Andrew Hudson - Fedora™ Unleashed, 2008 edition

Apache version 2.0 and greater now uses a new internal architecture supporting multiprocessing modules (MPMs). These modules are used by the server for a variety of tasks, such as network and process management, and are compiled into Apache. MPMs enable Apache to work much better on a wider variety of computer platforms, and they can help improve server stability, compatibility, and scalability.

Apache can use only one MPM at any time. These modules are different from the base set included with Apache (see the "Apache Modules" section later in this chapter), but are used to implement settings, limits, or other server actions. Each module in turn supports numerous additional settings, called directives , which further refine server operation.

The internal MPM modules relevant for Linux include the following:

► mpm_common— A set of 20 directives common to all MPM modules

► prefork— A nonthreaded, preforking web server that works similar to earlier (1.3) versions of Apache

► worker— Provides a hybrid multiprocess multithreaded server

MPM enables Apache to be used on equipment with fewer resources, yet still handle massive numbers of hits and provide stable service. The workermodule provides directives to control how many simultaneous connections your server can handle.

Other MPMs are available for Apache related to other platforms, such as mpm_netwarefor NetWare hosts and mpm_winntfor Windows NT platforms. An MPM named perchild, which provides user ID assignment to selected daemon processes, is under development. For more information, browse to the Apache Software Foundation's home page athttp://www.apache.org/.

Apache also supports special configuration files, known as .htaccessfiles. Almost any directive that appears in httpd.confcan appear in an .htaccessfile. This file, specified in the AccessFileNamedirective in httpd.conf(or srm.confprior to version 1.3.4) sets configurations on a per-directory (usually in a user directory) basis. As the system administrator, you can specify both the name of this file and which of the server configurations can be overridden by the contents of this file. This is especially useful for sites in which there are multiple content providers and you want to control what these people can do with their spaces.

To limit which server configurations the .htaccessfiles can override, use the AllowOverridedirective. AllowOverridecan be set globally or per directory. For example, in your httpd.conffile, you could use the following:

# Each directory to which Apache has access can be configured with respect

# to which services and features are allowed and/or disabled in that

# directory (and its subdirectories).

#

# First, it's best to configure the "default" to be a very restrictive set of

# permissions.

#

Options FollowSymLinks

AllowOverride None

To configure which configuration options are available to Apache by default, you must use the Optionsdirective. Optionscan be None; All; or any combination of Indexes, Includes, FollowSymLinks, ExecCGI, and MultiViews. MultiViewsisn't included in Alland must be specified explicitly. These options are explained in Table 17.2.

TABLE 17.2 Switches Used by the OptionsDirective

These directives also affect all subdirectories of the specified directory.

The AllowOverridesdirectives specify which configuration options .htaccessfiles can override. You can set this directive individually for each directory. For example, you can have different standards about what can be overridden in the main document root and in UserDirdirectories. This capability is particularly useful for user directories, where the user doesn't have access to the main server configuration files.

AllowOverridescan be set to Allor any combination of Options, FileInfo, AuthConfig, and Limit. These options are explained in Table 17.3.

TABLE 17.3 Switches Used by the AllowOverridesDirective

You're likely to include material on your website that isn't supposed to be available to the public. You must be able to lock out this material from public access and provide designated users with the means to unlock the material. Apache provides two methods for accomplishing this type of access: authentication and authorization. You can use different criteria to control access to sections of your website, including checking the client's IP address or hostname, or requiring a username and password. This section briefly covers some of these methods.