Apache HTTP Server

From KevinWiki

Revision as of 06:09, 29 March 2009 by Kevin (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)

Jump to: navigation, search

Apache HTTP Server

Modules

UserDir

UserDir module allows users on the server have a web site in their home directory.

Configuration

-Check if the module is available in the directory /etc/apache2/mods-available/

-Open the conf file, /etc/apache2/mods-available/userdir.conf.

$ gksudo gedit /etc/apache2/mods-available/userdir.conf &

<IfModule mod_userdir.c>
        UserDir public_html
        UserDir disabled root
        UserDir disabled
        UserDir enabled username

        <Directory /home/*/public_html>
                AllowOverride FileInfo AuthConfig Limit
#                Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
                Options MultiViews SymLinksIfOwnerMatch IncludesNoExec
        </Directory>
</IfModule>

-To prevent the files and directories from being listed when there are no index files such as index.html, index.htm and so on, remove Indexes from the following line

                Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec

So it would be like this

                Options MultiViews SymLinksIfOwnerMatch IncludesNoExec

It is already commented out from the above example.

-Enable the module.

$ cd cd /etc/apache2/mods-enabled/ 
$ sudo ln -s ../mods-available/userdir.load userdir.load 
$ sudo ln -s ../mods-available/userdir.conf userdir.conf

-Restart the Apache server

$ sudo /etc/init.d/apache2 restart

References

http://httpd.apache.org/docs/2.0/en/mod/mod_userdir.html

Virtual Hosts

-make a copy of the default virtual host configuration to have your own.

$ sudo cp /etc/apache2/sites-available/default /etc/apache2/sites-available/mysite

-e.g. Ubuntu Linux 8.04 Hardy

NameVirtualHost *

<VirtualHost *>
	ServerAdmin kevin@localhost
	
	DocumentRoot /var/www/
	<Directory />
		Options FollowSymLinks
		AllowOverride None
	</Directory>
	<Directory /var/www/>
#               Options Indexes FollowSymLinks MultiViews
               Options FollowSymLinks MultiViews
		AllowOverride None
		Order allow,deny
		allow from all
	</Directory>

	ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
	<Directory "/usr/lib/cgi-bin">
		AllowOverride None
		Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
		Order allow,deny
		Allow from all
	</Directory>

	ErrorLog /var/log/apache2/error.log

	# Possible values include: debug, info, notice, warn, error, crit,
	# alert, emerg.
	LogLevel warn

	CustomLog /var/log/apache2/access.log combined
	ServerSignature On

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

<VirtualHost *>
	ServerAdmin kevin@localhost
	
	DocumentRoot /home/kevin/public_html
	ServerName kevin.kevin-home
	ErrorLog /home/kevin/logs/error_log
	TransferLog /home/kevin/logs/access_log
</VirtualHost>

-Many virtual hosts with http & https,

NameVirtualHost *:80
NameVirtualHost *:443
<VirtualHost *:443>
        ServerAdmin kevin@yoursite.com

        SSLEngine on

        SSLOptions +StrictRequire

        SSLCertificateFile /etc/ssl/certs/server.crt
        SSLCertificateKeyFile /etc/ssl/private/server.key

        DocumentRoot /var/www/
        ServerName yoursite.com 
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /var/www/>
#                Options Indexes FollowSymLinks MultiViews
                Options FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog /var/log/apache2/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog /var/log/apache2/access.log combined
        ServerSignature On

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>


<VirtualHost *:80>
        ServerAdmin kevin@yoursite.com

        DocumentRoot /var/www/
        ServerName yoursite.com 
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /var/www/>
#                Options Indexes FollowSymLinks MultiViews
                Options FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog /var/log/apache2/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog /var/log/apache2/access.log combined
        ServerSignature On

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

#<VirtualHost *:80>
#        ServerAdmin kevin@yoursite.com
#
#        DocumentRoot /home/kevin/public_html
#        ServerName kevin.yoursite.com
#        ErrorLog /home/kevin/logs/error_log
#        TransferLog /home/kevin/logs/access_log
#</VirtualHost>

<VirtualHost *:80>
    ServerAdmin kevin@yoursite.com

    DocumentRoot /var/www/blog
    ServerName blog.yoursite.com
</VirtualHost>

-NameVirtualHost *:443 is not necessary if there is only one virtual host using 443 port.

-Ubuntu Linux 8.10 Intrepid

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    
    DocumentRoot /var/www/

    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
#        Options Indexes FollowSymLinks MultiViews
        Options FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog /var/log/apache2/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog /var/log/apache2/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

-Add the following lines after SSL setup

<VirtualHost *:443>
    ServerAdmin webmaster@localhost
    
    DocumentRoot /var/www/

    SSLEngine on

    SSLOptions +StrictRequire

    SSLCertificateFile /etc/ssl/certs/server.crt
    SSLCertificateKeyFile /etc/ssl/private/server.key

    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
#        Options Indexes FollowSymLinks MultiViews
        Options FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog /var/log/apache2/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog /var/log/apache2/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

Enable .htaccess

-Change AllowOverride None

e.g)
	<Directory />
		Options FollowSymLinks
		AllowOverride None
	</Directory>

to

	<Directory />
		Options FollowSymLinks
		AllowOverride All
	</Directory>

-make changes as you wish then disable the default one and enable yours.

$ sudo a2dissite default && sudo a2ensite mysite

-To check the virtual host setting

$ apache2 -S

-If it displays an error message like this

apache2: bad user name ${APACHE_RUN_USER}

-Try this

$ apache2ctl -S

Using SSL

Generating a Certificate Signing Request (CSR)

Generate A Key for the CSR

-To generate the keys for the Certificate Signing Request (CSR) run the following command from a terminal prompt:

$ openssl genrsa -des3 -out server.key 1024 

Generating RSA private key, 1024 bit long modulus
.......................++++++
.++++++
e is 65537 (0x10001)
Enter pass phrase for server.key:your passphrase
Verifying - Enter pass phrase for server.key:your confirm passphrase

-To See the details of the RSA private key.

$ openssl rsa -noout -text -in server.key

Remove Passphrase from Key File

If there is a problem with starting apache when the computer is booted, remove passphrase from the key file can be used to solve it. -Make backup file first

$ cp server.key server.key.original

-Remove the encryption from the RSA private key.

$ openssl rsa -in server.key.original -out server.key

-Make sure the server.key file is only readable by root:

$ chmod 400 server.key

Create the CSR

-To create the CSR, run the following command at a terminal prompt:

$ openssl req -new -key server.key -out server.csr 

Enter pass phrase for server.key:your passphrase
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:Country
State or Province Name (full name) [Some-State]:State
Locality Name (eg, city) []:City
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Company
Organizational Unit Name (eg, section) []:Section
Common Name (eg, YOUR name) []:Your Name
Email Address []:email@address

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:(e.g. a74mf94ns62kjdf8e)
An optional company name []:

-To see the details of this CSR

$ openssl req -noout -text -in server.csr

Creating a Self-Signed Certificate

-To create the self-signed certificate, run the following command at a terminal prompt:

$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt 

Signature ok
subject=/C=**/ST=***/L=******/O=**********/OU=******/CN=*********/emailAddress=***********
Getting Private key
Enter pass phrase for server.key:your passphrase

-To see the details of this certificate

$ openssl x509 -noout -text -in server.crt

Installing the Certificate

$ sudo cp server.crt /etc/ssl/certs/ 
$ sudo cp server.key /etc/ssl/private/

Enable Module SSL

$ sudo a2enmod ssl 
Module ssl installed; run /etc/init.d/apache2 force-reload to enable.

$ sudo /etc/init.d/apache2 force-reload 
 * Reloading web server config apache2                                                                                                                                                        [ OK ]

Edit Site Enabled

-Add the following in the VirtualHost section under the DocumentRoot

	SSLEngine on

	SSLOptions +StrictRequire

	SSLCertificateFile /etc/ssl/certs/server.crt
	SSLCertificateKeyFile /etc/ssl/private/server.key

So it should look like:

<VirtualHost *>
	ServerAdmin blade2@localhost
	
	SSLEngine on

	SSLOptions +StrictRequire

	SSLCertificateFile /etc/ssl/certs/server.crt
	SSLCertificateKeyFile /etc/ssl/private/server.key


        ...blah blah	

</VirtualHost>

-Restart the Apache server

$ sudo /etc/init.d/apache2 restart 
 * Restarting web server apache2Apache/2.2.8 mod_ssl/2.2.8 (Pass Phrase Dialog)
Some of your private key files are encrypted for security reasons.
In order to read them you have to provide the pass phrases.

Server blade2-home:443 (RSA)
Enter pass phrase: type your passphrase

OK: Pass Phrase Dialog successful.