##
## httpd.conf -- Apache HTTP server configuration file
##

# This is the main server configuration file. See URL http://www.apache.org/
# for instructions.

# Do NOT simply read the instructions in here without understanding
# what they do, if you are unsure consult the online docs. You have been
# warned.  

# Originally by Rob McCool

# Dynamic Shared Object (DSO) Support
#
# To be able to use the functionality of a module which was built as a DSO you
# have to place corresponding `LoadModule' lines at this location so the
# directives contained in it are actually available _before_ they are used.
# Please read the file README.DSO in the Apache 1.3 distribution for more
# details about the DSO mechanism and run `httpd -l' for the list of already
# built-in (statically linked and thus always available) modules in your httpd
# binary.
#
# Example:
# LoadModule foo_module libexec/mod_foo.so

# ServerType is either inetd, or standalone.

ServerType standalone

# If you are running from inetd, go to "ServerAdmin".

# Port: The port the standalone listens to. For ports < 1023, you will
# need httpd to be run as root initially.

Port 8082

##
##  SSL Support
##
##  When we also provide SSL we have to listen to the 
##  standard HTTP port (see above) and to the HTTPS port
##
<IfDefine SSL>
Listen 8082
Listen 8445
</IfDefine>

# HostnameLookups: Log the names of clients or just their IP numbers
#   e.g.   www.apache.org (on) or 204.62.129.132 (off)
# The default is off because it'd be overall better for the net if people
# had to knowingly turn this feature on.

HostnameLookups off

# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.  

# User/Group: The name (or #number) of the user/group to run httpd as.
#  On SCO (ODT 3) use User nouser and Group nogroup
#  On HPUX you may not be able to use shared memory as nobody, and the
#  suggested workaround is to create a user www and use that user.
#  NOTE that some kernels refuse to setgid(Group) or semctl(IPC_SET)
#  when the value of (unsigned)Group is above 60000; 
#  don't use Group nobody on these systems!

User nobody
Group nobody

# ServerAdmin: Your address, where problems with the server should be
# e-mailed.

ServerAdmin webflow@osprey4.npac.syr.edu

# ServerRoot: The directory the server's config, error, and log files
# are kept in.
# NOTE!  If you intend to place this on a NFS (or otherwise network)
# mounted filesystem then please read the LockFile documentation,
# you will save yourself a lot of trouble.

ServerRoot "/npac/home/webflow/apache-ssl"

# BindAddress: You can support virtual hosts with this option. This option
# is used to tell the server which IP address to listen to. It can either
# contain "*", an IP address, or a fully qualified Internet domain name.
# See also the VirtualHost directive.

#BindAddress *

# ErrorLog: The location of the error log file. If this does not start
# with /, ServerRoot is prepended to it.

ErrorLog /npac/home/webflow/apache-ssl/var/log/error_log

# LogLevel: Control the number of messages logged to the error_log.
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.

LogLevel warn

# The following directives define some format nicknames for use with
# a CustomLog directive (see below).

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent

# The location of the access logfile (Common Logfile Format).
# If this does not start with /, ServerRoot is prepended to it.

CustomLog /npac/home/webflow/apache-ssl/var/log/access_log common

# If you would like to have an agent and referer logfile uncomment the
# following directives.

#CustomLog /npac/home/webflow/apache-ssl/var/log/referer_log referer
#CustomLog /npac/home/webflow/apache-ssl/var/log/agent_log agent

# If you prefer a single logfile with access, agent and referer information
# (Combined Logfile Format) you can use the following directive.

#CustomLog /npac/home/webflow/apache-ssl/var/log/access_log combined

# PidFile: The file the server should log its pid to
PidFile /npac/home/webflow/apache-ssl/var/run/httpd.pid

# ScoreBoardFile: File used to store internal server process information.
# Not all architectures require this.  But if yours does (you'll know because
# this file is created when you run Apache) then you *must* ensure that
# no two invocations of Apache share the same scoreboard file.
ScoreBoardFile /npac/home/webflow/apache-ssl/var/run/httpd.scoreboard

# The LockFile directive sets the path to the lockfile used when Apache
# is compiled with either USE_FCNTL_SERIALIZED_ACCEPT or
# USE_FLOCK_SERIALIZED_ACCEPT. This directive should normally be left at
# its default value. The main reason for changing it is if the logs
# directory is NFS mounted, since the lockfile MUST BE STORED ON A LOCAL
# DISK. The PID of the main server process is automatically appended to
# the filename. 
#
#LockFile /npac/home/webflow/apache-ssl/var/run/httpd.lock

# ExtendedStatus controls whether Apache will generate "full" status
# information (ExtendedStatus On) or just basic information (ExtendedStatus
# Off) when the server-status Handler is called. The default is Off.
#
#ExtendedStatus On

# ServerName allows you to set a host name which is sent back to clients for
# your server if it's different than the one the program would get (i.e. use
# "www" instead of the host's real name).
#
# Note: You cannot just invent host names and hope they work. The name you 
# define here must be a valid DNS name for your host. If you don't understand
# this, ask your network administrator.
# If your host doesn't have a registered DNS name, enter its IP address here.
# You will have to access it by its address (e.g., http://123.45.67.89)
# anyway, and this will make redirections work in a sensible way.

#ServerName osprey4.npac.syr.edu

# Optionally add a line containing the server version and virtual host
# name to server-generated pages (error documents, ftp directory listings,
# mod_status and mod_info output etc., but not SSI generated documents).
# Set to "EMail" to also include a mailto: link to the ServerAdmin.
# Set to one of:  On | Off | EMail
ServerSignature on

# UseCanonicalName:  (new for 1.3)  With this setting turned on, whenever
# Apache needs to construct a self-referencing URL (a url that refers back
# to the server the response is coming from) it will use ServerName and
# Port to form a "canonical" name.  With this setting off, Apache will
# use the hostname:port that the client supplied, when possible.  This
# also affects SERVER_NAME and SERVER_PORT in CGIs.
UseCanonicalName on

# CacheNegotiatedDocs: By default, Apache sends Pragma: no-cache with each
# document that was negotiated on the basis of content. This asks proxy
# servers not to cache the document. Uncommenting the following line disables
# this behavior, and proxies will be allowed to cache the documents.

#CacheNegotiatedDocs

# Timeout: The number of seconds before receives and sends time out

Timeout 300

# KeepAlive: Whether or not to allow persistent connections (more than
# one request per connection). Set to "Off" to deactivate.

KeepAlive On

# MaxKeepAliveRequests: The maximum number of requests to allow
# during a persistent connection. Set to 0 to allow an unlimited amount.
# We reccomend you leave this number high, for maximum performance.

MaxKeepAliveRequests 100

# KeepAliveTimeout: Number of seconds to wait for the next request

KeepAliveTimeout 15

# Server-pool size regulation.  Rather than making you guess how many
# server processes you need, Apache dynamically adapts to the load it
# sees --- that is, it tries to maintain enough server processes to
# handle the current load, plus a few spare servers to handle transient
# load spikes (e.g., multiple simultaneous requests from a single
# Netscape browser).

# It does this by periodically checking how many servers are waiting
# for a request.  If there are fewer than MinSpareServers, it creates
# a new spare.  If there are more than MaxSpareServers, some of the
# spares die off.  These values are probably OK for most sites ---

MinSpareServers 5
MaxSpareServers 10

# Number of servers to start --- should be a reasonable ballpark figure.

StartServers 5

# Limit on total number of servers running, i.e., limit on the number
# of clients who can simultaneously connect --- if this limit is ever
# reached, clients will be LOCKED OUT, so it should NOT BE SET TOO LOW.
# It is intended mainly as a brake to keep a runaway server from taking
# Unix with it as it spirals down...

MaxClients 150

# MaxRequestsPerChild: the number of requests each child process is
#  allowed to process before the child dies.
#  The child will exit so as to avoid problems after prolonged use when
#  Apache (and maybe the libraries it uses) leak.  On most systems, this
#  isn't really needed, but a few (such as Solaris) do have notable leaks
#  in the libraries.

MaxRequestsPerChild 30

# Proxy Server directives. Uncomment the following line to
# enable the proxy server:

#ProxyRequests On

# Enable/disable the handling of HTTP/1.1 "Via:" headers.
# ("Full" adds the server version; "Block" removes all outgoing Via: headers)
# Set to one of: Off | On | Full | Block
#ProxyVia on

# To enable the cache as well, edit and uncomment the following lines:
# (no cacheing without CacheRoot)

#CacheRoot /npac/home/webflow/apache-ssl/var/proxy

#CacheSize 5
#CacheGcInterval 4
#CacheMaxExpire 24
#CacheLastModifiedFactor 0.1
#CacheDefaultExpire 1
#NoCache a_domain.com another_domain.edu joes.garage_sale.com

# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports, in addition to the default. See also the VirtualHost command

#Listen 3000
#Listen 12.34.56.78:80

# VirtualHost: Allows the daemon to respond to requests for more than one
# server address, if your server machine is configured to accept IP packets
# for multiple addresses. This can be accomplished with the ifconfig 
# alias flag, or through kernel patches like VIF.

# Any httpd.conf or srm.conf directive may go into a VirtualHost command.
# See also the BindAddress entry.
 
#<VirtualHost host.some_domain.com>
#ServerAdmin webmaster@host.some_domain.com
#DocumentRoot /www/docs/host.some_domain.com
#ServerName host.some_domain.com
#ErrorLog logs/host.some_domain.com-error_log
#TransferLog logs/host.some_domain.com-access_log
#</VirtualHost>


##
##  SSL Support
##
##  Note that all SSL options can apply to virtual hosts, which is
##  where we are going to put them. Per default SSL is disabled
##  globally and you have to enable it inside virtual hosts
##  explicitly.
##

<IfModule mod_ssl.c>

#   Configure the pass phrase gathering process. [RECOMMENDED]
#   The filtering dialog program (`builtin' is a internal
#   terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog   builtin

#   Configure the path to the mutial explusion lockfile the
#   SSL engine uses internally for syncronization. [RECOMMENDED]
SSLMutex  file:/npac/home/webflow/apache-ssl/var/run/ssl_mutex

#   Configure the SSL Session Cache: First either `none'
#   or `dbm:/path/to/file' for the mechanism to use and
#   second the expiring timeout (in seconds). [RECOMMENDED].
SSLSessionCache         dbm:/npac/home/webflow/apache-ssl/var/run/ssl_scache
SSLSessionCacheTimeout  300

#   The home of the dedicated SSL protocol logfile. Errors are
#   additionally duplicated in the general error log file.  Put
#   this somewhere where it cannot be used for symlink attacks on
#   a real server (i.e. somewhere where only root can write).
#   [RECOMMENDED]
#   Log levels are (ascending order: higher ones include lower ones):
#   none:  no dedicated SSL logging at all, but errors are still 
#          duplicated to the Apache error log.
#   error: log error messages (plus duplicate them to the error log)
#   warn:  log warning messages
#   info:  log information messages
#   debug: log debugging messages
SSLLog      /npac/home/webflow/apache-ssl/var/log/ssl_engine_log
SSLLogLevel info

</IfModule>

<IfDefine SSL>

<VirtualHost _default_:8445>

#   Setup the general virtual host configuration.
DocumentRoot /npac/home/webflow/apache-ssl/share/htdocs
ServerName osprey4.npac.syr.edu
ServerAdmin webflow@osprey4.npac.syr.edu
ErrorLog /npac/home/webflow/apache-ssl/var/log/error_log
TransferLog /npac/home/webflow/apache-ssl/var/log/access_log

#   Enable SSL for this virtual host.
SSLEngine on

#   Point SSLCertificateFile at a PEM encoded certificate.  If
#   the certificate is encrypted, then you will be prompted for a
#   pass phrase.  Note that a kill -HUP will prompt again. A test
#   certificate can be generated with `make certificate' under
#   built time. [RECOMMENDED]
SSLCertificateFile    /npac/home/webflow/apache-ssl/etc/ssl.crt/apacheserver.crt

#   If the key is not combined with the certificate, use this
#   directive to point at the key file. [OPTIONAL]
SSLCertificateKeyFile /npac/home/webflow/apache-ssl/etc/ssl.key/apacheserver.key

#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
#   [OPTIONAL]
#   Note: Inside SSLCACertificatePath you need hash symlinks
#         to point to the certificate files. Use the provided
#         Makefile to update the hash symlinks after changes.
SSLCACertificatePath  /npac/home/webflow/apache-ssl/etc/ssl.crt
SSLCACertificateFile  /npac/home/webflow/apache-ssl/etc/ssl.crt/webflow-ca.cert

#   Set the file containing CA certificates which are sent to the
#   client on an `SSLv3 write certificate request A'. This is
#   used with SSLv3 certificate chaining where the client loads
#   intermediate certificates in the chain from the server to
#   speedup processing of the server authentication. This
#   defaults to SSLCACertificateFile but can be set to a
#   different file when you want to use a different set of
#   certificates you sent out to the client.
#SSLCACertificateReqFile /npac/home/webflow/apache-ssl/etc/ssl.crt/ca-bundle.crt

#   Set client verification level: [RECOMMENDED]
#   none:           no certificate is required
#   optional:       the client may  present a valid certificate
#   require:        the client must present a valid certificate
#   optional_no_ca: the client may  present a valid certificate 
#                   but it is not required to have a valid CA
SSLVerifyClient require

#   Set how deeply to verify the certificate issuer chain before
#   deciding the certificate is not valid. [OPTIONAL]
SSLVerifyDepth 10

#   List the ciphers that the client is permitted to negotiate.
#   See the mod_ssl documentation for a complete list. [OPTIONAL]
#SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

#   Set various SSL engine options [OPTIONAL]
#   (notice that SSLOptions can be used also in .htaccess files!)
#   FakeBasicAuth:
#     Translate the client X.509 into a Basic Authorisation.  This means that
#     the standard Auth/DBMAuth methods can be used for access control.  The
#     user name is the `one line' version of the client's X.509 certificate.
#     Note that no password is obtained from the user. Every entry in the user
#     file needs this password: `xxj31ZMTZzkVA'.
#   ExportCertData:
#     This exports two additional environment variables: SSL_CLIENT_CERT and
#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
#     server (always existing) and the client (only existing when client
#     authentication is used). This can be used to import the certificates
#     into CGI scripts.
#   CompatEnvVars:
#     This exports obsolete environment variables for backward compatibility
#     to Apache-SSL 1.x, mod_ssl 2.0.x, Sioux 1.0 and Stronghold 2.x. Use this
#     to provide compatibility to existing CGI scripts.
#SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars

#   With SSLRequire you can do access control based on
#   arbitrary complex boolean expressions containing
#   server variable checks and other lookup directives.
#   The syntax is a mixture between C and Perl. 
#   See the mod_ssl documentation for more details.
#SSLRequire %{SSL_CIPHER} !~ m/^EXP-.*/ and \
#           %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." and \
#           %{REMOTE_ADDR} =~ m/^1\.2\.3\.[0-9]+$/

#   The home of a custom SSL log file. [RECOMMENED]
#   (Use this when you want a compact non-error SSL logfile
#   on a virtual host basis)
#CustomLog /npac/home/webflow/apache-ssl/var/log/ssl_request_log \
#          "%t %h %{version}c %{cipher}c \"%r\" %b %{subjectdn}c %{issuerdn}c"
CustomLog /npac/home/webflow/apache-ssl/var/log/ssl_request_log \
          %{subjectdn}c

</VirtualHost>                                  

</IfDefine>

Include /npac/home/webflow/apache-ssl/ApacheJServ-1.0/conf/httpd.conf

