HP OpenVMS SystemsSecure Web Server (based on Apache™)
HP Secure Web Server for OpenVMS (based on Apache™)
2.2 for OpenVMS Alpha, based on Apache 2.0.63
2.2 for OpenVMS Integrity servers, based on Apache 2.0.63
» Downloading the Kit
HP is pleased to provide you with a new, HP supported version of HP Secure Web Server for OpenVMS (based on Apache). The Secure Web Server (SWS) includes Secure Sockets Layer (SSL) through mod_ssl and OpenSSL.
Downloading the Kit
The SWS for OpenVMS kit is available for the Alpha and Integrity server platforms as a compressed self-extracting file.
You can also download the SWS Version 1.3-1, based on Apache 1.3.26, which is an earlier HP supported, customer release version for OpenVMS Alpha and Integrity servers.
Fill and submit the SWS for OpenVMS registration form to download the kit.
For information about expanding and installing the kit, see the HP Secure Web Server for OpenVMS Installation and Configuration Guide.
Secure Web Server Documentation
See the Documentation Page for links to the Installation and Configuration Guide and the SSL User Guide for SWS Version 2.2.
For the SWS Version 1.3-1, documentation and compatible optional kits (CSWS_PERL, CSWS_JAVA, and CSWS_PHP) are also available from the SWS Documentation Page.
Apache Server Documentation
For more information about the Apache Server, see the Apache HTTP Server documentation.
You can also view the online Apache server documentation at:
Note: To view some of the Apache server documentation, you must enable MultiViews under <Directory
· Fixed the issue of modperl by redirecting the console mode stdout to /Device/Nul when the server is starting up, and mirroring the UNIX Multi-Processing Modules (MPM).
· Fixed the issue of innt_mpm by recreating the bucket allocator each time the trans pool is cleared.
QXCM1000879236: Fixed the issue of case-sensitive comparison in
· QXCM1000903433: Fixed the issue of Lightweight Directory Access Protocol (LDAP) authentication.The modules mod_auth_kerberos.exe and mod_auth_ldap.exe are not supported in the SWS Version 2.1.
· QXCM1000968008: Fixed the issue of rotatelogs with error_log file.
· QXCM1000976572: Fixed the issue of security audit messages when the SWS serve a file located in a user's public directory. This error occurs when the Uniform Resource Locator (URL) accesses a directory through the UserDir directive.
· QXCM1001070984: Fixed the issue of Internet Protocol version 6 (IPv6).
· CVE-2009-1891: Fixed the issue of Denial of Service or CPU consumption in the mod_deflate module.
· CVE-2009-3095: Fixed the issue of access restriction bypass in the mod_proxy_ftp module.
· CVE-2009-3555: Fixed the issue of renegotiation handshakes with an existing connection.
The SWS_APACHE Version 2.2 is not vulnerable to the following
Based on Apache 2.0.63 from the
Apache Software Foundation
· Apache 2.2 is built using the OpenSSL Version 0.9.8h
Changes required in
httpd.conf when upgrading from Version 1.3-1 to Version 2.2
In SWS Version 2.2, many loadable modules are no longer loaded by default. You mustuncomment the modules in httpd.conf to load them. See the file httpd-vms.conf to load other modules.
For example, to load the modules,uncomment the following lines in httpd.conf:
The OpenVMS platform supports the following list of modules:
are included in Version 2.x:
· Obsolete directives
are obsolete directives in
Changed server process naming scheme
Changed site-specific startup and shutdown procedure definitions
Do not use
Version 2.2 with the older SWS optional kits
Do not use SWS Version 2.2 with the following optional kits. Using these kits together causes a process crash. These kits, in addition to the newer optional kits, are currently available for download from http://h71000.www7.hp.com/openvms/products/ips/apache/csws.html.
SWS Version 2.2 works properly with the following new optional kits:
PERL for OpenVMS 5.8.6
· Installing SWS Version 2.2 on an ODS-2 volume corrupts the previous SWS Version 1.3 installation
must install the SWS Version 2.2 kit only on an
target volume. If you install this kit on an ODS-2 volume, the
installation will fail with the following error:
If your existing installation is SWS Version 1.3, then the failed operation will leave it in a corrupt state.
Language variant filename restriction
language variants on an OpenVMS system in the same way as you do on a UNIX system,
using multiple dots in the filename. For example, the French variant of a
filename is filename.html.fr.
earlier versions of SWS, you could use an underscore instead
of a dot before the language extension (for example, filename.html_fr).
WebDAV database manager type restriction
support requires the VDBM database manager type.
VDBM is the default.
change the database manager type, set the logical name APACHE$DAV_DBM_TYPE so that it is visible
to Apache, as APACHE$COMMON:LOGIN.COM.
SSLSessionCache DBM file error
Either of the SDBM or GDBM database manager types,when used, causes the following SSL session cache failure:
[Thu Apr 14 2005] [error] (2)no such file or
must use the default VDBM database manager type. To change the database manager type, set the
logical name APACHE$SSL_DBM_TYPE so that it is visible to Apache, as APACHE$COMMON:LOGIN.COM.
·If suEXEC is enabled in the initial configuration, SWS cannot add a node in a cluster environment
If you enable suEXEC during the initial configuration of SWS or by using Option 4 (Manage suEXEC users) from the SWS Configuration Menu, then Option 10 of the SWS configuration menu (Add a node to CSWS in a cluster environment) fails.
temporary workaround, use Option 4 to disable suEXEC and use Option 10 to add the
node, and then use Option 4 to re-enable suEXEC.
APACHE$MENU.COM "Create an Apache instance"
2 in APACHE$MENU.COM, called "Create an
Apache instance", fails under the following circumstances:
· Specifying a
nonexistent target directory
fails with the following error when the
Root Location: dev:[APACHE.SPECIFIC.FOO]
· Creating an instance under a name other than APACHE$WWW fails with the
[Tue Apr 19 11:20:23 2005] [error] (13)permission denied: Unable
Cached files not served
proxy cache feature does not serve the cached files in SWS Version 2.2.
the mod_auth directives AuthUserFile and AuthGroupFile are combined with the mod_auth_openvms directives AuthOpenVMSUser and AuthOpenVMSGroup, the mod_auth directives override mod_auth_openvms.
practice, these sets of directives are not commonly used together.
·Require user directive must specify user names in uppercase with mod_auth_openvms
TheRequire user directive must specify user names in uppercase when used with mod_auth_openvms.
ApacheBench tool fails (Integrity servers only)
OpenVMS Integrity servers, the ApacheBench tool fails as follows:
after 10 failures
The following section describes the documentation updates and errata for HP Secure Web Server for OpenVMS (based on Apache) documentation.
In the HP Secure Web Server Based on Apache SSL User Guide the following changes should be made to these sections:
To enable SSL:
1. Generate a self signed certificate, which is valid for 30 days. To do so, use the following certificate tool: