Odd behaviour when apache-module is active

[Peter Schober]

* Martin Schmidt <sektor3 at gmail.com> [2017-07-11 09:08]:
> i want to run Shibboleth 2.5.3 on a Debian Wheezy System with Apache 2.2
> and Tomcat 6.
> The apache uses prefork-mpm. The Server is already running a Website.

You can stop right there based solely on the info from the Shib2
start page in the wiki, the one that starts with:
  "The minimum safe release of the SP is v2.6.0. You must also ensure
  various libraries are also sufficiently new. [...]"

See the different kinds of vulnerabilities that plague those versions
(either version):
https://wiki.shibboleth.net/confluence/display/SHIB2/SecurityAdvisories#SecurityAdvisories-ServiceProviderVulnerabilityMatrix

So we might not even need to go into how *everything* here is unsupported:
Debian always was and is unsupported by the Shibboleth project,
Debian Wheezy ("oldoldstable") is unsupported by the Debian
project itself, but kept alive (comatose?) by the LTS team.
And prefork never was a good match for the Shib SP, IIRC.

> Right after doing all that i tested the Website and everything runs fine.
> 15 Minutes later and all Pages on the Website load very slow (~1 minute)
> and also trying to connect to the server via ssh takes about 30seconds.
> When im connected everything runs fine inside the terminal.
> I used "top" to look at the load but everything seems fine.
> 
> I also tried 2.4.3 before but it had the same behaviour but without the 15
> minutes running fine.

You're saying using the Wheezy default packages causes "the same
behaviour", i.e., instant slowness of the server, but you can't find
out why, but you still suspect it's Shibboleth's fault? Probably
because the slowness immediately goes away once you stop shibd and
unload mod_shib?

So is your specific question why using the version from backports
packages don't change the symptoms you're (not) seeing (only feeling)
also when using the version from oldoldstable?

I've certainly run that version many years ago and did not experience
any of that, as would be to be expected. (People don't generally
tolerate such behaviour, so I guess we would have noticed if
activating shib bogged down the server so hard even ssh takes
forever.)

While I don't really believe that anything happening here is the
result of the Debian Shibboleth packaging team changing code you're
best bet is probably asking at there:
https://wiki.debian.org/Teams/DebianShibboleth

> Any ideas?

You could build a current version of the Shibboleth software from
source[1], but unless you know exactly what's happening in your server
right now causing the slowness I think that's pointless. Also because
running the current release on Debian oldoldstable is stil officially
unsupported[2] by the Shibboleth project (the way I understand it).
[1] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxSourceBuild
[2] https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPLinuxInstall

> because i deactivated shibd there is no log.

The symptoms disappear as soon as you deactivate Shibboleth on that
machine?
Also you're not mentioning anything about the machine, assigned
hardware (or virtualized "hardware") resources, usage of these
resources, available (or lack of) entropy, etc.
-peter