Standing up a server of your own

Two marks of httpd are enough.

~ $ httpd -p 8080 -h /home/learner/site~ $

-p 8080                 wait at door 8080-h /home/learner/site   hand out the files in here

The place given to -h is called the document root.

the place handed out = /home/learner/site/index.html  ->  /home/learner/site/index.html/a.txt       ->  /home/learner/site/a.txt

The path in the URL matches where the file sits. Grasp that and eight tenths of the web is grasped.

Here are the other marks.

-f is useful now and then.

httpd -p 8080 -h site      goes behind (the screen returns at once)httpd -f -p 8080 -h site   stays on the screen (Ctrl-C to stop)

Gone behind, it is easy to forget how to stop it. Be ready with the ps and kill of chapter 8, and the killall of the last lesson.

There is one pitfall.

~ $ httpd -p 8080 -h /home/learner/nonehttpd: can't change directory to '/home/learner/none'

With no place to hand out, it will not start. So you mkdir first, then stand it up. Get that order wrong and you spend a while wondering why "it started but nothing connects".

Let us break down the writing of the address you ask at.

http://127.0.0.1:8080/a.txt+-+-+   +---+---+ +-++ +-+-+agree    address  door path

Four parts.

The last two lessons sit right inside the URL.

ip / ping   -> the address partnetstat     -> the door parttoday       -> the path part

Chapter 12 joins up here.

The door number can be left out when it is a settled one.

http://example.com/       80 is left outhttps://example.com/      443 is left outhttp://127.0.0.1:8080/    8080 cannot be

Only the famous numbers may be left out. So practice always writes the :8080.

One thing to remember about the path part.

http://127.0.0.1:8080/        ->  it looks for index.htmlhttp://127.0.0.1:8080/a.txt   ->  it hands over a.txt

A bare / means look for index.html, by agreement. Which is why every site has an index.html. What happens without one, this lesson's exercises will show.

Add -S to wget and the head of the answer shows.

~ $ wget -S -q -O /dev/null http://127.0.0.1:8080/a.txtHTTP/1.1 200 OK  Connection: close  Content-type: text/plain  Content-Length: 4

The 200 on the first line is the number for the result.

200 OK    it went well404 ...   not found

The numbers have three figures, and the hundreds place divides them broadly.

The difference between 4 and 5 matters a great deal.

4xx  a problem with how you asked (a mistyped URL and so on)5xx  a problem inside the server (a program fell over)

a 404 -> check the URLa 500 -> look at the server's record (the logger of the lesson before!)

The number decides which side to look at. Knowing this alone removes wasted searching.

Read the headings too.

Content-type: text/plain    the kind of the contentsContent-Length: 4           the size of the contents (bytes)

Before the contents begin, a description of the contents arrives. Like the note on a parcel. So the receiver knows what is coming before opening it.

The Content-type is decided by the handing side from the name of the file.

a.txt      ->  text/plainb.html     ->  text/htmlc.png      ->  image/pngd.json     ->  application/json

Why does that matter? Because the receiver behaves differently.

text/html   the browser "reads it through" and shows ittext/plain  it comes out as letters, as they are

With the very same contents <h1>Fulfledge</h1>, this happens.

text/html   a large "Fulfledge"text/plain  the letters <h1>Fulfledge</h1> themselves

The contents are the same and the look changes.

There is a common accident behind this.

you wrote HTML and the tags come out as letters  -> the ending had become .txt

The naming changes the showing, which surprises newcomers more than anything.

It has a use the other way round.

hand it out as text/plain on purpose -> show contents safely

Why safely? Because handed out as text/html, the instructions written in it will run. Handing out somebody else's letters as text/html is very dangerous (you would be running their instructions on your own site).

do not hand out what somebody else wrote as HTML

That is the doorway into web safety. Today, only remember that the kind decides the behaviour. Writing HTML properly comes in the HTML/CSS course.

Four marks of wget are enough.

Learn three shapes.

wget -q -O - URL          see the contents on the screenwget -q -O file URL       save itwget -q --spider URL      only check whether it is there

The - of -O - means the screen. It joins to the pipes of chapter 4 as well.

wget -q -O - URL | grep the-word-you-wantwget -q -O - URL | wc -l

What you fetched hands straight to the tools of chapters 3 to 5. Everything you have learned tells here.

A word on where --spider is used.

wget -q --spider URL && echo here || echo none

When you do not need the contents, do not take them. With a big file this is hundreds of times faster.

Hold on to the exit statuses too.

a 200 came back      exit status 0a 404 came back      exit status 1the door is shut     exit status 1

A script can judge whether the contents are there. Work for the && and || of chapter 11.

One more: know the name of a similar tool, curl. It is not in this environment, but out in the world curl is used more.

wget   good at fetching filescurl   good at trying things with fine control

Their parts differ slightly; the thinking is the same.

Once the place to hand out is decided, you cannot get outside it. Try and you will see.

~ $ wget -q -O - "http://127.0.0.1:8080/../secret.txt"wget: server returned error: HTTP/1.1 400 Bad Request

Refused. The .. is the "one up" of chapter 1.

the place handed out   /home/learner/sitewhat was asked for     /home/learner/secret.txt   <- outside!

If you could get outside, this would be possible.

may I have /../../../etc/passwd

The whole machine could be read. So the handing side is built to refuse requests containing ... This way of attacking has a name: path traversal.

But do not take too much comfort. What matters is this order.

> Put only what may be handed out in the place you hand out from

leaning on the refusing    -> a hole will be found one daynot putting it there       -> a hole leaks nothing

What is not there cannot leak. That is the single most important idea in web safety.

Real accidents happen like this.

.git left in the place handed out and published  -> even old passwords were readbackup.zip left there and forgotten  -> the whole thing was downloaded

Both were caused by putting it there, not by a hole in the arrangement.

So in today's practice you make a place of its own called site and hand out only what is inside it. Keeping the places apart is the manner.

Here are the shapes for this lesson.

mkdir -p site                     make the place to hand outhttpd -p 8080 -h /home/learner/site   hand outwget -q -O - URL                  see it on the screenwget -q -O file URL               save itwget -S -q -O /dev/null URL       see the head of the answerwget -q --spider URL              only see whether it is therekillall httpd                     shut it

And the places to read.

200 OK          it went well404 Not Found   not found400 Bad Request the asking itself is oddContent-type    the kind (decided by the ending)Content-Length  the size

Three things to remember most today.

1. the web is only asking for a file and receiving it2. 4xx is the asker's problem, 5xx the handing side's3. put only what may be handed out in the place you hand out from

And today's conclusion.

> A server is something you can stand up yourself

No special equipment is needed. You can already put a file down, hand it out, and fetch it back.

In the last exercise you join everything of chapter 12 into a tool that runs the three-rung check by itself.

ping -> netstat -> wget -> logger -> cron

Write that and you have graduated from chapter 12. The next chapter is vi. Being able to change a file inside the screen alone means you can mend the page you made here too. Let us type.