<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html>
<head>
<meta name="Generator" content="Kopano WebApp v-6.0.0.57-1+2026.1">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>RE: [BlueOnyx:26060] Re: BlueOnyx Webserver Performance a.k.a. the impact of "open_basedir"</title>
</head>
<body>
<p style="font-family: arial,helvetica,sans-serif; font-size: 11pt; padding: 0; margin: 0;">Hi Michael,</p>
<p style="font-family: arial,helvetica,sans-serif; font-size: 11pt; padding: 0; margin: 0;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;"><br /></span></p>
<p style="font-family: arial,helvetica,sans-serif; font-size: 11pt; padding: 0; margin: 0;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;">thanks for looking into it. I was really suprised by your perfomance measures. But I found there is a difference in commenting out the open_basedir option and disabling it by setting it to the value "Off". When disabling the php process gets the server wide setting, which isn't off.</span></p>
<p style="font-family: arial,helvetica,sans-serif; font-size: 11pt; padding: 0; margin: 0;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;"><br /></span></p>
<p style="font-family: arial,helvetica,sans-serif; font-size: 11pt; padding: 0; margin: 0;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;">Please repeat your test with "php_admin_value[open_basedir] = Off". I am sure you will see the difference. The website I just tested (a real world wordpress with lots of content and plugins installed) just took 5 seconds before and less than 1 second after the change..</span></p>
<p style="font-family: arial,helvetica,sans-serif; font-size: 11pt; padding: 0; margin: 0;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;"><br /></span></p>
<p style="font-family: arial,helvetica,sans-serif; font-size: 11pt; padding: 0; margin: 0;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;"><br /></span></p>
<p style="font-family: arial,helvetica,sans-serif; font-size: 11pt; padding: 0; margin: 0;"><span style="font-size: 11pt; font-family: arial, helvetica, sans-serif;">Regards,<br />Tobias</span></p>
<p style="padding: 0; margin: 0; min-height: 11pt; font-family: arial,helvetica,sans-serif; font-size: 11pt;"><br /></p>
<blockquote style="border-left: 2px solid #325FBA; padding-left: 5px; margin: 0px 5px;"><span style="font-family: tahoma,arial,helvetica,sans-serif; font-size: 10pt;">-----Ursprüngliche Nachricht-----<br /><span><strong>Von:</strong> Michael Stauber <mstauber@blueonyx.it></span><br /><span><strong>Gesendet:</strong> Freitag 31. März 2023 21:43</span><br /><span><strong>An:</strong> blueonyx@mail.blueonyx.it</span><br /><span><strong>Betreff:</strong> [BlueOnyx:26060] Re: BlueOnyx Webserver Performance a.k.a. the impact of "open_basedir"</span><br /><br /></span>
<div>
<pre style="white-space: pre-wrap; word-wrap: break-word;">Hi Tobias,<br /><br />> we had some complaints lately about very poor web server performance on <br />> our BlueOnyx servers. All affected sites are cms driven, mainly <br />> Wordpress. We did a lot of tests and comparisons with other hardware and <br />> software - always looks as if the reason was within BlueOnyx itself.<br />> <br />> <br />> We now are very sure to have found the reason, why a non-blueonyx <br />> webserver is about 3 times as fast as a blueonyx one: If you disable <br />> open_basedir the problem is gone (A single request on <br />> https://server.name/wp-login.php <https://server.name/wp-login.php> is <br />> sufficient to see the difference).<br />> <br />> The problem behind that is, that the php feature "Realpath cache" is <br />> disabled when open_basedir is enabled, see:<br />> <br />> https://serverfault.com/questions/158584/php-safe-mode-open-basedir-lstat-performance-problem <https://serverfault.com/questions/158584/php-safe-mode-open-basedir-lstat-performance-problem><br />> <br />> https://bugs.php.net/bug.php?id=52312 <br />> <https://bugs.php.net/bug.php?id=52312><br /><br /><br />Ok, I just did a test on a 5211R. Two identical Vsites. Both using <br />PHP-FPM with PHP-8.2.4 from the shop. And the latest WordPress also <br />installed from the shop.<br /><br />I just finished the web based initial setup of Wordpress, so both <br />installs have the same sample configuration and identical appearance.<br /><br />One is installed as "site1", the other as "site2".<br /><br />I then edited /etc/php-fpm-8.2.d/site2.conf and commented out the ...<br /><br />php_admin_value[open_basedir] = [...]<br /><br />... line and restarted PHP-FPM:<br /><br />systemctl restart php-fpm-8.2<br /><br />I then prepared Firefox to have two tabs open with the debugging console <br />activated and the "Network Analysis" open and accessed the Worpress <br />installs. "site1" in one tab, "site2" in the other.<br /><br />Both Vsites use SSL (LE certs), so I used HTTPS for testing.<br /><br />site1: load time 2.31s on first load, 1,06s on reload<br />site2: load time 2.84s on first load, 1,17s on reload<br /><br />So the Vsite w/o open_basedir actually loaded SLOWER and reloaded SLOWER.<br /><br />I then hit reload a couple of times and the results were all over the <br />place. The best speed I could ever get on reloads for "site1" was 1,01s <br />and the best speed for reloads of "site2" I could ever get was 0,96s.<br /><br />So the best speed gain (after many retries) measured in 0,05s (five <br />miliseconds!).<br /><br />I then opened a new Firefox in private mode and tested "site1" (initial <br />load and multiple reloads) and then closed that browser, opened another <br />Firefox in private mode and repeated the same steps for "site2".<br /><br />Again the results were all over the place and I could make out no <br />discernible speed advantage of one over the other. In fact in some cases <br />both the initial load as well as the reload were faster on the Vsite <br />with open_basedir enabled and on retries the Vsite with open_basedir <br />disabled was faster.<br /><br />So if there is any speed advantage of NOT having open_basedir <br />configured, then in my experience it is so miniscule that it's almost <br />impossible to measure.<br /><br />> We are aware of that open_basedir is a security feature. But I have to <br />> open a discussion here: Is it really needed? From my understanding there <br />> should be file access rights permitting access of every website only to <br />> areas they are allowed to access and permit the others.<br /><br />Recall that we're doing shared webhosting on a BlueOnyx. So normally a <br />PHP script can access *ANYTHING* on the server that the user who runs <br />the script has read permissions for. Without the limits imposed by <br />open_basedir a malicious user could use scripts to get read access to <br />privileged information that includes some of the server configuration as <br />well as some limited information about what other Vsites are present and <br />possibly also read access to some of the data that other Vsites have <br />hosted in their webspace.<br /><br />For that reason open_basedir is really an absolute must have to isolate <br />content of Vsites against access from other Vsites.<br /><br />> Nice would be an option to disable it per site. But at least we'd need <br />> an option to disable it per server.<br /><br />That is certainly doable, but it would be a feature that only the server <br />admin can activate/deactivate on a per Vsite level.<br /><br />> Maybe it would be a good compromise to include this plugin <br />> https://github.com/Whissi/realpath_turbo <br />> <https://github.com/Whissi/realpath_turbo> to get both, performance and <br />> security as for sure this is we all want. In addition to disabling <br />> open_basedir they disable dangerous PHP functions (link,symlink)<br /><br />The last update to that code on GitHub was posted on January 4th, 2020. <br />The latest PHP versions available at that time were PHP-7.4.1 and <br />PHP-7.3.14.<br /><br />https://github.com/Whissi/realpath_turbo/blob/master/realpath_turbo.c <br />indicates that this is a Zend extension and in PHP-8.0, 8.1 and 8.2 the <br />API for Zend extensions changed drastically (yet again). So I doubt that <br />this extension will work in any modern PHP. In fact: It won't work in <br />any PHP that hasn't been EOL'ed long ago.<br /><br />It having received no updates in three years is a really bad sign. For <br />all intends and purposes it is abandonware and I wouldn't want to base <br />critical infrastructure on something that is no longer actively supported.<br /><br />Out of curiosity: What BlueOnyx version and PHP versions (also PHP <br />implementation - DSO, RUID, suPHP, FPM) are you testing this and what <br />speed improvements (if any) do you see?<br /><br />-- <br />With best regards<br /><br />Michael Stauber<br />_______________________________________________<br />Blueonyx mailing list<br />Blueonyx@mail.blueonyx.it<br />http://mail.blueonyx.it/mailman/listinfo/blueonyx<br /></pre>
</div>
</blockquote>
</body>
</html>