Subject: http and https

From: [email-masked]
Date: Thu, 18 Apr 2002 13:07:49 -0400

Hello, 

I have the following config:
Apache/1.3.23 (Unix) mod_ssl/2.8.7 OpenSSL/0.9.6 

I notice that if i enter:
https://server/www/index.php

it works great. 

Now if if I enter this
http://server/www/index.php

I get to the same location and it is not SSL secured???? 

So my question is can you turn off access to http?
Thanks,
Ron

--
Pop3Now Personal, Get quick remote access to your email accounts!
Sign Up Now!  Visit http://www.pop3now.com/personal

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Cliff Woolley <[email-masked]>
Date: Thu, 18 Apr 2002 13:11:50 -0400 (EDT)

> So my question is can you turn off access to http?

See the SSLRequireSSL directive.  Or you might want to set up a Redirect
so that the client is automatically sent over to the https side.

--Cliff

---

From: "R. DuFresne" <[email-masked]>
Date: Thu, 18 Apr 2002 12:19:51 -0400 (EDT)

yes, remove and directives in http.conf for port 80 and just keep the port
443 stuff.

Thanks,

Ron Dufresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: "Jeremy Walton" <[email-masked]>
Date: Thu, 18 Apr 2002 13:40:35 -0400

In the eyes of apache.  Https and http are different sites.  If you open
the ssl.conf file you'll see 

<VirtualHost _default_:443>

</VirtualHost>

If you put a DocumentRoot of the one you have in http... And change the
one you have in httpd.conf.. You should have one site that's not secure
and one that is.  Now you can have general pages and secure pages.

Jeremy Walton
DICE Corporation

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Thursday, April 18, 2002 1:08 PM
To: [email-masked]
Subject: http and https

Hello, 

it works great. 

Now if if I enter this

--
Pop3Now Personal, Get quick remote access to your email accounts! Sign
Up Now!  Visit http://www.pop3now.com/personal

---

From: "R. DuFresne" <[email-masked]>
Date: Thu, 18 Apr 2002 12:52:35 -0400 (EDT)

Would this not still leave port 80 open and bound?  Is not just removing
the port delcarations for 80 and only having 443 set better and perhaps
more secure?

Thanks,

Ron DuFresne

---

From: Cliff Woolley <[email-masked]>
Date: Thu, 18 Apr 2002 13:57:03 -0400 (EDT)

On Thu, 18 Apr 2002, R. DuFresne wrote:

> Would this not still leave port 80 open and bound?

It would, yes.

> Is not just removing the port delcarations for 80 and only having 443
> set better and perhaps more secure?

That's a case-by-case decision.  In some cases, it would be insufficiently
secure to leave open port 80 (as when the initial request contains
privileged information).  In other cases, it's only the response or
subsequent requests that are privileged, so it's okay to let the initial
request come in on port 80 as long as you immediately bounce them over to
https.  In that situation, leaving port 80 open is just a convenience for
your users (in case they type http: by mistake), if you deem it safe to
provide that convenience.

--Cliff