IT pass HikiWiki - [Memo2015][ITPASS]Apache のインストールと設定 Diff

  • Added parts are displayed like this.
  • Deleted parts are displayed like this.

{{toc}}

= Apache のインストールと設定

最新バージョンの状況に合わせて作業内容を見直しながら行った.

== ビルドのための設定

* ソースを取得・展開した.
  * apache の最新バージョンを ((<URL:http://httpd.apache.org/>)) から確認し, 取得・展開した.  
  ※ 2015 年 10 月 20 日時点の最新バージョンは 2.4.17 である.

    # cd /usr/local/src
    # wget 'http://ftp.tsukuba.wide.ad.jp/software/apache//httpd/httpd-2.4.17.tar.gz'
    # tar xvfz httpd-2.4.17.tar.gz
    # cd httpd-2.4.17

* configure を行った
  * インストール先と configure の際につけるオプションは以下の通りである.
    * インストール先
      * /usr/local/apache2 (apache2 のデフォルト)
        *  configure の際に --prefix の設定は不要
  * configure オプション (: 目的)
    * --enable-ssl  (: apache-ssl を動作させるため)
    * --enable-rewrite (: mod_rewrite を使用するため)
      * gate の登録窓口を http から https へ移動させたい  
    * --enable-so (: DSO (Dynamic shared object: 動的共有オブジェクト) を使用するため)
    * --with-included-apr (: ビルド時に "Cannot use an external APR-util with  the bundled APR" とエラーが生じる場合があるため)
    * apache2.4.x では apr と apr-util を別途用意する必要が有るため, ((<URL: http://apr.apache.org/download.cgi/>)) から最新版を取得し, 展開する. (参照: ((<URL: http://weblabo.oscasierra.net/install-apache24-1/>)))

   $ wget 'http://ftp.jaist.ac.jp/pub/apache/apr/apr-1.5.2.tar.gz'
   $ tar xzf apr-1.5.2.tar.gz
   $ cd apr-1.5.2
   $ sudo ./configure
   $ sudo make
   $ sudo make install

   $ wget 'http://ftp.jaist.ac.jp/pub/apache/apr/apr-util-1.5.4.tar.gz'
   $ tar xzf apr-util-1.5.4.tar.gz
   $ cd apr-util-1.5.4
   $ ./configure --with-apr=/usr/local/apr
   $ sudo make install

  * configure を行った
   $ sudo ./configure --enable-ssl --enable-rewrite --enable-so --with-apr=/usr/local/apr
  
  * configure の結果は config.log や build/config_vars.mk を参照した.
    * PCRE(Perl Compatible Regular Expressions) が無い, とエラーが出たため, PCRE をインストールした.

     $ sudo apt-get install libpcre3 libpcre3-dev

    * もう一度, configure を行なった
      * うまくいった

== ビルドとインストール

# make
# make install

* /usr/local/apache2 の下に以下のディレクトリが作成されていることを確認した.

XXXX@xxx-itpass:/usr/local/apache2$ ls
bin  build  cgi-bin  conf  error  htdocs  icons  include  logs  man  manual  modules

== 実行ファイルへのパスの設定

* インストールされた Apache のバイナリファイル群へパスを通した.
  * ((<[ITPASS2014]パスの設定>)) の((* <一般ユーザ用コマンドのパス> *)) と ((* <システム管理用コマンドのパス> *)) の両方に ((*/usr/local/apache2/bin*)) を追加した. (システム管理用コマンドも一般ユーザ用コマンドと同じ場所にインストールされているため, システム管理用コマンドの設定を別途行う必要は無い).
  * 具体的には, 以下のようにした.
    * /etc/bash.bashrc の冒頭に

       # add PATH for local installed softwares
       PATH="${PATH}:/usr/local/apache2/bin"
       # add PATH for local installed softwares (for root)
       if [ "`id -u`" -eq 0 ]; then
       PATH="${PATH}:/usr/local/apache2/bin"
       fi
       export PATH

      を追加した.

    * /etc/csh.cshrc の冒頭に

       # add PATH for local installed softwares
       set path = ($path /usr/local/bin /usr/bin /bin /usr/local/apache2/bin)
       # add PATH for local installed softwares (for root)
       if ( "`id -u`" == 0 ) then
       set path = ($path /usr/local/sbin /usr/sbin /sbin /usr/local/apache2/bin)
       endif
    
      を追加した.

    * /etc/zsh/zshenv に

       # add PATH for local installed softwares
       export PATH="$PATH:/usr/local/apache2/bin”
       # add PATH for local installed softwares (for root)
       if [ "`id -u`" -eq 0 ]; then
         export PATH="$PATH:/usr/local/apache2/bin”
       fi
       # delete duplicated path setting
       typeset -U path

      の記述を追加した.

    * bash だけパスが通っていない


== マニュアルへのパスの設定

* インストールされた Apache のマニュアル群へパスを通した.
  * /etc/manpath.config に以下の行を追加した. 詳しくは ((<[ITPASS2014]パスの設定#man 関連のパスの設定>)) を参照した.

     MANDATORY_MANPATH                          /usr/local/apache2/man
     MANPATH_MAP        /usr/local/apache2/bin  /usr/local/apache2/man
     MANDB_MAP          /usr/local/apache2/man  /usr/local/apache2/man

== モジュールの確認, 追加

* インストールした apache2 で有効になっているモジュールを確認した.

  # /usr/local/apache2/bin/apachectl -t -D DUMP_MODULES

  * 結果, 以下の3つが最低限有効になっているかを確認したが, 有効になっていなかった.
    * ssl_module
    * rewrite_module
    * userdir_module

* 以下のように対処した
  * DSO(Dynamic Shared Object) を有効にしているので (configure 時に --enable-so をつけた), モジュールを追加した.
    * mod_rewrite

       # cd /usr/local/src/httpd-2.4.10/modules/mappers
       # apxs -c mod_rewrite.c
       # apxs -i -a -n rewrite mod_rewrite.la

    * mod_ssl

       # cd /usr/local/src/httpd-2.4.10/modules/ssl
       # apxs -c mod_ssl.c
       # apxs -i -a -c -I /usr/include/openssl -D HAVE_OPENSSL=1 -lcrypto -lssl *.c

      * 参考: ((<URL: http://kamiyasu2.blog.fc2.com/blog-entry-22.html>))

    * mod_userdir

       # cd /usr/local/src/httpd-2.4.10/modules/mappers
       # apxs -c mod_userdir.c
       # apxs -i -a -n rewrite mod_userdir.la

== 設定ファイルの編集

各種設定ファイルは以下のとおり.

* httpd 用
  * /usr/local/apache2/conf/httpd.conf
* httpd-ssl
  * /usr/local/apache2/conf/extra/httpd-ssl.conf
* 各ユーザの public_html 以下の設定用
  * /usr/local/apache2/conf/extra/httpd-userdir.conf


変更の要点は以下の通りである(以下は変更点の概要であり, 実際に行った作業はこのあとに記述).

* httpd.conf
  * HTTP デーモンを起動するユーザを www-data にする
  * サーバ管理者 (ServerAdmin) のメールアドレスを設定
  * サーバ名 (ServerName) を設定
  * サーバのデフォルトルート (DefaultRoot) を /~itpass に設定
  * ディレクトリのインデックスファイルに index.html 以外に
    index.htm index.htm.en index.html.en index.htm.ja index.html.ja
    も追加.
  * エラーログファイルを /var/log/httpd-error.log に設定
  * アクセスログファイルを /var/log/httpd-access.log に設定
  * CGI に関する設定を変更
  * extra/httpd-vhosts.confをロード
  * extra/httpd-userdir.conf をロード
  * extra/httpd-ssl.conf をロード
  * /~gate, および /cgi-bin に対するアクセスを HTTPS へ移動させる.
  * hiki.cgi の置かれた場所で設定したすべての設定値の変更を, 下位のディレクトリで変更できるようにする.
  * hiki-IPtable 以外では, mod_negotiation によるコンテントネゴシエーションされた "MultiViews" を許可する.

* httpd-vhosts.conf
  * {epa,aoe}.scitec.kobe-u.ac.jp 宛の接続を受ける (virtual host)
    * ドキュメントルートは /home/{epalab,aoelab}/public_html にする
    * 管理者メールアドレスは itpadmin _at_ ... にする
    * http://{epa,aoe}.scitec.kobe-u.ac.jp/~gate/ 以下に対するアクセスを https://itpass.scitec.kobe-u.ac.jp/~gate に移動させる
  * http://itpass.scitec.kobe-u.ac.jp/{/hiki,/~epalab/hiki,/~itpass/hiki} に対するアクセスのみ HTTPS へ移動させる. その際, URI のエンコードは行わない.  

* httpd-userdir.conf
  * 所有者がマッチしなくてもシンボリックリンクの公開を許可する.

* httpd-ssl.conf
  * ドキュメントルート (DocumentRoot),
    サーバ名 (ServerName),
    サーバ管理者アドレス (ServerAdmin),
    エラーログ (ErrorLog),
    アクセスログ (TransferLog) を設定する
  * epa.scitec, aoe.scitec の場合の https 接続を設定する

# * 設定ファイルのところどころにメールアドレスを指定する項目がある.
#   * 以下の diff では "_at_" となっているが, 実際にファイルを書き換える際にはすべて "@" に読み替えて書き換えた.

== オリジナルとの diff

=== httpd.conf

chikuwa3@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/httpd.conf httpd.conf
--- original/httpd.conf 2015-10-22 18:14:23.846681507 +0900
+++ httpd.conf 2015-10-22 10:55:25.874182514 +0900
@@ -28,7 +28,7 @@
  # same ServerRoot for multiple httpd daemons, you will need to change at
  # least PidFile.
  #
-ServerRoot "/usr/local/apache-httpd/httpd-2.4.17"
+ServerRoot "/usr/local/apache2"
  
  #
  # Mutex: Allows you to set the mutex mechanism and mutex file directory
@@ -62,7 +62,7 @@
  #
  # Example:
  # LoadModule foo_module modules/mod_foo.so
-#
+LoadModule rewrite_module modules/mod_rewrite.so
  LoadModule authn_file_module modules/mod_authn_file.so
  #LoadModule authn_dbm_module modules/mod_authn_dbm.so
  #LoadModule authn_anon_module modules/mod_authn_anon.so
@@ -82,7 +82,7 @@
  #LoadModule auth_digest_module modules/mod_auth_digest.so
  #LoadModule allowmethods_module modules/mod_allowmethods.so
  #LoadModule file_cache_module modules/mod_file_cache.so
-#LoadModule cache_module modules/mod_cache.so
+LoadModule cache_module modules/mod_cache.so
  #LoadModule cache_disk_module modules/mod_cache_disk.so
  #LoadModule cache_socache_module modules/mod_cache_socache.so
  #LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
@@ -126,7 +126,7 @@
  #LoadModule session_cookie_module modules/mod_session_cookie.so
  #LoadModule session_dbd_module modules/mod_session_dbd.so
  #LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
-#LoadModule ssl_module modules/mod_ssl.so
+LoadModule ssl_module         modules/mod_ssl.so
  #LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
  #LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
  #LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
@@ -136,16 +136,16 @@
  LoadModule status_module modules/mod_status.so
  LoadModule autoindex_module modules/mod_autoindex.so
  #LoadModule info_module modules/mod_info.so
-#LoadModule cgid_module modules/mod_cgid.so
+LoadModule cgid_module modules/mod_cgid.so
  #LoadModule dav_fs_module modules/mod_dav_fs.so
  #LoadModule vhost_alias_module modules/mod_vhost_alias.so
  #LoadModule negotiation_module modules/mod_negotiation.so
  LoadModule dir_module modules/mod_dir.so
  #LoadModule actions_module modules/mod_actions.so
  #LoadModule speling_module modules/mod_speling.so
-#LoadModule userdir_module modules/mod_userdir.so
+LoadModule userdir_module modules/mod_userdir.so
  LoadModule alias_module modules/mod_alias.so
-#LoadModule rewrite_module modules/mod_rewrite.so
+LoadModule rewrite_module     modules/mod_rewrite.so
  
  <IfModule unixd_module>
  #
@@ -156,8 +156,8 @@
  # It is usually good practice to create a dedicated user and group for
  # running httpd, as with most system services.
  #
-User daemon
-Group daemon
+User www-data
+Group www-data
  
  </IfModule>
  
@@ -178,7 +178,7 @@
  # e-mailed.  This address appears on some server-generated pages, such
  # as error documents.  e.g. admin@your-domain.com
  #
-ServerAdmin you@example.com
+ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
  
  #
  # ServerName gives the name and port that the server uses to identify itself.
@@ -187,7 +187,7 @@
  #
  # If your host doesn't have a registered DNS name, enter its IP address here.
  #
-#ServerName www.example.com:80
+ServerName itpass.scitec.kobe-u.ac.jp:80
  
  #
  # Deny access to the entirety of your server's filesystem. You must
@@ -211,8 +211,8 @@
  # documents. By default, all requests are taken from this directory, but
  # symbolic links and aliases may be used to point to other locations.
  #
-DocumentRoot "/usr/local/apache-httpd/httpd-2.4.17/htdocs"
-<Directory "/usr/local/apache-httpd/httpd-2.4.17/htdocs">
+DocumentRoot "/home/itpass/public_html"
+<Directory "/home/itpass/public_html">
      #
      # Possible values for the Options directive are "None", "All",
      # or any combination of:
@@ -234,10 +234,12 @@
      #
      AllowOverride None
  
+    Order deny,allow
+
      #
      # Controls who can get stuff from this server.
      #
-    Require all granted
+         Require all granted
  </Directory>
  
  #
@@ -245,7 +247,7 @@
  # is requested.
  #
  <IfModule dir_module>
-    DirectoryIndex index.html
+    DirectoryIndex index.html index.htm index.htm.en index.html.en index.htm.ja index.html.ja
  </IfModule>
  
  #
@@ -263,7 +265,7 @@
  # logged here.  If you *do* define an error logfile for a <VirtualHost>
  # container, that host's errors will be logged there and not here.
  #
-ErrorLog "logs/error_log"
+ErrorLog "/var/log/httpd-error.log"
  
  #
  # LogLevel: Control the number of messages logged to the error_log.
@@ -292,13 +294,13 @@
      # define per-<VirtualHost> access logfiles, transactions will be
      # logged therein and *not* in this file.
      #
-    CustomLog "logs/access_log" common
+    # CustomLog "logs/access_log" common
  
      #
      # If you prefer a logfile with access, agent, and referer information
      # (Combined Logfile Format) you can use the following directive.
      #
-    #CustomLog "logs/access_log" combined
+    CustomLog "logs/access_log" combined
  </IfModule>
  
  <IfModule alias_module>
@@ -328,7 +330,7 @@
      # client.  The same rules about trailing "/" apply to ScriptAlias
      # directives as to Alias.
      #
-    ScriptAlias /cgi-bin/ "/usr/local/apache-httpd/httpd-2.4.17/cgi-bin/"
+    ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"
  
  </IfModule>
  
@@ -337,16 +339,16 @@
      # ScriptSock: On threaded servers, designate the path to the UNIX
      # socket used to communicate with the CGI daemon of mod_cgid.
      #
-    #Scriptsock cgisock
+    Scriptsock cgisock
  </IfModule>
  
  #
-# "/usr/local/apache-httpd/httpd-2.4.17/cgi-bin" should be changed to whatever your ScriptAliased
+# "/usr/local/apache2/cgi-bin" should be changed to whatever your ScriptAliased
  # CGI directory exists, if you have that configured.
  #
-<Directory "/usr/local/apache-httpd/httpd-2.4.17/cgi-bin">
-    AllowOverride None
-    Options None
+<Directory "/usr/local/apache2/cgi-bin/">
+    AllowOverride AuthConfig Limit
+    Options +ExecCGI +FollowSymLinks +IncludesNoExec
      Require all granted
  </Directory>
  
@@ -383,7 +385,7 @@
      # To use CGI scripts outside of ScriptAliased directories:
      # (You will also need to add "ExecCGI" to the "Options" directive.)
      #
-    #AddHandler cgi-script .cgi
+    AddHandler cgi-script .cgi
  
      # For type maps (negotiated resources):
      #AddHandler type-map var
@@ -455,13 +457,13 @@
  #Include conf/extra/httpd-languages.conf
  
  # User home directories
-#Include conf/extra/httpd-userdir.conf
+Include conf/extra/httpd-userdir.conf
  
  # Real-time info on requests and configuration
  #Include conf/extra/httpd-info.conf
  
  # Virtual hosts
-#Include conf/extra/httpd-vhosts.conf
+Include conf/extra/httpd-vhosts.conf
  
  # Local access to the Apache HTTP Server Manual
  #Include conf/extra/httpd-manual.conf
@@ -478,7 +480,7 @@
  </IfModule>
  
  # Secure (SSL/TLS) connections
-#Include conf/extra/httpd-ssl.conf
+Include conf/extra/httpd-ssl.conf
  #
  # Note: The following must must be present to support
  #       starting without SSL on platforms with no /dev/random equivalent
@@ -488,7 +490,44 @@
  SSLRandomSeed startup builtin
  SSLRandomSeed connect builtin
  </IfModule>
+
  #
+# Setting for Hiki Area
+#
+<Directory "/home/epalab/public_html/hiki">
+ AllowOverride ALL
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/itpass/public_html/hiki">
+ AllowOverride ALL
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/itpass/public_html/hiki-secret">
+ AllowOverride ALL
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/uwabami/public_html/hiki">
+ AllowOverride FileInfo AuthConfig Limit Indexes Options=ExecCGI,FollowSymlinks
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/bldg3/public_html/hiki">
+ AllowOverride ALL
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/fourtran/public_html/hiki">
+ AllowOverride FileInfo AuthConfig Limit Indexes Options=ExecCGI,FollowSymlinks
+ Options -MultiViews
+</Directory>
+
+<Directory "/home/itpass/public_html/hiki-IPtable">
+ AllowOverride ALL
+</Directory>
+
  # uncomment out the below to deal with user agents that deliberately
  # violate open standards by misusing DNT (DNT *must* be a specific
  # end-user choice)

=== extra/httpd-ssl.conf

chikuwa3@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/extra/httpd-ssl.conf extra/httpd-ssl.conf
--- original/extra/httpd-ssl.conf 2015-10-22 18:15:25.262682670 +0900
+++ extra/httpd-ssl.conf 2015-10-22 12:24:46.814284081 +0900
@@ -49,7 +49,8 @@
  #   ensure these follow appropriate best practices for this deployment.
  #   httpd 2.2.30, 2.4.13 and later force-disable aNULL, eNULL and EXP ciphers,
  #   while OpenSSL disabled these by default in 0.9.8zf/1.0.0r/1.0.1m/1.0.2a.
-SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
+#SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
+SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
  SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4
  
  #  By the end of 2016, only TLSv1.2 ciphers should remain in use.
@@ -69,7 +70,8 @@
  #   own preference of either security or performance, therefore this
  #   must be the prerogative of the web server administrator who manages
  #   cpu load versus confidentiality, so enforce the server's cipher order.
-SSLHonorCipherOrder on
+SSLHonorCipherOrder on
+SSLCompression Off
  
  #   SSL Protocol support:
  #   List the protocol versions which clients are allowed to connect with.
@@ -88,8 +90,8 @@
  #   Inter-Process Session Cache:
  #   Configure the SSL Session Cache: First the mechanism
  #   to use and second the expiring timeout (in seconds).
-#SSLSessionCache         "dbm:/usr/local/apache-httpd/httpd-2.4.17/logs/ssl_scache"
-SSLSessionCache        "shmcb:/usr/local/apache-httpd/httpd-2.4.17/logs/ssl_scache(512000)"
+#SSLSessionCache         "dbm:/usr/local/apache2/logs/ssl_scache"
+#SSLSessionCache        "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
  SSLSessionCacheTimeout  300
  
  #   OCSP Stapling (requires OpenSSL 0.9.8h or later)
@@ -106,7 +108,7 @@
  #   the same mechanism that is used for the SSL session cache
  #   above.  If stapling is used with more than a few certificates,
  #   the size may need to be increased.  (AH01929 will be logged.)
-#SSLStaplingCache "shmcb:/usr/local/apache-httpd/httpd-2.4.17/logs/ssl_stapling(32768)"
+#SSLStaplingCache "shmcb:/usr/local/apache2/logs/ssl_stapling(32768)"
  
  #   Seconds before valid OCSP responses are expired from the cache
  #SSLStaplingStandardCacheTimeout 3600
@@ -118,19 +120,22 @@
  ## SSL Virtual Host Context
  ##
  
-<VirtualHost _default_:443>
+# NameVirtualHost *:433
+<VirtualHost *:443>
  
  #   General setup for the virtual host
-DocumentRoot "/usr/local/apache-httpd/httpd-2.4.17/htdocs"
-ServerName www.example.com:443
-ServerAdmin you@example.com
-ErrorLog "/usr/local/apache-httpd/httpd-2.4.17/logs/error_log"
-TransferLog "/usr/local/apache-httpd/httpd-2.4.17/logs/access_log"
+DocumentRoot "/home/itpass/public_html"
+ServerName itpass.scitec.kobe-u.ac.jp:443
+ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+ErrorLog "/var/log/httpd-ssl-error.log"
+TransferLog "/var/log/httpd-ssl-access.log"
  
  #   SSL Engine Switch:
  #   Enable/Disable SSL for this virtual host.
  SSLEngine on
  
+SSLProtocol all -SSLv2 -SSLv3
+
  #   Server Certificate:
  #   Point SSLCertificateFile at a PEM encoded certificate.  If
  #   the certificate is encrypted, then you will be prompted for a
@@ -141,9 +146,9 @@
  #   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
  #   require an ECC certificate which can also be configured in
  #   parallel.
-SSLCertificateFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server.crt"
-#SSLCertificateFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server-dsa.crt"
-#SSLCertificateFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server-ecc.crt"
+SSLCertificateFile "/usr/local/apache2/conf/ca/itpass/itpass.crt"
+#SSLCertificateFile "/usr/local/apache2/conf/server-dsa.crt"
+#SSLCertificateFile "/usr/local/apache2/conf/server-ecc.crt"
  
  #   Server Private Key:
  #   If the key is not combined with the certificate, use this
@@ -151,9 +156,9 @@
  #   you've both a RSA and a DSA private key you can configure
  #   both in parallel (to also allow the use of DSA ciphers, etc.)
  #   ECC keys, when in use, can also be configured in parallel
-SSLCertificateKeyFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server.key"
-#SSLCertificateKeyFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server-dsa.key"
-#SSLCertificateKeyFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server-ecc.key"
+SSLCertificateKeyFile "/usr/local/apache2/conf/ca/itpass/itpass.key"
+#SSLCertificateKeyFile "/usr/local/apache2/conf/server-dsa.key"
+#SSLCertificateKeyFile "/usr/local/apache2/conf/server-ecc.key"
  
  #   Server Certificate Chain:
  #   Point SSLCertificateChainFile at a file containing the
@@ -162,7 +167,7 @@
  #   the referenced file can be the same as SSLCertificateFile
  #   when the CA certificates are directly appended to the server
  #   certificate for convenience.
-#SSLCertificateChainFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server-ca.crt"
+#SSLCertificateChainFile "/usr/local/apache2/conf/server.crt"
  
  #   Certificate Authority (CA):
  #   Set the CA certificate verification path where to find CA
@@ -171,8 +176,8 @@
  #   Note: Inside SSLCACertificatePath you need hash symlinks
  #         to point to the certificate files. Use the provided
  #         Makefile to update the hash symlinks after changes.
-#SSLCACertificatePath "/usr/local/apache-httpd/httpd-2.4.17/conf/ssl.crt"
-#SSLCACertificateFile "/usr/local/apache-httpd/httpd-2.4.17/conf/ssl.crt/ca-bundle.crt"
+#SSLCACertificatePath "/usr/local/apache2/conf/ssl.crt"
+#SSLCACertificateFile "/usr/local/apache2/conf/ssl.crt/ca-bundle.crt"
  
  #   Certificate Revocation Lists (CRL):
  #   Set the CA revocation path where to find CA CRLs for client
@@ -183,8 +188,8 @@
  #   Note: Inside SSLCARevocationPath you need hash symlinks
  #         to point to the certificate files. Use the provided
  #         Makefile to update the hash symlinks after changes.
-#SSLCARevocationPath "/usr/local/apache-httpd/httpd-2.4.17/conf/ssl.crl"
-#SSLCARevocationFile "/usr/local/apache-httpd/httpd-2.4.17/conf/ssl.crl/ca-bundle.crl"
+#SSLCARevocationPath "/usr/local/apache2/conf/ssl.crl"
+#SSLCARevocationFile "/usr/local/apache2/conf/ssl.crl/ca-bundle.crl"
  #SSLCARevocationCheck chain
  
  #   Client Authentication (Type):
@@ -200,8 +205,8 @@
  #   file (containing login information for SRP user accounts).
  #   Requires OpenSSL 1.0.1 or newer. See the mod_ssl FAQ for
  #   detailed instructions on creating this file. Example:
-#   "openssl srp -srpvfile /usr/local/apache-httpd/httpd-2.4.17/conf/passwd.srpv -add username"
-#SSLSRPVerifierFile "/usr/local/apache-httpd/httpd-2.4.17/conf/passwd.srpv"
+#   "openssl srp -srpvfile /usr/local/apache2/conf/passwd.srpv -add username"
+#SSLSRPVerifierFile "/usr/local/apache2/conf/passwd.srpv"
  
  #   Access Control:
  #   With SSLRequire you can do per-directory access control based
@@ -249,7 +254,7 @@
  <FilesMatch "\.(cgi|shtml|phtml|php)$">
      SSLOptions +StdEnvVars
  </FilesMatch>
-<Directory "/usr/local/apache-httpd/httpd-2.4.17/cgi-bin">
+<Directory "/usr/local/apache2/cgi-bin">
      SSLOptions +StdEnvVars
  </Directory>
  
@@ -284,7 +289,41 @@
  #   Per-Server Logging:
  #   The home of a custom SSL log file. Use this when you want a
  #   compact non-error SSL logfile on a virtual host basis.
-CustomLog "/usr/local/apache-httpd/httpd-2.4.17/logs/ssl_request_log" \
+CustomLog "/usr/local/apache2/logs/ssl_request_log" \
            "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
  
-</VirtualHost>
+</VirtualHost>
+
+<VirtualHost *:443>
+DocumentRoot "/home/aoelab/public_html"
+ServerName aoe.scitec.kobe-u.ac.jp:443
+ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+ErrorLog /var/log/httpd-ssl-error.log
+TransferLog /var/log/httpd-ssl-access.log
+SSLEngine on
+#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:!SSLv2:!SSLv3:+EXP:+eNULL
+SSLCipherSuite  ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
+SSLCertificateFile "/usr/local/apache2/conf/ca/aoe/aoe.crt"
+SSLCertificateKeyFile "/usr/local/apache2/conf/ca/aoe/aoe.key"
+SSLProtocol all -SSLv2 -SSLv3
+SSLHonorCipherOrder On
+SSLCompression Off
+</VirtualHost>
+
+<VirtualHost *:443>
+DocumentRoot "/home/epalab/public_html"
+ServerName epa.scitec.kobe-u.ac.jp:443
+ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+ErrorLog /var/log/httpd-ssl-error.log
+TransferLog /var/log/httpd-ssl-access.log
+SSLEngine on
+#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:!SSLv2:!SSLv3:+EXP:+eNULL
+SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
+SSLCertificateFile "/usr/local/apache2/conf/ca/epa/epa.crt"
+SSLCertificateKeyFile "/usr/local/apache2/conf/ca/epa/epa.key"
+SSLProtocol all -SSLv2 -SSLv3
+SSLHonorCipherOrder On
+SSLCompression Off
+</VirtualHost>
+
+

=== extra/httpd-vhosts.conf

chikuwa3@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/extra/httpd-vhosts.conf extra/httpd-vhosts.conf
--- original/extra/httpd-vhosts.conf 2015-10-22 18:17:09.778684650 +0900
+++ extra/httpd-vhosts.conf 2015-10-22 12:25:19.174284694 +0900
@@ -21,21 +21,72 @@
  # match a ServerName or ServerAlias in any <VirtualHost> block.
  #
  <VirtualHost *:80>
-    ServerAdmin webmaster@dummy-host.example.com
-    DocumentRoot "/usr/local/apache-httpd/httpd-2.4.17/docs/dummy-host.example.com"
-    ServerName dummy-host.example.com
-    ServerAlias www.dummy-host.example.com
-    ErrorLog "logs/dummy-host.example.com-error_log"
-    CustomLog "logs/dummy-host.example.com-access_log" common
+ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+    DocumentRoot "/home/itpass/public_html"
+    ServerName itpass.scitec.kobe-u.ac.jp
+    ErrorLog "/var/log/httpd-error.log"
+    CustomLog "/var/log/httpd-access.log" combined
+    <IfModule mod_rewrite.c>
+      RewriteEngine On
+#      RewriteLog "/var/log/httpd-rewrite.log"
+#      RewriteLogLevel 0
+      LogLevel alert rewrite:trace1
+      RewriteCond %{SERVER_PORT} !^443$
+      RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki/$1 [L,R,NE]
+      RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki-secret/$1 [L,R,NE]
+      # ---- hiki
+      RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki/$1 [L,R,NE]
+      RewriteRule ^/~bldg3/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~bldg3/hiki/$1 [L,R,NE]
+      RewriteRule ^/~epalab/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~epalab/hiki/$1 [L,R,NE]
+      RewriteRule ^/~itpass/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~itpass/hiki/$1 [L,R,NE]
+      RewriteRule ^/~itpass/hiki-secret/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~itpass/hiki-secret/$1 [L,R,NE]
+      # ---- gate
+      RewriteRule ^/~gate/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~gate/$1 [L,R,NE]
+      RewriteRule ^/cgi-bin/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/cgi-bin/$1 [L,R,NE]
+    </IfModule>
  </VirtualHost>
  
+# ---- aoelab ----
  <VirtualHost *:80>
-    ServerAdmin webmaster@dummy-host2.example.com
-    DocumentRoot "/usr/local/apache-httpd/httpd-2.4.17/docs/dummy-host2.example.com"
-    ServerName dummy-host2.example.com
-    ErrorLog "logs/dummy-host2.example.com-error_log"
-    CustomLog "logs/dummy-host2.example.com-access_log" common
+    ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+        DocumentRoot "/home/aoelab/public_html"
+        ServerName aoe.scitec.kobe-u.ac.jp
+        ErrorLog "/var/log/httpd-error.log"
+        CustomLog "/var/log/httpd-access.log" combined
+        <IfModule mod_rewrite.c>
+          RewriteEngine On
+#          RewriteLog "/var/log/httpd-rewrite.log"
+#          RewriteLogLevel 0
+          LogLevel alert rewrite:trace1
+          RewriteCond %{SERVER_PORT} !^443$
+          # ---- hiki
+          RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki/$1 [L,R]
+          # ---- gate
+          RewriteRule ^/~gate/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~gate/$1 [L,R,NE]
+          RewriteRule ^/cgi-bin/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/cgi-bin/$1 [L,R,NE]
+        </IfModule>
  </VirtualHost>
  
+# ---- epalab ----
+<VirtualHost *:80>
+    ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
+    DocumentRoot "/home/epalab/public_html"
+    ServerName epa.scitec.kobe-u.ac.jp
+    ErrorLog /var/log/httpd-error.log
+    CustomLog /var/log/httpd-access.log combined
+    <IfModule mod_rewrite.c>
+      RewriteEngine On
+#      RewriteLog "/var/log/httpd-rewrite.log"
+#      RewriteLogLevel 0
+      LogLevel alert rewrite:trace1
+      RewriteCond %{SERVER_PORT} !^443$
+      # ---- hiki
+      RewriteRule ^/hiki/(.*)?$ https://epa.scitec.kobe-u.ac.jp/hiki/$1 [L,R,NE]
+      # ---- gate
+      RewriteRule ^/~gate/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~gate/$1 [L,R,NE]
+      RewriteRule ^/cgi-bin/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/cgi-bin/$1 [L,R,NE]
+    </IfModule>
+ </VirtualHost>
+

=== extra/httpd-userdir.conf
  
chikuwa3@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/extra/httpd-userdir.conf extra/httpd-userdir.conf
--- original/extra/httpd-userdir.conf 2015-10-22 18:15:56.770683267 +0900
+++ extra/httpd-userdir.conf 2015-10-22 10:28:50.730152293 +0900
@@ -1,3 +1,4 @@
+# -*- apache -*-
  # Settings for user home directories
  #
  # Required module: mod_authz_core, mod_authz_host, mod_userdir
@@ -15,7 +16,14 @@
  #
  <Directory "/home/*/public_html">
      AllowOverride FileInfo AuthConfig Limit Indexes
-    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
+    Options MultiViews Indexes FollowSymLinks IncludesNoExec
      Require method GET POST OPTIONS
+    <IfModule negotiation_module>
+        AddLanguage ja .ja
+        AddLanguage ja-JP .ja
+        AddLanguage en .en
+        LanguagePriority en ja
+        ForceLanguagePriority Prefer Fallback
+    </IfModule>
  </Directory>

= ログローテートの設定

* /etc/logrotate.conf を編集して圧縮オプションを追加する
  * compressのコメントアウトを外した
  
* /etc/logrotate.d/ 以下に apache2 ファイルがなかったので, 以下の内容を書き込んだ.
  
    /var/log/httpd-access.log {
        missingok
        weekly
        rotate 12
        postrotate
            /usr/bin/killall -HUP httpd 2> /dev/null || true
        endscript
    }
  
    /var/log/httpd-error.log {
        delaycompress
        missingok
        weekly
        rotate 12
        postrotate
            /usr/bin/killall -HUP httpd 2> /dev/null || true
        endscript
    }
  
    /var/log/httpd-ssl-access.log {
        missingok
        weekly
        rotate 12
        postrotate
            /usr/bin/killall -HUP httpd 2> /dev/null || true
        endscript
    }
  
    /var/log/httpd-ssl-error.log {
        missingok
        weekly
        rotate 12
        postrotate
            /usr/bin/killall -HUP httpd 2> /dev/null || true
        endscript
    }
    
= SSL 用の証明書の作成

== openssl の設定を変更

/etc/ssl/openssl.cnf について以下の二点の変更を加える.

* [usr_cert] セクションにある nsCertType=server のコメントアウトを外す
* [v3_ca] セクションにある nsCertType=sslCA,emailCA のコメントアウトを外す

=== プライベート CA の作成

apache の config ディレクトリに入り, 次のように証明書を格納するディレク
トリを
ディレクトリを作成する.

    # cd /usr/local/apache2/conf
    # mkdir ca
    # cd ./ca/
    # mkdir {itpass,epa,aoe のそれぞれの名称で作成}

以下の作業は ServerName : itpass.scitec.kobe-u.ac.jp,
itpass.scitec.kobe-u.ac.jp, epa.scitec.kobe-u.ac.jp, aoe.scitec.kobe-u.ac.jp
aoe.scitec.kobe-u.ac.jp のそれぞれについて行った. サーバ名を適宜読みかえ, 3 回実行した.

((*< 3 回実行した作業 ここから>*))

秘密鍵を生成した.

    # openssl genrsa -out itpass.key 2048

公開鍵を生成した(SHA-2(256)形式).

    # openssl req -new -sha256 -key itpass.key -out itpass.csr

自己署名証明書を作成した.

    # openssl x509 -req -in itpass.csr -signkey itpass.key -out itpass.crt

    Country Name (2 letter code) [AU]: JP
    State or Province Name (full name) [Some-State]: Hyogo
    Locality Name (eg, city) []: Kobe
    Organization Name (eg, company) [Internet Widgits Pty Ltd]: Kobe
    University
    Organizational Unit Name (eg, section) []: ITPASS (他に "EPA lab.",
"AOE lab." として登録)
    Common Name (eg, YOUR name) : itpass.scitec.kobe-u.ac.jp (ここは
    itpass の他に, epa, aoe の分をそれぞれ作成する)
    Email Address: itpadmin_at_itpass.scitec.kobe-u.ac.jp
    A challenge password: (空で Enter)
    A optional company name: (空で Enter)

生成された鍵や証明書をディレクトリに格納した.

((*< 3 回実行した作業 ここまで>*))

ここまでを itpass, epa, aoe のそれぞれについて計 3 回行った.

= 動作チェック

* apache を起動する前に, ドキュメントルートとなるディレクトリを作成した.
    * /home/ 以下に itpass/, epalab/, aoe/ という名前のディレクトリを作った
    * さらにそれぞれのディレクトリ内に public_html/ という名前のディレク
トリを
ディレクトリを作った
* apache を起動した
    * apache は /usr/local/apache2/bin/apachectl で起動/停止する

      # /usr/local/apache2/bin/apachectl -k start

    * 起動したかどうかを以下のコマンドで確認した.

      # ps aux | grep http

      画面左端に www-data と表示されている行があれば, 起動していると分か
分かる.
    * 起動していなかった.
      * 動作すべき module が動作していなかったため, 作業のやり直しを行なった

= Apache のインストールと設定

== モジュールの確認, 追加

* インストールした apache2 で有効になっているモジュールを確認した.

    # /usr/local/apache2/bin/apachectl -t -D DUMP_MODULES

* 結果, 以下の3つが最低限有効になっているかを確認したが, 有効になっ
ていなかった
有効になっていなかった.
    * ssl_module
    * rewrite_module
    * userdir_module

* 以下のように対処した
    * DSO(Dynamic Shared Object) を有効にしているので (configure 時に
--enable-so をつけた), モジュールを追加した.
      * mod_rewrite

        # cd /usr/local/src/httpd-2.4.10/modules/mappers
        # apxs -c mod_rewrite.c
        # apxs -i -a -n rewrite mod_rewrite.la

      * mod_ssl

        # cd /usr/local/src/httpd-2.4.10/modules/ssl
        # apxs -c mod_ssl.c
        # apxs -i -a -c -I /usr/include/openssl -D HAVE_OPENSSL=1
HAVE_OPENSSL=1 -lcrypto -lssl *.c

* 参考: ((<URL: http://kamiyasu2.blog.fc2.com/blog-entry-22.html>))

      * mod_userdir

        # cd /usr/local/src/httpd-2.4.10/modules/mappers
        # apxs -c mod_userdir.c
        # apxs -i -a -n rewrite mod_userdir.la

* この方法では, module は追加されなかった.

もう一度, apache をインストールするところからやり直した.

* configure を行った
     * インストール先と configure の際につけるオプションは以下の通りである.
       * インストール先
         * /usr/local/apache2 (apache2 のデフォルト)
           *  configure の際に --prefix の設定は不要
     * configure オプション (: 目的)
       * --enable-ssl  (: apache-ssl を動作させるため)
       * --enable-rewrite (: mod_rewrite を使用するため)
         * gate の登録窓口を http から https へ移動させたい
       * --enable-so (: DSO (Dynamic shared object: 動的共有オブジェクト)
) を使用するため)
       * --with-included-apr (: ビルド時に "Cannot use an external
external APR-util with  the bundled APR" とエラーが生じる場合があるため)
       * apache2.4.x では apr と apr-util を別途用意する必要が有るため,
((<URL:
.((<URL: http://apr.apache.org/download.cgi/>)) から最新版を取得し, 展開
する
展開する. (参照: ((<URL: http://weblabo.oscasierra.net/install-apache24-1/>)))
     * configure を行った

       $ sudo ./configure --enable-ssl --enable-rewrite --enable-so
--enable-so --with-apr=/usr/local/apr

== ビルドとインストール

    # make
    # make install

* /usr/local/apache2 の下に以下のディレクトリが作成されていることを確認した.

    XXXX@xxx-itpass:/usr/local/apache2$ ls
    bin  build  cgi-bin  conf  error  htdocs  icons  include  logs  man
manual  modules

== 実行ファイルへのパスの設定

* 以前に行なった作業の確認をした

== マニュアルへのパスの設定

* 以前に行なった作業の確認をした

== 設定ファイルの編集

各種設定ファイルは以下のとおり.

* httpd 用
     * /usr/local/apache2/conf/httpd.conf
* httpd-ssl
     * /usr/local/apache2/conf/extra/httpd-ssl.conf
* 各ユーザの public_html 以下の設定用
     * /usr/local/apache2/conf/extra/httpd-userdir.conf


変更の要点は以下の通りである(以下は変更点の概要であり, 実際に行った作業
はこのあとに
作業はこのあとに記述).

* httpd.conf
     * HTTP デーモンを起動するユーザを www-data にする
     * サーバ管理者 (ServerAdmin) のメールアドレスを設定
     * サーバ名 (ServerName) を設定
     * サーバのデフォルトルート (DefaultRoot) を /~itpass に設定
     * ディレクトリのインデックスファイルに index.html 以外に
       index.htm index.htm.en index.html.en index.htm.ja index.html.ja
       も追加.
     * エラーログファイルを /var/log/httpd-error.log に設定
     * アクセスログファイルを /var/log/httpd-access.log に設定
     * CGI に関する設定を変更
     * extra/httpd-vhosts.confをロード
     * extra/httpd-userdir.conf をロード
     * extra/httpd-ssl.conf をロード
     * /~gate, および /cgi-bin に対するアクセスを HTTPS へ移動させる.
     * hiki.cgi の置かれた場所で設定したすべての設定値の変更を, 下位のディ
レクトリで
ディレクトリで変更できるようにする.
     * hiki-IPtable 以外では, mod_negotiation によるコンテントネゴシエー
ションされた
コンテントネゴシエーションされた "MultiViews" を許可する.

* httpd-vhosts.conf
     * {epa,aoe}.scitec.kobe-u.ac.jp 宛の接続を受ける (virtual host)
       * ドキュメントルートは /home/{epalab,aoelab}/public_html にする
       * 管理者メールアドレスは itpadmin _at_ ... にする
       * http://{epa,aoe}.scitec.kobe-u.ac.jp/~gate/ 以下に対するアクセス
アクセスを https://itpass.scitec.kobe-u.ac.jp/~gate に移動させる
     * http://itpass.scitec.kobe-u.ac.jp/{/hiki,/~epalab/hiki,/~itpass/hiki} に
対するアクセスのみ HTTPS へ移動させる. その際, URI のエンコードは行わない.

* httpd-userdir.conf
     * 所有者がマッチしなくてもシンボリックリンクの公開を許可する.

* httpd-ssl.conf
     * ドキュメントルート (DocumentRoot),
       サーバ名 (ServerName),
       サーバ管理者アドレス (ServerAdmin),
       エラーログ (ErrorLog),
       アクセスログ (TransferLog) を設定する
     * epa.scitec, aoe.scitec の場合の https 接続を設定する

== オリジナルとの diff

=== httpd.conf

    chikuwa3@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/httpd.conf httpd.conf
    --- original/httpd.conf 2015-10-22 18:14:23.846681507 +0900
    +++ httpd.conf 2015-10-22 10:55:25.874182514 +0900
    @@ -28,7 +28,7 @@
     # same ServerRoot for multiple httpd daemons, you will need to change at
     # least PidFile.
     #
    -ServerRoot "/usr/local/apache-httpd/httpd-2.4.17"
    +ServerRoot "/usr/local/apache2"

     #
     # Mutex: Allows you to set the mutex mechanism and mutex file directory
    @@ -62,7 +62,7 @@
     #
     # Example:
     # LoadModule foo_module modules/mod_foo.so
    -#
    +LoadModule rewrite_module modules/mod_rewrite.so
     LoadModule authn_file_module modules/mod_authn_file.so
     #LoadModule authn_dbm_module modules/mod_authn_dbm.so
     #LoadModule authn_anon_module modules/mod_authn_anon.so
    @@ -82,7 +82,7 @@
     #LoadModule auth_digest_module modules/mod_auth_digest.so
     #LoadModule allowmethods_module modules/mod_allowmethods.so
     #LoadModule file_cache_module modules/mod_file_cache.so
    -#LoadModule cache_module modules/mod_cache.so
    +LoadModule cache_module modules/mod_cache.so
     #LoadModule cache_disk_module modules/mod_cache_disk.so
     #LoadModule cache_socache_module modules/mod_cache_socache.so
     #LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
    @@ -126,7 +126,7 @@
     #LoadModule session_cookie_module modules/mod_session_cookie.so
     #LoadModule session_dbd_module modules/mod_session_dbd.so
     #LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
    -#LoadModule ssl_module modules/mod_ssl.so
    +LoadModule ssl_module         modules/mod_ssl.so
     #LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
     #LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
     #LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
    @@ -136,16 +136,16 @@
     LoadModule status_module modules/mod_status.so
     LoadModule autoindex_module modules/mod_autoindex.so
     #LoadModule info_module modules/mod_info.so
    -#LoadModule cgid_module modules/mod_cgid.so
    +LoadModule cgid_module modules/mod_cgid.so
     #LoadModule dav_fs_module modules/mod_dav_fs.so
     #LoadModule vhost_alias_module modules/mod_vhost_alias.so
     #LoadModule negotiation_module modules/mod_negotiation.so
     LoadModule dir_module modules/mod_dir.so
     #LoadModule actions_module modules/mod_actions.so
     #LoadModule speling_module modules/mod_speling.so
    -#LoadModule userdir_module modules/mod_userdir.so
    +LoadModule userdir_module modules/mod_userdir.so
     LoadModule alias_module modules/mod_alias.so
    -#LoadModule rewrite_module modules/mod_rewrite.so
    +LoadModule rewrite_module     modules/mod_rewrite.so

     <IfModule unixd_module>
     #
    @@ -156,8 +156,8 @@
     # It is usually good practice to create a dedicated user and group for
     # running httpd, as with most system services.
     #
    -User daemon
    -Group daemon
    +User www-data
    +Group www-data

     </IfModule>

    @@ -178,7 +178,7 @@
     # e-mailed.  This address appears on some server-generated pages, such
     # as error documents.  e.g. admin@your-domain.com
     #
    -ServerAdmin you@example.com
    +ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp

     #
     # ServerName gives the name and port that the server uses to identify itself.
    @@ -187,7 +187,7 @@
     #
     # If your host doesn't have a registered DNS name, enter its IP address here.
     #
    -#ServerName www.example.com:80
    +ServerName itpass.scitec.kobe-u.ac.jp:80

     #
     # Deny access to the entirety of your server's filesystem. You must
    @@ -211,8 +211,8 @@
     # documents. By default, all requests are taken from this directory, but
     # symbolic links and aliases may be used to point to other locations.
     #
    -DocumentRoot "/usr/local/apache-httpd/httpd-2.4.17/htdocs"
    -<Directory "/usr/local/apache-httpd/httpd-2.4.17/htdocs">
    +DocumentRoot "/home/itpass/public_html"
    +<Directory "/home/itpass/public_html">
         #
         # Possible values for the Options directive are "None", "All",
         # or any combination of:
    @@ -234,10 +234,12 @@
         #
         AllowOverride None

    +    Order deny,allow
    +
         #
         # Controls who can get stuff from this server.
         #
    -    Require all granted
    +         Require all granted
     </Directory>

     #
    @@ -245,7 +247,7 @@
     # is requested.
     #
     <IfModule dir_module>
    -    DirectoryIndex index.html
    +    DirectoryIndex index.html index.htm index.htm.en index.html.en index.htm.ja index.html.ja
     </IfModule>

     #
    @@ -263,7 +265,7 @@
     # logged here.  If you *do* define an error logfile for a <VirtualHost>
     # container, that host's errors will be logged there and not here.
     #
    -ErrorLog "logs/error_log"
    +ErrorLog "/var/log/httpd-error.log"

     #
     # LogLevel: Control the number of messages logged to the error_log.
    @@ -292,13 +294,13 @@
         # define per-<VirtualHost> access logfiles, transactions will be
         # logged therein and *not* in this file.
         #
    -    CustomLog "logs/access_log" common
    +    # CustomLog "logs/access_log" common

         #
         # If you prefer a logfile with access, agent, and referer information
         # (Combined Logfile Format) you can use the following directive.
         #
    -    #CustomLog "logs/access_log" combined
    +    CustomLog "logs/access_log" combined
     </IfModule>

     <IfModule alias_module>
    @@ -328,7 +330,7 @@
         # client.  The same rules about trailing "/" apply to ScriptAlias
         # directives as to Alias.
         #
    -    ScriptAlias /cgi-bin/ "/usr/local/apache-httpd/httpd-2.4.17/cgi-bin/"
    +    ScriptAlias /cgi-bin/ "/usr/local/apache2/cgi-bin/"

     </IfModule>

    @@ -337,16 +339,16 @@
         # ScriptSock: On threaded servers, designate the path to the UNIX
         # socket used to communicate with the CGI daemon of mod_cgid.
         #
    -    #Scriptsock cgisock
    +    Scriptsock cgisock
     </IfModule>

     #
    -# "/usr/local/apache-httpd/httpd-2.4.17/cgi-bin" should be changed to whatever your ScriptAliased
    +# "/usr/local/apache2/cgi-bin" should be changed to whatever your ScriptAliased
     # CGI directory exists, if you have that configured.
     #
    -<Directory "/usr/local/apache-httpd/httpd-2.4.17/cgi-bin">
    -    AllowOverride None
    -    Options None
    +<Directory "/usr/local/apache2/cgi-bin/">
    +    AllowOverride AuthConfig Limit
    +    Options +ExecCGI +FollowSymLinks +IncludesNoExec
         Require all granted
     </Directory>

    @@ -383,7 +385,7 @@
         # To use CGI scripts outside of ScriptAliased directories:
         # (You will also need to add "ExecCGI" to the "Options" directive.)
         #
    -    #AddHandler cgi-script .cgi
    +    AddHandler cgi-script .cgi

         # For type maps (negotiated resources):
         #AddHandler type-map var
    @@ -455,13 +457,13 @@
     #Include conf/extra/httpd-languages.conf

     # User home directories
    -#Include conf/extra/httpd-userdir.conf
    +Include conf/extra/httpd-userdir.conf

     # Real-time info on requests and configuration
     #Include conf/extra/httpd-info.conf

     # Virtual hosts
    -#Include conf/extra/httpd-vhosts.conf
    +Include conf/extra/httpd-vhosts.conf

     # Local access to the Apache HTTP Server Manual
     #Include conf/extra/httpd-manual.conf
    @@ -478,7 +480,7 @@
     </IfModule>

     # Secure (SSL/TLS) connections
    -#Include conf/extra/httpd-ssl.conf
    +Include conf/extra/httpd-ssl.conf
     #
     # Note: The following must must be present to support
     #       starting without SSL on platforms with no /dev/random equivalent
    @@ -488,7 +490,44 @@
     SSLRandomSeed startup builtin
     SSLRandomSeed connect builtin
     </IfModule>
    +
     #
    +# Setting for Hiki Area
    +#
    +<Directory "/home/epalab/public_html/hiki">
    + AllowOverride ALL
    + Options -MultiViews
    +</Directory>
    +
    +<Directory "/home/itpass/public_html/hiki">
    + AllowOverride ALL
    + Options -MultiViews
    +</Directory>
    +
    +<Directory "/home/itpass/public_html/hiki-secret">
    + AllowOverride ALL
    + Options -MultiViews
    +</Directory>
    +
    +<Directory "/home/uwabami/public_html/hiki">
    + AllowOverride FileInfo AuthConfig Limit Indexes Options=ExecCGI,FollowSymlinks
    + Options -MultiViews
    +</Directory>
    +
    +<Directory "/home/bldg3/public_html/hiki">
    + AllowOverride ALL
    + Options -MultiViews
    +</Directory>
    +
    +<Directory "/home/fourtran/public_html/hiki">
    + AllowOverride FileInfo AuthConfig Limit Indexes Options=ExecCGI,FollowSymlinks
    + Options -MultiViews
    +</Directory>
    +
    +<Directory "/home/itpass/public_html/hiki-IPtable">
    + AllowOverride ALL
    +</Directory>
    +
     # uncomment out the below to deal with user agents that deliberately
     # violate open standards by misusing DNT (DNT *must* be a specific
     # end-user choice)

=== extra/httpd-ssl.conf

    chikuwa3@tako-itpass:/usr/local/apache2/conf$ sudo diff -u original/extra/httpd-ssl.conf extra/httpd-ssl.conf
    --- original/extra/httpd-ssl.conf 2015-10-22 18:15:25.262682670 +0900
    +++ extra/httpd-ssl.conf 2015-10-22 12:24:46.814284081 +0900
    @@ -49,7 +49,8 @@
     #   ensure these follow appropriate best practices for this deployment.
     #   httpd 2.2.30, 2.4.13 and later force-disable aNULL, eNULL and EXP ciphers,
     #   while OpenSSL disabled these by default in 0.9.8zf/1.0.0r/1.0.1m/1.0.2a.
    -SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
    +#SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
    +SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
     SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4

     #  By the end of 2016, only TLSv1.2 ciphers should remain in use.
    @@ -69,7 +70,8 @@
     #   own preference of either security or performance, therefore this
     #   must be the prerogative of the web server administrator who manages
     #   cpu load versus confidentiality, so enforce the server's cipher order.
    -SSLHonorCipherOrder on
    +SSLHonorCipherOrder on
    +SSLCompression Off

     #   SSL Protocol support:
     #   List the protocol versions which clients are allowed to connect with.
    @@ -88,8 +90,8 @@
     #   Inter-Process Session Cache:
     #   Configure the SSL Session Cache: First the mechanism
     #   to use and second the expiring timeout (in seconds).
    -#SSLSessionCache "dbm:/usr/local/apache-httpd/httpd-2.4.17/logs/ssl_scache"
    -SSLSessionCache "shmcb:/usr/local/apache-httpd/httpd-2.4.17/logs/ssl_scache(512000)"
    +#SSLSessionCache         "dbm:/usr/local/apache2/logs/ssl_scache"
    +#SSLSessionCache "shmcb:/usr/local/apache2/logs/ssl_scache(512000)"
     SSLSessionCacheTimeout  300

     #   OCSP Stapling (requires OpenSSL 0.9.8h or later)
    @@ -106,7 +108,7 @@
     #   the same mechanism that is used for the SSL session cache
     #   above.  If stapling is used with more than a few certificates,
     #   the size may need to be increased.  (AH01929 will be logged.)
    -#SSLStaplingCache "shmcb:/usr/local/apache-httpd/httpd-2.4.17/logs/ssl_stapling(32768)"
    +#SSLStaplingCache "shmcb:/usr/local/apache2/logs/ssl_stapling(32768)"

     #   Seconds before valid OCSP responses are expired from the cache
     #SSLStaplingStandardCacheTimeout 3600
    @@ -118,19 +120,22 @@
     ## SSL Virtual Host Context
     ##

    -<VirtualHost _default_:443>
    +# NameVirtualHost *:433
    +<VirtualHost *:443>

     #   General setup for the virtual host
    -DocumentRoot "/usr/local/apache-httpd/httpd-2.4.17/htdocs"
    -ServerName www.example.com:443
    -ServerAdmin you@example.com
    -ErrorLog "/usr/local/apache-httpd/httpd-2.4.17/logs/error_log"
    -TransferLog "/usr/local/apache-httpd/httpd-2.4.17/logs/access_log"
    +DocumentRoot "/home/itpass/public_html"
    +ServerName itpass.scitec.kobe-u.ac.jp:443
    +ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
    +ErrorLog "/var/log/httpd-ssl-error.log"
    +TransferLog "/var/log/httpd-ssl-access.log"

     #   SSL Engine Switch:
     #   Enable/Disable SSL for this virtual host.
     SSLEngine on

    +SSLProtocol all -SSLv2 -SSLv3
    +
     #   Server Certificate:
     #   Point SSLCertificateFile at a PEM encoded certificate.  If
     #   the certificate is encrypted, then you will be prompted for a
    @@ -141,9 +146,9 @@
     #   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
     #   require an ECC certificate which can also be configured in
     #   parallel.
    -SSLCertificateFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server.crt"
    -#SSLCertificateFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server-dsa.crt"
    -#SSLCertificateFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server-ecc.crt"
    +SSLCertificateFile "/usr/local/apache2/conf/ca/itpass/itpass.crt"
    +#SSLCertificateFile "/usr/local/apache2/conf/server-dsa.crt"
    +#SSLCertificateFile "/usr/local/apache2/conf/server-ecc.crt"

     #   Server Private Key:
     #   If the key is not combined with the certificate, use this
    @@ -151,9 +156,9 @@
     #   you've both a RSA and a DSA private key you can configure
     #   both in parallel (to also allow the use of DSA ciphers, etc.)
     #   ECC keys, when in use, can also be configured in parallel
    -SSLCertificateKeyFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server.key"
    -#SSLCertificateKeyFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server-dsa.key"
    -#SSLCertificateKeyFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server-ecc.key"
    +SSLCertificateKeyFile "/usr/local/apache2/conf/ca/itpass/itpass.key"
    +#SSLCertificateKeyFile "/usr/local/apache2/conf/server-dsa.key"
    +#SSLCertificateKeyFile "/usr/local/apache2/conf/server-ecc.key"

     #   Server Certificate Chain:
     #   Point SSLCertificateChainFile at a file containing the
    @@ -162,7 +167,7 @@
     #   the referenced file can be the same as SSLCertificateFile
     #   when the CA certificates are directly appended to the server
     #   certificate for convenience.
    -#SSLCertificateChainFile "/usr/local/apache-httpd/httpd-2.4.17/conf/server-ca.crt"
    +#SSLCertificateChainFile "/usr/local/apache2/conf/server.crt"

     #   Certificate Authority (CA):
     #   Set the CA certificate verification path where to find CA
    @@ -171,8 +176,8 @@
     #   Note: Inside SSLCACertificatePath you need hash symlinks
     #         to point to the certificate files. Use the provided
     #         Makefile to update the hash symlinks after changes.
    -#SSLCACertificatePath "/usr/local/apache-httpd/httpd-2.4.17/conf/ssl.crt"
    -#SSLCACertificateFile "/usr/local/apache-httpd/httpd-2.4.17/conf/ssl.crt/ca-bundle.crt"
    +#SSLCACertificatePath "/usr/local/apache2/conf/ssl.crt"
    +#SSLCACertificateFile "/usr/local/apache2/conf/ssl.crt/ca-bundle.crt"

     #   Certificate Revocation Lists (CRL):
     #   Set the CA revocation path where to find CA CRLs for client
    @@ -183,8 +188,8 @@
     #   Note: Inside SSLCARevocationPath you need hash symlinks
     #         to point to the certificate files. Use the provided
     #         Makefile to update the hash symlinks after changes.
    -#SSLCARevocationPath "/usr/local/apache-httpd/httpd-2.4.17/conf/ssl.crl"
    -#SSLCARevocationFile "/usr/local/apache-httpd/httpd-2.4.17/conf/ssl.crl/ca-bundle.crl"
    +#SSLCARevocationPath "/usr/local/apache2/conf/ssl.crl"
    +#SSLCARevocationFile "/usr/local/apache2/conf/ssl.crl/ca-bundle.crl"
     #SSLCARevocationCheck chain

     #   Client Authentication (Type):
    @@ -200,8 +205,8 @@
     #   file (containing login information for SRP user accounts).
     #   Requires OpenSSL 1.0.1 or newer. See the mod_ssl FAQ for
     #   detailed instructions on creating this file. Example:
    -#   "openssl srp -srpvfile /usr/local/apache-httpd/httpd-2.4.17/conf/passwd.srpv -add username"
    -#SSLSRPVerifierFile "/usr/local/apache-httpd/httpd-2.4.17/conf/passwd.srpv"
    +#   "openssl srp -srpvfile /usr/local/apache2/conf/passwd.srpv -add username"
    +#SSLSRPVerifierFile "/usr/local/apache2/conf/passwd.srpv"

     #   Access Control:
     #   With SSLRequire you can do per-directory access control based
    @@ -249,7 +254,7 @@
     <FilesMatch "\.(cgi|shtml|phtml|php)$">
         SSLOptions +StdEnvVars
     </FilesMatch>
    -<Directory "/usr/local/apache-httpd/httpd-2.4.17/cgi-bin">
    +<Directory "/usr/local/apache2/cgi-bin">
         SSLOptions +StdEnvVars
     </Directory>

    @@ -284,7 +289,41 @@
     #   Per-Server Logging:
     #   The home of a custom SSL log file. Use this when you want a
     #   compact non-error SSL logfile on a virtual host basis.
    -CustomLog "/usr/local/apache-httpd/httpd-2.4.17/logs/ssl_request_log" \
    +CustomLog "/usr/local/apache2/logs/ssl_request_log" \
               "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

    -</VirtualHost>
    +</VirtualHost>
    +
    +<VirtualHost *:443>
    +DocumentRoot "/home/aoelab/public_html"
    +ServerName aoe.scitec.kobe-u.ac.jp:443
    +ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
    +ErrorLog /var/log/httpd-ssl-error.log
    +TransferLog /var/log/httpd-ssl-access.log
    +SSLEngine on
    +#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:!SSLv2:!SSLv3:+EXP:+eNULL
    +SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
    +SSLCertificateFile "/usr/local/apache2/conf/ca/aoe/aoe.crt"
    +SSLCertificateKeyFile "/usr/local/apache2/conf/ca/aoe/aoe.key"
    +SSLProtocol all -SSLv2 -SSLv3
    +SSLHonorCipherOrder On
    +SSLCompression Off
    +</VirtualHost>
    +
    +<VirtualHost *:443>
    +DocumentRoot "/home/epalab/public_html"
    +ServerName epa.scitec.kobe-u.ac.jp:443
    +ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
    +ErrorLog /var/log/httpd-ssl-error.log
    +TransferLog /var/log/httpd-ssl-access.log
    +SSLEngine on
    +#SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:!SSLv2:!SSLv3:+EXP:+eNULL
    +SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS
    +SSLCertificateFile "/usr/local/apache2/conf/ca/epa/epa.crt"
    +SSLCertificateKeyFile "/usr/local/apache2/conf/ca/epa/epa.key"
    +SSLProtocol all -SSLv2 -SSLv3
    +SSLHonorCipherOrder On
    +SSLCompression Off
    +</VirtualHost>
    +
    +

=== extra/httpd-vhosts.conf

    chikuwa3@tako-itpass:/usr/local/apache2/conf$ sudo diff -u
original/extra/httpd-vhosts.conf extra/httpd-vhosts.conf
    --- original/extra/httpd-vhosts.conf 2015-10-22 18:17:09.778684650 +0900
    +++ extra/httpd-vhosts.conf 2015-10-22 12:25:19.174284694 +0900
    @@ -21,21 +21,72 @@
     # match a ServerName or ServerAlias in any <VirtualHost> block.
     #
     <VirtualHost *:80>
    -    ServerAdmin webmaster@dummy-host.example.com
    -    DocumentRoot "/usr/local/apache-httpd/httpd-2.4.17/docs/dummy-host.example.com"
    -    ServerName dummy-host.example.com
    -    ServerAlias www.dummy-host.example.com
    -    ErrorLog "logs/dummy-host.example.com-error_log"
    -    CustomLog "logs/dummy-host.example.com-access_log" common
    +ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
    +    DocumentRoot "/home/itpass/public_html"
    +    ServerName itpass.scitec.kobe-u.ac.jp
    +    ErrorLog "/var/log/httpd-error.log"
    +    CustomLog "/var/log/httpd-access.log" combined
    +    <IfModule mod_rewrite.c>
    +      RewriteEngine On
    +#      RewriteLog "/var/log/httpd-rewrite.log"
    +#      RewriteLogLevel 0
    +      LogLevel alert rewrite:trace1
    +      RewriteCond %{SERVER_PORT} !^443$
    +      RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki/$1 [L,R,NE]
    +      RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki-secret/$1 [L,R,NE]
    +      # ---- hiki
    +      RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki/$1 [L,R,NE]
    +      RewriteRule ^/~bldg3/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~bldg3/hiki/$1 [L,R,NE]
    +      RewriteRule ^/~epalab/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~epalab/hiki/$1 [L,R,NE]
    +      RewriteRule ^/~itpass/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~itpass/hiki/$1 [L,R,NE]
    +      RewriteRule ^/~itpass/hiki-secret/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~itpass/hiki-secret/$1 [L,R,NE]
    +      # ---- gate
    +      RewriteRule ^/~gate/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~gate/$1 [L,R,NE]
    +      RewriteRule ^/cgi-bin/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/cgi-bin/$1 [L,R,NE]
    +    </IfModule>
     </VirtualHost>

    +# ---- aoelab ----
     <VirtualHost *:80>
    -    ServerAdmin webmaster@dummy-host2.example.com
    -    DocumentRoot "/usr/local/apache-httpd/httpd-2.4.17/docs/dummy-host2.example.com"
    -    ServerName dummy-host2.example.com
    -    ErrorLog "logs/dummy-host2.example.com-error_log"
    -    CustomLog "logs/dummy-host2.example.com-access_log" common
    +    ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
    +        DocumentRoot "/home/aoelab/public_html"
    +        ServerName aoe.scitec.kobe-u.ac.jp
    +        ErrorLog "/var/log/httpd-error.log"
    +        CustomLog "/var/log/httpd-access.log" combined
    +        <IfModule mod_rewrite.c>
    +          RewriteEngine On
    +#          RewriteLog "/var/log/httpd-rewrite.log"
    +#          RewriteLogLevel 0
    +          LogLevel alert rewrite:trace1
    +          RewriteCond %{SERVER_PORT} !^443$
    +          # ---- hiki
    +          RewriteRule ^/hiki/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/hiki/$1 [L,R]
    +          # ---- gate
    +          RewriteRule ^/~gate/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~gate/$1 [L,R,NE]
    +          RewriteRule ^/cgi-bin/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/cgi-bin/$1 [L,R,NE]
    +        </IfModule>
     </VirtualHost>

    +# ---- epalab ----
    +<VirtualHost *:80>
    +    ServerAdmin itpadmin@itpass.scitec.kobe-u.ac.jp
    +    DocumentRoot "/home/epalab/public_html"
    +    ServerName epa.scitec.kobe-u.ac.jp
    +    ErrorLog /var/log/httpd-error.log
    +    CustomLog /var/log/httpd-access.log combined
    +    <IfModule mod_rewrite.c>
    +      RewriteEngine On
    +#      RewriteLog "/var/log/httpd-rewrite.log"
    +#      RewriteLogLevel 0
    +      LogLevel alert rewrite:trace1
    +      RewriteCond %{SERVER_PORT} !^443$
    +      # ---- hiki
    +      RewriteRule ^/hiki/(.*)?$ https://epa.scitec.kobe-u.ac.jp/hiki/$1 [L,R,NE]
    +      # ---- gate
    +      RewriteRule ^/~gate/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/~gate/$1 [L,R,NE]
    +      RewriteRule ^/cgi-bin/(.*)?$ https://itpass.scitec.kobe-u.ac.jp/cgi-bin/$1 [L,R,NE]
    +    </IfModule>
    + </VirtualHost>
    +

=== extra/httpd-userdir.conf

    chikuwa3@tako-itpass:/usr/local/apache2/conf$ sudo diff -u
original/extra/httpd-userdir.conf extra/httpd-userdir.conf
    --- original/extra/httpd-userdir.conf 2015-10-22 18:15:56.770683267 +0900
    +++ extra/httpd-userdir.conf 2015-10-22 10:28:50.730152293 +0900
    @@ -1,3 +1,4 @@
    +# -*- apache -*-
     # Settings for user home directories
     #
     # Required module: mod_authz_core, mod_authz_host, mod_userdir
    @@ -15,7 +16,14 @@
     #
     <Directory "/home/*/public_html">
         AllowOverride FileInfo AuthConfig Limit Indexes
    -    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    +    Options MultiViews Indexes FollowSymLinks IncludesNoExec
         Require method GET POST OPTIONS
    +    <IfModule negotiation_module>
    +        AddLanguage ja .ja
    +        AddLanguage ja-JP .ja
    +        AddLanguage en .en
    +        LanguagePriority en ja
    +        ForceLanguagePriority Prefer Fallback
    +    </IfModule>
     </Directory>

== モジュールの確認, 追加

* インストールした apache2 で有効になっているモジュールを確認した.

# /usr/local/apache2/bin/apachectl -t -D DUMP_MODULES

* 結果, 最低限有効になっておくべき以下の3つが有効になっていることを確認した
    * ssl_module
    * rewrite_module
    * userdir_module

= ログローテートの設定

* 以前に行なった作業の確認をした.

= SSL 用の証明書の作成

== openssl の設定を変更

* 以前に行なった作業の確認をした.

=== プライベート CA の作成

前日と同じ作業を行った.

= 動作チェック

* apache を起動する前に, ドキュメントルートとなるディレクトリを作成して
あることを
作成してあることを確認した.
     * /home/ 以下に itpass/, epalab/, aoe/ という名前のディレクトリがあ
ることを
ディレクトリがあることを確認した
     * さらにそれぞれのディレクトリ内に public_html/ という名前のディレク
トリがあることを
ディレクトリがあることを確認した.

* apache を起動した
     * apache は /usr/local/apache2/bin/apachectl で起動/停止する

        # /usr/local/apache2/bin/apachectl -k start

     * 起動したかどうかを以下のコマンドで確認した.

        # ps aux | grep http

       画面左端に www-data と表示されている行があれば, 起動していると分かる.
         * 起動していることを確認した.

* ~itpass/public_html/ に test という名前のディレクトリを作成し, その
中に test.txt というファイルを作成した

* ブラウザで text.txt が正常に表示されるかどうかを確認した
     * URL は http://tako-itpass.scitec.kobe-u.ac.jp/test/test.txt,
http://tako-itpass.scitec.kobe-u.ac.jp/test/test.txt, https://tako-itpass.scitec.kobe-u.ac.jp/test/test.txt
       * "http://..." と "https://..." の両方に関して行った.
       * 正常に表示されることを確認した.

* apache を停止する

       # /usr/local/apache2/bin/apachectl -k graceful-stop

     * 停止したかどうかを確認した
     * apache のエラーログ /var/log/httpd-error.log を確認し, エラーなどが
出ていないことを確認した


= 起動スクリプトの用意

* サーバの起動時に apache が起動させるための起動スクリプトを用意した.
     * Debian 8 から導入された systemd による起動設定を行なった.

具体的には, ((<URL:http://www.smiyasaka.com/CentOS7.0_server21.html>))
((<URL:http://www.smiyasaka.com/CentOS7.0_server21.html>)) を参考に, /etc/systemd/system に apache2.service を作成した.

    chikuwa2@tako-itpass /etc/systemd/system
    % cat apache2.service
    [Unit]
    Description=httpd-2.4.17 daemon

    [Service]
    Type=forking
    ExecStart=/usr/local/apache2/bin/apachectl start

    [Install]
    WantedBy=multi-user.target%

* 起動テストを行い, 起動の確認をした

    $ sudo systemctl start apache2
    $ ps aux | grep httpd

* システム起動時に apache が立ち上がるようにするために追加設定を行った.

    $ sudo systemctl enable apache2

* 再起動して apache が起動するかを確認する.
     * 起動していることを確認した.