Apache HTTPD setup

Describes how to setup an Apache WebServer, used for file exchange, in a Bit Repository BitRepository system.

Apache2

Install Apache2, mod_ssl and mod_dav if not pre-installed.

Debian based systems

Code Block


$ a2enmod dav dav_fs dav_lock # Enable DAV
$ mkdir /path/to/www/dav      # Create directory for DAV
$ chown www-data:wwwdata /path/to/www/dav

$ a2enmod ssl                 # Enable SSL
$ a2ensite default-ssl        # Enable SSL site

RHEL

yum install httpd mod_ssl
mkdir -p /path/to/www/dav/
chown apache:apche /path/to/www/dav/
vim /etc/httpd/conf/httpd.conf (and change ServerName and enable WebDAV)
mkdir /etc/httpd/ssl/
generate self-signed key to /etc/httpd/ssl (and make sure it's only accessible by apache: chown apache:apache /path/to/server.key && chmod 600 /path/to/server.key)
vim /etc/httpd/conf.d/ssl.conf
service httpd start
chkconfig httpd on

SSL Setup

Setup the SSL site (on debian /etc/apache2/sites-available/default-ssl, redhat: /etc/httpd/conf.d/ssl.conf) to use the relevant keys and certificates (see Create self signed certificate):

Code Block
SSLCertificateFile /path/to/server.crt SSLCertificateKeyFile /path/to/server.key SSLCACertificateFile /path/to/trusted.crt SSLVerifyClient require SSLVerifyDepth 0

SSLCACertificateFile is a concatenation of client certificates in PEM format (i.e.

DAV Setup

Code Block
<Location /dav> Dav On </Location>

Code Block
$ /etc/init.d/apache2 restart # Finally restart apache or $ service httpd restart

Redhat

As with Debian, except some things are done differently, see here.

References:
Apache SSL/TLS Encryption
Apache Module mod_dav

Lighttpd

Enabling upload (WebDAV):

Add "mod_webdav" to server.modules, and configure it:

No Format
webdav.activate = "enable" webdav.is-readonly = "disable" webdav.sqlite-db-name = "/var/run/lighttpd/lighttpd.webdav_lock.db"

Enabling SSL (HTTPS) on port 443:

No Format


$SERVER["socket"] == ":443" {
	ssl.engine = "enable"
	ssl.pemfile = "/path/to/server.pem" # a PEM file is a combination of a key and certificate
	ssl.ca-file = "/path/to/ca.crt"     # This is the CA file used to sign the above key (if needed, which it is for self-signed certificates)
}

To enable client authentication add the following to the configuration:

No Format
ssl.verifyclient.activate = "enable" ssl.verifyclient.enforce = "enable" #ssl.verifyclient.depth = "1" # Should possibly be enabled in the future ssl.verifyclient.username = "SSL_CLIENT_S_DN_CN"

References:
Configuring SSL
Redirecting HTTP to HTTPS

Create self signed certificate

...

No Format


# For HTTPS servers remember to put the
# server FQDN in the CN.

KEY="$CN.key"
CSR="$CN.csr"
CRT="$CN.crt"

# Generate key
openssl genrsa -out "$KEY" 1024 || exit 1

# Certificate Signing Request (Remember to modify the signing request subject)
openssl req -new -key "$KEY" -out "$CSR" -subj "/C=DK/O=TestOrganization/OU=TestDepartment/CN=$CN" || exit 1

# Self sign
openssl x509 -req -days 1000 -in "$CSR" -out "$CRT" -signkey "$KEY" || exit 1

Optionally this can be packaged into a web browser friendly pkcs-12 file along with the server certificate:

No Format
openssl pkcs12 -export -in browser.crt -inkey browser.key -out browser.p12 -certfile /path/to/server.crt

Creating a certificate authority for test

No Format


$ mkdir /path/to/ca/                 # CA root
$ mkdir /path/to/ca/ca.db.certs      # Signed certificates
$ touch /path/to/ca/ca.db.index      # Index of signed certificates
$ echo 01 > /path/to/ca/ca.db.serial # Next (sequential) serial number
$ cp ca.conf /path/to/ca/            # Configuration file (see below)

$ cd /path/to/ca
$ openssl genrsa -out ca.key 1024    # Generate CA private key
$ openssl req -new -key ca.key \
                   -out ca.csr       # Create Certificate Signing Request
$ openssl x509 -req -days 10000 \
               -in ca.csr \
               -out ca.crt \
               -signkey ca.key       # Create self-signed certificate

ca.conf:

No Format


[ ca ]
default_ca = ca_default

[ ca_default ]
dir = ./ca
certs = $dir
new_certs_dir = $dir/ca.db.certs
database = $dir/ca.db.index
serial = $dir/ca.db.serial
RANDFILE = $dir/ca.db.rand
certificate = $dir/ca.crt
private_key = $dir/ca.key
default_days = 365
default_crl_days = 30
default_md = md5
preserve = no
policy = generic_policy
[ generic_policy ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

Creating and signing webserver certificate:

No Format


$ openssl genrsa -out server.key 1024 # Create private/public key pair for server
$ openssl req -new -key server.key \
                   -out server.csr    # Create certificate signing request
                                      # (Remember: Common name *MUST* match server address)
$ openssl ca -config ca.conf \
             -in server.csr \
             -cert ca.crt \
             -keyfile ca.key \
             -out server.crt          # Sign certificate request with CA certificate.

# Create PEM file with the server key and certificate for use with lightttpd
$ cat server.key server.crt > server.pem

Creating a client certificate for use with web browsers (remember it will also usually need the CA certificate used in signing):

No Format


# openssl genrsa -out client.key 1024 # Generate public/private key for client
# openssl req -new -key client.key \
                   -out client.csr    # Create certificate signing request
# openssl ca -config ca.conf \
             -in client.csr \
             -cert ca.crt \
             -keyfile ca.key \
             -out client.crt          # Sign certificate

# openssl pkcs12 -export -clcerts \
                 -in client.crt \
                 -inkey client.key \
                 -out client.p12      # Create PKCS12 keystore for use with web browsers

References:
Client certificates with apachecat trusted_certs/*.crt > trusted.crt).

DAV Setup

To enable DAV on a specific location (it's not enabled for any directory by default), edit either ssl.conf (or default-ssl for debian) and add the following:

Code Block
Alias /dav/ /var/www/dav/ <Location /dav> Dav On </Location>

The alias is needed since the directory is outside of the document root.

If the DAV directory should be accessible over HTTP (NOT advisable) add a similar configuration fragment to httpd.conf (or sites-enabled/000-default for debian).

If the above doesn't work (or the DAV directory isn't placed in the document root, the following can be used instead:

Code Block
Alias /dav/ /path/to/dav/ <Directory /path/to/dav> Dav On </Directory>

Code Block
$ /etc/init.d/apache2 restart # Finally restart apache or $ service httpd restart

Testing

One can verify that files can be uploaded to the dav directory using curl:

Code Block
curl -T <some_file_to_upload> <http://server/dav/>

One can verify that files can be uploading using HTTPS with client authentication (Note: it should only be possible to access the server using HTTPS if a valid key/certificate pair is presented):

Code Block
curl --cacert <webserver.crt> --key <clientXX.key> --cert <clientXX.crt> -T <some_file_to_upload> <https://server/dav/>

References:
Apache default directory layuout
Apache SSL/TLS Encryption
Apache Module mod_dav

Versions Compared

Old Version 17

New Version Current

Key

Apache HTTPD setup

Apache2

Debian based systems

RHEL

SSL Setup

DAV Setup

Redhat

Lighttpd

Create self signed certificate

Creating a certificate authority for test

DAV Setup

Testing

Page Comparison

Versions Compared

Old Version 17

New Version Current

Key

Apache HTTPD setup

Apache2

Debian based systems

RHEL

SSL Setup

DAV Setup

Redhat

Lighttpd

Create self signed certificate

Creating a certificate authority for test

DAV Setup

Testing