Apache

Local

• 403 Forbidden
• Aliases
• cgi from windows .bat files
• Command Line
• Configuring a New Install
• Default Initial Page
• Directory Access
• Directory Browsing
• Log Piping
• Log Rotating
• Modules
• Password Protecting a Directory
• Redirecting
• Redirecting based on Hostname to a Path
• Redirecting page requests with ip address in the URL to a Domain in the URL
• Removing a file and making it known
• SEARCH, filtering this out of the access log
• Setup to a simple config
• Virtual Host (serve different pages based on address)

External

• Installer (Apache, mysql, perl and more) http://www.apachefriends.org/en/xampp.html
• Official site http://httpd.apache.org
• Quick reference card http://refcards.com/refcards/index.html
• Tutorials (official site) http://httpd.apache.org/docs-2.0/misc/tutorials.html

Setup to a simple config

• Get the binary windows distribution and install it taking defaults
• Change the web root directory. Change the value of DocumentRoot to whatever you want it to be
  (example: DocumentRoot "X:/webroot")

403 Forbidden

• Make sure the file has the proper permissions to be looked at by Apache

Configuring a New Install

1. Run the windows installer and take the defaults, except set the name of the server
2. Disable directory listing see: Directory Access

Removing a file and making it known

This uses mod_alias

Use the command Redirect gone path-from-top-of-website

Example: Redirect gone /notes/everquest.html

Redirecting based on Hostname to a Path

From http://www.onlamp.com/pub/a/apache/2003/12/23/apache_ckbk.html

Support virutal hosts by remapping a the hostname to a directory.

Use mod_rewrite

RewriteEngine on
RewriteCond   %{HTTP_HOST}     ^(www\.)?([^.]+)\.com$
RewriteRule   ^(.*)$   /home/%2$1

Directory Access

Note: There must be no spaces between the allow deny and the comma

• Best Practice is to lock out every thing from the root down, and then just unlock whatever you need
• Directory settings are recursive into child directories
• More specific Directory settings override parent directory settings

Example settings

<Directory />
	Order deny,allow
	deny from all
#the following line disables getting directory listings:
	Options -Indexes
</Directory>

<Directory /usr/local/apache/vhosts/cousineddie>
	Order allow,deny
	Allow from all
</Directory>

Modules

Log Piping

Redirecting page requests with ip address in the URL to a Domain in the URL

<virtualhost *:80>
        ServerName 66.56.82.97
        RedirectMatch permanent (.*) http://www.exogenesis.org$1
</virtualhost>

SEARCH, filtering this out of the access log

From the best I can tell, this is some sort of attack on IIS
SEARCH /\x90\x02\xb1\x02...
It is a very long line and mucks up looking at the access.log. Here is how to keep it out of the log:

This works, but limits logging to only GETs and POSTs

Log Rotating

Here is how to turn on automatic log rotating. (add the following to httpd.conf)

TransferLog usage

rotatelogs usage

rotatelogs is part of the Apache distrobution

Example

Redirecting

• Redirecting page requests with ip address in the URL to a Domain in the URL

RedirectPermanent

Redirect

I have a friends domain pointing to my server, but his web pages are stored at an ISP. I figured out how to get his URL to load his page at the ISP. I added the following to my httpd.conf file:

(Note that there is no file with the name tigerofdoom.html on my server)

<VirtualHost *:80>
        DocumentRoot "C:/Program Files/Apache Group/Apache2/htdocs"
        ServerName www.tigerofdoom.com
        DirectoryIndex /tigerofdoom.html
</VirtualHost>

Redirect /tigerofdoom.html http://home.comcast.net/~tigerofdoom/

Password Protecting a Directory

1. Make a password file using Apache's htpasswd.exe (find it in the Apache/bin directory)
2. Put it where ever you want it, but not in the htdocs path (big security risk if you do)
3. Add something like the following to the httpd.conf file

Note: You can do this at the end of the conf file and have it work for all virtual hosted websites

Virtual Host (serve different pages based on address)

Note: If you use VirtualHosts, then there is _NO_ main default host. All hosting is done through VirtualHosts, so you must make your default settings occur in a VirtualHost block.

1. The first VirtualHost block is the default block that gets used if a match does not happen with any of the VirtualHost blocks.
2. Turn on Virtual host ability NameVirtualHost *:80
   You can optionally use an IP address (useful if machine has multiple IP address) and you can specify another port if you want to
3. Add VirtualHost blocks. Make sure the argument to VirtualHost matches the value of NameVirtualHost.
4. See example below:

Default Initial Page

To change it: DirectoryIndex newDefaultPage.html

You can also add alternate defaults by appending more values:
DirectoryIndex index.html index.php

Command Line

Usage: apache [-D name] [-d directory] [-f file] [-n service]
              [-C "directive"] [-c "directive"] [-k signal]
              [-v] [-V] [-h] [-l] [-L] [-S] [-t] [-T]
              
  -D name          : define a name for use in  directives
  -d directory     : specify an alternate initial ServerRoot
  -f file          : specify an alternate ServerConfigFile
  -C "directive"   : process directive before reading config files
  -c "directive"   : process directive after  reading config files
  -v               : show version number
  -V               : show compile settings
  -h               : list available command line options (this page)
  -l               : list compiled-in modules
  -L               : list available configuration directives
  -S               : show parsed settings (currently only vhost settings)
  -t               : run syntax check for config files (with docroot check)
  -T               : run syntax check for config files (without docroot check)
  -n name          : name the Apache service for -k options below;
  -k stop|shutdown : tell running Apache to shutdown
  -k restart       : tell running Apache to do a graceful restart
  -k start         : tell Apache to start
  -k install   | -i: install an Apache service
  -k config        : reconfigure an installed Apache service
  -k uninstall | -u: uninstall an Apache service

cgi from windows .bat files

@echo off
echo "content-type: text/plain"
echo.
echo "Have a nice day"

NOTE: The trick is that echo. prints just a carrage return

Dumb IE problem

IE will sometimes think you are trying to download instead of running a .bat file here is a trick to make it not try that. Tack a path onto the end of the URL like this http://localhost/cgi-bin/test.bat/fakepath this passes fakepath as the environment setting PATH_INFO to the bat file

Directory Browsing

You set or disable this in a <directory> block, the Indexes command is cases sensitive.

Note: place this at the end of httpd.conf to make it work right. I need to figure out where the highest place it can go is.

#too allow browsing
<directory "C:/Program Files/Apache Group/Apache2/htdocs">
	Options +Indexes
</directory>

#to disallow browsing
<directory "C:/Program Files/Apache Group/Apache2/htdocs">
	Options -Indexes
</directory>

Aliases

Used to map arbitraray directorys on the system to specific URLS. Put something like the following in the httpd.conf file.