Assignment 2: The Core

Installation and configuration of the WEB service: APACHE2

Now, our goal is to deploy a secure WEB service that enables publishing and managing web contents.

1. Installation of the web server apache2 on server-04 (1)

   • Install the apache2 server

     • Initially, keep the default configuration.

   • Quick check:

     • From the frontend, check the service is up using curl (2)

2. Initial configuration:

   • Check which Apache2 modules are initially loaded (default).

   • Disable the following module which is being used:

     • deflate

   • Identify the website initially (default) active on the server.

   • Modify the default website to show this content:

                                         CSDA

   Student:                                                        
   Server version: 		                               (Debian)

3. Advanced configuration:

   • Multi-Processing Modules configuration:

     • Check it using apache2 tools (apachectl).

     • Configure your HTTP server to use worker MPM. Try to “load” it as second MPM module on apache2 simultaneously.

   • User web directories:

     • Enable user web directories in apache2 for LDAP users. They will have their own web space for storing web content (personal pages). For this we will need to create the $HOME/public_html (NFS) directory for each one and to enable that functionality on apache2.

     • Make the changes only for user1.

   • Restrict access to user web directories:

     • Restrict access to these directories in Apache2 using the .htaccess method.

   • Definition of Virtualhosts:

     • Configure a new “virtualhost” that uses the same server IP but another FQDN:

       1. Name of “virtualhost” -> csda

       2. FQDN for the “virtualhost” -> web.localdomain

       3. Web directory to the “virtualhost” -> /var/www/csda

          • The content will be a single html page that shows “CSDA Virtualhost” in upper case and large size.

       4. Log files for the “virtualhost”:

          • Error logs: csda_error.log

          • Access logs: csda_access.log

   • Enable PHP content management in apache2 for the new (csda) “virtualhost”

     • Change the web content from html to php by using the attached .php file in ANNEX 1.

     • Check that it works ok.

4. Security settings for apache2:

   • Restrict IP access:

     • Restrict IP access to web content managed by the "VirtualHost" csda created in the preceding section so that only the computer with IP 10.128.0.100 (frontend) is able to access it through the Apache server.

     • Check it using lynx command from server-04.

   • LDAP user authentication:

     • Now, we want to delegate user authentication to the LDAP active directory on server-01 instead of htaccess. This way, only LDAP users will be able to access web content. Specifically, the content of user web directories ($HOME/public_html):

       1. Disable .htaccess

       2. Enable LDAP integration on Apache2.

       3. Information required for integration:

          • Message to be shown: "CSDA Web services"

          • LDAP bind dn: cn=admin,dc=localdomain

          • LDAP admin password: "ldap"

          • LDAP auth URL: ldaps://server-01.localdomain:636/ou=people,dc=localdomain?uid

          • Use SSL.

   • Secure access to web content using SSL:

     • Configure a new secure “virtualhost” (SSL) that uses SSL/TLS certificate to conduct encrypted communications:

       1. Name of “virtualhost” -> secure_csda

       2. FQDN for the “virtualhost” -> web.localdomain (4)

       3. Web directory for the “virtualhost” -> var/www/secure_csda

          • The content will be a single html page that shows the message “CSDA Secure Access” in upper case and large size.

       4. Log files for the “virtualhost”:

          • Error logs: secure_csda_error.log

          • Access logs: secure_csda_access.log

       5. Disable the directory listing for this “virtualhost”

       In order to configure SSL access correctly, we will need to create a new TLS certificate for our web service. Use the same procedure as the one we used in Lab1.

       1. Use the CA (self-signed) certificate already created in Lab1 (5).

       2. Generate the WEB service certificate that you will sign using the CA certificate (private key):

          • Generate a WEB certificate private key:

            1. File name: web.localdomain.key (6).

            2. Key size (bits): 4096

            3. Rest of params by default.

          • Generate the WEB service certificate and sign it using the CA certificate and its private key. Save it as web.localdomain.cert (5).

            1. Sign mode: signed by a CA

            2. Profile:

               • This certificate will be used to encrypt data

                 This certificate will be used for a TLS server

            3. Other data (7):

               • Certificate type: X.509 (default)

               • Expiration days: 365 days

               • Country of the subject: ES

               • State: Cantabria

               • Locality: Santander

               • Organization: UC

               • Unit: CSDA

               • “Common name”: web.localdomain (8)

               • e-mail: sistemas@localdomain

       3. Now, use the new TLS service certificate and key in Apache in order to enable SSL communications in secure_csda“virtualhost”

5. Checking:

   • Basic configuration:

     • External access:

       1. Use your host (PC/laptop) web browser to access server-04 web service through external network (public IP).

     • Internal access:

       1. From frontend, use the curl y/o lynx commands to check access to the web service.

     • Advanced configuration:

       1. Check the .htaccess mechanism

       2. Access to content of “virtualhost” csda

       3. Take a look at log files of that virtualhost.

       4. Check that PHP functionality is loaded --> http://web.localdomain/index.php

     • Security settings:

       1. Restrict access to web contents on server-04 (“virtualhost” csda) to only IP 10.128.0.100.

       2. LDAP user authentication

       3. SSL communications in “virtualhost” secure_csda --> https://web.localdomain/

          You can use the command-line browsers “curl”, “w3m”, “links” …

(1) Use the official debian software repositories

(2)curl is a Linux “command line” tool for transferring data from server. It can use the following protocols: DICT, FILE, FTP, FTPS, GOPHER, HTTP, HTTPS, IMAP, LDAP, LDAPS, POP3 …

(3)lynx is a Linux “command line” web browser

(4) We will use the same name as csda “virtualhost”. The difference will be the protocol to be used: https.

(5) PATH /etc/ssl/certs

(6) PATH /etc/ssl/private. Make sure that the apache2 service user (www-data) is allowed to read (UNIX permissions) the HTTP certificate private key file

(7) You can use a template like the one used in Lab1: www_server-04.localdomain.info

(8) It is very important to use the FQDN and not its IP or another value.