2 - Raspberry PI Community Projects

11.2. Web Server (HTTP)
The Falcot Corp administrators decided to use the Apache HTTP server, included in Debian
Squeeze at version 2.2.16.
ALTERNATIVE
Other web servers
Apache is merely the most widely-known (and widely-used) web server, but
there are others; they can offer beer performance under certain workloads,
but this has its counterpart in the smaller number of available features and
modules. However, when the prospective web server is built to serve static
files or to act as a proxy, the alternatives, such as nginx and lighpd, are worth
investigating.
11.2.1. Installing Apache
By default, installing the apache2 package causes the apache2-mpm-worker version of Apache to
be installed too. The apache2 package is an empty shell, and it only serves to ensure that one of
the Apache versions is actually installed.
The differences between the variants of Apache 2 are concentrated in the policy used to handle
parallel processing of many requests; this policy is implemented by an MPM (short for Multi-
Processing Module). Among the available MPMs, apache2-mpm-worker uses threads (lightweight
processes), whereas apache2-mpm-prefork uses a pool of processes created in advance (the traditional
way, and the only one available in Apache 1.3). apache2-mpm-event also uses threads,
but they are terminated earlier, when the incoming connection is only kept open by the HTTP
keep-alive feature.
The Falcot administrators also install libapache2-mod-php5 so as to include the PHP support in
Apache. This causes apache2-mpm-worker to be removed, and apache2-mpm-prefork to be installed
in its stead, since PHP only works under that particular MPM.
SECURITY
Execution under the wwwdata
user
By default, Apache handles incoming requests under the identity of the wwwdata
user. This means that a security vulnerability in a CGI script executed by
Apache (for a dynamic page) won't compromise the whole system, but only
the files owned by this particular user.
Using the suexec modules allows bypassing this rule so that some CGI scripts
are executed under the identity of another user. This is configured with a
SuexecUserGroup usergroup directive in the Apache configuration.
Another possibility is to use a dedicated MPM, such as the one provided by
apache2-mpm-itk. This particular one has a slightly different behavior: it allows
“isolating” virtual hosts so that they each run as a different user. A vulnerability
in one website therefore cannot compromise files belonging to the
owner of another website.
QUICK LOOK
List of modules
The full list of Apache standard modules can be found online.
➨ http://httpd.apache.org/docs/2.2/mod/index.html
268 The Debian Administrator's Handbook