HTTPS - Revision history

Purps at 09:35, 18 July 2011

2011-07-18T09:35:41Z

←Older revision		Revision as of 09:35, 18 July 2011
Line 1:		Line 1:
	[[Category: Development]]		[[Category: Development]]

			Purps, 18/07/11: '''This now appears to be set up by default.''' Just make sure you forward port 443 in web admin though (add tcp ipv4 443 443 core_input in Advanced -> Network -> Firewall

	= Introduction =		= Introduction =

Purps: /* Notes */

2011-06-13T22:22:09Z

Notes

←Older revision		Revision as of 22:22, 13 June 2011
Line 151:		Line 151:

	*I found that some devices had to be reset before they could connect to my core via https.		*I found that some devices had to be reset before they could connect to my core via https.
	*On my current installation (810 beta, snapshot 23796) I found that "/etc/apache2/sites-available/pluto" and "/etc/apache2/ports.conf" were being overwritten every time the core was restarted. To combat the problem I did...
	~~chattr +i /etc/apache2/sites-available/pluto~~
	~~chattr +i /etc/apache2/ports.conf~~
	~~...which stops even root from being able to alter the files. FYI this can be reversed using "-i" instead of "+i".~~

Purps at 19:54, 2 May 2011

2011-05-02T19:54:12Z

←Older revision		Revision as of 19:54, 2 May 2011
Line 6:		Line 6:
	I used http://www.dyndns.com/ to set up my fully qualified domain name, and it has worked very well, as it is free!		I used http://www.dyndns.com/ to set up my fully qualified domain name, and it has worked very well, as it is free!

	Once ~~set up is complete~~, you ~~will~~ be able to access your LinuxMCE admin page externally by typing in https://linuxmce.yourdomain.com. The "linuxmce.yourdomain.com" essentially replaces the "192.168.80.1" part that you would normally type in when on the internal network. This means that you can access your web orbiter (https://linuxmce.yourdomain.com/lmce-admin/weborbiter.php), your MythTV admin page (https://linuxmce.yourdomain.com/mythweb) or ZoneMinder for example (https://linuxmce.yourdomain.com/zm), if you have it installed.		Once the steps in this guide have been carried out, you should be able to access your LinuxMCE admin page externally by typing in https://linuxmce.yourdomain.com. The "linuxmce.yourdomain.com" essentially replaces the "192.168.80.1" part that you would normally type in when on the internal network. This means that you can access your web orbiter (https://linuxmce.yourdomain.com/lmce-admin/weborbiter.php), your MythTV admin page (https://linuxmce.yourdomain.com/mythweb) or ZoneMinder for example (https://linuxmce.yourdomain.com/zm), if you have it installed.

	Your fully qualified domain name can also be used for ssh-ing into your core i.e...		Your fully qualified domain name can also be used for ssh-ing into your core i.e...

Purps at 13:36, 28 April 2011

2011-04-28T13:36:26Z

←Older revision		Revision as of 13:36, 28 April 2011
Line 1:		Line 1:
	[[Category: Development]]		[[Category: Development]]
	= ~~HTTPS / SSL access on the outside~~ =		= Introduction =

	I ~~am trying~~ to ~~setup https on~~ the ~~outside so Linuxmce can~~ be ~~used safely~~. ~~Below is my setup~~.		This wiki page will help you to set up secure outside https access WITHOUT having to enable "Outside Access" in web admin (currently insecure I believe). Before starting, I would recommend registering a fully qualified domain name. This for all intents and purposes maps your external IP to an easy-to-remember address, which makes life a lot easier. Keeping in line with the example mentioned in this guide, it will be something similar to "linuxmce.yourdomain.com".

	We start by creating a new password file (-c option) and adding a user (~~linux~~) with a password (test) to the password file:		I used http://www.dyndns.com/ to set up my fully qualified domain name, and it has worked very well, as it is free!

			Once set up is complete, you will be able to access your LinuxMCE admin page externally by typing in https://linuxmce.yourdomain.com. The "linuxmce.yourdomain.com" essentially replaces the "192.168.80.1" part that you would normally type in when on the internal network. This means that you can access your web orbiter (https://linuxmce.yourdomain.com/lmce-admin/weborbiter.php), your MythTV admin page (https://linuxmce.yourdomain.com/mythweb) or ZoneMinder for example (https://linuxmce.yourdomain.com/zm), if you have it installed.

			Your fully qualified domain name can also be used for ssh-ing into your core i.e...

			ssh root@linuxmce.yourdomain.com

			Just make sure you open port 22 in the firewall settings in web admin if you want to do this.

			= Setting up HTTPS / SSL access on the outside =

			We start by creating a new password file (-c option) and adding a user (linuxmce) with a password (test) to the password file:

	htpasswd -bc /etc/apache2/httpd.passwd linuxmce test		htpasswd -bc /etc/apache2/httpd.passwd linuxmce test
Line 30:		Line 42:
	mv /root/ssl/server.key.insecure /root/ssl/server.key		mv /root/ssl/server.key.insecure /root/ssl/server.key

	~~You~~ now have the following files in /root/ssl:		FYI, you now have the following files in /root/ssl:

	server.crt: The self-signed server certificate.		*server.crt: The self-signed server certificate.
	server.csr: Server certificate signing request.		*server.csr: Server certificate signing request.
	server.key: The private server key, does not require a password when starting Apache.		*server.key: The private server key, does not require a password when starting Apache.
	server.key.secure: The private server key, it does require a password when starting Apache.		*server.key.secure: The private server key, it does require a password when starting Apache.


Line 44:		Line 56:


	~~add~~ the following in /etc/apache2/httpd.conf		Add the following in /etc/apache2/httpd.conf

	<pre>		<pre>
Line 97:		Line 109:
	</pre>		</pre>

	On the top of httpd.conf add the fully qualified domain name of your box that you added by "Common Name (eg, YOUR name)" when creating the certificate:		At the top of /etc/apache2/httpd.conf add the fully qualified domain name of your box that you added by "Common Name (eg, YOUR name)" when creating the certificate:

	ServerName linuxmce.yourdomain.com		ServerName linuxmce.yourdomain.com

	we have to change the beginning of vi /etc/apache2/sites-available/pluto to:		We have to change the beginning of vi /etc/apache2/sites-available/pluto to:
	<pre>		<pre>
	# NameVirtualHost *		# NameVirtualHost *
Line 107:		Line 119:
	</pre>		</pre>

	~~and~~ then copy this file:		And then copy this file:
	cp /etc/apache2/sites-available/pluto /etc/apache2/sites-available/pluto443		cp /etc/apache2/sites-available/pluto /etc/apache2/sites-available/pluto443

	~~then~~ change the ~~beginnig~~ to:		Then change the beginning of /etc/apache2/sites-available/pluto443 to:
	<pre>		<pre>
	# NameVirtualHost *		# NameVirtualHost *
Line 117:		Line 129:
	</pre>		</pre>

	~~make~~ a symbolic link:		Make a symbolic link:
	ln -s /etc/apache2/sites-available/pluto443 /etc/apache2/sites-enabled/pluto443		ln -s /etc/apache2/sites-available/pluto443 /etc/apache2/sites-enabled/pluto443

	~~move~~ the original ssl configuration out of the way (to your home dir):		Move the original ssl configuration out of the way (to your home dir):
	mv /etc/apache2/sites-available/default-ssl ~/		mv /etc/apache2/sites-available/default-ssl ~/
	rm /etc/apache2/sites-enabled/default-ssl		rm /etc/apache2/sites-enabled/default-ssl

	~~make~~ sure that apache is listening on port 443 and the following line is in /etc/apache2/ports.conf:		Make sure that apache is listening on port 443 and the following line is in /etc/apache2/ports.conf:
	Listen 443		Listen 443

	go to pluto web admin and to Advanced>Network>Firewall and add a new rule:		Go to pluto web admin and to Advanced>Network>Firewall and add a new rule:
	tcp ipv4 443 443 core_input		tcp ipv4 443 443 core_input

	~~then~~ run:		Then run:

	apache2ctl restart		apache2ctl restart

			...and that should be it.

			= Notes =

			*I found that some devices had to be reset before they could connect to my core via https.
			*On my current installation (810 beta, snapshot 23796) I found that "/etc/apache2/sites-available/pluto" and "/etc/apache2/ports.conf" were being overwritten every time the core was restarted. To combat the problem I did...
			chattr +i /etc/apache2/sites-available/pluto
			chattr +i /etc/apache2/ports.conf
			...which stops even root from being able to alter the files. FYI this can be reversed using "-i" instead of "+i".

Esperanto: listen not in the ports.conf ?? so added remark

2011-04-01T18:03:03Z

listen not in the ports.conf ?? so added remark

←Older revision		Revision as of 18:03, 1 April 2011
Line 123:		Line 123:
	mv /etc/apache2/sites-available/default-ssl ~/		mv /etc/apache2/sites-available/default-ssl ~/
	rm /etc/apache2/sites-enabled/default-ssl		rm /etc/apache2/sites-enabled/default-ssl

			make sure that apache is listening on port 443 and the following line is in /etc/apache2/ports.conf:
			Listen 443

	go to pluto web admin and to Advanced>Network>Firewall and add a new rule:		go to pluto web admin and to Advanced>Network>Firewall and add a new rule:

Purps: /* HTTPS / SSL access on the outside */

2011-03-12T20:45:40Z

HTTPS / SSL access on the outside

←Older revision		Revision as of 20:45, 12 March 2011
Line 125:		Line 125:

	go to pluto web admin and to Advanced>Network>Firewall and add a new rule:		go to pluto web admin and to Advanced>Network>Firewall and add a new rule:
	tcp 443 443 core_input		tcp ipv4 443 443 core_input

	then run:		then run:

	apache2ctl restart		apache2ctl restart

Esperanto: changes because ssl is enabled by default

2011-03-12T17:38:57Z

changes because ssl is enabled by default

←Older revision		Revision as of 17:38, 12 March 2011
Line 43:		Line 43:


	~~add to /etc/apache2/ports.conf:~~

	~~<pre>~~
	~~<IfModule mod_ssl.c>~~
	~~Listen 443~~
	~~</IfModule>~~

	~~</pre>~~

	~~ln -s /etc/apache2/mods-available/ssl.load /etc/apache2/mods-enabled/ssl.load~~
	~~ln -s /etc/apache2/mods-available/ssl.conf /etc/apache2/mods-enabled/ssl.conf~~

	add the following in /etc/apache2/httpd.conf		add the following in /etc/apache2/httpd.conf
Line 115:		Line 104:
	<pre>		<pre>
	# NameVirtualHost *		# NameVirtualHost *
	<VirtualHost *:80>		<VirtualHost _default_:80>
	</pre>		</pre>

Line 124:		Line 113:
	<pre>		<pre>
	# NameVirtualHost *		# NameVirtualHost *
	<VirtualHost *:443>		<VirtualHost _default_:443>
	SSLEngine On		SSLEngine On
	</pre>		</pre>
Line 130:		Line 119:
	make a symbolic link:		make a symbolic link:
	ln -s /etc/apache2/sites-available/pluto443 /etc/apache2/sites-enabled/pluto443		ln -s /etc/apache2/sites-available/pluto443 /etc/apache2/sites-enabled/pluto443

			move the original ssl configuration out of the way (to your home dir):
			mv /etc/apache2/sites-available/default-ssl ~/
			rm /etc/apache2/sites-enabled/default-ssl

	go to pluto web admin and to Advanced>Network>Firewall and add a new rule:		go to pluto web admin and to Advanced>Network>Firewall and add a new rule:

Ray N at 17:58, 23 August 2009

2009-08-23T17:58:58Z

←Older revision		Revision as of 17:58, 23 August 2009
Line 1:		Line 1:
			[[Category: Development]]
	= HTTPS / SSL access on the outside =		= HTTPS / SSL access on the outside =

Esperanto: enabled local host so lmce can connect to itselves ;-)

2009-02-10T19:12:56Z

enabled local host so lmce can connect to itselves ;-)

←Older revision		Revision as of 19:12, 10 February 2009
Line 84:		Line 84:
	Order deny,allow		Order deny,allow
	Deny from all		Deny from all
	Allow from 192.168.80.0/24		Allow from 192.168.80.0/24 127.0.0.1

	# HTTP Basic Authentication		# HTTP Basic Authentication
Line 99:		Line 99:
	RewriteEngine on		RewriteEngine on
	RewriteCond %{REMOTE_ADDR} !^192\.168\.80\.[0-9]+$		RewriteCond %{REMOTE_ADDR} !^192\.168\.80\.[0-9]+$
			RewriteCond %{REMOTE_ADDR} !^127\.0\.0\.[0-9]+$
	RewriteCond %{HTTPS} !=on		RewriteCond %{HTTPS} !=on
	RewriteRule ^/(.*) https://%{SERVER_NAME}/$2 [R,L]		RewriteRule ^/(.*) https://%{SERVER_NAME}/$2 [R,L]

Esperanto at 10:56, 10 December 2008

2008-12-10T10:56:41Z

←Older revision		Revision as of 10:56, 10 December 2008
Line 5:		Line 5:
	We start by creating a new password file (-c option) and adding a user (linux) with a password (test) to the password file:		We start by creating a new password file (-c option) and adding a user (linux) with a password (test) to the password file:

	htpasswd -c /etc/apache2/httpd.passwd linuxmce test		htpasswd -bc /etc/apache2/httpd.passwd linuxmce test

	(Use the same line without the -c to add additional users)		(Use the same line without the -c to add additional users)