Direkt zum Hauptbereich

SSL virtualhost after you setup a SSH connection through rsa keys and always redirect to it

You may have done this: ssh-keygen and ssh-copy-id and now you want to enable SSL. With Eric Ambergs "Linux-Server" book and Converting keys between openssl and openssh, I did this so far:

  • local: "scp MYKEY root@remote.server:~"
    after this its just remote:
  • "a2enmod ssl"
  • "mkdir /etc/apache2/ssl"
  • "openssl req -x509 -days 365 -new -key MYKEY -out /etc/apache2/ssl/nedab.de.pem" and make sure you use a wildcard domain as common name, e.g. *.common.com. That way your certificate is valid for all subdomains.
  •  "a2enmod redirect"
  • virtualhost in /etc/apache/site-available with help from Redirect Request to SSL:
     <VirtualHost *:80>  
       ServerName ..........  
       Redirect permanent / https://........../  
     </VirtualHost>  
       
     <VirtualHost _default_:443>  
         SSLEngine on  
         SSLCipherSuite HIGH:MEDIUM  
       
         SSLCertificateFile   /etc/apache2/ssl/........pem  
         SSLCertificateKeyFile  /etc/apache2/ssl/MYKEY  
       
         ServerName   .......  
         DocumentRoot  /var/www/html/ssl  
       
         #CustomLog    "/var/log/httpd/one-access.log" combined  
         #ErrorLog    "/var/log/httpd/one-error.log"  
       
         #Redirect permanent http://....... https://.........  
       
     #        <IfModule mod_rewrite.c>  
      #       RewriteEngine On  
      #       RewriteCond %{HTTPS} off  
       #      RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]  
       #      </IfModule>  
       
          <Directory /var/www/html/ssl>  
             AllowOverride none  
       
             Order Allow,Deny  
             Allow from all  
         </Directory>  
     </VirtualHost> 
  • "a2ensite YOURHOST"
  • "service /etc/apache2 restart"
 And now everyting for that virtualhost should be redirected to a SSL connection.

Even though this took me a while, I did it the first time, it was important because now I can secure a lot of my connections, e.g. postfixadmin with roundcube and dovecot in the background ;)


Kommentare

Beliebte Posts aus diesem Blog

rails + carrierwavve + plupload = multiple file upload

Right now I am very happy! I finished my work on creating a file upload method in rails for more than one file, altogether handled by rails sessions and as objects. First I had to learn a bit more about how rails works and I achieved that by reading a lot: books, screencasts and blogs. In this blog post I like to share what I accomplished, but without the hussle of putting code blocks in here, so watch out for bold formatted text as that is the code. My goal was to have one site with just the pure option of uploading files. All file handling would be done behind the scenes by myself logging onto my server. That said you are not going to see any fancy CRUD here. Lets start then! And dont forget to versioning your app BEFORE you try something new! [e.g. git] > rails g scaffold Photo title:string Now add carrierwave to you Gemfile and run > bundle install >rails g uploader Photo Alltogether you have model, controller, views and an uploader folder with the Ph...

debian 6 vserver - a new installation due to centOS update problem - my steps

My centOS vserver broke down after a "yum update" and even the centOS community forum could not give an answer within 24h. In my books that is poor for the almighty and stable centOS. Bare in mind that I am just a normal user of linux, no professional and definitely no expert when it comes to server, but I can read, try and share my findings: debian 6 installation steps via ssh secure your server: adduser foobar for security purposes  change /etc/sshd/sshd_conf to PermitRootLogin no now you can login as foobar and change to root via su - visudo for sudo command permissions and put this at the bottom: foobar   ALL=(ALL) ALL change hostname change hostname in /etc/hostname and in /etc/hosts reboot login via rsa key rather than password locally do ssh-keygen ssh-copy-id -i foobar@hostname... ssh now works without passwords but with keys (for easy deployment) install ruby and rails via rvm login as root always good to have: sudo apt-get install...

Virtuelles Wasser?!

In den letzten Tagen habe ich immer mal wieder etwas mit Rails programmiert und werde mich ebenso heute dem neuen Auftrag "multiple file upload" kümmern. Und weil vieles "Versuch-Irrtum" ist, gucke ich auf dem zweiten Monitor immer Reportagen. Letztens kam mir "Der große Haushaltscheck" unter die Finger: ARD Mediathek "Der große Haushaltscheck" In der Sendung vom 11.3.2013 ging es um unser Trinkwasser. Jedem sollte klar sein, dass Plastikflaschen nicht die erste Wahl sind, weil man nicht darauf vertrauen kann, dass der Hersteller wirklich "gutes" Plastik nahm (BPA, Phtalate, Benzol, Xylol usw.), aber das interessante waren die genannten Zahlen in puncto virtuellem Wasser bzw. Wassersparen. Wasser sparen an und für sich ist ja gut, nur heisst das nicht, dass wir weniger die Klospühlung benutzen sollten, sondern dass wir uns Gedanken machen über das "virtuelle Wasser". Unsere Kanalisation ist eine Schwemm-Kanalisatio...