...

Apache HTTPD setup

Describes how to setup an Apache WebServer, used for file exchange, in a Bit Repository system.

Creating a certificate authority for test

...

BitRepository system.

Apache2

Install Apache2, mod_ssl and mod_dav if not pre-installed.

Debian based systems

$ a2enmod dav dav_fs dav_lock # Enable DAV
$ mkdir /path/to/ca/ca.db.certswww/dav      # SignedCreate certificatesdirectory $ touch /path/to/ca/ca.db.index      # Index of signed certificatesfor DAV
$ echo 01 >chown www-data:wwwdata /path/to/ca/ca.db.serial # Next (sequential) serial numberwww/dav

$ cpa2enmod ca.conf /path/to/ca/            # Configuration file (see below)

$ cd /path/to/ca
$ openssl genrsa -out ca.key 1024ssl                 # Generate CA private keyEnable SSL
$ openssla2ensite req -new -key ca.key \
  default-ssl                 -out ca.csr       # CreateEnable CertificateSSL Signing Request
$ openssl x509 -req -days 10000 \
               -in ca.csr \
               -out ca.crt \
               -signkey ca.key       # Create self-signed certificate

ca.conf:

[ ca ]
default_ca = ca_default

[ ca_default ]
dir = ./ca
certs = $dir
new_certs_dir = $dir/ca.db.certs
database = $dir/ca.db.index
serial = $dir/ca.db.serial
RANDFILE = $dir/ca.db.rand
certificate = $dir/ca.crt
private_key = $dir/ca.key
default_days = 365
default_crl_days = 30
default_md = md5
preserve = no
policy = generic_policy
[ generic_policy ]
countryName = optional
stateOrProvinceName = optional
localityName = optional
organizationName = optional
organizationalUnitName = optional
commonName = supplied
emailAddress = optional

Creating and signing webserver certificate:

$ openssl genrsa -out server.key 1024 # Create private/public key pair for server
$ openssl req -new -key server.key \site

RHEL

1. yum install httpd mod_ssl
2. mkdir -p /path/to/www/dav/
3. chown apache:apche /path/to/www/dav/
4. vim /etc/httpd/conf/httpd.conf (and change ServerName and enable WebDAV)
5. mkdir /etc/httpd/ssl/
6. generate self-signed key to /etc/httpd/ssl (and make sure it's only accessible by apache: chown apache:apache /path/to/server.key && chmod 600 /path/to/server.key)
7. vim /etc/httpd/conf.d/ssl.conf
8. service httpd start
9. chkconfig httpd on

SSL Setup

Setup the SSL site (on debian /etc/apache2/sites-available/default-ssl, redhat: /etc/httpd/conf.d/ssl.conf) to use the relevant keys and certificates (see Create self signed certificate):

         SSLCertificateFile      /path/to/server.crt
         SSLCertificateKeyFile   /path/to/server.key
        -out server.csrSSLCACertificateFile    # Create certificate signing request/path/to/trusted.crt
         SSLVerifyClient         require
         SSLVerifyDepth              # (Remember: Common name *MUST* match server address)
$ openssl ca -config ca.conf \
             -in server.csr \0

SSLCACertificateFile is a concatenation of client certificates in PEM format (i.e. cat trusted_certs/*.crt > trusted.crt).

DAV Setup

To enable DAV on a specific location (it's not enabled for any directory by default), edit either ssl.conf (or default-ssl for debian) and add the following:

        Alias /dav/ /var/www/dav/

    -cert ca.crt \        <Location /dav>
     -keyfile ca.key \         Dav On
    -out server.crt          # Sign certificate request with CA certificate.

# Create PEM file with the server key and certificate for use with lightttpd
$ cat server.key server.crt > server.pem

References:
Client certificates with apache

Lighttpd

Enabling upload (WebDAV):

Add "mod_webdav" to server.modules, and configure it:

webdav.activate = "enable"
webdav.is-readonly = "disable"
webdav.sqlite-db-name = "/var/run/lighttpd/lighttpd.webdav_lock.db"

Enabling SSL (HTTPS) on port 443:

$SERVER["socket"] == ":443" {
	ssl.engine = "enable"
	ssl.pemfile = "/path/to/server.pem" # a PEM file is a combination of a key and certificate
	ssl.ca-file = "/path/to/ca.crt"     # This is the CA file used to sign the above key (if needed, which it is for self-signed certificates)
}

To enable client authentication add the following to the configuration:

	ssl.verifyclient.activate = "enable"
	ssl.verifyclient.enforce = "enable"
	#ssl.verifyclient.depth = "1" # Should possibly be enabled in the future
	ssl.verifyclient.username = "SSL_CLIENT_S_DN_CN"

...

</Location>

The alias is needed since the directory is outside of the document root.

If the DAV directory should be accessible over HTTP (NOT advisable) add a similar configuration fragment to httpd.conf (or sites-enabled/000-default for debian).

If the above doesn't work (or the DAV directory isn't placed in the document root, the following can be used instead:

Alias /dav/ /path/to/dav/
<Directory /path/to/dav>
  Dav On
</Directory>

$ /etc/init.d/apache2 restart # Finally restart apache
or
$ service httpd restart

Testing

One can verify that files can be uploaded to the dav directory using curl:

curl -T <some_file_to_upload> <http://server/dav/>

One can verify that files can be uploading using HTTPS with client authentication (Note: it should only be possible to access the server using HTTPS if a valid key/certificate pair is presented):

curl --cacert <webserver.crt> --key <clientXX.key> --cert <clientXX.crt> -T <some_file_to_upload> <https://server/dav/>

References:
Apache default directory layuout
Apache SSL/TLS Encryption
Apache Module mod_dav