Edward Parrish © 2003     

4. Server Configuration

What We Will Cover


Log Tails

From Last Lab

Quiz Review


4.1: Choosing Web Server Software

Objectives

At the end of the lesson the student will be able to:

  • Describe what options are available for server software
  • Install a web server on a computer
  • Web server can refer to machines -- our Web server is that machine
  • Can also refer to software running on a machine -- Apache is our Web server
  • Double meaning can be confusing -- must understand in context
  • Similarly, Web server software also known as HTTPD -- hypertext transfer protocol daemon
  • Today will be using Web server and HTTPD interchangeably
  • HTTPD is heart of a server
  • Choice of HTTPD affects scalability, manageability, and accessibility of sites hosted on the server
  • Number of factors to consider when choosing Web server, including:
    • Price: How much the server costs, considering that some excellent servers are free.
    • Scalability: How well the server will work when the number of hits increases.
    • Configurability: How much the server can be changed or customized.
    • Performance: How effective is server throughput, individual response time, and availability.
  • Netcraft Web Server Survey maintains the current rankings of web server usage on Internet connected computers
  • Security Space publishes several free reports including:
  • From these reports, what are the most popular Web servers?

4.1.1: Apache

  • Apache Web server available from http://www.apache.org
    • All source code is included in the distribution
  • Apache Web server runs on either Linux/Unix or Windows
  • More difficult to configure than other popular servers
  • Apache Web server does not have a GUI administration console
  • Configuration is done through a series of configuration files
  • Configuration files contain directives that control the behavior of Apache
    • Typical httpd.conf file: 1.3 or 2.0
  • Pound sign (#) is used for comments -- any text after pound sign ignored
  • List of configuration directives available from the Apache Web site: http://httpd.apache.org/
    • Will look at directives after installation
  • Instructions for installing Apache available here

4.1.2: IIS

  • Internet Information Server (IIS) is Microsoft’s Web server
  • Runs only on Windows NT/2000/XP Platforms
  • IIS is very good Web server for Windows platforms
  • IIS available on Windows 2000 Professional and XP Professional
  • You can remove IIS or select additional components using Control Panel
  • To start using IIS in the classroom, see HowTo's page on Setting Up IIS
  • For more information, see Windows 2000 Server Documentation

4.1.3: Other Servers

Following are links to various server offerings


4.1.4: Installing a Web Server

Installing on Windows

  • Every Windows program has an easy-to-use Setup.exe program
    • Asks you some easy questions
    • Then automatically performs the rest of the install
  • Apache provides a version of Apache for Windows using such a method
  • IIS is found on your Windows CD ROM, if you bought the correct version.
    • Already installed on the classroom computers
    • Also available in the CTC

Installing on Linux/Unix

  • Some Linux programs are almost as easy to install as Windows, but some are more difficult
  • Several methods for delivering and installing Apache software on Linux/Unix

RPM

  • RPM (Red Hat Package Manager) provides one of the easier methods
    • Also supported by Caldera and S.u.S.E
  • Software is bundled into a package for installation
  • Apache web server included in Red Hat Linux distributions in RPM form
    • We will not be using this method in the classroom
    • However, may find it useful at home or work
  • To install a package:
  • [root]# rpm -i <packagename>
    
  • To upgrade an existing package to a newer version:
  • [root]# rpm -U <packagename>
    
  • To remove a package:
  • [root]# rpm -e <packagename>
    

TAR or TGZ (TAR.GZ)

  • A TAR (Tape Archive) file is a series of files appended together
    • Either executable binaries or source code
    • Can include directories
  • Makes transfer and archiving to tape, or other media, easier
  • Usually compressed after TARing using the GNU Zip program: gzip
  • To unzip and untar in one step:
  • tar xzvf <filename>.tar.gz
    

Compiling Source Code

  • After downloading a souce-code file, will have to unzip and untar
  • Then will need to compile it into machine code
  • Usually a README or INSTALL file with instructions
  • Typical first step is to configure the compilation script
  • ./configure
    • Make sure to include the dot and slash before the configure command
    • Bash shell requires a path to executables
  • Next step is to compile the source code using the make utility
  • make
    • Will take about 5 minutes to compile Apache
  • After compiling, use the make utility again to install the software
  • make install
    • Copies the compiled code into the locations for running the program
  • Final step is to verify the installation by starting and testing the application

More Information


Lab Exercise 4.1

Instructions:

  1. Start a text file named exercise4.txt
    Will be adding to this file during the lesson -- save it save it often.
  2. Prepare the exercise header as described in the HowTo on submitting exercises
  3. Label this exercise: Lab 4.1
  4. Use the next 20 minutes to complete the exercises and answer the questions.
  5. Do not submit exercises until all from today's lesson are finished

Exercises and Questions

    Understand What Options Are Available for Server Software

  1. What are the three most popular choices for Web servers?
  2. Find a Web server other than Apache and IIS, and see how it compares. Record your thoughts in exercise4.txt.
  3. Install a Web Server on Your Computer

  4. Chose either Apache on Linux or IIS for your server. Why did you choose the particular server and operating system over another?
  5. Note: For the operating system you chose, you need understand the basics of how to use it. The following help is available in the HowTos:

  6. Install the server on a machine. What are some of the problems you encounter, and how did you resolve them? Does your server work now (can you access it from a browser)?
    • If you choose Apache on Linux, follow the instructions for HowTo Install Apache on Linux.
    • If you choose IIS, then the server is already installed. You should try starting and stoping it, following the instructions in HowTo Setup IIS.

4.2: Customizing Your Web Server

Objectives

At the end of the lesson the student will be able to:

  • Describe typical server configuration options
  • Configuration tools vary between different Web servers
  • IIS uses an IIS Console and Wizards
  • Apache traditionally uses a text editor to set directives in httpd.conf file
  • Can find this file on classroom systems at:
  • /usr/local/apache2/conf/httpd.conf
    • On some Linux systems: /etc/httpd/conf/httpd.conf
    • Can always find it using: find / -iname "httpd.conf"
  • In following sections we will review main configuration settings
  • Apache maintains documentation for its configuration directives

4.2.1: General Server Options

These options are global to the entire HTTPD server:

  • User and Group: The name (or #number) of the user and group to run httpd as; this should usually be a user and group that has restricted access on the server. It should not be the root or administrator user. For example:
  • User nobody
    Group #-1
    
  • Listen (IIS: IP Address): Tells the server to accept incoming requests on the specified port or address-and-port combination. If only a port number is specified, the server listens to the given port on all interfaces. If an IP address is given as well as a port, the server will listen on the given port and interface.
  • Since a single server can have multiple IP addresses, you may want to specify which address to listen for, or have it listen on all available addresses. This option is sometimes used for virtual hosts (see Lab 4.5).

    Listen 172.30.1.100:80

    Note for Apache 1.3 users: The BindAddress and Port directives no longer exist in Apache 2.0. Use the Listen directive instead.


4.2.2: Directory Options

These options specify the attributes of specific directories:

  • DocumentRoot (IIS: Home Directory). This option is used to set the document root directory for a Web site. When a user types in www.domain.com, the server looks in this directory for documents. See Lab 3.1.1.
  • DocumentRoot "/usr/local/apache2/htdocs"
  • UserDir: This option is used to determine which directory in a user’s home directory is used for publishing Web documents. Typically set to public_html. See Lab 3.1.3
  • UserDir public_html
  • ScriptAlias (IIS: Execute). This option specifies that a directory is used for executable content (e.g. CGI scripts).
  • ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
    
  • Alias (IIS: Virtual Directory). This option allows documents to be stored in the local filesystem other than under the document root directory. See Lab 3.1.1.
  • Alias /icons/ "/usr/local/apache2/icons/"
    
    <Directory "/usr/local/apache2/icons">
        Options Indexes MultiViews
        AllowOverride None
        Order allow,deny
        Allow from all
    </Directory>
    
  • DirectoryIndex (IIS: Default Document): This option specifies filenames that are used as directory indexes. Multiple filenames can typically be specified. See Lab 3.4.
  • DirectoryIndex index.html index.htm /cgi-bin/index.pl
  • IndexOptions (IIS: Directory Browsing): This option specifies whether or not to display a directory’s contents if no default document is found when a user requests a directory and not a specific file. See Lab 3.4.
  • IndexOptions FancyIndexing VersionSort

IIS Web Site Properties

  • Available from Computer Management Console


4.2.3: Access Control

Options are used to restrict access to your site, or particular directories. Covered in more detail in Lab 4.3.

  • AuthUserFile: Text file used the list of users and passwords for user authentication.
  • AuthGroupFile: file to use for determining which groups have access.
  • Require (IIS: Authentication Control): require a certain user, group, or any authenticated user.
  • Allow and Deny (IIS: IP Address and Domain Name Restrictions): allow or deny access from a certain IP address, network, or domain.

IIS Web Site Properties

  • Available from Computer Management Console


4.2.4: Other Options

  • AddHandler (IIS: Application Mappings): Add a handler to a particular file type. A handler is something built in to the server, or an external program designed to work with the Web server. A handler will usually take the file requested, do something with it, and return the results to the server. A common example is to set up a handler for CGI scripts so that any file with a .cgi extension is executed.
  • AddHandler cgi-script .cgi
  • Redirect (IIS: Redirection to a URL): Redirect clients to a different URL. It maps an old URL to a new one. When the URL specified is accessed, the client is directed to a different URL instead. This is useful when a site is reorganized or moves. For example, if the support section of your Web site was located at http://www.yoursite.com/ support but now resides at http://support.yoursite.com, you can configure a redirection option on www.yoursite.com to forward visitors automatically to the new site. A URL is usually specified as the destination for a redirect.
  • Redirect URL-path new-URL

Lab Exercise 4.2

Instructions:

  1. Label this exercise: Lab 4.2
  2. Use the next 10 minutes to answer the following questions.
  3. Do not submit exercises until all of them from today's lesson are finished

Exercises and Questions

    Understand Typical Server Configuration Options

  1. Find the document root directory on your Web server and create a simple HTML document in that directory. Can you access that file from a browser on another machine?
  2. Note: to access another machine in the lab, type 172.30.1.1XX in the address bar, where XX is the station number.

  3. Configure an alias (IIS: Virtual Directory) on your machine. Make an alias so that http://localhost/vortex points to a directory named vortex outside your document root directory, such as /home/cis164/public_html. What options did you change in your configuration?
  4. For Windows, follow the instructions for Creating a Virtual Directory in HowTo Setup IIS.

    Note: Make certain the server has permission to view the directory and files outside your document root directory.


4.3: Controlling Access

Objectives

At the end of the lesson the student will be able to:

  • Set Proper Permissions on Files and Directories
  • Limit Access on Your Server to Specific Users and Hosts
  • Web server must have permission to access documents it makes available to clients
  • Access is governed largely by the file system
  • Under UNIX/Linux:
    • Web server typically runs as a restricted user
    • Does not have any special privileges
    • Owner must set file permissions so Web server can access them
  • Under Windows XP:
    • Web server typically runs as IUSR_XXX, where XXX is the machine name
    • Does not have any special privileges
    • Must add IUSR_XXX to Directory Security

4.3.1: User Access

  • Most documents on Web server available for anyone to read
  • Possible to restrict access to certain pages
  • HTTP offers simple authentication protocol to require a username and password
  • HTTP 1.1 currently offers two types of authentication:
    • Basic authentication offers little security as it does not use encryption
    • Digest authentication relies on MD5 checksums to ensure integrity -- not much better because cracker can just capture digest
    • Best way to ensure secure authentication is to use HTTPS
  • Basic methodolgy for enabling user authentication:
    1. Determine which resources need to be restricted
    2. Determine users and groups
    3. Create users and groups
    4. Apply restrictions to files and directories (resources)
  • First two steps require you to decide which directories and files require authentication and who should have access
  • Third step depends on your server
    • Apache uses special password files
    • IIS requires you to create user accounts in the operating system
  • Fourth step, applying the restrictions, also depends on your Web server
    • Generally use Web server administration tools

Apache Access Control Example

  • As a prerequisite on Apache, must have the AllowOverride directive to permit .htaccess files
  • For example:
  • Alias /cis164 "/home/cis164/public_html/"
    
    <Directory "/home/cis164/public_html/">
        Options Indexes MultiViews
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
    
  • Also make sure that Apache has been restarted since updating this file
  1. Open a terminal emulation window by clicking the icon in the bottom panel
  2. Login as the superuser, if you are not already.
  3. su -l root

    You will be prompted for the root password

  4. First will need to create a password file
    • Password file should be placed somewhere outside of your document directory
    • For example: /usr/local/apache/htdocs

    To create this directory on our computers:

    mkdir /usr/local/apache2/passwd
  5. To create the password file, move to the apache2/bin directory
  6. cd /usr/local/apache2/bin
  7. To create a password for user cis164, we type:
  8. ./htpasswd -c /usr/local/apache2/passwd/password cis164

    htpasswd will ask you for the password and then ask you to type it again to confirm it.

    New password: mypassword
    Re-type new password: mypassword
    Adding password for user cis164
    
  9. Following steps are as user cis164, so we exit as superuser
  10. exit
  11. Next step is to create the directory we want to protect
  12. For our example, we will create a protected directory name secret.

    mkdir /home/cis164/public_html/secret
  13. Then we will move to the secret directory
  14. cd /home/cis164/public_html/secret
  15. Next we need to create a file in the directory we want to protect
    • File usually called .htaccess (htaccess on Windows Apache)
  16. Create the file using an editor such as gedit
  17. gedit .htaccess &
  18. Add the following lines to the .htaccess file and save the file
  19. AuthType Basic
    AuthName "By Invitation Only"
    AuthUserFile /usr/local/apache2/passwd/password
    AuthGroupFile /dev/null
    require user cis164
    

    Next time we load a file from that directory should see a login/password prompt. If not, we probably are not permitted to use .htaccess files in the directory in question.

  20. Type into the browser address bar: localhost/cis164/secret

IIS Access Control

  • Anonymous authentication uses a designated user account's permissions to access the Web site files
  • Following must be true for the account:
    • Designated user account must exist
    • Must have a valid password
    • Must not have expired or have been deleted
  • All other standard Windows security mechanisms also apply
  • Can see which account is being used for anonymous authentication
  • Can run the Permissions Wizard to make sure the account can access files and directories

    Checking the IIS Account

  1. Open the Computer Management console
  2. Right-click on the Default Web Site
  3. Select the Properties option
  4. Select the Directory Security tab
  5. Click the Edit button found in the tab's Anonymous Access and Authentication Control section
  6. The Authentication Methods dialog box appears
  7. Make sure that the Anonymous access check-box is selected
  8. Also click the Edit button to verify the account is being used

    Running the Permissions Wizard

  1. Open the Computer Managment window by clicking the Start menu and then right-clicking on My Computer
  2. Select Manage from the popup list
  3. Expand the Internet Information Services tree until you see Default Web Sites
  4. Right-click on Default Web Sites and follow the menus for AllTasks => Permissions Wizard
  5. Choose the Directory Security tab and you should see the following window

  1. Select the appropriate settings as you step through the wizard

Setting NTFS Permissions

  • IIS relies on NTFS permissions for securing individual files and directories
  • Can set permissions from Windows Explorer
    1. Right-click on the file or directory and select Properties
    2. Click the Security tab to view and change permissions
  • Note that permissions are inherited from directories higher in the hierarchy
  • More information: About Access Control

4.3.2: Host Access

  • Can denying access to your server from a particular host or domain
  • When is this a good idea?

Apache Example

  • Basic format is to specify allow and deny directives to control access by host
  • Place the restrictions in the httpd.conf file
  • <Directory "/var/www/icons">
        Options Indexes MultiViews
        AllowOverride None
        Order allow,deny
        Allow from all
        deny from *.spammer.com
    </Directory>
    
  • More information:

IIS Information

  • This feature is only available for Windows 2000 Server installations
    • Costs extra money
    • IIS in XP limited to 10 concurrent users, per the EULA
  • If it were available, we would access it from the Web Site Properties dialog
    • IP addresses and domain name restrictions
  • Note that PortMapper is a free way to block access based on IP addresses
    • Would be a good student project


Lab Exercise 4.3

Instructions:

  1. Label this exercise: Lab 4.3
  2. Use the next 10 minutes to answer the following questions.
  3. Do not submit exercises until all of them from today's lesson are finished

Exercises and Questions

    Set Proper Permissions on Files and Directories

  1. Create a file on your server that only you (the owner) have access to. What happens when you try to access that file from the Web server via a browser?
  2. How can you view the file in a browser via the Web server?
  3. Limit Access on Your Server to Specific Users and Hosts

  4. Read the documentation to your Web server to determine how to control access. What steps do you need to take to password-protect a specific directory?
  5. How can you limit access to specific hosts?

4.4: Secure Sockets Layer Configuration

Objectives

At the end of the lesson the student will be able to:

  • Describe How the Secure Sockets Layer Is Used
  • By default, HTTP is not a secure protocol
  • Normal HTTP transactions not encrypted -- can be viewed by unintended parties
  • Mostly not a problem since most Web pages do not contain personal, private information
  • However there are times when encryption is important -- for example?

4.4.1: SSL

  • Most popular encryption protocol on Internet is Secure Sockets Layer (SSL).
  • Developed by Netscape, but it is now used by many other companies
  • Transport Layer Security (TLS) protocol, based on SSL version 3.0, is becoming an internet standard
    • SSL and TLS are both supported in Apache module mod_ssl
    • SSL nd TLS supported by IIS as well
  • SSL comes in two strengths: 40-bit and 128-bit
    • Longer key makes breaking encryption more difficult
  • Most communication on the Internet is done using TCP/IP as the communications protocol
  • HTTP is application-level protocol used by browsers and Web server applications
  • SSL intended as layer between an application-level protocol and TCP/IP
  • Thus, SSL can be used in a variety of network applications besides HTTP-based ones
  • Other uses include: secure FTP and telnet clients (SSH)

4.4.2: HTTPS

  • HTTPS is normal HTTP wrapped in SSL
  • Many browsers support the HTTPS protocol
  • Need to configure an HTTPS server that runs alongside normal HTTP server
  • Note that URL to a resource on HTTPS server uses a slightly different naming convention
  • Instead of the "http:" prefix, HTTPS uses the "https:" prefix
    • This tells the browser to attempt a secure connection to the server using port 443
    • Port 443 is designated port for HTTPS assigned by the Internet Assigned Numbers Authority (IANA)
  • Browser typically notifies user when it engages in a secure transaction
  • Can see a small padlock icon at the bottom of the browser window

4.4.3: Certificates

  • Must install certificates to use SSL/HTTPS
  • Certificate is a document that contains information about your site
  • Certificate authority (CA) is a mutually trusted organization that issues and verifies certificates
  • Can obtain certificate from a CA as follows:
    1. Create an encryption private and public key pair
    2. Create a certificate request based on the public key. The certificate request contains information about your server and the company hosting it
    3. Send the certificate request, along with documents proving your identity, to a CA
    4. When the CA is satisfied that you are indeed who you claim to be, they will send you a digital certificate
    5. Install this certificate on your Web server, and begin handling secure transactions
  • CA-signed certificate provides two important capabilities for your server:
    • Browsers will (usually) automatically recognize the certificate and allow a secure connection to be made, without prompting the user.
    • When a CA issues a signed certificate, they are guaranteeing the identity of the organization that is providing the Web pages to the browser.
  • Problem with a CA is they cost money
  • As an option, can create self-signed certificates
    • Says to clients, "trust me"
    • Does not offer any real assurance

  • For your site, you decide which approach to use for certificates
  • For today's lab, we will create self-signed certificates for testing

4.4.4: Creating and Installing Self-Signed Certificates

  • Both Apache and IIS allow you to create self-signed certificates
  • Instruction below for creating and installing these certificates

Apache on Linux

  • OpenSSL is a library installed with the operating system
  • Can find the location of OpenSSL
  • which openssl
  • We will be using the OpenSSL library to create our certificates

    Create the Certificates

  1. Download the script newcert-ca.sh and save it in the /home/cis164/ directory
  2. Open a terminal emulation window, if not already opened
  3. Login as the superuser, if you are not already.
  4. su -l root

    You will be prompted for the root password

  5. In the terminal window, change directories:
  6. cd /usr/local/apache2/conf
  7. Copy the script file from /home/cis164/newcert-ca.sh
  8. cp /home/cis164/newcert-ca.sh .

    Do not forget the dot at the end.

  9. Change permissions to make the script executable:
  10. chmod 700 newcert-ca.sh
  11. Execute the script to create your own Certificate Authority (CA)
  12. ./newcert-ca.sh
  13. When the script asks what you want to call your CA, enter: cis164
  14. what is or what do you want to call your CA
    cis164
    

    You will see various output as the OpenSSL program and the script does its work.

  15. When the script asks you for a password, enter: password
  16. Enter PEM pass phrase: password
    Verifying password - Enter PEM pass phrase: password
    

    We use password because it is easy to remember. This is not a good practice in the real world.

  17. When you are prompted for the PEM pass phrase, enter: password
  18. Enter PEM pass phrase: password
    
  19. At this point you will be asked to enter information that will be incorporated into your certificate request. Make sure you enter all the required fields as shown:
  20. Country Name (2 letter code) [US]:
    State or Province Name (full name) [Utah]:California
    Locality Name (eg, city) [Magna]:Santa Cruz
    Organization Name (eg, company) [ZENEZ]:Cabrillo
    Organizational Unit Name (eg, section) [Certific...]:
    Common Name (eg, ZENEZ Root CA) []:Cab Root CA
    Email Address []:
    
  21. When you are promted to enter a name for a cert, enter: localhost
  22. Generate cert for <www.domain.com>
    What do you want to call this cert?
    localhost
    
  23. Next you will be asked to enter data for incorporation into the certificate request. Make sure you enter all the required fields as shown:
  24. Country Name (2 letter code) [US]:
    State or Province Name (full name) [Utah]:California
    Locality Name (eg, city) [Magna]:Santa Cruz
    Organization Name (eg, company) [ZENEZ]:Cabrillo
    Organizational Unit Name (eg, section) [Secure...]:
    Common Name (eg, www.domain.com) []:localhost
    Email Address []:
    
  25. When asked if you want to sign the certificate, answer y
  26. Sign the certificate? [y/n]:y
    
  27. When asked if you want to commit the certificates, answer y
  28. 1 out of 1 certificate requests certified, commit? [y/n]y
    

    Update ssl.conf

    When the script for creating certificates is done, it will display a message similar to:

Please Use the /usr/local/ssl/cis164/certs/ssl/localhost_httpsd.key
Please Use the /usr/local/ssl/cis164/certs/ssl/localhost_httpsd.cert

    This key and cert must be entered into your ssl.conf file

  1. Set the SSLCertificateFile to the cert value
  2. Set the SSLCertificateKeyFile to the key value
  3. Restart the Server

  4. To stop Apache, type the following and press the Enter key:
  5. /usr/local/apache2/bin/apachectl stop

    After a few moments, the command prompt will return. If no error message is reported, then Apache stopped successfully.

  6. To start Apache, type the following and press the Enter key:
  7. /usr/local/apache2/bin/apachectl -D SSL -k start
    Note that we had to explicitly specify the use of SSL.

    After a few moments, the command prompt will return. If no error message is reported, then Apache started successfully.

  8. Try accessing https://localhost with your browser
  9. You will now have access to the localhost using https.

IIS on Windows XP

  1. Open the Computer Managment window by clicking the Start menu and then right-clicking on My Computer
  2. Select Manage from the popup list
  3. Expand the Internet Information Services tree until you see Default Web Sites
  4. Right-click on Default Web Sites and select Properties
  5. Choose the Directory Security tab and you should see the following window

  1. Click on the Server Certificate button to open the Web Server Certificate Wizard
  2. Click the Next button

  1. Select Create a new certificate and press the Next button
  2. Select Prepare the request now, but send it later and press the Next button

  1. In the next four windows, enter the appropriate information
    • When in doubt, use any defaults provided
  2. Save the certreq.txt file in the suggested location
  3. Press the Next and Finish buttons until done

    Create and Install the Certificate

  • At his point we have a certificate request to process
  • Can send the certificate to a Certifcate Authority for processing
  • Can use Microsoft Certificate Services 2.0 to create our own certificate
    • Can be installed under Windows Server 2003 and Windows 2000 Server only
  • When we get a certifcate returned, can install it by restarting the Web Server Certificate Wizard
  • More Information

  • Note the article Enabling SSL in IIS on Windows XP Professional
    • Describes a process for creating our own certificates using OpenSSL and Perl
    • Would be a good student project
  • Certificate Services
  • If IIS is running, can view the documetation for Obtaining a Server Certificate

Lab Exercise 4.4

Instructions:

  1. Label this exercise: Lab 4.4
  2. Use the next 10 minutes to answer the following questions.
  3. Do not submit exercises until all of them from today's lesson are finished
  4. Complete the Specific Instructions and answer the Exercise Questions that follow

Exercises and Questions

  1. In what situations would you want to set up a SSL server?
  2. Once you have a working Web server, configure HTTPS support for the server (at least as far as possible). Allow access to a particular directory using HTTPS. Can you access the directory with a https: URL in a browser? What happens when you try to access the directory using a standard HTTP: URL?

4.5: Virtual Hosts

Objectives

At the end of the lesson the student will be able to:

  • Describe the basics of Virtual Hosting
  • Describe how to configure Virtual Hosts on your server

4.5.1: About Virtual Hosts

  • Single machine can host many Web sites
  • Typically, a server has only one IP address, but it can have many
  • Since domain name simply points to IP address, server can host many domains
  • Additional domains associated with a server are called virtual hosts
  • Two types of virtual hosts

IP-based Virtual Hosts

  • Have unique IP addresses, just like a normal host
  • HTTPD just listens for requests on a particular IP address
  • Single network interface can be assigned multiple addresses
  • For instance, can add virtual IP address on Linux/UNIX:
  • /sbin/ifconfig eth0:0 172.30.1.XXX
  • Where the XXX is our particular subnet
  • To verify, enter ifconfig without argument to list addresses:
  • /sbin/ifconfig
  • Then create an IP-based virtual host for each virtual IP on the server
  • <VirtualHost 172.30.1.XXX>
        ServerName vhost.somedomain.com
        DocumentRoot /some/doc/path
    </VirtualHost>
    

Name-based Virtual Hosts

  • Name-based virtual hosting does not have a unique IP address
  • One IP address can have many names pointing at it
  • Relies on DNS to provide address records and aliases for the host machine
  • Once a domain is registered or a subdomain is added to the DNS tables, it can be pointed at just about any IP address
  • Up to Web server to determine the domain of incoming requests
  • Hostname is sent in the HTTP headers as the Host header in HTTP 1.1
  • If the client is not HTTP 1.1 compliant, server is unable to determine which server the client is attempting to access
  • IP-based virtual hosts are the better choice for HTTP 1.0 clients

Lab Exercise 4.5

Instructions:

  1. Label this exercise: Lab 4.5
  2. Use the next 10 minutes to answer the following questions.
  3. Do not submit exercises until all of them from today's lesson are finished

Exercises and Questions

Note that we cannot set up a virtual host in the classroom because we do not have DNS available.

  1. What is a virtual host?
  2. What are the benefits of Virtual Hosts?
  3. What is required to set up a virtual host on a server?

Wrap Up

  • When class is over, please shut down your computer
    Main Menu => Logout => Shut Down
  • Due Next: N/A

  • You may complete unfinished exercises at any time before the next class.
  • Be sure to submit the file to the instructor before the beginning of the next class to receive credit.
  • Instructions on submitting exercises are available from the HowTo's page.

Home | WebCT | Announcements | Schedule | Expectations | Syllabus
| Help | FAQ's | HowTo's | Links

Last Updated: 7/16/2003 4:45:35 PM