have a problem with kerberos authentication on apache php
Setup = RHEL 7
apache 2.4 from rhscl
php7 from rhscl configured with php-fpm
Kerberos is working perfectly on http://site.domain/
but not on http://site.domain/index.php
The same problem occurs for all sub directories when accessing a .php file.
There is a rewrite for php to fcgi in the vhost setup.
index.php => $_SERVER['REMOTE_USER']
vhost setup
<VirtualHost *:443 >
## Vhost docroot
DocumentRoot /opt/code70
<Directory /opt/code70>
Options Indexes MultiViews
Options FollowSymLinks
IndexOptions FancyIndexing HTMLTable VersionSort IgnoreCase
IndexOrderDefault Descending Date
IndexIgnore *.php
AuthType Kerberos
AuthName "Kerberos"
KrbMethodNegotiate On
KrbMethodK5Passwd On
KrbAuthRealms ....
....
KrbVerifyKDC Off
KrbSaveCredentials Off
KrbLocalUserMapping On
KrbAuthoritative On
Order allow,deny
Allow from all
Require valid-user
</Directory>
## SSL directives
SSLEngine on
SSLCertificateFile ......
SSLProtocol -ALL +TLSv1
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM
SSLHonorCipherOrder On
ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://localhost:9000/opt/code70/$1
</VirtualHost>
Related
I have setup a lot of Virtual Hosts in Ubuntu but today I needed to do this on a CentOS 7 server. I installed Apache and setup the VHost config but nothing appears when I view the site.
I know that Apache is reading my Config files because if I add a fault in it and restart Apache, it complains about the error. Is there something "else" that is needed on CentOS 7?
What kind of virtualhosts are you trying to achieve? name based I guess.
If you are not running on version 2.4> then you need to enable the name virtual host directive for the IP:PORT pair
NameVirtualHost *:80
The different behavior can depend on the different versions of the Apache servers shipped with the distro.
If not, it could be depending on selinux labels not being set properly. In this case anyway, you would get a permission error. Honestly I don't believe this is the case.
This is the settings that I use on a CentOS 7.3.1611 running Apache 2.4.6 I normally use virtualmin / webmin for configuration, but I have looked at the httpd.conf The basic settings that are in my config are
<VirtualHost xxx.xxx.xxx.xxx:80>
SuexecUserGroup "#502" "#502"
ServerName grid.hosted-systems.co.uk
ServerAlias www.grid.hosted-systems.co.uk
ServerAlias webmail.grid.hosted-systems.co.uk
ServerAlias admin.grid.hosted-systems.co.uk
DocumentRoot /home/grid/public_html
ErrorLog /var/log/grid.hosted-systems.co.uk_error_log
CustomLog /var/log/grid.hosted-systems.co.uk_access_log combined
DirectoryIndex index.html index.htm index.php index.php4 index.php5
<Directory /home/grid/public_html>
Options -Indexes +IncludesNOEXEC +SymLinksIfOwnerMatch +ExecCGI
allow from all
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
Require all granted
AddType application/x-httpd-php .php
AddHandler fcgid-script .php
AddHandler fcgid-script .php5
FCGIWrapper /home/grid/fcgi-bin/php5.fcgi .php
FCGIWrapper /home/grid/fcgi-bin/php5.fcgi .php5
</Directory>
<Directory /home/grid/cgi-bin>
allow from all
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
Require all granted
</Directory>
RewriteEngine on
RewriteCond %{HTTP_HOST} =webmail.grid.hosted-systems.co.uk
RewriteRule ^(.*) https://grid.hosted-systems.co.uk:20000/ [R]
RewriteCond %{HTTP_HOST} =admin.grid.hosted-systems.co.uk
RewriteRule ^(.*) https://grid.hosted-systems.co.uk:10000/ [R]
RemoveHandler .php
RemoveHandler .php5
php_admin_value engine Off
FcgidMaxRequestLen 1073741824
Alias /dav /home/grid/public_html
<Location /dav>
DAV on
AuthType Basic
AuthName "grid.hosted-systems.co.uk"
AuthUserFile /home/grid/etc/dav.digest.passwd
Require valid-user
ForceType text/plain
Satisfy All
RemoveHandler .php
RemoveHandler .php5
RewriteEngine off
</Location>
<Files awstats.pl>
AuthName "grid.hosted-systems.co.uk statistics"
AuthType Basic
AuthUserFile /home/grid/.awstats-htpasswd
require valid-user
</Files>
</VirtualHost>
<VirtualHost xxx.xxx.xxx.xxx:80>
SuexecUserGroup "#500" "#500"
ServerName mirrors.hosted-systems.co.uk
ServerAlias www.mirrors.hosted-systems.co.uk
ServerAlias webmail.mirrors.hosted-systems.co.uk
ServerAlias admin.mirrors.hosted-systems.co.uk
DocumentRoot /home/hosted-systems/domains/mirrors.hosted-systems.co.uk/public_html
ErrorLog /var/log/virtualmin/mirrors.hosted-systems.co.uk_error_log
CustomLog /var/log/virtualmin/mirrors.hosted-systems.co.uk_access_log combined
ScriptAlias /cgi-bin/ /home/hosted-systems/domains/mirrors.hosted-systems.co.uk/cgi-bin/
ScriptAlias /awstats/ /home/hosted-systems/domains/mirrors.hosted-systems.co.uk/cgi-bin/
DirectoryIndex index.html index.htm index.php index.php4 index.php5
<Directory /home/hosted-systems/domains/mirrors.hosted-systems.co.uk/public_html>
Options +Indexes +IncludesNOEXEC +SymLinksIfOwnerMatch +ExecCGI
allow from all
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
Require all granted
AddType application/x-httpd-php .php
AddHandler fcgid-script .php
AddHandler fcgid-script .php5
FCGIWrapper /home/hosted-systems/domains/mirrors.hosted-systems.co.uk/fcgi-bin/php5.fcgi .php
FCGIWrapper /home/hosted-systems/domains/mirrors.hosted-systems.co.uk/fcgi-bin/php5.fcgi .php5
</Directory>
<Directory /home/hosted-systems/domains/mirrors.hosted-systems.co.uk/cgi-bin>
allow from all
AllowOverride All Options=ExecCGI,Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
Require all granted
</Directory>
Alias "/centos" "/home/shared/CentOS"
<Directory "/home/shared/CentOS">
Options +Indexes +IncludesNOEXEC +SymLinksIfOwnerMatch +ExecCGI
Require all granted
HeaderName HEADER.html
</Directory>
Alias "/centos/" "/home/shared/CentOS/"
<Directory "/home/shared/CentOS/">
Options +Indexes +IncludesNOEXEC +SymLinksIfOwnerMatch +ExecCGI
IndexOptions FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=*
Require all granted
HeaderName HEADER.html
</Directory>
</VirtualHost>
The settings here set up two virtual websites using port 80 and bound to the same single IP , this is accessable by using http://servername or http://ServerAlias The DocumentRoot is the location of the files to be servers.
The second VirtualServer is basically the same set up, but it also shows how the Alias section can be used to pull documents from outside the main directory.
As a side note, if anyone spots any vunerabilities in what is posted, let me know or edit and let me know.
Amber-Marie
So the answer to this was that the CentOS server had (by default) blocked the HTTP port 80. This really seems a bit silly but as soon as I allowed the firewall to open these ports for the web traffic, all worked fine:
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
I try firewall-cmd --add-service=http on Centos 7.5 and it work
I ran this following command to find out which port is being occupied by php-fpm
netstat -pl | grep fpm
(No info could be read for "-p": geteuid()=1000 but you should be root.)
unix 2 [ ACC ] STREAM LISTENING 9500 - /var/run/php5-fpm.sock
I have this following proxypassmatch in my web configuration file
ProxyPassMatch ^/(.+\.php.*)$ fcgi://127.0.0.1:9500/var/www/html/$1 timeout=1800
I have all the necessary dependencies installed for processing php fpm as a fastcgi module.
<IfModule mod_fastcgi.c>
AddHandler php5-fcgi .php
Action php5-fcgi /php5-fcgi
Alias /php5-fcgi /usr/lib/cgi-bin/php5-fcgi
FastCgiExternalServer /usr/lib/cgi-bin/php5-fcgi -socket /var/run/php5-fpm.sock -pass-header Authorization
<Directory /usr/lib/cgi-bin>
Options ExecCGI FollowSymLinks
SetHandler fastcgi-script
Require all granted
</Directory>
</IfModule>
My VirtualHost directives are in the following set:
<VirtualHost *:443>
ServerName domain.com
ServerAlias www.domain.com
SSLEngine on
SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
SSLCertificateFile /etc/apache2/ssl/private/ec1ed7d470bd0db4.crt
SSLCertificateKeyFile /etc/apache2/ssl/private/.key
SSLCertificateChainFile /etc/apache2/ssl/.crt
DocumentRoot /var/www/html/dir
# Setup php-fpm to process php files
# ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://127.0.0.1:9500/var/www/html/dir/$1
# ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://127.0.0.1:9000/var/www/html/$1
ProxyPassMatch ^/(.+\.php.*)$ fcgi://127.0.0.1:9500/var/www/html/$1 timeout=1800
</VirtualHost>
I still get the following message after restarting Apache and php fpm
Service Unavailable The server is temporarily unable to service your request due to maintenance downtime or capacity problems
I managed to create my own OPENSSL enabled sites in localhost wampserver 2.5. I have 7 clients computers. I can access the site from these 7 clients computer without the https://. I installed wamp on my Drive C:/wamp but I put my site file in drive D:/sites. So my httpd-ssl.conf file goes:
httpd-ssl.conf
<VirtualHost *:443>
DocumentRoot "D:/sites"
ServerName local.client:443
ServerAdmin admin#gmail.com
ErrorLog "c:/wamp/logs/error.log"
TransferLog "c:/wamp/logs/access.log"
SSLEngine on
#SSLCertificateFile and ssl related goes here
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "D:/sites">
SSLOptions +StdEnvVars
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Require local
</Directory>
BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
#custom log
</VirtualHost>
When I try to access the site from the 7 client machines using https://local.client/, It points to wamp default site directory (www). There is no error message as well. On the server machine (the machine where I installed wamp), it is working fine. So for client machines, I added the same virtualhost tag to httpd-vhosts.conf and added the following code for port 80 so that I can access without https://
httpd-vhosts.conf
<VirtualHost *:443>
DocumentRoot "D:/sites"
ServerName local.client:443
ServerAdmin admin#gmail.com
ErrorLog "c:/wamp/logs/error.log"
TransferLog "c:/wamp/logs/access.log"
SSLEngine on
#SSLCertificateFile and ssl related goes here
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "D:/sites">
SSLOptions +StdEnvVars
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Require local
</Directory>
BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
#custom log
</VirtualHost>
<VirtualHost *:80>
DocumentRoot "D:/sites"
ServerName local.client
<Directory "D:/sites">
Options Indexes FollowSymLinks
AllowOverride all
Require all granted
</Directory>
</VirtualHost>
So the http:// is working great in the 7 client machines. But https:// is not working at all. There is no error message, it just directs me to index.php in www folder. So can anyone help me figure out where I go wrong, or is this something possible to do in apache2.4.9? Any advises and suggestions are welcome.
So, I need to run multiple php apps/sites on one server. One or many should run using apache and mod_php5, and one or many should be able to run using mod_fastcgi and php-fpm. The mod_php5 ones are currently fine, and the fastcgi ones work if i disable mod_php5, but I'm having difficulty getting them to work at the same time.
I think this can be achieved using some combination of filesmatch, if.mod_fastcgi and if.mod_actions in apache, but I cant work out what it is. We can install any apache modules required to do this if needed.
Super bonus points if there is a different version of the vhost for Apache 2.2 or less and you have that snippet too, or at least know what I should do
Im not going to post the entire vhosts i have as i know they're wrong, but the first, default, mod_php based vhosts are looking like so...
#NameVirtualHost 127.0.0.1:80 < Apache 2.2 or less
<VirtualHost 127.0.0.1:80>
ServerAdmin webmaster#localhost
ServerName some.site.tld
DocumentRoot /var/www/some/site/
<Directory /var/www/some/site/>
Options Indexes FollowSymLinks MultiViews
Require all granted
# Order deny,allow < Apache 2.2 or less
# Allow from all < Apache 2.2 or less
</Directory>
ErrorLog /var/log/apache2/error.log
CustomLog /var/log/apache2/access.log combined
</VirtualHost>
Ideally, I'd like these to remain untouched, and that we can add more if we need more of these.
The outcome I would like, is to be able to drop in new vhosts configured for mod_php using something like the first configuration, and also drop in vhosts like the following for fast cgi.
# NameVirtualHost 0.0.0.0:80 < Apache 2.2 or Less
<VirtualHost 0.0.0.0:80>
ServerAdmin webmaster#localhost
ServerName some.application.tld
DocumentRoot /opt/some/app/dir/
ErrorLog /var/log/apache2/error.log
CustomLog /var/log/apache2/access.log combined
<IfModule mod_fastcgi.c>
# php_admin_flag engine off < I tried to use this to disable PHP
AddType application/x-httpd-fastphp5 .php
Action application/x-httpd-fastphp5 /php5-fcgi
Alias /php5-fcgi /usr/lib/cgi-bin/php5-fcgi_someapp
FastCgiExternalServer /usr/lib/cgi-bin/php5-fcgi_someapp -socket /var/run/php5-fpm_ptbuild.sock -pass-header Authorization
<Directory /usr/lib/cgi-bin>
Options Indexes FollowSymLinks MultiViews ExecCGI
Require all granted
</Directory>
<Directory /opt/some/app/dir/>
#Options Indexes FollowSymLinks MultiViews ExecCGI
Require all granted
</Directory>
</IfModule>
# I tried to use the below alongside mod_php, didnt work
# <IfModule mod_php5.c>
# php_admin_flag engine off
# AddType application/x-httpd-fastphp5 .php
# <Directory /opt/some/app/dir/>
# Options Indexes FollowSymLinks MultiViews ExecCGI
# Require all granted
# </Directory>
# </IfModule>
</VirtualHost>
If you could post the second vhost, or tell me what I'm doing wrong, thanks very much in advance.
We've got a similar setup on our servers to run 2 versions of PHP, but under the same virtual host. Essentially it's for an old version of the software while transitioning to a new version - 1 runs through the original Apache config and the other through CGI.
Ours is directory based, so slightly different but I think it should work for your situation still.
First, we have the fastCGI config in a separate file /etc/apache2/mods-enabled/fastcgi.conf:
<IfModule mod_fastcgi.c>
# AddHandler fastcgi-script .fcgi
FastCgiWrapper /usr/lib/apache2/suexec
FastCgiIpcDir /var/lib/apache2/fastcgi
FastCgiConfig -idle-timeout 110 -killInterval 120 -pass-header HTTP_AUTHORIZATION -autoUpdate
ScriptAlias /php-fcgi/ /var/www/cgi-bin/
</IfModule>
Then, in the virtual host config itself we have this:
<VirtualHost *:80>
ServerName sitename
...
# Original non-CGI site
<Directory "/sites/webroot/site1/">
Options Indexes FollowSymLinks MultiViews
AllowOverride all
Order allow,deny
Allow from all
</Directory>
# FastCGI version
<Directory "/sites/webroot/site2/">
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
AddHandler php-cgi .php
Action php-cgi /php-fcgi/php562.fcgi
<FilesMatch "\.php$">
SetHandler php-cgi
</FilesMatch>
</Directory>
</VirtualHost>
I think the key thing that is required for you is the AddHandler and SetHandler directives which make it work. Then you should be able to add as many separate sites either with different directories or individual virtual hosts.
I followed this guide and managed to make Python with a Django installation work perfectly, but it seems to have rendered all the locally hosted PHP sites inaccessible returning a 404 error.
httpd.conf
LoadModule wsgi_module modules/mod_wsgi.so
#This is placed right after the rule for <Directory "f:/WAMP/www/">
<Directory "f:/WAMP/www/python">
Options ExecCGI
AddHandler wsgi-script .py
Order allow,deny
Allow from all
</Directory>
#This is placed at the end of the file
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
Include "f:/WAMP/alias/*"
Include "F:/WAMP/www/python/sandbox/apache/apache_django_wsgi.conf"
apache_django_wsgi.conf
Alias /python/images/ "F:/WAMP/www/python/sandbox/images"
<Directory "F:/WAMP/www/python/sandbox/images">
Order allow,deny
Allow from all
</Directory>
WSGIScriptAlias /python "F:/WAMP/www/python/sandbox/apache/django.wsgi"
<Directory "F:/WAMP/www/python/sandbox/apache">
Allow from all
</Directory>
<VirtualHost *:80>
DocumentRoot f:/WAMP/www/python/sandbox/
ServerName 127.0.0.1
</VirtualHost>
django.wsgi
import os, sys
sys.path.append('F:/WAMP/www/python/sandbox')
os.environ['DJANGO_SETTINGS_MODULE'] = 'sandbox.settings'
import django.core.handlers.wsgi
application = django.core.handlers.wsgi.WSGIHandler()
PHP only renders when I comment out the lastline from httpd.conf.
You need to have another virtual host if you're going to set the DocumentRoot:
# This is for PHP
<VirtualHost *:80>
DocumentRoot f:/WAMP/www/
ServerName local.php.dev
</VirtualHost>
# This is for your Django stuff
<VirtualHost *:80>
DocumentRoot f:/WAMP/www/python/sandbox/
ServerName local.py.dev
</VirtualHost>
Otherwise, as it is now, all the local requests are being sent to the python sandbox.
Note that you'll need to have several hosts pointing locally.