Changes between Version 1 and Version 2 of Iam2023/Agenda/SP-Installation

Timestamp:

Mar 21, 2023, 10:56:08 AM (19 months ago)

Author:

admin

Comment:

--

Iam2023/Agenda/SP-Installation

@@ -31 +31 @@
 apt install libapache2-mod-shib ntp --no-install-recommends
 }}}
+
+From this point the location of the SP directory is: /etc/shibboleth
+
+== Apache Configuration ==
+
+Here we have to create SSL certificates and assign them to the virtual hosts created. We can create SSL certificates using three methods.
+1. Generate a self-signed certificates (Steps 5 to 9)
+2. Create certificates using Let's Encrypt free SSL service. (Steps 10 to )
+3. Receiving certificates from a Commercial Certificate Authority.
+
+As below you can use any of the above methods. Follow the steps as you prefer.
+
+4. These configurations are based for test purposes with self generated ssl certificates. If you have purchased ssl certificate from a commercial CA substitute those with the self signed files. If you wish to get letsencrypt certificates Skip to Step 10.
+
+5. Create a Certificate and a Key self-signed for HTTPS:
+
+{{{
+    openssl req -x509 -newkey rsa:4096 -keyout /etc/ssl/private/ssl-sp.key -out /etc/ssl/certs/ssl-sp.crt -nodes -days 1095
+}}}
+
+6. Modify the file /etc/apache2/sites-available/sp-ssl.conf as follows:
+
+{{{
+<IfModule mod_ssl.c>
+   <VirtualHost *:443>
+
+       ServerName sp.YOUR-DOMAIN
+
+       ServerAdmin webmaster@localhost
+       DocumentRoot /var/www/html
+
+       ErrorLog ${APACHE_LOG_DIR}/error.log
+       CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+     SSLCertificateFile /etc/ssl/certs/ssl-sp.crt
+     SSLCertificateKeyFile /etc/ssl/private/ssl-sp.key
+     </VirtualHost>
+</IfModule>
+}}}
+
+7. Enable proxy_http, SSL and headers Apache2 modules:
+
+{{{
+
+    a2enmod proxy_http ssl headers alias include negotiation
+    a2ensite sp-ssl.conf
+    systemctl restart apache2
+}}}
+
+8. Configure Apache2 to open port 80 only for localhost:
+
+{{{
+nano /etc/apache2/ports.conf
+
+# If you just change the port or add more ports here, you will likely also
+# have to change the VirtualHost statement in
+# /etc/apache2/sites-enabled/000-default.conf
+
+Listen 127.0.0.1:80
+
+<IfModule ssl_module>
+  Listen 443
+</IfModule>
+
+<IfModule mod_gnutls.c>
+  Listen 443
+</IfModule>
+}}}
+
+9. Configure Apache2 to redirect all on HTTPS:
+
+{{{
+nano /etc/apache2/sites-enabled/000-default.conf
+
+<VirtualHost *:80>
+   ServerName "sp.YOUR-DOMAIN"
+   Redirect permanent "/" "https://sp.YOUR-DOMAIN/"
+   RedirectMatch permanent ^/(.*)$ https://sp.YOUR-DOMAIN/$1
+</VirtualHost>
+}}}
+
+10. Let'sencrypt setup (Skip this step if you already configured SSL with self signed or CA provided certificates)
+
+Disable the default configuration
+
+{{{
+
+    cd /etc/apache2/sites-available/
+    a2dissite 000-default.conf
+    systemctl reload apache2
+
+}}}
+
+Create a new conf file as sp.conf
+
+cp 000-default.conf sp.conf
+
+Edit sp.conf with following
+
+{{{
+nano sp.conf
+
+<VirtualHost *:80>
+ 
+        ServerName sp.YOUR-DOMAIN
+        ServerAdmin YOUR-Email
+        DocumentRoot /var/www/html
+        
+        ErrorLog ${APACHE_LOG_DIR}/error.log
+        CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+</VirtualHost>
+}}}