![iPlanet to HP Apache
5.4 gcc
gcc, the GNU Open Source compiler, is needed for building Apache modules in C and C++. To download, go to
the “Develop & Solution Partner Portal” at http:/www.hp.com/dspp/ and search for gcc.
5.5 IPv6
HP Apache 2.x with IPv6 support is a separate product, B9416BA. B9416BA runs on HP-UX 11.11 with the IPv6
product, T1306AA, also installed.
To install T1306AA, go to software.hp.com and search for: T1306AA
HP Apache-based Web Server may or may not work the same as in the IPv4 Apache-based Web Server product.
For example, the following components work on IPv6 but may not behave correctly for networking calls related to
IPv6, due to the lack of underlying support: Perl-based CGI, mod_perl, Webmin, LDAP connectivity, Stunnel,
OpenSSL, ab with SSL, and SSL clients.
For detailed information about setting up and using HP Apache 2.x with IPv6, refer to the IPv6 admin guide that
is bundled with HP Apache, /opt/hpapache2/hp_apache_docs/ipv6.admin.guide, or the online copy,
http://www.hp.com/products1/unix/webservers/apache/infolibrary/pa_ipv6_admin_guide.pdf
For more information on IPv6, see http://www.ipv6.org/
5.6 Patches
These patches are recommended for running the HP Apache-based Web Server. Please install these patches (or
supersedes) and their dependent patches. Patches can be downloaded from HP’s IT Resource Center at,
http://us-support.external.hp.com
1. Tomcat
PHNE_22397 s700_800 11.00 cumulative ARPA Transport
2. Dynamic Shared Libraries (DSOs)
Check the version of ld on your system to determine if it needs upgrading. It should be at least version
B.11.28. Without this patch you may see unresolved external errors such as,
"/usr/lib/dld.sl: Unresolved symbol : dlsym (code) from mod_jk.so"
Update to at least B.11.28 by installing PHSS_24303 or later,
PHSS_24303 s700_800 11.00 ld(1) and linker tools cumulative patch
To verify the version of ld:
$ ld –V
92453-07 linker command s800.sgs ld PA64 B.11.28 REL 010621
ld: 92453-07 linker linker ld B.11.28 010621
ld: Usage: ld [options] [flags] files
$ what /usr/lib/libdld.sl
/usr/lib/libdld.sl:
92453-07 dld dld libdld.sl B.11.28 010621
3. IPv6 on HP-UX 11i (PA-RISC)
Page 19](https://image.slidesharecdn.com/iplanet-to-hp-apache-migration-plan3799/85/iPlanet-to-HP-Apache-Migration-Plan-19-320.jpg)
![iPlanet to HP Apache
Modify the httpd.conf and the ssl.conf files to assign ports.
IP Addresses and Ports HP Apache 2.x
Binding to port 80 on all IP addresses Listen *:80
Binding to port 80 on 111.222.333.444 Listen 111.222.333.444:80
Binding to ports 80 and 8080 on all IP Listen 80
addresses Listen 8080
Binding to a domain name Listen uses IP addresses only.
Using extended addresses, IPv6 Listen [fe80::1]:80
IP Address and Port HP Apache 2.x
port 80 on all IP addresses Listen *:80 or Listen 80
port 80 on 111.222.333.444 Listen 111.222.333.444:80
ports 80 and 8080 on all IP addresses Listen 80
Listen 8080
port 80 on 111.222.333.444 and Listen 192.170.2.1:80
port 8080 on 555.666.777.888 Listen 192.170.2.5:8000
Specifying a domain name Listen uses IP addresses only.
Extended addresses, IPv6 Listen [fe80::1]:80
Notes: <VirtualHost> can be used to specify a different behavior for one or more of the addresses
and ports. See the Enterprise 3: Virtual Servers step for setting up Virtual Hosts. The ServerName
directive has an optional port number argument that is used in redirection URLs. See the Core 4:
ServerName step for specifying a server name.
For more information see the Apache documentation,
http://httpd.apache.org/docs-2.0/bind.html
http://httpd.apache.org/docs-2.0/vhosts/
http://httpd.apache.org/docs-2.0/dns-caveats.html
Verification:
Try various URLs with ports numbers you have configured, for example,
http://yourserver.com
https://yourserver.com (SSL)
For HP Apache 2.x, you can also run the ports utility to check the configured ports,
/opt/hpapache2/util/ports.sh. More information on this utility can be found in
/opt/hpapache2/hp_apache_docs/utilities.user.guide.
Core 4: ServerName
Definition:
Sets the hostname of the server.
NES/iWS:
Preferences Network Settings
HP Apache 1.3.x:
Page 32](https://image.slidesharecdn.com/iplanet-to-hp-apache-migration-plan3799/85/iPlanet-to-HP-Apache-Migration-Plan-32-320.jpg)
![iPlanet to HP Apache
This exports the certificate identified by nickname from the database to the PKCS#12 format in
the exportfile specified. The exportfile contains both the certificate and the corresponding key in
the same file in the DER format (binary format).
d. Convert the DER format file into the PEM format by using the /opt/apache/ssl/bin/openssl utility:
$ openssl pkcs12 -in <DER exportfile> -out <PEM exportfile>
You will be asked to enter the PEM pass phrase. The resulting file, exportfile.pem, contains both
the key and the certificates in the same file. You should manually split this file into .crt, with
certificate in it and .key with key in it.
NOTE: This option can be used only for those certificates that have a valid key in the keys
database. If the certificate doesn't have a corresponding key in the database, the utility will
fail with the error "certmig: find cert by nickname failed".
For more information, see /opt/apache/htdocs/doc/certmig.user.guide
HP Apache 2.x (not for IPF):
HP Apache 2.x supports Netscape 4.x certificates but not Netscape 3.x certificates. The process for
migrating certificates is similar to the process described for HP Apache 1.3.x. In HP Apache 2.x,
/opt/hpapache2/util/test_certmig.sh can be used a wrapper around the certmig utility. If desired,
certmig utility can be used by following the steps for HP Apache 1.3.x above.
• For Netscape 3.x certificates:
a. Use the migration tool provided with iWS to migrate 3.x certificates to 4.x certificates.
b. Use test_certmig.sh to migrate 4.x certificates to Apache certificates as described below.
• For Netscape 4.x certificates, use /opt/hpapache2/util/test_certmig.sh
a. Verify certificates in the desired Certificate Database,
$ test_certmig.sh –list
This prompts the user for the directory containing the Certificate and Key Databases, and then
lists the “Nick Name” of each Certificate found.
b. Extract a certificate from the list above,
$ test_certmig.sh –extract
This prompts the user for the following [defaults in brackets]
Netscape Database directory location [/opt/hpapache2/util]
SSL Certificates directory location [/opt/hpapache2/util/ssl.crt]
Directory Location of the SSL Certificate key file [/opt/hpapache2/util/ssl.key]
Import/Export Pass Phrase [hp.com]
Name of the certificate to be extracted [My Personal Certificate]
Password or Pin for "NSS Certificate DB"
For more information, see
/opt/hpapache2/hp_apache_docs/utilities.user.guide (test_certmig.sh explained)
/opt/hpapache2/hp_apache_docs/certmig.user.guide (certmig binary explained)
Verification:
After extracting the certificate – key pairs, you should be able to “view” them using openssl,
/opt/apache/ssl/bin/openssl
or
/opt/hpapache2/ssl/openssl_bsafe/bin/openssl.pkcs12
1. To view the Key (the following commands are one line):
Page 40](https://image.slidesharecdn.com/iplanet-to-hp-apache-migration-plan3799/85/iPlanet-to-HP-Apache-Migration-Plan-40-320.jpg)
![iPlanet to HP Apache
# Define the server map
RewriteMap myservers rnd:/opt/apache/rewritemaps/mymap.txt
# Rewrite the URL if it matches the web server name
RewriteRule ^http://www.(.*)$ http://mymap:www).$2 [P,L]
# Forbid any URL that doesn’t match
RewriteRule .* - [F]
# Proxy directives
ProxyRequests on
ProxyPassReverse / http://www1.myserver.com/
ProxyPassReverse / http://www2.myserver.com/
ProxyPassReverse / http://www3.myserver.com/
ProxyPassReverse / http://www4.myserver.com/
ProxyPassReverse / http://www5.myserver.com/
ProxyPassReverse / http://www6.myserver.com/
HP Apache 2.x:
HP Apache 2.0 is configured for load balancing in the same way as HP Apache 1.3.x. If considering
mod_backhand, verify first if the module has an Apache 2.x version.
Verification:
1. Flood the proxy server with client requests. For example, test a URL 4000 times with 200
concurrently:
/opt/hpapache2/bin/ab -n 4000 –c 200 http://localhost/index.html
2. Determine if response time is improved by looking at the output of ab. ab is the Apache
benchmarking tool bundled with the product, http://httpd.apache.org/docs/programs/ab.html
This is ApacheBench, Version 2.0.32 <$Revision: 1.87 $> apache-2.0
Copyright (c) 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Copyright (c) 1998-2001 The Apache Software Foundation, http://www.apache.org/
Benchmarking localhost (be patient)
Completed 400 requests
Completed 800 requests
Completed 1200 requests
Completed 1600 requests
Completed 2000 requests
Completed 2400 requests
Completed 2800 requests
Completed 3200 requests
Completed 3600 requests
Finished 4000 requests
Server Software: HP
Server Hostname: localhost
Server Port: 80
Document Path: /index.html
Document Length: 4307 bytes
Concurrency Level: 200
Time taken for tests: 70.367472 seconds
Page 68](https://image.slidesharecdn.com/iplanet-to-hp-apache-migration-plan3799/85/iPlanet-to-HP-Apache-Migration-Plan-68-320.jpg)
![iPlanet to HP Apache
Complete requests: 4000
Failed requests: 12
(Connect: 0, Length: 12, Exceptions: 0)
Write errors: 0
Total transferred: 18352776 bytes
HTML transferred: 17176316 bytes
Requests per second: 56.84 [#/sec] (mean)
Time per request: 3.518 [ms] (mean)
Time per request: 0.018 [ms] (mean, across all concurrent requests)
Transfer rate: 254.69 [Kbytes/sec] received
Connection Times (ms)
min mean[+/-sd] median max
Connect: 0 0 1.1 0 27
Processing: 216 3505 1328.8 3648 10469
Waiting: -2878 1934 1224.3 2126 8359
Total: 216 3505 1328.8 3648 10469
Percentage of the requests served within a certain time (ms)
50% 3648
66% 3954
75% 4258
80% 4484
90% 5475
95% 5988
98% 6079
99% 8094
100% 10469 (longest request)
8.10 Migrating Enterprise Capability
See Appendix 8: Enterprise Capability for a summary on the how NES and iWS differ from HP Apache.
Enterprise 1: Multiple Web Server Instances
Definition:
This is the ability to run multiple copies of a web server on one machine.
NES/iWS:
General Administration
HP Apache 1.3.x:
Multiple instances of HP Apache 1.3.x cannot run on the same machine.
HP Apache 2.x:
HP Apache 1.3.x and 2.x can be installed on the same machine. They can also run simultaneously
provided they use different port number or different IP addresses. Both use port 80 and port 443 (SSL)
by default.
Multiple installations of HP Apache 2.x can run on the same machine provided they use different port
numbers or different IP addresses. The /opt/hpapache2/util/altroot.sh utility will move Apache
from its default location (/opt/hpapache2/) to an alternate directory. altroot.sh changes all
occurrences of the current Apache root to the new Apache root in all configuration files and scripts.
Page 69](https://image.slidesharecdn.com/iplanet-to-hp-apache-migration-plan3799/85/iPlanet-to-HP-Apache-Migration-Plan-69-320.jpg)
![iPlanet to HP Apache
1. Enable PHP
2. Try a simple SQL example. Assuming a database with a customer table containing name and
address fields,
<?
@ $db = mysql_pconnect("localhost", user, password);
if (!db)
{
echo "Error: Couldn't connect";
}
mysql_select_db("customers");
$query = "select * from customers";
$result = mysql_query($query);
$num_results = mysql_num_rows($result);
for ($i = 0; $i < $num_results; $i++)
{
$row = mysql_fetch_array($result);
echo "<p;>i+1).". Name: ";
echo $row["name"];
echo "<br;> Address: ";
echo $row["address"];
echo "<p;>";
}
?>
JDBC:
1. Enable Tomcat servlets (Server-Side 3: Java Servlets and Java Server Pages (JSPs))
2. Create a sample servlet that talks to a database such as the following
package test;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.util.*;
import java.sql.*;
public class Servlet1 extends HttpServlet {
private static final String CONTENT_TYPE = "text/html";
// initialize the driver
static {
try {
Class.forName("COM.ibm.db2.jdbc.net.DB2Driver").newInstance();
} catch (Exception e) {
e.printStackTrace();
}
}
Connection con;
public void init() throws ServletException {
try {
// construct the URL
String url = "jdbc:database://server:port/sample";
// connect to database with userid and password
Page 77](https://image.slidesharecdn.com/iplanet-to-hp-apache-migration-plan3799/85/iPlanet-to-HP-Apache-Migration-Plan-77-320.jpg)
iPlanet to HP Apache Migration Plan
- 1. hp apache-based september migration guide web server 2002 Migration Guide iPlanet Web Server to HP Apache-based Web Server on HP-UX September 3, 2002 Page 1
- 2. iPlanet to HP Apache Glossary ................................................................................................................................................................... 6 Legal Notices ........................................................................................................................................................... 7 Conventions in this Guide ...................................................................................................................................... 8 1 Using this Guide ......................................................................................................................................... 9 2 Overview of HP Apache-based Web Servers......................................................................................... 11 2.1 Summary of Features in HP Apache-based Web Server 1.3.x ........................................................ 11 2.2 Summary of New Features in HP Apache-based Web Server 2.x ................................................... 12 2.3 Feature Differences between PA and IPF .......................................................................................... 13 2.4 Getting More Information .................................................................................................................... 14 3 HP Apache-based Web Server Requirements ....................................................................................... 16 4 Installing or Upgrading HP-UX ................................................................................................................ 17 5 Installing Required Software ................................................................................................................... 18 5.1 Perl......................................................................................................................................................... 18 5.2 Java Development Kit (JDK) ............................................................................................................... 18 5.3 Java Servlet Development Kit (JSDK 2.0).......................................................................................... 18 5.4 gcc ......................................................................................................................................................... 19 5.5 IPv6 ........................................................................................................................................................ 19 5.6 Patches.................................................................................................................................................. 19 6 Installing the HP Apache-based Web Server......................................................................................... 21 7 Tools and Utilities..................................................................................................................................... 22 7.1 HP Apache Tools.................................................................................................................................. 22 7.1.1 Certmig .......................................................................................................................................... 22 7.1.2 Test_certmig.sh ............................................................................................................................. 22 7.1.3 mkcert.sh ....................................................................................................................................... 22 7.1.4 stunnel_ctl.sh................................................................................................................................. 22 7.1.5 Ports.sh.......................................................................................................................................... 23 7.1.6 Cache_util.pl .................................................................................................................................. 23 7.2 iPlanet Tools ......................................................................................................................................... 24 7.2.1 migrateLocalDB ............................................................................................................................. 24 7.2.2 htconvert ........................................................................................................................................ 24 8 Performing the Migration......................................................................................................................... 25 8.1 Configuration File Overview ............................................................................................................... 25 8.2 Preparation Checkpoint....................................................................................................................... 27 8.3 Migrating the Core................................................................................................................................ 28 Core 1: Process Handling.......................................................................................................................... 28 Core 2: Logging ......................................................................................................................................... 30 Core 3: IP Addresses and Port Numbers .................................................................................................. 31 Core 4: ServerName.................................................................................................................................. 32 Core 5: DNS Lookups................................................................................................................................ 33 Core 6: Document Root............................................................................................................................. 34 Core 7: Additional Document Directories .................................................................................................. 35 Core 8: Directory Indexing......................................................................................................................... 35 Core 9: User Directories ............................................................................................................................ 36 Page 2
- 3. iPlanet to HP Apache Core 10: MIME Types................................................................................................................................. 37 8.4 Migrating Security ................................................................................................................................ 38 Security 1: SSL/TLS .................................................................................................................................. 38 Security 2: Certificates............................................................................................................................... 39 Security 3: Chroot...................................................................................................................................... 41 Security 4: .htaccess file............................................................................................................................ 42 Security 5: Access Control/Access Control Lists (ACLs) .......................................................................... 43 Security 6: Database Authentication ......................................................................................................... 45 Security 7: LDAP Authentication ............................................................................................................... 48 8.5 Migrating Server-Side Execution........................................................................................................ 49 Server-Side 1: CGI scripts......................................................................................................................... 49 Server-Side 2: Parsed HTML (SHTML/SSI).............................................................................................. 51 Server-Side 3: Java Servlets and Java Server Pages (JSPs) .................................................................. 53 Server-Side 4: Java Server Pages (JSP) Custom Tag Libraries .............................................................. 56 8.6 Migrating Management ........................................................................................................................ 56 Management 1: Server Status................................................................................................................... 56 Management 2: Server Administration ...................................................................................................... 57 Management 3: Cluster Management ....................................................................................................... 60 Management 4: Distributed Administration ............................................................................................... 61 Management 5: Dynamic Log Rotation ..................................................................................................... 63 8.7 Migrating Web Publishing ................................................................................................................... 64 Web Publishing 1: HTTP PUT ................................................................................................................... 64 Web Publishing 2: WebDAV...................................................................................................................... 64 8.8 Migrating Performance ........................................................................................................................ 65 Performance 1: File Caching ..................................................................................................................... 65 8.9 Migrating Scalability ............................................................................................................................ 67 Scalability 1: Load Balancing..................................................................................................................... 67 8.10 Migrating Enterprise Capability .......................................................................................................... 69 Enterprise 1: Multiple Web Server Instances ............................................................................................ 69 Enterprise 2: Internationalization (i18n)...................................................................................................... 70 Enterprise 3: Virtual Servers...................................................................................................................... 71 Enterprise 4: Proxy Server ........................................................................................................................ 73 8.11 Migrating Developer Support.............................................................................................................. 75 Developer 1: Database Connectivity ......................................................................................................... 75 Developer 2: Plug-in APIs ......................................................................................................................... 78 9 Final Migration Verification ..................................................................................................................... 81 Appendix A Summary of Web Server Functionality Differences...................................................................... 82 A.1 Core.............................................................................................................................................................. 82 Process Handling........................................................................................................................................ 82 Logging ....................................................................................................................................................... 82 Log Rotation ............................................................................................................................................... 82 IP Addresses and Port Numbers ................................................................................................................ 82 DNS lookups............................................................................................................................................... 83 Document Directories ................................................................................................................................. 83 Directory indexing ....................................................................................................................................... 83 File redirection ............................................................................................................................................ 83 MIME Types and Settings .......................................................................................................................... 83 A.2 Security........................................................................................................................................................ 84 SSL/TLS ..................................................................................................................................................... 84 Certificates.................................................................................................................................................. 84 Page 3
- 4. iPlanet to HP Apache Chroot ......................................................................................................................................................... 84 Access Control Files/Dynamic Configuration Files (.nsconfig, .htaccess) ................................................. 84 Access Control Lists (ACLs)....................................................................................................................... 84 Database Authentication ............................................................................................................................ 84 Directory-based Access Control ................................................................................................................. 85 A.3 Server-Side Execution ............................................................................................................................... 85 Common Gateway Interface (CGI) ............................................................................................................. 85 Parsed HTML (SHMTL).............................................................................................................................. 85 SHTML <SERVLET> tag............................................................................................................................ 85 Web Application Interface (WAI) ................................................................................................................ 85 Java Servlets .............................................................................................................................................. 86 Java Server Pages (JSP) ........................................................................................................................... 86 Java Server Pages (JSP) Custom Tag Libraries........................................................................................ 86 Server-Side JavaScript (LiveWire, LiveConnect) ....................................................................................... 86 A.4 Management................................................................................................................................................ 86 Server Status .............................................................................................................................................. 86 Cluster Management .................................................................................................................................. 87 Administration Server ................................................................................................................................. 87 Distributed Administration........................................................................................................................... 87 System Monitoring ...................................................................................................................................... 87 A.5 Web Publishing........................................................................................................................................... 87 Web Publisher ............................................................................................................................................ 87 Search Collections and Version Control..................................................................................................... 88 A.6 Performance................................................................................................................................................ 88 File Caching................................................................................................................................................ 88 A.7 Scalability .................................................................................................................................................... 88 Load Balancing ........................................................................................................................................... 88 A.8 Enterprise Capability.................................................................................................................................. 88 Multiple Web Server Instances................................................................................................................... 88 Internationalization (i18n) ........................................................................................................................... 88 LDAP Directory Server Integration ............................................................................................................. 89 Virtual Servers ............................................................................................................................................ 89 Proxy Server ............................................................................................................................................... 89 A.9 Developer Support ..................................................................................................................................... 90 Database Connectivity................................................................................................................................ 90 User Document Directories ........................................................................................................................ 90 Server plug-ins............................................................................................................................................ 90 A.10 Application Integration ............................................................................................................................ 90 HP Virtual Vault .......................................................................................................................................... 90 Application Servers..................................................................................................................................... 90 Appendix B Important HP Apache Files.............................................................................................................. 91 B.1 Configuration Files..................................................................................................................................... 91 B.2 Sample Files................................................................................................................................................ 92 B.3 Bundled Apache Web Server Documentation ......................................................................................... 92 B.4 Web Server Icons ....................................................................................................................................... 92 B.5 Backup......................................................................................................................................................... 93 B.6 Administration ............................................................................................................................................ 93 B.7 Installation files .......................................................................................................................................... 93 Page 4
- 5. iPlanet to HP Apache B.8 Startup/Shutdown scripts.......................................................................................................................... 93 Appendix C Web Servers Component Reference .............................................................................................. 95 Appendix D Open Source Apache versus HP Apache-based Web Server...................................................... 99 Page 5
- 6. iPlanet to HP Apache Glossary Apache Apache HTTP Server Project developed and maintained by ASF ASF Apache Software Foundation HP Apache HP Apache-based Web Server IPF Itanium Process Family iWS iPlanet Web Server, Enterprise Edition 4.1 (iWS EE 4.1) NES Netscape Web Server 3.6 (NES 3.6) PA-RISC Precision Architecture, Reduced Instruction Set RSA RSA Security Inc. JDK Java Development Kit LDAP Lightweight Directory Access Protocol MPM Multi-Processing Module PHP Hypertext Preprocessor WebDAV Web-based Distributed Authoring and Versioning IPv6 Internet Protocol Version 6 Publication History Version 5 September 3, 2002 Updating mod_perl DSO, auth_ldap 1.6 for HP Apache 1.3.26.06 Version 4 August 12, 2002 Updating OpenSSL v.0.9.6g, mod_ssl v.2.8.10 and MM v.1.2.1 for HP Apache 1.3.26.05 and 2.0.39.05 Version 3 July 24, 2002 Updating PHP to 4.2.2 Version 2 June 26, 2002 Update for HP Apache-based Web Server 2.0.39 and 1.3.26 Version 1 May 16, 2002 First Release Page 6
- 7. iPlanet to HP Apache Legal Notices The information in this document is subject to change without notice. Warranty Disclaimer. HEWLETT-PACKARD MAKES NO WARRANTY OF ANY KIND WITH REGARD TO THIS INFORMATION, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. Hewlett-Packard shall not be liable for errors contained herein or for direct, indirect, special, incidental or consequential damages in connection with the furnishing, performance or use of this material. Restricted Rights Legend. Use, duplication or disclosure by the U.S. Government is subject to restrictions as set forth in subparagraph (c) (1) (ii) of the Rights in Technical Data and Computer Software clause at DFARS 252.227-7013 for DOD agencies. Rights for non-DOD U.S. Government Department and Agencies are as set forth in FAR 52.227-19 (c)(1,2). Copyright Notices. Copyright Hewlett-Packard Company 1997-2002. This document contains information that is protected by copyright. All Rights Reserved. Reproduction, adaptation, or translation without prior written permission is prohibited, except as allowed under the copyright laws. Trademark Notices. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company Limited. Intel® Itanium™ Processor Family is a trademark of Intel Corporation in the U.S. and other countries and is used under license. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. Netscape is a U.S. trademark of Netscape Communications Corporation. Oracle ® is a registered U.S. trademark of Oracle Corporation, Redwood City, California. Acknowledgements. This product includes software developed by the Apache Software Foundation. This documentation is based on information from the Apache Software Foundation (http://www.apache.org). This product includes software developed by the OpenLDAP Project (http://www.openldap.org). This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org). This product includes cryptographic software written by Eric Young (eay@cryptsoft.com). This product includes PHP, freely available from (http://www.php.net). More information on the HP Apache-based Web Server for HP-UX can be found at http://www.hp.com/go/webserver Page 7
- 8. iPlanet to HP Apache Conventions in this Guide The following typographical conventions are used in this guide: $cat Boldface type with a “$” represents command or keywords that the user must enter. ports.sh Boldface type is also used for program names. <italic> Italic text within angle brackets indicates variable values, placeholders and function argument names. Fixed Fixed Width typeface indicates information that the computer displays. Examples include source Width code, file content, and directory paths. A right pointing arrow represents a separator between mouse clicks. For example, go to software.hp.com then click on Featured Products then click on HP Apache-based Web Server: http://software.hp.com Featured Products HP Apache-based Web Server http:// http:// refers to external documents Appendix Underlined text refers to a section of the migration guide Page 8
- 9. iPlanet to HP Apache 1 Using this Guide This guide covers the migration of Netscape Web Server (NES 3.6) and iPlanet Web Server, Enterprise Edition (iWS EE 4.1) to the HP Apache-based Web Server for HP-UX. The HP Apache-based Web Server currently runs on these versions and later of HP-UX: • HP-UX 11.0, PA-RISC • HP-UX 11i, PA-RISC • HP-UX 11i Version 1.5 (11.20) and Version 1.6 (11.22), IPF Included in this guide is information on how to: • Find more resources on the HP Apache-based Web Server • Understand how and what functionality is migrated • Prepare for a migration • Perform a migration • Verify the migration The focus of this document is on setting up HP Apache with functionality similar to Netscape and iPlanet web server functionality. Appendix A Summary of Web Server Functionality Differences provides a high-level view of basic functionality differences between iPlanet and HP Apache-based web servers. A broad range of technical topics are discussed here, some of which may not apply to your own web server setup. Select the subset of requirements and migration steps that are applicable to your installation. This guide is not intended as a general reference for setting up and running the HP Apache-based Web Server. Because of this focus, not all of the HP Apache-based Web Server’s features are described here. Additional HP Apache-based Web Server features are mentioned in the Overview of HP Apache-based Web Servers. Please consult the overview and Getting More Information sections for general information about the HP Apache-based Web Server. For a PDF version of this document, click on the link under “migration guides” http://www.hp.com/products1/unix/webservers/apache/techtips/index.html Guide Layout Overview of HP Apache-based Web Servers describes the family of HP Apache-based Web Servers that are currently available. Getting More Information addresses where to go for in-depth content about HP Apache-based Web Server releases and their features. HP Apache-based Web Server Requirements contains detailed information about the pre-requisites for product installation including revision numbers and patch information. Tools and Utilities introduces a set of tools that can be used during certain migration steps. Performing the Migration consists of a series of detailed steps to migrate specific features. These steps can be performed in any order. Select which features will be migrated from iPlanet to the HP-based Apache Web Server then execute the corresponding implementation steps. Each step includes, 1. A label to identify the functionality category (Core 1, Core 2, Security 1, Security 2, etc.) 2. A brief description of the feature 3. Directions on how to find the feature’s setting(s) in your iPlanet web server 4. Commands for setting the equivalent value(s) in the HP Apache web server 5. Verification of migration for the feature Page 9
- 10. iPlanet to HP Apache Appendix A Summary of Web Server Functionality Differences gives a big-picture view of how features between iPlanet and the HP Apache-based Web Server compare. Appendix B Summary of Web Server File Differences gives the location of important HP Apache files such as sample files, server bundled documentation and startup/shutdown scripts. Appendix C Web Servers Component Reference is a table that displays iPlanet and HP Apache features side-by- side for a quick reference of what each web server contains. Appendix D Open Source Apache versus HP Apache-based Web Server is a single table that displays ASF Apache, HP Apache 1.3.x, and HP Apache 2.x components as a quick reference for their content and component version numbers. Page 10
- 11. iPlanet to HP Apache 2 Overview of HP Apache-based Web Servers HP Apache-based Web Server is built on the open source Apache Web Server software developed by the Apache Software Foundation (ASF) with additional open source components and HP proprietary content. These components are integrated, bundled, tested, distributed, and supported by HP as the HP Apache-based Web Server product. Support is provided by the Hewlett-Packard Response Center as part of the HP-UX operating system. The HP Apache-based Web Server encompasses a suite of tools and services for creating and running secure web applications. HP currently has two families of HP Apache-based Web Servers. Each family includes PA-RISC and IPF versions: 1. HP Apache-based Web Server 1.3.x 2. HP Apache-based Web Server 2.x HP Apache-based Web Server 2.x is the latest product family and includes new features. Please review the product specifications for HP Apache 1.3.x and 2.x and/or talk to your HP representative to determine which version is best for you. NOTE: All users are encouraged to migrate to HP Apache-based Web Server 2.x. No more enhancements are planned for HP Apache 1.3.x. 2.1 Summary of Features in HP Apache-based Web Server 1.3.x HP Apache-based Web Server 1.3.x Description Features auth_ldap Authenticates users in iPlanet (Netscape) Directory Servers or OpenLDAP Directory Servers stunnel control utility Stunnel enables secure (SSL) transactions between HP Apache and an LDAP Directory Server Secure Socket Layer (SSL) Secure transactions with 128-bit/168-bit mod_ssl, OpenSSL, RSA’s BSAFE Crypto C encryption Library mod_perl Enables Perl shared libraries and faster Perl CGI scripts Apache JServ Java servlets run by Apache JServ and connected to HP Apache through mod_jserv Tomcat Java servlets and JSP run by Tomcat and connected to HP Apache through mod_jserv or mod_jk mod_jk Tomcat connector to HP Apache that supports ajpv12 and ajpv13 protocols PHP Server-side scripting language embedded in HTML with a Java/C++ syntax. Supports many databases. Webmin Web-based GUI Administrator for HP Apache Apache APIs APIs for writing customer Apache modules Dynamic loading of shared objects (DSOs) Modules built as shared libraries and loaded by Apache at run-time C++ shared library (DSO) support HP Apache shared libraries (DSOs) can be written in C++ HP and third-party plug-in support HP Application Server (HP-AS), BroadVision Page 11
- 12. iPlanet to HP Apache Automatic restart of Apache/Tomcat/Webmin Automatic startup at reboot Chroot Named, alternate directory becomes the root directory chroot copy utility Script that copies commonly used HP Apache files and system resources (i.e. system libraries) into the chroot directory MM Library which simplifies shared memory usage certmig utility Migration tool for iPlanet (iWS 4.x) certificates mkcert utility Generates private keys, certificate signing requests and certificates NOTE: Tomcat is a later implementation of the Java servlet specification and replaces Apache JServ. For a complete list of functionality and versions, please read the product specifications, http://www.hp.com/products1/unix/webservers/apache/infolibrary/index.html. 2.2 Summary of New Features in HP Apache-based Web Server 2.x HP Apache-based Web Server 2.x includes the same features as HP Apache-based Web Server 1.3.x plus these additional ones: HP Apache-based Web Server 2.x Description Features CGI daemon Daemon that forks child processes to run CGI scripts for improved CGI performance. suEXEC Provides the ability to run CGI and SSI programs under user IDs different from the user ID of the web server PHP extension to Oracle PHP scripts can access and modify Oracle databases port utility Reads and displays all configured ports altroot utility Move HP Apache 2.0 to a different directory cache utility Helps improve caching performance. test certmig utility Tests importing and exporting of Netscape certificates Multi-threaded processes Multiple threads per process for better scalability New Apache API/APR New APIs to provide additional capabilities and the Apache Portable Runtime (APR), a library forming a system portability layer to many operating systems. Filters Output of a module can be processed by another module IPv6 on HP-UX 11i (PA-RISC) Extended IP address support Web Publishing using WebDAV Web-based Distributed Authoring and Versioning (WebDAV). An IETF standard extension to HTTP to add, modify, move and delete server files locally. For a complete list of functionality and versions, please read the product specifications, http://www.hp.com/products1/unix/webservers/apache/infolibrary/index.html. Appendix A Web Server Functionality Reference also has more details. Page 12
- 13. iPlanet to HP Apache 2.3 Feature Differences between PA and IPF The features in HP Apache-based Web Server for PA-RISC and IPF are almost identical. The few exceptions are noted in the table below. Feature PA-RISC IPF HP Apache documentation /opt/apache/htdocs/doc (1.3.x) /opt/apache/hp_apache_docs (1.3.x) directory /opt/hpapache2/hp_apache_docs (2.x) /opt/hpapache2/hp_apache_docs (2.x) certmig utility 1.3.x, 2.x Not included IPv6 2.x (11i only) Not yet available Data model 32-bit 64-bit The certmig utility is not included with IPF systems since NES and iWS do not run on the IPF platform. IPv6 will be available in a later IPF release. NOTE: The HP Apache-based Web Server documentation directory for PA and IPF are the same for 2.x but not for 1.3.x. Page 13
- 14. iPlanet to HP Apache 2.4 Getting More Information The following tables list resources for HP Apache-based Web Server. For the latest HP Apache-based Web Server information, check http://www.hp.com/go/webserver. Table 1: Resources for HP Apache-based Web Server Resources Location HP Apache-based Web Server HP Apache information and http://www.hp.com/products1/unix/webservers/apache/ technical tips (latest information) HP Apache-based Web Server http://software.hp.com Featured Products HP Apache-based product electronic download Web Server or http://software.hp.com and search for “HP Apache-based Web Server” HP Apache-based Web Server PA-RISC: bundled documents /opt/apache/htdocs/doc/ (1.3.x) /opt/hpapache2/htdocs/hp_apache_docs (2.x) IPF: /opt/apache/hp_apache_docs/ (1.3.x) /opt/hpapache2/htdocs/hp_apache_docs (2.x) HP Apache FAQs http://www.hp.com/products1/unix/webservers/apache/faqs/index. html HP Apache-based Web Server http://www.hp.com/products1/unix/webservers/apache/techtips/ind Version 1.3.x to 2.x Migration ex.html Guide iPlanet to HP Apache-based Web http://www.hp.com/products1/unix/webservers/apache/techtips/ind Server Migration Guide ex.html HP Developer and Solution http://www.hp.com/dspp Partner Portal Table 2: Applications Integrated with HP Apache-based Web Server Integrated Application Resource HP Workload Manager (WLM) http://www.hp.com/go/wlm (1.3.x only) HP Apache connector (mod_lbb) Currently bundled with HP-AS to HP’s application server HP-AS http://www.hpmiddleware.com/download HP Apache connector (mod_bv) to Contact BroadVision BroadVision http://www.broadvision.com/ Table 3: ASF Apache and Open Source Resources Resources Location General Apache HTTP Web Server Project http://httpd.apache.org/ information Apache Software Foundation http://www.apache.org/ (ASF) Apache 1.3 User’s Guide http://httpd.apache.org/docs/ Apache 2.0 User’s Guide http://httpd.apache.org/docs-2.0/ Page 14
- 15. iPlanet to HP Apache Apache developer resources http://dev.apache.org/ Apache Module Registry http://modules.apache.org/ Servlets Tomcat User's Guide http://jakarta.apache.org/tomcat Apache JServ Development Kit 2.0 http://java.sun.com/products/servlet/archive.html (JSDK) for servlet development Perl Perl Interpreter http://software.hp.com/ search for “perl v.5.6.1” mod_perl http://perl.apache.org/ SSL OpenSSL User's Guide http://www.openssl.org/docs/ mod_ssl User's Guide http://www.modssl.org/docs/ PHP PHP User's Guide http://www.php.net/docs.php PHP general information http://www.php.net/ Webmin Webmin User's Guide http://www.swelltech.com/support/webminguide/server-apache.html Webmin Home Page http://www.webmin.com/webmin/ LDAP authentication OpenLDAP http://www.openldap.org/ auth_ldap http://www.rudedog.org/auth_ldap/ For Apache and open source news, see http://www.apacheweek.com/ http://www.oreillynet.com/apache/ http://www.serverwatch.com/stypes/servers/ http://slashdot.org/index.pl?section=apache Page 15
- 16. iPlanet to HP Apache 3 HP Apache-based Web Server Requirements The target web server machine must have the appropriate level of hardware and software for migration. The HP Apache-based Web Server can be installed on the same system that currently hosts the NES or iWS web server or it can be installed on another machine. If the target web server machine is currently running HP-UX 10.20, the operating system must be upgraded to HP-UX 11.x. HP Apache-based Web Server runs on HP-UX 11.0, 11i, and 11i Version 1.5 and Version 1.6. If the target web server machine cannot run 11.x, please contact HP for help and information on planning and performing a hardware upgrade. The HP documentation site, http://docs.hp.com/hpux/os/11.0/, has information on installing HP-UX. The following hardware and software is necessary for installing and running the HP Apache-based Web Server product. Table 4: HP Apache-based Web Server Hardware and Software Requirements HP Apache-based Web HP-UX Platform Disk mod_perl Webmi Java Servlets and JSPs Server Products Space n HP Apache-based Web Server versions 1.3.x v.1.3.26 PA-RISC HP-UX 11.0 or 11i 50-60 MB Perl Perl 5 HP JDK 1.2.2.04 or product # B9415AA v.5.6.1 or higher (JDK 1.3 or greater higher recommended) JSDK 2.0 for ApacheJServ 2.0 servlets v.1.3.26 IPF HP-UX 11i Version 50-60 MB 64-bit Perl 5 HP JDK 1.3.0 for IPF or 1.5 or later Perl for or higher Itanium Processor IPF greater Family (IPF) JSDK 2.0 for Pre-enabled for 64-bit ApacheJServ 2.0 Perl servlets product # B9415AA HP Apache-based Web Server versions 2.x v.2.0.39 PA-RISC HP-UX 11.0 or 11i 80-90 MB Perl Perl 5 HP JDK 1.2.2.04 or product # B9416AA v.5.6.1 or higher (JDK 1.3 or greater higher recommended) v.2.0.39 PA-RISC with HP-UX 11i 80-90 MB currently Perl 5 HP JDK 1.4 or higher IPv6 IPv6 product # no or product # B9416BA T1306AA mod_perl greater support v.2.0.39 IPF HP-UX 11i Version 80-90 MB 64-bit Perl 5 HP JDK 1.3.0 for IPF or product # B9416AA 1.5 or later Perl for or higher IPF greater Page 16
- 17. iPlanet to HP Apache 4 Installing or Upgrading HP-UX The version of HP-UX on your web server machine may need to be updated. If the machine is currently running HP-UX 10.20 then you must upgrade to HP-UX 11.x. Check the HP Apache-based Web Server Requirements table to determine which HP-UX platform you need. When upgrading, 1. Stop your NES or iWS web server 2. Stop the Administration Server 3. Back up your system including the entire NES or iWS environment from the server root (directory structure, files, etc). 4. Install HP-UX 11.x 5. Install other hardware and software as specified in the HP Apache-based Web Server Requirements table 6. Reload your files including your NES or iWS environment Page 17
- 18. iPlanet to HP Apache 5 Installing Required Software 5.1 Perl Perl is needed for mod_perl, for CGI scripts written in Perl, and for Perl utilities bundled with HP Apache (Webmin and apxs). Perl scripts and Utilities • Webmin is a web-based GUI administrator used for managing HP Apache and is dependent on Perl 5 or higher. It expects Perl to be installed in /opt/perl/bin/perl, however Webmin can be re-configured to look in any location. The HP Apache-based Web Server release notes, bundled with the product, describe how to configure Webmin. • apxs is a Perl script for compiling, linking, and configuring Apache modules. apxs expects Perl to reside in /opt/perl/bin/perl. The Perl path in apxs can be changed if Perl is installed in a different location on your machine. apxs on PA-RISC machines uses 32-bit Perl and on IPF machines apxs can use either 32-bit Perl or 64-bit Perl. More information about apxs is available at http://httpd.apache.org/docs- 2.0/programs/apxs.html. • Perl CGI scripts use 32-bit Perl on PA-RISC. On IPF machines, Perl CGI can use either 32-bit Perl or 64-bit Perl. mod_perl The mod_perl module is an add-on module from open source that is compiled into HP Apache. It is not configured by default. To use mod_perl you must explicitly configure it. The mod_perl module makes CGI written in Perl run faster and it also allows Apache modules to be written entirely in Perl. mod_perl modules are dependent on the Perl version and architecture (32 or 64-bit). For PA-RISC machines, mod_perl uses 32-bit Perl. For IPF machines, mod_perl requires 64-bit Perl. The HP Apache-based Web Server release notes, bundled with the product, describe how to configure mod_perl. 5.2 Java Development Kit (JDK) Tomcat Servlets and Apache JServ Servlets are two different implementations of Java servlets that are available with the HP Apache-based Web Server 1.3.x. Tomcat (with mod_jk connector) is the newer servlet implementation and is replacing Apache JServ (mod_jserv) in the open source community. HP Apache-based Web Server 2.x uses Tomcat only. Both implementations of servlets require the HP-UX Java Developer’s Kit. The latest versions of the JDK can be downloaded from: http://www.hp.com/go/java select “SDK and RTE 1.3” or “SDK and RTE 1.4” (PA-RISC or IPF) 5.3 Java Servlet Development Kit (JSDK 2.0) Apache JServ requires the Java Servlet Development Kit (JSDK) 2.0. This can be downloaded from: http://java.sun.com/products/servlet/archive.html By default, JServ assumes that the Java Servlet Development Kit 2.0 is installed under /opt/JSDK2.0. If it is installed in a different directory, then an additional configuration step is necessary. This step is described in the HP Apache-based Web Server release notes that are bundled with the product. Page 18
- 19. iPlanet to HP Apache 5.4 gcc gcc, the GNU Open Source compiler, is needed for building Apache modules in C and C++. To download, go to the “Develop & Solution Partner Portal” at http:/www.hp.com/dspp/ and search for gcc. 5.5 IPv6 HP Apache 2.x with IPv6 support is a separate product, B9416BA. B9416BA runs on HP-UX 11.11 with the IPv6 product, T1306AA, also installed. To install T1306AA, go to software.hp.com and search for: T1306AA HP Apache-based Web Server may or may not work the same as in the IPv4 Apache-based Web Server product. For example, the following components work on IPv6 but may not behave correctly for networking calls related to IPv6, due to the lack of underlying support: Perl-based CGI, mod_perl, Webmin, LDAP connectivity, Stunnel, OpenSSL, ab with SSL, and SSL clients. For detailed information about setting up and using HP Apache 2.x with IPv6, refer to the IPv6 admin guide that is bundled with HP Apache, /opt/hpapache2/hp_apache_docs/ipv6.admin.guide, or the online copy, http://www.hp.com/products1/unix/webservers/apache/infolibrary/pa_ipv6_admin_guide.pdf For more information on IPv6, see http://www.ipv6.org/ 5.6 Patches These patches are recommended for running the HP Apache-based Web Server. Please install these patches (or supersedes) and their dependent patches. Patches can be downloaded from HP’s IT Resource Center at, http://us-support.external.hp.com 1. Tomcat PHNE_22397 s700_800 11.00 cumulative ARPA Transport 2. Dynamic Shared Libraries (DSOs) Check the version of ld on your system to determine if it needs upgrading. It should be at least version B.11.28. Without this patch you may see unresolved external errors such as, "/usr/lib/dld.sl: Unresolved symbol : dlsym (code) from mod_jk.so" Update to at least B.11.28 by installing PHSS_24303 or later, PHSS_24303 s700_800 11.00 ld(1) and linker tools cumulative patch To verify the version of ld: $ ld –V 92453-07 linker command s800.sgs ld PA64 B.11.28 REL 010621 ld: 92453-07 linker linker ld B.11.28 010621 ld: Usage: ld [options] [flags] files $ what /usr/lib/libdld.sl /usr/lib/libdld.sl: 92453-07 dld dld libdld.sl B.11.28 010621 3. IPv6 on HP-UX 11i (PA-RISC) Page 19
- 20. iPlanet to HP Apache HP Apache-based Web Server uses IPv4 by default. To use IPv6 requires installation of the IPv6 product (T1306AA.). IPv6 is available from HP Software Depot. To download, go to http://software.hp.com and search for “HP-UX 11i IPv6”. NOTE: Swlist can be used to check which patches are already installed on your system. For example, $ swlist | egrep "PHNE_|PHSS_" sam can be used for installing patches. Page 20
- 21. iPlanet to HP Apache 6 Installing the HP Apache-based Web Server The HP Apache-based Web Server product is distributed as part of the HP-UX 11i Operating Environment (OE) and on Application Release (AR) CDs. The latest versions are available for electronic download from HP Software Depot. We strongly recommend using the online versions as listed in the requirements table. The online versions are updated frequently and often contain more features and functions than HP Apache versions that are part of the OE or that are distributed on CD. HP Apache-based Web Server is available from these sources: • HP Software Depot, http://software.hp.com Featured Products HP Apache-based Web Server or go to http://software.hp.com and search for “HP Apache-based Web Server”. • HP-UX 11.0/11i Application Release CDs (PA-RISC) • HP-UX 11i OE CDs (IPF) If you are receiving the HP Apache-based Web Server as part of the HP-UX 11.x Operating Environment, the software is installed automatically as part of the OE bundle. (Note: If you are installing Apache as part of the OE update and there is a non-HP version of Apache already on the system, HP Apache will not install.) HP Apache starts up automatically after installation if there are no conflicts with port numbers. HP Apache uses port 80 and port 443 (SSL) by default. During migration, these ports can be changed to other port numbers (i.e. 8080 and 8443) to not conflict with those used by NES or iWS. Make sure to change the port to their permanent numbers when migration is complete. We recommend removing any previous Apache installations (HP or non-HP) rather than installing over existing files. To remove HP Apache from your system, 1. Use swremove to remove HP Apache and completely remove it, $ swremove B9415AA 2. Remove or move the files in /opt/apache and /opt/tomcat (1.3.x) or /opt/hpapache2 (2.x). Make sure to save any data you may want to keep, $ rm –rf /opt/apache or $ mv /opt/apache /opt/apache.xxxx To install HP Apache, use swinstall. The following command invokes a user interface that leads you through the installation. The installation paths are /opt/apache and /opt/tomcat (1.3.x) or /opt/hpapache2 (2.x). $ /usr/sbin/swinstall& NOTE: If you install on top of an existing HP Apache installation, swinstall preserves the existing configuration files under /opt/apache/conf, /opt/apache/conf/jserv and /opt/tomcat/conf by renaming <file> to <file>.save. It also preserves certificates and certificate-related files under /opt/apache/conf/ssl.* directories by renaming <file> to <file>.save. That way, you do not lose previous configuration information. However, <file>.save will be overwritten upon a re-install of Apache. Page 21
- 22. iPlanet to HP Apache 7 Tools and Utilities 7.1 HP Apache Tools These are tools that are provided with the HP Apache product. These tools are available once HP Apache is installed. 7.1.1 Certmig Certmig is a utility to migrate iPlanet 4.x certificates to HP Apache-based Web Server. It is an extension of the PK12UTIL utility provided by the Mozilla community. Certmig uses Network Security Services (NSS) libraries for converting iPlanet certificates, key translations and certificate chains to those of the Apache web server. Certmig does not migrate Netscape 3.x certificates. HP Apache 1.3.x: certmig is installed in /opt/apache/bin/certmig, with documentation in /opt/apache/htdocs/doc/certmig.user.guide. For HP Apache 2.x: certmig is run using the wrapper util/test_certmig.sh. NOTE: certmig is not available on IPF machines since iPlanet does not run on IPF. 7.1.2 Test_certmig.sh The test_certmig.sh utility is a wrapper around certmig and is only included in HP Apache 2.x. It can be used to import, extract and list the certificates in an iPlanet 4.1.x Certificate database. HP Apache 1.3.x: For usage, consult the certmig user guide /opt/apache/htdocs/doc/certmig.user.guide. HP Apache 2.x: For usage, consult the utilities guide, /opt/hpapache2/hp_apache_docs/utilities.user.guide, or the certmig guide, /opt/hpapache2/hp_apache_docs/certmig.user.guide. 7.1.3 mkcert.sh The mkcert.sh utility generates private keys, certificate signing requests and certificates. HP Apache 1.3.x: mkcert.sh is installed in /opt/apache/bin/, with documentation in /opt/apache/htdocs/doc/utilities.user.guide. For HP Apache 2.x: mkcert.sh is installed in /opt/apache/bin/, with documentation in /opt/hpapache2/hp_apache_docs/utilities.user.guide. 7.1.4 stunnel_ctl.sh The stunnel_ctl.sh utility is a wrapper that calls the Stunnel program. Stunnel enables secure (SSL) transactions between HP Apache and an LDAP Directory Server HP Apache 1.3.x: Page 22
- 23. iPlanet to HP Apache stunnel_ctl.sh is installed in /opt/apache/bin/, with documentation in /opt/apache/htdocs/doc/utilities.user.guide and /opt/apache/htdocs/doc/ldap.admin.guide For HP Apache 2.x: stunnel_ctl.sh is installed in /opt/apache/bin/, with documentation in /opt/hpapache2/hp_apache_docs/utilities.user.guide and /opt/hpapache2/hp_apache_docs/ldap.admin.guide 7.1.5 Ports.sh Ports.sh is a port list utility bundled with HP Apache 2.x. It lists the ports being configured by the HP Apache-based Web Server including Apache, Apache(SSL), Tomcat, mod_jk, Webmin, and LDAP. ports.sh resides in /opt/hpapache2/util/ports.sh. For usage, consult the utilities guide /opt/hpapache2/hp_apache_docs/utilities.user.guide. 7.1.6 Cache_util.pl cache_util.pl is a file caching utility bundled with HP Apache 2.x. It helps optimizes file caching by reviewing the most commonly accessed files in logs/access_log and creating a caching file list. cache_util.pl resides in /opt/hpapache2/util/cache_util.pl. For usage, consult the utilities guide /opt/hpapache2/hp_apache_docs/utilities.user.guide. Page 23
- 24. iPlanet to HP Apache 7.2 iPlanet Tools 7.2.1 migrateLocalDB The utility migrateLocalDB can be used to migrate NES users and groups from a 3.X localdb to ldif format. The ldif can then be used to add entries into an LDAP directory server for use by HP Apache. /opt/iplanet/bin/https/admin/bin/migrateLocalDB 7.2.2 htconvert iPlanet includes the htconvert script for converting existing .nsconfig files to .htaccess files. Apache uses .htaccess files for per-directory configuration. htconvert is found under the plugins directory, for example, /opt/iplanet/plugins/htaccess/htconvert /opt/ns-enterprise36/plugins/htaccess/bin/htconvert Page 24
- 25. iPlanet to HP Apache 8 Performing the Migration This section contains steps for performing the migration. After setting up the web server environment, execute the steps that apply to the functionality to be migrated. For example, migrate the chroot environment by executing the chroot step, migrate an .htaccess file by executing the .htaccess step, etc. You may not need to execute every step if you are not currently using the functionality and/or not interested in configuring it on HP Apache. All steps in the Migrating the Core should be performed. Each step includes verification to test your changes. Most steps can be performed from either the HP-UX command line or through the Webmin GUI administrator. For example, an .htaccess file can be created and enabled either from the command line or from Webmin. To use Webmin, refer to the Webmin User’s Guide, http://www.swelltech.com/support/webminguide/server-apache.html. The steps here show how to use the command line. HP Apache 1.3.x and 2.x have a different root directory, a different tomcat root, and some differences in directives and functionality. Differences in setup between HP Apache 1.3.x and 2.x are shown in each step if there are any differences. For complete information on the differences between HP Apache 1.3.x and 2.x, refer to the Migration Guide HP Apache-based Web Server Version 1.3.x to 2.x, http://www.hp.com/go/webservers hp apache-based web server. Table 5 Major Directories in the HP Apache-based Web Server HP Apache 1.3.x HP Apache 2.x HP Apache /opt/apache/ /opt/hpapache2/ Tomcat /opt/tomcat/ /opt/hpapache2/tomcat/ HP Apache documentation (PA) /opt/apache/htdocs/doc /opt/hpapache2/hp_apache_docs/ HP Apache documentation (IPF) /opt/apache/hp_apache_docs /opt/hpapache2/hp_apache_docs HP Apache configuration files /opt/apache/conf/ /opt/hpapache2/conf/ 8.1 Configuration File Overview httpd.conf is HP Apache’s main configuration file. It resides in HP Apache’s conf directory along with other HP Apache configuration files. The following table describes the important configuration files used by HP Apache. Most additional configuration files are specified in the httpd.conf using the “Include <config-file>” directive. For example: Include /opt/hpapache2/conf/cache.conf HP Apache 1.3.x: HP Apache 2.x: Apache server /opt/apache/conf /opt/hpapache2/conf Main configuration file httpd.conf httpd.conf mod_file_cache N/A cache.conf mod_mime mime.types mime.types mod_mime_magic magic magic SSL /opt/apache/conf /opt/hpapache2/conf SSL (tuned for HP-UX) N/A (in httpd.conf) ssl.conf JServ /opt/apache/conf/jserv JServ jserv.conf N/A Page 25
- 26. iPlanet to HP Apache Tomcat/mod_jk /opt/tomcat/conf /opt/hpapache2/tomcat/conf/jk Tomcat tomcat.conf mod_jk.conf jk/mod_jk.conf(1.3.26 only) LDAP /opt/apache/conf /opt/hpapache2/conf auth_ldap ldap.conf (1.3.26 only) ldap.conf Some helpful hints from: http://httpd.apache.org/docs-2.0/configuring.html • Apache only recognizes changes to the main configuration files when it is started or restarted. • Apache configuration files contain one directive per line. • The back-slash "" may be used as the last character on a line to indicate that the directive continues onto the next line. There must be no other characters or white space between the back-slash and the end of the line. • Directives in the configuration files are case-insensitive, but arguments to directives are often case sensitive. • Lines which begin with the hash character "#" are considered comments, and are ignored. Comments may not be included on a line after a configuration directive. • Blank lines and white space occurring before a directive are ignored, so you may indent directives for clarity. • You can check your configuration files for syntax errors without starting the server by using one of the following commands: $ apachectl configtest $ httpd -t • All relative paths will be assumed to be relative to the ServerRoot. • To include additional configuration files, use the “Include <config-file>” directive as described above. • For directives multiply defined within the same <Context> </Context>, the last directive is used. (See below for more information on Contexts.) The following is a sample of a directive in httpd.conf. There are often helpful explanations or warnings before the directive. # # ServerRoot: The top of the directory tree under which the server's # configuration, error, and log files are kept. # # NOTE! If you intend to place this on an NFS (or otherwise network) # mounted filesystem then please read the LockFile documentation (available # at <URL:http://httpd.apache.org/docs-2.0/mod/core.html#lockfile>); # you will save yourself a lot of trouble. # # Do NOT add a slash at the end of the directory path. # ServerRoot "/opt/hpapache2" Directives can be included within context tags. Contexts are contained within angular brackets “< >” and are of the format of “<Context args> … </Context>”. See Security 5: Access Control/Access Control Lists (ACLs) for examples on using these. Contexts can be one of the following: <Directory directory-path> <DirectoryMatch regex> <Files pattern-match> <IfDefine parameter-name> <IfModule mod_xxx.c> <Limit limit-method> Page 26
- 27. iPlanet to HP Apache <LimitExcept limit-method> <Location URL-path> <LocationMatch regex> <VirtualHost address> Directives that are not within a context apply to the default or global server. The following is a sample of the <Files> context from httpd.conf. # # The following lines prevent .htaccess and .htpasswd files from being # viewed by Web clients. # <Files ~ "^.ht"> Order allow,deny Deny from all </Files> Directives defined within a context override any previous directives that were specified. Some contexts can be nested within each other. # # Control access to UserDir directories. The following is an example # for a site where these directories are restricted to read-only. # <Directory /home/*/public_html> AllowOverride FileInfo AuthConfig Limit Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec <Limit GET POST OPTIONS PROPFIND> Order allow,deny Allow from all </Limit> <LimitExcept GET POST OPTIONS PROPFIND> Order deny,allow Deny from all </LimitExcept> </Directory> Apache can be configured by directly editing the configuration files, or by using Webmin. Information on using Webmin is in Management 2: Server Administration. The configuration directives in httpd.conf for HP Apache 1.3.x and 2.x are usually the same. In some cases they may differ due to a change in functionality. These differences are shown in the migration steps. 8.2 Preparation Checkpoint Verify that the machine is ready for migration by making sure the following steps have been completed. 1. NES/iWS and Administration server is stopped. 2. All necessary hardware and software system requirements have been completed, including installation of HP Apache, using the HP Apache-based Web Server Requirements. 3. If desired, the HP-UX kernel parameters are tuned for HP Apache. 4. Start HP Apache and do a quick verification of the installation: a. $ /opt/apache/bin/apachectl startssl b. Check the error log, $ tail /opt/apache/logs/error_log Page 27
- 28. iPlanet to HP Apache c. Access the index.html page, http://yourserver.com d. Execute the test CGI script, http://yourserver.com/cgi-bin/test.cgi e. Stop the web server, $ /opt/apache/bin/apachectl stop Look at the release documents that are bundled with the HP Apache product to become familiar with HP Apache’s capability. The bundled documentation includes user guides and configuration information: /opt/apache/htdocs/doc/ (1.3.x) /opt/hpapache2/hp_apache_docs/ (1.3.x IPF and 2.x) 8.3 Migrating the Core See Appendix 1 : Core for a summary on the how NES and iWS differ from HP Apache. Core 1: Process Handling Definition: Process handling describes the process model of how a web server handles incoming requests. NES/iWS: Preferences Performance Tuning Preferences Thread Pools HP Apache 1.3.x: HP Apache 1.3.x implements a multi-process model. The server adjusts to handle loads by increasing and decreasing the number of processes. Each process handles a user request. More information is available at http://httpd.apache.org/docs/mod/core.html. The following table gives the default directives for configuring processes in HP Apache 1.3.x. Table 6: HP Apache 1.3.x Process Directives in /opt/apache/conf/httpd.conf Process Directive Default Value Description StartServers 5 StartServers refers to number of processes to create at start-up time. This value is represents the number processes available to handle server requests. MaxClients 150 MaxClients refers to the maximum number of processes running simultaneously. Apache creates and destroys processes to automatically handle demand. This value translates to the maximum number of concurrent requests served by the web server. MinSpareServers 5 MinSpareServers sets the desired minimum number of idle child processes at any time. It serves as a trigger point for Apache to automatically spawn new processes when the number of idle processes falls below this value. MaxSpareServers 10 MaxSpareServers sets the desired maximum number of idle child processes at any time. It serves as a trigger point for Apache to automatically kill spare idle processes when the number of idle processes goes above this value. Page 28
- 29. iPlanet to HP Apache Process Directive Default Value Description MaxRequestsPerChild 0 MaxRequestsPerChild sets the number of requests a process handles, before it is killed (aged-out). A value of 0 means a process never expires. HP Apache 2.x: HP Apache 2.x implements a hybrid multi-process multi-threaded model called “worker” in which each process has a fixed number of threads. The server adjusts to handle loads by increasing or decreasing the number of processes. Each thread handles a request. More information is available at http://httpd.apache.org/docs-2.0/mod/worker.html. The following table shows the default process and thread directives in HP Apache 2.x. Table 7: HP Apache 2.x Process Directives in /opt/hpapache2/conf/httpd.conf Process Directive Default Value Description StartServers 2 StartServers is the number of processes to ThreadsPerChild 25 create at start-up time. However, the number of requests that can be handled is dependent on the ThreadsPerChild directive. Hence, in this example, the number simultaneous server requests are 2*25 = 50. MaxClients 8 MaxClients refers to the maximum number of processes running simultaneously. In conjunction with the ThreadsPerChild directive, it translates to maximum number of concurrent requests served, in this case 8*25=200 requests. MinSpareThreads 25 MinSpareThreads sets the desired minimum number of idle threads at any time. It serves as a trigger point for Apache to automatically create new threads when the number of idle threads falls below this value. Spawning of each new process directly translates into 25 (ThreadsPerChild) new threads. MaxSpareThreads 75 MaxSpareThreads sets the desired maximum number of idle threads at any time. It serves as a trigger point for Apache to automatically kill spare idle threads, when the number of idle threads goes above this value. Killing of each process directly translates into ThreadsPerChild killed threads. MaxRequestsPerChild 0 MaxRequestsPerChild sets the number of requests a thread will handle before it is killed (aged-out). A value of 0 means the thread never expires. Verification: Run “/opt/perf/bin/gpm &” to start Glance-Plus. Use this tool to verify the number of httpd processes and threads: 1. $ /opt/perf/bin/gpm & Page 29
- 30. iPlanet to HP Apache 2. Select Reports Select Process List Select Configure Select Filters, turn on filtering and filter on “httpd” 3. Select (highlight) an httpd process Select Reports Select Process Thread List Core 2: Logging Definition: Logging is a way to record information about a client request and about the web server’s response. The main kinds of logs are access logs (requests) and error logs (responses). NES/iPlanet: Status Log Preferences HP Apache 1.3.x: Apache has a built-in definition for the Common Logfile Format (CLF) standard format. It is used for Apache’s access_log and error_log. New logs can be defined using Apache’s LogFormat and CustomLog directives to log items such as cookies, URL referring server, etc. In httpd.conf: ErrorLog /opt/apache/logs/error_log LogLevel warn CustomLog /opt/apache/logs/access_log common ErrorLog specifies where Apache’s error_log is located. LogLevel specifies the verbosity of the messages in error_log (none, error, warn, info, trace, debug). CustomLog defines the access_log and specifies it in CLF format. The Apache logresolve utility will resolve IP addresses into server names in access_log and provide statistics for number of web server accesses, http://httpd.apache.org/docs/programs/logresolve.html To run logresolve, $ cd /opt/apache/logs $ opt/apache/bin/logresolve -s alog.stats -c < access_log > alog.resolved For more information on 1.3 logging, http://httpd.apache.org/docs/logs.html HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x. However the access_log is not enabled by default. For information on the logresolve utility, http://httpd.apache.org/docs-2.0/programs/logresolve.html To run logresolve, $ cd /opt/hpapache2/logs $ /opt/hpapache2/bin/logresolve -s alog.stats -c < access_log > alog.resolved For more information on 2.x logging, http://httpd.apache.org/docs-2.0/logs.html Verification: 1. Create an error in error_log by requesting a non-existent file or URL, http://yourserver.com/foo.html 2. Display the entries in the error_log and access_log, Page 30
- 31. iPlanet to HP Apache $ tail /opt/hpapache2/logs/error_log $ tail /opt/hpapache2/logs/access_log Core 3: IP Addresses and Port Numbers Definition: Network location of the web server and network ports where it listens for requests NES/iWS: Preferences Network Settings HP Apache 1.3.x: The default configuration is to listen to all IP addresses on ports 80 and 443 (SSL). The default can be changed by using the BindAddress and Port directives in combination or by using the Listen directive. The BindAddress directive makes the server bind to a specified address and the Port directive sets which port to bind to. Listen tells the server to accept incoming requests on the specified port or address-and-port combination. If a port number only is specified only, the Apache listens to the given port on all interfaces (default). If an IP address only is given, then Apache listens on all ports for the specified IP address. Multiple Listen directives may be used to specify a number of addresses and ports to listen to. The server will respond to requests from any of the listed addresses and ports. Using Listen is recommended since Listen is used in Apache 2.x and BindAddress and Port were eliminated. Modify the httpd.conf file to assign IP addresses and ports. IP Address and Port HP Apache 1.3.x port 80 on all IP addresses Listen *:80 or Listen 80 port 80 on 111.222.333.444 Listen 111.222.333.444:80 ports 80 and 8080 on all IP addresses Listen 80 Listen 8080 port 80 on 111.222.333.444 and Listen 192.170.2.1:80 port 8080 on 555.666.777.888 Listen 192.170.2.5:8000 Specifying a domain name Listen uses IP addresses only. Extended addresses, IPv6 No support for IPv6 Note: <VirtualHost> can be used to specify a different behavior for one or more of the addresses and ports. For more information see the Apache documentation, http://httpd.apache.org/docs/bind.html http://httpd.apache.org/docs/vhosts http://httpd.apache.org/docs/dns-caveats.html HP Apache 2.x: The default configuration is to listen to all IP addresses on ports 80 and 443 (SSL). These can be changed by using the Listen directive. Page 31
- 32. iPlanet to HP Apache Modify the httpd.conf and the ssl.conf files to assign ports. IP Addresses and Ports HP Apache 2.x Binding to port 80 on all IP addresses Listen *:80 Binding to port 80 on 111.222.333.444 Listen 111.222.333.444:80 Binding to ports 80 and 8080 on all IP Listen 80 addresses Listen 8080 Binding to a domain name Listen uses IP addresses only. Using extended addresses, IPv6 Listen [fe80::1]:80 IP Address and Port HP Apache 2.x port 80 on all IP addresses Listen *:80 or Listen 80 port 80 on 111.222.333.444 Listen 111.222.333.444:80 ports 80 and 8080 on all IP addresses Listen 80 Listen 8080 port 80 on 111.222.333.444 and Listen 192.170.2.1:80 port 8080 on 555.666.777.888 Listen 192.170.2.5:8000 Specifying a domain name Listen uses IP addresses only. Extended addresses, IPv6 Listen [fe80::1]:80 Notes: <VirtualHost> can be used to specify a different behavior for one or more of the addresses and ports. See the Enterprise 3: Virtual Servers step for setting up Virtual Hosts. The ServerName directive has an optional port number argument that is used in redirection URLs. See the Core 4: ServerName step for specifying a server name. For more information see the Apache documentation, http://httpd.apache.org/docs-2.0/bind.html http://httpd.apache.org/docs-2.0/vhosts/ http://httpd.apache.org/docs-2.0/dns-caveats.html Verification: Try various URLs with ports numbers you have configured, for example, http://yourserver.com https://yourserver.com (SSL) For HP Apache 2.x, you can also run the ports utility to check the configured ports, /opt/hpapache2/util/ports.sh. More information on this utility can be found in /opt/hpapache2/hp_apache_docs/utilities.user.guide. Core 4: ServerName Definition: Sets the hostname of the server. NES/iWS: Preferences Network Settings HP Apache 1.3.x: Page 32
- 33. iPlanet to HP Apache ServerName <fully-qualified-domain-name> ServerName is used when creating redirection URLs. For example, if the name of the machine hosting the Apache is simple.example.com, but the machine also has the DNS alias www.example.com and you want the web server to be identified by its alias, use: ServerName www.example.com If no ServerName is specified, then the server attempts to deduce the hostname by performing a reverse lookup on the IP address. For optimal reliability and predictability, specify an explicit hostname. For more information, http://httpd.apache.org/docs/mod/core.html#servername HP Apache 2.x: ServerName <fully-qualified-domain-name:port> ServerName is used when creating redirection URLs. For example, if the name of the machine hosting the Apache is simple.example.com, but the machine also has the DNS alias www.example.com and you want the web server to be identified by its alias, use: ServerName www.example.com:80 NOTE: In 2.x, the port number parameter to ServerName is required whereas it is optional in 1.3.x. For more information, http://httpd.apache.org/docs-2.0/mod/core.html#servername Verification: Use the Perl printenv script to display environment variables (Perl must be installed), http://yourserver.com/cgi-bin/printenv Look at the setting for the server name, SERVER_NAME="yourserver.com" Core 5: DNS Lookups Definition: Web server access to a name server for a request to resolve a client’s IP address into a server name. This is often done for logging. NES/iWS: Preferences Performance Tuning HP Apache 1.3.x: HP Apache enables or disables DNS lookups using the HostnameLookups directive. It is disabled (Off) by default for better performance. See the Logging step for information on a bundled Apache log analyzer that can do IP to server name resolutions at log analysis time. To turn off or on DNS lookups, edit httpd.conf: HostnameLookups Off HP Apache 2.x: Apache 2.x is configured in the same way as HP Apache 1.3.x. Page 33
- 34. iPlanet to HP Apache Verification: Check the access_log to see is IP addresses or server names are being logged, $ tail /opt/apache/logs/access_log Core 6: Document Root Definition: Location where web server documents are stored. There is at least a primary root and there may be additional locations (roots) where files are stored. NES/iWS: Content Management Primary Document Directory NES has the default primary document directory of /opt/ns-enterprise36/docs-https-default iWS has the default primary document directory of /opt/iplanet/docs HP Apache 1.3.x: Apache’s primary document directory is the DocumentRoot. Additional document directories can be configured using the Alias directive or symbolic links. HP Apache 1.3.x has the default document directory of /opt/apache/htdocs The primary document directory can be migrated in several different ways: • Use Apache’s default DocumentRoot and copy NES/iWS documents to that location, $ cp -R /opt/iplanet/docs/* /opt/apache/htdocs/ $ chown -R www:other /opt/apache/htdocs/ • Change Apache’s default DocumentRoot to access the NES/iWS document root. For example, in httpd.conf, DocumentRoot "/opt/iplanet/docs" <Directory "/opt/iplanet/docs"> Options FollowSymLinks Indexes MultiViews </Directory> • Use Apache’s default DocumentRoot and point to the NES/iWS documents using symbolic links, a. Enable symbolic links in the document directory, DocumentRoot "/opt/apache/htdocs" <Directory "/opt/apache/htdocs"> Options FollowSymLinks Indexes MultiViews </Directory> b. Create the symbolic link to the actual document root, $ cd /opt/apache $ ln -s /opt/iplanet/docs htdocs • Use Apache’s default DocumentRoot and point to the NES/iWS documents using Alias directives Set up Alias in the document directory, DocumentRoot "/opt/apache/htdocs" Alias /opt/iplanet/docs /opt/apache/htdocs Page 34
- 35. iPlanet to HP Apache HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x except that it has a different location for its default document directory, /opt/hpapache2/htdocs Verification: 1. Use the Perl printenv script to display environment variables to view the DocumentRoot, http://yourserver.com/cgi-bin/printenv DOCUMENT_ROOT="/opt/hpapache2/htdocs" 2. Access the server home page http://yourserver.com Core 7: Additional Document Directories Definition: Location of additional web server files NES/iWS: Content Management Additional Document Directory HP Apache 1.3.x: Any number of additional document directories can be configured into Apache by using the Alias directive. 1. Make sure the web server has at least read access to the documents, $ chown -R www:other /opt/iplanet/docdirectory $ chmod 755 /opt/iplanet/docdirectory 2. Add the Alias directive to httpd.conf. Since it is dependent on the mod_alias module, it can (but does not have to) be within the <IfModule></IfModule> tags. <IfModule mod_alias.c> Alias /documents /opt/iplanet/docdirectory </IfModule> HP Apache 2.x: Apache 2.x is configured in the same way as Apache 1.3.x Verification: Access a document in the aliased directory, http://yourserver.com/documents/mydoc Core 8: Directory Indexing Definition: Behavior of the web server when provided with a URL that resolves to a directory. NES/iWS: Content Management Document Preferences HP Apache 1.3.x: When Apache is given a URL that resolves to a directory, it can return a default file in the directory, generate an HTML page of the contents of the directory, or return an error message. Directory contents can also be configured to display graphics, file modification dates, and file sizes. Page 35
- 36. iPlanet to HP Apache • To return a default file (returns first one found in the list): <Location mydirectory/> DirectoryIndex index.html index.htm index.shtml home.html home.htm index.cgi </Location> • To generate an HTML page of directory contents: <Location mydirectory/> Options +Indexes </Location> • To return a “Permission Denied” error: 1. Create a CGI script to generate an error message, cat fake404.cgi #!/bin/sh # #fake404.cgi echo "Content-Type: text/html" echo "Status: 404 Not Found" echo "" echo "<HTML><HEAD>" echo "<TITLE>Permission Denied</TITLE>" echo "</HEAD><BODY>" echo "<H1>Permission Denied</H1>" echo "<P>Directory access not allowed</P>" echo "</BODY></HTML>" 2. Execute the CGI script when for a directory URL, <Location /mydirectory/> DirectoryIndex index.html /cgi-bin/fake404.cgi </Location> HP Apache 2.x: Apache 2.x is configured in the same way as Apache 1.3.x Verification: Access a directory and verify that a list of files is returned, http://yourserver.com/ Core 9: User Directories Definition: User’s home directory used for storing personal documents. NES/iWS: Content Management User Document Directories HP Apache 1.3.x: Create the user’s document directory, such as public_html, in the user’s home directory as specified in /etc/passwd. User document directories are set using the UserDir directive. This directive sets the real directory to a user's home directory when a request for user document is received. For more information on user directories see, http://httpd.apache.org/docs/mod/mod_userdir.html 1. Set up the user directory in httpd.conf, Page 36
- 37. iPlanet to HP Apache # UserDir: The name of the directory which is appended onto a user's home # directory if a ~user request is received. <IfModule mod_userdir.c> UserDir public_html </IfModule> 2. Set up access control for this directory # Control access to UserDir directories. The following is an example # for a site where these directories are restricted to read-only. # #<Directory /home/*/public_html> # AllowOverride FileInfo AuthConfig Limit # Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec # <Limit GET POST OPTIONS PROPFIND> # Order allow,deny # Allow from all # </Limit> # <LimitExcept GET POST OPTIONS PROPFIND> # Order deny,allow # Deny from all # </LimitExcept> #</Directory> HP Apache 2.x: Apache 2.x is configured the same way as Apache 1.3.x. For more information about user directories see, http://httpd.apache.org/docs-2.0/mod/mod_userdir.html. Verification: 1. Create a file in a user’s home directory, $ vi /home/user/public_html/file.html 2. Access the file using a URL such as the following, http://yourserver.com/~user/file.html Core 10: MIME Types Definition: Standard for describing the content of a message NES/iWS: Preferences MIME Types HP Apache 1.3.x: 1. Apache comes with the file conf/mime.types that includes pre-configured, standard MIME types. More types can be added to this file. Entries in mime.types look the following. A file with the .xml extension (i.e. foo.xml) will be treated as an xml document. Content-type File Extension text/css css text/html html htm text/plain asc txt text/vnd.wap.wml wml Page 37
- 38. iPlanet to HP Apache text/vnd.wap.wmlscript wmls text/xml xml 2. New MIME types can also be added to httpd.conf using the AddType directive. For example, here the .tgz file extension is treated as a tar file, AddType application/x-tar .tgz HP Apache 2.x: MIME types are treated the same way as in HP Apache 1.3.x. Verification: 1. Create a new MIME type and extension that is displayed as plain text by the browser, AddType text/plain .note 2. Access a file with this extension and verify that it displays correctly in the browser http://yourserver.com/myfile.note 8.4 Migrating Security See Appendix 2 : Security for a summary on the how NES and iWS differ from HP Apache. For more information about Apache’s authentication, authorization, and access control, http://httpd.apache.org/docs/howto/auth.html Security 1: SSL/TLS Definition: Encrypted communication between the client and the web server. NES/iWS: Settings are available directly through magnus.conf or via the administration server: NES : Preferences Encryption On/Off Preferences Encryption Preferences Admin Server Keys and Certificates iWS : Preferences Encryption On/Off Preferences Encryption Preferences Security HP Apache 1.3.x: HP Apache comes pre-configured for SSL. SSL is configured in httpd.conf by a set of directives that begin with SSL (SSLEngine, SSLPassPhraseDialog, SSLSessionCache, SSLSessionCacheTimeout, SSLRandomSeed, SSLMutex , SSLLog , SSLLogLevel, SSLCipherSuite, SSLCertificateFile, SSLCertificateKeyFile, etc.) HP Apache 2.x: HP Apache 2.x comes pre-configured for SSL. SSL is configured in its own configuration file, conf/ssl.conf, by a set of directives that begin with SSL (SSLEngine, etc). Verification: 1. Start SSL using the “startssl” option in the Apache startup script, $ bin/apachectl startssl Page 38
- 39. iPlanet to HP Apache 2. Use https to specify a URL (make sure to use the SSL port number, 443 by default), https://yourserver.com:443 NOTE: When in SSL mode, Apache accepts both encrypted (SSL) and non-encrypted (non-SSL) connections. Security 2: Certificates Definition: File that validates the web server’s private key on the Internet. NES/iWS: NES: General Admin -> Keys & Certificates iWS : Security HP Apache 1.3.x (not for IPF): HP Apache 1.3.x supports Netscape 4.x certificates but not Netscape 3.x certificates. Netscape 4.x certificates are migrated to HP Apache using the HP Apache bin/certmig utility. certmig utility is an extension of the pk12util utility from Mozilla and migrates certificates of PKCS#12 format. It also lists and extracts certificates from iWS certificate databases. • For Netscape 3.x certificates: a. Use the migration tool provided with iWS to migrate 3.x certificates to 4.x certificates. b. Use certmig to migrate 4.x certificates to Apache certificates as described below. • For Netscape 4.x certificates: Use certmig to migrate to Apache certificates, $ /opt/apache/bin/certmig a. Ensure your certificate and keys databases are named properly. Before any trust (Keys) databases are created and Certificate Databases are installed, the iPlanet 'alias' directory is EMPTY. Once a trust database is created, and a certificate installed, let says for the server instance http-X on the server Y, the following files are created in the 'alias' directory: http-X-Y-cert7.db, http-X-Y-key3.db, secmod.db To use the certmig utility, first rename these files : $ cp https-X-Y-cert7.db cert7.db $ cp https-X-Y-key3.db key3.db If you do not rename these files, and you execute the following command: $ certmig -L -d /opt/iplanet/alias all you get back is: "Opened Cert DB successfully", but no certificates are displayed. If you now look in the /opt/iplanet/alias directory, you will notice that two new files, cert7.db and key3.db are generated. b. Verify certificates in the desired Certificate Database $ certmig –L <database-path> This lists the “Nick Name” of each Certificate found. c. Extract a certificate from the list above $ certmig –o <exportfile> -n “Nick Name” -d <database-path> Page 39
- 40. iPlanet to HP Apache This exports the certificate identified by nickname from the database to the PKCS#12 format in the exportfile specified. The exportfile contains both the certificate and the corresponding key in the same file in the DER format (binary format). d. Convert the DER format file into the PEM format by using the /opt/apache/ssl/bin/openssl utility: $ openssl pkcs12 -in <DER exportfile> -out <PEM exportfile> You will be asked to enter the PEM pass phrase. The resulting file, exportfile.pem, contains both the key and the certificates in the same file. You should manually split this file into .crt, with certificate in it and .key with key in it. NOTE: This option can be used only for those certificates that have a valid key in the keys database. If the certificate doesn't have a corresponding key in the database, the utility will fail with the error "certmig: find cert by nickname failed". For more information, see /opt/apache/htdocs/doc/certmig.user.guide HP Apache 2.x (not for IPF): HP Apache 2.x supports Netscape 4.x certificates but not Netscape 3.x certificates. The process for migrating certificates is similar to the process described for HP Apache 1.3.x. In HP Apache 2.x, /opt/hpapache2/util/test_certmig.sh can be used a wrapper around the certmig utility. If desired, certmig utility can be used by following the steps for HP Apache 1.3.x above. • For Netscape 3.x certificates: a. Use the migration tool provided with iWS to migrate 3.x certificates to 4.x certificates. b. Use test_certmig.sh to migrate 4.x certificates to Apache certificates as described below. • For Netscape 4.x certificates, use /opt/hpapache2/util/test_certmig.sh a. Verify certificates in the desired Certificate Database, $ test_certmig.sh –list This prompts the user for the directory containing the Certificate and Key Databases, and then lists the “Nick Name” of each Certificate found. b. Extract a certificate from the list above, $ test_certmig.sh –extract This prompts the user for the following [defaults in brackets] Netscape Database directory location [/opt/hpapache2/util] SSL Certificates directory location [/opt/hpapache2/util/ssl.crt] Directory Location of the SSL Certificate key file [/opt/hpapache2/util/ssl.key] Import/Export Pass Phrase [hp.com] Name of the certificate to be extracted [My Personal Certificate] Password or Pin for "NSS Certificate DB" For more information, see /opt/hpapache2/hp_apache_docs/utilities.user.guide (test_certmig.sh explained) /opt/hpapache2/hp_apache_docs/certmig.user.guide (certmig binary explained) Verification: After extracting the certificate – key pairs, you should be able to “view” them using openssl, /opt/apache/ssl/bin/openssl or /opt/hpapache2/ssl/openssl_bsafe/bin/openssl.pkcs12 1. To view the Key (the following commands are one line): Page 40
- 41. iPlanet to HP Apache $ openssl rsa –noout –text –in <server-key> 2. To view the Certificate: $ openssl x509 –noout –text –in <server-certificate> Security 3: Chroot Definition: Chroot enables a named directory to become the root directory, the starting point for path searches. A malicious user cannot get to the root file system if chroot is configured. NES/iWS: This cannot be configured through the administrative server. Settings are available directly through magnus.conf. HP Apache 1.3.x: HP Apache bundles a script called chroot_os_cp.sh to create a chroot directory and copy some files and system resources (i.e. system libraries) to the chrooted directory. This script may need to be altered if you have a special configuration. Chroot is not enabled by default. It includes SSL enhancements. For more information, refer to the comments in chroot_os_cp.sh and in httpd.conf. To set up chroot, 1. Uncomment the chroot directive in httpd.conf and specify the chroot directory (absolute path). The default path is /var/chroot. Chroot /var/chroot 2. Run chroot_os_cp.sh to create the chroot directory. If mkdir fails to create the directory, do it manually and rerun the script. If the specified directory exists, the chroot setup script provides an option for re-creating it or exiting the setup if you don’t want to proceed. $ /opt/apache/bin/chroot_os_cp.sh /var/chroot exists; remove and recreate (yes/no)? yes Creating /var/chroot . . . . . . . . Typical files needed by chrooted Apache copied to /var/chroot. DONE or exit the script instead of creating the directory, $ opt/apache/bin/chroot_os_cp.sh /var/chroot exists; remove and recreate (yes/no)? no Canceling operation. 3. Copy chrooted files from iWS to HP Apache, making sure they are readable by www:other, $ cp /<iWS-chroot dir>/* /var/chroot/ $ chown www:other <filelist> $ chmod 755 <filelist> 4. Stop and start HP Apache for chroot to take affect. Page 41
- 42. iPlanet to HP Apache NOTE: “apachectl restart” fails with chroot since it’s outside the chroot. Use “apachectl start” when running with chroot. HP Apache 2.x: Chroot is configured in the same way as for HP Apache 1.3.x. However, the location of the chroot setup script, chroot_os_cp.sh, is in /opt/hpapache2/util/chroot_os_cp.sh Verification: 1. Create a new file under chroot’s document root, for example, $ vi /var/chroot/opt/hpapache2/htdocs/chroot_test.html <HTML> <HEAD> <TITLE>Chroot test page</TITLE> <HEAD> <BODY> <H1>Testing if chroot can access this page</H1> </BODY> </HTML> 2. Make sure the file is readable by HP Apache, $ chown www:other chroot_test.html $ chmod 755 chroot_test.html 3. You should be able to read the file http://yourserver.com/chroot_test.html 4. Create a new file under HP Apache’s document root, vi /opt/hpapache2/htdocs/root_test.html <HTML> <HEAD> <TITLE>Apache root test page</TITLE> <HEAD> <BODY> <H1>Testing if Apache root can access this page</H1> </BODY> </HTML> 5. Make sure the file is readable by HP Apache, $ chown www:other root_test.html $ chmod 755 root_test.html 6. You should not be able to read the file, http://yourserver.com/root_test.html 7. Verify other PHP, CGI, etc. scripts located under the /var/chroot directory. Security 4: .htaccess file Definition: .htaccess is a file that controls access to web server resources. NES/iWS: iWS uses .nsconfig and .htaccess files to control resource access. HP Apache 1.3.x: Page 42
- 43. iPlanet to HP Apache HP Apache uses .htaccess to configure access to resources within the directory where the .htaccess file resides. The .htaccess file can be renamed using the AccessFileName directive. Changes made in an .htaccess file take effect immediately without restarting Apache. 1. Convert any .nsconfig files to .htaccess files using the iWS htconvert script and specify the path to obj.conf. For example, $ /opt/iplanet/plugins/htaccess/htconvert /opt/iplanet/https-<server name>/config/obj.conf Going to convert /opt/iplanet/docs/servlet Going to convert /opt/iplanet/docs/jsp.092 Going to convert /opt/iplanet/manual/https/servlets/scripts Going to convert /opt/iplanet/manual/https/servlets/scripts/servlet1 Going to convert /opt/iplanet/manual/https/servlets/scripts/shoes Going to convert /opt/iplanet/manual/https/servlets/images Going to convert /opt/iplanet/docs 2. Copy the .htaccess files into the directories to protect, $ cp .htaccess /opt/apache/htdocs/mydir/.htaccess 3. Modify httpd.conf so that .htaccess can be read, <Directory “/opt/apache/htdocs/mydir”> AllowOverride AuthConfig </Directory> 4. Create a password file and add the users that are referred to in the .htaccess files. For example, create password file “.htpasswd” with the user “Ron”, $ /opt/apache/bin/htpasswd –c /opt/apache/.htpasswd Barbara New password: <type password here> Re-type new password: <retype password here> Adding password for user Ron HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x. Use the HP Apache 2.x root directory instead, /opt/hpapache2/conf/httpd.conf /opt/hpapache2/bin/htpasswd Verification: 1. Make sure the required user has an entry in the password file, $ cat /opt/apache/.htpasswd Ron:vtUAT3C3KgEAg 2. Request a file in the protected directory, for example, http://yourserver.com/mydir/myfile Enter a valid user (“Ron” in this example) and user password (from the password file) in the dialog box. Security 5: Access Control/Access Control Lists (ACLs) Definition: Access control allows control over which clients can access your server and what they can access. Access control can screen out certain users, groups, or hosts to either allow or deny access to part of your server, and set up authentication so that only valid users and groups can access part of the server. Page 43
- 44. iPlanet to HP Apache NES/iWS: Preferences Restrict Access Access control is implemented through Access Control Lists (ACLs). By default, the web server uses one ACL file that contains all of the lists for access to the server in <server_root>/httpacl/generated.https-<servername>.acl Multiple ACLs can also be created and referenced in obj.conf. To check if multiple ACLs have been defined, look in obj.conf for PathCheck fn="check-acl". For example, the following entry restricts access to directory /usr/ns-home/docs/test/ using the rules in testacl: <Object ppath="/usr/ns-home/docs/test/*"> PathCheck fn="check-acl" acl="testacl" </Object> HP Apache 1.3.x: Apache implements access control through a set of directives that can be specified in httpd.conf (globally), in .htaccess (per directory), or using a combination of both. Apache includes many directives (<File>, <Directory>, etc) that are used in conjunction with Apache’s Allow/Deny/Order commands to restrict access by directory, URL, IP address, hostname, files, HTTP command, etc. To restrict access by 1. Directory (<Directory>, <DirectoryMatch>): To apply access control to a directory (file system path) and its subdirectories, <Directory /home/www> Options Includes ExecCGI FollowSymLinks allow from all </Directory> 2. URL (<Location>, <LocationMatch>): Only allow clients in your domain to view Apache’s status by accessing http://yourserver.com/apache- status, <Location /apache-status> SetHandler server-status order deny,allow deny from all allow from .yourdomain.com </Location> 3. File (<Files>, <FilesMatch>): To prevent access to .htaccess by everyone, <Files .htaccess> order deny, allow deny from all </Files> 4. HTTP method (<Limit>, <LimitExcept>): To allow only POST, PUT, and OPTIONS requests from the localhost, <Limit POST PUT OPTIONS > order deny, allow deny from all Page 44
- 45. iPlanet to HP Apache allow from 127.0.0.1 </Limit> 5. Hostname: To allow access to all hosts except a specific web robot, <Directory /> order deny, allow allow from all deny from robot.trouble.com </Directory> 6. IP address: To allow access to a specific subdirectory to only hosts on the internal network, <Directory /internal/> order deny, allow deny from all allow from 127.0.0.1 192.168.1 192.168.2 </Directory> 7. Environment variable: To lock out browsers that are using HTTP/1.0 or earlier, SetEnvIf Request_Protocol ^HTTP/1.1 http_11_ok <Directory /internal/> order deny, allow deny from all allow from env=http_11_ok </Directory> HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x. Verification: 1. Set up access control to a resource and deny your client access (i.e. “deny from 192.168.100”) then verify that you cannot access the resource. 2. Change “deny from” to “allow from” and verify that you can now access the resource. Security 6: Database Authentication Definition: Database authentication uses a database to store valid users, groups, and passwords to verify that someone is who they claim they are. NES/iWS: Preferences Restrict Access HP Apache 1.3.x: HP Apache 1.3.x includes basic authentication and authentication using Berkeley database files (DB files). • Basic Authentication Basic authentication is not really database authentication since usernames and passwords are saved in an ascii flat file. When a resource is protected with basic authentication, Apache sends a 401 Page 45
- 46. iPlanet to HP Apache Authentication Required header with the response to the request to notify the client that user credentials must be supplied in order for the resource to be returned as requested. Upon receiving a 401 response header, the client's browser will ask the user for a username and password to be sent to the server. A dialog box pops up for entering your username and password to send to the server. If the username is on the approved list, and if the password supplied is correct, the resource will be returned to the client. To set up basic authentication do the following, 1. Create a password file using the htpasswd utility. The password file (-c to create a new file) is .htpasswd, $ /opt/apache/bin/htpasswd -c /opt/apache/.htpasswd Liza New password: <password> Re-type new password: <password> Adding password for user Liza $ /opt/apache/bin/htpasswd /opt/apache/.htpasswd Mohan New password: <password> Re-type new password: <password> Adding password for user Mohan $ cat /opt/apache/.htpasswd Liza:KPFReZgxIruYE Mohan:i32RJ0L4np.2Q 2. Set the configuration to use this password file, $ chown www:other /opt/apache/.htpasswd $ chmod 640 /opt/apache/.htpasswd Add these directives to httpd.conf or put in a .htaccess file, AuthType Basic AuthName "HP Apache Team" AuthUserFile /opt/apache/.htpasswd Require valid-user 3. Optionally, create a group file $ vi /opt/apache/.groups hpapache_team: Liza Mohan Ron Aida Barbara Julius Madhu Roshan Dave Tair-Shian 4. Set the configuration to use this group file, $ chown www:other /opt/apache/.groups $ chmod 640 /opt/apache/.groups Specify the group file and the required group in httpd.conf or .htaccess, AuthType Basic AuthName "HP Apache Team" AuthUserFile /opt/apache/.htpasswd AuthGroupFile /opt/apache/.groups Require hpapache_team • User Authentication Using a DBM file Page 46
- 47. iPlanet to HP Apache This method of authentication is similar to basic authentication. It has much faster lookups of users (since they are kept in binary form) and should be used instead of basic authentication for a large set of users. To set up DBM authentication, 1. Create the user file, $ /opt/apache/bindbmmanage /opt/apache/.dbmpasswd adduser Tair-Shian New password: <password> Re-type new password: <password> User Tair-Shian added with password encrypted to fYcWqLRR8mr.2 using crypt 2. Configure Apache to use that file for authentication. $ chown www:other /opt/apache/.dbmpasswd $ chmod 640 /opt/apache/.dbmpasswd Add these directives to httpd.conf or put in a .htaccess file, $ cat .htaccess AuthName “HP Apache” AuthType Basic Require user Tair-Shian AuthDBMUserFile /opt/apache/.dbmpasswd AuthAuthoritative on 3. Optionally, create a group file, $ dbmmanage add /opt/apache/.dbmgroups hpapache_team Ron Aida Tair-Shian 4. Set the configuration to use this group file, $ chown www:other /opt/apache/.dbmgroups $ chmod 640 /opt/apache/.dbmgroups Specify the group file and the required group in httpd.conf or .htaccess, $ cat .htaccess AuthName “HP Apache” AuthType Basic AuthDBMUserFile /opt/apache/.dbmpasswd AuthDBMGroupFile /opt/apache/.dbmgroups AuthAuthoritative on Require group hpapache_team HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x. More information about basic and auth_dbm authentication is available from http://httpd.apache.org/docs/howto/auth.html. Information about dbmmanage and htpasswd is available from, http://httpd.apache.org/docs-2.0/programs/ Verification: 1. Request a resource protected by authentication, http://yourserver.com/mydir 2. Enter a valid user and password Page 47
- 48. iPlanet to HP Apache Security 7: LDAP Authentication Definition: LDAP authentication uses an LDAP directory server to look up valid users and groups. NES/iWS: Preferences Restrict Access Global Admin Global Settings Config Directory Service HP Apache 1.3.x: Users and groups can be authenticated in an iPlanet Directory Server or in an OpenLDAP Directory Server. Secure authentication is done over SSL to the LDAP server using the stunnel program for encryption. 1. Enable LDAP authentication in the httpd.conf by uncommenting the include, # Include conf/ldap.conf to Include conf/ldap.conf 2. Edit /opt/hpapache2/conf/ldap.conf to set up your auth_ldap configuration. For example, to require authentication for access to the manual directory, LoadModule auth_ldap_module modules/auth_ldap.so <Location /manual> AuthName "Restricted Area" AuthType Basic # AuthLDAPURL should point to your ldap server AuthLDAPURL ldap://ldap_server.com:ldap_port/o=organization.com # AuthLDAPStartTLS on require valid-user </Location> 3. If the LDAP Directory Server is configured for SSL (OpenLDAP uses TLS), a. Specify stunnel as the LDAP server in ldap.conf, AuthLDAPURL ldap://127.0.0.1:389/o=your-organization.com b. Start stunnel for an SSL connection between Apache and the destination LDAP server: $ /opt/hpapache2/util/stunnel_ctl.sh --server=389 --ldap=<ldap server>:636 4. When done, stop stunnel $ /opt/hpapache2/util/stunnel_ctl.sh --stop HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x except for the locations of ldap.conf and stunnel_ctl.sh. ldap.conf if found at /opt/apache/conf/ldap.conf and stunnel_ctl.sh is at /opt/apache/bin/stunnel_ctl.sh. Verification: 1. In a browser enter the URL, http://yourserver.com/manual/ 2. Enter a user name and password, Page 48
- 49. iPlanet to HP Apache Enter user name: <user name> Password: <password> 3. If using stunnel, check to see if it is running, $ ps –aef | grep stunnel | grep –v grep root 9241 1 0 18:46:47 ? 0:00 /opt/hpapache2/ssl/stunnel/sbin/stunnel –c -d 389 -r ldapserver.com:636 8.5 Migrating Server-Side Execution See Appendix 3: Server-Side Execution for a summary on the how NES and iWS differ from HP Apache. Server-Side 1: CGI scripts Definition: CGI scripts are scripts written in any number of languages that adhere to the Command Gateway Interface protocol. NES/iWS: CGI programs may be enabled in one of the following ways: • File in a CGI directory: All files in these directories are CGI programs. To determine if configured, use the CGI Directory page in the Programs tab of the Server Manager. • File with a specific extensions: Files with certain extensions are treated as CGI programs, regardless of which directory they reside in. The default CGI extensions are .cgi, .bat and .exe. To determine if configured, use the CGI File Type page in the Programs tab of the Server Manager. Programs CGI Directory Programs CGI File Type HP Apache 1.3.x: CGI programs may be enabled in one of the following ways: • File in a CGI directory: Use the ScriptAlias directive. Any file that resides in the directory specified by ScriptAlias will be executed as a CGI. The default location is /opt/apache/cgi-bin/. To run CGI scripts from additional locations, add a ScriptAlias directive in httpd.conf, ScriptAlias /cgi-bin/ "/opt/apache/cgi-bin/" • File with a specific extensions: Files with certain extensions are treated as CGI programs, regardless of which directory they reside in. To create CGI extensions, 1. Use Addhandler in httpd.conf, AddHandler cgi-script .cgi AddHandler cgi-script .exe 2. Add ExecCGI to the Options directive in httpd.conf, <Directory "/opt/apache/cgi"> AllowOverride None Options +ExecCGI Page 49
- 50. iPlanet to HP Apache Order allow,deny Allow from all </Directory> HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x with the option of using additional capabilities: CGI daemon, suEXEC. • CGI daemon Using a daemon speeds up CGI execution by eliminating the overhead of starting up a new process and threads for each CGI invocation. Apache communicates with this daemon using a UNIX domain socket whose name is specified in the ScriptSock directive. To configure a CGI daemon: 1. Use mod_cgid.so instead of mod_cgi.so in httpd.conf, LoadModule cgid_module modules/mod_cgid.so #LoadModule cgi_module modules/mod_cgi.so 2. View ScriptSock directive, <IfModule mod_cgid.c> # # Additional to mod_cgid.c settings, mod_cgid has Scriptsock <path> for setting UNIX socket for communicating with cgid. # Scriptsock logs/cgisock </IfModule> • suEXEC suEXEC provides the ability to run CGI programs under a different user ID from the user ID of the web server. Normally, CGI executes as the same user as the web server. For more information on suEXEC, see /opt/hpapache2/hp_apache_docs/suexec.admin.guide To configure suEXEC: 1. “Unhide” suexec binary. $ mv /opt/hpapache2/bin/suexec.hide /opt/hpapache2/bin/suexec 2. Make sure suexec has the necessary ownership/permissions: $ chmod 4755 /opt/hpapache2/bin/suexec $ chown root:sys /opt/hpapache2/bin/suexec 3. Edit httpd.conf to set SuexecUserGroup <IfModule mod_suexec.c> SuexecUserGroup <your-userid> <your-group> </IfModule> 4. Make sure cgi-bin directory and showuser.cgi file have the necessary ownership/permissions: $ chmod 755 /opt/hpapache2/cgi-bin /opt/hpapache2/cgi-bin/showuser.cgi $ chown <your-userid>:<your-group> /opt/hpapache2/cgi-bin /opt/hpapache2/cgi- bin/showuser.cgi Verification: 1. To verify CGI in /cgi-bin/, http://yourserver.com/cgi-bin/mycgi Page 50
- 51. iPlanet to HP Apache 2. To verify CGI with an extension, http://yourserver.com/mycgi.cgi 3. To verify suEXEC in /cgi-bin/, a. Access the URL, http://yourserver.com/cgi-bin/showuser.cgi b. You should see something like the following: Username=<your-userid> 4. To verify suEXEC in a user directory, a. Edit httpd.conf, <Directory /home/*/public_html> AddHandler cgi-script .cgi AllowOverride FileInfo AuthConfig Limit Options ExecCGI MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec <Limit GET POST OPTIONS PROPFIND> Order allow,deny Allow from all </Limit> <LimitExcept GET POST OPTIONS PROPFIND> Order deny,allow Deny from all </LimitExcept> </Directory> b. In your home directory, make a directory called “public_html” $ mkdir /home/<your-userid>/public_html c. Copy showuser.cgi into the directory you just created and change the ownership, $ chown <your-userid>:<your-group> /home/<your-userid>/public_html/showuser.cgi d. Access the URL, http://yourserver.com/~your-userid/showuser.cgi e. You should see something like the following: Username=<your-userid> Server-Side 2: Parsed HTML (SHTML/SSI) Definition: HTML files are embedded with instructions that are read (parsed) then executed. The results are embedded into the document in the place of the instruction then sent to the client. NES/iWS: Content Management Parsed HTML HP Apache 1.3.x: Apache can parse files with .shtml extensions or regular HTML files with the execute bit turned on (XbitHack). NOTE: The XbitHack implementation is being obsoleted. For a tutorial on 1.3.x server-side includes, see http://httpd.apache.org/docs/howto/ssi.html. • For SHTML extensions, set .shtml extensions in httpd.conf and add "Includes" to the "Options" directive, Page 51
- 52. iPlanet to HP Apache <Directory "/usr/share/doc"> Options Indexes MultiViews AllowOverride None Order allow,deny Allow from all AddHandler server-parsed .shtml AddType text/html .shtml Options +Includes </Directory> • To execute HTML with XBitHack, a. Set the XBitHack in httpd.conf, <Directory /shtml/> XbitHack on </Directory> b. Set execute (x) permission for the owner of the file $ chmod o+x myfile HP Apache 2.x: SHTML/SSI is implemented by the INCLUDES filter if a document contains server-side include directives and has the extension .shtml. Apache will also activate the INCLUDES filter for any document with mime type text/x-server-parsed-html or text/x-server-parsed-html3 (output is mime type text/html). For a tutorial on server-side 2.x includes, see http://httpd.apache.org/docs-2.0/howto/ssi.html To configure, 1. Add the following lines in httpd.conf, <FilesMatch ".shtml(..+)?$"> SetOutputFilter INCLUDES </FilesMatch> 2. In httpd.conf change, <Directory “/opt/hpapache2/htdocs”> Options Indexes FollowSymLinks Multiviews To, <Directory “/opt/hpapache2/htdocs”> Options Indexes FollowSymLinks Multiviews Includes Verification: 1. Create “ssi.shtml” file. $ vi /opt/hpapache2/htdocs/ssi.shtml <HTML><BODY> <p>Server Side Includes</P> <br> <p> <!--#echo var="DATE_LOCAL" --></p> <br> <p> <!--#config timefmt=" %H:%M:%S %A %B %d, %Y" --> Today is <!--#echo var="DATE_LOCAL" --></p> <br> <p> This document last modified <!--#flastmod file="ssi.shtml" --></p> <br> <p><pre><!--#exec cmd="ls" --></pre></p> </BODY></HTML> Page 52
- 53. iPlanet to HP Apache 2. In a browser enter the URL, http://yourserver.com/ssi.shtml 3. The output should look similar to the following, Server Side Includes Thursday, 18-Oct-2001 09:38:50 PDT Today is 09:38:50 Thursday October 18, 2001 This document last modified 09:35:46 Thursday October 18, 2001 README.rus apache_pb.gif apache_pb.png apache_pb2.gif apache_pb2.png apache_pb2_ani.gif index.html index.html.ca index.html.cz ... ssi.shtml test.php Server-Side 3: Java Servlets and Java Server Pages (JSPs) Definition: • Java servlets are server-side Java programs that conform to the Java Servlet API specification and produce dynamic output. • JSPs are web pages that mix regular, static HTML with dynamically generated HTML to create a servlet which is then executed. NES/iWS: NES : Programs -> Java iWS : Servlets HP Apache 1.3.x: HP Apache 1.3.x uses two versions of Java servlets containers, the older Apache JServ and its follow-on product Tomcat. We recommend using Tomcat. Tomcat can execute servlets directly through port 8081 (default) or through Apache via mod_jserv. To execute servlets through Apache, 1. Make sure that JAVA_HOME is set and that $JAVA_HOME/bin is on your path. 2. Uncomment the Tomcat include file in httpd.conf, Include /opt/tomcat/conf/tomcat.conf #Include /opt/apache/conf/jserv/jserv.conf 3. Start up Tomcat using Tomcat’s startup script /opt/tomcat/bin/startup.sh For more information see Tomcat User’s Guide, Page 53
- 54. iPlanet to HP Apache http://jakarta.apache.org/tomcat/tomcat-3.2-doc/uguide/tomcat_ug.html NOTE: HP Apache 1.3.26 includes the mod_jk connector between Apache and Tomcat. Follow the instructions for HP Apache 2.x using the path /opt/tomcat/conf/jk.For more information see, http://jakarta.apache.org/tomcat/tomcat-3.3-doc/tomcat-ug.html. HP Apache 2.x: There are two ways to run servlets, depending on whether the web application directory is already configured (3A below) or not (3B below). 1. Make sure that JAVA_HOME is set and that $JAVA_HOME/bin is on your path. 2. Configure the servlets engine, Uncomment Tomcat’s configuration file in httpd.conf, Include /opt/hpapache2/tomcat/conf/jk/mod_jk.conf 3. Set up the servlet connector to HP Apache and a servlet context, A. If the web application structure is already configured: 1. Add the following path to your servlets configuration file, $ vi /opt/hpapache2/tomcat/conf/jk/mod_jk.conf add the line, JKMount /my_servlets/* ajp13 2. Create a tomcat context for your servlets. For example, create a file such as, /opt/hpapache2/tomcat/conf/apps-my_servlets.xml where docBase points to your web application directory , $ cat /opt/hpapache2/tomcat/conf/apps-my_servlets.xml <?xml version="1.0" encoding="ISO-8859-1"?> <webapps> <!-- Setting special properties for /my_servlets ( as an example of overriding the defaults ) --> <Context path="/my_servlets" docBase="/opt/html-docs/my_servlets" debug="0" reloadable="true" > </Context> </webapps> B. If the web application structure is not already configured: 1. Add path to your servlets in the mod_jk configuration file: $ vi /opt/hpapache2/tomcat/conf/jk/mod_jk.conf. add the line, JkMount /my_servlets/* ajp13 2. Create a Tomcat context for your servlets, for example create a file such as /opt/hpapache2/tomcat/conf/apps-my_servlets.xml containing, <?xml version="1.0" encoding="ISO-8859-1"?> <webapps> <!-- Setting special properties for /my_servlets ( as an example of overriding the defaults ) --> <Context path="/my_servlets" Page 54
- 55. iPlanet to HP Apache docBase="/opt/html-docs/my_servlets" debug="0" reloadable="true" > </Context> </webapps> 3. Create a servlets directories under the WEB-INF directory $ mkdir -p /opt/html-docs/my_servlets/WEB-INF $ mkdir -p /opt/html-docs/my_servlets/WEB-INF/classes 4. Copy your compiled servlet to the directory you just created, for example $ cd /opt/html-docs/my_servlets $ cp MyServlet.class WEB-INF/classes/MyServlet.class 5. Create the application context file, for example, /opt/html-docs/my_servlets/WEB- INF/web.xml containing, <?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.2//EN" "http://java.sun.com/j2ee/dtds/webapp_2_2.dtd"> <web-app> <servlet-mapping> <servlet-name> MyServlet </servlet-name> <url-pattern> /MyServlet </url-pattern> </servlet-mapping> </web-app> 6. Start Apache and Tomcat $ /opt/hpapache2/bin/apachectl start $ /opt/hpapache2/tomcat/bin/startup.sh For more information about setting up servlets, /opt/hpapache2/hp_apache_docs/jserv_to_tomcat.migration.guide. For more information on Tomcat, http://jakarta.apache.org/tomcat/ Verification: 1. Check Java version, $ java –version 2. Check that Tomcat is running and its home page is displayed, http://yourserver.com:8081 3. Verify that Tomcat can serve JSPs http://yourserver.com:8081/test/jsp/HelloWorld.jsp the output should be, HelloWorld 4. Verify that Tomcat can serve an example servlet (xyz can be any alphanumeric characters), http://yourserver.com:8081/test/foo/bar/xyz Page 55
- 56. iPlanet to HP Apache the output should be, Servlet: Servlet1 5. Access your own servlets from Tomcat and verify that they still run, http://yourserver.com:8081/my_servlets/MyServlet 6. Access your own servlets from Apache and verify they still run, http://yourserver.com/my_servlets/MyServlet Server-Side 4: Java Server Pages (JSP) Custom Tag Libraries Definition: A tag library is a collection of custom actions written in Java that are called by JSPs as tags. It is a powerful feature of JSP v1.1 that aids in separating JSP content display from backend tiers of data access and other services. HP Apache 1.3.x: HP Apache can use JSP tag libraries to implement additional functionality. For example, HP Apache can use the Jakarta Project’s I18N Tag Library to implement I18N for localized formatting and parsing. There are also tag libraries for XML parsing and SQL access. For more information about tag libraries, http://jakarta.apache.org/taglibs/tutorial.html http://jakarta.apache.org/taglibs/doc/i18n-doc/intro.html HP Apache 2.x: HP Apache 2.x uses tag libraries in the same was as HP Apache 1.3.x. Verification: Execute the simple custom tag example provided with Tomcat. 1. Go to Tomcat’s JSP example page, http://yourserver.com:8081/examples/jsp/index.html 2. Select “Simple custom tag example” 8.6 Migrating Management See Appendix 4: Management for a summary on the how NES and iWS differ from HP Apache. Management 1: Server Status Definition: Information about the web server that enables an administrator to check on the web server. NES/iWS: Status Monitor Current Activity HP Apache 1.3.x: The mod_status and mod_info modules provide Apache status information. These are enabled in httpd.conf. mod_status creates an HTML page that displays number of children serving Page 56
- 57. iPlanet to HP Apache requests, number of idle children, average number of requests per second, time when the web server was last started, etc. mod_info provides a comprehensive overview of the server configuration, including all installed modules and directives in the configuration files. To enable server status, 1. Uncomment the server-status handler and change .your-domain.com to your own domain name or address, <Location /server-status> SetHandler server-status Order deny,allow Deny from all Allow from .your-domain.com </Location> 2. Optionally, enable full status information, ExtendedStatus On 3. Enable server configuration reports, changing your-domain.com to your domain name or address, <Location /server-info> SetHandler server-info Order deny,allow Allow from .your-domain.com </Location> For more information, see http://httpd.apache.org/docs/mod/mod_info.html and http://httpd.apache.org/docs/mod/mod_status.html HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x. For more information see, http://httpd.apache.org/docs-2.0/mod/mod_info.html and http://httpd.apache.org/docs-2.0/mod/mod_status.html Verification: 1. View server status, http://yourserver.com/server-status 2. View server info, http://yourserver/server-info Management 2: Server Administration Definition: Server administration is the configuration, monitoring, tuning, etc. of a web server. NES/iWS: Server administration can be done by editing configuration files from the command line or by using the Administration Server. The Administration Server is a separate server that manages the web server through a browser-based GUI with its own port number. HP Apache 1.3.x: HP Apache 1.3.x can be administered from a combination of the command line, utilities, and Webmin. Webmin is a web-based interface that consists of a miniserver and a number of CGI programs. The web Page 57
- 58. iPlanet to HP Apache server and CGI programs are written in Perl and use no external modules. Webmin is a general purpose UNIX and Apache administration tool that has been customized for HP Apache. To start up Webmin, 1. Run the Webmin startup script, $ /opt/apache/webmin/webmin-init start 2. Point the browser to Webmin’s port and, when prompted, enter a username and password, http://yourserver.com:10000 Login : admin Password : hp.com 3. The first time running Webmin, you will see a screen titled “Re-Configure Known Modules”. Press the “Configure” button. 4. To get to the HP Apache-based Web Server page, mouse click on “Servers” tab, then click of “HP Apache-based Web Server” icon. This will take you to the “Default/Global Server” page as shown in the picture. For general information about Webmin, see http://www.webmin.com/webmin/ For Webmin’s user guide for Apache, see http://www.swelltech.com/support/webminguide Apache Webserver For more information on Webmin on HP Apache, /opt/apache/htdocs/doc/webmin.release.notes (1.3.x, PA-RISC) /opt/apache/hp_apache_docs/webmin.release.notes (1.3.x, IPF) To change Webmin’s password on HP Apache, see /opt/apache/htdocs/doc/webmin.config.notes (1.3.x, PA-RISC) /opt/apache/hp_apache_docs/webmin.config.notes (1.3.x, IPF) Page 58
- 59. iPlanet to HP Apache HP Apache 2.x: Webmin on HP Apache 2.x is configured and used as with HP Apache 1.3.x. To change Webmin’s password, see /opt/hpapache2/hp_apache_docs/webmin.admin.guide (2.x, PA-RISC and IPF) Verification: 1. Check if Webmin is running, $ ps –aef | grep webmin | grep –v grep You should see something like, root 3140 1 0 20:54:53 ? 0:00 /opt/hpapache2/webmin/miniserv.pl /opt/hpapache2/webmin/miniserv 2. In a browser enter the URL, Page 59
- 60. iPlanet to HP Apache http://yourserver.com:10000/apache The page should have the title: “HP Apache-based Web Server” 3. Under the “Virtual Server” heading, click on “Default Server” icon. The page should have the title: “Virtual Server Options for default server” Click on the ”Log Files” icon. 4. If there is an Error Log specified, click on the “View..” link next to the filename. If “default” is specified, you should also be able to “View..” it. It should display the tail –20 of the log. (The amount can be changed.) Do the same for the Access Log files that are specified. 5. Stop Webmin then check if is has stopped, $ /opt/hpapache2/webmin/webmin-init stop $ ps –aef | grep webmin | grep –v grep You should not see any output from the ps/grep command. You should see something similar to the following: Stopping Webmin server in /opt/hpapache2/webmin Management 3: Cluster Management Definition: Cluster Management is the central management of multiple remote web servers. NES/iWS: General Admin HP Apache 1.3.x: HP Apache 1.3.x does not have true cluster management. Webmin can be configured to manage multiple instances of HP Apache 1.3.x on the same machine. To manage additional HP Apache 1.3.x web servers, 1. From the Webmin Index, click on “Webmin configuration”, then click on “Webmin Modules” icon 2. Under “Clone Module” select “HP Apache-based Web Server”, specify a server name, and click the “Clone Module” button. 3. Go back to Webmin Index, select “Servers” tab, select the icon of the new server, click on “Module Config”, set the HP Apache root, the apachectl path, the httpd path, etc. To remove an Apache web server from Webmin, 1. From the Webmin Index, click on “Webmin configuration”, then click on “Webmin Modules” icon Page 60
- 61. iPlanet to HP Apache 2. Under “Delete Modules” select the HP Apache server to remove, click on “Delete Selected Modules” button HP Apache 2.x: HP Apache 2.x works is a similar manner to HP Apache 1.3.x. Webmin can configure and manage multiple of HP Apache 2.x web servers or multiple HP Apache web servers of 2.x and 1.3.x combined. Verification: 1. Install HP Apache 2.x swinstall 2. Move HP Apache from its default location (/opt/hpapache2) to a new root using the altroot.sh utility /opt/hpapache2/util/altroot.sh /opt/hpapache2.org 3. Install HP Apache 2.x again 4. Modify LogLevel in both web servers and verify it the error_log has been affected Management 4: Distributed Administration Definition: Distributed administration is the ability to create multiple administrators with different levels of administration capability. NES/iWS: General Admin Users and Groups Page 61
- 62. iPlanet to HP Apache HP Apache 1.3.x: Webmin can be set up with multiple administrators, each with different capabilities for modifying the web server. Webmin is installed with user “admin” with password “hp.com” pre-configured. • To set up additional administrators, 1. Go to Webmin’s main screen, http://yourserver.com:10000 2. Click on “Webmin Users” icon, click on “Create a new Webmin user”, under modules select “HP Apache-based Web Server” 3. Fill in the user name, password, etc., then click on the “Save” button. 4. To remove an administrative user, Click on “Webmin Users” icon, click on the user name, click on the “Delete” button HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x. Verification: 1. Create user testadmin with log viewing capabilities only 2. Log on to Webmin as testadmin 3. View the error_log Page 62
- 63. iPlanet to HP Apache 4. Try to update the httpd.conf file. 5. Verify that the update is not successful Management 5: Dynamic Log Rotation Definition: Dynamic log rotation automatically archive log files based on some criteria such as date, time, a specified interval, etc. NES/iWS: Status Archive Log HP Apache 1.3.x: Apache logs can be rotated using an open source rotation utility, such as rotatelogs that is bundled with HP Apache, or using simple cron-based scripts. • To use the rotatelogs utility: 1. Use Apache’s piped logfile feature, for example, on the access_log, CustomLog "|bin/rotatelogs /opt/apache/logs/access_log 86400" common 2. Check for files /opt/apache/logs/access_log.nnnn where nnnn is the system time at which the log starts (multiple of the rotation time for synchronization with cron scripts). At the end of each rotation time (here after 24 hours, 24 hrs x 60 mins/hr x 60 secs/min = 86400 secs) a new log is started. • To rotate Apache logs using a cron-based script: 1. Create a script, for example, mv access_log access_log.old mv error_log error_log.old apachectl restart 2. Optionally, compress the log files within the script by adding, for example, gzip access_log.old error_log.old NOTE: If “mv” is done while Apache is running Apache will continue writing to the old log files since it continues to hold them open. Apache must be restarted after the log files are moved or deleted in order to open new logs. “apachectl restart” does not work with Apache 2.0.32. To close the old log files and open new ones, use “apachectl stop” then “apachectl start”. For more information on log rotation, http://httpd.apache.org/docs/programs/rotatelogs.html http://httpd.apache.org/docs/logs.html#rotation HP Apache 2.x: Log files for HP Apache 2.x can be dynamically rotated in the same way as HP Apache 1.3.x. For more information, http://httpd.apache.org/docs-2.0/logs.html#rotation http://httpd.apache.org/docs-2.0/programs/rotatelogs.html Verification: Look at the log files in the logs directory to verify they are being rotated, $ ls /opt/apache/logs Page 63
- 64. iPlanet to HP Apache 8.7 Migrating Web Publishing See Appendix 5: Web Publishing for a summary on the how NES and iWS differ from HP Apache. Web publishing is updating or adding content to a remote web server. Web Publishing 1: HTTP PUT Definition: "PUT" is an HTTP method that is similar to the POST method except that a POST is normally directed to a script that already exists while a PUT can be directed to a resource which does not (yet) exist. HP Apache 1.3.x: HP Apache 1.3.x handles PUT similar to the way it handles POST. It supports it, however you need to supply a script to handle it and make changes to httpd.conf. For information on implementing PUT using CGI, http://www.apacheweek.com/features/put For information on implementing PUT using PHP, http://teckla.corp.hp.com/reference/cgi/php/features.file-upload.put-method.html HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x. Verification: Check that HTTP PUT is enabled. Web Publishing 2: WebDAV Definition: WebDAV ("Web-based Distributed Authoring and Versioning") is a set of extensions to the HTTP protocol that allows users to create, move, copy, and delete resources (files) and collections (directories) on a remote server. For example, WebDAV can be used to edit HTML files. HP Apache 2.x provides class 1 and class 2 WebDAV using the mod_webdav module. This feature is not available with HP Apache 1.3.x. HP Apache 1.3.x: WebDAV is not implemented in HP Apache 1.3.x. HP Apache 2.x: To configure WebDAV, 1. Ensure the following lines are present and not commented in httpd.conf, LoadModule dav_module mod_dav.so LoadModule dav_fs_module mod_dav_fs.so 2. Enable by turning on DAV in httpd.conf by adding the “DAV” directive, <Directory "/opt/hpapache2/htdocs"> # add the following line DAV On 3. Set “DAVLockDB” in httpd.conf to anything except an NFS mounted files system. This is a prefix string used by WebDAV to create files. DocumentRoot "/opt/hpapache2/htdocs" Page 64
- 65. iPlanet to HP Apache # add the “DAVLockDB” directive as follows DAVLockDB /opt/hpapache2/locks/DAVLock 4. Create the locks directory and change ownerships, $ mkdir /opt/hpapache2/locks $ chown –R www:other /opt/hpapache2/locks $ chown –R www:other /opt/hpapache2/htdocs More information on WebDAV see, http://httpd.apache.org/docs-2.0/mod/mod_dav.html and http://www.webdav.org Verification: • Windows2000 ONLY Double click the “My Network Places” icon on the Windows 2000 desktop. Double click “Add Network Place”. • WindowsNT ONLY Double click on “Network Neighborhood”. Click on the “Network Neighborhood” click-down list, and select “Web Folders”. Double click on “Add Web Folder”. Note: WindowsNT may not have complete support for “Web Folders” and hence you may not be able to fully test WebDAV. • WindowsNT and Windows2000 Enter the following URL: http://yourserver.com/ Provide a simple display name for this WebDAV folder If able to connect successfully to the WebDAV server and a web-folder is created on the Windows machine, then our WebDAV server is working. 8.8 Migrating Performance See Appendix 6: Performance for a summary on the how NES and iWS differ from HP Apache. More complete information on performance and sizing is available in the Performance/Sizing section of the FAQ (see Getting More Information). This is also some performance information under HP Apache Technical Tips on HP’s webserver site, http://www.hp.com/products1/unix/webservers/apache/techtips/index.html. Performance 1: File Caching Definition: File Caching is the ability to save files in local storage for quicker access times. iPlanet/NES: File caching values are set in the nsfc.conf file. HP Apache 1.3.x: File caching is configured (cache size, file expiration time, garbage collection interval, number of subdirectories) through a set of caching directives that are part of the mod_proxy module. The CacheRoot directive enables caching and also specifies where cached files are stored (by default, /opt/apache/proxy/). For information on additional caching directives, see http://httpd.apache.org/docs/mod/mod_proxy.html 1. Set up Apache as a proxy server (section Enterprise x: Proxy Server) Page 65
- 66. iPlanet to HP Apache 2. Start up caching by uncommenting the following lines in httpd.conf: <IfModule mod_proxy.c> CacheRoot "/opt/apache/proxy" </IfModule> HP Apache 2.x: Apache 2.x separates caching from the proxy server function. mod_proxy does proxying only and mod_cache implements caching of either local or proxied content. mod_cache requires one or more storage management modules. These are currently experimental and should be used with caution, o mod_disk_cache A disk-based storage manager generally used for proxy caching. Causes the proxy server to serve cached files directly instead of sending on requests to the web server. o mod_file_cache An mmap-based or file handle-based storage manager that allows the server file system to control whether the file is in memory or not. o mod_mem_cache (not implemented in HP Apache 2.x) An in-memory based storage manager primarily used for caching local content. 1. Specify caching in httpd.conf. CacheOn turns on caching, CacheRoot specifies where file handles are stored, and CacheEnable specifies the kind of caching (i.e. disk) and which parts of the file system may be cached (i.e. /): <IfModule mod_cache.c> CacheOn On <IfModule mod_disk_cache.c> CacheRoot /opt/hpapache2/proxy CacheEnable disk / </IfModule> </IfModule> 2. Specify in cache.conf which files to cache: <IfModule mod_file_cache.c> CacheFile /opt/hpapache2/htdocs/index.html </IfModule> 3. Create the directory where cached file handles will be stored: mkdir /opt/hpapache2/proxy chown www:other /opt/hpapache2/proxy chmod 755 /opt/hpapache2/proxy 4. Optionally, use util/cache_util.pl to automatically save the most frequently accessed files. cache_util.pl will add CacheFile directives in cache.conf using the most frequently requested files listed in logs/access_log. $ /opt/hpapache2/util/cache_util.pl For more information, http://httpd.apache.org/docs-2.0/mod/mod_cache.html http://httpd.apache.org/docs-2.0/mod/mod_file_cache.html. Verification: 1. There is no easy way to check if file caching is operating. Monitor the performance before and after file caching in enabled. When enabled, files should be delivered more quickly to clients. 2. If cache_util.pl was used, check the cached file list in cache.conf, a. cat /opt/hpapache2/util/cache.conf Page 66
- 67. iPlanet to HP Apache 8.9 Migrating Scalability See Appendix 7: Scalability for a summary on the how NES and iWS differ from HP Apache. Scalability 1: Load Balancing Definition: Load balancing is the distribution of client requests between multiple servers to improve reliability and performance of large, busy web sites. HP Apache 1.3.x: Load balancing can be done using the features on mod_rewrite and mod_proxy. mod_rewrite can be configured to randomly select a back-end server for each client request. mod_proxy disguises the URL so clients are forced to go through the proxy. Users could also build the open source load balancing module from the Backhand Project, mod_backhand. When this is linked as a dynamically loadable module (DSO), it is loaded at Apache startup time. For the source code and building instructions for mod_backhand, go to the Backhand Project’s open source site, http://www.backhand.org/mod_backhand/. To implement load balancing with mod_rewrite and mod_proxy, • One machine is selected to be the proxy server. This server appears to clients as the web server. • The proxy server machine uses mod_rewrite directives to randomly select a back-end server for each client request. • Caching is disabled so that back-end servers handle the load To implement load balancing, 1. Create a proxy server, for example, www.yourserver.com, that randomly accesses six back-end servers named, for example, www1.yourserver.com through www6.yourserver.com. 2. Set up the proxy server, ServerName www.yourserver.com ServerAdmin webmaster@www.yourserver.com ServerRoot /opt/apache DocumentRoot /opt/apache/proxy_docs ErrorLog /opt/apache/proxy_error_log TransferLog /opt/apache/proxy_access_log # This server is for proxying so disable everything else <Directory /> Options None AllowOverride None </Directory> # Turn on URL rewriting RewriteEngine On # Define a log for debugging (if needed) RewriteLog logs/proxy_rewrite # Set logging to 0 for performance unless actively debugging RewriteLogLevel 0 Page 67
- 68. iPlanet to HP Apache # Define the server map RewriteMap myservers rnd:/opt/apache/rewritemaps/mymap.txt # Rewrite the URL if it matches the web server name RewriteRule ^http://www.(.*)$ http://mymap:www).$2 [P,L] # Forbid any URL that doesn’t match RewriteRule .* - [F] # Proxy directives ProxyRequests on ProxyPassReverse / http://www1.myserver.com/ ProxyPassReverse / http://www2.myserver.com/ ProxyPassReverse / http://www3.myserver.com/ ProxyPassReverse / http://www4.myserver.com/ ProxyPassReverse / http://www5.myserver.com/ ProxyPassReverse / http://www6.myserver.com/ HP Apache 2.x: HP Apache 2.0 is configured for load balancing in the same way as HP Apache 1.3.x. If considering mod_backhand, verify first if the module has an Apache 2.x version. Verification: 1. Flood the proxy server with client requests. For example, test a URL 4000 times with 200 concurrently: /opt/hpapache2/bin/ab -n 4000 –c 200 http://localhost/index.html 2. Determine if response time is improved by looking at the output of ab. ab is the Apache benchmarking tool bundled with the product, http://httpd.apache.org/docs/programs/ab.html This is ApacheBench, Version 2.0.32 <$Revision: 1.87 $> apache-2.0 Copyright (c) 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/ Copyright (c) 1998-2001 The Apache Software Foundation, http://www.apache.org/ Benchmarking localhost (be patient) Completed 400 requests Completed 800 requests Completed 1200 requests Completed 1600 requests Completed 2000 requests Completed 2400 requests Completed 2800 requests Completed 3200 requests Completed 3600 requests Finished 4000 requests Server Software: HP Server Hostname: localhost Server Port: 80 Document Path: /index.html Document Length: 4307 bytes Concurrency Level: 200 Time taken for tests: 70.367472 seconds Page 68
- 69. iPlanet to HP Apache Complete requests: 4000 Failed requests: 12 (Connect: 0, Length: 12, Exceptions: 0) Write errors: 0 Total transferred: 18352776 bytes HTML transferred: 17176316 bytes Requests per second: 56.84 [#/sec] (mean) Time per request: 3.518 [ms] (mean) Time per request: 0.018 [ms] (mean, across all concurrent requests) Transfer rate: 254.69 [Kbytes/sec] received Connection Times (ms) min mean[+/-sd] median max Connect: 0 0 1.1 0 27 Processing: 216 3505 1328.8 3648 10469 Waiting: -2878 1934 1224.3 2126 8359 Total: 216 3505 1328.8 3648 10469 Percentage of the requests served within a certain time (ms) 50% 3648 66% 3954 75% 4258 80% 4484 90% 5475 95% 5988 98% 6079 99% 8094 100% 10469 (longest request) 8.10 Migrating Enterprise Capability See Appendix 8: Enterprise Capability for a summary on the how NES and iWS differ from HP Apache. Enterprise 1: Multiple Web Server Instances Definition: This is the ability to run multiple copies of a web server on one machine. NES/iWS: General Administration HP Apache 1.3.x: Multiple instances of HP Apache 1.3.x cannot run on the same machine. HP Apache 2.x: HP Apache 1.3.x and 2.x can be installed on the same machine. They can also run simultaneously provided they use different port number or different IP addresses. Both use port 80 and port 443 (SSL) by default. Multiple installations of HP Apache 2.x can run on the same machine provided they use different port numbers or different IP addresses. The /opt/hpapache2/util/altroot.sh utility will move Apache from its default location (/opt/hpapache2/) to an alternate directory. altroot.sh changes all occurrences of the current Apache root to the new Apache root in all configuration files and scripts. Page 69
- 70. iPlanet to HP Apache To move HP Apache 2.x to a new directory, /opt/hpapache2/util/altroot.sh </current/apache/root> </new/apache/root> For more information on using altroot.sh and its parameters see, /opt/hpapache2/hp_apache_docs/utilities_user_guide Verification: 1. Install HP Apache 2.x 2. Move it to a new root with and update the RC Scripts (default) $ altroot.sh /opt/hapache2 /opt/hpapache2_new 3. Change the port numbers, a. In httpd.conf: ServerName yourserver.com:8080 Listen 8080 Listen 4443 b. In ssl.conf: <VirtualHost _default_:4443> … ServerName jlion05.cup.hp.com:4443 ServerAdmin www@yourserver.com … </VirtualHost> 4. Start up both HP Apache 2.x copies, $ /opt/hpapache2/bin/apachectl start $ /opt/hpapache2_new/bin/apachectl start 5. Reboot the system and verify that both webs servers auto restart $ reboot $ ps –aef | grep httpd Enterprise 2: Internationalization (i18n) Definition: Encompasses support for a user’s native language for input, file names, printing, displaying messages, and formatting numbers, dates, money, etc. "i18n" is a common abbreviation for internationalization. NES/iWS: Content Management Document Preferences and International Characters HP Apache 1.3.x: HP Apache 1.3.x has a number of internationalization features. Native language versions of a file can be returned. Different character sets are pre-defined and new ones can be added. Client error messages are pre-defined for English, French, Spanish, and German and can customized to add new languages and alter message design. Apache’s default index.html file comes in many different languages. I18N is also available through the Jakarta Project’s i18n JSP Tag Library. To get native language versions of a document, 1. Set your client to your native language. On Windows 2000, go to Control Panel, Regional Options and select “Your locale”. Page 70
- 71. iPlanet to HP Apache 2. Set Options Multiviews in the directory(s) where you want to use native language files, for example, <Directory "/opt/hpapache2/htdocs"> # Note that "MultiViews" must be named *explicitly* --- "Options All" # doesn't give it to you. # # The Options directive is both complicated and important. Please see # http://httpd.apache.org/docs-2.0/mod/core.html#options # for more information. # Options Indexes FollowSymLinks Multiviews </Directory> 3. Create files using the file extension for your language. Many are already pre-configured in httpd.conf. For French language files, for example, use .fr $ vi myfile.fr For more information on native language configuration see, http://yourserver.com/error/README http://httpd.apache.org/docs/misc/custom_errordocs.html http://httpd.apache.org/docs/mod/mod_mime.html http://httpd.apache.org/docs/mod/mod_negotiation.html http://httpd.apache.org/docs/content-negotiation.html http://www.apacheweek.com/features/negotiation HP Apache 2.x: HP Apache 2.x is configured in the same way as HP Apache 1.3.x. For more information on native language configuration see, http://yourserver.com/error/README http://httpd.apache.org/docs-2.0/misc/custom_errordocs.html http://httpd.apache.org/docs-2.0/content-negotiation.html http://httpd.apache.org/docs-2.0/mod/mod_negotiation.html Verification: 1. Set your client to your native language. On Windows 2000, go to Control Panel, Regional Options and select “Your locale”. 2. Access a directory that has native language files, for example, http://yourserver.com/manual Enterprise 3: Virtual Servers Definition: Allows more than one server to be running on the same system. The different servers can be distinguished with different names, IP addresses or Ports. NES/iWS: General Administration HP Apache 1.3.x: Apache defines IP-based virtual hosts that share a single IP address and Name-based virtual hosts where each virtual server requires its own IP address. A virtual server can use a non-standard port number (port 80 is the default non-SSL (http) port, port 443 is the default SSL (https) port. Page 71
- 72. iPlanet to HP Apache The following example sets up two name-based virtual hosts called “foo” and “bar”. You must have their names already configured on your DNS server, 192.168.1.1 foo www.foo.com 192.168.1.1 bar www.bar.com 1. Add the following lines to httpd.conf in “Section 3: Virtual Hosts” NameVirtualHost 192.168.1.1 <VirtualHost foo> DocumentRoot /opt/apache/htdocs-foo ServerName www.foo.com </VirtualHost> <VirtualHost bar> DocumentRoot /opt/apache/htdocs-bar ServerName www.bar.com </VirtualHost> 2. Check the configuration, /opt/apache/bin/httpd –S You should see the text, VirtualHost configuration: 192.168.1.1:80 is a NameVirtualHost default server www.foo.com (/opt/apache/conf/httpd.conf:1299) port 80 namevhost www.foo.com (/opt/apache/conf/httpd.conf:1299) port 80 namevhost www.bar.com (/opt/apache/conf/httpd.conf:1304) For more information see, http://www.apache.org/docs/vhosts/ HP Apache 2.x: 1. Add the following lines to httpd.conf in “Section 3: Virtual Hosts” NameVirtualHost 192.168.1.1 <VirtualHost foo> DocumentRoot /opt/apache/htdocs-foo ServerName www.foo.com </VirtualHost> <VirtualHost bar> DocumentRoot /opt/apache/htdocs-bar ServerName www.bar.com </VirtualHost> 2. Check the configuration, /opt/hpapache2/bin/httpd -t -D DUMP_VHOSTS You should see the text: VirtualHost configuration: 192.168.1.1:80 is a NameVirtualHost default server www.foo.com (/opt/hpapache2/conf/httpd.conf:1299) port 80 namevhost www.foo.com (/opt/hpapache2/conf/httpd.conf:1299) port 80 namevhost www.bar.com (/opt/hpapache2/conf/httpd.conf:1304) For more information see, Page 72
- 73. iPlanet to HP Apache http://www.apache.org/docs/vhosts/ Verification: 1. Create a file under virtual host “foo”, $ vi /opt/hpapache2/htdocs-foo/index.html or $ vi /opt/apache/htdocs-foo/index.html 2. Add the following: <HTML> <HEAD> <TITLE>index.html for www.foo.com</TITLE> </HEAD> <BODY> <P>index.html for www.foo.com</P> </BODY> </HTML> 3. Create a file under virtual host “bar” $ vi /opt/hpapache2/htdocs-bar/index.html or $ vi /opt/apache/htdocs-bar/index.html 4. Add the following: <HTML> <HEAD> <TITLE>index.html for www.bar.com</TITLE> </HEAD> <BODY> <P>index.html for www.bar.com</P> </BODY> </HTML> 5. Invoke virtual server foo’s home page http://www.foo.com You should see, “index.html for www.foo.com” 6. Invoke virtual server bar’s home page, http://www.bar.com You should see the text: “index.html for www.bar.com” Enterprise 4: Proxy Server Definition: Proxies are intermediate servers that stand between a client and a remote server and make requests to the remote server on behalf of the client. NES/iWS: This is provided in a separate product. HP Apache 1.3.x: Page 73
- 74. iPlanet to HP Apache The /opt/apache/proxy directory is the default proxy directory in HP Apache 1.3.x . It can be used for either access control of the proxy server or as a location for cached files. HP Apache implements proxying capability for FTP, CONNECT(for SSL), HTTP/0.9, HTTP/1.0, and HTTP/1.1. To set up proxying, 1. Uncomment CacheNegotiatedDocs to allow caching , CacheNegotiatedDocs 2. Uncomment the <IfModule mod_proxy.c>...</IfModule> directives. ProxyRequests enables the proxy server. The directives in <Directory proxy> control the proxy requests. <IfModule mod_proxy.c> ProxyRequests On <Directory proxy:*> Order deny,allow Deny from all Allow from .your_domain.com </Directory> 3. Optionally, enable caching of proxy files (see Performance 1: File Caching) For more information about the proxy directives, see the mod_proxy documentation on the Apache site, http://httpd.apache.org/docs/mod/mod_proxy.html See also the HP Apache FAQs for more information on setting up a proxy server and a reverse proxy server. HP Apache 2.x: The mod_proxy module that implements proxying in Apache was rewritten for Apache 2.x. There is no longer a default proxy directory. The <Proxy *>container replaces the <Directory proxy> where "*" specifies the proxy directory. The CacheNegotiatedDocs is no longer needed and has been eliminated. HP Apache implements proxying capability for FTP, CONNECT(for SSL), HTTP/0.9, HTTP/1.0, HTTP/1.1, and filters. To enable proxying, 1. Uncomment the following directives between <IfModule mod_proxy.c> and </IfModule> <IfModule mod_proxy.c> ProxyRequests On <Proxy *> Order deny,allow Deny from all Allow from .your_domain.com </Proxy> 2. Replace "*" with your proxy directory and .your_domain.com with your own domain 3. Add the following two lines before the </IfModule> … ProxyRemote * http://<IP-address>:8088 ProxyReceiveBufferSize 2048 … </IfModule> Page 74
- 75. iPlanet to HP Apache The <IP-address> should be the IP address of an already functional proxy server. The ProxyRemote directive causes requests to be directly forwarded to <IP-address>:8088 where <IP- address> does the DNS lookups on host names. 4. Make sure the web server is listening on port 8088, Listen 8088 ServerName yourserver.com:8088 5. Optionally, enable caching (see Performance 1:File Caching) For more information about the proxy directives, see the mod_proxy documentation on the Apache site, http://httpd.apache.org/docs-2.0/mod/mod_proxy.html See also the HP Apache FAQs for more information on setting up a proxy server and a reverse proxy server. Verification: 1. On your browser, set yourserver.com:8088 as the proxy server 2. Try accessing a URL, for example, http://www.apache.org You should see ASF’s Web Page. Make sure HP Apache was used as the proxy: 1. Stop HP Apache, $ /opt/hpapache2/bin/apachectl stop 2. Trying to connect to a new web page, http://httpd.apache.org/dev/ 8.11 Migrating Developer Support See Appendix 9: Developer Support for a summary on the how NES and iWS differ from HP Apache. Developer 1: Database Connectivity Definition: Database connectivity is accessing database content via the web server to return dynamic content to a client. NES/iWS: Programs Server Side Javascript or, http://<yourserver.com>/appmgr HP Apache 1.3.x: HP Apache 1.3.x can connect to a variety of databases using Java JDBC, Perl’s DBI, PHP, and PHP extensions. • JDBC: JDBC(TM) technology is an API that lets you access virtually any tabular data source from Java. It provides cross-DBMS connectivity to a wide range of SQL databases and to other tabular data sources, such as spreadsheets or flat files. It provides a standard interface to a database server. JDBC can be used with HP Apache’s servlets or JSPs. Page 75
- 76. iPlanet to HP Apache • Perl DBI: Perl DBI is an API that allows users to access multiple database types transparently such as Oracle, Informix, mySQL, and Sybase. Perl DBI can be used in conjunction with Perl CGI scripts. Using HP Apache mod_perl module, the perl interpreter is embedded is loaded at Apache startup so your DBI will run faster. To enable mod_perl: Edit httpd.conf, 1. Uncomment the mod_perl AddModule directive. #AddModule mod_perl.c 2. Verify that the section enclosed in the <IfModule mod_perl.c> ... </IfModule> tags is uncommented This allows files ending with *.pl to run through mod_perl. • PHP: PHP has built-in mySQL support for access to mySQL databases. More information about MySQL can be found at http://www.mysql.com/. Documentation for MySQL can be found at http://www.mysql.com/documentation/. To enable PHP in HP Apache, Uncomment the following lines in httpd.conf: #LoadModule php4_module libexec/libphp4.so #AddModule mod_php4.c For more information about PHP, see the PHP user’s guide, http://www.php.net/docs.php and PHP general information, http://www.php.net/ HP Apache 2.x: HP Apache 2.x has the same database connections available to HP Apache 1.3.x with the addition of a PHP extension for Oracle connectivity. HP Apache 2.x can connect to Oracle 8.1.6 or later. To configure PHP to Oracle: 1. Enable PHP by uncommenting the following line in httpd.conf, LoadModule php4_module modules/libphp4.so 2. Install the Oracle client libraries on the same machine as HP Apache. 3. Uncomment the following line in /opt/hpapche2/conf/php.ini, extension=oci8.sl This tells PHP to load the Oracle extension on startup. The 'extension_dir' directive in the php.ini file points to the location of oci8.sl. It is set by default to /opt/hpapache2/php/libs/php/extensions/ 4. Uncomment and set appropriate values for the following variables in apachectl, export ORACLE_HOME = /path/to/oracle-8.1.6/client/side/libraries export SHLIB_PATH=$SHLIB_PATH:$ORACLE_HOME/lib export ORACLE_SID=YourConnectionNameA. The location of the extensions. For more information on PHP with Oracle, /opt/hpapache2/hp_apache_docs/php.admin.guide Verification: mySQL Page 76
- 77. iPlanet to HP Apache 1. Enable PHP 2. Try a simple SQL example. Assuming a database with a customer table containing name and address fields, <? @ $db = mysql_pconnect("localhost", user, password); if (!db) { echo "Error: Couldn't connect"; } mysql_select_db("customers"); $query = "select * from customers"; $result = mysql_query($query); $num_results = mysql_num_rows($result); for ($i = 0; $i < $num_results; $i++) { $row = mysql_fetch_array($result); echo "<p;>i+1).". Name: "; echo $row["name"]; echo "<br;> Address: "; echo $row["address"]; echo "<p;>"; } ?> JDBC: 1. Enable Tomcat servlets (Server-Side 3: Java Servlets and Java Server Pages (JSPs)) 2. Create a sample servlet that talks to a database such as the following package test; import javax.servlet.*; import javax.servlet.http.*; import java.io.*; import java.util.*; import java.sql.*; public class Servlet1 extends HttpServlet { private static final String CONTENT_TYPE = "text/html"; // initialize the driver static { try { Class.forName("COM.ibm.db2.jdbc.net.DB2Driver").newInstance(); } catch (Exception e) { e.printStackTrace(); } } Connection con; public void init() throws ServletException { try { // construct the URL String url = "jdbc:database://server:port/sample"; // connect to database with userid and password Page 77
- 78. iPlanet to HP Apache con = DriverManager.getConnection(url, "userid", "password" ); } catch( Exception e ) { e.printStackTrace(); } } private void doSelect (PrintWriter out) { try { Statement stmt = con.createStatement(); // we will run simple select statement ResultSet rs = stmt.executeQuery("SELECT * from Table"); out.println ("<table>"); while (rs.next()) { String r1= rs.getString(1); String r2 = rs.getString(2); String oneLine = "<tr><td>" + r1 + "</td><td>" + r2 + "</td></tr>"; } stmt.close(); out.println ("</table>"); } catch( Exception e ) { e.printStackTrace(); } } //Process the HTTP Get request public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { response.setContentType(CONTENT_TYPE); PrintWriter out = response.getWriter(); out.println("<html>"); out.println("<head><title>Servlet1</title></head>"); out.println("<body>"); doSelect (out); out.println("</body></html>"); } //Clean up resources public void destroy() { } } Developer 2: Plug-in APIs Definition: Plug-ins are code modules that are written using the web servers APIs and which extend the functionality of the web server. NES/iWS: NES and iPlanet use the Netscape Application Interface (NSAPI) to create plug-ins for the web server. HP Apache 1.3.x: Apache has its own set of APIs which are different than NSAPIs. Apache plug-ins are called modules and can be written in C, C++, or Perl (using mod_perl) and can define new Apache configuration Page 78
- 79. iPlanet to HP Apache directives and participate in any phase of request processing. HP Apache modules Apache modules can be built as static objects that are compiled into Apache but are usually built as shared libraries that are dynamically loaded at Apache startup time. These modules are called Dynamic Shared Objects (DSOs). Details about the Apache APIs are provided on the ASF Apache web site, http://httpd.apache.org/docs/misc/API.html A good book on writing Apache modules is “Writing Apache Modules with Perl and C” by Lincoln Stein & Doug MacEachern, published in 1999 by O'Reilly and Associates. To migrate NES/iPlanet plug-ins, 1. Some plug-ins might be replaced with open source or third-party Apache modules. For open source Apache modules see the Apache Module Registry, http://modules.apache.org/. For third-party modules, contact the third-party vendor directly. For example, SpeedCard requires a plug-in which is supplied by Rainbow. An equivalent module is available from Rainbow for Apache. 2. Compare the capabilities between NSAPI and Apache APIs and consider the application’s overall architecture. It may be advantageous, for example, to rewrite an application into an Apache Perl module or into a Java servlet. 3. apxs is a bundled utility for building and installing Apache modules (DSOs). For example, to compile the source file mod_foo.c into a DSO using apxs, $ apxs -c mod_foo.c 4. apxs can auto install a DSO in Apache’s shared object directory (/opt/apache/libexec) and update httpd.conf with a LoadModule directive, $ apxs -i -a mod_foo.c This adds the following line to httpd.conf, LoadModule foo_module libexec/mod_foo.so Complete information on apxs is provided in the apxs man page, http://httpd.apache.org/docs/programs/apxs.html HP Apache 2.x: The APIs for 1.3.x and 2.x are significantly different. The API for 2.x is called the Apache Portable Runtime (APR) and is enhanced to provide automatic module loading and new calls with additional capabilities. 1. /opt/hpapache2/example/mod_example is the source code of a working Apache module that can be used as a template for creating new modules. 2. Modules are located in the module directory, /opt/hpapache2/modules 3. apxs can be used to create and install Apache modules. httpd.conf no longer requires the LoadModule directive. For more information about Apache 2.x modules, http://httpd.apache.org/docs-2.0/developer/ For more information about apxs, http://httpd.apache.org/docs-2.0/programs/apxs.html Verification: 1. Start HP Apache with the new module configured, $ /opt/hpapache2/bin/apachectl start Page 79
- 80. iPlanet to HP Apache 2. Check the error_log for module loading errors $ tail /opt/hpapache2/logs/error_log 3. If the module doesn’t load, turn on debugging messages for error_log and try loading it again. $ cat httpd.conf, … LogLevel debug … Page 80
- 81. iPlanet to HP Apache 9 Final Migration Verification Make sure you have performed the verification for each feature that is given in its migration step. Here are additional ways to test HP Apache. 1. Check the syntax of the configuration file, $ /opt/apache/bin/httpd –t Syntax OK 2. Start HP Apache as the root user, $ /opt/hpapache2/bin/apachectl startssl 3. Check the error log for Apache and for other components such as Tomcat, $ cat opt/apache/logs/error_log 4. Check file permissions to make sure your files are readable, writeable , and executable ( as appropriate) by HP Apache. HP Apache runs as, User www Group other 5. Check references in existing web pages (servlets, JSPs, HTML, CGI, etc.) to see if web server references are relative or absolute. Absolute references may no longer be valid under the HP Apache directory structure. 6. Run your regression tests making sure to access files and applications that have been affected by the migration. 7. Run performance and load tests. Tune HP Apache directives and HP-UX kernel parameters using the information from the HP Apache-based Web Server FAQs, http://www.hp.com/products1/unix/webservers/apache/faqs/index.html. The FAQs are also bundled with HP Apache 2.x. 8. For troubleshooting tips, consult the HP Apache FAQs, http://www.hp.com/products1/unix/webservers/apache/faqs/index.html. 9. Consult the Migration Guide HP Apache-based Web Server 1.3.x to 2.x for more information on the differences between HP Apache 1.3.x and 2.x, http://www.hp.com/products1/unix/webservers/apache/techtips/migration_hpApache1.3to2.pdf 10. Consult the FAQs for a list of additional manual tests. 11. Remove NES or iPlanet files only after the HP Apache migration has been thoroughly tested. NOTE: Verify the use of Alias directives and/or symlinks from HP Apache to iPlanet before doing any file cleanup. Page 81
- 82. iPlanet to HP Apache Appendix A Summary of Web Server Functionality Differences This section gives a summary of how iPlanet web server functionality (NES and iWS) differs from that of HP Apache-based Web Server. See the Performing the Migration section for more functionality details and for instructions on migrating individual components. A.1 Core Core functionality refers to the fundamental behavior of the web server. This is functionality that is part of a web server’s basic operation. Process Handling Process handling is the process model of how a web server handles incoming requests. NES/iWS: iPlanet uses a multi-process, multi-threaded model where each thread handles a request HP Apache: HP Apache 1.3.x uses a multi-process model where each process handles a user request. HP Apache 2.x uses a hybrid multi-process, multi-threaded model where each thread handles a request. Logging Logging is the saving of information for use in detecting performance problems, errors, and for evidence of potential security violations. NES/iWS: iWS uses error and access logs. Access logs can be custom formatted or use the Common Logfile Format (CLF). The admin server displays error and access log content. HP Apache: Apache’s main logs are error and access logs, formatted using CLF. There are additional logs for configured features such as Tomcat, Rewrite, and CGI. Log Rotation Log rotation is a way to automatically archive log files at specific intervals. NES/iWS: iWS’ admin server can be configured to automatically archive access logs either through Internal-daemon log rotation and cron-based log rotation. HP Apache: Apache’s logs can be archived using open source rotation tools (such as the one bundled with Apache) or using cron-based log rotation. IP Addresses and Port Numbers IP addresses specify the network address on which a web server listens. Port numbers specify the network port(s) on which the web server listens. NES/iWS: By default, NES and iWS listen on port 80. By default, it never tries to match IP addresses with corresponding host names. HP Apache: By default, Apache listens on port 80 (http) and port 443 (https) for all IP addresses. Default ports can be changed and additional ports can be configured. Specific IP addresses can be configured in combination with multiple ports. Page 82
- 83. iPlanet to HP Apache DNS lookups DNS lookups refers to web server access to a domain name server to resolve a client’s IP address into a server name. NES/iWS: Can be enabled or disabled HP Apache: Can be enabled or disabled. It is disabled (off) by default for better performance. Document Directories Document directories are the directories where web pages are located. NES/iWS: Has a Primary Document Directory. Additional document directories can be configured. HP Apache: Apache’s primary document directory is called the Document Root. Additional document directories can be configured. Directory indexing Directory indexing specifies which page(s) to use as an index page, and how to display directories. NES/iWS: By default, NES and iWS assume that index.html and home.html are the preferred index. Directories can be configured to be displayed in a variety of configurations. HP Apache: Can retrieve a specific index page, can generate a dynamic directory listing, and can create “Fancy” directory indexes that display graphics, file modification dates, etc. File redirection With file redirection, clients accessing a URL on a system are sent to a different location on either the same server or a different server. This is useful if a resource has moved and you want the move to be transparent to the client. NES/iWS: Can be configured as needed. HP Apache: Can be configured as needed. Use the “Redirect*” directives from mod_alias. MIME Types and Settings MIME types and settings specify the content type (HTML, picture, text, etc.) of a web page so a browser knows how to display it correctly. File extensions (.html, .gif, .txt, etc.) are mapped to a content type that is sent back to the browser. The content type can also specify a character set (charset-iso-2022-jp, etc.) to use when displaying. NES/iWS: Uses the mime.types file HP Apache: Uses the mime.types files that is pre-configured with standard MIME types. More types can be added. Page 83
- 84. iPlanet to HP Apache A.2 Security SSL/TLS NES/iWS: iPlanet is configurable for SSL v.2 or SSL v.3 and for which ciphers each uses. The server can be enabled to request client certificates and to set the key size. SSL caching is also available. HP Apache: HP Apache uses mod_ssl and OpenSSL to implement SSL/TLS. These provide 128bit/168 bit strong cryptography via SSL v2, SSL v3, and TLS v1. Certificates NES/iWS: NES uses Netscape 3.x certificates. iWS uses Netscape 4.x certificate. HP Apache: Uses Public-Key Cryptography Standard (PKCS) #12 developed by RSA Laboratories. Chroot Chroot is a security feature that provides an alternate root directory and limits a web server to directories below the alternate root. When the web server tries to access the root directory it accesses the chroot directory instead. NES/iWS: NES using Virtual Vault for chroot, iWS has chroot built in. HP Apache: HP Apache has chroot built in and provides a bundled script for creating a chroot directory and copying files to that directory. Access Control Files/Dynamic Configuration Files (.nsconfig, .htaccess) .nsconfig and .htaccess files are per-directory configuration files that allow certain directives to be placed in a directory. NES/iWS: iWS uses .nsconfig and .htaccess and refers to them as Dynamic Configuration Files. A conversion utility for converting .nsconfig to .htaccess is bundled with iWS. HP Apache: HP Apache uses .htaccess as the default file name for per-directory configuration files. The file name can be changed to any name. Access Control Lists (ACLs) ACLs are rules that control access to web server resources. NES/iWS: NES and iWS implement ACLs in .acl files. They can restrict access to the server, a directory, a URI, a file type, a hostname, an IP address or by time of day. Access rights can be specified as read, write, execute, delete, list, and info. ACLs can authenticate users and groups in an LDAP directory. HP Apache: Restricts access using the containers <File>, <Directory>, etc. in conjunction with Allow/Deny commands to restrict access by directory, URI, IP address, or files. The <LIMIT> directive restricts access rights based on HTTP commands (GET, PUT, etc.). HP Apache 2.x authenticates users using an LDAP directory. Database Authentication Database authentication authenticates user access to a web resource from a list of users and groups in a database. Page 84
- 85. iPlanet to HP Apache NES/iWS: iWS authenticates users and groups from customer databases such as Oracle. HP Apache: HP Apache includes Basic Authentication to authenticate users and groups from a ascii flat file. HP Apache can also use a DBM database file (similar to Basic Authentication) to authenticate users and groups. Directory-based Access Control Directory-based access control accesses a directory server for controlling access to web server resources. NES/iWS: NES and iWS use LDAP through the iPlanet (Netscape) Directory Server for authenticating users and groups. HP Apache: HP Apache authenticates users and groups via entries in an iPlanet Directory Server or an OpenLDAP Directory Server. For secure transactions, authentication can be done over SSL to an iPlanet Directory Server or over TLS to an OpenLDAP directory server. A.3 Server-Side Execution Common Gateway Interface (CGI) Common Gateway Interface (CGI) programs are applications that run on the server and generate a response to the requesting client. NES/iWS: NES and iWS support the CGI standard. HP Apache: Apache supports the CGI standard. CGI can be written in C, C++, Java, Perl, or using shell commands. mod_perl can be configured to boost Perl CGI performance. Parsed HTML (SHMTL) Web servers normally send HTML back to a client exactly as it exists on disk without intervention. With SHTML files, the web server checks (parses) the disk file for special SHTML commands and modifies the file before sending it back to the client. NES/iWS: NES and iWS uses the term “Parsed HTML”. HP Apache: Apache refers to SHTML files as Server-Side Includes (SSI). SHTML <SERVLET> tag Servlets can be called from a Server-Side Includes ( SHTML) document by using the <SERVLET> tag. NES/iWS: iWS implement this functionality, NES does not. HP Apache: In HP Apache servlets are executed through a JSP only. Web Application Interface (WAI) WAI is an API called the Web Application Interface that extends web server functionality using the Common Object Request Broker Architecture (CORBA). WAI applications/plug-ins are ORB-compliant. Page 85
- 86. iPlanet to HP Apache NES/iWS: NES and iWS support WAI applications written in C, C++, or Java that interact with the web server using Internet Inter-ORB Protocol (IIOP). Using servlets instead of WAI is recommended. HP Apache: HP Apache does not directly support CORBA. It does support servlets. Java Servlets NES/iWS: Servlets are run on an iPlanet native servlet engine. HP Apache: HP Apache 1.3.x supports two different servlet engines, Apache JServ and Tomcat, and two different connectors, mod_jserv and mod_jk. mod_jserv connects Apache to JServ and mod_jk connects Apache to JServ or Tomcat. HP Apache 2.x supports Tomcat only and uses the mod_jk connector between Apache and the Tomcat servlet engine. Java Server Pages (JSP) NES/iWS: NES uses JSP 0.92 and iWS uses JSP 1.1. iWS uses the open source JSP compiler “Jasper” included with Tomcat 3.0 for compiling a JSP pages into servlets. Config/jvm12.conf file is the Java Virtual Machine (JVM) configuration file. HP Apache: HP Apache 1.3.x and 2.x support JSP version 1.1 as implemented by the open source Jakarta Project, http://jakarta.apache.org/tomcat/index.html. JSP version 1.x is not backward compatible with JSP version 0.92. Java Server Pages (JSP) Custom Tag Libraries Tag libraries contain Java code that can be called by JSPs. Tag libraries also allow for the creation of custom JSP tags. Tags aid in the development and understanding of JSPs for HTML authors. Servers that support the JSP 1.1 specification also support tag libraries. NES/iWS: NES uses JSP 0.92 so tag libraries are not available. IWS uses JSP 1.1 so tag libraries are available. HP Apache: Tag libraries are supported on HP Apache 1.3.x and 2.x through Tomcat. Server-Side JavaScript (LiveWire, LiveConnect) Server-side JavaScript is JavaScript that is executed inside a <SERVER> tag and executes on the server. NES/iWS: NES and iWS support server-side JavaScript. Server-side JavaScript is part of the LiveWire development tool. JavaScript applications are compiled into .web files and can access relational databases that meet the Open Database Connectivity (ODBC) standard. LiveConnect is a framework for interconnection of Java, HTML, JavaScript, CORBA objects, and plug-ins. HP Apache: HP Apache 1.3.x and 2.x support client-side JavaScript but not server-side JavaScript. A.4 Management Server Status NES/iWS: NES and iWS use the Management Information Base (MIB) to detect server status. HP Apache: HP Apache uses the mod_status and mod_info modules to gather and display web server status. Page 86
- 87. iPlanet to HP Apache Cluster Management Administer multiple remote servers from a single administration server. NES/iWS: Multiple web servers of the same type can be configured identically. The collection of servers that are configured from a single administration server is called a cluster. HP Apache: Webmin can manage multiple remote web servers by adding to servers to its configuration. Administration Server NES/iWS: NES and iWS include an web-based GUI administration server, a separate server that manages multiple web servers through a single interface. HP Apache: HP Apache includes a web-based GUI administration called Webmin. Webmin is a miniserver consisting of a number of Perl CGI programs. Distributed Administration Delegate administrative tasks without giving administrators full access. NES/iWS: NES 3.x uses the name and password of the logged in admin server to determine what can be configured allowing others to access to a limited set of features. HP Apache: Webmin can multiple administrators with different levels of capability to manage the server. System Monitoring System monitoring is real-time remote monitoring of networked system for checking status. NES/iWS: NES and iWS support SNMP versions 1 and 2 for system monitoring through HP’s OpenView, Tivoli/IBM’s TME, BMC’s Patrol, CA’s UniCenter and Sun Solstice. HP Apache: HP Apache does not implement an interface for remote system monitoring. A.5 Web Publishing Web Publishing it the capability for clients to access and manipulate files on a remote server. Web Publisher NES/iWS: NES and iWS use Web Publisher. Web Publisher gives direct access to files and folders in a user’s home directory and allows sharing of files from the desktop. Web Publisher is implemented as a Java applet that runs on the local client. HP Apache: In HP Apache 1.3.x, files can be updated on the server if the HTTP PUT command is configured. HP Apache 2.x implements WebDAV, web-based distributed authoring and versioning, through an Apache module. Page 87
- 88. iPlanet to HP Apache Search Collections and Version Control NES/iWS: NES and iWS use the Verity Search engine and the mks versioning system. Verity Search engine can search collections (directories) for HTML and non-HTML documents, supports NNTP-clients (Network Transfer Protocol for newsgroups) and uses the mks document versioning. HP Apache: Not available in HP Apache 1.3 or 2.x A.6 Performance File Caching A caching server stores files for immediate return to a client without accessing a local or remote web server to retrieve it. NES/iWS: HP Apache: HP Apache 1.3.x implements caching through the mod_proxy module. HP Apache 2.x implements caching through the new caching modules, mod_file_cache, mod_cache, and mod_disk_cache. A.7 Scalability Load Balancing Load balancing distributes the load of customer requests between servers for large, busy web sites. NES/iWS: NES and iWS implement load balancing through a plug-in from Resonate. Resonate (www.resonate.com) compares resource usage with the current number of requests and balances the traffic distribution to reduce the incoming traffic volume to a particular server. HP Apache: HP Apache does not directly provide load balancing capability. A load balancing scheme can be set up using HP Apache’s mod_rewrite and mod_proxy modules or by building a third-party module such as mod_backhand. A.8 Enterprise Capability Multiple Web Server Instances This is the capability to install and run multiple copies (separate binaries) of the web server. Multiple instances can be started and stopped independently. NES/iWS: NES and iWS support installation of multiple web servers on the same box. HP Apache: HP Apache 1.3.x and HP Apache 2.x can run simultaneously on the same machine provided they use unique port numbers or different IP addresses. Multiple instances of HP Apache 2.x can run on the same machine using the altroot.sh utility to move HP Apache from its default location. Internationalization (i18n) Internationalization encompasses support for inputting characters in a users' native languages, handling files in popular encoding, using characters from a user’s native language for file names and other items, Page 88
- 89. iPlanet to HP Apache printing out characters from a user’s native language, displaying messages in a user’s native language, formatting numbers, dates, money, etc that obeys the customs if a user’s native culture. "i18n" is a common abbreviation for internationalization because there are 18 letters between the first "i" and the last "n". NES/iWS: i18n support is built into NES and iWS. iPlanet allows a character set assignment to the documents on the web server. The character set of a document is determined in part by the language in which it is written. A client’s default character set can be overridden for a document, a set of documents, or a directory by selecting and entering a character set for that resource. HP Apache: HP Apache supports i18n through the Jakarta Project’s i18n Tag Library for JSPs. It also comes with an index.html page translated into many different languages. HP Apache error messages can also be customized into any language. LDAP Directory Server Integration NES/iWS: The LDAP Directory Server can be used as a general purpose LDAP directory. It can also check for valid (unrevoked) certificates. It an also can contain users and groups for authentication. HP Apache: HP Apache does not support general usage of an LDAP Directory Server. HP Apache has LDAP integration for authentication only. Virtual Servers Virtual Servers are a method for running a single web server binary yet having the appearance and flexibility of running multiple web servers. NES/iWS: NES does not implement virtual servers. iWS implements hardware virtual servers and software virtual servers. iWS Hardware Virtual Servers allow mapping of multiple IP addresses to multiple document roots. All hardware virtual servers share the same configuration information (i.e. is one virtual server has SSL enabled then all virtual servers must also have it enabled. iWS Software Virtual Servers give the ability to map a single IP address to multiple server names. Each software virtual server can have its own home page (i.e. to host multiple web sites from one IP address). Software virtual servers share the same configuration file but can have a separate document root and a separate CGI directory. HP Apache: HP Apache 1.3.x and 2.x implement virtual servers. Apache virtual servers are called “IP- based Virtual Hosts” and “Name-based Virtual Hosts”. An IP-based virtual host has its own unique IP address. It does not need to be identified by name so it will work older browsers that don’t implement HTTP/1.1 protocol (specifically, don’t send a Host: header). With name-based virtual hosts, many domain names share a single IP address and the virtual host selected depends on the Host: header. Virtual Hosts can share configuration directives with the main web server or have their own configuration directives, http://httpd.apache.org/docs/vhosts/index.html. Virtual Hosts can use most of the directives available to the default (main) server. Proxy Server Proxy servers are intermediate servers that stand between a client and a remote server to make requests to the remote server on the client’s behalf. Proxy servers can be used for load balancing or to isolate clients and servers to prevent unauthorized transactions. NES/iWS: NES and iWS Proxy use iPlanet Proxy Server product for proxy functionality such as caching, forward proxy, reverse proxy, and logging. Page 89
- 90. iPlanet to HP Apache HP Apache: HP Apache has built-in proxy server capability that provides caching, forward proxy, reverse proxy, and logging. A.9 Developer Support Database Connectivity This is the ability for web applications to access a database. NES/iWS: Supports native database connectivity to Oracle, IBM DB2, Sybase, and Informix using relational-database access capabilities built on native drivers. HP Apache: Java-based applications or Java servlets can connect to a database through JDBC. Connectivity to Oracle 8.1.6 or later and MySQL are available through PHP scripts. User Document Directories A user document directory allows users to create and manage a home page and other documents in their own directory. Oftentimes, a user document directory resides in /~user/public_html and is accessed by the URL http://yourserver.com/~user/file.html. ~user is a user’s home directory as specified in /etc/passwd. NES/iWS: This feature is supported as described. HP Apache: This feature is supported as described. Server plug-ins A server plug-in is add-on functionality that is written using a defined set of application programming interfaces (APIs). A plug-in extends and/or customizes the functionality of the web server. NES/iWS: NES and iWS plug-ins are written using the iPlanet proprietary API (NSAPI). HP Apache: Plug-ins are called “modules” in Apache. Modules are written using an open source API that parallels NSAPI in functionality. Apache also provides a tool for building and installing modules. Modules can be built shared libraries that are dynamically loaded at Apache startup time. These modules are called Dynamic Shared Objects (DSOs). The APIs between Apache 1.3.x and 2.x are significantly different requiring module modifications when modules are moved from 1.3.x to 2.x. A.10 Application Integration HP Virtual Vault NES/iWS: Supported in versions 4.0 and earlier. HP Apache: VirtualVault 4.5 uses Apache as its outside and inside web server. These implementations of Apache are not the same as the HP Apache products. Application Servers NES/iWS: Supports Sun ONE Application Server HP Apache: HP Apache can access the HP Application Server (HP-AS) through the mod_lbb module. mod_lbb is included with HP-AS. Page 90
- 91. iPlanet to HP Apache Appendix B Important HP Apache Files B.1 Configuration Files HP Apache 1.3.x: HP Apache 2.x: Apache server /opt/apache/conf /opt/hpapache2/conf access.conf cache.conf srm.conf mime.types mime.types highperformance-std.conf magic highperformance.conf httpd.conf httpd-std.conf httpd.conf magic JServ /opt/apache/conf/jserv/ N/A jserv.conf zone.properties jserv.properties Tomcat /opt/tomcat/conf (before 1.3.26) /opt/hpapache2/tomcat/conf build.xml apps-127.0.0.1.xml server.xml.test jk/ tomcat.conf.org server.xml jni_server.xml apps-admin.xml test-tomcat.xml modules.xml tomcat.conf.test tomcat.policy jni_workers.properties apps-examples.xml tomcat-apache.conf prof-server.xml tomcat.properties users/ manifest.servlet auto/ tomcat-portal.conf profile.xml uriworkermap.properties obj.conf tomcat-portal.conf web.dtd server.dtd tomcat-users.xml web.xml server.xml workers.properties /opt/tomcat/conf (1.3.26) same structure as 2.x PHP /opt/apache/conf /opt/hpapache2/conf php.ini php.ini php.ini.bak* SSL /opt/apache/conf /opt/hpapache2/conf ssl.crl/ ssl-std.conf ssl.crt/ ssl.conf ssl.csr/ ssl.crt/ ssl.key/ ssl.key/ Page 91
- 92. iPlanet to HP Apache ssl.prm/ LDAP /opt/apache/conf /opt/hpapache2/conf ldap.conf (1.3.26.06 and later) ldap.conf B.2 Sample Files HP Apache has the following sample files. HP Apache 1.3.x: Servlets and JSPs /opt/apache/servlets/ (Apache JServ servlets) http://yourserver.com:8081/servlets /opt/tomcat/webapps/examples/ (Tomcat servlets and JSPs) Servlets: http://yourserver.com:8081/examples/servlets JSPs: http://yourserver.com:8081/examples/jsp PHP /opt/apache/htdocs/test.php (PHP script) http://youserver.com/test.php HP Apache 2.x: Servlets and JSPs /opt/hpapache2/tomcat/webapps/examples/ (Tomcat servlets and JSPs) Servlets: http://yourserver.com:8081/examples/servlets JSPs: http://yourserver.com:8081/examples/jsp PHP /opt/apache/htdocs/test.php (PHP script) http://youserver.com/test.php XML /opt/hpapache2/tomcat/conf/apps-examples.xml /opt/hpapache2/tomcat/conf/users/example-users.xml Apache modules /opt/hpapache2/modules/mod_example /opt/hpapache2/modules/mod_echo B.3 Bundled Apache Web Server Documentation The following documentation is bundled with the HP Apache product: HP Apache 1.3.x: HP Apache 2.x: HP Apache /opt/apache/htdocs/manual/ /opt/hpapache2/htdocs/manual/ ASF Apache server /opt/apache/htdocs/doc/ /opt/hpapache2/hp_apache_docs/ B.4 Web Server Icons HP Apache has a separate directory for icons that includes a default set of .gif files: HP Apache 1.3.x: Page 92
- 93. iPlanet to HP Apache /opt/apache/icons HP Apache 2.x: /opt/hpapache2/icons B.5 Backup Configuration files are backed up when installing over a previous version of HP Apache. HP Apache 1.3.x: The existing configuration <file> is renamed to <file>.save. If <file>.save already exists, an additional .save suffix is added, <file>.save.save. For example, these files are saved: /opt/apache/conf/httpd.conf /opt/tomcat/conf/jserv/tomcat.conf HP Apache 2.x: The existing configuration <file> is renamed to <file>.save. If <file>.save already exists, it is overwritten. For example, these files are saved: /opt/hpapache2/conf/httpd.conf B.6 Administration Webmin web-based administration tool has a separate subdirectory under the Apache root. Utilities for automating administration tasks are located in the util subdirectory. HP Apache 1.3.x: /opt/apache/webmin/ (Webmin GUI tool) HP Apache 2.x: /opt/hpapache2/webmin (Webmin GUI tool) /opt/hpapache2/util/ (utilities) B.7 Installation files HP Apache is installed using swinstall, the same installation software used for installing other HP products. B.8 Startup/Shutdown scripts The HP Apache server (httpd) is started and stopped using the apachectl utility. This utility has various options for starting Apache. These options are described in the script itself and in the apachectl manual page, http://httpd.apache.org/docs/programs/apachectl.html (Apache 1.3.x) http://httpd.apache.org/docs-2.0/programs/apachectl.html (Apache 2.x). Webmin and Tomcat each have their own startup and shutdown scripts. HP Apache 1.3.x: HP Apache 2.x: Apache server /opt/apache/bin/apachectl start /opt/hpapache2/bin/apachectl start /opt/apache/bin/apachectl startssl /opt/hpapache2/bin/apachectl startssl /opt/apache/bin/apachectl stop /opt/hpapache2/bin/apachectl stop Tomcat Page 93
- 94. iPlanet to HP Apache /opt/tomcat/bin/startup.sh /opt/tomcat/bin/startup.sh /opt/tomcat/bin/shutdown.sh /opt/tomcat/bin/shutdown.sh Webmin tool /opt/apache/webmin/webmin-init start /opt/hpapache2/webmin/webmin-init start /opt/apache/webmin/webmin-init stop /opt/hpapache2/webmin/webmin-init stop Automatic startup scripts for Apache, Tomcat, and Webmin /etc/rc.config.d/apacheconf /etc/rc.config.d/hpapache2conf Page 94
- 95. iPlanet to HP Apache Appendix C Web Servers Component Reference This table lists functionality on NES and iPlanet web servers and how it maps to HP Apache-based Web Servers. Table C.1 NES, iWS and HP Apache-based Web Server Functionality NES/iWS NES 3.x iWS 4.x HP Apache HP Apache HP Apache Functionality 1.3.x 1.3.26.x 2.x (PA-RISC, (PA-RISC, (PA-RISC, IPF) IPF IPF) Core Static HTML Yes Yes Yes Yes Yes HTTP protocol HTTP 1.0 HTTP 1.1 HTTP 1.0/1.1 HTTP 1.0/1.1 HTTP 1.0/1.1 Software Virtual Servers Yes Yes Name-based Name-based Name-based Virtual Host Virtual Host Virtual Host Hardware Virtual Servers Yes Yes IP-based Virtual IP-based Virtual IP-based Virtual Host Host Host Multiple instances Yes Yes Yes Yes Yes Alternate Installation Location Yes No No Yes I18N Yes Jakarta open Jakarta open Jakarta open source I18N tag source I18N tag source I18N tag library library library Data Model 32-bit PA: 32-bit, PA: 32-bit, PA: 32-bit, IPF: 64-bit IPF: 64-bit IPF: 64-bit Alternate Character Sets (us-ascii, iso_xxx) Multi-Process Yes Yes Yes Yes Yes Multi-Threaded 1 request/proc 1 request/thrd No No 1 request/thrd HP-UX 10.20, 1 request/thrd HP-UX 11.x SSI/SHMTL Yes Yes Yes Yes Yes SHTML <SERVLET> tag No Yes JSP JSP JSP LDAP Netscape Directory Yes Yes No No User Server Integration authentication LDAP SDK only bundled Application Development Java Servlets Servlets 1.0.1 Servlets 2.2, PA: PA: Servlets 2.2 (JavaSoft) except WAR Servlets 2.0 Servlets 2.0 (Tomcat 3.3.1) files (JServ1.1.1), (JServ1.1.1), Servlets 2.2 Servlets 2.2 (Tomcat 3.1.1) (Tomcat 3.3.1) IPF: IPF: Servlets 2.0 Servlets 2.0 (JServ1.1.1), (JServ1.1.1), Servlets 2.2 Servlets 2.2 (Tomcat 3.2.3) (Tomcat 3.3.1) Multiple servlet contexts No Yes Yes Yes Yes Java Server Pages (JSP) JSP 0.92 JSP 1.1, JSP 1.1 JSP 1.1 JSP 1.1 JSP0.92 as (PA: Tomcat (Tomcat 3.3.1) (Tomcat 3.3.1) legacy 3.1.1, IPF: 3.2.3) JSP custom tag library Yes. Yes Yes Yes Proprietary Tomcat Tomcat Tomcat implementation JDBC JDBC 2.0 JDBC through JDBC through JDBC through Java 1.2,1.3 Java 1.2,1.3 Java 1.2,1.3 Page 95
- 96. iPlanet to HP Apache IDE for Java developers Sun’s Forte for Webgain’s Webgain’s Webgain’s Java VisualCafe VisualCafe VisualCafe Java JDK JDK 1.2 JDK 1.2 JDK 1.2,1.3 JDK 1.3 for IPF JDK 1.2,1.3 APIs for 3rd party NSAPI NSAPI Apache 1.3 API Apache 1.3 API Apache 2.0 APR API Accelerator Cache Yes NSAPI Server-Side Java Script Yes JavaScript 1.4 PA: Servlets, Servlets, Servlets, (LiveWire, LiveConnect) LiveConnect 3 PHP 4.0.4.pl1 PHP 4.2.2 PHP 4.2.2 IPF: Servlets, PHP 4.0.6 Server-Side Java applets Yes Servlets Servlets Servlets Servlets (HttpApplets) Web App Interface (WAI) Inprise Object Inprise Object Servlets Servlets Servlets (CORBA/IIOP) Request Broker Request Broker (ORB) (ORB) CGI Runs as server Runs as server Runs as server suEXEC user user user FastCGI Extensions only No No No LiveWire Native PA: mySQL mySQL through Oracle 8.1.6 and Database Connectivity connectivity to through PHP PHP 4.2.1 mySQL through Oracle, 4.0.4pl1, JDBC JDBC through PHP 4.2.1, Informix, IBM, through Java 1.2 Java 1.2 and 1.3 JDBC through DB2,Sybase, and 1.3 Java 1.2 and 1.3 JDBC IPF: mySQL through PHP 4.0.6, JDBC through Java 1.2 and 1.3 Security (SSL2/SSL3) Yes Yes mod_ssl 2.8.3, mod_ssl mod_ssl (built- Client Authentication OpenSSL 0.9.5c v.2.8.10, in), with BSAFE OpenSSL OpenSSL patch v.0.9.6g with v.0.9.6g with BSAFE patch BSAFE patch 128-bit encryption Proprietary RSA’s BSAFE RSA’s BSAFE RSA’s BSAFE security Crypto C library Crypto C library Crypto C library libraries PA: v.5.0 PA: v.5.2 PA: v.5.2 IPF: v.5.2.1 IPF: v.5.2.1 IPF: v.5.2.1 Hardware Encryption Fortezza No No No Public Key Cryptography PKCS #11 Standard .htaccess (Apache/NCSA- Yes (plug-in) Yes .htaccess .htaccess .htaccess style), .nsconfig AuthGroupFile implemented differently. Not all directives implemented. Chroot Yes Yes Yes Yes User and Group Database LDAP Directory LDAP Directory No auth_ldap 1.6 auth_ldap 1.5.4 Authorization Server Server with OpenLDAP with OpenLDAP SDK 2.0.7 SDK 2.0.7 Customized database access (Oracle) Server certificates NES 3.x iWS4.x Bundled tool Bundled tool Bundled tool certificates certificates (certmig) for iWS (certmig) for iWS (certmig) for iWS 4.x to Apache 4.x to Apache 4.x to Apache Bundled tool certificate certificate certificate Page 96
- 97. iPlanet to HP Apache for NES 3.x to migration migration migration iWS 4.x certificate No 3.x cert No 3.x cert No 3.x cert migration migration migration migration certmap.conf (map certificates Yes Yes No No No to an identity) Certification Revocation Lists Yes CRL checking Yes Yes Yes (CRL) plug-in using NSAPI Access Control Lists (ACLs) Yes Yes <File> <File> <File> <Directory> <Directory> <Directory> <Location> <Location> <Location> <Limit> <Limit> <Limit> combined with combined with combined with Allow/Deny Allow/Deny Allow/Deny Manageability Netscape server certificate 3.x certificates Bundled Bundled certmig Bundled certmig Bundled certmig migration utility migration tool for migration tool for migration tool for for 3.x 4.x certificates 4.x certificates 4.x certificates certificates Monitoring/SNMP Yes Yes No No No Web-based GUI Administration Netscape iPlanet Web Webmin 0.84 Webmin 0.980 Webmin 0.980 Server Server Manager Administrator Clustering Yes No No No Distributed Administration Administration Webmin 0.84 Webmin 0.980 Webmin 0.980 Server Automatic installation Yes Yes Yes Yes Integration with management CA/Unicenter, No No No software HP OpenView, IBM/Tivoli, TME,Sun Soltice Content Management Verity Search (full-text and Yes No No No attribute search of HTML and non-HTML docs) Multi-format collections in Yes No No No No search WebPub APIs Yes No No WebDAV (mod_dav) WebPub Applet Yes No No WebDAV client Version control and link MKS No No No No management in web publishing Agent email (MTA) Yes No No No No Notification by email of document changes Auto-catalog Yes No No No No FrontPage support No No No Performance/Scalability Failover and High Availability MC/Service No No MC/Service Guard Guard Load Balancing libresonate.sl Use built-in Use built-in Use built-in plug-in for proxy server proxy server proxy server Resonate (www.resonate. com) SSL hardware accelerator Yes No No No Page 97
- 98. iPlanet to HP Apache File Caching Yes Yes Yes Yes (mod_proxy), (mod_proxy), (mod_cache), MM lib for SSL MM v.1.2.1 shmem lib for cache shared memory SSL cache for SSL cache Enterprise Capability Proxy server iPlanet Proxy iPlanet Proxy built-in built-in built-in Server Server Note: The version numbers in the preceding table are correct for the HP Apache-based Web Servers 1.3.26.06 and 2.0.39.05. For other releases, see the HP Apache Release Notes in the documentation directory of your installation, or on the Software Depot web site: software.hp.com/ Featured Products HP Apache-based Web Server or software.hp.com/, search for "HP Apache-based Web Server" Page 98
- 99. iPlanet to HP Apache Appendix D Open Source Apache versus HP Apache-based Web Server This table shows the difference between open source Apache (ASF Apache) and the HP Apache-based Web Server based on the releases available in September 2002. Table D.1 Components & Features of Apache and HP Apache Apache 1.3 HP Apache 1.3.26 Apache 2.0 HP Apache 2.0.39 Components & Features from ASF1 PA/IPF from ASF1 PA / IPF 2 Latest HP Apache Available 1.3.26 2.0.39 on HP SW Depot (Sept. 2002) Apache Web Server 1.3.26 1.3.26 2.0.39 2.0.39 suEXEC yes yes yes IPv6** yes PA only *Auto-restart Apache, yes yes Tomcat, or Webmin *Shared Memory Caching MM v.1.2.1 yes apr_shm *Support for C++ modules yes yes *altroot.sh yes *cache_util.sh yes *ports.sh yes Security mod_ssl 2.8.10 Built-in Built-in OpenSSL 0.9.6g 0.9.6g *RSA BSAFE Crypto-C 5.2 / 5.2.1 5.2 / 5.2.1 auth_ldap 1.6 1.5.4 Stunnel 3.1.4 3.1.4 *Chroot yes yes *Certmig PA only PA only *test_certmig.sh PA only *mkcert.sh yes yes *stunnel_ctl.sh yes yes Java Tomcat Servlet Container 3.3.1 3.3.1 Apache connector to Tomcat mod_jserv, mod_jk 1.2.0 mod_jk 1.2.0 Apache JServ 1.1.1 Scripting mod_perl 1.27 1.99_03 PHP 4.2.2 4.2.2 PHP with Oracle extension yes Administration Webmin 0.980 0.980 Miscellaneous mod_dav/mod_dav_fs yes yes mod_proxy yes yes yes yes mod_define yes 1 “Apache from ASF” indicates that if you were to go to httpd.apache.org, download and build Apache yourself, these features/components would be included in the standard distribution. 2 PA-RISC binaries are 32-bit and IPF binaries are 64-bit. * Indicates HP added feature. Not available in Open Source. ** IPv6 is only available on PA-RISC 11i (11.11) with IPv6 product (T1306AA) installed and 11i Version 1.6 (11.23). Since Apache is dependent on other products such as Java and Perl, some components are not completely supported. The version numbers in the preceding table are correct for the HP Apache-based Web Server 1.3.26.05 and 2.0.39.05 releases shown. For later releases see the HP Apache Release Notes in the documentation directory, or on the Software Depot web site: software.hp.com/ Featured Products HP Apache-based Web Server or software.hp.com/, search for "HP Apache-based Web Server" Page 99