About the Apache Web Server
Apache is the most widely used web server on the Internet today, according to a Netcraft survey of active websites in January 2005, which is shown in Table 21.1.
Table 21.1. Netcraft Survey Results (January 2005)
/Web Server / Number / Percentage /
Apache / 39,821,368 / 68.43%
Microsoft[*] / 12,137,446 / 20.86%
SunONE / 1,830,008 / 3.14%
Zeus / 690,193 / 1.19%
[*] All web server products
Note that these statistics do not reflect Apache's use on internal networks, known as intranets.
The name Apache appeared during the early development of the software because it was "a patchy" server, made up of patches for the freely available source code of the NCSA HTTPd web server. For a while after the NCSA HTTPd project was discontinued, a number of people wrote a variety of patches for the code, to either fix bugs or add features they wanted. A lot of this code was floating around and people were freely sharing it, but it was completely unmanaged.
After a while, Brian Behlendorf and Cliff Skolnick set up a centralized repository of these patches, and the Apache project was born. The project is still composed of a small core group of programmers, but anyone is welcome to submit patches to the group for possible inclusion in the code.
There's been a surge of interest in the Apache project over the past several years, partially buoyed by a new interest in open source on the part of enterprise-level information services. It's also due in part to crippling security flaws found in Microsoft's Internet Information Services (IIS); the existence of malicious web task exploits; and operating system and networking vulnerabilities to the now-infamous Code Red, Blaster, and Nimda worms. IBM made an early commitment to support and use Apache as the basis for its web offerings and has dedicated substantial resources to the project because it makes more sense to use an established, proven web server.
In mid-1999, The Apache Software Foundation was incorporated as a nonprofit company. A board of directors, elected on an annual basis by the ASF members, oversees the company. This company provides a foundation for several open-source software development projects, including the Apache Web Server project.
The best places to find out about Apache are the Apache Software Foundation's website, http://www.apache.org/, and the Apache Week website, http://www.apacheweek.com/, where you can subscribe to receive Apache Week by email to keep up on the latest developments in the project, keep abreast of security advisories, and research bug fixes.
Tip
You'll find an overview of Apache in the Apache Software Foundation's frequently asked questions (FAQs) at http://httpd.apache.org/docs-2.0/faq/. In addition to extensive online documentation, you can also find the complete documentation for Apache in the HTML directory of your Apache server. You can access this documentation by looking at http://localhost/manual/index.html on your new Fedora system with one of the web browsers included on your system. You'll need to have Apache running on your system!
Fedora ships with Apache 2.0, and the server (named httpd) is included on this book's CD-ROMs and DVD. You can obtain the latest version of Apache as an RPM installation file from a Fedora FTP server; upgrade using up2date, yum, or apt-get; or get the source code from the Apache website and, in true Linux tradition, build it for yourself.
To determine the version of Apache included with your system, use the web server's -V command-line option like this:
$ /usr/sbin/httpd -V | cat
Server version: Apache/2.0.50
Server built: Jun 29 2004 11:11:55
Server's Module Magic Number: 20020903:8
Architecture: 32-bit
Server compiled with....
The output displays the version number, build date and time, platform, and various options used during the build. You can use the -v option to see terser version information.
Tip
In the previous command, we piped to the cat command because your machine might have SELinux configured to stop Apache writing to the terminal.
Installing the Apache Server
You can install Apache from RPMs or build it yourself from source code. The Apache source builds on just about any UNIX-like operating system and on Win32. If you elect to install the Web Server group of files when first installing Fedora, Apache and related software and documentation in 17 packages are installed automatically.
If you're about to install a new version of Apache, you should shut down the old server. Even if it's unlikely that the old server will interfere with the installation procedure, shutting it down ensures that there will be no problems. If you don't know how to stop Apache, see the "Starting and Stopping Apache" section later in this chapter.
Installing from the RPM
You can find the Apache RPM on the Fedora Core installation media, on the Fedora FTP server, or at one of its many mirror sites. Check the fedora.redhat.com site as often as possible to download updates as they become available. Updated RPM files usually contain important bug and security fixes. When an updated version is released, install it as quickly as possible to keep your system secure.
Note
Check the Apache site for security reports. Browse to http://httpd.apache.org/security_report.html for links to security vulnerabilities for Apache 1.3 and 2.0. Subscribe to a support list or browse through up-to-date archives of all Apache mailing lists at http://httpd.apache.org/mail/ (for various articles) or http://httpd.apache.org/lists.html (for comprehensive and organized archives).
If you want the most recent, experimental version of Apache for testing, check Red Hat's Rawhide distribution, which is also available on the Fedora FTP server (http://download.fedora.redhat.com/pub/fedora/linux/core/development/). This distribution is experimental and always contains the latest versions of all RPMs. However, note that the Apache package might depend on new functionality available in other RPMs. Therefore, you might need to install many new RPMs to be able to use packages from Rawhide. If you still want to use an Apache version from the Rawhide distribution for testing, a better option might be to download the source code RPM (SRPM) and compile it yourself. That way, you avoid dependencies on other new packages. (Refer to the "Working with Source RPM Files" section in Chapter 7, "Managing Software," for information about building and installing packages from SRPM files.)
Caution
You should be wary of installing experimental packages, and never install them on production servers (that is, servers used in "real life"). Very carefully test the packages beforehand on a host that isn't connected to a network!
After you have obtained an Apache RPM, you can install it with the command-line rpm tool by typing the following:
rpm -Uvh latest_apache.rpm
where latest_apache.rpm is the name of the latest Apache RPM. For more information on installing packages with RPM, refer to Chapter 7.
The Apache RPM installs files in the following directories:
· /etc/httpd/conf— This directory contains the Apache configuration file, httpd.conf. See the section "Configuring Apache for Peak Performance" later in this chapter for more information.
· /etc/rc.d/— The tree under this directory contains the system startup scripts. The Apache RPM installs a startup script named httpd for the web server under the /etc/rc.d/init.d directory. This script, which you can use to start and stop the server from the command line, also automatically starts and stops the server when the computer is halted, started, or rebooted.
· /var/www— The RPM installs the default server icons, Common Gateway Interface (CGI) programs, and HTML files in this location. If you want to keep web content elsewhere, you can do so by making the appropriate changes in the server configuration files.
· /var/www/ manual/— If you've installed the apache-manual RPM, you'll find a copy of the Apache documentation in HTML format here. You can access it with a web browser by going to http://localhost/manual/.
· /usr/share/man— Fedora's Apache RPM also contains man pages, which are placed underneath this directory. For example, the httpd man page is in section 8 of the man directory.
· /usr/sbin— The executable programs are placed in this directory. This includes the server executable itself, as well as various utilities.
· /usr/bin— Some of the utilities from the Apache package are placed here—for example, the htpasswd program, which is used for generating authentication password files.
· /var/log/httpd— The server log files are placed in this directory. By default, there are two important log files (among several others): access_log and error_log. However, you can define any number of custom logs containing a variety of information. See the "Logging" section, later in this chapter, for more detail.
· /usr/src/redhat/SOURCES/— This directory might contain a tar archive containing the source code for Apache and, in some cases, patches for the source. You must have installed the Apache SRPM for these files to be created.
When Apache is being run, it also creates the file httpd.pid, containing the process ID of Apache's parent process in the /var/run/ directory.
Note
If you are upgrading to a newer version of Apache, RPM doesn't write over your current configuration files. RPM moves your current files and appends the extension .rpmnew to them. For example, srm.conf becomes srm.conf.rpmnew.
Building the Source Yourself
There are several ways to obtain the source code for Apache. The Fedora Project provides SRPMs containing the source of Apache, which includes patches to make it work better with the Fedora Core distribution. The most up-to-date, stable binary version for Fedora can be installed via RPM packages using the up2date command or by installing a source RPM from Fedora's source repository (browse to http://fedora.redhat.com and then click the Download link). When you install one of these SRPMs, a tar archive containing the Apache source is created in /usr/src/redhat/SOURCES/.
You can also download the source directly from http://www.apache.org/. The latest version at the time of this writing (2.0.50) is a 6MB compressed tape archive, and the latest pre-2.0 version of Apache is 1.3.31. Although many sites continue to use the older version (for script and other compatibility reasons), many new sites are migrating to or starting out using the latest stable version.
After you have the tar file, you must unroll it in a temporary directory, such as /tmp. Unrolling this tar file creates a directory called apache_version_number, where version_number is the version you've downloaded (for example, apache_1.3.21).
There are two ways to compile the source—the old, familiar way (at least, to those of us who have been using Apache for many years) by editing makefile templates, and the new, easy way using a configure script. You'll first see how to build Apache from source the easy way. The configure script offers a way to have the source software automatically configured according to your system. However, manually editing the configuration files before building and installing Apache provides more control over where the software is installed and which capabilities or features are built in to Apache.
Tip
As with many software packages distributed in source code form for Linux and other UNIX-like operating systems, extracting the source code results in a directory that contains a README and an INSTALL file. Be sure to peruse the INSTALL file before attempting to build and install the software.
Using ./configure to Build Apache
To build Apache the easy way, run the ./configure script in the directory just created. You can provide it with a --prefix argument to install it in a directory other than the default, which is /usr/local/apache/. Use this command:
# ./configure --prefix=/preferred/directory/
This generates the makefile that's used to compile the server code.
Next, type make to compile the server code. After the compilation is complete, type make install as root to install the server. You can now configure the server via the configuration files. See the "Runtime Server Configuration Settings" section, later in this chapter, for more information.
Tip
A safer way to install a new version of Apache from source is to use the ln command to create symbolic links of the existing file locations (listed in the "Installing from the RPM" section earlier in this chapter) to the new locations of the files. This method is safer because the default install locations are different from those used when the RPM installs the files. Failure to use this installation method could result in your web server process not being started automatically at system startup.
Another safe way to install a new version of Apache is to first back up any important configuration directories and files (such as /etc/httpd) and then use the rpm command to remove the server. You can then install and test your new version and, if needed, easily restore your original server and settings.
It is strongly recommended that you use Fedora's RPM version of Apache until you really know what happens at system startup. No "uninstall" option is available when installing Apache from source!
Apache File Locations After a Build and Install
Files are placed in various subdirectories of /usr/local/apache (or whatever directory you specified with the --prefix parameter) if you build the server from source. Before version 1.3.4, files were placed in /usr/local/etc/httpd.
The following is a list of the directories used by Apache, as well as brief comments on their usage: