Direkt zum Hauptbereich

SSL virtualhost after you setup a SSH connection through rsa keys and always redirect to it

You may have done this: ssh-keygen and ssh-copy-id and now you want to enable SSL. With Eric Ambergs "Linux-Server" book and Converting keys between openssl and openssh, I did this so far:

  • local: "scp MYKEY root@remote.server:~"
    after this its just remote:
  • "a2enmod ssl"
  • "mkdir /etc/apache2/ssl"
  • "openssl req -x509 -days 365 -new -key MYKEY -out /etc/apache2/ssl/nedab.de.pem" and make sure you use a wildcard domain as common name, e.g. *.common.com. That way your certificate is valid for all subdomains.
  •  "a2enmod redirect"
  • virtualhost in /etc/apache/site-available with help from Redirect Request to SSL:
     <VirtualHost *:80>  
       ServerName ..........  
       Redirect permanent / https://........../  
     </VirtualHost>  
       
     <VirtualHost _default_:443>  
         SSLEngine on  
         SSLCipherSuite HIGH:MEDIUM  
       
         SSLCertificateFile   /etc/apache2/ssl/........pem  
         SSLCertificateKeyFile  /etc/apache2/ssl/MYKEY  
       
         ServerName   .......  
         DocumentRoot  /var/www/html/ssl  
       
         #CustomLog    "/var/log/httpd/one-access.log" combined  
         #ErrorLog    "/var/log/httpd/one-error.log"  
       
         #Redirect permanent http://....... https://.........  
       
     #        <IfModule mod_rewrite.c>  
      #       RewriteEngine On  
      #       RewriteCond %{HTTPS} off  
       #      RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]  
       #      </IfModule>  
       
          <Directory /var/www/html/ssl>  
             AllowOverride none  
       
             Order Allow,Deny  
             Allow from all  
         </Directory>  
     </VirtualHost> 
  • "a2ensite YOURHOST"
  • "service /etc/apache2 restart"
 And now everyting for that virtualhost should be redirected to a SSL connection.

Even though this took me a while, I did it the first time, it was important because now I can secure a lot of my connections, e.g. postfixadmin with roundcube and dovecot in the background ;)


Kommentare

Beliebte Posts aus diesem Blog

Virtuelles Wasser?!

In den letzten Tagen habe ich immer mal wieder etwas mit Rails programmiert und werde mich ebenso heute dem neuen Auftrag "multiple file upload" kümmern. Und weil vieles "Versuch-Irrtum" ist, gucke ich auf dem zweiten Monitor immer Reportagen. Letztens kam mir "Der große Haushaltscheck" unter die Finger: ARD Mediathek "Der große Haushaltscheck" In der Sendung vom 11.3.2013 ging es um unser Trinkwasser. Jedem sollte klar sein, dass Plastikflaschen nicht die erste Wahl sind, weil man nicht darauf vertrauen kann, dass der Hersteller wirklich "gutes" Plastik nahm (BPA, Phtalate, Benzol, Xylol usw.), aber das interessante waren die genannten Zahlen in puncto virtuellem Wasser bzw. Wassersparen. Wasser sparen an und für sich ist ja gut, nur heisst das nicht, dass wir weniger die Klospühlung benutzen sollten, sondern dass wir uns Gedanken machen über das "virtuelle Wasser". Unsere Kanalisation ist eine Schwemm-Kanalisatio...

debian 6 vserver - a new installation due to centOS update problem - my steps

My centOS vserver broke down after a "yum update" and even the centOS community forum could not give an answer within 24h. In my books that is poor for the almighty and stable centOS. Bare in mind that I am just a normal user of linux, no professional and definitely no expert when it comes to server, but I can read, try and share my findings: debian 6 installation steps via ssh secure your server: adduser foobar for security purposes  change /etc/sshd/sshd_conf to PermitRootLogin no now you can login as foobar and change to root via su - visudo for sudo command permissions and put this at the bottom: foobar   ALL=(ALL) ALL change hostname change hostname in /etc/hostname and in /etc/hosts reboot login via rsa key rather than password locally do ssh-keygen ssh-copy-id -i foobar@hostname... ssh now works without passwords but with keys (for easy deployment) install ruby and rails via rvm login as root always good to have: sudo apt-get install...