Subject: securing one area of a vhost in apache 2

From: Nick Tonkin <[email-masked]>
Date: Wed, 26 Feb 2003 21:49:34 -0800 (PST)

Hello,

I am using Apache/2.0.44 (Unix) mod_perl/1.99_09-dev Perl/v5.8.0
mod_ssl/2.0.44 OpenSSL/0.9.7

I have a virtual host which mostly is served without SSL. But it has one
area, /secure,  that needs to be secured with SSL. I've tried various
combinations of directives but can't get it to work. Right now I have:

<VirtualHost 123.456.789.123:8080>
    SSLEngine on
    SSLProtocol all
    SSLCipherSuite HIGH:MEDIUM
    SSLCertificateFile /home/debug/www/_conf/certs/ladyraquel.crt
    SSLCertificateKeyFile /home/debug/www/_conf/certs/ladyraquel.key
    SSLCACertificateFile /home/debug/www/_conf/certs/ca.crt
    SSLVerifyClient none

    <Directory /home/debug/www/ladyraquel/secure>
        SSLVerifyClient require
        SSLVerifyDepth 1
    </Directory>
</VirtualHost>

The server starts fine, serves non-SSL pages fine, but hangs when I
request /secure .

The error log has nothing, but the access log shows that the request went
instead to the server's first virtual host, with a weird method of 'L'.

Any advice much appreciated.

- nick

-- 

~~~~~~~~~~~~~~~~~~~~
Nick Tonkin   {|8^)>

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Steven Resnick" <[email-masked]>
Date: Wed, 26 Feb 2003 22:14:09 -0800

The technique I have seen for this is to simply serve the entire site using
SSL and link only to the areas you want as secure.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Nick Tonkin
> Sent: Wednesday, February 26, 2003 9:50 PM
> To: [email-masked]
> Subject: securing one area of a vhost in apache 2
>
>
>
> Hello,
>

---

From: "R. DuFresne" <[email-masked]>
Date: Thu, 27 Feb 2003 09:34:00 -0500 (EST)

You gave this site it's own IP address yes?

Virtual hosting with non-ssl works in a 'software' aware mode, while
virtual hosting with ssl is more 'hardware' in nature requireing specifici
IP addressing to function properly.

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: Nick Tonkin <[email-masked]>
Date: Thu, 27 Feb 2003 12:54:05 -0800 (PST)

> SSL and link only to the areas you want as secure.

But that sort of defeats the whole porpoise! I want users to be able to
browse the site and then when they enter a certain area, the connection
should swicth to SSL-encrypted via https. Are you saying that this cannot
be done with a separate virtual host?

- nick

-- 

~~~~~~~~~~~~~~~~~~~~
Nick Tonkin   {|8^)>

---

From: Nick Tonkin <[email-masked]>
Date: Thu, 27 Feb 2003 12:57:55 -0800 (PST)

> You gave this site it's own IP address yes?

No. It is using NameVirtualHost.

> IP addressing to function properly.

Hmm. I must have missed this in the docos. Rechecking ...

Hm. Well, I see that I was on the wrong track with "How can I authenticate
my clients for a particular URL based on certificates but still allow
arbitrary clients to access the remaining parts of the server?" ... that
appears on closer inspection to deal with certificate-wielding clients ...

Hm.

So, bottom line, it is not possible to have a virtual host accessible via
http and require SSL for a part of it. Is that correct?

Thanks,

- nick

-- 

~~~~~~~~~~~~~~~~~~~~
Nick Tonkin   {|8^)>

---

From: "Don Woodward" <[email-masked]>
Date: Thu, 27 Feb 2003 16:16:31 -0500

Take a look at the "RedirectMatch" configuration directive. You should be
able to do something like

RedirectMatch http://www.mysite.com/secure/*
https://www.mysite.com/secure/secureindex.htm

73's

Don Woodward

---

From: "R. DuFresne" <[email-masked]>
Date: Thu, 27 Feb 2003 16:19:19 -0500 (EST)

> http and require SSL for a part of it. Is that correct?

It's somewhat dependant upon what you are serving up.  If there are like
perhaps two ends of the virtual host<s>, say, http://www.someplace.com and
https://someplace.com under the same IP address space, then you will work
okay.  If you are virtual hosting more then this, then you need seperate
IP addresses for at least each and every SSL vh, and if there's a no0n-ssl
end, that vh would need to most likely match the IP addressing setup of
the ssl side.  I'm sure others will correct or enhance what I'm prolly
splaining poorly here.

thanks,

Ron DuFresne