[Cialug] Apache - SSL Proxy - Name Based VirtualHost Problem

Dave J. Hala Jr. dave at 58ghz.net
Fri Oct 19 16:29:05 CDT 2007


I've been  running 2.x here for two years without incident.


On Fri, 2007-10-19 at 16:17 -0500, David Champion wrote:
> Other than not being a default, do you have any reasons for not going to
> Apache 2.x? It's been "stable" for years. Most of the arguments against
> have been pretty well debunked. In my experience, 2.x works just fine,
> runs faster than 1.3.x, and it has some nice features like the one you
> mention below that aren't in the 1.3.x tree.
> 
> -dc
> 
> Claus wrote:
> > Great suggestion Chris.  It sounds like you identified the problem.  The
> > ProxyPass directive takes the new specified server domain name and uses
> > it in the host header.  Unfortunately I'm using Apache 1.3.29 and the
> > ProxyPreserveHost directive isn't part of Apache until 2.0.31. It's the
> > default with the OpenBSD default install and so far I have tried to stay
> > with that. :(
> > 
> > Rethinking the whole issue I probably just use the RewriteRule of port
> > 80 and let the clients connect directly to port 8030 of the final Apache
> > server.
> > 
> > Advantages:
> >  - each domain can have their individual certificate
> > 
> > Disadvantages:
> >  - need to update firewall rules
> >  - client can't easily use https:// address.
> > 
> > I really thought the proxy would be a neat solution.  Does anybody use
> > proxy in such a way?  Should I continue considering it and if so are
> > there other (asides Apache 2.0) that I should consider?
> > 
> >   Claus
> > 
> > On 10/19/2007 3:27 PM, chris wrote:
> > On quick glance I'd say you're loosing your host header.  Try adding in
> > a "ProxyPreserveHost On" in the Main Proxy and in the Second Proxy as
> > well.
> > 
> > The default vhost is always the first defined vhost, so in named based
> > hosting if nothing matches, you get the the first one apache found when
> > parsing the config.
> > 
> > BTW, what you are doing we call real privilege separation.  Rici Lake
> > recently wrote a nice howto on it here:
> > http://wiki.apache.org/httpd/DifferentUserIDsUsingReverseProxy
> > 
> > You might find some useful stuff in it.
> > 
> > cheers!
> > 
> > chris at ia.gov
> > 
> > 
> > Claus wrote:
> >>>> I'm virtualizing the Apache servers, so each server is chrooted to their
> >>>> directory and PHP scripts from one server can't access the other
> >>>> servers.  So, on the server I'm running one main Apache instance that
> >>>> listens to the publicly accessible port 80.  The other Apache instances
> >>>> listen to local host only on their respective port (eg. 8010, 8020).  To
> >>>> do this, and it does work, I use the following directives for the main
> >>>> (proxy) Apache instance:
> >>>>
> >>>> <Directory proxy:http://localhost:8010/>
> >>>>   Order deny,allow
> >>>>   Allow from all
> >>>> </Directory>
> >>>> <VirtualHost *:80>
> >>>>   ServerName host1.example.com
> >>>>   ProxyPass / http://localhost:8010/
> >>>>   ProxyPassReverse / http://localhost:8010/
> >>>> </VirtualHost>
> >>>>
> >>>> <Directory proxy:http://localhost:8020/>
> >>>>   Order deny,allow
> >>>>   Allow from all
> >>>> </Directory>
> >>>> <VirtualHost *:80>
> >>>>   ServerName host2.example.com
> >>>>   ProxyPass / http://localhost:8020/
> >>>>   ProxyPassReverse / http://localhost:8020/
> >>>> </VirtualHost>
> >>>>
> >>>>
> >>>> The next step was to add an SSL host, which successfully worked by
> >>>> adding these directives:
> >>>>
> >>>> <Directory proxy:http://localhost:8030/>
> >>>>   SSLRequireSSL
> >>>>   Order deny,allow
> >>>>   Allow from all
> >>>> </Directory>
> >>>> <VirtualHost *:80>
> >>>>   ServerName sslhost3.example.com
> >>>>   RewriteEngine on
> >>>>   RewriteRule ^/(.*) https://sslhost3.example.com/$1 [L,R]
> >>>> </VirtualHost>
> >>>> <VirtualHost *:443>
> >>>>   SSLEngine on
> >>>>   ServerName sslhost3.example.com
> >>>>   ProxyPass / http://localhost:8030/
> >>>>   ProxyPassReverse / http://localhost:8030/
> >>>>   SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:
> >>>>     +MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
> >>>>   SSLCertificateFile /etc/ssl/example.com.crt
> >>>>   SSLCertificateKeyFile /etc/ssl/private/example.com.key
> >>>>   SetEnvIf User-Agent ".*MSIE.*" nokeepalive
> >>>>      ssl-unclean-shutdown downgrade-1.0 force-response-1.0
> >>>> </VirtualHost>
> >>>>
> >>>>
> >>>> Now I want to add another SSL host.  I know that each SSL host needs to
> >>>> have their unique IP and port pair.  This is due to the fact that SSL
> >>>> encryption needs to happen before the hostname is disclosed to the
> >>>> server.  That's why name based virtual hosting doesn't work.
> >>>> However, with proxy I thought I could do the following:
> >>>>
> >>>> 1. Main Proxy Server
> >>>>   Accepts connection on port 80 and 443.  Forwards proxies port 80 as
> >>>> usual but forwards port 443 to second proxy server in clear text.
> >>>>
> >>>> 2. Second Proxy Server
> >>>>   Now that the incoming traffic is not encrypted the name based
> >>>> VirtualHost directive should work.
> >>>>
> >>>> So I invisioned the directives to be:
> >>>>
> >>>> <VirtualHost *:80>
> >>>>   ServerName sslhost3.example.com
> >>>>   RewriteEngine on
> >>>>   RewriteRule ^/(.*) https://sslhost3.example.com/$1 [L,R]
> >>>> </VirtualHost>
> >>>> <VirtualHost *:80>
> >>>>   ServerName sslhost4.example.com
> >>>>   RewriteEngine on
> >>>>   RewriteRule ^/(.*) https://sslhost4.example.com/$1 [L,R]
> >>>> </VirtualHost>
> >>>>
> >>>> # Main Proxy Server
> >>>> <Directory proxy:http://localhost:44344/>
> >>>>   SSLRequireSSL
> >>>>   Order deny,allow
> >>>>   Allow from all
> >>>> </Directory>
> >>>> <VirtualHost *:443>
> >>>>   SSLEngine on
> >>>>   ServerName sslhost3.example.com
> >>>>   ServerAlias sslhost4.example.com
> >>>>   ProxyPass / http://localhost:44344/
> >>>>   ProxyPassReverse / http://localhost:44344/
> >>>>   SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:
> >>>>     +MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
> >>>>   SSLCertificateFile /etc/ssl/example.com.crt
> >>>>   SSLCertificateKeyFile /etc/ssl/private/example.com.key
> >>>>   SetEnvIf User-Agent ".*MSIE.*" nokeepalive
> >>>>      ssl-unclean-shutdown downgrade-1.0 force-response-1.0
> >>>> </VirtualHost>
> >>>>
> >>>> # Second Proxy Server
> >>>> <Directory proxy:http://localhost:8030/>
> >>>>   Order deny,allow
> >>>>   Allow from all
> >>>> </Directory>
> >>>> <VirtualHost *:44344>
> >>>>   SSLEngine on
> >>>>   ServerName sslhost3.example.com
> >>>>   ProxyPass / http://localhost:8030/
> >>>>   ProxyPassReverse / http://localhost:8030/
> >>>>   SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:
> >>>>     +MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
> >>>>   SSLCertificateFile /etc/ssl/example.com.crt
> >>>>   SSLCertificateKeyFile /etc/ssl/private/example.com.key
> >>>>   SetEnvIf User-Agent ".*MSIE.*" nokeepalive
> >>>>      ssl-unclean-shutdown downgrade-1.0 force-response-1.0
> >>>> </VirtualHost>
> >>>>
> >>>> <Directory proxy:http://localhost:8040/>
> >>>>   Order deny,allow
> >>>>   Allow from all
> >>>> </Directory>
> >>>> <VirtualHost *:44344>
> >>>>   SSLEngine on
> >>>>   ServerName sslhost4.example.com
> >>>>   ProxyPass / http://localhost:8040/
> >>>>   ProxyPassReverse / http://localhost:8040/
> >>>>   SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:
> >>>>     +MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
> >>>>   SSLCertificateFile /etc/ssl/example.com.crt
> >>>>   SSLCertificateKeyFile /etc/ssl/private/example.com.key
> >>>>   SetEnvIf User-Agent ".*MSIE.*" nokeepalive
> >>>>      ssl-unclean-shutdown downgrade-1.0 force-response-1.0
> >>>> </VirtualHost>
> >>>>
> >>>> So far I haven't gotten this to work.  Whatever I do it seems to pick
> >>>> the first VirtualHost listed, seemingly ignoring the ServerName.  At the
> >>>> point of processing the port 44344 request no encryption should hinder
> >>>> the name based VirtualHost resolution, right?  Is there anything I'm
> >>>> overlooking?
> >>>>
> >>>>   Claus
> >>>>
> >>>> PS:  I'm aware about mismatch between the SSL certificate and the domain
> >>>> names.  At this point I'm not concerned about it.
> >>>> _______________________________________________
> >>>> Cialug mailing list
> >>>> Cialug at cialug.org
> >>>> http://cialug.org/mailman/listinfo/cialug
> > 
> _______________________________________________
> Cialug mailing list
> Cialug at cialug.org
> http://cialug.org/mailman/listinfo/cialug
> >>
> 
> > _______________________________________________
> > Cialug mailing list
> > Cialug at cialug.org
> > http://cialug.org/mailman/listinfo/cialug
> 
> 
> 
> _______________________________________________
> Cialug mailing list
> Cialug at cialug.org
> http://cialug.org/mailman/listinfo/cialug



More information about the Cialug mailing list