files/etc/apache2/sites-available/ssl.mako

   1 <%
   2 from invirt.config import structs as cfg
   3 hostname = cfg.web.hostname
   4 errmail  = cfg.web.errormail
   5 tracuri  = cfg.trac.uri
   6 %>
   7 Listen 442
   8 Listen 446
   9
  10 <%def name="invirt_webinterface()">
  11         DocumentRoot /var/www/invirt-web
  12         <Directory /var/www/invirt-web>
  13                 Options Indexes FollowSymLinks MultiViews ExecCGI
  14                 AllowOverride None
  15                 Order allow,deny
  16                 allow from all
  17         </Directory>
  18         <Location />
  19 ${caller.body()}
  20         </Location>
  21
  22         RewriteEngine On
  23         RewriteRule ^/favicon.ico - [L]
  24         RewriteRule ^/static(.*) - [L]
  25         RewriteRule ^/overlord/static(.*) /static/$1 [L]
  26         RewriteRule ^/admin/static(.*) /static/$1 [L]
  27         RewriteRule ^/trac(.*) ${tracuri}$1 [R,L]
  28         RewriteRule ^/(.*) /var/www/invirt-web/auth.fcgi/$1 [L]
  29
  30         RewriteLog /var/log/apache2/rewrite.log
  31         RewriteLogLevel 0
  32
  33         ErrorLog /var/log/apache2/error.log
  34
  35         # Possible values include: debug, info, notice, warn, error, crit,
  36         # alert, emerg.
  37         LogLevel warn
  38
  39         CustomLog /var/log/apache2/ssl_access.log combined
  40         ServerSignature On
  41
  42         SSLEngine on
  43
  44         SSLCertificateFile ssl/server.crt
  45         SSLCertificateChainFile ssl/server.crt
  46         SSLCertificateKeyFile ssl/server.key
  47
  48         SSLCACertificateFile /etc/ssl/certs/mitCAclient.pem
  49         SSLVerifyDepth 10
  50
  51         SSLOptions +StdEnvVars
  52         SSLProtocol all -SSLv2
  53         SSLCipherSuite RC4-SHA:AES128-SHA:ALL:!ADH:!EXP:!LOW:!MD5:!SSLV2:!NULL
  54
  55         SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
  56
  57         Redirect /wiki ${tracuri}
  58 </%def>
  59 <VirtualHost *:443>
  60         ServerAdmin ${errmail}
  61         ServerName ${hostname}:443
  62         <%call expr="invirt_webinterface()">
  63                 Require valid-user
  64                 AuthType SSLCert
  65                 AuthSSLCertVar SSL_CLIENT_S_DN_Email
  66                 AuthSSLCertStripSuffix "@MIT.EDU"
  67         </%call>
  68         SSLVerifyClient require
  69 </VirtualHost>
  70 <VirtualHost *:442>
  71         ServerAdmin ${errmail}
  72         ServerName ${hostname}:442
  73         <%call expr="invirt_webinterface()">
  74                 Require valid-user
  75                 AuthType Kerberos
  76                 KrbMethodNegotiate on
  77                 KrbMethodK5Passwd off
  78                 KrbAuthoritative off
  79                 KrbAuthRealms ${cfg.kerberos.realm}
  80                 Krb5Keytab /etc/invirt/keytab
  81                 KrbSaveCredentials off
  82         </%call>
  83         SSLVerifyClient optional
  84 </VirtualHost>
  85
  86 <VirtualHost *:446>
  87         ServerAdmin ${errmail}
  88         ServerName ${hostname}:446
  89
  90         DocumentRoot /var/www/invirt-web
  91         <Directory />
  92                 Options Indexes FollowSymLinks MultiViews ExecCGI
  93                 AllowOverride None
  94                 Order allow,deny
  95                 allow from all
  96         </Directory>
  97
  98         ErrorLog /var/log/apache2/error.log
  99
 100         # Possible values include: debug, info, notice, warn, error, crit,
 101         # alert, emerg.
 102         LogLevel warn
 103
 104         CustomLog /var/log/apache2/ssl_nocert_access.log combined
 105         ServerSignature On
 106
 107         SSLEngine on
 108
 109         SSLCertificateFile ssl/server.crt
 110         SSLCertificateChainFile ssl/server.crt
 111         SSLCertificateKeyFile ssl/server.key
 112
 113         SSLVerifyClient none
 114
 115         SSLOptions +StdEnvVars
 116         SSLProtocol all -SSLv2
 117         SSLCipherSuite RC4-SHA:AES128-SHA:ALL:!ADH:!EXP:!LOW:!MD5:!SSLV2:!NULL
 118
 119         SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
 120 </VirtualHost>