# Apache/Print version

The current, editable version of this book is available in Wikibooks, the open-content textbooks collection, at
https://en.wikibooks.org/wiki/Apache

# Introduction

Apache is primarily used to serve both static content and dynamic Web pages on the World Wide Web. Many web applications are designed expecting the environment and features that Apache provides.
Apache is redistributed as part of various proprietary software packages including the Oracle Database and the IBM WebSphere application server. Mac OS X integrates Apache as its built-in web server and as support for its WebObjects application server. It is also supported in some way by Borland in the Kylix and Delphi development tools. Apache is included with Novell NetWare 6.5, where it is the default web server. Apache is included with many Linux distributions.
Apache is used for many other tasks where content needs to be made available in a secure and reliable way. One example is sharing files from a personal computer over the Internet. A user who has Apache installed on their desktop can put arbitrary files in Apache's document root which can then be shared.
Programmers developing web applications often use a locally installed version of Apache in order to preview and test code as it is being developed.
Microsoft Internet Information Services (IIS) is the main competitor to Apache, followed by Sun Microsystems' Sun Java System Web Server and a host of other applications such as Zeus Web Server or Nginx.

# Introduction/History
## History and name

The first version of the Apache web server software was created by Robert McCool, who was heavily involved with the National Center for Supercomputing Applications web server, known simply as NCSA HTTPd. When McCool left NCSA in mid-1994, the development of httpd stalled, leaving a variety of patches for improvements circulating through e-mails. These patches were provided by a number of other developers besides McCool, and they thus helped to form the original "Apache Group".
There have been two explanations of the project's name. According to the Apache Foundation, the name was chosen out of respect for the Native American tribe of Apache (Indé), well-known for their endurance and their skills in warfare. However, the original FAQ on the Apache Server project's website, from 1996 to 2001, claimed that "The result after combining [the NCSA httpd patches] was a patchy server. The first explanation was supported at an Apache Conference and in an interview in 2000 by Brian Behlendorf, who said that the name connoted "Take no prisoners. Be kind of aggressive and kick some ass". Behlendorf then contradicted this in a 2007 interview, stating that "The Apache server isn't named in honor of Geronimo's tribe" but that so many revisions were sent in that "the group called it 'a patchy Web server'". Both explanations are probably appropriate.
Version 2 of the Apache server was a substantial re-write of much of the Apache 1.x code, with a strong focus on further modularization and the development of a portability layer, the Apache Portable Runtime. The Apache 2.x core has several major enhancements over Apache 1.x. These include UNIX threading, better support for non-Unix platforms (such as Microsoft Windows), a new Apache API, and IPv6 support. The first alpha release of Apache 2 was in March 2000, with the first general availability release on April 6, 2002.
Version 2.2 introduced a more flexible authorization API. It also features improved cache modules and proxy modules.

# Introduction/License
## License

The software license under which software from the Apache Foundation is distributed is a distinctive part of the Apache HTTP Server's history and presence in the open source software community. The Apache License allows for the distribution of both open and closed source derivatives of the source code.
The Free Software Foundation does not consider the Apache License to be compatible with version 2 of the GPL in that software licensed under the Apache License cannot be integrated with software that is distributed under the GPL:
   This is a free software license but it is incompatible with the GPL. The Apache Software License is incompatible with the GPL because it has a specific requirement that is not in the GPL: it has certain patent termination cases that the GPL does not require. We don't think those patent termination cases are inherently a bad idea, but nonetheless they are incompatible with the GNU GPL.
However, version 3 of the GPL includes a provision (Section 7e) which allows it to be compatible with licenses that have patent retaliation clauses, including the Apache License.
The name Apache is a registered trademark and may only be used with the trademark holder's express permission.

## References

* ↑ Various Licenses and Comments about Them from GNU

# Architecture
## Features

Apache supports a variety of features, many implemented as compiled modules which extend the core functionality. These can range from server-side programming language support to authentication schemes. Some common language interfaces support Perl, Python, Tcl, and PHP. Popular authentication modules include mod access, mod auth, mod digest, and mod auth digest, the successor to mod_digest. A sample of other features include SSL and TLS support (mod ssl), a proxy module (mod proxy), a URL rewriter (implemented under mod rewrite), custom log files (mod log config), and filtering support (mod include and mod ext filter).
Popular compression methods on Apache include the external extension module, mod gzip, implemented to help with reduction of the size of web pages served over HTTP. ModSecurity is an open source intrusion detection and prevention engine for web applications. Apache logs can be analyzed through a web browser using free scripts such as AWStats/W3Perl or Visitors.
Virtual hosting allows one Apache installation to serve many different actual websites. For example, one machine with one Apache installation could simultaneously serve www.example.com, www.test.com, test47.test-server.test.com, etc.
Apache features configurable error messages, DBMS-based authentication databases, and content negotiation. It is also supported by several graphical user interfaces.

# Installation
## Windows

The program can be installed alone from http://www.apache.org/dyn/closer.cgi.
However the best is generally to get it with an all-in-one solution like WAMP or EasyPHP, because it includes the installation or PHP and MySQL at the same time.
Apart from that, a portable all-in-one is XAMPP.
Remark (on a PC):
By default Apache is set to automatically launch at startup which is convenient on a server. However on a PC, it may be better to create a script to start and stop it manually. Example with EasyPHP:

## Unix-like
### Configuration

The service should be restarted manually after the most part of the configuration modifications:

# Configuration

Configuring Apache WebServer
GUI Tools:
There are some GUI tools to configure Apache web server but they mostly do the basic or intermediate levels of configurations. For advanced configuration, modifying the configuration file. is the way to go. Some GUI tools are: Comanche, TkApache, LinuxConf, WebMin, ApacheConf, user_manage. Among them, Webmin is browser based and may be a better choice than the others.
Basic Apache Configuration Information is as below:
Apache has three configuration files:
httpd.conf is the main file, you can forget about the others.
A basic configuration file may look like the following:
You can create your own user and set that to access webpages
then use

# Configuration/Performance
## Performance

Although the main design goal of Apache is not to be the "fastest" web server, Apache does have performance comparable to other "high-performance" web servers. Instead of implementing a single architecture, Apache provides a variety of MultiProcessing Modules (MPMs) which allow Apache to run in a process-based, hybrid (process and thread) or event-hybrid mode, to better match the demands of each particular infrastructure. This implies that the choice of correct MPM and the correct configuration is important. Where compromises in performance need to be made, the design of Apache is to reduce latency and increase throughput, relative to simply handling more requests, thus ensuring consistent and reliable processing of requests within reasonable time-frames.

# Virtual hosting
## Principle

Virtual hosting in Apache allows a single instance of the Apache software to host more than one distinct web site. Since only one instance of Apache can use port 80 on a server at once, without virtual hosting each new web site you hosted would need a new server.
Sites hosted under virtual hosting appear to end users as normal sites in every way; the only difference is that fewer server machines are needed to host them. Virtual hosting is commonly used by high-volume low-price web hosting companies, who give each of their customers a virtual host, with potentially hundreds of customers sharing the same server.

## Configuration

To add a virtual host, edit apache2.conf (or httpd.conf). Example:

## References

* ↑ https://httpd.apache.org/docs/2.4/en/vhosts/examples.html

# SSL

Install and Configure Apache2 with PHP5 and SSL Support

## Configuration Steps
### Step 1: generate certificate

For generating certificate Use the following command to generate certificates
You are about to be asked to enter information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter ‘.’, the field will be left blank.
This will complete the certificate now you need to make sure you have the correct permissions for .pem file if not use the following command to set the correct permissions
Note: For generating a certificate signing request give the following command

### Step 2: listen the port

By default the server will listen for incoming HTTP requests on port 80 - and not SSL connections on port 443. So you need to enable SSL support by entering the following entry to the file /etc/apache2/ports.conf save and exit the file.

### Step 3: enable SSL support

If you want to enable SSL support for your apache web server you need to use the following command
Module ssl installed; run /etc/init.d/apache2 force-reload to enable. Now you need to restart the apache2 server using the following command

### Step 4: configuring SSL Certificate to Virtual Hosts in Apache2

First you need to edit the /etc/apache2/sites-available/default file change
to
Now you need to configure Virtual hosts using port 80.

## Example

configure Virtual hosts using port 443 the main difference is you need to use the following two lines for each SSL hosts.
Example
Now you need to restart your apache web server using the following command
Sample Files : sample for “ports.conf” file
sample for “default” file

# .htaccess
## Principle

In order to protect a directory in particular (and its subdirectories), it suffices to place a file called .htaccess inside. Apache will instantly apply its rules after, only in this tree structure. The syntax is the same as the general vhost rules (eg: URL rewriting or protection), unless it will only affect the .htaccess directory (so no Directory clause).
Attention: the Windows explorer doesn't allow to name some files beginning by a dot, but a text editor is able to save as .htaccess.

## Installation

To authorize the .htaccess in the site .conf, use AllowOverride:
To forbid them:

## References

* ↑ http://httpd.apache.org/docs/2.2/mod/core.html#allowoverride

# Security

Numerous robots use to try to crack some databases (for instance via PhpMyAdmin or WordPress). To be protected from them, we can play on several criteria.
For example, to forbid to visualize a directory files which hasn't got any index (e.g.: .html, .php), add the code: Options -Indexes.

## Protection by provenance

Authorize only two IP to read the directory:

### whitelist with allow (obsolete in Apache 2.4)

If the authorization ranges have some addresses in common with the prohibited ranges, it's better to specify their precedence (the lines order in the .htaccess file doesn't change anything):

#### order allow, deny

    begin by the authorizations and then start the interdictions, by risking to ban what was previously allowed.

#### order deny, allow

    the contrary is less restrictive.

### blacklist avec deny (obsolete in Apache 2.4)
## Protection by password
### Authentication configuration

It's imperative to allow the authentication parameters modifications in the Apache settings.
The directive AllowOverride of a parent directory must contain the option AuthConfig.
The directives to place in the .htaccess are:

#### AuthType basic

    authentication type communally adopted but poorly secured.

#### AuthName "My message"

    the text as an invite in the dialog box.

#### AuthUserFile /etc/apache2/my_passwd

    the passwords file path.

#### Require valid-user

    specifies that a valid account is needed to accede to the folder.
We can also use Require user toto sasa to authorize only the two accounts toto & sasa.
The authentication type basic uses not crypted passwords.
Some other more secured types exist, like digest, which is recommended to combine with HTTPS.
The first request is addressed to the protected directory and provokes the displaying of the dialog box, from which the user should identify (with login and password):
* If the password is invalid, the dialog will be displayed again.
* If it's valid, the navigator can record it, and never ask it again until the next relaunching.

### Passwords file

The following command creates a passwords file called with one user toto:
To add or modify a user:
Then, tell to .htaccess the .htpasswd path with:

## References

* ↑ https://httpd.apache.org/docs/2.4/en/howto/access.html
* ↑ https://httpd.apache.org/docs/2.4/en/upgrading.html
* ↑ http://httpd.apache.org/docs/2.2/mod/core.html#allowoverride

# CGI
## CGI scripts

The CGI (Common Gateway Interface) is a norm permitting Apache to execute some programs, which can be written in any programming language (Bash, C, Java, Perl, PHP, Python...), from the moment it's executable and it respects certain in/out constraints.

### Configure the CGI scripts access

To make Apache interpret the scripts, it's necessary to do a minimum of settings in the site configuration.

#### ScriptAlias

The directive (from httpd.conf):
precise the folder name where Apache is authorized to executer the CGI scripts.
Unix example:
Windows example, use the URL format (no backslash):
Actually the path /cgi-bin/ doesn't really exist, it's redirected to the scripts path, set by the directive, and it allows to write some URL like http://server/cgi-bin/my_script.

#### ExecCGI

The following clause activates the option ExecCGI in /var/www/cgi-bin, which authorize Apache to execute some scripts on the server:
For example, if a script is called essai.cgi into /home/httpd/cgi-bin:
Then, call the URL: http://serveur/cgi-bin/essai.cgi

#### AddHandler

This clause permits to choose the files extensions which will be authorized, eg:

#### Recapitulation

Full example on Windows, in the Apache configuration:
In E:/www/cgi-bin/.htaccess :

### Write a CGI program

The main constraint concerns the program outputs. If a CGI script generates some data on its standard output, he must display an HTTP header before, allowing to identify them.

#### Bash

This script generates an HTML page.

#### VBS

For Windows.

### Known errors

* Error 500 Server error!: replace a Deny from all by a Allow from all.
or
* Error 403 Forbidden access: impossible to list this folder, so call directly its files.
* If the file source code is appearing in the navigator: the .htaccess is not properly set.
* couldn't create child process: replace the path after shebang. For example:
    #!/usr/bin/perl par #!c:/perl/perl/bin/perl.exe -w.
    #!/usr/bin/env python par #!C:\Program Files (x86)\Python\python.exe.
* End of script output before headers: missing header (eg: move the importation before print "Content-Type: text/plain;charset=utf-8"). But it can also be the symptom of a compilation error in the script language.
* malformed header from script: Bad header: : the header is not adapted (eg: replace #print "Content-Type: text/plain;charset=utf-8" by print "Content-type: text/html\n\n" if there is a print "<html>" after).
Otherwise consult the Apache logs...

## References

* ↑ http://httpd.apache.org/docs/current/en/howto/cgi.html
* ↑ http://wiki.uniformserver.com/index.php/CGI:_VBScript_CGI