Subject: stop apache/mod_ssl binding to all IP's.

From: Terry Kerr <[email-masked]>
Date: Thu, 06 Mar 2003 17:36:44 +1100

Hi,

I am running apache 1.3.26 and mod_ssl 2.8.9-2.1 on a debian linux system.

The system has two IP's, and I only wish for apache to start on ports 80 and 443 
on one of those IPs.  I am using named based virtual hosting for many sites on 
the system for http, and have just one virtual host setup for https on port 443. 
  The problem that I am having is that I cannot stop mod_ssl from binding to 
port 443 on both the IP's on my system.  I have tried every possible combination 
of Listen, BindAddress, and Port, and have managed to prevent http from starting 
on all IP's, but https still starts on all IPs.  Is there any way to stop this?

Will I need to start two seperate servers, one serving http only, and one 
serving https only?  If I was to do this, I may as well go back to using 
apache-ssl which is the default installation on debian anyway.

Thanks in advance

terry

-- 
Terry Kerr ([email-masked])
Adroit Internet Solutions (www.adroit.net)
Phone: +61 3 9563 4461
Fax: +61 3 9563 3856

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Mark Boddington <[email-masked]>
Date: Thu, 6 Mar 2003 09:30:08 +0000 (GMT)

Hi Terry,

Perhaps your directives are being overridden in a "IfDefine SSL" or
"IfModule SSL" block ? Listen IP:Port does work, works for me. Do you
have the following in your config ?

Listen my.ip.address:443
...
NameVirtualHost my.ip.address:443
...
<VirtualHost my.ip.address:443>
...
</VirtualHost>

Cheers,

Mark

> on all IP's, but https still starts on all IPs.  Is there any way to stop this?
ddD> Will I need to start two seperate servers, one serving http only, and
one

---

From: "R. DuFresne" <[email-masked]>
Date: Thu, 6 Mar 2003 09:39:57 -0500 (EST)

> apache-ssl which is the default installation on debian anyway.

add the IP address or FQDN to the port designation for the appropriate
listen paramater:

<IfDefine SSL>
Listen someplace.com:80
Listen someplace.com:443
</IfDefine>

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: Terry Kerr <[email-masked]>
Date: Fri, 07 Mar 2003 08:54:51 +1100

Mark,

Thanks for you suggestion, but whenever I try to put

Listen my.ip.address:443 (with the correct ip address ;-)

My http or https server does start at all on any port.  The log error I get is

[crit] (98)Address already in use: make_sock: could not bind to address 
203.89.254.243 port 443

But I don't get a similar error for port 80, so I don't know why it also doesn't 
start.

I also have Listen ip.address:80 defined, and have a NameVirtualHost ip.address 
defined.  I have tried many different combinations of name based and ip based 
virtual hosting, but https always binds to all IP's.  As soon as I put the 
Listen ip.address:443, I get the log error above and no servers start.

terry

---

From: "R. DuFresne" <[email-masked]>
Date: Thu, 6 Mar 2003 17:04:41 -0500 (EST)

it sounds like perhaps yer http.conf file<s> have perhaps more then one
listen directive, perhaps outside the <virtual Host> directives.  Might
try grepping the file for listen and see what comes up.  or, better yet,
egrepping for bind|listen|etc...

thanks,

Ron DuFresne

---

From: Terry Kerr <[email-masked]>
Date: Fri, 07 Mar 2003 09:16:32 +1100

my apologies...I am an idiot...I found the other Listen directive ;-)

terry

---

From: Terry Kerr <[email-masked]>
Date: Fri, 07 Mar 2003 09:08:27 +1100

Yes, I do have one other Listen directive...the Listen my.ip:80 for http, and 
yes, it is outside all <virtual host> directives, because as far as I am aware, 
they have to be.  I tried placing them inside <virt host> directives and I got a 
config error.  I have no BindAddress directives at all, and one Port directive 
at Port 80.

terry