Topic awaiting preservation: Windows server/IIS?

*please* help -

Can anyone give me some tips on what kind of problems I will have setting up a php/mysql run site on a windows/iis server?

I am starting to run into a bit of a nightmare...building a site on a volunteer basis, and the 'client' has just set themselves up with a friend who offered to host the site. We had big talks, of course, and I offered plenty of recommendations on inexpensive hosts...but....

I don't know enough about the issues at hand to have a meaningful conversation with them about the details in this case - I would appreciate any tips or links anyone can offer in regard to running on a windows server, particularly when implementing php/mysql (the host assured the client that it would not be a problem...). I have no idea what I might be up against trying to set this site up if they stick with this host. Would like to arm myself before getting back to them.

thanks =)

Ok, the topic is complicated.
I'll give you an engineer's perspective, and a sincere one at that: beware of the anti-commercial potential impact.

Try to mentally place the arguments in context, and you'll see if they fit.

Anyway...

This basically is suicidal for a web server.
IIS is a very, veeeeeeeeeeeeeeeeeery weak solution for web publishing, in all regards. It lacks scalability and security, and could lead to much higher costs when combined with php.
Scalability means: "have to face a really large audience? You're fucked. You're in for buying mirroring solutions a plenty".

Apache, the web server, is a much more interesting solution on Windows, even, methinks.
A much more clever and scalable piece of software - but it also requires an expertise to be run correctly. We can provide that, though, I guess (the Asylum to you I mean).

On to searching for references that can be shown to a customer, comparison, and less theoretical stuff... <brb>

Ok, here is a good reference about networking and a market share comparison.
Pure technical benchmarks I could find for now are biased, some towards IIS, some towards Apache, so my above certainties may not hold true until I find a *really good* information source.

http://news.netcraft.com/archives/2006/04/06/april_2006_web_server_survey.html

You should also ask Pugz, if that is an option.
Despite the sayings that "IIS is not THAT vulnerabl", to me it's the devil in terms of security.
Maintanability should be considered, does the host want to be able to easilly maintain?

Here is a good tutorial about *how to do it* since it was your concern:
http://www.visualwin.com/PHP/

Basically, one of the best options is to run it as an ISAPI filter, eg. a filter used to tell the server how to render web pages.

And my humble opinion is that, if your friends *really* want to do it this way, eg. the worst possible way to me (mixing oil and water leads to plenty of natural cracks between the onion layers),
you should make sure they won't sue you for the issues they will encounter.

thanks mauro

Your view is the general impression I have had of windows server.
I am reading through those links now.

A little info on the site/audience/scale -
it is for a local Taekwondo school, of which my daughter is a member. The mainintended audience is essentially the students/parents/staff, and of course potential students, other schools looking for information on events and the like.

There won't be any particularly sensitive information present that needs high-security or anything like that, but obviously a basic measure of security is desired.
The scope will at some point include credit-card transactions, but through a 3rd party on their own secure site.

There are a variety of dynamic content sections (news, events, and the like), and a student resource area requring a login.

So, nothing high-end, nothing highly sensitive, but not a simple static 2-page advertisment site either...

Security updates and software updates force you to restart the server, and that is the full reboot, you are not just stoping and starting the server, you are bringing the box down. When it comes back up you will then have to check that all of the services are running and operating correctly. That is painful. This could be 5 minutes of downtime, which depending on what you are hosting can be a problem.

That is the problem when you choose windows.

IIS tends to be a bit slower to work with, everything is a GUI so when you are attempting to do a repetitive task it will take a bit longer. This is out of the ordinary, but I had to register 5k domain names through IIS and to register a name you normally have to use a 10 step GUI. I got past this by having a script create the resultant file, but you then still had to use the GUI to actually register the domain with the server (10 steps became 2) but that was still about 25,000 button clicks total to setup all these domains. This might be better now, this was back in 2000.

The next issue is that when you use windows you have to give up a good amount of resources since you are running in a GUI environment. When running on a *nix varient you tend not to be in a GUI environment thus increase the performance you can get out of the same hardware.

The standard anagram is LAMP not WIMP. This is because (li)nix, apache, php and mysql just fit so well together, it is free and stable. You do not get the same out of windows and IIS.

Dan @ Code Town

quote:

---

WarMage said:
That is the problem when you choose windows.

---

Is that a function of *Windows* or IIS? I have a w2k machine that I nuked IIS on and run Apache instead (have been doing so for 3-4 years maybe), as a service, and when I reboot once every few months after a software update, it's down a couple of minutes and never fails to restart apache/mysql...

Is it an option to axe IIS and run a WAMP package instead? I assume they'll be insistant on Windows but probably not IIS unless they're using it for something else already (is the machine multi-use?). There's a lot of other questions to be asked as well about the network and hardware, what's been chosen and why... a lot to get into for a vounteer web site where there's someone else in charge of the web server. Sounds like head butting time, or step back and run away time

If you are going to be having this hosted you might want to make sure that the person doing the hosting has a name server setup. That is not the easies thing to get setup.

For the scale you are talking about, a couple of thousand hits a month, without anything being mission critical you could go with either solution.

I would highly recommend using a hosting provider, for $60 a year you can get rid of all the headache associated with running a server and get a 99.9% uptime guarantee.

You do not want to have your website hosted by someone with a server. You have to make sure that they have UPS and that they are on a dedicated IP and that they have a name server. If they do not have this you are asking for problems.

I have codetown.org connected to roadrunner without a ups. What this means is that when the power goes out codetown goes out. It also means that when roadrunner gives me a different IP address I have to update my name server configuration and request a name server change with the registrar, which can take up to 48 to propogate through the internet.

Having the server is a great personal learning experience, and a nice way to have access to an SSH tunnel from anywhere. But it is definately not something that should be hosting a business and be a front for accepting money.

Dan @ Code Town

quote:

---

I would highly recommend using a hosting provider, for $60 a year you can get rid of all the headache associated with running a server and get a 99.9% uptime guarantee.

---

I second that, reallyreally. I had a friend... well, he was a computer catastrophy, but I had a friend who managed to toast his home comp completely...
By hosting mobile ringtones on his home pc It just couldn't stand it, died at a tremendous speed and ended up catching fire.

Concurrent posting what fun.

That is a function of Windows. So you have only 2 minutes of downtime for a restart. That is not too bad. Two minutes of downtime for an upate is sometimes more than some clients will accept.

I have not run windows as a dedicated server in 7 years. The services are probably more stable than the last time I used it. We do have a windows server for crystal reports here at work and that is the buggiest thing we have going. We need to restart it all the time it is slow it is aweful. I can not say how much of it is windows and how much of it is crystal (I tend to think most of it is crystal). But having to work with that server is just a pain in the ass. You either have to walk over to the server room or run a VNC. SSH is just easier for me.

Dan @ Code Town

yup, it'd be ideal to pay the nominal fee for hosting without a doubt. In fact, I just realized my signature pimps cheap hosting for just such small orgs and friends

edit: WarMage, this is a dev server on my LAN only, services are stripped to the minimum and I keep it updated via Windows Update. The only other things it runs is ZoneAlarm and a (python) bittorrent client so it's very lean. I have Apache serving about 30 virtual roots and the host files for PCs on the network all point my "home made domain names" to this dev server/virtuals. It's a great setup for a windows shop, virtually maintenance free, rock solid, and runs of a 500mhz P2 like a champ



(Edited by JKMabry on 04-21-2006 21:15)

I am unclear right now what the situation of the "host" actually is. I will certainly need to clarify what the setup is exactly as far as - is this his box that he hosts his own site on, and offered to throw this site on as well? Or is this a legitimate server...or...?

I don't know at this point.

This much I know: neither myself nor the client will be doing any sort of server configuration.

I am scared so far by the impression I get of the situation....

<warning: alcohol powered post... may be even more spontaneous, or totaly meaningless>

There's nothing to be scared about.
The only real "concern" I see that cannot be solved by a couple of posts at the Asylum is the "will they sue me" issue.

I do think that matters that involves close friends, couples, stuff... that when people who are close in "real life" have to do business together, well..
They should clarify in a written form what the limits of theyre involvements are.

As long as the lines are blurry, there is matter for conflicts.
Making the lines a little bit clearer may sound "harsh", but it's just like those freeware license agreements you get to accept when downloading free soft:
"the developer declines all responsibilites in case your comp would blow up" just means "99% chances your computer won't blow up, but if you're too much of an idiot to run a comp,
then my behind and our friendship are safe".

* * * hips.... mmmhmmm. Ricard. And Mélanie. Gotta love fridays.