From: dgaudet Date: Fri, 27 Jun 1997 03:02:14 +0000 (+0000) Subject: Merge in all of the docs from HEAD, I'll clean it up a bit later. X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=44da8e745c09db2ae6207a48e18b2abe1ff28137;p=thirdparty%2Fapache%2Fhttpd.git Merge in all of the docs from HEAD, I'll clean it up a bit later. Reviewed by: Submitted by: Obtained from: git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/APACHE_1_2_X@78392 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/custom-error.html b/docs/manual/custom-error.html index 3f04af058b0..3165ec044e6 100644 --- a/docs/manual/custom-error.html +++ b/docs/manual/custom-error.html @@ -29,9 +29,9 @@ response, then this response can be replaced with either some friendlier text or by a redirection to another URL (local or external). - +

- +

Old behavior
NCSA httpd 1.3 would return some boring old error/problem message diff --git a/docs/manual/misc/FAQ.html b/docs/manual/misc/FAQ.html index 6c3fce52d73..e19bb35f393 100644 --- a/docs/manual/misc/FAQ.html +++ b/docs/manual/misc/FAQ.html @@ -15,7 +15,7 @@

Apache Server Frequently Asked Questions

- $Revision: 1.63.2.2 $ ($Date: 1997/06/11 21:21:39 $) + $Revision: 1.63.2.3 $ ($Date: 1997/06/27 03:02:04 $)

The latest version of this FAQ is always available from the main @@ -35,11 +35,11 @@ - + - - - + + +

@@ -131,6 +131,8 @@

  • Why can't I run more than <n> virtual hosts?
    • +
  • Can I increase FD_SETSIZE on FreeBSD? +
  • Why do I keep getting "access denied" for form POST requests?
    • @@ -205,6 +207,15 @@
  • Why doesn't mod_info list any directives? +
  • When I run it under Linux I get "shmget: + function not found", what should I do? +
    • +
  • Why does my authentification give + me a server error? +
  • Do I have to keep the (mSQL) + authentification information on the same machine? +
    • +
  • Why is my mSQL authentification terribly slow?
    • @@ -569,27 +580,48 @@

    It means just what it says: the server was expecting a complete set of HTTP headers (one or more followed by a blank line), and didn't get - them. The most common cause of this (aside from people not - outputting the required headers at all) a result of an interaction - with perl's output buffering. To make perl flush its buffers - after each output statement, insert the following statements before your - first print or write statement: + them. +

    +

    + The most common cause of this problem is the script dying before + sending the complete set of headers, or possibly any at all, to the + server. To see if this is the case, try running the script standalone + from an interactive session, rather than as a script under the server. + If you get error messages, this is almost certainly the cause of the + "premature end of script headers" message. +

    +

    + The second most common cause of this (aside from people not + outputting the required headers at all) is a result of an interaction + with Perl's output buffering. To make Perl flush its buffers + after each output statement, insert the following statements around + the print or write statements that send your + HTTP headers:

    -
    $cfh = select (STDOUT);
    - $| = 1;
    - select ($cfh);     +
    {
    +  local ($oldbar) = $|;
    +  $cfh = select (STDOUT);
    +  $| = 1;
    +  #
    +  # print your HTTP headers here
    +  #
    +  $| = $oldbar;
    +  select ($cfh);
    + }

    This is generally only necessary when you are calling external programs from your script that send output to stdout, or if there will - be along delay between the time the headers are sent and the actual + be a long delay between the time the headers are sent and the actual content starts being emitted. To maximise performance, you should - turn buffering back on (with $| = 0 or the - equivalent) after the statements that send the headers. + turn buffer-flushing back off (with $| = 0 or the + equivalent) after the statements that send the headers, as displayed + above. +

    If your script isn't written in Perl, do the equivalent thing for whatever language you are using (e.g., for C, call @@ -796,8 +828,9 @@ HREF="../mod/core.html#listen" >Listen directives. If there are no other servers running on the machine - and all of them are running on the same port, you normally don't - need any Listen directives at all. + on the same port then you normally don't + need any Listen directives at all. By default Apache listens to + all addresses on port 80.

  • Reduce the number of log files. You can use performance hints - page. + page. There is a specific note for + FreeBSD below.
  • "Don't do that" - try to run with fewer virtual hosts
    • @@ -831,6 +865,24 @@ available in the way of solutions.

    + +
  • + Can I increase FD_SETSIZE on FreeBSD? + +

    + On FreeBSD 2.2 and older FD_SETSIZE, which limits the number of open + files on the system, is limted to 256. This can limit the number of + virtual hosts you are using; especially if they all use different log + files. Increasing this limit (and recompiling apache) is not enough + (As it is on some platforms, such as Solaris), as you also will have + to recompile libc with the changed setting. +

    +

    + On FreeBSD 3.0 the default is 1024, so the problem is lessened. +

    +
    +
    • +
  • Why do I keep getting "access denied" for form POST requests? @@ -1113,7 +1165,7 @@

    -
    if ($0 =~ m:/*nph-:) { +
    if ($0 =~ m:^(.*/)*nph-[^/]*$:) {
         $HTTP_headers =  @@ -1124,9 +1176,9 @@ "Connection: close\015\012";
         - printf ($HTTP_headers); + print $HTTP_headers;
    - };     + }

    @@ -1137,7 +1189,8 @@
  • Why do I get complaints about redefinition - of "struct iovec" when compiling under Linux? + of "struct iovec" when + compiling under Linux?

    This is a conflict between your C library includes and your kernel @@ -1540,6 +1593,111 @@

    • +
  • + When I run it under Linux I get "shmget: + function not found", what should I do? + +

    + Your kernel has been built without SysV IPC support. You will have to + rebuild the kernel with that support enabled (it's under the + "General Setup" submenu). Documention for + kernel building is beyond the scope of this FAQ, you should consult + the Kernel + HOWTO, or the documentation provided with your distribution, + or a Linux + newsgroup/mailing list. As a last resort workaround, you can + comment out the #define HAVE_SHMGET definition in the + LINUX section of + src/conf.h and rebuild the server. This will produce + a server which is slower and less reliable. +

    +
    +
    • + +
  • + Why does my authentification give me a server error? + +

    + Under normal circumstances, the apache access control modules will + pass unrecognized userids on to the next access control module in + line. Only if the userid is recognized, the password is validated + (or not) will it give the usual success or authentification failed + messages. +

    +

    + However if the last access module in line 'declines' the validation + request (because it has never heard of the userid or because it is not + configured) the http_request handler will give one of the following, + confusing, errors: +

      +
    • check access +
    • check user. No user file? +
    • check access. No groups file? +
    + This does not mean that you have to add a 'AuthUserFile /dev/null' + line as some magazines suggest ! +

    +

    + The solution is to ensure that at least the last module is authoritative + and CONFIGURED. By default mod_auth is authoritative + and will give an OK/Denied, but only if it is configured with the + proper AuthUserFile. Likewise if a valid group is required. (Remember + that the modules are processed in the reverse order they appear in + your compile-time Configuration file.) +

    +

    + A typical situation for this error is when you are using the + mod_auth_dbm, mod_auth_msql, mod_auth_mysql, mod_auth_anon or + mod_auth_cookie on their own. These are by default not + authoritative, and this will pass the buck on to the (non-existent) next + authentification module when the user ID is not in their respective + database. Just add the appropriate 'XXXAuthoritative yes' line to + the configuration. +

    +

    + In general it is a good idea (though not terribly efficient) to have the + file based mod_auth a module of last resort. This allows you to access + the web server with a few special passwords even if the databases are + down or corrupted. This does cost a file-open/seek/close for each + request in a protected area. +

    +
    +
    • + +
  • + Do I have to keep the (mSQL) authentification information + on the same machine? + +

    + Some organizations feel very strongly about keeping the authentification + information on a different machine than the webserver. With the + mod_auth_msql, mod_auth_mysql and other SQL modules connecting to + (R)DBMses this is quite well possible. Just configure an explicit host + to contact. +

    +

    + Be aware that with mSQL and Oracle, opening and closing these database + connections is very expensive and time consuming. You might want to + look at the code in the auth_modules and play with the compile time + flags to alleviate this somewhat; if your RDBMS licences alows for it. +

    +
    +
    • + +
  • + Why is my mSQL authentification terribly slow? + +

    + You have probably configured the Host by specificing a FQHN, + and thus the libmsql will use a full blown tcp/ip socket to talk to + the database, rather than a fast internal device. Both the libmsql, + the mSQL faq and the mod_auth_msql documentation warn you about this. If + you have to use different hosts, check out the mod_auth_msql code for + some compile time flags which might, or might not suit you. +

    +
    +
    • + diff --git a/docs/manual/misc/compat_notes.html b/docs/manual/misc/compat_notes.html index 85655cf6391..23adf537c6c 100644 --- a/docs/manual/misc/compat_notes.html +++ b/docs/manual/misc/compat_notes.html @@ -33,6 +33,7 @@ href="http://www.apache.org/bugdb.cgi">let us know.
  • The basic mod_auth AuthGroupFile-specified group file format allows commas between user names - Apache does not.
    - added 12/1/96 +

  • If you follow the NCSA guidelines for setting up access restrictions based on client domain, you may well have added entries for, @@ -99,6 +100,9 @@ it added one automatically if the .asis file contained a Location header. files if the last line does not have a trailing newline. This affects configuration files (httpd.conf, access.conf and srm.conf), and htpasswd and htgroup files. +

    • + +
  • Apache does not permit commas delimiting the methods in <Limit>. diff --git a/docs/manual/misc/fin_wait_2.html b/docs/manual/misc/fin_wait_2.html index 48e10874af7..2d9e946d174 100644 --- a/docs/manual/misc/fin_wait_2.html +++ b/docs/manual/misc/fin_wait_2.html @@ -57,13 +57,13 @@ not send back a FIN and ACK to the server. This means that the connection stays in the FIN_WAIT_2 state until one of the following happens:

      -
    • The client opens a new connection to the same or a different - site, which causes it to fully close the older connection on +
    • The client opens a new connection to the same or a different + site, which causes it to fully close the older connection on that socket. -
    • The user exits the client, which on some (most?) clients - causes the OS to fully shutdown the connection. -
    • The FIN_WAIT_2 times out, on servers that have a timeout - for this state. +
    • The user exits the client, which on some (most?) clients + causes the OS to fully shutdown the connection. +
    • The FIN_WAIT_2 times out, on servers that have a timeout + for this state.

    If you are lucky, this means that the buggy client will fully close the connection and release the resources on your server. However, there @@ -77,16 +77,16 @@ TCP implementation.

    The clients on which this problem has been verified to exist:

      -
    • Mozilla/3.01 (X11; I; FreeBSD 2.1.5-RELEASE i386) -
    • Mozilla/2.02 (X11; I; FreeBSD 2.1.5-RELEASE i386) -
    • Mozilla/3.01Gold (X11; I; SunOS 5.5 sun4m) -
    • MSIE 3.01 on the Macintosh -
    • MSIE 3.01 on Windows 95 +
    • Mozilla/3.01 (X11; I; FreeBSD 2.1.5-RELEASE i386) +
    • Mozilla/2.02 (X11; I; FreeBSD 2.1.5-RELEASE i386) +
    • Mozilla/3.01Gold (X11; I; SunOS 5.5 sun4m) +
    • MSIE 3.01 on the Macintosh +
    • MSIE 3.01 on Windows 95

    This does not appear to be a problem on:

      -
    • Mozilla/3.01 (Win95; I) +
    • Mozilla/3.01 (Win95; I)

    @@ -155,56 +155,56 @@ violation of the RFC, but it is widely recognized as being necessary. The following systems are known to have a timeout:

      -
    • FreeBSD versions starting at 2.0 or possibly earlier. -
    • NetBSD version 1.2(?) -
    • OpenBSD all versions(?) -
    • BSD/OS 2.1, with the - - K210-027 patch installed. -
    • Solaris as of around version - 2.2. The timeout can be tuned by using ndd to - modify tcp_fin_wait_2_flush_interval, but the - default should be appropriate for most servers and improper - tuning can have negative impacts. -
    • SCO TCP/IP Release 1.2.1 - can be modified to have a timeout by following - SCO's instructions. -
    • Linux 2.0.x and - earlier(?) -
    • HP-UX 10.x defaults to - terminating connections in the FIN_WAIT_2 state after the - normal keepalive timeouts. This does not - refer to the persistent connection or HTTP keepalive - timeouts, but the SO_LINGER socket option - which is enabled by Apache. This parameter can be adjusted - by using nettune to modify parameters such as - tcp_keepstart and tcp_keepstop. - In later revisions, there is an explicit timer for - connections in FIN_WAIT_2 that can be modified; contact HP - support for details. -
    • SGI IRIX can be patched to - support a timeout. For IRIX 5.3, 6.2, and 6.3, - use patches 1654, 1703 and 1778 respectively. If you - have trouble locating these patches, please contact your - SGI support channel for help. -
    • NCR's MP RAS Unix 2.xx and - 3.xx both have FIN_WAIT_2 timeouts. In 2.xx it is non-tunable - at 600 seconds, while in 3.xx it defaults to 600 seconds and - is calculated based on the tunable "max keep alive probes" - (default of 8) multiplied by the "keep alive interval" (default - 75 seconds). -
    • Squent's ptx/TCP/IP for - DYNIX/ptx has had a FIN_WAIT_2 timeout since around - release 4.1 in mid-1994. +
    • FreeBSD versions starting at 2.0 or possibly earlier. +
    • NetBSD version 1.2(?) +
    • OpenBSD all versions(?) +
    • BSD/OS 2.1, with the + + K210-027 patch installed. +
    • Solaris as of around version + 2.2. The timeout can be tuned by using ndd to + modify tcp_fin_wait_2_flush_interval, but the + default should be appropriate for most servers and improper + tuning can have negative impacts. +
    • SCO TCP/IP Release 1.2.1 + can be modified to have a timeout by following + SCO's instructions. +
    • Linux 2.0.x and + earlier(?) +
    • HP-UX 10.x defaults to + terminating connections in the FIN_WAIT_2 state after the + normal keepalive timeouts. This does not + refer to the persistent connection or HTTP keepalive + timeouts, but the SO_LINGER socket option + which is enabled by Apache. This parameter can be adjusted + by using nettune to modify parameters such as + tcp_keepstart and tcp_keepstop. + In later revisions, there is an explicit timer for + connections in FIN_WAIT_2 that can be modified; contact HP + support for details. +
    • SGI IRIX can be patched to + support a timeout. For IRIX 5.3, 6.2, and 6.3, + use patches 1654, 1703 and 1778 respectively. If you + have trouble locating these patches, please contact your + SGI support channel for help. +
    • NCR's MP RAS Unix 2.xx and + 3.xx both have FIN_WAIT_2 timeouts. In 2.xx it is non-tunable + at 600 seconds, while in 3.xx it defaults to 600 seconds and + is calculated based on the tunable "max keep alive probes" + (default of 8) multiplied by the "keep alive interval" (default + 75 seconds). +
    • Squent's ptx/TCP/IP for + DYNIX/ptx has had a FIN_WAIT_2 timeout since around + release 4.1 in mid-1994.

    The following systems are known to not have a timeout:

      -
    • SunOS 4.x does not and - almost certainly never will have one because it as at the - very end of its development cycle for Sun. If you have kernel - source should be easy to patch. +
    • SunOS 4.x does not and + almost certainly never will have one because it as at the + very end of its development cycle for Sun. If you have kernel + source should be easy to patch.

    There is a diff --git a/docs/manual/misc/index.html b/docs/manual/misc/index.html index 127b1f2f0d3..2b44c661318 100644 --- a/docs/manual/misc/index.html +++ b/docs/manual/misc/index.html @@ -21,92 +21,92 @@

    API
    Description of Apache's Application Programming Interface.
    FAQ
    Frequently-Asked Questions concerning the Apache project and server
    Reading Client Input in Apache 1.2
    Describes differences between Apache 1.1 and 1.2 in how modules read information from the client
    Compatibility with NCSA
    Notes about Apache's compatibility with the NCSA server
    FIN_WAIT_2
    A description of the causes of Apache processes going into the FIN_WAIT_2 state, and what you can do about it
    "How-To"
    Instructions about how to accomplish some commonly-desired server functionality changes
    Known Bugs
    Just what it says - a list of known bugs in each of the Apache releases
    No PGP
    Why we took PEM and PGP support out of the base Apache distribution
    Performance Notes (BSD 4.4)
    Some notes about ways to improve/optimize Apache performance on BSD 4.4 systems
    Performance Notes (Digital UNIX)
    Extracts of USENET postings describing how to optimize Apache performance on Digital UNIX systems
    Performance Notes (General)
    Some generic notes about how to improve Apache performance
    Security Tips
    Some "do"s - and "don't"s - for keeping your Apache web site secure
    Virtual Hosts (IP-based)
    Excerpts and notes about configuring and using Apache IP-based virtual hosts
    Windows Bug with Web Keepalive
    A brief description of a known problem with Microsoft Windows and diff --git a/docs/manual/mod/core.html b/docs/manual/mod/core.html index fde6c351a23..4f0a3033cf6 100644 --- a/docs/manual/mod/core.html +++ b/docs/manual/mod/core.html @@ -836,6 +836,9 @@ Execution of CGI scripts is permitted.
    The server will follow symbolic links in this directory. +Note: even though the server follows the symlink it does not +change the pathname used to match against <Directory> +sections.
    Includes
    @@ -1158,7 +1161,7 @@ release.

    SendBufferSize directive

    Syntax: SendBufferSize bytes
    -Context: server config, virtual host
    +Context: server config
    Status: core

    The server will set the TCP buffer size to the number of bytes diff --git a/docs/manual/mod/mod_auth_anon.html b/docs/manual/mod/mod_auth_anon.html index c880c34ee10..c1b6933053a 100644 --- a/docs/manual/mod/mod_auth_anon.html +++ b/docs/manual/mod/mod_auth_anon.html @@ -61,23 +61,23 @@ allows users to share URLs. Status: Extension
    Module: mod_auth_anon

    - A list of one or more 'magic' userIDs which are allowed access - without password verification. The userIDs are space separated. - It is possible to use the ' and " quotes to allow a space in - a userID as well as the \ escape character. -

    - Please note that the comparison is case-IN-sensitive. -
    - I strongly suggest that the magic username 'anonymous' - is always one of the allowed userIDs. -

    - Example:
    - - Anonymous: anonymous "Not Registered" 'I don\'t know' -

    - This would allow the user to enter without password verification - by using the userId's 'anonymous', 'AnonyMous','Not Registered' and - 'I Don't Know'. + A list of one or more 'magic' userIDs which are allowed access + without password verification. The userIDs are space separated. + It is possible to use the ' and " quotes to allow a space in + a userID as well as the \ escape character. +

    + Please note that the comparison is case-IN-sensitive. +
    + I strongly suggest that the magic username 'anonymous' + is always one of the allowed userIDs. +

    + Example:
    + + Anonymous: anonymous "Not Registered" 'I don\'t know' +

    + This would allow the user to enter without password verification + by using the userId's 'anonymous', 'AnonyMous','Not Registered' and + 'I Don't Know'.

    Anonymous_Authoritative

     @@ -91,12 +91,12 @@ allows users to share URLs. When set 'on', there is no fall-through to other authorization methods. So if a userID does not match the values specified in the - Anonymous directive, access is denied. -

    - Be sure you know what you are doing when you decide to switch - it on. And remember that it is the linking order of the modules - (in the Configuration / Make file) which details the order - in which the Authorization modules are queried. + Anonymous directive, access is denied. +

    + Be sure you know what you are doing when you decide to switch + it on. And remember that it is the linking order of the modules + (in the Configuration / Make file) which details the order + in which the Authorization modules are queried.

    Anonymous_LogEmail

     @@ -107,8 +107,8 @@ allows users to share URLs. Status: Extension
    Module: mod_auth_anon

    - When set 'on', the default, the 'password' entered (which hopefully - contains a sensible email address) is logged in the httpd-log file. + When set 'on', the default, the 'password' entered (which hopefully + contains a sensible email address) is logged in the httpd-log file.

    Anonymous_MustGiveEmail

     @@ -120,8 +120,8 @@ allows users to share URLs. Status: Extension
    Module: mod_auth_anon

    - Specifies whether the user must specify an email - address as the password. This prohibits blank passwords. + Specifies whether the user must specify an email + address as the password. This prohibits blank passwords.

    Anonymous_NoUserID

     @@ -132,11 +132,11 @@ allows users to share URLs. Status: Extension
    Module: mod_auth_anon

    - When set 'on', users can leave - the userID (and perhaps the password field) empty. This - can be very convenient for MS-Explorer users who can - just hit return or click directly on the OK button; which - seems a natural reaction. + When set 'on', users can leave + the userID (and perhaps the password field) empty. This + can be very convenient for MS-Explorer users who can + just hit return or click directly on the OK button; which + seems a natural reaction.

    @@ -148,9 +148,9 @@ allows users to share URLs. Status: Extension
    Module: mod_auth_anon

    - When set 'on' the 'password' entered is - checked for at least one '@' and a '.' to encourage users to enter - valid email addresses (see the above Auth_LogEmail). + When set 'on' the 'password' entered is + checked for at least one '@' and a '.' to encourage users to enter + valid email addresses (see the above Auth_LogEmail).

    Example

     @@ -180,10 +180,10 @@ Excerpt of access.conf:
    Anonymous anonymous guest www test welcome

    -Anonymous_MustGiveEmail on
    +Anonymous_MustGiveEmail on
    Anonymous_VerifyEmail on
    -Anonymous_NoUserId off
    -Anonymous_LogEmail on
    +Anonymous_NoUserId off
    +Anonymous_LogEmail on

    AuthName Use 'anonymous' & Email address for guest entry
    AuthType basic

    @@ -217,8 +217,8 @@ This version: 23 Nov 1995, 24 Feb 1996, 16 May 1996.

    Version 0.5
    Added 'VerifyEmail' and 'LogEmail' options. Multiple - 'anonymous' tokens allowed. more docs. Added Authoritative - functionality. + 'anonymous' tokens allowed. more docs. Added Authoritative + functionality.
    diff --git a/docs/manual/mod/mod_dir.html b/docs/manual/mod/mod_dir.html index aebd31a5bb8..a6cccca6100 100644 --- a/docs/manual/mod/mod_dir.html +++ b/docs/manual/mod/mod_dir.html @@ -324,6 +324,26 @@ This will suppress the file size in fancy indexing listings.
    This will suppress the file description in fancy indexing listings. +
    IconHeight[=pixels] (Apache 1.3 and later) +
    + +Presence of this option, when used with IconWidth, will cause the server +to include HEIGHT and WIDTH attributes in the +IMG tag for the file icon. This allows browser to +precalculate the page layout without having to wait until all the +images have been loaded. If no value is given for the option, it +defaults to the standard height of the icons supplied with the Apache +software. +
    IconWidth[=pixels] (Apache 1.3 and later) +
    + +Presence of this option, when used with IconHeight, will cause the server +to include HEIGHT and WIDTH attributes in the +IMG tag for the file icon. This allows browser to +precalculate the page layout without having to wait until all the +images have been loaded. If no value is given for the option, it +defaults to the standard width of the icons supplied with the Apache +software. This default is that no options are enabled. If multiple IndexOptions could apply to a directory, then the most specific one is taken complete; diff --git a/docs/manual/mod/mod_include.html b/docs/manual/mod/mod_include.html index 6f511309989..f1576471e63 100644 --- a/docs/manual/mod/mod_include.html +++ b/docs/manual/mod/mod_include.html @@ -309,15 +309,15 @@ elements are: Unix egrep command.
    ( test_condition ) -
    true if test_condition is true +
    true if test_condition is true
    ! test_condition -
    true if test_condition is false +
    true if test_condition is false
    test_condition1 && test_condition2 -
    true if both test_condition1 and - test_condition2 are true +
    true if both test_condition1 and + test_condition2 are true
    test_condition1 || test_condition2 -
    true if either test_condition1 or - test_condition2 is true +
    true if either test_condition1 or + test_condition2 is true

    "=" and "!=" bind more tightly than "&&" and diff --git a/docs/manual/mod/mod_proxy.html b/docs/manual/mod/mod_proxy.html index e0aef688460..30926d4da6a 100644 --- a/docs/manual/mod/mod_proxy.html +++ b/docs/manual/mod/mod_proxy.html @@ -297,7 +297,7 @@ disables caching completely.

  • Using Netscape hostname shortcuts
  • Why doesn't file type xxx download via FTP?
  • Why does Apache start more slowly when using the - proxy module? + proxy module?
  • Can I use the Apache proxy module with my SOCKS proxy? @@ -337,7 +337,7 @@ application/octet-stream bin dms lha lzh exe class tgz taz

    Why does Apache start more slowly when using the - proxy module?

    + proxy module? If you're using the ProxyBlock or NoCache directives, hostnames' IP addresses are looked up and cached during diff --git a/docs/manual/mod/mod_rewrite.html b/docs/manual/mod/mod_rewrite.html index 03eaa5801f7..8d432e4c4ef 100644 --- a/docs/manual/mod/mod_rewrite.html +++ b/docs/manual/mod/mod_rewrite.html @@ -988,10 +988,10 @@ comma-separated list of the following flags: which will be expanded. You can use this flag more than once to set more than one variable. The variables can be later dereferenced at a lot of situations, but the usual location will be from within XSSI (via - <!--#echo var="VAR"-->) or CGI (e.g. $ENV{'VAR'}). - But additionally you can also dereference it in a following RewriteCond - pattern via %{ENV:VAR}. Use this to strip but remember - information from URLs. + <!--#echo var="VAR"-->) or CGI (e.g. $ENV{'VAR'}). + But additionally you can also dereference it in a following RewriteCond + pattern via %{ENV:VAR}. Use this to strip but remember + information from URLs.

    diff --git a/docs/manual/mod/mod_status.html b/docs/manual/mod/mod_status.html index f5a55fa397c..f671ad78367 100644 --- a/docs/manual/mod/mod_status.html +++ b/docs/manual/mod/mod_status.html @@ -90,7 +90,7 @@ mark@ukweb.com and tell me your configuration. Do this by adding the following to the AUX_CFLAGS line in the "Configuration" file and then recompiling as usual. 

    -	AUX_CFLAGS= (something) -DSTATUS
+        AUX_CFLAGS= (something) -DSTATUS
    diff --git a/docs/manual/process-model.html b/docs/manual/process-model.html index c130decffa7..2c37337b70f 100644 --- a/docs/manual/process-model.html +++ b/docs/manual/process-model.html @@ -39,9 +39,9 @@ as too confusing. The defaults for each variable are: 
    -MinSpareServers		5
-MaxSpareServers		10
-StartServers		5
+MinSpareServers         5
+MaxSpareServers         10
+StartServers            5
    There is an absolute maximum number of simultaneous children defined diff --git a/docs/manual/suexec.html b/docs/manual/suexec.html index 7806bc8f55c..0157cd0c1b5 100644 --- a/docs/manual/suexec.html +++ b/docs/manual/suexec.html @@ -17,14 +17,15 @@

      - CONTENTS -
    1. What is suEXEC?
      2. -
    2. Before we begin.
      3. -
    3. suEXEC Security Model.
      4. -
    4. Configuring & Installing suEXEC
      5. -
    5. Enabling & Disabling suEXEC
      6. -
    6. Debugging suEXEC
      7. -
    7. Beware the Jabberwock: Warnings & Examples
      8. + CONTENTS +
    8. What is suEXEC?
      9. +
    9. Before we begin.
      10. +
    10. suEXEC Security Model.
      11. +
    11. Configuring & Installing suEXEC
      12. +
    12. Enabling & Disabling suEXEC
      13. +
    13. Debugging suEXEC
      14. +
    14. Beware the Jabberwock: Warnings & + Examples

    @@ -119,124 +120,124 @@ user and group IDs under which the program is to execute. The wrapper then employs the following process to determine success or failure -- if any one of these conditions fail, the program logs the failure and exits with an error, otherwise it will continue: -
      -
    1. Was the wrapper called with the proper number of arguments? -
      - The wrapper will only execute if it is given the proper number of arguments. - The proper argument format is known to the Apache web server. If the wrapper - is not receiving the proper number of arguments, it is either being hacked, or - there is something wrong with the suEXEC portion of your Apache binary. -
      -
      2. -
    2. Is the user executing this wrapper a valid user of this system? -
      - This is to ensure that the user executing the wrapper is truly a user of the system. -
      -
      3. -
    3. Is this valid user allowed to run the wrapper? -
      - Is this user the user allowed to run this wrapper? Only one user (the Apache - user) is allowed to execute this program. -
      -
      4. -
    4. Does the target program have an unsafe hierarchical reference? -
      - Does the target program contain a leading '/' or have a '..' backreference? These - are not allowed; the target program must reside within the Apache webspace. -
      -
      5. -
    5. Is the target user name valid? -
      - Does the target user exist? -
      -
      6. -
    6. Is the target group name valid? -
      - Does the target group exist? -
      -
      7. -
    7. Is the target user NOT superuser? -
      - Presently, suEXEC does not allow 'root' to execute CGI/SSI programs. -
      -
      8. -
    8. Is the target userid ABOVE the minimum ID number? -
      - The minimum user ID number is specified during configuration. This allows you - to set the lowest possible userid that will be allowed to execute CGI/SSI programs. - This is useful to block out "system" accounts. -
      -
      9. -
    9. Is the target group NOT the superuser group? -
      - Presently, suEXEC does not allow the 'root' group to execute CGI/SSI programs. -
      -
      10. -
    10. Is the target groupid ABOVE the minimum ID number? -
      - The minimum group ID number is specified during configuration. This allows you - to set the lowest possible groupid that will be allowed to execute CGI/SSI programs. - This is useful to block out "system" groups. -
      -
      11. -
    11. Can the wrapper successfully become the target user and group? -
      - Here is where the program becomes the target user and group via setuid and setgid - calls. The group access list is also initialized with all of the groups of which - the user is a member. -
      -
      12. -
    12. Does the directory in which the program resides exist? -
      - If it doesn't exist, it can't very well contain files. -
      -
      13. -
    13. Is the directory within the Apache webspace? -
      - If the request is for a regular portion of the server, is the requested directory - within the server's document root? If the request is for a UserDir, is the requested - directory within the user's document root? -
      -
      14. -
    14. Is the directory NOT writable by anyone else? -
      - We don't want to open up the directory to others; only the owner user may be able - to alter this directories contents. -
      -
      15. -
    15. Does the target program exist? -
      - If it doesn't exists, it can't very well be executed. -
      -
      16. -
    16. Is the target program NOT writable by anyone else? -
      - We don't want to give anyone other than the owner the ability to change the program. -
      -
      17. -
    17. Is the target program NOT setuid or setgid? -
      - We do not want to execute programs that will then change our UID/GID again. -
      -
      18. -
    18. Is the target user/group the same as the program's user/group? -
      - Is the user the owner of the file? -
      -
      19. -
    19. Can we successfully clean the process environment to ensure safe operations? -
      - suEXEC cleans the process' environment by establishing a safe execution PATH (defined - during configuration), as well as only passing through those variables whose names - are listed in the safe environment list (also created during configuration). -
      -
      20. -
    20. Can we successfully become the target program and execute? -
      - Here is where suEXEC ends and the target program begins. -
      -
      21. -
    +
      +
    1. Was the wrapper called with the proper number of arguments? +
      + The wrapper will only execute if it is given the proper number of arguments. + The proper argument format is known to the Apache web server. If the wrapper + is not receiving the proper number of arguments, it is either being hacked, or + there is something wrong with the suEXEC portion of your Apache binary. +
      +
      2. +
    2. Is the user executing this wrapper a valid user of this system? +
      + This is to ensure that the user executing the wrapper is truly a user of the system. +
      +
      3. +
    3. Is this valid user allowed to run the wrapper? +
      + Is this user the user allowed to run this wrapper? Only one user (the Apache + user) is allowed to execute this program. +
      +
      4. +
    4. Does the target program have an unsafe hierarchical reference? +
      + Does the target program contain a leading '/' or have a '..' backreference? These + are not allowed; the target program must reside within the Apache webspace. +
      +
      5. +
    5. Is the target user name valid? +
      + Does the target user exist? +
      +
      6. +
    6. Is the target group name valid? +
      + Does the target group exist? +
      +
      7. +
    7. Is the target user NOT superuser? +
      + Presently, suEXEC does not allow 'root' to execute CGI/SSI programs. +
      +
      8. +
    8. Is the target userid ABOVE the minimum ID number? +
      + The minimum user ID number is specified during configuration. This allows you + to set the lowest possible userid that will be allowed to execute CGI/SSI programs. + This is useful to block out "system" accounts. +
      +
      9. +
    9. Is the target group NOT the superuser group? +
      + Presently, suEXEC does not allow the 'root' group to execute CGI/SSI programs. +
      +
      10. +
    10. Is the target groupid ABOVE the minimum ID number? +
      + The minimum group ID number is specified during configuration. This allows you + to set the lowest possible groupid that will be allowed to execute CGI/SSI programs. + This is useful to block out "system" groups. +
      +
      11. +
    11. Can the wrapper successfully become the target user and group? +
      + Here is where the program becomes the target user and group via setuid and setgid + calls. The group access list is also initialized with all of the groups of which + the user is a member. +
      +
      12. +
    12. Does the directory in which the program resides exist? +
      + If it doesn't exist, it can't very well contain files. +
      +
      13. +
    13. Is the directory within the Apache webspace? +
      + If the request is for a regular portion of the server, is the requested directory + within the server's document root? If the request is for a UserDir, is the requested + directory within the user's document root? +
      +
      14. +
    14. Is the directory NOT writable by anyone else? +
      + We don't want to open up the directory to others; only the owner user may be able + to alter this directories contents. +
      +
      15. +
    15. Does the target program exist? +
      + If it doesn't exists, it can't very well be executed. +
      +
      16. +
    16. Is the target program NOT writable by anyone else? +
      + We don't want to give anyone other than the owner the ability to change the program. +
      +
      17. +
    17. Is the target program NOT setuid or setgid? +
      + We do not want to execute programs that will then change our UID/GID again. +
      +
      18. +
    18. Is the target user/group the same as the program's user/group? +
      + Is the user the owner of the file? +
      +
      19. +
    19. Can we successfully clean the process environment to ensure safe operations? +
      + suEXEC cleans the process' environment by establishing a safe execution PATH (defined + during configuration), as well as only passing through those variables whose names + are listed in the safe environment list (also created during configuration). +
      +
      20. +
    20. Can we successfully become the target program and execute? +
      + Here is where suEXEC ends and the target program begins. +
      +
      21. +

    @@ -257,7 +258,7 @@ section of this document. BACK TO CONTENTS

    -

    Configuring & Installing suEXEC

    +

    Configuring & Installing suEXEC

    Here's where we begin the fun. The configuration and installation of suEXEC is a four step process: edit the suEXEC header file, compile suEXEC, place the @@ -396,7 +397,7 @@ user shell, do so now and execute the following commands. BACK TO CONTENTS

    -

    Enabling & Disabling suEXEC

    +

    Enabling & Disabling suEXEC

    After properly installing the suexec wrapper executable, you must kill and restart the Apache server. A simple @@ -454,7 +455,7 @@ and the error_log for the server to see where you may have gone astray. BACK TO CONTENTS

    -

    Beware the Jabberwock: Warnings & Examples

    +

    Beware the Jabberwock: Warnings & Examples

    NOTE! This section may not be complete. For the latest revision of this section of the documentation, see the Apache Group's @@ -467,33 +468,33 @@ There are a few points of interest regarding the wrapper that can cause limitations on server setup. Please review these before submitting any "bugs" regarding suEXEC.

      - suEXEC Points Of Interest -
    • Hierarchy limitations -
      - For security and efficiency reasons, all suexec requests must - remain within either a top-level document root for virtual - host requests, or one top-level personal document root for - userdir requests. For example, if you have four VirtualHosts - configured, you would need to structure all of your VHosts' - document roots off of one main Apache document hierarchy to - take advantage of suEXEC for VirtualHosts. (Example forthcoming.) -
      -
      • -
    • suEXEC's PATH environment variable -
      - This can be a dangerous thing to change. Make certain every - path you include in this define is a trusted - directory. You don't want to open people up to having someone - from across the world running a trojan horse on them. -
      -
      • -
    • Altering the suEXEC code -
      - Again, this can cause Big Trouble if you try - this without knowing what you are doing. Stay away from it - if at all possible. -
      -
      • + suEXEC Points Of Interest +
    • Hierarchy limitations +
      + For security and efficiency reasons, all suexec requests must + remain within either a top-level document root for virtual + host requests, or one top-level personal document root for + userdir requests. For example, if you have four VirtualHosts + configured, you would need to structure all of your VHosts' + document roots off of one main Apache document hierarchy to + take advantage of suEXEC for VirtualHosts. (Example forthcoming.) +
      +
      • +
    • suEXEC's PATH environment variable +
      + This can be a dangerous thing to change. Make certain every + path you include in this define is a trusted + directory. You don't want to open people up to having someone + from across the world running a trojan horse on them. +
      +
      • +
    • Altering the suEXEC code +
      + Again, this can cause Big Trouble if you try + this without knowing what you are doing. Stay away from it + if at all possible. +
      +