Chapter 4. Administering and configuring the administration server

290 Pages·2016·2.4 MB·English

IBM
IBM HTTP Server - Powered by Apache
Version9
SC27-8417-01

IBM
IBM HTTP Server - Powered by Apache
Version9
SC27-8417-01
ii z/OS V2R2 HTTP Server User's Guide
Contents
Tables . . . . . . . . . . . . . . . v Chapter 3. Administering and
configuring IBM HTTP Server . . . . . 69
Note. . . . . . . . . . . . . . . . vii Performing required z/OS system configurations. . 69
ix Starting and stopping IBM HTTP Server. . . . . 73
Using the administrative console to start IBM
How to send your comments to IBM . . xi HTTP Server . . . . . . . . . . . . . 74
Using apachectl commands to start IBM HTTP
If you have a technical problem. . . . . . . . xi
Server . . . . . . . . . . . . . . . 75
Using Windows services to start IBM HTTP
Summary of changes . . . . . . . . xiii
Server . . . . . . . . . . . . . . . 76
Using JCL procedures to start IBM HTTP Server
Summary of changes for IBM HTTP
on z/OS . . . . . . . . . . . . . . 78
Server Version 9, z/OS Version 2 Configuring IBM HTTP Server . . . . . . . . 81
Release 2 (V2R2), as updated Apache modules (containing directives)
September 2016. . . . . . . . . . . xv supported by IBM HTTP Server . . . . . . 82
Apache programs supported by IBM HTTP
Server . . . . . . . . . . . . . . . 89
Chapter 1. Product overview and quick
Apache APR and APR-util libraries supported by
start . . . . . . . . . . . . . . . . 1
IBM HTTP Server . . . . . . . . . . . 90
What is new in this release . . . . . . . . . 1 Apache MPM and addressing modes supported
Key differences from the Apache HTTP Server . . . 2 by IBM HTTP Server . . . . . . . . . . 91
IPv4 and IPv6 configuration for Windows
Chapter 2. Migrating and installing IBM operating systems . . . . . . . . . . . 91
HTTP Server. . . . . . . . . . . . . 5 Enabling IBM HTTP Server for FastCGI applications 92
Learn about FastCGI . . . . . . . . . . 93
Migrating from previous versions of IBM HTTP
FastCGI directives . . . . . . . . . . . 93
Server . . . . . . . . . . . . . . . . 5
Managing IBM HTTP Server remotely with the
Migrating from IBM HTTP Server V5.3 for z/OS . 7
WebSphere Application Server administrative
Migrating to IBM HTTP Server 9.0 . . . . . 22
console . . . . . . . . . . . . . . . 104
Installing IBM HTTP Server on distributed systems 23
Extending IBM HTTP Server functionality with
Mounting CD-ROMS on AIX, HP-UX, Linux and
third-party plug-in modules . . . . . . . . 105
Solaris systems . . . . . . . . . . . . 26
Viable compilers for Apache and third-party
Installing IBM HTTP Server using the GUI. . . 28
plug-in modules . . . . . . . . . . . 106
Installing IBM HTTP Server silently . . . . . 32
Build method options for dynamic modules . . 107
Creating multiple instances of IBM HTTP Server
Considerations for building dynamic modules
on Windows operating systems. . . . . . . 43
on Windows platforms . . . . . . . . . 107
Running multiple instances of IBM HTTP Server
Considerations for building dynamic modules
from a single install . . . . . . . . . . 44
on Unix platforms. . . . . . . . . . . 108
Installing fix packs on IBM HTTP Server using
Configuring IBM HTTP Server for SMF recording 108
the Installation Manager GUI . . . . . . . 46
Classifying HTTP requests for WLM (z/OS
Uninstalling IBM HTTP Server using the GUI . . 47
operating systems) . . . . . . . . . . . 109
Uninstalling IBM HTTP Server silently . . . . 48
WLM directives for IBM HTTP Server . . . . 111
Uninstalling fix packs from IBM HTTP Server
using the Installation Manager GUI . . . . . 53
Chapter 4. Administering and
Migrating and installing IBM HTTP Server on z/OS
systems. . . . . . . . . . . . . . . . 54 configuring the administration server . 113
Installing and configuring IBM HTTP Server on Starting and stopping the IBM HTTP Server
the z/OS V2R2 system . . . . . . . . . 54 administration server. . . . . . . . . . . 113
Installing IBM HTTP Server for WebSphere Protecting access to the IBM HTTP Server
Application Server for z/OS V2R1 and earlier. . 58 administration server. . . . . . . . . . . 114
Configuring an instance of IBM HTTP Server on Enabling access to the administration server
z/OS V2R1 . . . . . . . . . . . . . 64 using the htpasswd utility . . . . . . . . 114
Uninstalling IBM HTTP Server for z/OS. . . . 66 Running the setupadm command for the
administration server. . . . . . . . . . 115
Setting permissions manually for the
administration server. . . . . . . . . . 117
© Copyright IBM Corp. 2016 iii
Chapter 5. Securing IBM HTTP Server 119 Storing a certificate authority certificate . . . 199
Securing IBM HTTP Server. . . . . . . . . 119 Storing the encrypted database password in a
Configure SSL between the IBM HTTP Server stash file . . . . . . . . . . . . . . 199
Administration Server and the deployment Managing keys with the native key database
manager . . . . . . . . . . . . . . . 120 gskkyman (z/OS systems) . . . . . . . . . 200
Securing with SSL communications . . . . . . 122 Getting started with the cryptographic hardware
Secure Sockets Layer (SSL) protocol . . . . . 125 for SSL (Distributed systems) . . . . . . . . 200
SSL directive considerations . . . . . . . 131 Cryptographic hardware for Secure Sockets
Authentication . . . . . . . . . . . . 132 Layer . . . . . . . . . . . . . . . 200
Encryption . . . . . . . . . . . . . 133 Using IKEYMAN to store keys on a PKCS11
Secure Sockets Layer environment variables . . 134 device. . . . . . . . . . . . . . . 202
SSL directives . . . . . . . . . . . . 138 Configuring IBM HTTP Server to use nCipher
Setting advanced SSL options . . . . . . . . 165 and Rainbow accelerator devices and PKCS11
Choosing the level of client authentication. . . 165 devices . . . . . . . . . . . . . . 204
Server Name Indication . . . . . . . . . 166 Authenticating with LDAP on IBM HTTP Server
Viewing cipher specifications . . . . . . . 167 using mod_ldap. . . . . . . . . . . . . 205
SSL cipher specifications. . . . . . . . . 168 Converting your directives from mod_ibm_ldap
Choosing the type of client authentication to mod_ldap. . . . . . . . . . . . . 207
protection . . . . . . . . . . . . . 170 Authenticating with SAF on IBM HTTP Server
Defining SSL for multiple-IP virtual hosts . . . 171 (z/OS systems). . . . . . . . . . . . . 218
Setting up a reverse proxy configuration with SAF directives . . . . . . . . . . . . 219
SSL. . . . . . . . . . . . . . . . 171 Setting up HTTP Strict Transport Security (HSTS) 227
IBM HTTP Server certificate management. . . . 172
Managing keys with the IKEYMAN graphical Chapter 6. Troubleshooting and
interface (Distributed systems). . . . . . . . 175 support: IBM HTTP Server. . . . . . 229
Starting the Key Management utility user Troubleshooting IBM HTTP Server . . . . . . 229
interface . . . . . . . . . . . . . . 176 Known problems on Windows platforms . . . 229
Working with key databases . . . . . . . 176 Known problems on z/OS platforms . . . . 231
Changing the database password. . . . . . 177 Known problems with hardware cryptographic
Creating a new key pair and certificate request 178 support on AIX. . . . . . . . . . . . 231
Importing and exporting keys. . . . . . . 179 Symptoms of poor server response time . . . 232
Listing certificate authorities . . . . . . . 181 Hints and tips for managing IBM HTTP Server
Certificate expiration dates. . . . . . . . 182 using the administrative console . . . . . . 232
Creating a self-signed certificate . . . . . . 182 Could not connect to IBM HTTP Server
Receiving a signed certificate from a certificate administration server error. . . . . . . . 234
authority. . . . . . . . . . . . . . 183 Experiencing an IBM HTTP Server Service logon
Displaying default keys and certificate failure on Windows operating systems . . . . 234
authorities . . . . . . . . . . . . . 184 Viewing error messages for a target server that
Storing a certificate authority certificate . . . 185 fails to start . . . . . . . . . . . . . . 235
Storing the encrypted database password in a Cache messages . . . . . . . . . . . 236
stash file . . . . . . . . . . . . . . 185 Configuration messages. . . . . . . . . 236
Managing keys from the command line Handshake messages. . . . . . . . . . 238
(Distributed systems). . . . . . . . . . . 186 SSL initialization messages . . . . . . . . 246
Using the gskcapicmd command. . . . . . 187 I/O error messages . . . . . . . . . . 254
Key Management Utility command-line SSL stash utility messages . . . . . . . . 255
interface (gskcmd) syntax . . . . . . . . 188
Creating a new key database using the Appendix. Accessibility . . . . . . . 263
command-line interface . . . . . . . . . 191
Accessibility features. . . . . . . . . . . 263
Managing the database password using the
Consult assistive technologies . . . . . . . . 263
command line . . . . . . . . . . . . 192
Keyboard navigation of the user interface . . . . 263
Creating a new key pair and certificate request 193
Dotted decimal syntax diagrams . . . . . . . 263
Importing and exporting keys using the
command line . . . . . . . . . . . . 194
Notices . . . . . . . . . . . . . . 267
Creating a self-signed certificate . . . . . . 195
Receiving a signed certificate from a certificate
authority. . . . . . . . . . . . . . 197 Index . . . . . . . . . . . . . . . 269
Displaying default keys and certificate
authorities . . . . . . . . . . . . . 198
iv z/OS V2R2 HTTP Server User's Guide
Tables
1. Default locations for Installation Manager files 60 9. Variables for HTTPS_CIPHER in Secure
2. Apache modules. . . . . . . . . . . 83 Sockets Layer V2. . . . . . . . . . . 136
3. MPM and addressing modes. . . . . . . 91 10. Attribute values for the SSLClientAuthGroup
4. Bytes ranges and their descriptions for SMF directive . . . . . . . . . . . . . 150
records. . . . . . . . . . . . . . 109 11. Attribute values for the
5. Signer Certificate information . . . . . . 122 SSLClientAuthRequire directive . . . . . 151
6. Types of access and mechanisms for SSL 12. Client authentication level . . . . . . . 165
environment variables . . . . . . . . 134 13. Medium and high strength TLS ciphers 169
7. SSL handshake environment variables 135 14. Other TLS ciphers . . . . . . . . . . 170
8. Variables for HTTPS_KEYSIZE and 15. Actions for gskcmd command objects 188
HTTPS_SECRETKEYSIZE in Secure Sockets 16. LDAP configuration directives conversion 208
Layer V3 and Transport Layer Security V1. . 135
© Copyright IBM Corp. 2016 v
vi z/OS V2R2 HTTP Server User's Guide
Note
Before using this information and the product it supports, read the information in
Notices.
© Copyright IBM Corp. 2016 vii
viii z/OS V2R2 HTTP Server User's Guide