PCTResearch Wiki

User Tools

Site Tools

Trace:
apache2

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
apache2 [2025/02/25 21:53] – [Apache2] jianwuapache2 [2025/03/13 12:22] (current) – [Ubuntu 24.04 LTS + Apache2 + PHP installarion and setting] jianwu
Line 1: Line 1:
-[[https://pctresearch.com/|{{:banner_image.jpg?nolink&800|}}]]+[[https://pctresearch.com/|{{:wiki_banner.jpg?nolink&800|}}]]
 ===== Ubuntu 24.04 LTS + Apache2 + PHP installarion and setting ===== ===== Ubuntu 24.04 LTS + Apache2 + PHP installarion and setting =====
 ^OS|Ubuntu 24.04.2 LTS| ^OS|Ubuntu 24.04.2 LTS|
Line 105: Line 105:
 ==== Set to start ufw on boot ==== ==== Set to start ufw on boot ====
 <code Diff> <code Diff>
-$ git diff etc/ufw/ufw.conf+$ git diff /etc/ufw/ufw.conf
 diff --git a/etc/ufw/ufw.conf b/etc/ufw/ufw.conf diff --git a/etc/ufw/ufw.conf b/etc/ufw/ufw.conf
 index 8336b91..28fe534 100644 index 8336b91..28fe534 100644
Line 149: Line 149:
 </code> </code>
  
-@@@@@@@@@@@@@@@@@@@@ 
-(a2enmod is not necessary.) 
-<code Bash> 
-a2enmod 
-script that enables the specified module within the apache2 configuration. It does this by creating symlinks within  /etc/apache2/mods-enabled. 
-a2dismod 
-disables a module by removing those symlinks.  
-</code> 
-@@@@@@@@@@@@@@@@@@@@ 
 ==== Create user wweb ==== ==== Create user wweb ====
 :!: You can change the user name whatever you want. :!: You can change the user name whatever you want.
Line 279: Line 270:
 ====/etc/apache2/mods-enabled/dir.conf==== ====/etc/apache2/mods-enabled/dir.conf====
 <code Bash> <code Bash>
-        DirectoryIndex index.php index.html index.cgi index.pl index.xhtml index.htm+DirectoryIndex index.php index.html index.cgi index.pl index.xhtml index.htm
 </code> </code>
  
Line 347: Line 338:
 </code> </code>
  
-==== Enabling SSL ====+===== Enabling SSL =====
 make wweb_ssl.conf from 000-default.conf make wweb_ssl.conf from 000-default.conf
  
Line 376: Line 367:
 -- --
 <code Bash> <code Bash>
-sudo a2ensite wweb_ssl.conf +$ sudo a2ensite wweb_ssl.conf 
-sudo a2enmod ssl +$ sudo a2enmod ssl 
-sudo systemctl reload apache2+$ sudo systemctl reload apache2
 </code> </code>
 +<code Bash>
 +a2enmod
 +script that enables the specified module within the apache2 configuration. It does this by creating symlinks within  /etc/apache2/mods-enabled.
 +a2dismod
 +disables a module by removing those symlinks. 
 +</code>
 +If you want to use self-signed certificates, you should install the ssl-cert
 +package (see below). Otherwise, just adjust the SSLCertificateKeyFile and
 +SSLCertificateFile directives in '/etc/apache2/sites-available/default-ssl.conf'
 +to point to your SSL certificate. 
 +
 +Then restart apache:
 +<code Bash>
 +$ sudo systemctl restart apache2
 +</code>
 +
 +===== Creating self-signed SSL certificates =====
 +<code Bash>
 +$ apt list --installed 2>/dev/null | grep -i ssl-cert
 +ssl-cert/noble,now 1.1.2ubuntu1 all [installed,automatic]
 +</code>
 +If it isn't installed
 +<code Bash>
 +$ sudo apt install ssl-cert
 +</code>
 +If you install the ssl-cert package, a self-signed certificate will be
 +
 +automatically created using the hostname currently configured on your computer.
 +<code Bash>
 +        SSLCertificateFile      /etc/ssl/certs/ssl-cert-snakeoil.pem
 +        SSLCertificateKeyFile   /etc/ssl/private/ssl-cert-snakeoil.key
 +</code>
 +You can recreate that certificate (e.g. after you have changed '/etc/hosts' or
 +
 +DNS to give the correct hostname) as user root with:
 +<code Bash>
 +$ make-ssl-cert generate-default-snakeoil --force-overwrite
 +</code>
 +
 +To create more certificates with different host names, you can use
 +
 +        make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /path/to/cert-file.crt
 +
 +This will ask you for the hostname and place both SSL key and certificate in
 +the file '/path/to/cert-file.crt'. Use this file with the SSLCertificateFile
 +directive in the Apache config (you don't need the SSLCertificateKeyFile in
 +this case as it also contains the key). The file '/path/to/cert-file.crt'
 +should only be readable by root. A good directory to use for the additional
 +certificates/keys is '/etc/ssl/private'.
 +
 +make
 +/usr/share/ssl-cert/ssleay_wweb.cnf from /usr/share/ssl-cert/ssleay.cnf
 +<code Bash>
 +$ sudo cp /usr/share/ssl-cert/ssleay.cnf /usr/share/ssl-cert/ssleay_wweb.cnf
 +</code>
 +<code Bash>
 +$ diff -c /usr/share/ssl-cert/ssleay.cnf /usr/share/ssl-cert/ssleay_wweb.cnf
 +*** /usr/share/ssl-cert/ssleay.cnf      2023-10-01 13:19:41.000000000 +0900
 +--- /usr/share/ssl-cert/ssleay_wweb.cnf 2025-02-25 22:37:05.706472564 +0900
 +***************
 +*** 6,19 ****
 +  default_bits            = 2048
 +  default_keyfile         = privkey.pem
 +  distinguished_name      = req_distinguished_name
 +  prompt                  = no
 +  policy                        = policy_anything
 +  req_extensions          = v3_req
 +  x509_extensions         = v3_req
 +
 +  [ req_distinguished_name ]
 +! commonName                      = @HostName@
 +
 +  [ v3_req ]
 +  basicConstraints        = CA:FALSE
 +  subjectAltName          = @SubjectAltName@
 +--- 6,27 ----
 +  default_bits            = 2048
 +  default_keyfile         = privkey.pem
 +  distinguished_name      = req_distinguished_name
 ++ attributes              = req_attributes
 +  prompt                  = no
 +  policy                        = policy_anything
 +  req_extensions          = v3_req
 +  x509_extensions         = v3_req
 +
 +  [ req_distinguished_name ]
 +! countryName             = JP
 +! commonName              = ubuntupctr
 +
 +  [ v3_req ]
 +  basicConstraints        = CA:FALSE
 +  subjectAltName          = @SubjectAltName@
 ++
 ++ [ req_attributes ]
 ++ challengePassword        = A challenge password
 ++ challengePassword_min    = 4
 ++ challengePassword_max    = 20
 ++
 +</code>
 +
 +<code Bash>
 +$ make-ssl-cert [OPTION]... template output-certificate
 +</code>
 +^--force-overwrite|Always create a new certificate, even if the file already exists. |
 +So,
 +<code Text>
 +$ sudo make-ssl-cert --force-overwrite /usr/share/ssl-cert/ssleay_wweb.cnf /etc/ssl/private/wweb_cert-file.crt
 +Package configuration
 +┌─────────────────┤ Configure an SSL Certificate. ├───────────────────────┐
 +│ Please enter the host name to use in the SSL certificate.               │
 +│                                                                         │
 +│ It will become the 'commonName' field of the generated SSL certificate. │
 +│                                                                         │
 +│ Host name:                                                              │
 +│                                                                         │
 +│ localhost_______________________________________________________________│
 +│                                                                         │
 +│                   <Ok>                       <Cancel>                   │
 +└─────────────────────────────────────────────────────────────────────────┘
 +
 +┌──────────────────────────────┤ Configure an SSL Certificate. ├────────────────────────────────────────────────┐
 +│ Please enter any additional names to use in the SSL certificate.                                              │
 +│                                                                                                               │
 +│ It will become the 'subjectAltName' field of the generated SSL certificate.                                   │
 +│                                                                                                               │
 +│ Multiple alternative names should be delimited with comma and no spaces. For a web server with multiple DNS   │
 +│ names this could look like:                                                                                   │
 +│                                                                                                               │
 +│ DNS:www.example.com,DNS:images.example.com                                                                    │
 +│                                                                                                               │
 +│ A more complex example including a hostname, a WebID, an email address, and an IPv4 address:                  │
 +│                                                                                                               │
 +│ DNS:example.com,URI:http://example.com/joe#me,email:me@example.com,IP:192.168.7.3                             │
 +│                                                                                                               │
 +│ Alternative name(s):                                                                                          │
 +│                                                                                                               │
 +│ DNS:ubuntupctr,URI:ubuntupctr,email:your_mail@address.com,IP:192.168.1.2_____________________________________ │
 +│                                                                                                               │
 +│                                <Ok>                                    <Cancel>                               │
 +│                                                                                                               │
 +└───────────────────────────────────────────────────────────────────────────────────────────────────────────────┘
 +</code>
 +<code Bash>
 +$ sudo ll /etc/ssl/private/ | grep wweb_cert-file.crt
 +lrwxrwxrwx 1 root root       18 Feb 25 23:23 9ae71ddb.0 -> wweb_cert-file.crt
 +-rw------- 1 root root     2896 Feb 25 23:23 wweb_cert-file.crt
 +</code>
 +
 +For reference, Invoked with "generate-default-snakeoil":
 +<code Bash>
 +$ make-ssl-cert generate-default-snakeoil --force-overwrite
 +</code>
 +will generate:
 +<code Bash>
 +/etc/ssl/certs/ssl-cert-snakeoil.pem
 +and
 +/etc/ssl/private/ssl-cert-snakeoil.key.
 +</code>
 +
 +'openssl req' command primarily creates and processes certificate requests (CSRs) in PKCS#10 format.
 +It can additionally create self-signed certificates for use as root CAs for example.
 +<code Bash>
 +$ sudo openssl req -new -newkey rsa:2048 -nodes -keyout wweb_server.key -out wweb_server.csr
 +......+....+.....+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+.+..+.+..+....+.....+.+..+............................+.....+....+.....+....+..+....+.........+.....+....+.....+............+.+..+.+..+....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 +..+........+.......+......+.....+..........+..+.+..+.........+....+..+...+.......+..+.+.....+.+...+...+..+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+...+...+..............+.+.....+.........+...+....+...+.....+.......+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+......+........+......+...................+..+.............+.................+.........+...+.......+.....+...+.+..+...+.+.....+.+........+..........+.....+....+..+....+......+...........+.......+.....+.+..+..........+.........+........+.............+..+..........+..+.+...+..+............+...+....+.....+...+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 +-----
 +You are about to be asked to enter information that will be incorporated
 +into your certificate request.
 +What you are about to enter is what is called a Distinguished Name or a DN.
 +There are quite a few fields but you can leave some blank
 +For some fields there will be a default value,
 +If you enter '.', the field will be left blank.
 +-----
 +Country Name (2 letter code) [AU]:JP
 +State or Province Name (full name) [Some-State]:Tokyo
 +Locality Name (eg, city) []:Shinjuku-ku
 +Organization Name (eg, company) [Internet Widgits Pty Ltd]:PCTResearch
 +Organizational Unit Name (eg, section) []:Security
 +Common Name (e.g. server FQDN or YOUR name) []:ubuntupctr
 +Email Address []:your_mail@address.com
 +
 +Please enter the following 'extra' attributes
 +to be sent with your certificate request
 +A challenge password []:********
 +An optional company name []:
 +</code>
 +
 +<code Bash>
 +$ sudo mv wweb_server.key /etc/ssl/private/
 +$ sudo openssl x509 -req -signkey /etc/ssl/private/wweb_server.key -in wweb_server.csr -out wweb_server.crt
 +Certificate request self-signature ok
 +subject=C = JP, ST = Tokyo, L = Shinjuku-ku, O = PCTResearch, OU = Security, CN = ubuntupctr, emailAddress = your_mail@address.com
 +$ sudo mv wweb_server.csr wweb_server.crt /etc/ssl/certs/
 +</code>
 +
 +<code Bash>
 +$ sudo ls -la /etc/ssl/private/ | grep wweb
 +lrwxrwxrwx 1 root root       18 Feb 25 23:23 9ae71ddb.0 -> wweb_cert-file.crt
 +-rw------- 1 root root     2896 Feb 25 23:23 wweb_cert-file.crt
 +-rw------- 1 root root     1708 Feb 25 23:36 wweb_server.key
 +</code>
 +<code Bash>
 +$ ll /etc/ssl/certs | grep wweb
 +-rw-r--r-- 1 root root   1342 Feb 25 23:44 wweb_server.crt
 +-rw-r--r-- 1 root root   1106 Feb 25 23:41 wweb_server.csr
 +</code>
 +
 +The following sections are for reference.
 +
 +==== How to create a self-signed PEM file ====
 +Privacy Enhanced Mail (PEM) files are concatenated certificate containers frequently used in certificate installations when multiple certificates that form a complete chain are being imported as a single file. They are a defined standard in RFCs 1421 through 1424. They can be thought of as a layered container of chained certificates. A .pem file is a container format that may just include the public certificate or the entire certificate chain (private key, public key, root certificates):
 +
 +<code Bash>
 +Private Key
 +Server Certificate (crt, puplic key)
 +(optional) Intermediate CA and/or bundles if signed by a 3rd party
 +</code>
 +
 +<code Bash>
 +$ sudo openssl req -new -x509 -days 3650 -nodes -newkey rsa:2048 -keyout key.pem -out cert.pem
 +</code>
 +
 +==== How to create a PEM file from existing certificate files that form a chain ====
 +(optional) Remove the password from the Private Key by following the steps listed below:
 +<code Bash>
 +$ openssl rsa -in server.key -out nopassword.key
 +</code>
 +Note: Enter the pass phrase of the Private Key.
 +
 +Combine the private key, public certificate and any 3rd party intermediate certificate files:
 +<code Bash>
 +$ cat nopassword.key > server.pem
 +$ cat server.crt >> server.pem
 +</code>
 +Note: Repeat this step as needed for third-party certificate chain files, bundles, etc:
 +<code Bash>
 +cat intermediate.crt >> server.pem
 +</code>
 +
 +==== logs of apache2  ====
 +/etc/apache2/envvars
 +<code Bash>
 +export APACHE_LOG_DIR=/var/log/apache2$SUFFIX
 +</code>
 +/etc/apache2/sites-available/wweb.conf
 +<code Bash>
 +ErrorLog ${APACHE_LOG_DIR}/error.log
 +CustomLog ${APACHE_LOG_DIR}/access.log combined
 +</code>
 +<code Bash>
 +/var/log/apache2/
 +access.log
 +error.log
 +</code>
 +
  
apache2.1740488014.txt.gz · Last modified: 2025/02/25 21:53 by jianwu