[Memo2016][ITPASS]Apache のインストールと設定

Apache のインストールと設定

最新バージョンの状況に合わせて作業内容を見直しながら行う.

ビルドのための設定

  • ソースを取得・展開した.

    ※ 2016 年 10 月 31 日時点の最新バージョンは 2.4.23 である.

    # cd /usr/local/src
    # wget 'http://ftp.tsukuba.wide.ad.jp/software/apache//httpd/httpd-2.4.23.tar.gz'
    # tar xvfz httpd-2.4.23.tar.gz
    # cd httpd-2.4.23
  • configure を行った.
    • インストール先と configure の際につけるオプションは以下の通りである.
      • インストール先
        • /usr/local/apache2 (apache2 のデフォルト)
          • configure の際に --prefix の設定は不要
    • configure オプション (: 目的)
      • --enable-ssl (: apache-ssl を動作させるため)
      • --enable-rewrite (: mod_rewrite を使用するため)
        • gate の登録窓口を http から https へ移動させたい
      • --enable-so (: DSO (Dynamic shared object: 動的共有オブジェクト) を使用するため)
      • --with-included-apr (: ビルド時に "Cannot use an external APR-util with the bundled APR" とエラーが生じる場合があるため)
      • apache2.4.x では apr と apr-util を別途用意する必要が有るため, <URL: http://apr.apache.org/download.cgi/> から最新版を取得し, 展開する. (参照: <URL: http://weblabo.oscasierra.net/install-apache24-1/>)
  • はじめ失敗し, ファイルを削除したが二回目で成功した.

    $ sudo wget 'http://ftp.jaist.ac.jp/pub/apache/apr/apr-1.5.2.tar.gz'
    $ sudo rm -rf apr-1.5.2.tar.gz
    
    $ cd
    $ wget http://ftp.jaist.ac.jp/pub/apache/apr/apr-1.5.2.tar.gz
    $ sudo mv apr-1.5.2.ta.gz /usr/local
    $ cd /usr/local
    $ sudo tar xzf apr-1.5.2.tar.gz
    
    $ cd apr-1.5.2
    $ sudo ./configure
    $ sudo vi configure
    $ sudo ./configure
    
    $ sudo make
    $ sudo make install
    
    $ cd
    $ wget http://ftp.jaist.ac.jp/pub/apache/apr/apr-util-1.5.4.tar.gz
    $ sudo mv apr-util-1.5.4.tar.gz /usr/local
    $ sudo tar xzf apr-util-1.5.4.tar.gz 
    $ cd apr-util-1.5.4
    $ sudo ./configure --with-apr=/usr/local/apr
    $ sudo make
    $ sudo make install
    • PCRE をインストールした.
    $ sudo apt-get install libpcre3 libpcre3-dev
    • configure を行った.
    $ sudo ./configure --enable-ssl --enable-rewrite --enable-so --with-apr=/usr/local/apr
    • configure の結果は config.log を参照し, 問題ないか確認した.

ビルドとインストール

# make
# make install
  • /usr/local/apache2 の下に以下のディレクトリが作成されていることを確認した.
XXXX@xxx-itpass:/usr/local/apache2$ ls
bin  build  cgi-bin  conf  error  htdocs  icons  include  logs  man  manual  modules

実行ファイルへのパスの設定

  • インストールされた Apache のバイナリファイル群へパスを通した.
    • [ITPASS2015]パスの設定 <一般ユーザ用コマンドのパス> <システム管理用コマンドのパス> の両方に /usr/local/apache2/bin を追加した. (システム管理用コマンドも一般ユーザ用コマンドと同じ場所にインストールされているため, システム管理用コマンドの設定を別途行う必要は無い).
    • 具体的には, 以下のようにした.
      • /etc/bash.bashrc の冒頭に

        # add PATH for local installed softwares
        PATH="${PATH}:/usr/local/apache2/bin"
        # add PATH for local installed softwares (for root)
        if [ "`id -u`" -eq 0 ]; then
        PATH="${PATH}:/usr/local/apache2/bin"
        fi 
        export PATH

        を追加した.

      • /etc/csh.cshrc の冒頭に

        # add PATH for local installed softwares
        set path = ($path /usr/local/bin /usr/bin /bin /usr/local/apache2/bin) 
        # add PATH for local installed softwares (for root)
        if ( "`id -u`" == 0 ) then
        set path = ($path /usr/local/sbin /usr/sbin /sbin /usr/local/apache2/bin)
        endif

        を追加した.

      • /etc/zsh/zshenv に

        # add PATH for local installed softwares
        export PATH="$PATH:/usr/local/apache2/bin”
        # add PATH for local installed softwares (for root)
        if [ "`id -u`" -eq 0 ]; then
          export PATH="$PATH:/usr/local/apache2/bin”
        fi
        # delete duplicated path setting
        typeset -U path 

        の記述を追加した.

マニュアルへのパスの設定

  • インストールされた Apache のマニュアル群へパスを通した.
    • /etc/manpath.config に以下の行を追加した. 詳しくは [ITPASS2015]パスの設定#man 関連のパスの設定 を参照.

      MANDATORY_MANPATH                          /usr/local/apache2/man
      MANPATH_MAP        /usr/local/apache2/bin  /usr/local/apache2/man
      MANDB_MAP          /usr/local/apache2/man  /usr/local/apache2/man

モジュールの確認, 追加

  • インストールした apache2 で有効になっているモジュールを確認した.

    # /usr/local/apache2/bin/apachectl -t -D DUMP_MODULES
    • 結果, 以下の3つが最低限有効になっているかを確認する.
      • ssl_module
      • rewrite_module
      • userdir_module
  • 有効になっていなかったので, 以下のように対処した.
    • DSO(Dynamic Shared Object) を有効にしているので (configure 時に --enable-so をつけた), モジュールを追加した.
      • mod_rewrite

        # cd /usr/local/src/httpd-2.4.23/modules/mappers
        # apxs -c mod_rewrite.c
        # apxs -i -a -n rewrite mod_rewrite.la
      • mod_ssl

        # cd /usr/local/src/httpd-2.4.23/modules/ssl
        # apxs -c mod_ssl.c
        # apxs -i -a -c -I /usr/include/openssl -D HAVE_OPENSSL=1 -lcrypto -lssl *.c
      • mod_userdir

        # cd /usr/local/src/httpd-2.4.23/modules/mappers
        # apxs -c mod_userdir.c
        # apxs -i -a -n rewrite mod_userdir.la

設定ファイルの編集

各種設定ファイルは以下のとおり.

  • httpd 用
    • /usr/local/apache2/conf/httpd.conf
  • httpd-ssl
    • /usr/local/apache2/conf/extra/httpd-ssl.conf
  • 各ユーザの public_html 以下の設定用
    • /usr/local/apache2/conf/extra/httpd-userdir.conf

変更の要点は以下の通りである(以下は変更点の概要であり, 実際に行う作業はこのあとに記述).

  • httpd.conf
    • HTTP デーモンを起動するユーザを www-data にする
    • サーバ管理者 (ServerAdmin) のメールアドレスを設定
    • サーバ名 (ServerName) を設定
    • サーバのデフォルトルート (DefaultRoot) を /~itpass に設定
    • ディレクトリのインデックスファイルに index.html 以外に index.htm index.htm.en index.html.en index.htm.ja index.html.ja も追加.
    • エラーログファイルを /var/log/httpd-error.log に設定
    • アクセスログファイルを /var/log/httpd-access.log に設定
    • CGI に関する設定を変更
    • extra/httpd-vhosts.confをロード
    • extra/httpd-userdir.conf をロード
    • extra/httpd-ssl.conf をロード
    • /~gate, および /cgi-bin に対するアクセスを HTTPS へ移動させる.
    • hiki.cgi の置かれた場所で設定したすべての設定値の変更を, 下位のディレクトリで変更できるようにする.
    • hiki-IPtable 以外では, mod_negotiation によるコンテントネゴシエーションされた "MultiViews" を許可する.
  • httpd-vhosts.conf
    • {epa,aoe}.scitec.kobe-u.ac.jp 宛の接続を受ける (virtual host)
      • ドキュメントルートは /home/{epalab,aoelab}/public_html にする
      • 管理者メールアドレスは itpadmin _at_ ... にする
      • http://{epa,aoe}.scitec.kobe-u.ac.jp/~gate/ 以下に対するアクセスを https://itpass.scitec.kobe-u.ac.jp/~gate に移動させる
    • http://itpass.scitec.kobe-u.ac.jp/{/hiki,/~epalab/hiki,/~itpass/hiki} に対するアクセスのみ HTTPS へ移動させる. その際, URI のエンコードは行わない.
  • httpd-userdir.conf
    • 所有者がマッチしなくてもシンボリックリンクの公開を許可する.
  • httpd-ssl.conf
    • ドキュメントルート (DocumentRoot), サーバ名 (ServerName), サーバ管理者アドレス (ServerAdmin), エラーログ (ErrorLog), アクセスログ (TransferLog) を設定する
    • epa.scitec, aoe.scitec の場合の https 接続を設定する

オリジナルとの diff

httpd.conf

chikuwa2@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/httpd.conf httpd.conf
--- original/httpd.conf      2016-11-01 18:41:53.577018744 +0900
+++ httpd.conf       2016-11-01 21:53:34.185236632 +0900
@@ -128,7 +128,7 @@
 #LoadModule session_cookie_module modules/mod_session_cookie.so
 #LoadModule session_dbd_module modules/mod_session_dbd.so
 #LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
-#LoadModule ssl_module modules/mod_ssl.so
+LoadModule ssl_module         modules/mod_ssl.so
 #LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
 #LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
 #LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
@@ -147,7 +147,8 @@
 #LoadModule speling_module modules/mod_speling.so
 #LoadModule userdir_module modules/mod_userdir.so
 LoadModule alias_module modules/mod_alias.so
-#LoadModule rewrite_module modules/mod_rewrite.so
+LoadModule rewrite_module     modules/mod_rewrite.so
+LoadModule rewrite_module     modules/mod_userdir.so

 <IfModule unixd_module>
 #
@@ -158,8 +159,8 @@
 # It is usually good practice to create a dedicated user and group for
 # running httpd, as with most system services.
 #
-User daemon
-Group daemon
+User www-data
+Group www-data

 </IfModule>

@@ -180,7 +181,7 @@
 # e-mailed.  This address appears on some server-generated pages, such
 # as error documents.  e.g. admin@your-domain.com
 #
-ServerAdmin you@example.com
+ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp

 #
 # ServerName gives the name and port that the server uses to identify itself.
@@ -189,7 +190,7 @@
 #
 # If your host doesn't have a registered DNS name, enter its IP address here.
 #
-#ServerName www.example.com:80
+ServerName itpass.scitec.kobe-u.ac.jp:80

 #
 # Deny access to the entirety of your server's filesystem. You must
@@ -213,8 +214,8 @@
 # documents. By default, all requests are taken from this directory, but
 # symbolic links and aliases may be used to point to other locations.
 #
-DocumentRoot "/usr/local/apache2/htdocs"
-<Directory "/usr/local/apache2/htdocs">
+DocumentRoot "/home/itpass/public_html"
+<Directory "/home/itpass/public_html">
     #
     # Possible values for the Options directive are "None", "All",
     # or any combination of:
@@ -247,7 +248,7 @@
 # is requested.
 #
 <IfModule dir_module>
-    DirectoryIndex index.html
+    DirectoryIndex index.htm index.htm.en index.html.en index.htm.ja index.html.ja
 </IfModule>

 #
@@ -265,7 +266,7 @@
 # logged here.  If you *do* define an error logfile for a <VirtualHost>
 # container, that host's errors will be logged there and not here.
 #
-ErrorLog "logs/error_log"
+ErrorLog "/var/log/httpd-error.log"

 #
 # LogLevel: Control the number of messages logged to the error_log.
@@ -294,7 +295,7 @@
     # define per-<VirtualHost> access logfiles, transactions will be
     # logged therein and *not* in this file.
     #
-    CustomLog "logs/access_log" common
+    # Customlog "logs/access_log" common

     #
     # If you prefer a logfile with access, agent, and referer information
@@ -339,7 +340,7 @@
     # ScriptSock: On threaded servers, designate the path to the UNIX
     # socket used to communicate with the CGI daemon of mod_cgid.
     #
-    #Scriptsock cgisock
+    Scriptsock cgisock
 </IfModule>

 #
@@ -347,8 +348,8 @@
 # CGI directory exists, if you have that configured.
 #
 <Directory "/usr/local/apache2/cgi-bin">
-    AllowOverride None
-    Options None
+    AllowOverride AuthConfig Limit
+    Options +ExecCGI +FollowSymLinks +IncludesNoExec
     Require all granted
 </Directory>

@@ -385,7 +386,7 @@
     # To use CGI scripts outside of ScriptAliased directories:
     # (You will also need to add "ExecCGI" to the "Options" directive.)
     #
-    #AddHandler cgi-script .cgi
+    AddHandler cgi-script .cgi

     # For type maps (negotiated resources):
     #AddHandler type-map var
@@ -457,13 +458,13 @@
 #Include conf/extra/httpd-languages.conf

 # User home directories
-#Include conf/extra/httpd-userdir.conf
+Include conf/extra/httpd-userdir.conf

 # Real-time info on requests and configuration
 #Include conf/extra/httpd-info.conf

 # Virtual hosts
-#Include conf/extra/httpd-vhosts.conf
+Include conf/extra/httpd-vhosts.conf

 # Local access to the Apache HTTP Server Manual
 #Include conf/extra/httpd-manual.conf
@@ -480,7 +481,7 @@
 </IfModule>

 # Secure (SSL/TLS) connections
-#Include conf/extra/httpd-ssl.conf
+Include conf/extra/httpd-ssl.conf
 #
 # Note: The following must must be present to support
 #       starting without SSL on platforms with no /dev/random equivalent
@@ -491,3 +492,43 @@
 SSLRandomSeed connect builtin
 </IfModule>

+ #
+# Setting for Hiki Area
+#
+<Directory "/home/epalab/public_html/hiki">
+ AllowOverride ALL
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/itpass/public_html/hiki">
+ AllowOverride ALL
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/itpass/public_html/hiki-secret">
+ AllowOverride ALL
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/uwabami/public_html/hiki">
+ AllowOverride FileInfo AuthConfig Limit Indexes Options=ExecCGI,FollowSymlinks
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/bldg3/public_html/hiki">
+ AllowOverride ALL
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/fourtran/public_html/hiki">
+ AllowOverride FileInfo AuthConfig Limit Indexes Options=ExecCGI,FollowSymlinks
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/itpass/public_html/hiki-IPtable">
+ AllowOverride ALL
+</Directory>
+
+ # uncomment out the below to deal with user agents that deliberately
+ # violate open standerds by misusing DNT (DNT *must* be a specific
+ # end-user choice)

extra/httpd-ssl.conf

chikuwa2@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/extra/httpd-ssl.conf extra/httpd-ssl.conf
--- original/extra/httpd-ssl.conf    2016-11-01 18:41:53.653018746 +0900
+++ extra/httpd-ssl.conf     2016-11-01 22:58:19.017310233 +0900
@@ -49,8 +49,9 @@
 #   ensure these follow appropriate best practices for this deployment.
 #   httpd 2.2.30, 2.4.13 and later force-disable aNULL, eNULL and EXP ciphers,
 #   while OpenSSL disabled these by default in 0.9.8zf/1.0.0r/1.0.1m/1.0.2a.
-SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
-SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4
+#SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
+SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
+ SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4

 #  By the end of 2016, only TLSv1.2 ciphers should remain in use.
 #  Older ciphers should be disallowed as soon as possible, while the
@@ -69,7 +70,8 @@
 #   own preference of either security or performance, therefore this
 #   must be the prerogative of the web server administrator who manages
 #   cpu load versus confidentiality, so enforce the server's cipher order.
-SSLHonorCipherOrder on
+SSLHonorCipherOrder on
+SSLCompression Off

 #   SSL Protocol support:
 #   List the protocol versions which clients are allowed to connect with.
@@ -89,7 +91,7 @@
 #   Configure the SSL Session Cache: First the mechanism
 #   to use and second the expiring timeout (in seconds).
 #SSLSessionCache         "dbm:/usr/local/apache2/logs/ssl_scache"
-SSLSessionCache        "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
+#SSLSessionCache "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
 SSLSessionCacheTimeout  300

 #   OCSP Stapling (requires OpenSSL 0.9.8h or later)
@@ -107,7 +109,6 @@
 #   above.  If stapling is used with more than a few certificates,
 #   the size may need to be increased.  (AH01929 will be logged.)
 #SSLStaplingCache "shmcb:/usr/local/apache2/logs/ssl_stapling(32768)"
-
 #   Seconds before valid OCSP responses are expired from the cache
 #SSLStaplingStandardCacheTimeout 3600

@@ -118,18 +119,20 @@
 ## SSL Virtual Host Context
 ##

-<VirtualHost _default_:443>
+# NameVirtualHost *:433
+<VirtualHost *:443>
 #   General setup for the virtual host
-DocumentRoot "/usr/local/apache2/htdocs"
-ServerName www.example.com:443
-ServerAdmin you@example.com
-ErrorLog "/usr/local/apache2/logs/error_log"
-TransferLog "/usr/local/apache2/logs/access_log"
+DocumentRoot "/home/itpass/public_html"
+ServerName itpass.scitec.kobe-u.ac.jp:443
+ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+ErrorLog "/var/log/httpd-ssl-error.log"
+TransferLog "/var/log/httpd-ssl-access.log"

 #   SSL Engine Switch:
 #   Enable/Disable SSL for this virtual host.
 SSLEngine on
+SSLProtocol all -SSLv2 -SSLv3

 #   Server Certificate:
 #   Point SSLCertificateFile at a PEM encoded certificate.  If
@@ -141,7 +144,7 @@
 #   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
 #   require an ECC certificate which can also be configured in
 #   parallel.
-SSLCertificateFile "/usr/local/apache2/conf/server.crt"
+SSLCertificateFile "/usr/local/apache2/conf/ca/itpass/itpass.crt"
 #SSLCertificateFile "/usr/local/apache2/conf/server-dsa.crt"
 #SSLCertificateFile "/usr/local/apache2/conf/server-ecc.crt"

@@ -151,7 +154,7 @@
 #   you've both a RSA and a DSA private key you can configure
 #   both in parallel (to also allow the use of DSA ciphers, etc.)
 #   ECC keys, when in use, can also be configured in parallel
-SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
+SSLCertificateKeyFile "/usr/local/apache2/conf/ca/itpass/itpass.key"
 #SSLCertificateKeyFile "/usr/local/apache2/conf/server-dsa.key"
 #SSLCertificateKeyFile "/usr/local/apache2/conf/server-ecc.key"

@@ -162,7 +165,7 @@
 #   the referenced file can be the same as SSLCertificateFile
 #   when the CA certificates are directly appended to the server
 #   certificate for convenience.
-#SSLCertificateChainFile "/usr/local/apache2/conf/server-ca.crt"
+#SSLCertificateChainFile "/usr/local/apache2/conf/server.crt"

 #   Certificate Authority (CA):
 #   Set the CA certificate verification path where to find CA
@@ -287,4 +290,38 @@
 CustomLog "/usr/local/apache2/logs/ssl_request_log" \
           "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

-</VirtualHost>
+</VirtualHost>
+
+<VirtualHost *:443>
+DocumentRoot "/home/aoelab/public_html"
+ServerName aoe.scitec.kobe-u.ac.jp:443
+ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+ErrorLog /var/log/httpd-ssl-error.log
+TransferLog /var/log/httpd-ssl-access.log
+SSLEngine on
+#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:!SSLv2:!SSLv3:+EXP:+eNULL
+SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
+SSLCertificateFile "/usr/local/apache2/conf/ca/aoe/aoe.crt"
+SSLCertificateKeyFile "/usr/local/apache2/conf/ca/aoe/aoe.key"
+SSLProtocol all -SSLv2 -SSLv3
+SSLHonorCipherOrder On
+SSLCompression Off
+</VirtualHost>
+
+<VirtualHost *:443>
+DocumentRoot "/home/epalab/public_html"
+ServerName epa.scitec.kobe-u.ac.jp:443
+ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+ErrorLog /var/log/httpd-ssl-error.log
+TransferLog /var/log/httpd-ssl-access.log
+SSLEngine on
+#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:!SSLv2:!SSLv3:+EXP:+eNULL
+SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
+SSLCertificateFile "/usr/local/apache2/conf/ca/epa/epa.crt"
+SSLCertificateKeyFile "/usr/local/apache2/conf/ca/epa/epa.key"
+SSLProtocol all -SSLv2 -SSLv3
+SSLHonorCipherOrder On
+SSLCompression Off
+</VirtualHost>
+
+

ビルドのための設定(二回目)

  • apr のインストール

    $ cd apr-1.5.2
    $ sudo ./configure
    $ sudo vi configure
    $ sudo ./configure
    
    $ sudo make
    $ sudo make install
  • configure を行った.

    $ cd /usr/local/src/httpd-2.4.23
    $ sudo ./configure --enable-ssl --enable-rewrite --enable-so --with-apr=/usr/local/apr
    • configure の結果は config.log を参照し, 問題ないか確認した.

ビルドとインストール(二回目)

# make
# make install
  • /usr/local/apache2 の下に以下のディレクトリが作成されていることを確認した.
XXXX@xxx-itpass:/usr/local/apache2$ ls
bin  build  cgi-bin  conf  error  htdocs  icons  include  logs  man  manual  modules

モジュールの確認, 追加(二回目)

  • インストールした apache2 で有効になっているモジュールを確認した.

    • エラーメッセージがでた
    root@tako-itpass:/usr/local/apache2/conf# /usr/local/apache2/bin/apachectl -t -D DUMP_MODULES 
    [Wed Nov 02 11:57:03.420198 2016] [so:warn] [pid 2061:tid 139820495034112] AH01574: module rewrite_module is already loaded, skipping
    AH00526: Syntax error on line 217 of /usr/local/apache2/conf/httpd.conf:
    DocumentRoot '/home/itpass/public_html' is not a directory, or is not readable
  • 一回目に編集したファイル /usr/local/apache2/conf/httpd.conf, /usr/local/apache2/conf/extra/httpd-ssl.conf, /usr/local/apache2/conf/extra/httpd-userdir.conf, /usr/local/apache2/conf/extra/httpd-vhosts.conf を元に戻して以下を実行した.

    # /usr/local/apache2/bin/apachectl -t -D DUMP_MODULES
    • 結果, 以下の3つが最低限有効になっているかを確認した.
      • ssl_module
      • rewrite_module
      • userdir_module
  • 有効になっていなかったので, 以下のように対処した.
    • DSO(Dynamic Shared Object) を有効にしているので (configure 時に --enable-so をつけた), モジュールを追加した.
      • mod_rewrite

        # cd /usr/local/src/httpd-2.4.23/modules/mappers
        # apxs -c mod_rewrite.c
        # apxs -i -a -n rewrite mod_rewrite.la
      • mod_ssl

        # cd /usr/local/src/httpd-2.4.23/modules/ssl
        # apxs -c mod_ssl.c
        # apxs -i -a -c -I /usr/include/openssl -D HAVE_OPENSSL=1 -lcrypto -lssl *.c
      • mod_userdir

        # cd /usr/local/src/httpd-2.4.23/modules/mappers
        # apxs -c mod_userdir.c
        # apxs -i -a -n rewrite mod_userdir.la

設定ファイルの編集(二回目)

各種設定ファイルは以下のとおり.

  • httpd 用
    • /usr/local/apache2/conf/httpd.conf
  • httpd-ssl
    • /usr/local/apache2/conf/extra/httpd-ssl.conf
  • 各ユーザの public_html 以下の設定用
    • /usr/local/apache2/conf/extra/httpd-userdir.conf

変更の要点は以下の通りである(以下は変更点の概要であり, 実際に行う作業はこのあとに記述).

  • httpd.conf
    • HTTP デーモンを起動するユーザを www-data にする
    • サーバ管理者 (ServerAdmin) のメールアドレスを設定
    • サーバ名 (ServerName) を設定
    • サーバのデフォルトルート (DefaultRoot) を /~itpass に設定
    • ディレクトリのインデックスファイルに index.html 以外に index.htm index.htm.en index.html.en index.htm.ja index.html.ja も追加.
    • エラーログファイルを /var/log/httpd-error.log に設定
    • アクセスログファイルを /var/log/httpd-access.log に設定
    • CGI に関する設定を変更
    • extra/httpd-vhosts.confをロード
    • extra/httpd-userdir.conf をロード
    • extra/httpd-ssl.conf をロード
    • /~gate, および /cgi-bin に対するアクセスを HTTPS へ移動させる.
    • hiki.cgi の置かれた場所で設定したすべての設定値の変更を, 下位のディレクトリで変更できるようにする.
    • hiki-IPtable 以外では, mod_negotiation によるコンテントネゴシエーションされた "MultiViews" を許可する.
  • httpd-vhosts.conf
    • {epa,aoe}.scitec.kobe-u.ac.jp 宛の接続を受ける (virtual host)
      • ドキュメントルートは /home/{epalab,aoelab}/public_html にする
      • 管理者メールアドレスは itpadmin _at_ ... にする
      • http://{epa,aoe}.scitec.kobe-u.ac.jp/~gate/ 以下に対するアクセスを https://itpass.scitec.kobe-u.ac.jp/~gate に移動させる
    • http://itpass.scitec.kobe-u.ac.jp/{/hiki,/~epalab/hiki,/~itpass/hiki} に対するアクセスのみ HTTPS へ移動させる. その際, URI のエンコードは行わない.
  • httpd-userdir.conf
    • 所有者がマッチしなくてもシンボリックリンクの公開を許可する.
  • httpd-ssl.conf
    • ドキュメントルート (DocumentRoot), サーバ名 (ServerName), サーバ管理者アドレス (ServerAdmin), エラーログ (ErrorLog), アクセスログ (TransferLog) を設定する
    • epa.scitec, aoe.scitec の場合の https 接続を設定する

オリジナルとの diff(二回目)

httpd.conf(二回目)

chikuwa2@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/httpd.conf httpd.conf
 --- original/httpd.conf 2016-11-02 11:31:35.304212645 +0900
 +++ httpd.conf  2016-11-11 19:45:31.122670234 +0900
 @@ -16,7 +16,6 @@
  # with "/", the value of ServerRoot is prepended -- so "logs/access_log"
  # with ServerRoot set to "/usr/local/apache2" will be interpreted by the
  # server as "/usr/local/apache2/logs/access_log", whereas "/logs/access_log"
 -# will be interpreted as '/logs/access_log'.

  #
  # ServerRoot: The top of the directory tree under which the server's
 @@ -128,7 +127,7 @@
  #LoadModule session_cookie_module modules/mod_session_cookie.so
  #LoadModule session_dbd_module modules/mod_session_dbd.so
  #LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
 -#LoadModule ssl_module modules/mod_ssl.so
 +LoadModule ssl_module         modules/mod_ssl.so
  #LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
  #LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
  #LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
 @@ -138,16 +137,17 @@
  LoadModule status_module modules/mod_status.so
  LoadModule autoindex_module modules/mod_autoindex.so
  #LoadModule info_module modules/mod_info.so
 -#LoadModule cgid_module modules/mod_cgid.so
 +LoadModule cgid_module modules/mod_cgid.so
  #LoadModule dav_fs_module modules/mod_dav_fs.so
  #LoadModule vhost_alias_module modules/mod_vhost_alias.so
  #LoadModule negotiation_module modules/mod_negotiation.so
  LoadModule dir_module modules/mod_dir.so
  #LoadModule actions_module modules/mod_actions.so
  #LoadModule speling_module modules/mod_speling.so
 -#LoadModule userdir_module modules/mod_userdir.so
 +LoadModule userdir_module modules/mod_userdir.so
  LoadModule alias_module modules/mod_alias.so
 -#LoadModule rewrite_module modules/mod_rewrite.so
 +LoadModule rewrite_module     modules/mod_rewrite.so
 +# LoadModule rewrite_module     modules/mod_userdir.so

  <IfModule unixd_module>
  #
 @@ -158,8 +158,8 @@
  # It is usually good practice to create a dedicated user and group for
  # running httpd, as with most system services.
  #
 -User daemon
 -Group daemon
 +User www-data
 +Group www-data

  </IfModule>

 @@ -180,7 +180,7 @@
  # e-mailed.  This address appears on some server-generated pages, such
  # as error documents.  e.g. admin@your-domain.com
  #
 -ServerAdmin you@example.com
 +ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp   

  #
  # ServerName gives the name and port that the server uses to identify itself.
 @@ -189,7 +189,7 @@
  #
  # If your host doesn't have a registered DNS name, enter its IP address here.
  #
 -#ServerName www.example.com:80
 +ServerName itpass.scitec.kobe-u.ac.jp:80

  #
  # Deny access to the entirety of your server's filesystem. You must
 @@ -213,8 +213,8 @@
  # documents. By default, all requests are taken from this directory, but
  # symbolic links and aliases may be used to point to other locations.
  #
 -DocumentRoot "/usr/local/apache2/htdocs"
 -<Directory "/usr/local/apache2/htdocs">
 +DocumentRoot "/home/itpass/public_html"
 +<Directory "/home/itpass/public_html">
      #
      # Possible values for the Options directive are "None", "All",
      # or any combination of:
 @@ -246,9 +246,9 @@
  # DirectoryIndex: sets the file that Apache will serve if a directory
  # is requested.
  #
 -<IfModule dir_module>
 -    DirectoryIndex index.html
 -</IfModule>
 +# <IfModule dir_module>
 +    DirectoryIndex index.html index.htm index.htm.en index.html.en index.htm.ja index.html.ja
 +# </IfModule>

  #
  # The following lines prevent .htaccess and .htpasswd files from being
 @@ -265,7 +265,7 @@
  # logged here.  If you *do* define an error logfile for a <VirtualHost>
  # container, that host's errors will be logged there and not here.
  #
 -ErrorLog "logs/error_log"
 +ErrorLog "/var/log/httpd-error.log"

  #
  # LogLevel: Control the number of messages logged to the error_log.
 @@ -294,7 +294,7 @@
      # define per-<VirtualHost> access logfiles, transactions will be
      # logged therein and *not* in this file.
      #
 -    CustomLog "logs/access_log" common
 +    # Customlog "logs/access_log" common

      #
      # If you prefer a logfile with access, agent, and referer information
 @@ -339,7 +339,7 @@
      # ScriptSock: On threaded servers, designate the path to the UNIX
      # socket used to communicate with the CGI daemon of mod_cgid.
      #
 -    #Scriptsock cgisock
 +    Scriptsock cgisock
  </IfModule>

  #
 @@ -347,8 +347,8 @@
  # CGI directory exists, if you have that configured.
  #
  <Directory "/usr/local/apache2/cgi-bin">
 -    AllowOverride None
 -    Options None
 +    AllowOverride AuthConfig Limit
 +    Options +ExecCGI +FollowSymLinks +IncludesNoExec
      Require all granted
  </Directory>

 @@ -385,7 +385,7 @@
      # To use CGI scripts outside of ScriptAliased directories:
      # (You will also need to add "ExecCGI" to the "Options" directive.)
      #
 -    #AddHandler cgi-script .cgi
 +    AddHandler cgi-script .cgi

      # For type maps (negotiated resources):
      #AddHandler type-map var
 @@ -457,13 +457,13 @@
  #Include conf/extra/httpd-languages.conf

  # User home directories
 -#Include conf/extra/httpd-userdir.conf
 +Include conf/extra/httpd-userdir.conf

  # Real-time info on requests and configuration
  #Include conf/extra/httpd-info.conf

  # Virtual hosts
 -#Include conf/extra/httpd-vhosts.conf
 +Include conf/extra/httpd-vhosts.conf

  # Local access to the Apache HTTP Server Manual
  #Include conf/extra/httpd-manual.conf
 @@ -480,7 +480,7 @@
  </IfModule>

  # Secure (SSL/TLS) connections
 -#Include conf/extra/httpd-ssl.conf
 +Include conf/extra/httpd-ssl.conf
  #
  # Note: The following must must be present to support
  #       starting without SSL on platforms with no /dev/random equivalent
 @@ -491,3 +491,54 @@
  SSLRandomSeed connect builtin
  </IfModule>

 + #
 +# Setting for Hiki Area
 +#
 +<Directory "/home/epalab/public_html/hiki">
 + AllowOverride ALL
 + Options -MultiViews
 +</Directory>
 +
 +<Directory "/home/itpass/public_html/hiki">
 + AllowOverride ALL
 + Options -MultiViews
 +</Directory>
 +
 +<Directory "/home/chikuwa2/public_html/hiki">
 + AllowOverride ALL
 + Options -MultiViews
 +</Directory>
 +
 +<Directory "/home/chikuwa3/public_html/hiki">
 + AllowOverride ALL
 + Options -MultiViews
 +</Directory>
 +
 +
 +<Directory "/home/itpass/public_html/hiki-secret">
 + AllowOverride ALL
 + Options -MultiViews
 +</Directory>
 +
 +<Directory "/home/uwabami/public_html/hiki">
 + AllowOverride FileInfo AuthConfig Limit Indexes Options=ExecCGI,FollowSymlinks
 + Options -MultiViews
 +</Directory>
 +
 +<Directory "/home/bldg3/public_html/hiki">
 + AllowOverride ALL
 + Options -MultiViews
 +</Directory>
 +
 +<Directory "/home/fourtran/public_html/hiki">
 + AllowOverride FileInfo AuthConfig Limit Indexes Options=ExecCGI,FollowSymlinks
 + Options -MultiViews
 +</Directory>
 +
 +<Directory "/home/itpass/public_html/hiki-IPtable">
 + AllowOverride ALL
 +</Directory>
 +
 + # uncomment out the below to deal with user agents that deliberately
 + # violate open standerds by misusing DNT (DNT *must* be a specific
 + # end-user choice)

extra/httpd-ssl.conf(二回目)

chikuwa2@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/extra/httpd-
 ssl.conf extra/httpd-ssl.conf
 --- original/extra/httpd-ssl.conf       2016-11-02 11:31:35.376212647 +0900
 +++ extra/httpd-ssl.conf        2016-11-01 22:58:19.017310233 +0900
 @@ -49,8 +49,9 @@
  #   ensure these follow appropriate best practices for this deployment.
  #   httpd 2.2.30, 2.4.13 and later force-disable aNULL, eNULL and EXP ciphers,
  #   while OpenSSL disabled these by default in 0.9.8zf/1.0.0r/1.0.1m/1.0.2a.
 -SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
 -SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4
 +#SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
 +SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
 + SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4

  #  By the end of 2016, only TLSv1.2 ciphers should remain in use.
  #  Older ciphers should be disallowed as soon as possible, while the
 @@ -69,7 +70,8 @@
  #   own preference of either security or performance, therefore this
  #   must be the prerogative of the web server administrator who manages
  #   cpu load versus confidentiality, so enforce the server's cipher order.
 -SSLHonorCipherOrder on
 +SSLHonorCipherOrder on
 +SSLCompression Off

  #   SSL Protocol support:
  #   List the protocol versions which clients are allowed to connect with.
 @@ -89,7 +91,7 @@
  #   Configure the SSL Session Cache: First the mechanism
  #   to use and second the expiring timeout (in seconds).
  #SSLSessionCache         "dbm:/usr/local/apache2/logs/ssl_scache"
 -SSLSessionCache        "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
 +#SSLSessionCache "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
  SSLSessionCacheTimeout  300

  #   OCSP Stapling (requires OpenSSL 0.9.8h or later)
 @@ -107,7 +109,6 @@
  #   above.  If stapling is used with more than a few certificates,
  #   the size may need to be increased.  (AH01929 will be logged.)
  #SSLStaplingCache "shmcb:/usr/local/apache2/logs/ssl_stapling(32768)"
 -
  #   Seconds before valid OCSP responses are expired from the cache
  #SSLStaplingStandardCacheTimeout 3600

 @@ -118,18 +119,20 @@
  ## SSL Virtual Host Context
  ##
-<VirtualHost _default_:443>
 +# NameVirtualHost *:433
 +<VirtualHost *:443>

  #   General setup for the virtual host
 -DocumentRoot "/usr/local/apache2/htdocs"
 -ServerName www.example.com:443
 -ServerAdmin you@example.com
 -ErrorLog "/usr/local/apache2/logs/error_log"
 -TransferLog "/usr/local/apache2/logs/access_log"
 +DocumentRoot "/home/itpass/public_html"
 +ServerName itpass.scitec.kobe-u.ac.jp:443
 +ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
 +ErrorLog "/var/log/httpd-ssl-error.log"
 +TransferLog "/var/log/httpd-ssl-access.log"

  #   SSL Engine Switch:
  #   Enable/Disable SSL for this virtual host.
  SSLEngine on
 +SSLProtocol all -SSLv2 -SSLv3

  #   Server Certificate:
  #   Point SSLCertificateFile at a PEM encoded certificate.  If
 @@ -141,7 +144,7 @@
  #   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
  #   require an ECC certificate which can also be configured in
  #   parallel.
 -SSLCertificateFile "/usr/local/apache2/conf/server.crt"
 +SSLCertificateFile "/usr/local/apache2/conf/ca/itpass/itpass.crt"
  #SSLCertificateFile "/usr/local/apache2/conf/server-dsa.crt"
  #SSLCertificateFile "/usr/local/apache2/conf/server-ecc.crt"

 @@ -151,7 +154,7 @@
  #   you've both a RSA and a DSA private key you can configure
  #   both in parallel (to also allow the use of DSA ciphers, etc.)
  #   ECC keys, when in use, can also be configured in parallel
 -SSLCertificateKeyFile "/usr/local/apache2/conf/server.key"
 +SSLCertificateKeyFile "/usr/local/apache2/conf/ca/itpass/itpass.key"
  #SSLCertificateKeyFile "/usr/local/apache2/conf/server-dsa.key"
  #SSLCertificateKeyFile "/usr/local/apache2/conf/server-ecc.key"

 @@ -162,7 +165,7 @@
  #   the referenced file can be the same as SSLCertificateFile
  #   when the CA certificates are directly appended to the server
  #   certificate for convenience.
 -#SSLCertificateChainFile "/usr/local/apache2/conf/server-ca.crt"
 +#SSLCertificateChainFile "/usr/local/apache2/conf/server.crt"

  #   Certificate Authority (CA):
  #   Set the CA certificate verification path where to find CA
 @@ -287,4 +290,38 @@
  CustomLog "/usr/local/apache2/logs/ssl_request_log" \
            "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

 -</VirtualHost>
 +</VirtualHost>
 +
 +<VirtualHost *:443>
 +DocumentRoot "/home/aoelab/public_html"
 +ServerName aoe.scitec.kobe-u.ac.jp:443
 +ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
 +ErrorLog /var/log/httpd-ssl-error.log
 +TransferLog /var/log/httpd-ssl-access.log
 +SSLEngine on
 +#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:!SSLv2:!SSLv3:+EXP:+eNULL
 +SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
 +SSLCertificateFile "/usr/local/apache2/conf/ca/aoe/aoe.crt"
 +SSLCertificateKeyFile "/usr/local/apache2/conf/ca/aoe/aoe.key"
 +SSLProtocol all -SSLv2 -SSLv3
 +SSLHonorCipherOrder On
 +SSLCompression Off
 +</VirtualHost>
 +
 +<VirtualHost *:443>
 +DocumentRoot "/home/epalab/public_html"
 +ServerName epa.scitec.kobe-u.ac.jp:443
 +ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
 +ErrorLog /var/log/httpd-ssl-error.log
 +TransferLog /var/log/httpd-ssl-access.log
 +SSLEngine on
 +#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:!SSLv2:!SSLv3:+EXP:+eNULL
 +SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
 +SSLCertificateFile "/usr/local/apache2/conf/ca/epa/epa.crt"
 +SSLCertificateKeyFile "/usr/local/apache2/conf/ca/epa/epa.key"
 +SSLProtocol all -SSLv2 -SSLv3
 +SSLHonorCipherOrder On
 +SSLCompression Off
 +</VirtualHost>
 +
 +

extra/httpd-vhosts.conf(二回目)

chikuwa2@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/extra/httpd-
vhosts.conf extra/httpd-vhosts.conf
--- original/extra/httpd-vhosts.conf    2016-11-02 11:31:35.392212647 +0900
+++ extra/httpd-vhosts.conf     2016-11-01 23:23:04.429338375 +0900
@@ -21,21 +21,71 @@
 # match a ServerName or ServerAlias in any <VirtualHost> block.
 #
 <VirtualHost *:80>
-    ServerAdmin webmaster@dummy-host.example.com
-    DocumentRoot "/usr/local/apache2/docs/dummy-host.example.com"
-    ServerName dummy-host.example.com
-    ServerAlias www.dummy-host.example.com
-    ErrorLog "logs/dummy-host.example.com-error_log"
-    CustomLog "logs/dummy-host.example.com-access_log" common
+ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+    DocumentRoot "/home/itpass/public_html"
+    ServerName itpass.scitec.kobe-u.ac.jp
+    ErrorLog "/var/log/httpd-error.log"
+    CustomLog "/var/log/httpd-access.log" combined
+    <IfModule mod_rewrite.c>
+      RewriteEngine On
+#      RewriteLog "/var/log/httpd-rewrite.log"
+#      RewriteLogLevel 0
+      LogLevel alert rewrite:trace1
+      RewriteCond %{SERVER_PORT} !^443$
+      RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki/$1 [L,R,NE]
+      RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki-secret/$1 [L,R,NE]
+      # ---- hiki
+      RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki/$1 [L,R,NE]
+      RewriteRule ^/~bldg3/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~bldg3/hiki/$1 [L,R,NE]
+      RewriteRule ^/~epalab/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~epalab/hiki/$1 [L,R,NE]
+      RewriteRule ^/~itpass/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~itpass/hiki/$1 [L,R,NE]
+      RewriteRule ^/~itpass/hiki-secret/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~itpass/hiki-secret/$1 [L,R,NE]
+      # ---- gate
+      RewriteRule ^/~gate/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~gate/$1 [L,R,NE]
+      RewriteRule ^/cgi-bin/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/cgi-bin/$1 [L,R,NE]
+    </IfModule>
 </VirtualHost>

+# ---- aoelab ----
 <VirtualHost *:80>
-    ServerAdmin webmaster@dummy-host2.example.com
-    DocumentRoot "/usr/local/apache2/docs/dummy-host2.example.com"
-    ServerName dummy-host2.example.com
-    ErrorLog "logs/dummy-host2.example.com-error_log"
-    CustomLog "logs/dummy-host2.example.com-access_log" common
+    ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+        DocumentRoot "/home/aoelab/public_html"
+        ServerName aoe.scitec.kobe-u.ac.jp
+        ErrorLog "/var/log/httpd-error.log"
+        CustomLog "/var/log/httpd-access.log" combined
+        <IfModule mod_rewrite.c>
+          RewriteEngine On
+#          RewriteLog "/var/log/httpd-rewrite.log"
+#          RewriteLogLevel 0
+          LogLevel alert rewrite:trace1
+          RewriteCond %{SERVER_PORT} !^443$
+          # ---- hiki
+          RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki/$1 [L,R]
+          # ---- gate
+          RewriteRule ^/~gate/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~gate/$1 [L,R,NE]
+          RewriteRule ^/cgi-bin/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/cgi-bin/$1 [L,R,NE]
+        </IfModule>
 </VirtualHost>

+# ---- epalab ----
+<VirtualHost *:80>
+    ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+    DocumentRoot "/home/epalab/public_html"
+    ServerName epa.scitec.kobe-u.ac.jp
+    ErrorLog /var/log/httpd-error.log
+    CustomLog /var/log/httpd-access.log combined
+    <IfModule mod_rewrite.c>
+      RewriteEngine On
+#      RewriteLog "/var/log/httpd-rewrite.log"
+#      RewriteLogLevel 0
+      LogLevel alert rewrite:trace1
+      RewriteCond %{SERVER_PORT} !^443$
+      # ---- hiki
+      RewriteRule ^/hiki/(.*)?$ https://epa.scitec.kobe-u.ac.jp/hiki/$1 [L,R,NE]
+      # ---- gate
+      RewriteRule ^/~gate/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~gate/$1 [L,R,NE]
+      RewriteRule ^/cgi-bin/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/cgi-bin/$1 [L,R,NE]
+    </IfModule>
+ </VirtualHost>

extra/httpd-userdir.conf(二回目)

chikuwa2@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/extra/httpd-
userdir.conf extra/httpd-userdir.conf
--- original/extra/httpd-userdir.conf   2016-11-02 11:31:35.384212647 +0900
+++ extra/httpd-userdir.conf    2016-11-01 23:24:55.273340475 +0900
@@ -15,7 +15,14 @@
 #
 <Directory "/home/*/public_html">
     AllowOverride FileInfo AuthConfig Limit Indexes
-    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
+    Options MultiViews Indexes FollowSymLinks IncludesNoExec
     Require method GET POST OPTIONS
+    <IfModule negotiation_module>
+        AddLanguage ja .ja
+        AddLanguage ja-JP .ja
+        AddLanguage en .en
+        LanguagePriority en ja
+        ForceLanguagePriority Prefer Fallback
+    </IfModule>
 </Directory>

ログローテートの設定

  • /etc/logrotate.conf を編集して圧縮オプションを追加した.
    • compressのコメントアウトを外した.
  • /etc/logrotate.d/ 以下に apache2 ファイルをつくり, 以下の内容を書き込んだ.

    /var/log/httpd-access.log {
        missingok
        weekly
        rotate 12
        postrotate
            /usr/bin/killall -HUP httpd 2> /dev/null || true
        endscript
    }
    
    /var/log/httpd-error.log {
        delaycompress
        missingok
        weekly
        rotate 12
        postrotate
            /usr/bin/killall -HUP httpd 2> /dev/null || true
        endscript
    } 
    
    /var/log/httpd-ssl-access.log {
        missingok
        weekly
        rotate 12
        postrotate
            /usr/bin/killall -HUP httpd 2> /dev/null || true
        endscript
    }
    
    /var/log/httpd-ssl-error.log {
        missingok
        weekly
        rotate 12
        postrotate
            /usr/bin/killall -HUP httpd 2> /dev/null || true
        endscript
    }

SSL 用の証明書の作成

openssl の設定を変更

/etc/ssl/openssl.cnf について以下の二点の変更を加えた.

  • [usr_cert] セクションにある nsCertType=server のコメントアウトを外した
  • [v3_ca] セクションにある nsCertType=sslCA,emailCA のコメントアウトを外した

プライベート CA の作成

apache の config ディレクトリに入り, 次のように証明書を格納するディレク トリを作成した.

# cd /usr/local/apache2/conf
# mkdir ca
# cd ./ca/
# mkdir {itpass,epa,aoe のそれぞれの名称で作成}

以下の作業は ServerName : itpass.scitec.kobe-u.ac.jp, epa.scitec.kobe-u.ac.jp, aoe.scitec.kobe-u.ac.jp のそれぞれについて行った. サーバ名を適宜読みかえ, 3 回実行した.

< 3 回実行する作業 ここから>

秘密鍵を生成した.

# openssl genrsa -out itpass.key 2048

公開鍵を生成した(SHA-2(256)形式).

# openssl req -new -sha256 -key itpass.key -out itpass.csr

Country Name (2 letter code) [AU]: JP
State or Province Name (full name) [Some-State]: Hyogo
Locality Name (eg, city) []: Kobe
Organization Name (eg, company) [Internet Widgits Pty Ltd]: Kobe
University
Organizational Unit Name (eg, section) []: ITPASS (epa, aoe のときはそれぞれ "EPA lab.", "AOE lab." として登録)
Common Name (eg, YOUR name) : itpass.scitec.kobe-u.ac.jp (ここは
itpass の他に, epa, aoe の分をそれぞれ作成する)
Email Address: itpadmin_at_itpass.scitec.kobe-u.ac.jp (ここは同じ)
A challenge password: (空で Enter)
A optional company name: (空で Enter)

自己署名証明書を作成.

# openssl x509 -req -in itpass.csr -signkey itpass.key -out itpass.crt

生成された鍵や証明書をディレクトリに格納した.

< 3 回実行する作業 ここまで>

ここまでを itpass, epa, aoe のそれぞれについて計 3 回行った.

動作チェック

  • apache を起動する前に, ドキュメントルートとなるディレクトリを作成した.
    • /home/ 以下に itpass/, epalab/, aoe/ という名前のディレクトリを作った
    • さらにそれぞれのディレクトリ内に public_html/ という名前のディレクトリを作った
  • apache を起動
    • apache は /usr/local/apache2/bin/apachectl で起動/停止する

      # /usr/local/apache2/bin/apachectl -k start
    • 起動したかどうかを以下のコマンドで確認した.

      # ps aux | grep http
    • エラーで起動しなかった AH00112: Warning: DocumentRoot [/home/aoelab/public_html] does not exist AH00112: Warning: DocumentRoot [/home/aoelab/public_html] does not exist
      • httpd-ssl.conf と extra/httpd-vhosts.conf を書き直した. DocumentRoot "/home/aoelab/public_html" の aoelab/ を aoe/ とした.
  • apache を起動
    • apache は /usr/local/apache2/bin/apachectl で起動/停止する

      # /usr/local/apache2/bin/apachectl -k start
    • 起動したかどうかを以下のコマンドで確認した.

      # ps aux | grep http

      画面左端に www-data と表示されている行があり, 起動に成功した.

  • ~itpass/public_html/ に test という名前のディレクトリを作成し, その中に test.txt というファイルを作成した
  • ブラウザで test.txt が正常に表示されるかどうかを確認した
    • URL は http://tako-itpass.scitec.kobe-u.ac.jp/test/test.txt, https://tako-itpass.scitec.kobe-u.ac.jp/test/test.txt
      • "http://..." と "https://..." の両方に関して行う.
  • apache を停止

    # /usr/local/apache2/bin/apachectl -k graceful-stop
    • 停止したかどうかを確認する
    • apache のエラーログ /var/log/httpd-error.log を確認し, エラーなどが出ていないことを確認する

起動スクリプトの用意

  • サーバの起動時に apache が起動させるための起動スクリプトを用意する.
    • Debian 8 から導入された systemd による起動設定を行った.

具体的には, <URL:http://www.smiyasaka.com/CentOS7.0_server21.html> を参考に, /etc/systemd/system に apache2.service を作成した.

chikuwa2@tako-itpass /etc/systemd/system
% cat apache2.service
[Unit]
Description=httpd-2.4.17 daemon

[Service]
Type=forking
ExecStart=/usr/local/apache2/bin/apachectl start

[Install]
WantedBy=multi-user.target
  • 起動テストを行い, 起動の確認をした

    $ sudo systemctl start apache2
    $ ps aux | grep httpd
  • システム起動時に apache が立ち上がるようにするために追加設定を行った.

    $ sudo systemctl enable apache2
  • 再起動して apache が起動するかを確認した.
    • 起動していることを確認した.
Last modified:2016/11/11 20:25:06
Keyword(s):
References:[[ITPASS2016]2016年度サーバ構築ログ]