Chapter 7 Configuring Server Preferences

This chapter describes how to configure server preferences for your iPlanet Web Server.

• Starting and Stopping the Server
• Viewing Server Settings
• Adding and Using Thread Pools
• Configuring Network Settings
• Customizing Error Responses
• Working with Dynamic Configuration Files
• Restricting Symbolic Links (Unix/Linux)
• Using the Watchdog (uxwdog) Process (Unix/Linux)

• Click the Server On or Server Off in The Server On/Off Page.
• Use the Services window in the Control Panel (Windows NT).
• Use start. If you want to use this script with init, you must include the start command http:2:respawn:server_root/type-identifier/start -start -i in /etc/inittab. (Unix/Linux)
• Use stop, which shuts down the server completely, interrupting service until it is restarted. If you set the etc/inittab file to automatically restart (using "respawn"), you must remove the line pertaining to the web server in etc/inittab before shutting down the server; otherwise, the server automatically restarts. (Unix/Linux)

TerminateTimeout seconds

• Automatically restart it from the inittab file.

Note that if you are using a version of Unix/Linux not derived from System V (such as SunOS 4.1.3), you will not be able to use the inittab file.

• Automatically restart it with daemons in /etc/rc2.d when the machine reboots.
• Restart it manually.

The server's start script, key pair file, and the key password should be owned by root (or, if a non-root user installed the server, that user account), with only the owner having read and write access to them.

1. Using a text editor, open the start file, which is located in server_root/https-server-id.
2. In the 10th line counting from the top of the script, insert the following:

echo "your_SSL-enabled_server_password"|

For example, the edited line might look like this:

echo "MBi12!mo"|./$PRODUCT_BIN -d $PRODUCT_SUBDIR/config $@

http:2:respawn:server_root/type-identifier/start - start -i

server_root/type-identifier/start

server_root/type-identifier/start

server_root/type-identifier/stop

• Using the Services Control Panel to restart any server.
• Using the Services Control Panel to configure the operating system to restart the server or the administration server each time the machine is restarted.

1. In the Main group, double-click the Control Panel icon.
2. Double-click the Services icon.
3. Scroll through the list of services and select the service for your server.
4. Check Automatic to have your computer start the server each time the computer starts or reboots.
5. Click OK.

1. From the Start menu, choose Settings, and then Control Panel.
2. Double-click the Services icon.
3. Scroll through the list of services and select the service for your server.
4. Check Automatic to have your computer start the server each time the computer starts or reboots.
5. Click OK.

1. Using a text editor, such as Notepad, create a new text file called password.txt in server_root\https-server_id\config. For a default web server installation, password.txt would be stored in the C:\Netscape\server4\https-server_id\config directory.
2. Type your private-key password in the first line, making sure not to put carriage returns or linefeeds after the password. The file must contain only the password.

When you start your SSL-enabled server, it first tries to read the password in password.txt. If the file does not exist, you will be prompted for the password. If password.txt exists but the password is incorrect, the server will add an entry to the error log and exit.

To change the time interval that elapses between startup and the time the server can automatically restart, perform the following steps:

1. Start the Registry Editor.
2. Select your server's key (in the left side of the Registry Editor window, located in HKEY_LOCAL_MACHINE\SOFTWARE\Netscape\).
3. Choose Add Value from the Edit menu. The Add Key dialog box appears.
4. In Value Name, type MortalityTimeSecs.
5. Select REG_DWORD from the Data Type pull-down list.
6. Click OK. The DWORD Editor dialog box appears.
7. Type the time interval (in seconds) that will elapse between startup and the time the server can restart automatically.

The interval can be in binary, decimal, or hexadecimal format.

8. Click the numerical format for the value you entered in the previous step (binary, decimal, or hexadecimal).
9. Click OK.

The MortalityTimeSecs value appears in hexadecimal format at the right side of the Registry Editor window.

If you've installed an application (such as a compiler) that has modified the system debugging settings and the server crashes, you might see a system-generated application error dialog box. The server will not restart until you click OK.

1. Start the Registry Editor.
2. Select the AeDebug key, located in the left side of the Registry window in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion.
3. Double-click the Auto value in the right side of the window.

The String Editor dialog box appears.

4. Change the string value to 1.

Init fn="thread-pool-init" name=name_of_the_pool MaxThreads=n MinThreads=n QueueSize=n StackSize=n

pool="name_of_pool"

If you want to avoid creating a new user account, you can choose the user nobody or an account used by another HTTP server running on the same host. On some systems, however, the user nobody can own files but not run programs.

1. Create a user with the Windows NT Users Manager. The user must have "Log in as a service" rights.
2. Stop the server.
3. From the Windows Control Panel, choose Services.
4. Select the iWS service.
5. In the Service pop-up, in the Log on As section, click the This Account radio button.
6. Type the user account you want the web server to use.
7. Type the password for that account; type it again for confirmation.
8. Click OK.
9. Restart the server using the Services program or the Server Administration page.

http://www.iplanet.com:8090

Although the port number can be any port from 1 to 65535, the standard insecure web server port number is 80, and the standard secure web server port number is 443.

Init fn="load-modules" funcs="htaccess-init,htaccess- find"\
shlib="server_root/plugins/htaccess/htaccess.so"
Init fn="htaccess-init"

Init fn="load-modules" funcs="htaccess-init,htaccess- find" \
shlib="server_root/plugins/htaccess/bin/htaccess.dll"
Init fn="htaccess-init"

PathCheck fn="htaccess-find"

<Object name="default"
...
</Object

PathCheck fn="htaccess-find" filename="filename"

The iPlanet Web Server includes a script for converting your existing .nsconfig files to .htaccess files. To convert your files, at the command prompt, enter the path to Perl on your system, the path to the script, and the path to your obj.conf file. For example you might type the following (it should all be on one line when you type it):

server_root\install\perl server_root/plugins/htaccess/ htconvert server_root/https-server_name/config/ obj.conf

The following .htaccess directives are supported in this release:

• AuthName

• AuthType (The only AuthType supported is Basic.)


• Limit



• order
• deny


• allow


• require

• AuthGroupFile

• AuthUserFile (This has different formats depending on your usage. See below.)

1. Revise the format of the user file format to list all the groups a user belongs to:

username:password:group1,group2,group3,...groupn

2. Revise the AuthGroupFile directive to point to the same file as the AuthUserFile.

1. Remove the AuthGroupFile directive entirely.
2. And add this option to the 'Init fn=htaccess-init' line in the obj.conf file:

groups-with-users="yes"

The following example shows an .htaccess file:

<Limit> GET POST
order deny,allow
deny from all
allow from all
</Limit>
<Limit> PUT DELETE
order deny,allow
deny from all
</Limit>
AuthName mxyzptlk.kawaii.com
AuthUserFile /server_root/mxyz-docs/service.pwd
AuthGroupFile /server_root/mxyz-docs/service.grp

C:\Netscape\server4\docs\.nsconfig
C:\Netscape\server4\docs\gfx\.nsconfig
C:\Netscape\server4\docs\gfx\icons\.nsconfig

1. From the Server Manager, choose Server Preferences.
2. Click the Dynamic Configuration Files link.
3. Choose a resource from the Resource Picker.
4. Choose whether to base the directory from the URL or from a specified directory.
5. Type the filename.
6. Choose whether to search only the base directory.
7. Type the disabled types.
8. Click OK.
9. Click Save and Apply.

The .nsconfig files consist of sets of directives that control the server. These directives are surrounded by Files directives that tell the server which files in the configuration file's directory the directives apply to. For example:

<Files PATTERN1
... directives ...
</Files
<Files PATTERN2
... directives ...
</Files

• AddType exp=SHEXP type=mime-type enc=http-encoding AddType assigns the give type or encoding to the paths represented by the wildcard pattern SHEXP . One or both of type and encoding can appear, but only one expression can be used. You cannot apply two MIME types or encodings to the same pattern of the files.
• ErrorFile reason=error-string code=error-code path=html-file
  ErrorFile causes the HTML file described by the URL suffix path to be sent in place of the server's default error message. The file is substituted when an error described by one or both of reason and code occurs. path is a valid URL to the local server but without the http://server prefix. The error codes are the standard HTTP error codes:

• 401 Unauthorized
• 403 Forbidden


• 404 Not found


• 500 Server error


• RequireAuth dbm=dbmfile userfile=database_name realm=string userpat=PATTERN
  RequireAuth lets you ask the user for a username and a password when accessing the directory. dbm is a user database. Note that dbm can only be used on a 2.x Enterprise user database. userfile is an NCSA-style user database filename. The file consists of lines in the format user:encrypted_password. realm is a unique string to tell your users which password they should use. userpat determines which users from the given dbm or userfile are allowed access. userpat is a wildcard pattern or list of user names. For example, you can use the syntax userpat="user1" or userpat="(user1|user2)" for specifying a user or a list of users.
• RestrictAccess method=HTTP-method type=allow|deny ip=addrpattern dns=hostpattern return-code=403|404
  RestrictAccess applies access control to the directory and restricts certain users. method is an optional parameter specifying a wildcard pattern of HTTP methods to protect (no method specified means all of them). type determines whether the IP address wildcard pattern or hostname wildcard pattern is allowed or denied access. If the only RestrictAccess directives in a Files set are of type allow, then all hosts not specified by the patterns are denied. ip must be typed in lowercase for the directive to work. More than one RestrictAccess can appear in the file. The order in which these lines appear is important; later RestrictAccess lines override earlier ones.

The following example shows an .nsconfig file:

• Hard links—A hard link is really two filenames that point to the same set of data blocks; the original file and the link are identical. For this reason, hard links cannot be on different filesystems.
• Symbolic (soft) links—A symbolic link consists of two files, an original file that contains the data, and another that points to the original file. Symbolic links are more flexible than hard links. Symbolic links can be used across different filesystems and can be linked to directories.

UXWDOG_NO_AUTOSTART=1; export UXWDOG_NO_AUTOSTART

UXWDOG_RESTART_ON_EXIT=1; export UXWDOG_RESTART_ON_EXIT