More than one site? Use multiple configuration files Use multiple configuration files  httpd –d {path}  Assumes “conf/httpd.conf” Logging transactions Logging transactions  TransferLog “logs/access_log”  Must tell apache to do logging

ErrorDocument Directive Allows you to provide your own custom error pages Allows you to provide your own custom error pages Syntax: Syntax:  ErrorDocument {error-code} {document}

4 Possible Ways to Handle Errors Apache can be configured to: Apache can be configured to:  Output a simple hardcoded error message  Output a customized message  Redirect to a local URL to handle error  Redirect to an external URL to handle error

ErrorDocument Examples ErrorDocument ErrorDocument ErrorDocument 404 /cgi-bin/bad_link.cgi ErrorDocument 404 /cgi-bin/bad_link.cgi ErrorDocument 401 /error_401.html ErrorDocument 401 /error_401.html ErrorDocument 403 “Sorry – you can’t do that” ErrorDocument 403 “Sorry – you can’t do that”

Block Directives and and

Other Directives ServerName hostname ServerName hostname UseCanonicalName on/off UseCanonicalName on/off ServerAdmin _address ServerAdmin _address ServerRoot directory ServerRoot directory PidFile file PidFile file KeepAlive number KeepAlive number

Other Directives (continued) KeepAliveTimeout seconds KeepAliveTimeout seconds HostNameLookups on/off/double HostNameLookups on/off/double Include filename Include filename

Options Directive Syntax: Syntax:  Options option option …  Default: ALL All All  All options are enabled ExecCGI ExecCGI  Execution of CGI scripts is permitted

Options Directives (continued) Includes Includes  Server-side includes permitted Indexes Indexes  Option allows ways to handle requests if no index.html is located MultiViews MultiViews  Supports AddLanguage and image neg.

Options Examples Arguments are preceded with “+” or “-” Arguments are preceded with “+” or “-” i.e. Options +ExecCGI i.e. Options +ExecCGI If you don’t use + or – than strange things can happen so ALWAYS be explicit If you don’t use + or – than strange things can happen so ALWAYS be explicit Options override previous ones if you’re not explicit with what you want to happen Options override previous ones if you’re not explicit with what you want to happen Web servers ASSUME you know what you’re doing (?) Web servers ASSUME you know what you’re doing (?)

Restarting your server Stop: Kill pid# Stop: Kill pid# Start: httpd –flags Start: httpd –flags or use apachectl or use apachectl Problem with this is loss of service Problem with this is loss of service Alternative to restarting your server Alternative to restarting your server .htaccess file

.htaccess file Text file stored in the htdocs directory Text file stored in the htdocs directory File is read at each access (problems) File is read at each access (problems) Advantages: Advantages:  Very Flexible  Don’t have to stop/start the server AllowOverride directive allows webmaster AllowOverride directive allows webmaster to control user

Common Gateway Interface (CGI) Remember the whole purpose of your web server is to accept requests and return a file Remember the whole purpose of your web server is to accept requests and return a file  Can be a static text file or generated by another executable program Important portion of a request is METHOD Important portion of a request is METHOD  Tells the server how to handle the incoming data

HTTP Methods GET – returns the data asked for GET – returns the data asked for HEAD – returns the headers a GET would have but without the data HEAD – returns the headers a GET would have but without the data POST – tells the server to accept data and do something with it using the CGI POST – tells the server to accept data and do something with it using the CGI PUT – tells the server to store the data PUT – tells the server to store the data

HTTP Methods (continued) DELETE – tells the server to delete the data DELETE – tells the server to delete the data TRACE – tells the server to return a diagnostic of the actions taken TRACE – tells the server to return a diagnostic of the actions taken CONNECT – used to ask a proxy to make a connection to another host and relay the content rather than parse or cache it. (used to work around SSL connections) CONNECT – used to ask a proxy to make a connection to another host and relay the content rather than parse or cache it. (used to work around SSL connections)

Using a FORM

Writing and Executing Scripts Use ScriptAlias in httpd.conf to point to the location of your executable programs Use ScriptAlias in httpd.conf to point to the location of your executable programs Remember your OS must believe it’s an executable program Remember your OS must believe it’s an executable program  In UNIX this means permissions CGI script consists must generate all the expects HTTP info (header and body) CGI script consists must generate all the expects HTTP info (header and body) Header is separated from body by blank line Header is separated from body by blank line

Writing and Executing Scripts AddHandler method AddHandler method  AddHandler cgi-script cgi Means if the server comes across a document with the extension.cgi it wil be taken to be an executable script Means if the server comes across a document with the extension.cgi it wil be taken to be an executable script Not a good method in practice unless you trust your users and developers Not a good method in practice unless you trust your users and developers

Script Directives ScriptAlias urlpath directory ScriptAlias urlpath directory ScriptAliasMatch regex directory ScriptAliasMatch regex directory ScriptLog filename ScriptLog filename ScriptLogLength # of bytes ScriptLogLength # of bytes ScriptLogBuffer # of bytes ScriptLogBuffer # of bytes

Unix specific Script Directives RlimitCPU # or max, # or max RlimitCPU # or max, # or max  CPU Cycles: Soft limit, hard limit RLimitMEM # or max, # or max RLimitMEM # or max, # or max  Bytes of Memory: Soft, hard limit RLimitNROC #or max, # or max RLimitNROC #or max, # or max  # of Processes per user limits

Wrappers for Scripts Scripts present a security risk if not constructed properly and carefully Scripts present a security risk if not constructed properly and carefully On Unix a “wrapper” is used to encase the script and protect the rest of the system On Unix a “wrapper” is used to encase the script and protect the rest of the system Unix uses suEXEC which changes the permissions given to an executable program Unix uses suEXEC which changes the permissions given to an executable program

Handlers Performs certain actions when a file with a particular MIME or handler type is called Performs certain actions when a file with a particular MIME or handler type is called send-as-is : sends the file with headers send-as-is : sends the file with headers cgi-script : executes the file cgi-script : executes the file imap-file : uses the file as an imagemap imap-file : uses the file as an imagemap server-parsed : parses server-side includes server-parsed : parses server-side includes AddHandler cgi-script cgi pl AddHandler cgi-script cgi pl