RE: New version, release candidate for 1.4

On Mon, 2002-09-16 at 17:54, Rob Hagopian wrote:
> I haven't because I'm a bit concerned about having to change all the clients
> again... The instrs below seem straightforward except that I don't have
> build boxes for all the redhat versions... Is there a good way to seamlessly
> upgrade to 1.3.90 - that is, no change in server cert or port numbers?
> 
> Please feel free to tell me to RTFM since I haven't :-)

The text document that I still haven't written basically goes as
follows:

1. What do I do convert a current 1.0.x style current.pem key/cert pair
into something that apache will understand?

Nothing. 
cp /etc/current/current.pem /etc/httpd/conf/ssl.crt/server.crt
cp /etc/current/current.pem /etc/httpd/conf/ssl.key/server.key

If you got real adventurous you could then EDIT those two files with a
plain text editor and remove the part of the file that isn't needed.
(IE, for server.crt, you'd remove the key, and for server.key you'd
remove the certificate)

I didn't on mine, and it works perfectly. No changes on the clients.

2. What do I do about apache/mod_ssl listening to ports 80 and 443, when
current 1.0.x listened on 8080 and 8081?

Couple things present themselves: 

1. Just change 80's to 8080's and 443's to 8081's in httpd.conf. A blind
sed should get it right. I don't think this is the most correct answer,
but it WILL work.

2. Apache can be configured to listen to several ports, some ssl'd and
some not. I did that, and my httpd.conf is at 
http://www.biology.duke.edu/computer/unix/current/httpd.conf
which is also now linked to from the home page.

Looking through that file, if you search for "deny", you'll get several
hits of commented out sections- here's how I limit access to my
departmental current server to just my subnets.

If anyone's apache-fu is stronger than mine, I wouldn't mine knowing how
to JUST specify those subnets in one place, instead of about 6.

Running apache at the normal ports I think is the better long term
solution, as it will let you use that apache for other things. (I'm also
going to be doing my kickstarts from that apache, and putting up
internal documentation).

> 
-- 
Hunter Matthews                          Unix / Network Administrator
Office: BioScience 145/244               Duke Univ. Biology Department
Key: F0F88438 / FFB5 34C0 B350 99A4 BB02  9779 A5DB 8B09 F0F8 8438
Never take candy from strangers. Especially on the internet.