Skip to Content.
Sympa Menu

unclug - Re: [unclug] Redirect 80 ---> 443 with Apache? -- credentials encrypted?

unclug AT lists.ibiblio.org

Subject: UNC Linux Users Group

List archive

Chronological Thread  
  • From: "John W. Sopko Jr." <sopko AT cs.unc.edu>
  • To: UNC Linux Users Group <unclug AT lists.ibiblio.org>, Jeff Bollinger <jeff01 AT email.unc.edu>
  • Cc:
  • Subject: Re: [unclug] Redirect 80 ---> 443 with Apache? -- credentials encrypted?
  • Date: Wed, 03 Mar 2004 12:29:03 -0500

I have a similar situation, I think you can use tcpdump to check this out:

tcpdump dst port 443 and host lark.cs.unc.edu

You should see the traffic on 443 and not 80 after submitting
the user/password.

Another way to check this out that works for me, (I think):

I know what you mean about not seeing the https or the security icon, I have seen this similar scenario on other web sites including my own
and am not sure if my user/passwe is encrypted, I think it is.

For example, I have a .htaccess file:

<IFDefine INSECURE>
RedirectMatch (.*)$ https://lark.cs.unc.edu$1
</IFDefine>

<IFDefine SECURE>
AuthUserFile /var/www/.htpasswd
AuthName 'Computer Science UserID:'
AuthType Basic
require valid-user
</IFDefine>

I do a -DINSECURE define on my port 80 server and a -DSECURE on my port
443 server. When I hit the port 80 server the .htaccess file
re-directs me to the port 443 but it does not show the https link etc.
when prompting for the user/password.

But, I have a ssl certificate that does not match my https host name, mozilla complains about this with a popup before it pops up the user/password box which proves to me it did get re-directed to the ssl server.

Setup an alias on your https and redirect to the alias and see if
it commplains about the hostname not matching the certificate name
before the user/passwd prompt.



Jeff Bollinger wrote:
Joe Morris wrote:

On Fri, 20 Feb 2004, John W. Sopko Jr. wrote:

<snip>

| servers. I just wanted a simple way when going to port 80 to go to
| port 443 like Jeff did. I think there is some issue in apaceh 2.x.

All you should need is the following then...

----
<VirtualHost 192.168.0.1:80>
RedirectMatch permanent .* https://newsitename$1
</VirtualHost>
----

All other environment variables will get inherited, so nothing else to
define inside of that virtual host container.

<snip>

_______________________________________________
Joe Morris, Web Systems Manager
Academic Technology and Networks
The University of North Carolina at Chapel Hill



I hate to drudge this issue up again, but say you do the above:

<VirtualHost 192.168.0.1:80>
RedirectMatch permanent .* https://newsitename$1
</VirtualHost>

but your index page requires a login (via any of the auth modules, say, mod_auth_ldap for example). I notice that when I have the above virtual host set, I do indeed get the redirect but I don't see https in the address bar (or the lock icon at the bottom right of the browser) until *after* I authenticate. How can I tell if my authentication is passing through the SSL tunnel?

Thanks!
Jeff

_______________________________________________
unclug mailing list
unclug AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/unclug

--
John W. Sopko Jr. University of North Carolina
email: sopko AT cs.unc.edu Computer Science Dept., CB 3175
Phone: 919-962-1844 Sitterson Hall; Room 044
Fax: 919-962-1799 Chapel Hill, NC 27599-3175





Archive powered by MHonArc 2.6.24.

Top of Page