"proper" apache setup?

[mtwnet]

I've recently built a gentoo box to be used as web development system. Over the weekend I did a stage 1 install, and last night I finally emerged apache2. The install went fine -- I'm now getting the apache index.html file when I point my browser to that box.

My problem is I don't know exactly where to go from here. The apache.org documentation is fine, it tells me what I can change, but not what I SHOULD change. Since this is a local development box, is it acceptable to serve documents out of /var/www/htdocs? Or is there another accepted practice?

I've also noticed alot of mentions of httpd.conf. I believe this is the Apache 1.3 conf file right? I've located apache2.conf in /etc/apache2/conf. There's also commonapache2.conf. What's that used for?

I'm hoping someone knows of a good HOWTO that helps n00bs with proper admin. Right now it's just for local development, but at some point I can see opening it up as a production server.

Any help or pointers is appreciated!

[msalerno]

httpd.conf is for Apache 1.x

I don't know of any howto's, but there are some basic steps that you should take to setting up the apache configuration. You could either write your own config or use the one provided, but if you use the one provided you will have to do plenty of commenting out.

If you choose not to write your own config, first thing should be to disable any unused modules, LoadModule. The config files make good use of <IfModule> so if you prevent the module from being loaded, the ifmodule section will be skipped.

Then just go through and make sure your directory directives are setup properly. I would imagine that a quick search of this forum and google would return many apache sercurity howto's.

Good luck.

[Utoxin]

[apc]

Having just emerged apache, should I start out with commonapache2.conf as my config? It and apache2.conf are pretty different right now, and among other things, the current apache2.conf doesnt have anything with like directory permissions ( <Directory /> order deny allow </Directory) which I think I read is important.

And also, on the subject of directories, what do I do if i want to have an open directory, like so my friends can see pics?

If the folder inside /var/www/localhost/htdocs/ is pics, do I do
<Directory /pics, <Directory /var/www/localhost/htdocs/pics
and then allow all

or something completely different?

[splooge]

The config files that come with apache shouldn't need to be changed much -- if at all. You need BOTH those config files, you don't choose one over the other.

The <Directory /var/www/localhost/htdocs> directive automatically includes any subdirectories, so there's no need to change it from what it currently is.

I'm not quite sure what you mean by having an open directory... but taking a crazy guess, I'd guess you mean that you want to view files and folders when you navigate to your /pics dir? If so, add +Indexes to the above directory directive.
_________________
http://get.a.clue.de

[apc]

What about a general directory command? I.e.:

<Directory />
Order Deny,Allow
Deny from all
</Directory>

that is not present in apache2.conf but it is in common, and in the apache security tips it says to have this. also this is why i asked if i needed like a separate one for folders i want to be able to be viewed as directories

edit: and also currently, (although this probably doesnt matter), i have a directory in my htdocs folder. if a user on the internet tries to go to it, they get not allowed error, but they can manually go to the address of picures inside the folder that theyre denied access to.

[apc]

I think I figured it out...
both apache2.conf AND commonapache2.conf are loaded when apache starts?

[Lajasha]

As far as the err trying to get into the folder it is either permissions or you do not have directory indexing turned on for that directory.

And yes both of those files are loaded.
_________________
Come and play in my land