7.2.1 Understanding the Default OES Setup of Apache HTTP Server

When you install services from the OES Add-On disk, the following Apache setup is configured:

7.2.2 Manually Configuring Apache

On OES servers and Novell Open Workgroup Suite (NOWS) Small Business Edition (SBE) servers, you must manually configure Apache settings, OES virtual hosts, and virtual hosts for your personalized Web sites. Use a text editor to create or modify the configuration files, then gracefully restart the Apache HTTP Server daemon (rcapache2 graceful) to apply the changes.

For information about using the configuration files to manage your Apache HTTP Server and virtual hosts, see Configuring Apache Manually in the SLES 11 Administration Guide.

7.2.3 Creating and Configuring a Virtual Host for Each Web Site

On Linux, the Apache HTTP server can serve multiple universal resource identifiers (URIs) from a single instance of Apache running on the server. That is, multiple Web sites, such as www.example.com and www.example.net, can be run from a single Web server. Each Web site is referred to as a virtual host. Virtual hosts can be name based, IP based, or port based.

You can set up personalized Web sites by manually creating a virtual host configuration file for each Web site. Templates for secure SSL virtual host and non-secure virtual host configuration files are available in the /etc/apache2/vhosts.d/ directory.

When you cluster-enable the Web content by using Novell Cluster Services, use the IP address of the cluster resource for the virtual host. This ensures that the Web site traffic is directed to the cluster node where the Web content cluster resource is currently active. Do not use the server node’s IP address or the master IP address of the cluster. Specify the Linux file path to the Web content.

On OES servers, you create and configure a separate virtual host configuration file for each Web site that you want to host in the cluster. The following procedure provides basic information about setting up the file. Refer to other sections in this document to learn about the key settings that are available. For detailed information, see the Apache Virtual Host documentation Web site.

7.2.4 Requiring Strong Ciphers

We recommend that you secure your Web solution by requiring strong ciphers when the client is negotiating the connection in the SSL handshake.

We recommend that you enable only the strongest ciphers: RSA, HIGH, and SSLv2.

To enable strong ciphers and disable weak ciphers:

7.2.5 Configuring an SSL Certificate for the Server

OES automatically configures secure SSL communications for a default virtual host (_default_:443). SSL is enabled in the Apache global configuration file (/etc/sysconfig/apache2) with the following directive:

APACHE_SERVER_FLAGS="SSL"

The default SSL configuration is defined in the /etc/apache2/vhosts.d/vhost-ssl.conf file. It uses an INCLUDE directive for the /etc/opt/novell/httpd/sslconf.d/*.conf files. This target directory contains the configuration files (or symbolic links to them) for OES virtual hosts that require SSL, such as the nps-Apache.conf file that is used for the Novell iManager tool.

By default, OES sets up an SSL certificate file and key file for the server by using certificates generated in Novell eDirectory. Table 7-1 identifies the location of the SSL certificate and key files that are referenced by the SSLCertificateFile and SSLCertificateKeyFile directives in the /etc/apache2/vhosts.d/vhost-ssl.conf file.

If you modify the content or location of the certificate and key files, gracefully restart the Apache HTTP Server daemon (rcapache2 graceful) to apply the new values.

7.2.6 Configuring Apache to Listen on Multiple Ports

The Listen directive in the /etc/apache2/listen.conf file tells the Apache HTTP Server to accept incoming requests on the specified port or an address-and-port combination. If the directive specifies only a port, the server listens to the given port on all interfaces. If the directive specifies an IP address and port combination, the server listens on the given port and network interface.

By default, OES configures Apache to listen on non-secure port 80 and secure port 443 in the /etc/apache2/listen.conf file. If a firewall is used on the server, port 80 and port 443 are automatically opened in the firewall. The ports are not bound to a particular IP address, so Apache responds to requests on all IP interfaces on the server.

Listen 80


<IfDefine SSL>
    <IfDefine !NOSSL>
  <IfModule mod_ssl.c>

      Listen 443

  </IfModule>
    </IfDefine>
</IfDefine>

You can configure multiple Listen directives to specify multiple IP addresses and ports. The server responds to requests from any of the listed addresses and ports. For information about formats and options for the Listen directive, see the Listen Directive in the Apache MPM Common Directives collection.

If you configure non-standard ports for your personalized Web sites, you must add a Listen directive in the /etc/apache2/listen.conf file, then gracefully restart the Apache HTTP Server daemon (rcapache2 graceful) to apply the changes. Ensure that you open the port in the firewall.

7.2.7 Configuring Permissions for the Web Site DocumentRoot Directory

Apache uses the user wwwrun identity to serve files to clients of your Web site. You must configure permissions for the Web site content that allow Apache to serve the files to client users.

7.2.8 Configuring a Web Location that Requires LDAP Authentication

If you have documents or a location that requires restricted Web access, you can set up Apache to enforce eDirectory authentication and force the authentication to be done over https. This solution can be used on individual directories, URLs, or the entire Apache server.

The following example creates a single secure location so that any document that is referenced under the directory requires authentication. For example, the URL www.example.com can have public access, while the URL www.example.com/secure and documents it contains require authentication. Authentication should be done over a secure connection (https) rather than a non-secure connection (http). All http attempts are redirected to https for the given location.

7.2.9 Starting, Stopping, or Restarting the Apache Daemon

The Apache HTTP Server program runs as a daemon (httpd2) that executes continuously in the background to handle requests. OES configures the daemon to start automatically on system restart. You must restart Apache to apply any changes you make to the Apache or virtual host configuration files, or to add new virtual host configuration files. A graceful restart does not disrupt the service.

In a cluster, you manually copy the virtual host configuration files for clustered personalized Web sites to every node in the cluster. When Apache starts on each node, it reads the configuration file and is available to serve the site when the resource is active on the node. You do not add Apache commands in the resource’s load and unload scripts. All requests to a clustered Web site are sent to the DNS name or IP address of the cluster resource, and not to a specific node. The site’s requests are served by the Apache process that runs on the node where the cluster resource is currently active.

To start, stop, or restart the Apache daemon, use the /usr/sbin/rcapache2 commands in Table 7-2:

rcapache2 start

rcapache2 stop

rcapache2 graceful-stop

rcapache2 restart

rcapache2 graceful

7.2.10 Viewing the Apache Log Files

The following Apache log files are located in the /var/log/apache2/ directory:

• access_log
• error_log
• rcapache2.out
• rewrite_log
• ssl_request_log

You can also specify custom logs by adding the CustomLog directive to your virtual host configuration file. For information about formatting the custom log, see Apache Module mod_log_config.