Apache authentication and authorization using LDAPS

Apache web Authentication using LDAP/LDAPS requires two steps.

1. Enabling public key at client side
2. Configure LDAPS server in Apache (assuming that your LDAPS server is already running)

To enable secure connection with LDAPS server, the public key should be installed at Apache machine server follow below steps

1. Copy the key in to /etc/ldap/cacerts or /etc/openldap/cacerts
2. Configure the key entry in /etc/ldap.conf

To configure Apache server to communicate LDAPS server for authentication, add this into Apache http.conf or default.conf file.

LDAPTrustedGlobalCert CA_BASE64 /etc/openldap/cacerts/ldap_pubkey.pem
<Directory /var/www/html/>
    AuthName "Apache authentication using Ldaps Server"
    AuthType Basic
    AuthBasicProvider ldap
    AuthzLDAPAuthoritative off
    AuthLDAPURL ldaps://ldaps.test.com:636/ou=users,dc=test,dc=com?uid
    AuthLDAPBindDN cn=manager,dc=test,dc=com
    AuthLDAPBindPassword <pwd>
    #Allowed user list
    Require ldap-user user1 user2

    Options Indexes FollowSymLinks
    AllowOverride All
    Order allow,deny
    Allow from all
</Directory>

Err: Client denied by server configuration after Apache upgrade

From Apache 2.4, syntax of user directive options were changed. So that Apache configuration from old version to new 2.4 or later will cause this error due the incorrect syntax.

# Apache version 2.2 or lower configuration:
<Directory /docroot>
Order allow,deny
Allow from all
</Directory>

# Apacheversion 2.4 or later configuration:
<Directory /docroot>
Require all granted
</Directory>

For more information on new syntax visit Apache Access Directive in Details.

So use latest directory access directives syntax to avoid the same type of errors.

Port 80 is already used by another program in windows

This may happens in Windows machines while installing Apache.

This because of the port may be used by some other program like Skype or default os service. To resolve this try the below ways:

• Disable HTTP.sys driver that was started by some of the Windows inbuilt applications
• Disable the HTTP in registry under the path "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP"

Custom access denied error page for sites/default/files url in Apache

User will get access denied page after setting up standard codes in htaccess file of site/default/files folder. This error page can be customized by adding our used defined html page to that.

The page can be showed by redirecting from access denied default page by adding the below line in htaccess file.

ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var

It redirects and shows the page from Apache's default error page where user either can modify the code of that file or add new custom html file.

Err: Symbolic link doesn't shows or lists the files from given path in Apache

Error:

          No files are listed/shown in browser from the path given as symbolic link in Apache.

Reasons:

1. The remote file path may not contains minimum permission required to list the contents.
2. .htaccess file may not allows the server to list the contents for security purpose.

Solution:

     For reason 1,

           Make sure the permission given to the remote file path to be displayed. Minimum required permission to display (indexing) files on a path is (read, execute) for internet users (otherwise its called as others in Linux systems). This also should be given from the root upto the path you mentioned.

           For example, if you want to list the files from the path '/home/user/Desktop', the permission for each folder in a given path should contains minimum of (read, execute) like,

           /home  (r-x)

                    |_user  (r-x)

                            |_Desktop (r-x)

            Other wise none will be displayed even if you gave 777 to owner and group.

     For reason 2,

           For security purposes, System administrator may wrote this .htaccess file inside the folder they want. Some time this also caused the problem we faced. If it is, remove or comment the following line in the file located on our remote folder path,

           deny from all

            or else remove it it is not required. Make sure importance of  the file on that path before remove.

            If it is required then restart the Apache server once or give 'force-reload' to take effect.

Note: This is tested under Ubuntu 11.04. In Windows systems, you have use 'Security tab' from the folder properties of the remote path to change the user permission.

Err: Rewrite url not working in Ubuntu

    The problem may occur due to that module is not enabled yet.


    To enable the module in Ubuntu
          $ a2moden rewrite
          $ /etc/init.d/apache2 restart

    And do the following changes in 'default' file under /etc/apache/sites-available
          Change the line 'Allowoverride None' to 'Allowoverride All' inside the respective folder directory.


Ref : http://ubuntuforums.org/showthread.php?t=252778
        http://rudyegenias.wordpress.com/2006/08/21/enabling-mod-rewrite-in-xampp/

Set default pages for various Server errors

Just add the required line inside the apache configuration file and restart the server once

ErrorDocument 500 http://foo.example.com/cgi-bin/tester
ErrorDocument 404 /cgi-bin/bad_urls.pl
ErrorDocument 401 /subscription_info.html
ErrorDocument 403 "Sorry can't allow you access today"

Allowing web users to browse your local drive files

Solution:


           Create a soft link inside the file browser software folder or some where inside the WWWROOT folder.


For example,


           If you want to display the contents of the folder path '/Data/images' on your browser through Apache, just give the command in Linux,


           ln -s /Data/images images

          This will create a symbolic link here for the remote folder path.

          And make sure that the remote folder path (ie. here /Data/images) contains the read, execute (r-x) permission from the root folder /Data. Even the 'images' folder have the r-x permission when the /Data doesn't means then the files will not be displayed in browser. The permission level should be follows. (ie. read and execute is minimally required)

          /Data (r-x)
              |_images (r-x)

Name based virutal host

Creating new site

        Create a file /etc/apache2/sites-available/example.com like
       
        ServerAdmin webmaster@example.com
        ServerName example.com
        ServerAlias www.example.com

        <VirtualHost *>
                ServerAdmin webmaster@example.com
                ServerName example.com
                ServerAlias www.example.com

                DocumentRoot /home/srw/example.com
                <Directory /home/srw/example.com>
                        Options Indexes MultiViews
                        AllowOverride None
                        Order allow,deny
                        allow from all
                </Directory>
        </VirtualHost>

Enabling the site

mkdir /home/srw/example.com
chown www-data /home/srw/example.com
a2ensite example.com
apache2ctl configtest
/etc/init.d/apache2 reload

Ref : http://www.debian-administration.org/articles/285
        http://www.debianhelp.co.uk/virtualhosts.htm
        http://www.techmongrel.com/05/setting-up-a-virtual-host-using-apache-2-on-ubuntu-710/

Redirect http requests to https in Apache

Apache HTTP requests can be redirected to HTTPS in many ways. This uses mode_rewrite module to achieve. The configuration can be written in Apache configuration file or htaccess file of an application.

To enable that by using htaccess file, add the lines in to that file. Make sure that mod_rewrite module is enabled with Apache. 

        RewriteEngine On
        RewriteCond %{HTTPS} off
        RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}

Err: [notice] child pid 7587 exit signal Segmentation fault (11)...

Apache will throws error like "child pid ... exit signal Segmentation fault" in such scenarios like PHP-APC package conflicts with some other package(s).

The conflict packages may varied to each with respect to the installed packages. Here are some suggestions to get rid of it:

• Remove php-xdebug package
• Remove php-apc
• For temporary purpose restart Apache sever once to get the rid of it for a while to run other pages which is not throwing the error while executing.

Note: This is tested under Ubuntu 10.10.