Re: Encripted web pages
"Andrei Smirnov" <[email protected]> Mon, 15 Jan 2007 21:38:31 -0500
| Newsgroups | gmane.org.user-groups.linux.morlug |
|---|---|
| Message-ID | <[email protected]> |
--===============0669028229==
Content-Type: multipart/alternative;
boundary="----=_Part_77918_17805952.1168915111343"
------=_Part_77918_17805952.1168915111343
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Thanks Ed,
I am using FC5 on one machine and RHEL 4 on another.
But I found the answer.
Here's what I had to add to my httpd.conf to solve the problem:
<Directory "/home/www/html/secure-area">
# Force clients from the Internet to use HTTPS
RewriteEngine on
RewriteCond %{HTTPS} !=on
RewriteRule .* - [F]
</Directory>
I have no clue what the last line with RewriteRule means. I've got the
answer from this
link, which described an even more complex problem:
http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html
How can I require HTTPS with strong ciphers and either basic authentication
or client certificates for access to a subarea on the Intranet website for
clients coming from the Internet but still allow plain HTTP access for
clients on the Intranet?
Let us assume the Intranet can be distinguished through the IP network
192.160.1.0/24 and the subarea on the Intranet website has the URL /subarea.
Then configure the following outside your HTTPS virtual host (so it applies
to both HTTPS and HTTP):
httpd.conf
SSLCACertificateFile conf/ssl.crt/company-ca.crt
<Directory /usr/local/apache2/htdocs>
# Outside the subarea only Intranet access is granted
Order deny,allow
Deny from all
Allow from 192.168.1.0/24
</Directory>
<Directory /usr/local/apache2/htdocs/subarea>
# Inside the subarea any Intranet access is allowed
# but from the Internet only HTTPS + Strong-Cipher + Password
# or the alternative HTTPS + Strong-Cipher + Client-Certificate
# If HTTPS is used, make sure a strong cipher is used.
# Additionally allow client certs as alternative to basic auth.
SSLVerifyClient optional
SSLVerifyDepth 1
SSLOptions +FakeBasicAuth +StrictRequire
SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128
# Force clients from the Internet to use HTTPS
RewriteEngine on
RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$
RewriteCond %{HTTPS} !=on
RewriteRule .* - [F]
# Allow Network Access and/or Basic Auth
Satisfy any
# Network Access Control
Order deny,allow
Deny from all
Allow 192.168.1.0/24
# HTTP Basic Authentication
AuthType basic
AuthName "Protected Intranet Area"
AuthUserFile conf/protected.passwd
Require valid-user
</Directory>
On 1/15/07, Edward Bosco <[email protected]> wrote:
>
> Sorry - Linux version /distribution. Perhaps the Apache version might be
> useful as well
>
> On 1/15/07, Edward Bosco < [email protected]> wrote:
> >
> > Andrei -
> >
> > What distribution and version are you using?
> >
> > On 1/15/07, Andrei Smirnov < [email protected] > wrote:
> > >
> > > Thanks for all your hints. They helped me to get a better picture
> > > about SSL and certification.
> > >
> > > My problem with encrypted web pages was simpler solved than I thought.
> > > It turns out that as long as I don't care to certify who I am, and only want
> > > my web-server to use encryption when serving the web-pages I just need to
> > > ask the viewer to use https:// instead of http:// in the URL.
> > >
> > > But I still have an important question: how do I make it impossible to
> > > use the insecure 'http://' on those web pages which I only want to be
> > > accessed via SSL? Say it's sensitive documents, and I password protected the
> > > web-page, but now I want to make sure that those with the access can only
> > > view the pages using SSL.
> > > Currently, a user can forget to enter 'https://' and can use just
> > > 'http://', and the page will still be served insecurely. I looked at
> > > http.conf settings, but could not see such an option right away. Maybe
> > > I missed something?
> > >
> > > Andrei
> > >
> > >
> > >
> > > On 1/6/07, David Krovich <[email protected] > wrote:
> > > >
> > > > Andrei,
> > > >
> > > > I recommend looking into http://www.cacert.org.
> > > >
> > > > -Dave
> > > >
> > > > Andrei Smirnov wrote:
> > > > > On 11/2/06, *Jimi Kimble* < [email protected]
> > > > > <mailto:[email protected]>> wrote:
> > > > >
> > > > > I assume you want to use openssl, so I googled openssl and
> > > > apache
> > > > > and got this walk through:
> > > > > http://www.unixcities.com/apache-openssl/index.html
> > > > >
> > > > >
> > > > > Thanks Jimi for the link. I finally started to get serious about
> > > > > implementing the SSL on my apache server.
> > > > > After reading your link I stumbled on these two lines:
> > > > >
> > > > > SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
> > > > > SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key
> > > > >
> > > > > How do I get these two files?
> > > > > I remember we once performed some sort of ritual at Morlug of
> > > > signing
> > > > > digital certificates or similar. Was that the occasion when I was
> > > > > supposed to
> > > > > obtain those files? Even if I did, I must have lost them by now.
> > > > > Any help would be appreciated.
> > > > >
> > > > > Andrei
> > > > >
> > > > > On 11/1/06, *Andrei Smirnov* < [email protected]
> > > > > <mailto:[email protected]>> wrote:
> > > > >
> > > > > I wonder if anyone can give me a brief howto on how to
> > > > setup an
> > > > > encripted web-page using Apache?
> > > > > I have a linux web-server running Apache of course, and
> > > > now I
> > > > > need to
> > > > > exchange confidential patent material with my attorney. I
> > > > > thought of
> > > > > doing it using the SSL protocol, like they use in web
> > > > commerce for
> > > > > credit card transactions etc. But how do I set it up? I
> > > > presume it
> > > > > should be easy.
> > > > >
> > > > > Thanks in advance,
> > > > >
> > > > > Andrei
> > > > >
> > > > > --
> > > > > Andrei V. Smirnov, PhD.
> > > > > http://smirnov.mae.wvu.edu
> > > > > MulPhys.com
> > > > > _______________________________________________
> > > > > Morlug mailing list
> > > > > Morlug @ mailman.morlug.org <mailto:
> > > > [email protected]>
> > > > > http://mailman.morlug.org/mailman/listinfo/ morlug
> > > > > < http://mailman.morlug.org/mailman/listinfo/morlug>
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > ph: 304.284.0688
> > > > > cell 304.290.7245
> > > > > AIM, MSN, gtalk : jimikimble
> > > > > yahoo : xnebox
> > > > > http://resumes.hotjobs.com/xnebox/jameskimble
> > > > > http://jimikimble.blogspot.com
> > > > >
> > > > >
> > > > >
> > > > >
> > > > > --
> > > > > Andrei V. Smirnov, PhD.
> > > > > http://smirnov.mae.wvu.edu
> > > > > MulPhys.com
> > > > > +1 304 293 3111 x2345 (w)
> > > > >
> > > > ------------------------------------------------------------------------
> > > > >
> > > > > _______________________________________________
> > > > > Morlug mailing list
> > > > > [email protected]
> > > > > http://mailman.morlug.org/mailman/listinfo/morlug
> > > > >
> > > >
> > > >
> > >
> > >
> > > --
> > > Andrei V. Smirnov, PhD.
> > > http://smirnov.mae.wvu.edu
> > > MulPhys.com
> > > +1 304 293 3111 x2345 (w)
> > >
> > > _______________________________________________
> > > Morlug mailing list
> > > [email protected]
> > > http://mailman.morlug.org/mailman/listinfo/morlug
> > >
> > >
> > >
> >
>
--
Andrei V. Smirnov, PhD.
http://smirnov.mae.wvu.edu
MulPhys.com
+1 304 293 3111 x2345 (w)
------=_Part_77918_17805952.1168915111343
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Thanks Ed,<br><br>I am using FC5 on one machine and RHEL 4 on another.<br>But I found the answer.<br>Here's what I had to add to my httpd.conf to solve the problem:<br><br><Directory "/home/www/html/secure-area">
<br># Force clients from the Internet to use HTTPS<br>RewriteEngine on<br>RewriteCond %{HTTPS} !=on<br>RewriteRule .* - [F]<br></Directory><br><br>I have no clue what the last line with RewriteRule means. I've got the answer from this
<br>link, which described an even more complex problem:<br><br><a href="http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html">http://httpd.apache.org/docs/2.0/ssl/ssl_howto.html</a><br><div id="page-content"><div class="section">
<h3><a name="intranet" id="intranet">How can I require HTTPS with strong ciphers and either basic
authentication or client certificates for access to a subarea on the
Intranet website for clients coming from the Internet but still allow
plain HTTP access for clients on the Intranet?</a></h3>
<p>Let us assume the Intranet can be distinguished through the IP
network <a href="http://192.160.1.0/24">192.160.1.0/24</a> and the subarea on the Intranet website has
the URL <code>/subarea</code>. Then configure the following outside
your HTTPS virtual host (so it applies to both HTTPS and HTTP):</p>
<div class="example"><h3>httpd.conf</h3><pre>SSLCACertificateFile conf/ssl.crt/company-ca.crt<br><br><Directory /usr/local/apache2/htdocs><br># Outside the subarea only Intranet access is granted<br>Order deny,allow
<br>Deny from all<br>Allow from <a href="http://192.168.1.0/24">192.168.1.0/24</a><br></Directory><br><br><Directory /usr/local/apache2/htdocs/subarea><br># Inside the subarea any Intranet access is allowed
<br># but from the Internet only HTTPS + Strong-Cipher + Password<br># or the alternative HTTPS + Strong-Cipher + Client-Certificate<br><br># If HTTPS is used, make sure a strong cipher is used.<br># Additionally allow client certs as alternative to basic auth.
<br>SSLVerifyClient optional<br>SSLVerifyDepth 1<br>SSLOptions +FakeBasicAuth +StrictRequire<br>SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128<br><br># Force clients from the Internet to use HTTPS
<br>RewriteEngine on<br>RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$<br>RewriteCond %{HTTPS} !=on<br>RewriteRule .* - [F]<br><br># Allow Network Access and/or Basic Auth<br>Satisfy any
<br><br># Network Access Control<br>Order deny,allow<br>Deny from all<br>Allow <a href="http://192.168.1.0/24">192.168.1.0/24</a><br><br># HTTP Basic Authentication<br>AuthType basic
<br>AuthName "Protected Intranet Area"<br>AuthUserFile conf/protected.passwd<br>Require valid-user<br></Directory></pre></div>
</div></div>
<div class="bottomlang">
<p><span></span></p></div><br><br><br><div><span class="gmail_quote">On 1/15/07, <b class="gmail_sendername">Edward Bosco</b> <<a href="mailto:[email protected]">[email protected]</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Sorry - Linux version /distribution. Perhaps the Apache version might be useful as well<div><span class="e" id="q_1102892e016d4cbf_1"><br><br><div><span class="gmail_quote">On 1/15/07, <b class="gmail_sendername">Edward Bosco
</b> <<a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
[email protected]</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Andrei -<br><br>What distribution and version are you using?
<div><span><br><br><div><span class="gmail_quote">On 1/15/07, <b class="gmail_sendername">Andrei Smirnov</b> <<a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
[email protected]
</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Thanks for all your hints. They helped me to get a better picture about SSL and certification.
<br>
<br>
My problem with encrypted web pages was simpler solved than I thought.
It turns out that as long as I don't care to certify who I am, and only
want my web-server to use encryption when serving the web-pages I just
need to ask the viewer to use https:// instead of http:// in the URL.<br>
<br>
But I still have an important question: how do I make it impossible to
use the insecure 'http://' on those web pages which I only want to be
accessed via SSL? Say it's sensitive documents, and I password protected
the web-page, but now I want to make sure that those with the access
can only view the pages using SSL.<br>
Currently, a user can forget to enter 'https://' and can use just
'http://', and the page will still be served insecurely. I looked at
http.conf settings, but could not see such an option right away. Maybe
I missed something?<br><span>
<br>
Andrei</span><div><span><br>
<br> <br><br><div><span class="gmail_quote">On 1/6/07, <b class="gmail_sendername">David Krovich</b> <<a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">[email protected]
</a>> wrote:</span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Andrei,<br><br>I recommend looking into <a href="http://www.cacert.org" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://www.cacert.org</a>.<br><br>-Dave<br><br>Andrei Smirnov wrote:<br>> On 11/2/06, *Jimi Kimble* <
<a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">[email protected]
</a><br>> <mailto:<a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">[email protected]</a>>> wrote:<br>><br>> I assume you want to use openssl, so I googled openssl and apache
<br>> and got this walk through:
<br>> <a href="http://www.unixcities.com/apache-openssl/index.html" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://www.unixcities.com/apache-openssl/index.html</a><br>><br>><br>
> Thanks Jimi for the link. I finally started to get serious about<br>
> implementing the SSL on my apache server.<br>> After reading your link I stumbled on these two lines:<br>><br>> SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt<br>> SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key
<br>><br>> How do I get these two files?<br>> I remember we once performed some sort of ritual at Morlug of signing<br>> digital certificates or similar. Was that the occasion when I was<br>> supposed to<br>
> obtain those files? Even if I did, I must have lost them by now.<br>> Any help would be appreciated.<br>><br>> Andrei<br>><br>> On 11/1/06, *Andrei Smirnov* < <a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
[email protected]</a><br>> <mailto:<a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">[email protected]</a>>> wrote:<br>>
<br>> I wonder if anyone can give me a brief howto on how to setup an
<br>> encripted web-page using Apache?<br>> I have a linux web-server running Apache of course, and now I<br>> need to<br>> exchange confidential patent material with my attorney. I
<br>> thought of<br>> doing it using the SSL protocol, like they use in web commerce for<br>> credit card transactions etc. But how do I set it up? I presume it<br>> should be easy.
<br>><br>> Thanks in advance,<br>><br>> Andrei<br>><br>> --<br>> Andrei V. Smirnov, PhD.<br>> <a href="http://smirnov.mae.wvu.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://smirnov.mae.wvu.edu
</a><br>> MulPhys.com<br>> _______________________________________________<br>> Morlug mailing list<br>> Morlug @<a href="http://mailman.morlug.org" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
mailman.morlug.org</a> <mailto:
<a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">[email protected]</a>><br>> <a href="http://mailman.morlug.org/mailman/listinfo/" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://mailman.morlug.org/mailman/listinfo/</a> morlug<br>> <
<a href="http://mailman.morlug.org/mailman/listinfo/morlug" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://mailman.morlug.org/mailman/listinfo/morlug</a>><br>><br>><br>><br>>
<br>> --<br>> ph: 304.284.0688<br>> cell 304.290.7245
<br>> AIM, MSN, gtalk : jimikimble<br>> yahoo : xnebox<br>> <a href="http://resumes.hotjobs.com/xnebox/jameskimble" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://resumes.hotjobs.com/xnebox/jameskimble
</a><br>> <a href="http://jimikimble.blogspot.com" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://jimikimble.blogspot.com</a><br>><br>><br>><br>><br>> --<br>> Andrei V. Smirnov, PhD.<br>> <a href="http://smirnov.mae.wvu.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
http://smirnov.mae.wvu.edu</a><br>> MulPhys.com<br>> +1 304 293 3111 x2345 (w)
<br>> ------------------------------------------------------------------------<br>><br>> _______________________________________________<br>> Morlug mailing list<br>> <a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">
[email protected]</a><br>> <a href="http://mailman.morlug.org/mailman/listinfo/morlug" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://mailman.morlug.org/mailman/listinfo/morlug</a>
<br>><br><br></blockquote></div><br><br clear="all"><br>-- <br>Andrei V. Smirnov, PhD.
<br><a href="http://smirnov.mae.wvu.edu" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://smirnov.mae.wvu.edu</a><br>MulPhys.com<br>+1 304 293 3111 x2345 (w)
</span></div><br>_______________________________________________<br>Morlug mailing list<br><a href="mailto:[email protected]" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">[email protected]
</a><br>
<a href="http://mailman.morlug.org/mailman/listinfo/morlug" target="_blank" onclick="return top.js.OpenExtLink(window,event,this)">http://mailman.morlug.org/mailman/listinfo/morlug</a><br><br><br></blockquote></div><br>
</span></div></blockquote></div><br>
</span></div></blockquote></div><br><br clear="all"><br>-- <br>Andrei V. Smirnov, PhD.<br><a href="http://smirnov.mae.wvu.edu">http://smirnov.mae.wvu.edu</a><br>MulPhys.com<br>+1 304 293 3111 x2345 (w)
------=_Part_77918_17805952.1168915111343--
--===============0669028229==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
_______________________________________________
Morlug mailing list
[email protected]
http://mailman.morlug.org/mailman/listinfo/morlug
--===============0669028229==--