Does anyone know a SSH/ SFTP/ FTP wrapper class around pfsockopen();?? I'm still on my quest to keep persistent connections in PHP.
After a quick read, it looks like opening a socket deals with a different layer then what you are wanting. You want to connect via SSH or SFTP, which is the Application Layer using a method that makes connections via TTP/TLS/UDP, which is the transport layer.
So really what you want (I think) is to create an SSL or TLS connection using the pfsockopen() function, and then use that connection to pass data via the SSH/SFTP protocol.
According to the PHP site:
If you have compiled in OpenSSL
support, you may prefix the hostname
with either ssl:// or tls:// to use an
SSL or TLS client connection over
TCP/IP to connect to the remote host.
So my best guess is that you set your hostname to start with ssl:// and then use the SSH or SFTP port as the port (so port 22 or port 989). Something like:
$persistent_socket = pfsockopen("ssl://myhostsite", 22);
or
$persistent_socket = pfsockopen("ssl://myhostsite", 989);
#user260294: Thank you so much for http://phpseclib.sourceforge.net/. Although unrelated to original question, it saved me hours of coding on a similar project.
#Simon: You haven't seen anyone using pfsockopen() specifically with SSH / SFTP due to the fact that it does not work for these specific protocols. The idea is that if a connection already exists you are able to reuse it with pfsockopen without resending any headers, but this is not allowed with daemons listening on port 22. You have no other choice but to reestablish the connection and resend the headers. This applies to anything that deals with SSH1/2/SFTP.
In the case of a daemon that establishes a persistent connection - when it times out you have to reconnect all over... So I don't see much of a point in doing that.
Here's an SSH / SFTP wrapper class around fsockopen():
http://phpseclib.sourceforge.net/
It's not pfsockopen() but maybe replacing the one fsockopen() call with pfsockopen() will do the trick?
wow the package at http://phpseclib.sourceforge.net/ works perfectly for sftp connection and no need to install or add modules or anything. It just works. Thanks sooo much
I Dont know of a class implementation built around that but there is an ssh2 module if that helps you...
Related
The target is simple： clients post http requests to query data and update record by some keys。 Highest request: 500/sec (the higher the better, but the best is to fulfil this requirement while making the system easy to achieve and using less mashines)
what I've done: nginx + php-cgi(using php) to serve http request, the php use thrift RPC to retrieve data from a DB proxy which is only used to query and update DB(mysql). The DB proxy uses mysql connection pool and thrift's TNonblockingServer. (In my country, there are 2 ISP, DB Proxy will be deployed in multi-isp machine and so is the db, web servers can be deployed on single-isp mashine according to the experience)
what trouble me: when I do stress test(when >500/sec), I found " TSocket: Could not connect to 172.19.122.32:9090 (Connection refused [111]" from php log. I think it may be caused by the port's running out(may be incorrect conclusion). So I design to use thrift connection bool to reduce thrift connection. But there is no connection pool in php (there seem to be some DB connection pool tech) and php does not support the feature.
So I think maybe the project is designed in the wrong way from the beginning(like use php ,thrift). Is there a good way to solve this based on what i've done? And I think most people will doubt my awkward scheme. Well, your new scheme will help a lot
thanks.
"TSocket: Could not connect to 172.19.122.32:9090 (Connection refused [111])" from php log shows the ports running out because of too many short connections in a short time. So I config the tcp TIME_WAIT status to recycle port in time using:
sysctl -w net.ipv4.tcp_timestamps=1
sysctl -w net.ipv4.tcp_tw_recycle=1
it works!
what droubles me is sloved, but to change the kernal parameter will affect the NAT. It's not a perfect solution. I think a new good design of this system can be continue to discuss.
I need to connect to a webservice which is behind of a VPN via PHP. My server is Debian Linux (Squeeze).
Is it possible to accomplish this via PHP on Linux?
Is it risky to do this if it is possible? (When VPN connection hangs etc., does the operating system or any other what-so-over handles the situation)
I have only one network card, therefore I really wonder whether it is possible to keep server online for normal users while "posting data over an accomplished VPN connection in the background".
Although my question seems to a conceptual question, any specific help is also welcome.
Server OS : Debian Linux Squeeze (x64)
Web Server : Apache HTTP
PHP Version: 5.3
Framework: Symfony 1.4
VPNs are at a network layer below PHP, PHP won't know or care that the connection is over a VPN or a normal connection. It's handled by the network stack.
If you use a permanent one (e.g. IPSEC) then PHP doesn't need to create the connection, it's just there to use when PHP connects to an IP address that is in the VPN. It is selected to use by the network layer when it does the routing, not by PHP. This is true even if you create the VPN on demand, as jderda suggested using exec() or similar. But a permanent connection is better (IPSEC).
So to answer your questions:
The question doesn't make sense, the only way PHP could do this is using PPTP or similar and exec() to bring the connection up, but better to use IPSEC
If the VPN connection hangs/dies PHP won't get a connection to the remote end and will timeout the connection.
Yes it is.
From PHP point of view, the VPN is just a plain network connection. It does not require additional handling.
If you want to dynamicaly estabilish a VPN connection, you'll probably need to use exec() and some commandline tool for estabilishing a connection. But as such connection doesn't interfere with normal network communication (as long as it's properly configured, with other subnet ip range), you should estabilish it once and keep it active for PHP and other apps to use.
I have a project to do and it goes like this:
When you open a telnet console and telnet to my server, PHP should respond with:
"Hello, What is your name?"
And you type in your name and so on. How can I do this in PHP? Is it even possible?
See http://php.net/manual/en/book.sockets.php
This is a good tutorial to get you started. http://devzone.zend.com/article/1086
And google is your friend here as well: http://www.google.ca/search?q=php+socket+server
Actual TELNET can be a little difficult to get correct; there are a lot of control sequences that are used to influence how a terminal displays its contents.
If you simply want to write a service that people can use via TELNET, then it would probably be best to use an existing TELNET server (Ubuntu has several packages available, for simple TELNET: inetutils-telnetd, telnetd; for encrypted TELNET: telnetd-ssl; for Kerberos-authenticated TELNET: heimdal-servers, krb5-telnetd.) to provide TELNET functionality, and set your PHP program as the login shell for whichever user you want everyone to log in as. (See passwd(5) for information on the login shell.)
If you want to do all the socket operations yourself, then you'll need to use the BSD sockets support; create a socket, bind a server name to the socket, listen on the socket, and when a new connection comes in, fork a new process to handle the new client, and accept the new connection.
Once you have a new process with a connected client, you can use the standard read and write operations to send and receive data to the client. If you really want to support the full TELNET specification, it'll take some clever programming. If you don't mind not having access to advanced terminal features (such as provided by readline(3), ncurses(3), or slang) then you may need to drop characters with the eighth bit turned on to get rid of the TELNET control characters from your clients. (I've not tried this, because I've always used the netcat tool when I wanted a clean unencrypted and unauthenticated connection between hosts.)
Lets say a listening socket is created in PHP, and it accepts a secure connection.
How do I know that it's encrypted and how do I decode it?
From the way your question is worded, you are a very long way from being to implement any sort of solution to the question as you've asked it. Implementing your own SSL server using PHP and off the shelf components will be virtually impossible even for a total PHP guru. I don't imagine that anyone who really understood the problem would try to solve it in this way - a far more pragmatic approach would be to set up the server to listen on two different ports (or use 2 seperate servers) use an SSL proxy (e.g. stunnel) which only accepts connections from localhost for the SSL traffic, and write your server(s) to talk non-SSL. You know its secure if the connection arrives from localhost and on the port that listens for the stunnel connection (or someone is running their own client/proxy on your server).
HTH
C.
I need to be able to encrypt the MySQL traffic from a web server to a database server. I know how to set MySQL to use SSL based on the server and client settings in my.cnf however, this needs to be done using mysql_connect() in PHP. This may be a 2 part question.
1) Does mysql_connect() use the MySQL client settings that are set in my.cnf?
If not...
I have read that you can use MYSQL_CLIENT_SSL however, where is the SSL data obtained from? Does using MYSQL_CLIENT_SSL in the mysql_connect function automagically encrypt the traffic?
Simply put, what is the best way to do this?
Thanks!
If you connect to MySQL using SSL, all your traffic between your SSL client and server will be encrypted.
MYSQL_CLIENT_SSL is obsolete. Using mysqli if you need to use SSL,
$db = mysqli_init();
$db->ssl_set(null, null,'cacert.pem',NULL,NULL);
$db->real_connect('host','user','pass','db');
As an alternate solution, you can also use SSH tunnels to accomplish compression and encryption.
MYSQL_CLIENT_SSL was removed from PHP and should not work.
You have a few options: the first is that if your web server is also your database server, you don't need encryption because the connection never leaves your box: it just uses localhost.
The second option is to use what Pablo suggested above and take advantage of SSH tunnels. An SSH tunnel essentially does the same thing as an SSL connection, except it takes one "extra step" to get it going.
This seems like a pretty decent tutorial to help get you started:
http://www.revsys.com/writings/quicktips/ssh-tunnel.html
Hope this helps!
According to http://www.php.net/manual/en/mysql.constants.php#mysql.client-flags MYSQL_CLIENT_SSL is still part of PHP 4 and 5. You need to set up the SSL connection beforehand though. You'll have to generate certificates and a bunch of other hassle (http://www.madirish.net/?article=244) but it will encrypt the traffic between your web server and your database host.
As mentioned above, if your web server is on the same host as the database server this encryption is unnecessary as the data travels over a local socket and isn't exposed to the network. The SSL encryption only encrypts traffic over the network.
I would warn against using an SSH tunnel because they have a tendency to die and you'll have to worry about maintaining the connection.