Denying SSL

Discussion in 'General' started by alexillsley, Jan 15, 2007.

  1. alexillsley

    alexillsley ISPConfig Developer ISPConfig Developer

    Say i had the site mysite.com and this was the only site with SSL https

    how can i stop users going to https://theresite.com and it displaying my site

    Thanks,
    Alex
     
  2. mlz

    mlz New Member

    Assuming that theirsite.com is mirroring your site without your permission, you can put a deny hostip into your apache config and keep them from mirroring (using wget, curl, or the like)...
     
  3. alexillsley

    alexillsley ISPConfig Developer ISPConfig Developer

    no there not doing it on purpose every one of clients sites, when you goto ssl https of there site it displays my one:confused:
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    You need a separate IP address for every site, then you can have a address like https://theresite.com. Otherwise you will get the SSL site of the IP address if you use a IP for more then one site.
     
  5. alexillsley

    alexillsley ISPConfig Developer ISPConfig Developer

    So i only get one SSL per server then? Is it possible to allow the SSL to only work from 1 domain?
     
  6. martinfst

    martinfst ISPConfig Developer ISPConfig Developer

    No, you get one SSL per IP.
    A server can have multiple IP addresses assigned on one ethernet card. And you can have multiple ethernet cards in a system.
     
  7. alexillsley

    alexillsley ISPConfig Developer ISPConfig Developer

    If i just add another IP to my ethernet card will ISP config be able to use this when setting up a site?
    Thanks,
    Alex
     
  8. martinfst

    martinfst ISPConfig Developer ISPConfig Developer

    You'd have to add that IP in the ISPConfig administration settings, and then you can use it from a dropdown list when creating new sites.
     
  9. alexillsley

    alexillsley ISPConfig Developer ISPConfig Developer

    I have added the IP to my ethernet card:

    Code:
    Allias: 
    IP Address: 192.168.1.11
    NetMask: 255.255.255.0
    
    and added it to Management-> Server -> Settings -> IP list

    but then when i goto a domain i assigned it to it displays the shared ip page:confused:

    How can i get this to work?

    Thanks,
    Alex
     
  10. martinfst

    martinfst ISPConfig Developer ISPConfig Developer

    What's the output of
    Code:
    ifconfig
    ?
     
  11. alexillsley

    alexillsley ISPConfig Developer ISPConfig Developer

    Heres the output:


    server1:~ # ifconfig
    eth0 Link encap:Ethernet HWaddr 00:D0:09:CB:BC:61
    inet addr:192.168.1.10 Bcast:192.168.1.255 Mask:255.255.255.0
    inet6 addr: fe80::2d0:9ff:fecb:bc61/64 Scope:Link
    UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
    RX packets:3917 errors:0 dropped:0 overruns:0 frame:0
    TX packets:4666 errors:0 dropped:0 overruns:0 carrier:0
    collisions:0 txqueuelen:1000
    RX bytes:695079 (678.7 Kb) TX bytes:2334668 (2.2 Mb)
    Interrupt:3 Base address:0xd400

    lo Link encap:Local Loopback
    inet addr:127.0.0.1 Mask:255.0.0.0
    inet6 addr: ::1/128 Scope:Host
    UP LOOPBACK RUNNING MTU:16436 Metric:1
    RX packets:20191 errors:0 dropped:0 overruns:0 frame:0
    TX packets:20191 errors:0 dropped:0 overruns:0 carrier:0
    collisions:0 txqueuelen:0
    RX bytes:1212934 (1.1 Mb) TX bytes:1212934 (1.1 Mb)

    server1:~ #
     
  12. martinfst

    martinfst ISPConfig Developer ISPConfig Developer

    Which means you haven't added the IP to the network card (yet).
    There are two routes to accomplish this. One is via ISPConfig, in which case you have to change an .inc file somewhere in /home/admispconfig (it's described in a thread somewhere), but the drawback is that this file will be overwritten with any update.

    I've chosen to modify my interfaces file. Now this depends a bit on the used Linux distribution, which has not been mentioned yet in this thread. For Ubuntu this file is /etc/network/interfaces and you should edit that so it looks similar to
    Code:
    # The primary network interface
    auto eth0
    iface eth0 inet static
            address 172.16.3.120
            netmask 255.255.255.0
            network 172.16.3.0
            broadcast 172.16.3.255
    
    auto eth0:0
    iface eth0:0 inet static
            address 172.16.3.121
            netmask 255.255.255.0
            network 172.16.3.0
            broadcast 172.16.3.255
            gateway 172.16.3.1
    
    After saving this file you can give the command
    Code:
    ifup eth0:0
    Next you need to go to ISPConfig and in the management part change the server settings and add there the IP's of the server. Then you'll see them in the drop down list for a new site.
     
  13. alexillsley

    alexillsley ISPConfig Developer ISPConfig Developer

    it already appears to wrok

    It already should work look:

    server1:~ # ifstatus eth-id-00:d0:09:cb:bc:61
    eth0 device: Silicon Integrated Systems [SiS] SiS900 PCI Fast Ethernet (rev 02)
    eth0 configuration: eth-id-00:d0:09:cb:bc:61
    eth0 is up
    2: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 1000
    link/ether 00:d0:09:cb:bc:61 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.10/24 brd 192.168.1.255 scope global eth0
    inet 192.168.1.11/24 brd 192.168.1.255 scope global secondary eth0
    inet6 fe80::2d0:9ff:fecb:bc61/64 scope link
    valid_lft forever preferred_lft forever
    eth0 IP address: 192.168.1.10/24
    secondary eth0 IP address: 192.168.1.11/24
    Configured routes for interface eth0:
    default 192.168.1.1 - -
    169.254.0.0 - 255.255.0.0 eth0
    Active routes for interface eth0:
    192.168.1.0/24 proto kernel scope link src 192.168.1.10
    169.254.0.0/16 scope link
    default via 192.168.1.1
    1 of 2 configured routes for interface eth0 up
    server1:~ #
     
  14. martinfst

    martinfst ISPConfig Developer ISPConfig Developer

    :confused:
    Never seen ifconfig with no options does not report all IP addresses. Which distro are you using?
     
  15. alexillsley

    alexillsley ISPConfig Developer ISPConfig Developer

    OpenSUSE 10.2
     
  16. falko

    falko Super Moderator ISPConfig Developer

    Did you try from within your local network or from the outside? The problem if you try from the outside is that you can forward port 80 from your router to only one local IP address, not to two. So if you forwarded port 80 to 172.16.3.120, but your new domain is on 172.16.3.121, then you will get the Shared-IP page because the router forwards the request to 172.16.3.120.

    If you do this from within your LAN, the same will happen unless you use a local DNS server that resolves your domains locally.
     
  17. alexillsley

    alexillsley ISPConfig Developer ISPConfig Developer

    :( well its not possible then
     

Share This Page