setup_htaccess

Apache webserver

The Biodicée wiki website is run by gollum, which includes a tiny sinatra webserver. The content provided by this webserver is hosted at port '4567' by default, which means it is hidden behind the university firewall, which only allows port 80 within the IP range of ISEMs local network and the ISEM VPN. We use the apache webserver to forward this port to port 80.

More general, apache delivers the content provided by the wiki to the fixed web-address http://162.38.184.118/wiki/.

University Firewall

Open webservers with proxy forwarding are welcome targets for attackers. Thus, we need to accept a couple of security measures.
First, as described in the security concept, visibility of the webserver is constrained by the University firewall to the IP range 162.38.184.1 -- 162.38.184.255 as well as computers logged in via VPN only to port 80 (for http connections). To change this, ask Yannik Frontera of the ISEM IT desk. Second, the only port open to anyone from the internet is port 22, which is the default port for ssh connections, which we need to connect to the workstation via command line to run simulations and exchange files. This has to be secured by disabling ssh connections by password and by fortifying the computers firewall against brute force attacks.

All in all this means, any shared web content must be forwarded to port 80 using apache webserver.

install apache

Apache can be installed easily using the LAMP stack (Linux-Apache-MySQL-PHP), which provides all the tools you need to run a website on your computer (see apache docs):

$ sudo apt-get install lamp-server^ 

There are a couple of modules that need to be enabled using the tool a2enmod:

$ sudo a2enmod

it lists all the modules that are available and asks you to list those you want enabled. Just copy this line

proxy proxy_ajp proxy_http rewrite deflate headers proxy_balancer proxy_connect proxy_html

after a restart of your apache you can start using the modules.

Apache2 has the concept of sites, which are separate configuration files that Apache2 will read. These are available in /etc/apache2/sites-available. By default, there is one site available called 000-default. This is what you will see when you browse to http://localhost or http://127.0.0.1. You can have many different site configurations available, and activate only those that you need. (source: Ubuntu help page)

This means, we need to redefine the localhost site. To do this, we disable the default site and enable a newly defined site called 'wikis.conf', which we place in the 'sites-available' directory. This new site actually is only forwarding the content that is provided by gollum on port '4567' to a virtual host at port 80.

1. create the new site:

   $ nano /etc/apache2/sites-available/wikis.conf
   

   and paste

<VirtualHost *:80> ServerAdmin florian.schneider@univ-montp2.fr ServerName 162.38.184.118 ProxyPreserveHost On

# setup the proxy
<Proxy *>
    Order allow,deny
    Allow from all
</Proxy>
ProxyPass /wiki http://localhost:4567/wiki
ProxyPassReverse /wiki http://localhost:4567/wiki

ProxyPass /welcomewiki http://localhost:5678/welcomewiki
ProxyPassReverse /welcomewiki http://localhost:5678/welcomewiki

``` 
exit with `CTRL`+`X` and confirm saving. 

2. disable default and enable wikis.conf

   $ sudo a2dissite 000-default && sudo a2ensite wikis
   

https://www.digitalocean.com/community/tutorials/how-to-use-apache-http-server-as-reverse-proxy-using-mod_proxy-extension

https://httpd.apache.org/docs/2.2/mod/mod_proxy.html

configure port forwarding

.htaccess (not in use any more)

The simplest server-side method to constrain the visibility on the internet. A file called .htaccess placed in the directory we want to protect.

First, create such a file, if it doesn't already exist. Then for instance put the following lines in:

Order Allow,Deny
Allow from 162.38.184

This would disallow all visitors, except the ones from the IP range 162.38.184.1 -- 162.38.184.255, which would mean the entire equipe EEC.

password protection using htaccess and htpasswd (not in use any more)

.htpasswd

Much more flexible is the definition of an additional password vault in a file called .htpasswd.

It can be created easily by navigating to the directory to protect (here /var/www/) and typing

[kefi@kefi118 ~]:/var/www/$ 	sudo htpasswd -c .htpasswd user1
New password:
Re-type new password:
Adding password for user user1

You need sudo rights, of course. Then you will be asked for the new password for user1. Add a second user

[kefi@kefi118 ~]:/var/www/gitlist$ 		sudo htpasswd .htpasswd user1

The same prompt without the -c option! Delete a user by typing

[kefi@kefi118 ~]:/var/www/gitlist$ 		sudo htpasswd .htpasswd -D user1

.htaccess

The htaccess file redirects the requests of visitors and asks for the password. It needs to contain the following

AuthType Basic
AuthName "Internal content. Please authenticate!"
AuthUserFile /var/www/.htpasswd
AuthGroupFile None
Require valid-user

restart apache2 webserver

/etc/init.d/apache2 restart

links

german tutorial on htaccess and htpassword