Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i need to secure two different sites in apache. One of them should only be a proxy for a different server which is running on port 8069.

Now one (which is natively included in apache) runs with SSL:

<VirtualHost *:443>
      ServerName 192.168.1.20
      SSLEngine on
      SSLCertificateFile /etc/ssl/erp/oeserver.crt
      SSLCertificateKeyFile /etc/ssl/erp/oeserver.key
      DocumentRoot /var/www/cloud
      ServerPath /cloud/
      #CustomLog /var/www/logs/ssl-access_log combined
      #ErrorLog /var/www/logs/ssl-error_log
</VirtualHost>

The other one is not running and even not registered. When i try to access it, i get an exception (ssl_error_rx_record_too_long):

<VirtualHost *:443>

ServerName 192.168.1.20
ServerPath /erp/

SSLEngine on
SSLCertificateFile /etc/ssl/erp/oeserver.crt
SSLCertificateKeyFile /etc/ssl/erp/oeserver.key

ProxyRequests Off
ProxyPreserveHost On

<Proxy *>
Order deny,allow
Allow from all
</Proxy>

ProxyVia On
ProxyPass / http://127.0.0.1:8069/
ProxyPassReverse / http://127.0.0.1:8069
RewriteEngine on
RewriteRule ^/(.*) http://127.0.0.1:8069/$1 [P]


RequestHeader set "X-Forwarded-Proto" "https"

SetEnv proxy-nokeepalive 1
</VirtualHost>

My whish is the following configuration:

192.168.1.20        ->> unsecured local path to website
192.168.1.20/cloud/ ->> secured local documentpath from cloud
192.168.1.20/erp/   ->> secured proxy on port 80 for http://192.168.1.20:8069

how is this possible? is this even possible? perhaps cloud.192.168.1.20 and erp.192.168.1.20 is better?!

Thank you ============ EDIT ========================== apache2ctl -S -M: *:443 is a NameVirtualHost default server myserver (/etc/apache2/conf.d/cloud.conf:1) port 443 namevhost myserver (/etc/apache2/conf.d/cloud.conf:1) *:80 is a NameVirtualHost default server myserver (/etc/apache2/sites-enabled/default:1) port 80 namevhost myserver (/etc/apache2/sites-enabled/default:1)

default:

<VirtualHost *:80>
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

    ServerAdmin webmaster@localhost

    DocumentRoot /var/www
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

Modified (current) cloud.conf:

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /etc/ssl/openerp/oeserver.crt
    SSLCertificateKeyFile /etc/ssl/openerp/oeserver.key
    DocumentRoot /var/www/
    RewriteCond {REQUEST_URI} ^/cloud$
    RewriteEngine on
    RewriteRule /(.*) http://127.0.0.1:8069/$1 [P]
    RequestHeader set "X-Forwarded-Proto" "https"
    SetEnv proxy-nokeepalive 1
</VirtualHost>
share|improve this question

1 Answer 1

up vote 2 down vote accepted

you cannot have

<VirtualHost *:443>
      ServerName 192.168.1.20
      SSLEngine on

2 times because apache will bind to one virtualhost only.

why not include both /locations/ into one config?

<VirtualHost *:443>
      ServerName 192.168.1.20
      SSLEngine on
      SSLCertificateFile /etc/ssl/erp/oeserver.crt
      SSLCertificateKeyFile /etc/ssl/erp/oeserver.key
      DocumentRoot /var/www/cloud
      <Directory /var/www/cloud>
          blah
      </Directory>

      # erp-config
      # ... proxy_config ....
      ProxyPass /erp http://127.0.0.1:8069/
      proxyPassReverse /erp http://127.0.0.1:8069/

</VirtualHost>

Edit2

another way would be 2 separate <VirtualHosts> - configs, either Name-Based (one IP, SNI must be available) or IP-Based (one IP for each host, works usually always)

share|improve this answer
    
Ok, i'll give it a try. Thanks for the hint - i didn't know that this is possible –  elCapitano Nov 4 '13 at 10:38
    
unfortunately i can not include a proxy within a <location>. Do you have other tips? –  elCapitano Nov 4 '13 at 11:22
    
see my edit /changed erp-config –  that guy from over there Nov 4 '13 at 11:58
    
hmmm.. it seems to work a bit better. Now I get the correct URL but the false content... the content is now the content from 127.0.0.1/ without any ssl and not from :8069. –  elCapitano Nov 4 '13 at 12:05
    
see edit 2. for your problem: you seem to have another config flying around then? you can check with apache2ctl -S -M (apachectl @ centos, iirc) –  that guy from over there Nov 4 '13 at 12:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.