rgraham writes "James Duncan Davidson (the original author of Apache Tomcat and Apache Ant) has an article over at O'Reilly's MacDevCenter that walks you through the steps of not only getting Apache up and running on 10.2 (pretty simple, I know) but also DNS and Mail. The aricle goes along well with Alan Graham article on how to setup your own .Mac type service."

An anonymous reader writes "A flaw in Apache 2.0's interpretation of the backslash delimiter allows for a remote r00ting on NetWare, Windows, and OS/2. InfoWorld has an overview; the attack was discoverd by PivX's Auriemma Luigi, and he describes it in this technical document. I don't know whether there is such a thing as an OS/2 shop anymore, and most Microsoft shops probably run IIS, but Apache now ships as the default web server for NetWare 6, so Novell shops: Take note. A patch is available from Apache, and Luigi describes a workaround in his article."

cant_get_a_good_nick writes "From this week's Apacheweek comes a link to a white paper discussing Total Cost of Ownership for Linux in the Enterprise. Some very good hard numbers here, although as always, YMMV. It shows that even with "expensive UNIX admins" having to switch over costs to a "new UNIX", admin costs are lower than for Windows or Solaris. Some great quotes too, I can see these plastered in posts for weeks to come. I wish they could have included FreeBSD in the survey, but all in all interesting."

rbowen writes "The Apache Server Documentation Team is pleased to announce an overhaul of the Apache 2.0 documentation web site. I addition to new page layout and better navigation, there are a number of new documents, and all of the directive documentation now has helpful examples. Special kudos to Joshua Slive for all of his hard work and leadership."

Sterling Hughes writes "It is now possible to embed MSIL bytecodes into Apache using the mod_haydn module. This means any language that can be compiled into MSIL, now has access to the Apache API, and can register Apache handlers (theoretically at least). Currently content, translation and authentication handlers are supported. mod_haydn is released under the BSD License."

Robert Nagle writes: "Apache's HTTP server has been by many measures the most popular web server on the web, and perhaps the primary application that drives people to Linux and open source. Three years ago, Wrox published the definitive book on running the Apache server by Peter Wainwright. Excellent though the book was, it badly needed updating. In May 2002, Wrox published another book, Professional Apache 2.0, which covers the new generation of Apache server, as well as older 1.3x versions that are still running production servers around the world." Robert's review continues, below.

An Onimous Cow Herd writes "Augusts Netcraft Web survey results are now out. This month's results show a dramatic upsurge of nearly 6% for Apache and a corresponding drop for MS IIS! At this point, Apache's decline has dramatically reversed, regaining the ground it lost to IIS starting mid-2001 and currently Apache's market share stands the highest since Netscraft started their monthly surveys."

bLanark asks: "I'm in the process of converting one of my clients from IIS/CGI to Apache/mod_perl. I need a (free) web site stress/load test tool to prove that performance will be increased. Using this page as my starting point, I can see that there are quite a few tools to investigate. Has anyone used any of these (or any others) and what are they like. I need HTTP GETS, form POSTing, and clever stuff like simulation of caching of images would be useful too, I guess." The previous story didn't get much of a response, but that was about a year ago, but the submittor has shared a fairly impressive list with us, impressions about any piece of software on it would be greatly appreciated.

cliffwoolley writes "On August 7, the Apache Software Foundation was notified of a significant vulnerability that affects the Win32, OS/2, and Netware ports of Apache 2.0. It has the potential to allow an attacker to inflict serious damage to a server and/or reveal sensitive data on those platforms. To fix this vulnerability in addition to a number of cross-platform issues (a pair of path exposures and a number of bugs), Apache 2.0.40 has been released. It is considered the best currently available version of Apache, and all users are urged to upgrade."

cant_get_a_good_nick asks: "I was trolling Sourceforge, and found NetLooney. Since there seemed to be interest in a quality Apache admin tool, I was wondering if anybody here had used it and can comment on it. It was commercial at one time, now iit's GPL'ed."

PerlGuy was so kind as to forward us the news about the joint Apache/Microsoft combined press conference scheduled from Wednesday at the OSCON Quote: "We will announce news related to the Apache web server and Microsoft's development technology, .NET. This should be one of the biggest announcements of the conference..."

corz writes "Just when you thought you were finished upgrading the webserver, 'The PHP Group has learned of a serious security vulnerability in PHP versions 4.2.0 and 4.2.1. An intruder may be able to execute arbitrary code with the privileges of the web server. This vulnerability may be exploited to compromise the web server and, under certain conditions, to gain privileged access.' Here's the bugtraq announcement." The hole is in the parsing of HTTP POST headers and can allow arbitrary code to be run on vulnerable machines. PHP thoughtfully decided to release a new version, 4.2.2, today with the fix. You can find a copy of it here (mirror).

Joshua Chamas writes "I have been running the Hello World benchmarks for years, and I have finally published the Apache Hello World Benchmarks site based on this data. Most people have a love-hate relationship with benchmark data, but I think its critical information to have whenever choosing what's right for your project. The beauty of these benchmarks is that they are open source, so one can run them easily on their Apache/UNIX system and pry them apart to see what makes them tick!"

IOOOOOI asks: "I work at a high traffic web hosting company and we're trying to find a simple effective way to limit bandwidth hogs, some of whom we've clocked pulling over 4Gb/hr off our servers. We've tried mod_throttle and have looked into QoS/fair queuing as well as a couple of custom solutions in-house. None of these quite did the trick. Has anyone found an effective way to do this, one that can handle individual connection streams?"

Sergey Zimin writes "ApacheConf is a shell for configuring Apache web servers, that will help you to tune the main configuration file httpd.conf. ApacheConf presents all the information in the file httpd.conf in a structured view. All of the server's directives are grouped by categories (Global parameters, Main server's parameters, Directories, Virtual hosts, etc) and all these groups are represented as a tree. Therefore you can see the entire structure of the server at a glance and you can easily manage all of the server's directives, as well as the directories and virtual hosts. You save time, as you don't have to use notepad for configuring your server! ApacheConf has advanced description all of the server's directives and parameters. It will help the beginner to quickly master the Apache server. For the experienced user it will become an indispensable administrative tool."

VanMan writes "IBM is offering a free download of their WebSphere SDK for Web Services. It's based on open specifications for Web services such as SOAP, WSDL, and UDDI and runs on both Linux and Windows operating systems. The IBM WebSphere SDK for Web Services includes software developed by the Apache Software Foundation, so it merits a look-see."

A reader writes:"On NewsForge, there is an interview with a system administrator looking for an officially supported FrontPage install for RedHat Linux Apache rpm to fix CERT Advisory CA-2002-17 , which has already found in the wild. According to the interview Microsoft may, at some point, release an official patch or upgrade which Apache, RedHat and others fixed long ago."

cant_get_a_good_nick writes: "From ApacheWeek, probably the best net resource for Apache, comes the announcement of a binary build of Apache 2.0.39 for PS2 Linux. You too can have a server farm for web serving, and GTA3. Be nice and don't kill this guy's downloads page."

Andy Cheung writes "http://www.netcraft.com/survey/ The Netcraft Web Server Survey for June is out. Apache market share rises 3.46%; MS down -2.72". Scroll down past the graph on servers and check out the information on current exploits. It makes you wonder why "immediate death of the internet" has not happened.

vw asks: "I was wondering if anyone has setup a webserver farm that uses both SSL and zero-affinity network-load-balancing. (i.e. requests in an SSL channel can be handled by any server in the farm) I have been having a very difficult time locating information on this specific combination of features in a web server product. The closest I found was WLBS, which implies that there must be an affinity toward a particular server for a given client IP. I understand the problem has something to do with sharing SSL certificates between physical machines. Any suggestions?"