Hitachi

uCosminexus Application Server HTTP Server User Guide


6.2.7 Directives starting with S

Organization of this subsection

(1) Satisfy {any | all}

(a) Contents

When the access to the contents is controlled by both the user authentication (specifications of AuthUserFile and Require directives) and the host name or the IP address (specifications of Allow from and Deny from directive), this directive sets their relationship.

any: If any of the condition is satisfied, permits the access to the contents.

all: If none of the conditions are satisfied, prohibits the access to the contents.

(b) Location where you can code

<Directory>, .htaccess

(2) Script Method CGI-script-name

(a) Contents

When a request based on the specified method, this directive executes the script displayed in CGI script name.

Methods that you can specify: GET, POST, PUT, DELETE

The Method is case sensitive.

However, in the case of GET method, the script is called only when there is an query string (for example, /foo.html?bar).

(b) Location where you can code

httpsd.conf, <VirtualHost>, <Directory>

(c) Specification example

Script POST /cgi-bin/search

(3) ScriptAlias URL directory-name

(a) Contents

This directive specifies the name of the directory that contains the CGI program to be executed for the requests to execute the CGI programs specified in the URL from the Web browser.

You cannot specify a URL that is a duplicate of any of the following directive specification values:

  • ProxyPass path name

  • JkMount URL patterns in the redirector definition file

For example, the following URLs cannot be specified:

  ScriptAlias /aaa/bbb/ C:/alias/
  ProxyPass /aaa/ http://aaa.example.com/

Specify the directory name with an absolute path.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

ScriptAlias /cgi-bin/ "Application-Server-installation-directory/httpsd/cgi-bin/"

(4) ScriptAliasMatch regular-expression new-path

(a) Contents

When the URL requesting the execution of the specified CGI program from the Web browser satisfies the conditions described by the regular expressions, this directive executes the CGI program with the specified new path. When the regular expressions are grouped using brackets ( ), you can refer to the character string that matches with the expression of group i using $i in new path. Specify numeric characters from 1 to 9 for i.

Specify the new path with an absolute path. When '$' or '&' are included as characters of new path, add '[Figure]' before the characters. Note that when you specify $i, you need not add '[Figure]' before '$'.

You cannot specify a regular expression that is a duplicate of any of the following direcrive specification values:

  • ProxyPass path name

  • JkMount URL patterns in the redirector definition file

For example, the following regular expressions cannot be specified:

  ScriptAliasMatch ^/aaa/bbb/(.*) C:/alias/$1
  ProxyPass /aaa/ http://aaa.example.com/

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

ScriptAliasMatch ^/cgi-bin/(.*) "Application-Server-installation-directory/httpsd/cgi-bin/$1"

(5) ScriptInterpreterSource { registry | script } [Figure]

(a) Contents

This directive defines the interpreter used to execute the CGI script.

registry: The registry is searched and the program related to the extension is used as the interpreter.

script: The interpreter specified in #! Line in the script is used.

(b) Location where you can code

httpsd.conf, <VirtualHost>, <Directory>, .htaccess

(c) Overwrite permission

FileInfo level

(6) ScriptLog file-name

(a) Contents

The ScriptLog directive specifies the file to which the CGI script error log is output. For the file name, you can specify either an absolute path, or the relative path from the value specified in the ServerRoot directive.

In UNIX, the specified file must be writable with the user authentication specified in the User directive.

(b) Location where you can code

httpsd.conf

(7) ScriptLogBuffer number-of-buffers

~((0 - 2147483647))<<1024>> (Unit: Bytes)

(a) Contents

This directive specifies the maximum value when collecting the log of request body by PUT and POST methods, in bytes. This specification in valid only when you specify the file of the error log output destination with the ScriptLog directive.

The area of the value specified in this directive is stored in the request process. As a result, when you specify large values, memory storage failure may occur and Web server may stop. Hitachi recommends that you specify the default value or the minimum required value.

(b) Location where you can code

httpsd.conf

(8) ScriptLogLength file-size

~((0 - 2147483647))<<10385760>> (Unit: Bytes)

(a) Contents

This directive specifies the maximum size of error log file of CGI script in bytes. The specification of this directive is valid only when you specify the error log output destination file with the ScriptLog directive.

(b) Location where you can code

httpsd.conf

(9) SendBufferSize send-buffer-size

~((512 - 2147483647))<<0>> (Unit: Bytes)

(a) Contents

This directive specifies the TCP send buffer size for the Web server in bytes. If you specify 0, the default value of the OS is used.

In a high-speed network environment, specifying a value larger than the default value of the OS might improve the performance for sending responses.

(b) Location where you can code

httpsd.conf

(c) Specification example

SendBufferSize 131072

(10) ServerAdmin E-Mail-address

(a) Contents

This directive specifies the E-Mail address of the server administrator. Always specify this directive when you specify the E-Mail address with the ServerSignature directive.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

ServerAdmin www-admin@server.example.com

(11) ServerAlias host-name [host-name ...]

(a) Contents

This directive specifies an optional name for the host name (ServerName) that is used in the virtual host based on server name. You can specify the host name corresponding to an IPv6 address.

(b) Location where you can code

<VirtualHost>

(12) ServerLimit number-of-processes [Figure]

~((1-1000)))<<16>>

(a) Contents

The number of server processes that can be generated is calculated by using the MaxClients and ThreadsPerChild directives. The ServerLimit directive specifies the upper limit for the number of server processes that can be generated. According to the value specified in this directive, the shared memory area that stores server operation information is allocated. Therefore, if you specify a value larger than the number of server processes that actually run, an unused extra shared memory area will be allocated. We recommend that the value specified in this directive be equal to the value of the MaxClients directive divided by the value of the ThreadsPerChild directive. If different values are specified in those directives, the Web server might not be able to start or might become unstable.

You cannot change the value specified in this directive by simply restarting the server. To change the specified value, stop and then restart the Web server.

You can specify this directive when using the worker MPM.

(b) Location where you can code

httpsd.conf

(c) Specification example

ServerLimit 64

(13) ServerName server-name[:port-number]

(a) Contents

The ServerName directive specifies the server name and the port number of HTTP Server. When you omit the port number, the value specified in the Port directive is set.

Server name is specified in FQDN (fully qualified domain name) or IP address. You can also specify an IPv6 address or the FQDN corresponding to an IPv6 address for server-name. When specifying both an IPv6 address and a port number, enclose the IPv6 address in square brackets ([ ]).

Based on the specified value of the UseCanonicalName directive, any requests that use an image map or any specifications of a directory that does not end with a forward slash (/) are set in the Location header as redirect destination (when redirect is indicated in the Web server) and returned to the client. Therefore, you must specify the server name that a client can access. Specification of this directive is mandatory.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

ServerName www.example.com
ServerName 2001::123:4567:89ab:cdef
ServerName [2001::123:4567:89ab:cdef]
ServerName [2001::123:4567:89ab:cdef]:8080

(14) ServerPath path-name

(a) Contents

Specify this directive when you use the path name instead of Host header to connect to each host, in the virtual host based on the server name.

(b) Location where you can code

<VirtualHost>

(15) ServerRoot directory-name

~<</opt/hitachi/httpsd>>(UNIX version)

~<<Application Server-installation-directory\httpsd>> (Windows version)

(a) Contents

This directive specifies the root directory of server with the absolute path.

(b) Location where you can code

httpsd.conf

(c) Specification example

ServerRoot "C:/Program Files/Hitachi/Cosminexus/httpsd"

(16) ServerSignature {On | Off | Email}

(a) Contents

This directive specifies whether a content footer of error messages that the Web server creates is to be signed.

On: Displays the character string according to ServerTokens directive (such as Cosminexus HTTP Server and version number), and the server name and the port name according to the specified value of UseCanonicalName directive.

Cosminexus HTTP Server 09-00 at www.example.com Port 80

Off: Does not display signature in the contents footer.

Email: In addition to the display when On is specified, this option adds the specification value of the ServerAdmin directive in a mailto tag.

Note that when On is specified, the IPv6 address specified in the ServerName directive or the host name corresponding to an IPv6 address can be displayed.

(b) Location where you can code

httpsd.conf, <VirtualHost>, <Directory>, .htaccess

(c) Specification example

ServerSignature On

(17) ServerTokens {Minimal | OS | Full | ProductOnly}

(a) Contents

This directive sets the server header format of the HTTP response header. The Server header values based on respective setting are described below. Unix, Win32, or Win64 is set as the OS type. The value of Server header is used as per the client specifications.

Minimal: Cosminexus HTTP Server Version number

OS: Cosminexus HTTP Server Version number (OS type)

Full: Cosminexus HTTP Server Version number (OS type) Information set by an additional PP

ProductOnly: Cosminexus HTTP Server

(b) Location where you can code

httpsd.conf

(c) Specification example

ServerTokens Full

(18) SetEnv environment-variable-value

(a) Contents

This directive specifies the environment variable value that is set when you pass the optional environment variable to the CGI script. If you specify this directive multiple times, you cannot specify different values for the same environment variable.

(b) Location where you can code

httpsd.conf, <VirtualHost>, <Directory>, .htaccess

(c) Overwrite permission

FileInfo level

(d) Specification example

SetEnv MY_ENV myenv

(19) SetEnvIf request-value regular-expression environment-variable[=value] [environment-variable[=value] ...]

(a) Contents

This directive defines the environment variable on the basis of the client request. Set the specified environment variable when the request value from client satisfies the conditions in the regular expressions. By default, the value is set to 1. When ! is added before the environment variable, the setting of that environment variable is cancelled.

You can specify the value shown in the HTTP request header or the values shown in the following table as the request value. You can search an environment variable by specifying the environment value specified earlier as the request value. However, such environment variable must not conform to the HTTP request header and to the values described in the following table:

Request value

Meaning

Remote_Addr

IP address of the client

Remote_Host

Host name of the client (only when set in the request)

Request_Protocol

Protocol of the request (such as HTTP/1.1)

Request_Method

Method name of the request (such as GET, POST, and HEAD)

Request_URI

URI of the request

Server_Addr

IP address of the server that receives the request

When performing multiple specifications of this directive, you cannot specify the same request value multiple times.

Note that when specifying Remote_Host for request-value, you can also specify the host name corresponding to an IPv6 address for regular-expression. In addition, the Remote_Addr and Server_Addr request values cannot be used for connections that use IPv6. To use Remote_Addr and Server_Addr, perform settings by using the HWSSetEnvIfIPv6 directive.

(b) Location where you can code

httpsd.conf, <VirtualHost>, <Directory>, .htaccess

(c) Overwrite permission

FileInfo level

(d) Specification example

(Example 1)
SetEnvIf User-Agent "Mozilla.*" SETENVIF_USER_AGENT=Mozilla
(Example 2)
SetEnvIf Request_URI "[Figure].(gif|jpg)$" request_is_image
(Example 3)

For connections that use IPv4, set the environment variable for a specific client as follows:

Listen 123.123.123.123:80
Listen [2001::123:4567:89ab:cdef]:80
<VirtualHost 123.123.123.123:80>
        SetEnvIf Remote_Addr ^234[Figure].234[Figure].234[Figure].234$ IPV4_CLIENT
</VirtualHost>

(20) SetEnvIfNoCase request-value regular-expression environment-variable[=value] [environment-variable[=value] ...]

(a) Contents

This directive defines the environment variables based on the client request. Set the specified environment variables when the request value from the client satisfies the conditions described in the regular expression. By default, the value is set to 1. When ! is attached before environment variable, it cancels the settings of that environment variable.

For details on the values that can be specified for request-value, see the SetEnvIf directive.

However, regular-expression is not case-sensitive in this directive. When specifying this directive multiple times, you cannot specify the same request value in the directives.

Note that when specifying Remote_Host for request-value, you can specify the host name corresponding to request-value. In addition, the Remote_Addr and Server_Addr request values cannot be used for connections that use IPv6. To use Remote_Addr and Server_Addr, perform settings by using the HWSSetEnvIfIPv6 directive.

(b) Location where you can code

httpsd.conf, <VirtualHost>, <Directory>, .htaccess

(c) Overwrite permission

FileInfo level

(21) SetHandler handler-name

(a) Contents

Specify this directive when the requests of specified <Directory> or all the requests in the scope of access control file are related to the handlers specified with the handler names. If you specify none as the handler name, the settings specified for the SetHandler directive until then are disabled.

(b) Location where you can code

<Directory>, .htaccess

(c) Overwrite permission

FileInfo level

(22) SSLBanCipher encryption-type [encryption-type ...]

(a) Contents

This directive denies an access to specified encryption types and returns the status code 403 Forbidden to the client.

For details about the specifiable encryption types, see SSLCipherSuite directive.

(b) Location where you can code

<Directory>, .htaccess

(c) Overwrite permission

AuthConfig level

(23) SSLCACertificateFile file-name

(a) Contents

This directive specifies the name of the file that stores certificates (PEM format) of the CA (Certification Authority) when you perform client authentication by using the SSL features. By combining multiple certificate files, you can mix multiple certificates into one file.

Specify the file name with an absolute path.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

SSLCACertificateFile "Application-Server-installation-directory/httpsd/conf/ssl/cacert/anycert.pem"

(24) SSLCACertificatePath directory [Figure]

(a) Contents

This directive specifies the directory that stores the hash link to the certificate (PEM format) of the CA (Certification Authority) to perform client authentication by using the SSL features. For details on how to create and operate a hash link, see 5.2.8 Creating a hash link (in UNIX) (openssl.sh x509 command).

Specify directory name with an absolute path.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

SSLCACertificatePath /opt/hitachi/httpsd/conf/ssl/cacerts

(25) SSLCARevocationCheck {none | leaf}

(a) Contents

This directive specifies whether to check the Certificate Revocation List (CRL). To check the CRL, you must specify the SSLCARevocationFile directive.

none: The CRL is not checked.

leaf: The CRL is checked for the client certificate.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(26) SSLCARevocationFile file-name

(a) Contents

This directive specifies the file containing CRLs combined in the order of priority in the PEM format. Specify an absolute path for the file name. Specify this directive to apply the CRLs during client authentication. However, no CRL is applied if you specify none in the SSLCARevocationCheck directive.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

SSLCARevocationFile "Application-Server-installation-directory/httpsd/conf/ssl/crl/crl.pem"

This directive specifies the CRL file in the PEM format.

(27) SSLCertificateFile file-name

(a) Contents

This directive specifies the file that stores the Web server certificate. To perform server authentication, you can add the certificates of the CA (Certification Authority) after the Web server certificate in the order of intermediate CA certificate and root CA certificate. The certificates must be in the PEM format.

When you specify a certificate for RSA encryption and a certificate for elliptic curve cryptography, you can specify them in separate files (with a single certificate in each file).

Specify file name with an absolute path.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

# RSA
SSLCertificateFile "Application-Server-installation-directory/httpsd/conf/ssl/server/httpsd-rsa.pem"
# ECC
SSLCertificateFile "Application-Server-installation-directory/httpsd/conf/ssl/server/httpsd-ecc.pem"

(28) SSLCertificateKeyFile file-name

(a) Contents

This directive specifies the private key file name of the Web server. The private key files must be in the PEM format. If you specify the private keys for RSA encryption and elliptic curve cryptography, you can specify them in separate files (with a single private key in each file).

Specify the file name with an absolute path.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

# RSA
SSLCertificateKeyFile "Application-Server-installation-directory/httpsd/conf/ssl/server/httpsdkey-rsa.pem"
# ECC
SSLCertificateKeyFile "Application-Server-installation-directory/httpsd/conf/ssl/server/httpsdkey-ecc.pem"

(29) SSLCipherSuite encryption-type [:encryption-type ...]

(a) Contents

This directive specifies the encryption type that can be used with the SSL features. If the encryption types specified in this directive and the encryption types that the client can use match, the Web server establishes the SSL communication and receives the HTTP requests. If encryption types do not match, the Web server does not establish the SSL communication or receive the HTTP request. The specifiable encryption types are as follows:

Encryption type

Key exchange method

Authentication method

Symmetric key cryptography

Encryption key size (bit)

Message authentication algorithm

AES128-SHA

RSA

RSA

AES

128

SHA

AES128-SHA256

RSA

RSA

AES

128

SHA256

AES256-SHA

RSA

RSA

AES

256

SHA

AES256-SHA256

RSA

RSA

AES

256

SHA256

AES128-GCM-SHA256

RSA

RSA

AES

128

AEAD#

AES256-GCM-SHA384

RSA

RSA

AES

256

AEAD#

ECDHE-RSA-AES128-SHA

ECDH

RSA

AES

128

SHA

ECDHE-RSA-AES256-SHA

ECDH

RSA

AES

256

SHA

ECDHE-RSA-AES128-SHA256

ECDH

RSA

AES

128

SHA256

ECDHE-RSA-AES256-SHA384

ECDH

RSA

AES

256

SHA384

ECDHE-RSA-AES128-GCM-SHA256

ECDH

RSA

AES

128

AEAD#

ECDHE-RSA-AES256-GCM-SHA384

ECDH

RSA

AES

256

AEAD#

ECDHE-ECDSA-AES128-SHA

ECDH

ECDSA

AES

128

SHA

ECDHE-ECDSA-AES256-SHA

ECDH

ECDSA

AES

256

SHA

ECDHE-ECDSA-AES128-SHA256

ECDH

ECDSA

AES

128

SHA256

ECDHE-ECDSA-AES256-SHA384

ECDH

ECDSA

AES

256

SHA384

ECDHE-ECDSA-AES128-GCM-SHA256

ECDH

ECDSA

AES

128

AEAD#

ECDHE-ECDSA-AES256-GCM-SHA384

ECDH

ECDSA

AES

256

AEAD#

#

AEAD: Authenticated Encryption with Associated Data

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

SSLCipherSuite AES128-SHA256:AES256-SHA256

(30) SSLEngine {On | Off}

(a) Contents

This directive specifies whether to enable SSL. The default disables SSL.

To enable SSL within a <VirtualHost> block, specify SSLEngine On in that <VirtualHost> block.

On: SSL is enabled.

Off: SSL is disabled.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(31) SSLOptions [+|-]option [[+|-]option ...]

(a) Contents

This directive specifies the options when using the SSL features.

+: The function specified in the option is enabled.

-: The function specified in the option is disabled.

Option

Function

StdEnvVars

The SSL-related standard environment variables are set in CGI environment variables. Because environment variable settings affect performance, enable this option only when the CGI requires SSL-related environment variables.

ExportCertData

SSL_SERVER_CERT, SSL_CLIENT_CERT, and SSL_CLIENT_CERT_CHAIN_n (n = 0, 1, 2, ...) are set for CGI environment variables. Specify this option when the CGI requires information for the server and client certificate.

FakeBasicAuth

In addition to the SSL client authentication functionality, specify this option to perform the basic authentication by simply presenting the client certificate without entering a user ID and password in the Web browser. Code the subject and password of the X509 client certificate in the file specified in the AuthUserFile directive. The password is always fixed to {SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g= (this indicates the encrypted password).

The value of the Subject field in the certificate displayed by using the openssl.sh x509 or openssl.bat x509 command is as follows:

Subject: C = JP, ST = Kanagawa, L = Yokohama-shi, O = HITACHI, OU = Software, CN = username, emailAddress = username@userhost

In this case, specify the file as follows in the AuthUserFile directive:

/C=JP/ST=Kanagawa/L=Yokohama-shi/O=HITACHI/OU=Software/CN=username/emailAddress=username@userhost:{SHA}W6ph5Mm5Pz8GgiULbPgzG37mj9g=

(b) Note

If you specify options without using + or -, only the last specified option is enabled.

(c) Location where you can code

httpsd.conf, <VirtualHost>, <Directory>, .htaccess

(d) Overwrite permission

Options level

(e) Specification example

(Example 1)
SSLOptions StdEnvVars
SSLOptions FakeBasicAuth

If two lines of this directive are specified without specifying + or - for the option as shown in this example, only the last specified FakeBasicAuth is enabled.

(Example 2)
SSLOptions StdEnvVars
SSLOptions +FakeBasicAuth

If the option with + is specified last as shown in this example, FakeBasicAuth is also enabled in addition to StdEnvVars.

(Example 3)
SSLOptions +StdEnvVars FakeBasicAuth

If the option without + or - is specified last, the preceding options are disabled and only the last specified FakeBasicAuth is enabled.

(32) SSLProtocol [+|-] protocol-name [[+|-] protocol-name ...]

~<<All>>

(a) Contents

This directive specifies the version of SSL protocol that is used.

+: The protocol specified by the protocol name is enabled.

-: The protocol specified by the protocol name is disabled.

You can specify the following values as protocol name:

TLSv1: Use the TLS protocol version 1.0.

TLSv1.1: Use the TLS protocol version 1.1.

TLSv1.2: Use the TLS protocol version 1.2.

All: Use all the above-mentioned protocols.

(b) Note

If you specify protocol names without using + or -, only the last specified protocol is enabled.

(c) Location where you can code

httpsd.conf, <VirtualHost>

(d) Specification example

(Example 1)
SSLProtocol +TLSv1.1 +TLSv1.2

TLSv1.1 and TLSv1.2 are enabled.

(Example 2)
SSLProtocol +TLSv1 +TLSv1.2

If sequential protocols are not specified, only the successor protocol TLSv1.2 is enabled.

(Example 3)
SSLProtocol All -TLSv1

TLSv1.1 and TLSv1.2 are enabled.

(33) SSLRequireSSL

(a) Contents

Specify this directive when allowing the access only through SSL. If this directive is specified, access from http is denied with the status code 403 Forbidden. This directive prevents the exposure of the contents due to carelessly disabled SSL in the coding locations of different directives.

(b) Location where you can code

<Directory>, .htaccess

(c) Overwrite permission

AuthConfig level

(d) Specification example

<VirtualHost 172.17.40.10:443>
 SSLEngine Off
 ... 
  <Directory /secure/dir>
    SSLRequireSSL    
    ... 
  </Directory>
</VirtualHost>

This example allows the http access to the port 443 of 172.17.40.10 host but denies the access to directory /secure/dir. The Web server responds with the status code 403 Forbidden for the http access to /secure/dir directory.

(34) SSLVerifyClient {none | optional | require}

(a) Contents

This directive specifies the settings for certificate used during the client authentication.

none: Certificate is not requested.

optional: Client can display the certificate. This setting is used to test the operations.

require: Client must display the certificate.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

SSLVerifyClient require

(35) SSLVerifyDepth number-of-levels

~((0 - 10))<<1>>

(a) Contents

This directive specifies the number of levels up to which the certificate chain is traced.

Specify the number of levels for authentication check related to CA certificate chain used in client authentication. This directive is used to limit the extent up to which the CA chain is used. Normally, specify at least one level because 0 is assumed if the client certificate is a certificate with a self-signature. For example:

(Example)
Conditions
  • CA1 has signed the root CA.

  • Certificate 1 signs in root CA.

  • Certificate 2 signs in CA1.

    [Figure]

Specifying SSLVerifyDepth

To perform authentication checks for both certificates 1 and 2 in this example, specify 2 or more in the SSLVerifyDepth directive. To perform an authentication check for certificate 1 and skip the authentication check for certificate 2, specify 1 in this directive.

(b) Location where you can code

httpsd.conf, <VirtualHost>

(c) Specification example

SSLVerifyDepth 10

(36) StartServers number-of-processes [Figure]

worker MPM

~((0 - (MaxClients/ThreadsPerChild))) <<3>>

prefork MPM

~((0 - 1024))<<5>>

(a) Contents

This directive specifies the number of server processes when the Web server starts.

worker MPM

The value that can be specified in the StartServers directive is in the range from 0 to the value of the MaxClients directive divided by the value of the ThreadsPerChild directive.

(b) Location where you can code

httpsd.conf

(c) Specification example

StartServers 5