Httpd RHEL Compilation: Difference between revisions

From NovaOrdis Knowledge Base
Jump to navigation Jump to search
No edit summary
 
(31 intermediate revisions by the same user not shown)
Line 8: Line 8:
=Overview=
=Overview=


This is the Apache httpd compilation/installation procedure. It implies that httpd is compiled from source. If you plan to install httpd with yum, go directly to [[#yum_Installation|yum installation]].
This is the Apache httpd compilation/installation procedure. It implies that httpd is compiled from source. If you plan to install httpd with yum, go directly to [[Httpd_Installation#Installation|yum installation]]. The procedure was tested on RHEL and Mac. If you compile on Mac, make sure to follow the advice from "[[httpd Compilation on Mac|Compilation on Mac]]" section, below.


=Procedure=
=Download=
 
==Download==


Download from http://httpd.apache.org/download.cgi and optionally place in the local <tt>archive</tt> directory.
Download from http://httpd.apache.org/download.cgi and optionally place in the local <tt>archive</tt> directory.


<pre>
<pre>
wget http://mirror.cogentco.com/pub/apache//httpd/httpd-2.4.25.tar.gz
wget http://mirror.cogentco.com/pub/apache//httpd/httpd-2.2.17.tar.gz
</pre>
</pre>


Older releases may not be on mirrors, but they can be downloaded directly from the apache web site: http://archive.apache.org/dist/httpd.
Older releases may not be on mirrors, but they can be downloaded directly from the apache web site: http://archive.apache.org/dist/httpd.


==Extract==
=Extract=


The sources can be extracted as a non-root user.
The sources can be extracted as a non-root user.
Line 31: Line 29:
</pre>
</pre>


==Configure Compilation==
=Configure Compilation=


* http://httpd.apache.org/docs/current/programs/configure.html
{{External|http://httpd.apache.org/docs/current/programs/configure.html}}


Compilation can be configured as a non-root user.
Compilation can be configured as a non-root user.
Line 46: Line 44:
</pre>
</pre>


===Compilation Configuration Notes===
==Compilation Configuration Notes==
 
===Shared Modules Option===
 
It is a good idea to compile httpd with shared module option enabled and load them dynamically as needed. For that, the Dynamic Shared Object (DSO) capability must be enabled at compilation, with:
 
<pre>
--enable-so
</pre>
 
For more details on Dynamic Shared Object (DSO) capability, see {{Internal|Httpd_Modules#Static_Modules_vs_Dynamic_Modules|Static Modules vs. Dynamic Modules}}


* It is a good idea to compile httpd with shared module option enabled (<tt>--enable-so --enable-expires=shared</tt>).
===APR===
* <tt>configure</tt> may complain about not finding APR. I worked around this by using <tt>--with-included-apr</tt> in configure configuration.
 
<tt>configure</tt> may complain about not finding APR. I worked around this by using <tt>--with-included-apr</tt> in configure configuration.


===SSL Compilation===
===SSL Compilation===
Line 69: Line 78:
</pre>
</pre>


===Various Module Configuration Requirements===
==Compilation on Mac==
 
{{Internal|httpd Compilation on Mac|Compilation on Mac}}
 
==Various Module Configuration Requirements==


<blockquote style="background-color: #f9f9f9; border: solid thin lightgrey;">
<blockquote style="background-color: #f9f9f9; border: solid thin lightgrey;">
* [[Httpd_worker_MPM#Compilation|worker MPM Compilation]]
: <br>
* [[httpd mod_proxy Compilation|mod_proxy Compilation]]
: <span id="worker_mpm_compilation">[[httpd worker MPM Compilation|worker MPM Compilation]]</span>
* [[Httpd mod proxy ajp Compilation|mod_proxy_ajp Compilation]]
: [[httpd mod_expires#Compilation|mod_expires Compilation]]
: [[httpd mod_proxy Compilation|mod_proxy Compilation]]
: [[Httpd mod proxy ajp Compilation|mod_proxy_ajp Compilation]]
: <br>
</blockquote>
</blockquote>


===Cleaning configuration===
==Cleaning configuration==


The only option I discovered so far is to completely remove the source tree. I am sure others exist ... if I find them, add them here.
The only option I discovered so far is to completely remove the source tree. I am sure others exist ... if I find them, add them here.


===Configuration Examples===
==Configuration Examples==


====Example 1====
===Example 1===


Version 2.2.15
Version 2.2.15
Line 108: Line 124:
We disabled mod_proxy so we can use the version included in mod_cluster.   
We disabled mod_proxy so we can use the version included in mod_cluster.   


====Example 2====
===Example 2===


We use mod_proxy:
We use mod_proxy:
Line 121: Line 137:
  --enable-expires=shared \
  --enable-expires=shared \
  --with-mpm=worker \
  --with-mpm=worker \
  --enable-proxy \
  --enable-proxy=shared \
  --enable-proxy-connect \
  --enable-proxy-connect=shared \
  --enable-proxy-http \
  --enable-proxy-http=shared \
  --enable-proxy-ajp \
  --enable-proxy-ajp=shared \
  --enable-proxy-balancer \
  --enable-proxy-balancer=shared \
  --disable-cgi \
  --disable-cgi \
  --enable-ssl \
  --enable-ssl \
Line 131: Line 147:
</pre>
</pre>


==mod_cluster Recommended Configuration==
=mod_cluster Recommended Configuration=


1. Apply http://anonsvn.jboss.org/repos/mod_cluster/trunk/native/mod_proxy_cluster/mod_proxy_ajp.patch (optional).
1. Apply http://anonsvn.jboss.org/repos/mod_cluster/trunk/native/mod_proxy_cluster/mod_proxy_ajp.patch (optional).
Line 144: Line 160:
   --with-expat=builtin \
   --with-expat=builtin \
   --enable-ssl \
   --enable-ssl \
   --enable-proxy \
   --enable-proxy=shared \
   --enable-proxy-http \
   --enable-proxy-http=shared \
   --enable-proxy-ajp \
   --enable-proxy-ajp=shared \
   --disable-proxy-balancer \
   --disable-proxy-balancer=shared \
   --enable-so  
   --enable-so  
</pre>
</pre>


==Compile==
=Compile=


Can be built as a non-root user.
Can be built as a non-root user.


<pre>
<pre>
./make
make
</pre>
</pre>


==Install==
=Install=


Can be installed as a non-root user, as long as the user has write access to the target directory.
Can be installed as a non-root user, as long as the user has write access to the target directory.


For more details on how to create the operational account, jump ahead to "[[#Create_the_Operational_Account|Create the Operational Account]]" section and then come back here.
For more details on how to create the operational account, jump ahead to "[[Httpd_Installation#Create_the_Operational_Account|Create the Operational Account]]" section and then come back here.


<pre>
<pre>
./make install
make install
</pre>
</pre>
==yum Installation==
Alternatively to download and compilation, install with yum:
<pre>
yum install httpd
</pre>
==Create the Operational Account==
!!httpd installed with yum
If httpd is installed with yum, the installation script usually creates a user ("apache"). If yes, use that user. The default behavior is for the httpd to start as a root (via /etc/init.d/httpd) and then switch to the Unix user declared as in /etc/httpd/conf/httpd.conf as "User" and "Group".
!!httpd installed from scratch
Otherwise, if httpd is compiled from scratch, for security reasons, it's best if httpd is operated by its own Unix user and group, with as little permissions as possible.
{{{
groupadd -g 101 httpd
useradd -c "httpd operational user" -d /home/httpd -g httpd -m -u 101 httpd
}}}
!!!8. Set Standard Environment
!!httpd installed with yum
Configuration directory: {{/etc/httpd/conf}} and {{/etc/httpd/conf.d}}.
The module directory: {{/usr/lib/httpd/modules}} (linked from {{/etc/httpd}})
The run directory: {{/var/run/httpd}} (linked from {{/etc/httpd}})
The log directory: {{/var/log/httpd}} (linked from {{/etc/httpd}})
When installed with yum, httpd is designed to be operated by root, and switch to "apache" at runtime, so add the following aliases to ~root/.bashrc:
{{{
...
alias cda='cd /etc/httpd'
alias cdac='cd /etc/httpd/conf'
alias cdal='cd /var/log/httpd'
alias cdar='cd /var/run/httpd'
...
}}}
!!httpd installed from scratch
In {{~&lt;httpd-user&gt;/.bashrc}}:
{{{
...
APACHE_HOME=/home/webr/httpd-2.2.17
PATH=${PATH}:${APACHE_HOME}/bin
export PATH APACHE_HOME
alias cda='cd ${APACHE_HOME}'
alias cdal='cd ${APACHE_HOME}/logs'
alias cdac='cd ${APACHE_HOME}/conf'
...
}}}
!!!9. Create Start/Stop Scripts
!!httpd installed with yum
If httpd installed with yum, the startup scripts is already created ({{/etc/init.d/httpd}}). Use it.
!!httpd installed from scratch
<font color=red>
Otherwise, create a similar one.
</font>
This also works:
{{{
    $APACHE_HOME/bin/apachectl start
    $APACHE_HOME/bin/apachectl stop
}}}
!!!10. Start at Boot
{{{
    chkconfig --level 2345 httpd on
}}}
!!!11. Configure iptables
{{{
iptables-save > /tmp/iptables.cfg
}}}
Add the following:
{{{
-A INPUT -p tcp -m state --state NEW --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT
}}}
right under the:
{{{
-A INPUT -m state --state ESTABLISHED -j ACCEPT
}}}
line. Then:
{{{
iptables-restore < /tmp/iptables.cfg
iptables-save > /etc/sysconfig/iptables
}}}
If planning to only run the SSL version, do not add the port 80 line.
!!!12. Reboot and make sure the server can be accessed
!!!13. Configure
Modify {{${APACHE_HOME}/conf/httpd.conf}}. See:
|[httpd Configuration]

Latest revision as of 19:51, 5 January 2017

External

Internal

Overview

This is the Apache httpd compilation/installation procedure. It implies that httpd is compiled from source. If you plan to install httpd with yum, go directly to yum installation. The procedure was tested on RHEL and Mac. If you compile on Mac, make sure to follow the advice from "Compilation on Mac" section, below.

Download

Download from http://httpd.apache.org/download.cgi and optionally place in the local archive directory. 

wget http://mirror.cogentco.com/pub/apache//httpd/httpd-2.2.17.tar.gz

Older releases may not be on mirrors, but they can be downloaded directly from the apache web site: http://archive.apache.org/dist/httpd.

Extract

The sources can be extracted as a non-root user. 

cd src
gunzip < ../archive/httpd-2.2.17.tar.gz | tar xfv -

Configure Compilation

http://httpd.apache.org/docs/current/programs/configure.html

Compilation can be configured as a non-root user. 

cd httpd-2.2.17
./configure \
  --prefix /opt/httpd-2.2.17[-worker] \
  --enable-so \
  --enable-expires=shared \
  --with-included-apr

Compilation Configuration Notes

Shared Modules Option

It is a good idea to compile httpd with shared module option enabled and load them dynamically as needed. For that, the Dynamic Shared Object (DSO) capability must be enabled at compilation, with: 

--enable-so

For more details on Dynamic Shared Object (DSO) capability, see

Static Modules vs. Dynamic Modules

APR

configure may complain about not finding APR. I worked around this by using --with-included-apr in configure configuration.

SSL Compilation

If you need SSL, compile the latest OpenSSL (see [OpenSSL#Compilation]) and then 

...
--enable-ssl 
--with-ssl=/data/openssl-1.0.2/
...

If you use SSL, when running httpd, you need to set LD_LIBRARY_PATH to point to the OpenSSL lib directory: 

LD_LIBRARY_PATH="/data/openssl-1.0.2/lib:${LD_LIBRARY_PATH}"
export LD_LIBRARY_PATH

Compilation on Mac

Compilation on Mac

Various Module Configuration Requirements


worker MPM Compilation
mod_expires Compilation
mod_proxy Compilation
mod_proxy_ajp Compilation

Cleaning configuration

The only option I discovered so far is to completely remove the source tree. I am sure others exist ... if I find them, add them here.

Configuration Examples

Example 1

Version 2.2.15 

./configure --prefix=/cust/soe/opt/apache/2.2.15_without_mod_proxy 
            --enable-logio 
            --disable-proxy 
            --enable-rewrite 
            --enable-ssl 
            --enable-vhost-alias 
            --enable-headers 
            --enable-dav 
            --enable-dav-fs 
            --enable-modules=ssl 
            --with-ssl=/cust/soe/opt/openssl/1.0.0/ 
            --with-included-apr 
            --enable-dav-lock 
            --enable-deflate 
            --enable-so 
            --with-mpm=worker

We disabled mod_proxy so we can use the version included in mod_cluster.

Example 2

We use mod_proxy: 

#!/bin/bash

$(dirname $0)/configure \
 --prefix /data/httpd-2.2.29-worker-mpm \
 --enable-so \
 --with-included-apr \
 --enable-expires=shared \
 --with-mpm=worker \
 --enable-proxy=shared \
 --enable-proxy-connect=shared \
 --enable-proxy-http=shared \
 --enable-proxy-ajp=shared \
 --enable-proxy-balancer=shared \
 --disable-cgi \
 --enable-ssl \
 --with-ssl=/data/openssl-1.0.2

mod_cluster Recommended Configuration

1. Apply http://anonsvn.jboss.org/repos/mod_cluster/trunk/native/mod_proxy_cluster/mod_proxy_ajp.patch (optional).

2. Configure: 

./configure  --prefix=apache_installation_directory \
  --with-mpm=worker \
  --enable-mods-shared=most \
  --enable-maintainer-mode \
  --with-expat=builtin \
  --enable-ssl \
  --enable-proxy=shared \
  --enable-proxy-http=shared \
  --enable-proxy-ajp=shared \
  --disable-proxy-balancer=shared \
  --enable-so

Compile

Can be built as a non-root user. 

make

Install

Can be installed as a non-root user, as long as the user has write access to the target directory.

For more details on how to create the operational account, jump ahead to "Create the Operational Account" section and then come back here. 

make install
Retrieved from "https://kb.novaordis.com/index.php?title=Httpd_RHEL_Compilation&oldid=15723"