Subject: RE: ssl no response

From: David Hsu <[email-masked]>
Date: Wed, 30 Jan 2002 11:14:31 +1100

This sounds like the problem I send out yesterday!

Have you ensure you have

Listen 443

in your httpd.conf?  apache does not pick it up automagically from
<VirtualHost x.x.x.x:443>

Cheers,

David Hsu

-----Original Message-----
From: Aodhan H [mailto:[email-masked]]
Sent: Wednesday, 30 January 2002 7:37 AM
To: [email-masked]
Subject: ssl no response

 Hello, I am trying to get an ssl virtual site running. The http site
works fine, but bringing up the https site gives me 'Could not reach
remote server' error.
 I can find no log of the event, and no error code comes up.
 I used apachectl to check the syntax, and I get no errors. Looking around
the web I have seen a variety of different configuration options, but none
of them get me very far.
 Here is the virtual host directive I have, if people could point out what
is wrong with it, I would appreciate it.

 <VirtualHost x.x.x.x:443 >
     ServerAdmin [email-masked]
     DocumentRoot /www/domain.net/ssl
     ServerName server.domain.net
     ErrorLog logs/443error_log
     CustomLog logs/443access_log common
     ScriptAlias /cgi-bin/ "/usr/local/apache/cgi-bin/"
     Group users
 <Directory /www/domain.net/ssl>
    AuthName "ssl"
    AuthType Basic
    AuthUserFile auth/.htpasswd
    Require user aodhan
    SSLVerifyClient require
    SSLVerifyDepth 1
    SSLRequireSSLA
 </Directory>

 </VirtualHost>

-- 

   =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

        Aodhan H.

        -   -   -   -   -   -   -   -   -   -   -   -   -   -   -   -
                   Ad Astra per Aspera
                          A Rough Road Leads To The Stars
        -   -   -   -   -   -   -   -   -   -   -   -   -   -   -   -

         Freedom is something you have, not something you're given.

   =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Aodhan H <[email-masked]>
Date: Wed, 30 Jan 2002 13:19:07 -0800 (PST)

I've changed the conf now to see:

 <VirtualHost ssl.domain.net:443 >
     SSLEngine on
     SSLCipherSuite
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
     SSLCertificateFile /usr/local/apache/conf/ssl.crt/server.crt
     SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/server.key

     ServerAdmin [email-masked]
     ServerName domain.net
    SSLRequireSSL
 </Directory>

 </VirtualHost>

 When I test (debug) it succedes to local host, but not to the actual
virtual host.

# openssl s_client -connect ssl.domain.net:443
-state -debug
connect: Connection refused
connect:errno=111
# openssl s_client -connect localhost:443 -state
-debug
CONNECTED(00000003)

 I have the listen 443 statment included, just inside Section 2:

<IfDefine SSL>
Listen 80
Listen 443
</IfDefine>

 Looking into the ssl_engine_log, I see the following error:

[30/Jan/2002 13:13:26 28201] [warn]  Init: (saratoga.domain.net:443) RSA
server certificate CommonName (CN) `www.domain.net' does NOT match server
name!?
[30/Jan/2002 13:13:26 28201] [info]  Init: Configuring server
domain.net:443 for SSL protocol
[30/Jan/2002 13:13:26 28201] [warn]  Init: (domain.net:443) RSA server
certificate CommonName (CN) `www.domain.net' does NOT match server
name!?

-- 

        Aodhan H.

---

From: Aodhan H <[email-masked]>
Date: Mon, 4 Feb 2002 10:37:31 -0800 (PST)

Alright, I've managed to establish an ssl conenction, but the session
hangs begore presenting me with a login prompt. I get an insecure prompt
to the directory in question if I use port 80.

 This is the portion of the log from ssl_engine_log during the
negotiation. Using Opera 6.x the connection hangs. Using IE 5.x it asks me
to select a certificate, and lists none for me to use. Can someone
describe what is happening?

     DocumentRoot /www//ssl
 <Directory /www//ssl>

 </VirtualHost>

 tail -f logs/ssl_engine_log
[04/Feb/2002 09:44:06 13354] [info]  Initial (No.1) HTTPS request received
for child 5 (server domain.net:443)
[04/Feb/2002 09:44:06 13354] [info]  Requesting connection re-negotiation
[04/Feb/2002 09:44:06 13354] [info]  Awaiting re-negotiation handshake
[04/Feb/2002 09:44:06 13354] [error] Re-negotiation handshake failed: Not
accepted by client!?
[04/Feb/2002 09:44:06 13354] [error] SSL error on writing data (OpenSSL
library error follows)
[04/Feb/2002 09:44:06 13354] [error] OpenSSL: error:140890C7:SSL
routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate
[Hint: No CAs known to server for verification?]
[04/Feb/2002 09:44:06 13354] [info]  Connection to child 5 closed with
standard shutdown (server domain.net:443, client 66.35.239.94)
[04/Feb/2002 09:44:07 13353] [info]  Connection to child 4 established
(server terran.net:443, client 66.35.239.94)
[04/Feb/2002 09:44:07 13353] [info]  Seeding PRNG with 1160 bytes of
entropy
[04/Feb/2002 09:44:07 13353] [info]  Connection: Client IP: 66.35.239.94,
Protocol: SSLv3, Cipher: RC4-SHA (128/128 bits)
[04/Feb/2002 09:48:38 13353] [info]  Connection to child 4 closed with
standard shutdown (server domain.net:443, client 66.35.239.94)

-- 

        Aodhan H.

---

From: "Sir SoilentG_kov" <[email-masked]>
Date: Mon, 4 Feb 2002 16:07:53 -0800

I've been looking thru the mod_ssl users archives and have learned that I
can't do SSL on Virtual Hosts that are name based.  I've seen that it is
possible to use it on Virtual Hosts with IP based.

Are these IP based hosts separate computers or can they be "Virtual IP's"
all pointing to the same computer?  What I want to do is have two domain
names routed to my Linux Web Server and have them both have separate certs.
However, I have no clue how I'd go about setting up two IP's that point to
the same box... doesn't make sense to me so I'm guessing it's not
possible... but would love it if it does.

thanks for bearing with me,

Jeff

---

From: Owen Boyle <[email-masked]>
Date: Tue, 05 Feb 2002 09:38:01 +0100

> possible to use it on Virtual Hosts with IP based.

Correct. Also, port based...
 
> possible... but would love it if it does.

It is entirely possible. Any single interface card (i.e. the physical
device, e.g. eth0) can listen to many IP addresses. On an internet
connected unix machine the basic procedure is:

- obtain two IP addresses (on the same network - e.g. 192.168.1.1 and
192.168.1.2)
- define your two sites in DNS
  (these two points are done via your ISP usually)

- use "ifconfig" to make your NIC listen to the two IPs
  (see man pages for more detail on this command)

- configure apache to "Listen" to the two IPs and 
- define two VHs for each IP e.g.

Listen 192.168.1.1
<VirtualHost 192.168.1.1>
  ServerName www.site1.com
  DocumentRoot /path/to/site1
</VirtualHost>

Listen 192.168.1.2
<VirtualHost 192.168.1.2>
  ServerName www.site2.com
  DocumentRoot /path/to/site2
</VirtualHost>

Rgds,

Owen Boyle.

---

From: "Sir SoilentG_kov" <[email-masked]>
Date: Tue, 5 Feb 2002 01:22:24 -0800

thanks,

FYI i used Linuxconf instead of ifconfig (newbie here) and it works
like a champ.

Jeff

> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Owen Boyle
> Sent: Tuesday, February 05, 2002 12:38 AM
> Subject: Re: ssl virtual host IP's
>
>
> Sir SoilentG_kov wrote:
> >

---

From: "R. DuFresne" <[email-masked]>
Date: Tue, 5 Feb 2002 12:17:05 -0500 (EST)

Lat time I checked, and perhaps it has been updated and fixed, it was not
a few mere weeks ago, Linuxconf was an open security hole waiting for
exploitation.  You may want to fix that.

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: "Sir SoilentG_kov" <[email-masked]>
Date: Tue, 5 Feb 2002 09:56:21 -0800

Ron,

can you be more specific as to what security hole or who could
exploit it?

I have sole access directly to my webserver so far as a real
terminal.  I allow SSH for only a couple of non-root users and
that is key based authentication and my FTP is chrooted to the
users home folder.  i'm starting to get into IP Tables.  My server
is NAT'ed behind a modem and the webmin port is not open.  I figure
if someone can get in and exploit Linuxconf then I'm hosed even if I
un-install it cuz they can merely get in.

Jeff

> [mailto:[email-masked]]On Behalf Of R. DuFresne
> Sent: Tuesday, February 05, 2002 9:17 AM
> Subject: RE: ssl virtual host IP's
>
>
>

---

From: "Eduardo Gomez" <[email-masked]>
Date: Wed, 6 Feb 2002 13:27:17 -0500

Can someone PLEASE post a simple tutorial on how to set domain name-based
virtual hosts with apache for windows??. I've been trying many things and I
just cant get it right. What is confusing me is how the following general
config. lines interact or have conflic with each other:

-Listen
-BindAdress
-ServerName
-DocumentRoot

And on the virtual hosts commands, what's really confusing me is how to
enter the correct path in the "DocumentRoot" line within the <virtualhost>
tags. Example:

 <VirtualHost >
      DocumentRoot path <--this line
 </VirtualHost>

If my main DocumentRoot, specified in the general configuration is:
"C:\webapps\apache\htdocs"
and my virtual host folder is
"C:\webapps\apache\htdocs\subfolder"
what do I enter in the line above ??? Any help would be appreciated.

Please, Gurus,  be kind to the unexperienced, but willing to learn :)

_______________
Eduardo Gomez
Innerlab Productions
www.innerlab.com

---

From: Tom Oehser <[email-masked]>
Date: Wed, 6 Feb 2002 21:15:09 -0500 (EST)

> virtual hosts with apache for windows??. I've been trying many things and I

Could someone PLEASE post a simple tutorial on flaming off-topic
inappropriate posts that have nothing to do with the list topic?

I've been trying many different kinds of flames, but I still can't get
them to understand that first you do a modicum of your own research and
RTFM, then you post a question to an appropriate topical list, or else
the very experts you are asking for help will ignore you and be annoyed.

I think maybe if I just were better at flaming them, they would stop.

Please help.

-Tom

---

From: "Eduardo Gomez" <[email-masked]>
Date: Wed, 6 Feb 2002 21:41:43 -0500

> inappropriate posts that have nothing to do with the list topic?

Haha, that was funny...
You're right, I sent this by accident to 2 lists (one is this one)
Sorry...i'll see that it doesn't happen again :)

______________
Eduardo Gomez
Innerlab Productions
www.innerlab.com

---

From: "R. DuFresne" <[email-masked]>
Date: Wed, 6 Feb 2002 22:33:29 -0500 (EST)

> Sorry...i'll see that it doesn't happen again :)

You can lead a horse to google.net, but ya can't make em typo in the
incorrect search parms...

Thanks,

Ron DuFresne

---

From: "Bert Courtin" <[email-masked]>
Date: Thu, 07 Feb 2002 09:53:27 +0100

Hi,

see http://httpd.apache.org/docs/vhosts/examples.html

Kind regards,
Bert

--
T-Online International AG
DCM
Waldstrasse 3
64331 Weiterstadt
Tel.: +49 (0)6151 680 7512