Subject: http to https redirect configuration question

From: "John W. Sopko Jr." <[email-masked]>
Date: Mon, 04 Feb 2002 11:48:56 -0500

I am having a difficult time solving the following: I want our
apache non-secure http:// server to redirect to the secure
https:// server whenever the non-secure server encounters a
.htaccess file in any directory? I do not want to redirect entire
directories or the server itself, only those that contain a
.htaccess file.

The standard apache Redirect or RedirctMatch cannot do this
because the .htaccess file is not typically specified by the
user. You run into a looping problem if you specify a redirect
in the .htaccess file itself.

I was hoping there is some switch at the server level to do this.
I of course searched all the docs and mailing archives for
a solution. There is a solution using javascript in the index.html
file that can do a redirect but this would have to be placed
in everyone's .index file and there is no guarantee users will
do this. 

Any solutions would be appreciated. Thanks.

-- 
John W. Sopko Jr.               University of North Carolina
email: [email-masked]         Computer Science Dept., CB 3175
Phone: 919-962-1844             Sitterson Hall; Room 135
Fax:   919-962-1799             Chapel Hill, NC 27599-3175
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Eduardo Gomez" <[email-masked]>
Date: Mon, 4 Feb 2002 12:12:20 -0500

Can this list implement a default header in the subject of all messages that
reads like "[modssl-users] " and THEN the subject?

I'm spending enough time sorting my mail box out already.

If the list admin cannot, oh well... Thanks anyway :)

_______________
Eduardo Gomez
Innerlab Productions
www.innerlab.com

---

From: "Gilles gros" <[email-masked]>
Date: Mon, 4 Feb 2002 09:27:27 -0800

We have from time to time the following traces in our Apache logs :

[Mon Feb  4 08:17:24 2002] [error] mod_ssl: SSL handshake interrupted by
system [Hint: Stop button pressed in browser?!] (System error follows)
[Mon Feb  4 08:17:24 2002] [error] System: Connection reset by peer (errno:
104)

Can anyone help us finding what can the problem be related to ?

Our apache is 1.3.20 mod_ssl 2.8.4 OpenSSL 0.9.6b.

Part of our configuration is :

<IfModule mod_ssl.c>

#   Pass Phrase Dialog:
#   Configure the pass phrase gathering process.
#   The filtering dialog program (`builtin' is a internal
#   terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog  builtin

# Adding that line because of info from mod_ssl mailing list to
# make more stable Apache SSL.
# To my understanding (and anyone who can correct me if I am wrong, please
do),
# some versions of Microsoft Internet Explorer (MSIE) have problems with
using the
# HTTP/1.1 protocol with SSL. What this command does is to turn off
keepalive
# facility and force HTTP/1.0 responses (rather than HTTP/1.1 responses)
when the
# browser (User-Agent) is a version of MSIE. If you would like more
information on
# this, you might try the following page from the mod_ssl FAQ:
#
# http://www.modssl.org/docs/2.8/ssl_faq.html#ToC49
#
<IfModule mod_setenvif.c>
        #SetEnvIf User-Agent ".*MSIE.*" nokeepalive \
                        ssl-unclean-shutdown downgrade-1.0 \
                        force-response-1.0
        SetEnvIf User-Agent "MSIE [1-4]" nokeepalive \
                        ssl-unclean-shutdown downgrade-1.0 \
                        force-response-1.0
        SetEnvIf User-Agent "MSIE [5-9]" ssl-unclean-shutdown
</IfModule>

#
#   Inter-Process Session Cache:
#   Configure the SSL Session Cache: First either `none'
#   or `dbm:/path/to/file' for the mechanism to use and
#   second the expiring timeout (in seconds).
#SSLSessionCache        none
#SSLSessionCache        shm:/opt/apache/logs/ssl_scache(512000)
SSLSessionCache         dbm:/opt/apache/logs/ssl_scache
SSLSessionCacheTimeout  300

#   Semaphore:
#   Configure the path to the mutual explusion semaphore the
#   SSL engine uses internally for inter-process synchronization.
SSLMutex  file:/opt/apache/logs/ssl_mutex

#   Pseudo Random Number Generator (PRNG):
#   Configure one or more sources to seed the PRNG of the
#   SSL library. The seed data should be of good random quality.
#   WARNING! On some platforms /dev/random blocks if not enough entropy
#   is available. This means you then cannot use the /dev/random device
#   because it would lead to very long connection times (as long as
#   it requires to make more entropy available). But usually those
#   platforms additionally provide a /dev/urandom device which doesn't
#   block. So, if available, use this one instead. Read the mod_ssl User
#   Manual for more details.
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random  512
#SSLRandomSeed startup file:/dev/urandom 512
#SSLRandomSeed connect file:/dev/random  512
#SSLRandomSeed connect file:/dev/urandom 512

SSLEngine       on
SSLCipherSuite
ALL:!ADH:!EXP56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

# The certificate files are now located under /opt/apache/conf
SSLCertificateFile /opt/apache/conf/XXX.crt
SSLCertificateKeyFile /opt/apache/conf/XXX.key

---

From: "Toomas Aas" <[email-masked]>
Date: Mon, 4 Feb 2002 20:37:08 +0200

Hi Eduardo!

> reads like "[modssl-users] " and THEN the subject?

I prefer it the way it is.

> I'm spending enough time sorting my mail box out already.

Why? Most modern mail clients let you sort the incoming mail into 
folders automatically.
--
Toomas Aas | [email-masked] | http://www.raad.tartu.ee/~toomas/
* I think, therefore I am overqualified.

---

From: NickM <[email-masked]>
Date: Tue, 05 Feb 2002 01:07:14 +0100 (CET)

No way, thats something that problems me also.  Not every emailer has 
filtering, esp web email.  Also it is standard practice to have a small key in 
the subject for visually filtering what's what.

It doesnt have to be big, something like [modu], and would not invade those 
with filters but allow those without or not using them to have something of use.

Thanks, Nick

---

From: "R. DuFresne" <[email-masked]>
Date: Mon, 4 Feb 2002 20:32:29 -0500 (EST)

filter on this:  To: [email-masked]

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: NickM <[email-masked]>
Date: Tue, 05 Feb 2002 04:36:07 +0100 (CET)

As just said, I do not have filtering!!

The list is not high traffic enough to concern me terribly, but would be nice.

---

From: "R. DuFresne" <[email-masked]>
Date: Mon, 4 Feb 2002 23:11:16 -0500 (EST)

Thats a shortcoming on your part though, a proper mail reader can
accomplish this chore.

Thanks,

Ron DuFresne