Lecture 18: Server Configuration & Miscellanea. Monday, April 23, 2018

Transcription

1 Lecture 18: Server Configuration & Miscellanea Monday, April 23, 2018

2 Apache Earlier in the course, we talked about the configuration of everything except Apache There are some components of configuring Apache that vary from operating system to operating system primarily the location of files We will talk about Apache as it is configured on Ubuntu 1

3 Apache Configuration All of the configuration files are found in /etc/apache2/ Only root can edit these files, but they are readable by anyone on the system 2

4 apache2.conf apache2.conf allows you to turn on options on the server that apply to all hosts Some of these options include: o The location of the files for the default host o The maximum number of requests that can be made o The number of seconds to wait before a timeout o Which user/group should the Apache processes run as This may be called httpd.conf on some systems 3

5 envvars envvars (no file extension) contains environment variables about the system Just as you need environment variables set to be able to operate as a user on a Linux system, so does the user running the Apache processes These variables include arguments to pass to the apache process, default directories for log files, default language, etc. 4

6 ports.conf ports.conf tells Apache which ports it should be checking for connections to serve webpages The default for http is port 80, so it will contain the line: Listen 80 5

7 ports.conf The default for https is port 443, but it should only check if the SSL module is installed, so it contains more: <IfModule ssl_module> Listen 443 </IfModule> This demonstrates that we can have Apache s configuration do things only if certain modules are installed 6

8 Structure of Remaining Configuration Files The remaining configuration files use a structure of two folders for configuration available and enabled These files include: o sites-available, sites-enabled holds configuration files for virtual hosts o mods-available, mods-enabled holds files for loading and configuring modules o conf-available, conf-enabled holds configuration files for more specific items that don t really belong in apache2.conf 7

9 Structure of Remaining Configuration Files All of the configuration files are found in the -available folder they are modules, sites, etc. that are available To enable the site configuration data stored in sitesavailable/cs383.conf, you would run the command: a2ensite cs383 (short for apache 2 enable site) There are also commands a2enmod and a2enconf 8

10 Structure of Remaining Configuration Files These commands create a symlink from X-available/Y.conf to X-enabled/Y.conf enabling the site There are also commands a2dissite, a2dismod, and a2disconf that disable the site, module, or configuration, which essentially remove the symlink 9

11 Site Configuration Files Site configuration files allow you to configure a virtual host This stores information such as what the hostname is, what ports it should respond to, where on the server the associated webdocs directory is located, where the error logs are, who the web server should run as (in our case), and various other options The first file in the sites-enabled directory is the default for the main host (which is why it is called 000-default.conf on most systems to ensure it comes first alphabetically) 10

12 HTTPS/SSL SSL is a later that sites on to of HTTP to give us HTTPS With the exception of the role of SSL, HTTP and HTTPS are otherwise identical SSL serves two main purposes: o To verify that the server we are communicating with is who we think it is o To encrypt data as it is sent over the Internet from our computer to the website 11

13 HTTPS/SSL Certificates must be purchased from a certificate authority (CA) For a certificate to work, you must have the server s public key If we had to store the public key of every server, it would use tons of data on everybody s computer, and would need to be updated hourly So we have CAs whose public keys are installed by default, some with the operating system and some with the browser 12

14 HTTPS/SSL You can create your own certificate with openssl on any server if you install the package; however, you will get a warning message if you attempt to access it, as the public key for your server (such as dilbert) isn t installed on every computer in the world If you know only a small group of people are using your site, you can give them the public key that they can install to avoid getting the error message 13

15 Isolation One last method of managing security for an outwardfacing server is isolation Think about the security issues we discussed this semester many of them would be moot points if you were the only user on the server, and your application was the only application on the server You no longer need to worry about who the server is running as, the permissions on the files, etc. 14

16 Virtualization However, isolation (in the past) had a major drawback physical space To isolate all of the applications, you needed a physical server for each one Virtualization makes this much easier to manage Many companies are purchasing large servers just to host virtual machines, and moving each service/application into it s own VM 15

17 APIs APIs allow us to connect and interact with other applications Creating APIs is often put on the web developer because the easiest way to make the data available is through a series of web pages that receive input and provide output 16

18 Sending/Receiving Data through APIs There are two different ways to send or receive data through an API o JSON o XML 17

19 JavaScript Object Notation JSON Similar to syntax used for arrays in JavaScript Example: {'building': [{'name': 'Stark Learning Center', 'abbrev': 'SLC', 'rooms': [ ]}...]} 18

20 Extensible Markup Language XML Similar syntax as HTML (in fact, HTML is considered to be XML) More important than with HTML that XML be well formed Example: o In HTML, this works, but is not well formed because all tags opened within one tag must be closed before that tag containing it is closed o Incorrect: <h1><strong>title</h1></strong> (but still parses correctly) o Correct: <h1><strong>title</strong></h1> 19

21 XML Example <?xml version="???"> <buildings> <building id="slc"> <name>stark Learning Center</name> <abbrev>slc</abbrev> <rooms> <room id="slc409"> <number>409</number> <seats>24</seats> <type>complab</type> </room> <room id="slc411"> <number>411</number> <seats>40</seats> <type>lecture</type> </room>... </rooms> </building> <building id="breis">... </building> </buildings> 20

22 Sending/Receiving Data through APIs When this data is sent, all white space (except in between string literals within the data) can be removed, i.e.: <?xml version="???"><buildings><building id="slc"><name>stark Learning Center</name><abbrev>SLC</abbrev><rooms>< room id="slc409"><number>409</number><seats>24 </seats><type>complab</type></room><room id="slc411"><number>411</number><seats>40 </seats><type>lecture</type></room>... </rooms></building><building id="breis">...</building></buildings> 21

23 Components Needed to Connect thru an API 1. Data (JSON and XML) 2. Action (Route) 3. App ID and Key 4. User ID and Key 22

24 App ID & Key Each application connecting to the API should have it s own application ID and key They should be random strings not at all able to be guessed This allows you to delegate access (or completely cut off access) to a particular app, particularly for sensitive information or protect against abuse 23

25 User ID and Key Corresponds to a particular username and password but not the same Different for each user on each API connection Again, allows you to control access and cut off in the case of abuse Example: In D2L, my User ID/Key allows me to perform instructor activities, while yours does student activities 24

26 Actions /Routes Routes tell the API what action you are performing Example: In D2L, a route to get a list of all of the dropboxes in a course is /d2l/api/le/{crn}/dropbox/folders/ The route is to access their D2L API in the learning environment ( le ) for a particular CRN to use the dropbox tool and show the folders 25

27 Putting It Together We take all of these components together to make an AJAX call over GET or POST in a URL like: XX&appKey=XXXXX&userID=XXXXX&userKey=XXXX X&route=XXXXX Additionally, we can either pass the data (if it requires it) as an additional query string variable (GET) or through an AJAX form (POST) 26