Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i heard that http is not good. for instance i do a basic http authentication, and that some hackers can figure out the password by snooping (i dont know what this is ).

so i was advised to install HTTPS.

how can i do this ?

apt-get install https or SSL ? what is the difference ?

i have my own dedicated server.

share|improve this question

4 Answers 4

This Apache FAQ should be useful reading and starting point.
You can also start at the Wikipedia HTTPS page.
There is also a Linux Journal Flash video on setting up a https server with apache.

share|improve this answer

You need to have mod_ssl installed for apache in order to get SSL support. If it isn't already packaged with httpd, you'll have to look for a mod_ssl in apt(sorry, I don't have ubuntu to test, but I would assume it is just an "apt-get mod_ssl").

If you are only worrying about encrypting the traffic so people can't pick out clear-text login credentials, I would recommend a self-signed cert as churnd stated.

share|improve this answer

If your server is hosted, check with your host about providing a signed SSL certificate. These cost $$, but are required for a valid secure connection. You can roll your own, but you are not a valid Certificate Authority, so people who visit your site will get a warning that the SSL cert is not signed by a valid CA. Not a big deal if they know you or it's just for your own use, as the security is about the same... it's just a matter of trusting who the security comes from. Here's a good howto for rolling your own.

share|improve this answer
    
how much does it cost ? –  oxuppp Oct 27 '09 at 2:44
    
How long is a piece of string. Go to somewhere like godaddy.com and see what they charge for a standard SSL certificate. I suspect you should be able to get a basic, one domain SSL certificate for qutie a bit less than 200USD or thereabouts. –  Tom O'Connor Oct 27 '09 at 9:16

Your questions:

SSL is a way of making a secure connection. The traffic is encrypted so that only the sender and receiver can see the actual information. HTTPS is ssl for HTTP. The endpoints agree to encryption and no one other than the server and client can see the info. SSL can also authenticate, using (hopefully) unforgeable certificates that prove that one side is who they claim to be.

Basic authentication has the password encoded. This means it's goes through a simple encoding transform (Base64) that is easy to reverse and see the real data. If someone has access to your network, or any network between your server and the client actually, they can see the base network traffic (the slang term for this is snooping, or sniffing) and easily see the username and password. If you use HTTPS, this is encrypted, and can not be seen.

To get https working, you need the https code in your server (from apt-get) and a certificate. The certificate tells people who the server is (the authentication above). You can either purchase a certificate, in which they'll ask you some info to prove some company or whatever, and sell to you. Or you can create a self-signed certificate for free.

To get the 'who are you' part of the authentication to work, they have a 'web of trust'. I can say i'm anyone i want, but how can i prove it? Well, if you buy a certificate, the issuer says 'I trust this guy is google.com'. And your web browser trusts the big issuers so they trust that they say you are google.com. But your self-signed cert will be trusted by no-one. So your browser will complain. If this is for internal intranet use, you can just tell them to ignore it. Internet users will be harder to convince, and you may eventually just need to buy one.

This isn't all free from a computing standpoint. Any https traffic will need to be encrypted. That takes CPU. Also, your content is essentially uncacheable, meaning more hits to your server. Check your server resource limits after the change.

Also, you didn't ask, but Basic Authentication isn't the best authentication. Besides the absolute need to encryption, there is no easy way to log out.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.