We are setting up an Apache\/PHP application server using the minimal number of modules necessary.<\/p>\n
A bare bones Apache server is suitable for delivering static files. More complex applications rely on dynamic content. This requires an extension of the server. A very fast and secure application server can be implemented using suEXEC<\/em>, an external FastCGI daemon<\/em> and PHP<\/em>. This is by far not the only option and also likely not the most widespread one in a corporate environment. But is a very simple architecture perfectly suited for a test system.<\/p>\n We\u2019ll configure the web server to start off with, aware of the fact that it is not yet capable of running in this configuration. Based on the minimal web server described in Tutorial 2, we\u2019ll configure a very simple application server in the conf\/httpd.conf_fastcgid<\/em> file.<\/p>\n I will no longer be discussing the overall configuration, but will instead only be focusing on the differences from Tutorial 2. There are three new modules: Added to the suEXEC<\/em> and FCGI<\/em> modules is the Mime module<\/em>, which enables us to assign the .php<\/em> file suffix to the FCGI daemon<\/em>. It is assigned using the AddHandler directive<\/em>.<\/p>\n The \/apache\/htdocs<\/em> directory now needs the additional ExecCGI<\/em> option. And finally, the FCGIWrapper<\/em>. This is the connection between the web server and the FCGI daemon<\/em> yet to be configured. Once the first request using the .php<\/em> suffix is received by the web server, the server calls a wrapper script<\/em>, starting the FCGI daemon<\/em>, which from this time on handles the PHP requests<\/em>.<\/p>\n FastCGI<\/em> is a method for executing dynamic program code from a web server. It is a very fast method which for the most part leaves the server untouched and runs the application on a separate daemon. To increase the speed, FastCGI<\/em> provides multiple instances of this daemon, allowing requests to be processed without having to wait. In practice, this is a promising gain in performance and, more importantly, an architecture that saves memory, as will be discussed in more detail below.<\/p>\n We now have to compile two missing modules and deploy other components for the FCGI daemon<\/em>. Let\u2019s start with the suEXEC module<\/em>.<\/p>\n An Apache web server was compiled in Tutorial 1. However, although the \u2013enable-mods-shared=all<\/em> option was used, suexec<\/em> has not been compiled yet. It seems, the module is so special that it can\u2019t be compiled as a default module, although it is present in the source code.<\/p>\n The web server configured in Tutorial 2 runs as user www-data<\/em> or, depending on configuration, as any other dedicated user. We would like to further restrict our dynamic application to have the separate daemon run as an additional, separate user that is introduced in one of the next steps. The suEXEC<\/em> module makes this possible for us. It is not absolutely required. But it adds a bit more security with little extra effort.<\/p>\n Let\u2019s enter the directory with the Apache source code and compile the server once more.<\/p>\nRequirements<\/h3>\n
\n
Step 1: Configuring Apache<\/h3>\n
<\/a>ServerName<\/span> localhost<\/span>\n<\/a>ServerAdmin<\/span> root@localhost<\/span>\n<\/a>ServerRoot<\/span> \/apache<\/span>\n<\/a>User<\/span> www-data<\/span>\n<\/a>Group<\/span> www-data<\/span>\n<\/a><\/span>\n<\/a>ServerTokens<\/span> Prod<\/span>\n<\/a>UseCanonicalName<\/span> On<\/span>\n<\/a>TraceEnable<\/span> Off<\/span>\n<\/a><\/span>\n<\/a>Timeout<\/span> 10<\/span>\n<\/a>MaxRequestWorkers<\/span> 100<\/span>\n<\/a><\/span>\n<\/a>Listen<\/span> 127.0.0.1:80<\/span>\n<\/a><\/span>\n<\/a>LoadModule<\/span> mpm_event_module modules\/mod_mpm_event.so<\/span>\n<\/a>LoadModule<\/span> unixd_module modules\/mod_unixd.so<\/span>\n<\/a><\/span>\n<\/a>LoadModule<\/span> log_config_module modules\/mod_log_config.so<\/span>\n<\/a>LoadModule<\/span> mime_module modules\/mod_mime.so<\/span>\n<\/a><\/span>\n<\/a>LoadModule<\/span> authn_core_module modules\/mod_authn_core.so<\/span>\n<\/a>LoadModule<\/span> authz_core_module modules\/mod_authz_core.so<\/span>\n<\/a><\/span>\n<\/a>LoadModule<\/span> suexec_module modules\/mod_suexec.so<\/span>\n<\/a>LoadModule<\/span> fcgid_module modules\/mod_fcgid.so<\/span>\n<\/a><\/span>\n<\/a>ErrorLogFormat<\/span> "[%{cu}t] [%-m:%-l] %-a %-L %M"<\/span><\/span>\n<\/a>LogFormat<\/span> "%h %l %u [%{%Y-%m-%d %H:%M:%S}t.%{usec_frac}t] <\/span>\\"<\/span>%r<\/span>\\"<\/span> %>s %b \\<\/span><\/span>\n<\/a>\\"<\/span>%{Referer}i<\/span>\\"<\/span> <\/span>\\"<\/span>%{User-Agent}i<\/span>\\"<\/span>"<\/span> combined<\/span>\n<\/a><\/span>\n<\/a>LogLevel<\/span> debug<\/span>\n<\/a>ErrorLog<\/span> logs\/error.log<\/span>\n<\/a>CustomLog<\/span> logs\/access.log combined<\/span>\n<\/a><\/span>\n<\/a>AddHandler<\/span> fcgid-script .php<\/span>\n<\/a><\/span>\n<\/a>DocumentRoot<\/span> \/apache\/htdocs<\/span>\n<\/a><\/span>\n<\/a><<\/span>Directory<\/span> \/><\/span><\/span>\n<\/a><\/span>\n<\/a> Require<\/span> all denied<\/span>\n<\/a><\/span>\n<\/a> Options<\/span> SymLinksIfOwnerMatch<\/span>\n<\/a><\/span>\n<\/a><<\/span>\/Directory<\/span>><\/span><\/span>\n<\/a><\/span>\n<\/a><<\/span>VirtualHost<\/span> 127.0.0.1:80><\/span><\/span>\n<\/a><\/span>\n<\/a> <<\/span>Directory<\/span> \/apache\/htdocs><\/span><\/span>\n<\/a><\/span>\n<\/a> Require<\/span> all granted<\/span>\n<\/a><\/span>\n<\/a> Options<\/span> ExecCGI<\/span>\n<\/a><\/span>\n<\/a> FCGIWrapper<\/span> \/apache\/bin\/php-fcgi-starter\/php-fcgi-starter<\/span>\n<\/a><\/span>\n<\/a> <<\/span>\/Directory<\/span>><\/span><\/span>\n<\/a><\/span>\n<\/a><<\/span>\/VirtualHost<\/span>><\/span><\/span><\/code><\/pre><\/div>\nStep 2: Compiling Apache with suEXEC support<\/h3>\n
<\/a>$><\/span> cd<\/span> \/usr\/src\/apache\/httpd-2.4.66<\/span>\n<\/a>$><\/span> .\/configure<\/span> --prefix=\/opt\/apache-2.4.66 --enable-mods-shared=all \\<\/span><\/span>\n<\/a> --with-apr<\/span>=\/usr\/local\/apr\/bin\/apr-1-config \\<\/span><\/span>\n<\/a> --with-apr-util<\/span>=\/usr\/local\/apr\/bin\/apu-1-config --enable-mpms-shared="event"<\/span> \\<\/span><\/span>\n<\/a> --enable-nonportable-atomics<\/span>=yes --enable-suexec --with-suexec-caller=www-data \\<\/span><\/span>\n<\/a> --with-suexec-docroot<\/span>=\/opt\/apache-2.4.66\/bin