DACS.INSTALL(7)         DACS Miscellaneous Information         DACS.INSTALL(7)



[1mNAME[0m
       dacs.install - [1mDACS [22minstallation guide

[1mDESCRIPTION[0m
       This document describes how to configure and install this release of
       [1mDACS[22m. Please read it carefully.

           [1mImportant[0m
           +o   Installation requires the GNU [1mmake [22mcommand ([34m[1mgmake[0m[1m[22m[1]) and
               [34m[1mGCC[0m[1m[22m[2].

           +o   The examples here and in other [1mDACS [22mdocumentation assume that
               [1mDACS [22mis installed in its default location, /usr/local/dacs. If
               you specify a different location at build time, please keep
               this in mind as you read the documentation. This also applies
               to third-party packages, which you may install where
               convenient, provided you are careful not to confuse or combine
               different versions of the same package; in this document's
               examples we install them under /usr/local and unpack their
               source code under /local/src.

           +o   In some command line examples, long lines have been split to
               improve readability; copying and pasting may not work.

           +o   Whenever you upgrade to a more recent version of [1mDACS[22m, please
               do not forget to install the [1mmod_auth_dacs [22mmodule that comes
               with your new version of [1mDACS[22m.

           +o   Please pay careful attention to the descriptions of the
               third-party packages below. Our philosophy is that [1mDACS [22mshould
               be used with the most recent stable versions of third-party
               packages available at the time [1mDACS [22mis released. This helps to
               ensure that a [1mDACS [22mdeployment has the latest security features
               and bug fixes.

               You should build third-party packages in the order in which
               they are discussed below because packages that are discussed
               earlier may require some that appear later.

               For a few third-party packages, it is important that you use
               the [4mexact[24m [4mversion[24m that is mentioned. Do not use anything newer
               or older.

               For some third-party packages, a particular release is
               [4mrecommended[24m. It is less critical that you use the recommended
               release, but older releases may have important bugs, including
               security problems. A release newer than the one(s) specified
               will not have been tested with [1mDACS [22m- and a release older than
               the one(s) specified may not have been tested with [1mDACS [22m- so if
               you choose to use such a release you are on your own.

               You may save yourself time and headaches if you just use the
               recommended releases.

               Sometimes the recommended version of a third-party package will
               be fine on some platforms but will not build or is buggy on
               another platform. Whenever possible, the [1mDACS [22minstallation
               instructions suggest an alternative version, and you may
               proceed with that version, or a recent version of your choice -
               but keep the preceding comments regarding older releases in
               mind and ensure that a "[1mgmake test[22m" of [1mDACS [22mcompletes
               successfully.

           +o   On Mac OS X you will probably need to install the [34m[1mXcode[0m[1m[22m[3]
               development environment.

           +o   On some systems it will be necessary to use [34m[1mldconfig(8)[0m[1m[22m[4] (or
               equivalent) so that your system finds the correct shared
               libraries for programs that are executed by the web server,
               including the [1mDACS [22mweb services.


   [1mTrying DACS[0m
       If at this time you only want to try [1mDACS [22mrather than doing a full
       install, review the information below regarding third-party packages
       and then proceed to follow the instructions you will find in
       [34m[1mdacs.quick(7)[0m[1m[22m[5], which is a step-by-step tutorial for installing and
       configuring [1mDACS[22m.

   [1mUpgrading DACS[0m
       If [1mDACS [22m1.4 is already installed on your system and you are not
       changing any third-party packages or installation options, for a "quick
       and dirty" upgrade you can often install a new release on top of a
       previous release. While this will leave your existing [1mDACS[0m
       configuration files alone, it will also leave files that are no longer
       needed by the new [1mDACS[22m. Be sure to check the new distribution's release
       notes and the rest of this manual page for any notable differences and
       incompatibilities - you may need to make some adjustments to your
       pre-existing installation.

       It is possible for minor, incompatible changes introduced by a new
       release to cause temporary, user-visible problems. For example, changes
       to the format of credentials might invalidate sessions (i.e., [1mDACS [22mHTTP
       cookies) issued by the earlier release, requiring users to
       reauthenticate.

        1. Make a backup copy of the previous install, just in case.  [4mIt[24m [4mis[0m
           [4mespecially[24m [4mimportant[24m [4mto[24m [4mmake[24m [4mcopies[24m [4mof[24m [4mall[24m [4mdata[24m [4mfiles[24m [4m(such[24m [4mas[24m [1mDACS[0m
           [4mpassword[24m [4mfiles,[24m [4mother[24m [4mkinds[24m [4mof[24m [4maccount[24m [4mfiles,[24m [4mencryption[24m [4mkeys)[24m [4mand[0m
           [4many[24m [4mcustom[24m [4mconfiguration[24m [4m(such[24m [4mas[24m [4maccess[24m [4mcontrol[24m [4mrules)[24m.

        2. Obtain and unpack the new distribution and [1mchdir [22mto it;

        3. Review [34m[1mdacs.readme(7)[0m[1m[22m[6] and the instructions in this document;

        4. Copy src/config.nice from your installed version to the new src
           directory, make any updates and corrections that are necessary, and
           configure [1mDACS[22m:

               % cd src; sh ./config.nice


        5. Build [1mDACS[22m:

               % gmake


        6. We recommend that you remove some of the files from the previous
           release in case they are no longer required or have been renamed.
           Unless you have put non-standard files in them or made non-standard
           customizations, it is safe to simply delete these directories and
           their contents:

               % rm -f -r /usr/local/dacs/{acls,bin,include,lib,man,www}


        7. Stop [1mhttpd[22m:


               % apachectl stop


        8. Install [1mDACS[22m:

               % gmake install


        9. Make and install the latest [34m[1mmod_auth_dacs module[0m[1m[22m[7]:

               % cd ../apache; gmake tag install


       10. Restart [1mhttpd[22m:

               % apachectl start

           or

               % apachectl startssl


       11. Check that [1mDACS [22mappears to be working correctly. You may find it
           handy to construct a set of links or bookmarks that you can use
           after installing or configuring [1mDACS [22mto invoke various [1mDACS [22mweb
           services with appropriate arguments; for instance, try
           [34m[1mdacs_authenticate(8)[0m[1m[22m[8] [34m[1mdacs_current_credentials(8)[0m[1m[22m[9],
           [34m[1mdacs_prenv(8)[0m[1m[22m[10], [34m[1mdacs_list_jurisdictions(8)[0m[1m[22m[11],
           [34m[1mdacs_conf(8)[0m[1m[22m[12], [34m[1mdacs_signout(8)[0m[1m[22m[13], and [34m[1mdacs_version(8)[0m[1m[22m[14].
           Review the [1mDACS [22mlog file for any error messages or warnings.

   [1mDACS on Windows[0m
       [1mDACS [22mis not currently supported on Microsoft Windows platforms.
       [34m[1mCygwin[0m[1m[22m[15], which provides a GNU/Linux-like environment for Windows, is
       not an officially-supported platform, but [1mDACS [22mreleases usually build
       on it.

       To run [1mDACS [22mutilities and commands on Windows (such as [1mdacscheck[22m), it
       appears to be sufficient to install the binaries along with the Cygwin
       run-time libraries that they require, such as /bin/cygwin1.dll and
       /bin/cygcrypt-0.dll.

   [1mInstalling DACS[0m
       The following describes how to install [1mDACS[22m.

           [1mImportant[0m
           +o   If another release of [1mDACS [22mis present, rename your previous
               release, install the new release, and then copy any
               site-specific configuration files from the previous release to
               the new release.

           +o   Be careful not to mix [1mDACS [22mbinaries and support files from
               different releases; this can lead to strange behaviour that is
               often hard to resolve.

           +o   If you are installing or upgrading a third-party package, make
               sure that you are building it against the correct include files
               and libraries (e.g., that the [1mDACS [22mbuild is not finding an old
               version, or using include files from one version and library
               files from a different version, or that [1mhttpd [22mis trying to use
               the wrong version of an [1mOpenSSL [22mlibrary). This is frequently
               the cause of build and run-time problems.

        1. Unpack the [1mDACS [22mdistribution and move to its root directory.

        2. Familiarize yourself with the system by:

           +o   reading this document;

           +o   running:

                   % src/configure --help


           +o   browsing through the documentation (best done by loading
               [34m[1mman/index.html[0m[1m[22m[16] into your browser);

           +o   deciding where you want the various components to be installed;
               and

           +o   considering which optional features you may want (you can
               easily make changes at any time, so do not be too concerned
               about this).

            3. A few third-party packages are [4mrequired[24m by [1mDACS [22mand must be
               built before [1mDACS [22mcan be configured and built. Please note
               carefully if any special exceptions apply to your particular
               platform and third-party package needs. Although you may have
               better luck, sometimes we experienced problems building the
               recommended packages (or combinations of packages) on certain
               platforms; whenever possible, we try to provide a workable
               alternative. Late-breaking updates are sometimes available in
               the release's [34m[1mPost-Release Notes[0m[1m[22m[17].

                   [1mImportant[0m
                   It is not necessary to actually [4minstall[24m these packages, you
                   only have to [4mbuild[24m them so that the [1mDACS [22mbuild can use
                   their libraries, include files, and so on, directly from
                   where you build the packages. You may chose to do this if
                   you do not want to upgrade an existing version of the
                   package, or if you are unable to do so.

                   Build these packages [4min[24m [4mthe[24m [4morder[24m [4min[24m [4mwhich[24m [4mthey[24m [4mare[24m [4mlisted[0m
                   [4mbelow[24m.

                   If you install a package, you may need to be root or use
                   [34m[1msudo(8)[0m[1m[22m[18] (e.g., "[1msudo make install[22m").

                   These packages are not distributed with [1mDACS [22mand have
                   licensing terms completely separate from those of [1mDACS [22mthat
                   are your responsibility.

               [1mThird-Party Package Index:[0m

               +o   [1mExpat[22m: XML parser

               +o   [1mOpenSSL[22m: Crytographic toolkit

               +o   [1mApache[22m: Web server

               +o   Berkeley DB, gdbm, ndbm: dbm-type database libraries

               +o   [1mSQLite[22m: SQL database engine

               +o   [1mSamba[22m: Microsoft Windows interoperability suite

               +o   libxml2, xmlsec1: XML toolkit and security libraries

               +o   [1mOpenLDAP[22m: Lightweight Directory Access Protocol software

               +o   Readline: Command line history and editing

                1. Install the Expat XML parser

                   This release of [1mDACS [22mhas been tested with [34m[1mExpat[0m[1m[22m[19] 2.1.0
                   and we recommend that you use that release.

                   For use with [1mDACS[22m, [1mExpat [22mcan either be built with
                   [1m-prefix=/usr/local [22mor something like
                   [1m-prefix=/usr/local/expat-2.1.0[22m, whichever you prefer. In
                   the former case, you can omit the [1m--with-expat [22mwhen
                   configuring [1mDACS [22mor use [1m--with-expat=/usr/local[22m, and in the
                   latter case you must use
                   [1m--with-expat=/usr/local/expat-2.1.0[22m. Here is how we usually
                   build [1mExpat [22mafter unpacking it:

                       % cd expat-2.1.0
                       % ./configure --prefix=/usr/local/expat-2.1.0
                       % make
                       (All should go well.)
                       % make install
                       (All should go well here, too.)


                       [1mNote[0m
                       On Win2K/Cygwin, only a static library is needed. From
                       the root of the [1mexpat [22mdistribution directory:

                           % cd lib; ar rv libexpat.a *.o; ranlib libexpat.a

                       If the build fails, reconfigure using
                       [1m--enable-shared=no [22mand [1m--enable-static=yes [22mand try to
                       build it again.

                2. Install [1mOpenSSL[0m

                   [1mDACS [22muses cryptographic functionality provided by
                   [34m[1mOpenSSL[0m[1m[22m[20]. This release of [1mDACS [22mhas been tested with
                   openssl-1.0.1e and we recommend that you use that release
                   with [1mDACS[22m.  [1mApache [22mshould be built using the version of
                   [1mOpenSSL [22mrecommended by the particular [1mApache [22mrelease -
                   using a more recent version of [1mOpenSSL [22mmay introduce build
                   problems or run-time bugs in [1mApache[22m.  [4mIt[24m [4mis[24m [4mnot[24m [4mnecessary[0m
                   [4mfor[24m [1mApache [4m[22mand[24m [1mDACS [4m[22mto[24m [4muse[24m [4mthe[24m [4msame[24m [4mrelease[24m [4mof[24m [1mOpenSSL[22m.

                       [1mNotes[0m
                       +o   Releases of [1mApache [22mprior to 2.0.55 do not work (as
                           shipped) with [1mOpenSSL [22m0.9.8 or newer.

                       +o   [1mDACS [22mwill probably work with openssl-1.0.0x,
                           although those versions are no longer officially
                           supported.  [1mDACS [22mwill not work with
                           openssl-0.9.8[mno] ("[1mgmake test[22m" fails);
                           openssl-0.9.8l is the last of the
                           pre-openssl-1.0.0x releases at one time known to
                           work correctly with [1mDACS[22m.

                       +o   If you need InfoCard support and you have upgraded
                           to openssl-1.0.0 or newer, it may be necessary to
                           rebuild [34m[1mxmlsec1[0m[1m[22m[21] against the new library (if you
                           need to rebuild, "[1mgmake test[22m" will fail).

                       +o   When building openssl-0.9.8j on FreeBSD 7.0,
                           problems were encountered that caused "[1mmake[0m
                           [1minstall[22m" to fail; corrections to Makefiles under
                           the fips subdirectory solved the problem.

                       +o   On OpenSolaris, more serious problems building
                           openssl-0.9.8j and openssl-0.9.8k were found and
                           neither could be successfully completed; with the
                           same options and environment, openssl-0.9.8i and
                           openssl-0.9.8l built without incident, however, and
                           the latter was used for testing on that platform.
                           There were also problems forcing the runtime linker
                           to use [1mOpenSSL [22mlibraries other than the default
                           system versions, despite the guidance of the
                           relevant manual pages; it was necessary to set
                           [1mLD_LIBRARY_PATH [22mappropriately (use [1mdacsversion -v[0m
                           to verify that the expected libraries are being
                           used at runtime). Note that OpenSolaris is no
                           longer a supported platform.

                       +o   If you are enabling [1mDACS [22msupport for Java, add the
                           [1m-fPIC [22mflag to [1mconfig [22mwhen you are building [1mOpenSSL[22m.

                       +o   In some configurations you may want or require
                           shared [1mOpenSSL [22mlibraries; if so, add the [1mshared[0m
                           command line flag to [1mconfig [22mwhen building [1mOpenSSL[22m.

                       +o   Solaris 8 (and perhaps other platforms) may require
                           [34m[1ma patch[0m[1m[22m[22] before [1mOpenSSL [22mwill work properly.
                           Please consult the latest [1mOpenSSL [22mdocumentation.

                       +o   For Solaris 10 x86, review [1mOpenSSL's [22mPROBLEMS file
                           to see if you must apply a patch before [1mOpenSSL[0m
                           will compile correctly with [1mGCC[22m.

                       +o   Here is how we built [1mOpenSSL[22m:

                               % ./config --prefix=/usr/local/openssl-1.0.1e --openssldir=/usr/local/openssl-1.0.1e -fPIC shared


                       +o   On Mac OS X, however, it was necessary to
                           explicitly request a 64-bit build of [1mOpenSSL[22m:

                               % ./Configure darwin64-x86_64-cc --prefix=/usr/local/openssl-1.0.1e --openssldir=/usr/local/openssl-1.0.1e -fPIC shared


                    3. Install Apache 2.4.3 or 2.2.23

                       You will need an SSL-capable [34m[1mApache[0m[1m[22m[23] server (build
                       [1mApache [22mwith [1m--enable-ssl[22m) that uses a recent version of
                       [1mOpenSSL [22m(build [1mApache [22musing [1m--with-ssl=[4m[22mpath[24m, see
                       [34m[1mabove[0m[1m[22m[24]).

                           [1mTip[0m
                           You can install a subset of [1mDACS [22mthat does not
                           require [1mApache [22mand does not require [4many[24m [1mDACS[0m
                           configuration. These stand-alone, general-purpose
                           utility commands, such as [1mdacshttp [22mand [1msslclient[22m,
                           might be of interest to you even if you are not
                           interested in any other parts of [1mDACS[22m. Look for
                           BASIC_PROGS in Makefile.in to see which commands
                           will be installed.

                           To build this subset, use [1m--with-apache=omit [22mwhen
                           running [1mconfigure[22m. Please continue to review the
                           information about third-party packages in this
                           document, but you can ignore anything that follows
                           that is related to [1mApache [22mand [1mmod_auth_dacs[22m.
                       If you want to use [34m[1mmod_auth_dacs[0m[1m[22m[7] as a dynamic
                       module, which is the recommended configuration, make
                       sure that [1mmod_so [22mis built-in to your [1mhttpd [22m("httpd -l"
                       displays a list).

                           [1mImportant[0m
                           +o   This release of [1mDACS [22mhas been tested with both
                               [1mApache [22m2.2.23 and [1mApache [22m2.4.3. We strongly
                               recommend that you use either of those
                               versions. If necessary, [1mDACS [22mwill probably also
                               work with 2.0.51 and newer, or 2.2.2 and newer,
                               but not with releases older than that.

                           +o   If suitable APR, APR-UTIL, and other support
                               libraries have already been installed on your
                               system, you may be able to perform a basic
                               build and install of [1mApache [22m2.4 with a command
                               like:

                                   % cd httpd-2.4.3
                                   % ./configure --prefix=/usr/local/apache2-2.4.3 --enable-ssl \
                                         --with-ssl=/usr/local/openssl-1.0.1e
                                   % make install

                               Detailed instructions for building [1mApache [22m2.4.3
                               can be found in Apache's INSTALL file. For the
                               testing platforms, we get the APR and APR-UTIL
                               libraries from [34m[1mapr.apache.org[0m[1m[22m[25] and unpack
                               them in the Apache distribution's srclib
                               directory, then rename them srclib/apr and
                               srclib/apr-util, respectively, as it says in
                               INSTALL. We currently use apr-1.4.6 and
                               apr-util-1.5.1. When building [1mhttpd[22m, run
                               [1mconfigure [22mwith the [1m--with-included-apr [22mflag.

                               On CentOS 5.9, the [1mApache [22mbuild initially
                               failed with a complaint about not finding
                               [1mpcre-config[22m. To solve this, we did:

                                   yum install pcre-devel.x86_64

                               When configuring for the [1mDACS [22mbuild it was not
                               necessary to use the [1m--with-apache-apr [22mflag.

                           +o   When building [1mApache [22m2.2, running [1mconfigure [22mas
                               shown above will work in some cases
                               (distributions of the 2.2 branch include the
                               APR and APR-UTIL libraries). Nevertheless, we
                               usually first build and install APR
                               (srclib/apr) and APR-UTIL (srclib/apr-util),
                               and then build [1mhttpd [22musing the [1m--with-apr [22mand
                               [1m--with-apr-util [22mflags. This may be helpful to
                               know if you run into problems. Also, if you
                               encounter problems building [1mdacsversion[22m, it may
                               be necessary for you to go back and build APR
                               with the [1m--disable-lfs [22mflag to disable large
                               file support on your platform. When you build
                               [1mDACS [22min an upcoming step, you will probably
                               need to use the [1m--with-apache [22mand
                               [1m--with-apache-apr [22mflags (see [34m[1mThird-party[0m
                               [1m[34msupport options[0m[1m[22m[26]). If you are going to use
                               the [1m--with-berkeley-db [22mflag when building
                               APR-UTIL (e.g.,
                               [1m--with-berkeley-db=/usr/local/BerkeleyDB.5.1[22m),
                               you may want to temporarily skip ahead to [34m[1mbuild[0m
                               [1m[34mBerkeley DB[0m[1m[22m[27] before returning here to
                               continue your [1mApache [22mbuild. (Note: it appears
                               that apr-util 2.2.23 will not work with
                               versions of Berkeley DB newer than 5.1; refer
                               to documentation for its [1m--with-dbm [22mflag).

                           +o   Here is how we built [1mApache [22m2.2 after unpacking
                               it:

                                   % cd httpd-2.2.23
                                   % cd srclib/apr
                                   % ./configure --prefix=/usr/local/apache2-2.2.23/apr-httpd --disable-lfs CFLAGS=-fPIC
                                   % make install
                                   % cd ../apr-util
                                   # See notes below for adding LDFLAGS
                                   % ./configure --prefix=/usr/local/apache2-2.2.23/apr-util-httpd
                                          --with-apr=/usr/local/apache2-2.2.23/apr-httpd
                                          --with-expat=/usr/local/expat-2.0.1
                                          --with-dbm=db51
                                   % make install
                                   % cd ../..
                                   # See notes below for adding LDFLAGS
                                   % ./configure --prefix=/usr/local/apache2-2.2.23 --enable-ssl
                                          --with-ssl=/usr/local/openssl-1.0.1e
                                          --with-apr=/usr/local/apache2-2.2.23/apr-httpd
                                          --with-apr-util=/usr/local/apache2-2.2.23/apr-util-httpd
                                          LDFLAGS="-rpath /usr/local/db-5.1.29/lib -rpath /usr/local/openssl-1.0.1e/lib"
                                   % make install

                               This builds a very basic server; you can enable
                               other options if you want.

                               Because we deal with multiple versions of
                               third-party packages, each release is installed
                               separately, hence the version numbers in the
                               pathnames.

                               Your mileage may vary, but when doing the top
                               level [1mApache [22mconfiguration above on FreeBSD it
                               was necessary to add "-rpath
                               /usr/local/db-5.1.29/lib -rpath
                               /usr/local/openssl-1.0.1e/lib" to [4mLDFLAGS[24m so
                               that Apache commands could find shared
                               libraries at run time.

                               On Linux, it was necessary to add "-Wl,-rpath
                               /usr/local/db-5.1.29/lib -Wl,-rpath
                               /usr/local/openssl-1.0.1e/lib" to [4mLDFLAGS[24m when
                               building apr-util and at the top level.

                               Alternatively, on either platform the [1mldconfig[0m
                               command or [1mLD_LIBRARY_PATH [22mmight be used.

                               It appears that the [4mLDFLAGS[24m above should be
                               omitted on Mac OS X.

                           +o   In some configurations an "undefined
                               ssl_hook_Fixup symbol" error or "Cannot load
                               modules/mod_ssl.so into server" error is
                               produced by [1mhttpd [22mwhen it starts up. This was
                               also seen in earlier releases of [1mApache[22m. These
                               errors can be due to an apparent bug in the
                               [1mApache [22mbuild procedure that results in the
                               [1mmod_ssl [22mmodule not knowing where libssl.so and
                               libcrypto.so are, even though the correct path
                               was specified at Apache build time through the
                               [1m--with-ssl [22mflag to [1mconfigure[22m.

                               One solution is to make [1mmod_ssl [22ma built-in
                               module instead of a dynamically loaded module.
                               Build [1mApache [22musing something similar to this
                               (using the [1m--enable-ssl=static [22mflag is the
                               important change):

                                   % ./configure --prefix=/usr/local/apache2-2.4.3 --with-ssl=/usr/local/openssl-1.0.1e --enable-ssl=static

                               Then do a "[1mmake install[22m". Note that you will
                               need to comment out the httpd.conf directive
                               that loads [1mmod_ssl[22m:

                                   # LoadModule ssl_module modules/mod_ssl.so

                               Now, from the [1mApache [22minstallation directory,
                               try:

                                   % bin/httpd -l

                               If [1mhttpd [22mcannot find your [1mOpenSSL [22mlibraries,
                               you will see an error message like this:

                                   error while loading shared libraries: libssl.so.1.0.0: cannot open shared object file: No such file or directory

                               Tell the linker where the [1mOpenSSL [22mlibraries are
                               by setting the [1mLD_LIBRARY_PATH [22menvironment
                               variable for [1mhttpd[22m; for example:

                                   %  sh -c "export LD_LIBRARY_PATH=/usr/local/openssl-1.0.1e/lib; bin/httpd -M"

                               You may also be able to resolve the problem
                               using the [1mldconfig [22mcommand, but we don't know
                               if that could possibly break other programs
                               that expect a different version of the [1mOpenSSL[0m
                               library. You will need to always set
                               [1mLD_LIBRARY_PATH [22mbefore running [1mhttpd[22m, maybe
                               using an alias or script. If you use [1mapachectl[0m
                               to manage [1mApache[22m, you could simply have it set
                               [1mLD_LIBRARY_PATH [22m(also see the [1mApache envvars[0m
                               script, which is sourced by [1mapachectl[22m).

                           +o   One difference to be aware of between the
                               [1mApache [22m2.0 branch and subsequent branches is
                               that the default [1mApache [22mconfiguration of the
                               newer branches may deny all access by default;
                               some [1mDACS [22mfiles should be publicly accessible,
                               however, so you may need to explicitly allow
                               this. For example, in httpd.conf:

                                   <Directory /usr/local/dacs/www>
                                     Satisfy Any
                                     Allow from all
                                     Options Indexes FollowSymLinks
                                   </Directory>


                           +o   [1mApache [22m1.3 is [4mnot[24m supported; please consult the
                               [34m[1mFAQ[0m[1m[22m[28].  [1mDACS [22mhas not been tested with [1mApache[0m
                               2.3 or 2.4.

                           +o   We do not support using [1mmod_auth_dacs [22mwith a
                               non-source install of [1mApache[22m; we have received
                               feedback that it can be done manually without
                               much effort, however. In this case, we believe
                               that the install may go more smoothly if you
                               use the configure flag [1m--disable-shared[22m.

                           [1mTip[0m
                           Check that [1mApache [22mis working properly and that it
                           is actually using the version of [1mOpenSSL [22mthat you
                           are expecting. It is important to confirm that your
                           server is working correctly with your web resources
                           [4mbefore[24m [1mDACS [22mgets involved - doing so can save you
                           time and frustration.

                           You can see your [1mhttpd's [22mServer response-header by
                           connecting to your server (e.g., using [1mtelnet[22m) and
                           engaging in an interaction with it similar to the
                           following (note the last line of output):

                               % telnet localhost 80
                               Trying 127.0.0.1...
                               Connected to localhost
                               Escape character is '^]'.
                               GET / HTTP/1.0

                               HTTP/1.1 200 OK
                               Date: Tue, 30 Aug 2011 21:27:17 GMT
                               Server: Apache/2.2.23 (Unix) mod_auth_dacs/1.4.27(Release date 17-Oct-2012 00:00:01) mod_ssl/2.2.23 OpenSSL/1.0.1c

                4. A few third-party packages are [4moptional[24m and whether you
                   need them depends on which optional features of [1mDACS [22myou
                   require. These packages must be built before [1mDACS [22mcan be
                   configured and built. If you decide you want to add or
                   remove optional capabilities after building [1mDACS[22m, it is
                   easy to do so later.

                       [1mTip[0m
                       If you are new to [1mDACS[22m, it may be a good idea to first
                       build it without any optional packages. After you have
                       gotten the basic system working to your satisfaction,
                       rebuild [1mDACS [22mwith the optional components you need. Or,
                       if you are not sure at this time which optional
                       packages you need, return to this step later.

                    1. Berkeley DB, gdbm, ndbm DB (dbm-type databases)

                       If you want to be able to store [1mDACS [22mconfiguration
                       information in a database or need to access files
                       managed by [1mApache's mod_auth_dbm[22m, you may use [34m[1mBerkeley[0m
                       [1m[34mDB[0m[1m[22m[29] from [34m[1mOracle Corporation[0m[1m[22m[30] (Sleepy Cat Software
                       was acquired by Oracle in February, 2006). A suitable
                       version may already be installed on your system.
                       Version db-5.3.21 is being used for testing, but
                       somewhat older or newer versions should be fine. See
                       the [1mDACS [22mconfigure arguments: [34m[1m--enable-bdb[0m[1m[22m[31],
                       [34m[1m--disable-bdb[0m[1m[22m[32], and [34m[1m--with-bdb[0m[1m[22m[33].

                           [1mTip[0m
                           You may find that you must sign on to the Oracle
                           site before it allows you to download Berkeley DB.
                           You may be able to avoid this by using a URL such
                           as
                           http://download.oracle.com/berkeley-db/db-5.3.21.tar.gz,
                           or you may be able to obtain BDB elsewhere (such as
                           at linux.softpedia.com, pkgs.fedoraproject.org, or
                           fossies.org). Consider validating the downloaded
                           file using a checksum published on a different
                           site, however.
                       The default is to use Berkeley DB if it is available,
                       but if you do not want to use Berkeley DB you can
                       disable it ([34m[1m--disable-bdb[0m[1m[22m[32]) and get similar
                       functionality from the NDBM library, or from GNU GDBM
                       (version 1.8.3, 1.9.1, or 1.10) in its NDBM
                       compatibility mode. These libraries may already be
                       installed on your system. Get GDBM from
                       [34m[1mftp://ftp.gnu.org/gnu/gdbm[0m[1m[22m[34]. See the
                       [34m[1m--enable-ndbm[0m[1m[22m[35] and [34m[1m--enable-gdbm[0m[1m[22m[36] configure
                       flags.

                           [1mNotes[0m
                           +o   It may be necessary to create (or update) links
                               to the Berkeley DB installation directory to
                               avoid problems when building other packages.
                               For example, if you install it in
                               /usr/local/bdb-5.3.21:

                                   % ln -sf /usr/local/bdb-5.3.21 /usr/local/BerkeleyDB.5.3
                                   % ln -sf /usr/local/bdb-5.3.21 /usr/local/db53


                           +o   Here is how we built Berkeley DB for [1mDACS [22mafter
                               unpacking it:

                                   % cd build_unix
                                   % ../dist/configure --prefix=/usr/local/bdb-5.3.21
                                   % make
                                   (All should go well.)
                                   % make install
                                   (All should go well here, too.)


                           +o   You cannot use both [1m--enable-ndbm [4m[22mand[0m
                               [1m--enable-gdbm[22m, but you can use either one along
                               with [1m--enable-bdb[22m.

                           +o   GNU GDBM 1.9.1 and newer may not interoperate
                               correctly with databases created by older
                               versions of GNU GDBM; consult its source code
                               and documentation for details.

                           +o   A deficiency in configuration processing is
                               that the locations of the GNU GDBM and NDBM
                               libraries cannot be specified; the standard
                               configuration search path is used. A future
                               version should provide [1m--with-gdbm [22mand
                               [1m--with-ndbm [22mflags.

                           +o   The NDBM-workalike, [34m[1msdbm[0m[1m[22m[37], is not currently
                               supported. It may be added to a future release,
                               however, particularly if it is requested.

                    2. SQLite

                       The [34m[1mSQLite[0m[1m[22m[38] database, which can be used together
                       with the [34m[1mdbm-type databases[0m[1m[22m[27], is another option for
                       storing [1mDACS [22mconfiguration information. Version
                       3.7.14.1 is being used for testing (we use the
                       "autoconf" tarball). See the [1mDACS [22mconfigure arguments:
                       [34m[1m--enable-sqlite[0m[1m[22m[39], [34m[1m--disable-sqlite[0m[1m[22m[40], and
                       [34m[1m--with-sqlite[0m[1m[22m[41].

                           [1mNotes[0m
                           +o   Here is how we built SQlite:

                                   % ./configure --prefix=/usr/local/sqlite-3.7.14.1


                        3. [1mSamba[0m

                           If you want to be able to authenticate against
                           Microsoft NTLM (see [34m[1mlocal_ntlm_authenticate[0m[1m[22m[42]),
                           you must obtain [34m[1mSamba[0m[1m[22m[43]. This release of [1mDACS [22mhas
                           been tested with samba-3.6.12, and we strongly
                           recommend that you use that version. It is not
                           known whether this release of [1mDACS [22mwill work with
                           any other version of [1mSamba [22m- we do not officially
                           support them.

                           [1mDACS [22mNTLM authentication has been tested against
                           Windows Server 2012.

                               [1mNote[0m
                               [1mDACS [22mrequires the [1mSamba [22msource distribution to
                               be [4mbuilt[24m but it does not matter if [1mSamba [22mis
                               [4minstalled[24m. The [1mDACS [22mbuild procedure looks for
                               include files and libraries relative to the
                               [1mSamba [22mdistribution's root directory.
                           To build [1mSamba [22mfor [1mDACS[22m, from your [1mSamba[0m
                           distribution's ./source3 directory do:

                               % ./configure --enable-static=yes --with-ads=no --with-ldap=no --disable-swat --disable-cups --disable-pie \
                                   --enable-external-libtalloc=no --enable-external-libtdb=no
                               % make

                           Then, when configuring [1mDACS[22m, specify the directory
                           where [1mSamba [22mwas unpacked, for example:

                               --with-samba=/local/src/samba-3.6.12

                           See the [1mDACS [22mconfigure arguments:
                           [34m[1m--enable-ntlm-auth[0m[1m[22m[44] and [34m[1m--with-samba[0m[1m[22m[45].

                        4. libxml2 and xmlsec1

                           If you need InfoCard support (see
                           [34m[1mlocal_infocard_authenticate[0m[1m[22m[46]), [34m[1mlibxml2[0m[1m[22m[47] and
                           [34m[1mxmlsec1[0m[1m[22m[21] are required. Build libxml2 and [1mOpenSSL[0m
                           first, because [34m[1mxmlsec1[0m[1m[22m[21] depends on both of them.
                           This release of [1mDACS [22mhas been tested with
                           libxml2-2.9.0 and xmlsec1-1.2.18, and we strongly
                           recommend that you use those versions. It is not
                           known whether this release of [1mDACS [22mwill work with
                           any other versions - we do not officially support
                           them.

                               [1mNotes[0m
                               +o   Here is how we built libxml2:

                                       % ./configure --prefix=/usr/local/libxml2-2.9.0

                                   Due to an apparent bug in the code (in
                                   threads.c) that results in a syntax error,
                                   it was necessary to add [1m--with-threads=no[0m
                                   on some platforms, such as Mac OS X.

                               +o   Here is how we built xmlsec1:

                                       % ./configure --prefix=/usr/local/xmlsec1-1.2.18
                                           --with-libxml=/usr/local/libxml2-2.9.0
                                           --with-openssl=/usr/local/openssl-1.0.1e --with-gnu-ld
                                           --enable-static-linking  --disable-crypto-dl --disable-apps-crypto-dl

                                   Except on Mac OS X:

                                       % ./configure --prefix=/usr/local/xmlsec1-1.2.18 \
                                             --with-libxml=/usr/local/libxml2-2.9.0 --with-gnu-ld --enable-static=yes \
                                             --enable-shared=yes --with-nss=/Applications/Firefox.app/Contents/MacOS \
                                             --with-nspr=/Applications/Firefox.app/Contents/MacOS \
                                             --with-openssl=/usr/local/openssl-1.0.1e \
                                             --disable-crypto-dl


                               +o   Due to an apparent error in its build
                                   procedure, we sometimes encountered the
                                   following error message:

                                       *** Warning: Linking the shared library libxmlsec1-openssl.la against the
                                       *** static library /local/openssl-1.0.1e/lib/libcrypto.a is not portable!

                                   After ensuring that libcrypto.so (or
                                   libcrypto.dylib) had been installed when
                                   building [1mOpenSSL[22m, to correct the xmlsec1
                                   build problem we did "[1mmake clean[22m", re-ran
                                   [1mconfigure [22mas above, and edited
                                   src/openssl/Makefile under the root of the
                                   xmlsec1 distribution directory to change
                                   all occurrences of "libcrypto.a" to
                                   "libcrypto.so". It was sometimes also
                                   necessary to delete the -ldl flag on those
                                   same lines, and in other Makefile files in
                                   the distribution (and making sure the flag
                                   was not specified by xmlsec1-config). After
                                   those changes, we ran [1mmake [22magain.
                                   Additionally, it was sometimes necessary to
                                   specify CFLAGS="-I/usr/local/include
                                   -L/usr/local/lib".

                               +o   Another problem related to this library on
                                   a CentOS platform resulted in an error
                                   message similar to this:

                                       Cannot restore segment prot after reloc: Permission denied

                                   The solution was to issue the command
                                   (adjust the path as necessary):

                                       % chcon -t texrel_shlib_t /usr/local/xmlsec1-1.2.18/lib/libxmlsec1-openssl.so


                               +o   When including InfoCard support on Mac OS
                                   X, it was necessary to tell the dynamic
                                   linker where to find the xmlsec1 library
                                   (despite using the [1m-rpath [22mflag during the
                                   build). To work around this, do something
                                   like the following (or equivalent):

                                       % setenv DYLD_LIBRARY_PATH /usr/local/xmlsec1-1.2.18/lib

                                   Ensure that "[1mgmake test[22m" does not fail.

                               +o   Due to an apparent bug in configure.in, on
                                   FreeBSD [1mconfigure [22mmay incorrectly use the
                                   [1m-ldl [22mflag in generated Makefiles. Either
                                   edit all Makefiles to remove all
                                   occurrences of the [1m-ldl [22mflag, or edit
                                   configure.in, add a "*-*-freebsd*" case
                                   like the others in the "OpenSSL" section,
                                   run [1mautoconf [22mto regenerate [1mconfigure[22m, and
                                   then "[1mmake clean[22m" and re-run [1mconfigure[22m.

                               +o   Your experience may differ, but we found
                                   xmlsec1 to not cooperate when we wanted to
                                   work with multiple installations of libxml2
                                   - apparently if a libxml2 directory or link
                                   has been installed, its build procedure
                                   seems to use that version, regardless of
                                   what is specified on the command line,
                                   requiring manual editing of its Makefiles.
                                   Check that the correct instance of
                                   [1mxml2-config [22mis being used.
                               The [1mDACS [22mbuild procedure uses [1mxmlsec1-config[22m, a
                               program that comes with xmlsec1. If InfoCard
                               support is enabled, the build procedure will
                               look in some standard places for this command.
                               You can specify its location with the
                               [34m[1m--with-xmlsec1-config[0m[1m[22m[48] flag.

                               See the [1mDACS [22mconfigure arguments:
                               [34m[1m--enable-infocard-auth[0m[1m[22m[49] and
                               [34m[1m--with-xmlsec1-config[0m[1m[22m[48]

                            5. [1mOpenLDAP[0m

                               Authentication through LDAP or Microsoft Active
                               Directory (see [34m[1mlocal_ldap_authenticate[0m[1m[22m[50]) is
                               implemented using [34m[1mOpenLDAP[0m[1m[22m[51]. This release of
                               [1mDACS [22mhas been tested only with openldap-2.4.33
                               and we strongly recommend that you use that
                               version.

                               It is not known whether this release of [1mDACS[0m
                               will work with any other version of [1mOpenLDAP [22m-
                               we do not support them.  [1mDACS [22mmay work properly
                               with [1mOpenLDAP [22mversions at least as old as
                               2.2.24, if you really must use one of them.

                               [1mDACS [22mhas been tested against Windows 2000
                               Server SP4.

                               If the [1m--with-ldap [22mflag is [4mnot[24m given (in which
                               case LDAP authentication must be enabled; e.g.,
                               via [1m--enable-ldap-auth[22m), [1mconfigure [22mwill search
                               for [1mOpenLDAP [22mheaders and libraries; if found,
                               it will assume they are a suitable version and
                               use them.

                               If [1m--with-ldap [22mis given (either because
                               [1mOpenLDAP [22mis not installed or an unsuitable
                               version is installed), headers and libraries
                               relative to the root of the specified directory
                               will be used rather than any installed [1mOpenLDAP[0m
                               files; it is not necessary to [4minstall[24m [1mOpenLDAP[22m,
                               you only need to [4mbuild[24m it - so you do not need
                               to be concerned about hassles associated with
                               upgrading or any other versions that might
                               already be installed on your system.

                               To build [1mOpenLDAP [22mfor [1mDACS[22m, from the root of
                               your [1mOpenLDAP [22mdistribution do:

                                   % ./configure --disable-slapd --enable-static
                                   % make

                               If so instructed, do a "[1mmake depend[22m" before the
                               [1mmake[22m.

                               See the [1mDACS [22mconfigure arguments:
                               [34m[1m--enable-ldap-auth[0m[1m[22m[52] and [34m[1m--with-ldap[0m[1m[22m[53]

                            6. Readline

                               The history and editing functionality provided
                               by the [34m[1mGNU Readline Library[0m[1m[22m[54] can be nice to
                               have when using [34m[1mdacsexpr(1)[0m[1m[22m[55] interactively.
                               This release of [1mDACS [22mhas been tested with
                               version 6.2, although we have used readline-6.0
                               and readline-6.1 with recent releases of [1mDACS[22m.
                               Note that you may need to compile Readline with
                               the [1m-fPIC [22mflag ("[1mmake CFLAGS=-fPIC[22m").

                               It is not necessary for you to [4minstall[0m
                               readline, you only need to [4mbuild[24m it - so you do
                               not need to be concerned about hassles
                               associated with upgrading or any other versions
                               that might already be installed on your system.

                                   [1mNotes[0m
                                   +o   When building on Mac OS X, it was
                                       necessary to fix a bug by editing
                                       shlib/Makefile and making this change:

                                           #SHOBJ_LDFLAGS = -dynamic
                                           SHOBJ_LDFLAGS = -dynamiclib

                                   See the [1mDACS [22mconfigure arguments:
                                   [34m[1m--with-readline[0m[1m[22m[56]

                            5. Configure and build [1mDACS [22mlibraries, services,
                               commands, and utilities

                               See [34m[1mBuild Options[0m[1m[22m[57] for build alternatives
                               and options to [1mconfigure[22m.

                                   % cd src
                                   % ./configure
                                   % gmake

                               To confirm that [1mDACS [22mhas been built with the
                               third-party packages that you intended, from
                               the run:

                                   % ./version -v

                               You should ensure that the [1msslclient [22mutility is
                               working correctly. From the src directory, you
                               can test it using the following command:

                                   % perl -e 'printf "GET / HTTP/1.0\n\n";' | ./sslclient dacs.dss.ca:443

                               which should print the contents of
                               [34m[1mhttps://dacs.dss.ca [0m[1m[22mto the standard output. You
                               should repeat this test substituting the name
                               of your server and port.

                                   [1mTip[0m
                                   After building [1mDACS[22m, it is strongly
                                   recommended that you run the self-tests
                                   (expression evaluation, crypto code, string
                                   handling, and so on) from the src
                                   directory:

                                       % gmake test

                                   If any error occurs during testing, testing
                                   will stop immediately and a message will be
                                   displayed. In this event, first check that
                                   you are using the recommended software
                                   packages and that your build flags are
                                   correct. Most often, problems are the
                                   result of mixing header files or library
                                   files from different versions of a
                                   third-party package (e.g., [1mOpenSSL[22m) or
                                   incorrect file permissions. If you cannot
                                   find anything wrong with your
                                   configuration, please submit a bug report
                                   that includes the self test output and
                                   describes your platform (you can include
                                   the output of "./version -v").

                            6. If all looks good, install [1mDACS[0m

                                   % gmake install


                                   [1mNotes[0m
                                   +o   If [1mgmake [22mcomplains about not being able
                                       to find [1mxsltproc[22m, docbook.xsl, or
                                       something that might be related to
                                       installing the documentation, try:

                                           % (cd ../man; gmake touch)
                                           % gmake install


                                   +o   This will install the rules for the
                                       standard [1mDACS [22mweb services and run
                                       [34m[1mdacsacl(1)[0m[1m[22m[58] to create and install an
                                       index for them.

                                   +o   You can specify [34m[1mDESTDIR[0m[1m[22m[59] to [1mgmake[0m
                                       when installing or uninstalling:

                                           % gmake DESTDIR=/tmp/mydacs install

                                   The installation process may prompt you for
                                   the owner name and group name to use for
                                   files and directories; it will guess at
                                   reasonable defaults for your platform. The
                                   appropriate responses will depend on local
                                   conventions, but to start with you might
                                   set the owner to your login name or root,
                                   and the group name to the same name that is
                                   used by [1mApache [22m(specified by the [34m[1mGroup[0m[1m[22m[60]
                                   directive in httpd.conf).

                                       [1mTip[0m
                                       While running "[1mgmake install[22m",
                                       important instructions regarding manual
                                       installation steps may be displayed. A
                                       copy is written to .build_notes,
                                       truncating any previous contents.

                                7. As part of the installation procedure, the
                                   [1mDACS [22mmanual pages are copied into the [1mDACS[0m
                                   man directory (default:
                                   /usr/local/dacs/man). If you adjust your
                                   [1mMANPATH [22menvironment variable to include
                                   that directory, try:


                                       % man dacs

                                   While it is occasionally handy to view the
                                   manual pages using the [1mman [22mcommand, the
                                   HTML documentation is far superior.

                                8. Build a [1mDACS[22m-enabled [1mhttpd[0m

                                   Please consult apache/README in the [1mDACS[0m
                                   distribution for details and, from the
                                   apache directory, do:

                                       % gmake help


                                       [1mSecurity[0m
                                       You can build the [34m[1mmod_auth_dacs[0m
                                       [1m[34mmodule[0m[1m[22m[7] with a module identification
                                       string (a "version tag") with varying
                                       amounts of detail, or without a tag.
                                       For a full-length tag, use "[1mgmake tag[22m",
                                       for a simple tag use "[1mgmake smalltag[22m",
                                       or to disable the tag use "[1mgmake notag[22m"
                                       or "[1mgmake module[22m". We suggest that you
                                       compile [1mmod_auth_dacs [22mwith a tag so
                                       that [1mApache's SERVER_SIGNATURE [22mand
                                       Server response header field can
                                       include [1mDACS [22mversion identification;
                                       this makes it easy to tell which
                                       version of [1mDACS [22mthe server is running
                                       and helps to detect mismatches. If
                                       [1mmod_auth_dacs [22mis compiled with
                                       debugging enabled or if the
                                       [34m[1mSetDACSAuthDebug[0m[1m[22m[61] directive enables
                                       debugging, additional version
                                       information is added to the tag. For
                                       production use, identifying the modules
                                       in your [1mApache [22mserver is considered by
                                       some to be a potential security
                                       weakness - you may reasonably choose
                                       not to include the version tag. For
                                       some versions of [1mApache[22m, module
                                       identification can be suppressed at
                                       runtime through its [34m[1mServerTokens[0m[1m[22m[62]
                                       directive.
                                   If you want [34m[1mmod_auth_dacs[0m[1m[22m[7] to be a
                                   dynamic module, which is recommended, do:

                                       % cd apache
                                       % gmake tag
                                       % gmake install

                                   Check that your httpd.conf has the
                                   appropriate LoadModule directive.

                                   If you want [34m[1mmod_auth_dacs module[0m[1m[22m[7] to be a
                                   static module:

                                    1. Copy apache/mod_auth_dacs.c to [1mApache's[0m
                                       modules/aaa directory

                                    2. Re-run [1mApache[22m's configure, adding
                                       [1mmod_auth_dacs[0m
                                       ([1m--with-module=aaa:auth_dacs[22m)

                                    3. Reinstall [1mApache[22m:

                                           % make install


                                    4. Verify that [1mmod_auth_dacs [22mappears in
                                       the list of [1mApache [22mmodules:

                                           % httpd -l


                                           [1mTip[0m
                                           Because [34m[1mmod_auth_dacs[0m[1m[22m[7] references
                                           symbols in [1mmod_ssl[22m, apparently
                                           those symbols must be loaded [4mbefore[0m
                                           [1mmod_auth_dacs [22mis loaded. This can
                                           be ensured by statically compiling
                                           [1mmod_ssl [22minto [1mhttpd [22m(configure [1mhttpd[0m
                                           with [1m--enable-ssl [22mand verify with
                                           "[1mhttpd -l[22m") and using the following
                                           directive in httpd.conf to
                                           dynamically load the [1mmod_auth_dacs[0m
                                           module:

                                               LoadModule auth_dacs_module modules/mod_auth_dacs.so

                                           Alternatively, it may be sufficient
                                           to dynamically load [1mmod_ssl [4m[22mbefore[0m
                                           [1mmod_auth_dacs[22m.

                                           If [1mmod_ssl [22msymbols are unavailable
                                           when they are needed, you'll
                                           probably see a message like the
                                           following when you try to start
                                           [1mhttpd[22m:

                                               mod_auth_dacs.so: undefined symbol: ssl_hook_Fixup
                                       After you've installed [1mmod_auth_dacs[22m,
                                       restart [1mhttpd[22m.

                                       If you built the module with a tag,
                                       verify that the [1mDACS [22mversion identifier
                                       appears in [1mSERVER_SIGNATURE[22m. You can do
                                       this by hitting [1mApache's printenv [22mCGI
                                       program from your browser or using a
                                       command like:

                                           % http "http://[4mmyserver[24m:[4mmyserverport[24m/cgi-bin/printenv"

                                       (first making sure that [1mApache's[0m
                                       [1mprintenv [22mCGI is executable) and
                                       examining the [1mSERVER_SIGNATURE[0m
                                       environment variable, or by running:

                                           % telnet [4mmyserver[24m [4mmyserverport[0m

                                       and typing:

                                           OPTIONS * HTTP/1.0

                                       followed by a blank line and examining
                                       the Server response header.

                                           [1mNote[0m
                                           +o   The URLs that follow will use
                                               http and omit [4mmyserverport[24m.
                                               Substitute https and/or include
                                               [4mmyserverport[24m as necessary for
                                               your configuration.

                                           +o   If you install a new version of
                                               [1mDACS[22m, please make sure that you
                                               use the [1mmod_auth_dacs [22mmodule
                                               that comes with it. Follow the
                                               instructions above.

                                    9. An assortment of [1mDACS [22mfiles, including
                                       HTML documentation and CSS files, are
                                       copied into the [1mDACS [22mwww directory
                                       (default: /usr/local/dacs/www).

                                       While you can view the documentation
                                       simply by pointing your web browser at
                                       the [1mDACS [22mwww directory, it is
                                       recommended that you make it available
                                       through [1mApache [22musing its [34m[1mAlias[0m[1m[22m[63]
                                       directive because the default site
                                       configuration (site.conf-std) expects
                                       handlers and DTDs to be available using
                                       certain URLs.

                                       Add lines like the following to your
                                       httpd.conf:

                                           Alias /dacs      "/usr/local/dacs/www/"
                                           Alias /css       "/usr/local/dacs/www/css/"
                                           Alias /dtd-xsd   "/usr/local/dacs/www/dtd-xsd/"
                                           Alias /examples  "/usr/local/dacs/www/examples/"
                                           Alias /handlers  "/usr/local/dacs/www/handlers/"
                                           Alias /infocards "/usr/local/dacs/www/infocards/"
                                           Alias /man       "/usr/local/dacs/www/man/"
                                           Alias /misc      "/usr/local/dacs/www/misc/"
                                           Alias /mod       "/usr/local/dacs/www/mod/"

                                       To see the [1mDACS [22mDTD files from your
                                       browser, you can also add:

                                           AddType text/plain      .dtd

                                       These .dtd files are only used to
                                       document XML structures and messages
                                       used by [1mDACS [22mand are cited in the
                                       documentation.

                                       You should also uncomment these two
                                       directives in your site.conf file:

                                           XSD_BASE_URL "/dacs/dtd-xsd"
                                           DTD_BASE_URL "/dacs/dtd-xsd"


                                           [1mTip[0m
                                           After restarting [1mhttpd[22m, you can
                                           view the documentation using a URL
                                           that looks like
                                           http://[4mmyserver[24m/dacs/man or simply
                                           http://[4mmyserver[24m/man.

                                   10. Access to all [1mDACS [22mweb services
                                       (everything installed in the
                                       .../cgi-bin/dacs directory) [4mmust[24m be
                                       controlled by [1mDACS[22m; that is, they must
                                       be "[1mDACS[22m-wrapped". Assuming you are
                                       following the defaults for installing
                                       [1mDACS[22m, these are the only files that are
                                       required to be [1mDACS[22m-wrapped.

                                       [1mDACS[22m-wrapping a resource or set of
                                       related resources involves:

                                       +o   Configuring [1mApache [22mso that it uses
                                           [1mDACS [22mto manage access to the
                                           contents of a directory or portion
                                           of URL space and

                                       +o   Configuring one or more [1mDACS [22maccess
                                           control rules for the jurisdiction
                                           responsible for the resources (this
                                           is done for the [1mDACS [22mweb services
                                           by the default ACLs).
                                           Configuring [1mApache [22minvolves, at
                                           minimum, adding directives like the
                                           following to the appropriate
                                           VirtualHost section of httpd.conf:

                                               AddDACSAuth dacs-acs /usr/local/dacs/bin/dacs_acs "-t -v"
                                               SetDACSAuthMethod dacs-acs external
                                               SetDACSAuthConf dacs-acs "/usr/local/dacs/dacs.conf"
                                               <Location /cgi-bin/dacs>
                                                  AuthType DACS
                                                  AuthDACS dacs-acs
                                                  Require valid-user
                                               # Note: For Apache 2.4, instead use:
                                               # Require dacs-authz
                                                  Options ExecCGI
                                               </Location>


                                               [1mTip[0m
                                               Remember to restart [1mApache[0m
                                               after making changes to
                                               httpd.conf.
                                           Some administrators may choose to
                                           make [4mall[24m content or [4mall[24m CGIs
                                           [1mDACS[22m-wrapped. That is probably a
                                           more secure approach, although of
                                           course it can be somewhat less
                                           efficient than segmenting the
                                           server's URL space into "secure"
                                           and "insecure" areas. Content that
                                           is not [1mDACS[22m-wrapped is totally
                                           oblivious to [1mDACS [22mand incurs no
                                           overhead due to [1mDACS[22m. Also, this
                                           approach may necessitate making
                                           "holes" in the URL space for
                                           non-access controlled resources,
                                           which must be done with care.

                                               [1mTip[0m
                                               If you decide to [1mDACS[22m-wrap
                                               everything, you will likely
                                               want to add rules to grant
                                               access to various public
                                               resources, such as CSS files,
                                               robots.txt, favicon.ico, and
                                               various public [1mDACS [22mresources,
                                               such as its man, dtd-xsd, etc.
                                               directories (see the
                                               instructions for the Alias
                                               directive above). The default
                                               ACL acl-stddocs.0 does this for
                                               some resources, but you may
                                               need to extend the list to
                                               grant access to additional
                                               public resources.

   [1mInitial Configuration[0m
           [1mTip[0m
           At this point, reviewing [34m[1mdacs.quick(7)[0m[1m[22m[5] is strongly recommended.
           It provides a detailed example of what needs to be done to make
           your [1mDACS [22moperational and how to do some basic testing.

           [1mTip[0m
           The interactive [1mdacsinit [22mutility can perform the steps described
           below quickly. You will find [1mdacsinit [22min the distribution's src
           directory. It can be run anytime after [1mDACS [22mhas been built and
           installed. It produces a directory structure for the federation,
           copies the distribution's site configuration file, creates a
           minimal dacs.conf for the federation and one jurisdiction, makes
           federation and jurisdiction encryption keys, and generates metadata
           for the jurisdiction. The resulting configuration can be used
           immediately by [1mDACS [22mcommands and by [1mDACS [22mweb services after [1mApache[0m
           has been configured for [1mDACS[22m.

           Passing the [1m-d [22mflag to [1mdacsinit [22mcauses it to append a string to
           certain paths and filenames so that, for debugging or test
           purposes, it is unlikely to overwrite any "real" configuration
           files. Passing it the [1m-n [22mflag causes it to display what it would do
           without performing any of the actions.

       Having installed [1mDACS[22m, the next major step is to do some initial
       configuration of your federation and jurisdiction(s). At each
       jurisdiction in your federation you will need to do the following:

        1. Install the default site configuration file. The distribution comes
           with a default site configuration file found in the distribution's
           conf/site.conf-std file. The installation procedure copies this
           file into the [1mDACS [22mfederations directory. After making a backup
           copy of any federations/site.conf file that is already there, copy
           federations/site.conf-std to federations/site.conf, applying any
           customizations you require (customizations are usually done in
           dacs.conf though, so that you can simply copy on top of the
           previous site.conf). Note that conf/site.conf-std may well change
           in a new release and you should use the latest version.

        2. As part of the installation procedure, a default set of access
           control rules is copied into the [1mDACS [22macls directory (default:
           /usr/local/dacs/acls). The default site.conf file (site.conf-std)
           configures [1mDACS [22mto look in that directory for the default rules.
           These rules control access to [1mDACS [22mweb services and are sufficient
           for proper operation.

               [1mTip[0m
               If your installed [1mDACS [22mweb services have a filename suffix
               (e.g., .cgi, you should probably build [1mDACS [22mwith an appropriate
               [1m--with-cgi-suffix [22mflag or customize the rules manually. If it
               is necessary to change the default rules, consider overriding
               them at the jurisdiction level instead of editing a default ACL
               file - this will make it easier for you to upgrade because you
               will not have to carry these changes forward to future releases
               of [1mDACS[22m.

               [1mSecurity[0m
               Access to some administrative and experimental [1mDACS [22mweb
               services is completely disabled or restricted by default;
               [4mchange[24m [4mthese[24m [4mwith[24m [4mcare[24m [4mand[24m [4mat[24m [4myour[24m [4mown[24m [4mrisk,[24m [4mparticularly[24m [4mif[0m
               [4myour[24m [4mweb[24m [4mserver[24m [4mis[24m [4mreachable[24m [4mfrom[24m [4mthe[24m [4mInternet[24m.

        3. Configure your dacs.conf file at each jurisdiction. At the very
           least, you must provide [34m[1mFEDERATION_DOMAIN[0m[1m[22m[64], [34m[1mFEDERATION_NAME[0m[1m[22m[65],
           and [34m[1mJURISDICTION_NAME[0m[1m[22m[66] directives; all other required directives
           will come from the site.conf file installed in an earlier step if
           you do not specify them.

        4. Use [34m[1mdacskey(1)[0m[1m[22m[67] to make encryption keys for the federation (if
           you are creating a new federation) or obtain a copy of the
           federation's encryption keys for each new jurisdiction (if you are
           joining an existing federation). Each jurisdiction in a federation
           must have a copy of the same federation keys.

        5. Use [34m[1mdacskey(1)[0m[1m[22m[67] to make encryption keys for each new
           jurisdiction (each jurisdiction will have different keys).

        6. Create a group definition that describes your jurisdictions - see
           [34m[1mdacs.groups(5)[0m[1m[22m[68] - and install an identical copy at each
           jurisdiction.

        7. Check ownership and permissions on [1mDACS [22mexecutables and data files.

               [1mSecurity[0m
               All access to [1mDACS [22mconfiguration files (dacs.conf, site.conf)
               and keys must be limited to the [1mDACS [22madministrator and the [1mDACS[0m
               CGI programs called by [1mApache[22m. The installation process tries
               to set this reasonably, but you should re-check now and after
               making changes because it is vital to maintain a secure system
               (e.g., ls -lR /usr/local/dacs).


   [1mInitial Testing[0m
       Having configured [1mApache [22mand [1mDACS[22m, you should try some basic [1mDACS [22mweb
       services to make sure that they are working properly before you go on
       to make customizations.

       For example, invoke [34m[1mdacs_version(8)[0m[1m[22m[14] from your browser to check that
       it is properly [1mDACS[22m-wrapped (adjust the URL for your environment):

           % http "http://[4mmyserver[24m/cgi-bin/dacs/dacs_version"

       Review the [1mDACS [22mlog files (default: /usr/local/dacs/logs/*) to see what
       happened. You can also try [34m[1mdacsversion(1)[0m[1m[22m[69] from the command line.

       You should verify that [34m[1mdacs_list_jurisdictions(8)[0m[1m[22m[11] works properly.

       The next step is to configure an authentication method - see
       [34m[1mdacs_authenticate(8)[0m[1m[22m[8] and try to authenticate. Once that appears to
       be working, you can try [34m[1mdacs_current_credentials(8)[0m[1m[22m[9],
       [34m[1mdacs_prenv(8)[0m[1m[22m[10], [34m[1mdacs_conf(8)[0m[1m[22m[12], and [34m[1mdacs_signout(8)[0m[1m[22m[13].

   [1mBuild Options[0m
       Running [1mconfigure [22mgenerates config.nice (over-writing any previous
       contents), which can be executed at some later time if you want to
       re-run [1mconfigure [22mwith the same arguments.

           [1mTip[0m
           After you are happy with your configuration, consider squirrelling
           away a copy of config.nice in case you want to reconfigure [1mDACS [22mor
           for use with later releases of [1mDACS[22m.

       It is possible to "bundle" several of the [1mDACS [22mutility programs
       together into a single binary called [1mdacs[22m. This is similar to what
       [1mOpenSSL [22mdoes with its [1mopenssl [22mcommand. Instead of running:

           % dacsacl ...

       you would run:

           % dacs dacsacl ...

       Running [1mdacs [22mwithout arguments displays the list of built-in utilities.
       Some utilities have multiple names that are equivalent; these appear in
       a comma-separated list. To build this combined command, add the flag
       bundle=yes to command lines when building and installing:

           % gmake bundle=yes
           % gmake bundle=yes install

       The commands that are bundled into the [1mdacs [22mcommand won't be built as
       separate programs. To build and install both bundled and unbundled
       commands:

           % gmake bundle=both
           % gmake bundle=both install

       Command: gmake or "[1mgmake build[22m"
           This will build libraries, services, and utilities in the source
           directory. By default, the build process will create shared
           libraries and binaries if they are supported on your platform.

               [1mTip[0m
               If you encounter problems while building [1mDACS [22mwith shared
               libraries, use [1m--disabled-shared [22mand [1m--enable-static [22mwith
               [1mconfigure [22mand try building it again.

       Command: "[1mgmake install[22m"
           This will install all [1mDACS [22mcomponents. We recommend that everything
           other than CGI binaries be put under /usr/local/dacs, which is the
           default. The CGI binaries are by default installed in
           .../[4myour-apache-dir[24m/cgi-bin/dacs. By default, [1mDACS [22mutilities will
           be installed in /usr/local/dacs/bin, which you may want to put on
           your [1mPATH [22mfor convenience.

       Command: "[1mgmake clean[22m"
           Removes binaries, object files, and other junk in the build
           directory

       Command: "[1mgmake distclean[22m"
           Does a "[1mgmake clean[22m" and cleans up so that [1mconfigure [22mcan be
           re-done.

       Command: "[1mgmake extraclean[22m"
           Does a "[1mgmake distclean[22m" and removes configure. After this, do:

               % autoconf -I../include

           and then run [1mconfigure[22m.

       Command: "[1mgmake uninstall[22m"
           Removes installed binaries, include files, and libraries

       Other useful build commands (these should be self-explanatory):

           % gmake build-services
           % gmake build-progs
           % gmake build-static
           % gmake build-shared
           % gmake build-static-services
           % gmake build-shared-services
           % gmake build-static-progs
           % gmake build-shared-progs
           % gmake build-shared-lib
           % gmake install-libs
           % gmake install-shared-lib
           % gmake install-static-lib
           % gmake install-progs
           % gmake install-services

       [1mConfigure Options[0m
           To verify that this documentation is up-to-date, please run:

               % configure --help

           This will also tell you which features are enabled (or disabled) by
           default.  Standard build and install options.PP

           [1m--prefix=[4m[22mPREFIX[0m
               The root for the installation hierarchy [/usr/local/dacs],
               which is referred to as the symbol and variable [34m[1mDACS_HOME[0m[1m[22m[70]

           [1m--exec-prefix=[4m[22mEPREFIX[0m
               The root for the architecture-dependent hierarchy [[4mPREFIX[24m]

           [1m--bindir=[4m[22mDIR[0m
               Where [1mDACS [22mutilities are installed [[4mEPREFIX[24m/bin]

           [1m--libdir=[4m[22mDIR[0m
               Where [1mDACS [22mlibraries are installed [[4mEPREFIX[24m/lib]

           [1m--includedir=[4m[22mDIR[0m
               Where [1mDACS [22minclude files are installed [[4mEPREFIX[24m/include]

           [1m--mandir=[4m[22mDIR[0m
               Where [1mDACS [22mmanual pages are installed [[4mEPREFIX[24m/man]

           [1m--enable-shared[0m
               Generate shared libraries

           [1m--enable-static[0m
               Generate static libraries

           [1m--disable-prefix-check[0m
               Disable prefix path check. The prefix path check does some
               sanity tests on [4mPREFIX[24m.
           Feature selection options.PP

           [1m--enable-access-tokens[0m
               Compile with the authorization caching feature

           [1m--enable-all-auth[0m
               Enable all authentication methods; you can use this flag and
               then individually disable methods (e.g., [1m--enable-all-auth[0m
               [1m--disable-apache-auth [22mwould enable all methods except [1mApache[0m
               password authentication

           [1m--enable-apache-auth[0m
               Enable [1mApache [22mpassword authentication directly through [1mDACS[0m

           [1m--enable-bdb[0m
               Enable Berkeley DB support (default is yes). If you don't want
               it, use [1m--disable-bdb[0m

           [1m--enable-cas-auth[0m
               Enable CAS authentication

           [1m--enable-cert-auth[0m
               Enable X.509 client certificate authentication

           [1m--enable-dacs-conf[0m
               Specify default [1mDACS [22mconfig file

           [1m--enable-dacs-log[0m
               Specify initial [1mDACS [22mlog file

           [1m--enable-debug[0m
               Compile with debugging

           [1m--enable-developer[0m
               Compile with development flags

           [1m--enable-fts[0m
               Use included [34m[1mfts(3)[0m[1m[22m[71] library

           [1m--enable-gdbm[0m
               Enable ndbm support using gdbm's compatibility API
               ([34m[1mgdbm(3)[0m[1m[22m[72])

           [1m--enable-grid-auth[0m
               Enable one-time password grid authentication

           [1m--enable-infocard-auth[0m
               Enable InfoCard authentication and support

           [1m--enable-java[0m
               Enable Java support

           [1m--enable-ldap-auth[0m
               Enable LDAP authentication and roles

           [1m--enable-local-roles[0m
               Enable private [1mDACS [22mroles module (enabled by default)

           [1m--enable-native-auth[0m
               Enable authentication via [1mApache [22mmodules

           [1m--enable-ndbm[0m
               Enable native Unix ndbm API support

           [1m--enable-ntlm-auth[0m
               Enable NTLM authentication

           [1m--enable-pam-auth[0m
               Enable PAM authentication

                   [1mImportant[0m
                   The PAM module should be considered experimental. Test it
                   carefully before production use.

           [1m--enable-passwd-auth[0m
               Enable DACS password-protected account authentication

           [1m--enable-rule-patterns[0m
               Enable extended URL patterns when matching a request against
               ACLs (this is an add-on feature)

           [1m--enable-simple-auth[0m
               Enable simple DACS account authentication

           [1m--enable-sqlite[0m
               Enable SQLite support (default is no). If you don't want it,
               use [1m--disable-sqlite[0m

           [1m--enable-token-auth[0m
               Enable one-time password token authentication

           [1m--enable-unix-roles[0m
               Enable Unix groups roles module (enabled by default on Unix
               platforms)

           [1m--enable-user-info[0m
               Compile with the user information reporting feature
           Third-party support options.PP

           [1m--with-apache=[4m[22mDIR[0m
               Root [1mApache [22minstall directory; if [4mDIR[24m is "omit", however, a
               basic subset of [1mDACS [22mwill be installed ([34m[1malso see above[0m[1m[22m[73])
               (example: if [1mApache [22mfiles have been installed in
               /usr/local/apache2.2/include, /usr/local/apache2.2/conf, etc.,
               use [1m--with-apache[22m=/usr/local/apache2.2)

           [1m--with-apache-apr=[4m[22mDIR[0m
               Root [1mApache [22mAPR install directory; required only when [1mApache[0m
               2.2 or 2.4 are used (example:
               [1m--with-apache-apr[22m=/usr/local/apache2.2/apr-httpd)

           [1m--with-apache-apr-config=[4m[22mPATH[0m
               [1mApache [22mAPR configuration program; required only when [1mApache [22m2.2
               or 2.4 are used and the correct program is not on the search
               path; this flag may be required if the build system has more
               than one instance of [1mApache [22minstalled or if you have installed
               [1mApache [22min a non-standard location (example:
               [1m--with-apache-apr-config[22m=/usr/local/apache2.2/apr-httpd/bin/apr-1-config)

           [1m--with-apache-apr-cpp-defs=[4m[22mFLAGS[0m
               Preprocessor flags required when compiling files that include
               [1mApache [22mAPR code; may be required with some "non-standard" cases
               when [1mApache [22m2.2 or 2.4 are used and "[1mapr-1-config --cppflags[22m"
               is unavailable or does not report the correct flags (example:
               [1m--with-apache-apr-cpp-defs[22m=-D_LARGEFILE64_SOURCE)

                   [1mNote[0m
                   It has been reported that on some GNU/Linux platforms, such
                   as Ubuntu, it is necessary to define these symbols when
                   building [1mDACS [22mcode that includes APR header files (such as
                   [1mdacsversion[22m):

                       #define LINUX 2
                       #define _REENTRANT
                       #define _GNU_SOURCE
                       #define _LARGEFILE64_SOURCE

           [1m--with-apache-apr-includes=[4m[22mDIR[0m
               [1mApache [22mAPR include files directory; required with some
               "non-standard" cases when [1mApache [22m2.2 or 2.4 are used and
               [1mapr-1-config [22mis unavailable or does not report the correct
               directory (example:
               [1m--with-apache-apr-includes[22m=/usr/bin/include/apr-1.0)

           [1m--with-apxs=[4m[22mPATH[0m
               By default, the build procedure expects the [1mApache apxs [22mutility
               to be bin/apxs, relative to [1mApache's [22minstallation directory. On
               systems where this is incorrect, you must specifically
               configure the path for [1mapxs[22m. (example:
               [1m--with-apxs[22m=/usr/sbin/apxs2)

           [1m--with-bdb=[4m[22mDIR[0m
               Location of the root of the installed Berkeley DB libraries,
               include files, etc.; for example
               [1m--with-bdb[22m=/usr/local/db-5.3.21. This implies [1m--enable-bdb[22m.

           [1m--with-cgi-bin=[4m[22mDIR[0m
               Location of [1mApache [22mCGI files for [1mDACS [22mweb services. This will
               resolve to [4mDIR[24m/cgi-bin/dacs if it exists, or [4mDIR[24m/dacs if that
               exists, or [4mDIR[24m if its last component is "dacs".

           [1m--with-cgi-suffix=[4m[22mSUFFIX[0m
               When installing CGI executables, add [4mSUFFIX[24m as the file
               extension. A typical value for [4mSUFFIX[24m is ".cgi". The default
               access control rules for [1mDACS [22mweb services (via the VFS item
               type dacs_acls) respect this suffix. On Windows platforms,
               where ".exe" is the standard extension for programs, [4mSUFFIX[24m is
               set to that by default. Using a [4mSUFFIX[24m of "no" sets the
               extension to the null string.

           [1m--with-dacs-conf=[4m[22mPATH[0m
               Specify default [1mDACS [22mconfig file (default:
               [4mPREFIX[24m/federations/dacs.conf)

           [1m--with-dacs-log=[4m[22mPATH[0m
               Specify initial [1mDACS [22mlog file (default: [4mPREFIX[24m/logs/error_log)

           [1m--with-expat=[4m[22mDIR[0m
               Root directory of installed [1mExpat [22mlibraries and include files.
               If Expat files have been installed in /usr/local/expat/include,
               /usr/local/expat/lib, etc., use [1m--with-expat[22m=/usr/local/expat.

           [1m--with-federations-root=[4m[22mDIR[0m
               Location of [1mDACS [22mfederations root directory (default:
               [4mPREFIX[24m/federations)

           [1m--with-htdocs=[4m[22mDIR[0m
               Location of [1mApache DACS [22mfiles if not the htdocs subdirectory of
               the [1mApache [22minstall directory.

           [1m--with-iconv=[4m[22mDIR[0m
               Path to parent of iconv installation. This flag may be required
               if you are enabling [1mSamba [22msupport.

           [1m--with-jdk-bin[0m
               If Java support is enabled, this identifies the directory
               containing the [1mjava[22m, [1mjavac[22m, [1mjavah[22m, and [1mjar [22mcommands. If this
               flag is absent, [1mconfigure [22mwill look for those programs using
               the current [1mPATH [22mvariable. (Example:
               [1m--with-jdk-bin=/usr/local/java/bin[22m)

           [1m--with-jdk-includes[0m
               If Java support is enabled, this is a list of one or more [1mGCC[0m
               include flags for JDK include directories (Example:
               [1m--with-jdk-includes=-I/usr/local/jdk/include[0m
               [1m-I/usr/local/jdk/include/freebsd[22m)

           [1m--with-ldap=[4m[22mDIR[0m
               Location of [1mOpenLDAP [4m[22msource[24m files. This is the root directory
               for the OpenLDAP source distribution (Example:
               /local/src/openldap-2.2.28). This implies [1m--enable-ldap-auth[22m.

           [1m--with-mailer-prog=[4m[22mPATH[0m
               Location of a mailer program to use instead of [1msendmail[22m. This
               is only needed if email support is required. If
               [1m--with-mailer-args [22mis also specified, it will be used as the
               command line arguments. See [34m[1mdacsemail(1)[0m[1m[22m[74] for a description
               of how the mailer is expected to behave.

           [1m--with-mailer-args=[4m[22mSTRING[0m
               Command line arguments to use with the selected mailer program.
               This is only required if email support is required. See
               [34m[1mdacsemail(1)[0m[1m[22m[74] for a description of how the mailer is
               expected to behave.

           [1m--with-readline=[4m[22mLIB[0m
               Use [34m[1mGNU Readline[0m[1m[22m[54] when available. If [4mLIB[24m is given, it is the
               link flag to use or the pathname for the library (other flags
               may also be specified). (Example:
               [1m--with-readline=-Wl,-rpath,/local/src/readline-6.2/lib[0m
               [1m-L/local/src/readline-6.2/lib[0m
               [1m-I/local/src/readline-6.2/include[22m)

           [1m--with-samba=[4m[22mDIR[0m
               Location of Samba [4msource[24m files. This is the root directory for
               the Samba source distribution (Example:
               /local/src/samba-3.6.12). This implies [1m--enable-ntlm-auth[22m.

           [1m--with-sendmail=[4m[22mPATH[0m
               Location of [34m[1msendmail(8)[0m[1m[22m[75]. This is only needed if email
               support is required and the location of the [1msendmail [22mcommand
               found at configuration time must be overridden. If
               [1m--with-mailer-args [22mis also specified, it will be used instead
               of the default [1msendmail [22mcommand line arguments. See
               [34m[1mdacsemail(1)[0m[1m[22m[74] for additional details.

           [1m--with-sqlite=[4m[22mDIR[0m
               Location of the root of the installed SQLite libraries, include
               files, etc.; for example
               [1m--with-sqlite[22m=/usr/local/sqlite-3.7.10. This implies
               [1m--enable-sqlite[22m.

           [1m--with-ssl=[4m[22mDIR[0m
               Location of the root of the installed [1mOpenSSL [22mlibraries and
               include files. If [1mOpenSSL [22mfiles have been installed in
               /usr/local/openssl/include, /usr/local/openssl/lib, etc., use
               [1m--with-expat[22m=/usr/local/openssl.

           [1m--with-xmlsec1-config=[4m[22mPATH[0m
               If the build procedure cannot find [1mxmlsec1-config[22m, or if it
               finds the wrong one, you can specify its location as [4mPATH[24m. This
               may only be required if InfoCard authentication has been
               enabled.

           To specify additional flags for compiling or linking [1mDACS[22m, set
           [4mCFLAGS[24m or [4mLDFLAGS[24m, respectively.

           To specify additional flags for compiling or linking the
           [34m[1mmod_auth_dacs module[0m[1m[22m[7], set [4mAPACHE_CFLAGS[24m or [4mAPACHE_LDFLAGS[24m,
           respectively. For example, this command will cause [1mmod_auth_dacs [22mto
           be built with the [1m-m64 [22mflag and [1mDACS [22mto be built with both the [1m-m64[0m
           flag and the [1m-O3 [22mflag:

               % ./configure "APACHE_CFLAGS=-m64" "CFLAGS=-O3 -m64" ...


[1mSEE ALSO[0m
       [34m[1mdacs(1)[0m[1m[22m[76], [34m[1mdacs.readme(7)[0m[1m[22m[6], [34m[1mdacs.quick(7)[0m[1m[22m[5]

[1mAUTHOR[0m
       Distributed Systems Software ([34m[1mwww.dss.ca[0m[1m[22m[77])

[1mCOPYING[0m
       Copyright (C) 2003-2013 Distributed Systems Software. See the
       [34m[1mLICENSE[0m[1m[22m[78] file that accompanies the distribution for licensing
       information.

[1mNOTES[0m
        1. gmake
           http://directory.fsf.org/project/make

        2. GCC
           http://gcc.gnu.org

        3. Xcode
           https://developer.apple.com/xcode

        4. ldconfig(8)
           http://www.freebsd.org/cgi/man.cgi?query=ldconfig&apropos=0&sektion=8&manpath=FreeBSD+9.1-RELEASE&format=html

        5. dacs.quick(7)
           http://dacs.dss.ca/man/dacs.quick.7.html

        6. dacs.readme(7)
           http://dacs.dss.ca/man/dacs.readme.7.html

        7. mod_auth_dacs module
           http://dacs.dss.ca/man/mod_auth_dacs.html

        8. dacs_authenticate(8)
           http://dacs.dss.ca/man/dacs_authenticate.8.html

        9. dacs_current_credentials(8)
           http://dacs.dss.ca/man/dacs_current_credentials.8.html

       10. dacs_prenv(8)
           http://dacs.dss.ca/man/dacs_prenv.8.html

       11. dacs_list_jurisdictions(8)
           http://dacs.dss.ca/man/dacs_list_jurisdictions.8.html

       12. dacs_conf(8)
           http://dacs.dss.ca/man/dacs_conf.8.html

       13. dacs_signout(8)
           http://dacs.dss.ca/man/dacs_signout.8.html

       14. dacs_version(8)
           http://dacs.dss.ca/man/dacs_version.8.html

       15. Cygwin
           http://cygwin.com

       16. man/index.html
           http://dacs.dss.ca/man/index.html

       17. Post-Release Notes
           http://dacs.dss.ca/download.html

       18. sudo(8)
           http://www.freebsd.org/cgi/man.cgi?query=sudo&apropos=0&sektion=8&manpath=FreeBSD+9.1-RELEASE&format=html

       19. Expat
           http://sourceforge.net/projects/expat

       20. OpenSSL
           http://www.openssl.org

       21. xmlsec1
           http://www.aleksey.com/xmlsec

       22. a patch
           http://www.openssl.org/support/faq.html#USER1

       23. Apache
           http://httpd.apache.org

       24. above
           http://dacs.dss.ca/man/#install-openssl

       25. apr.apache.org
           http://apr.apache.org

       26. Third-party support options
           http://dacs.dss.ca/man/#third-party-support-options

       27. build Berkeley DB
           http://dacs.dss.ca/man/#dbm-databases

       28. FAQ
           http://dacs.dss.ca/man//faq.html

       29. Berkeley DB
           http://www.oracle.com/technology/software/products/berkeley-db/index.html

       30. Oracle Corporation
           http://www.oracle.com

       31. --enable-bdb
           http://dacs.dss.ca/man/#build_flag_--enable-bdb

       32. --disable-bdb
           http://dacs.dss.ca/man/#build_flag_--disable-bdb

       33. --with-bdb
           http://dacs.dss.ca/man/#build_flag_--with-bdb

       34. ftp://ftp.gnu.org/gnu/gdbm
           ftp://ftp.gnu.org/gnu/gdbm/

       35. --enable-ndbm
           http://dacs.dss.ca/man/#build_flag_--enable-ndbm

       36. --enable-gdbm
           http://dacs.dss.ca/man/#build_flag_--enable-gdbm

       37. sdbm
           http://search.cpan.org/src/NWCLARK/perl-5.8.8/ext/SDBM_File/sdbm/README

       38. SQLite
           http://www.sqlite.org

       39. --enable-sqlite
           http://dacs.dss.ca/man/#build_flag_--enable-sqlite

       40. --disable-sqlite
           http://dacs.dss.ca/man/#build_flag_--disable-sqlite

       41. --with-sqlite
           http://dacs.dss.ca/man/#build_flag_--with-sqlite

       42. local_ntlm_authenticate
           http://dacs.dss.ca/man/dacs_authenticate.8.html#local_ntlm_authenticate

       43. Samba
           http://www.samba.org

       44. --enable-ntlm-auth
           http://dacs.dss.ca/man/#build_flag_--enable-ntlm-auth

       45. --with-samba
           http://dacs.dss.ca/man/#build_flag_--with-samba

       46. local_infocard_authenticate
           http://dacs.dss.ca/man/dacs_authenticate.8.html#local_infocard_authenticate

       47. libxml2
           http://xmlsoft.org

       48. --with-xmlsec1-config
           http://dacs.dss.ca/man/#build_flag_--with-xmlsec1-config

       49. --enable-infocard-auth
           http://dacs.dss.ca/man/#build_flag_--enable-infocard-auth

       50. local_ldap_authenticate
           http://dacs.dss.ca/man/dacs_authenticate.8.html#local_ldap_authenticate

       51. OpenLDAP
           http://www.openldap.org

       52. --enable-ldap-auth
           http://dacs.dss.ca/man/#build_flag_--enable-ldap-auth

       53. --with-ldap
           http://dacs.dss.ca/man/#build_flag_--with-ldap

       54. GNU Readline Library
           http://cnswww.cns.cwru.edu/php/chet/readline/rltop.html

       55. dacsexpr(1)
           http://dacs.dss.ca/man/dacsexpr.1.html

       56. --with-readline
           http://dacs.dss.ca/man/#build_flag_--with-readline

       57. Build Options
           http://dacs.dss.ca/man/#build_options

       58. dacsacl(1)
           http://dacs.dss.ca/man/dacsacl.1.html

       59. DESTDIR
           http://www.gnu.org/prep/standards/standards.html#DESTDIR

       60. Group
           http://httpd.apache.org/docs/2.2/mod/mpm_common.html#group

       61. SetDACSAuthDebug
           http://dacs.dss.ca/man/mod_auth_dacs.html#SetDACSAuthDebug

       62. ServerTokens
           http://httpd.apache.org/docs/current/mod/core.html#servertokens

       63. Alias
           http://httpd.apache.org/docs/2.2/mod/mod_alias.html#alias

       64. FEDERATION_DOMAIN
           http://dacs.dss.ca/man/dacs.conf.5.html#FEDERATION_DOMAIN

       65. FEDERATION_NAME
           http://dacs.dss.ca/man/dacs.conf.5.html#FEDERATION_NAME

       66. JURISDICTION_NAME
           http://dacs.dss.ca/man/dacs.conf.5.html#JURISDICTION_NAME

       67. dacskey(1)
           http://dacs.dss.ca/man/dacskey.1.html

       68. dacs.groups(5)
           http://dacs.dss.ca/man/dacs.groups.5.html#dacs_metadata

       69. dacsversion(1)
           http://dacs.dss.ca/man/dacsversion.1.html

       70. DACS_HOME
           http://dacs.dss.ca/man/dacs.conf.5.html#var_dacs_home

       71. fts(3)
           http://www.freebsd.org/cgi/man.cgi?query=fts&apropos=0&sektion=3&manpath=FreeBSD+9.1-RELEASE&format=html

       72. gdbm(3)
           http://directory.fsf.org/gdbm.html

       73. also see above
           http://dacs.dss.ca/man/#building_subset

       74. dacsemail(1)
           http://dacs.dss.ca/man/dacsemail.1.html

       75. sendmail(8)
           http://www.freebsd.org/cgi/man.cgi?query=sendmail&apropos=0&sektion=8&manpath=FreeBSD+9.1-RELEASE&format=html

       76. dacs(1)
           http://dacs.dss.ca/man/dacs.1.html

       77. www.dss.ca
           http://www.dss.ca

       78. LICENSE
           http://dacs.dss.ca/man/../misc/LICENSE



DACS 1.4.28b                      03/01/2013                   DACS.INSTALL(7)
