Apache configuration file: http. conf configuration details

Description of the HTTP. conf parameter in the Apache configuration file

Apache configuration is configured in the httpd. conf file. Therefore, the following configuration commands are all modified in the httpd. conf file.
Configuration of the primary site (basic configuration)

(1) Basic Configuration:
Serverroot "/mnt/software/apache2" # location of your Apache software installation. If no absolute path is specified for other specified directories, the directory is relative to this directory.

Pidfile logs/httpd. pid # the location of the Process number file of the first HTTPd process (parent process of all other processes.

Listen 80 # Port Number of the server listener.

Servername www.clusting.com: 80 # main site name (website host name ).

Serveradmin admin@clusting.com # administrator email address.

DocumentRoot "/mnt/web/clusting" # webpage storage location of the primary site.

Access Control for the Directory of the main site is as follows:

<Directory "/mnt/web/clusting">
Options followsymlinks
AllowOverride none
Order allow, deny
Allow from all
</Directory>

The preceding Directory attribute configuration mainly includes the following options:

Options: What features are used for configuration in a specific directory? common values and basic meanings are as follows:

Execcgi: Execute CGI scripts in this directory.

Followsymlinks: in this directory, the file system is allowed to use symbols to connect.

Indexes: if the user cannot find the main page file specified by directoryindex(for example, index.html), the list of files in the directory is returned to the user.

SymLinksIfOwnerMatch: a symbolic connection is accessible only when the owner of the symbolic connection is the same as the owner of the actual file.

For other available values and meanings, see: http://www.clusting.com/Apache/ApacheManual/mod/core.html#options

AllowOverride: indicates the type of the command that is allowed to exist in the. htaccess file. The file name of the. htaccess file can be changed. The file name is determined by the AccessFileName command ):
None: When AllowOverride is set to None. Do not search for. htaccess files in this directory (you can reduce the server overhead ).

All: All commands can be used in the. htaccess file.

For other available values and meanings (for example, Options FileInfo AuthConfig Limit), see: http://www.clusting.com/Apache/ApacheManual/mod/core.html#AllowOverride

Order: control which of the Allow and Deny access rules takes precedence during access:

Allow: List of hosts that can be accessed (available domain names or subnets, for example, Allow from 192.168.0.0/16 ).

Deny: List of Access Denied hosts.

For more detailed usage, see: http://www.clusting.com/Apache/ApacheManual/mod/mod_access.html#order

DirectoryIndex index.html index.htm index. php # settings of the home page file (in this example, the home page file is set to index.html, index.htm and index. php)

(2) server optimization (MPM: Multi-Processing Modules)
The main advantage of apache2 is that it provides better support for multi-processor, and uses the-with-mpm option to determine the working mode of apache2 during compilation. If you know the working mechanism used by apache2, you can use the httpd-l command to list all modules of apache:

Prefork: If httpd-l lists prefork. c, you need to configure the following segments:

<IfModule prefork. c>

StartServers 5 # Number of httpd processes started when apache is started.

MinSpareServers 5 # minimum number of idle processes maintained by the server.

MaxSpareServers 10 # maximum number of idle processes maintained by the server.

MaxClients 150 # maximum number of concurrent connections.

MaxRequestsPerChild 1000 # the number of times each sub-process is killed after it is requested for service. 0 indicates no restriction. We recommend that you set it to 1000.

</IfModule>

In this mode, five httpd processes are started after the server is started (six parent processes are added, which can be seen through the ps-ax | grep httpd command ). When a user connects, apache uses an idle process to serve the connection, and the parent process fork a sub-process. Until the idle process in the memory reaches MaxSpareServers. This mode is used to be compatible with earlier versions of programs. My default options during compilation.
Worker: If httpd-l lists worker. c, you need to configure the following sections:

<IfModule worker. c>

StartServers 2 # Number of httpd processes started when apache is started.

MaxClients 150 # maximum number of concurrent connections.
IXDBA. NET Community Forum

MinSpareThreads 25 # minimum number of Idle threads maintained by the server.

MaxSpareThreads 75 # maximum number of Idle threads maintained by the server.

ThreadsPerChild 25 # Number of threads produced by each sub-process.

MaxRequestsPerChild 0 # the number of times each sub-process is killed after it is requested for service. 0 indicates no restriction. We recommend that you set it to 1000.

</IfModule>

This mode is used by threads to listen to customer connections. When a new client connects, one of the Idle threads accepts the connection. The server starts two processes at startup. The number of threads produced by each process is fixed (determined by ThreadsPerChild). Therefore, there are 50 threads at startup. When 50 threads are insufficient, the server automatically forks a process and generates 25 more threads.

Perchild: If httpd-l lists perchild. c, you need to configure the following segments:

<IfModule perchild. c>

NumServers 5 # Number of sub-processes started at server startup

StartThreads 5 # Number of threads started when each sub-process starts

MinSpareThreads 5 # minimum number of Idle threads in the memory

MaxSpareThreads 10 # maximum number of Idle threads

MaxThreadsPerChild 2000 # maximum number of requests to each thread before exiting. 0 is not restricted.

MaxRequestsPerChild 10000 # the number of times each sub-process is fork again. 0 indicates no restriction.

</IfModule>

In this mode, the number of sub-processes is fixed and the number of threads is not limited. When the client is connected to the server, Idle threads provide services. If the number of Idle threads is insufficient, the child process automatically generates threads to serve the new connection. This mode is used for multi-site servers.
(3) HTTP return header configuration:

ServerTokens Prod # This parameter sets the apache version information returned by the http header. The available values and meanings are as follows:

Prod: only the software name, for example, apache
Major: includes the main version number, for example, apache/2.
Minor: contains the Minor version number, for example, apache/2.0.
Min: only the complete apache version, for example, apache/2.0.54
OS: includes the operating system type, for example, apache/2.0.54 (Unix)
Full: Includes modules and module versions supported by apache, such as Apache/2.0.54 (Unix) mod_ssl/2.0.54 OpenSSL/0.9.7g
ServerSignature Off # whether the server version information is displayed when an error occurs on the page. Recommended to Off

(4) persistent connection settings

KeepAlive On # enable the persistent connection function. That is, when the client connects to the server, the connection status remains unchanged after the data is downloaded.

MaxKeepAliveRequests 100 # maximum number of requests for a connection service.

KeepAliveTimeout 30 # How long does the connection last? If no data is requested for the connection, the connection is closed. The default value is 15 seconds.

Alias settings
For pages that are not in the directory specified by DocumentRoot, you can use a symbolic connection or an alias. The alias settings are as follows:

Alias/download/"/var/www/download/" # You can enter: http://www.custing.com/download/ when accessing

<Directory "/var/www/download"> # Set access control for this Directory
Options Indexes MultiViews
AllowOverride AuthConfig
Order allow, deny
Allow from all
</Directory>

CGI settings

Scr listen ptAlias/cgi-bin/"/mnt/software/apache2/cgi-bin/" # access can: http://www.clusting.com/cgi-bin. However, the CGI script file in this directory must have the executable permission!

<Directory "/usr/local/apache2/cgi-bin"> # Set Directory Properties
AllowOverride None
Options None
Order allow, deny
Allow from all
</Directory>

Personal Homepage settings (public_html)

UserDir public_html (the user's home page is stored in the public_html directory under the user's home directory URL http://www.clusting.com /~ Bearzhang/file.html will read the/home/bearzhang/public_html/file.html file)

Chmod 755/home/bearzhang #

Allows other users to read the file.

UserDir/var/html (the URL http://www.clusting.com /~ Bearzhang/file.html will read/var/html/bearzhang/file.html)

UserDir/var/www/*/docs (the URL http://www.clusting.com /~ Bearzhang/file.html will read/var/www/bearzhang/docs/file.html)

Log Settings

(1) Setting of error logs
ErrorLog logs/error_log # log storage location
IXDBA. NET Community Forum
LogLevel warn # Log Level

Displayed in the following format:
[Mon Oct 10 15:54:29 2005] [error] [client 192.168.10.22] access to/download/failed, reason: user admin not allowed access

(2) access log settings

The default log formats are as follows:
LogFormat "% h % l % u % t" % r "%> s % B" % {Referer} I "" % {User-Agent} I "combined
LogFormat "% h % l % u % t" % r "%> s % B" common # common is the log format name
LogFormat "% {Referer} I-> % U" referer
LogFormat "% {User-agent} I" agent
CustomLog logs/access_log common

Parameters in the format are as follows:

% H-Client IP address or host name

% L-The RFC 1413 identity determined by The client identd. The output symbol "-" indicates that The information here is invalid.

% U-name of the customer accessing the webpage obtained by the HTTP Authentication System. Valid only when authentication is available. The "-" symbol in the output indicates that the information here is invalid.

% T-time when the server completes processing the request.

"% R"-the quotation marks indicate the request content sent by the customer that contains many useful information.

%> S-the status code returned by the server to the client.

% B-the last response is the number of bytes that are returned to the client, excluding the response header.

"% {Referer} I"-This item indicates the webpage from which the request was submitted.

"% {User-Agent} I"-This item is the browser identification information provided by the customer's browser.

The following is an example of an access log:
192.168.10.22-bearzhang [10/Oct/2005: 16: 53: 06 + 0800] "GET/download/HTTP/1.1" 200 1228
192.168.10.22--[10/Oct/2005: 16: 53: 06 + 0800] "GET/icons/blank.gif HTTP/1.1" 304-
192.168.10.22--[10/Oct/2005: 16: 53: 06 + 0800] "GET/icons/back.gif HTTP/1.1" 304-

For a detailed explanation of each parameter, see: http://www.clusting.com/Apache/ApacheManual/logs.html

User Authentication Configuration
(1) in the httpd. conf:
AccessFileName. htaccess
.........
Alias/download/"/var/www/download /"
<Directory "/var/www/download">
Options Indexes
AllowOverride AuthConfig
</Directory>
(2) create a password file:
/Usr/local/apache2/bin/htpasswd-c/var/httpuser/passwords bearzhang

(3) onfigure the server to request a password and tell the server which users are allowed access.
Vi/var/www/download/. htaccess:
AuthType Basic
AuthName "Restricted Files"
AuthUserFile/var/httpuser/passwords
Require user bearzhang
# Require valid-user # all valid user

Virtual Host Configuration
(1) ip address-based Virtual Host Configuration
Listen 80
<VirtualHost 172.20.30.40>
DocumentRoot/www/example1
ServerName www.example1.com
</VirtualHost>
<VirtualHost 172.20.30.50>
DocumentRoot/www/example2
ServerName www.example2.org
</VirtualHost>

(2) IP-based and multi-port Virtual Host Configuration
Listen 172.20.30.40: 80
Listen 172.000030.40: 8080
Listen 172.20.30.50: 80
Listen 172.20.30.50: 8080

<VirtualHost 172.20.30.40: 80>
DocumentRoot/www/example1-80
ServerName www.example1.com
</VirtualHost>

<VirtualHost 172.20.30.40: 8080>
DocumentRoot/www/example1-8080
ServerName www.example1.com
</VirtualHost>

<VirtualHost 172.20.30.50: 80>
DocumentRoot/www/example2-80
ServerName www.example1.org
</VirtualHost>

<VirtualHost 172.20.30.50: 8080>
DocumentRoot/www/example2-8080
ServerName www.example2.org
</VirtualHost>

(3) domain name-based VM configuration on a server with a single IP Address:
# Ensure that Apache listens on port 80
Listen 80

# Listen for virtual host requests on all IP addresses
NameVirtualHost *: 80

<VirtualHost *: 80>
DocumentRoot/www/example1
ServerName www.example1.com
ServerAlias example1.com. * .example1.com
# Other directives here
</VirtualHost>

<VirtualHost *: 80>
DocumentRoot/www/example2
ServerName www.example2.org
# Other directives here
</VirtualHost>

(4) configure a domain name-based VM on a server with multiple IP addresses:
Listen 80

# This is the "main" server running on 172.20.30.40
ServerName server.domain.com
DocumentRoot/www/mainserver

# This is the other address
NameVirtualHost 172.20.30.50

<VirtualHost 172.20.30.50>
DocumentRoot/www/example1
ServerName www.example1.com
# Other directives here...
</VirtualHost>
IXDBA. NET Community Forum

<VirtualHost 172.20.30.50>
DocumentRoot/www/example2
ServerName www.example2.org
# Other directives here...
</VirtualHost>

(5) run different sites on different ports (configure a domain name-based virtual host on a multi-port server ):
Listen 80
Listen 8080.

NameVirtualHost 172.20.30.40: 80
NameVirtualHost 172.000030.40: 8080

<VirtualHost 172.20.30.40: 80>
ServerName www.example1.com
DocumentRoot/www/domain-80
</VirtualHost>

<VirtualHost 172.20.30.40: 8080>
ServerName www.example1.com
DocumentRoot/www/domain-8080
</VirtualHost>

<VirtualHost 172.20.30.40: 80>
ServerName www.example2.org
DocumentRoot/www/otherdomain-80
</VirtualHost>

<VirtualHost 172.20.30.40: 8080>
ServerName www.example2.org
DocumentRoot/www/otherdomain-8080
</VirtualHost>

(6) configuration of domain name-based and IP-based Hybrid Virtual Hosts:
Listen 80

NameVirtualHost 172.20.30.40

<VirtualHost 172.20.30.40>
DocumentRoot/www/example1
ServerName www.example1.com
</VirtualHost>

<VirtualHost 172.20.30.40>
DocumentRoot/www/example2
ServerName www.example2.org
</VirtualHost>

<VirtualHost 172.20.30.40>
DocumentRoot/www/example3
ServerName www.example3.net
</VirtualHost>

SSL encryption Configuration

First, you should first understand some basic concepts before configuring:

Certificate concept: First, you must have a root certificate, and then use the root certificate to issue the server certificate and customer certificate. Generally, the server certificate and customer certificate are in a hierarchical relationship. Server certificates must be installed for SSL authentication. Therefore, in this environment, you must have at least three certificates: Root Certificate, server certificate, and client certificate. Before a certificate is generated, a private key is usually used to generate a certificate request with the private key, and then use the root certificate of the Certificate Server to issue the certificate.

The certificate used by SSL can be generated by itself or through a commercial certificate
CA (such as Verisign or Thawte) signs the certificate.

Question about issuing a certificate: if you are using a commercial certificate, please refer to the instructions of the relevant vendors for specific signing methods; if you are a friend-issued certificate, you can use the CA that comes with openssl. sh script tool.
IXDBA. NET Community Forum

If a certificate is not issued for a separate client, the client certificate does not need to be generated. The client and the server use the same certificate.
(1) The main parameter configurations in the conf/ssl. conf configuration file are as follows:

Listen 443.
SSLPassPhraseDialog buildin
# SSLPassPhraseDialog exec:/path/to/program
SSLSessionCache dbm:/usr/local/apache2/logs/ssl_scache
SSLSessionCacheTimeout 300
SSLMutex file:/usr/local/apache2/logs/ssl_mutex

<VirtualHost _ default _: 443>

# General setup for the virtual host
DocumentRoot "/usr/local/apache2/htdocs"
ServerName www.example.com: 443
ServerAdmin you@example.com
ErrorLog/usr/local/apache2/logs/error_log
TransferLog/usr/local/apache2/logs/access_log

SSLEngine on
SSLCipherSuite ALL :! ADH :! EXPORT56: RC4 + RSA: + HIGH: + MEDIUM: + LOW: + SSLv2: + EXP: + eNULL

SSLCertificateFile/usr/local/apache2/conf/ssl. crt/server. crt
Sslcertificatekeyfile/usr/local/apache2/CONF/SSL. Key/server. Key
Customlog/usr/local/apache2/logs/ssl_request_log "% T % H % {ssl_protocol} X % {ssl_cipher} X" % R "% B"

</Virtualhost>

(2) create and use self-signed certificates:
A. Create a RSA private key for your Apache server
/Usr/local/OpenSSL/bin/OpenSSL genrsa-des3-out/usr/local/apache2/CONF/SSL. Key/server. Key 1024

B. Create a Certificate Signing Request (CSR)
/Usr/local/OpenSSL/bin/OpenSSL req-New-key/usr/local/apache2/CONF/SSL. key/server. key-out/usr/local/apache2/CONF/SSL. key/server. CSR

C. Create a self-Signed CA certificate (X509 structure) with the RSA key of the CA
/Usr/local/OpenSSL/bin/OpenSSL req-X509-days 365-key/usr/local/apache2/CONF/SSL. key/server. key-in/usr/local/apache2/CONF/SSL. key/server. CSR-out/usr/local/apache2/CONF/SSL. CRT/server. CRT

/Usr/local/openssl/bin/openssl genrsa 1024-out server. key
/Usr/local/openssl/bin/openssl req-new-key server. key-out server. csr
/Usr/local/openssl/bin/openssl req-x509-days 365-key server. key-in server. csr-out server. crt

(3) create your own CA (certificate) and use the CA to sign the server certificate.
Mkdir/CA
Cd/CA
Cp openssl-0.9.7g/apps/CA. sh/CA
./CA. sh-newca
Openssl genrsa-des3-out server. key 1024
Openssl req-new-key server. key-out server. csr
Cp server. csr newreq. pem
./CA. sh-sign
Cp newcert. pem/usr/local/apache2/conf/ssl. crt/server. crt
Cp server. key/usr/local/apache2/conf/ssl. key/

 

Link: http://www.demi.cn/archives/482