It works! — This is the default welcome page used to test the correct operation of the Apache2 server after installation on Debian systems. If you can read this page, it means that the Apache HTTP server installed at this site is working properly. You should replace this file before putting your server online.
If you are a normal user of this web site and don't know what this page is about, this probably means that the site is currently unavailable due to maintenance. If the problem persists, please contact the site's administrator.
Configuration Overview
Debian's Apache2 default configuration is different from the upstream default configuration, and split into several files optimised for interaction with Debian tools. The configuration system is fully documented in /usr/share/doc/apache2/README.Debian.gz. Refer to this for the full documentation. Documentation for the web server itself can be found by accessing the manual if the apache2-doc package was installed on this server.
The configuration layout for an Apache2 web server installation on Debian systems is as follows:
| /etc/apache2/ | Main Apache2 configuration directory |
| /etc/apache2/apache2.conf | Main configuration file. It puts together all remaining configuration components when starting the web server. |
| /etc/apache2/ports.conf | Declares the specific TCP ports that Apache2 listens to. |
| /etc/apache2/mods-enabled/ | Contains symlinks to available modules in mods-available/. Use a2enmod / a2dismod to manage. |
| /etc/apache2/conf-enabled/ | Holds active global configuration fragments. Use a2enconf / a2disconf to manage. |
| /etc/apache2/sites-enabled/ | Contains symlinks to site definitions in sites-available/. Use a2ensite / a2dissite to manage. |
Document Roots
By default, Debian does not allow access through the web browser to any file apart of those located in /var/www, public_html directories (when enabled) and /usr/share (for web applications). If your site is using a web document root located elsewhere (such as in /srv) you may need to whitelist your document root directory in /etc/apache2/apache2.conf.
The default Debian document root is /var/www/html. You can make your own virtual hosts under /var/www. This is different to previous releases which provides better security out of the box.
Debian jessie and later ship Apache with a hardened configuration by default. In particular, the following security features are enabled:
- The ServerTokens directive is set to Prod to minimise information disclosure.
- TraceEnable is set to Off to prevent certain cross-site tracing attacks.
- The ServerSignature is disabled by default.
- Options FollowSymLinks is disabled globally; symlinks that cross document roots are restricted.
- The mod_status and mod_info modules are disabled by default.
Reporting Problems
Please use the reportbug tool to report bugs in the Apache2 package with Debian. However, check existing bug reports before reporting a new bug. If you need to report a security vulnerability, please contact the Debian Security Team.
For questions related to Debian packaging of Apache2, refer to the debian-apache mailing list. For general Apache2 questions, refer to the official Apache mailing lists. For general Debian questions, see the Debian support pages.
More information about Debian GNU/Linux is available from the Debian Project.