Server Configuration

Certain directives are used to configure your server's overall operations. These directives are placed in the httpd.conf configuration file. Some require pathnames, whereas others only need to be turned on or off with the keywords on and off. Apache provides a default httpd.conf configuration file. The httpd.conf file already contains these directives. Some are commented out with a preceding # symbol. You can activate a directive by removing its # sign. Many of the entries are preceded by comments explaining their purpose. Several of the commonly used server level directives are listed in Table 22-4. The following is an example of the ServerAdmin directive used to set the address where users can send mail for administrative issues. You replace the you@your.address entry with the address you want to use to receive system administration mail. By default, this is set to root@localhost.

# ServerAdmin: Your address, where problems should be e-mailed.
ServerAdmin you@your.address

Some directives require specific information about your system. For example, ServerName holds the hostname for your Web server. Specifying a hostname is important to avoid unnecessary DNS lookup failures that can hang your server. Notice the entry is commented with a preceding #. Simply remove the # and type your Web server's hostname in place of new.host.name.

# ServerName allows you to set a hostname which is sent
# back to clients for your server if it's different than the
# one the program would get (i.e. use
# "www" instead of the host's real name).
   
#ServerName new.host.name

On Red Hat systems, entries have already been made for the standard Web server installation using /var/www as your Web site directory. You can tailor your Web site to your own needs by changing the appropriate directives. The DocumentRoot directive determines the home directory for your Web pages. The ServerRoot directive specifies where your Web server configuration, error, and log files are kept.

DocumentRoot /var/www/html
ServerRoot /etc/httpd

The MaxClients directive sets the maximum number of clients that can connect to your server at the same time.

MaxClients 150

Directory-Level Configuration: .htaccess and <Directory>

One of the most flexible aspects of Apache is its ability to configure individual directories. With the Directory directive, you can define a block of directives that apply only to a particular directory. Directory directives are listed in Table 22-5. Such a directive can be placed in the httpd.conf or access.conf configuration file. You can also use an .htaccess file within a particular directory to hold configuration directives. Those directives are then applied only to that directory. The name ".htaccess" is actually set with the AccessFileName directive. You can change this if you want.

AccessFileName .htaccess

A Directory block begins with a <Directory pathname> directive, where pathname is the directory to be configured. The ending directive uses the same <> symbols, but with a slash preceding the word "Directory": </Directory>. Directives placed within this block apply only to the specified directory. The following example denies access to only the mypics directory by requests from www.myvids.com.

<Directory /var/www/html/mypics>
Order Deny,Allow
Deny from www.myvids.com
</Directory>

With the Options directive, you can enable certain features in a directory, such as the use of symbolic links, automatic indexing, execution of CGI scripts, and content negotiation. The default is the All option, which turns on all features except content negotiation (Multiviews). The following example enables automatic indexing (Indexes), symbolic links (FollowSymLinks), and content negotiation (Multiviews).

Options Indexes FollowSymLinks Multiviews

Configurations made by directives in main configuration files or in upper-level directories are inherited by lower-level directories. Directives for a particular directory held in .htaccess files and Directory blocks can be allowed to override those configurations. This capability can be controlled by the AllowOverride directive. With the all argument, .htaccess files can override any previous configurations. The none argument disallows overrides, effectively disabling the .htaccess file. You can further control the override of specific groups of directives. AuthConfig enables use of authorization directives, FileInfo is for type directives, Indexes is for indexing directives, Limit is for access control directives, and Options is for the options directive.

AllowOverride all

Access Control

With access control directives, such as allow and deny, you can control access to your Web site by remote users and hosts. Access control directives are listed in Table 22-6. The allow directive followed by a list of hostnames restricts access to only those hosts. The deny directive with a list of hostnames denies access by those systems. The argument all applies the directive to all hosts. The order directive specifies in what order the access control directives are to be applied. Other access control directives, such as require, can establish authentication controls, requiring users to log in. The access control directives can be used globally to control access to the entire site or placed within Directory directives to control access to individual directives. In the following example, all users are allowed access:

order allow,deny
allow from all

You can further qualify access control directives by limiting them to certain HTML access methods. HTML access methods are ways a browser interacts with your Web site. For example, a browser could get information from a page (GET) or send information through it (POST). You can control such access methods using the <Limit> directive. Limit takes as its argument a list of access methods to be controlled. The directive then pairs with a </Limit> directive to define a Limit block within which you can place access control directives. These directives apply only to the specified access methods. You can place such Limit blocks with a Directory block to set up controls of access methods for a specific directory. The following Directory block in the /etc/config/httpd.conf file controls access methods for your Web site's home directory, /var/www/html.

# This should be changed to whatever you set DocumentRoot to.
<Directory /var/www/html>
   Options Indexes FollowSymLinks
   AllowOverride All
   <Limit GET>
     order allow,deny
     allow from all
   </Limit>
</Directory>

Controls are inherited from upper-level directories to lower-level ones. If you want to control access strictly on a per-directory basis to your entire Web site, you can use the following entry to deny access to all users. Then, in individual directories, you can allow access to certain users, groups, or hosts.

<Directory /var/www/html>
 Order Deny,Allow
 Deny from All
</Directory>

URL Pathnames

Certain directives can modify or complete pathname segments of a URL used to access your site. The pathname segment of the URL specifies a particular directory or Web page on your site. Directives enable you to alias or redirect pathnames, as well as to select a default Web page. With the Alias directive, you can let users access resources located in other parts of your system, on other file systems, or on other Web sites. An alias can use a URL for sites on the Internet, instead of a pathname for a directory on your system. With the Redirect directive, you can redirect a user to another site.

Alias /mytrain /home/dylan/trainproj
Redirect /mycars http://www.myautos.com/mycars

If Apache is given only a directory to access, rather than a specific Web page, it looks for an index Web page located in that directory and displays it. The possible names for a default Web page are listed by the DirectoryIndex directive. The name usually used is index.html, but you can add others. The standard names are shown here. When Apache is given only a Web directory to access, it looks for and displays the index.html Web page located in it.

DirectoryIndex index.html index.shtml index.cgi

Apache also lets a user maintain Web pages located in a special subdirectory in the user's home directory, rather than in the main Web site directory. Using a ~ followed by the username accesses this directory. The name of this directory is specified with the UserDir directive. The default name is public_html, as shown here. The site turtle.mytrek.com/~dylan accesses the directory turtle.mytrek.com/home/dylan/public_html on the host turtle.mytrek.com.

UserDir public_html

MIME Types

When a browser accesses Web pages on a Web site, it is often accessing many different kinds of objects, including HTML files, picture or sound files, and script files. To display these objects correctly, the browser must have some indication of what kind of objects they are. A JPEG picture file is handled differently from a simple text file. The server provides this type information in the form of MIME types (see Chapter 13). MIME types are the same types used for sending attached files through Internet mailers, such as Pine. Each kind of object is associated with a given MIME type. Provided with the MIME type, the browser can correctly handle and display the object.

The MIME protocol associates a certain type with files of a given extension. For example, files with a .jpg extension would have the MIME type image/jpeg. The TypesConfig directive holds the location of the mime.types file, which lists all the MIME types and their associated file extensions. DefaultType is the default MIME type for any file whose type cannot be determined. AddType enables you to modify the mime.type types list without editing the MIME file.

TypesConfig /etc/mime.types
DefaultType text/plain

Other type directives are used to specify actions to be taken on certain documents. AddEncoding lets browsers decompress compressed files on the fly. AddHandler maps file extensions to actions, and AddLanguage enables you to specify the language for a document. The following example marks filenames with the .gz extension as gzip-encoded files and files with the .fr extension as French language files:

AddEncoding x-gzip gz
AddLanguage fr .fr

A Web server can display and execute many different types of files and programs. Not all Web browsers are able to display all those files, though. Older browsers are the most limited. Some browsers, such as Lynx, are not designed to display even simple graphics. To allow a Web browser to display a page, the server negotiates with it to determine the type of files it can handle. To enable such negotiation, you need to enable the Multiviews option.

Option multiviews

CGI Files

Common Gateway Interface (CGI) files are programs that can be executed by Web browsers accessing your site. CGI files are usually initiated by Web pages that execute the program as part of the content they display. Traditionally, CGI programs were placed in a directory called cgi-bin and could only be executed if they resided in such a special directory. Usually, only one cgi-bin directory exists per Web site. Distributions will normally set up a cgi-bin directory in the default Web server directory (/var/www/cgi-bin on Red Hat). Here, you place any CGI programs that can be executed on your Web site. The ScriptAlias directive specifies an alias for your cgi-bin directory. Any Web pages or browsers can use the alias to reference this directory.

ScriptAlias /cgi-bin/ /var/www/cgi-bin/

If you want to execute CGI programs that reside anywhere on your Web site, you can specify that files with a .cgi extension are treated as executable CGI programs. You do this with the AddHandler directive (see Table 22-7). This directive applies certain handlers to files of a given type. The handler directive to do this is included in the default httpd.conf file, provided with the Apache source code files, though commented out. You can remove the comment symbol (#) to enable it.

AddHandler cgi-script cgi

Automatic Directory Indexing

When given a URL for a directory instead of an HTML file, and when no default Web page is in the directory, Apache creates a page on the fly and displays it. This is usually only a listing of the different files in the directory. In effect, Apache indexes the items in the directory for you. You can set several options for generating and displaying such an index. Indexing directives are listed in Table 22-8. If FancyIndexing is turned on, Web page items are displayed with icons and column headers that can be used to sort the listing.

FancyIndexing on

Icon directives tell Apache what icon to display for a certain type of file. The AddIconByType and AddIconByEncoding directives use MIME-type information to determine the file's type and then associate the specified image with it. AddIcon uses the file's extension to determine its type.

With the IndexOptions directive, you can set different options for displaying a generated index. Options exist for setting the heights and widths of icons and filenames. The IconsAreLinks option makes icons part of filename anchors. The ScanHTMLTitles option reads the titles in HTML documents and uses those to display entries in the index listing instead of filenames. Various options exist for suppressing different index display features such as sorting, descriptions, and header/readme inserts.

Authentication

Your Web server can also control access on a per-user or per-group basis to particular directories on your Web site. You can require various levels for authentication. Access can be limited to particular users and require passwords, or expanded to allow members of a group access. You can dispense with passwords altogether or set up an anonymous type of access, as used with FTP. Authentication directives are shown in Table 22-9.

To apply authentication directives to a certain directory, you place those directives within either a Directory block or the directory's .htaccess file. You use the require directive to determine what users can access the directory. You can list particular users or groups. The AuthName directive provides the authentication realm to the user, the name used to identify the particular set of resources accessed by this authentication process. The AuthType directive specifies the type of authentication, such as basic or digest. A require directive requires also AuthType, AuthName, and directives specifying the locations of group and user authentication files. In the following example, only the users george, robert, and mark are allowed access to the newpics directory:

<Directory /var/www/html/newpics
     AuthType Basic
     AuthName Newpics
     AuthUserFile /web/users
     AuthGroupFile /web/groups
     <Limit GET POST>
        require users george robert mark
     </Limit>
</Directory>

The next example allows group access by administrators to the CGI directory:

<Directory /var/www/html/cgi-bin
     AuthType Basic
     AuthName CGI
     AuthGroupFile /web/groups
   <Limit GET POST>
        require groups admin
   </Limit>
</Directory>

To set up anonymous access for a directory, place the Anonymous directive with the user anonymous as its argument in the directory's Directory block or .htaccess file. You can also use the Anonymous directive to provide access to particular users without requiring passwords from them.

Apache maintains its own user and group authentication files specifying what users and groups are allowed to which directories. These files are normally simple flat files, such as your system's password and group files. They can become large, however, possibly slowing down authentication lookups. As an alternative, many sites have used database management files in place of these flat files. Database methods are then used to access the files, providing a faster response time. Apache has directives for specifying the authentication files, depending on the type of file you are using. The AuthUserfile and AuthGroupFile directives are used to specify the location of authentication files that have a standard flat file format. The AuthDBUserFile and AuthDBGroupFile directives are used for DB database files, and the AuthDBMGUserFIle and AuthDBMGGroupFile are used for DBMG database files.

The programs htdigest, htpasswd, and dbmmanage are tools provided with the Apache software package for creating and maintaining user authentication files, which are user password files listing users who have access to specific directories or resources on your Web site. htdigest and htpasswd manage a simple flat file of user authentication records, whereas dbmmanage uses a more complex database management format. If your user list is extensive, you may want to use a database file for fast lookups. htdigest takes as its arguments the authentication file, the realm, and the username, creating or updating the user entry. htpasswd can also employ encryption on the password. dbmmanage has an extensive set of options to add, delete, and update user entries. A variety of different database formats are used to set up such files. Three common ones are Berkeley DB2, NDBM, and GNU GBDM. dbmmanage looks for the system libraries for these formats in that order. Be careful to be consistent in using the same format for your authentication files.

Log Files

Apache maintains logs of all requests by users to your Web site. By default, these logs include records using the Common Log Format (CLF). The record for each request takes up a line composed of several fields: host, identity check, authenticated user (for logins), the date, the request line submitted by the client, the status sent to the client, and the size of the object sent in bytes. Log file directives are listed in Table 22-10.

FormatLog "%h %l %u %t \"%r\" %s %b"

"%h %l %u %t \"%r\" %s %b\"%{Referer}i\" \"%{User-agent}i\"".

FormatLog "%h %l %u %t \"%r\" %s %b"
# Create a new log file called myprojlog using the FormatLog format
TransferLog myprojlog
# Create a new log file called mypicslog using its own format
CustomLog mypicslog "%h %l %u %t \"%r\" %s %b"