Subject: Re: mod_perl

From: Server Admin <[email-masked]>
Date: Thu, 11 Apr 2002 10:08:04 -0500

Hello: Running FBSD 4.5, I've been struggling with my first Apache+modssl
install from ports and get the need to recompile with -DEAPI error as well
when I run configtest. I'm unfamiliar as to what to do about that except
most likely some modifications need to be made to the Makefile in each
port... This are the latest ports with apache+mod_ssl-1.3.24+2.8.8.

It doesn't like the mod_ssl2.8.8 port that is supposed to be alright for
the SSL install...., so wondered why it didn't make install right.... and
what would be the modifications?... sorry to impose on your time, but
tearing out my hair and not much left before going bald!

Here's the error, if you have a moment to look and advise. Need a secure
server setup badly.... thanks in advance!

INSTALL ERROR
======================================================================
[Wed Apr 10 18:26:46 2002] [warn] Loaded DSO libexec/apache/libphp4.so uses
plain Apache 1.3 API, this module might crash under EAPI! (please recompile
it with -DEAPI)
[Wed Apr 10 18:26:46 2002] [warn] Loaded DSO
libexec/apache/mod_frontpage.so uses plain Apache 1.3 API, this module
might crash under EAPI! (please recompile it with -DEAPI)
======================================================================

At 03:01 AM 4.11.2002 -0500, Philip M. Gollucci wrote:
>if you install apache from ports then just go to the mod_perl port and
>install that too.  It will work fine.
>
>
>END
>---------------------------------------------------------------------------
---
>Philip M. Gollucci (p6m7g8) [email-masked] 301.314.3118 301.646.3011
>
>Science, Discovery, & the Universe (UMCP)
>        Webmaster & Webship Teacher
>        URL: http://www.sdu.umd.edu
>
>EJournalPress.com
>        Database/PERL Programmer & System Admin
>        URL : http://www.ejournalpress.com
>
>Homepage    : http://p6m7g8.com
>Resume      : http://p6m7g8.com/Work/index.html
>Software    : http://p6m7g8.com/Developement/
>
>
>
>On Thu, 11 Apr 2002, Mike Loiterman wrote:
>
>>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> I currently have apache installed via its port, but I need to use
>> mod_perl.  It is my understanding that apache needs to be recompiled
>> in order for this to work.  How should I go about doing this?  Should
>> I just cd in /usr/ports/mod_perl and do a make && make install?  Will
>> this recompile and reinstall apache?
>>
>> Mike Loiterman
>> [email-masked]
>> PGP Key 0xD1B9D18E
>>
>>
>> -----BEGIN PGP SIGNATURE-----
>> Version: PGP 7.0.4
>> Comment: Message digitally signed by Mike Loiterman
>>
>> iQA/AwUBPLV80WjZbUnRudGOEQJFFACgup8vH4RnPy7tsbTAQcskaXLYmGoAnjUS
>> 50eHNtMkvIv7+20+DY+xA4lu
>> =SaGN
>> -----END PGP SIGNATURE-----
>>
>>
>> To Unsubscribe: send mail to [email-masked]
>> with "unsubscribe freebsd-questions" in the body of the message
>>
>
>
>To Unsubscribe: send mail to [email-masked]
>with "unsubscribe freebsd-questions" in the body of the message
>
>

.... our website: http://www.sage-one.net/

Best regards,

Jack L. Stone
Server Admin
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Server Admin <[email-masked]>
Date: Thu, 11 Apr 2002 18:49:42 -0500

...hmmm. thanks for the reply. I think I forgot the "distclean" part on
re-installs.

BTW, did you just install over the existing Apache+++...???? ..or did you
deinstall the old first...??

This helps.... many thanks.... getting a bit closer methinks!

At 10:01 AM 4.11.2002 -0500, Philip M. Gollucci wrote:
>Do this:
>
>cvsup /usr/share/examples/cvsup/ports-supfile
>cd /usr/ports/www/apache13-modssl
>make install distclean
>cd ../mod_frontpage
>make install distclean
>cd /usr/local/sbin
>./apachectl startssl
>tail /var/log/httpd-error.log
>[Thu Apr 11 15:53:21 2002] [notice] Apache/1.3.24 (Unix)
>FrontPage/5.0.2.2623 mod_ssl/2.8.8 OpenSSL/0.9.6a configured
>-- resuming normal operations
>[Thu Apr 11 15:53:21 2002] [notice] Accept mutex: flock (Default: flock)
>
>For reference, I just did this myself 5
>minutes ago with FreeBSD4.5-RELEASE and ports as of 5 minutes ago
>Works like a charm.
>
>
>END
---
>On Thu, 11 Apr 2002, Server Admin wrote:
>

Best regards,

Jack L. Stone
Server Admin

---

From: "Philip M. Gollucci" <[email-masked]>
Date: Thu, 11 Apr 2002 10:01:37 -0500 (EST)

Do this:

END
------------------------------------------------------------------------------
Philip M. Gollucci (p6m7g8) [email-masked] 301.314.3118 301.646.3011

EJournalPress.com

---

From: Server Admin <[email-masked]>
Date: Fri, 12 Apr 2002 15:46:26 -0500

HURRAY!!!! I got apache+modssl plus, mod_php, mod_perl, mod_frontpage all
installed and the things works! Loads right up without complaint.

BUT, now.... can anyone tell me how to get the FrontPage extensions
actually loaded so that the FP client can access the site...??? FrontPage
says "no extensions on the server". I've tried starting apache with
"apachectl -DMOD_FP", but no dice....

This is my LAST obstacle.... please, anyone who can advise about staring
those darn extensions with ssl loaded... or is that possible....???

---

Best regards,

Jack L. Stone
Server Admin

---

From: "Robert Covell" <[email-masked]>
Date: Fri, 12 Apr 2002 15:53:46 -0500

You have to run the fpsrvadm.exe on the site you want to all fp access to.
>From my experience it is picky about DocumentRoot and UserDir.  Hope this
helps...

Sincerely,

Robert T. Covell
President / Owner
Rolet Internet Services, LLC
Web: www.rolet.com
Email: [email-masked]
Phone: 816.471.1095
Fax: 816.471.3447
24x7: 816.210.7145

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Server Admin
Sent: Friday, April 12, 2002 3:46 PM
To: [email-masked]
Cc: Mike Loiterman; [email-masked];
[email-masked]
Subject: Re: mod_perl

---

Best regards,

Jack L. Stone
Server Admin

---

From: "James A. Peltier" <[email-masked]>
Date: 12 Apr 2002 13:49:05 -0700

> with "unsubscribe freebsd-questions" in the body of the message

I believe there is a fpadmin program that you need to run to actually
apply the FP Extensions to the VirtualHost entry you will be needing the
extensions for.

- James

---

From: Server Admin <[email-masked]>
Date: Sat, 13 Apr 2002 08:16:24 -0500

On earlier versions of Apache+FrontPage, and after installation, I always
ran "fp_install.sh" which fully installed the extensions on the sites and
set up webs. I have never run the fpsrvadm command but willing to try it if
it will help. But, I've looked at all the docs on this command and I don't
see anything in the description about it loading the extensions. I have
found it is not enough to just intall frontpage, but the extensions have to
be loaded somehow. This seems to change with every version of frontpage +
Apache.... For instance on the apache13_fp in FBSD ports, to load the
extensions requires
# /usr/local/sbin/httpd -DMOD_FP ...this is in the bootup script
"apache.sh" for version apache-1.23, but will not work in the present
apache-ssl (apache ver 1.24).

Following the install of Frontpage, the instructions say to add these to
the http.conf to enable FrontPage, but it is crytic about WHERE to put the
lines (to enable... the default is disabled) and when I put them in,
apachectl configtest doesn't like the syntax. (Sheesh! It shouldn't be this
hard!)

FrontPageEnable         # Enable Frontpage Extensions
FrontPageDisable        # Disable Frontpage Extensions
FrontPageAdminEnable    # Enable Frontpage Extensions fpadmcgi.exe
FrontPageAdminDisable   # Disable Frontpage Extensions fpadmcgi.exe

The above seems to be a logical solution, but am puzzled by how to use it.

I'm obviously not doing something right here. Please just a little more
help from anyone who is trying to run frontpage with
apache+ssl-1.24./2.8.8. This is maddening.... sorry for the lengthy
message, but as brief as I could explain it... THANKS!!!!!

Best regards,

Jack L. Stone
Server Admin

---

From: Server Admin <[email-masked]>
Date: Sat, 13 Apr 2002 08:23:13 -0500

Thanks for the reply, James.... as I said in an earlier post, I have never
found it necessary to run fpadmin on earlier FP installs. Instead, I have
used "fp_install" which installed the extensions, BUT, the next problem
seems to be how to laod the extensions.

Have you used the fpadmin and what would the syntax be to make the darn
extensions load...? Nothing in the MS docs about fpadmin says anything
about making the extensions load....

I have Apache_FP (Apache-1.23) running fine with FP on one server, but
cannot get FP to load the extensions on the new Apache-1.24. Any additional
thoughts....???? Or systax on the fpadmin...??? I am really stuck on this
and I NEED SSL plus FP. Thanks!

Best regards,

Jack L. Stone
Server Admin

---

From: "Andrew Lietzow" <[email-masked]>
Date: Sat, 13 Apr 2002 09:55:05 -0500

Dear "Server Admin",
RE:>>Please just a little more help from anyone who is trying to run
frontpage with
apache+ssl-1.24./2.8.8. This is maddening....
---------------
I'm sorry that I cannot help you but I share the sentiments of another
ISP--running FrontPage
is NOT something he allows his hosted domains to do.  If they want to run
FrontPage
extensions, he simply declines hosting their pages because he needs his
Apache
server to be very stable.  He shared with me recently that he hosts over
2,000 domains.

Is it possible that you are trying to use a product with Apache that is
wasn't designed to support?
Perhaps you would have better luck with IIES?  I don't know but I HOPE there
can be some discussion
of this on this list server.  Maybe I need to shift my focus because I'm
missing out on valuable functionality?

e.g. I would like to find an WYSIWYG HTML editor, but if it means that the
web server has to support
special extensions that crash the server, than how can this be a good thing?
Talk to me "Server Admin", or mod_ssl list.

Fortunately, I just downloaded Apache 2.0.35, ran ./configure and it's up
and running on SuSE LInux 7.3
with but a couple of whimpers.  (I'll be doing the same on my RH servers
soon, but they are production servers).

Now, even /server-status works and I had not been able to get that going
with 1.3.XX.  It worked right out of
the tarball; the first time!  Congratulations, Apache and mod_ssl folks!
(Now, if I can just apply my CERT again,
without a glitch....).

So Server Admin, your statement was my experience over much of the past 16
years when
working with proprietary source vendors....."This is maddening".

I made a choice to join the GNU/GPL generation and I'm not turning back
unless I hit a block wall.  So far, I wake up every morning seeing an even
bigger expanse of open spaces. I'm enjoying the view...

Andrew Lietzow
The ACL Group, Inc.

---

From: Server Admin <[email-masked]>
Date: Sat, 13 Apr 2002 10:33:22 -0500

Andrew, thanks for your sentiments and I quite agree about the FrontPage
frustration being shared by many of the aministrators I've discussed this
issue. I'm really interested in "drifting away" from the use of FP as well,
but, alas, one major domain that publishes an online tech magazine to 180
countries needs the assist that is provided by the FP client in its fast
procution of html and pages with functionality... there is a tremendous
amount of new content produced each month being an online mag. FP saves a
lot of time on this heavy production. No need to learn html or cgi for the
workstations... just type it and publish it...done.

Thus, there is an immediate need until another way is found. Frontpage is
running just fine at the moment on a server with Apache-1.23 (and earlier
1.22 and 1.20), but once trying to move to the Apache-1.24+ssl... no
frontpage extensions. No doubt I'm missing some ingredient, but as I said
in the previous post, EVERY install of Apache+FP version seems to be different

Even is I start Apache-1.24 without ssl, I cannot load the darn extensions.
Suspect it has to do with permissions.... but, if I knew the answer to
that, I'd be able to fix it.

My long workaround until I solve this FP thing is to run the FP domains on
the Apache-1.23+FP and the Apache+ssl on another server using a separate
domain which provides the secure website for processing online orders. But,
it means forwarding the traffic from the HTTP server to the HTTPS server
and any pages produced by FP will have to be FTP'd. For some reason, the
order pages containing FP bots still work once loaded, even though the FP
extensions are not loaded... kinda scares me though and is why I still want
to find the answer to loading the extensions....

BTW, I have not been able to get /server-status or /server-info wo work
either.... it tries to run, but answers with "you don't have
permissions...." and I'm running ROOT!!!

Best regards,

Jack L. Stone
Server Admin

---

From: "R. DuFresne" <[email-masked]>
Date: Sat, 13 Apr 2002 12:02:48 -0400 (EDT)

frontpage can be used without the extensions.  At least the client can use
frontpage on his end and then push the pages out without the extensions
being allowed, though, this may well disable some of the special
scripting.  Folks that shy away from frontpage tend to do so due to it's
repeated history of having security issues, though there may well be
further stability issues I'm unaware of additinally.  you might find
better help on getting FP up and running if really required on the apache
list or a FP specific listing.

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: Server Admin <[email-masked]>
Date: Sat, 13 Apr 2002 11:20:01 -0500

Thanks, Ron & I agree that FP issues belong on a more specific list except
it has only become a problem when the SSL and need for mod_ssl enters this
picture. BUT, belonging to most lists for quite a while, I have yet to find
a specific list and I've never seen this issue dealt with in detail enough,
and my large pile of doc printouts are mostly useless being out of date
with present Apache, etc. versions.... thus, I still have this problem and
even your comment proves to be true as I found out just yesterday... my
only concern was that the online order forms have cgi scripts called "web
bots" and I was surprised/baffled to see the forms work at all, although I
haven't tested everything on the forms...

Eventually perhaps FP will catch up with the latest Apache+ssl and I will
hobble along till then.....

Thanks for the patience on this list even if off-topic (but not entirely)....

Best regards,

Jack L. Stone
Server Admin

---

From: "Andrew Lietzow" <[email-masked]>
Date: Sun, 14 Apr 2002 11:25:58 -0500

Dear mod_ssl'ers,
I have in my possesion a diskette on which I backed up my Thawte CRT file
(at least I'm bright enough to have done that...but at the time I didn't
know that I would need to have backed up TWO files... anyhow...).  It has
been successfully installed previously on a SuSE Linux 7.1 server.  The box
crashed hard last weekend (fortunately, it is was not quite yet a production
server).  I could not get that fairly old P-100 system to come back up.
Everything I tried failed.  Apparently, it took a hit on a memory chip or
something critical to the system such that it could not be rebooted.  I
pulled hair for about a day while searching the SuSE site, and the entire
Inet crash recover routines on a SuSE box.  No magical answer appeared.  I
made the decision to upgrade.

Now I have installed SuSE 7.3 on this new server and I need to reinstall my
CERT.  I have the securedomainname.crt file in my possession on a diskette
but I do not have the original securedomainname.key file, or the
securedomainname.csr file (because I trust servers to never crash?).  The
files are gone now as I have completely reformatted that system during the
new install.

I have gone through the steps at
http://www.thawte.com/ucgi/gothawte.cgi?a=e380614470105000 to generate a new
server.key and server.csr file.  Since I am running Apache 2.0.35, I
modified my /usr/local/apache2/conf/ssl.conf file to access the new .key and
OLD .crt file.  It appears to be work through the ssl.conf file just fine
and then dies with a mismatch error.

The entries I made look like this:
SSLCertificateFile /usr/local/apache2/conf/ssl.crt/securedomainname.crt (the
old file from Thawte, copied over from diskette)
SSLCertificateKeyFile /usr/local/apache2/conf/ssl.key/securedomainname.key
(a new file).

Of course, perhaps critical to this routine is whether I answered the
questions EXACTLY the same during the creation of the NEW
securedomainname.csr file.  It's possible, but I'm not 100% certain.

When I attempt to fire up with:
./apachectl startssl
the system prompts me for a passphrase and it accepts it.  I did NOT enter a
passphrase when I requested my original Thawte CERT.  I don't know if this
is critical (i.e. is my passphrase encrypted into the CSR file and they use
this as part of the generation of my private.crt file?).  Anyhow, when I
ATTEMPT to fire up with

./apachectl startssl
the system prompts with

<Some of your private key files are encrypted for security reasons.
In order to read them, you have to provide us with the pass phrases.
securedomainname.com:443(RSA)>

I enter the pass phrase, and it returns

<Ok: Pass Phrase Dialog successful>

and then I get an "Unable to start httpd" error message.

I checked the /logs/error_log file where there is a record of a grumble...
<yadda, yadda, yadda, .... key values mismatch>.
Rather than spend hours attempting to make new .key and .csr files, and then
to "trick" the system into accepting my old.crt file, I need to ask the
question whether this is even feasible.  Was my original KEY file generated
with a random seed routine that made it so that when I sent my CSR file to
Thawte, I cannot ever create a KEY file on this server that would match to
my old CRT?

NOW that I see their caveat,
"Now PLEASE backup your www.xxx.com.key and make a note of the passphrase.
Losing your key will cost you money!" I imagine this is why this can't be
done, but I have to pose the question, just to be sure.  No use spending
another 100 bucks if I don't have to.  TIA,

Baffled and UNCERTIFIED on CRT'S,  I remain...

Andrew Lietzow
The ACL Group, Inc.

---

From: Cliff Woolley <[email-masked]>
Date: Sun, 14 Apr 2002 12:57:40 -0400 (EDT)

> files are gone now as I have completely reformatted that system during the

Sorry to be the one to have to tell you this, but you can't mix-and-match
like that.  The certificate is absolutely tied to the private key, because
the certificate contains the public key.  So you can't use the
certificate/public key unless you have the private key that goes with it.

I don't know if Thawte has a "replacement" program... I think some of the
CA's do.  So maybe you can get a reissued certificate to go with your new
private key for less than the full price.

Good luck,
Cliff

--------------------------------------------------------------
   Cliff Woolley
   [email-masked]
   Charlottesville, VA

---

From: "R. DuFresne" <[email-masked]>
Date: Sun, 14 Apr 2002 13:20:46 -0400 (EDT)

pull the drive and pop it into another machine so you can recover what ya
need.

Thanks,

Ron DuFresne

---

From: [email-masked]
Date: Sun, 14 Apr 2002 10:09:57 +0700

Unfortunately, you're out of luck. 
The .key file and .crt file are a related to each other much in the same way 
the SSH public/private key pairs are related.

I do have a question and a recommendation:

Q: Ok, the old server died, but was the hard-drive utterly non-functional? What 
prevents you from putting the HD into a functional Linux box, mounting it, and 
reading the old .key?

R: I use OpenSSL to manage the CSRs and the keys for our production servers - 
on my UNIX workstation. (Yep, I back things up onto out DLT tape setups from 
that workstation). Floppies go bad too often. 

Hope this helps

[email-masked]