Quand on dirige une société d’hébergement, on a de nombreux clients qui ne peuvent pas mettre à jour leurs logiciels. Pour garder ces clients, la seule solution est de maintenir d’anciennes versions de paquets, comme PHP. Sinon, il faut arrêter le service.
Aujourd’hui, je migre un serveur historique vers une nouvelle machine pour des raisons de sécurité. Certains clients utilisent encore PHP4 et Apache 1.3. Voici l’exemple sur une distribution Linux Mandriva 2010.2 en 64 bits :
Première étape : installer les paquets nécessaires sur le système :
<em>urpmi make gcc libpng-devel libjpeg-devel freetype2-devel mysql-devel curl-devel munin munin-node munin-master flex bzip2-devel pure-ftpd python-devel gd-devel librsync-devel ntp-client vim-e</em>
Il me faut aussi quelques fichiers pour installer ces anciennes versions :
– mod_ssl-2.8.31-1.3.41.tar.gz
– apache_1.3.41.tar.gz
– suexec.c modifié maison
– php-4.4.9.tar.gz
Après avoir décompressé toutes les archives et remplacé src/support/suexec.c par ma version modifiée, je tente de compiler Apache :
<em>cd apache_1.3.41
./configure --prefix=/usr/local/apache
Configuring for Apache, Version 1.3.41
+ using installation path layout: Apache (config.layout)
Creating Makefile
Creating Configuration.apaci in src
Creating Makefile in src
+ configured for Linux platform
+ setting C compiler to gcc
+ setting C pre-processor to gcc -E
+ using "tr [a-z] [A-Z]" to uppercase
+ checking for system header files
+ adding selected modules
+ using builtin Expat
+ checking sizeof various data types
+ doing sanity check on compiler and options
Creating Makefile in src/support
Creating Makefile in src/regex
Creating Makefile in src/os/unix
Creating Makefile in src/ap
Creating Makefile in src/main
Creating Makefile in src/lib/expat-lite
Creating Makefile in src/modules/standard</em>
Deuxième étape : mod_ssl
<em>cd ../mod_ssl-2.8.31-1.3.41
./configure --with-apache=../apache_1.3.41 --with-ssl --prefix=/usr/local/apache
Configuring mod_ssl/2.8.31 for Apache/1.3.41
+ Apache location: ../apache_1.3.41 (Version 1.3.41)
+ Auxiliary patch tool: ./etc/patch/patch (local)
+ Applying packages to Apache source tree:
o Extended API (EAPI)
o Distribution Documents
o SSL Module Source
o SSL Support
o SSL Configuration Additions
o SSL Module Documentation
o Addons
Done: source extension and patches successfully applied.</em>
On essaie maintenant de compiler Apache avec mod_ssl :
<em> cd ../apache_1.3.41
./configure --prefix=/usr/local/apache --enable-module=so --enable-module=rewrite --enable-suexec --suexec-caller=nobody --suexec-userdir=www --suexec-docroot=/ --suexec-logfile=/var/log/httpd/cgi.log --suexec-uidmin=500 --suexec-gidmin=100 --suexec-safepath=/usr/local/bin:/usr/bin:/bin --enable-module=ssl</em>
<em>Configuring for Apache, Version 1.3.41</em>
<em> + using installation path layout: Apache (config.layout)</em>
<em> Creating Makefile</em>
<em> Creating Configuration.apaci in src</em>
<em> Creating Makefile in src</em>
<em> + configured for Linux platform</em>
<em> + setting C compiler to gcc</em>
<em> + setting C pre-processor to gcc -E</em>
<em> + using "tr [a-z] [A-Z]" to uppercase</em>
<em> + checking for system header files</em>
<em> + adding selected modules</em>
<em> o rewrite_module uses ConfigStart/End</em>
<em> disabling DBM support for mod_rewrite</em>
<em> (perhaps you need to add -ldbm, -lndbm or -lgdbm to EXTRA_LIBS)</em>
<em> o ssl_module uses ConfigStart/End</em>
<em> + SSL interface: mod_ssl/2.8.31</em>
<em> + SSL interface build type: OBJ</em>
<em> + SSL interface compatibility: enabled</em>
<em> + SSL interface experimental code: disabled</em>
<em> + SSL interface conservative code: disabled</em>
<em> + SSL interface vendor extensions: disabled</em>
<em> + SSL interface plugin: Built-in SDBM</em>
<em> + SSL library path: [SYSTEM]</em>
<em> Error: Cannot find SSL library files in any of the following dirs:</em>
<em> Error: . /lib /usr/lib /usr/local/lib</em>
<em> + SSL library version: OpenSSL 1.0.0a 1 Jun 2010</em>
Premier problème : les bibliothèques 64 bits ne se trouvent pas au même endroit que les versions 32 bits. Un lien symbolique peut régler ça :
<em>ln -s /usr/lib64/libssl.so /usr/lib/libssl.so</em>
Nouvelle tentative :
<em>
./configure --prefix=/usr/local/apache --enable-module=so --enable-module=rewrite --enable-suexec --suexec-caller=nobody --suexec-userdir=www --suexec-docroot=/ --suexec-logfile=/var/log/httpd/cgi.log --suexec-uidmin=500 --suexec-gidmin=100 --suexec-safepath=/usr/local/bin:/usr/bin:/bin --enable-module=ssl
Configuring for Apache, Version 1.3.41
+ using installation path layout: Apache (config.layout)
Creating Makefile
Creating Configuration.apaci in src
Creating Makefile in src
+ configured for Linux platform
+ setting C compiler to gcc
+ setting C pre-processor to gcc -E
+ using "tr [a-z] [A-Z]" to uppercase
+ checking for system header files
+ adding selected modules
o rewrite_module uses ConfigStart/End
disabling DBM support for mod_rewrite
(perhaps you need to add -ldbm, -lndbm or -lgdbm to EXTRA_LIBS)
o ssl_module uses ConfigStart/End
+ SSL interface: mod_ssl/2.8.31
+ SSL interface build type: OBJ
+ SSL interface compatibility: enabled
+ SSL interface experimental code: disabled
+ SSL interface conservative code: disabled
+ SSL interface vendor extensions: disabled
+ SSL interface plugin: Built-in SDBM
+ SSL library path: [SYSTEM]
+ SSL library version: OpenSSL 1.0.0a 1 Jun 2010
+ SSL library type: installed package (system-wide)
+ enabling Extended API (EAPI)
+ using builtin Expat
+ using -ldl for vendor DSO support
+ checking sizeof various data types
+ doing sanity check on compiler and options
Creating Makefile in src/support
Creating Makefile in src/regex
Creating Makefile in src/os/unix
Creating Makefile in src/ap
Creating Makefile in src/main
Creating Makefile in src/lib/expat-lite
Creating Makefile in src/modules/standard
Creating Makefile in src/modules/ssl</em>
Tout est bon, on peut donc essayer de lancer la commande « make » :
<em>ssl_util_ssl.c: In function ‘SSL_X509_isSGC’:
ssl_util_ssl.c:327: erreur: ‘STACK’ undeclared (first use in this function)
ssl_util_ssl.c:327: erreur: (Each undeclared identifier is reported only once
ssl_util_ssl.c:327: erreur: for each function it appears in.)
ssl_util_ssl.c:327: erreur: ‘sk’ undeclared (first use in this function)
ssl_util_ssl.c:336: erreur: expected expression before ‘)’ token
make[4]: *** [ssl_util_ssl.o] Erreur 1
make[3]: *** [all] Erreur 1
make[2]: *** [subdirs] Erreur 1
make[2]: quittant le répertoire " /home/dni/apache/apache_1.3.41/src "
make[1]: *** [build-std] Erreur 2
make[1]: quittant le répertoire " /home/dni/apache/apache_1.3.41 "
make: *** [build] Erreur 2</em>
Il faut donc modifier ssl_util_ssl.c
Ligne 327 :
<em>- STACK *sk;</em>
<em> + _STACK *sk;</em>
Ligne 336 :
<em> - if ((sk = (STACK *)X509V3_EXT_d2i(ext)) != NULL) {</em>
<em> + if ((sk = (_STACK *)X509V3_EXT_d2i(ext)) != NULL) {</em>
On peut réessayer :
<em>make
/usr/include/stdio.h:651: note: previous declaration of ‘getline’ was here
make[2]: *** [htpasswd.o] Erreur 1
make[2]: quittant le répertoire " /home/dni/apache/apache_1.3.41/src/support "
make[1]: *** [build-support] Erreur 1
make[1]: quittant le répertoire " /home/dni/apache/apache_1.3.41 "
make: *** [build] Erreur 2</em>
Il faut maintenant faire une petite modification sur le système :
<em>vim /usr/include/stdio.h</em>
<em>
Ligne 651 :
<em>
- extern _IO_ssize_t getline (char **__restrict __lineptr,
+ extern _IO_ssize_t preline (char **__restrict __lineptr,</em>
et on réessaie :
<em>make
make[1]: entrant dans le répertoire " /home/dni/apache/apache_1.3.41 "
+---------------------------------------------------------------------+
| Before you install the package you now should prepare the SSL |
| certificate system by running the 'make certificate' command. |
| For different situations the following variants are provided: |
| |
| % make certificate TYPE=dummy (dummy self-signed Snake Oil cert) |
| % make certificate TYPE=test (test cert signed by Snake Oil CA) |
| % make certificate TYPE=custom (custom cert signed by own CA) |
| % make certificate TYPE=existing (existing cert) |
| CRT=/path/to/your.crt [KEY=/path/to/your.key] |
| |
| Use TYPE=dummy when you're a vendor package maintainer, |
| the TYPE=test when you're an admin but want to do tests only, |
| the TYPE=custom when you're an admin willing to run a real server |
| and TYPE=existing when you're an admin who upgrades a server. |
| (The default is TYPE=test) |
| |
| Additionally add ALGO=RSA (default) or ALGO=DSA to select |
| the signature algorithm used for the generated certificate. |
| |
| Use 'make certificate VIEW=1' to display the generated data. |
| |
| Thanks for using Apache & mod_ssl. Ralf S. Engelschall |
| rse@engelschall.com |
| www.engelschall.com |
+---------------------------------------------------------------------+
make[1]: quittant le répertoire " /home/dni/apache/apache_1.3.41 "</em>
ça fonctionne !
et :
<em>make install
make[1]: quittant le répertoire " /home/dni/apache/apache_1.3.41 "
+--------------------------------------------------------+
| You now have successfully built and installed the |
| Apache 1.3 HTTP server. To verify that Apache actually |
| works correctly you now should first check the |
| (initially created or preserved) configuration files |
| |
| /usr/local/apache/conf/httpd.conf
| |
| and then you should be able to immediately fire up |
| Apache the first time by running: |
| |
| /usr/local/apache/bin/apachectl start
| |
| Or when you want to run it with SSL enabled use: |
| |
| /usr/local/apache/bin/apachectl startssl
| |
| Thanks for using Apache. The Apache Group |
| http://www.apache.org/ |
+--------------------------------------------------------+</em>
Tout est bon !
Troisième étape : compiler PHP avec suexec :
<em>cd php-4.4.9</em>
<em>perl -pi -e "s/cgi = 1;/cgi = 0;/" sapi/cgi/cgi_main.c</em>
On essaie maintenant de configurer :
<em>./configure --with-xml --with-domxml --enable-ftp --enable-bcmath --enable-calendar --with-jpeg-dir --with-png-dir --with-gd --enable-dba --enable-freetype-4bit-antialias-hack --enable-gd-native-ttf --with-freetype-dir --with-xslt --with-gettext --enable-magic-quotes --enable-force-cgi-redirect --enable-fastcgi --with-curl --with-mysql=/usr --with-zlib-dir --with-bz2 --enable-trans-sid --enable-sysvsem --enable-sysvshm</em>
<em>
configure: error: libpng.(a|so) not found.</em>
Encore un problème d’emplacement des bibliothèques, qu’on peut corriger avec un lien symbolique :
<em>ln -s /usr/lib64/libpng.so /usr/lib/libpng.so
ln -s /usr/lib64/libjpeg.so /usr/lib/libjpeg.so
ln -s /usr/lib64/libmysqlclient.so /usr/lib/libmysqlclient.so
</em>
Nouvelle tentative :
<em>./configure --with-xml --with-domxml --enable-ftp --enable-bcmath --enable-calendar --with-jpeg-dir --with-png-dir --with-gd --enable-dba --enable-freetype-4bit-antialias-hack --enable-gd-native-ttf --with-freetype-dir --with-xslt --with-gettext --enable-magic-quotes --enable-force-cgi-redirect --enable-fastcgi --with-curl --with-mysql=/usr --with-zlib-dir --with-bz2 --enable-trans-sid --enable-sysvsem --enable-sysvshm</em>
<em>Generating files</em>
<em> updating cache ./config.cache</em>
<em> creating ./config.status</em>
<em> creating php4.spec</em>
<em> creating main/build-defs.h</em>
<em> creating scripts/phpize</em>
<em> creating scripts/man1/phpize.1</em>
<em> creating scripts/php-config</em>
<em> creating scripts/man1/php-config.1</em>
<em> creating sapi/cli/php.1</em>
<em> creating main/php_config.h</em>
<em> creating main/internal_functions.c</em>
<em> creating main/internal_functions_cli.c</em>
<em> +--------------------------------------------------------------------+</em>
<em> | License: |</em>
<em> | This software is subject to the PHP License, available in this |</em>
<em> | distribution in the file LICENSE. By continuing this installation |</em>
<em> | process, you are bound by the terms of this license agreement. |</em>
<em> | If you do not agree with the terms of this license, you must abort |</em>
<em> | the installation process at this point. |</em>
<em> +--------------------------------------------------------------------+</em>
<em> | *** NOTE *** |</em>
<em> | The default for register_globals is now OFF! |</em>
<em> | |</em>
<em> | If your application relies on register_globals being ON, you |</em>
<em> | should explicitly set it to on in your php.ini file. |</em>
<em> | Note that you are strongly encouraged to read |</em>
<em> | http://www.php.net/manual/en/security.globals.php |</em>
<em> | about the implications of having register_globals set to on, and |</em>
<em> | avoid using it if possible. |</em>
<em> +--------------------------------------------------------------------+</em>
<em> Thank you for using PHP.</em>
On lance ensuite la commande make :
<em>make
Build complete.
(It is safe to ignore warnings about tempnam and tmpnam).
</em>
Maintenant, l’installation :
<em>make install
Installing PHP SAPI module: cgi
Installing PHP CGI into: /usr/local/bin/
Installing PEAR environment: /usr/local/lib/php/
[PEAR] Archive_Tar - installed: 1.3.2
[PEAR] Console_Getopt - installed: 1.2.1
[PEAR] HTML_Template_IT- installed: 1.1
[PEAR] Net_UserAgent_Detect- installed: 2.0.1
warning: pear/PEAR requires package "pear/Structures_Graph" (recommended version 1.0.2)
pear/PEAR can optionally use package "pear/XML_RPC" (version >= 1.4.0)
[PEAR] PEAR - installed: 1.5.0
Wrote PEAR system config file at: /usr/local/etc/pear.conf
You may want to add: /usr/local/lib/php to your php.ini include_path
[PEAR] Structures_Graph- installed: 1.0.2
Installing build environment: /usr/local/lib/php/build/
Installing header files: /usr/local/include/php/
Installing helper programs: /usr/local/bin/
program: phpize
program: php-config
Installing man pages: /usr/local/man/man1/
page: phpize.1
page: php-config.1</em>
Tout est bon :)
Christophe Casalegno
Vous pouvez me suivre sur : Twitter | Facebook | Linkedin | Telegram | Youtube
Laisser un commentaire
Ajouter un commentaire