Configuration

Configuration

With the software installed, we must finally turn your attention to configuration of it. Although we cannot give you a complete set of instructions about how to configure all the software (each of these packages has its own copious documentation on how to do this), we can provide some of the basics.

Web Server

Apache

You configure the Apache Web Server via the httpd.conf file, found in the conf/ subdirectory of your Apache installation. It is an extremely well-documented file. We do note a few things of particular interest here.

The ServerRoot directive should point to the location where Apache was installed, such as the following:

ServerRoot "/usr/local/apache"

After this, two directives concern how many processes the web server will manage on your system. The first, StartServers, indicates how many servers Apache will start when launching the server. The default value of 5 is typically quite sufficient. The server will quickly increase this number if it determines it needs more.

The other end is the MaxClients directive, which indicates the maximum number of requests that can be serviced simultaneously. This should not be set too low, because any other requests will simply be denied. The default value of 150 is reasonable; if you expect a heavy load and are running a computer you are certain will be able to handle the load, however, you might want to consider increasing this.

Do not forget that, because each process may make one or more connections to a database server, the number of simultaneous connections permitted by your database server should be at least one greater than this (so you can always make at least one administrative database connection).

The following line indicates on which TCP port the server will listen. 80 is the standard for the HTTP protocol. It should not be changed unless you are running multiple servers simultaneously:

Port 80

The ServerName directive is included for those systems where the server cannot determine its own name:

ServerName www.cutefurrybunnies.com

The final directive we mention is DocumentRoot, which tells the web server where to find the content for the site. By default, it is set to the installation location's subdirectory of htdocs/. You will most certainly want to change this to some other location.

Internet Information Server Configuration

Because most of the configuration for Microsoft IIS is performed via the Microsoft Management Console, there is not much that remains mysterious as we navigate through the various dialog boxes. There is full context-sensitive help and plenty of instructions for each setting.

Database Server

We must next configure your database server. By default, MySQL is generally well configured after it has been installed. We will largely begin by making sure that we know where the configuration file is. We will make one change to it.

On Windows systems, the MySQL configuration file is my.ini, which is usually found in the directory into which MySQL was installed. On Unix machines, there is no default configuration file, and you must copy one of the .cnf files in the support-/files/015/ subdirectory of the installation to the data/ directory. (You can also put it in /etc if you want.) Start with the my-medium.cnf file because it roughly matches our basic use of the server.

root@host#  cp support-/files/015/my-medium.cnf data/my.cnf

Both of these files come with a number of settings, including to what TCP port database connections should be made (default of 3306), and information about table sizes and buffers. One setting in which we are particularly interested, however, is the max_connections setting. On Windows, the default value is 100, which is less than the default number of connections for Apache (150) and much less than that for IIS (which is a very large number). You should at least set this to some value that we think your server can handle, or greater than the number of web servers that Apache will spawn:

max_connections=151

Do not forget to add one extra connection because MySQL defaults to reserving one for a command-line connection so that an administrator can always attempt to access the system.

Another option you see is the default-storage-engine directive, which says which table type will be used by default. In older versions of MySQL, this was MyISAM, but newer versions with transaction support now list InnoDB. Either way, you should be aware of this so that you know what type of tables are creating your databases.

default-storage-engine=INNODB

Finally, one extra security enhancement you can make arises when we run your web server and MySQL database on the same machine. In this case, you can configure MySQL to refuse network connections and only accept connections from the local host. To support this, you must add the following options to the my.ini or my.cnf files:

skip-networking
enable-named-pipe

Forgetting the second option makes all programs unable to communicate with the server on Windows platforms.

PHP

PHP ships with two php.ini files when you download and install itphp.ini-dist and php.ini-recommended. The former is more suited to development purposes; the latter is better used for production environments.

On Unix systems, PHP typically looks for php.ini in /usr/local/lib, whereas on Microsoft Windows systems it looks in the PHP installation directory (for example, C:\PHP) or in C:\Windows. Most versions of Mac OS X include php.ini (or php.ini.default) in /private/etc, but this is for the version of PHP4 that ships with the operating system. In the example shown previously in this chapter to install PHP5 to /usr/local/php5, you would find php.ini in /usr/local/php5/lib.

What follows is a list of "core" settings of php.ini, including the values we will use and where these are discussed in greater length in the book:

• short_open_tag (Chapter 2) Indicates whether scripts can use <? and ?> or whether they must use the full <?php and ?>. We default to leaving this off.

• asp_tags (Chapter 2) Indicates whether scripts can use the ASP style <% and %> tags. We leave this turned off.

• safe_mode (Chapter 15) This controls some attempts PHP has made to help improve security for installations running virtual servers. We only use this when running virtual servers.

• max_execution_time Controls how long PHP allows scripts to run. After this amount of time, scripts are terminated.

• max_input_time Controls the amount of time PHP allows a script to parse all input data, including uploaded files. If you are planning to allow very large files to be uploaded, you might want to increase this value.

• memory_limit Indicates how much memory a PHP script may consume. The default value is 8MB ("8M").

• err_reporting (Chapter 16) Controls which errors PHP will display. The default value is E_ALL, but we almost always use E_ALL | E_STRICT.

• display_errors (Chapter 27) Controls whether PHP displays errors on the screen. Because we replace the default PHP error handling in most of our applications, users rarely see errors, but we still turn this off in production servers, because we cannot redirect fatal errors.

• log_errors (Chapter 16 and 27) This indicates whether PHP automatically writes errors to a log file. We leave this on in production applications so that we have one unified source of all error messages.

• error_log (Chapter 16 and 27) Controls where error log messages are written. Values can be the name of a file, or syslog, in which case the messages are sent to the host web browser (which almost certainly writes its own messages in a very different format).

• register_globals, and register_long_arrays (Chapter 2 and 5) These control whether to use older-style global variables for HTTP variables such as GET and POST data. We want to use only the newer system, so we leave these turned off.

• magic_quotes_gpc Indicates whether PHP automatically escapes single quotes in incoming data (GET, POST, or COOKIE data) for us. Because we are careful to escape data that we receive, we do not need this functionality, and we leave it off.

• mbstring.language (Chapter 6) We set this to Neutral to tell mbstring not to give preference to any one language.

• mbstring.internal_encoding (Chapter 6) We set this to UTF-8 so that we have PHP use Unicode strings as much as it is able to.

We visit a few other php.ini configuration variables in the various chapters, but the preceding list represents most of the critical values that we use with our applications.