View source for Web server administration



==Server Software==
This is the software I have experience in using while running a [[wpen:MediaWiki|MediaWiki]].

[[wpen:Software update|Software update]]s should always be configured to be applied automatically for security reasons.

Always use a different, large, [[Web services for server admins#Generators|generated]] password for all your accounts. Even if brute force attacks are prevented by your system, using weak passwords is just inviting trouble.

[[Instructions]] contains some links to some instructions that are potentially useful for a web server admin.

{| class="wikitable top"
!Aspect
!Software
!MediaWiki Link
!Useful Links
!Version [[wpen:Upgrade|Upgrades]]
!Notes
|-
|[[wpen:Operating system|Operating system]]
|[[wpen:Ubuntu|Ubuntu]]
|
|[[wpen:Ubuntu version history#Version timeline|Ubuntu version history]]
|should be possible by using the web interface supplied by the [[wpen:Web hosting service|Web hosting service]]
|A [[wpen:web server|web server]] should always be running a [[wpen:Linux|Linux]]-Kernel marked as LTS ([[wpen:Long-term support|Long-term support]]).
|-
|[[wpen:Web hosting control panel|Web hosting control panel]]
|[[wpen:Plesk|Plesk]]
|
|[https://docs.plesk.com/en-US/obsidian/administrator-guide/plesk-updates.59215/ Plesk Updates]
|[https://support.plesk.com/hc/en-us/articles/12377672451223-How-to-upgrade-Plesk-to-the-next-release Plesk Upgrade]; but it could be tied to the operating system by the [[wpen:Web hosting service|Web hosting service]]
|A web hosting control panel simplifies the administration of a web server. Many configurations can be changed by using the web browser interface, and it can be expanded with additional [[#Plesk Components and Extensions]].

Plesk also has the option of configuring automatic database backups; I would not recommend this, because Plesk uses the database management system too - and if the DMS does not start anymore (happened to us in 2019), the Plesk interface and thus the backups will also not be available. We currently use a [[#Backup|backup-Script]].
|-
|[[wpen:Web application firewall|Web application firewall]]
|[[wpen:ModSecurity|ModSecurity]]
|
|[https://github.com/owasp-modsecurity/ModSecurity/wiki/ documentation]
|automatically
|ModSecurity will deny certain harmful requests based on a ruleset.<br>Not to be confused with the Plesk Firewall extension.
|-
|intrusion prevention software framework
|[[wpen:Fail2ban|Fail2ban]]
|
|[https://github.com/fail2ban/fail2ban github-page]
|automatically
|Fail2Ban will block IPs from which a certain number of denied requests originate. This stops [[wpen:Brute-force attack|Brute-force attack]]s.
|-
|[[wpen:Job scheduler|Job scheduler]]
|[[wpen:Cron|Cron]]
|
|[[ubuntu:Cron|Cron]]
|automatically
|[[wpen:Systemd|Systemd]] could probably be used too.
|-
|[[wpen:Web server|Web server]]
|[[wpen:Apache HTTP Server|Apache]]
|[[med:Apache configuration|Apache configuration]]
|[https://httpd.apache.org/docs/2.4/en/ documentation]<br>[https://httpd.apache.org/docs/current/mod/mod_deflate.html mod_deflate]<br>[https://httpd.apache.org/docs/current/mod/mod_expires.html mod_expires]<br>[https://httpd.apache.org/docs/current/mod/mod_rewrite.html mod_rewrite]<br>[https://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html mod_fcgid]<br>[https://dominia.org/djao/limitipconn.html mod_limitipconn.c]
|automatically
|[[wpen:nginx|nginx]] could be used too.
|-
|web server scripting language
|[[wpen:PHP|PHP]]
|[[med:PHP configuration|PHP configuration]]<br>[[med:Manual:Installation_requirements#PHP|Manual:Installation_requirements#PHP]]
|[https://www.php.net/manual/en/ documentation]<br>[https://www.php.net/manual/en/function.phpinfo.php phpinfo]<br>[https://www.php.net/manual/en/install.fpm.php FastCGI Process Manager (FPM)]<br>[https://www.cyberciti.biz/faq/linux-unix-apache-increase-php-upload-limit/ PHP Increase Upload File Size Limit]
|should be possible by using the web hosting control panel
|The extension php-intl (required by MediaWiki) was not pre-installed on the server, so we added it via [[#Webserver Access|SSH]]:
<pre>
sudo apt install php php-intl php-mbstring php-apcu php-curl
</pre>
|-
|Object cache
|[https://www.php.net/manual/de/book.apcu.php APCu]
|[[med:Manual:Performance_tuning#Object_caching|Manual:Performance tuning#Object caching]]
|[https://help.creoline.com/de/doc/apcu-php-extension-fuer-plesk-php-8-SJaspnjfYG help.creoline.com]<br>[https://www.cloudservices.store/cp/index.php/knowledgebase/64/How-to-install-APCu-module-on-Plesk-server-.html cloudservices.store]
|
|APCu is a php extension which we need for the MediaWiki cache. It was not pre-installed on the server.
|-
|[[wpen:Database management system|Database management system]]
|[[wpen:MariaDB|MariaDB]]
|[[med:Manual:MariaDB|Manual:MariaDB]]
|[https://mariadb.com/kb/en/configuring-mariadb-with-option-files/ Configuring MariaDB with Option Files]<br>[https://mariadb.com/docs/server/clients-and-utilities/mariadb-client/mariadb-command-line-client#mariadb-commands mariadb commands]<br>[https://mariadb.com/docs/server/clients-and-utilities/backup-restore-and-import-clients/mariadb-dump mariadb-dump]<br>[https://stackoverflow.com/questions/10934745/restore-the-mysql-database-from-frm-files/10943833#10943833 Restore the mysql database from .frm files]
|has to be done manually via [[#Webserver Access|SSH]]:<br>[https://support.plesk.com/hc/en-us/articles/213367429-How-to-upgrade-MySQL-from-5-1-to-5-5-on-Linux Upgrade 5.1 to 5.5]<br>[https://support.plesk.com/hc/en-us/articles/213403429 Upgrade 5.5 to 5.6]
|Before upgrading, it is advisable to create [[#Backup]]s of the databases by using [https://mariadb.com/docs/server/clients-and-utilities/backup-restore-and-import-clients/mariadb-dump mariadb-dump] and by directly copying the database file:
<pre>
cp -a /var/lib/mysql /var/lib/mysql_backup
</pre>
If the upgrade does not work, it is possible to recover the databases (after reverting the upgrade):
<pre>
rm -fr /var/lib/mysql
cp -a /var/lib/mysql_backup /var/lib/mysql
</pre>
Alternatively, and probably preferable, the mariadb-dump backup could be imported into the new system by using [[wpen:phpMyAdmin|phpMyAdmin]] or by accessing mariadb via [[#Webserver Access|SSH]].
|-
|Database administration
|[[wpen:phpMyAdmin|phpMyAdmin]]
|
|[https://docs.phpmyadmin.net/en/latest/ documentation]
|automatically
|Enables the administration of databases through the web browser. It works well for small databases, but operations on large databases should be done via  [[#Webserver Access|SSH]], because of the possibility of timeouts in the web interface.
|-
|Thumbnail creation
|[[wpen:ImageMagick|ImageMagick]]<br>[[wpen:inkscape|inkscape]] (for&nbsp;[[wpen:svg|svg]])<br>poppler-utils (for&nbsp;[[wpen:pdf|pdf]])
|[[med:Manual:Image administration#ImageMagick|Manual:Image administration]]
|
|automatically
|These programs were not pre-installed on the server, so we added them via [[#Webserver Access|SSH]]:
<pre>
sudo apt -y install imagemagick inkscape poppler-utils
</pre>
|-
|Texteditor on the web server
|[[wpen:vi (text editor)|vi]]
|
|[[ubuntu:VIM|VIM]]<br>[https://www.cs.colostate.edu/helpdocs/vi.html Basic vi Commands]
|automatically
|Some configuration files can only be accessed via [[#Webserver Access|SSH]], so sometimes it is necessary to use a text editor started from the command line. Luckily, one only has to learn a few commands in order to be able to change a few lines:<br>
open file with vi: <code>vi filename</code><br>
change to edit mode: <code>i</code><br>
exit edit mode: <code><Esc></code><br>
save file: <code>:w</code><br>
exit vi: <code>:q</code><br>
exit vi without saving changes: <code>:q!</code>
|-
|[[wpen:Web analytics|Web analytics]]
|[[wpen:GoAccess|GoAccess]]
|
|[https://goaccess.io/man documentation]<br>[https://github.com/sapics/ip-location-db IP-location databases]<br>[https://curiouscoding.nl/posts/goaccess-setup/#geoip-database Setting up GeoIP]
|automatically
|Web analytics programs will analyze access log files and generate statistical reports.<br>
If you (have to) care about data privacy protection, do not use google analytics.<br>
In Plesk, GoAccess is easy to activate:
*Tools&Settings -> Plesk -> Updates -> Add/Remove Components
**Web Hosting -> GoAcess
Then, for every domain:
*Websites & Domains -> Hosting & DNS -> Hosting -> Web statistics -> GoAcess
Then define a cron-job: <code>/usr/local/psa/admin/sbin/statistics</code>

It does lack a geoIP database though, and thus will not display geo-information. Download a mmdb database and edit the conf file (find it with <code>goaccess --dcf</code>) with this line: <code>geoip-database /path/to/your/database.mmdb</code>

If this does not work (did not for me thus far), you could try using other [[#log analysis]] programs.
|}

===Plesk Extensions===

{| class="wikitable top"
!Aspect
!Extension
!Useful Links
!Notes
|-
|[[wpen:Firewall (computing)|Firewall]]
|Plesk Firewall
|[https://docs.plesk.com/en-US/obsidian/administrator-guide/plesk-administration/plesk-for-linux-the-plesk-firewall.72046/ documentation]
|The order of the firewall rules can be changed. The first fitting rule encountered in the list for a request will determine the behavior of the firewall: If a deny rule is found first, the request will be denied, and if an allow rule is found first, the request will be allowed, no matter which rules are further down the list.
|-
|System monitoring in Plesk UI
|Monitoring
|
|Shows server metrics as graphs, which is useful for finding time slots of unusual activity.
|-
|Log viewing in Plesk UI
|Log Browser
|
|Lets the user view the latest log entries of logs relevant to web server activity. Useful for inspecting incoming requests and analyzing errors.
|-
|Plesk configuration editing in Plesk UI
|Panel.ini Editor
|
|Enables the editing of the Plesk configuration in the Plesk UI.
|}

==[[wpen:List_of_HTTP_status_codes#4xx_client_error|404 errors]]==
Some clients will ask for files which do not exist on your server.

There are three cases:
#Some automated system is looking for some [[#standardized files]] which you do not provide. You could think about providing it.
#Bad actors are [[#searching for weaknesses]] in your system. Such requests are good candidates for being redirected to [[Bot-trap]] via htaccess.
#Someone follows a wrong or old link, or manually types a wrong URL into their web browser. If a wrong link originates somewhere on your own website, you could try to find and fix it.

===searching for weaknesses===
Any of the following 404 hits can be considered an attack, and the corresponding IP blocked by your system:
#With the exception of <code>.well-known</code> ([[wpen:Well-known URI|Well-known URI]]), any 404 hit of a dot file (I saw <code>.azure</code>, <code>.aws</code>, <code>.claude</code>, <code>.bashrc</code>, <code>.vscode</code> in my logs).
#With the exception of the files of your system, any <code>.php</code>, <code>.zip</code>, <code>.rar</code>, <code>.asp</code> or <code>.lua</code> file (I saw a large number of those, some of them files which are used by non-MediaWiki [[wpen:Content management system|CMSs]] for admin access).

Make sure dot files are not in your web-root if they don't have to be, and make sure the admin access to all your systems is well protected. Using a weak password, for example, is alike to begging for someone to breach your system.

===standardized files===

{| class="wikitable top"
!File
!Explanation
!Link
!Fix
|-
|<code>favicon.ico</code>
|this picture will be displayed in the web browser
|[[wpen:Favicon|Favicon]]
|use [https://favicon.io/ favicon.ico] to generate your favicon from an image file
|-
|<code>robots.txt</code>
|this file is requested by well-behaved bots to gain information about which URLs they should not request; if you want to enforce these rules, you could use [[Bot-trap]]
|[[wpen:robots.txt|robots.txt]]
|create the file with whatever rules you wish
|-
|<code>sitemap.xml</code>
|this file is intended to inform well-behaved bots about the URLs available on the website
|[[wpen:sitemap.xml|sitemap.xml]]
|use some script to create the file; in MediaWiki there is [[med:Manual:generateSitemap.php|generateSitemap.php]]
|-
|<code>age.xml</code><br><code>age-de.xml</code>
|rating file from the Commission for Youth Media Protection in Germany (KJM)
|[https://www.jugendschutzprogramm.de/en/label-generator-2/ jugendschutzprogramm.de]
|use the [https://www.jugendschutzprogramm.de/en/label-generator-iframe/ label generator] or just create an empty file with that name
|-
|<code>ads.txt</code>
|file for internet fraud prevention
|[[wpen:ads.txt|ads.txt]]
|create the file with the following content: <code>placeholder.example.com, placeholder, DIRECT, placeholder</code>, or fill it with your information
|-
|<code>ai.txt</code>
|file intended to inform AI agents about your website
|[https://aitxt.ing/ aitxt.ing] [https://arxiv.org/html/2505.07834v1 ai.txt: A Domain-Specific Language for Guiding AI Interactions with the Internet]
|create an empty file with that name, or fill it with some text describing your website and what AI agents should or should not do with it
|}

;discontinued or non-standard:
{| class="wikitable top"
!File
!Explanation
!Link
!Fix
|-
|<code>labels.rdf</code>
|discontinued rating file from the Internet Content Rating Association (ICRA) 
|[http://www.java-samples.com/showtutorial.php?tutorialid=1584 java-samples.com]
|just create an empty file with that name
|-
|<code>apple-touch-icon</code>
|apple expects websites to create a special icon, just for them
|[[med:Manual:$wgAppleTouchIcon|Manual:$wgAppleTouchIcon]]
|just copy your site logo, or create an empty file with that name
|-
|<code>trafficbasedsspsitemap.xml</code>
|bing bot expecting to find a non-standard sitemap
|[http://webmasters.stackexchange.com/questions/44257/bingbot-request-for-trafficbasedsspsitemap-xml-which-does-not-exist webmasters.stackexchange.com]
|just create an empty file with that name
|-
|<code>browserconfig.xml</code>
|file expected by the Internet explorer
|[http://msdn.microsoft.com/en-us/library/ie/dn320426%28v=vs.85%29.aspx microsoft.com]
|just create an empty file with that name
|}

==Personal Computer Software==
Software running on your own system which is helpful in administrating a web server.

===Webserver Access===

{| class="wikitable top"
!Aspect
!Software
!Useful Links
!Notes
|-
|[[wpen:File Transfer Protocol|FTP]] access
|[[wpen:FileZilla|FileZilla]]
|[[ubuntu:FileZilla|FileZilla]]<br>[https://blog.phpbb.com/2011/08/23/the-dangers-of-ascii-mode/ The dangers of ASCII mode]<br>[[wde:Benutzer:StipenTreublatt/Usability-Fails#FileZilla|Benutzer:StipenTreublatt/Usability-Fails#FileZilla]]
|Although file transfer is certainly possible through SSH, I prefer FTP for working on the web folder.<br>
'''Warning:''' Never use ASCII-mode! Make sure FileZilla is configured to use binary mode, otherwise files might be corrupted.
|-
|[[wpen:Secure Shell|SSH]] access
|[[ubuntu:SSH|SSH]] (Linux)<br>[https://www.chiark.greenend.org.uk/~sgtatham/putty/ PuTTY] (Windows)
|[https://ss64.com/bash/ Index of the Linux command line: bash + utilities]<br>[https://superuser.com/questions/44106/is-there-a-way-to-auto-login-in-putty-with-a-password Auto login in PuTTy with password]
|SSH access to a web server enables a user to run programs on the server through the [[wpen:command line|command line]]. Use with caution.
|}

===log analysis===
{| class="wikitable top"
!Software
!Useful Links
!Notes
|-
|[https://github.com/c-amie/analog-ce Analog CE]
|
|continuation of [[wpen:Analog (program)|Analog]]
|-
|[https://www.patrickfrei.ch/webalizer/ Webalizer Xtended]
|
|fork of [[wpen:Webalizer|Webalizer]]
|}

===Working with Code===
{| class="wikitable top"
!Aspect
!Software
!Useful Links
!Notes
|-
|[[wpen:Data compression|Data compression]]
|[[wpen:7-Zip|7-Zip]] (Windows)<br>[[wpen:gzip|gzip]] (Linux)
|[[ubuntu:gzip|gzip]]
|Software packages presented for download (like the MediaWiki software and it's extensions) are almost always compressed. You will need software to decompress the package before being able to use it.
|-
|[[wpen:Source code|Source code]] editing
|[[wpen:PSPad|PSPad]] (Windows)<br>[[wpen:Geany|Geany]] (Linux)<br>[[wpen:Kate (text editor)|Kate]] (Linux)
|
|In order to be able to edit source code (like the localsettings of MediaWiki) correctly, one has to use a source code editor.<br>
'''Warning:''' Never use texteditors like [[wpen:Windows Notepad|Windows Notepad]] or [[wpen:Microsoft Word|Microsoft Word]] for this, it will break your file.
|-
|[[wpen:Integrated development environment|IDE]]
|[[wpen:VSCodium|VSCodium]]
|[https://vscodium.com/ vscodium.com]
|An IDE makes bugfixing or code rewriting a lot easier. VSCodium is the "telemetry-free" (read: surveillance-free) version of [[wpen:VS Code|VS Code]].
|}