Wedge

Public area => The Pub => Off-topic => Topic started by: MultiformeIngegno on June 1st, 2012, 02:08 AM

Title: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 02:08 AM
I'm setting up a (remote) virtual server with Ubuntu Server 12.04. I installed apache2, php5, mysql, etc..
I need to host several websites on this server, that has just 1 IP. So I need to create virtual hosts. I read Apache documentation and many posts here and there..

The problem is that I get the warning "NameVirtualHost *:80 has no VirtualHosts" every time I restart Apache.

These are the files I have:

etc/apache2/apache2.conf
Code: [Select]
#
# Based upon the NCSA server configuration files originally by Rob McCool.
#
# This is the main Apache server configuration file.  It contains the
# configuration directives that give the server its instructions.
# See http://httpd.apache.org/docs/2.2/ for detailed information about
# the directives.
#
# Do NOT simply read the instructions in here without understanding
# what they do.  They're here only as hints or reminders.  If you are unsure
# consult the online docs. You have been warned. 
#
# The configuration directives are grouped into three basic sections:
#  1. Directives that control the operation of the Apache server process as a
#     whole (the 'global environment').
#  2. Directives that define the parameters of the 'main' or 'default' server,
#     which responds to requests that aren't handled by a virtual host.
#     These directives also provide default values for the settings
#     of all virtual hosts.
#  3. Settings for virtual hosts, which allow Web requests to be sent to
#     different IP addresses or hostnames and have them handled by the
#     same Apache server process.
#
# Configuration and logfile names: If the filenames you specify for many
# of the server's control files begin with "/" (or "drive:/" for Win32), the
# server will use that explicit path.  If the filenames do *not* begin
# with "/", the value of ServerRoot is prepended -- so "foo.log"
# with ServerRoot set to "/etc/apache2" will be interpreted by the
# server as "/etc/apache2/foo.log".
#

### Section 1: Global Environment
#
# The directives in this section affect the overall operation of Apache,
# such as the number of concurrent requests it can handle or where it
# can find its configuration files.
#

#
# ServerRoot: The top of the directory tree under which the server's
# configuration, error, and log files are kept.
#
# NOTE!  If you intend to place this on an NFS (or otherwise network)
# mounted filesystem then please read the LockFile documentation (available
# at <URL:http://httpd.apache.org/docs/2.2/mod/mpm_common.html#lockfile>);
# you will save yourself a lot of trouble.
#
# Do NOT add a slash at the end of the directory path.
#
#ServerRoot "/etc/apache2"

#
# The accept serialization lock file MUST BE STORED ON A LOCAL DISK.
#
LockFile ${APACHE_LOCK_DIR}/accept.lock

#
# PidFile: The file in which the server should record its process
# identification number when it starts.
# This needs to be set in /etc/apache2/envvars
#
PidFile ${APACHE_PID_FILE}

#
# Timeout: The number of seconds before receives and sends time out.
#
Timeout 300

#
# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.
#
KeepAlive On

#
# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We recommend you leave this number high, for maximum performance.
#
MaxKeepAliveRequests 100

#
# KeepAliveTimeout: Number of seconds to wait for the next request from the
# same client on the same connection.
#
KeepAliveTimeout 5

##
## Server-Pool Size Regulation (MPM specific)
##

# prefork MPM
# StartServers: number of server processes to start
# MinSpareServers: minimum number of server processes which are kept spare
# MaxSpareServers: maximum number of server processes which are kept spare
# MaxClients: maximum number of server processes allowed to start
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_prefork_module>
    StartServers          5
    MinSpareServers       5
    MaxSpareServers      10
    MaxClients          150
    MaxRequestsPerChild   0
</IfModule>

# worker MPM
# StartServers: initial number of server processes to start
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadLimit: ThreadsPerChild can be changed to this maximum value during a
#              graceful restart. ThreadLimit can only be changed by stopping
#              and starting Apache.
# ThreadsPerChild: constant number of worker threads in each server process
# MaxClients: maximum number of simultaneous client connections
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_worker_module>
    StartServers          2
    MinSpareThreads      25
    MaxSpareThreads      75
    ThreadLimit          64
    ThreadsPerChild      25
    MaxClients          150
    MaxRequestsPerChild   0
</IfModule>

# event MPM
# StartServers: initial number of server processes to start
# MinSpareThreads: minimum number of worker threads which are kept spare
# MaxSpareThreads: maximum number of worker threads which are kept spare
# ThreadsPerChild: constant number of worker threads in each server process
# MaxClients: maximum number of simultaneous client connections
# MaxRequestsPerChild: maximum number of requests a server process serves
<IfModule mpm_event_module>
    StartServers          2
    MinSpareThreads      25
    MaxSpareThreads      75
    ThreadLimit          64
    ThreadsPerChild      25
    MaxClients          150
    MaxRequestsPerChild   0
</IfModule>

# These need to be set in /etc/apache2/envvars
User ${APACHE_RUN_USER}
Group ${APACHE_RUN_GROUP}

#
# AccessFileName: The name of the file to look for in each directory
# for additional configuration directives.  See also the AllowOverride
# directive.
#

AccessFileName .htaccess

#
# The following lines prevent .htaccess and .htpasswd files from being
# viewed by Web clients.
#
<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
    Satisfy all
</Files>

#
# DefaultType is the default MIME type the server will use for a document
# if it cannot otherwise determine one, such as from filename extensions.
# If your server contains mostly text or HTML documents, "text/plain" is
# a good value.  If most of your content is binary, such as applications
# or images, you may want to use "application/octet-stream" instead to
# keep browsers from trying to display binary files as though they are
# text.
#
# It is also possible to omit any default MIME type and let the
# client's browser guess an appropriate action instead. Typically the
# browser will decide based on the file's extension then. In cases
# where no good assumption can be made, letting the default MIME type
# unset is suggested  instead of forcing the browser to accept
# incorrect  metadata.
#
DefaultType None


#
# HostnameLookups: Log the names of clients or just their IP addresses
# e.g., [url=http://www.apache.org]www.apache.org[/url] (on) or 204.62.129.132 (off).
# The default is off because it'd be overall better for the net if people
# had to knowingly turn this feature on, since enabling it means that
# each client request will result in AT LEAST one lookup request to the
# nameserver.
#
HostnameLookups Off

# ErrorLog: The location of the error log file.
# If you do not specify an ErrorLog directive within a <VirtualHost>
# container, error messages relating to that virtual host will be
# logged here.  If you *do* define an error logfile for a <VirtualHost>
# container, that host's errors will be logged there and not here.
#
ErrorLog ${APACHE_LOG_DIR}/error.log

#
# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
#
LogLevel warn

# Include module configuration:
Include mods-enabled/*.load
Include mods-enabled/*.conf

# Include all the user configurations:
Include httpd.conf

# Include ports listing
Include ports.conf

#
# The following directives define some format nicknames for use with
# a CustomLog directive (see below).
# If you are behind a reverse proxy, you might want to change %h into %{X-Forwarded-For}i
#
LogFormat "%v:%p %h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" vhost_combined
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %O" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

# Include of directories ignores editors' and dpkg's backup files,
# see README.Debian for details.

# Include generic snippets of statements
Include conf.d/

# Include the virtual host configurations:
Include sites-enabled/

ServerSignature Off
ServerTokens Prod

httpd.conf is blank

ports.conf:
Code: [Select]
# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default
# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
# README.Debian.gz

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

/etc/apache2/sites-enabled/000-default
Code: [Select]
<VirtualHost *:80>
ServerAdmin webmaster@localhost

DocumentRoot /home/www
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /home/www/>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
AllowOverride None
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn

CustomLog ${APACHE_LOG_DIR}/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

/etc/apache2/sites-available/default:
same as /etc/apache2/sites-enabled/000-default

/etc/apache2/sites-available/www.example.com:
Code: [Select]
#
#  Example.com (/etc/apache2/sites-available/www.example.com)
#
<VirtualHost *>
        ServerAdmin webmaster@example.com
        ServerName  [url=http://www.example.com]www.example.com[/url]
        ServerAlias example.com

        # Indexes + Directory Root.
        DirectoryIndex index.html
        DocumentRoot /home/www/www.example.com/htdocs/

        # CGI Directory
        ScriptAlias /cgi-bin/ /home/www/www.example.com/cgi-bin/
        <Location /cgi-bin>
                Options +ExecCGI
        </Location>


        # Logfiles
        ErrorLog  /home/www/www.example.com/logs/error.log
        CustomLog /home/www/www.example.com/logs/access.log combined
</VirtualHost>

/etc/apache2/sites-available/www.example.net:
same as example.com with dirs changed

/etc/apache2/sites-available/www.example.org:
same as example.com with dirs changed

Of course I enabled the sites with the a2ensite command.

Do you know what can cause the problem? :o
Title: Re: Help with apache2
Post by: Arantor on June 1st, 2012, 02:15 AM
Yup. All the virtual hosts are defined as being * but without any port designation, while you clearly state that Named Virtual Hosts should use *:80 in ports.conf.

(And yes, this is Apache 2, httpd.conf is deprecated in favour of apache2.conf and lots of sub configuration files)

It actually shouldn't matter, Apache is bound to port 80 through the Listen directive so it should just be a case of Apache complaining but still actually serving files correctly.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 02:25 AM
You're right! ;)
I changed all websites to *:80 and the error disappeared. :D

Now it's time to test if the virtual hosts actually work. So I have 3 available websites (let's say example.com/org/net), I just need to point their A records to the server IP? I think I need to do something with the /etc/host.conf file too.. currently it has only these lines:

Code: [Select]
# The "order" line is only used by old versions of the C library.
order hosts,bind
multi on
Title: Re: Help with apache2
Post by: Arantor on June 1st, 2012, 02:28 AM
Yup, you just point all the records at the server and let the HTTP request indicate which one it wants.

You don't need to change /etc/host.conf (I think you mean /etc/hosts), you just need to make sure whatever you're using for external DNS points to the right server, and that each of your virtual hosts has the proper ServerName defined like yours does.

What happens is that each request will come in with the Host header set as part of the request, Apache will look through all the name based virtual hosts for any server whose ServerName matches the Host header as indicated, and will work with that one if it's matched.

If no matches are found, I forget exactly what Apache does but I believe it goes to the last one defined as a fallback.


(Interesting: the link still gets processed even inside a code tag >_<)
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 02:34 AM
Seems magic! :D
So it doesn't matter the name of the "available-website", but just the one specified in "ServerName"? I could have the website named sadsadsasad.com but the ServerName set to the right domain?
ServerAlias takes care of the www and non-www version, right? :)
Title: Re: Help with apache2
Post by: Arantor on June 1st, 2012, 02:36 AM
Correct. The name in available-sites (at least that's the default Apache folder name) is only an internal name for your reference.

ServerName is the directive that tells Apache what to look for and ServerAlias is for declaring alternative variations of the same handler, exactly as you indicate - you can declare ServerName example.com and ServerAlias www.example.com(http://www.example.com) and Apache will match either to find that host. ServerName must be declared once per host, but you can have as many aliases as you want.
Title: Re: Help with apache2
Post by: PantsManUK on June 1st, 2012, 11:47 AM
A little late to the party, and a little OT. I applaud you using 12.04 (guessing this was a new VPS/VM), but as a warning to existing LTS users I wouldn't recommend upgrading to it (yet). It's very "unstable" at present; *lots* of updates... Needs a few months to settle down then it'll be good to dist-upgrade to.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 11:48 AM
Great! Everything works fine! My website loads from my virtual server! :D
Now that this new available-site works, what happens if I delete the default one? What would be displayed if I try to reach my IP?

Are there any security tecniques to adopt (apart from permissions) or configurations to make to improve security?
So far I just added these lines to apache.conf (dunno if are of any help..):
Code: [Select]
ServerSignature Off
ServerTokens Prod
Title: Re: Help with apache2
Post by: Dragooon on June 1st, 2012, 01:01 PM
There are a couple of things you can do, one is run every site in their own user/group using suPHP/PHPSuExec/PHP-FPM (one of these, fpm being recommended). Apart from that you can install php suhosin and enable open_basedir (even though this shouldn't be required if you got user/group properly configured, but never hurts). There are a few other things that I'm probably forgetting, but search around.
Title: Re: Help with apache2
Post by: Arantor on June 1st, 2012, 01:20 PM
I'll agree with FPM (especially as it means you can run nginx instead of Apache), but I can't in good conscience recommend suhosin. The number of times I've found software randomly break for no apparent reason just because of suhosin, I find it's more effort than it's worth.

Groups/users is sort of irrelevant if you have software that can update itself through the admin panel since that requires making the software writable by the web server user. (Yeah, I know that suPHP and PHPSuExec are supposed to do this but rarely seem to work properly in that respect)
Title: Re: Help with apache2
Post by: Dragooon on June 1st, 2012, 01:36 PM
I haven't really had a problem with suhosin, but to each it's own. Group/user is more for preventing a site from accessing other site (so one site's weak site weak security doesn't result in all of the sites getting hacked). Plus FPM will make the instance of apache run in that user/group so it doesn't need to be writable by nobody, but only the user of the site itself.
Title: Re: Help with apache2
Post by: Arantor on June 1st, 2012, 01:43 PM
Wait... how will FPM make Apache run in that user/group? FPM is what you use to run a pool of PHP processes that nginx can use...

(I've not used FPM with Apache. But the design of FPM is fundamentally stronger than doing it any other way because things aren't just shoved at FPM the way they are with other routes)
Title: Re: Help with apache2
Post by: Dragooon on June 1st, 2012, 01:58 PM
Slightly incorrect wording there, FPM doesn't make Apache run in that user/group but it does make apache's user/group irrelevant. From what I understand with FPM Apache/Nginx just routes the request to FPM/FCGI and then FPM processes the request. At that point Apache's user/group doesn't matter anymore since FPM/FCGI is running the PHP process, so the scripts are executed with FPM's user/group. And FPM has the ability to have different user/group for different ports/sites. Hence, once can change the user/group php runs in and prevent those files from accessing files of other user/group, just make sure you don't have everything 777.
Title: Re: Help with apache2
Post by: Arantor on June 1st, 2012, 02:00 PM
Hmm, I suppose that makes sense. Need to check on that, though, because I didn't think FPM did the whole different user thing.
Title: Re: Help with apache2
Post by: Dragooon on June 1st, 2012, 02:10 PM
Quote from Arantor on June 1st, 2012, 02:00 PM
Hmm, I suppose that makes sense. Need to check on that, though, because I didn't think FPM did the whole different user thing.
I've been using that setup as an alternative to suExec/PHPSuExec (since both haven't received any updates in years) in my new server. Plus [Unknown] recommended a nice permission setup which IMO is fairly logical and I have been using it for well almost a year. Basically, make all the web server files chown'd to site-user:site-user and make the web process run as site-user-www:site-user (user being different and group being same). Then chmod all files which are primarily read only to 640 and the folders which require write to 750/770 (don't remember properly, should be 750), and make sure that these folders cannot execute PHP scripts. That way, all the other user's are completely locked out, and at the same time you don't sacrifice complete access to the files but still lock PHP out enough to maintain control. Plus if someone gets in, they cannot modify a PHP file or run a script and hence run it securely.
Title: Re: Help with apache2
Post by: Arantor on June 1st, 2012, 02:13 PM
That's a good plan, I like that :)
Title: Re: Help with apache2
Post by: Dragooon on June 1st, 2012, 02:17 PM
Yeah it works fairly well, although it does lock Package manager and the likes out by default, but that should be the case anyway.
Title: Re: Help with apache2
Post by: Arantor on June 1st, 2012, 02:18 PM
Sadly if only people were happy with that, people love having one-click updates to things...
Title: Re: Help with apache2
Post by: Dragooon on June 1st, 2012, 02:20 PM
Quote from Arantor on June 1st, 2012, 02:18 PM
Sadly if only people were happy with that, people love having one-click updates to things...
Until one day a creep comes in and bombs their forum into oblivion...:P
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 02:20 PM
I remember a topic on Mantis about Suhosin + SMF auth. Nao lost days on that..... :^^;:
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 03:11 PM
A good FTP server to install? :)
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 04:23 PM
I'm trying vsftpd
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 09:14 PM
Uhm.. I need a little help with users permissions I think.
Here's the content of the /etc/vsftpd.conf file:
Code: [Select]
# Example config file /etc/vsftpd.conf
#
# The default compiled in settings are fairly paranoid. This sample file
# loosens things up a bit, to make the ftp daemon more usable.
# Please see vsftpd.conf.5 for all compiled in defaults.
#
# READ THIS: This example file is NOT an exhaustive list of vsftpd options.
# Please read the vsftpd.conf.5 manual page to get a full idea of vsftpd's
# capabilities.
#
#
# Run standalone?  vsftpd can run either from an inetd or as a standalone
# daemon started from an initscript.
listen=YES
#
# Run standalone with IPv6?
# Like the listen parameter, except vsftpd will listen on an IPv6 socket
# instead of an IPv4 one. This parameter and the listen parameter are mutually
# exclusive.
#listen_ipv6=YES
#
# Allow anonymous FTP? (Beware - allowed by default if you comment this out).
anonymous_enable=NO
#
# Uncomment this to allow local users to log in.
local_enable=YES
#
# Uncomment this to enable any form of FTP write command.
write_enable=YES
#
# Default umask for local users is 077. You may wish to change this to 022,
# if your users expect that (022 is used by most other ftpd's)
#local_umask=022
#
# Uncomment this to allow the anonymous FTP user to upload files. This only
# has an effect if the above global write enable is activated. Also, you will
# obviously need to create a directory writable by the FTP user.
#anon_upload_enable=YES
#
# Uncomment this if you want the anonymous FTP user to be able to create
# new directories.
#anon_mkdir_write_enable=YES
#
# Activate directory messages - messages given to remote users when they
# go into a certain directory.
dirmessage_enable=YES
#
# If enabled, vsftpd will display directory listings with the time
# in  your  local  time  zone.  The default is to display GMT. The
# times returned by the MDTM FTP command are also affected by this
# option.
use_localtime=YES
#
# Activate logging of uploads/downloads.
xferlog_enable=YES
#
# Make sure PORT transfer connections originate from port 20 (ftp-data).
#connect_from_port_20=YES
#
# If you want, you can arrange for uploaded anonymous files to be owned by
# a different user. Note! Using "root" for uploaded files is not
# recommended!
#chown_uploads=YES
#chown_username=whoever
#
# You may override where the log file goes if you like. The default is shown
# below.
#xferlog_file=/var/log/vsftpd.log
#
# If you want, you can have your log file in standard ftpd xferlog format.
# Note that the default log file location is /var/log/xferlog in this case.
#xferlog_std_format=YES
#
# You may change the default value for timing out an idle session.
#idle_session_timeout=600
#
# You may change the default value for timing out a data connection.
#data_connection_timeout=120
#
# It is recommended that you define on your system a unique user which the
# ftp server can use as a totally isolated and unprivileged user.
#nopriv_user=ftpsecure
#
# Enable this and the server will recognise asynchronous ABOR requests. Not
# recommended for security (the code is non-trivial). Not enabling it,
# however, may confuse older FTP clients.
#async_abor_enable=YES
#
# By default the server will pretend to allow ASCII mode but in fact ignore
# the request. Turn on the below options to have the server actually do ASCII
# mangling on files when in ASCII mode.
# Beware that on some FTP servers, ASCII support allows a denial of service
# attack (DoS) via the command "SIZE /big/file" in ASCII mode. vsftpd
# predicted this attack and has always been safe, reporting the size of the
# raw file.
# ASCII mangling is a horrible feature of the protocol.
#ascii_upload_enable=YES
#ascii_download_enable=YES
#
# You may fully customise the login banner string:
ftpd_banner=Welcome to our FTP service.
#
# You may specify a file of disallowed anonymous e-mail addresses. Apparently
# useful for combatting certain DoS attacks.
#deny_email_enable=YES
# (default follows)
#banned_email_file=/etc/vsftpd.banned_emails
#
# You may restrict local users to their home directories.  See the FAQ for
# the possible risks in this before using chroot_local_user or
# chroot_list_enable below.
chroot_local_user=YES
#
# You may specify an explicit list of local users to chroot() to their home
# directory. If chroot_local_user is YES, then this list becomes a list of
# users to NOT chroot().
# (Warning! chroot'ing can be very dangerous. If using chroot, make sure that
# the user does not have write access to the top level directory within the
# chroot)
chroot_list_enable=YES
# (default follows)
chroot_list_file=/etc/vsftpd.chroot_list
#
# You may activate the "-R" option to the builtin ls. This is disabled by
# default to avoid remote users being able to cause excessive I/O on large
# sites. However, some broken FTP clients such as "ncftp" and "mirror" assume
# the presence of the "-R" option, so there is a strong case for enabling it.
#ls_recurse_enable=YES
#
# Customization
#
# Some of vsftpd's settings don't fit the filesystem layout by
# default.
#
# This option should be the name of a directory which is empty.  Also, the
# directory should not be writable by the ftp user. This directory is used
# as a secure chroot() jail at times vsftpd does not require filesystem
# access.
secure_chroot_dir=/var/run/vsftpd/empty
#
# This string is the name of the PAM service vsftpd will use.
pam_service_name=vsftpd
#
# This option specifies the location of the RSA certificate to use for SSL
# encrypted connections.
rsa_cert_file=/etc/ssl/private/vsftpd.pem

listen_port=21

And I have a vsftpd.chroot_list file with a list (well.. just one) of users with the perms to use ftp (as far as I understood). Just the name of the users.

To create the user whom name is in the vsftpd.chroot_list file I used the command:
useradd -d /home/www USERNAME

Then:
chown USERNAME /home/www/

and finally:
passwd USERNAME

When I try to connect via FTP using the credentials of this username I manage to connect!
The problems are:
1) I can access not only the dir /home/www/ but also parent dirs!
2) User doesn't have write perms..


EDIT: Of course I restarted the vsftpd process.
Title: Re: Help with apache2
Post by: Nao on June 1st, 2012, 09:31 PM
I don't remember that suhosin thing?

URL tags are parsed because of the Aeva rewrite I guess.
Uh... So many things to fix.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 09:33 PM
Quote from Nao on June 1st, 2012, 09:31 PM
I don't remember that suhosin thing?
http://www.simplemachines.org/community/index.php?topic=374064.0 :whistle:
Title: Re: Help with apache2
Post by: Nao on June 1st, 2012, 09:35 PM
Did you edit that post to have it crash like that? Before you fixed it...
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 09:39 PM
Quote from Nao on June 1st, 2012, 09:35 PM
Did you edit that post to have it crash like that? Before you fixed it...
Which post? The one above yours containing the link to SMF?
I first posted the link with a smiley, than edited it changing smiley. URL tags brake and I had to edit it again replacing the URL with the right one.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 1st, 2012, 09:58 PM
Ok, solved the problem of the write perms. I had to chown -R /home/www/ (all subfolders..), not just chown /home/www/ :)
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 2nd, 2012, 05:42 PM
Stupid stupid stupid question... :blush:
To make the PHP mail() function work do I need a SMTP server installed or something..? If yes can you suggest one? :)
Title: Re: Help with apache2
Post by: Dragooon on June 2nd, 2012, 05:50 PM
Quote from MultiformeIngegno on June 2nd, 2012, 05:42 PM
Stupid stupid stupid question... :blush:
To make the PHP mail() function work do I need a SMTP server installed or something..? If yes can you suggest one? :)
If you only need send and not receive, you can do a basic installation of Exim and be done in 5 minutes.
Title: Re: Help with apache2
Post by: Arantor on June 2nd, 2012, 05:59 PM
Personally I go for postfix, but yeah, same thing, if you're just after outbound email, that's the way to do it.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 2nd, 2012, 06:07 PM
I tried with sendmail but it's too complicated.. <_< <_<
I'm trying postfix now..
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 2nd, 2012, 06:37 PM
-_-

This is what I did..
sudo apt-get install postfix

This is my /etc/postfix/main.cf:
Code: [Select]
# See /usr/share/postfix/main.cf.dist for a commented, more complete version


# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no


# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=no
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# in myhostname indicate il nome del vostro server. Meglio se gli date un FQDN tipo mioserver.home.local
myhostname = tsXXX561.server.topcloud.it

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases

myorigin = /etc/mailname
mydestination =
relayhost = [smtp.gmail.com]:587
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = loopback-only
default_transport = smtp
relay_transport = smtp
inet_protocols = all

# SASL Settings
smtp_use_tls=yes
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_sasl_tls_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem

Then I created the file /etc/mailname with my hostname as content:
tsXXX561.server.topcloud.it


Then I created the file /etc/postfix/sasl_passwd:
Code: [Select]
[smtp.gmail.com]:587 gmail_username@gmail.com:gmail_password

Then sudo postmap /etc/postfix/sasl/passwd

sudo cat /etc/ssl/certs/Thawte_Premium_Server_CA.pem | sudo tee -a /etc/postfix/cacert.pem

service postfix restart

Still sends nothing...
Title: Re: Help with apache2
Post by: Nao on June 2nd, 2012, 11:38 PM
I had, for my own sanity, forgotten how fucked up server management can be...
Title: Re: Help with apache2
Post by: Dragooon on June 2nd, 2012, 11:55 PM
Quote from Nao on June 2nd, 2012, 11:38 PM
I had, for my own sanity, forgotten how fucked up server management can be...
I find those more insane who can navigate through all this without looking at documentation once.
Title: Re: Help with apache2
Post by: Nao on June 3rd, 2012, 12:03 AM
Especially if they have Suhosin installed, ahah!
Title: Re: Help with apache2
Post by: Arantor on June 3rd, 2012, 12:46 AM
I'm reasonably hardened and can reconfigure Apache for modest needs without referring to the docs, but other stuff like postfix, once I had it set up, I left it firmly alone!
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 3rd, 2012, 11:29 AM
I read a bit of documentation and I managed to setup a server (stock Ubuntu 11.10, which I upgraded to 12.04) with apache2, php5, MySQL, phpmyadmin, enable virtual servers, compile mods for apache.. in 2 days. It's pretty easy. But email servers are fu***ng complex. Sendmail is arabic, postfix is complicated (I set it up, I have no errors but I can't send mails.. I think it's a certificates issue.. gmail requires TLS..). I'm still trying with exim4 (Dragooon gave me a guide I'll try this afternoon).
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 3rd, 2012, 02:36 PM
YEAHHH!! Managed to get exim4 to work (thanks Dragooon for the link)!! :D
I'm using my FQDN.. I gave up on Gmail as a relay for now.. :P

EDIT: Maybe I found the problem with Gmail and exim4.. if it's this is a stupid stupid stupid bug. In my Gmail password I have a $ symbol. In exim 'mainlog' I found these errors:

2012-06-03 14:28:15 xxxxxxxxx == username@gmail.com R=send_via_gmail T=gmail_smtp defer (0): expansion of "my_password_with_$_char" failed in gmail_login authenticator: unknown variable name "part_of_the_password_after_$"
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 3rd, 2012, 02:45 PM
Is there a way to hide my hostname from the "Received: from" or "envelope-from", etc..?
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 3rd, 2012, 10:47 PM
Are these packages used by exim4 or I can remove 'em?
m4{u} procmail{u} sendmail-base{u} sendmail-cf{u} sensible-mda{u}
Title: Re: Help with apache2
Post by: Arantor on June 3rd, 2012, 10:49 PM
apt-get should be able to deal with that for you, apt-get clean IIRC.
Title: Re: Help with apache2
Post by: Dragooon on June 3rd, 2012, 10:50 PM
Quote from MultiformeIngegno on June 3rd, 2012, 10:47 PM
As these packages used by exim4 or I can remove 'em?
m4{u} procmail{u} sendmail-base{u} sendmail-cf{u} sensible-mda{u}
If you installed via apt-get then it'll let you know if they're required when trying to remove them.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 3rd, 2012, 11:57 PM
Thanks! :)
I noticed a "weird" behavior with CHMOD. I moved my SMF install to my VPS and to get everything to work properly I had to CHMOD 777 /cache, /attachments, /avatars, /mgal_data... Not even 775 was good! With /cache to 775 I got the error that cache folder hadn't the right permissions.. the same for the others.. it's not normal!

Maybe because owner is not root but a user I created to use for FTP?
Title: Re: Help with apache2
Post by: Arantor on June 4th, 2012, 12:09 AM
Well, that's because the owner:group of the files is totally different to the owner:group Apache is running as, so 777 is all that will work.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 4th, 2012, 12:29 AM
D'oh.. so if I understood correctly I should create a new group. Add the FTP user I created to that group and the root user too. Then I should set this group as owner of the only dirs I'd like to be accessible by the FTP user. The rest should be owned by root. Correct? :)
Title: Re: Help with apache2
Post by: Arantor on June 4th, 2012, 12:33 AM
*shrug* I have no idea what you're actually trying to achieve and from where I'm (drunkenly) sat, it looks like it's more complicated than it should be...
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 4th, 2012, 12:41 AM
eheh :lol:
All my /home/www subdirs (so also /cache, /attachments, etc) have 'root' as group and 'ftp_user' as owner (at least this is what WinSCP is telling me). I did this to be sure that the ftp user could only access /home/www and not also the other directories.

Anyway the problem is (as you said) that owner of apache is root..
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 4th, 2012, 03:49 PM
Another question ( :whistle: ): I have phpmyadmin installed. For every website I host on my VPS (thanks to virtual hosts) I noticed I can access phpmyadmin simply going to website.tld/phpmyadmin.
I'd like to avoid this.. is there a way to only have hostname/phpmyadmin accessible (and not for every website)..?
Title: Re: Help with apache2
Post by: Arantor on June 4th, 2012, 04:16 PM
How is it installed?
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 4th, 2012, 04:27 PM
Quote from Arantor on June 4th, 2012, 04:16 PM
How is it installed?
Uhm.. I think I just did apt-get install phpmyadmin.. it's in /etc/phpmyadmin
Here's apache.conf:
Code: [Select]
# phpMyAdmin default Apache configuration

Alias /phpmyadmin /usr/share/phpmyadmin

<Directory /usr/share/phpmyadmin>
Options FollowSymLinks
DirectoryIndex index.php

<IfModule mod_php5.c>
AddType application/x-httpd-php .php

php_flag magic_quotes_gpc Off
php_flag track_vars On
php_flag register_globals Off
php_admin_flag allow_url_fopen Off
php_value include_path .
php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/
</IfModule>

</Directory>

# Authorize for setup
<Directory /usr/share/phpmyadmin/setup>
    <IfModule mod_authn_file.c>
    AuthType Basic
    AuthName "phpMyAdmin Setup"
    AuthUserFile /etc/phpmyadmin/htpasswd.setup
    </IfModule>
    Require valid-user
</Directory>

# Disallow web access to directories that don't need it
<Directory /usr/share/phpmyadmin/libraries>
    Order Deny,Allow
    Deny from All
</Directory>
<Directory /usr/share/phpmyadmin/setup/lib>
    Order Deny,Allow
    Deny from All
</Directory>

Maybe changing the line Alias /phpmyadmin /usr/share/phpmyadmin ..?
Title: Re: Help with apache2
Post by: Arantor on June 4th, 2012, 04:33 PM
Yeah, that's the problem, it's being declared as an Alias, which means it's applicable to all virtual hosts. Normally for virtual hosting that's fine.

What I personally do, should I ever install pMA on a server is install it into a given folder and dump the rest of the stuff into an .htaccess file so it's contained in the one place - I don't use apt-get for that, though.

I don't know what you should do for the best, though.
Title: Re: Help with apache2
Post by: Dragooon on June 4th, 2012, 04:35 PM
Quick fix would be to move the Alias to VHost declaration.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 4th, 2012, 05:00 PM
Quote from Dragooon on June 4th, 2012, 04:35 PM
Quick fix would be to move the Alias to VHost declaration.
You mean adding the line 'Alias /phpmyadmin /usr/share/phpmyadmin' to the 'default' site and removing that line from phpmyadmin's apache.conf?
Title: Re: Help with apache2
Post by: Dragooon on June 4th, 2012, 05:38 PM
Quote from MultiformeIngegno on June 4th, 2012, 05:00 PM
Quote from Dragooon on June 4th, 2012, 04:35 PM
Quick fix would be to move the Alias to VHost declaration.
You mean adding the line 'Alias /phpmyadmin /usr/share/phpmyadmin' to the 'default' site and removing that line from phpmyadmin's apache.conf?
Yeah.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 4th, 2012, 05:40 PM
Worked! ;)
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 5th, 2012, 08:43 PM
I restarted the server and now I'm getting this mail every 10 min ~:
Subject:
Cron <smmsp@ts100561> test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp

Text:
/usr/share/sendmail/sendmail: 899: /usr/share/sendmail/sendmail: /usr/sbin/sendmail-msp: not found
Title: Re: Help with apache2
Post by: Dragooon on June 6th, 2012, 05:44 PM
In reply to your thought, using mod_php + apache2 in a low-memory situation is a very bad idea. Because on every new request apache forks a new child process and each child process with mod_php in SMF's case takes about 25-60 MB of RAM. And apache does this without any regards of how much of RAM is left. So I can hold F5 on any one of your site and crash your server without much trouble. Solution to this is using PHP-FPM which spawns semi-persistent processes and manages the low RAM scenarios much better. What PHP-FPM does is that it separates the php process into a separate entity instead if being bound into apache, so apache doesn't have to load php on every request even if it's non-php related. This itself saves RAM, plus FPM can restrict the number of open processes thus preventing RAM overflow. FCGI is an interface to use PHP-FPM with Apache2. I used this guide(http://alexcabal.com/installing-apache-mod_fastcgi-php-fpm-on-ubuntu-server-maverick/) to install FCGI + PHP-FPM on an Ubuntu 12.04 server, this should be fine.

PS : I'm fairly sure what I said here is correct, but I can be wrong. Feel free to correct me in the most humiliating way possible.

EDIT: As a matter of fact, Baidu can single handily take out a website with mod_php in a low RAM situation.
Title: Re: Help with apache2
Post by: ziycon on June 6th, 2012, 05:45 PM
Quote from MultiformeIngegno on June 5th, 2012, 08:43 PM
I restarted the server and now I'm getting this mail every 10 min ~:
Subject:
Cron <smmsp@ts100561> test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp

Text:
/usr/share/sendmail/sendmail: 899: /usr/share/sendmail/sendmail: /usr/sbin/sendmail-msp: not found
I've experienced a similar issue before with POSTFIX. It turned out that apt did not remove the old sendmail files (just the sendmail-bin). To fix this I did the below:
Code: [Select]
sudo apt-get --purge remove sendmail-base sendmail-cf sendmail-doc

This removed any leftover files form the old sendmail install (including /etc/cron.d/sendmail which causes this error message).
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 6th, 2012, 09:17 PM
Quote from Dragooon on June 6th, 2012, 05:44 PM
I used this guide(http://alexcabal.com/installing-apache-mod_fastcgi-php-fpm-on-ubuntu-server-maverick/) to install FCGI + PHP-FPM on an Ubuntu 12.04 server, this should be fine.
Uhm, I think I'm doing something wrong with the latest thing (adding the lines to your virtualhost section)..
I'm trying with the website heystella.it (located in /home/www/heystella.it/htdocs), here's my site Vhost with the lines added:

Code: [Select]
<VirtualHost *:80>
        ServerAdmin xxxx@xxx.com
        ServerName  heystella.it
        ServerAlias [url=http://www.heystella.it][url=http://www.heystella.it]www.heystella.it[/url][/url]

        # Indexes + Directory Root.
        DirectoryIndex index.html index.cgi index.pl index.php index.xhtml
        DocumentRoot /home/www/heystella.it/htdocs/

        # CGI Directory
        ScriptAlias /cgi-bin/ /home/www/heystella.it/cgi-bin/
        <Location /cgi-bin>
                Options +ExecCGI
        </Location>


        # Logfiles
        ErrorLog  /home/www/heystella.it/logs/error.log
        CustomLog /home/www/heystella.it/logs/access.log combined

        FastCgiExternalServer /home/www/php5.external -host 127.0.0.1:9000
        AddHandler php5-fcgi .php
        Action php5-fcgi /usr/lib/cgi-bin/php5.external
        Alias /usr/lib/cgi-bin/ /home/www/
</VirtualHost>

But if I visit the website I get:

Not Found

The requested URL /usr/lib/cgi-bin/php5.external/index.php was not found on this server.


EDIT: Don't know why now it seems to work... http://heystella.it/test.php
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 6th, 2012, 09:27 PM
What if I add:
      AddHandler php5-fcgi .php
      Action php5-fcgi /usr/lib/cgi-bin/php5.external

      <Location "/usr/lib/cgi-bin/php5.external">
         Order deny,allow
         Deny from all
         Allow from env=REDIRECT_STATUS
      </Location>

to fastcgi.conf (as explained here(http://drupal.org/node/1235890#comment-5266614))?

EDIT: No, I get a 500 Server error..
Title: Re: Help with apache2
Post by: Arantor on June 6th, 2012, 09:36 PM
So what happens in the error log for that?
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 6th, 2012, 09:36 PM
Uhm.. now I'm getting a:
Syntax error on line 24 of /etc/apache2/sites-enabled/heystella.it:
FastCgiExternalServer: redefinition of previously defined class "/home/www/php5.external"
Action 'configtest' failed.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 6th, 2012, 09:45 PM
Here's happening something strange.. 1 website works, others don't.. if I attach:

        FastCgiExternalServer /home/www/php5.external -host 127.0.0.1:9000
        AddHandler php5-fcgi .php
        Action php5-fcgi /usr/lib/cgi-bin/php5.external
        Alias /usr/lib/cgi-bin/ /home/www/

to more than 1 site I get the error:
Syntax error on line 24 of /etc/apache2/sites-enabled/SITENAME:
FastCgiExternalServer: redefinition of previously defined class "/home/www/php5.external"
Action 'configtest' failed.

I'm thinking that this method maybe works only if you have 1 website and not multiple..
This seems to tell I'm right..:
http://redmine.froxlor.org/issues/1048

In apache log:
[Wed Jun 06 21:41:19 2012] [alert] FastCGI: read() from pipe failed (0)
[Wed Jun 06 21:41:19 2012] [alert] FastCGI: the PM is shutting down, Apache seems to have disappeared - bye
Title: Re: Help with apache2
Post by: Arantor on June 6th, 2012, 09:54 PM
Those aren't per-host declarations, they're for the entire server. You don't declare .php files for each virtual host, for example.

Add it to the main httpd.conf or similar.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 6th, 2012, 10:01 PM
Quote from Arantor on June 6th, 2012, 09:54 PM
Those aren't per-host declarations, they're for the entire server. You don't declare .php files for each virtual host, for example.

Add it to the main httpd.conf or similar.
In httpd.conf was ok!!!!! :D
http://heystella.it/test.php
Posted: June 6th, 2012, 09:56 PM

Does the use of sockets instead of TCP/IP connections help? :)
Title: Re: Help with apache2
Post by: Arantor on June 6th, 2012, 10:14 PM
Yes, using sockets should be slightly faster than TCP/IP.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 6th, 2012, 10:20 PM
Ok, I pointed my websites back to my VPS.. Let's see if now it handles RAM better. :)
Posted: June 6th, 2012, 10:18 PM

After a few minutes...

(http://img233.imageshack.us/img233/8227/ramhandle.png)
Title: Re: Help with apache2
Post by: Arantor on June 6th, 2012, 10:26 PM
That seems reasonable at the moment, there's a healthy amount of cache.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 7th, 2012, 12:02 AM
Uhm... it's finishing.. :(

(http://img163.imageshack.us/img163/4907/ramtopserver.png)
Title: Re: Help with apache2
Post by: Arantor on June 7th, 2012, 12:30 AM
You must have a lot of traffic on your server?
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 7th, 2012, 12:40 AM
Quote from Arantor on June 7th, 2012, 12:30 AM
You must have a lot of traffic on your server?
Uhm.. I don't know.. I'm hosting these websites (data are for the last 7 days, anyway they're on the VPS from 2 days with interruptions caused by server "collapsing" :P):

piloalbertelli.it:
49,649 total requests - 2.5 GB total bandwidth - 1,555 Unique visitors - 7,928 Page views

compagniaoltreconfine.com:
1,256 total requests - 16.7 MB total bandwidth - 29 Unique visitors - 205 Page views

danielamandolini.it:
2,746 total requests - 8.3 MB total bandwidth - 19   Unique visitors - 281 Page views

heystella.it:
4,973 total requests - 100.3 MB total bandwidth - 163 Unique visitors - 377 Page views

lorenzoraffio.com:
7,573 total requests - 34.9 MB total bandwidth - 454 Unique visitors - 1,566 Page views

multiformeingegno.it:
40,954 total requests - 677.3 MB total bandwidth - 2,070 Unique visitors - 8,311 Page views

rockciclopedia.com:
175,211 total requests - 2.0 GB total bandwidth - 4,591 Unique visitors - 34,670 Page views

studioassociatogema.it:
57 total requests - 750.0 KB total bandwidth - 4 Unique visitors - 8 Page views

As you can see there are 3 or 4 websites with "important" load but the others are semi-insignificant..
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 7th, 2012, 05:00 PM
Quote from ziycon on June 6th, 2012, 05:45 PM
Quote from MultiformeIngegno on June 5th, 2012, 08:43 PM
I restarted the server and now I'm getting this mail every 10 min ~:
Subject:
Cron <smmsp@ts100561> test -x /etc/init.d/sendmail && /usr/share/sendmail/sendmail cron-msp

Text:
/usr/share/sendmail/sendmail: 899: /usr/share/sendmail/sendmail: /usr/sbin/sendmail-msp: not found
I've experienced a similar issue before with POSTFIX. It turned out that apt did not remove the old sendmail files (just the sendmail-bin). To fix this I did the below:
Code: [Select]
sudo apt-get --purge remove sendmail-base sendmail-cf sendmail-doc

This removed any leftover files form the old sendmail install (including /etc/cron.d/sendmail which causes this error message).
Thanks ziycon, that solved the problem. :)
Title: Re: Help with apache2
Post by: Dragooon on June 7th, 2012, 05:08 PM
Which processes are taking the max. amount of memory? Observe top for a while.
Title: Re: Help with apache2
Post by: MultiformeIngegno on June 7th, 2012, 07:52 PM
Code: [Select]
top - 19:44:28 up 1 day,  3:46,  1 user,  load average: 0.12, 0.16, 0.11
Tasks:  71 total,   1 running,  70 sleeping,   0 stopped,   0 zombie
Cpu(s):  1.6%us,  0.2%sy,  0.0%ni, 96.1%id,  2.0%wa,  0.0%hi,  0.0%si,  0.1%st
Mem:    502992k total,   353164k used,   149828k free,     1548k buffers
Swap:  1048572k total,   120556k used,   928016k free,    38220k cached

  PID USER      PR  NI  VIRT  RES  SHR S %CPU %MEM    TIME+  COMMAND                                                                                                   
11125 root      20   0 17336 1176  892 R  2.0  0.2   0:00.01 top                                                                                                       
    1 root      20   0 24316    0    0 S  0.0  0.0   0:00.40 init                                                                                                       
    2 root      20   0     0    0    0 S  0.0  0.0   0:00.00 kthreadd                                                                                                   
    3 root      20   0     0    0    0 S  0.0  0.0   0:03.06 ksoftirqd/0                                                                                               
    4 root      20   0     0    0    0 S  0.0  0.0   0:00.00 kworker/0:0                                                                                               
    5 root      20   0     0    0    0 S  0.0  0.0   0:00.05 kworker/u:0                                                                                               
    6 root      RT   0     0    0    0 S  0.0  0.0   0:00.00 migration/0                                                                                               
    7 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 cpuset                                                                                                     
    8 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 khelper                                                                                                   
    9 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 netns                                                                                                     
   10 root      20   0     0    0    0 S  0.0  0.0   0:00.00 xenwatch                                                                                                   
   11 root      20   0     0    0    0 S  0.0  0.0   0:00.02 xenbus                                                                                                     
   12 root      20   0     0    0    0 S  0.0  0.0   0:00.23 sync_supers                                                                                               
   13 root      20   0     0    0    0 S  0.0  0.0   0:00.00 bdi-default                                                                                               
   14 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 kintegrityd                                                                                               
   15 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 kblockd                                                                                                   
   16 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 ata_sff                                                                                                   
   17 root      20   0     0    0    0 S  0.0  0.0   0:00.00 khubd                                                                                                     
   18 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 md                                                                                                         
   19 root      20   0     0    0    0 S  0.0  0.0   0:00.02 khungtaskd                                                                                                 
   20 root      20   0     0    0    0 S  0.0  0.0   0:00.00 kworker/u:1                                                                                               
   21 root      20   0     0    0    0 S  0.0  0.0   0:15.76 kworker/0:1                                                                                               
   22 root      20   0     0    0    0 S  0.0  0.0   0:17.43 kswapd0                                                                                                   
   23 root      25   5     0    0    0 S  0.0  0.0   0:00.00 ksmd                                                                                                       
   24 root      20   0     0    0    0 S  0.0  0.0   0:00.00 fsnotify_mark                                                                                             
   25 root      20   0     0    0    0 S  0.0  0.0   0:00.00 ecryptfs-kthrea                                                                                           
   26 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 crypto                                                                                                     
   34 root       0 -20     0    0    0 S  0.0  0.0   0:00.00 kthrotld                                                                                                   
   35 root      20   0     0    0    0 S  0.0  0.0   0:00.00 khvcd                                                                                                     
  159 root      20   0     0    0    0 S  0.0  0.0   0:01.78 kjournald                                                                                                 
  253 root      20   0 17224    0    0 S  0.0  0.0   0:00.05 upstart-udev-br                                                                                           
  256 root      20   0 21460   16   16 S  0.0  0.0   0:00.06 udevd                                                                                                     
  322 messageb  20   0 23808    0    0 S  0.0  0.0   0:00.02 dbus-daemon                                                                                               
  326 syslog    20   0  243m  168    0 S  0.0  0.0   0:10.09 rsyslogd                                                                                                   
  395 root      20   0 21456   16   12 S  0.0  0.0   0:00.00 udevd                                                                                                     
  419 root      20   0 23344    4    0 S  0.0  0.0   0:00.00 vsftpd                                                                                                     
  438 root      20   0 21456   16   12 S  0.0  0.0   0:00.00 udevd                                                                                                     
  485 root      20   0 49948   64    0 S  0.0  0.0   0:00.41 sshd                                                                                                       
  494 root      20   0 15180    4    0 S  0.0  0.0   0:00.01 upstart-socket-                                                                                           
  541 root      20   0 14500   20   16 S  0.0  0.0   0:00.00 getty                                                                                                     
  547 root      20   0 14500   20   16 S  0.0  0.0   0:00.00 getty                                                                                                     
  555 root      20   0 14500   20   16 S  0.0  0.0   0:00.00 getty                                                                                                     
  558 root      20   0 14500   20   16 S  0.0  0.0   0:00.00 getty                                                                                                     
  564 root      20   0 14500   20   16 S  0.0  0.0   0:00.00 getty                                                                                                     
  571 root      20   0  4352    4    0 S  0.0  0.0   0:00.00 acpid                                                                                                     
  572 root      20   0 19104  248  156 S  0.0  0.0   0:00.35 cron                                                                                                       
  573 daemon    20   0 16900    0    0 S  0.0  0.0   0:00.00 atd                                                                                                       
  612 mysql     20   0  850m  50m 2752 S  0.0 10.4   2:08.66 mysqld                                                                                                     
  873 Debian-e  20   0 45372   68    0 S  0.0  0.0   0:00.06 exim4                                                                                                     
 1010 root      20   0     0    0    0 S  0.0  0.0   0:01.30 flush-202:0                                                                                               
 1504 root      20   0 12744   16   12 S  0.0  0.0   0:00.00 getty                                                                                                     
 1506 root      20   0 14500   20   16 S  0.0  0.0   0:00.00 getty                                                                                                     
 7577 root      20   0 98812  760  100 S  0.0  0.2   0:04.24 apache2                                                                                                   
 7581 www-data  20   0 98048  568    8 S  0.0  0.1   0:00.00 apache2                                                                                                   
 7582 www-data  20   0 98040  584    0 S  0.0  0.1   0:00.02 apache2                                                                                                   
 7583 www-data  20   0  830m 4896  860 S  0.0  1.0   0:09.15 apache2                                                                                                   
 7585 www-data  20   0  830m 4940  848 S  0.0  1.0   0:09.11 apache2                                                                                                   
 7892 root      20   0  240m  920  292 S  0.0  0.2   0:03.46 php5-fpm                                                                                                   
 9813 www-data  20   0  829m 4936 1008 S  0.0  1.0   0:02.79 apache2                                                                                                   
10204 root      20   0 73352  688  404 S  0.0  0.1   0:00.22 sshd                                                                                                       
10222 root      20   0 19700 1352  648 S  0.0  0.3   0:00.24 bash                                                                                                       
10236 root      20   0 73352  392  132 S  0.0  0.1   0:00.08 sshd                                                                                                       
10254 root      20   0 12904   20   16 S  0.0  0.0   0:00.02 sftp-server                                                                                               
10293 root      20   0 73352  412  184 S  0.0  0.1   0:00.06 sshd                                                                                                       
10311 root      20   0 12768   12   12 S  0.0  0.0   0:00.00 sftp-server                                                                                               
10800 www-data  20   0  294m  58m 4732 S  0.0 12.0   0:30.21 php5-fpm                                                                                                   
10804 www-data  20   0  293m  51m 4716 S  0.0 10.4   0:27.01 php5-fpm                                                                                                   
11021 www-data  20   0  271m  36m 5756 S  0.0  7.5   0:02.30 php5-fpm                                                                                                   
11041 www-data  20   0  255m  18m 4460 S  0.0  3.8   0:01.28 php5-fpm                                                                                                   
11065 www-data  20   0  263m  28m 3968 S  0.0  5.8   0:01.96 php5-fpm                                                                                                   
11082 www-data  20   0  273m  38m 4032 S  0.0  7.8   0:01.66 php5-fpm                                                                                                   

Now it seems acceptable:
(http://img225.imageshack.us/img225/4907/ramtopserver.png)