Contents

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

What's New in Oracle HTTP Server 12c (12.2.1.x)

• New and Changed Features in 12c (12.2.1.1)
• New and Changed Features in 12c (12.2.1)
  • New Features in 12c (12.2.1)
    • New and Changed Features Available with Apache httpd 2.4
    • New Operational Mode—Restricted-JRF
    • New Modules
    • iPlanet Migration to Oracle HTTP Server
    • Trust Flags
    • Oracle WebLogic Server Proxy Monitoring
    • Support for Multi-tenancy and Partitions for Oracle WebLogic Server Proxy Plug-Ins
  • Significant Updates in 12c (12.2.1)
    • New Ciphers
    • Removal of Modules
    • Replacements for mod_perl
    • Replacements for mod_fastcgi/mod_cgi
    • Replacements for mod_plsql
    • Names of WLST Custom Command Have Changed
    • New WLST Commands
    • createOHSTestDomain (ohs_createTestDomain) WLST Custom Command Has Been Removed
    • Other Upgrade Notes
  • Features Removed

Part I Understanding Oracle HTTP Server

1 Introduction to Oracle HTTP Server

• What is Oracle HTTP Server?
• Oracle HTTP Server 12c (12.2.1) Topologies
• Key Features of Oracle HTTP Server
  • Restricted-JRF Mode
  • Oracle WebLogic Server Proxy Plug-In (mod_wl_ohs)
  • CGI and Fast CGI Protocol (mod_proxy_fcgi)
  • Security Features
    • Oracle Secure Sockets Layer (mod_ossl)
    • Security: Encryption with Secure Sockets Layer
    • Security: Single Sign-On with WebGate
  • URL Rewriting and Proxy Server Capabilities
• Domain Types
  • WebLogic Server Domain (Full-JRF Mode)
  • WebLogic Server Domain (Restricted-JRF Mode)
  • Standalone Domain
• Understanding Oracle HTTP Server Directory Structure
• Understanding Configuration Files
  • Staging and Run-time Configuration Directories
  • Oracle HTTP Server Configuration Files
  • Modifying an Oracle HTTP Server Configuration File
• Upgrading from Earlier Releases of Oracle HTTP Server
• Oracle HTTP Server Support

2 Understanding Oracle HTTP Server Modules

• Oracle-Developed Modules for Oracle HTTP Server
  • mod_certheaders Module—Enables Reverse Proxies
  • mod_context Module—Creates or Propagates ECIDs
  • mod_dms Module—Enables Access to DMS Data
  • mod_odl Module—Enables Access to ODL
  • mod_ora_audit—Supports Authentication and Authorization Auditing
  • mod_ossl Module—Enables Cryptography (SSL)
  • mod_webgate Module—Enables Single Sign-on
  • mod_wl_ohs Module—Proxies Requests to Oracle WebLogic Server
• Apache HTTP Server and Third-party Modules in Oracle HTTP Server

3 Understanding Oracle HTTP Server Management Tools

• Administering Oracle HTTP Server Using Fusion Middleware Control
  • Accessing Fusion Middleware Control
  • Accessing the Oracle HTTP Server Home Page
  • Understanding the Oracle HTTP Server Home Page
  • Editing Configuration Files Using
• Administering Oracle HTTP Server Using WLST
  • Oracle HTTP Server-Specific WLST Commands
  • Using WLST in a Standalone Environment

Part II Managing Oracle HTTP Server

4 Running Oracle HTTP Server

• Before You Begin
• Creating an OHS Instance
  • Creating an Oracle HTTP Server Instance in a WebLogic Server Domain
    • Creating an Instance by Using WLST
    • Creating an Instance by Using
    • About Instance Provisioning
  • Creating an Oracle HTTP Server Instance in a Standalone Domain
• Performing Basic Oracle HTTP Server Tasks
  • About Using the WLST Commands
  • Understanding the PID File
  • Starting Oracle HTTP Server Instances
    • Starting Oracle HTTP Server Instances Using Fusion Middleware Control
    • Starting Oracle HTTP Server Instances Using WLST
    • Starting Oracle HTTP Server Instances from the Command Line
      • Storing Your Node Manager Password
    • Starting Oracle HTTP Server Instances on a Privileged Port (UNIX Only)
    • Starting Oracle HTTP Server Instances as a Different User (UNIX Only)
  • Stopping Oracle HTTP Server Instances
    • Stopping Oracle HTTP Server Instances Using Fusion Middleware Control
    • Stopping Oracle HTTP Server Instances Using WLST
    • Stopping Oracle HTTP Server Instances from the Command Line
  • Restarting Oracle HTTP Server Instances
    • Restarting Oracle HTTP Server Instances Using Fusion Middleware Control
    • Restarting Oracle HTTP Server Instances Using WLST
  • Checking the Status of a Running Oracle HTTP Server Instance
    • Checking Server Status Using Fusion Middleware Control
    • Checking Server Status Using WLST
  • Deleting an Oracle HTTP Server Instance
    • Deleting an Oracle HTTP Server Instance in a WebLogic Server Domain
      • Deleting an Instance Using WLST
      • Deleting an Instance Using
    • Deleting an Oracle HTTP Server Instance from a Standalone Domain
  • Changing the Default Node Manager Port Number
    • Changing the Default Node Manager Port Using WLST
    • Changing the Default Node Manager Port Using Oracle WebLogic Server Administration Console
• Remotely Administering Oracle HTTP Server
  • Setting Up a Remote Environment
    • Host Requirements for a Remote Environment
    • Task 1: Set Up an Expanded Domain on host1
    • Task 2: Pack the Domain on host1
    • Task 3: Unpack the Domain on host2
    • Task 4: Run Oracle HTTP Server Remotely

5 Working with Oracle HTTP Server

• About Editing Configuration Files
  • Editing a Configuration File for a Standalone Domain
  • Editing a Configuration File for a WebLogic Server Domain
• Specifying Server Properties
  • Specifying Server Properties Using Fusion Middleware Control
  • Specify Server Properties by Editing the httpd.conf File
• Configuring Oracle HTTP Server Instances
  • Secure Sockets Layer Configuration
  • Configuring Secure Sockets Layer in Standalone Mode
    • Configure SSL
      • Task 1: Create a Real Wallet
      • Task 2: (Optional) Customize Your Configuration
      • Basic SSL Configuration Example
    • Specify SSLVerifyClient on the Server Side
      • Forcing Clients to Authenticate Using Certificates
      • Forcing a Client to Authenticate for a Particular URL
      • Authorizing a Client for a Particular URL
      • Allowing Clients with Strong Ciphers and CA Client Certificate or Basic Authentication
    • Enable SSL Between and Oracle WebLogic Server
  • Exporting the Keystore to an Oracle HTTP Server Instance Using WLST
  • Importing Wallets to the KSS Database after an Upgrade Using WLST
  • Associating Oracle HTTP Server Instances With a Keystore Using WLST
  • Configuring MIME Settings using Fusion Middleware Control
    • Configuring MIME Types
    • Configuring MIME Encoding
    • Configuring MIME Languages
  • About Configuring mod_proxy_fcgi
  • About Configuring the Oracle WebLogic Server Proxy Plug-In (mod_wl_ohs)
    • Configuring SSL for mod_wl_ohs
  • Removing Access to Unneeded Content
    • Edit the cgi-bin Section
    • Edit the Fancy Indexing Section
    • Edit the Product Documentation Section
  • Using the apxs Command to Install Extension Modules
  • Disabling the Options Method
  • Updating Oracle HTTP Server Component Configurations on a Shared Filesystem
• Configuring the mod_security Module
  • Configuring mod_security in the httpd.conf File
  • Configuring mod_security in a mod_security.conf File
  • Sample mod_secuirity.conf File

6 Managing and Monitoring Server Processes

• Oracle HTTP Server Processing Model
  • Request Process Model
  • Single Unit Process Model
• Monitoring Server Performance
  • Oracle HTTP Server Performance Metrics
  • Viewing Performance Metrics
    • Viewing Server Metrics Using Fusion Middleware Control
    • Viewing Server Metrics Using WLST
• Oracle HTTP Server Performance Directives
  • Understanding Performance Directives
    • Changing the MPM Type Value in a Standalone Domain
    • Changing the MPM Type Value in a WebLogic Server Managed Domain
  • Configuring Performance Directives Using Fusion Middleware Control
    • Setting the Request Configuration Using Fusion Middleware Control
    • Setting the Connection Configuration Using Fusion Middleware Control
    • Setting the Process Configuration Using Fusion Middleware Control
• Understanding Process Security for UNIX

7 Managing Connectivity

• Default Listen Ports
• Defining the Admin Port
• Viewing Port Number Usage
  • Viewing Port Number Usage Using Fusion Middleware Control
  • Viewing Port Number Usage Using WLST
• Managing Ports
  • Creating Ports Using Fusion Middleware Control
  • Editing Ports Using Fusion Middleware Control
  • Disabling a Listening Port in a Standalone Environment
• Configuring Virtual Hosts
  • Creating Virtual Hosts Using Fusion Middleware Control
  • Configuring Virtual Hosts Using Fusion Middleware Control

8 Managing Oracle HTTP Server Logs

• Overview of Server Logs
  • About Error Logs
  • About Access Logs
  • Configuring Log Rotation
    • Syntax and Examples for Time- and Size-Based Log Rotation
• Configuring Oracle HTTP Server Logs
  • Configuring Error Logs Using Fusion Middleware Control
    • Configuring the Error Log Format and Location
    • Configuring the Error Log Level
    • Configuring Error Log Rotation Policy
  • Configuring Access Logs Using Fusion Middleware Control
    • Configuring the Access Log Format
    • Configuring the Access Log File
  • Configuring the Log File Creation Mode (umask) (UNIX/Linux Only)
    • Configure umask for an Oracle HTTP Server Instance in a Standalone Domain
    • Configure umask for an Oracle HTTP Server Instance in a WebLogic Server Managed Domain
• Configuring the Log Level Using WLST
• Log Directives for Oracle HTTP Server
  • Oracle Diagnostic Logging Directives
    • OraLogMode
    • OraLogDir
    • OraLogSeverity
    • OraLogRotationParams
  • Apache HTTP Server Log Directives
    • ErrorLog
    • LogLevel
    • LogFormat
    • CustomLog
• Viewing Oracle HTTP Server Logs
  • Viewing Logs Using Fusion Middleware Control
  • Viewing Logs Using WLST
  • Viewing Logs in a Text Editor
• Recording ECID Information
  • About ECID Information
  • Configuring Error Logs for ECID Information
  • Configuring Access Logs for ECID Information
• Terminating SSL Requests
  • About Terminating SSL at the Load Balancer
    • Terminating SSL at the Load Balancer
  • About Terminating SSL at Oracle HTTP Server
    • Terminating SSL at Oracle HTTP Server

9 Managing Application Security

• About Oracle HTTP Server Security
• Classes of Users and Their Privileges
• Resources Protected
• Authentication, Authorization and Access Control
  • Access Control
  • User Authentication and Authorization
    • Authenticating Users with Apache HTTP Server Modules
    • Authenticating Users with WebGate
  • Support for FMW Audit Framework
    • Managing Audit Policies Using Fusion Middleware Control
• Implementing SSL
  • Global Server ID Support
  • PKCS #11 Support
  • SSL and Logging
• Using mod_security
• Using Trust Flags

Part III Appendixes

A Oracle HTTP Server WLST Custom Commands

• Getting Help on Oracle HTTP Server WLST Custom Commands
• Names of WLST Custom Commands Have Changed
• Oracle HTTP Server Commands
  • ohs_addAdminProperties
  • ohs_addNMProperties
  • ohs_createInstance
  • ohs_deleteInstance
  • ohs_exportKeyStore
  • ohs_postUpgrade
  • ohs_updateInstances

B Migrating to the mod_proxy_fcgi and mod_authnz_fcgi Modules

• Task 1: Replace LoadModule Directives in htttpd.conf File
• Task 2: Delete mod_fastcgi Configuration Directives From the htttpd.conf File
• Task 3: Configure mod_proxy_fcgi to Act as a Reverse Proxy to an External FastCGI Server
• Task 4: Setup an External FastCGI Server
• Task 5: Setup mod_authnz_fcgi to Work with FastCGI Authorizer Applications.

C Frequently Asked Questions

• How Do I Create Application-Specific Error Pages?
• What Type of Virtual Hosts Are Supported for HTTP and HTTPS?
• Can I Use Different Language and Character Set Versions of Document?
• Can I Apply Apache HTTP Server Security Patches to Oracle HTTP Server?
• Can I Upgrade the Apache HTTP Server Version of Oracle HTTP Server?
• Can I Compress Output From Oracle HTTP Server?
• How Do I Create a Namespace That Works Through Firewalls and Clusters?
• How Can I Enhance Website Security?
• Why is REDIRECT_ERROR_NOTES not set for "File Not Found" errors?
• How can I hide information about the Web Server Vendor and Version
• Can I Start OHS by Using apachectl or Other Command-Line Tool?
• How Do I Configure Oracle HTTP Server to Listen at Port 80?
• How Do I Terminate Requests Using SSL Within Oracle HTTP Server?
• How Do I Configure End-to-End SSL Within Oracle HTTP Server?
• Can Oracle HTTP Server Front-End Oracle WebLogic Server?
• What is the Difference Between Oracle WebLogic Server Domains and Standalone Domains?
• Can Oracle HTTP Server Cache the Response Data?
• How Do I Configure a Virtual Server-Specific Access Log?

D Troubleshooting Oracle HTTP Server

• Oracle HTTP Server Unable to Start Due to Port Conflict
• System Overloaded by Number of httpd Processes
• Permission Denied When Starting Oracle HTTP Server On a Port Below 1024
• Using Log Files to Locate Errors
  • Rewrite Log
  • Script Log
  • Error Log
• Recovering an OHS Instance on a Remote Host
• Oracle HTTP Server Performance Issues
  • Special Runtime Files Reside on a Network File System
  • UNIX Sockets on a Network File System
  • DocumentRoot on a Slow File System
• Out of DMS Shared Memory
• Performance Issues with Instances Created on Shared File Systems
• Node Manager 12c (12.1.2) OHS Throws Java Exception on AIX

E Configuration Files

• httpd.conf File
• ssl.conf File
• admin.conf File
• mod_wl_ohs.conf File
• mime.types File
• ohs.plugins.nodemanager.properties File
• magic File
• keystores/<wallet-directory> File
• auditconfig.xml File
• component-logs.xml File
• component_events.xml File
• Additional Reference

F Property Files

• ohs_admin.properties File
• ohs_nm.properties File
• ohs.plugins.nodemanager.properties File
  • Cross-platform Properties
  • Environment Variable Configuration Properties
  • Properties Specific to Oracle HTTP Server Instances Running on Linux and UNIX

G OHS Module Directives

• Note on mod_wl_ohs Module
• mod_certheaders Module
  • AddCertHeader Directive
  • SimulateHttps Directive
• mod_ossl Module
  • SSLCARevocationFile Directive
  • SSLCARevocationPath Directive
  • SSLCipherSuite Directive
  • SSLEngine Directive
  • SSLFIPS Directive
  • SSLHonorCipherOrder Directive
  • SSLInsecureRenegotiation Directive
  • SSLOptions Directive
  • SSLProtocol Directive
  • SSLProxyCipherSuite Directive
  • SSLProxyEngine Directive
  • SSLProxyProtocol Directive
  • SSLProxyWallet Directive
  • SSLRequire Directive
  • SSLRequireSSL Directive
  • SSLSessionCache Directive
  • SSLSessionCacheTimeout Directive
  • SSLTraceLogLevel Directive
  • SSLVerifyClient Directive
  • SSLWallet Directive