Building Apache 2.0.59, with mod_deflate and mod_ssl
Building a Web Server, for Linux
Requirements
- Perl
- zlib [built and installed, shared libs] : mod_deflate
- OpenSSL [built and installed, shared libs] : mod_ssl
Download
- Package(Linux source) : httpd-2.0.59.tar.bz2
- unpack with command...
tar -xjf httpd-2.0.59.tar.bz2
Our Configuration
- Install to : /usr/local/httpd-2.0.59, with symlink /usr/local/apache2
- Module type : dynamically loaded modules, *.so
- Additional modules : mod_ssl, mod_deflate, mod_logio
Configuration Options
Displays a list of configuration options...
...httpd-2.0.59]# ./configure -h
Build Instructions
Configure
Configure the Apache build with mod_ssl and mod_deflate...
...httpd-2.0.59]# ./configure --prefix=/usr/local/httpd-2.0.59 --enable-mods-shared=all --enable-logio --enable-deflate --enable-ssl --with-z=/usr/local --with-ssl=/usr/local/ssl
--prefix=/usr/local/httpd-2.0.59
[this is the installation location; default is /usr/local/apache2 -- which we will symlink]--enable-mods-shared=all
[build all standard modules in the package (still excludes some modules); build as loadable modules (.so)]--enable-logio
[enable mod_logio: input and output logging]--enable-deflate
[enable mod_deflate: deflate transfer encoding support]--enable-ssl
[enable mod_ssl: SSL/TLS support]--with-z=DIR
[use a specific zlib library (mod_deflate)]
[if user built zlib using our Guide (installing to /usr/local) -- DIR=/usr/local]--with-ssl=DIR
[use a specific SSL/TLS toolkit (OpenSSL)]
[if user built openssl using our Guide (installing to /usr/local/ssl) -- DIR=/usr/local/ssl]
[sanity check] Generated Output
Verify that the configuration proccess has detected and enabled mod_ssl and mod_deflate correctly...
mod_deflate...
checking whether to enable mod_deflate... checking dependencies adding "-I/usr/local/include" to INCLUDES adding "-L/usr/local/lib" to LDFLAGS setting LIBS to "-lz" checking for zlib library... found checking zutil.h usability... yes checking zutil.h presence... yes checking for zutil.h... yes checking whether to enable mod_deflate... shared (all)
mod_ssl...
checking whether to enable mod_ssl... checking dependencies checking for SSL/TLS toolkit base... /usr/local/ssl checking for SSL/TLS toolkit version... OpenSSL 0.9.8c 05 Sep 2006 checking for SSL/TLS toolkit includes... /usr/local/ssl/include checking for SSL/TLS toolkit libraries... /usr/local/ssl/lib adding "-I/usr/local/ssl/include/openssl" to INCLUDES adding "-I/usr/local/ssl/include" to INCLUDES adding "-L/usr/local/ssl/lib" to LDFLAGS ... checking whether to enable mod_ssl... shared (all)
Build and Install
Before proceeding with make...
Make sure files 'libcrypto.so.0.9.8' and 'libssl.so.0.9.8' have been symlinked or copied from '/usr/local/ssl/lib' to '/lib'. This library location seems to be hardcoded for these libs under httpd make build.
If these files are not present, make will fail with message...
./dftables: error while loading shared libraries: libssl.so.0.9.8: cannot open shared object file: No such file or directory
make[3]: *** [.../httpd-2.0.59/srclib/pcre/chartables.c] Error 127
Build and Install Apache...
...httpd-2.0.59]# make...httpd-2.0.59]# make install
[sanity check] Runtime Linker
Verify that binary 'httpd' is linking against the correct zlib and ssl libraries...
...]# ldd /usr/local/httpd-2.0.59/bin/httpd
- libz.so.1 => /usr/local/lib/libz.so.1 ...
- libssl.so.0.9.8 => /lib/libssl.so.0.9.8 ...
- libcrypto.so.0.9.8 => /lib/libcrypto.so.0.9.8 ...
Symlink
Form symlink from '/usr/local/httpd-2.0.59' to '/usr/local/apache2'
...]# cd /usr/local/usr/local]# ln -s httpd-2.0.59 apache2
Configuration Files
- Edit /usr/local/apache2/conf/httpd.conf if needed.
- Edit /usr/local/apache2/conf/ssl.conf if needed.
- Note that if "localhost" will be used, make sure that file /etc/hosts contains line...
127.0.0.1 <tab> localhost.localdomain <tab> localhost
SSL Private/Public Key Setup
To be able to accept 'https://...' requests, a private/public key-pair is required.
Create directories that will store certificate and key...
...]# mkdir /usr/local/apache2/conf/ssl.crt...]# mkdir /usr/local/apache2/conf/ssl.key
Create a certificate signing request (server.csr) and private key (privkey.pem)...
...]# openssl req -new -out server.csr
Remove pass-phrase from private key (privkey.pem), creating server.key...
...]# openssl rsa -in privkey.pem -out server.key
Create a self-signed certificate, server.crt (public key)...
...]# openssl x509 -in server.csr -out server.crt -req -signkey server.key -days 365
Remove file '.rnd' which contains entropy information, and could be used to re-create keys...
...]# rm .rnd
Remove file 'privkey.pem' as we have no use for it...
...]# rm privkey.pem
Keep file 'server.csr' if you plan on self-signing any more keys and you want the authority to match up exactly, otherwise delete it...
...]# rm server.csr
Move the created certificate and key to their proper locations...
...]# mv server.crt /usr/local/apache2/conf/ssl.crt...]# mv server.key /usr/local/apache2/conf/ssl.key
Update Configuration Files
Mod_deflate and mod_ssl require several additions and updates to be made to httpd.conf, the Apache2 configuration file.
Open /usr/local/apache2/conf/httpd.conf, add the following...
<Location /> <IfModule mod_deflate.c> #compress content with type html, text, and css AddOutputFilterByType DEFLATE text/html text/plain text/css <IfModule mod_headers.c> #properly handle requests coming from behind proxies Header append Vary User-Agent </IfModule> </IfModule> </Location> #properly handle old browsers that do not support compression <IfModule mod_deflate.c> BrowserMatch ^Mozilla/4 gzip-only-text/html BrowserMatch ^Mozilla/4\.0[678] no-gzip BrowserMatch \bMSIE !no-gzip !gzip-only-text/html </IfModule>
Startup and Operation
Start the Apache2 [httpd] Server
Start regular (port 80) apache2 daemon...
/usr/local/apache2/bin]# ./apachectl start
Start regular and ssl (port 80 and 443) apache2 daemon...
/usr/local/apache2/bin]# ./apachectl startsslStop Apache2 [httpd] Server
/usr/local/apache2/bin]# ./apachectl stop
Restart Apache2 [httpd] Server
Restart Apache2 Server...
/usr/local/apache2/bin]# ./apachectl restart
Graceful restart Apache2 Server, without losing any existing or pending connections from clients...
/usr/local/apache2/bin]# ./apachectl graceful
Help
List available command line options...
/usr/local/apache2/bin]# ./apachectl -h
List compiled in modules...
/usr/local/apache2/bin]# ./apachectl -l
Show version and compile settings...
/usr/local/apache2/bin]# ./apachectl -V
Testing
- To test the regular (port 80) server enter url : http://localhost
- To test the SSL (port 443) server enter url : https://localhost