[Info-vax] Using VMS for a web server

[Dirk Munk]

Stephen Hoffman wrote:
> On 2015-06-03 13:35:39 +0000, Dirk Munk said:
>
>> I've always been in favour of using VMS for a web server. The reason
>> is quite simple, VMS is quite save out of the box (now Hoff is going
>> to explain to us that other operating systems improved very much, and
>> that certain aspects of VMS are not as save any more :-) ), and that
>> it is unknown to the script kiddies.
>
> No; I'm just going to think your requirements are different than those
> of most other folks.
>
>> Secure web servers are vitally important for companies and
>> institutions, so a save web server can be a selling point.
>
> Might want to expand out your experiences with other platforms and
> tools, too.
>
>> There are three web server packages for VMS: OSU, WASD and Apache (aka
>> Compaq Secure Web Server CSWS, these days HP Secure Web Server but
>> still CSWS ?!?). I've worked with CSWS in the past, it seemed the
>> natural choice given the popularity of Apache - at least at the time.
>
> So go experiment with Apache, and try building a secure configuration
> with current / recent patched-to-current Apache circa 2.4.12, current /
> recent mod_ssl, supported Java services, current / recent php and Python
> and Perl for CGI, get a FastCGI going, current / recent ciphers for ssh
> and maybe get IPsec going, get the Apache authentication hooked to your
> local OpenVMS LDAP services, get IPv6 going, and post up your
> experiences with that.  Try out what you're considering and/or
> suggesting.   FWIW, this experiment is quite entirely unfair, as you
> won't be able to do most this with OpenVMS, short of a huge investment
> of your time and effort porting and updating code.

I'm well aware of the enormous list of software products that are in 
need of serious updating on VMS. If you can take CSWS out of that list 
because WASD can do the same, and maybe even better, than that is one 
item less on the list.

>
>> I've been reading more on WASD, and more specifically on the
>> performance and security aspects. Performance wise, WASD is much
>> better than CSWS, and I've read about certain security problems with
>> CSWS (can't find the link again I'm afraid). WASD is a 'real' VMS
>> product instead of a Unix/Linux product made to run on VMS, like
>> Apache is.
>>
>> Also, in general the popularity of Apache is dwindling in favour of
>> the Microsoft web server.
>
> The folks leaving Apache aren't going to IIS.
> http://w3techs.com/technologies/history_overview/web_server
>
>> The latter seems to be much faster.
>
> If you want speed, try nginx.  Maybe also try lighttpd, too.  (AFAIK,
> neither has been ported to OpenVMS.)  Definitely try configuring and
> running and managing web services different platforms.   The target for
> and the capabilities of nginx are different from Apache, too.
>
>> So now I wonder if it wouldn't be better to focus on WASD instead of
>> CSWS as the standard web server for VMS. The Australian company VMS
>> Software Services Pty and VSI and much more comparable than was the
>> case with Compaq or HP.  Together the two might be able to build a set
>> of nice web server products for VMS.
>
> Most folks are interested in Apache or nginx, or — if they're running
> Windows Server — IIS.  These folks are not going to be interested in
> OpenVMS for quite some time, either — VSI has a whole lot of work before
> they're likely to start attracting new users to OpenVMS. Existing users
> of OpenVMS, sure, they can run WASD or (preferably updated) Apache on
> OpenVMS.
>
> VSI will be working to move the current OpenVMS infrastructure moved
> forward — the compilers and core libraries, SSL and ssh, networking,
> crypto, LDAP, ncurses, X, password storage, and the many other bits that
> enable other packages, for instance — and then with whatever hunks of
> Apache and other network services and middle-level infrastructure might
> be targeted — and particularly areas such as ease of installation and
> ease of management.

I'm aware of all these things, but if WASD can be the web server of 
choice for VMS, then it would be possible to drop Apache. After alle, 
WASD is a pure VMS product, it may be easier to implement on VMS than 
Apache.

>
> Then there's the question of pricing.  VSI is also competing with a
> zero-cost entry-price for Linux and BSD distros; for those folks
> experimenting with and just getting started.  If hosting services are in
> play, then you're competing with Amazon and folks like
> https://www.digitalocean.com/ or http://www.rackspace.com/ or
> http://azure.microsoft.com/ here.  Spooling up a guest is seriously fast
> on most boxes, too.  A few clicks and you're off and running, whether
> hosted services or with an end-user-targeted server OS configuration.
>

I'm referring to the type of web server that is a front end to your 
business, not some box at a hosting organization.


>> As usual, your thoughts please.
>
> Go try it — test out your guesses and your suppositions.  Try some
> different configurations.  Try some hosted-services options. Definitely
> try out some of the operating system configurations other than OpenVMS,
> as those _are_ the competition here, and those are also going to be a
> potential source of ideas and enhancements for OpenVMS, too.
>
> You might also need to expand your definition of what comprises modern
> web services, too.  Of what folks seeking to run such can and will
> expect.  That's typically going to involve far more than "just" a web
> server, and has for a while now.

I suppose it all depends on what you want to do with your web server. 
I'm not suggesting that a VMS web server could or should do anything any 
other web server can do. It's like with buying a car, you can buy a very 
amall one, a big one, a sports car, a saloon, a station wagon, a pickup, 
it all depends on your needs and wishes.

And if a VMS webserver can do the things we need it for, then that is 
good enough.

>
> Related:
> http://labs.hoffmanlabs.com/node/525
> http://labs.hoffmanlabs.com/node/3
>
>
>