[Top] [Prev] [Next] [Last]
Download PDF:   US   UK
Download Postscript:   US   UK
Stronghold Web Server 2.4.1 Server Setup Guide

Installation

This chapter provides information about how to set up your new Stronghold Web Server, including

To customize your new site after installation, you'll need to configure Stronghold Web Server:




System Requirements

Stronghold Web Server is available for most varieties of the UNIX operating system. In addition to a version suitable for your operating system, you need a server platform that meets these system requirements:

These are the minimum requirements for running Stronghold itself. In addition, you also need




Installing Stronghold Web Server

Stronghold Web Server comes in a single, self-contained installer file when you download it. Note that in Stronghold 2.4.1, no upgrade scripts are available. This version of Stronghold must be installed from scratch. If you have an existing Apache or Stronghold server, install this version into a new directory and then upgrading manually. See "Manually Upgrading to Stronghold 2.4.1" on page 11.

The installer prompts you for information about your existing system. To guide you through the available options, this section provides a flow chart overview of the installation. The flow chart shows three different elements of the installation procedure:

Figure 1: Elements of an Installation Flowchart

The program installs Stronghold Web Server from scratch, then starts the new server with the configuration file shown in "Default Configuration" at the end of this guide. The minimum configuration required to run the server includes

The script prompts you for the required information as it performs these tasks. The dialog between the script and the user who runs it looks like this:

Configure Stronghold Generate new key Submit request to Verisign Submit request to Thawte Submit request to another CA Generate temporary certificate
Figure 2: Installing Stronghold Web Server from Scratch

To begin the process, move to the directory created when you extracted the archive, then su to the user that you want to install the server as. This should be the same user that will start the server, usually root. Start the script from the command line:

# ./sh24-platform

If you receive an error such as "Permission denied," then you must change the installer's file permissions before continuing:

# chmod 0700 sh24-platform

NOTE: If you have an existing server on the same host, you must stop the old server or install Stronghold on ports that your server does not use.

The installer launches with a full-screen, text-based interface that begins by asking you to confirm that you want to proceed with the installation process:

Figure 3: The Stronghold Installer

Select Yes by pressing Return.



To configure Stronghold

  1. Enter the absolute path to the directory where you want to install the server and its components. If the directory you enter does not exist, the program asks you to confirm that you want to create a new directory. In that case, select Yes to continue.

    This directory is called ServerRoot. Wherever the documentation refers to ServerRoot, substitute the actual path to this directory.

    The program installs the Stronghold Web Server and its components. A status bar displays the installer's progress in real time. When installation is complete, the program prompts you to press any key to continue.

  2. Press any key.

  3. Enter the path to the directory where you want to store server logs.

    The path can be absolute or relative to the directory you chose for installation. The default is ServerRoot/logs, but you can use any directory.

  4. Enter the fully-qualified domain name of your main server host.

    The installer guesses the hostname and presents this as the default. Edit the default hostname if it is not correct.

  5. Enter the email address of the server administrator.

    The default is "webmaster" at the hostname you entered in the previous step.

  6. Enter the number of the port you want to use for regular, unsecured transactions.

    The default is port 80. Browsers automatically direct their requests to port 80 unless the user specifies a different port. To install Stronghold as an SSL-only server, enter "0." If you are installing the server as root, you can choose any unused port number. If you are installing as another user, then you can only choose an unused port number of 1024 or above.

    If the port you choose is already in use, the script prompts you to choose a different one. If you have another Web server running on this platform, select a different port for Stronghold Web Server or your other server. If you do this, you must advertise this fact to your users.

  7. Enter the port you want to use for secure, encrypted transactions.

    The default is port 443. Browsers automatically direct HTTPS requests to port 443 unless the user specifies a different port. If you are installing the server as root, you can choose any unused port number. If you are installing as another user, then you can only choose an unused port number of 1024 or above.

    If the port you choose is already in use, the script prompts you to choose a different one. If you have another secure Web server running on this platform, select a different port number for Stronghold Web Server or your secure server. If you do this, you must advertise this fact to your users.

    The program warns you that you are about to be prompted for the Stronghold license block that you received via email when you downloaded the installer. If you do not have a license block, contact the organization that sold you Stronghold:

    C2Net Software US C2Net International
    stronghold-admin@c2.net sales@eu.c2.net

  8. Press Return.

  9. Paste your complete Stronghold license block into the window.

    Your license block looks something like this:

    *****BEGIN LICENSE BLOCK*****
    TEIAAQCKAAAAAGar2a7Pc0iD2oyGDN9a5mrYkZ0NrG7Zcy7UFbFoP4xLzvcVAN4K
    0Mrww4z0A2o+gfVADbDz9IdePDKOA21C2E8SiPu1qwVI1pwvbA6xuVRWDo05BT/I
    rNGExtSx+LMh3N1q2icj4eD53kNQVoLvaoQ5CcYvWGexrKiSDQvE3agLU2VyaWFs
    OiAzMTQxNTkyNjUzNTg5NzkzMjMKQ29tcGFueTogQzJOZXQgRXVybSchmunkZApF
    eHBpcmVzOiBOZXZlcgpQcm9kdWN0OiBTSDIKVHlwZfogRXZhbHVhdGlvbgpJREVB
    OiBZZXMKRmFrZTogCkJyb2tlbiBMaW5lCkJyb2tlbjogMQ==
    *****END LICENSE BLOCK*****

  10. Press Control-D at the beginning of the first blank line after the license block. Press Return to get a blank line if one was not inserted when you pasted the license block.

    You may need to wait a moment while the installer processes your license block. When your license block has been accepted, the installer invokes the genkey utility and exits. Genkey begins by generating a new key pair, as described in the next section.



To generate a new key

  1. Press Return.

  2. Enter a key size in bits.

    NOTE: Keys sizes must be either 512 or 1024 for compatibility with certain browsers. We recommend 1024 bits. Keys larger than 1024 bits are incompatible with some versions of Netscape Navigator and Microsoft Internet Explorer, and with other browsers that use RSA's BSAFE cryptography toolkit.

    The program generates some random data with which to create a unique key pair. Then it prompts you for random keystrokes.

  3. Tap out some random keystrokes.

    The program generates more random data based on the intervals between your keystrokes. It also displays a counter that moves closer to zero as you type. Stop when the counter reads 0 and the program beeps:

    0 * -Enough, thank you.

    The program generates the key pair and saves it at ServerRoot/ssl/private/hostname.key. Then it asks whether you want to request a signed certificate from a Certification Authority (CA). You must have a signed certificate in order to authenticate your site. You can request one from Verisign, Thawte, or another CA.



To request a signed certificate from Verisign

  1. At the Certification Authority prompt, enter "A":

    Please choose the CA you would like to use:
    A) VeriSign
    B) Thawte
    C) Other
    Choose: A

  2. Enter the two-letter code for your country.

    This is the same two-letter code used in hostnames in your country, such as DE for Germany, GB for Great Britain, or JP for Japan. For a list of valid country codes, see Appendix D of the Administration Guide.

  3. Enter the full name of your state or province.

  4. Enter the name of your city, town, or other locality.

  5. Enter the name of your organization.

  6. Enter the name of your unit within the organization.

  7. Enter the fully-qualified domain name of your site.

    The program prints the certificate signing request (CSR), which looks something like this:

    -----BEGIN NEW CERTIFICATE REQUEST-----
    MIIBEzCBzgIBADB7MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEQ
    MA4GA1UEBxMHT2FrbGFuZDEbMBkGA1UEChMSQzJOZXQgU29mdHdhcmUgSW5jMRAw
    DgYDVQQLEwdUZXN0aW5nMRYwFAYDVQQDEw1nYWJiZXIuYzIubmV0MEwwDQYJKoZI
    hvcNAQEBBQADOwAwOAIxAJukoQhq4LanG2k+/LnRTGJAcgv9LJPsdfCsjqRs8ygo
    yaw4ucOEdx+WdnM0x36NcQIDAQABMA0GCSqGSIb3DQEBBAUAAzEABRLR6IkG70oN
    G1MnvuMDeWou4kIvc98ysjssCNKsDKsHAXBSEbfsIQs5JRNagVBW
    -----END NEWCERTIFICATE REQUEST-----

  8. Copy the CSR.

  9. Using your Web browser, access https://digitalid.verisign.com/ss_getCSR.html.

    This is Verisign's Digital ID Enrollment page.

  10. Follow Verisign's online instructions.



To request a signed certificate from Thawte

  1. At the Certification Authority prompt, enter "B":

    Please choose the CA you would like to use:
    A) VeriSign
    B) Thawte
    C) Other
    Choose: B

  2. Enter the two-letter code for your country.

    This is the same two-letter code used in hostnames in your country, such as DE for Germany, GB for Great Britain, or JP for Japan. For a list of valid country codes, see Appendix D of the Administration Guide.

  3. Enter the full name of your state or province.

  4. Enter the name of your city, town, or other locality.

  5. Enter the name of your organization.

  6. Enter the name of your unit within the organization.

  7. Enter the fully-qualified domain name of your site.

  8. Press Return.

    The program prints your certificate signing request (CSR).

  9. Copy the CSR.

  10. Using your Web browser, access https://www.thawte.com/cgi-bin/server/step1.sioux.

    This is the Thawte Server Cert Request Step 1 page.

  11. Follow Thawte's online instructions.



To request a signed certificate from another CA

  1. Enter the email address of your Certification Authority.

  2. Enter the two-letter code for your country.

    This is the same two-letter code used in hostnames in your country, such as DE for Germany, GB for Great Britain, or JP for Japan. For a list of valid country codes, see Appendix D of the Administration Guide.

  3. Enter the full name of your state or province.

  4. Enter the name of your city, town, or other locality.

  5. Enter the name of your organization.

  6. Enter the name of your unit within the organization.

  7. Enter the fully-qualified domain name of your site.

  8. Press Return to send the certificate signing request to the email address you entered in step 1.

    If you made a mistake in step 1, enter the correct email address here and then press Return.

  9. Press Return to see the text of the CSR.

    If your CA uses Web forms for CA enrollment, you may need to paste this into those forms.

  10. Press Return to continue.

    The script shows you where the CSR is saved for backup.

  11. Press Return to continue.,



To create a temporary certificate

  1. Enter the two-letter code for your country.

    This is the same two-letter code used in hostnames in your country, such as DE for Germany, GB for Great Britain, or JP for Japan. For a list of valid country codes, see Appendix D of the Administration Guide.

  2. Enter the full name of your state or province.

  3. Enter the name of your city, town, or other locality.

  4. Enter the name of your organization.

  5. Enter the name of your unit within the organization.

  6. Enter the fully-qualified domain name of your site.

  7. Press Return.

    The program generates a temporary certificate that you can use until you receive a signed certificate from a CA. The temporary certificate does not authenticate your site; it is only a placeholder. Browsers alert users when they receive a site certificate that is not signed by a recognized CA.




Manually Upgrading to Stronghold 2.4.1

Upgrades to this version can only be performed manually. The manual upgrade procedure is slightly different depending on whether you are upgrading from Stronghold 2.3 or earlier, Stronghold 2.4, or Apache.

Many third-party modules have not been thoroughly tested for use with Stronghold 2.4.1 and Apache 1.3.2. If your existing server has third-party modules that you wish to compile into Stronghold 2.4.1, do so with caution. When using an existing Configuration file or modifying the new Configuration file to include new modules, note these changes as of Stronghold 2.4:



Upgrading Stronghold 2.3 or Earlier

Upgrading to Stronghold Web Server 2.4.1 from Stronghold 2.3 or earlier involves



To upgrade from Stronghold 2.3 or earlier

  1. Install Stronghold 2.4.1 into a new directory, using the instructions in "Installing Stronghold Web Server" on page 2.

  2. Copy the contents of the old ServerRoot/cgi-bin/ directory into the 2.4.1 cgi-bin/ directory.

  3. Copy the contents of the old ServerRoot/htdocs/ directory into the 2.4.1 htdocs/ directory.

  4. Copy the contents of the old ServerRoot/conf/ directory into the 2.4.1 conf/ directory.

  5. Copy the contents of the old ServerRoot/ssl/ directory into the 2.4.1 ssl/ directory.

  6. If you use Stronghold's SWISH site indexer, copy any site indexes from the old ServerRoot/swish/ directory into the 2.4.1 swish/ directory.

  7. Create a new subdirectory in the 2.4.1 logs/ directory for storing your old log files:

    # mkdir ServerRoot/logs/old

  8. Copy the contents of the old ServerRoot/logs/ directory into the new 2.4.1 ServerRoot/logs/old/ directory.

  9. Open both the old and new server configuration files using a text editor in separate windows.

  10. Copy and paste any custom configurations from the old file into the new file.

    Using the new configuration file as a base, you must modify your custom configurations to comply with new configuration conventions.

  11. Locate any AuthName directives and place quotes around their values. For example,

    AuthName Marx Bros

    should be changed to

    AuthName "Marx Bros"

  12. Edit the ServerRoot directive to reflect the path to the new 2.4.1 directory.

  13. Change the StrongholdKey directive to StrongholdLicenseFile and replace the old license key value with the name of the file that contains the server license block.

  14. For every name-based virtual host configuration, enter a NameVirtualHost directive in the global configuration:

    NameVirtualHost 209.60.53.41:80
    NameVirtualHost 207.57.43.92:80

  15. For every <Files> container, replace the full path to the file with the filename.

    In previous versions, <Files> containers could stand alone and specify full paths to files. <Files> containers must now specify filenames instead of paths, but can also take wildcards and regular expressions. For example,

    <Files /usr/local/www/htdocs/aquabats/batty.html>
    . . .
    </Files>

    should be changed to

    <Directory /usr/local/www/htdocs/aquabats>
    <Files batty.html>
    . . .
    </Files
    </Directory>

  16. For every container that uses wildcards, modify the wildcard statement so that all slashes are literal.

    Wildcards no longer match slash (/). For example,

    <Directory /usr/local/www/htdocs/beavis*>

    no longer matches any subdirectories of the beavis directory. Instead, it should be changed to

    <Directory /usr/local/www/htdocs/beavis/*>

    to match subdirectories one level below beavis, or

    <Directory /usr/local/www/htdocs/beavis/*/*>

    to match subdirectories two levels below.

  17. Save the modified server configuration file.

  18. Stop the old server.

  19. Start the new server with the ServerRoot/bin/start-server script.



Upgrading From Stronghold 2.4

Although the installation program currently cannot automatically upgrade from Stronghold 2.4 to 2.4.1, all 2.4 files are compatible with 2.4.1. No modification to the configuration files is necessary. There are two ways to upgrade from Stronghold 2.4:

This section contains instructions for the second upgrade option.



To upgrade from Stronghold 2.4

  1. Install Stronghold 2.4.1 into a new directory, using the instructions in "Installing Stronghold Web Server" on page 2.

  2. Copy the contents of the old ServerRoot/cgi-bin/ directory into the 2.4.1 cgi-bin/ directory.

  3. Copy the contents of the old ServerRoot/htdocs/ directory into the 2.4.1 htdocs/ directory.

  4. Copy the contents of the old ServerRoot/conf/ directory into the 2.4.1 conf/ directory.

  5. Copy the contents of the old ServerRoot/ssl/ directory into the 2.4.1 ssl/ directory.

  6. If you use Stronghold's SWISH site indexer, copy any site indexes from the old ServerRoot/swish/ directory into the 2.4.1 swish/ directory.

  7. Create a new subdirectory in the 2.4.1 logs/ directory for storing the old log files:

    # mkdir ServerRoot/logs/old

  8. Copy the contents of the old ServerRoot/logs/ directory into the new 2.4.1 ServerRoot/logs/old/ directory.

  9. Open httpd.conf in a text editor.

  10. Replace all references to the old ServerRoot path with the new path.

  11. Save the modified configuration file.

  12. Stop the old server.

  13. Start the new server with the ServerRoot/bin/start-server script.



Upgrading from Apache

Upgrading to Stronghold Web Server 2.4.1 from an Apache Web Server involves



To upgrade from an Apache Web Server

  1. Install Stronghold 2.4.1 into a new directory, using the instructions in "Installing Stronghold Web Server" on page 2.

  2. Copy the contents of the old ServerRoot/cgi-bin/ directory into the 2.4.1 cgi-bin/ directory.

  3. Copy the contents of the old ServerRoot/htdocs/ directory into the 2.4.1 htdocs/ directory.

    Take care not to overwrite the 2.4.1 documentation files.

  4. Copy the contents of the old ServerRoot/conf/ directory into the 2.4.1 conf/ directory.

  5. If you use the SWISH site indexer, copy any site indexes from the old swish/ directory into the 2.4.1 swish/ directory.

  6. Create a new subdirectory in the 2.4.1 logs/ directory for storing your old log files:

    # mkdir ServerRoot/logs/old

  7. Copy the contents of the old ServerRoot/logs/ directory into the new 2.4.1 ServerRoot/logs/old/ directory.

  8. Open both the old and new server configuration files using a text editor in separate windows.

  9. Copy and paste any custom configurations from the old file into the new file.

    Using the new configuration file as a base, you must modify your custom configurations to comply with new configuration conventions.

  10. Locate any AuthName directives and place quotes around their values. For example,

    AuthName Marx Bros

    should be changed to

    AuthName "Marx Bros"

  11. Edit the ServerRoot directive to reflect the path to the new 2.4.1 directory.

  12. In the global configuration, add the StrongholdLicenseFile directive. As its value, enter the name of the file that contains the server license block.

  13. Duplicate all <VirtualHost> containers in another part of the same file.

    If necessary, insert section headings to distinguish between the two copies. The original set of <VirtualHost> sections is for directives pertaining to non-SSL transactions, and the second set is for directives pertaining to SSL transactions.

  14. In each original <VirtualHost> section, append the port number for non-SSL transactions to the hostname or IP number:

    <VirtualHost 204.17.33.11:80>

  15. In each copied <VirtualHost> section, append the port number for SSL transactions to the hostname or IP number:

    <VirtualHost 204.17.33.11:443>

    This marks the beginning of an SSL <VirtualHost> section.

  16. Add the following directives to the global server configuration:

    Listen 443

  17. For every name-based virtual host configuration, enter a NameVirtualHost directive in the global configuration:

    NameVirtualHost 209.60.53.41:80
    NameVirtualHost 207.57.43.92:80

  18. Add these directives to each SSL <VirtualHost> section:

    SSLFlag on
    SSLCertificateKeyFile private/filename
    SSLCertificateFile certs/filename

    See the Administration Guide for information about generating keys and certificates.

  19. Add directives that pertain to modules that were installed with your Stronghold upgrade, if you wish to use them.

    See the Administration Guide for information about directives.

  20. For every <Files> container, replace the full path to the file with the filename.

    In previous versions, <Files> containers could stand alone and specify full paths to files. <Files> containers must now specify filenames instead of paths, but can also take wildcards and regular expressions. For example,

    <Files /usr/local/www/htdocs/aquabats/batty.html>
    . . .
    </Files>

    should be changed to

    <Directory /usr/local/www/htdocs/aquabats>
    <Files batty.html>
    . . .
    </Files
    </Directory>

  21. For every container that uses wildcards, modify the wildcard statement so that all slashes are literal.

    Wildcards no longer match slash (/).

  22. Save the modified configuration file.

  23. Stop the old Apache server.

  24. Run the ServerRoot/bin/start-server script to start the new, SSL-enabled Stronghold server.




Requesting and Installing New License Blocks

When you first install Stronghold Web Server, the installation program prompts you for your license block and installs it automatically. If you installed an evaluation version of Stronghold before you purchased it, you installed a temporary license block that expires when your evaluation period ends. You must install your permanent license block when you receive it. You can do this manually or by using the install_lb utility located in the ServerRoot/bin/ directory.

NOTE: License keys from Stronghold version 2.3 and below do not work with Stronghold 2.4.1.



To install a license block with install_lb

  1. Copy the license block.

  2. Run the install_lb utility:

    # ServerRoot/bin/install_lb

    The utility prompts you for the license block.

  3. Paste the license block into the install_lb window.

  4. Press Control-D at the beginning of the first blank line after the license block. Press Return to get a blank line if none was inserted when you pasted the license block.

    If the license block you pasted is not valid or there was no blank line when you pressed Control-D, the utility warns you of this and asks you if you want to try pasting the license block again. If the license block was pasted successfully, the utility exits and the license block is installed.



To install a license block manually

  1. Back up the original sh2licence file:

    # cp sh2licence sh2licence-backup

    If the StrongholdLicenseFile directive in your server configuration specifies a different file, use that file instead.

  2. Use a text editor to open the ServerRoot/sh2licence file.

  3. Delete your previous license block.

  4. Paste your new license block into the file.

    Your license block looks something like this:

    *****BEGIN LICENSE BLOCK*****
    TEIAAQCKAAAAAGar2a7Pc0iD2oyGDN9a5mrYkZ0NrG7Zcy7UFbFoP4xLzvcVAN4K
    0Mrww4z0A2o+gfVADbDz9IdePDKOA21C2E8SiPu1qwVI1pwvbA6xuVRWDo05BT/I
    rNGExtSx+LMh3N1q2icj4eD53kNQVoLvaoQ5CcYvWGexrKiSDQvE3agLU2VyaWFs
    OiAzMTQxNTkyNjUzNTg5NzkzMjMKQ29tcGFueTogQzJOZXQgRXVybSchmunkZApF
    eHBpcmVzOiBOZXZlcgpQcm9kdWN0OiBTSDIKVHlwZfogRXZhbHVhdGlvbgpJREVB
    OiBZZXMKRmFrZTogCkJyb2tlbiBMaW5lCkJyb2tlbjogMQ==
    *****END LICENSE BLOCK*****

  5. Save the modified file.

  6. Restart the server:

    # ServerRoot/bin/reload-server






[Top] [Prev] [Next] [Last]
© 1998 C2Net International
Feedback: stronghold-docs@c2.net
C2Net Logo