apache2.0to2.4.md · 1.7 KiB · Markdown Raw

# Migrating the Apache config files into new places and naming scheme

see https://gist.github.com/waja/86a3a055c1fedfba3c58#file-wheezy2jessie-sh

# Upstream changes

* [Order](http://httpd.apache.org/docs/2.4/mod/mod_access_compat.html#order), [Allow](http://httpd.apache.org/docs/2.4/mod/mod_access_compat.html#allow), [Deny](http://httpd.apache.org/docs/2.4/mod/mod_access_compat.html#deny) and [Satisfy](http://httpd.apache.org/docs/2.4/mod/mod_access_compat.html#satisfy) are obsolete, you should read [Run-Time Configuration Changes](http://httpd.apache.org/docs/2.4/upgrading.html#run-time) or [Beyond just authorization](http://httpd.apache.org/docs/2.4/howto/auth.html#beyond)
* Mixing [Options](http://httpd.apache.org/docs/current/mod/core.html#options) with a + or - with those without is not valid syntax, and will be rejected during server startup by the syntax check with an abort.
* Certificate handleing has changed, obsoletes [SSLCertificateChainFile](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcertificatechainfile), please use [SSLCertificateFile](http://httpd.apache.org/docs/current/mod/mod_ssl.html#sslcertificatefile), it may also include intermediate CA certificates, sorted from leaf to root now
* Several other changes can be found in the [Upgrading to 2.4 from 2.2](http://httpd.apache.org/docs/2.4/upgrading.html) documentation

# Some more other handy resources

https://www.digitalocean.com/community/tutorials/migrating-your-apache-configuration-from-2-2-to-2-4-syntax  
https://www.linode.com/docs/security/upgrading/updating-virtual-host-settings-from-apache-2-2-to-apache-2-4  
http://linoxide.com/linux-how-to/apache-migration-2-2-to-2-4-ubuntu-14-04/

Migrating the Apache config files into new places and naming scheme

see https://gist.github.com/waja/86a3a055c1fedfba3c58#file-wheezy2jessie-sh

Upstream changes

Order, Allow, Deny and Satisfy are obsolete, you should read Run-Time Configuration Changes or Beyond just authorization
Mixing Options with a + or - with those without is not valid syntax, and will be rejected during server startup by the syntax check with an abort.
Certificate handleing has changed, obsoletes SSLCertificateChainFile, please use SSLCertificateFile, it may also include intermediate CA certificates, sorted from leaf to root now
Several other changes can be found in the Upgrading to 2.4 from 2.2 documentation

Some more other handy resources

https://www.digitalocean.com/community/tutorials/migrating-your-apache-configuration-from-2-2-to-2-4-syntax
https://www.linode.com/docs/security/upgrading/updating-virtual-host-settings-from-apache-2-2-to-apache-2-4
http://linoxide.com/linux-how-to/apache-migration-2-2-to-2-4-ubuntu-14-04/

wheezy2jessie.sh · 6.8 KiB · Bash Raw

Please also refer to http://www.debian.org/releases/jessie/releasenotes and use your brain!

# upgrade to UTF-8 locales (http://www.debian.org/releases/jessie/amd64/release-notes/ap-old-stuff.en.html#switch-utf8)
dpkg-reconfigure locales

# remove unused config file
rm -rf /etc/network/options /etc/environment
 
# Transition and remove entries from older releases
sed -i s#/backports.org/debian#/ftp.de.debian.org/debian#g /etc/apt/sources.list*
sed -i s/debian-backports/debian/g /etc/apt/sources.list*
sed -i /etch/d /etc/apt/sources.list*
sed -i /lenny/d /etc/apt/sources.list*
sed -i /sarge/d /etc/apt/sources.list*
sed -i /squeeze/d /etc/apt/sources.list*
sed -i /volatile/d /etc/apt/sources.list*
sed -i /proposed-updates/d /etc/apt/sources.list*
# change distro (please move 3rd party sources to /etc/apt/sources.list.d/), maybe look into http://ftp.cyconet.org/debian/sources.list.d/
sed -i s/wheezy/jessie/g /etc/apt/sources.list*
sed -i "s/ stable/ jessie/g" /etc/apt/sources.list*
sed -i s/wheezy/jessie/g /etc/apt/preferences*
sed -i s/wheezy/jessie/g /etc/apt/sources.list.d/*wheezy*
rename s/wheezy/jessie/g /etc/apt/sources.list.d/*wheezy*
aptitude update

# check package status
dpkg --audit
aptitude search "~ahold" | grep "^.h"
dpkg --get-selections | grep hold
 
# unmark packages auto
aptitude unmarkauto vim
aptitude unmarkauto $(dpkg-query -W 'linux-image-3.2.*' | cut -f1)
 
# have a look into required and free disk space
apt-get -o APT::Get::Trivial-Only=true dist-upgrade || df -h

# record session
script -t 2>~/upgrade-jessie.time -a ~/upgrade-jessie.script

# install our preseed so libc doesn't whine
cat > /tmp/jessie.preseed <<EOF
libc6 glibc/upgrade boolean true
libc6 glibc/restart-services string
libc6 libraries/restart-without-asking boolean true
EOF
/usr/bin/debconf-set-selections /tmp/jessie.preseed

# update aptitude first
[ "$(which aptitude)" = "/usr/bin/aptitude" ] && aptitude install aptitude

# minimal system upgrade (keep sysvinit / see http://noone.org/talks/debian-ohne-systemd/debian-ohne-systemd-clt.html#%2811%29)
aptitude upgrade '~U' 'sysvinit-core+'

# (re)enable wheel
if [ -f /etc/pam.d/su.dpkg-new ]; then CFG=/etc/pam.d/su.dpkg-new; else CFG=/etc/pam.d/su; fi
sed -i "s/# auth       required   pam_wheel.so/auth       required   pam_wheel.so/" $CFG

# (re)configure snmpd
if [ -f /etc/snmp/snmpd.conf.dpkg-new ]; then CFG=/etc/snmp/snmpd.conf.dpkg-new; \
   else CFG=/etc/snmp/snmpd.conf; fi
sed -i "s^#rocommunity secret  10.0.0.0/16^rocommunity mycommunity^g" $CFG
sed -i s/#agentAddress/agentAddress/ $CFG
sed -i "s/^ rocommunity public/# rocommunity public/" $CFG
sed -i "s/^ rocommunity6 public/# rocommunity6 public/" $CFG
sed -i "s/agentAddress  udp:127/#agentAddress  udp:127/" $CFG

# chrony update
if [ -f /etc/chrony/chrony.conf.new ]; then CFG=/etc/chrony/chrony.conf.new; else CFG=/etc/chrony/chrony.conf; fi
sed -i s/debian.pool/de.pool/g $CFG

# randomize crontab
if [ -f /etc/crontab.dpkg-new ]; then CFG=/etc/crontab.dpkg-new; else CFG=/etc/crontab; fi
sed -i 's#root    cd#root    perl -e "sleep int(rand(300))" \&\& cd#' $CFG
sed -i 's#root\ttest#root\tperl -e "sleep int(rand(3600))" \&\& test#' $CFG

# phpmyadmin
if [ -f /etc/phpmyadmin/config.inc.php.dpkg-new ]; then CFG=/etc/phpmyadmin/config.inc.php.dpkg-new; \
   else CFG=/etc/phpmyadmin/config.inc.php; fi
sed -i "s/\['auth_type'\] = 'cookie'/\['auth_type'\] = 'http'/" $CFG
sed -i "s#//\$cfg\['Servers'\]\[\$i\]\['auth_type'\] = 'http';#\$cfg['Servers'][\$i]['auth_type'] = 'http';#" $CFG

# maybe we want to change some shorewall config stuff again
sed -i s/^startup=0/startup=1/ /etc/default/shorewall

# full-upgrade
aptitude full-upgrade

# Apache2 config migration
# see also /usr/share/doc/apache2/NEWS.Debian.gz
#
# migrate sites into new naming scheme
perl /usr/share/doc/apache2/migrate-sites.pl
# migrate server config snippets into new directory
APACHE2BASEDIR="/etc/apache2"; for CONF in $(ls -l ${APACHE2BASEDIR}/conf.d/ | grep -v ^l | awk {'print $9'} | grep -v ^$); do
	if ! [ ${CONF##*.} == "conf" ]; then
		mv ${APACHE2BASEDIR}/conf.d/${CONF} ${APACHE2BASEDIR}/conf.d/${CONF}.conf
		CONF="${CONF}.conf"
	fi
	mv ${APACHE2BASEDIR}/conf.d/${CONF} ${APACHE2BASEDIR}/conf-available/${CONF}
	# enable this
	CONF=$(basename ${CONF} .conf)
	a2enconf ${CONF}
done
# migrate standard Options config to valid one
sed -i "s/Options ExecCGI/Options +ExecCGI/" /etc/apache2/sites-available/*
# fix probable Piped Logs
sed -i 's/|exec /| /' /etc/apache2/sites-available/*

# serveral changes may be needed to adjust content of config files
# see https://gist.github.com/waja/86a3a055c1fedfba3c58#file-apache2.0to2.4.md

# migrate redmine plugins
mv /usr/share/redmine/vendor/plugins/* /usr/share/redmine/plugins/ && rmdir /usr/share/redmine/vendor/plugins/
# Remove inconsistent link in /usr/share/redmine/vendor/rails
rm /usr/share/redmine/vendor/rails
# migrate database config for mysql
sed -i "s/adapter: mysql/adapter: mysql2/" /etc/redmine/default/database.yml

# remove old squeeze packages left around (keep eyes open!)
apt-get autoremove
aptitude search ?obsolete
dpkg -l | grep etch | grep -v xen | grep -v unbound | grep -v finch | awk '{print $2}' | xargs aptitude -y purge
dpkg -l | grep lenny | grep -v xen | awk '{print $2}' | xargs aptitude -y purge
dpkg -l | grep squeeze | grep -v xen | awk '{print $2}' | xargs aptitude -y purge
dpkg -l | grep -E 'deb7|wheezy' | grep -v xen | grep -v linux-image | awk '{print $2}' | xargs aptitude -y purge
aptitude -y install deborphan && deborphan | grep -v xen | grep -v libpam-cracklib | xargs aptitude -y purge
dpkg -l | grep ^r | awk '{print $2}' | xargs aptitude -y purge

### not needed until now
# mysql
# remove anonymous mysql access
#mysql -u root -p -e "DELETE FROM mysql.user WHERE User=''; DELETE FROM mysql.db WHERE Db='test' AND Host='%' OR Db='test\\_%' AND Host='%'; FLUSH PRIVILEGES;"

# dont use iptables when creating xen vifs
#cp /etc/xen/scripts/vif-bridge /etc/xen/scripts/vif-bridge-local
#sed -i "s/^    handle_iptable/    true/g" /etc/xen/scripts/vif-bridge-local
#sed -i "s/^(vif-script vif-bridge)/(vif-script vif-bridge-local)/" /etc/xen/xend-config.sxp

# xen
#/bin/sed -i -e 's/^[# ]*$(dom0-min-mem$.*$).*$$/\1 512\2/' /etc/xen/xend-config.sxp
#sed -i s/XENDOMAINS_RESTORE=true/XENDOMAINS_RESTORE=false/ /etc/default/xendomains
#sed -i s#XENDOMAINS_SAVE=/var/lib/xen/save#XENDOMAINS_SAVE=\"\"# /etc/default/xendomains
#dpkg-divert --divert /etc/grub.d/09_linux_xen --rename /etc/grub.d/20_linux_xen
#echo 'GRUB_CMDLINE_XEN="dom0_mem=512M"' >> /etc/default/grub

# migrate expose.ini
#[ -f /etc/php5/conf.d/expose.ini ] && mv /etc/php5/conf.d/expose.ini \
# /etc/php5/mods-available/local-expose.ini && php5enmod local-expose/90
# migrate local suhosin config
#find /etc/php5/conf.d/ -type f -name "*suhosin.ini" -exec mv '{}' \
# /etc/php5/mods-available/local-suhosin.ini \; && php5enmod local-suhosin/90

1	Please also refer to http://www.debian.org/releases/jessie/releasenotes and use your brain!
2
3
4	# upgrade to UTF-8 locales (http://www.debian.org/releases/jessie/amd64/release-notes/ap-old-stuff.en.html#switch-utf8)
5	dpkg-reconfigure locales
6
7	# remove unused config file
8	rm -rf /etc/network/options /etc/environment
9
10	# Transition and remove entries from older releases
11	sed -i s#/backports.org/debian#/ftp.de.debian.org/debian#g /etc/apt/sources.list*
12	sed -i s/debian-backports/debian/g /etc/apt/sources.list*
13	sed -i /etch/d /etc/apt/sources.list*
14	sed -i /lenny/d /etc/apt/sources.list*
15	sed -i /sarge/d /etc/apt/sources.list*
16	sed -i /squeeze/d /etc/apt/sources.list*
17	sed -i /volatile/d /etc/apt/sources.list*
18	sed -i /proposed-updates/d /etc/apt/sources.list*
19	# change distro (please move 3rd party sources to /etc/apt/sources.list.d/), maybe look into http://ftp.cyconet.org/debian/sources.list.d/
20	sed -i s/wheezy/jessie/g /etc/apt/sources.list*
21	sed -i "s/ stable/ jessie/g" /etc/apt/sources.list*
22	sed -i s/wheezy/jessie/g /etc/apt/preferences*
23	sed -i s/wheezy/jessie/g /etc/apt/sources.list.d/wheezy
24	rename s/wheezy/jessie/g /etc/apt/sources.list.d/wheezy
25	aptitude update
26
27	# check package status
28	dpkg --audit
29	aptitude search "~ahold" \| grep "^.h"
30	dpkg --get-selections \| grep hold
31
32	# unmark packages auto
33	aptitude unmarkauto vim
34	aptitude unmarkauto $(dpkg-query -W 'linux-image-3.2.*' \| cut -f1)
35
36	# have a look into required and free disk space
37	apt-get -o APT::Get::Trivial-Only=true dist-upgrade \|\| df -h
38
39	# record session
40	script -t 2>~/upgrade-jessie.time -a ~/upgrade-jessie.script
41
42	# install our preseed so libc doesn't whine
43	cat > /tmp/jessie.preseed <<EOF
44	libc6 glibc/upgrade boolean true
45	libc6 glibc/restart-services string
46	libc6 libraries/restart-without-asking boolean true
47	EOF
48	/usr/bin/debconf-set-selections /tmp/jessie.preseed
49
50	# update aptitude first
51	[ "$(which aptitude)" = "/usr/bin/aptitude" ] && aptitude install aptitude
52
53	# minimal system upgrade (keep sysvinit / see http://noone.org/talks/debian-ohne-systemd/debian-ohne-systemd-clt.html#%2811%29)
54	aptitude upgrade '~U' 'sysvinit-core+'
55
56	# (re)enable wheel
57	if [ -f /etc/pam.d/su.dpkg-new ]; then CFG=/etc/pam.d/su.dpkg-new; else CFG=/etc/pam.d/su; fi
58	sed -i "s/# auth required pam_wheel.so/auth required pam_wheel.so/" $CFG
59
60	# (re)configure snmpd
61	if [ -f /etc/snmp/snmpd.conf.dpkg-new ]; then CFG=/etc/snmp/snmpd.conf.dpkg-new; \
62	else CFG=/etc/snmp/snmpd.conf; fi
63	sed -i "s^#rocommunity secret 10.0.0.0/16^rocommunity mycommunity^g" $CFG
64	sed -i s/#agentAddress/agentAddress/ $CFG
65	sed -i "s/^ rocommunity public/# rocommunity public/" $CFG
66	sed -i "s/^ rocommunity6 public/# rocommunity6 public/" $CFG
67	sed -i "s/agentAddress udp:127/#agentAddress udp:127/" $CFG
68
69	# chrony update
70	if [ -f /etc/chrony/chrony.conf.new ]; then CFG=/etc/chrony/chrony.conf.new; else CFG=/etc/chrony/chrony.conf; fi
71	sed -i s/debian.pool/de.pool/g $CFG
72
73	# randomize crontab
74	if [ -f /etc/crontab.dpkg-new ]; then CFG=/etc/crontab.dpkg-new; else CFG=/etc/crontab; fi
75	sed -i 's#root cd#root perl -e "sleep int(rand(300))" \&\& cd#' $CFG
76	sed -i 's#root\ttest#root\tperl -e "sleep int(rand(3600))" \&\& test#' $CFG
77
78	# phpmyadmin
79	if [ -f /etc/phpmyadmin/config.inc.php.dpkg-new ]; then CFG=/etc/phpmyadmin/config.inc.php.dpkg-new; \
80	else CFG=/etc/phpmyadmin/config.inc.php; fi
81	sed -i "s/\['auth_type'\] = 'cookie'/\['auth_type'\] = 'http'/" $CFG
82	sed -i "s#//\$cfg\['Servers'\]\[\$i\]\['auth_type'\] = 'http';#\$cfg['Servers'][\$i]['auth_type'] = 'http';#" $CFG
83
84	# maybe we want to change some shorewall config stuff again
85	sed -i s/^startup=0/startup=1/ /etc/default/shorewall
86
87	# full-upgrade
88	aptitude full-upgrade
89
90	# Apache2 config migration
91	# see also /usr/share/doc/apache2/NEWS.Debian.gz
92	#
93	# migrate sites into new naming scheme
94	perl /usr/share/doc/apache2/migrate-sites.pl
95	# migrate server config snippets into new directory
96	APACHE2BASEDIR="/etc/apache2"; for CONF in $(ls -l ${APACHE2BASEDIR}/conf.d/ \| grep -v ^l \| awk {'print $9'} \| grep -v ^$); do
97	if ! [ ${CONF##*.} == "conf" ]; then
98	mv ${APACHE2BASEDIR}/conf.d/${CONF} ${APACHE2BASEDIR}/conf.d/${CONF}.conf
99	CONF="${CONF}.conf"
100	fi
101	mv ${APACHE2BASEDIR}/conf.d/${CONF} ${APACHE2BASEDIR}/conf-available/${CONF}
102	# enable this
103	CONF=$(basename ${CONF} .conf)
104	a2enconf ${CONF}
105	done
106	# migrate standard Options config to valid one
107	sed -i "s/Options ExecCGI/Options +ExecCGI/" /etc/apache2/sites-available/*
108	# fix probable Piped Logs
109	sed -i 's/\|exec /\| /' /etc/apache2/sites-available/*
110
111	# serveral changes may be needed to adjust content of config files
112	# see https://gist.github.com/waja/86a3a055c1fedfba3c58#file-apache2.0to2.4.md
113
114	# migrate redmine plugins
115	mv /usr/share/redmine/vendor/plugins/* /usr/share/redmine/plugins/ && rmdir /usr/share/redmine/vendor/plugins/
116	# Remove inconsistent link in /usr/share/redmine/vendor/rails
117	rm /usr/share/redmine/vendor/rails
118	# migrate database config for mysql
119	sed -i "s/adapter: mysql/adapter: mysql2/" /etc/redmine/default/database.yml
120
121	# remove old squeeze packages left around (keep eyes open!)
122	apt-get autoremove
123	aptitude search ?obsolete
124	dpkg -l \| grep etch \| grep -v xen \| grep -v unbound \| grep -v finch \| awk '{print $2}' \| xargs aptitude -y purge
125	dpkg -l \| grep lenny \| grep -v xen \| awk '{print $2}' \| xargs aptitude -y purge
126	dpkg -l \| grep squeeze \| grep -v xen \| awk '{print $2}' \| xargs aptitude -y purge
127	dpkg -l \| grep -E 'deb7\|wheezy' \| grep -v xen \| grep -v linux-image \| awk '{print $2}' \| xargs aptitude -y purge
128	aptitude -y install deborphan && deborphan \| grep -v xen \| grep -v libpam-cracklib \| xargs aptitude -y purge
129	dpkg -l \| grep ^r \| awk '{print $2}' \| xargs aptitude -y purge
130
131	### not needed until now
132	# mysql
133	# remove anonymous mysql access
134	#mysql -u root -p -e "DELETE FROM mysql.user WHERE User=''; DELETE FROM mysql.db WHERE Db='test' AND Host='%' OR Db='test\\_%' AND Host='%'; FLUSH PRIVILEGES;"
135
136	# dont use iptables when creating xen vifs
137	#cp /etc/xen/scripts/vif-bridge /etc/xen/scripts/vif-bridge-local
138	#sed -i "s/^ handle_iptable/ true/g" /etc/xen/scripts/vif-bridge-local
139	#sed -i "s/^(vif-script vif-bridge)/(vif-script vif-bridge-local)/" /etc/xen/xend-config.sxp
140
141	# xen
142	#/bin/sed -i -e 's/^[# ]$(dom0-min-mem$.$).*$$/\1 512\2/' /etc/xen/xend-config.sxp
143	#sed -i s/XENDOMAINS_RESTORE=true/XENDOMAINS_RESTORE=false/ /etc/default/xendomains
144	#sed -i s#XENDOMAINS_SAVE=/var/lib/xen/save#XENDOMAINS_SAVE=\"\"# /etc/default/xendomains
145	#dpkg-divert --divert /etc/grub.d/09_linux_xen --rename /etc/grub.d/20_linux_xen
146	#echo 'GRUB_CMDLINE_XEN="dom0_mem=512M"' >> /etc/default/grub
147
148	# migrate expose.ini
149	#[ -f /etc/php5/conf.d/expose.ini ] && mv /etc/php5/conf.d/expose.ini \
150	# /etc/php5/mods-available/local-expose.ini && php5enmod local-expose/90
151	# migrate local suhosin config
152	#find /etc/php5/conf.d/ -type f -name "*suhosin.ini" -exec mv '{}' \
153	# /etc/php5/mods-available/local-suhosin.ini \; && php5enmod local-suhosin/90
154