Bruce Grant's Tech Blog 
Border
Comments0 CommentsAdd CommentAdd CommentPermalinkPermalink
Author: Bruce Grant, Jr. (BX)
Published: April 6, 2008
Installing an Apache Server on Ubuntu 7.10
How I got my server up Part V: a Guide for Linux Novices
This guide will walk through how to install and configure an Apache web server on a newly installed Ubuntu Linux Server and is meant for the complete Linux novice. The guide assumes readers have a moderate degree of experience with Apache and web servers in general. This is the fifth installment of a series of articles explaining the technologies used to bring this web site online.
Ubuntu configures Apache differently than on other Linux distros and other operating systems. This guide will walk you through installing Apache, familiarize you with these setup differences and show you how I configured Apache to do the basic things I wanted: virtual hosts, ssl, redirect rules, etc.

Assumptions
This guide assumes that you have a working knowledge of Apache and networking in general. It also assumes you have "sysvconfig" installed to manage services:
sudo apt-get install sysvconfig
Copy


  1. Installing Apache on Ubuntu
    1. Installation
      Lets begin by installing the software we need: apache and ssl.
      sudo apt-get install apache2 apache2-common openssl
      Copy

      FYI: Apache runs by default with this user/group: www-data/www-data
      Start/Stop Apache
      Copy
      sudo service apache2 start sudo service apache2 stop sudo service apache2 restart
    2. Understanding Apache on Ubuntu
      Ubuntu organizes Apache differently than other platforms. Instead of having a single httpd.conf that contains module load statements, define virtual hosts and general config Ubuntu breaks things into separate files that in theory make it easier to manage your apache config. I'll leave it up to you if you think it's better.
      Ubuntu Apache Config Unveiled
      Copy
      1 /etc/apache2/apache2.conf 2 /etc/apache2/ports.conf 3 /etc/apache2/mods-available 4 /etc/apache2/mods-enabled 5 /etc/apache2/sites-available 6 /etc/apache2/sites-enabled
      Line 1.
      The main apache conf file. You should only need to touch it to change global directory settings and your document root.
      Line 2.
      Which ports apache should listen on Listen 80, Listen 443
      Line 3.
      Which apache modules are available - they've been downloaded and installed but may or may not be enabled.
      Line 4.
      Which modules are enabled - only these are usable (read on below for how to manage these)
      Line 5.
      Which sites are available. A site is essentially a virtual host. You break them out into separate files and those files go in here.
      Line 6.
      Which sites have been enabled (read on below for how to manage these).
    3. Modules
      Modules are first-class citizens: they are activated/deactivated using a command-line application.
      Module Management
      Copy
      1 sudo a2enmod ssl 2 sudo a2enmod cache 3 sudo a2enmod disk_cache 4 sudo a2enmod rewrite 5 sudo a2enmod expires 6 sudo a2enmod deflate 7 sudo a2enmod headers 8 9 sudo a2dismod ssl
      Line 1.
      I use mod_ssl, mod_cache, mod_disk_cache, mod_rewrite, mod_expires, mod_delfate and mod_headers. These show how to enable them. Not install them, enable them.
      Line 9.
      This shows how to disable a module: here I disable ssl.
    4. Sites
      If you have a simple site then everything is already configured for you. Simply create the directory /var/www/apache2-default and start putting your files in it. You're done. If you have a more complex site and you wish to create virtual hosts things are more complicated.

      If you need to create one or more virtual hosts then create one file for each virtual host in this directory: /etc/apache2/sites-available. You can put them all in one file in that directory if you like; these files are simply included in the main apache conf by debian scripts for you. If you have just one, modify the default "site" by modifying the file in that directory named default.

      The default site is enabled by default (duh). If you create another then you'll have to enable it using this command sudo a2ensite nameOfSiteFile and to later disable sudo a2dissite nameOfSiteFile.
    5. Security Concerns
      Two settings in the main apache configuration file need to be changed from their default value to make apache a little more secure.
      sudo nano /etc/apache2/apache2.conf
      Copy

      Modify Apache Settings for Security
      Copy
      1 # This tells apache not to return its version number or info about 2 # installed modules and your OS version to clients. 3 ServerTokens Prod 4 5 # This tells apache not to rerurn its version number in errors 6 # returned to clients. 7 ServerSignature Off
      Line 3.
      Search in the apache2.conf file for ServerTokens and change it to Prod. While not a huge deal if you don't make this change it only takes one exploit in a module for it to become a big deal.
      Line 7.
      Search in the apache2.conf file for ServerSignature and change the value to Off. Again, not a huge deal unless someone gets your Apache version number and finds a known eploit because of it. Chances of this happening aren't that good, but why take a chance.
    6. My Virtual Host Configuration
      I'm going to post my configuration and explain it both so you can benefit and so later on when I forget why I did something, I'll have a doc to help me remember :).

      I just modified the existing default configuration so:
      sudo nano /etc/apache2/sites-available/default
      Copy

      Here's the virtual host config I use which is actually two virtual hosts in the same file (one for non-ssl and one for ssl).
      Code Annotations
      I've embedded comments around major blocks within the virtual host file content but there are also a few detailed comments as annotations at the end of the code block. Click on the annotation row number at the bottom and it will hilight the row in question in the code. Have fun.

      My Virtual Host Configuration
      Copy
        1 # This turns on name virtual hosts for port 80 (the default port)   2 NameVirtualHost *:80   3   4 # This turns on name virtual hosts for the ssl port   5 NameVirtualHost *:443   6   7 # This virtual host will respond to requests on the default web port   8 <VirtualHost *:80>   9  10 # Tells apache the name of the server (bxgrant.com) and to apply this  11 # VirtualHost block to all subdomains in bxgrant.com (*.bxgrant.com)  12 ServerName bxgrant.com  13 ServerAlias *.bxgrant.com  14  15 # The directory apache will look for all resources (web pages, etc.) in  16 DocumentRoot /www/bxgrant.com  17  18 # These are used for error logs and reporting  19 ServerAdmin admin@myemailaddr.com  20 ErrorLog /var/log/apache2/host.com-error.log  21 CustomLog /var/log/apache2/host.com-access.log combined  22  23 # Possible values include: debug, info, notice, warn, error, crit,  24 # alert, emerg.  25 LogLevel warn  26  27 # This tells apache not to put its version number in error messages  28 ServerSignature Off  29  30 # These are used for zipping content sent to browsers  31 # to make it faster to get to the browser  32 DeflateCompressionLevel 9  33 DeflateFilterNote Output output_info  34 DeflateFilterNote Ratio ratio_info  35 LogFormat '"%r" %{output_info}n/%{input_info}n (%{ratio_info}n%%)' deflate  36 CustomLog /var/log/apache2/deflate_log deflate  37  38 # These are the mime types I choose to zip on their way to the browser  39 AddOutputFilterByType DEFLATE text/html  40 AddOutputFilterByType DEFLATE application/xhtml+xml  41 AddOutputFilterByType DEFLATE text/plain  42 AddOutputFilterByType DEFLATE text/xml  43 AddOutputFilterByType DEFLATE application/xml  44 AddOutputFilterByType DEFLATE text/css  45 AddOutputFilterByType DEFLATE application/rss+xml  46 AddOutputFilterByType DEFLATE application/atom+xml  47 AddOutputFilterByType DEFLATE application/rdf+xml  48 AddOutputFilterByType DEFLATE application/x-javascript  49 AddOutputFilterByType DEFLATE text/javascript  50  51 # The next three fix browsers that can't deal with zipping  52 # Netscape 4.x has some problems...  53 BrowserMatch ^Mozilla/4 gzip-only-text/html  54  55 # Netscape 4.06-4.08 have some more problems  56 BrowserMatch ^Mozilla/4\.0[678] no-gzip  57  58 # MSIE masquerades as Netscape, but it is fine  59 BrowserMatch \bMSIE !no-gzip !gzip-only-text/html  60  61 # These are used to bypass normal processing and pull resources  62 # from a disk cache instead.  63 CacheRoot /bxdb/apache_cache  64 CacheEnable disk /static_files  65 CacheEnable disk /user_files  66 CacheDefaultExpire 31536000  67 CacheMaxExpire 31536000  68 CacheMaxFileSize 52428800  69 CacheIgnoreCacheControl On  70 CacheIgnoreNoLastMod On  71 CacheIgnoreHeaders Set-Cookie  72 CacheDirLevels 2  73 CacheDirLength 1  74  75 # This turns on the generation of cache-control and expiration headers  76 ExpiresActive On  77  78 # This turns on rewrite rules  79 RewriteEngine On  80 RewriteLog /var/log/apache2/host.com-rewrite_log  81 RewriteLogLevel 1  82  83 # If a URL comes in from just bxgrant.com redirect to www.bxgrant.com  84 RewriteCond %{HTTP_HOST} !^www\.bxgrant\.com [NC]  85 RewriteCond %{HTTP_HOST} !^$  86 RewriteRule ^/(.*) http://www.bxgrant.com/$1 [L,R]  87  88 # If a URL comes into the root www.bxgrant.com, redirect to the /home directory  89 RewriteCond %{REQUEST_URI} ^/$  90 RewriteRule ^/$ http://www.bxgrant.com/home [L,R]  91  92 # Do an internal redirect for any url with bx_static_files to hit a Java  93 # webapp named main_files  94 RewriteRule ^/static_files/(.*)$ /main_files/bx_static_files/$1 [PT,L]  95  96 # Rewrite all urls that come in to the main_files web application  97 # EXCEPT for those listed below  98 RewriteCond %{REQUEST_URI} !^/bx_static_files  99 RewriteCond %{REQUEST_URI} !^/bx_wally_files 100 RewriteCond %{REQUEST_URI} !^/bx_users_files 101 RewriteCond %{REQUEST_URI} !^/favicon.ico 102 RewriteRule ^/(.*)$ /main_files/action_files/$1 [PT,L] 103 104 # Make sure proxies don't deliver the wrong content 105 Header append Vary User-Agent env=!dont-vary 106 <LocationMatch "/[^.]+.(gif|jpg|png|wav|mp3)"> 107 Allow from All 108 </LocationMatch> 109 110 <Directory /> 111 # ... 112 </Directory> 113 114 <Directory /www/bxgrant.com> 115 # ... 116 </Directory> 117 118 <Directory /bxmedia_files/users_files> 119 # ... 120 </Directory> 121 122 Alias /users_files /bxmedia_files/users_files 123 124 <Location "/main_files/*"> 125 ExpiresByType image/gif "access plus 1 years" 126 ExpiresByType image/png "access plus 1 years" 127 ExpiresByType image/jpeg "access plus 1 years" 128 ExpiresByType image/jpg "access plus 1 years" 129 ExpiresByType image/bmp "access plus 1 years" 130 ExpiresByType text/css "access plus 1 years" 131 ExpiresByType application/x-javascript "access plus 1 years" 132 133 JkMount ajp13_worker 134 </Location> 135 136 <Location "/users_files/*"> 137 ExpiresByType image/gif "access plus 1 years" 138 ExpiresByType image/png "access plus 1 years" 139 ExpiresByType image/jpeg "access plus 1 years" 140 ExpiresByType image/jpg "access plus 1 years" 141 ExpiresByType image/bmp "access plus 1 years" 142 ExpiresByType text/css "access plus 1 years" 143 ExpiresByType application/x-javascript "access plus 1 years" 144 </Location> 145 146 </VirtualHost> 147 148 # My SSL virtual host. Most values are the same as the main vhost above 149 <VirtualHost *:443> 150 ServerAdmin admin@myemailaddr.com 151 ServerName bxgrant.com 152 ServerAlias *.bxgrant.com 153 DocumentRoot /www/bxgrant.com 154 ErrorLog /var/log/apache2/bxgrant.com-error.log 155 CustomLog /var/log/apache2/bxgrant.com-access.%Y-%m.log combined 156 157 # This turns SSL on 158 SSLEngine On 159 SSLProxyEngine on 160 161 # These are my certificates 162 SSLCertificateFile /.../.../.../www.bxgrant.com.crt 163 SSLCertificateKeyFile /.../.../.../www.bxgrant.com.key 164 SSLCertificateChainFile /.../.../.../gd_intermediate_bundle.crt 165 166 <Location "/main_files/*"> 167 ExpiresDefault "now" 168 JkMount ajp13_worker 169 </Location> 170 </VirtualHost>
      Line 32.
      If you haven't heard about mod_deflate then you're in for a treat. This module will zip up files on their way to a web browser. This can provide a significant benefit to a user's experience; especially if you have a lot of Javascript. Be careful to configure it correctly so you don't try to zip things that are already compressed like images. I choose to specifically state what types of files I'll allow to be zipped in lines 39 - 49. Also, lines 53, 56 and 59 are boiler plate rules to prevent browsers with issues from getting zipped content. If you're interested don't forget to first enable it: sudo a2enmod deflate.
      Line 63.
      If you care about performance you'll want to turn on disk caching with mod_disk_cache and mod_cache. A full description of apache caching is way beyond the scope of this article but here are the hilights of what I'm doing. Any file returned from the URI /static_files will be cached for a year. That path leads to Javascript and CSS files which do change from time to time but not that often. I wrote a little tool that detects what files have changed and gives them a new unique name when I deploy into production on the server and also changes dependent HTML files that use the newly named files. That way the new file is found and cached instead of the old now defunct Javascript or CSS files. Yes, it is a little fragile but with a little discipline I reap huge performance benefits. The largest files of my site (JS, CSS and images) are all served from cache.
      Line 76.
      I'm turning on the ability to control what cache-control headers are returned to web browsers so I can tell the browsers how long to cache files before returning to my server to get them. Below I'll show you how I'm using this feature in conjunction with apache disk caching to get a screaming fast web site. The module that governs this is mod_expires.
      Line 79.
      I'm turning on apache rewriting using mod_rewrite so I can modify some URLs that come in. Certainly this one of Apache's most useful features.
      Line 84.
      This line through line 102 make use of URL rewriting. Look at comments embedded above the rules to explain what they do. Many sites use similar rules.
      Line 125.
      This line through 1ine 131 are the rules that use mod_rewrite to tell the browser how long to hold onto a file in the browser cache before coming to the sever to get it again. I can be aggressive with my caching because when a file is modified, as I said above, I detect it and give the modified file a new name. I'm telling the browser to hold onto the file for a year.
      Line 133.
      This is for hooking Apache to Tomcat. Tomcat will be the subject of my next article and I'll wait to explain this line until then.
Tags
                   
Comments
Be the first to add a comment.
Add a Comment
User:
Anonymous (Login or Create Account or Help)
Add Comment Reset
Border