Skip to content


Subversion checkout URL

You can clone with
Download ZIP
tree: 8d89273e47
Fetching contributors…

Cannot retrieve contributors at this time

386 lines (318 sloc) 15.863 kB
<?xml version='1.0' encoding='UTF-8' ?>
<!DOCTYPE manualpage SYSTEM "./style/manualpage.dtd">
<?xml-stylesheet type="text/xsl" href="./style/manual.en.xsl"?>
<!-- $LastChangedRevision$ -->
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
See the License for the specific language governing permissions and
limitations under the License.
<manualpage metafile="upgrading.xml.meta">
<title>Upgrading to 2.4 from 2.2</title>
<p>In order to assist folks upgrading, we maintain a document
describing information critical to existing Apache HTTP Server users. These
are intended to be brief notes, and you should be able to find
more information in either the <a
href="new_features_2_4.html">New Features</a> document, or in
the <code>src/CHANGES</code> file. Application and module developers
can find a summary of API changes in the <a href="developer/new_api_2_4.html"
>API updates</a> overview.</p>
<p>This document describes changes in server behavior that might
require you to change your configuration or how you use the server
in order to continue using 2.4 as you are currently using 2.2.
To take advantage of new features in 2.4, see the New Features
<p>This document describes only the changes from 2.2 to 2.4. If you
are upgrading from version 2.0, you should also consult the <a
href="">2.0 to 2.2
upgrading document.</a></p>
<seealso><a href="new_features_2_4.html">Overview of new features in
Apache HTTP Server 2.4</a></seealso>
<section id="compile-time">
<title>Compile-Time Configuration Changes</title>
<p>The compilation process is very similar to the one used in
version 2.2. Your old <code>configure</code> command line (as
found in <code>build/config.nice</code> in the installed server
directory) can be used in most cases. There are some changes in
the default settings. Some details of changes:</p>
<li>These modules have been removed: mod_authn_default,
mod_authz_default, mod_mem_cache. If you were using
mod_mem_cache in 2.2, look at <module>mod_cache_disk</module> in
<li>All load balancing implementations have been moved to
individual, self-contained mod_proxy submodules, e.g.
<module>mod_lbmethod_bybusyness</module>. You might need
to build and load any of these that your configuration
<li>Platform support has been removed for BeOS, TPF, and
even older platforms such as A/UX, Next, and Tandem. These were
believed to be broken anyway.</li>
<li>configure: dynamic modules (DSO) are built by default</li>
<li>configure: By default, only a basic set of modules is loaded. The
other <directive>LoadModule</directive> directives are commented
<li>configure: the "most" module set gets built by default</li>
<li>configure: the "reallyall" module set adds developer modules
to the "all" set</li>
<section id="run-time">
<title>Run-Time Configuration Changes</title>
<p>There have been significant changes in authorization configuration,
and other minor configuration changes, that could require changes to your 2.2
configuration files before using them for 2.4.</p>
<section id="authz">
<p>Any configuration file that uses authorization will likely
need changes.</p>
<p>You should review the <a href="howto/auth.html">Authentication,
Authorization and Access Control Howto</a>, especially the section
<a href="howto/auth.html#beyond">Beyond just authorization</a>
which explains the new mechanisms for controlling the order in
which the authorization directives are applied.</p>
<p>Directives that control how authorization modules respond when they don't match
the authenticated user have been removed: This includes
AuthzLDAPAuthoritative, AuthzDBDAuthoritative, AuthzDBMAuthoritative,
AuthzGroupFileAuthoritative, AuthzUserAuthoritative,
and AuthzOwnerAuthoritative. These directives have been replaced by the
more expressive <directive module="mod_authz_core">RequireAny</directive>,
<directive module="mod_authz_core">RequireNone</directive>, and
<directive module="mod_authz_core">RequireAall</directive>.</p>
<section id="access">
<title>Access control</title>
<p>In 2.2, access control based on client hostname, IP address,
and other characteristics of client requests was done using the
directives <directive
module="mod_access_compat">Order</directive>, <directive
module="mod_access_compat">Allow</directive>, <directive
module="mod_access_compat">Deny</directive>, and <directive
<p>In 2.4, such access control is done in the same way as other
authorization checks, using the new module
<module>mod_authz_host</module>. The old access control idioms
should be replaced by the new authentication mechanisms,
although for compatibility with old configurations, the new
module <module>mod_access_compat</module> is provided.</p>
<p>Here are some examples of old and new ways to do the same
access control.</p>
<p>In this example, all requests are denied.</p>
<title>2.2 configuration:</title>
<highlight language="config">
Order deny,allow
Deny from all
<title>2.4 configuration:</title>
<highlight language="config">
Require all denied
<p>In this example, all requests are allowed.</p>
<title>2.2 configuration:</title>
<highlight language="config">
Order allow,deny
Allow from all
<title>2.4 configuration:</title>
<highlight language="config">
Require all granted
<p>In the following example, all hosts in the domain
are allowed access; all other hosts are denied access.</p>
<title>2.2 configuration:</title>
<highlight language="config">
Order Deny,Allow
Deny from all
Allow from
<title>2.4 configuration:</title>
<highlight language="config">
Require host
<section id="config">
<title>Other configuration changes</title>
<p>Some other small adjustments may be necessary for particular
configurations as discussed below.</p>
<li><directive>MaxRequestsPerChild</directive> has been renamed to
<directive module="mpm_common">MaxConnectionsPerChild</directive>,
describes more accurately what it does. The old name is still
<li><directive>MaxClients</directive> has been renamed to
<directive module="mpm_common">MaxRequestWorkers</directive>,
which describes more accurately what it does. For async MPMs, like
<module>event</module>, the maximum number of clients is not
equivalent than the number of worker threads. The old name is still
<li>The <directive module="core">DefaultType</directive>
directive no longer has any effect, other than to emit a
warning if it's used with any value other than
<code>none</code>. You need to use other configuration
settings to replace it in 2.4.
<li><directive module="core">EnableSendfile</directive> now
defaults to Off.</li>
<li><directive module="core">FileETag</directive> now
defaults to "MTime Size" (without INode).</li>
<li><module>mod_log_config</module>: <a
matches whole cookie names. Previously any substring would
<li><module>mod_dav_fs</module>: The format of the <directive
module="mod_dav_fs">DavLockDB</directive> file has changed for
systems with inodes. The old <directive
module="mod_dav_fs">DavLockDB</directive> file must be deleted on
<li><directive module="core">KeepAlive</directive> only
accepts values of <code>On</code> or <code>Off</code>.
Previously, any value other than "Off" or "0" was treated as
<li>Directives AcceptMutex, LockFile, RewriteLock, SSLMutex,
SSLStaplingMutex, and WatchdogMutexPath have been replaced
with a single <directive module="core">Mutex</directive>
directive. You will need to evaluate any use of these removed
directives in your 2.2 configuration to determine if they can
just be deleted or will need to be replaced using <directive
<li><module>mod_cache</module>: <directive
now does an exact match against the query string instead of a
partial match. If your configuration was using partial
strings, e.g. using <code>sessionid</code> to match
then you will need to change to the full string
<li><module>mod_ldap</module>: <directive
module="mod_ldap">LDAPTrustedClientCert</directive> is now
consistently a per-directory setting only. If you use this
directive, review your configuration to make sure it is
present in all the necessary directory contexts.</li>
<li><module>mod_filter</module>: <directive
module="mod_filter">FilterProvider</directive> syntax has changed and
now uses a boolean expression to determine if a filter is applied.
<li>The <code>#if expr</code> element now uses the new <a
href="expr.html">expression parser</a>. The old syntax can be
restored with the new directive <directive module="mod_include"
<li>An SSI* config directive in directory scope no longer causes
all other per-directory SSI* directives to be reset to their
default values.</li>
<li><module>mod_charset_lite</module>: The <code>DebugLevel</code>
option has been removed in favour of per-module <directive
module="core">LogLevel</directive> configuration.
<li><module>mod_ext_filter</module>: The <code>DebugLevel</code>
option has been removed in favour of per-module <directive
module="core">LogLevel</directive> configuration.
<li><module>mod_ssl</module>: CRL based revocation checking
now needs to be explicitly configured through <directive
<li><module>mod_substitute</module>: The maximum line length is now
limited to 1MB.
<li><module>mod_reqtimeout</module>: If the module is loaded, it
will now set some default timeouts.</li>
<section id="misc">
<title>Misc Changes</title>
<li><module>mod_autoindex</module>: will now extract titles and
display descriptions for .xhtml files, which were previously
<li><module>mod_ssl</module>: The default format of the <code>*_DN</code>
variables has changed. The old format can still be used with the new
<code>LegacyDNStringFormat</code> argument to <directive
module="mod_ssl">SSLOptions</directive>. The SSLv2 protocol is
no longer supported. <directive module="mod_ssl">SSLProxyCheckPeerCN
</directive> and <directive module="mod_ssl">SSLProxyCheckPeerExpire
</directive> now default to On, causing proxy requests to HTTPS hosts
with bad or outdated certificates to fail with a 502 status code (Bad
<li><program>htpasswd</program> now uses MD5 hash by default on
all platforms.</li>
<li>The <directive module="core">NameVirtualHost</directive>
directive no longer has any effect, other than to emit a
warning. Any address/port combination appearing in multiple
virtual hosts is implicitly treated as a name-based virtual host.
<li><module>mod_deflate</module> will now skip compression if it knows
that the size overhead added by the compression is larger than the data
to be compressed.
<li>Multi-language error documents from 2.2.x may not work unless
they are adjusted to the new syntax of <module>mod_include</module>'s
<code>#if expr=</code> element or the directive
<directive module="mod_include">SSILegacyExprParser</directive> is
enabled for the directory containing the error documents.
<li>The functionality provided by <code>mod_authn_alias</code>
in previous versions (i.e., the <directive
module="mod_authn_core">AuthnProviderAlias</directive> directive)
has been moved into <module>mod_authn_core</module>.
<section id="third-party">
<title>Third Party Modules</title>
<p>All modules must be recompiled for 2.4 before being loaded.</p>
<p>Many third-party modules designed for version 2.2 will
otherwise work unchanged with the Apache HTTP Server version 2.4.
Some will require changes; see the <a href="developer/new_api_2_4.html">API
update</a> overview.</p>
<section id="commonproblems">
<title>Common problems when upgrading</title>
<ul><li>Startup errors:
<li><code>Invalid command 'User', perhaps misspelled or defined by a module not included in the server configuration</code> - load module <module>mod_unixd</module></li>
<li><code>Invalid command 'Require', perhaps misspelled or defined by a module not included in the server configuration</code>, or
<code>Invalid command 'Order', perhaps misspelled or defined by a module not included in the server configuration</code>
- load module <module>mod_access_compat</module>, or update configuration to 2.4 authorization directives.</li>
<li><code>Ignoring deprecated use of DefaultType in line NN of /path/to/httpd.conf</code> - remove <directive module="core">DefaultType</directive>
and replace with other configuration settings.</li>
<li>Errors serving requests:
<li><code>configuration error: couldn't check user: /path</code> -
load module <module>mod_authn_core</module>.</li>
Jump to Line
Something went wrong with that request. Please try again.