UNC Linux Users Group

["John W. Sopko Jr." <sopko AT cs.unc.edu>]

I have a similar situation, I think you can use tcpdump to check this out:

tcpdump dst port 443 and  host lark.cs.unc.edu

You should see the traffic on 443 and not 80 after submitting
the user/password.

Another way to check this out that works for me, (I think):

I know what you mean about not seeing the https or the security icon, I 
have seen this similar scenario on other web sites including my own
and am not sure if my user/passwe is encrypted, I think it is.

For example, I have a .htaccess file:

<IFDefine INSECURE>
RedirectMatch (.*)$ https://lark.cs.unc.edu$1
</IFDefine>

<IFDefine SECURE>
AuthUserFile /var/www/.htpasswd
AuthName 'Computer Science UserID:'
AuthType Basic
require valid-user
</IFDefine>

I do a -DINSECURE define on my port 80 server and a -DSECURE on my port
443 server. When I hit the port 80 server the .htaccess file
re-directs me to the port 443 but it does not show the https link etc.
when prompting for the user/password.

But, I have a ssl certificate that does not match my https host name, 
mozilla complains about this with a popup before it pops up the 
user/password box which proves to me it did get re-directed to the ssl 
server.

Setup an alias on your https and redirect to the alias and see if
it commplains about the hostname not matching the certificate name
before the user/passwd prompt.



Jeff Bollinger wrote:
> Joe Morris wrote:
>
> > On Fri, 20 Feb 2004, John W. Sopko Jr. wrote:
> <snip>
>
> > | servers. I just wanted a simple way when going to port 80 to go to
> > | port 443 like Jeff did. I think there is some issue in apaceh 2.x.
> >
> > All you should need is the following then...
> >
> > ----
> > <VirtualHost 192.168.0.1:80>
> > RedirectMatch permanent .* https://newsitename$1
> > </VirtualHost>
> > ----
> >
> > All other environment variables will get inherited, so nothing else to
> > define inside of that virtual host container.
>
> <snip>
>
> > _______________________________________________
> > Joe Morris, Web Systems Manager
> > Academic Technology and Networks
> > The University of North Carolina at Chapel Hill
>
>
>
> I hate to drudge this issue up again, but say you do the above:
>
> <VirtualHost 192.168.0.1:80>
> RedirectMatch permanent .* https://newsitename$1
> </VirtualHost>
>
> but your index page requires a login (via any of the auth modules, say, 
> mod_auth_ldap for example).  I notice that when I have the above virtual 
> host set, I do indeed get the redirect but I don't see https in the 
> address bar (or the lock icon at the bottom right of the browser) until 
> *after* I authenticate.  How can I tell if my authentication is passing 
> through the SSL tunnel?
>
> Thanks!
> Jeff
>
> _______________________________________________
> unclug mailing list
> unclug AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/unclug

--
John W. Sopko Jr.               University of North Carolina
email: sopko AT cs.unc.edu      Computer Science Dept., CB 3175
Phone: 919-962-1844             Sitterson Hall; Room 044
Fax:   919-962-1799             Chapel Hill, NC 27599-3175