0

I need some help with securing my test XAMPP server on ports 80 and 443. I am running Apache 2.4.7 on Windows 7 machine.

The setup is the following:

I am redirecting all traffic coming on my server IP, port 80 and 443 to a java application running on localhost:5000.

The code doing all this in httpd-vhosts.conf file is the following:

<VirtualHost *:80> 
  ServerName demo.website.com
  ServerAlias website.com

  <Location />
    ProxyPass http://localhost:5000/
    ProxyPassReverse http://localhost:5000/
  </Location>
</VirtualHost> 

<VirtualHost *:443>    
  ServerName demo.website.com
  ServerAlias website.com

  <Location />
    ProxyPass /api/socket ws://localhost:5000/api/socket
    ProxyPassReverse /api/socket ws://localhost:5000/api/socket
    ProxyPass http://localhost:5000/
    ProxyPassReverse http://localhost:5000/
  </Location>

  SSLEngine on
  SSLCertificateFile "conf/ssl.crt/cert1.crt"
  SSLCertificateKeyFile "conf/ssl.key/cert1.key"
</VirtualHost>

The above code works for port 80 but when I add it for port 443, apace cannot start. Note: I have enabled LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so.

EDIT1: The error I get in Apache is:

ProxyPass|ProxyPassMatch can not have a path when defined in a location

It seems the issue is with those two lines, when I remove them Apache starts just fine:

ProxyPass /api/socket ws://localhost:5000/api/socket
ProxyPassReverse /api/socket ws://localhost:5000/api/socket

EDIT2

I finally ended up doing this:

<VirtualHost *:443>    
      ServerName demo.website.com
      ServerAlias website.com

      <Location /api/socket>
        ProxyPass ws://localhost:5000/api/socket
        ProxyPassReverse ws://localhost:5000/api/socket
      </Location>

      <Location />
        ProxyPass http://localhost:5000/
        ProxyPassReverse http://localhost:5000/
      </Location>

      SSLEngine on
      SSLCertificateFile "conf/ssl.crt/cert1.crt"
      SSLCertificateKeyFile "conf/ssl.key/cert1.key"
    </VirtualHost>

Is this fine from security point of view?

  • the error message tells you exactly what you have to do. – Gerald Schneider Sep 18 at 10:11
  • Right, the question was posted before I got the error in the console...Anyway, I did modify the code and no errors now. Do you think this is secure enough? – user3132858 Sep 18 at 10:21
2
<VirtualHost *:443>    
      ServerName demo.website.com
      ServerAlias website.com
      <Location /api/socket>
        ProxyPass ws://localhost:5000/api/socket
        ProxyPassReverse ws://localhost:5000/api/socket
      </Location>
      <Location />
        ProxyPass http://localhost:5000/
        ProxyPassReverse http://localhost:5000/
      </Location>
      SSLEngine on
      SSLCertificateFile "conf/ssl.crt/cert1.crt"
      SSLCertificateKeyFile "conf/ssl.key/cert1.key"
    </VirtualHost>

Is this fine from security point of view?

Technically that will work as expected/needed and that is not an immediate security problem (like running an open proxy server) .

For a more secure environment you might want to make some trade-offs and tune much more than just using the the default settings your Apache httpd package shipped with :

  • Excellent explanation! I will definitely look into some of your other suggestions! What better solution would you recommend for reverse proxy on windows 7 machine, off the top of your head? – user3132858 Sep 18 at 13:38
  • 1
    haproxy is one common choice as is (the full webserver) nginx – HBruijn Sep 18 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.