Page 1/3 of linux Apache server system security settings and Optimization

The configuration file of the Apache server is located in the/usr/local/apache/conf/directory. Traditionally, three configuration files are used: httpd. conf, access. conf and srm. conf to configure the behavior of the Apache server. Httpd. conf provides the most basic server configuration, which is a technical description of how the daemon httpd runs. srm. conf is the server's resource ing file, which tells the server of the MIME types of various files and how to support these files; access. conf is used to configure Server access permissions and control access restrictions for different users and computers. These three configuration files control all aspects of the server, therefore, to run the Server properly, you need to set these three files.

In addition to these three settings files, Apache also uses mime. the types file is used to identify the MIME types corresponding to different files. The magic file sets some special identifiers for different MIME types, so that the Apache server cannot determine the MIME types of files from the document suffix, the MIME type of a document can be determined by these special tags in the file content. [Iaspec @ www conf] $ pwd/usr/local/apache/conf [iaspec @ www conf] $ ls access. conf httpd. conf. OLD magic. default srm. conf access. conf. default httpd. conf. SAVE mime. types srm. conf. default httpd. conf magic mime. types. default

The new version of Apache will be httpd. conf, srm. conf and access. all configuration parameters in conf are placed in a configuration file httpd. conf only uses three configuration files for compatibility with previous versions (NCSA-httpd is used to use these three configuration files. The access. conf and srm. conf files provided do not have specific settings.

In the new version of Apache, all the settings are placed in httpd. conf, so you only need to adjust the settings in this file. Based on httpd. conf in redhat 7.2, this article explains the configuration options of the Apache server. Of course, the configuration method can be extended to almost all unix systems.

Although Apache provides many set parameters, these parameters are basically clear, and you can run the Apache server without modifying them. However, if you need to adjust the performance of the Apache server and increase support for certain features, you need to understand the meaning of these settings parameters.

It should be noted that, apart from the performance adjustment of the operating system, the default configuration of the Apache server itself is by no means optimal and most efficient, however, to adapt to the configurations of almost all types of operating systems and all types of hardware, multi-platform software cannot provide optimal default configurations for specific platforms and hardware. Therefore, performance adjustment is essential when Apache is used.

Relationship between httpd. conf basic configuration and Performance Optimization

Httpd. conf defines the parameters required by the httpd daemon to determine the running mode and environment. The following describes the configuration parameters in httpd. conf and their configuration and Optimization Methods one by one:

(There are no shortcuts to optimization. you must first understand the meaning of each configuration)

ServerType standalone

ServerType defines the server startup mode. The default value is standalone. The httpd server will be started by itself and will stay in the host to monitor connection requests. In Linux, the Web server will be automatically started in the startup file/etc/rc. d/rc. local/init. d/apache. This method is recommended.

An inet method is another way to start the Apache server. The super server inetd is used to monitor connection requests and start the server. When you need to use the inetd startup method, you need to change it to this setting and block/etc/rc. d/rc. local/init. d/apache file, and change/etc/inetd. conf and restart inetd, then Apache can start from inetd.

The difference between the two methods is that the independent method is that the server itself manages its own startup processes, so that multiple copies of the server can be started immediately at startup, and each copy will reside in the memory, A connection request can be processed immediately without the need to generate a sub-process. The response to client browser requests is faster and the performance is high. The inetd method requires inetd to start the http server only after detecting a connection request. Because inetd needs to listen to too many ports, the response is slow and the efficiency is low, however, this saves the resources occupied by the Web server when no connection request is available. Therefore, the inetd method is only used on servers that are occasionally accessed and do not require access speed. In fact, the inetd method is not suitable for http burst and multi-connection features, because a page may contain multiple images, and each image will cause a connection request, even though the number of visitors causes less teaching, however, there are many transient connection requests, which are limited by the inetd performance and may even affect other server programs started by inetd.

ServerRoot "/usr/local"

ServerRoot is used to specify the running directory of the daemon httpd. After httpd is started, the current directory of the process is automatically changed to this directory. Therefore, if the file or directory specified in the file is set to a relative path, the actual path is located under the path defined by ServerRoot.

Because httpd often performs concurrent file operations, it is necessary to use the locking method to ensure that file operations do not conflict. Due to the limited file lock capabilities of the NFS file system, therefore, this directory should be a local disk file system instead of an NFS file system.

# LockFile/var/lock/httpd. lock

The LockFile parameter specifies the lock file of the httpd daemon. Generally, you do not need to set this parameter. The Apache server will automatically perform operations in the path under ServerRoot. However, if ServerRoot is an NFS file system, you need to use this parameter to specify the path in the local file system to increase the read/write speed.

PidFile/var/run/httpd. pid

The process Number of the httpd daemon is recorded in the file specified by PidFile. Because httpd can automatically copy itself, there are multiple httpd processes in the system, but only one process is the process initially started, it is the parent process of other processes. sending signals to this process affects all httpd processes. The process Number of the httpd parent process is recorded in the file defined by PidFILE.

ScoreBoardFile/var/run/httpd. scoreboard

Httpd uses ScoreBoardFile to maintain internal data of a process. Therefore, you do not need to change this parameter unless the administrator wants to run several Apache servers on a computer, at this time, each Apache server requires an independent configuration file htt pd. conf, and use different ScoreBoardFile.

# ResourceConfig conf/srm. conf # AccessConfig conf/access. conf

The two parameters ResourceConfig and AccessConfig are used to be compatible with the old version of Apache that uses the srm. conf and access. conf file. If there is no compatibility requirement, you can specify the corresponding setting file as/dev/null. This indicates that no other setting file exists and only httpd is used. conf file to save all the settings.

Timeout 300

Timeout defines the Timeout interval between the client program and the server. After the Timeout interval (in seconds) is exceeded, the server will be disconnected from the client. If the server load is heavy, you can reduce this number as appropriate.

KeepAlive On

In HTTP 1.0, only one HTTP request can be transmitted over one connection. The KeepAlive parameter is used to support one connection and multiple transmission over HTTP, in this way, multiple HTTP requests can be transmitted in a connection.

MaxKeepAliveRequests 100

MaxKeepAliveRequests is the maximum number of HTTP requests that a connection can perform. Setting this value to 0 will allow unlimited transmission requests in one connection. In fact, no client program requests too many pages in a single connection. Generally, the connection is completed if this limit is not reached. You can reduce this number to get the maximum speed.

KeepAliveTimeout 15

KeepAliveTimeout tests the time between multiple requests in a connection. If the server has completed a request but has never received the next request from the client program, after the interval exceeds the value set by this parameter, the server will be disconnected. You can adjust this value to release idle connections as soon as possible. But it cannot be too small. Otherwise, most customers will have to reconnect, which will consume CPU time.

MinSpareServers 5 MaxSpareServers 10

On the Web server that uses a sub-process to process HTTP requests, the response time is delayed because the sub-process must be generated first to process the customer's requests. However, the Apache server uses a special technique to get rid of this problem. This means that multiple idle sub-processes are generated in advance and reside in the system. Once a request appears, immediately use these idle sub-processes for processing, so that there is no latency caused by the generation of sub-processes. As client requests increase, the number of sub-processes started increases. However, these server copies do not exit immediately after an HTTP request is processed, instead, wait in the computer for the next request. However, the number of idle sub-process Replicas cannot be increased or decreased. Too many idle sub-processes do not process tasks and occupy the server's processing capabilities. Therefore, the number of idle copies must be limited, maintain a proper number of processes so that you can respond to customer requests in a timely manner and reduce the number of unnecessary processes.

Therefore, you can use the MinSpareServers parameter to set the minimum number of idle sub-processes, and use the MaxSpareServers parameter to limit the maximum number of idle sub-processes. Redundant server process copies will exit. Set according to the actual situation of the server. If the server has high performance and is frequently accessed, you should increase the settings of these two parameters. For high-load professional websites, these two values should be roughly the same, and are equivalent to the maximum number of server replicas supported by the system, and unnecessary copies should be removed.

For example, when the system is under high load, you can perform the following checks:

[Iaspec @ www iaspec] $ ps-ef | grep apache | wc 55... [iaspec @ www iaspec] $

This indicates that there are 55 sub-processes running at a high load. If this server is a dedicated WEB server, you should set these two values to 50, 60, or 40, 70, respectively, the specific speed test results shall prevail.

StartServers 5

The StartServers parameter is used to set the number of subprocess replicas started at httpd startup. this parameter is related to the MinSpareServers and MaxSpareServers parameters defined above, it is used to start idle sub-processes to speed up server response. This parameter should be set to a value between the first two values, which is less than MinSpareServers and greater than MaxSpareServers.

MaxClients 150

On the other hand, the server's capabilities are limited after all, and it is impossible to process an infinite number of connection requests at the same time. Therefore, the Maxclients parameter is used to specify the maximum number of concurrent access customers supported by the server, if this value is set too large, the system has to switch between too many processes during busy hours to serve too many customers. This slows down the response to each customer, and reduced the overall efficiency. If this value is set to a small value, some customer connection requests will be rejected when the system is busy. When the server performance is high, you can add this setting as appropriate. For professional websites, the policy to improve server efficiency should be used. Therefore, this parameter cannot exceed the hardware limit. If access is frequently denied, the server hardware needs to be upgraded. If you do not care much about the response speed to your browser, or think that the response speed is slower than rejecting the connection, you can set this parameter slightly beyond the hardware conditions.

But how many values are appropriate? When the performance requirement is high, you can use the following method to determine how to configure this parameter.

First, estimate your maximum number of concurrent connections, or use the ps-ef | grep apache | wc command to measure the maximum number of processes at high loads, generally, MaxClients is about twice the value. If the current website can be accessed at a high load, but there is a denial of service phenomenon, you should increase this parameter. If there is no denial-of-service phenomenon, but the access speed is slow, this value should be reduced.

This parameter also limits the settings of MinSpareServers and MaxSpareServers. They should not be greater than the settings of this parameter.

This is not enough for heavy-load machines.

The maximum number of processes allowed for requests in Apache is 256, and the limit of MaxClients is 256. if there are more users, you can only see Waiting for reply .... wait until the next available process appears. The maximum number is determined by the Apache program-its NT Version can have 1024, but the Unix version only has 256. You can include/httpd. h

See: # ifndef HARD_SERVER_LIMIT # ifdef WIN32 # define HARD_SERVER_LIMIT 1024 # else # define HARD_SERVER_LIMIT 256 # endif

You can tune it to 1024 and then compile your system. Remember to change the configuration in httpd. conf.

MaxRequestsPerChild 30

A sub-process is a commonly used method for providing Web services. A sub-process is a connection service, the problem is that each connection requires system operations to generate and exit sub-processes, so that these additional processes occupy a large amount of processing capabilities of the computer. Therefore, the best way is that a sub-process can connect to the service for multiple times, so that the system consumption of the generated and exited processes is not required. Apache uses this method. After a connection is completed, the sub-process does not exit, but stays in the system waiting for the next service request, which greatly improves the performance.

However, due to the constant application and release of memory in the processing process, a large number of times may cause some memory spam, which will affect the system stability and the effective use of system resources. Therefore, after a copy has been processed for a certain number of requests, the sub-process can exit the copy and re-copy a clean copy from the original httpd process, in this way, the system stability can be improved. In this way, the number of service requests processed by each sub-process is defined by MaxRequestPerChild. The default value is 30. This value is too conservative for Linux systems with high stability and can be set to 1000 or higher, set to 0 to support unlimited service processing for each copy.

# Listen 3000 # Listen 12.34.56.78: 80 # BindAddress *

The Listen parameter allows the server to monitor HTTP requests from other ports in addition to the standard port 80. Because the system can have multiple IP addresses at the same time, you can also specify that the server only listens to HTTP requests for an IP address of a BindAddress </B>. If this item is not configured, the server will respond to requests from all IP addresses.

Even if the BindAddress parameter is used, the server can only respond to requests from one IP address. However, by using the extended Listen parameter, the HTTP daemon can still respond to requests from other IP addresses. In this case, the List en parameter is used in the same way as the second example above. This complex usage is mainly used to set up virtual hosts. The VirtualHost parameter can be used to define virtual hosts with different IP addresses. However, this method is used to set virtual hosts in the earlier HTTP 1.0 standard. Each virtual host requires an IP address, in fact, it is not very useful. In HTTP 1.1, the support for single-IP multi-domain virtual hosts is added, making the virtual host settings more meaningful.