1. Apache : Installation, Configuration, Basic Security
Presented by,
Mr. Rahul Sharma
Associate Professor
ACEIT

2. Outline Introduction Why Apache ? Installation Configuration
Running Apache
Basic Security

3. Introduction A basic web server works as follows :
It is a program that runs on a host computer .
It waits for a request from web browser/client for objects it has in its possession
Upon receiving the request (GET command from client), it retrieves the requested information and sends it to the client. The objects it can serve include HTML documents, plain text, images, sounds, video and other data.

4. Introduction
Apache is the most popular web server on the internet, running approximately 60% of all web servers.
This is the default web server on Red Hat, SuSE, and Debian systems and is well known in industry for its flexibility and performance.

5. Introduction
Installing and maintaining is easy and ranks far below and DNS in complexity & difficulty of administration.
Its free and open source and full source code is available from Apache group site at

6. Why Apache ? Apache’s popularity is due to :
Apache is highly configurable .
It is extensible (for e.g. mod_perl and mod_php3 can be added) .
Supports virtual hosts or multi homed servers .
It is free and open source .

7. Installation
Apache is included with most Linux distributions. On a machine installed with recent version of Linux, chances are Apache is already installed and running.
Processor status can be checked to see if its running by using the command
machine1$ ps –ef | grep httpd

8. Installation
If one wishes to download the source code and compile it then,
Execute the configure script included with the distribution to detect type of system used and set up appropriate makefiles.
use --prefix option to specify where in ones directory tree the Apache server should live.

9. Installation For example : % ./configure --prefix=/etc/httpd
Default modules can be used or some features may be included or removed by invoking -enable-module= and
-disable-module= options to configure .

10. Installation
Some modules like asis, autoindex, env may be disabled for security reasons.
After executing configure run make and make install to actually compile and install the appropriate files .

11. Configuration
All configuration files are in conf directory ( /etc/httpd/conf). The files that are to be examined and customized are httpd.conf, srm.conf and access.conf .
httpd.conf is used to set the TCP port (usually port 80), location of log files, and various network and performance parameters

12. Running Apache
Apache can be started from machine’s rc scripts or initiated by hand with
% /usr/sbin/httpd –f /etc/httpd/conf/httpd.conf
It can be started automatically at boot time by making a link in rc directory that points to /etc/init.d/httpd .

13. Security Modifying the Default Header :
A hacker can exploit a web server by the information it sends in its header ( version, machine type, its built-up etc) .
Its always better to modify the default header by changing the lines that reveals this information in src/include/httpd.h file .

14. Security Upgrading old software when necessary.
Protecting Web Data with IP Restrictions :
Apache can be configured to allow restricted IP addresses only.
This can be done by adding following lines in .htaccess :
Order Deny, Allow
Deny from All
Allow from
Allow from

15. Security Using HTTP Authentication :
HTTP user authentication restricts access to a particular directory and subdirectories of the web server .
A browser implements authentication by prompting a dialog box for the user to type his username/password.

16. Security Using Secure HTTP Connections :
The Secure Socket Layer (SSL) should be used to minimize the likelihood that a hacker can snoop a username/password.
SSL not only encrypts the data before it is transferred to the web site, but also it decrypts the data received from the web site, thus securing the data transfers.

17. Internet Naming Service: DNS*

18. Overview Introduction to the DNS DNS Components
DNS Structure and Hierarchy
The DNS in Context

19. The DNS is… The “Domain Name System”
What Internet users use to reference anything by name on the Internet
The mechanism by which Internet software translates names to attributes such as addresses

20. The DNS is also… A globally distributed, scalable, reliable database
Comprised of three components
A “name space”
Servers making that name space available
Resolvers (clients) which query the servers about the name space

21. DNS as a Lookup Mechanism
Users generally prefer names to numbers
Computers prefer numbers to names
DNS provides the mapping between the two
I have “x”, give me “y”

22. DNS as a Database Keys to the database are “domain names”
18.in-addr.arpa, 6.4.e164.arpa
Over 200,000,000 domain names stored
Each domain name contains one or more attributes
Known as “resource records”
Each attribute individually retrievable

23. Global Distribution
Data is maintained locally, but retrievable globally
No single computer has all DNS data
DNS lookups can be performed by any device
Remote DNS data is locally cachable to improve performance

24. Loose Coherency
Each version of a subset of the database (a zone) has a serial number
The serial number is incremented on each database change
Changes to the master copy of the database are propagated to replicas according to timing set by the zone administrator
Cached data expires according to timeout set by zone administrator

25. Scalability No limit to the size of the database
No limit to the number of queries
Tens of thousands of queries handled easily every second
Queries distributed among masters, slaves, and caches

26. Reliability Data is replicated Clients can query
Data from master is copied to multiple slaves
Clients can query
Master server
Any of the copies at slave servers
Clients will typically query local caches
DNS protocols can use either UDP or TCP
If UDP, DNS protocol handles retransmission, sequencing, etc.

27. Dynamicity Database can be updated dynamically
Add/delete/modify of any record
Only master can be dynamically updated
Modification of the master database triggers replication

28. Overview Introduction to the DNS DNS Components
The name space
The servers
The resolvers
DNS Structure and Hierarchy
The DNS in Context

29. The Name Space The name space is the structure of the DNS database
An inverted tree with the root node at the top
Each node has a label
The root node has a null label, written as “”

30. Domain Names
A domain name is the sequence of labels from a node to the root, separated by dots (“.”s), read left to right
The name space has a maximum depth of 127 levels
Domain names are limited to 255 characters in length
A node’s domain name identifies its position in the name space

31. Subdomains
One domain is a subdomain of another if its domain name ends in the other’s domain name
So sales.nominum.com is a subdomain of
nominum.com & com
nominum.com is a subdomain of com

32. Delegation Administrators can create subdomains to group hosts
According to geography, organizational affiliation etc.
An administrator of a domain can delegate responsibility for managing a subdomain to someone else
The parent domain retains links to the delegated subdomains

33. Delegation Creates Zones
Each time an administrator delegates a subdomain, a new unit of administration is created
The subdomain and its parent domain can now be administered independently
These units are called zones
The boundary between zones is a point of delegation in the name space
Delegation is good: it is the key to scalability

34. Dividing a Domain into Zones
nominum.com domain
nominum.com zone
ams.nominum.com zone
rwc.nominum.com zone

35. Overview Introduction to the DNS DNS Components
The name space
The servers
The resolvers
DNS Structure and Hierarchy
The DNS in Context

36. Name Servers
Name servers store information about the name space in units called “zones”
The name servers that load a complete zone are said to “have authority for” or “be authoritative for” the zone
Usually, more than one name server are authoritative for the same zone
This ensures redundancy and spreads the load
Also, a single name server may be authoritative for many zones

37. Name Servers and Zones Name Servers Zones nominum.com isc.org
serves data for both nominum.com and isc.org zones
Name Servers
Zones
nominum.com
serves data for nominum.com zone only
isc.org
serves data for isc.org zone only

38. Types of Name Servers Two main types of servers
Authoritative – maintains the data
Master – where the data is edited
Slave – where data is replicated to
Caching – stores data obtained from an authoritative server
No special hardware necessary
BIND: Berkeley Internet Name Domain

39. Name Server Architecture
You can think of a name server as part of:
database server, answering queries about the parts of the name space it knows about (i.e., is authoritative for),
cache, temporarily storing data it learns from other name servers, and
agent, helping resolvers and other name servers find data
Also, the caching resolver can insert data into the cache, and can "query" the cache and the database server.

40. Name Server Architecture
Zone
data
file
From
disk
Authoritative Data
(primary master and
slave zones)
Agent
(looks up queries
on behalf of resolvers)
Cache Data
(responses from
other name servers)
Name Server Process
Master
server
Zone transfer

41. on behalf of resolvers)
Authoritative Data
Authoritative Data
(primary master and
slave zones)
Agent
(looks up queries
on behalf of resolvers)
Cache Data
(responses from
other name servers)
Name Server Process
Response
Resolver
Query

42. Using Other Name Servers
Authoritative Data
(primary master and
slave zones)
Agent
(looks up queries
on behalf of resolvers)
Cache Data
(responses from
other name servers)
Name Server Process
Response
Response
Another
name
server
Resolver
Query
Query

43. on behalf of resolvers)
Cached Data
Authoritative Data
(primary master and
slave zones)
Agent
(looks up queries
on behalf of resolvers)
Cache Data
(responses from
other name servers)
Name Server Process
Response
Resolver
Query

44. Overview Introduction to the DNS DNS Components
The name space
The servers
The resolvers
DNS Structure and Hierarchy
The DNS in Context

45. Name Resolution
Name resolution is the process by which resolvers and name servers cooperate to find data in the name space
Closure mechanism for DNS?
Starting point: the names and IP addresses of the name servers for the root zone (the “root name servers”)
The root name servers know about the top-level zones and can tell name servers whom to contact for all TLDs

46. Name Resolution A DNS query has three parameters:
A domain name (e.g.,
Remember, every node has a domain name!
A class (e.g., IN), and
A type (e.g., A)
Upon receiving a query from a resolver, a name server
1) looks for the answer in its authoritative data and its cache
2) If step 1 fails, the answer must be looked up

47. The Resolution Process
Let’s look at the resolution process step-by-step:
annie.west.sprockets.com
ping

48. The Resolution Process
The workstation annie asks its configured name server, dakota, for address
dakota.west.sprockets.com
What’s the IP address of
annie.west.sprockets.com
ping

49. The Resolution Process
The name server dakota asks a root name server, m, for address
m.root-servers.net
dakota.west.sprockets.com
What’s the IP address of
annie.west.sprockets.com
ping

50. The Resolution Process
The root server m refers dakota to the com name servers
This type of response is called a “referral”
m.root-servers.net
Here’s a list of the com name servers. Ask one of them.
dakota.west.sprockets.com
annie.west.sprockets.com
ping

51. The Resolution Process
The name server dakota asks a com name server, f, for address
What’s the IP address of
m.root-servers.net
dakota.west.sprockets.com
f.gtld-servers.net
annie.west.sprockets.com
ping

52. The Resolution Process
The com name server f refers dakota to the nominum.com name servers
Here’s a list of the nominum.com name servers. Ask one of them.
m.root-servers.net
dakota.west.sprockets.com
f.gtld-servers.net
annie.west.sprockets.com
ping

53. The Resolution Process
The name server dakota asks a nominum.com name server, ns1.sanjose, for address
What’s the IP address of
m.root-servers.net
dakota.west.sprockets.com
ns1.sanjose.nominum.net
f.gtld-servers.net
annie.west.sprockets.com
ping