HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials

HowtoForge Forums | HowtoForge - Linux Howtos and Tutorials (http://www.howtoforge.com/forums/index.php)
-   Installation/Configuration (http://www.howtoforge.com/forums/forumdisplay.php?f=27)
-   -   ISPConfig3 How to have multiple manually created port based SSL client sites hosts (http://www.howtoforge.com/forums/showthread.php?t=60099)

zapyahoo 3rd January 2013 19:53

ISPConfig3 How to have multiple manually created port based SSL client sites hosts
 
This Is just a small how to have multiple SSL client sites hosts. This setup is port based, because apache2 only allows 1 SSL in port 443. This means each client SSL website will have a port that responds to https requests.

Having more than one SSL responding on port 443, also relatively easy to accomplish but implies having several eth cards or eth0 virtual clones (with individual LAN ip's) eth0 = lan ip1, eth0:1 =lan ip2, eth0:2 = lan ip3, etc. and several external WAN ip's pointing to each individual LAN Ip clone on port 443. But again not covered here.

Initial recommendations:
1. Don't use ISPConfig3 SSL features to create the SSL virtual host. It overrides the ports. Just create the normal http site, leave SSL off.
2. In this setup I will use example.org as domain and port 444 for the SSL.
3. Remember to open / NAT your firewall / router port 444 and point it at your webserver LAN IP.
4. This will cover 1 host setup, if you have many websites like I do just repeat the instructions for each website domain and assign a different port to each one.

Lets Start:
1. in /etc/apache2sites-available/ create a new vhost file and name it example.org.https.vhost
Code:

cd /etc/apache2sites-available/
sudo nano example.org.https.vhost

copy the below text into the file
replace all instances of example.org and insert your domain name
replace all instance of /var/www/clients/client1/web8 and insert the path to your ispconfig3 website root location
PHP Code:

<Directory /var/www/example.org>
    
AllowOverride None
    Order Deny
,Allow
    Deny from all
</Directory>

<
VirtualHost example.org:444>
      
DocumentRoot /var/www/example.org/web
  
    ServerName example
.org
    ServerAlias www
.example.org
    ServerAdmin webmaster
@example.org

    ErrorLog 
/var/log/ispconfig/httpd/example.org/error.log

    Alias 
/error"/var/www/example.org/web/error/"
    
ErrorDocument 400 /error/400.html
    ErrorDocument 401 
/error/401.html
    ErrorDocument 403 
/error/403.html
    ErrorDocument 404 
/error/404.html
    ErrorDocument 405 
/error/405.html
    ErrorDocument 500 
/error/500.html
    ErrorDocument 502 
/error/502.html
    ErrorDocument 503 
/error/503.html

    
<IfModule mod_ssl.c>
    
SSLEngine on
    SSLCertificateFile 
/var/www/clients/client1/web8/ssl/example.org.crt
    SSLCertificateKeyFile 
/var/www/clients/client1/web8/ssl/example.org.key
    SSLCertificateChainFile 
/var/www/clients/client1/web8/ssl/sub.class1.server.ca.pem
    SSLCACertificateFile 
/var/www/clients/client1/web8/ssl/ca.pem
    
</IfModule>

    <
Directory /var/www/example.org/web>
        
Options FollowSymLinks
        AllowOverride All
        Order allow
,deny
        Allow from all
    
</Directory>
    <
Directory /var/www/clients/client1/web8/web>
        
Options FollowSymLinks
        AllowOverride All
        Order allow
,deny
        Allow from all
    
</Directory>



    
# suexec enabled
    
<IfModule mod_suexec.c>
      
SuexecUserGroup web8 client1
    
</IfModule>
    
# Clear PHP settings of this website
    
<FilesMatch "\.ph(p3?|tml)$">
        
SetHandler None
    
</FilesMatch>
    
# php as fast-cgi enabled
    # For config options see: http://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html
    
<IfModule mod_fcgid.c>
        
IdleTimeout 300
        ProcessLifeTime 3600
        
# MaxProcessCount 1000
        
DefaultMinClassProcessCount 0
        DefaultMaxClassProcessCount 100
        IPCConnectTimeout 3
        IPCCommTimeout 360
        BusyTimeout 300
    
</IfModule>
    <
Directory /var/www/example.org/web>
        
AddHandler fcgid-script .php .php3 .php4 .php5
        FCGIWrapper 
/var/www/php-fcgi-scripts/web8/.php-fcgi-starter .php
        Options 
+ExecCGI
        AllowOverride All
        Order allow
,deny
        Allow from all
    
</Directory>
    <
Directory /var/www/clients/client1/web8/web>
        
AddHandler fcgid-script .php .php3 .php4 .php5
        FCGIWrapper 
/var/www/php-fcgi-scripts/web8/.php-fcgi-starter .php
        Options 
+ExecCGI
        AllowOverride All
        Order allow
,deny
        Allow from all
    
</Directory>


    
# add support for apache mpm_itk
    
<IfModule mpm_itk_module>
      
AssignUserId web8 client1
    
</IfModule>

    <
IfModule mod_dav_fs.c>
      
# Do not execute PHP files in webdav directory
      
<Directory /var/www/clients/client1/web8/webdav>
        <
FilesMatch "\.ph(p3?|tml)$">
          
SetHandler None
        
</FilesMatch>
      </
Directory>
      
DavLockDB /var/www/clients/client1/web8/tmp/DavLock
      
# DO NOT REMOVE THE COMMENTS!
      # IF YOU REMOVE THEM, WEBDAV WILL NOT WORK ANYMORE!
      # WEBDAV BEGIN
      # WEBDAV END
    
</IfModule>


</
VirtualHost

save with ctrl-x

2. Now let's make a symbolik link of this file into apache2 sites-enabled
Code:

sudo ln -s /etc/apache2/sites-available/example.org.https.vhost /etc/apache2/sites-enabled/100-example.org.https.vhost
3.Proceed to copy all the website SSL files into the ispconfig3 website folder. As you may in the above vhost file, the example.org website is using the folder /var/www/clients/client1/web8/ ... the SSL files need to be copied into the ssl folder /var/www/clients/client1/web8/ssl/
Once done rename the ssl.key and ssl.crt file into example.org.key and example.org.crt
Code:

cd /var/www/clients/client1/web8/ssl/
sudo mv ssl.key example.org.key
sudo mv ssl.crt example.org.crt

4. You are done and just need to restart apache2
Code:

sudo /etc/init.d/apache2 restart
Not necessary but useful:
You probably notice each time you restart apache2 with the command:
Code:

sudo /etc/init.d/apache2 restart
you get a bunch of warnings like this:
Code:

[warn] NameVirtualHost *:80 has no VirtualHosts
They are not critical but they tick me off and create a huge error log. Unfortunately ISPConfig3 uses a basic vhost config that we can change by editing the master vhost template file vhost.conf.master located in /usr/local/ispconfig/server/conf/
1. create a backup file:
Code:

cp /usr/local/ispconfig/server/conf/vhost.conf.master /usr/local/ispconfig/server/conf/vhost.conf.master.bk
2. open vhost.conf.master file:
Code:

sudo nano /usr/local/ispconfig/server/conf/vhost.conf.master
around line 9 you will see:
Code:

<VirtualHost {tmpl_var name='ip_address'}:{tmpl_var name='port'}>
delete
Code:

:{tmpl_var name='port'}
so the line looks like:
Code:

<VirtualHost {tmpl_var name='ip_address'}>
3. save the file, ctrl-x

till 3rd January 2013 20:05

With sni, you can run as many ssl sites on one ip and port 443 as you like in apache. Sni is supported by ispconfig out of the box, the above described setup is not required then. All current browsers support sni, only the old internet explorer in windows xp does not support it.

To use sni, ensure that sni is enabled under system > server config > web. Then you can enable ssl on every site even if they use the same ip address without doing any manual configuration.

zapyahoo 3rd January 2013 20:19

sni is great, give a couple more years for XP to die or drop to 1 or 2% of website visits. You can also google if you want:
https://en.wikipedia.org/wiki/Server_Name_Indication
Does not work on Windows XP, even Internet Explorer 8
Google analytics:
windows XP is stil used by 25% of users

till 3rd January 2013 20:47

Internet explorer 8 is old, I know the wikipedia article, posted it a several times here already :)

zapyahoo 3rd January 2013 20:58

Till I agree with you and would never use any kind of internet explorer :) old or new :) Just talking about website statistics, 25% of XP users is still a lot.

More, in my case, as you may read from other posts of mine, I use SSL mainly for facebook apps, ssl is mandatory, and my websites links are masked by facebook app urls, the user actually never sees my SSL URL:port, they only see the facebook url. Facebook apps are used all over the world where many, many users still run XP and or IE8.

zapyahoo 3rd January 2013 21:01

Till, since I grabbed you here. Is there an official API for ipsconfig3?
Would like to develop an social app or module for the main control panel.

till 3rd January 2013 21:38

Ispconfig has a remote api, take a look into the remote_client directory in the tar.gz file for example files and api docs.

zapyahoo 4th January 2013 01:49

Hello Till,

Was just testing sni, also works fine.
I found 2 ways of making it work, independent of ispconfig3.
1. By adding 1 main https.vhost with all SSL hosts
2. By adding several https vhost files, 1 website per host file with include other https hosts directive.

Regarding the sni...support in ispconfig3, what system is implemented?
1. 1 main https vhost file for all websites
or like I'm guessing,
2. 1 vhost file per website (with http 80 and https 443) and include all the other https vhost files

till 4th January 2013 08:11

ISPConfig uses one vhost file per website, if ssl is enabled for this site, the ssl vhost is defined in the website file.

SamTzu 12th January 2013 12:47

XP & IE8 & Bots
 
I keep seeing that claim everywhere but personally don't know anyone who uses WindowsXP or IE8 anymore. I'm skeptical about it's validity. I think it's mostly Bot's that confuse this issue.


All times are GMT +2. The time now is 10:10.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.