H Apache Server Installation and Configuration

H.1.1 Running AUTOGEN

After the installation, when you have a normal system workload running on your machine, run SYS$UPDATE:AUTOGEN.COM (AUTOGEN) to evaluate the system parameters and make adjustments based on the hardware configuration and system workload. On Oracle HTTP Server, AUTOGEN will probably increase the page file size and the number of swap file pages.

H.1.2 Check Disk Quota

If the disk quota is too low, then Oracle HTTP Server will not start. Either raise the disk quota for the Oracle Database account or grant the account the EXQUOTA privilege, which enables it to bypass disk quota restrictions. Use the following commands:

$ SHOW QUOTA/USER=[server-uic]/DISK=device_name
$ SET PROCESS/PRIVILEGES=EXQUOTA node-name::ORACLE

H.1.3 Checking for SET TERMINAL/INQUIRE

When Oracle HTTP Server for OpenVMS is started, the following login files are run:

• SYS$MANAGER:SYLOGIN.COM

• LOGIN.COM (login for the Oracle Database account)

Check these files to ensure that any SET TERMINAL/INQUIRE statements are processed only in the INTERACTIVE mode. For example:

$ IF F$MODE() .EQS "INTERACTIVE" THEN $ SET TERMINAL/INQUIRE

If you do not check for this, then the HTML that is sent to clients may not be well-formed and may be sent in an intermittent fashion. This problem may also appear when running CGI scripts.

H.2.1 Browser Test

You can test the installation using a Web browser. Replace host.domain in the following URL with the corresponding information about Oracle HTTP Server that you installed:

HTTP://host.domain:port

If this is a new installation, then the browser should display the standard introductory screen with the following bold text at the top:

"Welcome to Oracle HTTP Server."

The Apache logo is displayed at the bottom.

H.2.2 Troubleshooting

If you do not receive a response from Oracle HTTP Server, check the following:

• In the SYS$MANAGER:SYLOGIN.COM file, ensure that there is no SET TERMINAL/INQUIRE statement for network processes.

• Look for the following files:

  APACHE$ROOT:[000000]APACHE$SERVER.LOG
  APACHE$ROOT:[LOGS]ERROR_LOG
  

H.3.1 Starting and Stopping the Server

To start Oracle HTTP Server, enter the following command:

$ APACHECTL STARTUP

To stop Oracle HTTP Server, enter the following command:

$ APACHECTL STOP

H.3.2 Server Log File

The server log file for APACHE$WWW is written to:

APACHE$SPECIFIC:[000000]APACHE$SERVER.LOG

H.3.3 Customizing the Server Environment

The installation procedure creates a file named HTTPD.CONF and places it in APACHE$ROOT:[CONF]. The HTTPD.CONF file stores information that Oracle HTTP Server uses to set up the server environment. The HTTPD.CONF file has been tailored to use OpenVMS syntax, but its overall functionality is essentially identical to httpd.conf on the UNIX platform.

The HTTPD.CONF file contains an explanation for each line that it can process. You can refer to these explanations when customizing the file for your environment. You can also refer to any generally available Apache documentation on HTTPD.CONF.

Note the following about HTTPD.CONF on OpenVMS:

• MOD_OSUSCRIPT has been added to enable CGI scripts that were originally written for the OSU server.

• UNIX-style path names are recognized by OpenVMS. You can use either UNIX-style or OpenVMS-style path names in the configuration file. However, you cannot mix the two styles within a specification.

• In an OpenVMS Cluster, you can specify either clusterwide or system-specific files.

H.3.4 How to Configure Apache

Perform the following steps to configure Apache to run while using an account other than the Oracle Database account:

1. Modify the HTTPD.CONF file to include the following line:

   User username
   
   

2. Modify APACHEUSER.COM to set the logical APACHE_USERNAME to the required user name. Ensure that the user name is exactly the same as the entry in the HTTPD.CONF file.

3. Restart the Apache Server if it is already running.

H.3.5 Modules and Directives

The Oracle HTTP Server provides the modules and directives that are provided by the HP Secure Web Server for OpenVMS (based on Apache), Version 1.3-1. Please refer to the HP documentation for that product for more information. All supported modules and directives function as documented by the Apache Software Foundation at:

http://www.apache.org/docs

H.3.6 Supported and Unsupported Features

Information about running Oracle HTTP Server that is specific to running the server on OpenVMS is provided in the following sections.

$ HTTPD -option

$ HTTPD "-L"

H.3.7 File Formats

All file formats are supported. However, the Web browser status bar will not show page loading progress for Variable or VFC format files larger than 8 KB.

Page loading progress relies on an accurate byte count, which is not readily available for files in Variable or VFC format. For files in these formats, Oracle HTTP Server must count the bytes as the files load. The counting process can slow performance, so it has been turned off in this situation.

H.3.8 File Naming Conventions

In general, users running Oracle HTTP Server for OpenVMS can specify either UNIX-style file names or OpenVMS-style file names. Oracle HTTP Server usually displays UNIX-style file names.

The On-Disk Structure Level 5 (ODS-5) volume structure, shipped with OpenVMS version 8.2, supports long file names, enables the use of a wider range of characters within file names, and preserves case within file names. However, the DEC C RTL that is shipped with OpenVMS Alpha version 7.2-1 does not provide full support for extended file names on ODS-5 devices. This lack of full support imposes certain restrictions on users running Oracle HTTP Server for OpenVMS.

Because mixed UNIX-style and OpenVMS-style extended file names are not yet supported by the DEC C RTL, you may be required to use UNIX-style syntax when interacting with Oracle HTTP Server. An example would be appending additional directories or a file name to a root.

The following examples illustrate mixed UNIX-style and OpenVMS-style file names that are not supported in OpenVMS version 8.2:

doc/foo.bar.bar
./tmp/foo.bar.b^_ar
~foo^.bar

You can, however, modify the last example so that it works as an OpenVMS extended file name that has a tilde (~) as the first character. Precede the leading tilde (~) with the Extended File Specifications escape character (^) as shown in the following example:

^~foo^.bar

For more information about using the tilde (~) in OpenVMS extended file names, refer to the OpenVMS Guide to Extended File Specifications at the following Web site:

http://h71000.www7.hp.com/doc/73final/6536/6536PRO.HTML

H.3.9 File Transfer Process and Access Control List

When performing an FTP operation, ensure that the access control list (ACL) for the target directory on Oracle HTTP Server has FTP access enabled as follows:

When transferring new files:

$ SET SECURITY/ACL=(IDENTIFIER=yourFTPname,ACCESS=READ+WRITE) [directory]

When replacing existing files:

$ SET SECURITY/ACL=(IDENTIFIER=yourFTPname,ACCESS=READ+WRITE) [directory]*.*

H.3.10 Logical Names

Oracle HTTP Server for OpenVMS creates the following logical names, which are listed with their descriptions in table Table H-2.

H.3.11 OpenVMS Cluster Considerations

An OpenVMS Cluster is a group of OpenVMS systems that work together as one virtual system. Oracle HTTP Server runs in an OpenVMS Cluster so that you can take advantage of the resource sharing that increases the availability of services and data.Bear the following points in mind:

• Oracle HTTP Server is supported on OpenVMS Version 8.2-1 or later.

• Oracle HTTP Server runs in an Alpha Itanium, or in a mixed architecture cluster, separate Apache installations are required for Alpha and Itanium.

$ EDIT APACHE$COMMON:[CONF]HTTPD.CONF

$ EDIT APACHE$ROOT:[CONF]HTTPD.CONF

DocumentRoot "/apache$common/htdocs"
        ...
      <Directory "/apache$common/htdocs">
      Options Indexes FollowSymLinks Multiviews
      AllowOverride None
      Order allow,deny
      Allow from all
      </Directory>

H.3.12 CGI Programs

Common gateway interface (CGI) programs run within the DCL shell on Oracle HTTP Server for OpenVMS. This section discusses the following CGI topics:

• Section H.3.12.1, "CGI Environment Logical"

• Section H.3.12.2, "Referencing Input"

• Section H.3.12.3, "Running CGI Images"

• Section H.3.12.4, "Logical Names for Debugging CGI Scripts"

• Section H.3.12.5, "Displaying Graphics with CGI Command Procedures"

APACHE$CGI_MODE      option 

APACHE$DCL_ENV [-c] [-d] [-e env-file]

Example: diff_mode_cgi.com
$ APACHE$DCL_ENV -d
$ Define APACHE$PREFIX_DCL_CGI_SYMBOLS_WWW 1
$ APACHE$DCL_ENV -c

APACHE$DCL_BIN [-s bin-size] bin-file

$ SAY := WRITE SYS$OUTPUT
$ SAY "Content-type: image/gif"
$ SAY ""
$ APACHE$DCL_BIN APACHE$ROOT:[ICONS]APACHE_PB.GIF
$ EXIT

H.4.1 Process Model

Oracle HTTP Server runs as a single job that consists of:

• One master process (APACHE$WWW)

• Several subprocesses

  Subprocesses are created to service incoming HTTP requests and to run CGI scripts.

Because the server runs as a single job, the OpenVMS security profile for each process is identical and no enhanced mechanism is required for these processes to communicate with one another. Resource utilization is controlled by a single user account (oracle) where pooled quotas are defined.

H.4.2 Privileged Images

Oracle HTTP Server performs three operations that require additional privileges:

• Binding to a port below 1024 (privileged ports)

  By default, the server binds to port 8080 (HTTP).

• Fetching path information for other users

  The server provides a replacement for the getpwnam C RTL routine to enable the server to fetch default path information for other users (required by MOD_UTIL and MOD_USERDIR).

• Changing the carriage-control attribute on socket (BG) devices

  The server also enables or disables (or both) the carriage-control attribute on BG (socket) devices for certain stream operations.

Two protected, shareable images are installed at startup to enable the server to perform the following functions:

• APACHE$PRIVILEGED.EXE (exec-mode services)

• APACHE$FIXBG.EXE (kernel-mode services)

The APACHE$PRIVILEGED.EXE image provides exec-mode services for binding to privileged sockets and fetching user default path information. Access to these services is limited to processes running under the oracle username and is controlled by the APACHE$PLV_ENABLE_APACHE$WWW logical name. This logical name is defined as:

"APACHE$PLV_ENABLE_APACHE$WWW" = "3,80,1023"

The "3,80,1023" string represents three parameters where:

• The first parameter (3) is a bit-mask that enables or disables the two services:

  • Binding to privileged ports

  • Fetching user default path information

• The second and third parameters indicate the minimum and maximum port that are allowed to be bound.

When a call to either service is made, the service code does the following:

1. Temporarily enables the SYSPRV, OPER, SYSNAM, and NETMBX privileges

2. Performs the function

3. Restores the process original privileges

The APACHE$FIXBG.EXE_ALPHA image provides a kernel-mode service for manipulating the carriage-control attribute for BG devices that are owned by the calling process. No special access control exists on this service. This function can also be performed using a setsocketopt C RTL run-time call, but it is not supported by all TCP/IP stack vendors, which is the reason this service exists. This service does not enable privileges, but runs in kernel mode.

H.4.3 Privileges Required to Start and Stop the Server

Oracle HTTP Server runs under the oracle username and UIC and is started as a detached, network process. During startup, protected images are installed and logical names are placed in the system logical name table. Shutdown is accomplished by sending a KILL signal to the master process and its subprocess.

In order to startup the Oracle HTTP Server, the following privileges are required:

• SYSPRV

• SYSNAM

• IMPERSONATE

• BYPASS

• CMKRNL

• ALTPRI

• WORLD

The privileges ALTPRI and BYPASS are not essential privileges for installing and running an Oracle database. These privileges can either be added to the oracle account, or a separate account can be created to maintain and run the Oracle HTTP Server.

If you have already configured Oracle HTTP Server using the oracle account and want to run under a different account, then the file ORA_ROOT:[APACHE.APACHE.SPECIFIC.node.CONF]HTTPD.CONF must be modified to change the USER parameter before attempting to start it up.

H.4.4 File Ownership and Protection

All the server files reside under the root directories that the APACHE$ROOT logical name points to. During installation, file protection is set to (S:RWED, O:RWED, G, W). During configuration, all files are set to be owned by the oracle user.

H.4.5 Server Extensions (CGI Scripts)

Server extensions, such as CGI scripts, run within the context of Oracle HTTP Server process or its subprocesses. These extensions have complete control over the server environment. You can configure the server to enable processing of arbitrary user scripts, but standard practice is to limit such activity to scripts that are written by completely trusted users. Oracle HTTP Server includes directives that enable a Web administrator to control script execution and client access. The use of these directives is described in numerous books and is not duplicated here.

H.4.6 suEXEC Not Available for Protecting Script Execution

Oracle HTTP Server for OpenVMS does not currently support the suEXEC method of running scripts under the username that owns the script. Many sites use this feature to allow execution of arbitrary, user-written scripts without the fear of compromising the server environment.

H.5.1 Apache

This product includes software developed by the Apache Software Foundation. You can visit the Web site of this organization at

http://www.apache.org/

You can view the license at the following Web site

http://www.apache.org/licenses/LICENSE-2.0

This product also includes software that is developed by Hewlett-Packard.