0

I am running an Ubuntu 14.04 LTS server with Apache installed. I have 3 Virtual Hosts set up, with another Default Server to catch all other requests not taken care of. The Default Server has a Document Root of /var/www/. The other 3 Virtual Hosts have a Document root of /var/www/html/.../.

I have all three Virtual Hosts enabled on their respective Domain Names that are only available for local access at this point for testing. However, whenever I try to access one of the three Virtual Hosts, I get instantly booted to the Document Root of the Default Server.

This is the config of one of the Virtual Hosts, with the other ones being pretty much the same, except some fields which obviously must be changed (Doc Root, Server Name). I have replaced the Server Name and the Document Roots, but both are legitimate and exist on the server, if that matters.

<VirtualHost [example.com]>
DocumentRoot "/var/www/html/[Directory]“
<Directory "/var/www/html/[Directory]“>
    allow from all
    Options None
    Require all granted
</Directory> 
ServerName [example.com] 
</VirtualHost>

This is the default-ssl.conf file.

<IfModule mod_ssl.c>
<VirtualHost _default_:443>
    ServerAdmin webmaster@localhost

    DocumentRoot /var/www/html

    # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
    # error, crit, alert, emerg.
    # It is also possible to configure the loglevel for particular
    # modules, e.g.
    #LogLevel info ssl:warn

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    # For most configuration files from conf-available/, which are
    # enabled or disabled at a global level, it is possible to
    # include a line for only one particular virtual host. For example the
    # following line enables the CGI configuration for this host only
    # after it has been globally disabled with "a2disconf".
    #Include conf-available/serve-cgi-bin.conf

    #   SSL Engine Switch:
    #   Enable/Disable SSL for this virtual host.
    SSLEngine on

    #   A self-signed (snakeoil) certificate can be created by installing
    #   the ssl-cert package. See
    #   /usr/share/doc/apache2/README.Debian.gz for more info.
    #   If both key and certificate are stored in the same file, only the
    #   SSLCertificateFile directive is needed.
    SSLCertificateFile  /etc/ssl/certs/ssl-cert-snakeoil.pem
    SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

    #   Server Certificate Chain:
    #   Point SSLCertificateChainFile at a file containing the
    #   concatenation of PEM encoded CA certificates which form the
    #   certificate chain for the server certificate. Alternatively
    #   the referenced file can be the same as SSLCertificateFile
    #   when the CA certificates are directly appended to the server
    #   certificate for convinience.
    #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt

    #   Certificate Authority (CA):
    #   Set the CA certificate verification path where to find CA
    #   certificates for client authentication or alternatively one
    #   huge file containing all of them (file must be PEM encoded)
    #   Note: Inside SSLCACertificatePath you need hash symlinks
    #        to point to the certificate files. Use the provided
    #        Makefile to update the hash symlinks after changes.
    #SSLCACertificatePath /etc/ssl/certs/
    #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt

    #   Certificate Revocation Lists (CRL):
    #   Set the CA revocation path where to find CA CRLs for client
    #   authentication or alternatively one huge file containing all
    #   of them (file must be PEM encoded)
    #   Note: Inside SSLCARevocationPath you need hash symlinks
    #        to point to the certificate files. Use the provided
    #        Makefile to update the hash symlinks after changes.
    #SSLCARevocationPath /etc/apache2/ssl.crl/
    #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl

    #   Client Authentication (Type):
    #   Client certificate verification type and depth.  Types are
    #   none, optional, require and optional_no_ca.  Depth is a
    #   number which specifies how deeply to verify the certificate
    #   issuer chain before deciding the certificate is not valid.
    #SSLVerifyClient require
    #SSLVerifyDepth  10

    #   SSL Engine Options:
    #   Set various options for the SSL engine.
    #   o FakeBasicAuth:
    #    Translate the client X.509 into a Basic Authorisation.  This means that
    #    the standard Auth/DBMAuth methods can be used for access control.  The
    #    user name is the `one line' version of the client's X.509 certificate.
    #    Note that no password is obtained from the user. Every entry in the user
    #    file needs this password: `xxj31ZMTZzkVA'.
    #   o ExportCertData:
    #    This exports two additional environment variables: SSL_CLIENT_CERT and
    #    SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
    #    server (always existing) and the client (only existing when client
    #    authentication is used). This can be used to import the certificates
    #    into CGI scripts.
    #   o StdEnvVars:
    #    This exports the standard SSL/TLS related `SSL_*' environment variables.
    #    Per default this exportation is switched off for performance reasons,
    #    because the extraction step is an expensive operation and is usually
    #    useless for serving static content. So one usually enables the
    #    exportation for CGI and SSI requests only.
    #   o OptRenegotiate:
    #    This enables optimized SSL connection renegotiation handling when SSL
    #    directives are used in per-directory context.
    #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
            SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory /usr/lib/cgi-bin>
            SSLOptions +StdEnvVars
    </Directory>

    #   SSL Protocol Adjustments:
    #   The safe and default but still SSL/TLS standard compliant shutdown
    #   approach is that mod_ssl sends the close notify alert but doesn't wait for
    #   the close notify alert from client. When you need a different shutdown
    #   approach you can use one of the following variables:
    #   o ssl-unclean-shutdown:
    #    This forces an unclean shutdown when the connection is closed, i.e. no
    #    SSL close notify alert is send or allowed to received.  This violates
    #    the SSL/TLS standard but is needed for some brain-dead browsers. Use
    #    this when you receive I/O errors because of the standard approach where
    #    mod_ssl sends the close notify alert.
    #   o ssl-accurate-shutdown:
    #    This forces an accurate shutdown when the connection is closed, i.e. a
    #    SSL close notify alert is send and mod_ssl waits for the close notify
    #    alert of the client. This is 100% SSL/TLS standard compliant, but in
    #    practice often causes hanging connections with brain-dead browsers. Use
    #    this only for browsers where you know that their SSL implementation
    #    works correctly.
    #   Notice: Most problems of broken clients are also related to the HTTP
    #   keep-alive facility, so you usually additionally want to disable
    #   keep-alive for those clients, too. Use variable "nokeepalive" for this.
    #   Similarly, one has to force some clients to use HTTP/1.0 to workaround
    #   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
    #   "force-response-1.0" for this.
    BrowserMatch "MSIE [2-6]" \
            nokeepalive ssl-unclean-shutdown \
            downgrade-1.0 force-response-1.0
    # MSIE 7 and newer should be able to use keepalive
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

</VirtualHost>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

This is the 000-default.conf. I don't know why nothing is showing on it other than this line.

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

How do I get the Virtual Hosts to display the correct directory when accessed? If it makes any difference, I'm administrating the Apache Server over Webmin 1.750 on Ubuntu Server 14.04 LTS

I have read somewhere that I need to specify a Server Name for the Default Server, or else it will catch all requests since it is the very first server on the list. Is this true? If so, how do I do so?

0

I am not able to comment so i am putting this as answer. I think that in apache location of your virtual hosts in the conf file matters. You should think of putting default virtual host on top and specific virtual hosts on bottom as apache select whatever matches last in the configuration options.

  • I have each virtual host as a separate config file as done automatically by WebMin. Is there a way to change the order? – Felix Jen Jun 3 '15 at 23:00
0

After lots and lots of searching, I finally found the cause.

In the Apache virtual sites configs, The first line was set to instead of ServerName some.domain.com

The first configuration is incorrect as the global directive is NameVirtualHost *:80

The following paragraph from the Apache wiki explains it more in depth.

Why is the first virtual host wrong? It's wrong on a couple levels. The most obvious is that some.domain.com, used in the first block, doesn't match *:80 used in NameVirtualHost. The other is that NameVirtualHost refers to an interface, not a domain. For instance, using *:80 means all interfaces on port 80. NameVirtualHost 1.1.1.1:80 means address 1.1.1.1 on port 80. While you can use a "NameVirtualHost some.domain.com/" combination, it doesn't make much sense and is not generally used... at least not used by anyone experienced with Apache administration.

Reports in #httpd suggest that Webmin 1.510 (at least) may cause this issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.