Website Hardening

Some notes that we can think of fine tuning to keep our website faster or more reliable:

1:

The availability kernel sockets:

Linux Increase Local Port Range with net.ipv4.ip_local_port_range

If your Linux server is opening lots of outgoing network connection, you need to increase local port range. By default range is small. For example squid proxy server can come under fire if it runs out of ports.

You can use sysctl command to to modify kernel parameters at runtime. The parameters available are those listed under /proc/sys/. Please note that this hack is only useful for high bandwidth, busy Linux servers or large scale grid servers.

Set new local port range:
# echo 1024 65535 > /proc/sys/net/ipv4/ip_local_port_range
Or:
$ sudo sysctl -w net.ipv4.ip_local_port_range="1024 64000"

or edit : " /etc/sysctl.conf" file:

# increase system IP port limits
net.ipv4.ip_local_port_range = 1024 65535

You must restart your network for the change to take effect.


2:

Better manage your TCP/IP resources

This hack just make the time default values for TCP/IP connection lower so that more connections can be handled by time on your TCP/IP protocol. The following will decrease the amount of time your Linux box will try take to finish closing a connection and the amount of time before it will kill a stale connection. This will also turn off some IP extensions that aren't needed. The default setup for the TCP/IP parameters we'll change under Red Hat Linux are:

    For the tcp_fin_timeout 180

    For the tcp_keepalive_time 7200

    For the tcp_window_scaling 1

    For the tcp_sack 1

    For the tcp_timestamps 1

To adjust the new TCP/IP values, type the following commands on your terminal:

 Edit the /etc/sysctl.conf file and add the following lines:
             # Decrease the time default value for tcp_fin_timeout connection
             net.ipv4.tcp_fin_timeout = 30
             # Decrease the time default value for tcp_keepalive_time connection
             net.ipv4.tcp_keepalive_time = 1800
             # Turn off the tcp_window_scaling
             net.ipv4.tcp_window_scaling = 0
             # Turn off the tcp_sack
             net.ipv4.tcp_sack = 0
             # Turn off the tcp_timestamps
             net.ipv4.tcp_timestamps = 0

You must restart your network for the change to take effect.           
            










Ref Links:

http://www.cyberciti.biz/tips/linux-increase-outgoing-network-sockets-range.html

http://www.faqs.org/docs/securing/chap6sec75.html

understanding inode

understanding inode

 The POSIX standard mandates filesystem behavior that is strongly influenced by traditional UNIX filesystems. Regular files must have the following attributes:


    The size of the file in bytes.
    Device ID (this identifies the device containing the file).
    The User ID of the file's owner.
    The Group ID of the file.
    The file mode which determines the file type and how the file's owner, its group, and others can access the file.
    Additional system and user flags to further protect the file (limit its use and modification).
    Timestamps telling when the inode itself was last modified (ctime, inode change time), the file content last modified (mtime, modification time), and last accessed (atime, access time).
    A link count telling how many hard links point to the inode.
    Pointers to the disk blocks that store the file's contents (see inode pointer structure).

The stat system call retrieves a file's inode number and some of the information in the inode.

Note: it don't carry the filename.

The stat() and lstat() functions take a filename argument. If the file name is a symbolic link, stat() returns attributes of the eventual target of the link, while lstat() returns attributes of the link itself. The fstat() function takes a file descriptor argument instead, and returns attributes of the file that it identifies.


stat MemcachedNetstatCount.py
  File: `MemcachedNetstatCount.py'
  Size: 339       Blocks: 8          IO Block: 4096   regular file
Device: 801h/2049d Inode: 590281      Links: 1
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2013-12-22 11:18:12.000000000 -0500
Modify: 2013-12-21 11:13:37.000000000 -0500
Change: 2013-12-21 11:13:37.000000000 -0500

Referred link:

http://en.wikipedia.org/wiki/Inode
http://en.wikipedia.org/wiki/Stat_%28Unix%29
http://en.wikipedia.org/wiki/System_call
   

understanding iostat

understanding iostat

 The "iostat" command shows average cpu time since the system was stared (similar to uptime0. It also creates a report of the activites of the disk sub system of the server in two parts:
( cpu utilization and device utilization. )



The CPU utilization report has four sections:

 %user: shows the percentage of cpu utilization that was taken up while executing at the user level applications.

 %nice: shows the percentages of cpu utilization that was taken up while executing at the user level with a nice priority.

 %sys: Shows the percentage of CPU utilization that was taken up while executing at the system level (kernel)

 %idel: shows the percentage of time the cpu was idle.


The Device utilization report has these sections:

 Device: The name of the block device.

 tps: The number of transfers per second (I/O requests per second) to the device. Multiple single I/O requests can be combined in a transfer request, because of transfer request can have different size.

 Blk_read/s, Blk_write/s: Blocks read and written per second indicate data read from or written to the device in seconds. Block can also have different sizes. Typical sizes are 1024, 2048 and 4096 bytes, depending on the partition size.

 # dumpe2fs -h /dev/sda1 | grep -F "Block size"

 Blk_read, Blk_wrtn: Indicates the total number of blocks read and written since the boot.


The "iostat" can use many options, the most useful one is "-x" option from the performance prespective.




#iostat -d -x sdb1

 rrpm/s, wrpm/s: The number of read/write requests merged per second that were issued to the device. Multiple single I/O requests can be mearged  in a transfer request, because a transfer request can have different size.


 r/s, w/s: The # of read/write requests that were issued to the device per seconds.

 rsec/s, wsec/s: The number of sectors read/write from the device per second.

 rkB/s, wkB/s: The number of kilobytes read/write from the device per second.

 avgrq-sz: The average size of the requests that were issued to the device. This value is displayed in sectors.

 avgqu-sz: The average queue leangth of the request that were issued to the device.

 await: show the percentage of cpu utilization that was used while executing at the system level (kernel)

 svctm: The average service time (In miliseconds) for I/O requests that were issued to the device.

 %utils: percentage of cpu time during which I/O requests were issued to the device (band width) utilization for the device). Device saturation occurs when this value is close to 100%

understanding vmstat

understanding vmstat

vmstat provides information about "processes", "memory", "paging", "block I/O", "traps" and "cpu" activity.

vmstat -n 2 10 [ generates vmstat 10 times with a sampling rate of two seconds. ]

process (procs):
 r: The number of processes waiting for runtime.
 b: The number of processes in uninterpretable sleep.

Memory:
 swpd: the amount of virtual memory used (KB)
 free: The amount of idle memory (KB)
 buff: the amount of memory used as buffers (KB)
 cache: The amount of memory used as cache (KB)

swap:
 si: Amount of memory swapped from the disk. (KB/s)
 so: Amount of memory swapped to the disk. (KB/s)

IO:
 bi: Blocks sent to a block device (blocks/s)
 bo: Blocks received from a block device (blocks/s)

system:
 in: The number of interrupts per seconds, including the clock.
 cs: The number of context switches per seconds.

cpu (% of total cpu time)
 us: Time spent running non-kernal code (user time, including nice time)
 sy: Time spent running kernel code  (system time)
 id: Time spent idle. (prior to linux 2.5.41, this included I/O-wait time. )
 wa: Time spent waiting for I/O. (prior to Linux 2.5.41, this appeared as zero)

some useful flags:

 -m: display the memory utilization of the kernal (slabs)
 -a: provides information about about active and inactive memory pages.
 -n: displays only one header line.
 -p: {partition} flag, vmstat also provides I/O statistics.

Understanding top

Understanding top

By default "top" displays the most cpu intensive task.
Update list in every five seconds

PID: process identification
USER: Name of the user who owns (and perhaps started) the process.
PRI: priority of the process.
NI: niceness level
SIZE: Amount of memory (code+data+stack)
RSS: Amount of physical RAM used, in kilobytes.
SHARE: Amount of memory shared with other processes, in kilobytes
STAT: state of process.
[S: sleeping, R: running, D: waiting (Mostly for IO), T: stopped(suspended), Z: Zombi(defunt)

%CPU: share of the cpu usage.
%MEM: share of physical memory.
Time: total cpu time used by the process.
command: command line used to start the task (including parameters)

Keys:

sort by: [A:age, N:pid, P:cpu usage, M:resident memory usage, T: time]
u: show only a specific user,
k: kill a task (with any signal)
r: renice a task
s: set the delay in seconds between update