Apache - Revision history

Sstrutt: Added NoIndex tag and depreciated note

2012-02-09T10:48:29Z

Added NoIndex tag and depreciated note

← Older revision		Revision as of 10:48, 9 February 2012
Line 1:		Line 1:
	~~{\|cellpadding="4" cellspacing="0" border="1"~~		__NOINDEX__
	~~\|- style="background-color:#bbddff;"~~
	~~! File path !! What~~'~~s there~~		'''This page is now depreciated - please see new [[:Category:Apache\|Apache]] pages'''
	\|-
	\| ~~<code> /var/www </code> \|\| Default web root~~
	\|-
	~~\| <code> /var/log/apache</code> \|\| Logs~~
	\|-
	~~\| <code> /etc/apache2 </code> \|\| Config files~~
	\|-
	~~\| <code> /etc/php5/apache2 </code> \|\| PHP config file~~
	\|}

	= Configuration =		= Configuration =

Sstrutt: /* Create Secure Website */ Moved to own page

2012-02-09T10:38:51Z

Create Secure Website: Moved to own page

@@ Line 13: / Line 13: @@
 = Configuration =
 == Log Rotation ==
 There are two ways to ensure your logs get rotated...

Sstrutt: /* Host Multiple Sites */ Moved to own page

2012-02-09T10:36:03Z

Host Multiple Sites: Moved to own page

@@ Line 13: / Line 13: @@
 = Configuration =
 == Create Secure Website ==
 === Certificates ===

Sstrutt: /* Configuration */ Added "Create Secure Website"

2012-02-09T10:26:16Z

Configuration: Added "Create Secure Website"

← Older revision		Revision as of 10:26, 9 February 2012
Line 80:		Line 80:

	</VirtualHost		</VirtualHost

			== Create Secure Website ==
			=== Certificates ===
			In order to run a secure website you need certificates, whist providing a full explanation as to the purpose and usage of certificates is beyond the scope of this page, I'll attempt to summarise...

			What kind of certificate your require depends on what you are going to use the site for. Generally speaking a website that's going to be accessed by the general public or non IT-literate users will need to be signed by one of the big certificate authorities (aka well-known root CA) which are already trusted by web-browsers; but if its a internal or test site, or its only going to be access by people who know and trust you, a self-signed certificate will be fine. It boils down to how much trust a user needs to have in your website, and what level of monetary insurance there should be if the security mechanism breaks down.

			A '''self-signed certificate''' will present an alert to the user, asking them if they really trust the website they're accessing. They can either decide that they do trust you or close the page. If they do trust you, and trust that they're hit your genuine website, they can permanently accept your self-signed certificate as valid and trustworthy. Note that if they (for some reason) go to an invalid website masquerading as you on, before they've accepted your certificate as valid, they can be tricked into trusting somebody else instead.

			A '''commercially signed certificate''' will normally automatically provide validation that the website is valid and trustworthy, but will also normally cost money. Cheaper (or sometimes free if you're a person rather than a company) require limited validation that you are who you say you are, and minimal insurance for an loss due to security breach. More expensive certificates can be more flexible (can cover an entire domain rather than just a single host), provide greater insurance, and should provide greater assurance to your users (they'll also require much more stringent validation to confirm you (or your company) actually exists, you own your domain etc etc).

			If you expect to be handling any money/card transactions or other highly sensitive data, then securing your website can be hard-work and expensive. Both in terms of the certificate(s) you need to purchase, and other measures you need to take to ensure your site is actually secure. There is good reason why many online businesses use 3rd party websites for their transactions. Unless you have dedicated staff that can continually apply preventative measures (be it OS patching, reacting to PHP vulnerabilities, or whatever) and that can promptly detect and react to potential security breaches, do not take on the responsibility yourself. If your site gets breeched, and your clients/customers become exposed, its your fault.

			=== Create Self-Signed Certificate ===
			This is basically an adapted version of what has been documented previously by [http://www.vanemery.com/Linux/Apache/apache-SSL.html Van Emery], if well worth checking out.

			# '''Create private (self generated) Certificate Authority (CA) key and certificate for you/your organisation'''
			#* These will be used as a basis for any future cert/key's for web-servers you need - keep them safe!
			## Create folder for them, and move into the folder
			##* EG <code> mkdir /root/certs </code>
			##* EG <code> chmod 0770 /root/certs </code>
			##* EG <code> cd /root/certs </code>
			## Create CA key (you'll need to provide a passphrase/password for your key)
			##* EG <code> openssl genrsa -des3 -out self-ca.key 2048 </code>
			## Create CA X.509 certificate (you'll need to provide details about you (if your website is public, these details will viewable))
			##* EG <code> openssl req -new -x509 -days 3650 -key self-ca.key -out self-ca.crt </code>
			## Check certificate
			##* EG <code> openssl x509 -in self-ca.crt -text -noout </code>
			# '''Create a private key and certificate for your website'''
			## Generate the private key for the server (you'll need to provide a passphrase/password for your key)
			##* This is specific to your server (not the website)
			##* EG <code> openssl genrsa -des3 -out my-server.key 1024 </code>
			## Create a Certificate Signing Request (CSR) for the website
			##* EG <code> openssl req -new -key my-server.key -out web-my-server.csr </code>
			##* The Common Name ''must'' match the FQDN of your website
			## Create certificate for the website
			##* EG <code> openssl x509 -req -in web-my-server.csr -out web-my-server.crt -sha1 -CA self-ca.crt -CAkey self-ca.key -CAcreateserial -days 3650 </code>
			## Check certificate
			##* EG <code> openssl x509 -in web-my-server.crt -text -noout </code>
			## Protect keys and copy to Apache directory
			##* EG <code> chmod 0400 *.key </code>
			##* EG <code> mkdir /etc/apache/ssl </code>
			##* EG <code> cp web-my-server.crt /etc/apache/ssl/</code>
			##* EG <code> cp my-server.key /etc/apache/ssl/</code>
			##* EG <code> cp self-ca.crt /etc/apache/ssl/</code>

			=== Setup Secured Website ===
			# Create sub-folders for your web-sites, eg
			#* EG <code> mkdir /var/www/www.domain.com </code>
			# Create sub-folders for your web-sites' logs, eg
			#* EG <code> mkdir /var/log/apache2/www.domain.com </code>
			# Enable <code>mod_ssl</code>
			#* <code> cd /etc/apache2/mods-enabled </code>
			#* <code> ln -s ../mods-available/ssl.conf ssl.conf </code>
			#* <code> ln -s ../mods-available/ssl.load ssl.load </code>
			# Create config file for site (see below for content)
			#* EG <code> vi /etc/apache2/sites-available/ssl-site </code>
			# Enable site
			#* <code> cd /etc/apache2/sites-enabled </code>
			#* <code> ln -s ../sites-available/ssl-site ssl-site </code>
			# Restart Apache to apply
			#* <code> service apache2 restart </code>

			<IfModule mod_ssl.c>
			<VirtualHost _default_:443>
			ServerName www.domain.com
			ServerAdmin info@domain.com

			DocumentRoot /var/www/www.domain.com
			<Directory />
			Options FollowSymLinks
			AllowOverride None
			</Directory>
			<Directory /var/www/www.domain.com>
			Options Indexes FollowSymLinks MultiViews
			AllowOverride None
			Order allow,deny
			allow from all
			</Directory>

			ErrorLog "\|/usr/sbin/rotatelogs /var/log/apache2/www.domain.com/error-%Y-%m-%d.log 86400"
			CustomLog "\|/usr/sbin/rotatelogs /var/log/apache2/www.domain.com/access-%Y-%m-%d.log 86400" combined

			# SSL Engine Switch:
			# Enable/Disable SSL for this virtual host.
			SSLEngine on
			# Server Certificate:
			SSLCertificateFile /etc/apache2/ssl/mail-sync2.crt

			# Server Private Key:
			SSLCertificateKeyFile /etc/apache2/ssl/web2-server.key

			# Server Certificate Chain:
			SSLCertificateChainFile /etc/apache2/ssl/self-ca.crt

			# Certificate Authority (CA):
			SSLCACertificateFile /etc/apache2/ssl/self-ca.crt

			</VirtualHost>
			</IfModule>

	== Log Rotation ==		== Log Rotation ==

Sstrutt: Added "Host Multiple Sites"

2012-02-06T17:28:57Z

Added "Host Multiple Sites"

@@ Line 11: / Line 11: @@
 | <code> /etc/php5/apache2	</code> || PHP config file
 |}
 == Log Rotation ==
@@ Line 40: / Line 109: @@
 #* <code> service apache2 restart </code>
-== Troubleshooting ==
+= Troubleshooting =
-=== NameVirtualHost *:80 has no VirtualHosts ===
+== NameVirtualHost *:80 has no VirtualHosts ==
 On restarting Apache you get presented with the following warning
   [Thu Jan 12 10:58:20 2012] [warn] NameVirtualHost *:80 has no VirtualHosts

Sstrutt: Added php path

2012-02-02T11:23:44Z

Added php path

← Older revision		Revision as of 11:23, 2 February 2012
Line 8:		Line 8:
	\|-		\|-
	\| <code> /etc/apache2 </code> \|\| Config files		\| <code> /etc/apache2 </code> \|\| Config files
			\|-
			\| <code> /etc/php5/apache2 </code> \|\| PHP config file
	\|}		\|}

Sstrutt: Added "Troubleshooting"

2012-01-12T11:17:42Z

Added "Troubleshooting"

← Older revision		Revision as of 11:17, 12 January 2012
Line 37:		Line 37:
	# Restart the apache service		# Restart the apache service
	#* <code> service apache2 restart </code>		#* <code> service apache2 restart </code>

			== Troubleshooting ==
			=== NameVirtualHost *:80 has no VirtualHosts ===
			On restarting Apache you get presented with the following warning
			[Thu Jan 12 10:58:20 2012] [warn] NameVirtualHost *:80 has no VirtualHosts

			This is generally caused by duplicate <code>NameVirtualHost</code> entries in your config.

			Perform the following in <code>/etc/apache2</code> folder to identify where the entries and delete the unwanted duplicates..
			grep NameVir * -R

Sstrutt: Added "Log Rotation"

2012-01-12T11:12:32Z

Added "Log Rotation"

@@ Line 9: / Line 9: @@
 | <code> /etc/apache2	</code> || Config files
 |}
 == User/pass restrictions ==

Sstrutt: More typo

2011-02-08T12:36:49Z

More typo

← Older revision		Revision as of 12:36, 8 February 2011
Line 3:		Line 3:
	! File path !! What's there		! File path !! What's there
	\|-		\|-
	\| <code> /var/www </code> \| Default web root		\| <code> /var/www </code> \|\| Default web root
	\|-		\|-
	\| <code> /var/log/apache</code> \| Logs		\| <code> /var/log/apache</code> \|\| Logs
	\|-		\|-
	\| <code> /etc/apache2 </code> \| Config files		\| <code> /etc/apache2 </code> \|\| Config files
	\|}		\|}

Sstrutt: Typo fixes

2011-02-07T11:19:23Z

Typo fixes

← Older revision		Revision as of 11:19, 7 February 2011
Line 4:		Line 4:
	\|-		\|-
	\| <code> /var/www </code> \| Default web root		\| <code> /var/www </code> \| Default web root
			\|-
	\| <code> /var/log/apache</code> \| Logs		\| <code> /var/log/apache</code> \| Logs
			\|-
	\| <code> /etc/apache2 </code> \| Config files		\| <code> /etc/apache2 </code> \| Config files
	\|}		\|}