Dkane: /* Create Template for Secure Pages */

2011-10-20T19:34:52Z

‎Create Template for Secure Pages

Pm705 at 12:34, 20 March 2010

2010-03-20T12:34:15Z

Pm705 at 15:08, 8 February 2010

2010-02-08T15:08:45Z

Tdb01r: New page: ==Add HTTPS Settings== For each `ARCHIVEID.xml` file, fill in the `securehost` and `securepath` entries. Example: .... secu...

2008-04-07T16:38:37Z

New page: ==Add HTTPS Settings== For each <tt>ARCHIVEID.xml</tt> file, fill in the <tt>securehost</tt> and <tt>securepath</tt> entries. Example: <archive id="demo"> .... <securehost>secu...

New page

==Add HTTPS Settings==

For each <tt>ARCHIVEID.xml</tt> file, fill in the <tt>securehost</tt> and <tt>securepath</tt> entries.

Example:

<archive id="demo">
....
<securehost>secure.mydomain.com</securehost>
<securepath>/demo</securepath>
....
</archive>

The <tt>securehost</tt> is vhosted on the same server as your EPrints archive(s).

Secure requests will be of the form <tt>https://securehost/securepath</tt>.

<tt>securepath</tt> therefore differentiates requests from individual archives.

==Generate Secure Config==

$ bin/generate_apacheconf

As well as the usual apache configuration files, and depending on the version of EPrints, this will generate:

* an <tt>auto-secure.conf</tt> file in each archive's <tt>cfg</tt> directory (2.3.13)
* an <tt>auto-your.secure.host.conf</tt> file (for each secure host) in the main <tt>cfg</tt> directory (2.3.11)

==Set up Secure Host==

Under Fedora Core 4, run:

$ yum install mod_ssl

This sets up a test SSL server.

===Certificates===

For a production system, you would need to provide the relevant certificates and tweak the mod_ssl config accordingly - see:

* [http://httpd.apache.org/docs/2.2/mod/mod_ssl.html Apache Module mod_ssl]
* [http://www.modssl.org/docs/2.8/ssl_faq.html mod_ssl FAQ]

Create a <tt>server.key</tt> on the EPrints server (remembering the passphrase you enter):

$ openssl genrsa -des3 -out server.key 1024

Create a certificate request:

$ openssl req -new -key server.key -out server.csr

The important thing when answering the questions is the CommonName: if ultimately the secure web address of your EPrints server is <tt>https://www.myeprints.com</tt>, then the CommonName value to enter is exactly <tt>www.myeprints.com</tt>.

Send the <tt>server.csr</tt> file to your Certificate Authority administrator, who should send you back a <tt>.cer</tt> file.

Copy <tt>server.key</tt> and the <tt>.cer</tt> file to the following locations:

/etc/httpd/conf/ssl.key/server.key
/etc/httpd/conf/ssl.crt/eprints.cer

Modify <tt>/etc/httpd/conf.d/ssl.conf</tt> accordingly:

SSLCertificateFile /etc/httpd/conf/ssl.crt/eprints.cer
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key

===Include EPrints SSL config===

Include each <tt>auto-secure.conf</tt> file generated by EPrints inside the <tt>Virtualhost</tt> directive.

On FC4, edit <tt>/etc/httpd/conf.d/ssl.conf</tt>:

<VirtualHost _default_:443>
....
Include /opt/eprints2/archives/ARCHIVEID/cfg/auto-secure.conf # 2.3.13
Include /opt/eprints2/cfg/auto-your.secure.host.conf # 2.3.11
Include /opt/eprints3/archives/soton/var/auto-secure.conf # 3.0.0
</VirtualHost>

If you have set up SSL certificates, you will be asked to enter your passphrase when you restart apache. To override this, see [http://www.modssl.org/docs/2.8/ssl_faq.html#remove-passphrase How can I get rid of the pass-phrase dialog at Apache startup time?].

==Create Template for Secure Pages==

Make a copy of the default template in <tt>archives/ARCHIVEID/cfg/lang/en/templates/</tt>:

$ cp default.xml secure.xml

In a multi-language archive, you would need to do this for each language-specific template (en = ENglish).

It's a good idea to have a visual differentiation between secure and non-secure pages, e.g. edit <tt>secure.xml</tt> and add "(SECURE)" to the title of the page.

Some browsers will complain if images/CSS etc. embedded in a secure page are served by the non-secure host. To solve this modify the <tt>secure_urlpath</tt> and <tt>secure_url</tt> entries in <tt>archives/ARCHIVEID/cfg/cfg.d/20_baseurls.pl</tt>:

$c->{secure_urlpath} = "";
$c->{secure_url} = "https://".$c->{securehost}.$c->{securepath};

In the <tt>secure.xml</tt> template replace image/CSS <tt>base_url</tt>s with <tt>secure_url</tt>.

BUG FIX: In bin/generate_static replace <tt>import url($base_url$1);</tt> with <tt>import url($1);</tt>.

← Older revision		Revision as of 19:34, 20 October 2011
Line 98:		Line 98:

	BUG FIX: In bin/generate_static replace <tt>import url($base_url$1);</tt> with <tt>import url($1);</tt>.		BUG FIX: In bin/generate_static replace <tt>import url($base_url$1);</tt> with <tt>import url($1);</tt>.
		+
		+	At the top of the page, replace the reference to '''/javascript/auto.js''' with '''/javascript/secure_auto.js'''.
		+
		+	At the top of auto.js, there are the following 3 lines:
		+	var eprints_http_root = "http:\/\/myrepository.ac.uk";
		+	var eprints_http_cgiroot = "http:\/\/myrepository.ac.uk\/cgi";
		+	var eprints_oai_archive_id = "myrepository.ac.uk";
		+	... in secure_auto.js, these must start with 'https' rather than just 'http'.

← Older revision		Revision as of 12:34, 20 March 2010
Line 1:		Line 1:
−	[[Category:~~Configuration~~]]	+	[[Category:Authentication]]
	==Add HTTPS Settings==		==Add HTTPS Settings==

← Older revision		Revision as of 15:08, 8 February 2010
Line 1:		Line 1:
		+	[[Category:Configuration]]
	==Add HTTPS Settings==		==Add HTTPS Settings==

HTTPS2 - Revision history

Dkane: /* Create Template for Secure Pages */

Pm705 at 12:34, 20 March 2010

Pm705 at 15:08, 8 February 2010

Tdb01r: New page: ==Add HTTPS Settings== For each ARCHIVEID.xml file, fill in the securehost and securepath entries. Example: .... secu...

Tdb01r: New page: ==Add HTTPS Settings== For each `ARCHIVEID.xml` file, fill in the `securehost` and `securepath` entries. Example: .... secu...