You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Leif W <wa...@usa.net> on 2003/08/17 02:29:02 UTC
[users@httpd] Apache2/SSL/VirtualHost/single external IP
Hello,
I've tried looking around google and this mailing list but couldn't find
this same scenario. Maybe I missed something and you could refer me to the
appropriate place.
I've got a typical cable internet access setup, a single dynamic IP (but
doesn't change much as I leave my box on 24/7) to the outside world, with a
Linux firewall/NAT setup to allow multiple boxes on the internal (LAN) side.
I had my server setup fine with IP Masquerading to point to the computer
running the webserver, and multiple VirtualHosts all on the same internal IP
(192.168.7.7). However, I wanted to start playing with Apache2's mod_ssl,
so I've created some self-signed certificates, read up on typical SSL
configuration options, and can get a single site (ServerName) to work on
http (80) and https (443) on a single internal IP. But I want to have
multiple secure sites.
I think I remember seeing somewhere that you can only run one secure per IP,
but I've tried a setup something like this config (see EXAMPLE 1 below),
just to see what happens. What I get is I can see www.site1.org:80 ok, I
can't see www.site2.net:80, I can see www.site1.org:443 and
www.site2.net:443 correctly. In short, it lets me see all sites correctly
except the second unencrypted site.
I also know I can setup the server's network card to listem to multiple IP
addresses in the 192.168.*.* range, and this would solve the SSL problems by
assigning each website it's own IP (against the whole point of Virtual
Hosting), but I'd still have the problem of only one external IP, so my
sites would not be accessible by the rest of the world (which I'd like the
sites to be accessible for testing / displaying web apps). So would I have
to have my NAT/ipmasq box somehow determine which site is being called, and
let it do masquerading/address translations to the appropriate internal IP
for that website? Is this even possible? Or is there something I can do in
the Apache's httpd.conf file?
Leif
EXAMPLE 1
--------------
NameVirtualHost *
<VirtualHost *>
#
ServerName default
(stuff)
</VirtualHost>
NameVirtualHost 192.168.7.7:80
<VirtualHost 192.168.7.7:80>
ServerName www.site1.org
(stuff)
</VirtualHost>
<VirtualHost 192.168.7.7:80>
ServerName www.site2.net
(stuff)
</VirtualHost>
<IfDefine SSL>
NameVirtualHost 192.168.7.7:443
<VirtualHost 192.168.7.7:443>
ServerName www.site1.org
(stuff including SSL opts)
</VirtualHost>
<VirtualHost 192.168.7.7:443>
ServerName www.site2.net
(stuff including SSL opts)
</VirtualHost>
--------------
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache2/SSL/VirtualHost/single external IP
Posted by Leif W <wa...@usa.net>.
> > You are sure that DNS is working properly for the hostname. Connection
>
> I'm using the hosts file, which I believe is looked at before DNS, so it
is
> finding the right IP.
It helps when I type the right IP into the hosts file. ;-) It was correct
in one place and incorrect in another place.
Now I am getting all the expected results from Apache and my browser.
Thanks for all the help and pointers.
Leif
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache2/SSL/VirtualHost/single external IP
Posted by Leif W <wa...@usa.net>.
----- Original Message -----
From: "Robert Andersson" <ro...@profundis.nu>
To: <us...@httpd.apache.org>
Sent: Sunday, August 17, 2003 7:43 AM
Subject: Re: [users@httpd] Apache2/SSL/VirtualHost/single external IP
> You are sure that DNS is working properly for the hostname. Connection
I'm using the hosts file, which I believe is looked at before DNS, so it is
finding the right IP.
> refused would not be the error if Apache was at fault. If Apache gets a
> request and can't find the appropriate VirtualHost, it will always serve
> from the first VHost defined on the IP of the incoming request.
But when I had the erroneous second secure VirtualHost section on the same
IP:port, I was getting the correct site, just the wrong certificate.
> Try doing a "telnet www.site2.net 80", and type:
>
> GET / HTTP/1.1
> Host: www.site2.net
>
> And see what you get.
Tried, and this just seems odd.
HTTP/1.1 200 OK
(headers)
(HTML page from the "default" site, the very first VirtualHost definition)
[pause for about 5 seconds]
Connection to host lost.
Log file shows a successful request (status 200).
Oddly, the browser fails instantly (no pause as compared with the manual
telnet) with the connection refused message, and without leaving anything in
the log files. Maybe the browser has the wrong IP stuck somewhere? I
restarted the browser, now I get the same results as the telnet, I am seeing
the "default" site, not the expected www.site2.net.
httpd.conf VirtualHosts section now looks like this:
NameVirtualHost *
# catch IP probes so they don't clutter other logfiles
<VirtualHost *>
ServerName default
(stuff)
</VirtualHost>
<VirtualHost *>
ServerName www.site1.org
(stuff)
</VirtualHost>
<VirtualHost *>
ServerName www.site2.net
(stuff)
</VirtualHost>
<IfDefine SSL>
NameVirtualHost 192.168.7.7:443
<VirtualHost 192.168.7.7:443>
ServerName www.site1.org
(stuff + ssl opts)
</VirtualHost>
</IfDefine>
> 'https://secure.site2.net:444/'.
I think this will be the most elegant solution, thanks for the tip. It's
trivial to maintain the ":IP" in the conf and throughout my sites' PHP or
Perl scripts and HTML files.
Leif
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache2/SSL/VirtualHost/single external IP
Posted by Robert Andersson <ro...@profundis.nu>.
Leif W wrote:
> Sorry, what I meant was my browser (Mozilla 1.4) says "The connection was
> refused when attempting to contact www.site2.net." I've commented out
> the second encrypted site, and removed the redundant NameVirtualHosts.
You are sure that DNS is working properly for the hostname. Connection
refused would not be the error if Apache was at fault. If Apache gets a
request and can't find the appropriate VirtualHost, it will always serve
from the first VHost defined on the IP of the incoming request.
Try doing a "telnet www.site2.net 80", and type:
GET / HTTP/1.1
Host: www.site2.net
And see what you get.
> What I don't understand is why I can't use this IP for more than one
> unencrypted site when it's also being used for a single secure site. Is
> this due to a misconfig or is this just how secure sites work?
Hmm, are you speaking of "unencrypted" or "secure" sites here? You should be
able to use one IP for several "normal" HTTP virtual hosts.
> Another solution is to have one secure site (secure.site.net), and map
> different paths to the appropriate directories (
> https://secure.site1.org/site2.net/, https://secure.site1.org/site3.com/,
> etc. ). This would be adequate to have some simple testing and
> functionality.
Yes. I forgot to add in my last response, SSL is not restricted to one per
IP, but to one per IP/port combination. Thus, you can have very many SSL
sites on a single IP, but for all except the one running on port 443 you'll
always need to explicitly inlcude the port in the URI, eg
'https://secute.site2.net:444/'.
>
> One other question comes to mind. Would it be possible to have a
> VirtualHost *:443 do a check to see if it's an unencrypted session, and
> if so, do a PermanentRedirect to the appropriate secure site? I.e.
> someone types in a browser https://www.site3.com/ and Apache catches,
> sees it's unsecure, redirects to https://secure.site1.org/site3.com/
> based on the Host header.
Again, Apache cannot see the Host header before the request has been
decrypted, and in order to do this it must know which certificate to pick
(which for it needs to know the host).
Regards,
Robert Andersson
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache2/SSL/VirtualHost/single external IP
Posted by Leif W <wa...@usa.net>.
----- Original Message -----
From: "Robert Andersson" <ro...@profundis.nu>
To: <us...@httpd.apache.org>
Sent: Saturday, August 16, 2003 9:15 PM
Subject: Re: [users@httpd] Apache2/SSL/VirtualHost/single external IP
> > www.site1.org:80 ok, I can't see www.site2.net:80
>
> What do you mean by "can't see"? Wrong contents, forbidden, document not
> found, host not found? What does the error log has to say?
Sorry, what I meant was my browser (Mozilla 1.4) says "The connection was
refused when attempting to contact www.site2.net." I've commented out the
second encrypted site, and removed the redundant NameVirtualHosts. What I
don't understand is why I can't use this IP for more than one unencrypted
site when it's also being used for a single secure site. Is this due to a
misconfig or is this just how secure sites work?
> You may *see* www.site2.net:443, but not *correctly*. What happens is that
> when you request it, Apache will use the certificate you defined for your
> first SSL host.
I checked the browser's certificates, and saw that is what happened.
> No. If you can live with it, you can use the same certificate for all your
> SSL sites, although all browsers will complain that the certificate
doesn't
> match the hostname.
Another solution is to have one secure site (secure.site.net), and map
different paths to the appropriate directories (
https://secure.site1.org/site2.net/, https://secure.site1.org/site3.com/,
etc. ). This would be adequate to have some simple testing and
functionality.
One other question comes to mind. Would it be possible to have a
VirtualHost *:443 do a check to see if it's an unencrypted session, and if
so, do a PermanentRedirect to the appropriate secure site? I.e. someone
types in a browser https://www.site3.com/ and Apache catches, sees it's
unsecure, redirects to https://secure.site1.org/site3.com/ based on the Host
header.
Leif
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache2/SSL/VirtualHost/single external IP
Posted by Robert Andersson <ro...@profundis.nu>.
Leif W wrote:
> I think I remember seeing somewhere that you can only run one secure
> per IP,
You read right.
> but I've tried a setup something like this config (see EXAMPLE 1
> below), just to see what happens. What I get is I can see
> www.site1.org:80 ok, I can't see www.site2.net:80
What do you mean by "can't see"? Wrong contents, forbidden, document not
found, host not found? What does the error log has to say?
> I can see www.site1.org:443 and www.site2.net:443 correctly.
You may *see* www.site2.net:443, but not *correctly*. What happens is that
when you request it, Apache will use the certificate you defined for your
first SSL host.
Apache can't determine which (named) host is being requested, because that
piece of information is encrypted. This discussion comes up at least once
per week, so go back in the archives for more detailed information about
this.
> So would I have to have my NAT/ipmasq box somehow determine which site
> is being called, and let it do masquerading/address translations to the
> appropriate internal IP for that website?
Your NAT has absolutely no way of telling which hostname the request is for,
and thus cannot forward requests on 443 to different internal IPs. It will
just see requests for port 443 with a lot of nonsense garbage.
> Or is there something I can do in the Apache's httpd.conf file?
No. If you can live with it, you can use the same certificate for all your
SSL sites, although all browsers will complain that the certificate doesn't
match the hostname.
> EXAMPLE 1
> --------------
> NameVirtualHost *
> <VirtualHost *>
> #
> ServerName default
> (stuff)
> </VirtualHost>
>
> NameVirtualHost 192.168.7.7:80
This is redundant. 'NameVirtualHost *' will accept requests on all
interfaces (on port 80).
Regards,
Robert Andersson
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache2/SSL/VirtualHost/single external IP
Posted by Leif W <wa...@usa.net>.
Thanks for the detailed response.
Leif
----- Original Message -----
From: "Brian Dessent" <br...@dessent.net>
To: <us...@httpd.apache.org>
Sent: Saturday, August 16, 2003 9:16 PM
Subject: Re: [users@httpd] Apache2/SSL/VirtualHost/single external IP
> Leif W wrote:
>
> > So would I have
> > to have my NAT/ipmasq box somehow determine which site is being called,
and
> > let it do masquerading/address translations to the appropriate internal
IP
> > for that website? Is this even possible? Or is there something I can
do in
> > the Apache's httpd.conf file?
>
> Ahh, that's the rub. Look at the situation from the standpoint of the
> NAT gateway: Packet comes in on 443. None of the HTTP headers are
> available for inspection -- they're part of the session and thus
> encrypted. Think about it, if a third party (which is what the NAT
> gateway really is) were able to decrypt and read the contents of the
> packets without either endpoint being aware, that would pretty much make
> https/SSL completely worthless.
>
> How is the gateway to know whether this request is addressed to
> site1.com or site2.com if it cannot look at the "Host:" header of the
> HTTP session? It can't. What you're trying to do (multiple https sites
> on one IP address) is not possible. You may have multiple addresses
> behind the NAT gateway but that doesn't change the fact that externally
> it's all the same IP address.
>
> Brian
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Apache2/SSL/VirtualHost/single external IP
Posted by Brian Dessent <br...@dessent.net>.
Leif W wrote:
> So would I have
> to have my NAT/ipmasq box somehow determine which site is being called, and
> let it do masquerading/address translations to the appropriate internal IP
> for that website? Is this even possible? Or is there something I can do in
> the Apache's httpd.conf file?
Ahh, that's the rub. Look at the situation from the standpoint of the
NAT gateway: Packet comes in on 443. None of the HTTP headers are
available for inspection -- they're part of the session and thus
encrypted. Think about it, if a third party (which is what the NAT
gateway really is) were able to decrypt and read the contents of the
packets without either endpoint being aware, that would pretty much make
https/SSL completely worthless.
How is the gateway to know whether this request is addressed to
site1.com or site2.com if it cannot look at the "Host:" header of the
HTTP session? It can't. What you're trying to do (multiple https sites
on one IP address) is not possible. You may have multiple addresses
behind the NAT gateway but that doesn't change the fact that externally
it's all the same IP address.
Brian
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org