Apache HTTP Server is an open-source web server platform. This article will outline the steps to install, configure, harden a zero-footprint instance of Apache 2.2 & 2.4, with particular focus on the nuances between each.
Prerequisites
If you are building you zero-footprint for the first time you will need a C/C++ compiler available on the initial system. Once compiled, the resulting package is portable to other like-O/S servers. For the most part, most Unix/Linux distributions will come packaged with the gcc compiler.
Unix/Solaris
Check if gcc compiler is installed:
$ which gcc # dependent on environment variables being set correctly. # Alternatively check the /usr/bin and /usr/sfw/bin paths.
If no compiler found, install it:
$ pkg install gcc-3 # or whatever version you need
Linux
Chech if gcc compilete is installed:
$ which gcc
If no compiler found, install it:
# Debian/Ubuntu $ sudo apt-get install build-essential # RHEL/CentOS/Fedora $ sudo yum group install "Development Tools"
Initial Installation
1) Get Source Files
The first step is to retrieve the source files from Apache. Grab the compressed files pertinent to the O/S you are using, typically bzip2 for Unix and gunzip for Linux:
# Change dir to whichever working directory you want to use $ cd /opt # Change version number/archive type as required $ wget --no-check-certificate https://archive.apache.org/dist/httpd/httpd-2.2.23.tar.bz2 [ -e use-proxy=yes -e https_proxy=xxxxx ] # Apache also provides MD5 hashes to verify your downloads, so you could do the following to generate a local MD5 hash to compare wget -O - https://archive.apache.org/dist/httpd-2.4.29.tar.bz2 | tee httpd-2.2.23.tar.bz2 | md5sum > md5sum.local
Unpack the archive:
Unix/Solaris
# Use -k switch to preserve the original archive $ bzip2 -d[k] httpd-2.2.32.tar.bz2 $ tar -xvf httpd-2.2.32.tar -C /opt/httpd/
Linux
$ tar -xzvf httpd-2.2.32.tar.gz -C /opt/httpd/
2) Compile Apache
Next, we will compile apache.
Apache 2.4 Setup
Since Apache 2.4, the Apache Portable Runtime and the Perl Compatible Regex modules are no longer packaged with the original source. However, these modules are mandatory for Apache to compile and run.
$ cd /opt/httpd
# First we configure the build using the following syntax
# ./configure --prefix=/opt/apache2 --enable-mods-shared=few [--enable-{modname}] [--disable-{modname}] [with-apr=included] [with-pcre=/opt/pcre]
# Here is the most common configuration
./configure --prefix=/opt/apache2 --enable-mods-shared=few --enable-rewrite --enable-headers --enable-ssl --disable-userdir --disable-autoindex --disable-status --disable-env --disable-setenvif --disable-cgi --disable-actions --disable-negotiation --disable-alias --disable-include --disable-filter --disable-version --disable-asis --with-apr=included --with-pcre=/opt/pcre
Here it is important to understand what each switch is doing and the implications of each.
| Configure Command Switch | What does it do? |
|---|---|
| --prefix | Sets the output directory for the build i.e. where Apache will reside. This direcory specification will have a direct impact on portability of the 0FS package. Read more in the Portability section. |
--enable-mods-shared=value or -- enable-mods-shared={module_names} (space-delimited) | Sets which modules will be compiled as DSOs (shared libraries). Options are "all" | "most" and in 2.4 and higher also "few" | "none" | "reallyall". |
--enable-{module_name} or -- enable-modules={module_names} (space-delimited) | Enables the module for the build. Shared or static inclusion is determined by the underlying APR as will as the --enable-mods-shared directive. For example, with Apache 2.4, the standard APR supports DSOs, so it would compile the module as shared, unless the --enable-mods-shared is set to "none", which will force it to be compiled as static. |
| --disable-{module_name} | Disables the module for the build. The module will not be compiled at all, so you will not even be able to add it dynamically later through Apache configuration without either recompiling Apache in full or compiling the module itself and copying it into the modules directory of the Apahce install |
| --with-{module_name}=path|included | Used to specify specific path to find compiled modules if not using the defaults included with source. The included value will force the build to use the one included with Apache source. |