Advanced Apache: MPMs, PHP-FPM and performance
You tune Apache's process models, module management, PHP-FPM integration, reverse proxying and hardening for production load.
Level 401 · 14 lessons · 12 practice labs
Lessons
Process model
- MPMs: prefork, worker and event
- MPM tuning: worker counts and the memory budget
- Live status with mod_status
- Short task: work out and apply worker counts from the memory budget
Applications
- PHP-FPM pools and proxy_fcgi
- Per-site users and pool isolation
- mod_proxy and mod_proxy_balancer
- Short task: run two PHP apps as separate users
Security and logging
- Hiding versions, headers and unneeded modules
- An introduction to a web application firewall with ModSecurity
- Log formats and conditional logging
- Short task: audit and fix an inherited Apache server
Wrap-up
- When Apache, when Nginx, when both
- Capstone: make a busy PHP site scale on Apache
Practice labs
- Find the active MPM and process count: Determine which multi-processing module Apache runs and the current number of workers.
- Move from prefork to the event MPM: Remove the embedded PHP module, move to PHP-FPM, switch the MPM to event and verify the site works.
- Size worker limits from memory: Measure memory per worker, compute the limits from the server's memory and show it does not swap under load.
- Connect a site to a PHP-FPM pool: Connect a virtual host to PHP-FPM over a Unix socket and verify a PHP page runs.
- Give each site its own pool and user: Define pools running as separate system users for two sites and show one site cannot read the other's files.
- Combine reverse proxy and rewrite rules: Proxy the API path to a backend, redirect old URLs permanently and resolve a loop caused by rule order using the trace log.
- Turn ModSecurity on in detection-only mode: Enable the rule set in detection mode, send a test request and submit the rule ID from the audit log.
- Tune a false positive with a narrow exclusion: Find from the audit log the rule blocking a legitimate form post and write an exclusion for that path and variable only.
- Move a WAF from detection to blocking in stages: On your own lab site analyse a week of detection logs, write the exclusions, switch to blocking and test legitimate traffic is unaffected.
- Open and read the server status page safely: Open the status page to local access only and read the number of busy and idle workers.
- Switch the access log to a timed, structured format: Define a JSON log format with response time and virtual host name and find the slowest path with jq.
- Find the bottleneck of a slow Apache site: Combine the status page, the PHP-FPM slow log and access timings to prove whether slowness comes from worker exhaustion or the app, and fix it.
About this course
You tune Apache's process models, module management, PHP-FPM integration, reverse proxying and hardening for production load.
What you will learn
- Process model
- Applications
- Security and logging
- Wrap-up
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.