Upgrading to 2.4 from 2.2 (original) (raw)

Compile-Time Configuration Changes

The compilation process is very similar to the one used in version 2.2. Your old configure command line (as found in build/config.nice in the installed server directory) can be used in most cases. There are some changes in the default settings. Some details of changes:

• These modules have been removed: mod_authn_default, mod_authz_default, mod_mem_cache. If you were using mod_mem_cache in 2.2, look at [mod_cache_disk](./mod/mod%5Fcache%5Fdisk.html) in 2.4.
• All load balancing implementations have been moved to individual, self-contained mod_proxy submodules, e.g.[mod_lbmethod_bybusyness](./mod/mod%5Flbmethod%5Fbybusyness.html). You might need to build and load any of these that your configuration uses.
• Platform support has been removed for BeOS, TPF, and even older platforms such as A/UX, Next, and Tandem. These were believed to be broken anyway.
• configure: dynamic modules (DSO) are built by default
• configure: By default, only a basic set of modules is loaded. The other LoadModule directives are commented out in the configuration file.
• configure: the "most" module set gets built by default
• configure: the "reallyall" module set adds developer modules to the "all" set

Run-Time Configuration Changes

There have been significant changes in authorization configuration, and other minor configuration changes, that could require changes to your 2.2 configuration files before using them for 2.4.

Authorization

Any configuration file that uses authorization will likely need changes.

You should review the Authentication, Authorization and Access Control Howto, especially the sectionBeyond just authorization which explains the new mechanisms for controlling the order in which the authorization directives are applied.

Directives that control how authorization modules respond when they don't match the authenticated user have been removed: This includes AuthzLDAPAuthoritative, AuthzDBDAuthoritative, AuthzDBMAuthoritative, AuthzGroupFileAuthoritative, AuthzUserAuthoritative, and AuthzOwnerAuthoritative. These directives have been replaced by the more expressive [RequireAny](./mod/mod%5Fauthz%5Fcore.html#requireany), [RequireNone](./mod/mod%5Fauthz%5Fcore.html#requirenone), and[RequireAll](./mod/mod%5Fauthz%5Fcore.html#requireall).

If you use [mod_authz_dbm](./mod/mod%5Fauthz%5Fdbm.html), you must port your configuration to use Require dbm-group ... in place of Require group ....

Access control

In 2.2, access control based on client hostname, IP address, and other characteristics of client requests was done using the directives [Order](./mod/mod%5Faccess%5Fcompat.html#order), [Allow](./mod/mod%5Faccess%5Fcompat.html#allow), [Deny](./mod/mod%5Faccess%5Fcompat.html#deny), and [Satisfy](./mod/mod%5Faccess%5Fcompat.html#satisfy).

In 2.4, such access control is done in the same way as other authorization checks, using the new module[mod_authz_host](./mod/mod%5Fauthz%5Fhost.html). The old access control idioms should be replaced by the new authentication mechanisms, although for compatibility with old configurations, the new module [mod_access_compat](./mod/mod%5Faccess%5Fcompat.html) is provided.

Mixing old and new directives

Mixing old directives like [Order](./mod/mod%5Faccess%5Fcompat.html#order), [Allow](./mod/mod%5Faccess%5Fcompat.html#allow) or [Deny](./mod/mod%5Faccess%5Fcompat.html#deny) with new ones like[Require](./mod/mod%5Fauthz%5Fcore.html#require) is technically possible but discouraged. [mod_access_compat](./mod/mod%5Faccess%5Fcompat.html) was created to support configurations containing only old directives to facilitate the 2.4 upgrade. Please check the examples below to get a better idea about issues that might arise.

Here are some examples of old and new ways to do the same access control.

In this example, there is no authentication and all requests are denied.

2.2 configuration:

Order deny,allow Deny from all

2.4 configuration:

Require all denied

In this example, there is no authentication and all requests are allowed.

2.2 configuration:

Order allow,deny Allow from all

2.4 configuration:

Require all granted

In the following example, there is no authentication and all hosts in the example.org domain are allowed access; all other hosts are denied access.

2.2 configuration:

Order Deny,Allow Deny from all Allow from example.org

2.4 configuration:

Require host example.org

In the following example, mixing old and new directives leads to unexpected results.

Mixing old and new directives: NOT WORKING AS EXPECTED

DocumentRoot "/var/www/html"

<Directory "/"> AllowOverride None Order deny,allow Deny from all

<Location "/server-status"> SetHandler server-status Require local

access.log - GET /server-status 403 127.0.0.1 error.log - AH01797: client denied by server configuration: /var/www/html/server-status

Why httpd denies access to servers-status even if the configuration seems to allow it? Because [mod_access_compat](./mod/mod%5Faccess%5Fcompat.html) directives take precedence over the [mod_authz_host](./mod/mod%5Fauthz%5Fhost.html) one in this configuration merge scenario.

This example conversely works as expected:

Mixing old and new directives: WORKING AS EXPECTED

DocumentRoot "/var/www/html"

<Directory "/"> AllowOverride None Require all denied

<Location "/server-status"> SetHandler server-status Order deny,allow Deny from all Allow From 127.0.0.1

access.log - GET /server-status 200 127.0.0.1

So even if mixing configuration is still possible, please try to avoid it when upgrading: either keep old directives and then migrate to the new ones on a later stage or just migrate everything in bulk.

In many configurations with authentication, where the value of theSatisfy was the default of ALL, snippets that simply disabled host-based access control are omitted:

2.2 configuration:

2.2 config that disables host-based access control and uses only authentication

Order Deny,Allow Allow from all AuthType Basic AuthBasicProvider file AuthUserFile /example.com/conf/users.passwd AuthName secure Require valid-user

2.4 configuration:

No replacement of disabling host-based access control needed

AuthType Basic AuthBasicProvider file AuthUserFile /example.com/conf/users.passwd AuthName secure Require valid-user

In configurations where both authentication and access control were meaningfully combined, the access control directives should be migrated. This example allows requests meeting both criteria:

2.2 configuration:

Order allow,deny Deny from all

Satisfy ALL is the default

Satisfy ALL Allow from 127.0.0.1 AuthType Basic AuthBasicProvider file AuthUserFile /example.com/conf/users.passwd AuthName secure Require valid-user

2.4 configuration:

AuthType Basic AuthBasicProvider file AuthUserFile /example.com/conf/users.passwd AuthName secure Require valid-user Require ip 127.0.0.1

In configurations where both authentication and access control were meaningfully combined, the access control directives should be migrated. This example allows requests meeting either criteria:

2.2 configuration:

Order allow,deny Deny from all Satisfy any Allow from 127.0.0.1 AuthType Basic AuthBasicProvider file AuthUserFile /example.com/conf/users.passwd AuthName secure Require valid-user

2.4 configuration:

AuthType Basic AuthBasicProvider file AuthUserFile /example.com/conf/users.passwd AuthName secure

Implicitly

Require valid-user Require ip 127.0.0.1

Other configuration changes

Some other small adjustments may be necessary for particular configurations as discussed below.

• MaxRequestsPerChild has been renamed to[MaxConnectionsPerChild](./mod/mpm%5Fcommon.html#maxconnectionsperchild), describes more accurately what it does. The old name is still supported.
• MaxClients has been renamed to[MaxRequestWorkers](./mod/mpm%5Fcommon.html#maxrequestworkers), which describes more accurately what it does. For async MPMs, like[event](./mod/event.html), the maximum number of clients is not equivalent than the number of worker threads. The old name is still supported.
• The [DefaultType](./mod/core.html#defaulttype) directive no longer has any effect, other than to emit a warning if it's used with any value other thannone. You need to use other configuration settings to replace it in 2.4.
• [AllowOverride](./mod/core.html#allowoverride) now defaults to None.
• [EnableSendfile](./mod/core.html#enablesendfile) now defaults to Off.
• [FileETag](./mod/core.html#fileetag) now defaults to "MTime Size" (without INode).
• [mod_dav_fs](./mod/mod%5Fdav%5Ffs.html): The format of the [DavLockDB](./mod/mod%5Fdav%5Ffs.html#davlockdb) file has changed for systems with inodes. The old [DavLockDB](./mod/mod%5Fdav%5Ffs.html#davlockdb) file must be deleted on upgrade.
• [KeepAlive](./mod/core.html#keepalive) only accepts values of On or Off. Previously, any value other than "Off" or "0" was treated as "On".
• Directives AcceptMutex, LockFile, RewriteLock, SSLMutex, SSLStaplingMutex, and WatchdogMutexPath have been replaced with a single [Mutex](./mod/core.html#mutex) directive. You will need to evaluate any use of these removed directives in your 2.2 configuration to determine if they can just be deleted or will need to be replaced using [Mutex](./mod/core.html#mutex).
• [mod_cache](./mod/mod%5Fcache.html): [CacheIgnoreURLSessionIdentifiers](./mod/mod%5Fcache.html#cacheignoreurlsessionidentifiers) now does an exact match against the query string instead of a partial match. If your configuration was using partial strings, e.g. using sessionid to match/someapplication/image.gif;jsessionid=123456789, then you will need to change to the full stringjsessionid.
• [mod_cache](./mod/mod%5Fcache.html): The second parameter to [CacheEnable](./mod/mod%5Fcache.html#cacheenable) only matches forward proxy content if it begins with the correct protocol. In 2.2 and earlier, a parameter of '/' matched all content.
• [mod_ldap](./mod/mod%5Fldap.html): [LDAPTrustedClientCert](./mod/mod%5Fldap.html#ldaptrustedclientcert) is now consistently a per-directory setting only. If you use this directive, review your configuration to make sure it is present in all the necessary directory contexts.
• [mod_filter](./mod/mod%5Ffilter.html): [FilterProvider](./mod/mod%5Ffilter.html#filterprovider) syntax has changed and now uses a boolean expression to determine if a filter is applied.
• [mod_include](./mod/mod%5Finclude.html):
  • The #if expr element now uses the new expression parser. The old syntax can be restored with the new directive [SSILegacyExprParser](./mod/mod%5Finclude.html#ssilegacyexprparser).
  • An SSI* config directive in directory scope no longer causes all other per-directory SSI* directives to be reset to their default values.
• [mod_charset_lite](./mod/mod%5Fcharset%5Flite.html): The DebugLevel option has been removed in favour of per-module [LogLevel](./mod/core.html#loglevel) configuration.
• [mod_ext_filter](./mod/mod%5Fext%5Ffilter.html): The DebugLevel option has been removed in favour of per-module [LogLevel](./mod/core.html#loglevel) configuration.
• [mod_proxy_scgi](./mod/mod%5Fproxy%5Fscgi.html): The default setting forPATH_INFO has changed from httpd 2.2, and some web applications will no longer operate properly with the new PATH_INFO setting. The previous setting can be restored by configuring the proxy-scgi-pathinfo variable.
• [mod_ssl](./mod/mod%5Fssl.html): CRL based revocation checking now needs to be explicitly configured through [SSLCARevocationCheck](./mod/mod%5Fssl.html#sslcarevocationcheck).
• [mod_substitute](./mod/mod%5Fsubstitute.html): The maximum line length is now limited to 1MB.
• [mod_reqtimeout](./mod/mod%5Freqtimeout.html): If the module is loaded, it will now set some default timeouts.
• [mod_dumpio](./mod/mod%5Fdumpio.html): DumpIOLogLevel is no longer supported. Data is always logged at [LogLevel](./mod/core.html#loglevel) trace7.
• On Unix platforms, piped logging commands configured using either [ErrorLog](./mod/core.html#errorlog) or[CustomLog](./mod/mod%5Flog%5Fconfig.html#customlog) were invoked using/bin/sh -c in 2.2 and earlier. In 2.4 and later, piped logging commands are executed directly. To restore the old behaviour, see the piped logging documentation.

Third Party Modules

All modules must be recompiled for 2.4 before being loaded.

Many third-party modules designed for version 2.2 will otherwise work unchanged with the Apache HTTP Server version 2.4. Some will require changes; see the API update overview.

Common problems when upgrading

• Startup errors:
  • Invalid command 'User', perhaps misspelled or defined by a module not included in the server configuration - load module [mod_unixd](./mod/mod%5Funixd.html)
  • Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration, orInvalid command 'Order', perhaps misspelled or defined by a module not included in the server configuration - load module [mod_access_compat](./mod/mod%5Faccess%5Fcompat.html), or update configuration to 2.4 authorization directives.
  • Ignoring deprecated use of DefaultType in line NN of /path/to/httpd.conf - remove [DefaultType](./mod/core.html#defaulttype) and replace with other configuration settings.
  • Invalid command 'AddOutputFilterByType', perhaps misspelled or defined by a module not included in the server configuration - [AddOutputFilterByType](./mod/mod%5Ffilter.html#addoutputfilterbytype) has moved from the core to mod_filter, which must be loaded.
• Errors serving requests:
  • configuration error: couldn't check user: /path - load module [mod_authn_core](./mod/mod%5Fauthn%5Fcore.html).
  • .htaccess files aren't being processed - Check for an appropriate [AllowOverride](./mod/core.html#allowoverride) directive; the default changed to None in 2.4.