Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 7 ■ WORKING WITH APACHEApache2 config file. This would have the advantage of keeping your module setup and config separate, whichmakes adding and removing modules much easier.You can of course do this symlink adding or removing by hand, but it’s better to use the Debiantools provided. To enable a module, use this command:a2enmod modulenameTo disable it, use this command:a2dismod modulenameTo get a list of the modules available to enable or disable, just use a2enmod or a2dismod without anyargument.Remember that after you’ve made any changes, you’ll need to reload Apache2 for them to takeeffect:/etc/init.d/apache2 reload7-3. Setting Up an SSL Certificate for Apache2When you set up a secure web server, clients have confirmation both that the server is who it claims tobe and that the transaction is well encrypted so their data is safe. To do this with Apache, you need touse Secure Sockets Layer (SSL), which is a secure communication protocol. Transport Layer Security(TLS) is the successor to SSL, but they work in basically the same way, so this recipe refers to SSL.SSL provides a protocol for cryptographically securing browser/web server transactions. In mostcases, only the server end is authenticated. Therefore, when the connection starts up, the client canconfirm that the server is who or what it claims to be, but not vice versa. However, once the connectionis established, both ends are secure, because only the server and that particular client have access to thekey that they’re exchanging. This is acceptable because in most cases all the server cares about is that theclient stays the same throughout the transaction. For client authentication, see the next recipe for howto set up Kerberos authentication.From the client side, you want to check both that you’re sending your data to the site that you thinkyou are communicating with and that no one is grabbing your data on the way through (a person-in-themiddleattack). SSL deals with both of these problems.Here’s a quick rundown of the SSL process:1. The client sends the web server a list of the ciphers it can use.2. The server picks the strongest cipher that both it and the client support andsends back a certificate with its name and public encryption key, signed by atrusted certificate authority (such as VeriSign).3. The client checks the CA signature; clients often store popular CAs locally, sothis can be done faster and without having to contact the CA.162Download at WoweBook.Com