his chapter tells you how to install the Netscape Proxy Server and begin configuring the server for your needs. The proxy server runs as a daemon process that spawns child processes. You can configure the proxy server by using the web-based administration forms or by editing the configuration files.
The web-based administration server is a separate HTTP server daemon that runs on your machine using a different port number than the proxy server. The administration server is a server common to all Netscape server products. You can have one administration server that configures all of the Netscape servers on your computer. For example, you might have a web server and a proxy server installed on the same machine (however, for high-load machines, you'll probably want a computer dedicated to one server).
The administration server runs a collection of web forms and CGI scripts. The Server Selector is the main web form that lets you configure the administration server itself or choose a server to configure. The Server Manager forms are specific forms for configuring the server you selected in the Server Selector. For more information, see Chapter 2 "Configuring and managing the server."
Before you install
Installing the Netscape Proxy Server is a smooth process if you prepare first. The following list describes the software you should install on your server machine before you install the proxy server.
nslookup and press Enter.
Default Server: dns.netscape.com
Address: 198.95.249.78
If nslookup cannot find an authoritative answer, it prints the names of any servers that might have an authoritative answer:
Non-authoritative answer:
Name: www.mysite.com
Address: 198.95.251.30
Control-d.
For instructions on creating a new user account, see your system manual or a Unix administrator's handbook.When the proxy server starts and runs, it runs with the Unix user account you specify during installation. Any child processes of the proxy and all files created by the proxy are created with this account as the owner. You can use the account with the name nobody, but this might not work on your system. Some machines ship with a user identification (uid) of -2 for the user nobody. A uid less than zero generates an error during installation. Check the /etc/passwd file or the yppasswd database to see if the uid for nobody exists, and then make sure it is greater than zero. Otherwise, create a new user account with a uid greater than zero. The default uid for nobody depends on the platform:
|
User ID
|
Platform
60001 |
Solaris, IRIX |
65534 |
OSF/1, HPUX |
4294967294 |
AIX |
|
|---|
Note
It's strongly recommended that you use a dedicated user account for the proxy
server.
Because the proxy server is configured through a web-based administration
server, you might also want to create another user account for the administration server. You can also run the administration server as root, and then start
and stop the server when you aren't using it to configure the proxy server.
Choosing unique port numbers
The proxy server uses two port numbers: one for the proxy server itself and another for the administrations server. You specify these two port numbers during installation, but you can also change the port numbers after installation.
The port numbers must be unique for each service on a computer. Port numbers for all network-accessible services on your machine are listed in the file /etc/services. Your system might use the YP (or NIS) Yellow Pages. In that case, you can use the command-line utility ypcat services to list the additional port numbers used or reserved in the YP database. Industry standards for many kinds of ports already exist; for example, the standard HTTP port number is 80; for Telnet, the standard port is 23; and for HTTPS, the standard port is 443. There isn't yet a standard port number for proxy servers; however, commonly used ports are 8000 and 8080. If you are unsure of which port number to use, 8000 or 8080 is probably a good choice. If you use the Netscape Proxy Server's built-in SOCKS daemon, you should use the SOCKS port 1080.
The administration server is typically run on a random port number above 1024. This makes it harder for someone to figure out where your administration server is and try to compromise its security.
Before you choose a port number, make sure the port you choose isn't in use. Look at the file /etc/services on the server machine (or use ypcat services) to make sure you don't assign a port number that is used by another service.
Note
If you choose a port number less than 1024, you'll have to be logged in as root
or superuser to start the proxy. After the proxy is bound to the port, the server
changes from root or superuser to the user account you chose to run under. If
you choose a port number greater than 1024, you don't have to be root or
superuser to start the proxy.
Installing the Netscape Proxy Server
After you've installed the required software, you can install the Netscape Proxy Server. You can install a new proxy, replace an existing proxy server, or install more than one proxy.
If you're already running a proxy server, you should install the new proxy server to a different port. For example, if you are replacing a proxy that listens to port 8080, you might first install the new Netscape Proxy Server on port 8081, assuming that port is available. After the new Netscape Proxy Server is properly configured, shut down the old proxy server and then change the new proxy to use port 8080.
If you're upgrading from a 1.1 Netscape Proxy Server, see page 38.
Note
The proxy server must be installed to an empty directory. By default, the installation process uses the directory /usr/ns-home.
To install the Netscape Proxy Server,
proxy. For example, if you are using Solaris, type cd SOLARIS/proxy.
Note
./ns-setup to start the server installation. If you aren't logged in as root (superuser) or if you don't have sufficient write permissions, you'll get one or more error messages. This program extracts proxy server files from the CD and installs them in the server root directory you specify. When you run .ns-setup, this prompt appears; the default directory is shown in brackets:
Server root [/usr/ns-home]:
You can either press Enter to accept the default name in brackets, or type the name of the directory you want to use and then press Enter.
Configure new server now? [yes]: yes
Full name [mybox.mysite.com]:
Administration port [8081]:
Run admin server as [root]:
Access username [admin]: admin
Password:
Password (again):
Hosts [NONE]: *.netscape.com
IP addresses [198.95.251.30]:
Wrote /usr/ns-home/admserv/admpw
Wrote /usr/ns-home/admserv/ns-admin.conf
Wrote /usr/ns-home/start-admin
Wrote /usr/ns-home/stop-admin
Press any key to continue.
warning: daemon is running as super-user
startup: listening to port 8081 as root
Network navigator [netscape]: NONE
Note
myproxy-8080.
/tmp directory and then removed after installation.
The installation program places all of the server files under the server root directory that you specified during installation. If you enabled caching, the cache framework is created under the cache root directory. The following files and directories are created under the server root directory.
Upgrading from a previous version of the Netscape Proxy Server
This section tells you how to upgrade from an earlier version of the Netscape Proxy Server. The upgrade process involves installing the new server to a new or empty directory and then transferring the configuration information from the old proxy server to the new one.
To upgrade from an earlier version of the proxy server,
You can start and stop the proxy server from the Server Selector or from the Server Manager forms. Next to each installed server in the Server Selector, there is a red graphic (shown at left) that shows you if the server is on or off. You can click this graphic to toggle the server. For example, if the server is running, you can click the graphic to turn it off, and vice versa.
[ServerRoot]/proxy-[IDENTIFIER]/start
[ServerRoot] is the directory where you installed the server The start script has two command-line arguments:
-p XX (where XX is a port number) starts the proxy on a specific port
number. This overrides the setting in magnus.conf.
-i runs the proxy in inittab mode, so that if the proxy process is ever
killed or crashes, inittab restarts the proxy server for you. It also prevents
the proxy from putting itself in a background process.
Note
inittab to starting the server, you'll need to remove the line from /etc/inittab before you stop the server. Otherwise, the server restarts automatically after it is stopped.
To stop the server manually, log in as root or become superuser, or if you started the proxy using the proxy's user account, log in as that user. Type the following at the command-line prompt:
[ServerRoot]/proxy-[IDENTIFIER]/stop
[ServerRoot] is the directory where you installed the server.
proxy:2:respawn:[ServerRoot]/proxy-[IDENTIFIER]/start -i
[ServerRoot] is the directory where you installed the server. You'll need to remove this line before you stop the server (see "Troubleshooting installation" on page 41).
Note
If you are using a version of Unix not derived from System V (such as SunOS
4.1.3), you won't be able to use the inittab option.
Restarting with the system RC scripts
If you choose to use /etc/rc.local, or your system's equivalent, place the following line in that directory:
[ServerRoot]/proxy-IDENTIFIER/start
[ServerRoot] is the directory where you installed the server.
Soft starting the proxy
If the proxy is currently running and you want to restart it so that it uses an updated configuration, type:
[ServerRoot]/proxy-[IDENTIFIER]/restart
[ServerRoot] is the directory where you installed the server. This script finds the parent process id (in the logs/pid file), and sends the hang-up (-HUP) signal with this process id.
Troubleshooting installation
This section describes common installation problems and how to solve them.
I accidentally denied all access to the Administration forms.
Log in as root or with the proxy's user account. In the server root directory, edit the magnus.conf file. See page 352 for more information on this file.
I don't have access to the proxy.
Log in as root or the proxy's user account. In the server root directory, edit the obj.conf file and remove the following lines:
<Client dns="[wildcardpattern]" ip="[wildcardpattern]">
[wildcardpattern] is a shell expression that matches your DNS or IP address. You can also edit the wildcard patterns so that your user account information isn't included. To deny service to everyone except a select group, use
PathCheck fn=deny-service
</Client>
*~ before the wildcard pattern (for example, *~*netscape.com denies service to everyone except those from the netscape.com domain). See Chapter 3, "Managing templates and resources" for more information on wildcard patterns.
Clients can't find the proxy server.
First try using the host name. If that doesn't work, use a fully-qualified name (in the form proxy.subdomain.domain). If that doesn't work, use the dotted quad IP address.
The proxy is slow, and transfers take too long.
If you log files to SYSLOG, you might encounter reduced performance. Use the proxy's error log files instead. The proxy computer might also need more RAM to handle the load, or if other applications are on the proxy machine, they might be degrading proxy performance by using most of the computers memory.
You can also reduce transfer time by configuring the cache refresh setting. See page 97 for more information on the cache refresh setting.