Newsgroup: it.comp.os.linux.iniziare
Titolo: https

uso RH 7.3
vorrei fare in modo che il mio server web sia criptato.
Ho attivato il modulo ssl
Ho abilitato listen 443
ho pure creato un virtual host, ma non funziona.
Qualcuno mi sa aiutare e/o consigliare dove reperire info complete e 
possibilmente in italiano?
ciao e grazie

"Alex" <n...@spam.pls> writes:

Tipo la guida su 
apache.org
?
btw da qualche parte (tipo un virtualhost) dovresti mettere SSLEngine on
.a.
-- 
Il mattino ha l'oro in bocca. Il MATTino ha l'OrO In bOcca.
i lma tt ino ha l'o roin bocc a.ilmattinohal'oroinbocca. il ma tt in
oh al' or oi nb oc ca. il matti noha l'oroinbocca. IL MATtiNO Ha l'ORO
InBOCCa. I l m a t t i n o  h a l' o r o i n b o c c a . ilmattinohal'oroin
BoCcA. iLmAtTiNoHaL'oRoInBoCcA.

avevo scritto alcune note tempo fa dovedo mettere su
un ssl: chiaramente orientate alla mia inatallazione, ma
magari ti possono essere utili:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
  <meta content="text/html; charset=ISO-8859-1"
 http-equiv="content-type">
  <title>SSL web server install</title>
</head>
<body>
<h2>Secure Web Server</h2>
<br>
This is a very quick tutorial about setting up an <a
 href="
http://www.apache.org
">Apache Web Server</a>
with SSL capabilities. Note that you should already
know how to install Apache; here it is covered just
the part about SSL support: SSL configuration and
certificate management.<br>
That is you should already know
<ul>
 <li> to install Apache
 <li> to install OpenSSL
</ul>
The tutorial will cover:
<ul>
 <li> SSL Certificate creation and installation
</ul>
If you just want to test a setup, follow the <a
href="#quick_reference">
Quick Reference</a>
<br>
<h3>Why do I need SSL?</h3>
<br>
If you do not know the answer, probably you do not need this tutorial
neither, anyway, if you are in some way concerned about the security of
your connection, probably SSL could be for you.<br>
You should check <a href="
http://www.openssl.org
">OpenSSL site</a>
for this protocol features, anyway, the main points that this
technology try to resolve are:<br>
<br>
<ul>
  <li>Give a Secure connection, so
that an occasional, or malicious external observer cannot see what data
I am exchanging with the server</li>
  <li>Authenticate the server, to
assure the client (the person who is browsing the site) that
the server is really the one I want to speak to, i.e. it is not a fake
server, trying to steal my data</li>
  <li>SSL can also authenticate
the client, but this is not cvered here.</li>
</ul>
<br>
If this is really our case, you should proceed with the tutorial: you
will need the following<br>
<br>
<ul>
  <li>a working platform (here I
suppose you have a linux-box) with configured network</li>
  <li>the last version of Apache (now Apache 2.0.53)</li>
  <li>the SSL library (now OpenSSL 0.9.7e)</li>
</ul>
<br>
<h3>OpenSSL Installation</h3>
The software could already be installed in your machine: to check if
OpenSSL is already installed, you should verify for the availability of
the <span style="font-weight: bold;">openssl</span>
command: if this is present, the ssl library has been installed,
tipically in /usr/local/openssl, otherwise, install a precompiled
package, or <a href="
http://www.openssl.org/source
">download the
sources</a> and install them.<br>
<br>
The standard compilation and installation is accomplished by the
following steps:<br>
<br>
<pre>$ ./config<br><br>$ make<br><br>$ make test<br><br>$ make
install<br><br></pre>
as documented in the INSTALL file coming with the source: this will
install the library in /usr/local/openssl.<br>
<br>
<br>
<h3>Apache Installation</h3>
<br>
If Apache is present, you should run<br>
<pre>/usr/local/apache2/bin/httpd -v<br></pre>
and see something like<br>
<pre>Server Version: Apache/2.0.53</pre>
This is very good, but there a last thing to verify, i,e, the support
for SSL protocol: you should run<br>
<pre>/usr/local/apache2/bin/httpd -l</pre>
and check for the presence of a line such as <br>
<pre>mod_ssl.c</pre>
If you don't have httpd, in you system, or your httpd does not support
SSL, you should consider to download and compile Apache: you can get
the last version from the official <a
 href="
http://httpd.apache.org/download.cgi
">Apache web site</a>, and
compile it: with respect to the standard procedure you should ensure
to configure SSL support:<br>
<pre>
# ./configure --enable-ssl
</pre>
<br>
and the server should be started with:
<pre>
/usr/local/apache2/bin/apachectl startssl
</pre>
<br>
<br>
<h3>SSL Configuration</h3>
<br>
<h4>SSL Authentication Mechanism</h4>
The typical use of SSL, or, if you prefer, the use
of SSL covered in this document, is the protection of
the transaction from unauthorized listener: to accomplish this
we must guarantee essentially 2 things:
<ul>
 <li> that the server we are speaking to is really the one we
think</li>
 <li> that the data exchanged with the server is not intecepted
 by others</li>
</ul>
This is accomplished using certificates and digital signatures,
essentially:
<ul>
 <li>the server must have a unique identification key
 </li>
 <li> the key must be signed by some well known and trusted entity</li>
</ul>
<br>
<h4>Server key</h4>
<br>
The server, to be identified, must have a unique identifier:
The server key is unique and referred to the server: it must be
generated by
the server himself:
<br>
<h4>Setup</h4>
<br>
First of all it is necessary to modify the Apache configuration file
accordingly to enable SSL: just add in the httpd.conf file
(tipically /usr/local/apache2/conf/httpd.conf) the following line:
it just say that, if there's SSL support, the configuration
is found in the ssl.con file):
<pre>
#
# Bring in additional module-specific configurations
#
<IfModule mod_ssl.c>
    Include conf/ssl.conf
</IfModule>
</pre>
The SSL will keep various configuration: starting from a
standard configuration file, whose location is
determined by the previous configuration lines,
the main point do modify are the 2 section
Server Private Key:
SSLCertificateKeyFile /usr/local/apache2/conf/ssl.cert/serverkey.pem
and
Server Certificate:
SSLCertificateFile /usr/local/apache2/conf/ssl.cert/newcert.pem
<br>
<h4>Where to get/how to build the needed certificates</h4>
<br>
The installation of OpenSSL comes complete with the
needed utility to manage the certificates: the basic
idea is
<ul>
  <li> create a requesto for the certificate
  <li> get the certificate signed by a signing authority
</ul>
the server adminitrator must create his server key and
the certificate request: this is accomplished by the
CA.pl script, as in the following:
<pre>
# create a request (private server key, encrypted and request) ->
newreq.pem
/usr/local/openssl/misc/CA.pl -newreq
</pre>
The server key is the one which is send to the browser
in the connection phase: the default generated file
is password protected: in this way the password must
be given each time the web server is started: this is
not very handsome if the web server is started in some
script: so it can be useful to have the server key without
password:
<pre>
# remove password to server key
openssl rsa -in newreq.pem -out serverkey.pem
</pre>
Note that the resulting file serverkey.pem is the one which will
be indicated in ssl.conf.
This file contains the certificate that can be imported
in the client browser (in Firefox: Preferences,
Advanced, Manage Certificates, Web Sites, Import) to recognize the
Apache server without any warning.
<h4>Certificate signing</h4>
The server key will tipically be signed by a trusted source: the idea
is
that each browser recognize some certificate authorities (for example,
in
Firefox, you can find them in  Edit, Preferences, Advanced,
Manage Certificates, Authorities).
To have you web server recognized, you should  get your key signed
by one of this authorities, but the things will cost some money:
tipically, the more the authoritiy is known, the more you will
pay, but you tipically have some logo you can put on your
secure pages.
To test the whole thing, anyway, you can sign the certificate yourself:
you can build the Certificate Authoritiy file with the following
script:
<pre>
## create a CA
/usr/local/openssl/misc/CA.pl -newca
</pre>
and the sign the key  you already built:
<pre>
# sign the request -> contains certificate and private key ->
newcert.pem
# this file can be imported to the browser
/usr/local/openssl/misc/CA.pl -signreq
</pre>
This give you the server certificate, signed by yourself, and the
file newcert.pem is the one you point to in the ssl.conf configuration
file.
<h4>Use a Certification Authority or sign by yourself?</h4>
A certificate must be signed by a Certification Authority: it is
possible to become a Certification Authority just using the script
present in the OpenSSL library:
<pre>
/usr/local/openssl/misc/CA.pl -newca
</pre>
This creates a MAster Certificate, to sign other certificates
(the file demoCA/cacert.pem can be imported in the browser
(in Firefox: Preferences,
Advanced, Manage Certificates, Authorities, Import) so that
we can be recognized as Certificate Authorities:
But, so, why pay for an externally signed certificate?
TODO
<a name="quick_reference">
<h3>The Quick reference</h3>
</a>
<ul>
 <li> install SSL library: you should have a script
  <pre>
  /usr/local/openssl/misc/CA.pl
  </pre>
  If you have the script, probably there's he whole SSL package
 <li> install Apache with support for SSL: in the configuration
 file (/usr/local/apache2/conf/httpd.conf) add the configuration for
 SSL:
<pre>
#
# Bring in additional module-specific configurations
#
<IfModule mod_ssl.c>
    Include conf/ssl.conf
</IfModule>
</pre>
 <li> create all the needed cetificates (auto-sign them):
 from the directory /usr/local/apache2/con/ssl.cert (create
 the directory if it is not present) use the following script:
<pre>
# Certificate creation example:
## create a CA
/usr/local/openssl/misc/CA.pl -newca
# create a request (private server key, encrypted and request) ->
newreq.pem
/usr/local/openssl/misc/CA.pl -newreq
# remove password to server key
openssl rsa -in newreq.pem -out serverkey.pem
# sign the request -> contains certificate and private key ->
newcert.pem
# this file can be imported to the browser
/usr/local/openssl/misc/CA.pl -signreq
</pre>
<li>
add the file \texttt{serverkey.pem} in the configuration file
sll.conf in a raw such as:
SSLCertificateKeyFile /usr/local/apache2/conf/ssl.cert/serverkey.pem
(search the SSLCertificateKeyFile, comment the old value and insert
your one)
<li>
add the file \texttt{newcert.pem} in the configuration file
sll.conf in a raw such as:
SSLCertificateFile /usr/local/apache2/conf/ssl.cert/newcert.pem
(search the SSLCertificateFile, comment the old value and insert
your one)
 <li> start Apache with support for SSL  with
  <pre>
  /usr/local/apache2/bin/apachectl startssl
  </pre>
</ul>
</body>
</html>

"Alex" <n...@spam.pls> wrote:

# chown  root:apache  /usr/sbin/suexec
# chmod  u=xs,g=x,o=  /usr/sbin/suexec
e leggi tutti i log file.
Ciao,
 ___ 
/_|_\  Umberto Salsi
\/_\/  
www.icosaedro.it