[Info-vax] Using VMS for a web server

[Stephen Hoffman]

On 2015-06-03 13:35:39 +0000, Dirk Munk said:

> I've always been in favour of using VMS for a web server. The reason is 
> quite simple, VMS is quite save out of the box (now Hoff is going to 
> explain to us that other operating systems improved very much, and that 
> certain aspects of VMS are not as save any more :-) ), and that it is 
> unknown to the script kiddies.

No; I'm just going to think your requirements are different than those 
of most other folks.

> Secure web servers are vitally important for companies and 
> institutions, so a save web server can be a selling point.

Might want to expand out your experiences with other platforms and tools, too.

> There are three web server packages for VMS: OSU, WASD and Apache (aka 
> Compaq Secure Web Server CSWS, these days HP Secure Web Server but 
> still CSWS ?!?). I've worked with CSWS in the past, it seemed the 
> natural choice given the popularity of Apache - at least at the time.

So go experiment with Apache, and try building a secure configuration 
with current / recent patched-to-current Apache circa 2.4.12, current / 
recent mod_ssl, supported Java services, current / recent php and 
Python and Perl for CGI, get a FastCGI going, current / recent ciphers 
for ssh and maybe get IPsec going, get the Apache authentication hooked 
to your local OpenVMS LDAP services, get IPv6 going, and post up your 
experiences with that.  Try out what you're considering and/or 
suggesting.   FWIW, this experiment is quite entirely unfair, as you 
won't be able to do most this with OpenVMS, short of a huge investment 
of your time and effort porting and updating code.

> I've been reading more on WASD, and more specifically on the 
> performance and security aspects. Performance wise, WASD is much better 
> than CSWS, and I've read about certain security problems with CSWS 
> (can't find the link again I'm afraid). WASD is a 'real' VMS product 
> instead of a Unix/Linux product made to run on VMS, like Apache is.
> 
> Also, in general the popularity of Apache is dwindling in favour of the 
> Microsoft web server.

The folks leaving Apache aren't going to IIS.   
http://w3techs.com/technologies/history_overview/web_server

> The latter seems to be much faster.

If you want speed, try nginx.  Maybe also try lighttpd, too.  (AFAIK, 
neither has been ported to OpenVMS.)  Definitely try configuring and 
running and managing web services different platforms.   The target for 
and the capabilities of nginx are different from Apache, too.

> So now I wonder if it wouldn't be better to focus on WASD instead of 
> CSWS as the standard web server for VMS. The Australian company VMS 
> Software Services Pty and VSI and much more comparable than was the 
> case with Compaq or HP.  Together the two might be able to build a set 
> of nice web server products for VMS.

Most folks are interested in Apache or nginx, or — if they're running 
Windows Server — IIS.  These folks are not going to be interested in 
OpenVMS for quite some time, either — VSI has a whole lot of work 
before they're likely to start attracting new users to OpenVMS.  
Existing users of OpenVMS, sure, they can run WASD or (preferably 
updated) Apache on OpenVMS.

VSI will be working to move the current OpenVMS infrastructure moved 
forward — the compilers and core libraries, SSL and ssh, networking, 
crypto, LDAP, ncurses, X, password storage, and the many other bits 
that enable other packages, for instance — and then with whatever hunks 
of Apache and other network services and middle-level infrastructure 
might be targeted — and particularly areas such as ease of installation 
and ease of management.

Then there's the question of pricing.  VSI is also competing with a 
zero-cost entry-price for Linux and BSD distros; for those folks 
experimenting with and just getting started.  If hosting services are 
in play, then you're competing with Amazon and folks like 
https://www.digitalocean.com/ or http://www.rackspace.com/ or 
http://azure.microsoft.com/ here.  Spooling up a guest is seriously 
fast on most boxes, too.  A few clicks and you're off and running, 
whether hosted services or with an end-user-targeted server OS 
configuration.

> As usual, your thoughts please.

Go try it — test out your guesses and your suppositions.  Try some 
different configurations.  Try some hosted-services options.   
Definitely try out some of the operating system configurations other 
than OpenVMS, as those _are_ the competition here, and those are also 
going to be a potential source of ideas and enhancements for OpenVMS, 
too.

You might also need to expand your definition of what comprises modern 
web services, too.  Of what folks seeking to run such can and will 
expect.  That's typically going to involve far more than "just" a web 
server, and has for a while now.

Related:
http://labs.hoffmanlabs.com/node/525
http://labs.hoffmanlabs.com/node/3



-- 
Pure Personal Opinion | HoffmanLabs LLC