I. Abstract

This document describes the process of setting up an Apache 2 Web Server on Red Hat Enterprise Linux with PHP5, OpenSSL (HTTPS), the Suhosin PHP Protection extension and support for PostgreSQL, IBM DB2, MySQL and/or Oracle databases.

Test Platform:

• Sun V20z
• AMD Opteron 248 2.4Ghz (x2) / 2GB RAM
• Red Hat Enterprise Linux 6.1 - i686/32-bit (Server)

Keep in mind that this document does not cover hardening the system. That process is outlined in other documents from myself or others. This machine needs to be well protected. It will be in a very vulnerable position, facing that filthy and scary Internet.

Also, you will need root access to do most of these tasks.

II. Install and Setup the Operating Environment

Go through the installation procedure and set things up according to your network and needs. You may want to nudge up the size on the /var partition, depending on your estimated needs. This guide uses /var/www as the home for the Web directory.

When you are presented with the software sets screen, select "Web Server" and then "Customize now" - click Next.

Next is the part where I either use Kickstart or just spend a while de-selecting/selecting packages I know I will or will not need (the package selection screen).

Make sure you have at least the following packages (the defaults within each should be sufficient):

FYI, the database and other modules will be attended to later, don't worry about it here. After the installation is complete, reboot.

Configure Services

Log in as root, and enter the command ntsysv. This will start the services management application. Here you can select or de-select the services you want started at boot. Go through the list and edit as your environment requires. One obvious selection would be httpd, unless you want to start this manually all the time. Any changes will go into effect after rebooting (but don't do that yet).

Configure Firewall

As root, enter the command system-config-firewall-tui. This will start the Firewall Configuration tool. Tab to the Customize field and hit enter. Here, make sure you allow for incoming WWW (HTTP) and Secure WWW (HTTPS). I use SFTP to transfer files to the Web server, so SSH needs to be enabled for that (instead of FTP). Unless you have more advanced firewall needs, you can select Close here to finish. Changes will go into effect immediately.

SELinux

I also disable SELinux, but if you are comfortable with the detailed configurations necessary for this feature, by all means, leave it on Enforcing and pay attention! To disable this feature, edit the /etc/selinux/config file so the SELINUX variable is "disabled" instead of "enforcing." A reboot is necessary for this change.

Update and Reboot

Finally, you should run yum update. It is important to keep your system as up to date as possible. When this process is finished, reboot and continue on!

III. Configure Database Client Support

PHP Support for PostgreSQL

PHP Support for MySQL

PHP Support for IBM DB2

Downloand, extract and install the DB2 client version for your environment from the DB2 Fix Packs FTP site at IBM.com.

In this example, I'll use the v9.5fp5 DB2 Client for Linux x86 (~242MB). When installing, use the defaults and follow the prompts! If you are using your full DB2 Enterprise package, the process is similar but different. Also, I'm assuming the database will live on another system, so I only detail the client install.

To install a DB2 client instance, you will need a dedicated system account and home directory (client instances are tied to a user account). You will also need to source the instance (set environment variables). IBM supplies a script for this purpose.

Next we need to setup the client connection to the DB2 server. This is an example. You can use any arbitrary name for the NODE, I usually just use db2node:

Now for the PECL stuff:

When asked to enter the DB2 Installation Directory, enter /home/plabs/sqllib and hit enter.

After it installs, create a text file named ibm_db2.ini in the /etc/php.d directory that contains the following:

PHP Support for Oracle (InstantClient Software & SDK)

Download, extract and install the Oracle InstantClient software. If you are using your full Oracle package, the process is similar but different. Also, I'm assuming the database will live on another system, so I only detail the client install. This process also assumes you are using Oracle11g on x86. The files should go in the /opt directory.

Grab the following files from the Instant Client Downloads site for your platform and put them in /opt:

• Instant Client Package - Basic Lite
• Instant Client Package - SDK

There is a bug in PHP5 that is easy to fix, however it is very annoying. The PHP5 compile, when built against the 11g client libraries, is looking for a file named libclntsh.so. Well, it is a simple matter of creating a soft link to solve this:

Now for the PECL stuff:

When prompted, enter 1 to update the first (and only) setting. The OCI8 configuration prompt will then be shown:

Please provide the path to the ORACLE_HOME directory. Use 'instantclient,/path/to/instant/client/lib' if you're compiling with Oracle Instant Client [autodetect] :

Enter the path as: instantclient,/opt/instantclient_11_2

After it installs, create a text file named oci8.ini in the /etc/php.d directory that contains the following:

You will also have to edit your LD_LIBRARY_PATH environment variable by doing the following:

IV. Configure Apache and PHP Modules / Suhosin Extension

Apache 2

mod_ssl may already be installed. Just to make sure, go ahead and install it:

PHP 5

There are all kinds of things you can do to configure PHP. These are all examples, starting points. Salt to taste. You can add or remove modules and options for your specific needs.

FYI, some of these may already be installed. First, for the basics (again, your requirements may differ):

Suhosin

I love this software. It is included with OpenBSD and some other BSD/Linux distributions, but missing in RHEL. Here we will compile and configure the extension to work with out PHP server:

After it installs, create a text file named suhosin.ini in the /etc/php.d directory that contains the following:

V. Configure Apache (for SSL, site-specific settings, etc.)

Edit the Apache configuration file:

If you'll be using port 80, then you want to pay attention to the settings here. You may also want to add index.php to the DirectoryIndex section!

I use /var/www/http for the port 80 traffic. If you edit your httpd.conf to use this directory for DocumentRoot, then I suggest doing this:

Next, edit the Apache SSL configuration file:

Edit the <VirtualHost _default_:443> section to match the environment you are using. This should be self explanatory. If you have trouble, check the help files or get a really good book on Apache.

I use /etc/httpd/ssl to store the SSL files, for simplicity. If you choose to do the same (as this guide will later use), change the SSL certificate definitions to:

SSLCertificateFile /etc/httpd/ssl/https.crt
SSLCertificateKeyFile /etc/httpd/ssl/https.key

Also, I use /var/www/https for the port 443 (SSL) traffic. If you edit your ssl.conf to use this directory for DocumentRoot, then I suggest doing this:

SSL Certificate / Key Pair

First, create the directory to store these files:

Generate the SSL server key (keep this extra super secret private). You will have to enter a passphrase for this process, however if you do not wish to use one (for practical / unattended restart purposes), don't enter the -aes256 flag:

Next, create a CSR certificate request:

Now, you can either send the certificate request (https.csr) to a Certificate Authority (CA) to be signed, or you can sign it yourself. CAs can be expensive, but it can be better to gain trust from customers - as the browser warning from a self-signed certificate can scare away some folks. The following process will create a self-signed certificate with a two year expiration:

VI. Test It!

Now we should test our Apache & PHP install. Create a file named info.php in the /var/www/http (or whichever area you configured as your www folder) directory. Place the following lines in that file:

Now start an instance of the httpd server as follows:

Go to any Web browser networked to this machine and enter its URL (http://name-or-ip/info.php). Review all the settings and make sure it is all correct. You should stop the Apache server process now by executing the same line as starting it, only with the stop parameter instead.

VII. Helpful Links

• Generating a Certificate Signing Request (CSR) using Apache Mod_SSL/OpenSSL (Instant SSL)
• Secure TCP/IP Connections for PostgreSQL with SSL
• Installing PHP and the Oracle Instant Client for Linux and Windows