Poscribes - Apache, PHP and MySQL Tips and Scripts

Apache Web Server - How To Create Self-Signed SSL Certificates

devans — Thu, 04 Feb 2010 22:18:45 +0000

I was recently asked if I had any documentation on how to create a self-signed SSL certificate for the Apache Web Server. As luck would have it, I indeed had exactly such an item!

With this in mind I have decided to add this information here also for all to share.

While this is targeted at creating a self-signed certificate, it can also be used to submit to a certificate authority.

In the following example I am assuming that you have chosen to install a pre-compiled Win32 Binary that already includes OpenSSL.

While Windows is the install of choice here, the syntax remains pretty much the same, only the file and directory structure differ. As such, if you are using Linux, Mac OS or something else just adjust the directory locations for your particular install.

The directory structure for this example is setup as follows:
c:\www\apache22\conf c:\www\apache22\conf\ssl.key c:\www\apache22\conf\ssl.crt c:\www\openssl\bin
To begin, open a command prompt and navigate to:
c:\www\openssl\bin
Next, type the following to generate your key.
c:\www\openssl\bin>openssl genrsa -out c:\www\apache22\conf\ssl.key\local_server.key 1024
With the key created, we are ready to create the CSR (Certificate Signed Request) that will be used to generate the Self-Signed Certificate.

Onceagain at the command prompt, type the following:
c:\www\openssl\bin>openssl req -new -key c:\www\apache22\conf\ssl.key\local_server.key -out c:\www\apache22\conf\ssl.key\local_server.csr
You will then be prompted with a series of requests that will be incorporated into your certificate request.
Country Name (2 letter code) [AU]: US State or Province Name (full name) [Some-State]: Florida Locality Name (eg, city) []: Viera Organization Name (eg, company) [Internet Widgits Pty Ltd]: Poscribes Organizational Unit Name (eg, section) []: Poscribes Web
and then most importantly the common name otherwise known as the domain name that will be used with your SSL secured website.
Common Name (eg, YOUR name) []: www.poscribes.com
Email Address []: webmaster@poscribes.com
For the next item, leave it blank and just hit enter.
Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:
Optionally, you could specify a department name or some other identifier here.
An optional company name []:
Now that we have generated the certificate signed request we can go ahead and generate a Self-Signed Certificate.
(NOTE: The following should all be entered in one continuous string with no line breaks)

C:\www\openssl\bin>openssl x509 -req -days 365 -in c:\www\apache22\conf\ssl.key\local_server.csr -signkey c:\www\apache22\conf\ssl.key\local_server.key -out c:\www\apache22\conf\ssl.crt\local_server.crt
That's it!

The self-signed certificate has now been generated.

Remember to change the respective SSLCertificateFile and SSLCertificateKeyFile entries in your SSL.CONF file to match the respective certificate and key values entered.

Restart the Apache Web Service and voila you have an SSL secured web site with a self-signed certificate!

Enjoy!

Minimal Apache Web Server httpd.conf configuration file

devans — Wed, 09 Dec 2009 19:53:35 +0000

Following an install of Apache on Windows you are faced with the somewhat daunting process of wading through the httpd.conf file and deciding upon what is required for your particular circumstance.

As a matter of course, I typically save the default httpd.conf file to another name and use a vastly trimmed down variant in place thereof.

What I have pasted below represents such an example and trims the config file to a much more manageable 55-lines of code having stripped the unnecessary elements along with all of the comments.

PidFile logs/httpd.pid Listen 80 ServerName localhost ServerTokens Prod ServerSignature Off FileETag None UseCanonicalName Off HostnameLookups Off AddDefaultCharset IS-8859-1 ServerAdmin webadmin@localhost ServerRoot "c:/www/Apache22" DocumentRoot "c:/www/vhosts/localhost" Timeout 45 KeepAlive On KeepAliveTimeout 15 MaxKeepAliveRequests 100 ThreadsPerChild 150 MaxRequestsPerChild 1000 ErrorLog logs/error.log LogLevel error LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined LogFormat "%{Referer}i -> %U" referer LogFormat "%{User-agent}i" agent CustomLog logs/access.log combined LoadModule authz_host_module modules/mod_authz_host.so LoadModule dir_module modules/mod_dir.so LoadModule log_config_module modules/mod_log_config.so LoadModule mime_module modules/mod_mime.so LoadModule rewrite_module modules/mod_rewrite.so DefaultType text/html DirectoryIndex index.html <FilesMatch "^\.ht"> Order allow,deny Deny from all </FilesMatch> AccessFileName .htaccess <Directory /> Options None AllowOverride None Order deny,allow Deny from all </Directory> <Directory "c:/www/vhosts/localhost"> Options Indexes FollowSymLinks AllowOverride None Order allow,deny Allow from all </Directory> RewriteEngine On RewriteCond %{REQUEST_METHOD} ^TRACE RewriteRule .* - [F] TraceEnable Off <IfModule mime_module> TypesConfig conf/mime.types </IfModule>

It should be noted that when modifying this for your own purposes, remember to pay special attention to the file location references throughout and align these to your own directory structure and configuration for Apache.

This configuration was designed for use with an Apache 2.2 release but should also work with the Apache 2.0 version too.

Also, while I have directed this configuration toward Microsoft Windows, there is no reason why, with the file modifications already referenced above, that this would not work for Apache installations on other operating systems too.

I'd love to hear other suggestions regarding optimizing this code even further or feedback on how such a configuration helped you out in some way.

Enjoy!

Using Forfiles in a BAT script to Purge Old Data on Windows

devans — Fri, 13 Nov 2009 16:25:34 +0000

As somewhat a continuance from my post regarding the use 7-Zip as part of an overall backup solution therein also lies the need for a file retention strategy too.

If we simply allow the creation of daily or weekly backups to run unchecked then dependant upon the size of the archive, the frequency of the backup job and ultimately the amount of available disk space we reach some kind of threshold. This necessitates the need for a retention strategy.

Daily backups may be viewed as no longer relevant after 24-hours in which case you could simply overwrite the data with the new information or if your retention schedule is defined as such, purge the information after say one week of retention.

The same could also be said for weekly or monthly backups for which you have defined that 30 days (for weekly) or 90 days (for monthly) is sufficient.

Having established your basis for a retention strategy you then have the task to follow through with executing and maintaining the retention strategy. Busy schedules being what they are we do not always have time to check without fail that we have compiled sufficient backups and can safely purge the remainder. Sooner rather than later this will start to feel like a neverending task, but do not worry we can make this easy!

To begin you will need to download the tool forfiles.exe. This can be obtain from here . Extract the downloaded file to your c:\ root directory and then continue to read below.

To automate this process we can simply create a .BAT file that does the purging for us and assign this task to be executed via the Windows Scheduler at pre-defined intervals.

For the weekly backups we can purge related information weekly and for the monthly backups we can purge on a quarterly basis.

Here is an example of a .BAT script that could be run weekly to purge data older than 30-days.

forfiles /P c:\ /M *backup.zip /D -30 /C "cmd /C del @file"

Here is an example of a .BAT script that could be run monthly to purge data older than 90-days.

forfiles /P c:\ /M *backup.zip /D -90 /C "cmd /C del @file"

In this next example we are using 'forfiles' to maintain log files to a safe level.

forfiles /P d:\logs /S /M *.log /D -30 /C "cmd /C del @file"

So what does the above really mean? Basically speaking we are telling forfiles to begin at the path (/P) of d:\logs then recursively (/S) search the directory for files identified as *.log (/M *.log). It then goes on to check for files being dated 30 days or older (/D -30) and run from the command line (/C "cmd) the specified command for each file (/C del @file"), in this case the delete command.

To re-iterate here we have a script that is designed to recursively search the log directory for files named *.log (where * indicates a wildcard) and providing they are more than 30 days old delete them.

Naturally this example is aimed at maintaining a directory of logs to a sufficient level that it does not choke the drive on which it resides. It you only have a single logical drive, the default c:\ for example, filling this drive with log files that are rotated daily or backup archives created at a regular interval spells trouble at some point!

By utilising the 'forfiles' application you are able to maintain a healthy level of files on your system without sacrificing the availability of your system/applications and or backup data.

I hope this page has helped you gain an understanding into what is a great way for maintaing file systems to appropriate levels. If anyone has any other great uses for this tool please let me know.

Enjoy!