IT Course Directory: VMware, Linux, Networking, and Raspberry Pi

Apache HTTP Server Online Course: Installation, Configuration, Virtual Hosts, SSL, Logging, and Proxies

Learn Apache HTTP Server administration on Ubuntu and Windows: installation, configuration files, virtual hosts, HTTPS, logs, modules, forward and reverse proxies, status monitoring, and troubleshooting.

Course overview

Apache HTTP Server is open-source software that receives HTTP and HTTPS requests and returns web content. It can serve static files, host several websites on one machine, terminate TLS encryption, and proxy requests to other services.

This course is designed for beginners who know basic files, directories, command-line navigation, IP addresses, ports, hostnames, and DNS. Examples use Ubuntu and Windows. Always validate configuration before reloading or restarting a production server.

1. How web serving works

Apache and the request flow

A web server is a server process that handles web protocol requests and delivers content. Apache HTTP Server is the software performing that role; it is not an operating system, domain registrar, DNS provider, browser, database, or application framework.

1. A browser or other HTTP client requests a hostname such as www.example.test.
2. DNS resolves the hostname to an IP address. During local testing, a hosts-file entry can provide the mapping instead.
3. The client connects to the server over TCP, commonly port 80 for HTTP or port 443 for HTTPS.
4. Apache accepts the connection and selects a virtual host using the destination address, port, and HTTP Host header.
5. Apache either reads a file from the DocumentRoot or forwards the request to an application or upstream service.
6. Apache sends an HTTP response containing a status code, headers, and possibly a response body.

HTTP is the application protocol used for ordinary web requests. HTTPS is HTTP protected by TLS encryption and server authentication. A hostname is a human-readable name; an IP address identifies a network interface; DNS maps names to addresses.

Important web-server concepts

• DocumentRoot: the filesystem directory from which a site serves files.
• Index file: a default file such as index.html returned when a directory is requested.
• MIME type: a response label such as text/html, text/css, or image/png describing content.
• Request method: an operation such as GET, POST, PUT, or DELETE.
• Status code: a result such as 200 Success, 301 Permanent Redirect, 404 Not Found, or 500 Server Error.

When Apache serves a file directly, it is the origin web server for that content. When it relays traffic, it is acting as a proxy. A reverse proxy receives public requests for an internal application. A forward proxy sends outbound requests for clients.

Common Apache uses

• Serving static HTML, CSS, JavaScript, images, and downloads.
• Hosting multiple websites on one IP address with name-based virtual hosts.
• Terminating TLS at Apache.
• Reverse proxying applications such as a service listening on port 3000.
• Forwarding outbound traffic for a controlled, trusted client network.

2. Installing Apache on Ubuntu

Install and manage the service

sudo apt update
sudo apt install apache2
sudo systemctl enable --now apache2
sudo systemctl status apache2
sudo apache2ctl configtest
sudo systemctl reload apache2
sudo systemctl restart apache2
sudo systemctl stop apache2
sudo systemctl start apache2
sudo systemctl disable apache2

Debian-based distributions commonly use the package and service name apache2. A reload applies validated configuration with less disruption than a restart. Enable makes the service start at boot; disable removes that boot-time behavior.

Ubuntu commonly stores the main configuration at /etc/apache2/apache2.conf, site content at /var/www/html, logs at /var/log/apache2, and modular configuration below /etc/apache2.

Test locally and remotely

curl -I http://localhost/
sudo ss -tulpn | grep -E ':80|:443'
sudo ufw allow 'Apache Full'

A successful local response proves that Apache is reachable from the host. Remote access also requires a listening interface, correct DNS or IP addressing, firewall permission, and any cloud or network security rule allowing ports 80 and 443.

3. Installing Apache on Windows

On Windows, common approaches include an available Apache HTTP Server binary distribution or a bundled development stack. Extract or install the selected distribution, choose a ServerRoot, and set a document root using Windows filesystem paths. For example, a configuration may use C:/Apache24 and C:/Apache24/htdocs. Apache accepts forward slashes in many configuration paths, which can reduce escaping confusion.

httpd.exe -t
httpd.exe -k start
httpd.exe -k restart
httpd.exe -k install

Run Apache in a console while learning so startup errors are visible. Installing it as a Windows service allows service-oriented administration through Windows tools. Permit httpd.exe or the required ports through Windows Firewall. If another program already uses port 80 or 443, Apache cannot bind that port; identify the process or select a deliberately different port.

Windows differs from Ubuntu in path syntax, package management, service commands, and default directory layout. The same principles still apply: test syntax, inspect logs, confirm listeners, and verify firewall rules.

4. Apache configuration fundamentals

Directives, context, and includes

A configuration directive is an Apache setting, such as Listen, ErrorLog, or ProxyPass. Arguments follow the directive name. A line beginning with # is a comment. A block directive uses opening and closing tags, such as <VirtualHost> or <Directory>.

Every directive has a permitted context. Global server context controls the whole instance, virtual-host context controls one site, directory context controls a filesystem directory, and .htaccess provides per-directory settings when the server permits it.

Include requires a matching file or pattern; IncludeOptional does not fail when the target is absent. Distribution layouts use these directives to assemble a manageable configuration from smaller files.

Safe change workflow

1. Back up the relevant configuration.
2. Edit the smallest appropriate file.
3. Run sudo apache2ctl configtest on Ubuntu or httpd.exe -t on Windows.
4. Fix every reported error before applying the change.
5. Reload Apache, or restart only when necessary.
6. Verify the response, listener, enabled site, and logs.

.htaccess is useful when site owners need delegated per-directory control or cannot edit the main configuration. Apache may search for it on requests, adding overhead. When administrative access is available, main configuration files are generally easier to audit and more efficient.

5. Ubuntu Apache configuration layout

Typical include relationships connect apache2.conf to ports.conf, enabled modules, enabled snippets, and enabled sites. mod_mime handles normal MIME mappings; the magic file supports content-based detection when mod_mime_magic is used.

6. The default virtual host

A virtual host is a configuration block that lets one Apache instance serve a hostname, address, or port. Ubuntu commonly provides a default site at /etc/apache2/sites-available/000-default.conf with document root /var/www/html. Its enabled link is normally in sites-enabled.

With name-based hosting, Apache compares the request hostname with ServerName and ServerAlias. If no configured name matches, Apache uses the first suitable virtual host for that address and port—the default site.

curl -I http://localhost/
curl -I -H 'Host: example.test' http://127.0.0.1/
apache2ctl -S

The explicit Host test is useful before DNS exists. A browser test requires a DNS record or a local hosts-file entry mapping the test name to the server address.

7. Creating and managing virtual hosts

Two separate websites on one server

Create a dedicated directory and readable content for each site. Apache needs permission to traverse the directories and read the files; avoid making all files writable by the web-server account merely to solve a read-permission problem.

sudo mkdir -p /var/www/example.test/public
sudo sh -c 'printf "<h1>Example site</h1>\n" > /var/www/example.test/public/index.html'
sudo nano /etc/apache2/sites-available/example.test.conf

<VirtualHost *:80>
    ServerName example.test
    ServerAlias www.example.test
    DocumentRoot /var/www/example.test/public

    <Directory /var/www/example.test/public>
        Require all granted
        AllowOverride None
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/example.test-error.log
    CustomLog ${APACHE_LOG_DIR}/example.test-access.log combined
</VirtualHost>

sudo a2ensite example.test.conf
sudo a2dissite 000-default.conf
sudo apache2ctl configtest
sudo systemctl reload apache2

Disable the default site only when it is no longer needed. Add matching DNS records in real use. For local use, place an entry such as 127.0.0.1 example.test in the local hosts file. Name-based hosting shares an address and distinguishes sites by hostname; IP-based hosting assigns different addresses to virtual hosts.

8. HTTPS and TLS

TLS encrypts traffic and lets a client authenticate the server through a TLS certificate. The certificate hostname must match the requested name. A self-signed certificate is suitable for controlled testing but causes browser trust warnings and is not normally suitable for public production use.

sudo a2enmod ssl
sudo a2ensite default-ssl.conf
sudo apache2ctl configtest
sudo systemctl reload apache2

<VirtualHost *:80>
    ServerName example.test
    Redirect permanent / https://example.test/
</VirtualHost>

<VirtualHost *:443>
    ServerName example.test
    DocumentRoot /var/www/example.test/public
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/example.test.crt
    SSLCertificateKeyFile /etc/ssl/private/example.test.key

    <Directory /var/www/example.test/public>
        Require all granted
    </Directory>
</VirtualHost>

Ensure Listen 443 is present, the SSL module is enabled, and the private key is readable by Apache but not broadly accessible. If a certificate authority supplies an intermediate chain, install and configure the appropriate chain file according to the certificate provider's instructions. Plan renewal before expiration.

In production, an ACME client such as Certbot can request and renew certificates from an automated certificate authority, often installing or updating Apache configuration. Test renewal and confirm that HTTP-to-HTTPS redirects do not point back to HTTP or create a loop. TLS may terminate at Apache while Apache communicates with a trusted internal application over HTTP; protect that internal network and understand the application's trust model.

curl -vk https://example.test/

9. Logs and diagnosis

The access log records completed requests. The error log records startup messages, warnings, configuration errors, permission failures, missing files, TLS problems, and proxy failures.

A combined access-log entry commonly includes client address, timestamp, request line, status code, response size, referrer, and user agent. A line such as GET /missing.html HTTP/1.1 with status 404 indicates a missing resource, not necessarily a broken Apache service.

sudo tail -f /var/log/apache2/access.log /var/log/apache2/error.log

Per-virtual-host logs make diagnosis easier. Ubuntu normally rotates logs through its system log-rotation mechanism; confirm retention and compression meet operational needs. Logs can contain IP addresses, URLs, referrers, user agents, and identifiers, so restrict access, define retention, and consider privacy and data-minimization requirements.

10. Apache modules

A module is an optional Apache extension that adds capabilities. On Ubuntu, inspect loaded modules and enable or disable them with helper commands.

apache2ctl -M
sudo a2enmod ssl
sudo a2enmod proxy proxy_http headers
sudo a2enmod status
sudo a2dismod module_name
sudo a2enmod proxy_wstunnel

Modules can have dependencies. An unknown directive often means the required module is disabled or the Apache build does not provide it. Enable only features required by the deployment.

11. Forward proxy configuration

A forward proxy represents clients and reaches external destinations for them. It is useful for controlled testing or an organization-managed network, but an unrestricted forward proxy can be abused for anonymity, scanning, and attacks.

sudo a2enmod proxy proxy_http
sudo nano /etc/apache2/conf-available/forward-proxy.conf

ProxyRequests On
ProxyVia On

<Proxy "*">
    Require ip 127.0.0.1 192.0.2.0/24
</Proxy>

Listen 8080

The example allows only localhost and the documentation-only network range shown. Use the actual trusted network in a controlled deployment, restrict the listener with firewall rules, and do not expose it publicly. Disable forward proxying when it is not needed.

sudo a2enconf forward-proxy.conf
sudo apache2ctl configtest
sudo systemctl reload apache2
curl -I -x http://127.0.0.1:8080 http://example.com/

12. Reverse proxy configuration

A reverse proxy represents backend services. Public clients connect to Apache, while Apache forwards requests to an application on a private address or port.

sudo a2enmod proxy proxy_http headers

<VirtualHost *:80>
    ServerName app.example.test
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:3000/
    ProxyPassReverse / http://127.0.0.1:3000/
    RequestHeader set X-Forwarded-Proto "http"
    RequestHeader set X-Forwarded-Host "%{Host}s"
    ErrorLog ${APACHE_LOG_DIR}/app-proxy-error.log
    CustomLog ${APACHE_LOG_DIR}/app-proxy-access.log combined
</VirtualHost>

ProxyPass maps an incoming path to a backend URL. ProxyPassReverse adjusts backend redirect headers so clients continue using the public URL. ProxyPreserveHost On passes the original host to the application. Forwarded headers such as X-Forwarded-For, X-Forwarded-Proto, and X-Forwarded-Host help an application reconstruct the original request, but the application must trust these headers only from a trusted proxy.

Common failure points include a stopped backend, wrong path or port, timeouts, backend redirects, unavailable WebSocket support, and incorrect TLS termination assumptions. A 502 or 503 should be investigated in both Apache and application logs. Test the backend directly from the Apache host before changing proxy timeouts.

13. Server statistics with mod_status

mod_status provides the server-status endpoint, including uptime, requests served, worker states, traffic, scoreboard information, and server-load indicators.

sudo a2enmod status
sudo nano /etc/apache2/conf-available/server-status.conf

<Location "/server-status">
    SetHandler server-status
    Require ip 127.0.0.1 192.0.2.0/24
</Location>

ExtendedStatus On

sudo a2enconf server-status.conf
sudo apache2ctl configtest
sudo systemctl reload apache2
curl http://127.0.0.1/server-status

Restrict this endpoint to localhost, a management network, a VPN, or authenticated administrators. Public exposure can reveal operational details, traffic patterns, and worker information.

14. Validation checklist

1. Run apache2ctl configtest or httpd.exe -t.
2. Check service status and listening sockets with ss -tulpn or the Windows equivalent.
3. Inspect active virtual hosts with apache2ctl -S.
4. Inspect loaded modules with apache2ctl -M.
5. Test ordinary HTTP responses and explicit Host headers.
6. Test HTTP-to-HTTPS redirects and certificate behavior with verbose curl output.
7. Test the backend directly, then test the reverse proxy.
8. Monitor access and error logs while reproducing a problem.
9. Confirm firewall, DNS, hosts-file, file ownership, and private-key permissions.

15. Forward proxy versus reverse proxy

16. Troubleshooting patterns

• Apache will not start: run a syntax test, read service output and the error log, check for an unknown directive, missing module, bad path, or port conflict, then validate again before restarting.
• Remote browser cannot connect: confirm the service, listener, DNS, firewall, and network security rules. Test locally with curl first.
• Default site appears: use apache2ctl -S, verify the site is enabled, check the request hostname, and test an explicit Host header.
• 403 Forbidden: inspect the error log, the applicable Directory block, .htaccess, directory traversal permissions, and file read permissions.
• TLS warning or handshake failure: check hostname matching, certificate chain, key pairing, SSL module state, paths, and key permissions.
• 502 or 503 through a proxy: request the backend directly, check its process and port, inspect both logs, and verify proxy modules and mappings.
• Proxy abuse: turn off ProxyRequests unless needed, then restrict clients, listener interfaces, and firewall exposure.
• Public server-status: tighten the Location authorization to approved administrators or networks.

17. Final knowledge check

1. Which ports are normally used for HTTP and HTTPS?
2. What is the difference between Apache and DNS?
3. What does DocumentRoot identify?
4. Why might Apache select the default virtual host?
5. What is the purpose of ProxyPassReverse?
6. Why is an unrestricted forward proxy dangerous?
7. Which log should you inspect for a missing file, and which log is most useful for a startup syntax failure?
8. Why should a configuration test run before a reload?
9. What must be checked when a virtual host returns the default website?
10. Why should server-status be access-restricted?

A strong administrative workflow is: understand the request path, make a small change in the correct configuration context, validate syntax, reload safely, test locally and remotely, and use separated access and error logs to confirm the result.

For related foundations, see the Free Linux Course, the Nmap Online Course, and the Apache course activity.