Apache2 and PHP5 - Revision history

82.161.20.132: /* Configuring WebDAV and LDAP for your SSL-enabled Virtual Host */

2010-10-15T13:25:06Z

Configuring WebDAV and LDAP for your SSL-enabled Virtual Host

@@ Line 58: / Line 58: @@
   </Location>
 This last directive means that any user who has authenticated is granted access. Since only LDAP users can authenticate, this is just fine.
 Next up, you need to create folder ''webdav'' under the root of your Virtual Host. Do not forget to make that folder owned by ''www-data:www-data'' and readable/writable only by that user:

Saruman!: added link to Visitor

2009-12-29T06:08:46Z

added link to Visitor

← Older revision		Revision as of 06:08, 29 December 2009
Line 7:		Line 7:

	===Configuration of Apache2===		===Configuration of Apache2===
	Once Apache2 is in place, you might want to [[Enabling SSL for Apache2 \| enable SSL]] for it.		Once Apache2 is in place, you might want to [[Enabling SSL for Apache2 \| enable SSL]] for it. And if you want to keep track of any visitor to your website(s), you might want to install [[Apache2 and Visitor\|Visitor]].

	Furthermore, you have to realise that mail sent by your webserver, or any PHP program running under it (e.g. MediaWiki) will have the envelope sender address of www-data@<your.maildomain>. To make sure that your maildomain is actually a real mail domain (necessary for reverse lookup, which is something that real mail servers do), you have to take care to put the right mail domain in ''/etc/mailname'' (e.g. "saruman.biz"). Furthermore, at the top of your Postfix ''main.cf'' you might like to add		Furthermore, you have to realise that mail sent by your webserver, or any PHP program running under it (e.g. MediaWiki) will have the envelope sender address of www-data@<your.maildomain>. To make sure that your maildomain is actually a real mail domain (necessary for reverse lookup, which is something that real mail servers do), you have to take care to put the right mail domain in ''/etc/mailname'' (e.g. "saruman.biz"). Furthermore, at the top of your Postfix ''main.cf'' you might like to add

Saruman!: /* Configuring WebDAV and LDAP for your SSL-enabled Virtual Host */ added test section

2009-10-12T17:50:38Z

Configuring WebDAV and LDAP for your SSL-enabled Virtual Host: added test section

← Older revision		Revision as of 17:50, 12 October 2009
Line 66:		Line 66:

	Now you can restart Apache2, see if it restarts ok, and then test your new WebDAV folder.		Now you can restart Apache2, see if it restarts ok, and then test your new WebDAV folder.

			===Testing WebDAV===
			To test WebDAV, you can most easily install the ''cadaver'' WebDAV client:
			apt-get install cadaver
			After that, you can start cadaver, and have it write a file in your WebDAV environment:
			localhost:/data/wwwroot/yoursite/webdav# '''cadaver https://www.saruman.biz/webdav'''
			WARNING: Untrusted server certificate presented for `*.saruman.biz':
			Issued to: Internet Dept., Saruman.biz, Utrecht, NL
			Issued by: Saruman.biz, Utrecht, NL
			Certificate is valid from Tue, 28 Oct 2008 07:34:41 GMT to Mon, 02 Nov 2009 07:34:41 GMT
			Do you wish to accept the certificate? (y/n) y
			Authentication required for Enter your Saruman.biz login on server `www.saruman.biz':
			Username: sixpacjo
			Password:
			dav:/webdav/> _
			When presented with the cadaver prompt, you can use the following commands:
			* ''edit <filename>'': this causes cadaver to open an existing file named ''<filename>''; or, failing that, to create a new file. Your default text editor is used.
			* ''lock <filename>'' or ''unlock <filename>'': set or remove a lock on a WebDAV published file. He who owns the lock can edit the file, others can only read it.
			* ''discover <filename>'': see the lock status of the file
			* ''quit'': well that one's easy...
			Use ''man cadaver'' for the full description.

			Errors that might occur if you have a problem in your WebDAV setup include:
			* Lock problems: if you fail to provide a webserver-writable place for the lock file, you will encounter HTTP 500 errors. In ''cadaver'':
			dav:/webdav/> edit test.html
			Locking `test.html': failed:
			500 Internal Server Error
			dav:/webdav/> discover test.html
			Discovering locks on `test.html': no locks found.
			dav:/webdav/>

Saruman!: /* Configuration of Apache2 */ mail address fix

2009-08-19T06:00:42Z

Configuration of Apache2: mail address fix

← Older revision		Revision as of 06:00, 19 August 2009
Line 8:		Line 8:
	===Configuration of Apache2===		===Configuration of Apache2===
	Once Apache2 is in place, you might want to [[Enabling SSL for Apache2 \| enable SSL]] for it.		Once Apache2 is in place, you might want to [[Enabling SSL for Apache2 \| enable SSL]] for it.

			Furthermore, you have to realise that mail sent by your webserver, or any PHP program running under it (e.g. MediaWiki) will have the envelope sender address of www-data@<your.maildomain>. To make sure that your maildomain is actually a real mail domain (necessary for reverse lookup, which is something that real mail servers do), you have to take care to put the right mail domain in ''/etc/mailname'' (e.g. "saruman.biz"). Furthermore, at the top of your Postfix ''main.cf'' you might like to add
			myorigin = /etc/mailname
			If you now restart Postfix, outgoing mail from user ''www-data'' will have an envelope sender address of ''www-data@saruman.biz''

	==Installation of PHP5==		==Installation of PHP5==

Saruman!: some words on PHP5 installation

2009-05-17T11:00:25Z

some words on PHP5 installation

← Older revision		Revision as of 11:00, 17 May 2009
Line 10:		Line 10:

	==Installation of PHP5==		==Installation of PHP5==
	~~Contribution~~ needed.		Installing PHP5 is as easy as
			sudo apt-get install php5 php5-cli
			Note that if you had installed Apache2 module ''apache2-mpm-worker'', it will get replaced with ''apache2-mpm-prefork''. Furthermore, note that ''php5-cli'' is only needed if you want to run PHP commands at the prompt - but our guess is that you want it (e.g. to perform maintenance tasks for your [[Mediawiki_Installation\|MediaWiki wikiserver]].

	==Adding WebDAV to your Apache2==		==Adding WebDAV to your Apache2==

Saruman!: apache installation outlined

2009-05-17T10:34:35Z

apache installation outlined

← Older revision		Revision as of 10:34, 17 May 2009
Line 2:		Line 2:

	===Installation of Apache2===		===Installation of Apache2===
	~~Contribution needed~~.		Installation of Apache2 is quite simple:
			apt-get install apache2
			This brings a slew of packages, a.o. ''apache2-mpm-worker'', ''apache2-utils'', ''libapr1'' et cetera. When you want a different worker (e.g. , you should use ''aptitude'' to select that different worker (prefork etc.).

	===Configuration of Apache2===		===Configuration of Apache2===

Saruman!: /* Configuring WebDAV and LDAP for your SSL-enabled Virtual Host */ finished WebDAV section

2009-02-16T21:28:03Z

Configuring WebDAV and LDAP for your SSL-enabled Virtual Host: finished WebDAV section

← Older revision		Revision as of 21:28, 16 February 2009
Line 41:		Line 41:
	This section sets up the authentication as HTTP Basic, with LDAP as the provider, and NOT allowing the authorization phase to fall back to other providers if LDAP cannot provide the required answer. If you want to use "require" statements from some other authorization provider, then you must set ''AuthzLDAPAuthoritative'' to "off".		This section sets up the authentication as HTTP Basic, with LDAP as the provider, and NOT allowing the authorization phase to fall back to other providers if LDAP cannot provide the required answer. If you want to use "require" statements from some other authorization provider, then you must set ''AuthzLDAPAuthoritative'' to "off".
	AuthName "Enter your Saruman.biz login"		AuthName "Enter your Saruman.biz login"
	AuthLDAPURL "ldap://myserver.my.~~domain.com~~/ou=~~it,ou=departments,dc=my~~,dc=~~domain~~,dc=~~com~~?~~sAMAccountName~~"		AuthLDAPURL "ldap://myserver.saruman.biz/ou=people,dc=saruman,dc=biz?mail" NONE
	AuthLDAPBindDN "~~myusername@my.domain.com~~"		AuthLDAPBindDN "cn=admin,dc=saruman,dc=biz"
	AuthLDAPBindPassword "mypassword"		AuthLDAPBindPassword "mypassword"
	The ''AuthName'' directive "sets the name of the authorization realm". The string provided for the AuthName is what will appear in the password dialog provided by most browsers.<br>		The ''AuthName'' directive "sets the name of the authorization realm". The string provided for the AuthName is what will appear in the password dialog provided by most browsers.<br>
			The ''AuthLDAPURL'' should point to your server, and the word behind the question mark should be the LDAP field that you want to use as login. We use ''mail'' so that we can log in with our mail address.<br>
			The ''AuthLDAPBindDN'' should be of a user with the right to view the passwords of the users that will be using the WebDAV server, and the ''AuthLDAPBindPassword'' should be that user's password.<br>
	require valid-user		require valid-user
	</Location>		</Location>
			This last directive means that any user who has authenticated is granted access. Since only LDAP users can authenticate, this is just fine.

			Next up, you need to create folder ''webdav'' under the root of your Virtual Host. Do not forget to make that folder owned by ''www-data:www-data'' and readable/writable only by that user:
			cd /data/wwwroot/yoursite
			mkdir webdav
			chown www-data:www-data webdav
			chmod 660 webdav

			Now you can restart Apache2, see if it restarts ok, and then test your new WebDAV folder.

Saruman!: extra info

2009-02-14T22:06:59Z

extra info

← Older revision		Revision as of 22:06, 14 February 2009
Line 11:		Line 11:

	==Adding WebDAV to your Apache2==		==Adding WebDAV to your Apache2==

			===Thoughts about WebDAV and your configuration===
	Out of the box, your Debian Apache2 is prepared to start using WebDAV. All you need is to enable two modules: one for WebDAV itself, one for the authentication that you want to use. Since our server mainly uses LDAP, we'll describe WebDAV+LDAP here.		Out of the box, your Debian Apache2 is prepared to start using WebDAV. All you need is to enable two modules: one for WebDAV itself, one for the authentication that you want to use. Since our server mainly uses LDAP, we'll describe WebDAV+LDAP here.

			Furthermore, because WebDAV allows editing files on your server, security is paramount (well, it always is, of course. What we mean is that it's even '''more''' important now). The Apache project recommends:<br>
			''The use of HTTP Basic Authentication is not recommended. You should use at least HTTP Digest Authentication, which is provided by the mod_auth_digest module. Nearly all WebDAV clients support this authentication method. An alternative is Basic Authentication over an SSL enabled connection.''<br>
			Thus you should not using Basic Authentication (which is pretty simple to set up) unless you run it over SSL - so we do that as well. We choose the Virtual Host that defines our SSL-site, and extend it with WebDAV functionality. If this is not what you want, consider stepping your authentication up to Digest Authentication.

			===Configuring WebDAV and LDAP for your SSL-enabled Virtual Host===
	First, enable the WebDAV and authnz_ldap modules:		First, enable the WebDAV and authnz_ldap modules:
	a2enmod dav		a2enmod dav
Line 18:		Line 25:
	a2enmod authnz_ldap		a2enmod authnz_ldap
	Do not restart Apache2 just yet, because we haven't configured either the WebDAV site or its authentication!		Do not restart Apache2 just yet, because we haven't configured either the WebDAV site or its authentication!

			Furthermore, a location for the DAV lock database must be specified in the global section of your Apache2 configuration file using the [http://httpd.apache.org/docs/2.2/mod/mod_dav_fs.html#davlockdb DavLockDB directive]. To this end, create a file under ''/etc/apache2/conf.d'' named ''webdav'' containing this single line:
			DavLockDB /var/run/apache2/DavLock
			This will act as the (global) lock database for WebDAV; we don't need to specify it in any other configuration file (like the Virtual Host configuration files). Of course, your server should have a directory ''/var/run/apache2'', and it must be writable for the user ''www-data'' under which Apache2 runs.

	Next, adapt the virtual host that may employ WebDAV and LDAP authentication. The virtual host file needs a section that enables WebDAV (using the directive ''Dav On''), and some directives on how to authorize users within this section. Suppose we want to enable WebDAV only for subdirectory ''webdav'' within virtual host ''<nowiki>http://www.saruman.biz/</nowiki>''. Then in the correspondig Virtual Host file (something like ''/etc/apache2/sites-available/000-saruman.biz'') we need to include the following section:		Next, adapt the virtual host that may employ WebDAV and LDAP authentication. The virtual host file needs a section that enables WebDAV (using the directive ''Dav On''), and some directives on how to authorize users within this section. Suppose we want to enable WebDAV only for subdirectory ''webdav'' within virtual host ''<nowiki>http://www.saruman.biz/</nowiki>''. Then in the correspondig Virtual Host file (something like ''/etc/apache2/sites-available/000-saruman.biz'') we need to include the following section:
	~~DavLockDB /var/run/apache2.DavLock~~

	<Location /webdav>		<Location /webdav>
	Order Allow,Deny		Order Allow,Deny
	Allow from all		Allow from all
	Dav On		Dav On
			These lines turn on WebDAV for the location ''/webdav''. This of course means that there should ''be'' a directory in your server's filesystem named ''webdav'' and located under the root of this virtual host, e.g. ''/var/www/saruman.biz/webdav''

	AuthType Basic		AuthType Basic
	AuthBasicProvider ldap		AuthBasicProvider ldap
	AuthzLDAPAuthoritative ~~Off~~		AuthzLDAPAuthoritative On
	AuthName "Saruman.~~BIZ~~"		This section sets up the authentication as HTTP Basic, with LDAP as the provider, and NOT allowing the authorization phase to fall back to other providers if LDAP cannot provide the required answer. If you want to use "require" statements from some other authorization provider, then you must set ''AuthzLDAPAuthoritative'' to "off".
			AuthName "Enter your Saruman.biz login"
	AuthLDAPURL "ldap://myserver.my.domain.com/ou=it,ou=departments,dc=my,dc=domain,dc=com?sAMAccountName"		AuthLDAPURL "ldap://myserver.my.domain.com/ou=it,ou=departments,dc=my,dc=domain,dc=com?sAMAccountName"
	AuthLDAPBindDN "myusername@my.domain.com"		AuthLDAPBindDN "myusername@my.domain.com"
	AuthLDAPBindPassword "mypassword"		AuthLDAPBindPassword "mypassword"
			The ''AuthName'' directive "sets the name of the authorization realm". The string provided for the AuthName is what will appear in the password dialog provided by most browsers.<br>

	require valid-user		require valid-user
	</Location>		</Location>

Saruman!: Started dav/ldap section

2009-02-14T21:24:18Z

Started dav/ldap section

@@ Line 1: / Line 1: @@
-==Apache2 and PHP5==
+==Apache2==
 ===Installation of Apache2===
@@ Line 7: / Line 7: @@
 Once Apache2 is in place, you might want to [[Enabling SSL for Apache2 | enable SSL]] for it.
-===Installation of PHP5===
+==Installation of PHP5==
 Contribution needed.

Saruman!: Page started

2009-01-18T09:15:25Z

Page started

New page

==Apache2 and PHP5==

===Installation of Apache2===
Contribution needed.

===Configuration of Apache2===
Once Apache2 is in place, you might want to [[Enabling SSL for Apache2 | enable SSL]] for it.

===Installation of PHP5===
Contribution needed.