Subject: RE: securing one area of a vhost in apache 2

From: [email-masked]
Date: Thu, 27 Feb 2003 09:27:58 -0000

> -----Original Message-----
> From: Nick Tonkin [mailto:[email-masked]]
> Sent: 27 February 2003 05:50
> To: [email-masked]
> Subject: securing one area of a vhost in apache 2
> 
> 
> 
> Hello,
> 
> I am using Apache/2.0.44 (Unix) mod_perl/1.99_09-dev Perl/v5.8.0
> mod_ssl/2.0.44 OpenSSL/0.9.7
> 
> I have a virtual host which mostly is served without SSL. But 
> it has one
> area, /secure,  that needs to be secured with SSL. I've tried various
> combinations of directives but can't get it to work. Right now I have:
> 
> <VirtualHost 123.456.789.123:8080>
>     SSLEngine on
>     SSLProtocol all
>     SSLCipherSuite HIGH:MEDIUM
>     SSLCertificateFile /home/debug/www/_conf/certs/ladyraquel.crt
>     SSLCertificateKeyFile /home/debug/www/_conf/certs/ladyraquel.key
>     SSLCACertificateFile /home/debug/www/_conf/certs/ca.crt
>     SSLVerifyClient none
> 
>     <Directory /home/debug/www/ladyraquel/secure>
>         SSLVerifyClient require
>         SSLVerifyDepth 1
>     </Directory>
> </VirtualHost>
> 
> The server starts fine, serves non-SSL pages fine, but hangs when I
> request /secure.

I'm assuming that you are only interested in securing access, not in using
client certificates. Would that be correct?

In that case this will suffice:

 <VirtualHost 123.456.789.123:8080>
     SSLEngine on
     SSLProtocol all
     SSLCipherSuite HIGH:MEDIUM
     SSLCertificateFile /home/debug/www/_conf/certs/ladyraquel.crt
     SSLCertificateKeyFile /home/debug/www/_conf/certs/ladyraquel.key
     <Directory /home/debug/www/ladyraquel/secure>
         SSLRequireSSL
     </Directory>
 </VirtualHost>

See the SSLRequireSSL directive for more details. 

http://www.modssl.org/docs/2.8/ssl_reference.html#ToC22

- 
John Airey, BSc (Jt Hons), CNA, RHCE
Internet systems support officer, ITCSD, Royal National Institute of the
Blind,
Bakewell Road, Peterborough PE2 6XU,
Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 [email-masked] 

A world of difference - in the UK, 37 million people put their faith on the
last census as "Christian". In Saudi Arabia, this answer would carry a death
sentence for any Saudi.

- 

NOTICE: The information contained in this email and any attachments is 
confidential and may be legally privileged. If you are not the 
intended recipient you are hereby notified that you must not use, 
disclose, distribute, copy, print or rely on this email's content. If 
you are not the intended recipient, please notify the sender 
immediately and then delete the email and any attachments from your 
system.

RNIB has made strenuous efforts to ensure that emails and any 
attachments generated by its staff are free from viruses. However, it 
cannot accept any responsibility for any viruses which are 
transmitted. We therefore recommend you scan all attachments.

Please note that the statements and views expressed in this email 
and any attachments are those of the author and do not necessarily 
represent those of RNIB.

RNIB Registered Charity Number: 226227

Website: http://www.rnib.org.uk 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Nick Tonkin <[email-masked]>
Date: Thu, 27 Feb 2003 12:52:06 -0800 (PST)

> > combinations of directives but can't get it to work. Right now I have:

[ snip ]

> client certificates. Would that be correct?

Yes. No authentication needed. Just want to make an SSL connection.

> See the SSLRequireSSL directive for more details.

This didn't work, I am afraid:

nick@world ~>lwp-request -sSd http://www.ladyraquel.com:8080/weather
GET http://www.ladyraquel.com:8080/weather --> 301 Moved Permanently
GET https://ladyraquel.com:8080/weather/ --> 501 Protocol scheme 'https' is not supported
## it's rewriting the http scheme ...
## https not supported for resource outside the named dir seems sort of OK

nick@world ~>lwp-request -sSd http://www.ladyraquel.com:8080/weather/
GET http://www.ladyraquel.com:8080/weather/ --> 200 OK
## working fine

nick@world ~>lwp-request -sSd http://www.ladyraquel.com:8080/secure/
GET http://www.ladyraquel.com:8080/secure/ --> 403 Forbidden
## sort of what i expected with scheme of http://

nick@world ~>lwp-request -sSed https://www.ladyraquel.com:8080/secure/
GET https://www.ladyraquel.com:8080/secure/ --> 501 Protocol scheme 'https' is not supported
## huh?!

Any more advice gratefully accepted :)

- nick

-- 

~~~~~~~~~~~~~~~~~~~~
Nick Tonkin   {|8^)>

---

From: Mads Toftum <[email-masked]>
Date: Thu, 27 Feb 2003 21:58:06 +0100

> Any more advice gratefully accepted :)
This looks very much like a client error from lwp. You need
Crypt::SSLeay for that, see:
http://search.cpan.org/author/CHAMAS/Crypt-SSLeay-0.49/

vh

Mads Toftum
-- 
`Darn it, who spiked my coffee with water?!' - lwall

---

From: Nick Tonkin <[email-masked]>
Date: Thu, 27 Feb 2003 13:01:21 -0800 (PST)

> http://search.cpan.org/author/CHAMAS/Crypt-SSLeay-0.49/

I'm sorry, for what? For requesting https?

- nick

-- 

~~~~~~~~~~~~~~~~~~~~
Nick Tonkin   {|8^)>