In this issue

The 2.0.23 release joins the list of abandoned 2.0 releases, suffering from a segfault in mod_mime caused by some recent optimisation work in the module. A fix has been committed and 2.0.24 is currently in testing.

Graham Leggett has been working on LDAP support for Apache, submitting an LDAP abstraction layer for the APR utility library which provides a common interface to the several LDAP libraries available today such as OpenLDAP. He went on to implement an LDAP-based authentication module for Apache 2.0 using this new API. There was some discussion about storing Apache configuration directives within an LDAP database; the consensus was that this is best achieved using a pre-processor program rather than adding LDAP configuration support.

Linux Today have a controversial guest column "Will Open Source Lose the Battle for the Web?" The author looks at why users would switch from Apache to IIS:

"it's nothing short of miraculous that Apache managed to retain its market share for about two years while essentially treading water. Let's face it, in spite of a few point releases, Apache hasn't introduced any significant user features in two years"..."Even Apache 2.0 (when it finally deigns to appear) won't offer any really revolutionary user benefits. It's just a better architecture for a vanilla webserver. What we need today is no longer a webserver, but a web services delivery platform. Sorry, but Apache doesn't cut it anymore..."

The aim of the Apache httpd project is to develop and maintain an open-source HTTP server and to provide secure, efficient and an extensible server providing HTTP services in sync with the standards. The Apache web server often forms part of a complete web services delivery platform.

The article has generated a large debate on the Slashdot news site.

Apache Software Foundation member Marc Slemko told Apache Week: "One of the main reasons to use the Apache HTTP server is because it is 'just a webserver'. One of the reasons it is a lot less likely to ever be vulnerable to anything like Code Red is because it is 'just a webserver' without dozens of wacky modules enabled by default that are poorly written and almost no one uses."

DaveNet on Apache offers a personal view on why Apache has more developer momentum than Microsoft or Sun - because it guarantees developer freedom. In his own words:

"As a platform for independent developers neither of the BigCo's half-hearted attempts to offer developers freedom is convincing. The Apache philosophy is the right one for me."

We continue to get a large number of messages from system administrators who see requests for /default.ida in their Apache access logs. The requests look similar to this:

192.168.2.12 - - [19/Jul/2001:16:55:47 +0100] "GET /default.ida?NNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
  HTTP/1.0" 400 252 -

If you are running Apache there is nothing to worry about, these requests are part of the Code Red Worm designed to search out vulnerable IIS servers running on Windows. You can quite happily ignore these requests, or get them back

Other common log entries you might see include:

• Requests for robots.txt in the root directory. These requests are normally automatically made by robots which will analyse the contents of this file to see what files and directories they are not allowed to access. The format of the robots.txt file is given in the HTML 4 Specification.
• Requests for favicon.ico in various directories (first seen in April 1999). Microsoft Internet Explorer version 5 and above can display a site-defined icon when a site's URL is displayed in a favourites list. This icon is obtained by asking the site for favicon.ico. If the URL contains slash characters (normally used to represent a directory hierarchy), MSIE 5 will request "favicon.ico" in each parent directory until it finds one or reaches the root. The format of the favicon.ico file is the Microsoft icon format. To see this 'feature' in action, bookmark this page using MSIE.
• Requests for cmd.exe in various directories. These are usually attempts to exploit various security vulnerabilities that affect Microsoft IIS servers.

In this section we highlight some of the articles on the web that are of interest to Apache users.

Fancy a role in Episode 2, Attack of the Code Red 2 Worm? No, this is not a new B-grade movie but how you can be a good internet citizen and let people know that their server has been infected by the Worm. One way is by using Apache::CodeRed written by Reuven M. Lerner. In this article, he explains how the module intercepts requests for /default.ida, determines the host name of the HTTP client, sends only one warning e-mail message in a 24-hour period to SecurityFocus and the administrator of that client, and keeps a list of IP addresses to be ignored.

WebmasterBase.com looks at the pros and cons of three methods of passing information to your web pages without the use of a query string so that your web site has search engine-friendly URLs. The methods are the implementation of PATH_INFO, .htaccess error pages, and the ForceType directive, and have been tested using PHP with Apache on Linux but they should also work on other platforms.

You may have set up your Apache web server perfectly but if you have not tested your web site thoroughly, it may still fail. Therefore, this basic "Step-by-Step Web testing" guide walks you through the numerous stages of testing. It starts with ensuring that the site looks as it is intended to, proceeds to testing functionality, scripts, browser compatibility in a realistic environment, proofing content, getting feedback from a selected group of users who previewed your site, checking your search engine rankings, and ends with analysing your users. After doing all those tests you may be exhausted, but hey, that's not too high a price to pay for a perfect web site.

From XML Basics, the Developer Shed has now moved on to "XSL Basics (part 1)" which explains how XSLT (Extensible Stylesheet Language Transformations) works, with sufficient examples on using it to present marked-up XML data. Hungry for more? Then you may as well read "XPath Basics" too. XPath provides a standard method of addressing parts of an XML document and is used by both XSLT and XPointer. As XML standards are still evolving, the author warns that this XPath tutorial may become invalid in the future but currently it is based on the W3C's XPath 1.0 recommendation.

This occasional section contains short announcements of jobs that require significant Apache experience. To see more jobs or find out how to submit your vacancy visit the Apache Week Jobs section.

Tomcat Web Admin / Java Developer (Atlanta, GA)

Thompson Technologies is seeking an Apache / Tomcat Administrator with experience with Java to troubleshoot servers and rewrite code to make sure applications are working correctly. This is full time position in Atlanta, GA