Everything in this guide was done on a full install of Fedora Core 3 running
Apache 2.0. If you are using an older version of Apache some of this may not
work, so I recommend upgrading. Also, on different Linux distributions, some
of the paths may be different.


The goal here is to get Elog set up under Secure Socket Layers, so that
communication both ways is encrypted.  This will cover any password
transactions so nothing gets sent over the web in the clear.

The previous method of securing the Elog, which involved using stunnel, is
out of date. A better way to go is to use the Elog in conjunction with
Apache. The Apache method leverages all the research and development that's
gone into providing secure sockets for Apache, and removes the need for any
serious reinventing of the wheel.


We begin with a web server running on port 80 and an Elog server running on
port 8080.


Making Certificates:
It's necessary to generate some secure certificates to be issued to anyone
who attempts to access the securesite.
A guide to making the certificates can be found at:

http://slacksite.com/apache/certificate.html

So, following the steps in the article:
   openssl genrsa -des3 -rand file1:file2:file3:file4:file5 -out\
   server.key 1024 
where the \ is merely an indicator that the command wouldn't fit on a line
here.  The fileN references are sources of random information to help the
random number seed be more random.  I merely used some personal text files
that were zipped up, as suggested in the page.

   openssl rsa -in server.key -out server.pem

Removes the RSA encryption from the key, to make it easier for the Apache
server to deal with it.

   openssl req -new -key server.key -out server.csr

Starts a line of questioning about us as a certificate issuing entity.
Answer with reasonable values.

  openssl x509 -req -days 60 -in server.csr -signkey server.key -  
  out\ 
  server.crt

After this move the server.pem, server.crt, and server.csr to the
appropriate directories under /etc/httpd/conf/ .  The extensions explain
which directory to put them in, with the exception that server.pem ended up
in etc/httpd/conf/ssl.key/ .


In the elogd.cfg file, change the port to 8079, and set the URL to
"https://your.host.name/" .  Restarting the Elog daemon now leaves us with
Elog listening to port 8079 instead of port 8080.


The rest of the story is in the "elogredirect.conf" file attached to this
post, but here are the highlights.

Create a virtual host dealing with SSL that listens to port 443 (the ssl
port), and acts as a proxy for port 8079 (where Elog is listening).  This
allows Apache to act as an SSL handler for Elog by handing off any access at
https://your.host.name/ to the Elog server.  The firewall then can keep out
any direct attempts to access port 8079, so that the only thing that can
reach the Elog server is stuff talking to 8079 on the local side of the
firewall (which pretty much means just the Apache proxy).  I recommend
Firestarter for the firewall config by the way, it's a real lifesaver.

http://firestarter.sourceforge.net/

This covers the SSL portion of the story, and by doing the redirection
inside the port 443 virtual host, instead of from the port 80 webpage as
before, you can avoid any path overlap.

As was the case for us, you may have links in older Elog posts, e-mails, or
web pages that point to specific Elog posts. If you have been using Elog for
some time and never bothered with the SSL stuff, the links most likely look
something like
http://your.host.name:8080/yourlogbook/postnumber. 

To cover legacy support for calls on port 8080, you can  create another
virtual host listening to port 8080.  This host's job is to take any
incoming URL calls on "http://your.host.name:8080/a_directory" and
translate them into calls on "https://your.host.name/the_same_directory" .
This means that any attempt to contact the Elog on port 8080 will get
answered by an Apache virtual host that redirects the client through the
Apache SSL virtual host described above. See the conf file for the details.

So in the end, the firewall is set to only allow through ports 80, 443, and
8080.  Port 80 handles the normal webpage access stuff.  Port 443
exclusively handles the SSL port for the Elog daemon, and port 8080
exclusively handles the redirect for the legacy Elog calls.

Implementation of this setup on another system should be pretty
straightforward.  Apache's config file is at /etc/httpd/conf/httpd.conf ,
and it also loads any *.conf files in /etc/httpd/conf.d/ .  So its a pretty
simple case of just dropping elogredirect.conf into /etc/httpd/conf.d/ and
restarting the Apache server.  Of course the necessary changes to elogd.cfg
have to be made and that server restarted as well.  The firewall, too, needs
to be setup to secure the whole deal. Note that the elogredirect.conf file
needs to be edited for your specific setup (changing the instances of 
"your.host.name" to whatever your server is, and also putting in the
administrator e-mail address where it is noted).


This work was done by Jonathan Hanson and Damon Nettles in the Gravity Lab
at Louisiana State University. You can see our Elog at
https://sam.phys.lsu.edu/elog .

If you have any questions or comments send them to
nettles@phgrav.phys.lsu.edu .

### Here be things to make the elogd daemon invisibly secure under an
### Apache SSL proxy virtual host.  Arrrrrr!
### ----This config file be mostly written by Jonathan Hanson, 11/23/04
### ----With some help from a few old salts on the net.



### This be the first instance of SSL in our setup, so the SSL module
### Must be called.  This can be commented out if it don't put wind in
### your sails.
LoadModule ssl_module modules/mod_ssl.so

### Ahoy, ye scurvy land dogs! Listen to the SSL port (443) or may the
### sea beasts take ye!
Listen 443

### Make a virtual host at the default server name, and assign it port 443.
<VirtualHost _default_:443>
	### Here be standard configuration for the Virtual Host
	ServerAdmin your_e-mail_address
	ServerName _default_:443
	RequestHeader set Front-End-Https "On"
	
	### This be the path to the elog directory 
	### (This didn't seem to make any difference, but it be a good
	###  idea nonetheless)
	DocumentRoot /usr/local/elog
	
	### Here be the setup for the SSL component of the Virtual Host
	SSLEngine On
	SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
	SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.pem
	
	### Here be the setup options for the Proxy module
	ProxyRequests Off
	ProxyPreserveHost On
	
	### This be the root of the new Virtual Host, and it should be
	### redirected to the port the elogd server is listening to 
	### (8079 on our poop deck).
	<Location />
		ProxyPass http://your.host.name:8079/
		ProxyPassReverse http://your.host.name:8079/
		SSLRequireSSL
	</Location>

	### Shiver me timbers!  A firewall can be laid across the elog
	### port to hinder direct access from the outside world to the elog
	### daemon.  This'll make the scurvy wretches come in through the apache
	### proxy virtual host, and batten down the hatches on the elog in general.

</VirtualHost>



### Our previous elog configuration was at http://your.host.name:8080 and some of our
### users made static HTML links to other posts in their posts and email.  They be sleeping 
### in Davy Jones's locker in the briney deep now, but we be needing to make these posts 
### backward-compatible.  We be changing the port Elogd listens to (as above) to 8079, and
### then we be using another new virtual host at port 8080 to redirect to the new SSL URL.
### So it appears to the landlubbers outside as if a normal elog server is listening to port
### 8080, but in reality it be a Virtual Host redirecting through the other SSL virtual host
### which then be passing it on to the port the elog server really be listening to.
### If ye not be needing this backwards compatability, the following section can be made
### to walk the plank.

### I won't be telling ye twice, ye slimy bilge rat!  Pay attention to what 
### used to be the old elog port(8080).
Listen 8080

<VirtualHost _default_:8080>
	### Here be standard configuration for the Virtual Host
	ServerAdmin your_e-mail_address
	ServerName _default_:8080
		
	### This be the path to the html directory 
	### (This didn't seem to make any difference, but it be a good
	###  idea nonetheless)
	DocumentRoot /httpd/html
	
	### Here be the dark magic of mod_rewrite.  Quake in your boots ye dogs!
	<IfModule mod_rewrite.c>
		RewriteEngine On
		RewriteRule ^/(.*) https://your.host.name/$1 [NC,R=301,L]
	</IfModule>
	
</VirtualHost>

### In the end, elog be reachable through either https://your.host.name/ 
### or http://your.host.name:8080/ , though the latter will be rewritten
### to the former as soon as the request be made.  This be satisfying our 
### needs for backwards compatbility with old URLs, while ensuring modern 
### secure SSL support.  Beware matey, recognize that we also had to change
### the port that elog listens to, and then add a URL line in the elogd.cfg
### file:
###      port = 8079
###      URL = https://your.host.name/
### Also a firewall was brought up and told to allow through only ports 
### 80(html), 443(SSL), and 8080(the elog stand-in) and of course any other 
### ports ye may need for other applications.