Server Side Programming with php cpan542

Server Side Programming with PHP CPAN542

Apache can be configured to handle HTTPS (HTTP over Secure Sockets Layer). The secure server encrypts the data in transit, making the exchange of information much harder to sniff.

 

Apache-SSL is a secure web server, based on Apache and SSLLeay/OpenSSL. The following steps describe the installation of the Win32 version of Apache with the mod_ssl extension:

1-     Download Apache_1.3.22-Mod_SSL_2.8.5-OpenSSL_0.9.6b-WIN32.zip from ftp://ftp.modssl.uli.it/contrib/. Unpack the zip file and store it into a folder called ssl under C drive.

2-     Copy ssleay32.dll and libeay32.dll from C:\ssl\openssl\bin to C:WINNT\System32

3-     Download the configuration file openssl.cnf from

Next you have to perform the following instructions that are obtained from http://www.apache-ssl.org/#FAQ

1-     Type the following command:

This creates a certificate signing request and a private key.

You will be asked for this phrase in the next step.

You will be asked about the country, province, city, organization name, and organization unit name .

When asked for "Common Name (your websites domain name)", give the exact domain name of your web server (e.g. localhost). The certificate belongs to this server name and browsers complain if the name doesn't match.

You will also be asked about the email address and a challenged password.

2-     Type the following command:

 

C:\ssl\openssl\bin openssl rsa -in privkey.pem -out my-server.key

This removes the passphrase from the private key. You MUST understand what this means; my-server.key should be only readable by the apache server and the administrator.

You should delete the .rnd file because it contains the entropy information for creating the key and could be used for cryptographic attacks against your private key.

3-     Type the following command:

This creates a self-signed certificate that you can use until you get a "real" one from a certificate authority. (Which is optional; if you know your users, you can tell them to install the certificate into their browsers). Note that this certificate expires after one year, you can increase -days 365 if you don't want this.

4-     If you have users with MS Internet Explorer 4.x and want them to be able to install the certificate into their certificate storage (by downloading and opening it), you need to create a DER-encoded version of the certificate:

 

C:\ssl\openssl\bin openssl x509 -in my-server.cert -out my-server.der.crt -outform DER

5-     Move my-server.key and my-server.cert into the C:\ssl\conf\ssl directory (you have to create ssl folder).

6-     Edit httpd.conf and make the following changes:

• 
  ServerRoot "c:/ssl"
  
• 
  Listen 443 
  
• 
  LoadModule ssl_module modules/mod_ssl.so 
  
• 
  ServerName myserver.com 
  
• 
  DocumentRoot "c:/ssl/htdocs" 
  
• 
   
  Options Indexes FollowSymLinks MultiViews 
  Order allow,deny 
  Allow from all 
   
  
• 
   
  UserDir "c:/ssl/htdocs"
   
  

And add the following to the end of httpd.conf:

 


# see http://www.modssl.org/docs/2.4/ssl_reference.html for more info 
SSLMutex sem 
SSLRandomSeed startup builtin 
SSLSessionCache none 
SSLLog logs/SSL.log 
SSLLogLevel info 
# You can later change "info" to "warn" if everything is OK 
 
SSLEngine On 
SSLCertificateFile conf/ssl/my-server.cert 
SSLCertificateKeyFile conf/ssl/my-server.key 
 

After that, run the server from the command line:

If everything was fine, then you have a secure server running. To access this server you need to type the following URL:

 

https:// localhost:443

When you have sensitive resources on your site, you may want to prevent unwanted access by using Authentication. The easiest way to use basic authentication under Apache is to use mod_auth module.

 When a user tries to access a specific directory under the server, the browser will prompt a login dialog, and the user must provide a valid user name and password in order to access that directory.

Assume that we have a directory called store that is saved under htdocs directory. We want to limit the access of store directory to authenticated users only. First we can create a text file called user.txt that contain users’ names and their passwords:

For example users.txt may consist of the following:

Then we can add the following directive to httpd.conf

Notice that we have stored users.txt under Apache folder, but it can be stored anywhere. Now, only John, Robert, and Sarah can access store directory.

Also we can provide access to groups of users, by providing another text file that contain groups’ names and their members. For example we can create a text file called groups.txt that contain:

Then we can have more control to which group can access the specified directory:

Now, only members of Group1 can access the store directory. This include John, and Robert only.  

 

Notes:  

• 
  If you have apache installed already, then you can still run it as normal server beside your new secure server.
  

IIS is a web server that ships with Microsoft Windows. You can install it during Windows 2000 installation or later as an Add-On Component. The following steps describe how to install  IIS to handle HTTPS requests:

• 
  From the Administrative tools open the Internet Information Services:
  

• 
  Right click the Default Web Site ,select Properties, and click on the Directory Security tab:
  

• 
  Click the Server Certificate button to start the
  
  Download 0.5 Mb.