Are you ready to connect your AS/400 to the Internet? This article will explain what the HTTP server is and how to configure it so you can connect your AS/400 to the rest of the world.
Since the early 1990s, Hypertext Transfer Protocol (HTTP) has been the core technology used to deliver, link, and relate Web pages. Browsers use it to communicate with Web servers, and Web servers use it to communicate among themselves. In fact, you may see Web servers also referred to as HTTP servers because of their intrinsic use of the protocol. Keep in mind that a Web server is nothing more than TCP/IP applications using the HTTP protocol to communicate with the client/browser. For those of you with a background using Novell NetWare servers, HTTP is analogous to the NetWare Core Program (NCP) protocol. For OS/2 Warp or Windows NT users, the analogy is to the Server Message Block (SMB) protocol.
A Simple Protocol
As with most items associated with the Internet and the IP protocol, HTTP is a simple protocol based on client/server techniques. HTTP defines how connections are formed, how data is formatted and transferred, and how connections are closed. When you look at these functions, there is nothing in HTTP that appears to make it such an outstanding protocol. However, one item that HTTP handles has revolutionized how we deal with data. HTTP allows chaining of documents across a network of computers, allowing one server to point to information in another server through hypertext links. The HTTP client is a Web browser, and the HTTP server is a Web server. In this document, I will use the terms browser and Web server.
The browser establishes a TCP connection to the server, issues a request, and reads the server’s response. The server denotes the end of the session and closes the connection. The server’s response can be a file, a graphic, a video, a sound, or an executable program and may contain information with hypertext links to files on other servers. The simplicity to the user is the ease of following these links from one server to another. Note that the
browser contains all the ease-of-use functions, like navigation, graphical display, and common display of information. It is interesting to note that, though the HTTP client (browser) is a more complex entity than the HTTP server (Web server), the HTTP server is complex to configure.
HTTP Protocol
In the TCP/IP world, applications are addressed via three pieces of information: the IP address, the protocol type, and the port number. By agreement through the Internet Engineering Task Force (IETF), the port number for HTTP is port 80. When a user types http://www.ibm.com, for example, on the browser’s address space, the following occurs:
• The name www.ibm.com is resolved to an IP address by a Domain Name System (DNS).
• The http indicates the protocol to use with the default port of 80.
• The default protocol of TCP is assumed.
• A connection is established to the server, and a request for information is relayed.
• The server responds with the information and terminates the connection. In 1997, most browsers were designed to default to http, so all that a user needs to type on the browser’s address line is www.ibm.com.
There are two message types in HTTP: requests and responses. You can’t make it much simpler than that. Compare this to the different number of commands used to communicate between a NetBIOS client and server or between a NetWare client and server. The difference is striking.
HTTP Syntax
This is the format for an HTTP request: Request URL HTTP-version
Headers
body The Request can take the form of GET, HEAD, or POST. Each request includes the version number of the HTTP client making the request. This allows HTTP servers and browsers to negotiate functional compatibility, allowing different release levels to work together.
Let’s look at the three request types in more detail. The most often used is the GET request. The GET request returns the information specified in the URL. Normally, this is the HTML document with the scripted information for the browser to display. Therefore, when you type www.ibm.com on the address line of the browser, it issues a “GET / HTTP 1.0”. The response is the HTML script for the Web page.
I estimate that over 99 percent of the requests from the browser are simple GET requests. Modifiers can be used in conjunction with GET requests. If the browser caches HTTP documents on the browser’s disk along with the date and time retrieved, then the next request for the URL will add an if-modified-since statement to the GET request so the server need not send the same information again.
In some cases, one may use the HEAD request. This request returns only the header information for the URL; it’s useful in checking for recent modifications to a URL. Push technologies that automatically update browsers use these requests.
Finally there is the POST request. The POST request allows a browser to send information along with the request. This is useful in filling out forms, for example, to order flowers over the Internet.
This is the format of an HTTP response: HTTP-version response-code response-phrase
Headers
With a flow as simple as this, it is easy to see why HTTP Web servers and browsers have become so popular. Now, let’s look at getting an HTTP server up and running on the AS/400!
HTTP on the AS/400
The AS/400 can act as a full HTTP Web server. This uses the original configuration model designed by CERN (Conseil Européen pour la Recherche Nucléaire), modified for the AS/400 platform and accessed with AS/400 commands.
The Configuration Pieces To configure HTTP on the AS/400, from a command line, type GO CFGTCP (to get to the TCP/IP configuration menu) and select option 20 (Configure TCP/IP Applications menu) as shown in Figure 1. From this menu, select option 14, Configure HTTP. From the Configure TCP/IP HTTP menu (CFGTCPHTTP), select option 1, Change HTTP attributes. This area allows you to change the autostart function and set the minimum and maximum number of server jobs. For most first-time installations, keep the defaults for all settings.
Return to the Configure TCP/IP HTTP menu (CFGTCPHTTP) and select option 14, Work with HTTP Configuration. This brings up the HTTP startup configuration screen (WRKHTTPCFG). From this flat file screen, items are defined that tell the HTTP server how to behave. Many HTTP servers call these items directives. The items defined fall into five categories: server information, actions available, allowable URLs, allowable files, and management.
Server Information
HostName—a fully qualified TCP/IP domain name, such as www.as400.com. The HostName will default to the name specified for the TCP/IP HostName with the CFGTCP command. There are times when you might want a different HostName for HTTP, but this will be the exception rather than the rule.
Port 80—Port 80 is the universally used default port number for HTTP. This port identifies incoming TCP/IP requests as destined for the HTTP Web server versus another TCP/IP application, like Telnet. Use the default.
Actions Available
Enable/Disable—allows the enabling or disabling of requests. The AS/400 allows GET, HEAD, and POST. By default, GET and HEAD are enabled, and POST is disabled. If you require the POST function for CGI scripts and/or Net.data, enable it. Several other actions are available on some HTTP servers, but the AS/400 supports only those listed.
Allowable URLs
In addition to retrieving information from an input URL, the AS/400 allows the URL to be edited before the file is retrieved. There are also mechanisms to inhibit access to directories, files, and executable programs. All of these configuration mechanisms enhance the security of the data on your AS/400, especially as Internet hackers become more sophisticated in their ability to break into systems. This is probably the most complex area for configuring HTTP on the AS/400.
The following statements are first defined, and then an example is given to show how they function.
Map /template/ /replacement / Allows you to replace a requested path. A URL request for www.as400.com/template/ can be mapped to the directory /replacement on the AS400. This is useful to keep hackers from understanding the physical makeup of your AS/400, because they do not actually see the directory structure of your AS/400. The replacement shields the world from the real directory structure.
Pass /template/ /replacement/ If the path matches the template, processing is terminated unless the replacement string is present. If the replacement string is present, use it in the resulting path. This can be used to prevent access to certain subdirectories.
Fail /template/ If the path request matches the template, access is denied. This allows you to explicitly prohibit access to areas in the AS/400.
Redirect /template/ /replacement/ Send a request to another server.
Exec /template/ /replacement/ The exec statement is used to indicate that the URL has a program to be executed by the HTTP server on behalf of the client/browser. The template is the virtual path to the program, and the replacement is the actual location of the program on the AS/400.
Let’s look at an example using the Map/Pass/Exec statements to explain how these work.
Map /pgm/ /400/pgm/*
Pass /abc/pgm/docs/*
Exec /abc/pgm/* /qsys.lib/as400_cgi.lib/*
The Map statement maps any path containing the string /pgm/ into /400/pgm/. The Pass statement prevents paths that refer to members /400/pbm/docs/ from being executed and allows them to be interpreted as resources.
The Exec statement maps /400/pgm/ into /qsys.lib/as400_cgi.lib/.
Allowable Files
These are analogous to source-type definitions in QSYS.LIB and are used to define the meaning associated with three-character file types used in DOS and OS/2 PC systems. For example, you may have CBL, TXT, HTM, and RPG already defined. These are added to the HTTP server with the addtype suffix type encoding command. An example is shown below.
AddType .prz freelance Binary *adds the freelance files to the access
list
Similar functions exist to add programs to the HTTP server list.
Management
Capturing HTTP server activity will be a critical administrative job, especially if this server is on the public Internet. It is important to watch for hackers, who may try to disrupt your system, steal information, or cause overall havoc to your business.
The access log (AccessLog log-file-name {max-size}) records information about visitors to your Web site. It is stored in QUSRSYS with the date stamp for each visitor. If you do not set a size (KB) on this file, it will grow without bound until the command STRTCPSVR SERVER(*http) RESTART(*http) is executed. The default format is DDS, which is a database file. It is suggested that you keep this format for the file. There may be performance implications if the HTTP server is experiencing a lot of activity.
The access log has a corresponding error log (ErrorLog log-file-name{max-size}). Any failing request for URL, time, or login will be recorded in it. This file also defaults to DDS or a database file format. It is recommended that you don’t change this default.
It is important to set the time of the HTTP server to your time zone. The default for the log time (LocalTimeGMT) is Greenwich Mean Time (GMT). Change this to your time zone, such as EST, PST, CST, etc. If you do not make this change, the information contained in the log files will not be easily correlated to the actual time of occurrence. It could also impact executable programs if time stamps are associated with them.
Once you have activated the logs, you can control the logging of information. Logging can be stopped based on IP address, IP network address, domain name, browser names, etc. It is best to collect all information, so you should not set any parameters in the NoLog area.
Stick with It
This may seem like a lot of work to configure the server for your business. However, the good news is that, with each new release of the product, the ease of use of the configuration process is further streamlined. Even though the current process can be rather laborious, stick with it, because most of the intricacies listed and the complexities of configuration are intended to protect your system and the information on it from unauthorized access.
 |
More than ever, there is a demand for IT to deliver innovation. Your IBM i has been an essential part of your business operations for years. However, your organization may struggle to maintain the current system and implement new projects. The thousands of customers we've worked with and surveyed state that expectations regarding the digital footprint and vision of the company are not aligned with the current IT environment.
TRY the one package that solves all your document design and printing challenges on all your platforms. Produce bar code labels, electronic forms, ad hoc reports, and RFID tags – without programming! MarkMagic is the only document design and print solution that combines report writing, WYSIWYG label and forms design, and conditional printing in one integrated product. Make sure your data survives when catastrophe hits. Request your trial now! Request Now.
Forms of ransomware has been around for over 30 years, and with more and more organizations suffering attacks each year, it continues to endure. What has made ransomware such a durable threat and what is the best way to combat it? In order to prevent ransomware, organizations must first understand how it works.
Disaster protection is vital to every business. Yet, it often consists of patched together procedures that are prone to error. From automatic backups to data encryption to media management, Robot automates the routine (yet often complex) tasks of iSeries backup and recovery, saving you time and money and making the process safer and more reliable. Automate your backups with the Robot Backup and Recovery Solution. Key features include:
Business users want new applications now. Market and regulatory pressures require faster application updates and delivery into production. Your IBM i developers may be approaching retirement, and you see no sure way to fill their positions with experienced developers. In addition, you may be caught between maintaining your existing applications and the uncertainty of moving to something new.
IT managers hoping to find new IBM i talent are discovering that the pool of experienced RPG programmers and operators or administrators with intimate knowledge of the operating system and the applications that run on it is small. This begs the question: How will you manage the platform that supports such a big part of your business? This guide offers strategies and software suggestions to help you plan IT staffing and resources and smooth the transition after your AS/400 talent retires. Read on to learn:
LATEST COMMENTS
MC Press Online