Apache: Difference between revisions

==Canonical Domain==

Here is how we use Apache to answer requests to our multiple registered TLDs, but direct everything to our canonical "bare" domain.

<VirtualHost *:80>

   # redirect 'www' subdomain

   RewriteCond %{HTTP_HOST} !^$

   RewriteRule ^/?(.*) https://equality-tech.com/$1 [L,R=301,NE]   

*Flags: No Case, Last, Redirect permanent, No Escape <ref>https://httpd.apache.org/docs/current/rewrite/flags.html#flag_ne</ref>

For Debian-based distros, the apache binary is '''apache2''' rather than httpd, so for finding out what modules are built-in or enabled you would type

sudo apache2 -l

If mod_ssl.so is not listed in the output, it can be easily enabled by using the [[a2enmod]] command

sudo a2enmod ssl

Enabling module ssl.

See /usr/share/doc/apache2.2-common/README.Debian.gz on how to configure SSL and create self-signed certificates.

Run '/etc/init.d/apache2 restart' to activate new configuration!

A script for generating randomness (to help in creating a more cryptographically secure SSL key)

#! /usr/bin/env python

   Random().sample(string.letters +

   string.digits, 1)[0])

And then use that to create and store some randomness.

./randomness.py > file1

./randomness.py > file2

# which is then fed into openssl

sudo openssl genrsa -des3 -rand file1:file2:file3 -out server.key 1024

Do this if you want to remove the server key (useful if you want the SSL server to restart unattended)

sudo openssl rsa -in server.key -out server.pem

Generate the signed certificate

sudo openssl req -new -key server.pem -out server.csr

sudo openssl x509 -req -in server.csr -signkey server.pem -out server.crt

Copy certificate over to the configuration directory

sudo cp server.pem server.crt /etc/apache2/

sudo chmod 600 /etc/apache2/server.pem /etc/apache2/server.crt

{{Messagebox

Modify the (default) configuration file (only if you want to change the available ciphers used)

sudo vi /etc/apache2/mods-available/ssl.conf

My ubuntu system comes pre-configured to allow medium to highly secure ciphers

Now configure our directory paths, and permissions in an Apache configuration file

sudo cp /etc/apache2/sites-available/default-ssl /etc/apache2/sites-available/mysite-ssl

sudo vi /etc/apache2/sites-available/mysite-ssl

In addition to setting Document Root, I modified these two directives:

</pre>

# enable the site

sudo a2ensite mysite-ssl

# restart the server

sudo apache2ctl graceful

==SSL Providers==

You have a bunch of virtual hosts configured by various files in your Apache's configuration directories.  Since you can output them all with <code>apache2ctl -S</code>, you can also do a bit more parsing of the output to be able to quickly check if they're all responding.

for x in `apachectl -S 2>&1 | awk '/default server / { g=$3; print g} /namevhost / { g=$4; print g } /alias/ { g=$2; print g }' | sort -u`; do echo "checking $x"; curl --head --location http://$x; done

Who are the zombies trying to crack your WordPress site?

awk '$6 ~ "POST" && $7 ~ "wp-login" { ips[$1]++ } END {for (ip in ips) { print ip, " ", ips[ip], " POSTs" }}' /var/log/apache2/access.log

or,  

grep POST /var/log/apache2/access.log | cut -d ' ' -f 1 | sort | uniq -c

{{References}}