0

I am losing my mind due to OpenSSL + Apache. I've checked a lot of resourced, consulted collegues and realised that the best choice at this moment would be to consult other resources (aka you guys).

I wrote software using Python and CherryPy that listerns on port 1240 for HTTP request. However, due to the fact that I need shielding from network inspection I want to wrap this with ssl. We decided to go for ProxyPass with Apache for the SSL instead of Python as it's faster, more reliable and more globally known.

Everything said and done, installed apache. Build a seperate user etc for the service to run so when it gets (cr/h)acked they are jailed in a useles user account. All that jazz.

Now I wrote the following enabled site:

    ProxyRequests Off
    <VirtualHost *:443>
            ServerName SERVER_NAME

            ProxyPass / http://127.0.0.1:1240/
            ProxyPassReverse / http://127.0.0.1:1240/

            <Directory proxy:*>
                    Order Deny,Allow
                    Allow from all
            </Directory>

            SSLEngine on
            SSLCACertificateFile /etc/ssl/certs/MY_CERT.crt
            SSLCertificateFile    /etc/ssl/certs/MY_CERT.crt
            SSLCertificateKeyFile /etc/ssl/certs/MY_CERT.pem
    </VirtualHost>

Looks are great, don't it (please note due to Dataleakage I've changed the names of the servername and the certs to capital letters etc. Anyway, even tough it looks great when I connect with firefox I get the following error.

(Error code: ssl_error_rx_record_too_long) And I thought: "Wait, thats not good".

So I started googling and I found out mod-ssl might not be loaded. Thus I checked like so:

    root@SYSTEM:/etc/apache2# apachectl -t -D DUMP_MODULES
    [Thu Jan 24 09:36:44 2013] [warn] NameVirtualHost *:8080 has no VirtualHosts
    Loaded Modules:
     core_module (static)
     log_config_module (static)
     logio_module (static)
     mpm_prefork_module (static)
     http_module (static)
     so_module (static)
     alias_module (shared)
     auth_basic_module (shared)
     authn_file_module (shared)
     authz_default_module (shared)
     authz_groupfile_module (shared)
     authz_host_module (shared)
     authz_user_module (shared)
     autoindex_module (shared)
     cgi_module (shared)
     deflate_module (shared)
     dir_module (shared)
     env_module (shared)
     mime_module (shared)
     negotiation_module (shared)
     php5_module (shared)
     proxy_module (shared)
     proxy_ajp_module (shared)
     proxy_balancer_module (shared)
     proxy_connect_module (shared)
     proxy_ftp_module (shared)
     proxy_http_module (shared)
     proxy_scgi_module (shared)
     reqtimeout_module (shared)
     setenvif_module (shared)
     ssl_module (shared)
     status_module (shared)
    Syntax OK

Looks good, moving on. Checking the logs I found the exact same error as on here: http://ubuntuforums.org/showthread.php?t=806884

Tried, didn't work. I regenerated the Keys, however same issue ( http://www.devco.net/archives/2006/02/13/public_-_private_key_encryption_using_openssl.php ) I checked the validity of the keys with openssl:

    root@SYSTEM:/etc/ssl/certs# openssl x509 -in MY_CERT.crt -noout -text
    Certificate:
        Data:
            Version: 1 (0x0)
            Serial Number: <---8<---snip---8<--->(0x<---8<---snip---8<--->)
        Signature Algorithm: sha1WithRSAEncryption
            Issuer: <---8<---snip---8<--->
            Validity
                Not Before: Jan 24 08:05:44 2013 GMT
                Not After : Mar 25 08:05:44 2013 GMT
            Subject: <---8<---snip---8<--->
            Subject Public Key Info:
                Public Key Algorithm: rsaEncryption
                    Public-Key: (1024 bit)
                    Modulus:
                         <---8<---snip---8<--->
                    Exponent: <---8<---snip---8<---> (0x<---8<---snip---8<--->)
        Signature Algorithm: sha1WithRSAEncryption
             <---8<---snip---8<--->

Looks valid, now I am starting to lose hair. Also when I telnet on 443. And I GET / I get HTML returned. So it looks like SSL isn't running at all. Any tips/tricks for me to try? Documents to review or ANYTHING?

Also, I realise Self-Signing etc isn't the most secure thing out there. But that is not the point now, as it's really just for a Proof-of-Concept at the moment. So any advice would be really useful and I'd reward you with one of those ServerFault +1 post thingys ;)

Edit: One more small note, when I use links https://localhost it works.

STOLAS@SYSTEM:~$ sudo apachectl -S
[sudo] password for STOLAS:
[Thu Jan 24 10:47:42 2013] [warn] NameVirtualHost *:8080 has no VirtualHosts
VirtualHost configuration:
wildcard NameVirtualHosts and default servers:
     *:443 SERVER.COM (/etc/apache2/sites-enabled/000-default:2)
Syntax OK 
7
  • 1
    Sanity check: You ran a2enmod ssl? You are accessing the correct vhost?
    – fuero
    Jan 24, 2013 at 9:08
  • woops yes, I forgot to add that part, I ran a2enmod ssl and a2ensite I think I am accessing the correct vhost as it's the only one and I read the logs.
    – Stolas
    Jan 24, 2013 at 9:22
  • What's the output of apachectl -S?
    – Ladadadada
    Jan 24, 2013 at 9:41
  • STOLAS@SYSTEM:~$ sudo apachectl -S [sudo] password for STOLAS: [Thu Jan 24 10:47:42 2013] [warn] NameVirtualHost *:8080 has no VirtualHosts VirtualHost configuration: wildcard NameVirtualHosts and default servers: *:443 SERVER.COM (/etc/apache2/sites-enabled/000-default:2) Syntax OK
    – Stolas
    Jan 24, 2013 at 9:48
  • Wait, so it works when you access via localhost? This seems odd, are you sure there's not a conflicting vhost in there somewhere, maybe the default site? Try changing your vhost to a different port (e.g. 8443) and seeing if its accessible via servername:8443 Jan 24, 2013 at 11:22

1 Answer 1

2

When the last reply posted by @al4 I started thinking. As I am not the only person who has been working on this issue I decided to do a cat $HISTFILE somebody included a iptables rule..

So, thanks all. And sorry for wasting your time. Turns out I did everything right with the Apache thing. But someone, used iptables to mess up my day (this took me 2 days..)

But when I did iptables -L ; iptables -t nat -L (dump my iptables rules to the stdout) I figured out there was a NATTING rule from 143 to local 1240. Other commands that made me realise about the iptables where netstat -lanp for checking if Apache was running at all and tcpdump not tcp 22 for checking if connections where send to the box at all.

Thanks for the help and I hope a lost googler will find this answer useful in the future!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .