><br>> I mean we could try testing mod_http2 with mpm_prefork anyway I suppose. And there’s always the old “if it ain’t broke, don’t fix it”.<br>><br>><br>> I suppose I just think it’s funny that HTTP/3 exists (although it’s not widely supported on FOSS servers yet) but we haven’t even moved from HTTP/1.1 to HTTP/2.<br>><br>><br>><br>> Frido, curious if you have any comments on HTTP/2 since I’m guessing you set up that Nginx reverse proxy?<br>><br>Chris<br><br><br><br>------------------------------<br><br>Message: 4<br>Date: Tue, 26 Jul 2022 13:25:14 +1000<br>From: <dcook@prosentient.com.au><br>To: "'Tomas Cohen Arazi'" <tomascohen@theke.io>, "'Chris Cormack'"<br> <chris@bigballofwax.co.nz><br>Cc: "'Koha Devel'" <koha-devel@lists.koha-community.org><br>Subject: Re: [Koha-devel] Thoughts on retiring libapache2-mpm-itk?<br>Message-ID: <066c01d8a09f$589f2aa0$09dd7fe0$@prosentient.com.au><br>Content-Type: text/plain; charset="utf-8"<br><br>What would be insecure about making the Starman/Plack sockets writeable by www-data? It wouldn’t be any different from using TCP sockets (instead of Unix sockets) which is common or a reverse proxy. <br><br> <br><br>David Cook<br><br>Senior Software Engineer<br><br>Prosentient Systems<br><br>Suite 7.03<br><br>6a Glen St<br><br>Milsons Point NSW 2061<br><br>Australia<br><br> <br><br>Office: 02 9212 0899<br><br>Online: 02 8005 0595<br><br> <br><br>From: Tomas Cohen Arazi <tomascohen@theke.io> <br>Sent: Tuesday, 26 July 2022 1:10 PM<br>To: Chris Cormack <chris@bigballofwax.co.nz><br>Cc: David Cook <dcook@prosentient.com.au>; Koha Devel <koha-devel@lists.koha-community.org><br>Subject: Re: [Koha-devel] Thoughts on retiring libapache2-mpm-itk?<br><br> <br><br><br>> Yet… Koha mostly runs in Starman these days. We don’t necessarily get that much benefit from AssignUserID anymore. The main problem would be permissions for the CGI scripts that we don’t proxy. So maybe we wait until after we’re proxying everything through Apache and Apache is just a reverse proxy to Starman and a static asset server. Because at that point… there’s no reason it couldn’t just run under the “www-data” user.<br>><br>><br>That's not entirely true, plack runs on a unix socket as a user, with<br>potentially multiple sites on a single server. So having only the<br>right apache sites being able to talk to the right sockets by them<br>both being the same user is a very important thing.<br><br> <br><br>+1<br><br> <br><br>Being able to have a secure deployment out of the box is a thing we shouldn't loose!<br><br> <br><br>-------------- next part --------------<br>An HTML attachment was scrubbed...<br>URL: <http://lists.koha-community.org/pipermail/koha-devel/attachments/20220726/24ef32b7/attachment-0001.htm><br><br>------------------------------<br><br>Subject: Digest Footer<br><br>_______________________________________________<br>Koha-devel mailing list<br>Koha-devel@lists.koha-community.org<br>https://lists.koha-community.org/cgi-bin/mailman/listinfo/koha-devel<br>website : https://www.koha-community.org/<br>git : https://git.koha-community.org/<br>bugs : https://bugs.koha-community.org/<br><br><br>------------------------------<br><br>End of Koha-devel Digest, Vol 200, Issue 25<br>*******************************************<br></div><br><br>NOTE: You are receiving this mail because, the Requester/Technician wanted you to get notified on this request creation.<br></body></html>