RSS feed for InstantSpot site Blog of Dave

Create SSL sites in Apache on Windows with OpenSSL

Fri, 13 Nov 2009 03:47:33 GMT

To get a secure SSL site up and running on Apache under Windows, there are a few hoops to jump through that are not very intuitive. To that end, I am going to document my approach to setting up SSL using OpenSSL. This approach assumes that you already have Apache up and running on your machine, so if you have not done that, head over to the HTTPD download page and set that up before continuing.

Setting up OpenSSL
First we need to get OpenSSL setup on our system, which is not included with the Apache Windows binaries. In fact the OpenSSL project doesn't even provide the binaries themselves, but you can find them at Shining Light Productions. For this example, I will be choosing the Win32 OpenSSL v0.9.8k Light version. If you see a message like the one below, you will need to install the Microsoft Visual C++ 2008 Redistributable Package and then attempt the OpenSSL installation again.

Once you have it installed, you can do a quick test to make sure that it is set up properly:
Creating Certificates
Next, we will use the OpenSSL terminal interface to create our self-signed certificates. To explain a bit about what is going on below, I have a site already existing on my system that can be reached at http://scribble. What we are doing is creating a secure subdomain of https://secure.scribble. Typically when I create certificates, I name the files with the host/domain obvious so that they can be easily identified later. Obviously you will want to replace the domain name to match your setup, but type the following in the terminal in the OpenSSL/bin directory:

[codeblock 433]

That will generate what you see below.

You may notice that I left a lot of the prompts blank. Considering this is a dummy certificate in a development environment, that approach makes sense. You may choose to be more explicit based on your needs.

If we were to use this key as it is, we would be prompted for the password every time that Apache starts. Since that is less than ideal, we will now generate a non-protected key from the one we created in the previous step by typing the following:

[codeblock 434]

You can see that I was prompted for a pass phrase. This is the same password that you created when we generated the certificate above.

Now we need to need to build the certificate that we will actually import into Apache. You can do so by typing:

[codeblock 435]

This will result in the following output:

You can see that we now have a .cert, .csr, .key, and .pem file for our domain. We will use a combination of the .key and the .cert
Configuring Apache
Now we need to make sure that your Apache server is ready to serve SSL requests.

First, let's put the .key and .cert files that we created above into a directory under Apache. In your "conf" directory, create a subdirectory named "ssl" and move secure.scribble.key and secure.scribble.cert into that new directory.

Next we need to make sure that the mod_ssl module is enabled. Open up the httpd.conf file for your Apache webserver. Search for "mod_ssl" and you should find a line that looks like this:

Yours will likely be commented out with a '#' sign in front of the line. You will want to delete that '#' so that it looks like the highlighted line above.

Next you will need to make sure that you have uncommented the line that includes the httpd-ssl.conf file like you see below:

The last thing we need to do is configure our site. Open up the conf/extra/httpd-ssl.conf file in an editor. You will see that there is an amazingly huge and complex site definition in there already that starts with and ends about 150 lines later with . We need to disable this site. If you are feeling bold, you can simply delete it. However, I take the approach of commenting it out entirely so that I still have it as a reference, which is my recommendation as well. Starting with the line , put a '#' at the start of every line that doesn't already have one and continue until you comment out the line.

Now it is finally time for us to create the site definition for our https://secure.scribble site. We will use some of the concepts in the example, but eliminate most of them. Here is what mine looks like after paring down all the excess:
[codeblock 436]

In that code you can see where we are pointing to the .key and .cert files that we created above.

Now, restart your Apache server and you are now serving up securely!

Setting up Apache, OpenBD, Railo and ColdFusion - Part 4 - Installing Railo under Tomcat with Apache webserver

Tue, 10 Feb 2009 04:31:00 GMT

This is Part 4 in an ongoing series demonstrating how to install OpenBlueDragon, ColdFusion, and Railo concurrently with all requests passing through the Apache webserver. You will find links to all parts of this series at the bottom under "Related Content"

In this post we will be building upon our existing environment in which we installed Apache webserver, Tomcat 6, OpenBlueDragon, and ColdFusion, by adding Railo to the mix. If you have been following along thus far, we are well past the hard stuff at this point. To install Railo, which is deployed as a java war file, we are going to repeat and slightly modify many of the steps that we took at the end of Part 2 when we installed OpenBD as a Tomcat web application.

Let's start by setting up our hosts entry so that our new site resolves to localhost.railo, and set up the Apache webserver to listen for the request. Open up /etc/hosts, and append 'localhost.railo' (without quotes!) to the line that begins with 127.0.0.1. Next we want to create a new virtual host file for the site under Apache. Do so like this:

$ cd /etc/apache2/sites-available   sudo gedit localhost.railo

Paste the following into that new file and save it.

<VirtualHost *>  ServerName localhost.railo  JKMount /* worker1 </VirtualHost>

As we learned in Part 2, the line "JKMount /* worker1" is instructing apache to pass everything to the worker we defined in /etc/apache2/workers.properties. That worker will then pass the request on to Tomcat port 8009, under which our application actually resides.

Now that we have defined this site, we want to make sure that it gets included on our next Apache restart. We do this by running the following:

$ sudo a2ensite localhost.railo  Site localhost.railo installed; run /etc/init.d/apache2 reload to enable.

At this point, we need to make sure there is a an application set up in Tomcat to receive our request. First, let's start by downloadingthe free Railo Server from their download page. Look toward the bottom of the page and download "Railo Custom" and download railo-3.0.2.001.war. (or newer version if it is there). Once we have the file downloaded, we will create a new directory for our application under Tomcat. We will then copy the Railo war file into it from our download directory. When we have the war file under /opt/tomcat6/webappas/localhost.railo/ we will extract it, and then safely delete the war file itself. These steps can be seen here:

$ sudo /opt/tomcat6/webapps/localhost.railo  sudo cp railo-3.0.2.001.war /opt/tomcat6/webapps/localhost.railo/  cd /opt/tomcat6/webapps/localhost.railo  sudo jar xvf railo-3.0.2.001.war   sudo rm railo-3.0.2.001.war

Since we now have the application in place, it is time to modify the Tomcat server config so that it knows to send the appropriate requests to it. Do the following:

$ sudo gedit /opt/tomcat6/conf/server.xml

Look for the section that we added previously for our OpenBlueDragon localhost site "localhost.bd". We are going to copy that section, modifying the "name" and "docBase" attributes to match our new application and paste it just below the localhost.bd site. When you are done they should look like this:

<Host name="localhost.bd"  appBase="webapps" unpackWARs="true"   autoDeploy="true" xmlValidation="true" xmlNamespaceAware="false">   <Context path="" docBase="localhost.bd/" reloadable="true" privileged="true" antiResourceLocking="false" anitJARLocking="false" /> </Host>  <Host name="localhost.railo"  appBase="webapps"  unpackWARs="true"   autoDeploy="true" xmlValidation="true" xmlNamespaceAware="false">   <Context path="" docBase="localhost.railo/" reloadable="true" privileged="true" antiResourceLocking="false" anitJARLocking="false" /> </Host>

With all that done, we are ready to restart (or start) Apache, Tomcat and our new Railo site will be available at http://localhost.railo

So with our original goal of being able to run the three CFML engines, it's time to see how we did....

Setting up Apache, OpenBD, Railo and ColdFusion - Part 3 - Installing ColdFusion and customizing the connector

Thu, 05 Feb 2009 04:35:00 GMT

This is the third part in a series of posts on setting up ColdFusion, OpenBlueDragon, and Railo all on the same machine using Apache webserver to listen for all requests and direct traffic. Part 2 can be found here. You will find links to all parts of this series at the bottom under "Related Content"

With that said, this part in the series focuses on installing ColdFusion and configuring the webserver adapter in such a way that only specific Virtual Hosts will be set up to pass requests to the ColdFusion server. First we want to start by creating a localhost site that is specific to ColdFusion 8 in Apache. I tend to keep all my sites under /www which is actually symlinked to a 'www' in my home directory. I find a few benefits in this. First, I usually keep my home partition in shape and carry it around with me from distro to distro, so I always have my sites in tact with me. Secondly since it is a symlink to my home and not in a system folder I don't need special permissions to write in it. I will be following along this path, but if you keep your sites elsewhere, then you can adjust as necessary.

$ mkdir /www/localhost.cf8

Now, we will want to create an Apache virtual host definition for this site. To do so, create a new configuration file like this:

$ sudo gedit /etc/apache2/sites-available/localhost.cf8

Paste the the following, then save and close.

<VirtualHost *>  ServerName localhost.cf8   <Directory /www/localhost.cf8/>   Options Indexes FollowSymLinks MultiViews   AllowOverride None   Order allow,deny   allow from all  </Directory>  DocumentRoot /www/localhost.cf8 </VirtualHost>

Now we need to make sure that file is included when Apache starts, so run the following command which will make a symlink to the sites-enabled directory.

$  sudo a2ensite localhost.cf8 Site localhost.cf8 installed; run /etc/init.d/apache2 reload to enable.

As you can see from the localhost.cf8 configuration file, we are expecting our ServerName to be localhost.cf8, so we now need to add that entry to our hosts file.

$ sudo gedit /etc/hosts

Append "localhost.cf8" (with no quotes!) to the line that begins with 127.0.0.1. Save the file and close. At this point you should be able to restart Apache and hit that empty site in your browser like this: Now that we have a site ready, it is time for us to install ColdFusion. Once you have downloaded the .bin installation file from Adobe, browse to that directory in a terminal window. You may need to chmod the file to be executable, then launch it like this:

$ chmod +x coldfusion-801-lin.bin  sudo ./coldfusion-801-lin.bin

Choose 1 for English. After the welcome screen, hit enter to continue. Next type "Y" and hit enter to agree to the terms and conditions. We are now faced with the installation type prompt. For this example of setting up a development environment, we will choose option 3 "Developer Edition" For our purposes we are going to choose the "Server configuration" option. However, it should be noted that you could quite easily choole the J2EE WAR file option and install into Tomcat as we did with OpenBlueDragon in Part 2 of thise series. Since we are installing from scratch, we will choose "No" (2) on the next option which is asking if there is an existing version of ColdFusion 8 installed on this machine. For this installation we do not want any of the extra options to install such as Documentation, LiveCycle, Search Services, nor do we want to start on system init since this is on my laptop and I may not always want ColdFusion to start at boot. So we will uncheck all options like you see in this image and continue. We are going to accept the default installation path of /opt/coldfusion8 Again, since this is a fresh installation, we are going to say "No" (2) to the prompt asking if there are earlier versions of ColdFusion on this computer. Now we start to work our way into the webserver configuration which will tie ColdFusion into Apache. To start, choose "Add Web Server Configuration" (1) when prompted, then choose "Apache" (1). In the following prompt asking for the Apache directory that contains your http.conf file, enter /etc/apache2 as you see in the picture below: For the location of the Apache program binary file, enter /usr/sbin/apache2. For the Start/Stop script, enter /etc/init.d/apache2. You will see both of these choices here: We now return to the first webserver configuration menu and this time choose "Continue with installation" (4). Then we will need to enter the location of the webroot. We are going to enter the directory of our new site /www/localhost.cf8 that we created above as you can see in the picture below. We will also be asked which user we would like ColdFusion to run as. I typically like to use my own user account for this so I don't end up with permissions issues where I have difficulty accessing files generated by ColdFusion Now enter your admin password, and if you choose to user RDS, enter the password for it as well. It will now show you the general options you have selected and you will hit enter to start the actual installation. Once it completes and prompts you to "Press Enter to exit the installer", do so and then start the server with this:

$ sudo /opt/coldfusion8/bin/coldfusion start

During this stage you should see messages that it is configuring the webserver successfully, assuming we entered everything properly above. Once you are returned to a prompt, it is time to go customize the Apache connector stuff just a bit. open the httpd.conf file like this:

$ sudo gedit /etc/apache2/httpd.conf

In that you will find the connector stuff that ColdFusion added starting with a line: #JRun Settings. Before we take the next steps, let me explain a bit what we are going to do. We are going to seperate this into two pieces: the module loader, and the actual connector declaration. As it stands right now, and request coming through the webserver would be handled by ColdFusion and we don't really want that. To make it more granular, we are going to create an include file that can be added to any site that will add the connector only to that particular site. With that said, let's walk through it. *Cut* (not copy!) these two lines of that connector info:

# JRun Settings LoadModule jrun_module /opt/coldfusion8/runtime/lib/wsconfig/1/mod_jrun22.so

Now we are going to paste those into a new file that will go in our mods-available directory. Click on the "New" button in gedit and paste that text in. Now save that file as /etc/apache2/mods-available/cf8.load. Now *cut* (not copy!) the remainder of the connector out that looks like this:

<IfModule mod_jrun22.c>     JRunConfig Verbose false     JRunConfig Apialloc false     JRunConfig Ignoresuffixmap false     JRunConfig Serverstore /opt/coldfusion8/runtime/lib/wsconfig/1/jrunserver.store     JRunConfig Bootstrap 127.0.0.1:51801     #JRunConfig Errorurl url <optionally redirect to this URL on errors>     #JRunConfig ProxyRetryInterval 600 <number of seconds to wait before trying to reconnect to unreachable clustered server>     #JRunConfig ConnectTimeout 15 <number of seconds to wait on a socket connect to a jrun server>     #JRunConfig RecvTimeout 300 <number of seconds to wait on a socket receive to a jrun server>     #JRunConfig SendTimeout 15 <number of seconds to wait on a socket send to a jrun server>     AddHandler jrun-handler .jsp .jws .cfm .cfml .cfc .cfr .cfswf </IfModule>

Create a new file named /etc/apache2/cf8connector. Pasted that text in and save the file. Lastly, you may not have this issue, but I found that the DirectoryIndex attribute of Apache was not adding index.cfm to the list of default files. Due to this I actually added it to my httpd.conf. After all of the steps above, my httpd.conf file only has a single line:

DirectoryIndex index.cfm

Now... it is time to do just a little more Apache config and we are ready to go! Rember that cf8.load mod file we created earlier? Let's turn that on:

$ sudo a2enmod cf8

Now, let's to add an include call to our localhost.cf8 virtual host configuration. Open up /etc/apache2/sites-available/localhost.cf8 and add the "Include c8connector" line that you see below:

<VirtualHost *>         ServerName localhost.cf8          <Directory /www/localhost.cf8/>                 Options Indexes FollowSymLinks MultiViews                 AllowOverride None                 Order allow,deny                 allow from all         </Directory>         DocumentRoot /www/localhost.cf8         Include cf8connector </VirtualHost>

Once you have saved that file, it is time to restart Apache and test out all of our hard work!

$ sudo /etc/init.d/apache2 restart

Now, using your browser, go to http://localhost.cf8/CFIDE/administrator/ and you will see the following: Now... if you are following along from earlier in this series, you should now be able to successfully connect to OpenBD at http://localhost.bd and ColdFusion 8 at http://localhost.cf8 On the next part of this series, we will bring Railo into the mix and finally have all three running on our system.

Next - Part 4 Installing Railo under Tomcat with Apache webserver

Setting up Apache, OpenBD, Railo, and ColdFusion - Part 1

Sun, 01 Feb 2009 07:33:00 GMT

This is Part 1 of a muilt-part blog post demonstrating how run OpenBlueDragon, Railo, and ColdFusion all on the same machine, and all using the Apache webserver with individual Virtual hosts using different CFML engines. But, before we get into it, here is a little background.

For the past several months now I have stepped over to Windows on my laptop after years of not using it regularly. It was actually the first time I had actually used Vista, actually and was quite an interesting experience. First, as much as I love the Linux environment, I really expected to loathe being in Windows daily. I was surprised at how much Vista *didn't* suck. With all the raging passion against it in general I suppose that I had low expectations, but nevertheless I really thought it was pretty decent in general. However it has a more sluggish, constricting feel to it in comparison to Linux, so I have decided I have paid my dues and it is time to go back to using an OS that is truly fun to use, rather than one that just wasn't as crappy as I thought it would be.

After lots of experimentation with various flavors, hands-down Ubuntu is the most painless and most comfortable Linux distros for me personally. My reasoning for that is vast and probably belongs in another blog entry, so I will attempt to keep from straying any further off the topic! That said, last night I decided to try gOS which is a really neat distro built off of Ubuntu. Although the UI is Gnome based, it has more of a Max 10.5.x feel to it. I think Mac folks would feel right at home taking this environment for a spin.

Immediately after the first boot of my shiny new OS I started trying to put my development environment back together. I decided that I wanted to have ColdFusion, Railo, and OpenBD all on from the beginning, with all requests first passing through Apache httpd. Quite some time ago, Aaron Lynch put together some steps to install Smith Project w/Tomcat/Apache, which we have used several times since, primarily setting up Railo. I am not sure I ever would have waded my way through it without his early experimentation and documentation. On this iteration, I loosely followed those instructions, opting for several packages from the repos, and updated versions of software, and have documented my steps as the are somewhat different in areas. For my current environment, I first installed OpenBD. I then followed this by installing ColdFusion and setting it up to user the default JRUN connector that is set up during the installation. Lastly, I installed Railo as another webapp in Tomcat and tied that into Apache as well.

In the following posts, you will see these steps in detail.

Next: Part 2 - Installing Tomcat/Apache/OpenBD

Aaron West's entry on SES URLs with Apache mod_rewrite

Thu, 17 Jan 2008 16:54:00 GMT

Somehow I totally missed this entry when Aaron posted it until he mentioned it on the Mach-II email list today. He has written a really nice and very detailed blog entry on how to configure your application to use SES URLs with by using mod_rewrite in Apache, and then goes on to show how the flow continues to his Mach-II application. We took some similar approaches with the URLs you see here on InstantSpot.

For those wondering how all these pieces fit togther, I strongly recommend you check out his blog entry entitled: Using Apache's mod_rewrite: SES URL's and More.

Creating the equivalent of IIS Virtual Directories in Apache

Sun, 09 Dec 2007 01:36:20 GMT

I have to admit that I used to be guilty of laziness on one aspect when I began using Linux/Apache a couple of years ago as a convert from Windows. I didn't immediately understand how to create the equivalent of virtual directories in Apache that are available in IIS. I soon found that I could just do symbolic links at the file level that would effectively give me the same effect at the broswer request level. However, one big negative is that there is a linked directory sitting there in the parent directory, which is a pain in the tail when it things like source control such as subversion comes into play. When I browse to a directory in a terminal or my IDE, I don't necessarily want to see it either. The answer is to use the "Alias" directive in Apache.

Example:

As a ColdFusion developer, I like to have a CFIDE directory available in my webroot as I develop so that I can access the ColdFusion administrator. I keep my CFIDE directory in /usr/local/apache2/htdocs/CFIDE.

To make that available as a virtual directoy, I need to add the following to my Apache virtual host definition:

    Alias /CFIDE /usr/local/apache2/htdocs/CFIDE
    <Directory /usr/local/apache2/htdocs/CFIDE>
    Order allow,deny
    Allow from all
    </Directory>

Just remember to remove that one before you put it in production!

Problem installing VMWare Tools

Fri, 05 Jan 2007 04:07:02 GMT

In the past year I have "discovered" how cool VMWare is. This virtual machine software allows you to run a huge variety of operating systems as guests under your host operating system. On my laptop, I have run ... errrr.... I mean I know someone who as run Mac OSX, a handful of different Linux distributions and even Windows. For most supported operating systems, VMWare recommends that you click a menu option to install the VMWare tools on the guest operating system. I have tried this repetitively but I always have the same result. It acts like it is going to start doing some type of installation but just never advances. If you look in the menu the option changes from "Install VMWare tools" to "Cancel Installation of VMWare Toos" so it thinks it is doing something. Inevitably after 10 minutes or so, I give up and cancel.

Tonight, however, I was a bit more curious. I noticed that when I began the install the CD icon on the task bar flashed a bit. After logging into the guest Windows operating system, I saw that the virtual CD was labeled VMWare. When I clicked into it, I found the setup program for VMWare tools. It ran it without issue!

I just thought I better document this in case anyone ran across the same situation.

Grand Canyon... It's on!

Mon, 11 Jul 2005 05:00:00 GMT

My father and I decided that this was the year that we would hike the North Rim to the South Rim of the Grand Canyon. I know this seems crazy, but it is actually a paperwork challenge to be able to hike the Grand Canyon. There is an application process in which you have to fax your request in the 1st day of the month 6 months before the intended date of your trip with a detailed itinerary, including where you will be sleeping and when. We sent faxed our paperwork in and held our breath on the 1st of April, 6 months before we hoped to go in September. After no word for a month we finally contacted them, only to find out that we had been rejected. Discouraged, but not beaten, we laid out the calendar to see if there was another time that would work. We decided that November would be acceptable, albeit a little colder. It should be in the 60s in the bottom of the canyon though where we will spend the majority of our time. Once again, we laid out our itinerary and faxed in on July 1. My dad received a letter today dated July 6, 2005 telling him that they were sorry, but they were unable to accept out application. He spent a good hour walking around the house cussing and feeling terribly disappointed. A bit later my mom noticed there was another letter from the Grand Canyon dated July 7, 2005.

Dear Mr. Shuck, we have accepted your request to hike the Grand Canyon on the dates of November 1, 2 and 3, 2005. Enlcosed are your passes, which you will need to affix to your backpack and carry with you in the canyon. There is no need to stop by the back country headquarters before departing on the trail.

So in 3.5 months, I will be taking this in....