Apache/iX for HP e3000 MPE

1. What's New
2. Welcome
3. System Requirements
4. How to Obtain Apache/iX
5. Distribution Contents Highlights
6. Bundled Packages
7. How to Compile Apache and mod_perl
8. How to Configure Apache
9. How to Run
10. Apache for MPE/iX vs. Apache for Unix Implementation Considerations
11. Known Bugs Under Investigation
12. To-Do List
13. Change History

---

What's New

• March 2, 2001
• Added a section on PHP.
• Added a get out the vote section regarding the Interex SIGWeb PHP ballot item.
• October 1, 2000
• Released beta testing version of 1.3.13-dev taken from Apache CVS snapshot from earlier today. Do not use this beta release in production environments. The production version of 1.3.13 will be released soon from www.apache.org, and will contain the latest MPE diffs.
• This version manages UID/GID issues differently than previous versions from www.apache.org. See Implementation Considerations below for details.
• Because this is only a snapshot of 1.3.13-dev, the final release of 1.3.13 will most likely contain some additional OS-independent functionality.
• June 11, 2000
• Upgraded to vanilla Apache 1.3.12 plus a few MPE patches that have been submitted to apache.org. Many features are available on MPE for the first time with this release:
• Support for DSO modules (mod_so). You can build add-on modules such as mod_perl or mod_php in NMXL libraries which Apache will load at startup time in order to extend the functionality of the server. Note that you no longer have to recompile all of Apache in order to add modules.
• Support for the incredible power of mod_rewrite.
• Support for the ftp/http proxy/caching abilities of mod_proxy.
• Support for mod_vhost_alias which simplifies server configuration when dealing with large numbers of virtual hosts.
• Bundled with mod_perl 1.24.
• The recommended umask (which controls default file permissions) is now 007 which forbids all non-owner, non-group access. The umask is specified in the JHTTPD job. This change may impact existing CGI applications. Do not alter the recommended umask without fully considering the security implications. The change matches WebWise.
• The freeware version of Apache is now distributed in the APACHEFW account. This will not conflict with HP Apache or HP WebWise in the APACHE account.
• The Apache parent process now runs as MGR.APACHEFW and the child processes run as SERVER.APACHEFW in order to provide better security against malicious or sloppy CGI applications. This change matches WebWise.
• Apache will now unconditionally do setuid()/setgid() on the values of User and Group specified in conf/httpd.conf. Previously the setuid()/setgid() would only be done if the server was running as MANAGER.SYS. This change matches WebWise.
• Standardized bixby.org INSTALL script.
• September 17, 1999
• Migrated from cccd.edu to bixby.org.

---

Welcome

Please send your comments, questions, and bug reports directly to me, Mark Bixby, by e-mailing to mark@bixby.org. Or just post them to HP3000-L.

The platform I used to do this port is an HP 3000 957 running MPE/iX 6.0 and using the GNU gcc C compiler.

The combined porting wisdom from all of my ports can be found in my MPE/iX Porting Guide.

---

CAUTION! CAUTION! CAUTION!

Furthermore, versions of Apache that you download from bixby.org will probably be more current than what HP is supporting on MPE, including both the FOS Apache (currently based on Apache 1.3.4, but a 1.3.9 beta is currently available) and the extra-cost HP WebWise MPE/iX Secure Web Server (currently based on Apache 1.3.9) products. The bixby.org version of Apache may have exciting new functionality that does not exist in the HP versions of Apache. If you become addicted to the bixby.org version, you may have trouble moving back to the older HP supported versions.

---

System Requirements

• Requires MPE/iX 6.0 or later. It will definitely NOT run on MPE/iX 5.5 or earlier.
• Requires the following patches:
• For MPE/iX 6.0:
• General release patch MPEKXT3B or MPEKX86I or MPEKXU3F. The original required patch is MPEKXT3B. It's been superseded several times -- the most current patch is MPEKXU3F. Any patch in the supersedes tree starting with MPEKXT3B is sufficient. If you do not install this patch, you will experience transient "access forbidden" errors on files that really are accessible.
• Beta patch MPELX44C. This patch is required to fix a bug in the HPGETPROCPLABEL() intrinsic that DSO support uses to load DSO modules from NMXLs. If you do not install this patch, you will not be able to use any DSOs. Because this patch is site-specific and not yet general release, you must call the HP Response Center and ask them to send it to you.
• Site-specific patch MPELX51A. This patch enhances the POSIX kill() function to permit an MPE user with AM capability to kill any process running with the same POSIX GID (i.e. running in the same MPE account). If you do not install this patch, the Apache parent process running as MGR.APACHEFW will not be able to properly manage the child processes running as SERVER.APACHEFW and unpredictable results may occur. Because this patch is site-specific and not yet general release, you must call the HP Response Center and ask them to send it to you.
• For MPE/iX 6.5:
• Site-specific patch MPELX44B. This patch is required to fix a bug in the HPGETPROCPLABEL() intrinsic that DSO support uses to load DSO modules from NMXLs. If you do not install this patch, you will not be able to use any DSOs. Because this patch is site-specific and not yet general release, you must call the HP Response Center and ask them to send it to you.
• Site-specific patch MPELX51B. This patch enhances the POSIX kill() function to permit an MPE user with AM capability to kill any process running with the same POSIX GID (i.e. running in the same MPE account). If you do not install this patch, the Apache parent process running as MGR.APACHEFW will not be able to properly manage the child processes running as SERVER.APACHEFW and unpredictable results may occur. Because this patch is site-specific and not yet general release, you must call the HP Response Center and ask them to send it to you.
• Since you have to talk to the HP Response Center anyway, do yourself a favor and ask them to send you GR patch MPELX37A which fixes many serious tar problems. This isn't required for Apache, but your installation will be much more reliable and will save a bunch of disk space.
• Perl/iX must be installed if you will be using the mod_perl DSO. The Apache 1.3.12 mod_perl 1.24 bundle requires the Perl/iX 5.6.0 June 1, 2000 release. You can download Perl/iX.

---

How to Obtain Apache/iX

1. Download Apache/iX using either FTP.ARPA.SYS or some other client
2. Extract the installation script
3. Edit the installation script
4. Run the installation script

Download Apache/iX using FTP.ARPA.SYS from your HP e3000 (the preferred method).....

:HELLO MANAGER.SYS
:XEQ FTP.ARPA.SYS
open ftp.bixby.org
anonymous
your@email.address
bytestream
cd /pub/mpe
get apache_1.3.13_dev.tar.Z /tmp/apache.tar.Z;disc=2147483647
exit

.....Or download using some other generic web or ftp client (the alternate method)

• Apache/iX from apache-1.3.9-php-3.0.14.tar.Z or apache_1.3.12_mpe.tar.Z or apache_1.3.13_dev.tar.Z

• /tmp/apache.tar.Z

Then extract the installation script (after both download methods)

:CHDIR /tmp
:XEQ TAR.HPBIN.SYS 'xvfopz /tmp/apache.tar.Z INSTALL'

Edit the installation script

:XEQ VI.HPBIN.SYS /tmp/INSTALL

Run the installation script

:XEQ SH.HPBIN.SYS /tmp/INSTALL

---

Distribution Contents Highlights

README

What you're reading now.

INSTALL

The installation script used to unpack the archive.

HTTPD

Ready to run pre-compiled Apache binary.

JHTTPD.sample

:STREAM this job to run Apache.

XLCOMBO

Special NMXL that HTTPD is linked with in order to support Perl scripts running under mod_perl. This is built by the mpebin/makexlcombo script.

XLC, XLCURSES, XLM, XLSOCKET, XLSTR, XLSVIPC

NMXL copies of /lib/libc.sl, /usr/lib/libcurses.sl, /lib/libm.sl, /usr/lib/libsocket.sl, /usr/lib/libstr.sl, /lib/libsvipc.sl. This is required to overcome certain limitations when the HPGETPROCPLABEL() intrinsic is called by programs with CAP=PM. These libraries are copied by the mpebin/makexlcopies script.

bin/

Various Apache support utilities.

cgi-bin/

sample CGI scripts; anything placed in this directory will be executed upon retrieval by Apache

conf/

Run-time Apache configuration files

htdocs/

The HTML Apache documentation.

icons/

The standard Apache icons.

include/

Various C header files required for compiling your own DSOs.

libexec/

Where the DSO NMXLs reside.

logs/

Run-time Apache log files

man/

Various Apache man pages. Do export MANPATH="/APACHEFW/PUB/man:$MANPATH" followed by man cmdname.

mpebin/

Various support scripts used when completely rebuilding Apache from source.

perl/

The equivalent of cgi-bin/ for Perl scripts that you want to run under mod_perl.

proxy/

Where mod_proxy does its caching.

public_html/

Various test files for demonstrating the //your.host/~MGR.APACHEF/ user directory feature. Contains several MPE-specific CGI examples, special server status links, and convenient links for running the mod_perl scripts.

src/apache-1.3-mpe/

The Apache source tree with integrated MPE patches.

src/mod_perl-1.24/

The mod_perl source tree. No modifications were required for MPE.

---

Bundled Packages

• Lars Appel's port of mod_jserv.

mod_perl-1.24

But mod_perl is much more than speedy CGI execution. Please visit //perl.apache.org/ for full details. And mod_perl is not just for geeks -- many large sites are running mod_perl, including PBS and TechWeb.

Mod_perl is preconfigured within conf/httpd.conf.sample to allow the speedy execution of Perl CGI scripts placed into the perl/ subdirectory.

The pieces of mod_perl are actually split between my Apache/iX and Perl/iX distributions. In order to run mod_perl under Apache, you must also install my Perl/iX 5.6.0 June 1, 2000 distribution.

I've tested mod_perl with Apache 1.3.12 and the HP WebWise MPE/iX Secure Web Server A.01.00 (based on Apache 1.3.9). Note that when you attempt to run my pre-compiled mod_perl DSO under WebWise, you will get a warning message at server startup complaining about module version differences. This is because WebWise is built with the EAPI (Enhanced Apache API) whereas the initial release of my mod_perl DSO is not. Non-EAPI DSOs will run on EAPI servers with warnings, but EAPI DSOs will not run at all on non-EAPI servers. A future release of the core Apache package will include the EAPI, and once that happens, so will all of my DSO modules. Therefore these compatibility issues will eventually disappear.

Note also that if you want to run mod_perl with WebWise, you will need to relink HTTPDS to include the same XL* libraries that my HTTPD requires. Please see the scripts in the mpebin/ subdirectory for how to create these libraries and do the relinking.

PHP

---

How to Compile Apache and mod_perl

1. :HELLO MGR.APACHEFW
2. :XEQ SH.HPBIN.SYS -L
3. cd src/apache_xxxxx
4. Read the INSTALL file for the official instructions
5. ./configure.mpe
6. make
7. make install
8. cd ../..
9. mpebin/makexlcombo
10. mpebin/makexlcopies
11. mpebin/relinkhttpd
12. cd src/mod_perl-xxxxx
13. Read the INSTALL file for the official instructions
14. ./configure.mpe
15. make
16. :HELLO MANAGER.SYS
17. :XEQ SH.HPBIN.SYS -L
18. cd /APACHEFW/PUB/src/mod_perl-xxxxx
19. make install

---

How to Configure Apache

1. :HELLO MGR.APACHEFW
2. :XEQ SH.HPBIN.SYS -L
3. cp JHTTPD.sample JHTTPD
4. Edit the JHTTPD job stream to make any desired customizations. Make sure the TZ variable is set appropriately for your geographic location.
5. cd conf
6. cp access.conf.sample access.conf
7. cp magic.sample magic
8. cp mime.types.sample mime.types
9. cp srm.conf.sample srm.conf
10. cp httpd.conf.sample httpd.conf
11. Edit httpd.conf and customize as desired. The other configuration files should not need customizing.
12. chmod 440 *

---

How to Run Apache

1. :STREAM JHTTPD.PUB.APACHEFW
2. Start a web browser and visit the following URLs:
• Official Apache documentation: //your.host:8080/
• The public_html subdirectory of user MGR.APACHEFW: //your.host:8080/~MGR.APACHEFW/
3. Examine the run-time log files in logs/*.
4. Stop Apache by kill `cat logs/httpd.pid`. You should only use :ABORTJOB as a last resort!

---

Apache for MPE/iX vs. Apache for Unix Implementation Considerations

Major functionality issues

• Beginning with HP-supported Apache 1.3.9 and HP WebWise MPE/iX Secure Web Server A.01.00 (based on Apache 1.3.9), the User and Group directives in httpd.conf are now unconditionally executed as corresponding setuid()/setgid() calls. Previously this was only done if HTTPD was being run as MANAGER.SYS. This functionality change was submitted back to the 1.3.13-dev source tree at www.apache.org. The Apache for Unix behavior is to only honor User and Group if running as root.
• Beginning with HP-supported Apache 1.3.9 and HP WebWise MPE/iX Secure Web Server A.01.00 (based on Apache 1.3.9), the SVIPC shared memory macros SHM_R and SHM_W have been modified from their traditional owner-only-read and owner-only-write values to be owner-and-group-read and owner-and-group-write on MPE/iX in order to allow increased parent/child flexibility in spite of MPE's limited POSIX UID/GID support. This functionality change was submitted back to the 1.3.13-dev source tree at www.apache.org. The Apache for Unix behavior uses the traditional owner-only values of SHM_R and SHM_W.

Minor functionality issues

• Apache/UX must be run as root to bind to TCP ports 1-1023. Apache/iX must call GETPRIVMODE() to bind to TCP ports 1-1023; PM is not used for ports greater than 1023. The standard web server HTTP port is 80.
• Apache/UX will call setuid()/setgid() to assume the run-time identity of the User/Group specified in httpd.conf if httpd is started by root. Apache/iX will call GETPRIVMODE() and setuid()/setgid() to assume the run-time identity of the User and Group specified in httpd.conf.
• Apache/UX in standalone mode will detach itself and run in the background as a system-type process. Apache/iX in standalone mode cannot detach itself and run in the background because MPE POSIX doesn't allow this.
• Apache/UX uses process groups to manage child processes. Apache/iX cannot use process groups because MPE POSIX doesn't support this. At this time, I don't know what the implications are.
• Apache/UX uses the setsockopt() options TCP_NODELAY. Apache/iX does not, because MPE doesn't support it. But TCP_NODELAY is the default MPE behavior anyway.
• Apache/UX under inetd reads from the socket via stdin and writes via stdout. Apache/iX under inetd reads *AND* writes the socket via stdin. I consider MPE 5.5 inetd to be broken and poorly documented, so I submitted SR 5003355016 to address this. If HP ever alters the MPE inetd to pass the socket the way HPUX inetd does, the existing Apache/iX code will break.

---

Known Bugs Under Investigation

• setsockopt() SO_KEEPALIVE fails, so this Apache code has been disabled for MPE. It's documented as supported in the Berkeley Sockets/iX manual.
• When doing shutdowns or restarts via the POSIX kill command, the Apache parent complains that the children don't terminate promptly. But I suspect the parent just isn't waiting long enough.

---

To-Do List

• Squash all known bugs listed above.
• Attempt to compile these modules:
• db_auth_module (will required porting Berkeley db)
• dbm_auth_module (will require porting GNU dbm)
• Attempt to compile support/suexec. This may or may not be possible due to MPE's somewhat limited setuid/setgid support.
• Investigate IP network performance issues. The MPE TCP/IP stack accessed via POSIX sockets calls seems to be *much* slower than the HPUX TCP/IP stack, i.e. a 9000/800G30 burdened with two full Usenet newsfeeds can serve large files with Apache/UX about 3-4 times faster than a 3000/969KS200 with Apache/iX.
• mod_php 4.0.
• mod_python?

---

Change History

• September 17, 1999
• Migrated from cccd.edu to bixby.org
• February 11, 1999
• HP dumps Netscape FastTrack in favor of Apache as the supported HP3000 web server.
• March 18, 1998
• New FastCGI section on the Apache/iX web page. I have no future plans to work on FastCGI.
• March 7, 1998
• Apache/iX updated to 1.3b5, compiled "straight out of the box" from the www.apache.org source. This BETA release contains various fixes, enhancements, and performance improvements. Of interest to Apache users on MPE 5.0 is the new NEED_HASHBANG_EMUL compile time symbol, which should support the use of CGI scripts (since I don't have access to a 5.0 machine, I haven't compiled or tested with this symbol).
• January 7, 1998
• Apache/iX updated to 1.2.5. This is a bugfix release consisting of mostly (minor) security fixes which on MPE would be more likely to just crash Apache rather than cause a security exposure. Still, if you are running something older than Apache 1.2.5, you probably want to upgrade. This version does not compile "straight out of the box" from www.apache.org; one minor porting fix was required which has been submitted to the next official 1.2.x release.
• December 18, 1997
• Apache/iX updated to 1.3b3. This version of Apache runs on MPE, Unix, Windows 95, Windows NT, and contains many new features. Note that 1.3b3 is BETA code that should not be run for mission-critical production purposes. The MPE port required a few patches that have not yet been submitted to the official Apache developers.
• FastCGI has been removed from Apache/iX 1.3b3 because the FastCGI developers do not yet support Apache 1.3.
• Proxy support has now been included for the first time in Apache/iX. It compiles cleanly, but I haven't personally tested it.
• October 8, 1997
• Added various Apache/iX home page links to Perl/iX.
• October 3, 1997
• Modified the gcc link on the Apache/iX home page to point to the Interex Freeware tape. Added the System Requirements section.
• August 27, 1997
• Newsflash from HPWorld97 in Chicago: HP plans to bundle Netscape FastTrack Server with MPE.
• August 19, 1997
• Changed the status scoreboard feature to use SVIPC shared memory instead of a disk file.
• August 18, 1997
• Rebuilt "straight out of the box" from the Apache 1.2.3 release from the official developers. This is a bugfix release; 1.2.2 was never released to the general public.
• MPE porting bug fixed for the RFC1413 "IdentityCheck On" configuration directive. This fix will be submitted to a future official version (1.3?) of Apache.
• Included mod_auth_anon into the standard MPE build.
• July 15, 1997
• Took the first step towards implementing SSL by successfully porting SSLeay-0.8.0. The next step will be to port the Apache-SSL patches when I can find some time, hopefully before the HPWorld conference next month. NOTE: the SSLeay port is strictly an internal work-in-progress. The source has not been included with the publicly available Apache/iX distribution, nor have the porting diffs been submitted yet to the SSLeay authors. Before you get overly excited about SSL, be aware that there are some important legal issues that you should know about.
• July 8, 1997
• Rebuilt "straight out of the box" from the Apache 1.2.1 release from the official developers.
• June 5, 1997
• Rebuilt "straight out of the box" from the Apache 1.2.0 release from the official developers who consider 1.2.0 to be a "production" release. The official developers will now be concentrating on the future 2.0 architecture, and so the 1.2.* code base won't be changing much. I still plan to test the few remaining untested 1.2.* modules (db, dbm, proxy) under MPE, as well as updating the FastCGI support once the OpenMarket folks stabilize their code somewhat.
• May 30, 1997
• Rebuilt "straight out of the box" from the Apache 1.2b11 release from the official developers. NOTE: this is the release candidate for 1.2 (i.e. non-"beta") that is scheduled to be released on June 5th, 1997.
• May 2, 1997
• Rebuilt "straight out of the box" from the Apache 1.2b10 release from the official developers. No new MPE functionality.
• April 11, 1997
• Support for FastCGI. Now I understand why people are waiting for FastCGI -- the performance is amazing compared to traditionally forked CGI programs.
• April 10, 1997
• Compiles "straight out of the box" from the official Apache group distribution. You should be able to build this on MPE from the source downloaded from www.apache.org. No new MPE functionality, but many generic Apache bug fixes from the official Apache developers.
• Demo config files now stored in conf/ instead of apache_1.2b8/conf/.
• Demo log files now written to logs/ instead of apache_1.2b8/logs/.
• February 27, 1997
• A few minor portability patches were required to get the public release of 1.2b7 to build on MPE. No new MPE functionality. If you discover the FastCGI references in the Apache/iX distribution, ignore them -- the code is definitely non-functional and is dependent on the results of an open HP Response Center call at this point.
• February 4, 1997
• I have compiled everything in support/ with the exception of suexec (which, being complex and dangerous, explains why I haven't worked on it yet).
• Basic user authentication works with password files created by support/htpasswd. But see Implementation Considerations for details.
• All of my porting patches to date have been submitted to the Apache group for inclusion in the upcoming 1.2b7 that will be available in source form at www.apache.org. My latest working copy of the port (which contains both source and binaries) will continue to be available from my own site as documented below in How to Obtain.
• January 30, 1997
• MPE patches carried forward to the newly released 1.2b6.
• Support removed for mod_fastcgi. With 1.2b6, mod_fastcgi is no longer bundled with the Apache source distribution. I will provide support for both the server side and the client side at the same time on a future date.
• APACHE account creation instructions modified to include CAP=ND,SF,IA,BA,PH for SERVER.APACHE. The PH is required for CGI to work.
• January 29, 1997
• Added support for inetd and mod_usertrack.c.
• APACHE account creation instructions modified.
• JHTTPD job changed to run under the new non-PM user SERVER.APACHE.
• January 28, 1997
• Created this web page.
• Added support for setuid() and FastCGI.