Upgrading to 2.4 from 2.2

Migrating an IHS configuration file from a previous release

The preferred method of migration is to apply your customizations over the new default configuration. If this is prohibitively complicated, it is possible to manually migrate a configuration from a prior release.

The following are steps to change an IHS 7.0, 8.0, or 8.5 httpd.conf such that it is useable on an IHS 9.0. This procedure assumes the installation paths of the old and new releases differ.

For information about migrating in-place, see the following technote: https://www.ibm.com/support/pages/node/6590897

1. Copy your prior releases configuration file(s) to the new installation path.
2. Update paths if the install root has changed. Many absolute paths within the configuration contain the install root. Replacing old paths can be done quickly using the sed command, e.g.

                   cp /opt/IBM/IHSv9/httpd.conf /opt/IBM/IHSv9/httpd.conf.premigration
                   sed "s@/opt/IBM/IHSv8/@/opt/IBM/IHSv9/@" /opt/IBM/IHSv8/httpd.conf > /opt/IBM/IHSv9/httpd.conf

   This command copies httpd.conf from the prior releases installation directory to the new installation directory, and replaces all instances of /opt/IBM/IHSv8/ with /opt/IBM/IHSv9/.
3. Remove <IfModule worker.c> and the </IfModule> that follows it, leaving the contained directives. On Linux, IHS uses the "event" MPM and this <IfModule worker.c> would hide the MPM configuration.
4. Replace authz_default_module with authz_core_module; i.e. replace

   LoadModule authz_default_module modules/mod_authz_default.so

   with

   LoadModule authz_core_module modules/mod_authz_core.so

   If the module is not replaced, you will receive an error similar to the following:

       httpd: Syntax error on line 141 of /IHS/install/path/conf/httpd22.conf: Can
       not load modules/mod_authz_default.so into server: EDC5205S DLL module not
       found. (errno2=0xC40B0025)

5. Update access control. Take only one of the following actions:
   • Replace the old access control directives Order, Allow, and Deny with the new Require directive. Refer to the Access Control section below. This is preferred.
   • Otherwise, load the mod_access_compat module by adding the following line to the configuration:

     LoadModule access_compat_module modules/mod_access_compat.so

   • Remove AuthSAFAuthoritative if present (see information at the bottom of this document for more details)
   If neither step is taken, the resulting error message resembles the following:

       AH00526: Syntax error on line 289 of /IHS/install/path/conf/httpd22.conf:  
       Invalid command 'Order', perhaps misspelled or defined by a module not included 
       in the server configuration

6. Load the mod_unixd security module by adding the following line to the configuration:

   LoadModule unixd_module modules/mod_unixd.so

   Otherwise, the following error occurs:

       AH00136: Server MUST relinquish startup privileges before accepting connections.  
       Please ensure mod_unixd or other system security module is loaded.

7. Update the WAS plugin by changing the LoadModule line from:

   LoadModule was_ap22_module  /PLUGIN/install/path/mod_was_ap22_http.so

   to:

   LoadModule was_ap24_module  /PLUGIN/install/path/mod_was_ap24_http.so

8. Update third-party modules to their Apache 2.4 versions. There are no general instructions for this step; contact the third-party module's vendor for explicit instructions.

   If modules are not compatible with Apache 2.4, you can receive one of two types of error messages. The examples below are how the message is reported on z/OS -- the operative parts of the message are problems with symbols similar to "ap_my_generation" or "ap_log_error".

   The first form resembles this:

       CEE3559S External variable ap_my_generation was not found in DLL apachecore.dll.
       From compile unit FLASH108:/u/WASTST1/2.4.x/srclib/apr/dso/os390/dso.c 
       at entry point apr_dso_load at statement 68 at compile unit offset +000000000D5B
       CCEA at entry offset +00000000000000C2 at address 000000000D5BCCEA.             
   
       CEE3561S External function ap_log_error was not found in DLL apachecore.dll.    
       From compile unit FLASH108:/IHS/install/path/srclib/apr/dso/os390/dso.c 
       at entry point apr_dso_load at statement 68 at compile unit offset +000000000D5B
       CCEA at entry offset +00000000000000C2 at address 000000000D5BCCEA.

   To figure out which module is causing the problem, start the server with the -e debug option, e.g.

   bin/apachectl -e debug

   This should partially output your configuration file, and then output the error. The line of the configuration after the last line which is printed should be a LoadModule directive containing the name of the failing module. The other type of error message that may be shown when a module is incompatible with Apache 2.4/IHS version 9.0 looks like this:

       httpd: Syntax error on line 1007 of /IHS/install/path/conf/httpd22.conf: API 
       module structure 'myap22_module' in file /mymodule/install/path/modules/mod_myap22.so 
       is garbled - expected signature 41503234 but saw 41503232 - perhaps this is not 
       an Apache module DSO, or was compiled for a different Apache version?

   The problematic module's name is contained within the error message - in this case, myapp22_module.
9. Search your configuration for directives such as Include, AuthUserFile, AuthGroupFile, and KeyFile. These directives may either point to files under the old installation root that need to be copied.
10. If using the 'BFlagEscapeAllNonAlnum' parameter to RewriteOptions, remove it. It's the default and only behavior in this and future releases.
11. Linux only: Add a line to dynamically load the Event MPM, e.g. 'LoadModule mpm_event_module modules/mod_mpm_event.so'?
12. Attempt to start the server with the updated configuration. Review the output of the start command and the error_log to make sure no errors were reported. If a directive has been removed or has moved to a new module, you may see an error resemlbing this message:

    AH00526: Syntax error on line 924 of /web1/httpd.conf:
    Invalid command 'Foo', perhaps misspelled or defined by a module not included in the server configuration

    Consult the rest of this document for informaton about the specific directive, then check http://publib.boulder.ibm.com/httpserv/manual24/mod/directives.html to find the proper module to load.

    This step will likely require a number of rounds of iteration, as only 1 error is detected at a time.

13. Optional: Review and apply other changes to the default configuration (httpd.conf.default) in the new release:
    • ReportInterval has been reduced to 300 seconds.
    • TrackModules On, TrackHooks allhooks, SlowThreshold 60, TrackHooksOptions logslow have been added.
    • mod_backtrace is now loaded on some platforms where it was unintentionally omitted in previous releases.
    • The default 'LogFormat' now has additional columns appended for serviceability.
    • The default config has been updated to deny access to all directories by default and then explicitly allow access to the document root, icons, CGI-BIN, etc.

      DocumentRoot /var/www/ihs1/htdocs
      ...
      <Directory />
          Options FollowSymLinks
          AllowOverride None
          FileETag All -INode
          Require all denied
      </Directory>
      <Directory "/var/www/ihs1/htdocs">
          Options FollowSymLinks
          AllowOverride None
          Require all granted
      </Directory>

After taking all the above steps, the configuration should be ready to be loaded by IHSv9.0. The remainder of the document serves as a reference for what has changed between Apache 2.2 and 2.4.

Compile-Time Configuration Changes

The compilation process is very similar to the one used in version 2.2. Your old configure command line (as found in build/config.nice in the installed server directory) can be used in most cases. There are some changes in the default settings. Some details of changes:

• These modules have been removed: mod_authn_default, mod_authz_default, mod_mem_cache. If you were using mod_mem_cache in 2.2, look at mod_cache_disk in 2.4.
• All load balancing implementations have been moved to individual, self-contained mod_proxy submodules, e.g. mod_lbmethod_bybusyness. You might need to build and load any of these that your configuration uses.
• Platform support has been removed for BeOS, TPF, and even older platforms such as A/UX, Next, and Tandem. These were believed to be broken anyway.
• configure: dynamic modules (DSO) are built by default
• configure: By default, only a basic set of modules is loaded. The other LoadModule directives are commented out in the configuration file.
• configure: the "most" module set gets built by default
• configure: the "reallyall" module set adds developer modules to the "all" set

Run-Time Configuration Changes

There have been significant changes in authorization configuration, and other minor configuration changes, that could require changes to your 2.2 configuration files before using them for 2.4.

Authorization

Any configuration file that uses authorization will likely need changes.

You should review the Authentication, Authorization and Access Control Howto, especially the section Beyond just authorization which explains the new mechanisms for controlling the order in which the authorization directives are applied.

Directives that control how authorization modules respond when they don't match the authenticated user have been removed: This includes AuthzLDAPAuthoritative, AuthzDBDAuthoritative, AuthzDBMAuthoritative, AuthzGroupFileAuthoritative, AuthzUserAuthoritative, AuthSAFAuthoritative, and AuthzOwnerAuthoritative. These directives have been replaced by the more expressive RequireAny, RequireNone, and RequireAll.

If you use mod_authz_dbm, you must port your configuration to use Require dbm-group ... in place of Require group ....

Access control

In 2.2, access control based on client hostname, IP address, and other characteristics of client requests was done using the directives Order, Allow, Deny, and Satisfy.

In 2.4, such access control is done in the same way as other authorization checks, using the new module mod_authz_host. The old access control idioms should be replaced by the new authentication mechanisms, although for compatibility with old configurations, the new module mod_access_compat is provided.

Here are some examples of old and new ways to do the same access control.

In this example, there is no authentication and all requests are denied.

Order deny,allow
Deny from all

Require all denied

In this example, there is no authentication and all requests are allowed.

Order allow,deny
Allow from all

Require all granted

In the following example, there is no authentication and all hosts in the example.org domain are allowed access; all other hosts are denied access.

Order Deny,Allow
Deny from all
Allow from example.org

Require host example.org

In the following example, mixing old and new directives leads to unexpected results.

DocumentRoot "/var/www/html"

<Directory "/">
    AllowOverride None
    Order deny,allow
    Deny from all
</Directory>

<Location "/server-status">
    SetHandler server-status
    Require 127.0.0.1
</Location>

access.log - GET /server-status 403 127.0.0.1
error.log - AH01797: client denied by server configuration: /var/www/html/server-status

Why httpd denies access to servers-status even if the configuration seems to allow it? Because mod_access_compat directives take precedence over the mod_authz_host one in this configuration merge scenario.

This example conversely works as expected:

DocumentRoot "/var/www/html"

<Directory "/">
    AllowOverride None
    Require all denied
</Directory>

<Location "/server-status">
    SetHandler server-status
    Order deny,allow
    Deny from all
    Allow From 127.0.0.1
</Location>

access.log - GET /server-status 200 127.0.0.1

So even if mixing configuration is still possible, please try to avoid it when upgrading: either keep old directives and then migrate to the new ones on a later stage or just migrate everything in bulk.

In many configurations with authentication, where the value of the Satisfy was the default of ALL, snippets that simply disabled host-based access control are omitted:

Order Deny,Allow
Deny from all
AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

# No replacement needed
AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

In configurations where both authentication and access control were meaningfully combined, the access control directives should be migrated. This example allows requests meeting both criteria:

Order allow,deny
Deny from all
# Satisfy ALL is the default
Satisfy ALL
Allow from 127.0.0.1
AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
<RequireAll>
  Require valid-user
  require ip 127.0.0.1
</RequireAll>

In configurations where both authentication and access control were meaningfully combined, the access control directives should be migrated. This example allows requests meeting either criteria:

Order allow,deny
Deny from all
Satisfy any
Allow from 127.0.0.1
AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
# Implicitly <RequireAny>
Require valid-user
Require ip 127.0.0.1

In many configurations with authentication, where the value of the Satisfy was the default of ALL, snippets that simply disabled host-based access control are omitted:

Order Deny,Allow
Deny from all
AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

# No replacement needed
AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

In configurations where both authentication and access control were meaningfully combined, the access control directives should be migrated. This example allows requests meeting both criteria:

Order allow,deny
Deny from all
# Satisfy ALL is the default
Satisfy ALL
Allow from 127.0.0.1
AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
<RequireAll>
  Require valid-user
  Require ip 127.0.0.1
</RequireAll>

In configurations where both authentication and access control were meaningfully combined, the access control directives should be migrated. This example allows requests meeting either criteria:

Order allow,deny
Deny from all
Satisfy any
Allow from 127.0.0.1
AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
Require valid-user

AuthBasicProvider File
AuthUserFile /example.com/conf/users.passwd
AuthName secure
# Implicitly <RequireAny>
Require valid-user
Require ip 127.0.0.1

Other configuration changes

Some other small adjustments may be necessary for particular configurations as discussed below.

• MaxRequestsPerChild has been renamed to MaxConnectionsPerChild, describes more accurately what it does. The old name is still supported.
• MaxClients has been renamed to MaxRequestWorkers, which describes more accurately what it does. For async MPMs, like event, the maximum number of clients is not equivalent than the number of worker threads. The old name is still supported.
• The DefaultType directive no longer has any effect, other than to emit a warning if it's used with any value other than none. You need to use other configuration settings to replace it in 2.4.
• AllowOverride now defaults to None.
• EnableSendfile now defaults to Off.
• FileETag now defaults to "MTime Size" (without INode).
• mod_dav_fs: The format of the DavLockDB file has changed for systems with inodes. The old DavLockDB file must be deleted on upgrade.
• KeepAlive only accepts values of On or Off. Previously, any value other than "Off" or "0" was treated as "On".
• Directives AcceptMutex, LockFile, RewriteLock, SSLMutex, SSLStaplingMutex, and WatchdogMutexPath have been replaced with a single Mutex directive. You will need to evaluate any use of these removed directives in your 2.2 configuration to determine if they can just be deleted or will need to be replaced using Mutex.
• mod_cache: CacheIgnoreURLSessionIdentifiers now does an exact match against the query string instead of a partial match. If your configuration was using partial strings, e.g. using sessionid to match /someapplication/image.gif;jsessionid=123456789, then you will need to change to the full string jsessionid.
• mod_cache: The second parameter to CacheEnable only matches forward proxy content if it begins with the correct protocol. In 2.2 and earlier, a parameter of '/' matched all content.
• mod_ldap: LDAPTrustedClientCert is now consistently a per-directory setting only. If you use this directive, review your configuration to make sure it is present in all the necessary directory contexts.
• mod_filter: FilterProvider syntax has changed and now uses a boolean expression to determine if a filter is applied.
• mod_include:
  • The #if expr element now uses the new expression parser. The old syntax can be restored with the new directive SSILegacyExprParser.
  • An SSI* config directive in directory scope no longer causes all other per-directory SSI* directives to be reset to their default values.
• mod_charset_lite: The DebugLevel option has been removed in favour of per-module LogLevel configuration.
• mod_ext_filter: The DebugLevel option has been removed in favour of per-module LogLevel configuration.
• mod_proxy_scgi: The default setting for PATH_INFO has changed from httpd 2.2, and some web applications will no longer operate properly with the new PATH_INFO setting. The previous setting can be restored by configuring the proxy-scgi-pathinfo variable.
• mod_ssl: CRL based revocation checking now needs to be explicitly configured through SSLCARevocationCheck.
• mod_substitute: The maximum line length is now limited to 1MB.
• mod_reqtimeout: If the module is loaded, it will now set some default timeouts.
• mod_dumpio: DumpIOLogLevel is no longer supported. Data is always logged at LogLevel trace7.
• On Unix platforms, piped logging commands configured using either ErrorLog or CustomLog were invoked using /bin/sh -c in 2.2 and earlier. In 2.4 and later, piped logging commands are executed directly. To restore the old behaviour, see the piped logging documentation.

Misc Changes

• mod_autoindex: will now extract titles and display descriptions for .xhtml files, which were previously ignored.
• mod_ssl: The default format of the *_DN variables has changed. The old format can still be used with the new LegacyDNStringFormat argument to SSLOptions. The SSLv2 protocol is no longer supported. SSLProxyCheckPeerCN and SSLProxyCheckPeerExpire now default to On, causing proxy requests to HTTPS hosts with bad or outdated certificates to fail with a 502 status code (Bad gateway)
• htpasswd now uses MD5 hash by default on all platforms.
• The NameVirtualHost directive no longer has any effect, other than to emit a warning. Any address/port combination appearing in multiple virtual hosts is implicitly treated as a name-based virtual host.
• mod_deflate will now skip compression if it knows that the size overhead added by the compression is larger than the data to be compressed.
• Multi-language error documents from 2.2.x may not work unless they are adjusted to the new syntax of mod_include's #if expr= element or the directive SSILegacyExprParser is enabled for the directory containing the error documents.
• The functionality provided by mod_authn_alias in previous versions (i.e., the AuthnProviderAlias directive) has been moved into mod_authn_core.
• The RewriteLog and RewriteLogLevel directives have been removed. This functionality is now provided by configuring the appropriate level of logging for the mod_rewrite module using the LogLevel directive. See also the mod_rewrite logging section.
• mod_include's <set> tag no longer performs entity decoding on the value being set.

Third Party Modules

All modules must be recompiled for 2.4 before being loaded.

Many third-party modules designed for version 2.2 will otherwise work unchanged with the Apache HTTP Server version 2.4. Some will require changes; see the API update overview.

Common problems when upgrading

• Startup errors:
  • Invalid command 'User', perhaps misspelled or defined by a module not included in the server configuration - load module mod_unixd
  • Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration, or Invalid command 'Order', perhaps misspelled or defined by a module not included in the server configuration - load module mod_access_compat, or update configuration to 2.4 authorization directives.
  • Ignoring deprecated use of DefaultType in line NN of /path/to/httpd.conf - remove DefaultType and replace with other configuration settings.
  • Invalid command 'AddOutputFilterByType', perhaps misspelled or defined by a module not included in the server configuration - AddOutputFilterByType has moved from the core to mod_filter, which must be loaded.
• Errors serving requests:
  • configuration error: couldn't check user: /path - load module mod_authn_core.
  • .htaccess files aren't being processed - Check for an appropriate AllowOverride directive; the default changed to None in 2.4.