LFCS 158 🐧 Web Server — Apache Basics - KandZ

⏱️ Estimated read: 9 min | |

The previous chapter covered Nginx, the event-driven web server that is the default on many modern distributions. This chapter introduces Apache HTTP Server, the older and still widely deployed alternative. The LFCS exam lists “Configure an HTTP server” under the Service Configuration domain . Apache uses a process-based model: a parent process manages a pool of child processes (or threads), and the children handle the requests. The configuration is spread across multiple files, and the apachectl tool is the control interface. The critical trap is the configuration file location: it is /etc/httpd/conf/httpd.conf on RHEL-family systems and /etc/apache2/apache2.conf on Debian/Ubuntu, and the two distributions use different naming conventions for the service (httpd versus apache2) and the configuration directories .

Key point: The Apache service is httpd on RHEL and apache2 on Debian/Ubuntu. The main configuration file is httpd.conf or apache2.conf. The apachectl configtest command validates the syntax. The apachectl graceful command applies the change without dropping the active connections . The DocumentRoot directive sets the directory that the server serves the static files from .

Why Apache basics require a specific mental model

The process model problem. Apache uses a pre-forking model in the default configuration. The parent process starts as root, binds to the privileged port (80 or 443), and then spawns the child processes under a less-privileged user (www-data on Debian, apache on RHEL) . The parent does not handle the requests; it only manages the children. The StartServers, MinSpareServers, and MaxSpareServers directives control the pool size . The child processes handle the requests. The ps -ef | grep apache command shows the parent and the children .

The configuration location problem. The main configuration file is not in the same place on every distribution. On RHEL, the file is /etc/httpd/conf/httpd.conf. On Debian/Ubuntu, the file is /etc/apache2/apache2.conf . The Debian package splits the configuration into the sites-available and sites-enabled directories, and the a2ensite command enables a site by creating the symlink . The RHEL package uses the conf.d directory for the additional configuration. The exam tests the commands and the file locations.

The apachectl problem. The apachectl is the control interface. The apachectl configtest command validates the syntax. The apachectl graceful command sends the SIGUSR1 signal to the parent, which reads the new configuration, starts the new children, and tells the old children to finish their current requests and exit . The graceful command checks the configuration before the restart, so a syntax error does not kill the server . The apachectl restart sends the SIGHUP, which drops the connections. The graceful is the correct command for the configuration change on a production server.

The virtual host problem. A single Apache instance can serve multiple domains. The <VirtualHost> block contains the ServerName and the DocumentRoot for the specific domain . The server matches the Host header to the ServerName and serves the request from the matching DocumentRoot. The first VirtualHost for a port is the default if no ServerName matches . The virtual hosts are the mechanism for the multi-site hosting.

The access restriction problem. The <Directory> block contains the Require directives. The Require all granted allows the access. The Require ip 192.168.1.0/24 restricts to the subnet. The Require valid-user requires the authentication . The AllowOverride directive controls whether the .htaccess file can override the configuration. The access restriction is the mechanism for the protected content.

The trade-off. Apache is more complex to configure than Nginx, but it has the .htaccess mechanism that allows the per-directory configuration without the server restart. The Nginx is faster for the static content and the reverse proxy. The Apache is more common for the legacy applications and the shared hosting. The exam tests the basics of both.

a. The installation and the service management

The package name and the service name differ by distribution.

# RHEL / Fedora
sudo dnf install httpd
sudo systemctl enable --now httpd

# Debian / Ubuntu
sudo apt install apache2
sudo systemctl enable --now apache2

The systemctl enable --now starts the service and enables it at boot . The systemctl status httpd or systemctl status apache2 confirms the service is running.

The apachectl is the control tool.

# Test the configuration syntax
sudo apachectl configtest

# Graceful restart (no connection drop)
sudo apachectl graceful

# Full restart (drops connections)
sudo apachectl restart

# Stop the server
sudo apachectl stop

The configtest output is Syntax OK or the specific error . The graceful is the recommended command for the configuration change .

b. The configuration structure and the static site

The main configuration file is httpd.conf or apache2.conf. The DocumentRoot sets the static directory.

# /etc/httpd/conf/httpd.conf (RHEL)
ServerRoot "/etc/httpd"
Listen 80
ServerName www.example.com:80
DocumentRoot "/var/www/html"

<Directory "/var/www/html">
    AllowOverride None
    Require all granted
</Directory>

The ServerRoot is the base directory for the configuration and the logs . The Listen is the port. The ServerName is the hostname. The DocumentRoot is the directory that the server serves the files from . The <Directory> block contains the access rules.

The Include directive loads the additional configuration files.

# RHEL
Include conf.d/*.conf

# Debian (via apache2.conf)
IncludeOptional sites-enabled/*.conf

The Include is the mechanism for the modular configuration .

c. The virtual hosts and the access restriction

A virtual host serves a specific domain. The <VirtualHost> block contains the configuration.

<VirtualHost *:80>
    ServerName mysite.example.com
    DocumentRoot /var/www/mysite

    <Directory "/var/www/mysite">
        Require all granted
    </Directory>
</VirtualHost>

The *:80 listens on all addresses on port 80. The ServerName is the domain. The DocumentRoot is the site directory .

The access restriction uses the Require directive.

<Directory "/var/www/admin">
    Require ip 192.168.1.0/24
</Directory>

The Require ip 192.168.1.0/24 allows only the specified subnet . The Require all denied blocks everyone. The Require valid-user requires the authentication. The htpasswd command creates the password file for the basic authentication.

sudo htpasswd -c /etc/httpd/.htpasswd alice

The -c flag creates the file. The subsequent calls add the users .

Complete Example Session

# ============================================
# PART 1: INSTALL AND START
# ============================================

sudo dnf install httpd
sudo systemctl enable --now httpd

# ============================================
# PART 2: VERIFY THE SERVICE
# ============================================

ps -ef | grep httpd | grep -v grep
# root  1234  1  0 10:00 ?  00:00:00 /usr/sbin/httpd -DFOREGROUND
# apache 1235 1234 0 10:00 ? 00:00:00 /usr/sbin/httpd -DFOREGROUND

# ============================================
# PART 3: TEST THE CONFIGURATION
# ============================================

sudo apachectl configtest
# Syntax OK

# ============================================
# PART 4: SERVE A STATIC PAGE
# ============================================

echo "<h1>Apache Works</h1>" | sudo tee /var/www/html/index.html
curl http://localhost
# <h1>Apache Works</h1>

# ============================================
# PART 5: ADD A VIRTUAL HOST
# ============================================

sudo tee /etc/httpd/conf.d/mysite.conf <<'EOF'
<VirtualHost *:80>
    ServerName mysite.local
    DocumentRoot /var/www/mysite
    <Directory "/var/www/mysite">
        Require all granted
    </Directory>
</VirtualHost>
EOF
sudo mkdir -p /var/www/mysite
echo "<h1>My Site</h1>" | sudo tee /var/www/mysite/index.html

# ============================================
# PART 6: RELOAD THE CONFIGURATION
# ============================================

sudo apachectl configtest
sudo apachectl graceful

# ============================================
# PART 7: VERIFY THE VIRTUAL HOST
# ============================================

curl -H "Host: mysite.local" http://localhost
# <h1>My Site</h1>

# ============================================
# PART 8: RESTRICT ACCESS
# ============================================

sudo tee /etc/httpd/conf.d/admin.conf <<'EOF'
<Directory "/var/www/admin">
    Require ip 192.168.1.0/24
</Directory>
EOF
sudo apachectl configtest
sudo apachectl graceful

# ============================================
# PART 9: BASIC AUTH
# ============================================

sudo htpasswd -c /etc/httpd/.htpasswd alice
# New password: ****
# Re-type new password: ****

The nine parts trace the Apache basics: install, verify, test, static page, virtual host, reload, verify host, restrict access, and basic auth.

Quick Reference

Service Commands

Command	Purpose
`systemctl start httpd`	Start (RHEL)
`systemctl start apache2`	Start (Debian)
`apachectl configtest`	Test syntax
`apachectl graceful`	Graceful reload
`apachectl restart`	Full restart

Configuration Files

Distribution	Main File
RHEL/Fedora	`/etc/httpd/conf/httpd.conf`
Debian/Ubuntu	`/etc/apache2/apache2.conf`
RHEL drop-in	`/etc/httpd/conf.d/*.conf`
Debian drop-in	`/etc/apache2/sites-enabled/*.conf`

Core Directives

Directive	Purpose
`ServerRoot`	Base directory
`Listen`	Port
`ServerName`	Hostname
`DocumentRoot`	Static directory
`Include`	Load additional config

Access Control

Directive	Purpose
`Require all granted`	Allow all
`Require all denied`	Deny all
`Require ip <subnet>`	Allow subnet
`Require valid-user`	Require auth

Best Practices

✅ Do This:

sudo apachectl configtest
<!-- Test the config before reload -->                # ✅

sudo apachectl graceful
<!-- Reload without dropping connections -->         # ✅

Require ip 192.168.1.0/24
<!-- Restrict to the internal subnet -->             # ✅

❌ Don’t Do This:

sudo apachectl restart
# For the configuration change
<!-- Use graceful to avoid the connection drop -->    # ❌

# Edit the config and assume it is active
<!-- The reload is required -->                      # ❌

# Forget the configtest
<!-- A syntax error kills the server on restart -->   # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
Service not starting	Port 80 already in use	Check with `ss -tlnp`
Config not applied	No reload	`apachectl graceful`
Syntax error crashes server	No `configtest`	Test before reload
Site not matching	Wrong `ServerName`	Check the `Host` header
Access denied	Wrong `Require`	Check the IP or the auth

Real-World Examples

1. Install

sudo dnf install httpd

2. Start

sudo systemctl enable --now httpd

3. Test Config

sudo apachectl configtest

4. Graceful

sudo apachectl graceful

5. Virtual Host

<VirtualHost *:80> ServerName site.local DocumentRoot /var/www/site </VirtualHost>

6. Restrict IP

Require ip 192.168.1.0/24

7. Basic Auth

sudo htpasswd -c /etc/httpd/.htpasswd alice

8. DocumentRoot

DocumentRoot "/var/www/html"

9. Listen Port

Listen 8080

10. Check Logs

sudo tail -f /var/log/httpd/error_log

Visual

Apache Process Model

┌──────────────────────────────────────────────┐
│  Parent Process (root)                       │
│  ├── Binds port 80                           │
│  └── Manages children                        │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  Child Processes (apache / www-data)         │
│  ├── Handle requests                         │
│  └── Serve content                           │
└──────────────────────────────────────────────┘

Graceful vs Restart

┌──────────────────────────────────────────────┐
│  apachectl graceful                          │
│  ├── Validates config                        │
│  ├── Starts new children                     │
│  └── Old children finish requests            │
│  → No connection drop                        │
└──────────────────┬───────────────────────────┘
                   │
                   ▼
┌──────────────────────────────────────────────┐
│  apachectl restart                           │
│  ├── Kills all children                      │
│  └── Starts new children                     │
│  → Connection drop                           │
└──────────────────────────────────────────────┘

Summary

Item	Value
Service (RHEL)	`httpd`
Service (Debian)	`apache2`
Config (RHEL)	`/etc/httpd/conf/httpd.conf`
Config (Debian)	`/etc/apache2/apache2.conf`
Test syntax	`apachectl configtest`
Graceful reload	`apachectl graceful`
Static directory	`DocumentRoot`
Virtual host	`<VirtualHost>`
Access control	`Require`

Key takeaways:

The service and the config file differ by distribution. The RHEL uses httpd and /etc/httpd/conf/httpd.conf. The Debian uses apache2 and /etc/apache2/apache2.conf .
The apachectl is the control tool. The configtest validates the syntax. The graceful applies the change without dropping the connections. The restart drops the connections .
The DocumentRoot sets the static directory. The <Directory> block contains the access rules. The Require directive controls who can access the directory .
The <VirtualHost> block serves a specific domain. The ServerName is the domain. The DocumentRoot is the site directory. The first virtual host for a port is the default .
The htpasswd creates the password file for the basic auth. The Require valid-user enforces the authentication .

Remember: The parent is the manager. The child is the handler. The configtest is the check. The graceful is the apply. The restart is the kill. The DocumentRoot is the content. The VirtualHost is the domain. The Require is the access. The exam tests the commands and the file locations.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!