From: Alex Dehnert Date: Fri, 15 Jan 2016 08:47:29 +0000 (-0500) Subject: Add .conf extensions to site configs X-Git-Url: https://dehnerts.com/gitweb/?a=commitdiff_plain;h=7a47aa9326e0116e6e5105fbf2179a410457eb89;hp=e347b69c7030e09770f3587bcf5658f8f6c3e26c;p=sysconfig%2Fapache2.git Add .conf extensions to site configs --- diff --git a/sites-available/acc-858-test b/sites-available/acc-858-test deleted file mode 100644 index 1dfdb7e..0000000 --- a/sites-available/acc-858-test +++ /dev/null @@ -1,139 +0,0 @@ - - - ServerAdmin webmaster@dehnerts.com - ServerName acc-858-test.mit.edu - - DocumentRoot /var/www/default - - - deny from all - - - # SSL Engine Switch: - # Enable/Disable SSL for this virtual host. - SSLEngine on - - # A self-signed (snakeoil) certificate can be created by installing - # the ssl-cert package. See - # /usr/share/doc/apache2.2-common/README.Debian.gz for more info. - # If both key and certificate are stored in the same file, only the - # SSLCertificateFile directive is needed. - SSLCertificateFile /var/tmp/certs/cur.pem - SSLCertificateKeyFile /var/tmp/certs/cur.key - - # Server Certificate Chain: - # Point SSLCertificateChainFile at a file containing the - # concatenation of PEM encoded CA certificates which form the - # certificate chain for the server certificate. Alternatively - # the referenced file can be the same as SSLCertificateFile - # when the CA certificates are directly appended to the server - # certificate for convinience. - #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt - - # Certificate Authority (CA): - # Set the CA certificate verification path where to find CA - # certificates for client authentication or alternatively one - # huge file containing all of them (file must be PEM encoded) - # Note: Inside SSLCACertificatePath you need hash symlinks - # to point to the certificate files. Use the provided - # Makefile to update the hash symlinks after changes. - #SSLCACertificatePath /etc/ssl/certs/ - #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt - - # Certificate Revocation Lists (CRL): - # Set the CA revocation path where to find CA CRLs for client - # authentication or alternatively one huge file containing all - # of them (file must be PEM encoded) - # Note: Inside SSLCARevocationPath you need hash symlinks - # to point to the certificate files. Use the provided - # Makefile to update the hash symlinks after changes. - #SSLCARevocationPath /etc/apache2/ssl.crl/ - #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl - - # Client Authentication (Type): - # Client certificate verification type and depth. Types are - # none, optional, require and optional_no_ca. Depth is a - # number which specifies how deeply to verify the certificate - # issuer chain before deciding the certificate is not valid. - #SSLVerifyClient require - #SSLVerifyDepth 10 - - # Access Control: - # With SSLRequire you can do per-directory access control based - # on arbitrary complex boolean expressions containing server - # variable checks and other lookup directives. The syntax is a - # mixture between C and Perl. See the mod_ssl documentation - # for more details. - # - #SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ - # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ - # and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ - # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ - # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ - # or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ - # - - # SSL Engine Options: - # Set various options for the SSL engine. - # o FakeBasicAuth: - # Translate the client X.509 into a Basic Authorisation. This means that - # the standard Auth/DBMAuth methods can be used for access control. The - # user name is the `one line' version of the client's X.509 certificate. - # Note that no password is obtained from the user. Every entry in the user - # file needs this password: `xxj31ZMTZzkVA'. - # o ExportCertData: - # This exports two additional environment variables: SSL_CLIENT_CERT and - # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the - # server (always existing) and the client (only existing when client - # authentication is used). This can be used to import the certificates - # into CGI scripts. - # o StdEnvVars: - # This exports the standard SSL/TLS related `SSL_*' environment variables. - # Per default this exportation is switched off for performance reasons, - # because the extraction step is an expensive operation and is usually - # useless for serving static content. So one usually enables the - # exportation for CGI and SSI requests only. - # o StrictRequire: - # This denies access when "SSLRequireSSL" or "SSLRequire" applied even - # under a "Satisfy any" situation, i.e. when it applies access is denied - # and no other module can change it. - # o OptRenegotiate: - # This enables optimized SSL connection renegotiation handling when SSL - # directives are used in per-directory context. - #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire - - SSLOptions +StdEnvVars - - - SSLOptions +StdEnvVars - - - # SSL Protocol Adjustments: - # The safe and default but still SSL/TLS standard compliant shutdown - # approach is that mod_ssl sends the close notify alert but doesn't wait for - # the close notify alert from client. When you need a different shutdown - # approach you can use one of the following variables: - # o ssl-unclean-shutdown: - # This forces an unclean shutdown when the connection is closed, i.e. no - # SSL close notify alert is send or allowed to received. This violates - # the SSL/TLS standard but is needed for some brain-dead browsers. Use - # this when you receive I/O errors because of the standard approach where - # mod_ssl sends the close notify alert. - # o ssl-accurate-shutdown: - # This forces an accurate shutdown when the connection is closed, i.e. a - # SSL close notify alert is send and mod_ssl waits for the close notify - # alert of the client. This is 100% SSL/TLS standard compliant, but in - # practice often causes hanging connections with brain-dead browsers. Use - # this only for browsers where you know that their SSL implementation - # works correctly. - # Notice: Most problems of broken clients are also related to the HTTP - # keep-alive facility, so you usually additionally want to disable - # keep-alive for those clients, too. Use variable "nokeepalive" for this. - # Similarly, one has to force some clients to use HTTP/1.0 to workaround - # their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and - # "force-response-1.0" for this. - BrowserMatch ".*MSIE.*" \ - nokeepalive ssl-unclean-shutdown \ - downgrade-1.0 force-response-1.0 - - diff --git a/sites-available/acc-858-test.conf b/sites-available/acc-858-test.conf new file mode 100644 index 0000000..1dfdb7e --- /dev/null +++ b/sites-available/acc-858-test.conf @@ -0,0 +1,139 @@ + + + ServerAdmin webmaster@dehnerts.com + ServerName acc-858-test.mit.edu + + DocumentRoot /var/www/default + + + deny from all + + + # SSL Engine Switch: + # Enable/Disable SSL for this virtual host. + SSLEngine on + + # A self-signed (snakeoil) certificate can be created by installing + # the ssl-cert package. See + # /usr/share/doc/apache2.2-common/README.Debian.gz for more info. + # If both key and certificate are stored in the same file, only the + # SSLCertificateFile directive is needed. + SSLCertificateFile /var/tmp/certs/cur.pem + SSLCertificateKeyFile /var/tmp/certs/cur.key + + # Server Certificate Chain: + # Point SSLCertificateChainFile at a file containing the + # concatenation of PEM encoded CA certificates which form the + # certificate chain for the server certificate. Alternatively + # the referenced file can be the same as SSLCertificateFile + # when the CA certificates are directly appended to the server + # certificate for convinience. + #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt + + # Certificate Authority (CA): + # Set the CA certificate verification path where to find CA + # certificates for client authentication or alternatively one + # huge file containing all of them (file must be PEM encoded) + # Note: Inside SSLCACertificatePath you need hash symlinks + # to point to the certificate files. Use the provided + # Makefile to update the hash symlinks after changes. + #SSLCACertificatePath /etc/ssl/certs/ + #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt + + # Certificate Revocation Lists (CRL): + # Set the CA revocation path where to find CA CRLs for client + # authentication or alternatively one huge file containing all + # of them (file must be PEM encoded) + # Note: Inside SSLCARevocationPath you need hash symlinks + # to point to the certificate files. Use the provided + # Makefile to update the hash symlinks after changes. + #SSLCARevocationPath /etc/apache2/ssl.crl/ + #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl + + # Client Authentication (Type): + # Client certificate verification type and depth. Types are + # none, optional, require and optional_no_ca. Depth is a + # number which specifies how deeply to verify the certificate + # issuer chain before deciding the certificate is not valid. + #SSLVerifyClient require + #SSLVerifyDepth 10 + + # Access Control: + # With SSLRequire you can do per-directory access control based + # on arbitrary complex boolean expressions containing server + # variable checks and other lookup directives. The syntax is a + # mixture between C and Perl. See the mod_ssl documentation + # for more details. + # + #SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \ + # and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ + # and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \ + # and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \ + # and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \ + # or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/ + # + + # SSL Engine Options: + # Set various options for the SSL engine. + # o FakeBasicAuth: + # Translate the client X.509 into a Basic Authorisation. This means that + # the standard Auth/DBMAuth methods can be used for access control. The + # user name is the `one line' version of the client's X.509 certificate. + # Note that no password is obtained from the user. Every entry in the user + # file needs this password: `xxj31ZMTZzkVA'. + # o ExportCertData: + # This exports two additional environment variables: SSL_CLIENT_CERT and + # SSL_SERVER_CERT. These contain the PEM-encoded certificates of the + # server (always existing) and the client (only existing when client + # authentication is used). This can be used to import the certificates + # into CGI scripts. + # o StdEnvVars: + # This exports the standard SSL/TLS related `SSL_*' environment variables. + # Per default this exportation is switched off for performance reasons, + # because the extraction step is an expensive operation and is usually + # useless for serving static content. So one usually enables the + # exportation for CGI and SSI requests only. + # o StrictRequire: + # This denies access when "SSLRequireSSL" or "SSLRequire" applied even + # under a "Satisfy any" situation, i.e. when it applies access is denied + # and no other module can change it. + # o OptRenegotiate: + # This enables optimized SSL connection renegotiation handling when SSL + # directives are used in per-directory context. + #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire + + SSLOptions +StdEnvVars + + + SSLOptions +StdEnvVars + + + # SSL Protocol Adjustments: + # The safe and default but still SSL/TLS standard compliant shutdown + # approach is that mod_ssl sends the close notify alert but doesn't wait for + # the close notify alert from client. When you need a different shutdown + # approach you can use one of the following variables: + # o ssl-unclean-shutdown: + # This forces an unclean shutdown when the connection is closed, i.e. no + # SSL close notify alert is send or allowed to received. This violates + # the SSL/TLS standard but is needed for some brain-dead browsers. Use + # this when you receive I/O errors because of the standard approach where + # mod_ssl sends the close notify alert. + # o ssl-accurate-shutdown: + # This forces an accurate shutdown when the connection is closed, i.e. a + # SSL close notify alert is send and mod_ssl waits for the close notify + # alert of the client. This is 100% SSL/TLS standard compliant, but in + # practice often causes hanging connections with brain-dead browsers. Use + # this only for browsers where you know that their SSL implementation + # works correctly. + # Notice: Most problems of broken clients are also related to the HTTP + # keep-alive facility, so you usually additionally want to disable + # keep-alive for those clients, too. Use variable "nokeepalive" for this. + # Similarly, one has to force some clients to use HTTP/1.0 to workaround + # their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and + # "force-response-1.0" for this. + BrowserMatch ".*MSIE.*" \ + nokeepalive ssl-unclean-shutdown \ + downgrade-1.0 force-response-1.0 + + diff --git a/sites-available/alex b/sites-available/alex deleted file mode 100644 index 20d88be..0000000 --- a/sites-available/alex +++ /dev/null @@ -1,24 +0,0 @@ - - ServerName alex.mit.edu - ServerAlias adehnert.mit.edu - ServerAlias alex.dehnerts.com - ServerAlias alex.dehnert.arctic.org - Include sites-common/alex - - - - - ServerName alex.mit.edu - Include sites-common/alex - Include sites-common/ssl-common - SSLCertificateFile /etc/ssl/certs/alex.mit.edu.pem - SSLCertificateKeyFile /etc/ssl/private/alex.mit.edu.key - - - ServerName adehnert.mit.edu - Include sites-common/alex - Include sites-common/ssl-common - SSLCertificateFile /etc/ssl/certs/adehnert.mit.edu.web.pem - SSLCertificateKeyFile /etc/ssl/private/adehnert.mit.edu.web.key - - diff --git a/sites-available/alex.conf b/sites-available/alex.conf new file mode 100644 index 0000000..20d88be --- /dev/null +++ b/sites-available/alex.conf @@ -0,0 +1,24 @@ + + ServerName alex.mit.edu + ServerAlias adehnert.mit.edu + ServerAlias alex.dehnerts.com + ServerAlias alex.dehnert.arctic.org + Include sites-common/alex + + + + + ServerName alex.mit.edu + Include sites-common/alex + Include sites-common/ssl-common + SSLCertificateFile /etc/ssl/certs/alex.mit.edu.pem + SSLCertificateKeyFile /etc/ssl/private/alex.mit.edu.key + + + ServerName adehnert.mit.edu + Include sites-common/alex + Include sites-common/ssl-common + SSLCertificateFile /etc/ssl/certs/adehnert.mit.edu.web.pem + SSLCertificateKeyFile /etc/ssl/private/adehnert.mit.edu.web.key + + diff --git a/sites-available/docs.mit.edu b/sites-available/docs.mit.edu deleted file mode 100644 index 54ac389..0000000 --- a/sites-available/docs.mit.edu +++ /dev/null @@ -1,14 +0,0 @@ - - ServerName docs.mit.edu - Include sites-common/docs.mit.edu - - - -# -# ServerName docs.mit.edu -# Include sites-common/docs.mit.edu -# Include sites-common/ssl-common -# SSLCertificateFile /etc/ssl/certs/alex.mit.edu.pem -# SSLCertificateKeyFile /etc/ssl/private/alex.mit.edu.key -# - diff --git a/sites-available/docs.mit.edu.conf b/sites-available/docs.mit.edu.conf new file mode 100644 index 0000000..54ac389 --- /dev/null +++ b/sites-available/docs.mit.edu.conf @@ -0,0 +1,14 @@ + + ServerName docs.mit.edu + Include sites-common/docs.mit.edu + + + +# +# ServerName docs.mit.edu +# Include sites-common/docs.mit.edu +# Include sites-common/ssl-common +# SSLCertificateFile /etc/ssl/certs/alex.mit.edu.pem +# SSLCertificateKeyFile /etc/ssl/private/alex.mit.edu.key +# + diff --git a/sites-available/roost b/sites-available/roost deleted file mode 100644 index 71347a6..0000000 --- a/sites-available/roost +++ /dev/null @@ -1,15 +0,0 @@ - - ServerName roost.dehnerts.com - Include sites-common/roost - - - - - ServerName roost.dehnerts.com - Include sites-common/roost - Include sites-common/ssl-common - SSLCertificateFile /etc/ssl/certs/roost.crt - SSLCertificateChainFile /etc/ssl/certs/roost.crt - SSLCertificateKeyFile /etc/ssl/private/roost.key - - diff --git a/sites-available/roost.conf b/sites-available/roost.conf new file mode 100644 index 0000000..71347a6 --- /dev/null +++ b/sites-available/roost.conf @@ -0,0 +1,15 @@ + + ServerName roost.dehnerts.com + Include sites-common/roost + + + + + ServerName roost.dehnerts.com + Include sites-common/roost + Include sites-common/ssl-common + SSLCertificateFile /etc/ssl/certs/roost.crt + SSLCertificateChainFile /etc/ssl/certs/roost.crt + SSLCertificateKeyFile /etc/ssl/private/roost.key + + diff --git a/sites-enabled/acc-858-test b/sites-enabled/acc-858-test deleted file mode 120000 index 135b672..0000000 --- a/sites-enabled/acc-858-test +++ /dev/null @@ -1 +0,0 @@ -../sites-available/acc-858-test \ No newline at end of file diff --git a/sites-enabled/acc-858-test.conf b/sites-enabled/acc-858-test.conf new file mode 120000 index 0000000..60b31ef --- /dev/null +++ b/sites-enabled/acc-858-test.conf @@ -0,0 +1 @@ +../sites-available/acc-858-test.conf \ No newline at end of file diff --git a/sites-enabled/alex b/sites-enabled/alex deleted file mode 120000 index c3cb0f1..0000000 --- a/sites-enabled/alex +++ /dev/null @@ -1 +0,0 @@ -../sites-available/alex \ No newline at end of file diff --git a/sites-enabled/alex.conf b/sites-enabled/alex.conf new file mode 120000 index 0000000..9c0169a --- /dev/null +++ b/sites-enabled/alex.conf @@ -0,0 +1 @@ +../sites-available/alex.conf \ No newline at end of file diff --git a/sites-enabled/docs.mit.edu b/sites-enabled/docs.mit.edu deleted file mode 120000 index 475226a..0000000 --- a/sites-enabled/docs.mit.edu +++ /dev/null @@ -1 +0,0 @@ -../sites-available/docs.mit.edu \ No newline at end of file diff --git a/sites-enabled/docs.mit.edu.conf b/sites-enabled/docs.mit.edu.conf new file mode 120000 index 0000000..03a68a0 --- /dev/null +++ b/sites-enabled/docs.mit.edu.conf @@ -0,0 +1 @@ +../sites-available/docs.mit.edu.conf \ No newline at end of file diff --git a/sites-enabled/roost b/sites-enabled/roost deleted file mode 120000 index bbc4b37..0000000 --- a/sites-enabled/roost +++ /dev/null @@ -1 +0,0 @@ -../sites-available/roost \ No newline at end of file diff --git a/sites-enabled/roost.conf b/sites-enabled/roost.conf new file mode 120000 index 0000000..ff1ab94 --- /dev/null +++ b/sites-enabled/roost.conf @@ -0,0 +1 @@ +../sites-available/roost.conf \ No newline at end of file