Httpd RHEL Compilation: Difference between revisions

From NovaOrdis Knowledge Base
Jump to navigation Jump to search
No edit summary
 
(23 intermediate revisions by the same user not shown)
Line 8: Line 8:
=Overview=
=Overview=


This is the Apache httpd compilation/installation procedure. It implies that httpd is compiled from source. If you plan to install httpd with yum, go directly to [[#yum_Installation|yum installation]].
This is the Apache httpd compilation/installation procedure. It implies that httpd is compiled from source. If you plan to install httpd with yum, go directly to [[Httpd_Installation#Installation|yum installation]]. The procedure was tested on RHEL and Mac. If you compile on Mac, make sure to follow the advice from "[[httpd Compilation on Mac|Compilation on Mac]]" section, below.


=Procedure=
=Download=
 
==Download==


Download from http://httpd.apache.org/download.cgi and optionally place in the local <tt>archive</tt> directory.
Download from http://httpd.apache.org/download.cgi and optionally place in the local <tt>archive</tt> directory.


<pre>
<pre>
wget http://mirror.cogentco.com/pub/apache//httpd/httpd-2.4.25.tar.gz
wget http://mirror.cogentco.com/pub/apache//httpd/httpd-2.2.17.tar.gz
</pre>
</pre>


Older releases may not be on mirrors, but they can be downloaded directly from the apache web site: http://archive.apache.org/dist/httpd.
Older releases may not be on mirrors, but they can be downloaded directly from the apache web site: http://archive.apache.org/dist/httpd.


==Extract==
=Extract=


The sources can be extracted as a non-root user.
The sources can be extracted as a non-root user.
Line 31: Line 29:
</pre>
</pre>


==Configure Compilation==
=Configure Compilation=


* http://httpd.apache.org/docs/current/programs/configure.html
{{External|http://httpd.apache.org/docs/current/programs/configure.html}}


Compilation can be configured as a non-root user.
Compilation can be configured as a non-root user.
Line 46: Line 44:
</pre>
</pre>


===Compilation Configuration Notes===
==Compilation Configuration Notes==
 
===Shared Modules Option===
 
It is a good idea to compile httpd with shared module option enabled and load them dynamically as needed. For that, the Dynamic Shared Object (DSO) capability must be enabled at compilation, with:
 
<pre>
--enable-so
</pre>


* It is a good idea to compile httpd with shared module option enabled (<tt>--enable-so --enable-expires=shared</tt>).
For more details on Dynamic Shared Object (DSO) capability, see {{Internal|Httpd_Modules#Static_Modules_vs_Dynamic_Modules|Static Modules vs. Dynamic Modules}}
* <tt>configure</tt> may complain about not finding APR. I worked around this by using <tt>--with-included-apr</tt> in configure configuration.


===Various Module Configuration Requirements===
===APR===


<blockquote style="background-color: #f9f9f9; border: solid thin lightgrey;">
<tt>configure</tt> may complain about not finding APR. I worked around this by using <tt>--with-included-apr</tt> in configure configuration.
: <br>
: [[Httpd_worker_MPM#Compilation|worker MPM Compilation]]
: [[httpd mod_proxy Compilation|mod_proxy Compilation]]
: [[Httpd mod proxy ajp Compilation|mod_proxy_ajp Compilation]]
: <br>
</blockquote>


===SSL Compilation===
===SSL Compilation===
Line 79: Line 78:
</pre>
</pre>


===Cleaning configuration===
==Compilation on Mac==
 
{{Internal|httpd Compilation on Mac|Compilation on Mac}}
 
==Various Module Configuration Requirements==
 
<blockquote style="background-color: #f9f9f9; border: solid thin lightgrey;">
: <br>
: <span id="worker_mpm_compilation">[[httpd worker MPM Compilation|worker MPM Compilation]]</span>
: [[httpd mod_expires#Compilation|mod_expires Compilation]]
: [[httpd mod_proxy Compilation|mod_proxy Compilation]]
: [[Httpd mod proxy ajp Compilation|mod_proxy_ajp Compilation]]
: <br>
</blockquote>
 
==Cleaning configuration==


The only option I discovered so far is to completely remove the source tree. I am sure others exist ... if I find them, add them here.
The only option I discovered so far is to completely remove the source tree. I am sure others exist ... if I find them, add them here.


===Configuration Examples===
==Configuration Examples==


====Example 1====
===Example 1===


Version 2.2.15
Version 2.2.15
Line 110: Line 124:
We disabled mod_proxy so we can use the version included in mod_cluster.   
We disabled mod_proxy so we can use the version included in mod_cluster.   


====Example 2====
===Example 2===


We use mod_proxy:
We use mod_proxy:
Line 123: Line 137:
  --enable-expires=shared \
  --enable-expires=shared \
  --with-mpm=worker \
  --with-mpm=worker \
  --enable-proxy \
  --enable-proxy=shared \
  --enable-proxy-connect \
  --enable-proxy-connect=shared \
  --enable-proxy-http \
  --enable-proxy-http=shared \
  --enable-proxy-ajp \
  --enable-proxy-ajp=shared \
  --enable-proxy-balancer \
  --enable-proxy-balancer=shared \
  --disable-cgi \
  --disable-cgi \
  --enable-ssl \
  --enable-ssl \
Line 133: Line 147:
</pre>
</pre>


==mod_cluster Recommended Configuration==
=mod_cluster Recommended Configuration=


1. Apply http://anonsvn.jboss.org/repos/mod_cluster/trunk/native/mod_proxy_cluster/mod_proxy_ajp.patch (optional).
1. Apply http://anonsvn.jboss.org/repos/mod_cluster/trunk/native/mod_proxy_cluster/mod_proxy_ajp.patch (optional).
Line 146: Line 160:
   --with-expat=builtin \
   --with-expat=builtin \
   --enable-ssl \
   --enable-ssl \
   --enable-proxy \
   --enable-proxy=shared \
   --enable-proxy-http \
   --enable-proxy-http=shared \
   --enable-proxy-ajp \
   --enable-proxy-ajp=shared \
   --disable-proxy-balancer \
   --disable-proxy-balancer=shared \
   --enable-so  
   --enable-so  
</pre>
</pre>


==Compile==
=Compile=


Can be built as a non-root user.
Can be built as a non-root user.


<pre>
<pre>
./make
make
</pre>
</pre>


==Install==
=Install=


Can be installed as a non-root user, as long as the user has write access to the target directory.
Can be installed as a non-root user, as long as the user has write access to the target directory.


For more details on how to create the operational account, jump ahead to "[[#Create_the_Operational_Account|Create the Operational Account]]" section and then come back here.
For more details on how to create the operational account, jump ahead to "[[Httpd_Installation#Create_the_Operational_Account|Create the Operational Account]]" section and then come back here.
 
<pre>
./make install
</pre>
 
==yum Installation==
 
Alternatively to download and compilation, install with yum:
 
<pre>
yum install httpd
</pre>
 
==Create the Operational Account==
 
===httpd installed with yum===
 
If httpd is installed with yum, the installation script usually creates a user ("apache"). If yes, use that user. The default behavior is for the httpd to start as a root (via /etc/init.d/httpd) and then switch to the Unix user declared as in /etc/httpd/conf/httpd.conf as "User" and "Group".
 
===httpd installed from scratch===
 
Otherwise, if httpd is compiled from scratch, for security reasons, it's best if httpd is operated by its own Unix user and group, with as little permissions as possible.
 
<pre>
groupadd -g 101 httpd
useradd -c "httpd operational user" -d /home/httpd -g httpd -m -u 101 httpd
</pre>
 
==Set Standard Environment==
 
===httpd installed with yum===
 
Configuration directory: <tt>/etc/httpd/conf</tt> and <tt>/etc/httpd/conf.d</tt>.
 
The module directory: <tt>/usr/lib/httpd/modules</tt> (linked from <tt>/etc/httpd</tt>)
 
The run directory: <tt>/var/run/httpd</tt> (linked from <tt>/etc/httpd</tt>)
 
The log directory: <tt>/var/log/httpd</tt> (linked from <tt>/etc/httpd</tt>)
 
When installed with yum, httpd is designed to be operated by root, and switch to "apache" at runtime, so add the following aliases to ~root/.bashrc:
 
<pre>
...
alias cda='cd /etc/httpd'
alias cdac='cd /etc/httpd/conf'
alias cdal='cd /var/log/httpd'
alias cdar='cd /var/run/httpd'
...
</pre>
 
===httpd installed from scratch===
 
In <httpd-user>/.bashrc:


<pre>
<pre>
...
make install
APACHE_HOME=/home/webr/httpd-2.2.17
PATH=${PATH}:${APACHE_HOME}/bin
export PATH APACHE_HOME
alias cda='cd ${APACHE_HOME}'
alias cdal='cd ${APACHE_HOME}/logs'
alias cdac='cd ${APACHE_HOME}/conf'
...
</pre>
</pre>
==Create Start/Stop Scripts==
===httpd installed with yum===
If httpd installed with yum, the startup scripts is already created (<tt>/etc/init.d/httpd</tt>). Use it.
===httpd installed from scratch===
<font color=red>
Otherwise, create a similar one.
</font>
This also works:
<pre>
$APACHE_HOME/bin/apachectl start
$APACHE_HOME/bin/apachectl stop
</pre>
==Start at Boot==
<pre>
chkconfig --level 2345 httpd on
</pre>
==Configure iptables==
<pre>
iptables-save > /tmp/iptables.cfg
</pre>
Add the following:
<pre>
-A INPUT -p tcp -m state --state NEW --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW --dport 443 -j ACCEPT
</pre>
right under the:
<pre>
-A INPUT -m state --state ESTABLISHED -j ACCEPT
</pre>
line. Then:
<pre>
iptables-restore < /tmp/iptables.cfg
iptables-save > /etc/sysconfig/iptables
</pre>
If planning to only run the SSL version, do not add the port 80 line.
==Reboot and make sure the server can be accessed==
==Configure==
Modify <tt>${APACHE_HOME}/conf/httpd.conf</tt>. See:
<blockquote style="background-color: #f9f9f9; border: solid thin lightgrey;">
:[[httpd Configuration]]
</blockquote>

Latest revision as of 19:51, 5 January 2017

External

Internal

Overview

This is the Apache httpd compilation/installation procedure. It implies that httpd is compiled from source. If you plan to install httpd with yum, go directly to yum installation. The procedure was tested on RHEL and Mac. If you compile on Mac, make sure to follow the advice from "Compilation on Mac" section, below.

Download

Download from http://httpd.apache.org/download.cgi and optionally place in the local archive directory. 

wget http://mirror.cogentco.com/pub/apache//httpd/httpd-2.2.17.tar.gz

Older releases may not be on mirrors, but they can be downloaded directly from the apache web site: http://archive.apache.org/dist/httpd.

Extract

The sources can be extracted as a non-root user. 

cd src
gunzip < ../archive/httpd-2.2.17.tar.gz | tar xfv -

Configure Compilation

http://httpd.apache.org/docs/current/programs/configure.html

Compilation can be configured as a non-root user. 

cd httpd-2.2.17
./configure \
  --prefix /opt/httpd-2.2.17[-worker] \
  --enable-so \
  --enable-expires=shared \
  --with-included-apr

Compilation Configuration Notes

Shared Modules Option

It is a good idea to compile httpd with shared module option enabled and load them dynamically as needed. For that, the Dynamic Shared Object (DSO) capability must be enabled at compilation, with: 

--enable-so

For more details on Dynamic Shared Object (DSO) capability, see

Static Modules vs. Dynamic Modules

APR

configure may complain about not finding APR. I worked around this by using --with-included-apr in configure configuration.

SSL Compilation

If you need SSL, compile the latest OpenSSL (see [OpenSSL#Compilation]) and then 

...
--enable-ssl 
--with-ssl=/data/openssl-1.0.2/
...

If you use SSL, when running httpd, you need to set LD_LIBRARY_PATH to point to the OpenSSL lib directory: 

LD_LIBRARY_PATH="/data/openssl-1.0.2/lib:${LD_LIBRARY_PATH}"
export LD_LIBRARY_PATH

Compilation on Mac

Compilation on Mac

Various Module Configuration Requirements


worker MPM Compilation
mod_expires Compilation
mod_proxy Compilation
mod_proxy_ajp Compilation

Cleaning configuration

The only option I discovered so far is to completely remove the source tree. I am sure others exist ... if I find them, add them here.

Configuration Examples

Example 1

Version 2.2.15 

./configure --prefix=/cust/soe/opt/apache/2.2.15_without_mod_proxy 
            --enable-logio 
            --disable-proxy 
            --enable-rewrite 
            --enable-ssl 
            --enable-vhost-alias 
            --enable-headers 
            --enable-dav 
            --enable-dav-fs 
            --enable-modules=ssl 
            --with-ssl=/cust/soe/opt/openssl/1.0.0/ 
            --with-included-apr 
            --enable-dav-lock 
            --enable-deflate 
            --enable-so 
            --with-mpm=worker

We disabled mod_proxy so we can use the version included in mod_cluster.

Example 2

We use mod_proxy: 

#!/bin/bash

$(dirname $0)/configure \
 --prefix /data/httpd-2.2.29-worker-mpm \
 --enable-so \
 --with-included-apr \
 --enable-expires=shared \
 --with-mpm=worker \
 --enable-proxy=shared \
 --enable-proxy-connect=shared \
 --enable-proxy-http=shared \
 --enable-proxy-ajp=shared \
 --enable-proxy-balancer=shared \
 --disable-cgi \
 --enable-ssl \
 --with-ssl=/data/openssl-1.0.2

mod_cluster Recommended Configuration

1. Apply http://anonsvn.jboss.org/repos/mod_cluster/trunk/native/mod_proxy_cluster/mod_proxy_ajp.patch (optional).

2. Configure: 

./configure  --prefix=apache_installation_directory \
  --with-mpm=worker \
  --enable-mods-shared=most \
  --enable-maintainer-mode \
  --with-expat=builtin \
  --enable-ssl \
  --enable-proxy=shared \
  --enable-proxy-http=shared \
  --enable-proxy-ajp=shared \
  --disable-proxy-balancer=shared \
  --enable-so

Compile

Can be built as a non-root user. 

make

Install

Can be installed as a non-root user, as long as the user has write access to the target directory.

For more details on how to create the operational account, jump ahead to "Create the Operational Account" section and then come back here. 

make install
Retrieved from "https://kb.novaordis.com/index.php?title=Httpd_RHEL_Compilation&oldid=15723"