Apache on Nico Maas

[Ubuntu] Secure your Apache 2 Reverse Proxy

Mon, 12 Sep 2016 10:36:40 +0000

We got an Apache 2, working as Reverse Proxy to some Docker instances (we won’t talk about the nginx vs Apache stuff here for the same reasons we won’t talk about vi vs emacs vs xyz ;)) - and somehow we realized that our apps are a little bit too sensitive to allow them from any ip.

First, we want to activate the needed modules. Normally that should not be necessary, but for sake of completeness:

[Ubuntu] Letsencrypt with Apache and Freeradius

Mon, 16 May 2016 08:00:53 +0000

This little tutorial describes how to use Letsencrypt with Apache, Freeradius and Auto-Renewal of the Certificates.

Install Letsencrypt

sudo apt-get update  
sudo apt-get install git  
cd /opt  
sudo git clone https://github.com/letsencrypt/letsencrypt /opt/letsencrypt  
cd /opt/letsencrypt

# Become root  
sudo su

# "Order" certificates (replace SERVERDOMAIN.COM with the DNS of your Server!)  
./letsencrypt-auto --apache -d SERVERDOMAIN.COM --rsa-key-size 4096  
Enter Contact Mail: mail@SERVERDOMAIN.COM  
Configuration Type: Secure #is best, as it does redirect insecure http to https)

# Read PATH variable  
echo $PATH

# Cronjob for certificate renewal  
#you should under all circumstances replace the string following PATH= with your own, as read with the command above.  
#Seperate with ; from the rest of the command like shown in the example  
crontab -e

# letsencrypt
30 2 * * 1 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games;/opt/letsencrypt/letsencrypt-auto renew &gt;&gt; /var/log/le-renew.log
35 2 * * 1 /etc/init.d/freeradius restart
35 2 * * 1 /etc/init.d/apache2 restart

Configure Freeradius

cp -r /etc/freeradius/certs/ /etc/freeradius/certs_bkp  
rm /etc/freeradius/certs/*.pem  
cp /etc/freeradius/eap.conf /etc/freeradius/eap.conf_bkp

vi /etc/freeradius/eap.conf

#certdir = ${confdir}/certs
#cadir = ${confdir}/certs
certdir = /etc/letsencrypt/live/SERVERDOMAIN.COM
cadir = /etc/letsencrypt/live/SERVERDOMAIN.COM
#dh_file = ${certdir}/dh
dh_file = ${confdir}/certs/dh
#private_key_password = whatever
private_key_file = ${certdir}/privkey.pem
certificate_file = ${certdir}/cert.pem
CA_file = ${cadir}/fullchain.pem

# Configure access rights on /etc/letsencrypt  
cd /etc/letsencrypt/  
chgrp -R ssl-cert archive csr keys live options-ssl-apache.conf renewal # set group of cert/key dirs to ssl-cert  
find . -type d -exec chmod g+xs {} \; # directories executable and setguid (set group ssl-cert for new files/dirs)  
find . -type f -exec chmod g+r {} \; # files readable

# Restart Freeradius  
service freeradius stop  
service freeradius start

Additional infos: https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-14-04

[WinXP/Vista/7] Port 80 Blocked

Wed, 14 Nov 2012 08:09:07 +0000

Developing Websites with XAMPP is always neat and nice: Compact package, everything you need is there - and even having it portable on an USB Stick (in an TrueCrypt file ;)) will get you up and running on every Windows PC - where ever you are - in no time. But the problem with this solution comes with the “Host PC”: There are a lot of tools nowdays which hijack and use Port 80 (your most beloved Webserver / Apache Standard Port) for their own needs. And so you are quickly on the point of “Apache terminated” in your XAMPP Windows - because of the blocked port. Finding out which program is blocking / using that port is easy, as XAMPP comes with an “Port-Check” Tool which can be used from the XAMPP Control Panel. Other than that, here is the TOP 4 of the most annoyning port blocking apps: