Apache Cookbook - TekX Chicago 2010

Apache Cookbook
Recipes for managing your Apache HTTP Server

/ Rich Bowen - rbowen@apache.org

Shameless Plug

Buy!
Buy!
Buy!

Old Hat ---->

• 1.3 is end of life
• 2.0 will be by the end of
the year
• 2.2 is now
• 2.4 is tomorrow Photo CC by “Lost Albatross” - Flickr

URLs you need

• http://people.apache.org/~rbowen
• http://wiki.apache.org/httpd
• http://httpd.apache.org/docs/trunk/

Recipes

Photo CC by Chemical Heritage Foundation - Flickr

Say it with style

IndexStyleSheet /styles/dir.css

...

.odd {
background-color: #eef;
}

.even {
background-color:
#fff;
}

Caveat: Some features 2.4 only

• In 2.2 and earlier, you can specify
a style sheet, but no classes are
added to the HTML
• Useful, but not quite as useful

Now, with extra class
<table id="indexlist">
<tr class="indexhead">
<th class="indexcolicon">...
<th class="indexcolname">...
<th class="indexcollastmod">...
<th class="indexcolsize">...
<th class="indexcoldesc">...
<tr class="indexbreakrow">...
<tr class="even"><td class="indexcolicon">...

An exercise for the reader:

• Nifty mouse-over effects
(JS in HeaderName
file?)
Photo CC by Ugglan - Flickr
• AJAXy file interaction
of some kind?
• Photo gallery, entirely
based on
mod_autoindex and
Javascript?

mod_substitite

• New module in 2.2
• Rewrite content using
regular expressions
• Syntax is identical to sed

s/foo/bar/

• Simple example - switch fonts
LoadModule substitute_module
libexec/apache2/mod_substitute.so

AddOutputFilterByType SUBSTITUTE text/html
Substitute s/ariel/courier/i

Proxying

• More useful example
• Proxying to back-end server that returns
fully-qualified URLs

LoadModule substitute_module
libexec/apache2/mod_substitute.so

AddOutputFilterByType SUBSTITUTE text/html
Substitute s/backend.local/www.example.com/ni

mod_security

• Are you running mod_security?

mod_security

• You should be

http firewall

• The earlier you catch it ...

Holes

Photo CC by
Darwin Bell

SQL Injection

# Prevent SQL injection attacks
SecFilter "delete[[:space:]]+from"
SecFilter "insert[[:space:]]+into"
SecFilter "select.+from"

18

Make sure you ...

# Inspect POST payloads
SecFilterScanPOST On

# Default action set
SecFilterDefaultAction "deny,log,status:406"

19

While you’re at it

# Inspect POST payloads
SecFilterScanPOST On

SecFilter “vidocin”

20

Acceptable arguments

# Only for the FormMail script
<Location /cgi-bin/FormMail>
# Reject request where the value of parameter "recipient"
# does not end with "@apache.org"
SecFilterSelective ARG_recipient
"![a-zA-Z0-9]+@apache.org$">
</Location>

21

Which PHP script is slagging my server?

• Which process, and what is
it doing?
• Look at /server-status for a
process list

Step 1: Look at top:

• Run ‘top’
• Order by CPU usage
• Pick off the httpd processes
that are causing the
problem and make note of
their PIDs

Step 2: /server-status

• Look at /server-status
output
• Look for the PIDs you
noted
• Move fast - the process
may be gone already

ExtendedStatus On

• You’ll need “ExtendedStatus On”
to get these details:

<Location /server-status>
SetHandler server-status
</Location>

ExtendedStatus On

SNI

• General knowledge: SSL
requires one certificate per IP
address
• That is, only one SSL site can
be on each IP address
• Limitation of SSL itself

SSL handshake

Certiﬁcate

Hostname

SNI

• Server Name Indication
• Passes server name in initial
handshake
• Simple solutions are always
best

Caveats

• You knew there would be a catch
Mozilla Firefox 2.0 or later
Opera 8.0 or later (the TLS 1.1 protocol must be
enabled)
Internet Explorer 7 (Vista or higher, not XP) or
later
Google Chrome (Vista or higher, not XP. OS X
10.5.7 or higher on Chrome 5.0.342.1 or newer)
Safari Safari 3.2.1 and newer on Mac OS X 10.5.6
and Windows Vista or higher, not XP

Apache • 2.2.12 or later
Listen 443
# Listen for virtual host requests on all IP addresses
NameVirtualHost *:443

# Go ahead and accept connections for these vhosts
# from non-SNI clients
SSLStrictSNIVHostCheck off

<VirtualHost *:443>

DocumentRoot /www/example1
ServerName www.example.com

</VirtualHost>

<VirtualHost *:443>
DocumentRoot /www/example2
ServerName www.example2.org

</VirtualHost>

More Info

http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

Secure mod_dav deployment

• Security rule #1: Content is not
writable
• Corollary: Anyone telling you to
‘chmod 777’ is a monkey
• Anyone telling you ‘chown apache
something.php’ *might* be a
monkey. Or they might be working
around Apache’s annoying
permissions model

However ...

•Setting up WebDAV
requires that content be
writable ...
•And owned by Apache
•This is annoying

WebDAV

<Directory /var/www/content>
Dav On
</Directory>

Why this is a problem

• People write bad code
• It’s easy to get PHP (or whatever
else) to overwrite your content
• Now your site is a radical terrorist
site
• This is a very unpleasant thing to
wake up to on a Saturday morning

Secure DAV

• It’s possible to set up Dav without
having the files written by the
Apache user
• Sort of

40

Two Apache Processes

Primary Secondary
server, server,
running as running as
user www user dav

File System,
owned by dav

41


Read-only
Running ordinary set of modules
Running web apps, etc
Primary
server,
running as
user www

File System,
owned by dav

42


Read/Write
Remove all extra modules
SSL Secondary
server,
Authenticated
running as
user dav

File System,
owned by dav

43

Multi-server config.
drwxr-xr-x 2 dav dav 68 Oct 3 12:41 /var/www
1
Listen *:80
User www
Group www
DocumentRoot /var/www/

Listen *:8080 2
DavLockDb /var/lock/dav
User dav
Group dav
44


1
Listen *:80 Can write
User www
Group www

Listen *:8080 2
User dav
Group dav
45


1 Can’t
Listen *:80
User www
Group www

Listen *:8080 2
User dav
Group dav
46

<If> Picture by BrewBooks (Flickr)

My favorite new feature in 2.4

<If>

<If ‘$req{Host} = “www.example.com”’>
RedirectMatch (.*) http://example.com/$1
</If>

<If>

</If>

This was hard prior to 2.4, and
probably required mod_rewrite,
or a separate virtual host.

<If>

</If>

$req
$resp
$env

Logging - Conditional Logging

• Don’t log certain things
• Per-directory logging

51

Conditional LogFormat

• The LogFormat directive
supports some conditionals in
the variables
• "%!200,304,302{Referer}i"
logs Referer on all requests
that do not return one of the
three specified codes

52

Conditional LogFormat

• "%400,501{User-agent}i" logs
User-agent on 400 errors and
501 errors only
• For other status codes, the
literal string "-" will be logged

53

Conditional CustomLog

• Stick Env=xyz on the end
• or Env=!xyz
• Yes, that’s =! not !=

54

For example ...

SetEnvIf Request_URI .gif$ gif-image
CustomLog gif-requests.log common env=gif-image
CustomLog nongif-requests.log common env=!gif-image

55

For example ...


56

For example ...


57

So the images get logged here


58

And everything else goes here


59

Per directory

SetEnvIf Request_URI ^/marketing mkt
CustomLog marketing.log common env=mkt

60

PCRE Zero-width assertions

• Match everything except one thing
• While you can do this with
RewriteRule, it would be nice if you
could do it with other directives
DirectoryMatch
FilesMatch
RedirectMatch

Negative Lookahead

• PCRE provides a regex
syntax to say “not preceded
by” or “not followed by”
• Negative lookbehind and
negative lookahead,
respectively

Andrei Rocks

• While we’re on the topic:
• Pretty much the best
presentation on regular
expressions anywhere:
• http://www.slideshare.net/
andreizm/andreis-regex-clinic

Everything except ...

• “I want to redirect everything except /
images”

• This is where you’d use a negative lookahead

• Necessary because RedirectMatch doesn’t
support negation

RedirectMatch ^/(?!images/)(.*)
http://other.myhost.com/$1


• Match anything ...
•



• Match anything ...
• That doesn’t start with images/



This is called a “zero width” assertion,
because it doesn’t fill $1, and doesn’t
consume any characters in the match.


What the heck is it doing?

RewriteLog /var/log/rewrite.log
RewriteLogLevel 9


RewriteLogLevel 9

• Alas, not in .htaccess
• Logs are always opened at startup


RewriteLogLevel 9

• Most entries between 1-4


RewriteLogLevel 9

• If there’s nothing in there, your rules are
being ignored.

Logging - RewriteLog

RewriteLogLevel 9

73


RewriteLogLevel 9

74


RewriteLogLevel 9

75

Kind of intimidating, isn’t it?

77

Learn to ignore the irrelevant bits

78

Which bits are those?

121.14.76.185 - - [24/Sep/2008:21:35:51 --0400]
[wooga.drbacchus.com/sid#b83444a8][rid#b85b8d00/
initial] (4) [perdir /var/www/vhosts/drbacchus/]
RewriteCond: input='/var/www/vhosts/drbacchus/
podcasts/poetry/maninmoon.mp3' pattern='!-f' => not-
matched

79

Client address

121.14.76.185 - - [24/Sep/2008:21:35:51 --0400]
matched

80

Dunno what those are

121.14.76.185 - - [24/Sep/2008:21:35:51 --0400]
matched

81

Time

121.14.76.185 - - [24/Sep/2008:21:35:51 --0400]
matched

82

Unique id

121.14.76.185 - - [24/Sep/2008:21:35:51 --0400]
matched

83

Request ID

121.14.76.185 - - [24/Sep/2008:21:35:51 --0400]
matched

84

The useful bit

121.14.76.185 - - [24/Sep/2008:21:35:51 --0400]
matched

85

Wouldn’t it be nice if you could just see the
useful part?

86

You could change the way mod_rewrite logs:

Piped logs

• I actually use a piped lot handler to
remove this superfluous stuff
• Like so ...
RewriteLog |/usr/local/bin/rewrite_log_pipe
RewriteLogLevel 9

88

RewriteLogLevel 9
with ...

#!/usr/bin/perl
$|++;

open (F, ">>/tmp/rewrite");
select F;
while (<>) {
s/^.*((d).*)/$1/;
print;
}
89

RewriteLogLevel 9

This bit says “instead of logging to a text
ﬁle, invoke this script and send the log
entries there.”

90

#!/usr/bin/perl
$|++;

open (F, ">>/tmp/rewrite");
select F;
while (<>) {
s/^.*((d).*)/$1/;
print;
}

• Look for the (1) or (2) bit
• drop everything before that
91

Results in:

(4) RewriteCond: input='wooga.drbacchus.com' pattern='!^wooga.drbacchus
.com' [NC] => not-matched
(3) applying pattern 'wp-rss2.php' to uri '/index.php'
(3) applying pattern '(journal/)?index.rdf' to uri '/index.php'
(3) applying pattern '^/wordpress/wp-comments' to uri '/index.php'
(3) applying pattern '^/perm/(.*)' to uri '/index.php'
(3) applying pattern '^/articles?/(.*)' to uri '/index.php'
(3) applying pattern '^/blog/(.*)' to uri '/index.php'
(3) applying pattern '^/book/(mod)?_?rewrite' to uri '/index.php'
(3) applying pattern '^/book/cookbook' to uri '/index.php'
(3) applying pattern '^/book/2.2' to uri '/index.php'
(3) applying pattern '^/booklink/(.*)' to uri '/index.php'
(3) applying pattern '^/books?/(.+)' to uri '/index.php'
(1) pass through /index.php

92

Results in:

(3) applying pattern '^/blog/(.*)' to uri '/index.php' better?
See? Isn’t that

93

Requested URI


94

Patterns applied


95

None of them matched


96

And now

• We can actually make some
sense of what’s happening
• Less inscrutable noise
• Yes, it means something, but
not to normal people

97

Examples


• This was the result of
RewriteCond %{HTTP_HOST}
!^wooga.drbacchus.com [NC]

98

Examples


• It shows what the input variable
looked like


99

Examples


• And what pattern was applied

100

Examples


• As well as what happened


101

Another example

(3) applying pattern '^/book/(mod)?_?rewrite' to uri '/
index.php'

• Was a result of
RewriteRule ^/book/(mod)?_?rewrite
http://www.amazon.com/exec/obidos/asin/
1590595610/drbacchus/ [R,L]

102

Again ...

index.php'

• What was requested

103

And ...

index.php'

• What it was compared against

104

Matched?

index.php'

• If it matched, the next line will be
the action log


105

The whole thing

(3) applying pattern '^/books?/(mod)?_?rewrite' to uri '/books/rewrite'
(2) rewrite '/books/rewrite' -> 'http://www.amazon.com/exec/obidos/
asin/1590595610/drbacchus/'
(2) explicitly forcing redirect with http://www.amazon.com/exec/
obidos/asin/1590595610/drbacchus/
(1) escaping http://www.amazon.com/exec/obidos/asin/1590595610/
drbacchus/ for redirect
(1) redirect to http://www.amazon.com/exec/obidos/asin/1590595610/
drbacchus/ [REDIRECT/302]

106

The match:


107

Followed by


108

[R]


109

But it all runs together!

• Look for:
•
(2) init rewrite engine with requested uri /atom/1

• ‘init rewrite engine’ shows where
a new request started being
rewritten

110

Fortunately ...

Photo CC by Camo53 (ﬂickr)

• mod_proxy_balancer
• Added in 2.1

Fairly simple to configure

<Proxy balancer://mycluster>
BalancerMember http://192.168.1.50:80
BalancerMember http://192.168.1.51:80
</Proxy>
ProxyPass /test balancer://mycluster

Sticky Sessions

Ensures that connections go to the same server they
started with.

ProxyPass / balancer://mycluster/
stickysession=PHPSESSIONID

118

Balancing measures

ProxyPass / balancer://hotcluster/
<Proxy balancer://hotcluster>
BalancerMember http://1.2.3.4:8009 loadfactor=1
# The below is the hot standby
BalancerMember http://1.2.3.6:8009 status=+H
ProxySet lbmethod=bytrafﬁc
</Proxy>

119

1.2.3.5 gets twice the traffic

</Proxy>

120

Hot spare

</Proxy>

121

bytraffic or byrequests

</Proxy>

122

BalancerManager

<Location /balancer-manager>
SetHandler balancer-manager

Order Deny,Allow
Deny from all
Allow from .example.com
</Location>

123

Disable a
particular host

125

Notes

• The things on the other end don’t have to
be Apache
• This is a popular way to set up Ruby on
Rails, with Mongrel

126

Bandwidth limiting
Picture by Joachim S. Müller (Flickr)

People always want their websites to run
slower. Seems odd to me ...

In 2.4 ...

• 2.4 adds two new modules for this
purpose
• mod_dialup
• mod_ratelimit

mod_dialup

Party like it’s 1999

v.92? Really?
<Location /mysite>
ModemStandard V.92
</Location>

Also available:
V.21
V.26bis
V.32
V.92

mod_ratelimit

<Location /downloads>
SetHandler RATE_LIMIT
SetEnv rate-limit 400
</Location>

Speed is in kb/s

Prior to 2.4

A variety of other modules do bandwidth
kind of things:

mod_cband
mod_bwshare
mod_bw
mod_evasive
mod_limitipconn

Logging

• mod_logio
• mod_log_forensic

Obligatory ridiculous log photo

Photo by Zevotron (Flickr)

Not enough

• Your log files don’t tell you enough
• Want more

Logging - mod_logio

Complete INPUT and
OUTPUT size

136

Logging - mod_logio

Complete INPUT and
OUTPUT size

137

Combined Log Format - Bytes transferred

138

Less than half the story

• Only bytes transferred to the
client
• Doesn’t include headers
• Doesn’t include data sent from
the client to the server

139

mod_logio

•Adds two additional
variables
•%I - Input bytes
•%O - Output bytes
•Includes headers, both
directions
140

mod_log_forensic

• Did it ever finish?

ForensicLog

ForensicLog /var/log/httpd/forensic.log

ForensicLog

ForensicLog /var/log/httpd/forensic.log

• Post-process with the check-forensic
script to tell you which URLs never exited

mod_speling

CheckSpelling On
CheckCaseOnly On

Image Theft

SetEnvIf Referer
".example.com/" local_referal
# Allow browsers that do not send Referer info
SetEnvIf Referer "^$" local_referal
<Directory /web/images>
Order Deny,Allow
Deny from all
Allow from env=local_referal
</Directory>

Or ...

RewriteEngine on
RewriteCond %{HTTP_REFERER} !=""
RewriteCond %{HTTP_REFERER} !example.com [NC]
RewriteRule .(jpe?g|gif|png)$ - [F,NC]

Or ...
RewriteEngine on

# depending upon in which context
# you use the RewriteRule,
# you might need a condition to
# exclude the go_away.png to prevent
# an internal redirect looping. We don't use a RegEx here:

RewriteCond %{REQUEST_URI} !=/images/go_away.png
RewriteRule .(jpe?g|gif|png)$ /images/go_away.png [NC,L]

Or ...
RewriteEngine on

# depending upon in which context
# you use the RewriteRule,
# you might need a condition to
# exclude the go_away.png to prevent
# an internal redirect looping. We don't use a RegEx here:

RewriteCond %{REQUEST_URI} !=/images/go_away.png
RewriteRule .(jpe?g|gif|png)$
http://other.example.com/images/go_away.png [R,NC,L]

Query Strings

monkeys.php?q=lemur&color=green&level=99.7&doc=info.txt

• Query Strings are:
• Ugly
• Hard to type
• Hard to remember
• Potentially insecure

Path Info


/monkeys/lemur/green/99.7/info

mod_rewrite



RewriteRule ^/monkeys/(.+)/(.+)/(.+)/(.+)
/monkeys.php?q=$1&color=$2&level=$3&doc=$4.txt
[PT,L,NE]

Engineering for failure

• Why not do it right to
begin with, and avoid the
mess?
• PHP makes this fairly
easy

Step One: SetHandler

• We want monkeys to be a PHP script
• We rename monkeys.php to monkeys, and
then ...
<Files monkeys>
SetHandler application/x-httpd-php
</Files>
This goes in your
server conﬁg, or
in .htaccess

Step Two: explode()

• The rest of the solution is in your
PHP:
$args = explode( $_SERVER[‘PATH_INFO’] );
$type = $args[0];
$color = $args[1];
...

While we’re at it

• File extensions are *so* 1980s
• All your files are php files, right?
• Why give them a .php extension?

RewriteCond %{REQUEST_URI} !.
RewriteRule ^ - [H=application/x-httpd-php,PT]

Write a better FM

• I’ll never get this far in the presentation,
right?

Apache Cookbook - TekX Chicago 2010

More Related Content

What's hot

Similar to Apache Cookbook - TekX Chicago 2010

More from Rich Bowen

Recently uploaded

Apache Cookbook - TekX Chicago 2010

Editor's Notes