Linux System Administration Recipes A Problem-Solution Approach

More documents

Recommendations

Info

CHAPTER 7 ■ WORKING WITH APACHEso that, on this virtual host (and thus in this part of the directory tree), SSL must be used. This avoidsanyone using an insecure connection to access your secure content.The SSLProtocol directive disables all protocols other than TLS v1.0 and SSL v3.0. SSLCipherSuite isset to use only HIGH and MEDIUM security cipher suites. SHA1 is preferred to MD5 because it isconsidered to be more secure.SSLCertificateFile and SSLCertificateKeyFile should be set to the locations where you put yourcertificate and key files. We’re not using client auth here, so SSLVerifyClient is set to none.■ Note The MSIE section is a workaround for some bugs in some versions of Internet Explorer, which can lead tothe user seeing I/O errors. Some other older versions of Internet Explorer have bugs with particular ciphers that areharder to work around; see http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#msie if this is a concernfor you.To run the regular server on port 80, add the following section to the config file:NameVirtualHost: *.80DocumentRoot "/local/www/html"# Host-specific directory setup, options, etc# Most of these options are likely to be set outside the VirtualHosts# sections.After you’ve saved the edited configuration file, restart the web server. If you did use a passphrasewhen generating your certificate, you’ll need to enter it when challenged.TestingCreate a basic index.html page wherever the root directory of the SSL part of your web server is located,if you don’t already have content there.Then point your web browser at https://www.example.com. You should see an SSL connectionopened and the page delivered. If you’re using a self-signed certificate, your browser will pop up an alertwarning you that the server’s identity cannot be verified, and you can choose to view and/or accept thecertificate. If using an external certificate, it should all happen without intervention.Now try to access that content with http://. You should get an error message.TroubleshootingIf it’s not working as expected, first check that your server is actually running using ps -a | grep apache.If that doesn’t return anything, try restarting Apache2 (/etc/init.d/apache2 restart), and check forerror messages on the terminal or in /var/log/apache2/error_log.166Download at WoweBook.Com
CHAPTER 7 ■ WORKING WITH APACHEAlso check that the permissions on your key and certificate files are set correctly (discussed earlier),as well as the permissions on your test HTML file and its parent directory.Next, check both the main server logs (at /var/log/apache2/error_log) and the SSL logs that you setup in your config file. If you don’t get anything useful, try changing the LogLevel value in the Apache2config file to debug, restart Apache2, and test again to get more log data.If your certificate is in .crt format and you’re having trouble, you could try converting it to .pemformat:openssl x509 -inform der -in MYCERT.cer -out MYCERT.pemThen edit this line in your config file:SSLCertificateFile /etc/apache2/ssl/server.pemIf you’re also running a regular web server on port 80, try fetching a test page via http:// rather thanhttps:// to help identify whether the problem is with the web server or with the SSL connection. Notethat in the previous setup, the web server’s root directory is different for http:// and https://, so youwon’t (or shouldn’t!) be able to access the same content. If your test page in the http:// root directoryworks fine, though, and your test page in the https:// root directory doesn’t, then that can help youpinpoint the problem.If the problem is the SSL connection, a useful tool is s_client, which is a diagnostic tool fortroubleshooting TLS/SSL connections. The basic usage is as follows:/usr/bin/openssl s_client -connect hostname:443There are numerous other options to this command as well, for which you can check thedocumentation. If you get error messages, this should help you in locating the problem.7-5. Securing Your Web Site with htaccessIt’s quite common to have a situation whereby you want to restrict part of your web site to a particularset of users. The next recipe shows a way of doing this via Kerberos if you want users to log in asthemselves, but if you just want to restrict access to people on the local network, htaccess is a quick andstraightforward way to go about this.Let’s say that you want to allow machines only on the local subnet (192.168.*.*) to access the$APACHEROOT/local subdirectory. The first file to set up is $APACHEROOT/local/.htaccess (note the dot); itshould look a bit like this:01 AuthName Local Pages02 AuthType Basic03 04 order deny,allow05 deny from all06 allow from 192.168.07 This will set things up so that the GET and POST methods require an IP from within this range. Denydirectives are read before allow ones (line 04), everything is denied (line 05), and then a specific set of IP167Download at WoweBook.Com
Page 2:
Download at WoweBook.Com
Page 5 and 6:
Download at WoweBook.Comiii
Page 7 and 8:
Contents■About the Author .......
Page 9 and 10:
■ CONTENTS3-7. Writing a Nagios P
Page 11 and 12:
■ CONTENTS■Chapter 8: Using the
Page 13 and 14:
■ CONTENTSAbout the Author■Juli
Page 15 and 16:
■ CONTENTSAcknowledgmentsMany tha
Page 17 and 18:
■ CONTENTSIntroductionThis book i
Page 19 and 20:
■ INTRODUCTIONDownloading the Cod
Page 21 and 22:
C H A P T E R 1■ ■ ■Saving Yo
Page 23 and 24:
CHAPTER 1 ■ SAVING YOURSELF EFFOR
Page 25 and 26:
Page 27 and 28:
Page 29 and 30:
Page 31 and 32:
Page 33 and 34:
Page 35 and 36:
Page 37 and 38:
Page 39 and 40:
Page 41 and 42:
C H A P T E R 2■ ■ ■Centraliz
Page 43 and 44:
CHAPTER 2 ■ CENTRALIZING YOUR NET
Page 45 and 46:
Page 47 and 48:
Page 49 and 50:
Page 51 and 52:
Page 53 and 54:
Page 55 and 56:
Page 57 and 58:
Page 59 and 60:
Page 61 and 62:
Page 63 and 64:
Page 65 and 66:
Page 67 and 68:
Page 69 and 70:
Page 71 and 72:
Page 73 and 74:
Page 75 and 76:
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
C H A P T E R 3■ ■ ■Monitorin
Page 85 and 86:
CHAPTER 3 ■ MONITORING AND UPDATI
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
C H A P T E R 4■ ■ ■Taking Ba
Page 117 and 118:
CHAPTER 4 ■ TAKING BACKUPS AND MA
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136: CHAPTER 4 ■ TAKING BACKUPS AND MA
Page 137 and 138: CHAPTER 4 ■ TAKING BACKUPS AND MA
Page 139 and 140: C H A P T E R 5■ ■ ■Working w
Page 141 and 142: CHAPTER 5 ■ WORKING WITH FILESYST
Page 155 and 156: C H A P T E R 6■ ■ ■Securing
Page 157 and 158: CHAPTER 6 ■ SECURING YOUR SYSTEMS
Page 179 and 180: CHAPTER 7 ■ WORKING WITH APACHEOn
Page 181 and 182: CHAPTER 7 ■ WORKING WITH APACHEdi
Page 183 and 184: CHAPTER 7 ■ WORKING WITH APACHE4.
Page 185: CHAPTER 7 ■ WORKING WITH APACHE
Page 189 and 190: CHAPTER 7 ■ WORKING WITH APACHE
Page 191 and 192: C H A P T E R 8■ ■ ■Making Be
Page 193 and 194: CHAPTER 8 ■ USING THE COMMAND LIN
Page 207 and 208: CHAPTER 9 ■ WORKING WITH TEXT IN
Page 223 and 224: C H A P T E R 10■ ■ ■Things G
Page 225 and 226: CHAPTER 10 ■ THINGS GO IN, THINGS
Page 233 and 234: C H A P T E R 11■ ■ ■Tracking
Page 235 and 236: CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 237 and 238:
CHAPTER 11 ■ TRACKING DOWN BUGS01
Page 239 and 240:
CHAPTER 11 ■ TRACKING DOWN BUGS
Page 241 and 242:
Page 243 and 244:
Page 245 and 246:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 247 and 248:
CHAPTER 11 ■ TRACKING DOWN BUGSAn
Page 249 and 250:
CHAPTER 11 ■ TRACKING DOWN BUGS#
Page 251 and 252:
C H A P T E R 12■ ■ ■Managing
Page 253 and 254:
CHAPTER 12 ■ MANAGING TIME AND PE
Page 255 and 256:
Page 257 and 258:
Page 259 and 260:
Page 261 and 262:
Page 263 and 264:
Page 265 and 266:
Page 267 and 268:
APPENDIX■ ■ ■Perl TipsSee rec
Page 269 and 270:
APPENDIX ■ PERL TIPS• Date::Par
Page 271 and 272:
APPENDIX ■ PERL TIPSPerl Syntax N
Page 273 and 274:
■ ■ ■Index■Symbols$CDPATH,
Page 275 and 276:
■ INDEXenscript option (printing)
Page 277 and 278:
■ INDEX■NNagiosadding hosts to,
Page 279 and 280:
■ INDEXsyslogcentralized logging
Page 281 and 282:
Download at WoweBook.Com
show all

Linux System Administration Recipes A Problem-Solution Approach

Create successful ePaper yourself

Delete template?

Save as template?