[next] [previous] [contents] [full-page]5.1 - VMS Server Account
5.2 - VMS Scripting Account
5.3 - Account Support Files
5.4 - Other Resources
5.5 - Server Startup
The HTTP server account should be a standard account, preferably in a group of its own (definitely at least a non-system, non-user group), with sufficient quotas to handle the expected traffic.
Process Quotas!
Server process quotas must be sufficient to support the expected traffic load. In particlular PRCLM must support expected script usage. BYTLM, BIOLM, DIOL, FILLM and PGFLQUO are all significant considerations.
Symptoms of insufficient process quotas include:
TCP/IP Agent Resources!
On an associated topic; some TCP/IP agents require particular internal resources to be adjusted against given loads (e.g. buffer space allocations). Symptoms of resource starvation may be TCP/IP services, including WASD, "pausing" for significant periods or associated processes entering miscellaneous wait states, etc., during processing. Please ensure such TCP/IP agents are appropriately dimensioned for expected loads.
The following provides a guide to the account.
Username: HTTP$SERVER Owner: WASD Server
Account: HTTPD UIC: [077,001] ([HTTP$SERVER])
CLI: DCL Tables: DCLTABLES
Default: HT_ROOT:[HTTP$SERVER]
LGICMD: LOGIN
Flags: Restricted DisNewMail
Primary days: Mon Tue Wed Thu Fri
Secondary days: Sat Sun
Primary 000000000011111111112222 Secondary 000000000011111111112222
Day Hours 012345678901234567890123 Day Hours 012345678901234567890123
Network: ##### Full access ###### ##### Full access ######
Batch: ##### Full access ###### ##### Full access ######
Local: ----- No access ------ ----- No access ------
Dialup: ----- No access ------ ----- No access ------
Remote: ----- No access ------ ----- No access ------
Expiration: (none) Pwdminimum: 6 Login Fails: 0
Pwdlifetime: 90 00:00 Pwdchange: (pre-expired)
Last Login: (none) (interactive), 11-MAY-1995 08:44 (non-interactive)
Maxjobs: 0 Fillm: 300 Bytlm: 5000000
Maxacctjobs: 0 Shrfillm: 0 Pbytlm: 0
Maxdetach: 0 BIOlm: 2048 JTquota: 1024
Prclm: 100 DIOlm: 1024 WSdef: 1000
Prio: 4 ASTlm: 2000 WSquo: 5000
Queprio: 0 TQElm: 100 WSextent: 20000
CPU: (none) Enqlm: 256 Pgflquo: 500000
Authorized Privileges:
NETMBX TMPMBX
Default Privileges:
NETMBX TMPMBX
5.2 - VMS Scripting Account
The following provides a guide to the account.
Username: HTTP$NOBODY Owner: WASD Scripting
Account: HTTPD UIC: [076,001] ([HTTP$NOBODY])
CLI: DCL Tables: DCLTABLES
Default: HT_ROOT:[HTTP$NOBODY]
LGICMD: LOGIN
Flags: Restricted DisNewMail
Primary days: Mon Tue Wed Thu Fri
Secondary days: Sat Sun
Primary 000000000011111111112222 Secondary 000000000011111111112222
Day Hours 012345678901234567890123 Day Hours 012345678901234567890123
Network: ##### Full access ###### ##### Full access ######
Batch: ##### Full access ###### ##### Full access ######
Local: ----- No access ------ ----- No access ------
Dialup: ----- No access ------ ----- No access ------
Remote: ----- No access ------ ----- No access ------
Expiration: (none) Pwdminimum: 6 Login Fails: 0
Pwdlifetime: 90 00:00 Pwdchange: (pre-expired)
Last Login: (none) (interactive), 11-MAY-1995 08:44 (non-interactive)
Maxjobs: 0 Fillm: 300 Bytlm: 500000
Maxacctjobs: 0 Shrfillm: 0 Pbytlm: 0
Maxdetach: 0 BIOlm: 2048 JTquota: 1024
Prclm: 100 DIOlm: 1024 WSdef: 1000
Prio: 4 ASTlm: 2000 WSquo: 5000
Queprio: 0 TQElm: 100 WSextent: 20000
CPU: (none) Enqlm: 256 Pgflquo: 500000
Authorized Privileges:
NETMBX TMPMBX
Default Privileges:
NETMBX TMPMBX
5.3 - Account Support Files
NOTE
Support procedures often change between versions. It is always advisable to check the versions documentation before installing or updating. Examples may be found in HT_ROOT:[EXAMPLE].
Two server executables can be built by the package.
As this image is to be installed with privileges unauthorized use should
be prevented by applying an ACL similar to the following against the
executable image:
$ SET SECURITY HT_EXE:HTTPD.EXE -
/ACL=((IDENT=HTTP$SERVER,ACCESS=R+E),(IDENT=*,ACCESS=NONE))
This can be done once, at installation, or for peace-of-mind (a.k.a. VMS-ish paranoia) at each server startup.
As the HTTP$SERVER account should be completely unprivileged, and the
HTTPd image requires CMKRNL, NETMBX, TMPMBX, PRMGBL, PRMMBX, PSWAPM, SHMEM (VAX
only), SYSGBL, SYSLCK, SYSNAM, SYSPRV and WORLD privileges (see the
"Nuts and Bolts" document for a description of how and why the server
uses these privileges). It must be installed using a command similar to the
following:
$ INSTALL = "$SYS$SYSTEM:INSTALL/COMMAND_MODE"
$ INSTALL ADD HT_EXE:HTTPD.EXE -
/PRIVILEGE=(ALTPRI,CMKRNL, PRMGBL,PRMMBX,PSWAPM,SHMEM,-
SYSGBL,SYSLCK,SYSNAM,SYSPRV,WORLD)
STARTUP.COM
Putting all this together the HTTP server startup procedure becomes something similar to the supplied example. It should be called from SYSTARTUP_VMS.COM or the site's equivalent.
This procedure will support simple and quite complex sites. It works closely with STARTUP_SERVER.COM (see below). It is designed to accept parameters from the command-line or as pre-assigned symbols. Operating in this fashion should mean that no modifications will need to be made to the procedure itself. Startup characteristics are essentially determined by DCL symbol values. Some symbols are booleans, switching functionality off and on, others require string values. When relevant startup values are not assigned a reasonable default will be applied. See the following examples.
Startup characteristics can be determined by supplying symbol assignment
values as command-line parameters when calling the procedure.
$ @$1$DKA0:[HT_ROOT.LOCAL]STARTUP WASD_DECNET=1 WASD_SSL=1 -
WASD_SSL_CERTIFICATE="HT_ROOT:[LOCAL]ALPHA.PEM"
Startup characteristics can also be determined by assigning the symbol
values before calling the procedure itself.
$ WASD_DECNET = 1
$ WASD_SSL = 1
$ WASD_SSL_CERTIFICATE = "HT_ROOT:[LOCAL]ALPHA.PEM"
$ @$1$DKA0:[HT_ROOT.LOCAL]STARTUP
On version of VAX VMS prior to 6.2 the startup uses a system batch queue.
By default SYS$BATCH is used. If a node does not have a SYS$BATCH then one
must be created. If a clustered node's SYS$BATCH is configured to run on a
cluster-common batch queue (i.e. not necessarily on the startup node) then a
node-specific queue must be specified.
$ @$1$DKA0:[HT_ROOT.LOCAL]STARTUP WASD_DECNET=1 WASD_BATcr_QUEUE=THIS$BATCH
Check the procedure itself for detail on symbol names and functionality.
See
HT_ROOT:[EXAMPLE]STARTUP.COM
STARTUP_LOCAL.COM
This file is automatically executed by the STARTUP.COM procedure immediately before the server is actually started. It is provided to supply all the local site's additional startup requirements. Place site-specific server environment startup in here, leaving STARTUP.COM alone as much as possible.
See
HT_ROOT:[EXAMPLE]STARTUP_LOCAL.COM
STARTUP_SERVER.COM
This procedure serves two purposes.
See HT_ROOT:[EXAMPLE]STARTUP_SERVER.COM
It is recommended to pass server startup command-line parameters using the
HTTPD$SERVER_STARTUP logical name that this procedure checks for and uses if
present. If this is defined in the system table it's contents are
applied to the server image when executed. It can be explicitly defined before
WASD startup.
$ DEFINE /SYSTEM /EXECUTIVE HTTPD$STARTUP_SERVER "/SYSUAF=ID"
$ @$1$DKA0:[HT_ROOT.LOCAL]STARTUP
It's value can also be passed to the main startup procedure in a symbol.
The startup procedure then defines a system logical name with that value (note
that any quotes used must be escaped).
$ WASD_DECNET = 1
$ WASD_SSL = 1
$ WASD_SSL_CERTIFICATE = "HT_ROOT:[LOCAL]ALPHA.PEM"
$ WASD_STARTUP = "/SYSUAF=ID"
$ @$1$DKA0:[HT_ROOT.LOCAL]STARTUP
It can also be manually redefined at any time and the server restarted to
apply different startup parameters to the running server.
$ DEFINE /SYSTEM /EXECUTIVE HTTPD$STARTUP_SERVER "/SYSUAF=(SSL,ID)"
$ HTTPD /DO=RESTART=NOW
5.4 - Other Resources
Other resources required or consumed by the package.
Global Pages/Sections
Accounting and request data made available to the server monitor utility (HTTPDMON) is provided by shared global memory. This requires one global section (SYSGEN parameter GBLSECTIONS) and 16 global pages (SYSGEN parameter GBLPAGES). The activity statistics available from the Server Admininistration facility requires one global section and 816 global pages. These two global sections are permanent.
If multiple server instances are to be employed one more global section is required for a standard server (a shared authentication cache), or two more for an SSL server (a shared session cache), with another if reverse proxy verify is enabled, plus a variable number (some tens) of global pages. These global sections are temporary.
If there are insufficient global sections or pages the server will fail to start for all requirements except the activity statistics, this will just be disabled. Startup messages advise on current usage.
As permanent, system-accessable global sections are deployed it may be
necessary to explicitly delete them after ad hoc server experimentation, etc.
(5.5 - Server Startup). The startup qualifier
/GBLSEC=NOPERM disables the creation of permanent global sections eliminating
this requirement.
Logical Names
The following logical names are used in the operation of the HTTPd server and most must be defined before startup (system-wide, or in the job table if server-specific). These are usually created by STARTUP.COM during server startup.
|
When starting up the server several characteristics of the server may be specified using qualifiers on the command line. If not specified appropriate defaults are employed. For recommended methods of passing parameters to the executable at server startup see STARTUP_SERVER.COM.
|