Administration Guide Draft/Apache

Installing Apache Web Server
The basic  functionality, serving static web sites, is provided by the   rpm package. To install Apache, run:

su -c "/usr/bin/yum install httpd"

Unless the requirement is to run a very basic web site, the more convenient way of installing the Apache web server is:

su -c "/usr/bin/yum groupinstall 'Web Server'"

In addition to the package, the command above installs software needed to run Apache with the support for database driven web sites, support for common web scripting languages, such as ,  , and  , Apache documentation provided by   rpm package and support for serving secure, encrypted content through   protocol.

Admonition("Tip","The  package group can be installed during Fedora installation, using the option to customize software packages.")

To start the Apache server, run:

su -c "/sbin/service httpd start"

To test the correct operation of the Apache server, point the web browser to. If the browser displays Fedora Test Page, the Apache is installed correctly.

To configure the Apache server to start at the boot time, run:

su -c "/sbin/chkconfig httpd on"

Configuring Apache web server
There are a few characteristic directories that contain files needed for proper operation of the Apache web server:

/etc/httpd:: The location of Apache configuration files, referred to as.

/usr/lib/httpd/modules:: The location of various Apache modules, loaded on demand from the main configuration file.

/var/www:: Default location for storing web site content.

/var/log/httpd:: The location of the Apache log files.

The main Apache configuration file is. At the minimum, there are only two directives in this file that need to be specified to enable Apache to serve the content over the Internet, The name to which server responds and the location of the web site content on the system. To serve the web content for www.example.com, these two entries are:

ServerName www.example.com:80 DocumentRoot "/var/www/html"

Reload the configuration file for these changes to take effect:

su -c "/sbin/service httpd reload"

Admonition("Note","This configuration assumes that www.example.com resolves correctly in DNS and that the content for the web site is in the, the default    in Fedora.")

file includes instructions for almost all of the configuration options in the form of comments, ie. the lines beginning with  character. This feature makes the configuration file very long and does not allow quick changes to it. However, the  directive within a file provides a way for splitting the configuration file into smaller, more manageable sections. The line:

Include conf.d/*.conf

causes the  daemon to read all   files placed in the   directory, in addition to to a main configuration file, during start up process. The common use of  files is to have separate configuration files for various Apache extensions or virtual hosts.

includes numerous options for configuring the Apache web server. Other notable options are:


 * Performance tuning:
 * limits the number of allowed simultaneous connections to the server and works together with the   option.
 * allows for a number of concurrent HTTP requests over a single TCP connection.
 * instructs the  daemon when to stop responding if it is under heavy load.

Admonition("Warning","Apache performance tuning is the art of managing the trade-off against the benefit. It requires good understanding of the server's capabilities and seldom improves by including arbitrary parameters.")


 * Log configuration:
 * points to the location where the server's errors are logged.
 * sets the verbosity of the   entries.
 * points to the location where the requests are logged.

Admonition("Tip","The Apache web server logs the requests and errors to  and   by default.")


 * Other configuration options:
 * associates files with certain extension to certain languages. Useful when the web server serves pages in multiple languages.
 * loads dynamically shared objects.
 * specifies the location of CGI scripts.
 * specifies who is the server administrator.
 * maps scripts to script handlers, such as,  , etc.

Admonition("Note","Refer to the Apache documentation in the === Additional Information === section for the extensive list of the Apache configuration options and their usage.")

Virtual Hosts
The Apache web server has the ability to serve the content for multiple sites from the single server through the concept of Virtual Hosts. Virtual hosts can be configured in two ways:


 * IP based Virtual Hosts:
 * Each virtual host has its own IP address and port combination.
 * Required for serving HTTPS requests, due to restrictions in the SSL protocol.


 * Name based Virtual Hosts:
 * All virtual hosts share the common IP address.
 * The Apache web server responds to the request by mapping the  header in the request to    and    directives in the particular virtual host's configuration file.

The example of the simple name based virtual hosts configuration:

NameVirtualHost *:80  ServerName localhost 
 * 1) global configuration options

 ServerName example.com ServerAlias www.example.com DocumentRoot /var/www/virtual/example.com/html 

 ServerName foobar.com ServerAlias www.foobar.com DocumentRoot /var/www/virtual/foobar.com/html 

The order in which the virtual hosts are listed is significant to the extent that the Apache will always serve the content from the first listed virtual host in case the request was made for the site that is resolvable in DNS but not defined as a   or a.

Admonition("Tip","Once the first   is defined, all of the content served by Apache must also be moved into virtual hosts.")

Apache File Security
By default, the  daemon runs as the user and group. Therefore, all files that the  needs to access to operate properly must be accessible by user. The safe way to accomplish this is to set the ownership on all of the files to another user and allow read-only access to all other users. For example, to allow read-only access to www.foobar.com content, so it can be served over the Internet, run the following:

su -c "/bin/chown -R root.root /var/www/virtual/foobar.com" su -c "/bin/chmod 755 /var/www/virtual/foobar.com /var/www/virtual/foobar.com/html" su -c "/bin/chmod 644 /var/www/virtual/foobar.com/html/*"

In case the content should be readable by the Apache and nobody else, the good practice is to change the group ownership to group  and deny access to others.

User-level ownership on files should be granted to the  user only if the web server is expected to modify the files, for example, through the use of CGI scripts.

Apache Access Controls
To control the access to the content served by the Apache web server, use the,  , and   directives, within the   container directive. To allow access to the content of www.foobar.com:

 Order deny,allow 

The  directive controls the behavior of how the access to the content is evaluated and sets the default precedence if   and   directives are not defined:


 * defaults to "allow access"
 * defaults to "deny access"

The latter value always overrides the former. For example, to allow access to all hosts on the 192.168.1 subnet and deny the host with the 192.168.1.66 IP address, add these options:

 Order allow,deny Allow from 192.168.1. Deny from 192.168.1.66 

SELinux Notes
The best way to avoid SELinux errors while running Apache is to store the Apache related files in the default system locations. If this is not possible, the solution is to change the SELinux context on non-standard directories, using default ones as a reference:

su -c "/usr/bin/chcon -R --reference=/etc/httpd/conf /path/to/new/conf"

or

su -c "/usr/bin/chcon -R --reference=/var/www/html /path/to/site/content"

Related Web Sites

 * The official Apache web server web site

Installed Documentation

 * - requires  rpm package