the apache-ssl locker (rev5)

The apache-ssl locker contains software supported and recommended by the CWIS group of MIT Information Systems for providing secure web servers. MIT's apache-ssl software is based on the Apache webserver, and includes support for ssl, fast cgi and Java servlet development. (Support for Java servlets is just for the Sun platform, due to the lack of JSDK for any other platform)

Contents of the apache-ssl locker
Pros and cons of running your own webserver
Current versions of the software: Linux Solaris
Old versions still available: SGI Irix and Digital Unix
What about NT?
How to install and run the apache-ssl software
Who uses apache-ssl?
Where do I get help
Known defects (bugs)
Keep informed
Support and maintenance
Revision history

Contents of apache-ssl locker:

The apache-ssl locker contains sources, documentation, and examples of the apache-ssl webserver, which is the webserver supported by MIT Information Systems. The locker also includes several pre-compiled binaries which contain some popular features, as well as sources and instructions to build custom webservers which use other features.
This is the fifth revision (rev5) of the apache-ssl locker, based on new revisions of apache software. The rev5 software is available for Unix/Athena platforms running Solaris (4u,4m)

The apache-ssl locker is accessible to any AFS client under

    /afs/athena.mit.edu/software/apache-ssl/

or to web browsers at

    http://web.mit.edu/apache-ssl/www/

The sources for MIT's apache-ssl software are based on sources of diverse origin: the Apache webserver, available from apache.org); Open Secure Socket Layer (SSL), (available from the OpenSSL Project); and the Java Servlet Development Kit (JSDK) from Sun Microsystems. MIT's apache-ssl includes fast-cgi, (available from apache-ssl.org). FastCGI, which is an addition to the Apache server for getting fast cgi applications to run (available from www.fastcgi.com) and finally Apache Jserv which enable Appache Web server to run Java servlets (available from Apache Java Group)
The locker contains the Fast CGI Development Kit to enable developers to build their own fast cgi applications.
The locker contains the Java Servlet Development Kit (JSDK), available from Sun Microsystems, which can be used to develop and test server extensions based on the servlet API.

Pros and Cons of Running Your Own Webserver:

We have written a short, inexhaustive list of things for you to consider carefully before deciding to run your own webserver. Basically, unless you have the time to spend in careful design, testing, deployment and management issues associated with webservers, we recommend strongly that you not run your own webserver.
This locker provides software that allows you to run your own webserver. We do not provide support for design, testing, deployment, and management issues associated with running a webserver.
In summary, the "pro" is that you get to run your own webserver; the "con" is that you get to run your own webserver.

Current versions: Solaris and Linux

The current (rev5) version of the apache-ssl software is based on:
- apache_1.3.12, available from apache.org
- openssl-0.9.5a, available from the OpenSSL Project
- apache-ssl, incorporating apache_1.3.12 and ssl_1.40
- mod_fastcgi_2.2.4, available from apache-ssl.org
- FastCGI kit 1.5.2, available from www.fastcgi.com
- ApacheJServ-1.1.2, available from Apache Java Group (available only for Solaris platform)
We have built, tested and provide pre-compiled binaries of apache-ssl (rev5) for:
- Solaris version 5.7, architecture 4x (4m, 4u)
- Linux version 2.2.14 (The version used by Linux Athena)
If our pre-compiled binaries do not suit your needs, you can build your own apache-ssl webserver (rev5) using our source distribution for:
- Solaris version 5.7, architecture 4x (4m, 4u)
- Linux version 2.2.14
See the section below for information on getting the apache-ssl distribution. The apache-ssl distrubtion consists of tarfiles which contain all sources, documentation and examples for you to build your own custom apache-ssl (rev5) webserver. Basically, you untar the distribution onto /var on your local disk, and you configure and build your server on your local disk.

Windows NT:

We have not ported the software to NT, and have no plans to do so.

How to Get, Install and Run MIT's apache-ssl software:

If you are running one of our "cookie-cutter" versions of apache-ssl (rev4) and want to update to rev5, you basically need to put some new binaries in place and make a few configuration file changes. Here are the instructions.
If you are running a custom apache-ssl server and want to update it to rev5, you should probably pick up the entire rev5 distribution as you would if you were setting up an apache-ssl webserver for the first time.

To set up an apache-ssl webserver for the first time:

Follow the instructions in the README file
Get the compressed tarfiles that make up the apache-ssl distribution for the platform you want, uncompress and untar them on your system, and see the instructions that come with them. apache-ssl (rev5) is available for
- Solaris 2.7 var.https.tar.gz and var.ssl.tar.gz
- Linux 2.2.14 var.https.tar.gz and var.ssl.tar.gz
Note : when you untar var.https.tar, the binary /var/https/httpsd points to /var/https/bin/httpsd, which is an apache server with ssl. If you want fcgi or java, repoint /var/https/httpsd to one of the other binaries in /var/https/bin. The names of the binaries suggest what features they include.
Note for AFS access: These files are located in the "rev5/arch" directory in the locker, under "rev5/arch/SYS/tar" where SYS represents the platform type.
These are essentially "cookie cutter" installations, with a few pre-compiled binaries, but they also contain all sources and documentation so you can compile and configure an apache-ssl webserver to meet your needs (look under /var/https/source).
Get the server certificate from the MIT CA ( How to), which you will need if you want your webserver to handle "https" connections. Install an rc script to automatically start/stop the server on reboot. (example of rc file )

Obsolete versions:

Previous versions of apache-ssl are still available :

rev4

For the time being rev4 is still available at rev4

Known Users:: A few of the users of the software are :
lcs@mit.edu

ccount@mit.edu

salemme@mit.edu
They may be willing to answer questions or help others in setting up their servers.

Keep informed:

If you use this software, please let us know so we can inform you of problems, new releases and so on by sending mail to

apache-ssl@mit.edu

If you have an Athena account, you can add yourself to the

apache-ssl-users@mit.edu

mailing list.

Known problems and defects: Problem with secure server not recognizing user certificates, 2/2/2000: On February 2, 2000, one of the certificate files included in the apache-ssl distribution expired, causing secure servers (https) to reject user certificates with the confusing (to the user) message, "Your certificate has expired...". See the README for information on how to make the fix to your apache-ssl webserver, which requires a new mitCAclient.pem file.
Security Note Received on 7/6/98:
On 7/6/98 we received a security warning on having the script test-cgi in the cgi-bin of an Apache server. Please, after testing the installation, remove /var/https/cgi-bin/test-cgi. For more information, see http://128.196.109.25/sploits/test-cgi.server_protocol.html.

Support and Maintenance

Consulting:

The main supporter of this software is miki@mit.edu

Address general questions regarding webservers at MIT to cwis-help@mit.edu

Users group:

Send general questions to the apache-ssl users at MIT at apache-ssl-users@mit.edu

Bug Reports:

Send bug reports to

apache-ssl@mit.edu

Maintainer(s):

Miki Lusztig
miki@mit.edu

Revision History

First release, rev1, on 1/22/98
Second release, rev2, on 10/5/98
Third release, rev3, on 1/21/99
Fourth release, rev4, on 9/3/99

Comments to web-request@mit.edu
$Date: 2000/03/03 16:49:23 $