Redhat secure server - Aug 1998 - Sharing server/document root?

I''d like some input on a plan to have both a secure and unsecure server
sharing their server and document roots.  The plan also calls for running
both servers on the same system and using the secure server at checkout
time or if the user is entering private information.

   I''ve read so much the last few weeks that it''s all starting
to blur
together leaving me VERY confused.

   Is this a bad idea?
   Are there any subtle points I''m missing?

Any and all thoughts appreciated.

Rod
--
Roderick A. Anderson
raanders@altoplanos.net               Altoplanos Information Systems, Inc.
Voice: 208.765.6149                            212 S. 11th Street, Suite 5
FAX: 208.664.5299                                  Coeur d''Alene, ID
83814
           Please don''t tell my mother I''m a System
Administrator.
                   She thinks I play piano in a bordello.

At 10:35 AM 8/21/98 -0700, you wrote:
>I''d like some input on a plan to have both a secure and unsecure
server
>sharing their server and document roots.  The plan also calls for running
>both servers on the same system and using the secure server at checkout
>time or if the user is entering private information. 
My immediate reaction is that actually sharing the document roots makes it
very hard to "audit" your configurations and ensure that the unsecure
server isn''t serving documents that you really meant to have served
only
over SSL.  

You realize that just because the servers have different document roots
that this doesn''t have to be reflected in the URLs?  In other words:

http://www.my.com/buyme/options.html   -> 
/home/httpd/html/buyme/options.html

https://www.my.com/buyme/payhere.html  ->  /home/ssl/html/buyme/payhere.html

is perfectly feasible.  

Unless I''m overlooking something also, it all becomes a tradeoff
between
ease of creation, particularly with web-site authoring tools, and making it
easier to ensure that the material that requires SSL always is served with
SSL.

--Jon Radel
jon@radel.com

On Fri, 21 Aug 1998, Jon Radel wrote:
> My immediate reaction is that actually sharing the document roots makes it
> very hard to "audit" your configurations and ensure that the
unsecure
> server isn''t serving documents that you really meant to have
served only
> over SSL.  
> 
After sending the message (don''t it figure) I thought about it some
more
and came to the same conclusion.
> You realize that just because the servers have different document roots
> that this doesn''t have to be reflected in the URLs?  In other
words:
> 
> http://www.my.com/buyme/options.html   -> 
/home/httpd/html/buyme/options.html
> 
> https://www.my.com/buyme/payhere.html  -> 
/home/ssl/html/buyme/payhere.html
> 
> is perfectly feasible.  
> 
I guess I was worrying in the wrong direction.  I was concerned about
multiple copies of the same file, maybe with slight differences, floating
around.  Since they shouldn''t exist anyway, different servers/different
documents, this isn''t the problem.
> Unless I''m overlooking something also, it all becomes a tradeoff
between
> ease of creation, particularly with web-site authoring tools, and making it
> easier to ensure that the material that requires SSL always is served with
> SSL.
This is the crux of it.  I forgot to KISS.
> --Jon Radel
> jon@radel.com
Thanks Jon,

Rod
--
           Please don''t tell my mother I''m a System
Administrator.
                   She thinks I play piano in a bordello.

Hi!
As it says in the manual, section 1.5.3, pages 13 and 14:
"The virtual hosts feature of the Red Hat Secure Web Server gives you the
flexibility to run different servers for different addresses all on the
same machine.  Virtual hosts also give you the ability to run both secure
and non-secure servers on the same machine."

You''ll need to uncomment the following lines to get it to work on both
ports 80 and 443:
#<VirtualHost *:80>
#ServerName my.domain.com
#SSLDisable
#</VirtualHost>

What you do with this setup will be up to you and your website developers
to decide.  (:
Good luck,
Cindy

fnord.

On Fri, 21 Aug 1998, Roderick A. Anderson wrote:
> Date: Fri, 21 Aug 1998 10:35:04 -0700 (PDT)
> From: "Roderick A. Anderson" <raanders@altoplanos.net>
> Reply-To: redhat-secure-server@redhat.com
> To: minivend-users@minivend.com, redhat-secure-server@redhat.com
> Subject: Sharing server/document root?
> Resent-Date: 21 Aug 1998 17:29:57 -0000
> Resent-From: redhat-secure-server@redhat.com
> Resent-cc: recipient list not shown: ;
> 
> I''d like some input on a plan to have both a secure and unsecure
server
> sharing their server and document roots.  The plan also calls for running
> both servers on the same system and using the secure server at checkout
> time or if the user is entering private information. 
> 
>    I''ve read so much the last few weeks that it''s all
starting to blur
> together leaving me VERY confused.
> 
>    Is this a bad idea?
>    Are there any subtle points I''m missing? 
> 
> Any and all thoughts appreciated.
> 
> Rod
> --
> Roderick A. Anderson
> raanders@altoplanos.net               Altoplanos Information Systems, Inc.
> Voice: 208.765.6149                            212 S. 11th Street, Suite 5
> FAX: 208.664.5299                                  Coeur d''Alene,
ID 83814
>            Please don''t tell my mother I''m a System
Administrator.
>                    She thinks I play piano in a bordello.
> 
> 
> -- 
>   PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
> http://www.redhat.com/RedHat-FAQ /RedHat-Errata /RedHat-Tips /mailing-lists
>          To unsubscribe: mail redhat-secure-server-request@redhat.com with 
>                        "unsubscribe" as the Subject.
> 

From mail@mail.redhat.com     
Received: (qmail 30 invoked from network); 22 Aug 1998 07:07:15 -0000
Received: from mail.bkbank.com (205.216.88.5)
  by mail2.redhat.com with SMTP; 22 Aug 1998 07:07:15 -0000
Received: from fcn105-122.tmi.net ( [207.170.105.122] ) by mail.bkbank.com
    (Hethmon Brothers Smtpd) ; Sat, 22 Aug 1998 02:07:14 CST6CDT
Message-Id: <199807220207.1434626.7@mail.bkbank.com>
From: "Jeff Rush" <jrush@summit-research.com>
To: "redhat-secure-server@redhat.com"
<redhat-secure-server@redhat.com>
Date: Sat, 22 Aug 98 02:07:17 -0500
Reply-To: "Jeff Rush" <jrush@summit-research.com>
Priority: Normal
X-Mailer: PMMail 1.95a For OS/2
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Subject: Re: Sharing server/document root?

On Fri, 21 Aug 1998 23:42:04 -0400 (EDT), Cynthia Dale wrote:
>As it says in the manual, section 1.5.3, pages 13 and 14:
>"The virtual hosts feature of the Red Hat Secure Web Server gives you
the
>flexibility to run different servers for different addresses all on the
>same machine.  Virtual hosts also give you the ability to run both secure
>and non-secure servers on the same machine."
>
>You''ll need to uncomment the following lines to get it to work on
both
>ports 80 and 443:
>#<VirtualHost *:80>
>#ServerName my.domain.com
>#SSLDisable
>#</VirtualHost>
Hmmm, I just installed the Secure Server here and uncommented
those lines and it doesn''t work.  My config is exactly the factory
original except for my domain name, of course.  The result of
uncommenting those lines is that the server listens (and serves fine)
on port 443 securely, but doesn''t listen on port 80 at all.  Running
''netstat -n --listening'' shows no one listening on port 80. 
I''ve
tried all kinds of experiments with the ''Port'' and
''BindAddress''
directives after that, but it never works.

Any ideas?

-Jeff Rush




From mail@mail.redhat.com Aug 07:50:57 1998  -0400
Received: (qmail 14131 invoked from network); 22 Aug 1998 12:44:13 -0000
Received: from linuxcentral.com (208.196.180.202)
  by mail2.redhat.com with SMTP; 22 Aug 1998 12:44:13 -0000
Received: from localhost (bradley@localhost)
	by linuxcentral.com (8.8.7/8.8.7) with SMTP id HAA25324;
	Sat, 22 Aug 1998 07:50:57 -0400
Date: Sat, 22 Aug 1998 07:50:57 -0400 (EDT)
From: Bradley Glonka <bradley@linuxcentral.com>
To: redhat-secure-server@redhat.com
cc: Cynthia Dale <silly@redhat.com>
Subject: Re: Other Apache modules?
In-Reply-To:
<Pine.LNX.3.96.980821231257.12480V-100000@taz.support.redhat.com>
Message-ID: <Pine.LNX.3.96.980822074214.24169I-100000@linuxcentral.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII

> Yep, you can use just about any module you like.  You may have to get the
> header files for apache from apache.org, then compile them.
Hmmmm, recompiling this server might be kinda of difficult.  Unless I have
overlooked something the source code(for apache) has NOT been included on
the CD.  Where should one get the source from to recompile?

Another question.  It looks as though mod_perl and mod_php where complied
as Dynamic Shared Objects.  I wanted to upgrade to mod_php to version 3.x.
However, according to the apache docs DSO is not supported until 1.3 and
later(see url).
http://www.apache.org/docs/dso.html

So how would one go about compiling in a a new DSO.  Or getting
back to my first question compiling them in as static modules?

Confused,
Brad


> > Date: Mon, 17 Aug 1998 15:36:39 -0400
> > From: Tod Hagan <todh@netwavelink.com>
> > 
> > Is it possible to use Apache modules other than the precompiled ones
> > that ship with Red Hat Secure Web Server?
> > 
> > If so, how does one compile and link these modules with Secure Web
> > Server?

From mail@mail.redhat.com Aug 10:49:11 1998  -0400
Received: (qmail 8674 invoked from network); 22 Aug 1998 14:47:07 -0000
Received: from xanadu.redhat.com (pbrown@199.183.24.86)
  by mail2.redhat.com with SMTP; 22 Aug 1998 14:47:07 -0000
Received: from localhost (pbrown@localhost)
	by xanadu.redhat.com (8.8.7/8.8.7) with SMTP id KAA15414;
	Sat, 22 Aug 1998 10:49:11 -0400
X-Authentication-Warning: xanadu.redhat.com: pbrown owned process doing -bs
Date: Sat, 22 Aug 1998 10:49:11 -0400 (EDT)
From: Preston Brown <pbrown@redhat.com>
To: Jeff Rush <jrush@summit-research.com>
cc: "redhat-secure-server@redhat.com"
<redhat-secure-server@redhat.com>
Subject: Re: Sharing server/document root?
In-Reply-To: <199807220207.1434626.7@mail.bkbank.com>
Message-ID: <Pine.LNX.3.96.980822104844.27035M-100000@xanadu.redhat.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII

On Sat, 22 Aug 1998, Jeff Rush wrote:
> Hmmm, I just installed the Secure Server here and uncommented
> those lines and it doesn''t work.  My config is exactly the factory
> original except for my domain name, of course.  The result of
> uncommenting those lines is that the server listens (and serves fine)
> on port 443 securely, but doesn''t listen on port 80 at all. 
Running
> ''netstat -n --listening'' shows no one listening on port
80.  I''ve
> tried all kinds of experiments with the ''Port'' and
''BindAddress''
> directives after that, but it never works.
Simple question, but: Did you restart the server after making changes?

---
 -Preston Brown
  Red Hat Software, Inc.
  pbrown@redhat.com