On 14 Dec 2021 at 23:02, Tim via users wrote: Subject: Re: Setting up webserver for https?? To: users@xxxxxxxxxxxxxxxxxxxxxxx Date sent: Tue, 14 Dec 2021 23:02:45 +1030 Send reply to: Community support for Fedora users <users@xxxxxxxxxxxxxxxxxxxxxxx> From: Tim via users <users@xxxxxxxxxxxxxxxxxxxxxxx> Copies to: Tim <ignored_mailbox@xxxxxxxxxxxx> > Tim: > >> While it can do what you want, it is subverting the purpose of > >> HTTPS. I'm not sure anyone should support a technique that hides an > >> insecure connection behind a faked secure one. > Just to clarify. dyndns.org only links my sites name to the public IP address I get from ISP. Has been the same exact IP for at least 2 years, but is a static one?? But works fine. On my internal network, I can connect to the server using https and it does on port 443 just fine, just gives a message about the certificate isn't confirmed by a 3rd party?? But otherwise works. Checked my router, and I have port 8081 mapped from the outside to the inside port 8081 on machine (how httpd setup). and it works fine. port 80 is blocked by ISP?? Also, found I have port 8443 mapped to 443 on machine, but nothing gets thru, so assume that port is blocked. Sent message to ISP, but they haven't gotten back? Give the address as sitename:8081 with http, but don't know if browser is changing it to https somehow? So, seems more questions than answers for actually getting something that works. Web server locally works with http and https but getting the outside connection to work is the problem. Thanks for all the replies. Lots of info to check out. > Greg Woods: > > I would dispute that. In my case, caddy runs on an internet- > > accessible server, but the actual web server is behind two firewalls. > > The unencrypted connection is entirely behind at least one firewall, > > and if someone manages to gain access to the inside of that firewall, > > then the game is already over. I don't think I'd recommend this for > > enterprise setups, as there are too many potential threats already > > behind the firewall (can you really trust every single one of your > > employees?) > > In the sense that if you can do it, miscreants can. We should be > endeavouring so that browsers can't be fooled, and thereby their users. > And some will argue that means disallowing overrides. e.g. How many > Windows users just clicked away the allow/deny pop-ups that were > supposed to protect them? > > If you make things so your browser doesn't warn you that you're about > to do something unencrypted when it otherwise ought to be, you can be > setting yourself up for an exploit in the future. > > But from following up on what's been previously written in the thread, > it sounds like something is erroneously triggering the use of HTTPS, > and that's the real problem. It could be how dyndns.org is handling > redirecting connection attempts through their domain to their IP. > > I run an externally hosted website, and I peruse the logs and see > various failed attempts to do something being logged. In my case, > their exploit attempts, not genuine browsing going wrong, so I do > nothing to help those failures. > > -- > > uname -rsvp > Linux 3.10.0-1160.49.1.el7.x86_64 #1 SMP Tue Nov 30 15:51:32 UTC 2021 x86_64 > > Boilerplate: All unexpected mail to my mailbox is automatically deleted. > I will only get to see the messages that are posted to the mailing list. > > _______________________________________________ > users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx > To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx > Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx > Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure _______________________________________________ users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
