SSL encryptie voor Apache

Introductie

Waarom SSL? Ik heb veel te doen gehad met data beveiliging en integriteit en ontdekte dat gevoelige data (zoals wachtwoorden van e-mail providers als GMX, Web.de enz.) makkelijk af te luisteren is op het netwerk. Zo kwam ik in aanraking met het them SSL (met SSL encryptie is de data niet zo makkelijk af te luisteren) en stelde ik deze korte HowTo samen. Deze kan je helpen bij het opzetten van een SSL webserver.

1. Wat is er nodig voor de installatie?

• apache 1.3.19 (apache_1.3.19.tar.gz)
• apache 1.3.19 SSL-encryptie (apache_1.3.19+ssl_1.44.tar.gz)
• patch 2.5.4
• openssl

2. Het patchen van de broncode voorbereiden

Eerst pak je broncode van Apache uit.

tar zxvf apache_1.3.19.tar.gz

Dan kopieer je het bestand apache_1.3.19+ssl_1.44.tar.gz naar de gemaakte directory apache_1.3.19/).

Dan pak je het uit met het commando

tar zxvf apache_1.3.19+ssl_1.44.tar.gz

Als patch 2.5.4 of hoger en openssl nog niet geïnstalleerd waren, moet je dat nu doen, deze zijn nodig om Apache SSL te laten ondersteunen.

3. Patching the sources

Om de broncode te patchen, ga je naar de apache directory en gebruik je het commando:

./FixPatch

./FixPatch /opt/openssl

Het path /opt/openssl is uiteraard afhankelijk van de lokale openssl installatie.

4. De webserver installeren

Om de webserver te installeren, gebruik je de volgende commando's:

  	 ./configure --prefix= DOELDIRECTORY 
          bijvoorbeeld /opt/apache-ssl
  
  	 make 
  
  	 make install 
  

Vervolgens maak je een directory die later nodig is

	
  	 mkdir /opt/apache-ssl/htdocs-ssl 
  	 chmod a+rx /opt/apache-ssl/htdocs-ssl 
  	 cd /opt/apache-ssl/ 
  

   
   /opt/
        apache-ssl/
                   htdocs/
                   htdocs-ssl/
                   conf/
  		 ...
                   etc.
    
  

5. The security certificate

It is necessary to discuss the settings for the security certificate now to make sure that you can follow this HowTo to its end.

Instead of "server" you can use any name in the following example.

For the creation of a certificate get a short instruction

  	1.  openssl req -new > server.cert.csr
  

  	2.  openssl rsa -in privkey.pem -out server.cert.key
  

  	3.  openssl x509 -in server.cert.csr -out server.cert.cert 
                                  -req -signkey server.cert.key -days 365 
  

Then you copy both keys, server.cert.key and server.cert.cert, to /opt/apache-ssl/conf

The reason why you had to create the key will become clear in the next point.

6. The configuration

The configuration takes most of the time because it is quite complicate. To make it simpler the configuration is explained using an example.

The configuration file is at /opt/apache-ssl/conf

First you edit the file httpsd.conf.
Here you have to set the lines to you requirements.
If you wanted to offer not encrypted pages as well you have to comment out the line

  #Listen 3000
  

If your (insecure) web server ran on port 8080 you should replace 3000 by 8080.

The main change appears at the end of the file. Before the last line you add two include commands.

Include "conf/ssl.conf"
  Include "conf/port-443.conf"
  

The meaning of them will be explained in the next section.

After finishing the configuration at the httpsd.conf you create a link. It will be needed later when starting the server.

  	 ln -s httpsd.conf httpd.conf 
  

6.1 ssl.conf

In the ssl.conf you find e.g. the place of the program gcache and which port it used. Without gcache apache cannot work.

Next you create the file ssl.conf; the entry should look like:

  SSLDisable
  SSLNoCAList
  
  SSLRandomFile file /var/tmp 1024
  
  SSLCacheServerPath /opt/apache-ssl/bin/gcache
  SSLCacheServerPort logs/gcache_port
  
  SSLCacheServerRunDir /tmp
  SSLSessionCacheTimeout 15
  

6.2 port-443.conf

Do not be scared by the name. The reason for me to name this file in such a way is simple: by default the port for SSL is 443. In this file you specify on which port the server has to wait for commands (listen) and where it finds the security certificates.

  Listen 192.168.11.45:8887
  
  <VirtualHost 192.168.11.45:8887>
  DocumentRoot /opt/apache-ssl/htdocs-ssl
  SSLCertificateFile /opt/apache-ssl/conf/server.cert.cert
  SSLCertificateKeyFile /opt/apache-ssl/conf/server.cert.key
  
  SSLVerifyClient 0
  SSLVerifyDepth 10
  
  SSLBanCipher NULL-MD5:NULL-SHA
  CustomLog    logs/ssl_log "%t %{version}c %{cipher}c %{clientcert}c"
  
  SSLEnable
  </VirtualHost>
  

7. Start and test of the web server

You start the web server with

  	 /opt/apache-ssl/bin/httpsdctl start 
  

You can test apache by creating an index.html file and copying both into the directory /opt/apache-ssl/htdocs and /opt/apache-ssl/htdocs-ssl.

If you browsed to the URLs

  
  http://192.168.11.45:8080
  https://192.168.11.45:8887