Re: Question: How to secure multiple URL's with SSL on a single host with a single domain?

"Foster, Nate" <nate.foster@xxxxxxxxxxxx> · Tue, 29 Apr 2014 13:36:13 -0700

Hi Nick,

Thanks for the fast response.  These URL's are all hosted on the same 

machine w/the same IP address.

I figured out what I was doing wrong thanks to Eggert.  I was not using 

the <directory "/xxx/xxx"> properly.

I'm including my fixed .conf file below in case it might be useful to 

others.

<VirtualHost *:443>

SSLEngine on
SSLCertificateFile /etc/ssl/apache.pem
SSLCertificateKeyFile /etc/ssl/private/apache.key
ServerAdmin webmaster@xxxxxxxxxxxx

# Those aliases do not work properly with several hosts on your apache 

server

# Uncomment them to use it or adapt them to your configuration
#    Alias /roundcube/program/js/tiny_mce/ /usr/share/tinymce/www/
#    Alias /roundcube /var/lib/roundcube
# by NF - Alias /roundcubemail /usr/share/roundcubemail/
Alias /webmail /usr/share/roundcubemail/

# by NF - Adding Alias for webadmin
Alias /kolab-webadmin /usr/share/kolab-webadmin/public_html/

# by NF - Alias for iRony
Alias /iRony   /usr/share/iRony/public_html

########################################################
#####   This section for RoundCubeMail AKA Webmail #####
########################################################
# Access to tinymce files
#<Directory "/usr/share/tinymce/www/">
#    Options Indexes MultiViews FollowSymLinks
#    AllowOverride None
#    Order allow,deny
#    Allow from all
#</Directory>

<Directory /usr/share/roundcubemail/>
    Options +FollowSymLinks
    AllowOverride All
    <ifModule mod_authz_core.c>
        Require all granted
    </ifModule>
    <ifModule !mod_authz_core.c>
        Order Allow,Deny
        Allow from All
    </ifModule>
</Directory>

# Protecting basic directories:
<Directory /usr/share/roundcubemail/config>
    Options -FollowSymLinks
    AllowOverride None
</Directory>

<Directory /usr/share/roundcubemail/logs>
    Options -FollowSymLinks
    AllowOverride None
    <ifModule mod_authz_core.c>
        Require all denied
    </ifModule>
    <ifModule !mod_authz_core.c>
        Order Deny,Allow
        Deny from All
    </ifModule>
</Directory>

########################################################
#####   This section for Kolab-Webadmin            #####
########################################################

<Directory "/usr/share/kolab-webadmin/public_html/">
    <IfModule mod_rewrite.c>
        RewriteEngine on

        # NOTE: This needs to point to the base uri of your 

installation.

        RewriteBase /kolab-webadmin/

        # Rewrite URLs of the form 'x' to the form 'index.php?q=x'.
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteCond %{REQUEST_URI} !=/favicon.ico

        RewriteRule ^api/(.*)\.(.*)$ api/index.php?service=$1&method=$2 

[L,QSA]

    </IfModule>

    AddDefaultCharset   UTF-8
    php_value error_reporting      6135

    DirectoryIndex index.php
    AllowOverride All

    <ifModule mod_authz_core.c>
        Require all granted
    </ifModule>
    <ifModule !mod_authz_core.c>
        Order Allow,Deny
        Allow from All
    </ifModule>

</Directory>

########################################################
#####   This section iRony                         #####
########################################################
<Directory "/usr/share/iRony/public_html/">
    AllowOverride All

    <IfModule mod_authz_core.c>
        # Apache 2.4
        Require all granted
    </IfModule>
    <IfModule !mod_authz_core.c>
        # Apache 2.2
        Order Allow,Deny
        Allow from All
    </IfModule>

    RewriteEngine On
    RewriteBase /iRony/
    RewriteRule ^\.well-known/caldav   / [R,L]
    RewriteRule ^\.well-known/carddav  / [R,L]

    RewriteCond  %{REQUEST_FILENAME}  !-f
    RewriteCond  %{REQUEST_FILENAME}  !-d
    RewriteRule  (.*)                 index.php  [qsappend,last]

</Directory>

</VirtualHost>

On 29.04.2014 13:16, Nick Tkach wrote:

So in that list of urls at the top, those are totally separate names
and IPs?  Something like this?

11.22.33.44/webmail is the main interface
55.66.77.88/web-admin is the administrative interface
99.00.11.22/webdav is for access to the WebDAV component

On Tue, Apr 29, 2014 at 2:48 PM, Foster, Nate 

<nate.foster@xxxxxxxxxxxx> wrote:

Hi All,

I'm new to the list, so please excuse me if I'm in the wrong spot.

I host a groupware service on a Debian 7 host running Apache2.2.  The
service uses multiple URL's for it's interface.

xx.xx.xx.xx/webmail is the main interface
xx.xx.xx.xx/web-admin is the administrative interface
xx.xx.xx.xx/webdav is for access to the WebDAV component

Each URL is enabled and it's .conf file is living in sites-enabled/

To secure the first URL, I modified the webmail.conf to have the 

following

lines at the top of the file:

<VirtualHost *:443>
SSLEngine on
SSLCertificateFile /etc/ssl/apache.pem
SSLCertificateKeyFile /etc/ssl/private/apache.key
ServerAdmin webmaster@xxxxxxxxxxxx

and </VirtualHost> at the bottom of the file.

This worked great until I repeated it for the remaining URL's which 

results

in an error:  [warn] _default_ VirtualHost overlap on port 443, the 

first

has precedence

When I search for tutorials and documentation on how to do this 

properly, I

keep getting information related to securing multiple virtual hosts, 

which

does not really work for my scenario.  I would be grateful for any 

pointers

on how I can secure my server properly!

Many Thanks!

-Nate

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx