'Server' without Apache etc. - basic nOOb question

[JGonz]

Hiya!

I've spent quite some time reading tutorials, searching the forum, but to no avail.
Seems the most used (and described) use case of the server is to deliver web pages, in a LAMP environment.

But I only want a (faceless) server (or a -ui standalone) as a service, doing things like such:
- Listening on a certain port for incoming (socket?) connections.
- Verify that these connections are from valid (authorized) machines, and respond only in such cases.
- Making sure there's a connection to the main LAN-Database.
- Receiving data to process, or data that 'order' a special reply.
- Return the data that was required (from LAN-DB using stored SQL statements and parameters from 'the client')

Basically I want such a beast as a connection controller/ maintainer between the (potentially unsafe) website out there, and my highly secured server LAN (it's running here). The PHP guys at the website (resp. their code) will send their requests, and I (resp. my code in the server LAN) will check it for authorization, validity and whatever, and if I feel comfortable, I'll send an SQL query to my database, and return a result to the PHP guys that they may embed in their shiny web site.

Vice verse, they may send me data to alter the database, I'll do my security checks, plausibility checks, and if all is well, I'd fire up an "UPDATE * IN MYTABLE WHERE ..."

Such LiveCode server / Standalone solution should run faceless, as a service under Win 2K server (at first), or under a Linux server system (later, CentOS preferred). Databases used are to be ignored, I have connected LC to any DB I needed yet w/o any real problems.

-----------------------------------------

My problem now is if to use server, and if, how to use it in cmd-line modus, or if to use a Standalone (shouldn't be a problem on Win-Server, but on Linux: Read this ...).
I don't want/ need a full blown LAMP. I want an LC as the only open service on this machine, because there are severe security reasons. We don't want a lot of running services that are not needed, and we don't want to check open ports after any other update. There will be LC listening only (and RDP/VNC maybe later, with RDP/VNC as a way to use an LC app, as a future project ...))

So, how to do such best, without inventing the wheel for the 1.001th time?

Then, is there any information about the load a LC server (or a -ui standalone) would put onto a common web presence? I'd love to have one running at the web site, to be accessed by my PHP guys (and to give me access to _their_ MySQL DB for updating)?

I don't expect long how-to's. Don't bother, plz, gimmi a link. I can read for myself.
But if someone with experience in this area has expertise, I'd be more then happy to read about. Should I get my project running, it'll run under the community edition, i.e. GPL.

I might add, this thread may point to a similar question, maybe they should be merged? Think the documentation for server besides web-site-making is rather sparse, and the LC docu isn't much helpful, too ...

Have a good time!

[FourthWorld]

This may be of interest, a slightly updated version of an HTTP server example that used to be available at the old MetaCard site:
http://livecodejournal.com/stacks/lchttpd.zip

It runs as a GUI in the IDE, using the GUI event loop to stay open. Conceivably it could be modified to use a loop within a script triggered with a -ui launch, but I tend to run LC only as a CGI under Apache so I haven't spent much time exploring that.

If you are able to get it running from the command line please post the script so others can use it as well.

To use:
1. Open the stack in LC
2. Click the Start Server button
3. In your browser, enter the URL "http://localhost:8080"

Note that if your machine is behind a firewall and you want to access this from outside, you'll likely need to set up port forwarding in the router's firewall settings to allow the connection.

[bangkok]

What about a tiny web server ?

http://www.aprelium.com/abyssws/

windows, linux. easy to setup with livecode server. and can handle php as well.

[JGonz]

Hiya,

guess I'm really a bloody nOOb in these things ...

At first, thx for replys, I'll check your suggestions.

But still asking myself if I need a HTTP server at all - I want to have a dedicated database machine with LC as the only interface to 'the outer world' - this way I could nicely control any connections.

I don't want any PHP, WebServer, Java etc. at all on this server - it contains a database (& engine, PostGreSQL if possible) that needs all the power the CPU is able to deliver, and a small LC app to do the connects.
(That only accepts tasks from certain clients, translates it to safe SQL, queries the database with it and responds to the client with a proper reply)

Cannot help feeling I'm thinking 'not in the proper direction'. Where's my fault?

Thx for any help!

Have fun!

PS: I don't mind using a commercial LC, even if all the stuff would be GPL anyways. I don't mind using the server version or a standalone. What I want is a way to have a(ny) LC stack/ script running on a stripped server that does my stuff, reliably. Wonder if this is possible at all, without adding a lot of other stuff (WebServer for instance ...)

[FourthWorld]

I wonder if you need LC in that scenario at all. You could use the machine as a SQL server only, with the firewall set up to allow connections only from the public Web server. Many shared hosts are set up like that, with the DB sever separate from the Web server, and in your case that would seem to keep the number of moving parts down to the minimum you need, no?

[JGonz]

Hi,

You could use the machine as a SQL server only, with the firewall set up to allow connections only from the public Web server.

Wouldn't this send all & anything to my DB that is passing the PHP stuff on this web server?
For instance:

Code: Select all

"SELECT USERGROUP FROM USERS WHERE NAME = 'JGonz' AND PASSWORD = '12345'; DROP TABLE USERS;"

I don't have much control on the web server, it's other ppl doing it, and I have already found enough poor practice in the PHP stuff ...
But it's my job to provide them some data, so I'd really love to have my own "firewall" in between.

I started to play with the LCHTTPD - thx a lot for the hint, this one looks very promising! Already got it running (and responding) on an age old Win 2K server as a StandAlone. Now it's time to read through the code, and to try to get it running as a faceless service. (NSSM is thought to do the trick).

Annotation: Whatever I write with LC is GPL code. I'm happy to share. Where to drop? (Given that I get some working solution at all ...)
And, is the LCHTTPD GPL yet? *scratch_head*

Have fun!

[FourthWorld]

Annotation: Whatever I write with LC is GPL code. I'm happy to share. Where to drop? (Given that I get some working solution at all ...)

I would be happy to make space for it at the community site LiveCodeJournal.com .

And, is the LCHTTPD GPL yet? *scratch_head*

Good question. I'll ask the original author, Dr. Raney, but my guess would be that he'd prefer something more permissive like MIT or public domain. I'll report back what I hear from him.

[JGonz]

H,

a short report about the situation:

After I checked FW's and bangkok's most helpful suggestions my head literally exploded. I had learned an awesome lot of things, the dictionary stack was overheating and nearly goin up in flames, and I started to realize that the solutions offered to me was ways above my possibilities - I had never before worked with sockets, with the intestines of the protocols and so on.

So I decided to take a break and fire up good old google. And found, to my disappointment, a lot of other most useful information. Why haven't I done this before, instead of bothering the helpful ppl here?

Most interesting was the lesson "How to communicate with other applications using sockets".
Using the code for a "LiveCode Chat Server" I was able, with only a few alternations, to build basically what I'm after - a tiny server that listens on sockets, and does approbate action once a client connects (and then, sends queries).
Atm I'm rewriting this code (since a lot of it isn't needed and I want a clear and readable code) to suit my needs. For less problems I decided that, for the moment, my "Server" should run on an Windows 2K server, as a service (it's here, and available). Porting later shouldn't be this much of a problem ...

Lemme describe my ideas, maybe someone is able to point me to mistakes I'll inevitably will make:

• A "[StackName].exe", a most tiny StandAlone that has the relevant libraries linked, and that doesn't do anything but check them sockets - listening. As soon as a client attempts to connect, or sends data, it relies on a second (normal) stack that contains the functions handling this, via "start using ..." on OpenStack. It will as well respond, for sure.
  .
• A stack "[StackName]_main.livecode", that is full of code to handle all kinds of basic events - checking valid users, encrypting, handling the Prefs, filtering input for SQL queries etc. This is the first stack that's put "in use", but since this one controls the Prefs, more may be put in use after an initial call.
  .
• A stack "[StackName]_db.livecode", that contains the actual database code for the db given - this is the one that offers the DB-specific functions to make proper SQL code. Change this stack to the proper version if you stop using MySQL, and go back to MS-SQL
  .
• Maybe a stack "[StackName]_tools.livecode" to add customer-specific things - that could even be linked by an:
  .
• (maybe) additional "[StackName]_daemon.exe" (another standalone with "quit" as bottom line of each handler?) that is invoked by a timed job (cron), or by getting called by the "[StackName].exe", to prepare lookUp tables (in SQLite, or text-based) for a customer in time as soon as logging in of such is detected, for instance?

OK, for now I only need to finish a very simple base stack ("[StackName].exe") that reliably responds with dummy answers, and doesn't respond to unknown ppl. Should be done soon.
Next then is to check how it behaves on a real server, running as a service (hoping NSSM will do it.)
Then checking vulnerabilities, after that adding useful code by adding the stacks.

Seems I have a lot or work for the next days. Feel free to add your thoughts, your knowledge and any warnings that might be useful!

Thx, and have fun!

PS: Thx for reading. Don't hesitate to reply even if you think you're not qualified - I'm less then you with a good probability;-) I'd be most happy for all and any thoughts, after all of the work of the recent I'm suffering of "tunnel-vision" for sure, and any outside idea might be a life-saver!

PPS: Should I ever finish this project it'll be OpenSource under the proper license - GPL V2? LiveCodeJournal.com, Github, MySite, whatever. I'll sell the customized installation (the work hours) to selected customers in my area. You are free to do such, too. I'll keep myself an edge with sparse comments in the sub-stacks - after all I have an old cat to feed, and if you ever had an old cat to feed you'll know how much they actually will eat! The fully commented code will be available for small coin, or free for all that commented here. Hope this is within the rules (else I'd change ...) ...

[BvG]

I think you might run into problems when trying to run LC as a Windows service, but I don't really have any experience with that. LC is either a command line application, or a full fledged app that has a full GUI. If you can incorporate either of those into a Windows service, then you're golden

Personally I think that having a GUI on a server is great. ChatRev is running from the IDE (an old version because it's on a PPC Mac), and that would allow me to make quick changes if necessary (I haven't changed the code in years tho). Before this machine, it ran from one of my ex-gaming machine, which was a pentium II 400mhz... What I'm trying to say is, LC can run as a server with GUI easily, all without using too much resources.

Note that, besides ChatRev, I also have made available a very simple server/client combination for learning purposes. You can find them on the User Samples in the ide, or at my site (at the bottom).

[JGonz]

Hi,

I think you might run into problems when trying to run LC as a Windows service, but I don't really have any experience with that. LC is either a command line application, or a full fledged app that has a full GUI. If you can incorporate either of those into a Windows service, then you're golden :)

Seems I'm golden - it's running already ;-))

It's a standalone-stack with no fields nor buttons, all code is in the stack script. It initializes itself in the preopenstack handler, putting 'in-use' another vanilla stack that contains most of the handlers (for more easy updating ...).
I used 'nssm' to register it as a service, can control it via 'services.mst', and it's responding even if no console is open (nobody logged in) at the server (an old remote Win2K terminalserver). The service runs with an own role, completely independent of any human interaction.

Came to the conclusion to move as much code as possible from the standalone to the 'used' stack, for better possibilities of testing/ debugging (got the IDE running there, quite funny in 256 colors over RDP ...).

Update: HOORAY!!!

Solved my major problem: I had advised nssm to start the standalone service with '-ui'. This way, after a few responses it went into a deadlock, eating up ~50% of the servers CPU time, not responding anymore. Thought I'd have made a mistake in my code, cleaned up, rewrote half of the whole shebang, tested, tested, then gave up and took a walk.

Came back from my walk, and decided to remove the '-ui' switch (via registry), restart the service and give it one more try - and this was it.
Running like a charm now, as a real faceless listener as it was desired. Time to start adding some useful code now :))

Personally I think that having a GUI on a server is great. [...] What I'm trying to say is, LC can run as a server with GUI easily, all without using too much resources.

Well, even if I had a GUI, I'd not see it - this thingie shall run as a service on a server, without the need of any interaction, should restart with the server in case of a voltage loss, and should be available 24/7/365.
So I cannot have it run in a user session, and cannot rely on any manual intervention.
I'll now define more 'chat commands' for it (currently only AUThorization and MeSaGge implemented), I want to get data from the LAN database and send this to a website (resp. its PHP script). Smells like hashes with salt and a bit of crypto sauce ;-)

A bit fat "Thank you" to all that helped, and provided your ideas and knowledge! I'll sleep a lot better today, than during the last nights :)

As soon as this thing is regarded V1.0 I'll provide a working solution in this thread. Meanwhile I have added the stack script of the Standalone at the end of this post, for a good laugh due to all these bugs still hiding there ;-)

Have fun!

Code: Select all

local sConnectedClients     -- array of authorised clients [client] => [name]
local sPendingClients        -- list of all pending clients
local sClientNames            -- list of all currently used client names
local sRunning = false                   -- if the server is currently running

constant kPort = 8080

on preopenstack
   start using stack "SockSerfD_main.livecode"
   -- This is my library stack
   if loadprefs() then
      -- loading prefs from a text file,
      -- and testing this way if the 'use' has worked
      get writelog("Prefs connected")
      -- a function that does the logging
      serverstart
   else
      get writelog("Error loading Prefs")
      close this stack -- no idea yet if this works ...
   end if
end preopenstack

command ServerStart
   if not sRunning then
      put true into sRunning
      accept connections on port kPort with message "ServerClientConnected"
      get writelog("Server listens")
   end if    
end ServerStart

command ServerStop
   if sRunning then
      put false into sRunning
      put empty into sConnectedClients
      put empty into sPendingClients
      put empty into sClientNames
      repeat for each line tSocket in the opensockets
         close socket tSocket
      end repeat
   end if
   get writelog("Server dead")
end ServerStop

on ServerClientConnected pSocket
   if checkallow(checkSocket(pSocket),true) then
      --Is it a valid IP? (I only allow designated IPs to connect at all)     
      read from socket pSocket until return with message "ServerMessageReceived"
      write "Welcome, please AUT!" & return to socket pSocket
      -- Bogus reply ...
      get writelog("Client connected: " & pSocket)
   else
      get writelog("Wrong IP, rejected " & pSocket)
      -- this is a miscreant, do nothing but logging
      close socket pSocket
      socketClosed -- hope this works ...
   end if
end ServerClientConnected

on ServerMessageReceived pSocket, pMsg
   put char 1 to -2 of pMsg into pMsg
   if mMsg <> empty then get writelog(pMsg)
   local tCommand, tLength, tMsg
   put item 1 of pMsg into tCommand
   if item 2 of pMsg is empty then put 0 into item 2 of pMsg --### Hmmm ...
   put item 2 of pMsg into tLength
   switch tCommand
      case "MSG"
         read from socket pSocket for tLength chars
         put it into MyVar
         get writelog(MyVar)
         write "Message received, send next!" & return & MyVar to socket pSocket
         -- (Actually something meaningful should come here...)
         break
      case "AUT"
         read from socket pSocket for tLength chars
         if checkallow(it) then
             -- correct User? Additionally it should be a correct User ...
            put it into sConnectedClients[pSocket]
            write it & " , you're welcome! Send MSG!" & return to socket pSocket            
            get writelog(it & " is valid: " & pSocket)
         else
            put "Unknown User, try again!" into tMsg
            write "ERR," & the number of chars in tMsg & return & tMsg to socket pSocket
            close socket pSocket
            socketClosed
         end if
         break
   end switch
   read from socket pSocket until return with message "ServerMessageReceived"
end ServerMessageReceived

on socketClosed pSocket
   if sConnectedClients[pSocket] is not empty then
      local tName
      put sConnectedClients[pSocket] into tName
      delete variable sConnectedClients[pSocket]
      get writelog(tName & " disconnected")
   end if
end socketClosed

function CheckSocket pSocket
   -- extracts the IP from a socket
   put the itemdelimiter into OldItemDel
   set the itemdelimiter to ":"
   get item 1 of pSocket
   set the itemdelimiter to olditemDel
   return it
end CheckSocket

[FourthWorld]

And, is the LCHTTPD GPL yet? *scratch_head*

Good question. I'll ask the original author, Dr. Raney, but my guess would be that he'd prefer something more permissive like MIT or public domain. I'll report back what I hear from him.

I finally heard back from Dr. Raney. He's good with the MIT license for mchttpd.mc; I'll be poating an updated version with the license included soon. In the meantime, if the stack is useful to you feel free to use the code under the permissive terms of the MIT license here:
http://opensource.org/licenses/MIT