Web Server with Apache 2, PHP 5, OpenSSL and Database Support
January 3, 2010

Operating System	Application(s)	Database(s)	Other
Platform

I. Abstract

This document describes the process of setting up an Apache 2 Web Server with Sun SPARC hardware, Solaris 10, PHP5, OpenSSL and support for either PostgreSQL, MySQL, Oracle and/or DB2 databases (via PDO and/or direct). I call this setup SAPS_DB (Solaris, Apache, PHP and SSL).

Test Platform:

• Sun v210
• 2x 1.0Ghz UltraSPARC-IIIi / 2GB RAM
• Solaris 10 OE 10/09

For this task, we will compile everything from source (so we can have the latest releases, compiled to our taste).

Keep in mind that this document does not cover hardening the system. That process is outlined in other documents from myself or others. This machine needs to be well protected. It will be in a very vulnerable position, facing that filthy and scary Internet.

Also, you will need root access to do most of these tasks. For the most part, this guide assumes access to the system through a terminal or SSH, with no attached keyboard or monitor.

II. Setup the Operating Environment

Follow my guide titled Configuring a Solaris 10 JumpStart Server to lay the foundation for what we will be doing here. This guide has an example JumpStart profile with the required clusters and packages needed for development.

You may want to nudge up the size on the /var partition, depending on your estimated needs. This guide uses /var/www as the home for the Web directory.

I also suggest you add /usr/local/bin to your system's PATH. I do this by adding the following line just above export LOGNAME PATH in /etc/profile:

MySQL / Oracle / DB2:
PATH=/usr/local/bin:/usr/local/apache2/bin:/usr/sfw/bin:/usr/ccs/bin:$PATH
or
PostgreSQL:
PATH=/usr/local/bin:/usr/local/apache2/bin:/usr/local/pgsql/bin:
     /usr/sfw/bin:/usr/ccs/bin:$PATH

This will allow easier access to some programs we will need later.

III. Configure Database Client Support

For Oracle (Instant Client Software & SDK):

Download, extract and install the Oracle Instant Client software. If you are using your full Oracle package, the process is similar but different. Also, I'm assuming the database will live on another system, so I only detail the client install. This process also assumes you are using Oracle11g. The files should go in the /opt directory.

Grab the following files from the Instant Client Downloads for Solaris Operating System (32-bit) site and put them in /opt:

• Instant Client Package - Basic Lite
• Instant Client Package - SDK

There is a bug in PHP5 that is easy to fix, however it is very annoying. The PHP5 compile, when built against the 11g client libraries, is looking for a file named libclntsh.so. Well, it is a simple matter of creating a soft link to solve this:

For IBM DB2 Client:

Downloand, extract and install the DB2 version 9.5 (or whichever one you require) client (~260MB) software (use the defaults and follow the prompts!). If you are using your full DB2 Enterprise 9 package, the process is similar but different. Also, I'm assuming the database will live on another system, so I only detail the client install.

To install a DB2 client instance, you will need a dedicated system account and home directory (client instances are tied to a user account). You will also need to source the instance (set environment variables). IBM supplies a script for this purpose.

Next we need to setup the client connection to the DB2 server. This is an example. You can use any arbitrary name for the NODE, I usually just use db2node:

For PostgreSQL Client:

Rather than fetch and install a pre-packaged binary, let's do it from source. This will allow us to have the latest version, compiled with only what we need:

For MySQL Client:

Rather than fetch and install a pre-packaged binary, let's do it from source. This will allow us to have the latest version, compiled with only what we need:

IV. Compile and Install Apache and PHP

Apache 2

Your configure flags may vary - this works for me:

PHP 5

There are all kinds of things you can do to configure PHP. These are all examples, starting points. Salt to taste. You can add or remove options for your specific needs. See the PHP 5 compile options for more detail (./configure --help).

For the ./configure line below, add the following depending on the database(s) you plan to support:

PostgreSQL

Standard: --with-pgsql=/usr/local/pgsql
PDO: --with-pdo-pgsql=/usr/local/pgsql

Oracle

Standard: --with-oci8=instantclient,/opt/instantclient_11_1
PDO: --with-pdo-oci=instantclient,/opt/instantclient_11_1,11.1.0.7

IBM DB2

Standard: --with-ibm-db2=/export/home/plabs/sqllib
PDO: --with-pdo-odbc=ibm-db2,/export/home/plabs/sqllib

MySQL

Standard: --with-mysql=/usr/local
PDO: --with-pdo-mysql=/usr/local

V. Configure Apache for PHP and SSL

Edit the Apache configuration file (httpd.conf):

To allow Apache to use index.php files for index pages, change the following line like so (bold type is the addition):

Tell Apache to parse the .php extension by adding this line in the AddType area (bold type is the addition):

For SSL to work, we need to un-comment the following Include directive like so (near the very end of the file):

Edit the Apache SSL configuration file (httpd-ssl.conf):

Edit the <VirtualHost _default_:443> section to match the environment you are using. This should be self explanatory. If you have trouble, check the help files or get a really good book on Apache.

Now, we need to create the SSL key / certificate pair!

Generate the SSL server key (keep this extra super secret private). You will have to enter a passphrase for this process, however if you do not wish to use one (for practical / unattended reboot purposes), don't enter the -aes256 flag:

Next, create a CSR certificate request:

Now, you can either send the certificate request (server.csr) to a Certificate Authority (CA) to be signed, or you can sign it yourself. CAs can be expensive, but it can be better to gain trust from customers - as the browser warning from a self-signed certificate can scare away some folks. The following process will create a self-signed certificate with a two year expiration:

VI. Test It!

Now we should test our Apache & PHP install. Create a file named info.php in the /usr/local/apache2/htdocs (or whichever area you configured as your www folder) directory. Place the following lines in that file:

Now start an instance of the httpd server as follows:

Go to any Web browser networked to this machine and enter its URL (http://name-or-ip/info.php). Review all the settings and make sure it is all correct. You should stop the Apache server process now by executing the same line as starting it, only with the stop parameter instead.

VII. Errata

IIX. Helpful Links

• Generating a Certificate Signing Request (CSR) using Apache Mod_SSL/OpenSSL (Instant SSL)
• Secure TCP/IP Connections for PostgreSQL with SSL
• Using Solaris SMF