Configure and Secure Your Web Server

Now that you have installed your compiled httpd binary and the directory structure for your Web server you are ready to make a couple of directories, touch some files, and go through the configuration process necessary prior to starting your Web server for the first time.

Create Directories and Files

You still have to create at least two directories
First create a directory for server logs and call it logs
Next create your documents directory and call it htdocs
Make the directories owned by root
Now create your log files inside /usr/local/etc/httpd/logs
touch error_log access_log agent_log referer_log
chown nobody error_log access_log agent_log referer_log
Log files are owned by the user nobody for security purposes since we will make the server run under that user when we edit the configuration files.
NCSA's own documentation for editing configuration files, managing user authentication, and using server side includes on your server.

Edit Configuration Files

Now we will edit the configuration files inside the directory /usr/local/etc/httpd/conf

First we will edit the httpd.conf file. This file determines the way the server will be run. Here is an example httpd.conf file.

Edit these directives in the httpd.conf file:

ServerType
This directive sets to either standalone or inetc
Choose standalone, memory consumption is less
Port
The default is 80
Select 80 unless you have reason to do otherwise
If you are not root you will not be able to select a port below 1024
StartServer
Linux code is not currently able to take advantage of this capability
Comment out this line with a # (pound) sign
MaxServer
Linux us not able to take advantage of this feature currently
Comment out this line with a # (pound) sign
User/Group
For security purposes do not select root
Httpd starts server as root then switches to user selected here
User must be in /etc/passwd file
User nobody is appropriate choice
No need to select a group but if you do make ceratin the group is in the /etc/group file
ServerAdmin
Make this the legal email address of the Web server administrator
ErrorLog
Make this the location of the error log file
Note this file is based off the server root directory (/usr/local/etc/httpd)
logs/error_log is typical
make sure to chown file to be owned by user selected to run httpd
TransferLog
This is the location of the transfer log
Note this file is based off the server root directory (/usr/local/etc/httpd)
logs/access_log is typical
make sure to chown file to be owned by user selected to run httpd
AgentLog
This is the location of the agent log
Note this file is based off the server root directory (/usr/local/etc/httpd)
logs/agent_log is typical
make sure to chown file to be owned by user selected to run httpd
RefererLog
This is the location of the referer log
Note this file is based off the server root directory (/usr/local/etc/httpd)
logs/refer_log is typical
make sure to chown file to be owned by user selected to run httpd
RefererIgnore
List any servers you do not want to keep records of in this line
You may list servers one line at a time
PidFile
This file is the one whic carries the numerical PID of the httpd process
File is typically logs/httpd.pid
Normally there is no reason to change it
You do NOT have to create this file, the server will create it upon starting the httpd daemon if the directory exists.
ServerName
You may list aliases the server will recognize when an httpd request is received.
The name selected my be a legal name, one stored in the tables of your DNS.

Next we will edit the access.conf file. This file determines who may access the server and how. Here is an example access.conf file.

There are two ways to create access control of your Web server, one is the access.conf file and the other individual .htaccess files in individual directories. You may also set user and password controls.

Edit these Parameters
<Directory /usr/local/etc/httpd/>
Set this to your server root
Documents Root
<Directory /usr/local/etc/httpd/htdocs> will work here
Options
There are lots, this is default and it works
Options Indexes FollowSymLinks
AllowOverride
Set to AllowOverride All
Determines which options the .htaccess file may control
<Limit GET>
order allow,deny
You can set this order.
deny from fferreri.ist.csuohio.edu is an example of denying someone access to your server or directory
</Directory>
You may list individual directories to control at this point

Next we will edit the srm.conf file. This file configures the server's data structure, aliases, and related items. Here is an example srm.conf file.

Here are the parameters of the srm.conf file which you must accept or change by editing.
DocumentRoot
/usr/local/etc/httpd/htdocs is the default
I recommend using this default under normal circumstances
UserDir
This is the directory which your users will be able to use to publish their own Home Page with a ~user request to the Server.
public_html is the default
Some use www
FancyIndexing
Set to on if you desire fancy indexing in your Web documents
AddIcon
This directive tells the server which icon to show for different files or filename extensions
Default Icon
based on the server root this file is the icon returned by the server on when there is no explicitly set icon
an example is: /icons/unknown.xbm
ReadmeName
Sets the name of the README file used
HeaderName
sets the name of the file used for indexes
IndexIgnore
Allows the Web administrator to set patterns of files which are ignored for indexing purposes
AccessFileName
Use this directive to set the name of the file which controls access per directory.
The default is .htaccess, but you must include it for it to function properly
DefaultType
If the server cannot find a MIME type in your MIME file the server will treat the document as the value included here
text/plain is the default value
AddType
Permits the administrator to tweak mime.types without editing the file itself.
AddEncoding
Allows the administrator to set certain browsers like Netscape and Mosaic to uncompress certain kinds of files on-the-fly
Example: AddEncoding x-gzip gz
Redirect
Is used when you move information off your server and you wish to leave a reference to the new location
Example: Redirect /cali94/index.htmld/ http://www.movedto.edu/cali94/index.htmld.
Aliases
Add up to twenty (20) aliases here
Uses the pattern Alias fakename realname
Example: Alias /icons/ /usr/local/etc/httpd/icons/
Allows you to use directories outside the normal DocumentRoot
ScriptAlias
The ScriptAlias allows the admin to create aliases for the Script directories, just like a normal Alias
Example: /cgi-bin/ /usr/local/etc/httpd/cgi-bin/
Server includes can be enabled if you uncomment these lines:
AddType text/x-server-parsed-html .shtml
AddType application/x-httpd-cgi .cgi
Normally one does not have to edit the mime.types file, at least not immediately. Here is an example mime.types file for your perusal.
Review (Double Check) Your Work

  • Now that you have edited the files and set the stage to actually start the server do the following:
  • Move the actual data to your DocumentRoot, /usr/local/etc/httpd/htdocs
  • Make sure you chmod the files to an appropriate value, such as 644
  • Keep documents file ownershp restricted to root for security purposes
  • Make sure the log files are chowned to nobody or the user you employ
  • Make sure the httpd binary is flagged executable
  • 755 is a good value to select
  • Proceed to Server StartUp!

    Go To: [MAIN] [ACQUIRE] [PREPARE] [CONFIG] [START] [LINKS]

    Rosenfeld.1@nd.edu