Apache. Apache. Something odd happening. Modularity 10/02/2014. We talked about it in CSCI110 Now it s time for you to configure an Apache web server

Transcription

1 Apache Apache We talked about it in CSCI110 Now it s time for you to configure an Apache web server You won t configure the entire Apache in the labs; there you will simply configure your own public_html directory What did you learn about it back in CSCI110? That it is the most common web server That it has a highly modular structure By selecting modules, you can build an Apache with different capabilities That its logs tell you about traffic on your site and that log analysis can warn you of hacker attacks That its run time behaviour is controlled by a configuration file And that it comes with lots of detailed documentation! You have forgotten it all? Sigh! Go find the notes in Web server usage from Netcraft Web server usage from Netcraft What s changing? Nothing very obvious; nginx is growing a little. Something odd happening Something odd in 2013 Apache down Microsoft up? Modularity Unfortunately, the way that this is achieved does vary quite a bit between different versions of Apache, and between the different implementations for Windows and Linux etc. And Debian/Ubuntu linux systems add their own twist But basically There is a core web server Handles delivery of static files With modules, almost always included, that implement HTTP features like content MIME type negotiation and authorization And additional modules, selectively included, that support specialized features like WebDAV Web based distributed authoring and versioning adds document editing and management functionality it s used to support web access to things like a subversion version management system. 1

2 Modularity Traditional Apache has a.configure script, you ran this with command line arguments naming the modules that you wanted enabled (or disabled if they were enabled by default) The configure script created a makefile You ran make, and it built a statically linked Apache with the modules thatyou specified If you wanted to change modules, you had to reconfigure, recompile and relink Modern Apaches You build your Apache with shared objects for the different modules You edit the configuration file to specify the modules that you want included leaving other modules around in case you want to add them later Just a matter of changing the config file and restarting Apache The code gets linked in dynamically when needed at run time Windows versions of Apache always did this Windows (xampp) C:\xamp\apache\conf\httpd.conf contains the Apache configuration file Near head, there is a section where modules are listed in LoadModule directives just comment/un comment these as needed to get your desired Apache Debian/Ubuntu Ubuntu Apache configured and make run with all but core modules specified as shared Two directories created for code mods available and mods enabled mods available contains shared object.so files with code, and.conffiles files with configuration datafor those modulesthat require such data mods enabled has links to files in mods available (or, sometimes, copies); these are the modules in your actually running Apache Helper programs a2enmod and a2dismod should keep these directories set up correctly But you can just create links at shell level If you need to change.conf files, I suggest that you create a copy in mods enabled and just edit the copy (that way, the standard configurations are still recorded in the mods available files) escape.com/web/configuring apache2 debian.html Ubuntu /etc/apache2 httpd.conf no content, required placeholder file apache2.conf root configuration file Some of settings And Include /etc/apache2/mods enabled/*.load etc ServerRoot /etc/apache2 Timeout 300 KeepAlive On MaxKeepAliveRequests 100 KeepAliveTimeout 15 <IfModule mpm_prefork_module> StartServers 5 MinSpareServers 5 MaxSpareServers 10 MaxClients 150 MaxRequestsPerChild 0 </IfModule> User ${APACHE_RUN_USER} Apache2 AccessFileName.htaccess DefaultType text/plain HostnameLookups Off ErrorLog /var/log/apache2/error.log Performance tuning? You may need to adjust values of parameters like MaxClients 2

3 Enabled mods Apaches in lab will have userdir in mods enabled which allows you to use a public_html directory in your home directory. What modules are available? Core features Core the basic web server; also deals with configuration aspects like location of htdocs, keep alive, etc etc mpm_common and variants like mpm winnt Code for the multi processing parts (threaded parts) prefork Code for the old style non threaded server Details at What modules are available? Some of the others! actions Allows you to specify that requests for particular file types should trigger execution of a specified CGI program So could specify that any request for an image/gif file would result in Apache running a specified cgi program (which maybe gets the image from a database, or generatesit) rather thanlooking for an actual image file cgi Adds in the standard CGI mechanism Files in the ScriptAlias directory (usually cgi bin) and those whose types have been defined in an AddHandler directive in the main configuration file will be executed as programs rather than returned as files (cgid) Specialization needed for some Unix operating systems running a threaded Apache More modules dav (also dav_fs, dav_lock) Support for WebDAV functionality cache (along with disk_cache and mem_cache) Supports caching of local (or proxied) content by URI Can have schemes where first request for some expensive to generate dynamic page results in it being generated and given a time to live; this version saved in a disk file or in memory. Subsequent requests for the same content are delivered from the cache until the time to live has expired.» Cautions hacker exploits suexec Allows set user scripts that run with userid other than that of web server There are more than 80 modules; some are a little exotic More modules so Module needed if this Apache will use dynamic linking ssl Encryption etc for use with SSL and TLS (https) uniqueid Generate a unique identifier for each request Maybe, for Unix clusters etc. Still listed as a module but description seems to relate to single threaded Apaches. rewrite Using regex, rewrite request URLs on the fly. One place you will encounter this is with Zend Framework where all requests have to actually be routed through the code of the framework engine. ident Call back to client running identd process supposedly returns identifier of user who submitted request. (Most clients don t run identd; those that do could always lie) More modules mime Associating filename extensions with handlers and filters mime_magic Guess file type based on first few bytes negotiaton Content negotiation deflate Compress content before return to client auth_basic, auth_digest, authn_dbd, authn_dbm, authn_file Components supporting various aspects of authentication. 3

4 Non Apache modules php, perl, Third party modules can be added mod php and mod perl both incorporate interpreter code into the Apache so that scripts in these languages can be handled directly rather than involving the more costly fork process, execinterpreter mechanism Set up can be a little involved which is why pre built software stacks like lamp and xampp are popular Modules Include your modules Configure your modules Some require their own environment variables withdata such as locationofrequiredof directories Editing a.conf file, e.g. userdir userdir.load Apache code to make use of individual public_html directories (e.g. ~nabg/hello.html) userdir.conf Where are the user directories? What changes can be made in.htacess files? userdir.conf Now default userdir.conf is probably wrong It doesn t match local directory hierarchy It doesn t allow enough overrides in.htaccess file Running Apache Windows/xampp xampp control.exe Allows you to manually control your Apache or have it as a Windows service If a Windows service, it will start automatically with Windows Runs at port 80 (can change in config file) Linux Can launch manually have to edit /etc/apache2/ports.conf to specify a port like 8080 Can be configured as a Linux daemon process Will need to read Linux documentation to find out how these are configured Your Apache is running Logs by default in /var/log/apache2 (or C:\xampp\apache\logs) Access log and error log Apache automatically ti handles rollover of log files; older files get compressed; current access.log and error.log Permissions in labs will prevent you from viewing log files, but there is a utility command to show the tail of error log file (apacheerrortail) 4

5 Logs Illustrated in CSCI110 Access all requests Who (IP), when, what, result (success/fail), size, browser, referrer, [18/Nov/2011:16:25: ] "GET /C2012GeoLoc/geo1.html HTTP/1.1" " " "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/ Firefox/8.0" [18/Nov/2011:16:26: ] "GET /C2012GeoLoc/geo1.html HTTP/1.1" 304 " " "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/ Firefox/8.0 Error Nov 09 15:01: ] [error] [client ] File does not exist: C:/xampp/htdocs/js, referer: Logs Analyse your logs Requests for non existent files, e.g. phpmyadmin/*, robots.txt, Repeated failed login attempts to controlled access sub directories Inappropriate referrer Example Minor cs.uow server used for 321 projects These 2 are legit; The rest hacker Same sequence of requests submitted on same day from , , , , , , , , , , This hacking script must be popular with the script kiddy types host a.b.c.d Who done it? E.g. $ host in addr.arpa domain name pointer ZET ZH ZGOZ P.net.t com.hr. Host in addr.arpa. not found: 3(NXDOMAIN) in in addr.arpa arpa domain name pointer isc210.internetdsl.tpnet.pl. internetdsl tpnet pl in addr.arpa domain name pointer mail.aclaimafrica.com in addr.arpa domain name pointer HINET IP.hinet.net. Host in addr.arpa. not found: 3(NXDOMAIN) Sometime worth adding deny from a.b.c.d to your httpd.conf files! Why did many reverse DNS lookups fail? Possibly deliberate The DNS reverse lookup relies on data registered in the DNS configuration files for the domain containing the machine You don t want to be easily recognised? You simply don t include all the data that you should have put in the DNS configuration file for your domain! But can you check further? Yes by using an IP location service such as that at geobytes.com They have tables mapping IP addresses to locations Who done it? Oh, it was a Chinese hacker, possibly somewhere in Beijing whoever would have thought of that This b****** was in Chile, probably Santiago Another Beijing boy Muscovite Beijing must be a big city filled with computer geeks Taiwan Uganda Hackers of the world unite you have nothing to lose save your time! 5

6 Lab exercises Lab machines have Apache configured and running at port 80. You control your public_html directory You can place a.htaccess file there Use it to do things like have subdirectories with restricted access or support multiple language types Limited Exercises Multiple language versions of a web site Need negotiation and mime modules (should be in lab setup) Works with language preferences set in browser Browser might ihtsend request like Accept Language: fr; 1=1.0, en; q=0.5 ( I want French but if you don t have it I will abase myself and read English ) Needs to handle cases where language preference cannot be satisfied Sub directory with restricted access Just basic authentication in the lab Language preferences Create multiple versions of those static pages that are to be delivered in chosen language Welcome.html.en, Welcome.html.fr, Welcome.html.de Pages should (obviously) have content in appropriate p language Will usually need an extra directive in the <head> section of the page that specifies font: <meta http equiv= Content type content= text/html; charset= utf 8 > (Charset value obviously needs to be appropriate to the page, utf 8 should suffice for most European languages) Best matching language Language preference system will try to find a page You have pages in English, French, German Your Bulgarian visitor will end up with the German page No match If the user s language requirements cannot be met, Apache will return some error message that might puzzle the browser Providing a default Rather than returning an error, it is better to return a page in some default language Old style (doesn t appear to work anymore) You had a page Welcome.html.html this would get returned if language preferences couldn t be satisfied. New style Specify what is to happen by directives in the.htacess file LanguagePriority and ForceLanguagePriority directives Example LanguagePriority en fr de ForceLanguagePriority Fallback The guy who wanted Bulgarian, Burmese, or Catalan will end up with the English page. 6

7 Another way The standard Apache ways of negotiating languages are described at But can instead use Apache rewrite rules Test the language preference header Rewrite the URL as appropriate Typically would have different language sub directories, rewrite rule would identify the browser s language preference and insert the appropriate sub directory name into the pathname for file Advice tips tricks.html apache redirect to languagepath by browser language setting/ Controlled Access Very common to have base directory Allow from all but sub directories to which you wish to restrict access Restriction by IP? Useful for Limiting access to machines within a specified domain (identified by the IP address) Blocking access from known hacker locations Name/password controls more generally useful Reference Limits on domain or ip Edit the.htacess directory in the sub directory that you wish to control; e.g. add deny lines (Or edit the <Directory> segment in a httpd.conf file) Example Deny from , , , Can use domain name, but a bit more costly at run time Deny from uow.edu.au (cost is that Apache must do a reverse DNS lookup on client s IP to check the domain) Limits on domain or ip If you want to limit access to a particular domain, edit the.htacess file so that it has both deny and allow directive: Order deny, allow Deny from all Allow from uow.edu.au Password access Need to create collections of user names and passwords, and optionally groups Apache allows various options for storing names and passwords text file, dbm file, sql database Lab setup will only support the text file option; this suffices if you have fewer than ~100 users If setting up your own Apache then try configuring with the dbm options and using that to store names and password Apache provides helper programs htpasswd and dbmanage Create password file Suggestions Put these files in a directory quite separate from the htdocs (or public_html) directory (but has to be accessible to Apache process www data user) Use names like.htpasses,.htgroups the File directive in the Apache configuration file should help stop such files being accessed by hackers Commands htpasswd c /home/e/ead432/apacheother/.htpasses tom New password: cleartext Re type new password: cleartext Adding new user tom Subsequently just use htpasswd passwordfile user 7

8 Groups Simple text file, one or more groups defined Format: Groupname: user1 user2 user3 Just create in text editor and save (e.g..htgroups) Example Friends: tom dick harry sue Directory hierarchy forfriendsonly.htaccess htdocs or your public_html Password file created using an apache utility passwordfile groupsfile Groups file created using a simple text editor These files in a different part of your file space; and controls set to prevent web access! Editing the.htaccess file The.htaccess file will require directives specifying things like the location of the password file: AuthType Basic AuthName "For my friends" AuthUserFile /home/e/ead432/apacheother/.htpasses AuthGroupFile /home/e/ead432/apacheother/.htgroups Require group Friends Access control On first access to the controlled directory, Apache will return an authentication required response and keep the connection open. Access control Browser will display a default prompt for the user name and password Basic access Password sent base 64 encoded simply a fixed character substitution scheme Apache and http support the more sophisticated Digest mechanism but not all browsers implement digest (enough have it, so you could probably try using Digest) Digest an MD5 hash of the realm, username and password Alternatively, set things up so that https is used and all data are encrypted; this can be achieved in Apache with a rewrite rule that changes the URLs ; one suggestion is at ssl htaccess.html 8

9 Browser fakes logged in status Every subsequent request sent by browser to same realm (i.e. sub directory on web site) will contain the name/password data in the HTTP headers Every subsequent access does involve Apache checking the authentication data (open.htpasses file and read it etc); this may slow operations Action is invisible to user who simply experiences a logged in state where they can read any pages in the controlled sub directory. Logs show data on user access Log while using authentication [03/Jan/2012:13:40: ] "GET /~nabg/formyfriends/friend.html HTTP/1.1" " " "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/ Firefox/8.0" harry [03/Jan/2012:13:42: ] "GET /~nabg/formyfriends/friend.html HTTP/1.1" " " "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/ Firefox/8.0" harry [03/Jan/2012:13:52:18/ ] "GET /~nabg/formyfriends/friend2.html HTTP/1.1" " " "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/ Firefox/8.0" harry [03/Jan/2012:13:52: ] "GET /~nabg/formyfriends/friend3.html HTTP/1.1" " " "Mozilla/5.0 (Windows NT 5.1; rv:8.0) Gecko/ Firefox/8.0" Access control Access control It s defined in HTTP all those authentication responses etc Apache implements it. Handled through special programs used by sys admin But it is also done in application code Your own database access code Probably a web component (with some restrictions on use) for administering users and their passwords Possibly utilising the built in support provided by HTTP, but more likely login state handled through cookies and session state variables When is it worth using the HTTP/Apache version? Uhm? Really not that convenient Most likely to be used when have a sub directory with lots of static content where access should be restricted Think of something like teaching materials for a 100 level subject at a small University; access to be limited to enrolled students But, but, but In modern usage, such content would be better handled using a content management system such as Drupal (where you will have a convenient administrator interface for updating content and for administering users) Apache/HTTP access control You need to be aware of it You need to be able to configure it You probably will rarely find it an appropriate solution for your application 9