Configuring Apache, Fedora, FTP, etc.

Some beginner's questions

[WebWalla]

OK, so I decided it was time to learn a bit more about Linux and Apache than a few remotely hosted domains allow, so I downloaded and installed Fedora Core 4. I've installed a dual boot configuration with WinXP, even though I know for sure I'm not going to be using XP on this box, but I wanted to see how it was done. Anyway, the installation seems to be working OK.

I want to use this machine mostly as a web server for testing, and hope to test a few mySQL/PHP database driven applications.

Given that this is my first installation, it was great to see my first .html file parsed correctly for a simple PHP "hello world" script after changing the httpd.conf file. Now, I want to configure Apache and vsftpd to allow FTP upload/download of my webpages and so to my questions ...

1. should I configure the Apache server root directory to coincide with the home directory of one of my FTP users, so that I can connect via FTP and update my web pages?
2. or, should I configure a Virtual Host and assign its root directory as the user's home?
3. and, if I configure Virtual Host, how do I actually access the web later? Do I need to configure some DNS entries?
4. lastly, as the only person with access to this box, I always logon as root, out of laziness/convenience. Does this have any security implications and should I really be loggin on as another user?

Thanks for any answers you can give to these beginner's questions.

[Frank_Rizzo]

The best thing to do is to create a username, a home dir, and point your apache config as the document root.

Never ssh or telnet in as root - always do so as the user and then su to root.

1. create a user joe
2. create home dir /home/joe/public_html
3. in httpd.conf or whatever your distro has set up point the doucment root to /home/joe/public_html You can either use single server or virtual. Try single first

One thing to make it all easier is to use something like webmin to create users, config apache etc.

[WebWalla]

OK, thanks.

Just out of academic interest ... if I configure virtual hosts for different websites, how do I access each different site later? Do I need to configure DNS in some way?

I have a combined router/switch/ADSL-modem which has 1 fixed external IP and can allocate up to (I believe) 100 internal IP addresses. The router can map a TCP/UDP external IP port to any of these internal IP's.

So, if I have 2 virtual hosts can I configure each one with a separate internal IP and then map different ports to each one for access from the outside world? Or is it best to give each virtual host a name? But if so, how do I access them?

Or am I getting totally confused?

[jdMorgan]

Long-term, you'll be better off using name-based virtual hosting unless you want to end up with a bunch of NIC cards stuffed in that PC. Multiple individual IP addresses on one machine won't scale well as you add sites in the future.

The answer to how to access the sites by name depends on whether you are trying to access them from the web or from your own network. If you only want to access them from your own network, you need only configure the 'hosts' file (no extension) on each PC to 'map' the domain name to the IP address of the machine corresponding to that doamin name. In simple terms, you can view the hosts file as a 'private DNS server' if you like. This file exists on both Windows and *nix operating systems, although of course the path to the file will be different. Just search your OS file directories for "hosts".

In order for others to access your locally-hosted sites from the web, you'll need to register the domains and point the DNS server to the publically-accessible IP address of your network. Then port-forward port 80 of that IP address in your router to the machine inside your network.

Jim

[WebWalla]

Thanks, I do want to access my web from outside my LAN, although initially just by IP address.

I've port-forwarded port 80 to internal LAN port 3389 (TCP & UDP) but I still can't access my web.

I'm pretty sure the port-forwarding is OK, so is there anything in Linux/Apache (e.g. firewall) that could be preventing me seeing the web from outside my LAN?

(By the way, the web is perfectly accessible from within the LAN)

<added>Sorry, was getting confused with another port-forward for access to Remote Desktop on WinXP. WIll check out the port-forwarding again. Later ... now works having port-forwarded port 80</added>

[edited by: WebWalla at 6:18 pm (utc) on Dec. 13, 2005]

[jdMorgan]

In addition to the above info? No, not that I can think of.

But you do need to be aware that you can't use your publically-accessible IP address to access your server from inside your LAN -- It just can't work, because then you'd be asking your router for a connection that is both going out and coming in at the same time. Your local server will only be available by using its LAN address (or hostnames defined in your 'hosts' file as described above) from inside your network. If you want to see the true "WWW view" of your server, then you'll need to connect from outside your LAN.

Jim

[WebWalla]

jdMorgan - thanks for your help.

In fact I can see the www view of my server by using the internal IP address of this particular machine. And now, having set up the port-forwarding correctly, I can see exactly the same thing from outside the LAN using the external IP of the router/switch/modem.

So, it looks like it's set up correctly now, although I'm going to try to setup a couple of name-based virtual hosts as well (some more reading to do for this beginner first!).

Then, more reading to setup my first SQL/PHP database driven site!

[WebWalla]

OK, I used the HTTP Configuration Tool to change the default virtual host settings. I changed the document root directory to /home/user1/html/ which has 755 permissions and in that directory I have an index.html file which also has 755 permissions. But when I browse to the root of my web, I get a 403 server error. If I change the document root back to /var/www/html/ everything's OK again.

Any ideas? Thanks.

[jdMorgan]

> In fact I can see the www view of my server by using the internal IP address

This is simply a case of terminology insufficient to the task at hand, but in my eyes, the "Web view" means exactly what is seen from the Web, including the IP address.

Take a look at httpd.conf on your server after configuring the new document root path, and see what changed. We'll need to see that modified code (before and after) to make sense of your new question.

Jim

[WebWalla]

Only 1 change was made to httpd.conf ...

The line ...

DocumentRoot /home/user1/html/

... was added to the <VirtualHost *> section.

Is this enough for you to give me an idea of what went wrong, or do you need to see more of the file?

Thanks.

[WebWalla]

I think it has womething to do with the permissions in this user's home directory, because I can connect to his home directory with FTP and download but I can't upload anything.

[WebWalla]

Don't know if this is correct, but for anybody who's interested, I solved it by adding this ...

Allow from all
Order allow,deny

to this section in httpd.conf file …

<Directory "/">
Options FollowSymLinks
AllowOverride None
</Directory>

... so it's now ...

<Directory "/">
Options FollowSymLinks
AllowOverride None
Allow from all
Order allow,deny
</Directory>

[jdMorgan]

Hmmm...

Odd that the default config denied all access...

Order should precede Allow or Deny, just as a matter of clarity.

Jim

[WebWalla]

It only denied access after changing the document root directory. It was OK with the default /var/www/html