Linux Apache Server system security settings and Optimization 1th/3 page _linux

Source: Internet
Author: User
Tags numeric value require dedicated server
The Apache server settings file is located in the/usr/local/apache/conf/directory and traditionally uses three profiles httpd.conf, access.conf, and srm.conf to configure the Apache server's behavior. HTTPD.CONF provides the most basic server configuration, a technical description of how the daemon httpd run, srm.conf is the server's resource mapping file, tells the server the MIME type of various files, and how to support the files; ACCESS.CONF is used to configure access rights for the server, to control access restrictions for different users and computers, and these three profiles control all aspects of the server, so the three files need to be set up to run the server properly.

In addition to these three settings files, Apache uses the Mime.types file to identify the MIME types for different files, and magic files to set some special identities for different MIME type files so that the Apache server cannot determine the MIME type of the file from the document suffix. The MIME type of the document can be judged by these special tags in the contents of the file. [Iaspec@www conf]$ pwd/usr/local/apache/conf [iaspec@www conf]$ ls access.conf httpd.conf.OLD magic.default srm.conf acc Ess.conf.default Httpd.conf.SAVE mime.types Srm.conf.default httpd.conf Magic

The new version of Apache puts all of the configuration parameters in the original httpd.conf, srm.conf, and access.conf in one profile httpd.conf, only for reasons compatible with previous versions ( Use these three settings files in a way that originates from ncsa-httpd to use three profiles. There are no specific settings in the access.conf and srm.conf files provided.

Because in the new version of Apache, all of the settings are placed in the httpd.conf, so you just need to adjust the settings in this file. This article, based on the httpd.conf of Redhat 7.2, explains the various setup options for the Apache server and, of course, its configuration method can be extended to almost all UNIX systems.

Although Apache provides a lot of settings, basically these parameters are very clear, or you can run the Apache server without modification. However, if you need to adjust the performance of the Apache server and increase support for an attribute, you need to understand what these settings parameters mean.

It should be noted that, in addition to operating system performance tuning, the Apache server itself's default configuration is not optimized and most efficient, but to adapt to almost all kinds of operating systems, all kinds of hardware settings, multi-platform software is not possible for specific platforms and specific hardware to provide the most optimized default configuration. So when you want to use Apache, performance tuning is essential.

Relationship between basic configuration and performance optimization of httpd.conf

Httpd.conf first defines some of the parameters that the httpd daemon needs to run in order to determine its operating mode and operating environment. The following is a description of the configuration parameters in the httpd.conf and their various configurations and optimization methods:

(There is no shortcut to optimization, you must first understand the meaning of each configuration)

ServerType Standalone

ServerType defines how the server starts, the default is standalone STANDALONE,HTTPD the server is started by itself and resides in the host to monitor connection requests. The Web server is automatically started in the startup file/etc/rc.d/rc.local/init.d/apache under Linux, which is the recommended setting.

Another way to start the Apache server is to inet, use the Super server inetd to monitor connection requests and start the server. When you need to use the inetd startup method, you need to change this setting, screen the/etc/rc.d/rc.local/init.d/apache file, and change the/etc/inetd.conf and inetd. Then Apache can be launched from the inetd.

The difference between the two approaches is that the server itself manages its own startup process. This allows multiple copies of the server to be started immediately at boot time, with each replica residing in memory, and a connection request that does not require a child process to be processed immediately, responding faster and with higher performance to the client's browser request. The inetd way to start the HTTP server by inetd found that there is a connection request, because inetd to listen to too many ports, so the response is slower, less efficient, but save the connection request when the Web server occupies resources. Therefore, the inetd method is only used on servers that are occasionally accessed and do not require access speed. In fact, the inetd mode is not suitable for the HTTP burst and multiple connection characteristics, because a page may contain multiple images, and each image will cause a connection request, even though the number of visitors to teach less, but a few moments of connection requests, which is limited by inetd performance, It can even affect other server programs that are started by inetd.

ServerRoot "/usr/local"

ServerRoot is used to specify the running directory of the daemon httpd, httpd will automatically change the current directory of the process to this directory after it is started, so if the file or directory specified in the settings file is a relative path, the True path is located under the ServerRoot defined path.

Because the httpd will often do concurrent file operations, you need to use a lock to ensure that the file operation does not conflict, because NFS file system in the file lock ability is limited, so this directory should be a local disk file system, and should not use NFS file system.

# Lockfile/var/lock/httpd.lock

The Lockfile parameter specifies the lock file for the httpd daemon, which generally does not need to be set, and the Apache server automatically operates in the path below ServerRoot. However, if ServerRoot is an NFS file system, you need to use this parameter to specify the path in the local file system to improve read-write speed.

Pidfile/var/run/httpd.pid

Pidfile the specified file will record the process number of the httpd daemon, because httpd can automatically replicate itself, so there are multiple httpd processes in the system, but only one process is the first initiated process, it is the parent process for the other process, and sending a signal to the process affects all httpd processes. The process number of the httpd parent process is recorded in the file defined by the Pidfile.

Scoreboardfile/var/run/httpd.scoreboard

HTTPD uses Scoreboardfile to maintain the internal data of the process, so there is usually no need to change this parameter unless the administrator wants to run several Apache servers on a single computer, and each Apache server requires a separate setup file htt Pd.conf, and use a different scoreboardfile.

#ResourceConfig conf/srm.conf #AccessConfig conf/access.conf

These two parameters, ResourceConfig and AccessConfig, are compatible with the old version of Apache that uses srm.conf and access.conf settings files. If there is no compatible need, the corresponding settings file can be specified as/dev/null, which means that no other settings file exists, and that only one file is used httpd.conf to save all of the setup options.

Timeout 300

Timeout defines a time-out interval for client and server connections that will disconnect the client after this interval (in seconds). If the server is heavily loaded, you can reduce the number appropriately.

KeepAlive on

In HTTP 1.0, a connection can only transmit one HTTP request at a time, and the keepalive parameter is used to support a single connection to HTTP, multiple transfers, which allows multiple HTTP requests to be delivered in a single connection.

Maxkeepaliverequests 100

Maxkeepaliverequests the maximum number of requests for HTTP requests that can be made for a single connection. Setting its value to 0 will support an unlimited transmission request within a single connection. In fact, no client program requests too many pages in a single connection, and usually does not reach the upper limit to complete the connection. You can adjust this number appropriately to get the maximum speed.

KeepAliveTimeout 15

KeepAliveTimeout tests the time between multiple request transfers in a connection, and if the server has completed a request but has not received the next request from the client, the server disconnects after the interval exceeds the value set by this parameter. This value can be adjusted appropriately to free up idle connections as soon as possible. But it's not too small, or most customers will have to reconnect, consuming CPU time.

Minspareservers 5 maxspareservers 10

On a Web server that uses a subprocess to process an HTTP request, the response time is slightly delayed because the child process is first built to process the customer's request. However, the Apache server uses a special technique to get rid of the problem, which is that the pre-generated multiple free child processes reside in the system and are immediately processed using these free subprocess once a request arises, so there is no delay caused by the build child process. As the number of client requests increases in the running, the child processes that are started are increased, but the server replicas do not exit immediately after processing an HTTP request, but stay on the computer for the next request. But the free copy of the child process does not increase the light without decreasing, too many free child processes do not process tasks and consume server processing power, so it is also necessary to limit the number of free copies so that they can be kept in a proper amount so that both the customer request and the unnecessary number of processes can be reduced.

Therefore, you can use parameter minspareservers to set the minimum number of free child processes and use parameter maxspareservers to limit the maximum number of free child processes, and redundant server process replicas will exit. Based on the actual situation of the server to set up, if the server performance is high, and is also frequently accessed, you should increase the settings of these two parameters. For a highly loaded professional web site, the two values should be roughly the same and equal to the maximum number of server replicas supported by the system, as well as unnecessary copy exits.

For example, when the system is high load, you can detect this:

[Iaspec@www iaspec]$ ps-ef|grep APACHE|WC 55. .. [Iaspec@www iaspec]$

This indicates that there are 55 running subprocess at high load, and if this server is a Web dedicated server, you should consider setting the two values to 50, 60, or 40, 70, whichever is the speed test result.

Startservers 5

The Startservers parameter is used to set the number of child process replicas that are started when the httpd is started, and this parameter is related to the minspareservers and maxspareservers parameters defined above and is used to initiate the idle subprocess to increase the server's response speed. This parameter should be set to a numeric value between the first two values, and less than minspareservers and greater than maxspareservers are meaningless.

MaxClients 150

On the other hand, the server's capabilities are limited after all, it is not possible to handle an unlimited number of connection requests at the same time, so the parameter maxclients is used to specify the maximum number of concurrent clients that the server supports, if this value is set too large, When the system is busy, it has to switch between too many processes to service a large number of customers, which slows down the response to each customer and reduces overall efficiency. If this value is set to a lesser size, some client connection requests will be rejected when the system is busy. When server performance is high, you can increase the setting of this value appropriately. For professional Web sites, you should use a strategy to improve server efficiency, so this parameter cannot exceed the hardware itself, and if frequent denial of access occurs, you need to upgrade the server hardware. You can also set this parameter slightly beyond the hardware condition when you are not too concerned with the speed of the response to the client's browser, or if you think that the reaction is slower than rejecting the connection.

But how much is the exact value? When performance requirements are high, you can determine how to configure this parameter in the following ways.

First, estimate the maximum number of concurrent connections you may have, or use the Ps-ef|grep APACHE|WC command to measure the maximum number of processes at high load, usually about twice times the maxclients value. If the current Web site's access speed is acceptable at high load, but there is a denial of service phenomenon, you should increase this parameter, if there is no denial of service phenomenon, but the access speed is slow, you should reduce this value.

This parameter also restricts the minspareservers and maxspareservers settings, which should not be greater than the setting of this parameter.

It's not enough for a load-carrying machine to do just that.

The maximum number of processes that Apache allows to open for requests is the 256,maxclients limit of 256. If the user is more, the user can only see waiting for reply .... Then wait until the next available process appears. The maximum number is the Apache program-its NT version can have 1024, but the UNIX version is only 256, you can include/httpd.h

See: #ifndef hard_server_limit #ifdef WIN32 #define HARD_SERVER_LIMIT 1024 #else #define HARD_SERVER_LIMIT 256 #endif #endi F

You can tune it to 1024 and then compile your system. Remember to change the configuration in httpd.conf.

Maxrequestsperchild 30

A Web service that uses a subprocess to provide a service is a common way to connect a child process to a single connection, causing the problem that each connection requires a system operation to generate and exit the subprocess, making these additional processes occupy the computer's capacity for processing. So the best way to do this is to have a child process that can request services for multiple connections, this does not require these build, exit process system consumption, Apache in this way, once the connection is over, the child process does not quit, but stay in the system waiting for the next service request, which greatly improve performance.

However, due to the continuous application and release of memory in the process of neutron processing, more times will cause some memory garbage, which will affect the stability of the system and affect the efficient utilization of system resources. Thus, after a certain number of requests have been processed by a copy, a copy of the child process can be exited and a clean copy is replicated from the original httpd process, which can improve the stability of the system. In this way, the number of service requests processed by each subprocess is defined by Maxrequestperchild. The default setting value is 30, which is overly conservative for Linux systems with high stability characteristics, can be set to 1000 or higher, and is set to 0 to support unlimited service processing for each replica.

#Listen 3000 #Listen 12.34.56.78:80 #BindAddress *

The Listen parameter can specify that the server monitors HTTP requests for other ports in addition to the standard 80 ports. Because the system can have multiple IP addresses at the same time, you can also specify that the server listens only for HTTP requests to an IP address of a bindaddress</b>;. If this is not configured, the server responds to requests for all IP.

Even if the bindaddress parameter is used, the server responds only to requests for one IP address, but by using the extended listen parameter, the HTTP daemon can still be allowed to respond to requests for other IP addresses. The use of the list en parameter is the same as the second example above. This more complex usage is primarily used to set up a virtual host. After that, you can define a virtual host for different IP with the VirtualHost parameter, but this usage is the method of setting up the virtual Host in the earlier HTTP 1.0 standard, each need an IP address for a virtual host, in fact it is not very useful. In HTTP 1.1, the support of the virtual host of single IP address multi domain is increased, which makes the setting of the virtual host more significant.
Current 1/3 page 123 Next read the full text
Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.