Apache HTTP Server Version 2.3
In order to assist folks upgrading, we maintain a document
describing information critical to existing Apache HTTP Server users. These
are intended to be brief notes, and you should be able to find
more information in either the New Features document, or in
the src/CHANGES
file. Application and module developers
can find a summary of API changes in the API updates overview.
This document describes changes in server behavior that might require you to change your configuration or how you use the server in order to continue using 2.4 as you are currently using 2.2. To take advantage of new features in 2.4, see the New Features document.
This document describes only the changes from 2.2 to 2.4. If you are upgrading from version 2.0, you should also consult the 2.0 to 2.2 upgrading document.
The compilation process is very similar to the one used in
version 2.2. Your old configure
command line (as
found in build/config.nice
in the installed server
directory) can be used in most cases. There are some changes in
the default settings. Some details of changes:
mod_disk_cache
in
2.4.mod_lbmethod_bybusyness
. You might need
to build and load any of these that your configuration
uses.There have been significant changes in authorization configuration, and other minor configuration changes, that could require changes to your 2.2 configuration files before using them for 2.4.
Any configuration file that uses authorization will likely need changes.
You should review the Authentication, Authorization and Access Control Howto, especially the section Beyond just authorization which explains the new mechanisms for controlling the order in which the authorization directives are applied.
In 2.2, access control based on client hostname, IP address,
and other characteristics of client requests was done using the
directives Order
, Allow
, Deny
, and Satisfy
.
In 2.4, such access control is done in the same way as other
authorization checks, using the new module
mod_authz_host
. The old access control idioms
should be replaced by the new authentication mechanisms,
although for compatibility with old configurations, the new
module mod_access_compat
is provided.
Here are some examples of old and new ways to do the same access control.
In this example, all requests are denied.
Order deny,allow
Deny from all
Require all denied
In this example, all requests are allowed.
Order allow,deny
Allow from all
Require all granted
In the following example, all hosts in the apache.org domain are allowed access; all other hosts are denied access.
Order Deny,Allow
Deny from all
Allow from apache.org
Require host apache.org
Some other small adjustments may be necessary for particular configurations as discussed below.
DefaultType
directive no longer has any effect, other than to emit a
warning if it's used with any value other than
none
. You need to use other configuration
settings to replace it in 2.4.
mod_log_config
: ${cookie}C
matches whole cookie names. Previously any substring would
match.mod_dav_fs
: The format of the DavLockDB
file has changed for
systems with inodes. The old DavLockDB
file must be deleted on
upgrade.
KeepAlive
only
accepts values of On
or Off
.
Previously, any value other than "Off" or "0" was treated as
"On".Mutex
directive. You will need to evaluate any use of these removed
directives in your 2.2 configuration to determine if they can
just be deleted or will need to be replaced using Mutex
.mod_cache
: CacheIgnoreURLSessionIdentifiers
now does an exact match against the query string instead of a
partial match. If your configuration was using partial
strings, e.g. using sessionid
to match
/someapplication/image.gif;jsessionid=123456789
,
then you will need to change to the full string
jsessionid
.
mod_ldap
: LDAPTrustedClientCert
is now
consistently a per-directory setting only. If you use this
directive, review your configuration to make sure it is
present in all the necessary directory contexts.mod_auto_index
: will now extract titles and
display descriptions for .xhtml files, which were previously
ignored.htpasswd
now uses MD5 hash by default on
all platforms.All modules must be recompiled for 2.4 before being loaded.
Many third-party modules designed for version 2.2 will otherwise work unchanged with the Apache HTTP Server version 2.4. Some will require changes; see the API update overview.
Invalid command 'User', perhaps misspelled or defined by a module not included in the server configuration
- load module mod_unixd
Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration
, or
Invalid command 'Order', perhaps misspelled or defined by a module not included in the server configuration
- load module mod_access_compat
, or update configuration to 2.4 authorization directives.Ignoring deprecated use of DefaultType in line NN of /path/to/httpd.conf
- remove DefaultType
and replace with other configuration settings.configuration error: couldn't check user: /path
-
load module mod_authn_core
.