View source for Mini Servers: Apache 2.2.9 PHP 5.2.6 Portable

{{Uc nav mini servers}}
[[Image:Uc_mini_2a.gif|Apache 2.2.9|right]]'''Mini Server 6 using Apache 2.2.9 and PHP 5.2.6 Core'''

This mini server packs a real punch; trouble is it also packs a real disk hit, increases server size from 1MB to 6MB. However adding the PHP 5.2.6 core greatly extends the server's power.

Hey not much use without a MYSQL server! So you have never considered file databases as an alternative. The support files include an excellent example; it’s a quest book (Version 1.7.2) from the [http://www.digioz.com/ DigiOz] stable. A single file database, code is well commented and easy to follow. These chaps produce height quality open source software, their site is more than worth a visit, and forum is friendly check out their tutorials. I would like to thank Pete for his kind permission to use the DigiOz logo and use the quest book as an example.

Note: Check the [[#Support files|support files]] section for server download details.

== Security ==
In order for PHP applications to perform their task they need to interact with the underlying programs if a security hole exists between interactions it can be exploited. Exploitation occurs only when data is returned by a user! or if the script is malicious.

A well-written program like the guest book will have these holes plugged, however an application remains venerable if server software leave other security holes open. Security issues are a two way street which I attempt to cover later.

Anyway I digress before looking at security issues lets get the server up and running with PHP.

'''''[[#top | Top]]'''''
== Specification ==
The server has the following specification:

* Server shall be portable
* Static HTML and Dynamic PHP pages shall be served.
* The server shall log all web requests.
* All unused modules shall be disabled.

Our mini server is intended to be small in keeping with this philosophy only the PHP core shall be used it is relatively large at 5MB however this is small in comparison to the complete PHP package of 25MB.

If the basic core does not meet your requirements download the full PHP package and add extensions as required. 

'''''[[#top | Top]]'''''
== Configuring Apache ==
Using the configuration file from [[Mini Servers: Apache 2.2.9 Portable|Mini Server 1a]] very few changes are required these I have highlighted in bold.
 
{|border="0" cellpadding="4" cellspacing="1" style="background:#222222"
|-style="background:#e8e8e8"
!httpd.conf located in folder: <nowiki>*</nowiki>\udrive\usr\local\apache2\conf
!Comments
|-style="background:#f5f5f5"
|
<nowiki>#</nowiki> File name: http.conf<br>
<nowiki>#</nowiki> Created By: The Uniform Server Development Team<br>
<nowiki>#</nowiki> Edited Last By: Mike Gleaves (ric) <br>
<nowiki>#</nowiki> Main Apache 2.2.9 HTTP server configuration file.<br>
<nowiki>#</nowiki> Supports PHP<br>
<nowiki>#</nowiki> V 1.0 14-7-2008
|
&nbsp;
|-style="background:#f5f5f5"
|
<nowiki>#</nowiki>&nbsp;================================================== <br>
<nowiki>#</nowiki> Modules <br>
<nowiki>#</nowiki>&nbsp;==================================================<br>
&nbsp;LoadModule authz_host_module modules/mod_authz_host.so<br>
&nbsp;LoadModule dir_module modules/mod_dir.so<br>
&nbsp;LoadModule log_config_module modules/mod_log_config.so<br>
&nbsp;LoadModule mime_module modules/mod_mime.so<br>
&nbsp;'''LoadModule php5_module&nbsp;"/usr/local/php/php5apache2_2.dll"''' 
|
'''LoadModule php5_module''': Module required to handle PHP5 pages.
|-style="background:#f5f5f5"
|
<nowiki>#</nowiki> ======================================== <br>
<nowiki>#</nowiki> Basic settings <br>
<nowiki>#</nowiki> ======================================== <br>
&nbsp;'''PHPIniDir "/usr/local/php/"''' <br>
&nbsp;'''Listen 8086''' <br>
&nbsp;ServerName '''localhost:8086'''<br>
&nbsp;ServerAdmin fred@www.somedomain.com <br>
&nbsp;UseCanonicalName Off <br>
&nbsp;ServerSignature Off <br>
&nbsp;HostnameLookups Off <br>
ServerTokens Prod <br>
&nbsp;ServerRoot "/usr/local/apache2"<br>
&nbsp;DocumentRoot "/www" <br>
&nbsp;PidFile /usr/local/apache2/logs/httpd.pid <br>
<IfModule mod_dir.c> <br>
&nbsp;&nbsp;'''DirectoryIndex index.html index.htm index.php'''<br>
</IfModule>
|
'''PHPIniDir:''' Informs PHP where to find the php.ini file.

'''''Note'':''' I found without this line php.ini was correctly located. However I would recommend using it otherwise PHP swans off looking in various locations (see info). The line guarantees correct php.ini file is used (multi servers or individual installations will place other php.ini files on your PC resulting in conflicts).

'''DirectoryIndex:''' When a user requests a page supplying only a folder name (example fred.com) the index page is automatically returned by default. Note you can have more than one index page in the same folder with a different file extension. Order of priority left to right, first one found in the list is returned, all other are ignored. I have added '''index.php''' to this list.

'''''Note'':''' Moved server port to 8086 prevents clashing with other servers. 
|-style="background:#f5f5f5"
|
<nowiki>#</nowiki> ======================================== <br>
<nowiki>#</nowiki> HTTP and performance settings <br>
<nowiki>#</nowiki> ======================================== <br>
&nbsp;Timeout 300 <br>
&nbsp;KeepAlive On <br>
&nbsp;MaxKeepAliveRequests 100 <br>
&nbsp;KeepAliveTimeout 15 <br>
<IfModule mpm_winnt.c><br>
&nbsp;&nbsp;ThreadsPerChild 64<br>
&nbsp;&nbsp;MaxRequestsPerChild  0<br>
</IfModule> 
|
&nbsp;
|-style="background:#f5f5f5"
|
<nowiki>#</nowiki> ======================================== <br>
<nowiki>#</nowiki> Access control <br>
<nowiki>#</nowiki> ======================================== <br>
<Directory /> <br>
&nbsp;&nbsp;Options None<br>
&nbsp;&nbsp;AllowOverride None <br>
&nbsp;&nbsp;Order deny,allow <br>
&nbsp;&nbsp;Deny from all <br>
</Directory> 

<Directory "/www"> <br>
&nbsp;&nbsp;Order allow,deny <br>
&nbsp;&nbsp;Allow from all <br>
</Directory>
|
&nbsp;
|-style="background:#f5f5f5"
|
<nowiki>#</nowiki> ======================================== <br>
<nowiki>#</nowiki> MIME encoding <br>
<nowiki>#</nowiki> ======================================== <br>
&nbsp;DefaultType text/plain <br>
&nbsp;TypesConfig /usr/local/apache2/conf/mime.types<br>
&nbsp;'''AddType Application/x-httpd-php .php'''
|
'''''Note'':''' The '''AddType''' directive maps a content-type to a file extension.
Without this line pages will be served unprocessed in plain text and reveal your PHP code.
|-style="background:#f5f5f5"
|
<nowiki>#</nowiki> ======================================== <br>
<nowiki>#</nowiki> Logs: debug, info, notice, warn, error, crit<br>
<nowiki>#</nowiki> ======================================== <br>
&nbsp;LogLevel warn <br>
&nbsp;LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\"<br>
&nbsp;\"%{User-Agent}i\"" combined <br>
&nbsp;LogFormat "%h %l %u %t \"%r\" %>s %b" common <br>
&nbsp;LogFormat "%{Referer}i -> %U" referer <br>
&nbsp;LogFormat "%{User-agent}i" agent <br>
&nbsp;ErrorLog "logs/error_log" <br>
&nbsp;CustomLog "logs/access.log" combined<br>
<nowiki>#</nowiki> ========================================
|
&nbsp;
|}

'''''[[#top | Top]]'''''
=== Information ===
I have shown below the search order PHP performs to locate its php.ini file no real need to understand this just make sure to include a '''PHPIniDir''' command in the Apache configuration file.

# SAPI module specific location:
## '''PHPIniDir''' directive in Apache 2
## -c command line option in CGI and CLI
## php_ini parameter in NSAPI
## PHP_INI_PATH environment variable in THTTPD
# The PHPRC environment variable (Before PHP 5.2.0 this was checked after the registry key mentioned below.)
# HKEY_LOCAL_MACHINE\SOFTWARE\PHP\IniFilePath (Windows Registry location)
# Current working directory (for CLI)
# The web server’s directory (for SAPI modules)
# Directory of PHP (If Windows)
# Windows directory (C:\windows or C:\winnt)
# –with-config-file-path compile time option

'''''[[#top | Top]]'''''

== PHP - Core ==
Although our mini server only uses the PHP core you need to download the full package to extract it. (OK I have included a core in the support files) Check the PHP site and download any newer version this allows you to install any extensions you require. On the other hand perhaps you want to run an earlier version of PHP. The following outlines how to install PHP on our mini server.

Download site [php.net http://www.php.net/downloads.php php.net]

We are not interested in installing PHP on our PC hence download a zip package:

PHP 5.2.6 zip package [9,516Kb] - 3 May 2008 located in the “Windows Binaries” section

After downloading unzip to any folder, locate files '''php5apache2_2.dll''', '''php5ts.dll''' and '''php.ini-recommended''' copy these to mini server folder '''*\mini_server_6\udrive\usr\local\php'''

Rename the file '''php.ini-recommended''' to '''php.ini'''

Believe it or not that’s all there is to the installation process, all that remains is to modify the php.ini file. 

'''''[[#top | Top]]'''''

== php.ini ==
Open '''php.ini''' have a read, yep its not a bedtime classic it’s a long confusing read. So what do you change! Surprisingly very little, to get you up and running the following table shows the lines that require changing:

{|border="0" cellpadding="2" cellspacing="1" style="background:#000000"
|-style="background:#e8e8e8"
!Line  	
!php.ini located in folder: *\mini_server_6\udrive\usr\local\php
|-style="background:#f5f5f5"
|131||short_open_tag = On
|-style="background:#f5f5f5"
|149||output_buffering = Off
|-style="background:#f5f5f5"
|212||allow_call_time_pass_reference = On
|-style="background:#f5f5f5"
|229||safe_mode_include_dir = ".;/usr/local/PHP/includes;/usr/local/PHP/pear"
|-style="background:#f5f5f5"
|297||expose_php = Off
|-style="background:#f5f5f5"
|355||error_reporting = E_ALL & ~E_NOTICE & ~E_STRICT
|-style="background:#f5f5f5"
|407||track_errors = On
|-style="background:#f5f5f5"
|431||error_log = logs/logs.log
|-style="background:#f5f5f5"
|455||variables_order = "EGPCS"
|-style="background:#f5f5f5"
|492||magic_quotes_gpc = On
|-style="background:#f5f5f5"
|495||magic_quotes_runtime = Off
|-style="background:#f5f5f5"
|498||magic_quotes_sybase = Off
|-style="background:#f5f5f5"
|525||include_path = ".;/usr/local/PHP/includes;/usr/local/PHP/pear"
|-style="background:#f5f5f5"
|537||user_dir = "/www"
|-style="background:#f5f5f5"
|541||extension_dir = "/usr/local/PHP/extensions"
|-style="background:#f5f5f5"
|598||upload_tmp_dir = /tmp
|-style="background:#f5f5f5"
|601||upload_max_filesize = 10M
|-style="background:#f5f5f5"
|757||sendmail_from = me@localhost.com
|-style="background:#f5f5f5"
|1045||session.save_path = "/tmp/"
|-style="background:#f5f5f5"
|1332||soap.wsdl_cache_dir="/tmp"
|}

'''''Note 1'':''' Our mini server does not require the folders pear, includes or extensions however including these in the ini file will make it easier when you want to add extensions or includes at a later date.

For extension you enable the appropriate line in the php.ini file remember to copy a corresponding dll into the extensions folder. 

'''''Note 2'':''' Line 466 '''register_globals = Off''' this is the default keep it that way. There are security issues if you tun it on. Checks out the included example site explaining why register_globals are evil.   

'''''[[#top | Top]]'''''

== Testing ==
* Start the server by double clicking on '''server_start.bat'''
* Type '''<nowiki>http://localhost:8086</nowiki>''' into your browser address bar.
* Check test site runs, this confirms the server is working.
* Close the server using '''server_stop.bat'''

'''''[[#top | Top]]'''''

== Security ==
When testing you need as much information as possible however when you put your servers on-line its best to restrict what you make public.
Restrict public Information:

Make sure the following are set in the Apache configuration file:

* '''ServerTokens Prod''' – Prevents exposing server information makes it a little more difficult for automated attacks, which scan for vulnerable versions of Apache or its modules.
* '''ServerSignature Off''' - Suppresses the error line which exposes the server version number, virtual host ServerName, "mailto:" reference to the ServerAdmin

Make sure the following are set in the PHP configuration file:

* '''expose_php = Off''' – Prevents reports in every request that PHP is being used to process the request, and what version of PHP is installed. makes it a little more difficult for automated attacks,

If you download the mini server on the index page you will find a link named '''PHP info''' this runs a page containing a small script:

{| cellpadding="2" cellspacing="1" style="background:#000000;"
|- style="background:#e8e8e8;"
!info.php located in folder www
|- style="background:#f5f5f5;"
| 
<?<br>
phpinfo();<br>
?>
|}

'''Delete''' the file '''info.php''' before you put your server on-line it exposes your PHP configuration and detailed server information.

'''''Note'':''' You can disable the function by setting this line in the '''php.ini''' configuration file: '''disable_functions''' = '''"phpinfo"'''

The above are not real security measures they just provide a little fence to be jumped when a script kiddie wants to play. 

'''''[[#top | Top]]'''''
=== Disable functions ===
I previously mentioned don’t install what you do not use hence disable all unused functions. This really is an impractical option however there are a number of system functions that should be disabled:

{|
|-
|phpinfo||&nbsp;
|-
|dir||— Return an instance of the Directory class
|-
|virtual||— Perform an Apache sub-request
|-
|popen||— Opens process file pointer
|-
|pclose||— Closes process file pointer
|-
|putenv||— Sets the value of an environment variable
|-
|dl||— Loads a PHP extension at runtime
|-
|exec||— Execute an external program
|-
|shell_exec||— Execute command via shell and return the complete output as a string
|-
|system||— Execute an external program and display the output
|-
|passthru||— Execute an external program and display raw output
|-
|proc_open||— Execute a command and open file pointers for input/output
|-
|proc_terminate||— Kills a process opened by proc_open
|-
|proc_get_status||— Get information about a process opened by proc_open()
|-
|proc_close||— Close a process opened by proc_open() and return the exit code of that process.
|-
|pfsockopen||— Open persistent Internet or Unix domain socket connection
|-
|pcntl_exec||— Executes specified program in current process space
|-
|posix_kill||— Send a signal to a process
|-
|posix_mkfifo||— Create a fifo special file (a named pipe)
|-
|posix_setpgid||— Set process group id for job control
|-
|posix_setsid||— Make the current process a session leader
|-
|posix_setuid||— Set the UID of the current process
|-
|escapeshellcmd||— Escape shell metacharacters
|-
|escapeshellarg||— Escape a string to be used as a shell argument
|-
|readfile||— Reads a file and writes it to the output buffer.
|-
|ini_alter||— Alias of ini_set()
|-
|parse_ini_file||— Parse a configuration file
|-
|show_source||— Alias of highlight_file()
|-
|curl_exec||— Perform a cURL session
|}

'''Your disable function line will look like this''':
{|cellpadding="2" cellspacing="1" style="background:#000000;"
|-style="background:#f5f5f5;"
|
disable_functions = "phpinfo, dir, virtual, popen, pclose, putenv, dl, exec, shell_exec, system, passthru, proc_open, proc_terminate, proc_get_status, proc_close, pfsockopen, pcntl_exec, apache_child_terminate, posix_kill, posix_mkfifo, posix_setpgid, posix_setsid, posix_setuid, escapeshellcmd, escapeshellarg, readfile, ini_alter, parse_ini_file, show_source, curl_exec"
|}

Backticks are dangerous when looking at a line of code they can be confused with a single quote . What follows a backtick is system commands never let anyone have access to this.

{|cellpadding="2" cellspacing="2" style="background:#000000;"
|-style="background:#f5f5f5;"
|
'''''Note'':''' '''Backticks''' are an alias for '''shell_exec()''' when shell_exec() is disabled backticks are also disabled.
|}

You need to edit php.ini to include phpinfo I have added the other functions, note when disabling functions be careful that you don't break any features you need hence always test.

That completes plugging the server holes, however what I have covered does not guarantee the server is one hundred percent secure. Think of the above as a pointer, it provides search terms you should be using when doing further research into hardening your server. I mentioned its a two way street any application must also be hardened this I cover on the next page.

'''''[[#top | Top]]'''''

== Support files ==
Each mini server is complete and zipped into a single self-extracting archive file.

=== Download ===
Download this server from SourceForge [http://sourceforge.net/projects/miniserver/files/MiniServer/MiniServer_%20Apache%202.2.9%20PHP%205.2.6%20Portable/ Project Page] save the file '''mini_server_6.exe''' to any folder of your choice.

'''''Note'':''' Check out the mini server's [[Mini Servers: Support and download|support and download page]] detailing how to obtain full binaries for Apache and PHP.

'''''[[#top | Top]]'''''

=== Extract files ===
Double click on mini_server_6.exe, starts the extraction process.

No need to change the folder destination, click extract, this creates a new folder '''mini_server_6''' containing the following:
{|
|-
|
{|cellpadding="2"
|-
|valign="top"|'''Top level folder'''||mini_server_6 contains two files:<br>1) '''server_start.bat''' - Double click to start the<br>2) '''server_stop.bat''' - Double click to stop server
|-
|'''program folder''':||Uniform Server's programs that make the server portable
|-
|'''tmp folder''':||Stores temporary files such as sessions
|-
|'''apache2 folder''':||Contains all files associate with the Apache server
|-
|'''php folder''':||Contains files that make up the PHP core
|-
|'''www folder:'''||This is where you put your web site or sites
|-
|valign="top"|'''Test sites''':||guestbook, test1 and test2 are test sites these are included to<br>
provide an idea of the servers capability's. Delete these folders and<br>
copy your sites into this folder (Referred to as the document root folder)
|}
|
[[Image:Uc_mini_server_6_dir.gif]]
|}

'''''[[#top | Top]]'''''

----

=== Test ===
Testing is straight forward.

# Start the server by double clicking on '''server_start.bat''' (automatically detects free drive letter creates new virtual drive and runs the server.) 
# Start a web browser.
# Type '''<nowiki>http://localhost:8086/</nowiki>''' into the browser address bar.
# An index page is displayed, check out test sites MPG1, MPG2 and guestbook.
# Stop the server by double clicking on server_stop.bat

'''''[[#top | Top]]'''''

=== Your web site ===
Open the folder www located in folder '''*mini_server_6\udrive\www''' (Note * is the path to the folder you extracted the server files) delete everything in '''www''' and copy your site into it.

'''''Note'':''' Make sure one of your pages in folder www is named '''index.html''', '''index.htm''' or '''index.php''', otherwise you will need to type a page name in every time to access your site.

e.g. <nowiki>http://localhost:8086/somepage.html</nowiki>

'''''[[#top | Top]]'''''

== Change Virtual Drive ==
The server automatically detects the first free drive letter and uses that to run the server on.
You can override this in one of two ways:

# Start the server using a drive parameter for example: '''server_start.bat z''' this forces the server to use drive z
# Edit server_start.bat, locate the following line:<br>&nbsp;&nbsp;'''rem set Disk=w''' <br>Remove the rem and replace w with the letter you want to use for example:<br>&nbsp;&nbsp;'''set Disk=x'''&nbsp; Forces the server to use drive letter x

'''''[[#top | Top]]'''''

== Change server default port ==
*Open file: '''httpd.conf''' (Located in folder: \mini_server_6\udrive\usr\local\apache2\conf)
*Locate the lines:<br>Listen 8086<br>ServerName localhost:8086<br>
*Change to:<br>Listen 8080<br>ServerName localhost:8080

This moves the server to the standard secondary web server port

'''''Note'':''' Type '''<nowiki>http://localhost:8080</nowiki>''' into a browser to view the site.

If port already in use try any value above 2000

'''''[[#top | Top]]'''''

== Multi Servers ==
If you wish to run several mini servers at the same time create a new folder for each server and copy contents of mini_server_6 into each of these.

Change the server port for each server to be unique. The servers may be started in any order.

'''''Note'':''' You can run the mini servers alongside Uniform Server 3.5-Apollo however you must start Uniform Server first.

'''''[[#top | Top]]'''''

== Summary ==
This mini server is ideal for learning PHP its compact size allows you have several copies installed on a USB pen drive each with different test applications. I have covered how to secure the server and PHP in the real world you also must pay attention to securing your PHP scripts. Included with the support files is a guest book script that demonstrates some of the techniques used.

When you change the scripts configuration file hopefully you will notice there is a fundamental problem, on the [[Mini Servers: Apache 2.2.9 PHP 5.2.6 Service|next page]] I show how to resolve this, in addition cover some defensive programming.

'''''[[#top | Top]]'''''

----

{|
| [[Image:Uc_small_logo.gif]] || [[User:Ric|Ric]]
|}

[[Category: UniCenter]]
[[Category: Mini Servers]]
[[Category: PHP]]
[[Category: Oily Rag]]
[[Category: Self Install]]