Duncansapien’s Techblog

Overview

Our Dell Poweredge 2850 Novell NetWare 6.0 server in Languages runs the Apache NLM. This has been reconfigured to serve audio-video files from volume \somfs1_media:AV_Media without providing a directory listing to prevent folder browsing.

The idea is that this server will serve the AV files, but that the URl to any file will be visible only to staff using a separate web server. This permit staff to preview a file, copy the link (URL) butdisallows students from browsing files which staff don’t wish them to have access to, perhaps for viewing later in the term.

In what follows, drive M: maps to Novell volume \somfs1_media.

Technical

Under \somfs1_sys: one finds the Apache folder, and in here we have the NCF files to start and stop Apache:

• apachestart.ncf
• apachestop.ncf

which may be run from the System Console (using Afreecon.nlm, for example, installable from N:admininstallAdRem Free Remote Console 5.0 where N: maps to \SOMFS2).

We also have httpd.conf with relevant lines:

DocumentRoot "media:/AV_Media"

<Directory "media:/AV_Media">
Options FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
Allow from all
</directory>

and a simple index.html page was written to notify users that browsing the folder structure was not permissable. We want to DNS register this instance of Apache as media.sml.hw.ac.uk (137.194.94.25 - which also matches somfs1.lan.hw.ac.uk) and open up the web server to global access on port 80. (Requested of UICS Jan 04 2008).

Protecting the Service

Finally, NDS container objects som.staff.hw and staff.lan.hw were granted [R F] access to index.html, index.php and the images folder underneath M:AV_Media to protect against accidental deletion.

Summary

1. Novell NetWare 6.0 Server SOMFS1, a Dell Poweredge 2850, now runs Apache as http://media.sml.hw.ac.uk, served from \SOMFS1_Media:AV_Media
2. Only basic HTML is supported - no PHP support nor Perl nor CGI of any kind is configured, for security.

Overview

SML currently runs Apache 1 and Apache 2 instances on the same physical Windows PC. The Apache 2 instance permits PHP scripts whereas the Apache 1 does not. It may be advantageous to merge these two servers into one and just use PHP security to deny execution of PHP scripts in normal user folders.

Apache2 and PHP

• Apache 2 was installed to Duncan’s PC (somdjppc.som.hw.ac.uk) under c:Apache2.
• PHP5 was also installed to C:Apache2php5.1.4
• MySQL 5 is already present, under C:MySQL

PHPMyAdmin

• PHPMyAdmin permits web-based administration of MySQL and was installed to folder C:Apache2htdocsphpMyAdmin-2.6.4-pl3.
• In order to work, the local MySQL database requires to have users and tables established by running the scripts within folder C:MySQLscriptsphpadmin.
• Once the above scripts have been run, one configures config.inc.php with the database hosts and credentials which the software is permitted to use.

HelpSpot

• The Helpspot helpdesk utility was copied from s:apache2htdocshelpspot_1.3.1 to c:apache2htdocsHelpspot_1.3.1.
• The Zend Optimiser (required to serve encrypted PHP files used by Helpspot) was run from N:admininstallPHPZend.

Helpspot has embedded database credentials in it’s config file, but the MySQL database to which it connects is configured to permit connections only from our official webserver (www.sml.hw.ac.uk). To permit connection from Duncan’s test machine the following code was executed on the SML Database PC (80.146):

GRANT ALL PRIVILEGES ON helpspot.*
TO ‘helpspot’@’somdjppc.som.hw.ac.uk’
IDENTIFIED BY ‘-removed-’
WITH GRANT OPTION;

This is a modified fragment of the Helpspot installation SQL code held under \somfs2users2:sqlserverBackupMySQL5Scriptshelpspot

• Helpspot is then configured by editing config.php
• Helpspot is accessed via: http://somdjppc.som.hw.ac.uk/helpspot_1.3.1/admin.php

Testing the above shows Helpspot runs perfectly on the Apache 2 test setup, and thus can be easily moved to another Apache server.

Serendipity 0.9.1

This tech-blog is downloadable from http://www.s9y.org/ which also has detailed installation instructions.

The files were copied from s:apache2serendipity to c:apache2serendipity. During the original installation, one follows and installation script which ensures everything is in the right place, so copying the entire folder might be expected to generate some problems.

The local config file serendipity_config_local.inc.php stores the MySQL database credentials, which do not require modification as again, they refer to the SML Database PC (80.148).

The Database PC instance of MySQL requires configuration so that the Serendipity credenentials are accepted from the new Apache 2 instance under test here, and so the following code was executed using PHPMyAdmin:

GRANT ALL PRIVILEGES ON serendipity.*
TO ‘-removed-’@’somdjppc.som.hw.ac.uk’
IDENTIFIED BY ‘-removed-’
WITH GRANT OPTION;

This is a modified fragment of the Serendipity installation SQL code
held under \somfs2users2:sqlserverBackupMySQL5Scriptsserendipity

Serendipity should now be ready for testing. Opening the local Apache 2 Serendipity web page http://127.0.0.1/serendipity/ generates error:

"Warning: Smarty error: unable to read resource: "" in C:Apache2htdocsserendipitybundled-libsSmartylibsSmarty.class.php on line 1088"

A problem anticipated by moving the folder rather than re-installing it. See Serendipity forum on this exact error which suggests damaged files. This could have occured during a global search and replace that recently took place on these files. Re-installing afresh should resolve this.

Using VMware

With the success of the above trials, a VM was created using Apache 2.2 and based on a Windows XP pro SP2, with 6Gb HDD. The VM was created on Duncan’s Buffalo USb drive in folder XPSP2_6Gb_Apache2.

The IP number assigned was 137.195.80.145

Apache was installed to C:Apache2.2 and the httpd.conf modified to support virtual hosts. Of immediate interest is the support of the PHP script which would be placed within folder M:AV_Media (where M: maps to \SOMFS1, our Novell 6.0 server). This script is described elsewhere but is basically a modified PHP-based file browser, modified (by Duncan) to permit preview of audio/video files found in folders.

Network-drive Documentroot Problem

The c:winntsystem32driversetchosts file was modifed to test virtual hosting.

A line mapping media.sml.hw.ac.uk to the IP number of the Apache server was made (to save making an actual DNS change at this time).

When this URL is mapped - in httpd.conf - to a documentroot on the C: drive, all works well. However, when it is mapped to the actual Novell drive, M:AV_Media, Apache throws an error when starting. This has also been reported here - see also another article Running Apache with DocumentRoot on a Mapped Drive.

For Linux there is a workaround described here - might be of interest one day.

However, the current SML webservers used, until recently, to service documentroot from the S: drive of our Novell server, so Apache can service network-based documentroot. Why does it crash here then?

Network Documentroot Crashing - Solved: Dec 18th 2007

Apache 2.2.6 under Win32 can service a documentroot on a network drive. If one starts Apache as a service, it fails, even if one configures the service to run as the Windows login used by the web server. However, just double-clicking the c:apache2.2binhttpd.exe file and opening Apache in a console permits all virtual hosts specified (see below) to be viewed, even those with documentroot on a network drive.

The relevant sections of c:apache2.2confhttpd.conf are:

-to be inserted -

The contents of c:apache2.2confextra–insert- is:

-to be inserted -

Documentroot Size Considerations

Resiliance is provided by having the Apache webserver serve a copy of s:apachehtdocs from it’s local c: drive, so that a web prescence is maintained in the event of problems connecting to drive s:.

The current size (Jan 2008) of S:apachehtdocs is 2.5Gb.

In a VMware environment, the ideal scenario is

• a small VM having only the OS and Apache server configured
• a separate (possibly) virtual disk holding the documentroot

Ok, in a proper VMware environment one would use a SAN or some other external storage but this isn’t yet available in SML. To keep things easy, one should still create a small VM and host the documentroot on a separate virtual disk - named, say, drive D:

However - for the time being, since a proper VMware (VI3) solution will doubtless be implemented in 2008, it may be sufficient to host the Apache server and documentroot in a single VM.

Overview

Apache on the SML Novell 6.0 server SOMFS1 (Languages, Dell Poweredge 2850) was started.

Details

The config file \somfs1sys:apacheconfhttpd.conf was based around that on SOMFS2, but the main difference was that documentroot was set to be \somfs1mirror:scratchapache2htdocswma for testing of video serving.

Apache is started by entering ApacheStart at the console, and stopped with ApacheStop. These are NCF files under \somfs1sys:apache.

To Be Done

The log file location should be changed to a non-SYS volume.

PHP

Not yet installed, see

• installation article.
• Novell Download Site.
• NDK Documentation: PHP for NetWare
• aa

Making Apache case-insensitive:

Scenario:

Html
files are held on the Scratch drive of a Novell NetWare 6.0 server, currently
served by a Apache32 which is case-insensitive. A Linux solution is
naturally case sensitive, so we need a way around this if we are to replace the Windows Apache server with a Linux one.

Versions:

• Novell NetWare 6.0
• Suse Linux 10.1 with Apache 2.2.0-21.7

Links:

• Mount webroot as a Samba share
• Use module mod_speling

Here’s the Plan

1. Mount the Novell server volume holding the Apache htdocs folder using ncpmount
2. Create a Virtual Host on Apache which will use this htdocs as it’s document root
3. Use mod_speling in this vhost to ignore case.

And here’s what actually worked

1. Mount the Novell server volume holding the Apache htdocs folder using ncpmount
2. When
   creating a vhost to serve the Novell htdocs folder, Apache will not,
   for some reason, serve html documents. It will serve text files, but
   not .htm or .html files and nothing appears in the error logs. Quite
   bizarre.
   • As a workaround, create a normal directory for
     the Vhost in question and use rsync to copy the Novell directory
     contents into this vhost directory. Long file names are copied just
     fine.
3. Load the mod_speling module into the Vhost config file and indeed, URLs are now case insensitive.

Important: DNS and Name Resolution in this article

In using the Vhost name of sml2.som.hw.ac.uk it’s important to remember that, in this test, this name is not actually DNS registered. To get the Linux machine to resolve this one must add this to the /etc/hosts file, with the same IP number as the suse01.som.hw.ac.uk host itself. On Windows, one must edit the hosts file under C:WINDOWSsystem32driversetc by including the line:
137.195.80.104 sml2.som.hw.ac.uk itc.som.hw.ac.uk

The Files Involved in this article:

a) The Novell Server mount point

• > mkdir /mnt/somfs2 [as root]
• > chown wwwrun.nwaccess /mnt/somfs2 [so that the Apache process - wwwrun- can access the folder]
• > chmod a+rx /mnt/somfs2 [so all Linux users can read this mount]
• > cd /mnt/somfs2
• > chown wwwrun.nwaccess . [so that Apache owns the folders/files actually mounted here]
• > chmod a+rx . [so all Linux users can read this mount, makes things easier]

The SCRATCH volume of Novell server SOMFS2 is mounted via the command

• ncpmount
  -S somfs2 -A somfs2.som.hw.ac.uk -V SCRATCH -U somweb.som.staff.hw -P
  thepassword -u 30 -g 1000 /mnt/somfs2 -d 0755 -f 0755

Here, somweb is the Novell webserver login, whose password is given after -P. The -u and -g
options specify that the mount process is to be owned by the user with
uid 30 (wwwrun) and group having guid 1000 (nwaccess); both can be
determined by viewing /etc/passwd /etc/group.

The -d and -f options
specify the file permissions with which the folder is to be mounted;
the first digit - a zero - indicates … I’ve forgotten, but 755 is
u=rwx,g=rx,o=rx.

In testing, the above command was
saved as a Bash shell script in /home/somdjp/apache_mount.sh and called
by root but ncpmount is flagged suid. Thus, the command runs with
privilieges of the file ownership, which is root, so it need not be
called by root. Check this with ‘>whereis ncpmount’ and ‘ls -l
/usr/bin/ncpmount’ which will return -rwsr-x—.

After mounting, we have this directory structure (where the red text represents folders on the Novell folder): /mnt/somfs2/Apache/htdocs/

b) The Apache Virtual Host: Config File

A virtual host (Vhost) was created by means of creating file /etc/apache2/vhosts.d/vhost-sml2.som.hw.ac.uk.conf

The contents of this file are below, the most important parts being documentroot and mod_speling.

<VirtualHost 137.195.80.104>
ServerAdmin D.Potter@hw.ac.uk
ServerName sml2.som.hw.ac.uk

# Duncan: Enable mod_speling

LoadModule speling_module /usr/lib/apache2/mod_speling.so
CheckSpelling On

DocumentRoot /srv/www/vhosts/sml2.som.hw.ac.uk/htdocs

# Default MIME typer - for text and html documents
DefaultType text/plain
Loglevel error
Alias /icons/ /srv/www/vhosts/sml2.som.hw.ac.uk/Apache/icons/
</VirtualHost>

c) The Apache Virtual Host Document Root

Remember, this is a real directory whose contents will be served by the Apache vhost. The contents of this folder are the same as the Novell mounted htdocs folder, and the rsync program will be used to copy the contents across. For some unknown reason, despite much effort, the Apache vhost cannot serve html documents from the Novell mounted htdocs folder, so we have to use this mechanism to get past this.

The documentroot is /srw/www/vhosts/sml2.som.hw.ac.uk/htdocs.

Using Rsync

In testing, only one folder under the Novell mounted htdocs was copied, and this was gb6.

• Novell: \somfs2scratchapachehtdocsgb6
• Suse: ncpmount’ed as /mnt/somfs2/Apache/htdocs/gb6
• Suse: rsync’ed to /srv/www/vhosts/sml2.som.hw.ac.uk/htdocs/gb6

The rsync command was [rsync options source destination]

• > rsync -avr /mnt/somfs2/Apache/htdocs/gb6 /srv/www/vhosts/sml2.som.hw.ac.uk/htdocs/gb6

which duly populated our Vhost htdocs documentroot. To remove files in the destination which are no longer in the source one would use the –delete option:

• > rsync -avr –delete /mnt/somfs2/Apache/htdocs/gb6/ /srv/www/vhosts/sml2.som.hw.ac.uk/htdocs/gb6/

Making Apache Case Insensitive

The subject of this article! All that’s required is

1. Track down where the Apache modules are held
2. Add the following lines to the Vhost.conf file in question (vhost-sml2….conf):
   • LoadModule speling_module /usr/lib/apache2/mod_speling.so
     CheckSpelling On
3. Restart Apache
   • > rcapache2 restart

Apache is now case-insensitive. Actually, when you type in a URL using the wrong case, Apache finds the file anyway and serves that so the web-browser location shows the proper, Linux filename. However, the case-insensitivity only applies to file names - not directory names. Example

• Correct URL is: http://sml2.som.hw.ac.uk/gb6/BroughtonRD/Tour.htm
• Changing the filename case works: http://sml2.som.hw.ac.uk/gb6/BroughtonRD/toUR.htm
• Changing the directory case fails!: http://sml2.som.hw.ac.uk/gb6/broughtonrd/Tour.htm

Sub-topic: Apache Installation
Apache
2 was installed using Yast under Suse 10.1 on the VM. Perl, PHP etc
were NOT installed to keep things simple at this stage. Installation
was from the DVD source of Suse 10.1 and went without a hitch.

Stages:

1. Login to Suse 10.1 with the KDE environment and launch Yast
2. Under Software Management - search for Apache. Found Apache 2.2.0-21.7 on the DVD (install).
3. Start Konqueror and enter http://localhost - an error message is obtained.
4. SU to root then
   • > chkconfig | grep apache [finds that Apache2 is off]
   • > service apache2 start [to start the service]
   • > service apache2 status [shows it is now running]
5. Again try Konqueror and localhost: "Access Forbidden"
6. Locate the Apache home folder (the hard way)
   • cat /etc/passwd | grep www
   • The response to the above is > wwwrun:x:30:8:www daemon Apache:/var/lib/wwwrun:/bin/false
   • The easy way: Google reports that Apache has web root under /srv/www/htdocs and the config file resides under /etc/apache2/httpd.conf
7. All the interesting Apache config files are in /etc/apache2 and are loaded by httpd.conf. The first one to look at is default-server.conf which cites Documentroot: /src/www/htdocs
8. Looking
   at /src/www/htdocs (ls -lF) one has drwxr-xr-x (so global read) but the
   folder is empty - explaining the error, as no index.html file is found.
   The resolution:
   • > cd /srv/www/htdocs
   • > echo hello > index.html
   • > chmod go+r index.html
   • Konqueror and localhost: now displays hello!
9. Adding Apache2 to the list of startup services:
   • > chkconfig –add apache2 [reports is ON for runlevel 3,5]
   • > chkconfig apache2 status [-> "illegal runlevel specified to apache2:t"]
10. The illegal runlevel is odd; checking with the Yast: System-runlevel editor it looks ok and certainly works.

See also this Novell link - with Apache, PHP and MySQL installed via Yast. Also, better, Suse 10.1 and Apache and The Perfect Setup: Suse 10.1 P6 which deals with Apache installation.

Sub-topic: Apache Virtual Hosts

The best article on this so far found is "Simplify Your Life with Apache Virtual Hosts" [Ref 2]

Setting up a vhost for itc.som.hw.ac.uk:

• The Linux host is named suse01.som.hw.ac.uk (137.195.80.104) - we want this name to load the default server homepage, as in a regular Apache setup.
• We also want http://itc.som.hw.ac.uk to be hosted on this Apache server, and bring up it’s own home page.
• This is done by Virtual hosting (vhosts) - the basis of which is that the browser sends the name of
  the website to the Apache server with each request. The Apache server
  then reads the name and responds with the correct homepage.
• Each vhost is configured by it’s own config file as explained in Ref 2 above.

One last thing - in testing this, the DNS only has the one site listed for this IP number (suse01…). For the browser to correctly locate the itc.som… site, we need to add this to /etc/hosts on Suse.

1. Copy /etc/apache2/vhosts.d/vhost.template to vhost-local-www.itc.sml.hw.ac.uk.conf
2. Edit /etc/hosts to include the virtual host:
   127.0.0.1 localhost
   137.195.80.104 itc.som.hw.ac.uk
3. > chmod a+rx /etc/apache2/vhosts.d/vhost-itc.som.hw.ac.uk.conf [so that it is readable by ugo].
4. Create the home folder for the vhost
   • > mkdir /srv/www/vhosts [because it doesn't exist]
   • > chmod a+rx /srv/www/vhosts [to make it world readable]
   • > mkdir /srv/www/vhosts/itc.som.hw.ac.uk
   • > chmod a+rx /srv/www/itc.som.hw.ac.uk [grant all read, execute permissions]
   • Create a simple index.html page in this folder and chmod a+rx it.
5. Restart the Apache server with: service apache restart
6. Konqueror and localhost: jumps straight to the itc.som.hw.ac.uk home page, not the ‘default’ home page.
7. Here’s the solution: "Apache Howto Quickstart - openSuse" [Ref] - under the section entitled "Add Virtual Hosts", it’s written:
   • "the "default" server, which responds to requests not handled by other vhosts, is always the one which is defined first.
     If you want a dedicated "default" server for such requests, you need to put it first in the configuration.
     Consequently, if the configuration is in multiple files, like /etc/apache2/vhosts.d/*.conf, then simply name it _default.conf, or e.g. _192.168.0.1.conf if you do it per IP address. Then it is read first."
   • File /etc/apache2/vhosts.d/_default.conf was created with document root set
     to /srv/www/htdocs and servername set to 137.195.80.104.

   • > service apache2 restart
   • Konqueror correctly finds the default home page, but the itc.som.hw.ac.uk link doesn’t work. Require to configure
     /etc/apache2/listen.conf

   • Slight config mistake: in
     vhost-itc.sml… the <virtualhost …> header line needs
     to be changed to <virtualhost 137.195.80.104>

8. Starting Apache (> service apache2 restart) results in a warning that:
   "NameVirtualHost *.80 has no virtual hosts"
   This is a VERY common Google search (sigh).
9. The best answer to 8. above is here -
   this removes the above error, but only the default homepage appears and
   not the vhost.
10. Here’s the resolution. One has
    to be VERY careful about the vhosts.conf files and NamedVirtualHost
    settings, but these are well described here.

What worked:

And a comment-removed version of /etc/apache2/httpd.conf reads: