| | 165 | CGI stands for Common Gateway Interface are useful for creating dynamic content on web page by transferring data from server to client. These scripts can be written in many languages such as bash, c, java, perl, python etc. [[br]] |
| | 166 | First we need to create a script firstbash.cgi in following location /usr/local/cgi-bin/ , you may need to |
| | 167 | create it as sudo. |
| | 168 | {{{ |
| | 169 | #!/bin/bash |
| | 170 | echo "Content-type: text/html" |
| | 171 | echo "" |
| | 172 | echo "My first CGI script" |
| | 173 | }}} |
| | 174 | Give the script file execute permissions |
| | 175 | {{{ |
| | 176 | sudo chmod 705 /usr/local/cgi-bin/firstbash.cgi |
| | 177 | }}} |
| | 178 | Now to add this CGI on our web2 virtual host, edit '''/etc/apache2/sites-available/web2.conf''' as follows. |
| | 179 | {{{ |
| | 180 | <VirtualHost *:80> |
| | 181 | ServerAdmin admin@yourdomain.ws.learn.ac.lk |
| | 182 | ServerName yourdomain.ws.learn.ac.lk |
| | 183 | ServerAlias web2.yourdomain.ws.learn.ac.lkDocumentRoot /var/www/web2 |
| | 184 | <Directory /var/www/web2> |
| | 185 | Require all granted |
| | 186 | </Directory> |
| | 187 | ScriptAlias /cgi-bin/ "/usr/local/cgi-bin/" |
| | 188 | <Directory "/usr/local/cgi-bin/"> |
| | 189 | Options +ExecCGI |
| | 190 | AddHandler cgi-script .cgi |
| | 191 | Require all granted |
| | 192 | </Directory> |
| | 193 | ErrorLog ${APACHE_LOG_DIR}/error.log |
| | 194 | CustomLog ${APACHE_LOG_DIR}/access.log combined |
| | 195 | </VirtualHost> |
| | 196 | }}} |
| | 197 | After editing web2.conf lets enable CGI apache module and restart the server. |
| | 198 | {{{ |
| | 199 | sudo a2enmod cgi |
| | 200 | sudo systemctl reload apache2 |
| | 201 | }}} |
| | 202 | Visit following link and check-out your script. |
| | 203 | |
| | 204 | http://web2.yourdomain.ws.learn.ac.lk/cgi-bin/firstbash.cgi |
| | 205 | |
| 167 | | == https configuration == |
| | 232 | |
| | 233 | When you create or modify documents under /var/www/ as sudo those files and directories will belong to root user and root group. Apache is usually run by a user www-data and www-data group in Ubuntu. Therefore, if any document belongs to root will also be published as root has higher precedence than www-data. But if some malicious content are hosted, they can also be run under root opening lot of vulnerabilities to the public. |
| | 234 | |
| | 235 | To secure publically accessible areas we can change user permissions by, |
| | 236 | {{{ |
| | 237 | sudo chown -R www-data:www-data /var/www |
| | 238 | }}} |
| | 239 | Also if we had directories that are open for users to upload content we can restrict access by modifying access modes. |
| | 240 | {{{ |
| | 241 | sudo chmod 664 /var/www/uploads |
| | 242 | }}} |
| | 243 | That will change file permissions to rw-rw-r— |
| | 244 | |
| | 245 | == Password protected Directory == |
| | 246 | |
| | 247 | When securing a directory it is a common practice we use a password to enter that path. Also in apache2 we can specify a password by creating an apache user and using .htaccess as needed. |
| | 248 | |
| | 249 | First install Apache Utiities; |
| | 250 | {{{ |
| | 251 | sudo apt-get install apache2-utils |
| | 252 | }}} |
| | 253 | On your virtual host configuration file add or modify following inside the <Document> ... </Document>. |
| | 254 | {{{ |
| | 255 | AllowOverride AuthConfig |
| | 256 | }}} |
| | 257 | Next create an authenticate user. |
| | 258 | {{{ |
| | 259 | sudo htpasswd -c /etc/apache2/.htpasswd yourname |
| | 260 | }}} |
| | 261 | This will ask you to enter a new password and conform it for the new user. If you want to add another user, try with the same command above with new username. You can view the contents of the .htpassword file by |
| | 262 | {{{ |
| | 263 | sudo cat /etc/apache2/.htpasswd |
| | 264 | }}} |
| | 265 | next we need to grant permission to www-data user. |
| | 266 | {{{ |
| | 267 | sudo chown www-data:www-data /etc/httpd/.htpasswd |
| | 268 | sudo chmod 0660 /etc/httpd/.htpasswd |
| | 269 | }}} |
| | 270 | After that create a directory called “mystuff” inside the directory web1, create an html page of your choice inside the directory as sudo and change ownership to www-data. |
| | 271 | {{{ |
| | 272 | sudo mkdir /var/www/web1/mystuff |
| | 273 | sudo nano /var/www/web1/mystuff/index.html |
| | 274 | sudo chown –R www-data:www-data /var/www/web1/mystuff/* |
| | 275 | }}} |
| | 276 | Now create .htaccess file inside mystuff directory |
| | 277 | {{{ |
| | 278 | sudo nano /var/www/web1/mystuff/.htaccess |
| | 279 | }}} |
| | 280 | Add following content |
| | 281 | {{{ |
| | 282 | AuthType Basic |
| | 283 | AuthName "Restricted Content" |
| | 284 | AuthUserFile /etc/apache2/.htpasswd |
| | 285 | Require valid-user |
| | 286 | }}} |
| | 287 | Now restart apache and browse to the newly created directory from your browser and check what is changed. |
| | 288 | == HTTPS configuration using Let’s Encrypt == |
| | 289 | Install letsencrypt client on the server |
| | 290 | {{{ |
| | 291 | sudo apt-get install python-letsencrypt-apache |
| | 292 | }}} |
| | 293 | Run the following to enable https for the selected domain specified with –d. |
| | 294 | {{{ |
| | 295 | sudo letsencrypt --apache -d www.yourdomain.ws.learn.ac.lk |
| | 296 | }}} |
| | 297 | During the process you will be requested to enter a valid e-mail address where it will be used to send you details of your certificate and alerts like certificate expiry. Also you will be able to pick between enabling both http and https access or forcing all requests to redirect to https. It is usually safest to require https, except you have a specific necessity for unencrypted http traffic. [[br]] |
| | 298 | If you want to enable https for other domains, then run the above with the other domain names as well. |
| | 299 | |
| | 300 | '''NOTE''': If your put several domains in single command with multiple –d flags then all those sites will be issued single ssl certificate with multiple domain names. This is useful if you want to certify a specific server name and a parent domain both at the same time. (Eg. www.learn.ac.lk , learn.ac.lk both will end up in same landing page without generating errors.) Once letsencrypt finishes, go to |
| | 301 | https://www.ssllabs.com/ssltest/analyze.html?d=www.yourdomain.ws.learn.ac.lk&latest |
| | 302 | |
| | 303 | and check https connectivity. |
| | 304 | |
| | 305 | Auto Renewal of Certificates: |
| | 306 | |
| | 307 | Let’s Encrypt certificates are normally valid for 90 days only. Therefore, we have to renew these |
| | 308 | certificates at least once every 3 months. This can be done automatically by creating a cron job in Linux |
| | 309 | to execute letsencript renew command. |
| | 310 | To edit cron Jobs |
| | 311 | {{{ |
| | 312 | sudo crontab –e |
| | 313 | }}} |
| | 314 | then it will ask for an editor. To use nano the default editor press enter. |
| | 315 | |
| | 316 | At the bottom of the page insert below and save/exit, |
| | 317 | {{{ |
| | 318 | 30 4 25 */2 * /usr/bin/letsencrypt renew >> /var/log/le-renew.log |
| | 319 | }}} |
| | 320 | Above command will execute “/usr/bin/letsencrypt renew” on 25 th day in every two months and will write the output to a file called “/var/log/le-renew.log” |
| | 321 | Also as a best practice it is better to disable port 80 or plain HTTP traffic to your server. But if your directly disable Port 80 and allow only 443 then we have to manually type “https://” before your exact url in browsers. Therefore, better to redirect all HTTP traffic to port443 from your server configuration without disabling. So to do that we need to put a redirect in each virtual host conf. files. |
| | 322 | |
| | 323 | Edit port 80 virtual host configuration files and add these in bottom just before the line </VirtualHost> |
| | 324 | {{{ |
| | 325 | RewriteEngine on |
| | 326 | RewriteCond %{SERVER_NAME} = www.yourdomain.ws.learn.ac.lk |
| | 327 | RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent] |
| | 328 | </VirtualHost> |
| | 329 | }}} |
| | 330 | Then enable mod-rewrite in apache and restart.. |
| | 331 | {{{ |
| | 332 | sudo a2enmod rewrite |
| | 333 | sudo systemctl reload apache2 |
| | 334 | }}} |
| | 335 | Now test your configuration by browsing to http://www.yourdomain.ws.learn.ac.lk and see how it redirects |
