Detailed Report On APACHE SERVER

This term paper presents the conceptual (abstract) architecture of the Apache web server. It tries to emphasize the overall structure of the system, without going into implementation details, or requiring such details to be previously known by the reader. The main purpose is to make the architecture "intellectually tractable" .The conceptual architecture has been inferred from a number of Apache related documents and from the way source files are grouped and named.At a high level the Apache server architecture is composed of a core that implements the most basic functionality of a web server and a set of standard modules that actually service the phases of handling an HTTP request.The server core accepts a HTTP request and implicitly invokes the appropriate handlers, sequentially, in the appropriate order, to service the request.The architecture offers great opportunities for extending or changing the Apache functionality, by the means of adding or replacing modules.

                             

                         Overview of the Apache Architecture

v  Apache is an open source HTTP web server. It handles HTTP Requests sent to it and then it is able to them

v  Apache is Open source and is built and maintained over at Apache.org

v  Apache is comprised of two main building Blocks with the Latter being comprised of many other little building blocks. The Building Blocks are the Apache Core and then the Apache Modules that in a sense extend the Apache core.

v  Very easy to implement and very easy to add extend its abilities by the adding of different modules. This is why this server has become so popular.

        Now I'm going to explain to you what is Apache

Apache is an HTTP server used by the majority of the servers. If you have Apache server installed on your computer, you can easily open it with the help of the icon that can be found on the tray. With the right click with the mouse, you can select open Apache monitor and here in this Apache service monitor, you can select from many options.

 For example –:

You can stop the working of the server or you can start it. Now we minimize it and now let's see how it looks like on the computer. In this Apache directory, you can find many folders and many files and if we go in HD ducks' folder, here we can find a file called index. If we would like to check how Apache works on the computer and how to erase the internal. It means that Apache is on and Apache works well on our computer

                    Brief Background

v  Initially started in 1996 by Robert McCool.

v  Since 1996, Apache web server has been the most popular HTTP server in the market on the World Wide Web.

v  The Apache was the first web server architecture that was used by the Netscape Communication Corporation.

v  Apache has evolved with the years of the internet. Server is used to support both static and dynamic pages online. Many programming languages are supported by the Apache Server are as follows: PHP, Perl and Python.

             

                                        Apache Overview Diagram

•      As you can see the designers of Apache decided to take a modular approach so that anyone can add to the basic functionality of the server without disturbing the basic Core implementation.

In order to achieve this Modular Approach the Apache Designers decided to break down the server into two main Components.

      The Apache Core: Which handles the basic functionality of the Server? Such as allocating requests and maintaining and pooling all the connections.

      The Apache Modules: Which are in a sense the added extensions to the server which handle a lot of the other types of processing the server must achieve such as doing user Authentication.

    This is what usually occurs in the Apache Core in a sense an overview of the flow that happens in the Apache Core.  This is the Apache Core interacting with all the other components that surround it. These are the core components of the Apache architecture.

         

                   Installation of Apache Server

                                  The installer start screen

Server Information - use local host for both the Network Domain and the Server Name, unless you have a fixed IP address and your own domain name. Put your e-mail address for the Administrator's Email Address.

Setup Type - select "Typical"

Destination folder - the default is fine, C:\Program Files\Apache Group\

Finish the installation and quit the installer. At this point Apache is probably already running on your machine

                                                                  

                                                  Tips & Warnings

v  On some Linux installations, Apache comes pre-installed and running. On those installations, many of these steps can be skipped.

                     Security Perspective in Apache Web Server

Ø      Hopefully with the presentation of the Apache server. You can now know what multi-processed Web servers are and how Apache qualifies to be one.

Ø       Another important aspect that is worth discussing is how processes work. Two types of processes are invoked, parent and child. The parent process is the main process from which several child processes are invoked.

                           

                   Now how does this imply to security right?

Ø       Whenever a request is sent to the Apache Web server, the parent process receives the request. Then the parent process forwards the request to one of the child processes. The child process then handles the request by responding to it. This behavior is supported for a valid reason: security.

Ø  The root user initiates the parent process of the Web server in UNIX systems. The root user is the most powerful user on the UNIX system. For security reasons, the parent process doesn't directly process the requests sent by the clients.

Ø For example, if a client sends a request with malicious intentions and the parent process handles the request. The parent process will being run as a root user will have all necessary rights to perform any operation on the computer, thereby making the system server vulnerable. However, if the request is forwarded to a process that has restricted permissions on the computer, no harm can be done.     

                           

                                     

                                Apache as a Proxy Server

The cool thing about Apache, though, is that it's not just a Web server. It can do lots of other things too - and of its more interesting (though less well-known) capabilities includes the ability to act as a proxy server for both HTTP and FTP connections over a network.

A proxy is a piece of software that supports sending and receiving data on behalf of another application. It's an intermediate layer on your network that receives requests from within the networks, forwards them to the appropriate host, reads the response, and sends the response back to the requesting host.

 

By functioning as a gateway to the public Internet, a proxy makes for more secure networks, and also allows multiple hosts on a network to share a single public IP address.

So, if you have an office network consisting of multiple workstations, but only a single Internet connection, you can use a proxy to provide Internet access to all the workstations using the single IP address and single connection.

Since a proxy effectively carries the weight of serving all Internet traffic for a network, it can also be used to do a couple of other things.

                    

                                   Common Media Hack

ü  Providing any kind of system information to a hacker could potentially provide a hacker with the ammunition they need to break into your server. The less a hacker knows about the configuration of a system, the harder it is to break into.

ü  One of the most common exploits used by hackers is to "take over" a service running on the server and use it for their own purposes.

For example-:

 Gaining access to a mail application via an HTML form-based script. Hacker would use the mail server to send out spam or acquire confidential user information.

ü  While not a direct security threat, a poorly written application can use up a system's available resources to the point where it becomes almost completely unresponsive.

ü  Safe programming layer to prevent buffer overrun exploits and sandboxing to limit resource consumption

ü  Efficient output data stream buffering

ü  Apache compatible configuration

ü  Extensive logging and debug trace

ü  The apache server architecture was design to be highly customizable for business programmer to modify it for their needs.

                                      Apache Web Server Popularity

As Apache continues to win market share and technically excellent products like AOL server stagnate a closer examination of the effect of popularity on web server selection has become necessary.

Examining the trends in the web server market for Apache, IIS and AOL server yields some interesting results. After a spectacular period of growth IIS seems to have stalled and seems unlikely to increase in popularity over the next year. AOL server has a shrinking share of the market as the number of servers in use has not changed for the last 2 years.

Popularity in itself should not always be an important part of web server selection. Only complex, large and mission critical sites will be adversely affected by a bad web server choice. Determining the popularity of various web solutions in this market segment is difficult due to the process of selecting which sites meet the criteria.

                                                

                                                          Apache Usage

v  Apache is primarily used to serve both static content and dynamic Web pages on the World Wide Web. Many web applications are designed expecting the environment and features that Apache provides.

v  Apache is the web server component of the popular LAMP web server application stack, alongside My SQL, and the PHP/Perl/Python programming languages.

v  Apache is used for many other tasks where content needs to be made available in a secure and reliable way.

                               Conclusion

Apache web server has a modular architecture with a core component that defines the most basic functionality of a web server and a number of modules which implements the steps of processing a HTTP request, offering handlers for one or more of the phases.

The core is the one that accepts and manages HTTP connections and calls the handlers in modules in the appropriate order to service the current request.

The architectural style can be characterized implicit invocation made by the server core on handlers implemented by the modules.

Modules are not implemented as separate process although it is possible to fork children or to cooperate with other independent process to handle a phase of processing a request.

The functionality of Apache can be easily changed by writing new modules which complements or replace the existing one. The server is also highly configurable, at different levels and modules can define their own configuration commands.