Subject: Dynamic IP Addressing

From: Jack Jacobsen <[email-masked]>
Date: Wed, 08 May 2002 01:18:49 -0400

I've recently started using the Apache HTTP server and really like it a lot.  One great advantage is the SSL capability, which I intend to use if I can.  That leads me to my question.  I use a commercial web host for the web site for my home business, but need to use my home computer as a download server to distribute rather large audio files to my clients.  I currently access my home server through a link on the main site, using my home computer's IP address, which has really worked well.  I can offer these large files for downloading to my customers on the main site and they never really know that they're being served up from my computer at home.
The problem is that I'd like to offer SSL as a feature of my home download server.  I've got a broadband connection with a company that doesn't offer static IP addressing for it's users, so my home IP address changes now and then.  I then simply have to go to the main site and update my link to the server to reflect the new IP address and I'm back in business, but I'm wondering if this will prohibit me from using SSL.  I'm not sure how to overcome the name matching that the SSL certificate requires.  I can't apply for a certificate using an IP address for an identity, because it'll change, but I also can't use the domain name of my computer because my client's browser's see only the IP address used for access.
What I'd like to know is if there's any way to configure Apache+mod-ssl to return my computer's domain name, even if it's accessed by way of it's IP address?  That would give me a consistent name that would satisfy the SSL certificate name matching.  When my IP address changes, all I'd need to do is update my httpd.conf file to reflect the new IP address to respond to and the SSL certificate should never know the difference.
I know that this is a reverse DNS function of sorts and I'm pretty sure that there's a way of doing it, but so far I've read all the documentation that I could find on httpd.conf configuration, but still haven't had any luck.  I'd sure appreciate any help that you could provide.
Thanks
--
Jack Jacobsen
[email-masked]
Voice (407) 636-9458
FAX   (407) 632-8189
______________________________________________________________________ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email-masked] Automated List Manager [email-masked]

---

From: Cliff Woolley <[email-masked]>
Date: Wed, 8 May 2002 01:58:37 -0400 (EDT)

On Wed, 8 May 2002, Jack Jacobsen wrote:

> What I'd like to know is if there's any way to configure Apache+mod-ssl
> to return my computer's domain name, even if it's accessed by way of it's
> IP address?

Why does it need to be accessed by IP address if it has a fixed domain
name?

--Cliff

--------------------------------------------------------------
   Cliff Woolley
   [email-masked]
   Charlottesville, VA

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: [email-masked]
Date: Wed, 8 May 2002 08:44:42 -0500

www.zoneedit.com they can allow you to have a domain name tagged thru a dynamic ip address.  you have to host the domain name they host your dns for the domain name.
  ----- Original Message ----- 
  From: Jack Jacobsen 
  To: [email-masked] 
  Sent: Wednesday, May 08, 2002 12:18 AM
  Subject: Dynamic IP Addressing

  Thanks

---

From: Balázs Nagy <[email-masked]>
Date: Wed, 08 May 2002 11:43:16 -0600

[email-masked] wrote:
> www.zoneedit.com <http://www.zoneedit.com> they can allow you to have a 
> domain name tagged thru a dynamic ip address.  you have to host the 
> domain name they host your dns for the domain name.

And than, in the Apache conf, you can just use the default
setting for your SSL virtual host (the one that is already there)
and you will be in business. You might want to consider geting a real cert
though if your site will be public.

-- 
Cheers,
	Balázs

-----------------------------------------------------
Balázs Nagy                           TheNewPush, LLC
Managing Partner                 tel. +1-303-523-5729
Research & Development           fax. +1-720-294-0933
=======>Internet Infrastructure and Presence Provider
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Jack Jacobsen <[email-masked]>
Date: Thu, 09 May 2002 01:52:06 -0400

I think you're right.  I may have to look into getting a a real cert and
static IP address (if I can) or going with a DNS service like zoneedit.com.
I've heard that the DNS sites really aren't the best things to use for
serious security, so a static IP address seems to be the only reliable
solution.  I really appreciate your help.

Jack Jacobsen

--
Jack Jacobsen
[email-masked]
Voice (407) 636-9458
FAX   (407) 632-8189

---

From: "R. DuFresne" <[email-masked]>
Date: Thu, 9 May 2002 01:59:52 -0400 (EDT)

umm, you do understand that ssl is not used to secure your website, yes?

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: "Peter Viertel" <[email-masked]>
Date: Thu, 09 May 2002 09:07:24 +0100

If you can get a real certificate based on a domainname you 'own' then 
which ip you come from is irrelevant.
The whole point of the certificate is that no-one can impersonate your 
website, even if they steal your dns away, because they don't have your 
private key.
the only issues with someone like zoneedit.org is they are a third party 
and you have to take a view on reliability.

---

From: "R. DuFresne" <[email-masked]>
Date: Thu, 9 May 2002 05:25:47 -0400 (EDT)

> and you have to take a view on reliability.

Yes, that's an important part of ssl and certificates, yet, not the whole
issue.  A point to make here is that ssl does not fix security issues
related to bad cgi scripting or other issues that might well lead to the
compromise of your server.  It does not mitigate patching a broked OS or
other software involved in the serving or web based information.

Perhaps the best way to view ssl, and I'm sure there might be some
disagreement or others might propose other views, is that it is a service
provided mostly as a benifit to the client, those folks you wish to do
business with, in that you are assuring them not only that you really are
who you say you are, but, also providing them a secure channel of
comunication for passing delicate personal information.  It's primary
purpose is not to enhance the security of the httpd or the hosting
system<s>.

Thanks,

Ron DuFresne

---

From: "webEpix Administration" <[email-masked]>
Date: Thu, 9 May 2002 03:01:37 -0700

I agree, i view mod ssl as a way of transmitting my data from server to
client in a secure manor not as a way of insuring the total security of my
server. Maintaining system security goes far beyon jus making sure
transmissions between client and server are secure, but that the system
itself is secure.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of R. DuFresne
Sent: Thursday, May 09, 2002 02.26 AM
To: [email-masked]
Subject: Re: Dynamic IP Addressing

Thanks,

Ron DuFresne

---

From: MegaZone <[email-masked]>
Date: Thu, 9 May 2002 10:19:46 -0400

Once upon a time webEpix Administration shaped the electrons to say...
> transmissions between client and server are secure, but that the system

SSL is like an armed courier.  It protects the data during transfer
from client to server, and vice-versa.  But it doesn't protect the
data on the client or the server, that's another issue.

Sending a message in an armored truck doesn't help if you leave it
laying out in the open on your desk where anyone can read it.

When I worked for GTEI's VPN group I had to explain this over and over
to clients.  "Why do I need a firewall if I have VPN?"  Etc...

-MZ, CISSP #3762, RHCE #806199299900541
-- 
<URL:mailto:[email-masked]> Gweep, Discordian, Author, Engineer, me..
"A little nonsense now and then, is relished by the wisest men" 781-788-0130
<URL:http://www.megazone.org/>  <URL:http://www.eyrie-productions.com/> Eris