Showing posts with label Apache Web Server. Show all posts
Showing posts with label Apache Web Server. Show all posts

Monday, August 10, 2015

How to setup "Basic" authentication to phpPgAdmin at Apache web server?


  • Run the command below to add user to ".htpasswd" file


# htpasswd [DIRECTORY]/.htpasswd [USERNAME]

[DIRECTORY] represent the folder that store the password
[USERNAME] represent the user login id

Note: Password/Retype password will be prompted after the command above has been executed


  • Open configuration file httpd.conf , add the configuration as described below

<Directory "/var/www/phpPgAdmin">
    AuthName "Secure Area"
    AuthType Basic
    AuthUserFile [DIRECTORY]/.htpasswd
    require valid-user
    Options Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>


Restart Apache server, voila, your phpPgAdmin is protected now.


Tuesday, February 11, 2014

Enable SSL on WAMP server and error encountered

In order to get my WAMP server to support SSL, below are the steps to configure

1. Open httpd.conf that located at [WAMP_HOME]\bin\apache\Apache2.4.4\conf

Uncomment line as described below

LoadModule ssl_module modules/mod_ssl.so
Include conf/extra/httpd-ssl.conf
2. Open php.ini that located at [WAMP_HOME]\bin\php\php5.4.12

Uncomment line as described below

extension=php_openssl.dll
3. Open httpd-ssl.conf that located at [WAMP_HOME]\bin\apache\Apache2.4.4\conf\extra, edit the parameter as described below

<VirtualHost _default_:443>
#   General setup for the virtual host
DocumentRoot "c:/wamp/www"
ServerName localhost:443
ServerAdmin admin@example.com
ErrorLog "[WAMP_HOME]/logs/apache_ssl_error.log"
TransferLog "[WAMP_HOME]/logs/access_ssl.log"
</VirtualHost>
SSLCertificateFile "[CERTIFICATE_FILE]"
SSLCertificateKeyFile "[CERTIFICATE_KEY_FILE]"
SSLCertificateChainFile "[CERTIFICATE_CHAIN_FILE]"
4. Restart WAMP services, encountered the WAMP service icon is displayed as brown color and unable to start.


5. Open DOS command and change to directory [WAMP_HOME]\bin\apache\Apache2.4.4\bin. Type command to cross check the Apache configuration file

 httpd -t
Encountered error as described below is displayed

AH00526: Syntax error on line 76 of C:/wamp/bin/apache/Apache2.4.4/conf/extra/ht
tpd-ssl.conf:
SSLSessionCache: 'shmcb' session cache not supported (known names: ). Maybe you
need to load the appropriate socache module (mod_socache_shmcb?).
Open httpd.conf, uncomment the line as described below

LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
Type command to cross check the Apache configuration file

 httpd -t
Encountered error as described below is displayed

(OS 3)The system cannot find the path specified.  : AH02297: Cannot access direc
tory 'C:/Apache24/logs/' for log file 'c:/Apache24/logs/ssl_request.log' defined
 at C:/wamp/bin/apache/Apache2.4.4/conf/extra/httpd-ssl.conf:250
AH00014: Configuration check failed
Open httpd-ssl.conf, change the custom log directory to point to correct directory.

CustomLog "[WAMP_HOME]/logs/ssl_request.log" \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
Restart WAMP services, you should be able to start your Apache Web Server. Your SSL has been enabled.

Wednesday, November 6, 2013

How to resolve "Could not open configuration file /etc/httpd/conf/httpd.conf: Permission denied" when start httpd service on RHEL 6?

I encounter this when I transfer (scp) httpd.conf file from my local machine to my new RHEL 6 server. I overwrote the httpd.conf file at /etc/httpd/conf directory and restart httpd service through "service httpd restart". Error message  "Could not open configuration file /etc/httpd/conf/httpd.conf: Permission denied" is prompted.

Type in the command below,
ls -Z
Output as described below is displayed
-rw-rw-r--. user1     user1      unconfined_u:object_r:user_home_t:s0 httpd.conf
-rw-r--r--. root       root       system_u:object_r:httpd_config_t:s0 magic
Steps to resolve this

1. Run the command below to change "unconfined_u:object_r:user_home_t:s0" to "system_u:object_r:httpd_config_t:s0".
chcon system_u:object_r:httpd_config_t:s0 httpd.conf
Once restart httpd service, it should be able to restart the apache service now.

2. For the sake of change the ownership correctly, you can run command below to change the owner
chown root:root httpd.conf
chmod 644 httpd.conf



Thursday, August 29, 2013

Issue encounter and simple note on CakePHP 2.3.9 & WAMP 2.4 exploration

How to disable debug mode on cakephp? (Please refer to the selected red rectangle)



Steps to resolve
1. Open core.php located at "[WAMP_INSTALL_PATH]\app\config".
2. Edit debug value to "0" and deploy to the server
<?php
    Configure::write('debug', 0);
?>
3. Deploy to the server, the debug mode will be disabled.

How to resolve "Forbidden You don't have permission to access / on this server." error message when access the new installed WAMP server version 2.4?

Description
Install a new WAMP server and when access the web server using the assigned IP address through browser, "Forbidden You don't have permission to access / on this server." error message is displayed.

When using localhost/127.0.0.1 in the local machine to access the WAMP server, the default WAMP page is displayed.

Steps to resolve
1. Edit https.conf which located at "[WAMP_INSTALL_PATH]\bin\apache\Apache2.4.4\conf", edit the configuration as shown below
<Directory "[WAMP_INSTALL_PATH]/www">
    Options Indexes FollowSymLinks
    AllowOverride All
    Order Deny,Allow
    Allow from all
</Directory>

2. Make sure port 80 in Window 2008 firewall  is opened.
- Launch "Windows Firewall with Advanced Security" screen
- Right click "Inbound Rules" and select "New Rule..." menu
- Select "Port - Rule that controls connections for a TCP or UDP port", click "Next" button
- Select "TCP" type and enter "80" for "Specific local ports", click "Next" button
- Select "Allow the connection" and click"Next" button
- Check "Domain", "Private" and "Public" checkbox and click on "Next" button
- Enter "Name" and "Description" value and click on "Finish" button.

3. Restart WAMP server, WAMP index page will be displayed.

How to redirect all the visitor's request to a particular subdirectory?

Description
When came to a requirement to redirect all visitor request to a particular subdirectory, for example /myapp/ in your PHP web application, normally I will use Apache rewrite feature to redirect all the request.

Steps to resolve
1. Edit httpd.conf and uncomment "LoadModule rewrite_module modules/mod_rewrite.so"
2. I have enable the virtual host configuration, add in the rewrite engine as described below

<VirtualHost *:80>
 ServerName [SERVER_NAME]
 DocumentRoot "C:/wamp/www"
        ErrorLog "c:/wamp/logs/apache_error.log"
        CustomLog "c:/wamp/logs/access.log" common
 RewriteEngine on
 RewriteRule ^/$ /[MY_APP_DEFAULT_FOLDER]/ [R]
</VirtualHost>
3. Rewrite your Apache web server.

Thursday, February 21, 2013

Vulnerability fixes – Web Server Supports Outdated SSLv2 Protocol

If your network engineer again come to you and said that, you need to resolve this vulnerability issue in your Apache server, what will you do? How you so sure that your configuration is working?


Steps:   Edit Apache's httpd-ssl.conf and include these lines at minimum:
SSLProtocol -ALL +SSLv3 +TLSv1
Note: I assume you know where is https-ssl.conf is resided. I assume you know how to turn on SSL :D

How to test?

Run command below to verify SSL3 is enabled
openssl s_client  -connect localhost:443 -ssl3
A success result of retrieving certificate will be displayed.

Run command below to verify SSL2 is disabled
openssl s_client  -connect localhost:443 –ssl2
A failure result is displayed.
Loading 'screen' into random state - done
CONNECTED(00000154)
4460:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:.\ssl\s2_pkt.c
:428:

SSLProtocol -ALL +SSLv3 +TLSv1

Monday, January 28, 2013

Vulnerability fixes – HTTP Server Prone To Slow Denial Of Service Attack

What if your security team do vulnerability scanning and found out your Apache Web Server have the possibility of having "HTTP Server Prone To Slow Denial Of Service Attack"?

Normally, this happen when hacker use slowloris tool to hold the connection of your Apache Web Server until your web server went down. For my testing, I use “HTTP attack version 3.6 (slow headers and slow POST)” tools to conduct the testing. Please visit http://code.google.com/p/slowhttptest/

How to avoid this?

Step 1: Open httpd.conf file and uncomment this line :

LoadModule reqtimeout_module modules/mod_reqtimeout.so

                                                               
Step 2: Add this tag in httpd.conf

<IfModule reqtimeout_module> 
# Wait max 10 seconds for the first byte of the request line+headers
# From then, require a minimum data rate of 500 bytes/s, but don't
# wait longer than 20 seconds in total.
RequestReadTimeout header=10-20,minrate=500 
# Wait max 10 seconds for the first byte of the request body (if any)
# From then, require a minimum data rate of 500 byte/s.
RequestReadTimeout body=10,minrate=500 
</IfModule>

Restart your web server.
Voila, your Apache Web Server is safe now!

Sunday, January 27, 2013

How to use mod_rewrite to redirect the request to your web application?

Recently, I was asked to redirect those request that direct access to the root of my web server(for example, http://[SERVER]/ or http://[SERVER]/index.html or https://[SERVER]/ or https://[SERVER]/index.html) to the login page of my web application. Due to some reason, I just can't use RedirectMatch or Redirect, I have more RewriteRule which I need to take into consideration. Below are some simple configuration by using RewriteEngine to achieve the requirement.

First step, open https.conf and comment out

LoadModule rewrite_module modules/mod_rewrite.so


For your info, I have configured 2 virtual host in httpd-vhosts.conf

1. 1 virtual host which is listening to port 80
2. 1 virtual host which  is listening to port 443, which is my SSL configuration.

I also configured mod_jk redirect traffic request to my Apache Web Application Server which is in my virtual host configuration as well.

Hence, my httpd-vhost.conf is currently having configuration like this,

<VirtualHost *:80>     ServerAdmin webmaster@dummy-host2.example.com
     DocumentRoot "C:\Apache24\htdocs"
     ServerName dummy-host2.example.com
     ErrorLog "logs/dummy-host2.example.com-error.log"
     CustomLog "logs/dummy-host2.example.com-access.log" common
     ...
</VirtualHost>


<VirtualHost *:443>
     ServerAdmin webmaster@dummy-host2.example.com     DocumentRoot "C:\Apache24\htdocs"
     ServerName dummy-host2.example.com
     ErrorLog "logs/dummy-host2.example.com-error.log"
     CustomLog "logs/dummy-host2.example.com-access.log" common
     ...
</VirtualHost>


I add the rewrite rule to each of the virtual host configuration

RewriteEngine On

RewriteCond %{REQUEST_URI} ^/index.html [OR]
RewriteCond %{REQUEST_URI} "^/$"
RewriteRule (.*)  https://%{HTTP_HOST}/myapp/ [R=301,L]


This is to make sure, whoever open the browser and type in
 http://[SERVER]/ or http://[SERVER]/index.html or https://[SERVER]/ or https://[SERVER]/index.html will be getting redirect to https://[SERVER]/myapp/ which is the URL of my web application.

Thursday, January 24, 2013

How to configure mod_jk to redirect your traffic from Apache Web Server (2.4) to Tomcat?

In corporate environment, there might be a requirement that the system don't allow the end user direct assess to the application server (Tomcat server). They want user assess to web server (Apache Web Server) and the web server redirect the traffic to application server. Hence, the configuration below is to serve the purpose. 

To configure the mod_jk in Apache Web Server (2.4), below are the assumption

1. Use Apache Web Server 2.4
2. Apache home folder is c:\Apache24
3. Place mod_jk.so, worker.properties and in c:\Apache24\conf folder

Step 1 - Open the httpd.conf and add in the configuration as shown below:

# Load mod_jk for communicating with Tomcat
LoadModule jk_module "C:/Apache24/conf/mod_jk.so"
# Where to find workers.properties
JkWorkersFile "C:/Apache24/conf/workers.properties"
# Where to put jk logs
JkLogFile "C:/Apache24/logs/mod_jk.log"
# Set the jk log level [debug/error/info]
JkLogLevel error
# Select the log format
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "
# JkOptions indicate to send SSL KEY SIZE, 
JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories
# JkRequestLogFormat set the request format 
JkRequestLogFormat "%w %V %T"

Step 2 - Add in the workers.properties to c:\Apache24\conf with the setting as shown below

worker.list=worker
worker.mcWorker.port=8009
worker.mcWorker.host=localhost
worker.mcWorker.type=ajp13

Step 3 - If you configure virtual host, add the line below to each of the virtual host configuration in httpd-vhosts.conf. Otherwise, add into httpd.conf.

JkMount /myserverpath* worker


Tuesday, January 22, 2013

Apache server unable to start after https setup?


Weird thing happened after I configured https on my Apache Web Server, my web server unable to start!!! To resolve this issue, open httpd-ssl.conf, replace “Listen 443” with “Listen 443 http”.



SSLSessionCache: Invalid argument: size has to be >= 8192 bytes

During the Apache https setup, I encountered the error as shown below when I run “httpd –S” command.


To resolve this issue, I run the command “dir /x c:\” to find the directory name in short form.



Replace the folder name in httpd-ssl.conf with the directory name in short form as shown in the screen above.
SSLSessionCache        "shmcb:C:/PROGRA\~2/Apache Software Foundation/Apache2.2/logs/ssl_scache(512000)"

How to generate self signed certificate on Apache Web Server (2.2) ?


How to generate self signed certificate on Apache Web Server (2.2)?

Step 1:

- Download Apache which have openssl bundle together as a package. You can go to http://www.apachelounge.com/download/
- Open command prompt and browse to the "APACHE_HOME\bin" folder
- Follow the steps as shown below:

1. Generate private key
openssl genrsa -des3 -out "[CERTIFICATE_FOLDER]\server.key" 1024

2. Generate CSR
openssl req -new -key "[CERTIFICATE_FOLDER]\server.key" -config "[APACHE_HOME]\conf\openssl.cnf" -out "[CERTIFICATE_FOLDER]\server.csr"

3. Backup the private key and after this command, passphrase will no longer in the private key
copy "[CERTIFICATE_FOLDER]\server.key" "[CERTIFICATE_FOLDER]\server.key.org"
openssl rsa -in "[CERTIFICATE_FOLDER]\server.key.org" -out "[CERTIFICATE_FOLDER]\server.key"

4. Generate the certificate
openssl x509 -req -days 365 -in "[CERTIFICATE_FOLDER]\server.csr" -signkey "[CERTIFICATE_FOLDER]\server.key" -out "[CERTIFICATE_FOLDER]\server.crt"


Step 2:

- Go to "APACHE_HOME\conf" folder and open httpd.conf.
- Uncomment line
LoadModule ssl_module modules/mod_ssl.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so

Include conf/extra/httpd-vhosts.conf
Include conf/extra/httpd-ssl.conf


Step 3:


- Go to "APACHE_HOME\conf\extra" folder and open httpd-ssl.conf.

SSLCertificateFile "[CERTIFICATE_FOLDER]\server.crt"
SSLCertificateKeyFile "[CERTIFICATE_FOLDER]\server.key"

Tips:
To check the Apache configuration, open Window command prompt and browse to the "APACHE_HOME\bin" folder, type in the command "httpd -S".

Step 4:

- Go to "APACHE_HOME\conf\extra" folder and open httpd-vhosts.conf, edit the value of both of the virual host configuration

<VirtualHost *:80>
    ServerAdmin webmaster@dummy-host2.example.com
    DocumentRoot "[APACHE_HOME]\htdocs"
    ServerName dummy-host2.example.com
ServerAlias www.dummy-host2.example.com
    ErrorLog "logs/dummy-host2.example.com-error.log"
    CustomLog "logs/dummy-host2.example.com-access.log" common
</VirtualHost>

<VirtualHost *:443>
    ServerAdmin webmaster@dummy-host2.example.com
DocumentRoot "[APACHE_HOME]\htdocs"
ServerName dummy-host2.example.com
ServerAlias www.dummy-host2.example.com

    ErrorLog "logs/dummy-host2.example.com-error.log"
    CustomLog "logs/dummy-host2.example.com-access.log" common

    SSLEngine on
    SSLCipherSuite HIGH:!aNULL:!MD5
SSLCertificateFile "[CERTIFICATE_FOLDER]\server.crt"
SSLCertificateKeyFile "[CERTIFICATE_FOLDER]\server.key"
</VirtualHost>

Wednesday, January 16, 2013

How to generate self signed certificate on Apache Web Server (2.4) ?

How to generate self signed certificate on Apache Web Server (2.4)?
Step 1:
- Download Apache which have openssl bundle together as a package. You can go to http://www.apachelounge.com/download/
- Open command prompt and browse to the "APACHE_HOME\bin" folder
- Type in the command as shown below

openssl req -x509 -config "C:\Apache24\conf\openssl.cnf" -nodes -days 365 -newkey rsa:2048 -keyout "C:\Apache24\certificate\server.key" -out "C:\Apache24\certificate\server.crt"

Fill in all the relevant information.

Step 2:
- Go to "APACHE_HOME\conf" folder and open httpd.conf.
- Uncomment line
LoadModule ssl_module modules/mod_ssl.so
LoadModule vhost_alias_module modules/mod_vhost_alias.so
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

Include conf/extra/httpd-vhosts.conf
Include conf/extra/httpd-ssl.conf

Step 3:
- Go to "APACHE_HOME\conf\extra" folder and open httpd-ssl.conf.

SSLCertificateFile "C:\Apache24\certificate\server.crt"
SSLCertificateKeyFile "C:\Apache24\certificate\server.key"

Tips:
To check the Apache configuration, - Open command prompt and browse to the "APACHE_HOME\bin" folder, type in the command "httpd -S".


Step 4:
- Go to "APACHE_HOME\conf\extra" folder and open httpd-vhosts.conf, edit the value of both of the virual host configuration

<VirtualHost *:80>
    ServerAdmin webmaster@dummy-host2.example.com
    DocumentRoot "C:\Apache24\htdocs"
    ServerName dummy-host2.example.com
    ErrorLog "logs/dummy-host2.example.com-error.log"
    CustomLog "logs/dummy-host2.example.com-access.log" common
</VirtualHost>

<VirtualHost *:443>
ServerName www.domain.com
DocumentRoot "C:\Apache24\htdocs"
ServerName dummy-host2.example.com
SSLEngine on
SSLCertificateFile "C:\Apache24\certificate\server.crt"
SSLCertificateKeyFile "C:\Apache24\certificate\server.key"
</VirtualHost>