Apache :: Authentication For Different Sub-domain
Oct 6, 2013I am implementing OpenERP service + Apache on Ubuntu server. The connection to the server need to be HTTPS.
Here is what I does:
a. For HTTP side, forward connection to HTTPS side.
ADVERTISEMENT
Apache Authentication
Apr 23, 2009I have a machine at home running the UniformServer wamp package on Win2K3 Standard server and I'm hosting a simple family picture gallery using Gallery 2.3. I put the gallery in a subdirectory of root so I could have a public homepage and a gallery that is password protected. I did this using .htaccess and .htpasswd.
My issue is when I browse to mydomain.com and click the link to the gallery [url], the password box pops up, and when I enter the appropriate credentials, the domain name reverts to the IP and another password box pops up. If I log in a second time, I'm fine. If I cancel that second login, it still lets me in, but prompts me to login that second time for every click going forward until I authenticate.
Apache :: SSL Client Authentication
Apr 14, 2014I have been trying to set ssl client authentication with Apache.I basically have a server certificate issued by a recognized CA. For the normal ssl authentication I use the following configuration (and it works fine):
View 1 Replies View RelatedApache :: Configuration With SSL And Authentication
Dec 3, 2014I have a couple of directories on my server that require authentication (MySQL DBD and AuthUserFile). Both work fine with SSL off. When I use SSL on directories without authentication that also works fine. However, when I put the 2 together, authentication is by-passed. I cannot seem to get the configuration right to do both. Here is my VH conf file (sanitized):
Code:
LoadModule dbd_module modules/mod_dbd.so
LoadModule authn_dbd_module modules/mod_authn_dbd.so
<VirtualHost *:80>
DocumentRoot "/var/www/html"
ServerName myhost.mydomain.com
ServerAdmin mailman-owner@mydomain.com
ErrorLog "/var/log/httpd/myhost_error_log"
CustomLog "/var/log/httpd/myhost_access_log" combined
[Code] .....
Apache User Authentication Logic ...
May 11, 2009I'd appreciate if you can point out some links, or if anyone is willing to help me for a fee, we can talk about it.
I have a web application called MyApp
- Each MyApp user has 5gb hosting, and a web interface to manage their files.
- Therefore MyApp user gets a user account on linux machine and has access to only one directory /repo/usr/<user_id> and nowhere else. (suexec?)
- If that MyApp user creates a subdomain from any folder inside his home folder (he can do that using web interface), that folder is readable by www-data user not writable.
- That myapp user is able to mount/unmount his own ftp drives using curlftpfs.
- In short, users can only mess with their own files and they have no access nor rights to any other file that is outside of their home dir.
In short, this is a kind of hosting company server setup. Right now, we will have to manage all this from -only- one powerful server.
PAM Authentication Failure With FTP And Apache Suexec
Jun 18, 2007i am trying to setup a VPS with:
Apache Suexec, so that each VHosts runs under there own username
FTP for each of the vhosts.
I have made a username aplushost and FTP works fine when i login, however when i try and get Suexec to work it shows a 403 permision dined, even know the whole directroy path is with correct permsions.
"/home/aplushost/www"
However if i chown the directroy "aplushost" to apaches username , currently "nobody" i have tried with "apache" and many others the page is displayed correctly.
The weird thing is that the www directroy can still be set to the aplushost username and files work inside.
However due to changing the privalages of the folder aplushost ftp now fails to login due to the folder not being owned by the ftp user "aplushost".
So im stuck between only having one item working at a time.
i have put some content of my config files.
----------httpd.conf vhosts------------------
<VirtualHost 87.117.196.247>
DocumentRoot "/home/aplushost/www"
ServerName aplushost.co.uk
SuexecUserGroup aplushost aplushost
<Directory "/home/aplushost/www">
allow from all
Options +Indexes
</Directory>
</VirtualHost>
---------------passwd file----------------
aplushost:x:500:99::/home/aplushost/www:/sbin/nologin
(Have tried with many different shells, no difference, also tried with home directroy as just /home/aplushost)
Apache :: LDAP Authentication Module
Mar 22, 2015I have some questions about the LDAP authentication module.I have a LDAP authentication with this config:
<AuthnProviderAlias ldap ldap-account>
AuthLDAPBindDN "CN=directory search,OU=Service-User,DC=company,DC=ch"
AuthLDAPBindPassword "xxxxx"
AuthLDAPURL "ldap://ldap.company.ch/ou=Users,dc=company,dc=ch?sAMAccountName?sub?(objectClass=*)"
</AuthnProviderAlias>
If a User logs in with username only, all works correct. If a user use the DomainUsername format, the login is rejected with "user not found".Should it not work with both login styles ? Or is there a option to reformat or rewrite the username before authentication without the "Domain part ?
Apache :: What LDAP Authentication Mechanism Is Used
Apr 23, 2015Is this simple authentication or SASL Digest MD5, ..)?
we are able to specify only the 'authbasicprovider ldap' ldap url, bind username and password in the apache httpd configuration file.
Can LDAP SASL (Digest MD5, GSSAPI,…) mechanism be specified in the Apache configuration during authentication?
If so, how to specify the LDAP SASL mechanism?
Apache :: Bruteforce Protection For Authentication?
Dec 2, 2013I was wondering if there's a simple way to implement some kind of authencation bruteforce protection in apache for windows? Right now my authentication never stops asking if user inputs the wrong credentials, this makes me think i'm vounrable for bruteforce attacks which could eventually get through if given the time.
View 4 Replies View RelatedApache :: HTTP Over SSL System - Authentication Authority
Oct 6, 2013I have to create a structure in which there is a client, a server and an authentication authority.
The authentication authority verifies the identity of both the client and server before they can communicate, so that the client can access the content offered by the server. Everything must be made using HTTP with SSL (HTTPS).
For now I have installed xampp on my pc with ubuntu, I performed the initial configuration and was able to view a test page locally hosted by entering the URL of the virtual server "www.server.it" (added to the configuration of apache2).
Apache :: Access Files Without Login / Authentication
Nov 18, 2014In web application we are facing high vulnerability issue based on the session validation.
We can download the files from the server whenever we are passing the link even without login. The links are directly hit into the server and download the files any type of files extension such as .txt, .xml, .zip and so on.
Need the solution for this issue: How will we resolve the issue using validate the session in apache side?
Scenario as below:
When user manually passing the request if user logged they should access the files
When user manually passing the request if user is not login they shouldn't access the files
Here both the scenarios they can access the files but we want to restrict when the request is coming to apache without login.
EX: [URL] ....
When i tried above link I can able to view the file in browser. Even able to download all different fies extension which are having in the under tomcat webapps dir.
How we can restrict this in apache code or any other files in apache side or is there any way to validate the request is logged one or not?.
Apache :: Set Up SSL Listening On Port 443 - Client Authentication
Oct 29, 2014I am setting up apache 2.4 as a service locally through localhost on a windows 2008 R2 standard server. I have set up SSL listening on port 443 and works correctly, however I am having trouble figuring out how to get apache to authenticate my CAC card.
I have downloaded the DOD certs and put them into various types of files including pem, base 64, der etc and I have yet to figure out a way to get the client certificates validated.
I have left out the information about the SSLCertificateChainFile, SSLCACertificateFile and SSLCARevocationPath as I am sure this must be where my problem is.
Is it possible to get this done through localhost. Here is the error I am getting in the error log.
[Wed Oct 29 11:37:05.675491 2014] [ssl:error] [pid xxxx:tid xxx] [client 127.0.0.1:59282] AH02039: Certificate Verification: Error (20): unable to get local issuer certificate
I am using a self created self signed server ceritficate. Here are some details from my httpd-ssl.conf file:
Code:
<VirtualHost _default_:443>
DocumentRoot "${SRVROOT}/htdocs"
ServerName localhost:443
ServerAdmin admin@example.com
ErrorLog "${SRVROOT}/logs/jtdi.log"
TransferLog "${SRVROOT}/logs/jtdi-Transfer.log"
[Code] ....
Apache :: LDAP Authentication - Not Linking To Server
Jan 16, 2014I am running apache currently on my QNAP server, and have enabled webserver and LDAP. We have set up users on LDAP. I have created a landing page for access from the internet. I want to configure Apache to authenticate the users using LDAP before granting access to the landing directory.
I have started this with the apache configuration below: My apache config file -
Code:
LogLevel debug
CustomLog "logs/access_log" combined
ErrorLog "logs/error_log"
LoadModule ldap_module modules/mod_ldap.so
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
ServerName MyServer
LDAPTrustedMode NONE
LDAPVerifyServerCert Off
[Code] ....
When I access my page, I get the authentication prompt. But when I enter my LDAP login and password, I get thrown out of the system with the error:
Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.
Please contact the server administrator, admin@NAS and inform them of the time the error occurred, and anything you might have done that may have caused the error.
More information about this error may be available in the server error log.
Looks like my apache configuration is a problem as I am able access my LDAP and everything with LDAP seems to be working fine except Apache configuration to authenticate against LDAP.
Apache :: Directories On Website Need Authentication Against LDAP
Nov 5, 2012We have a website running on Apache ver 2.2.3.
A couple of directories on the website need authentication against LDAP. The setup has been working for many years and all of a sudden is giving some issues.
The page asks for authentication and once login details are entered, either it throws an error "Page has moved" or "Please refresh your browser or reload the page".
As far as I am aware no configuration has been changed for LDAP or for Apache. The website runs on Windows Server 2003.
I am very much new to Apache and cannot seem to find any errors logged.
Plesk 11.x / Windows :: Slow Domain Creation On Same Web Space And Doc Root - Authentication Error
Jun 26, 2014We have more than 10 domains on the same webspace, sharing the same document root. When we try to add a new domain on the same web space (sharing the same document root) Plesk takes a long time to create it (about 10 minutes). While domain creation, all the other domains sharing the same document root and web space get an authentication error. When Plesk finishes, all domains work again.
View 1 Replies View RelatedApache :: Client Certificate Authentication To Verify User Name?
Oct 1, 2014Is it possible to verify client certificate based on username?If possible, How can we implement it in our httpd-ssl.conf file.
View 1 Replies View RelatedApache :: Local Authentication Is Not Working When LDAP Is Offline
Jan 10, 2014Im having a problem where local authentication will not work when when the configured LDAP server is unavailble. When the ldap server is online I can authenticate fine against ldap and local file. However, when the ldap server is offline, I cannot authenticate with the user1 account. The browser just sits at a blank screen.
Ive searched a lot on this and found many examples, all very similar to my config below, but I still cannot failback authentication to local file when ldap is unavailable. Im running Apache/2.2.10. I have also tested this on 2.2.16 with the same results.
=======.htaccess==========================
AuthName "Server Access"
AuthType Basic
AuthBasicProvider file ldap
AuthUserFile /etc/apache2/htpasswd
AuthzLDAPAuthoritative off
AuthLDAPURL ldap://ldap.domain.com:389/OU=Users,DC=domain,DC=com?sAMAccountName
[Code]...
Apache :: Remote User Reverse Proxy And Authentication
Dec 17, 2013I have several applications that use authentication and expect REMOTE_USER to be set by Apache for authentication/authorization.
I am putting a reverse proxy, with shibboleth in front of these applications, on a separate server.
Currently, REMOTE_USER is not sent. I have tried a few things, and I am currently sending it inside another header, but I have some applications that are closed sources and this will not work.
Is this possible to do? I am running this with Apache 2.4.7, I believe, on the Windows platform.
Apache :: Configure And Implement Server With Ssl Using Ldap For Authentication
Apr 28, 2015I have a class project that we are working on where we have to configure and implement an Apache server with ssl using ldap for authentication. I have documentation of literally everything I have done in the configuration. Everything seems to be fine with the config that I can tell. The client gets a prompt for username and password when they access the server ip address. However, once the correct username and password are entered, then the client receives a 500 internal server error message instead of the webpage: "Internal Server Error...The server encountered an internal error or misconfiguration and was unable to complete your request.
View 1 Replies View RelatedApache :: Add Www To Domain Unless It Is A Subdomain Request
Nov 18, 2014I would like to rewrite mysite.com to www.mysite.com.
However, if the request is a subdomain (i.e. blabla.mysite.com), then it should not rewrite.
I believe this gets me close, but it will not differentiate the subdomains (i.e., blabla.mysite.com).
Apache :: Domain Name Binding To IP Address
Jul 6, 2013I am having the hardest time binding my domain name to my Apache server. If I use the IP address, I can access it just fine even outside of my network. But when I try to bind my domain name to that exact same IP address it just does not work.
I am running Apache 2.0.64 on Windows 8 and my domain name is registered at Name.com. I have contacted them to and I am awaiting a response but they are really backlogged right now and I thought it wouldn't hurt to post here as well. Besides, I thought it might have something to do with my Apache config file anyways and I wanted to make sure.
Apache :: Trailing Dot Created After Domain Name?
Aug 7, 2014We are getting the below message in Apache's error.log when accessing from mobile application & updated apache from 2.4.9 to 2.4.10 also.Trailing dot is created after the URL.
I can able to hit [URL] ..... and I can't able to hit [URL] ....
Serving Domain Through Apache And Lighttpd At Same Time
Jan 11, 2008There are 2 different domains with the same IP being served by Apache. I want one of the domains to be served by lighttpd, is it possible without having to change the IP of that domain?
View 11 Replies View RelatedHardcode APACHE To Deny Request To Particular Domain
May 28, 2008I am seeking a solution such that the apache vs 2 denies php or allowing requests out of the server to say domain abc.com and its entire IP block.
I have done so far is used apf -d abc.com to deny outgoing and incoming requests and the php pages (proxies) cannot access the site anymore).
But what i want it something hardcoded into apache itself so it blocks all php based request going off the server to that domain.
How can i go about it?
using centos5 apache 2 and cpanel!
Apache :: Two Domain Names With Single Site
Jul 7, 2015I am currently running Apache on Ubuntu 14.04. I tried adding an alias, but it doesn't do exactly what I need. I have a single site and I need to point two domain names to it. The thing is, if someone types in www.site1.com I want it to show the url as www.site1.com and if someone types in www.site2.com I want it to continue to show www.site2.com in the URL. Right now if they type in www.site1.com it shows the first site name as the URL, but if they type in www.site2.com it changes the URL to www.site1.com. Below is what I have as my virtual host in my conf file currently.
OS - Ubuntu 14.04
Apache/2.4.7 (Ubuntu)
Apache :: Cross Domain / Setting Up HTAccess
Mar 30, 2014I'm trying to set up a login script on twenty subdomains that will be checked on another subdomain. I've found this example for different domains and figure it should be simple enough to utilise but my ereg is crappy
<IfModule mod_headers.c>SetEnvIf Origin "http(s)?://(www.)?(domain1.com|domain2.com)$" AccessControlAllowOrigin=$0$1Header add Access-Control-Allow-Origin %{AccessControlAllowOrigin}e env=AccessControlAllowOrigin</IfModule>
Apache :: Domain Name Doesn't Work On Localhost
Aug 4, 2013I have a home server set up with a couple of things going. Here is the weird thing that I can't figure out. I can access everything just fine from an INTERNET connection external to my LAN using my domain name, let's say "domain.com". So, if I type into my computer on my LAN www.domain.com, it searches without actually finding it's destination giving up after a period of time saying the server cannot be found.
But, if I type www.domain.com on my mobile phone using my data connection, it connects without a hitch and everything functions fine. I have done this set up before at a different home, but since I moved, I have come across this problem and either don't remember having this happen before or don't remember what I did to resolve it. What I should look for?
Apache :: 2.2.22 Picks SSL For Every Single Domain Error
Jul 3, 2014I have one valid commercial Comodo certificate. It is correctly installed and works fine on my 443 port when I go to https://www.domain1.com
However, I have quite a few other virtual hosts that also work fine on my port 80 when I go to http://www.domain2.com then http://www.domain3.com and so on.
Now out of curiosity I have typed https://www.domain2.com and it picked up the SSL certificate from my first domain1.com when it wasn't supposed to (I guess)! It reported an error but worked! Then I tried all my other domains 3,4,5 and so on and the issue repeated.
How do I keep this single certificate to the only domain name it belongs to? It has no wild cards and is valid for only one domain name I bought it for. The example of my hosts' configuration is below:
<VirtualHost *:80>
DocumentRoot "/directory/home/place"
ServerName domain1.com
<Directory "/directory/home/place">
allow from all
Options +Indexes
</Directory>
ServerAlias www.doamin1.com
</VirtualHost>
[code]...
Apache :: Domain Mapping That Don't Involve Wordpress?
May 6, 2015I used to have a server which had domain mapping via wordpress... a friend of mine had this up for me and every time I added a new website to the same server/ip-address, I just modified the .htaccess for example:
RewriteCond %{HTTP_HOST} !^www.
RewriteCond %{HTTP_HOST} domain.com
RewriteCond $1 !^domain
RewriteRule (.*) /domain/$1 [L]
Anyway, I no longer have this server and as a result, I have websites that are not being mapped correctly, many domains point to the same ip address.
I have tried to use name-based virtual hosts but it seems as if this is being ignored... I did restart Apache by sudo service apache2 restart
I'd really like to get my websites working again without buying multiple ip-addresses.
Apache :: Redirect To Domain Root When Not Logged In
Sep 12, 2013I would like to do do following using basic authentication:
1. non authenticated users have access to the index page: [URL] .....
2. there are other pages, e.g: [URL] .... but these would require basic auth
3. if users are not authenticated they would be redirected to [URL] .... otherwise authenticated users would have access to [URL] .... or anything else under that domain
