Safe Passage

Hugo Leisink was frustrated. Although he had already tried out various web servers, none of them were really convincing. In his opinion, the configuration tools were cryptic and the security features were limited. Leisink's concerns about the state of the web server craft prompted him to develop his own web server in January 2002.

The end of the story is Hiawatha, a light web server with good performance and some innovative security functions. Hiawatha's small size of just 600KB makes it perfect for deployment on embedded devices or less powerful machines.

Installation

Hiawatha is easy to install: Just download the current package from the homepage [1], unpack it, and run the typical set of three commands:

./configure
make
sudo make install

Hiawatha's minimum requirements are a C compiler and the libc6 (alias glibc2) library (typically libc6-dev, or glibc-devel). If any other dependencies are missing, the configure script will not warn you, but will, instead, simply disable the corresponding functionality.

Thus, it is a good idea to have a quick look at the log created by the script. If you don't have the OpenSSL library (libssl), you will have to do without encryption, and thus https connections. XSLT (Extensible Stylesheet Language Transformations) support is also optional; you need the --enable-xslt configure parameter and the libxslt library to tell the web server to use XSLT.

One for All

Hiawatha parses all of its settings from a single, small configuration file called httpd.conf, which resides in the /usr/local/etc/hiawatha directory by default. httpd.conf has some useful defaults and a number of commented lines you can use as templates, but you should give it a quick check to make sure the settings are correct before you run the web server for the first time.

Additionally, you can simply create a new configuration file on the fly – a feat that would make Apache stand back in amazement. Before you save a new configuration file, make sure you rename the original httpd.conf so you will have a working configuration to fall back on if you have problems.

Connection-Shy

The httpd.conf file starts by telling the web server which port on which network interface to listen on for incoming requests. The port is handled by the binding:

Binding {
      Port = 80
      Interface = 192.169.2.123
}

This command tells Hiawatha to listen on the network interface with the IP address of 192.169.2.123 for incoming requests using the default port for web servers (port 80). As the example shows, the structure of the configuration file is really simple: The web server expects exactly one setting in each line, and each setting comprises a name, an equals sign, and the matching value.

To bind Hiawatha to another interface, simply add a second Binding section, as follows:

Binding {
      Port = 443
      Interface = 192.168.2.124
}

If you want the web server to listen for requests on all your network interfaces, a single Binding section without an Interface specification will suffice.