Wednesday, March 2, 2011

UNIX / Linux: How to Install and Configure mod_perl for Apache 2


If you are running any web based open source application that is written in perl, you should be using mod_perl with Apache instead of running it as CGI. mod_perl is way faster than running a web application using CGI.
This article explains how to install mod_perl on Apache 2.
First, install Apache 2, if you don’t have it already.

1. Download mod_perl

Download mod_perl from perl.apache.org as shown below.
# cd ~

# wget http://perl.apache.org/dist/mod_perl-2.0-current.tar.gz

# tar xvfz mod_perl-2.0-current.tar.gz

# cd mod_perl-2.0.4/

2. Configure mod_perl with Apache2

Specify the location of your Apache 2 installation to the mod_perl as shown below.
# perl Makefile.PL MP_APXS=/usr/local/apache2/bin/apxs

Reading Makefile.PL args from @ARGV
MP_APXS = /usr/local/apache2/bin/apxs
no conflicting prior mod_perl version found - good.
Configuring Apache/2.2.15 mod_perl/2.0.4 Perl/v5.8.8
Checking if your kit is complete...
Looks good
Writing Makefile for ModPerl
Writing Makefile for ModPerl::XS
Writing Makefile for mod_perl2
Note: If you encounter the “libgdbm.so was not found. You could just symlink it to /usr/lib/libgdbm.so.2.0.0″ message, install the gdbm-devel package as shown below.
# rpm -ivh gdbm-devel-1.8.0-26.2.1.i386.rpm

# rpm -qa | grep gdbm
gdbm-devel-1.8.0-26.2.1
gdbm-1.8.0-26.2.1
At this stage, the mod_perl is still not installed, which you can verify by checking the contents of the Apache 2 modules directory.
# /usr/local/apache2/bin/apxs -q LIBEXECDIR
/usr/local/apache2/modules

# ls -l /usr/local/apache2/modules/
total 16512
-rw-r--r-- 1 root root 9083 May 18 09:59 httpd.exp
-rwxr-xr-x 1 root root 16871365 May 19 03:44 libphp5.so

3. Make and install the mod_perl

First, do a make test, to make sure everything looks good.
# make test

t/special_blocks.t ... ok
All tests successful.
Files=20, Tests=84, 14 wallclock secs ( 0.17 usr 0.06 sys + 9.10 cusr 1.46 csys = 10.79 CPU)
Result: PASS
Finally, do a make install to install the mod_perl on Apache2.
# make install

Installing /usr/share/man/man3/Apache::TestReport.3pm
Installing /usr/share/man/man3/ModPerl::Global.3pm
Installing /usr/bin/mp2bug
Appending installation info to /usr/lib/perl5/5.8.8/i386-linux-thread-multi/perllocal.pod
+--------------------------------------------------------------+
| |
| For details on getting started with mod_perl 2, see: |
| |
| http://perl.apache.org/docs/2.0/user/intro/start_fast.html |
| |
| |
| Found a bug? File a bug report: |
| |
| http://perl.apache.org/bugs/ |
| |
+--------------------------------------------------------------+

4. Modify httpd.conf and Restart Apache

Modify the httpd.conf to load the mod_perl.so as shown below
# grep perl /usr/local/apache2/conf/httpd.conf
LoadModule perl_module modules/mod_perl.so
Restart the Apache.
# /usr/local/apache2/bin/apachectl restart

5. Verify mod_perl is installed

If everything goes smoothly, you’ll see mod_perl.so under the apache modules directory.
# ls -l /usr/local/apache2/modules/
total 17752
-rw-r--r-- 1 root root 9083 May 18 09:59 httpd.exp
-rwxr-xr-x 1 root root 16871365 May 19 03:44 libphp5.so
-rwxr-xr-x 1 root root 1264743 Jun 21 10:01 mod_perl.so
Apache error_log will also show that mod_perl is installed as shown below.
# tail /usr/local/apache2/logs/error_log
[notice] Apache/2.2.15 (Unix) PHP/5.3.2 mod_perl/2.0.4 Perl/v5.8.8 configured

9 Tips to Use Apachectl and Httpd like a Power User


After you have installed Apache2, if you want to use apachectl and httpd to it’s maximum potential, you should go beyond using start, stop and restart. The 9 practical examples provided in this article will help you to use apachectl and httpd very effectively.

Apachectl acts as SysV init script, taking arguments like start, stop, restart and status. It also acts as front-end to httpd command, by simply passing the command line arguments to httpd.  So, all the commands you execute using apachectl, can also be executed directly by calling httpd.

1. Pass different httpd.conf filename to apachectl

Typically you’ll modify the original httpd.conf to try out different Apache directives. If something doesn’t work out, you’ll revert back the changes. Instead of playing around with the original httpd.conf, copy it to a new httpd.conf.debug and use this new httpd.conf.debug file with Apache for testing purpose as shown below using option -f.
# apachectl -f conf/httpd.conf.debug
# httpd -k start -f conf/httpd.conf.debug
[Note: you can use either apachectl or httpd as shown above]

# ps -ef | grep http
root 25080 1 0 23:26 00:00:00 /usr/sbin/httpd -f conf/httpd.conf.debug
apache 25099 25080 0 23:28 00:00:00 /usr/sbin/httpd -f conf/httpd.conf.debug
[Note: ps shows the httpd running with httpd.conf.debug file]
Once you are satisfied with the changes and Apache runs without any problem with httpd.conf.debug,  you can copy the changes to httpd.conf and start the Apache normally as shown below.
# cp httpd.conf.debug httpd.conf
# apachectl stop
# apachectl start

# ps -ef | grep httpd
root 25114 1 0 23:28 00:00:00 /usr/sbin/httpd -k start
daemon 25115 25114 0 23:28 00:00:00 /usr/sbin/httpd -k start
[Note: ps indicates that the httpd is running using the default config file]

2. Use a temporary DocumentRoot without modifying httpd.conf

This is very helpful, when you are trying out different layout for your website and don’t want to modify the original files under the default DocumentRoot. Take a copy of your original DocumentRoot directory (/var/www/html) to a new temporary DocumentRoot directory (/var/www/html_debug). Make all your changes under this temporary DocumentRoot directory (/var/www/html_debug) and start the Apache with this temporary directory as shown below using option -c.
# httpd -k start -c "DocumentRoot /var/www/html_debug/"
If you want to go back to original configuration using the default DocumentRoot (/var/www/html), simply restart the Apache as shown below.
# httpd -k stop
# apachectl start

3. Increase the LogLevel temporarily

While you are debugging an issue, you can change the LogLevel of the Apache temporarily, without modifying the LogLevel directive in the httpd.conf as shown below using option -e. In this example, the LogLevel is set to debug.
# httpd -k start -e debug
[Sun Aug 17 13:53:06 2008] [debug] mod_so.c(246): loaded module auth_basic_module
[Sun Aug 17 13:53:06 2008] [debug] mod_so.c(246): loaded module auth_digest_module
Possible values you can pass to option -e are: debug, info, notice, warn, error, crit, alert, emerg

4. Display the modules compiled inside Apache using option -l

# httpd -l
Compiled in modules:
core.c
prefork.c
http_core.c
mod_so.c

5. Display both static and dynamic module loaded by Apache

When you pass option -l, to httpd, it will display only the static modules. Passing option -M, will display both static and shared modules as shown below.
# httpd -M
Loaded Modules:
core_module (static)
mpm_prefork_module (static)
http_module (static)
so_module (static)
auth_basic_module (shared)
auth_digest_module (shared)
authn_file_module (shared)
authn_alias_module (shared)
Syntax OK

6. Show all accepted directives inside httpd.conf

This is like an extended help for httpd, which will display all the httpd.conf directives and the places where they are valid. For a specific directive, it tells all the possible values and where it can be used inside the httpd.conf.  This can be very helpful, when you want to quickly know about a particular Apache directive.
# httpd -L
HostnameLookups (core.c)
"on" to enable, "off" to disable reverse DNS lookups, or "double" to enable double-reverse DNS lookups
Allowed in *.conf anywhere

ServerLimit (prefork.c)
Maximum value of MaxClients for this run of Apache
Allowed in *.conf only outside <Directory>, <Files> or <Location>

KeepAlive (http_core.c)
Whether persistent connections should be On or Off
Allowed in *.conf only outside <Directory>, <Files> or <Location>

LoadModule (mod_so.c)
a module name and the name of a shared object file to load it from
Allowed in *.conf only outside <Directory>, <Files> or <Location>

7. Validate the httpd.conf after making changes

Use option -t to validate whether there are any issues with a specific Apache configuration file. In the example shown below, it displays that there is a problem at line 148 in the httpd.conf.debug. mod_auth_basicso is missing a . (period) before the so.
# httpd -t -f conf/httpd.conf.debug
httpd: Syntax error on line 148 of /etc/httpd/conf/httpd.conf.debug:
Cannot load /etc/httpd/modules/mod_auth_basicso into server:
/etc/httpd/modules/mod_auth_basicso: cannot open shared object file: No such file or directory
Once you fix the issue, it will display Syntax OK.
# httpd -t -f conf/httpd.conf.debug
Syntax OK

8. Display the httpd build parameters

Use option -V (upper-case V), to display Apache version number and all the parameters that are used while building the Apache.
# httpd -V
Server version: Apache/2.2.9 (Unix)
Server built: Jul 14 2008 15:36:56
Server's Module Magic Number: 20051115:15
Server loaded: APR 1.2.12, APR-Util 1.2.12
Compiled using: APR 1.2.12, APR-Util 1.2.12
Architecture: 32-bit
Server MPM: Prefork
threaded: no
forked: yes (variable process count)
Server compiled with....
-D APACHE_MPM_DIR="server/mpm/prefork"
-D APR_HAS_SENDFILE
-D APR_HAS_MMAP
-D APR_HAVE_IPV6 (IPv4-mapped addresses enabled)
-D APR_USE_SYSVSEM_SERIALIZE
-D APR_USE_PTHREAD_SERIALIZE
-D SINGLE_LISTEN_UNSERIALIZED_ACCEPT
-D APR_HAS_OTHER_CHILD
-D AP_HAVE_RELIABLE_PIPED_LOGS
-D DYNAMIC_MODULE_LIMIT=128
-D HTTPD_ROOT="/etc/httpd"
-D SUEXEC_BIN="/usr/sbin/suexec"
-D DEFAULT_PIDLOG="logs/httpd.pid"
-D DEFAULT_SCOREBOARD="logs/apache_runtime_status"
-D DEFAULT_LOCKFILE="logs/accept.lock"
-D DEFAULT_ERRORLOG="logs/error_log"
-D AP_TYPES_CONFIG_FILE="conf/mime.types"
-D SERVER_CONFIG_FILE="conf/httpd.conf"
If you want display only the Apache version number, use the option -v (lower-case v) as shown below.
# httpd -v
Server version: Apache/2.2.9 (Unix)
Server built: Jul 14 2008 15:36:56

9. Load a specific module only on demand.

Sometimes you may not want to load all the modules in the Apache. For e.g. You may want to load ldap related modules to Apache, only when you are testing LDAP. This can be achieved as shown below.
Modify the httpd.conf and add IfDefine directive called load-ldap (you can name this anything you want).
<IfDefine load-ldap>
LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
</IfDefine>
When you are testing ldap and would like to Load the ldap related modules, pass the load-ldap to Option -D, as shown below:
# httpd -k start -e debug -Dload-ldap -f /etc/httpd/conf/httpd.conf.debug
[Sun Aug 17 14:14:58 2008] [debug] mod_so.c(246): loaded module ldap_module
[Sun Aug 17 14:14:58 2008] [debug] mod_so.c(246): loaded module authnz_ldap_module
[Note: Pass -Dload-ldap, to load the ldap modules into Apache]

# apachectl start
[Note: Start the Apache normally, if you don't want to load the ldap modules.]
If you liked this article, please bookmark it on del.icio.us, Digg and Stumble using the link provided below under ‘What Next?’ section.

Install Apache 2 from Source on Linux


All Linux distributions comes with Apache. However, it is recommended to download latest Apache source code, compile and install on Linux. This will make it easier to upgrade Apache on a ongoing basis immediately after a new patch or release is available for download from Apache. This article explains how to install Apache2 from source on Linux.

1. Download Apache

Download the latest version from Apache HTTP Server Project . Current stable release of Apache is 2.2.9. Move the source to /usr/local/src and extract it as shown below.
# cd /usr/local/src
# gzip -d httpd-2.2.9.tar.gz
# tar xvf httpd-2.2.9.tar

2. Install Apache

View all configuration options available for Apache using ./configure –help (two hyphen in front of help). The most commonly used option is –prefix={install-dir-name} to install Apache on a user defined directory.
# cd httpd-2.2.9
# ./configure --help
In the following example, Apache will be compiled and installed to the default location /usr/local/apache2 with the DSO capability. Using the –enable-so option, you can load modules to Apache at runtime via the Dynamic Shared Object (DSO) mechanism, rather than requiring a recompilation.
# ./configure --enable-so
# make
# make install
Note: During the ./configure, you may get the following error message.
# ./configure --enable-so
configure: error: no acceptable C compiler found in $PATH
See `config.log' for more details.
configure failed for srclib/apr
Install the gcc and the dependent modules as shown below and try ./configure again to fix the above issue.
# rpm -ivh gcc-4.1.2-14.el5.i386.rpm glibc-devel-2.5-18.i386.rpm glibc-headers-2.5-18.i38
6.rpm kernel-headers-2.6.18-53.el5.i386.rpm
Preparing... ########################################### [100%]
1:kernel-headers ########################################### [ 25%]
2:glibc-headers ########################################### [ 50%]
3:glibc-devel ########################################### [ 75%]
4:gcc ########################################### [100%]

3. Start Apache and verify installation

# cd /usr/local/apache2/bin
# ./apachectl start
Go to http://local-host, which should display the default message “It Works!”

4. Start Apache automatically during system startup

Modify the /etc/rc.d/init.d/httpd script and change apachectl and httpd variable to point to the appropriate new location as shown below. Please note that this httpd script was originally installed as part of the default Apache from the Linux distribution.
apachectl=/usr/local/apache2/bin/apachectl
httpd=${HTTPD-/usr/local/apache2/bin/httpd}
Now, you can perform the following to stop and start the Apache
# service httpd stop
# service httpd start
Setup the Apache to automatically startup during reboot as shown below.
# chkconfig --list httpd
httpd 0:off 1:off 2:off 3:off 4:off 5:off 6:off
# chkconfig --level 2345 httpd on
# chkconfig --list httpd
httpd 0:off 1:off 2:on 3:on 4:on 5:on 6:off

How To Generate SSL Key, CSR and Self Signed Certificate For Apache


If you want to convert your website from HTTP to HTTPS, you need to get a SSL certificate from a valid organization like Verisign or Thawte. You can also generate self signed SSL certificate for testing purpose.

In this article, let us review how to generate private key file (server.key), certificate signing request file (server.csr) and webserver certificate file (server.crt) that can be used on Apache server with mod_ssl.

Key, CSR and CRT File Naming Convention

I typically like to name the files with the domain name of the HTTPS URL that will be using this certificate. This makes it easier to identify and maintain.
  • Instead of server.key, I use www.thegeekstuff.com.key
  • Instead of server.csr, I use www.thegeekstuff.com.csr
  • Instead of server.crt, I use www.thegeekstuff.com.crt

1. Generate Private Key on the Server Running Apache + mod_ssl

First, generate a private key on the Linux server that runs Apache webserver using openssl command as shown below.
# openssl genrsa -des3 -out www.thegeekstuff.com.key 1024
Generating RSA private key, 1024 bit long modulus
.......................................++++++
...................................................++++++
e is 73547 (0x01001)
Enter pass phrase for www.thegeekstuff.com.key:
Verifying - Enter pass phrase for www.thegeekstuff.com.key:

# ls -ltr www.thegeekstuff.*
-rw-r--r-- 1 root root 963 Jun 13 20:26 www.thegeekstuff.com.key
The generated private key looks like the following.
# cat www.thegeekstuff.com.key
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,485B3C6371C9916E

ymehJu/RowzrclMcixAyxdbfzQphfUAk9oK9kK2
jadfoiyqthakLKNqw9z1MoaqkPyqeHevUm26no
AJKIETHKJADFS2BGb0n61/Ksk8isp7evLM4+QY
KAQETKjdiahteksMJOjXLq+vf5Ra299fZPON7yr
-----END RSA PRIVATE KEY-----

2. Generate a Certificate Signing Request (CSR)

Using the key generate above, you should generate a certificate request file (csr) using openssl as shown below.
# openssl req -new -key www.thegeekstuff.com.key -out www.thegeekstuff.com.csr
Enter pass phrase for www.thegeekstuff.com.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [GB]:US
State or Province Name (full name) [Berkshire]:California
Locality Name (eg, city) [Newbury]:Los Angeles
Organization Name (eg, company) [My Company Ltd]:The Geek Stuff
Organizational Unit Name (eg, section) []:IT
Common Name (eg, your name or your server's hostname) []: thegeekstuff
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

# ls -ltr www.thegeekstuff.*
-rw-r--r-- 1 root root 963 Jun 13 20:26 www.thegeekstuff.com.key
-rw-r--r-- 1 root root 664 Jun 13 20:35 www.thegeekstuff.com.csr

3. Generate a Self-Signed SSL Certificate

For testing purpose, you can generate a self-signed SSL certificate that is valid for 1 year using openssl command as shown below.
# openssl x509 -req -days 365 -in www.thegeekstuff.com.csr -signkey www.thegeekstuff.com.key -out www.thegeekstuff.com.crt
Signature ok
subject=/C=US/ST=California/L=Los Angeles/O=thegeekstuff/OU=IT/CN=www.thegeekstuff.com
Getting Private key
Enter pass phrase for www.thegeekstuff.com.key:

# ls -l www.thegeekstuff*
-rw-r--r-- 1 root root 963 Jun 13 20:26 www.thegeekstuff.com.key
-rw-r--r-- 1 root root 664 Jun 13 20:35 www.thegeekstuff.com.csr
-rw-r--r-- 1 root root 879 Jun 13 20:43 www.thegeekstuff.com.crt

# cat www.thegeekstuff.com.crt
-----BEGIN CERTIFICATE-----
haidfshoaihsdfAKDJFAISHTEIHkjasdjadf9w0BAQUFADCB
kjadfijadfhWQIOUQERUNcMNasdkjfakljasdBgEFBQcDAQ
kjdghkjhfortoieriqqeurNZXCVMNCMN.MCNaGF3dGUuY29
-----END CERTIFICATE-----

You can use this method to generate Apache SSL Key, CSR and CRT file in most of the Linux, Unix systems including Ubuntu, Debian, CentOS, Fedora and Red Hat.

4. Get a Valid Trial SSL Certificate (Optional)

Instead of signing it youself, you can also generate a valid trial SSL certificate from thawte. i.e Before spending the money on purchasing a certificate, you can also get a valid fully functional 21 day trial SSL certificates from Thawte. Once this valid certificate works, you can either decide to purchase it from Thawte or any other SSL signing organization.

This step is optional and not really required. For testing purpose, you can always use the self-signed certificate that was generated from the above step.

Go to Thwate trial certificate request page and do the following:
  • Select “SSL Web Server Certificate (All servers)” under the “select your trial certificate”.
  • Do not check the PKCS #7 check-box under the “configure certificate”
  • Copy/Paste the *.csr file that you generate above in the textbox under “certificate signing request (CSR)”
  • Click on next at the bottom, which will give you a 21-day free trial certificate.

Copy/Paste the trial certificate to the www.thegeekstuff.com.crt file as shown below.
# cat www.thegeekstuff.com.crt
-----BEGIN CERTIFICATE-----
haidfshoaihsdfAKDJFAISHTEIHkjasdjadf9w0BAQUFADCB
kjadfijadfhWQIOUQERUNcMNasdkjfakljasdBgEFBQcDAQ
kjdghkjhfortoieriqqeurNZXCVMNCMN.MCNaGF3dGUuY29
-----END CERTIFICATE-----

How To Install Apache 2 with SSL on Linux (with mod_ssl, openssl)


This article gives step by step instructions on how to install Apache 2 with mod_ssl.
I prefer to install Apache from source, as it gives me more flexibility on exactly what modules I want to enable or disable, and I can also upgrade or apply patch immediately after it is released by the Apache foundation.

1. Download Apache

Download Apache from httpd.apache.org. The current stable release is 2.2.17.
Once you get the direct URL to download the latest stable version of Apache, use wget as shown below to download it directly to you server.
cd ~
wget http://www.eng.lsu.edu/mirrors/apache//httpd/httpd-2.2.17.tar.gz
tar xvfz httpd-2.2.17.tar.gz

2. Install Apache with SSL/TLS

View all available Apache installation and configuration options as shown below.
cd httpd-2.2.17
./configure --help
To install an Apache module, you would typically say –enable-{module-name}. For example, to install SSL with Apache, it is –enable-ssl. To install ldap module, it is –enable-ldap.
To uninstall any default module that comes with Apache, you would typically say –disable-{module-name}. For example, to disable basic authentication in Apache, it is –disable-auth-basic
In this example, we will install Apache with all default modules, with addition of –enable-ssl (to install mod_ssl for SSL support), and –enable-so, which helps to load modules in Apache during run-time via the Dynamic Shared Object (DSO) mechanism, rather than requiring a recompilation.
./configure --enable-ssl --enable-so
make
make install
Note: By default the above installs Apache under /usr/local/apache2. If you like to change this location, use –prefix option in the ./configure.

3. Enable SSL in httpd.conf

Apache configuration file httpd.conf is located under /usr/local/apache2/conf.
Uncomment the httpd-ssl.conf Include line in the /usr/local/apache2/conf/httpd.conf file.
# vi /usr/local/apache2/conf/httpd.conf
Include conf/extra/httpd-ssl.conf
View the httpd-ssl.conf to review all the default SSL configurations. For most cases, you don’t need to modify anything in this file.
vi /usr/local/apache2/conf/extra/httpd-ssl.conf
The SSL certificate and key are required before we start the Apache. The server.crt and server.key file mentioned in the httpd-ssl.conf needs to be created before we move forward.
# egrep 'server.crt|server.key' httpd-ssl.conf
SSLCertificateFile "/usr/local/apache2/conf/server.crt"
SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"

4. Create server.crt and server.key file

First, Generate the server.key using openssl.
cd ~
openssl genrsa -des3 -out server.key 1024
The above command will ask for the password. Make sure to remember this password. You need this while starting your Apache later.
If you don’t provide a password, you’ll get the following error message.
2415:error:28069065:lib(40):UI_set_result:result too small:ui_lib.c:849:You must type in 4 to 8191 characters
Next, generate a certificate request file (server.csr) using the above server.key file.
openssl req -new -key server.key -out server.csr
Finally, generate a self signed ssl certificate (server.crt) using the above server.key and server.csr file.
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

5. Copy the server.key and server.crt

Copy the server.key and server.crt file to appropriate Apache configuration directory location.
cd ~
cp server.key /usr/local/apache2/conf/
cp server.crt /usr/local/apache2/conf/

6. Start the apache and verify SSL

Start the Apache as shown below.
/usr/local/apache2/bin/apachectl start
This will prompt you to enter the password for your private key.
Apache/2.2.17 mod_ssl/2.2.17 (Pass Phrase Dialog)
Some of your private key files are encrypted for security reasons.
In order to read them you have to provide the pass phrases.

Server www.example.com:443 (RSA)
Enter pass phrase:

OK: Pass Phrase Dialog successful.