Microsoft Releases IIS FastCGI Module

Marcy writes "Microsoft has just announced the final release of the IIS FastCGI module for IIS 5.1 (XP), 6 (2003), and 7 (2008). This FastCGI module was built with collaboration from Zend, the creators of PHP, and is intended to solve the CGI on Windows problem." It's free as in beer.

Re:Problem?

[Saint Stephen]

"Forking" (launching) a process is much more expensive on Windows than it is on Linux. Windows NT is architected after VMS (in part because of Dave Cutler). Processes are expensive on windows.

Re:Stop the insanity.

[deniable]

I was in a small shop where we already had IIS to run things like Outlook Web Access. IIS also made it easy to have integrated AD authentication and access controls, so we had single sign on.

Rather than running another box or supporting a VM image to run apache, it's easier just to make do with IIS. The point of this article is that MS is making IIS play better for people from the PHP/fcgi side of things.

We did however run the outside web server on apache on an ancient almost broken P166 and it ran well.

Re:Why bother?

[gbjbaanb]

I'm not sure whether you think IIS has a text file or not...

Still, for my fellow readers:

With IIS7, all IIS configuration is now stored in a simple XML file called applicationHost.config, which is placed by default in the \windows\system32\inetsrv\config directory

from an Apache v IIS blog entry [iis.net] that also discusses the fastCGI module.

Re:free as in beer?

[kie]

is this what you are looking for?
freebeer.org [freebeer.org]

Re:Problem?

[gbjbaanb]

Its kind of a fallacy that 'forking' processes on Windows is significantly more expensive than forking them on Linux. I think it is somewhat more expensive, but that doesn't alter the fact that forking processes on linux is still expensive in the first place.

So, we needed ways to make things go faster - mod_php for example, that ran php scripts inside an apache process, but you still had to fork the apache process for each web request because of many thread-safety issues in php modules. This was also a security problem because every php script ran as the apache user. So the next idea was to start an apache process for each client and re-use it until that client disconnected (and stayed disconnected). This is the fastCGI approach.

With windows, you had 2 ways of running PHP scipts: as a CGI application (slow due to new processes all the time), and as an ISAPI (think of this as the equivalent of mod_php) module. The ISAPI one worked but you had the thread-safety issues of PHP to contend with (just like on Apache 2 that doesn't spawn worker processes).

In summary: nothing much to see, someone's just released fastCGI for IIS now so you have the same configuration options for IIS as you have for Apache.

Re:Why bother?

[El Lobo]

True. And that's it's beauty. Do you want to edit it? Do it. There is also something called IIS Manager which is the GUI for that.

Re:Why bother?

[jimstapleton]

If I skip an answer, it's safe to say I can't give a good answer.

How do you search a gui interface?
Most have a series of tabs/menus that allow a drill-down type search. Sometimes things aren't in the most obvious places, but it's not that bad, and if you don't know the exact text of what you are looking for it's a lot easier than text files. If you know the exact text, then it is harder. It's nicer to have both (such as provided in IIS)

How can you minimalise a gui config to the bare essentials?
Turn off the options you don't want - same way you would in a command line.

How do you upload/download a config and email it to someone?
Depends, if the gui attaches to an file (a-la IIS), email the text file. If the GUI attaches to the registry, export the hive and attach it.

How do you edit the config without having to run remote desktop client?
Assuming there is a command line interface to the machine, you can edit the file the GUI controls with a text editor, if it is a text file. If it is registry, you can call tools in windows that allow you to query/write the registry, and if it is a proprietary binary, you are SOL unless they wrote a tool for it.

And of course, with clicky configs, if they haven't provided an option for something, then you can't do it. Sorry, "computer says no".

Yep, text-y configs you can't change things they don't give you options for either! That's a matter of programmer incompetance, and not specific to the interface.

Re:Rasmus Lerdorf must be pissed today

[PHPfanboy]

Hi, I work for Zend (not in Marketing dept.) - this issue comes up every time it's written in the press or other interviews. It's not how we market ourselves, and every time we're quoted as "the creators of PHP" Zeev and Andi get hauled over the coals by the PHP development community. It's not the first time and probably not the last time this has happened. For the record, this is how Zend markets itself:

Zend is the PHP company.
Businesses utilizing PHP know Zend as the place to go for PHP expertise and sound technology solutions. Andi Gutmans and Zeev Suraski, two of Zend's founders, are key contributors to PHP and creators of the open source Zend Engine. Because of their internationally recognized authority, the company and its founders continue to play leadership roles in the PHP and open source communities, and are accountable for a central role in the explosive growth of PHP.

Slighty different, I think you'll agree.
Happy PHP'ing

Re:Problem?

[EvanED]

I think it is somewhat more expensive...

It's a lot more expensive. Some numbers MSR came up with while working on their research OS Singularity put process creation on Linux at ~700,000 cycles, just over 1 million on FreeBSD, and just under 5.4 million cycles on XP. Here's [microsoft.com] one source; slide 23.

I'm not arguing against your main point; I'm just pointing out that there is actually a huge difference between process creation time on the different systems.

FastCGI vs Proxy

[tcopeland]

Over on Linux, my perception is that FastCGI enjoyed a brief reawakening as it was (for a while) _the_ way to deploy Ruby on Rails apps with Apache. But now that seems to have changed to over to using Apache + mod_proxy_balancer + Mongrel [rubyforge.org].

One nice thing about mod_proxy_balancer is that it's easy to distribute the Mongrels across a couple of machines... and Apache will take them out of the loop if the machine goes down or they become unresponsive or whatever. Works for us [blogs.com], anyhow....

Re:Rasmus Lerdorf must be pissed today

[MrMunkey]

True Rasmus did create PHP, but Zeev and Andi rewrote the PHP parser in PHP3 and later created the Zend Engine along side PHP4. I'm not sure if it was a typo or if it was a misconception by the author of the article, but I'd say Zeev and Andi would at least know what they are talking about.

http://en.wikipedia.org/wiki/Php [wikipedia.org]

Re:Stop the insanity.

[tomknight]

Because some people live and work in the real world. Not everyone runs a webserver just to show off their Pokemon collection, some of us get paid money to do this sort of thing - and sometimes the people paying the money want to use Microsoft.

Re:Security

[LordLucless]

You're talking about a flaw in a apache's security model there, not PHPs. Apache runs as a single user. When it runs PHP as a module, then PHP runs as a single user. Same with Perl, or Ruby, or anything else that relies on a module interface as far as I know. If you use FastCGI (which this article is about, you may have noticed) then you can get it to suexec to a different user when it makes the CGI process, and you don't have the security problem you're whining about.

The bit about PHP admin scripts is application specific - nobody's forcing the authors to do it that way, and you can do the same with any other language. PHP has had it's flaws (register_globals and magic_quotes still give me the shivers), but if you're going to bitch about it, at least educate yourself first.

Re:Problem?

[Karellen]

Even things like Cygwin only emulate [fork() on Windows] with threads.

Sorry, but that's bollocks.

Cygwin fork() does create a new process. It calls CreateProcess() and then copies the current process into the new one. See the relevant Cygwin API FAQ [cygwin.com] for a full explanation.

Re:Why bother?

[oliderid]

httpd.conf can be quite difficult the first time you see it. Somes distributions have even splitted it into different configuration files (OpenSuse). You can understand it if you run dozens of virtual hosts but splitting the default httpd.conf is absurd IMHO.

Anyway there are editing tools:
http://kochizz.sourceforge.net/ [sourceforge.net]
Looks promising.

But I have never used it (the only one I've tried: YaST HTTP server module was incomplete for taste, I couldn't configure properly webdav through it).

Re:Stop the insanity.

[vaderhelmet]

Apache does run on Windows. This seems to be widely overlooked. Everyone's primary reason for running IIS is "We have Windows". Seeing as they are both free, there must be some other reason for not using Apache. My guess would be lacking familiarity of and the learning curve to configure Apache.

Re:Problem?

[Penguinisto]

Is it the same on Win2k3 Server?

Probably higher, considering the layers of security checks and "reducing the threat surface" whatnot which MSFT applied to IIS for Windows 2003 Server.

/P

Re:Problem?

[rabtech]

"Forking" (launching) a process is much more expensive on Windows than it is on Linux. Windows NT is architected after VMS (in part because of Dave Cutler). Processes are expensive on windows.

This is true because Windows and the Win32 require threads and assume they exist; if you want to spin-off a lightweight operation you kick up a new thread. Although most Unix systems have OS threads these days that wasn't always the case - processes were the word of the day for a long time and still are in some ways.

Re:Problem?

[PitaBred]

And if you have, say, 100 visitors at the same time? That's 3 seconds just to start the processes, much less actually run anything. It's multiplicative ;)

Re:Problem?

[Anonymous Coward]

This is why THREADS are in use on Windows so much, vs. forking an ENTIRELY NEW PROCESS, from the parent one. Thread uaage costs much less than forking an entirely diff. worker process (child) off the parent process.

Re:Stop the insanity.

[Allador]

It's trivial on the apache side, and relatively easy on the iis side.

Config the machine to have two IPs.

On apache, set a Listen directive in the config file, to have it listen on IP1:80.

For IIS, run this:

c:\>httpcfg set iplisten -i IP2

By default, both apache and IIS will bind to every IP on the box. These methods let you have each listening on port 80 on their respective IPs.

The only 'hard' part on the IIS side is knowing that httpcfg exists and controls this. If you've ever setup wildcard ssl certs in windows you've been here.

The reason this is controlled through this command prompt on windows is due to the architecture of IIS.

There is a very small kernel-mode component that handles listening on the port and handing off to IIS. This is what you're configuring with httpcfg.

I believe Vista (and therefore Win 2008 Server) doesnt have httpcfg and uses something else (dont know what off the top of my head).