Web Rewrite Rules

|!Punctuation|!Location|!Function|\n|{{{@@...@@}}}|surrounding text|@@highlighted text@@|\n|{{{//...//}}}|surrounding text|//italicized text//|\n|{{{==...==}}}|surrounding text|==strikethrough text==|\n|{{{''...''}}}|surrounding text|''boldfaced text''|\n|{{{__...__}}}|surrounding text|__underlined text__|\n|{{{[[text|url]]}}}|around text/url pair|[[text|http://gri.gallaudet.edu/]] link to url|\n|{{{ {...} }}}|''__tripled__'' surrounding text|{{{in-line literal text}}}|\n|{{{ {...} }}}|''__tripled__'' surrounding ''__lines__''|literal block|\n|{{{<<<}}}|surrounding ''__lines__''|blockquotes|\n|{{{!}}}|at start of line|subheading|\n|{{{|...|...|}}}|line sectioned by vertical bars|table row|\n|{{{!}}}|in a table|!table heading|\n|{{{----}}}|alone on line|horizontal rule|\n|{{{*}}}|at start of line|bulleted list item|\n|{{{#}}}|at start of line|numbered list item|\nsource: Kevin Cole, January 2007

TTiddlyWiki uses Wiki style markup, a way of lightly "tagging" plain text so it can be transformed into HTML. Edit this Tiddler to see samples.\n\n! Header Samples\n!Header 1\n!!Header 2\n!!!Header 3\n!!!!Header 4\n!!!!!Header 5\n\n! Unordered Lists:\n* Lists are where it's at\n* Just use an asterisk and you're set\n** To nest lists just add more asterisks...\n***...like this\n* The circle makes a great bullet because once you've printed a list you can mark off completed items\n* You can also nest mixed list types\n## Like this\n\n! Ordered Lists\n# Ordered lists are pretty neat too\n# If you're handy with HTML and CSS you could customize the [[numbering scheme|http://www.w3schools.com/css/pr_list-style-type.asp]]\n## To nest, just add more octothorpes (pound signs)...\n### Like this\n* You can also\n** Mix list types\n*** like this\n# Pretty neat don't you think?\n\n! Tiddler links\nTo create a Tiddler link, just use mixed-case WikiWord, or use [[brackets]] for NonWikiWordLinks. This is how the GTD style [[@Action]] lists are created. \n\nNote that existing Tiddlers are in bold and empty Tiddlers are in italics. See CreatingTiddlers for details.\n\n! External Links\nYou can link to [[external sites|http://google.com]] with brackets. You can also LinkToFolders on your machine or network shares.\n\n! Images\nEdit this tiddler to see how it's done.\n[img[http://img110.echo.cx/img110/139/gorilla8nw.jpg]]\n\n!Tables\n|!th1111111111|!th2222222222|\n|>| colspan |\n| rowspan |left|\n|~| right|\n|colored| center |\n|caption|c\n\nFor a complex table example, see PeriodicTable.\n\n! Horizontal Rules\nYou can divide a tiddler into\n----\nsections by typing four dashes on a line by themselves.\n\n! Blockquotes\n<<<\nThis is how you do an extended, wrapped blockquote so you don't have to put angle quotes on every line.\n<<<\n>level 1\n>level 1\n>>level 2\n>>level 2\n>>>level 3\n>>>level 3\n>>level 2\n>level 1\n\n! Other Formatting\n''Bold''\n==Strike==\n__Underline__\n//Italic//\nSuperscript: 2^^3^^=8\nSubscript: a~~ij~~ = -a~~ji~~\n@@highlight@@\n@@color(green):green colored@@\n@@bgcolor(#ff0000):color(#ffffff):red colored@@\n

! Apache2 tests include\n\napache2-ssl-certificate -days 365\n\na2enmod ssl\na2enmod rewrite\na2enmod proxy\n\na2ensite ssl\n\napache2ctl -t \napache2ctl -t -D DUMP_VHOSTS\napachectl startssl

[[IntroductioN]]

! Web Rewrite Rules Scope\n\n# [[apache2.2]]\n# [[apache2]]\n# [[apache2 ssl]]\n# [[apache-ssl]]\n# [[zope]]\n# [[custom]]\n\n\n\n\n

Documentation for Web Rewrite Rules

Web Rewrite Rules

! Is apache-modconf the answer to my prayers?\n\nna...\n

!! apache-ssl\n\nImportant Concept!\n\nApache-ssl is a Different program using the same source web space.\n\nThe configuration for apache-ssl is similar to the configuration for apache.\n\nin modules.conf is the following line:\n{{{\n# Autogenerated file - do not edit!\n# This file is maintained by the apache-ssl package.\n# To update it, run the command:\n# /usr/sbin/apache-modconf apache-ssl\n}}}\n\nIt must have its own mods activated!\n\nmodules seem to be kept in \n/usr/lib/apache/1.3/\n

! how to get apache.crt\n\n# make-ssl-cert /usr/share/ssl-cert/ssleay.cnf apache.crt

! apache2\nApache2 uses two directories for rewrite. These are:\n\n/etc/apache2/sites-available and\n/etc/apache2/sites-enabled which contains only symlinks to sites-available. \n\n\n!! Step 1 Map DNS Name to IP \nsee [[setDNS]]\n\n!! Step 2 Edit the rule file \nsee [[ruleEdit]]\n\n!! Step 3 Make the error logs\nmake the eror log and the access log in the right places\nas root use the mkdir -p and touch command\n\n{{{\nmkdir -p /var/log/apache2/demimonde.org\ntouch /var/log/apache2/demimonde.org/access.log\ntouch /var/log/apache2/demimonde.org/error.log\n}}}\n\n\n\nsymlink it into existence\nln -s ../sites-available/demimonde.org .\n\n!! Test apache configuration:\ntestApache2\n\n!! Reload Apache\n

! apache2 ssl\n\nApache2 ssl is a module added to the existing apache.\n\nInstructions for this are [[here | http://www.linode.com/wiki/index.php/Apache2_SSL_in_Ubuntu ]] our goal is to follow this and see how it goes.\n\n

! Apache 2 ssl step by step\n\nDo this all from /etc/apache2\n\n# openssl genrsa -des3 -rand file1:file1 -out server.key 1024\n# openssl rsa -in server.key -out server.pem\n# openssl req -new -key server.key -out server.csr\n# openssl x509 -req -days 30 -in server.csr -signkey server.key -out server.crt\n# cp /etc/apache2/server.crt /etc/ssl/certs/.\n\n# cp /etc/apache2/server.key /etc/ssl/private/.\n# check in /etc/apache2/mods-available/ssl.conf for right path\n## {{{SSLCertificateFile}}} \n## {{{SSLCertificateKeyFile}}}\n\n

! This is apache2 step by step version 1\nSOURCE\nhttp://www.linode.com/wiki/index.php/Apache2_SSL_in_Ubuntu\n\n# apt-get install apache2 libapache-mod-ssl\n# sudo apache2-ssl-certificate -days 365\n# sudo a2enmod ssl\n# echo "Listen 443" >> /etc/apache2/ports.conf\n# vi /etc/apache2/sites-available/ssl\n** file should look like [[ssl_default]]\n# a2ensite ssl\n# \n

! apache2-ssl-certificate Generates\n\napache.pem in directory invoked.\n\nuses the following:\n{{{\nUS\nVermont\nBarre\nBarre Open System Institute\nFlint Information Technolgy Systems\ndocbox.flint.com\nflint@flint.com\n}}}\n\nMake apache.crt a symlink to apache.pem\n\nThis seems to work.

! A cert generator apache2-ssl-certificate \n\nputs the certs in /etc/apache2/ssl/apache.pem\n\nappears to not generate anything else...\n\ngonna try something else...\n

! apache2.2 is the latest thing.\n\ninstalls with one package apache2.2-common\n\nReferences include\n\n* [[good stuff | http://www.dev411.com/wiki/Installing_Apache2_SSL]]\nNote Here:\nYou can also configure Apache to start SSL without these options by commenting out the {{{<IfDefine SSL>}}} and {{{</IfDefine>}}} tags. \n\n* [[overview | http://packages.ubuntu.com/feisty/web/apache2.2-common]]\nNote the line:\nThis package contains all the standard apache2 modules, including SSL support. However, it does *not* include the server itself; for this you need to install one of the apache2-mpm-* packages; such as worker or prefork.\n\n* [[installation | http://ubuntuforums.org/showthread.php?t=333375]]\n\n* [[caviet | http://ubuntuforums.org/showthread.php?t=490868]]\n\n* [[dreaded pass phrase problem | http://www.modssl.org/docs/2.8/ssl_faq.html]] search for:\n"get rid of the pass-phrase dialog"\n\nNote this works:\nHow can I get rid of the pass-phrase dialog at Apache startup time?\n\nThe reason this dialog pops up at startup and every re-start is that the RSA private key inside your server.key file is stored in encrypted format for security reasons. The pass-phrase is needed to decrypt this file, so it can be read and parsed. Removing the pass-phrase removes a layer of security from your server - proceed with caution!\n\n 1. Remove the encryption from the RSA private key (while keeping a backup copy of the original file):\n\n $ cp server.key server.key.org\n $ openssl rsa -in server.key.org -out server.key\n\n 2. Make sure the server.key file is only readable by root:\n\n $ chmod 400 server.key\n\nYou need to find the OPERATING KEY!!!\n\nstart in /etc/ssl\n\n[[Draft Ubuntu Documentation | http://doc.ubuntu.com/ubuntu/serverguide/C/httpd.html]] this looks promising...

! Is apachectl a good way to do this?\n\n apachectl startssl replaced by\n\n apache2ctl startssl

! now we get this error:\nUnable to configure RSA server private key\n\nSOURCE\nhttp://www.enterprisessl.com/ssl-certificate-support/server_faq/ssl-server-certificate-apache.html\n\nError: "Unable to configure RSA server private key"\nSpecify the correct private key for the certificate.\nCompare the modulus of certificate against the modulus of the private key to see if they match by using the following commands:\nTo view the certificate modulus:\nopenssl x509 -noout -text -in certfile -modulus\nTo view the key:\nopenssl rsa -noout -text -in keyfile -modulus\nCheck that the certificate and private key is saved in notepad and that it has no trailing spaces.\nThe "modulus" and "public exponent" portions in the key and the certificate must\nmatch exactly\n\n

! here is the step by step for rewrite\n\n{{{\nroot@docbox:/etc/apache2/ssl# sudo a2enmod rewrite\nThis module is already enabled!\n}}}\n\n\n

\nThe result is here:\n\n{{{\n<VirtualHost *:80>\n ServerName demimonde.org\n ServerAlias www.demimonde.org\n ServerAdmin flint@flint.com\n ServerSignature On\n\n# Possible values include:\n# debug, info, notice, warn, error, crit, alert, emerg.\n\n LogLevel warn\n CustomLog /var/log/apache2/demimonde.org/access.log combined\n ErrorLog /var/log/apache2/demimonde.org/error.log\n\n# This won't work without mod_proxy. If you switch to mod_ssl then things will get really hairy\n# as mod_proxy doesn't play nice with mod_ssl.\n<IfModule mod_proxy.c>\n ProxyVia On\n <LocationMatch "^[^/]">\n Deny from all\n </LocationMatch>\n </IfModule>\n\n# the dreaded rewrite module\n <IfModule mod_rewrite.c>\n RewriteEngine On\n RewriteRule ^/(.*) \ss\n http://127.0.0.1:8081/VirtualHostBase/http/%{SERVER_NAME}:80/demimonde.org/VirtualHostRoot/$1 [L,P]\n </IfModule>\n</VirtualHost>\n\n}}}

!! Step 1 Map DNS Name to IP\nWe are going to use demimonde.org. The first step is to point it to 64.5.53.104 using [[123cheapdomains | https://www.123cheapdomains.com/cgi-bin/manage-us.cgi ]] IP pointing.\n

{{{\n# Sun Jun 1 08:58:35 EDT 2008\n# From http://www.linode.com/wiki/index.php/Apache2_SSL_in_Ubuntu\n#\nNameVirtualHost *:443\n<virtualhost *:443>\n ServerAdmin webmaster@localhost\n SSLEngine On\n SSLCertificateFile /etc/apache2/ssl/certs/apache.crt\n SSLCertificateKeyFile /etc/apache2/ssl/apache.pem\n\n DocumentRoot /var/www/\n <directory />\n Options FollowSymLinks\n AllowOverride None\n </directory>\n\n <directory /var/www/>\n Options Indexes FollowSymLinks MultiViews\n AllowOverride None\n Order allow,deny\n allow from all\n # This directive allows us to have apache2's default start page\n # in /apache2-default/, but still have / go to the right place\n # Commented out for Ubuntu\n #RedirectMatch\n </directory>\n\n ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/\n <directory "/usr/lib/cgi-bin">\n AllowOverride None\n Options ExecCGI -MultiViews +SymLinksIfOwnerMatch\n Order allow,deny\n Allow from all\n </directory>\n\n ErrorLog /var/log/apache2/error.log\n\n # Possible values include: debug, info, notice, warn, error, crit,\n # alert, emerg.\n LogLevel warn\n\n CustomLog /var/log/apache2/access.log combined\n ServerSignature On\n\n Alias /doc/ "/usr/share/doc/"\n <directory "/usr/share/doc/">\n Options Indexes MultiViews FollowSymLinks\n AllowOverride None\n Order deny,allow\n Deny from all\n Allow from 127.0.0.0/255.0.0.0 ::1/128\n </directory>\n\n\n</virtualhost>\n\n\n}}}

\nTest apache configuration:\n\n{{{\nroot@docbox:/etc/apache2/sites-enabled# /usr/sbin/apache2 -t\nSyntax OK\n}}}\n\nor\n\n{{{\nroot@docbox:/etc/apache2/sites-enabled# /usr/sbin/apache2 -t -S\nVirtualHost configuration:\nwildcard NameVirtualHosts and _default_ servers:\n*:80 is a NameVirtualHost\n default server barre-draisine.net (/etc/apache2/sites-enabled/barre-draisine.net:18)\n port 80 namevhost barre-draisine.net (/etc/apache2/sites-enabled/barre-draisine.net:18)\n port 80 namevhost bmarvt.net (/etc/apache2/sites-enabled/bmarvt.net:18)\n port 80 namevhost bosivt.org (/etc/apache2/sites-enabled/bosivt.org:18)\n port 80 namevhost cvtgardenshow.org (/etc/apache2/sites-enabled/cvtgardenshow.org:18)\n port 80 namevhost demimonde.org (/etc/apache2/sites-enabled/demimonde.org:18)\n port 80 namevhost dfavt.org (/etc/apache2/sites-enabled/dfavt.org:18)\n port 80 namevhost docbox.flint.com (/etc/apache2/sites-enabled/docbox.flint.com:8)\n port 80 namevhost fleekyflux.com (/etc/apache2/sites-enabled/fleekyflux.com:10)\n port 80 namevhost gretta.flint.com (/etc/apache2/sites-enabled/gretta.flint.com:9)\n port 80 namevhost humctc.org (/etc/apache2/sites-enabled/humctc.org:18)\n port 80 namevhost paladintech.com (/etc/apache2/sites-enabled/paladintek.com:18)\n port 80 namevhost sciddlywiki.org (/etc/apache2/sites-enabled/sciddlywiki.org:18)\n port 80 namevhost thereconcilers.org (/etc/apache2/sites-enabled/thereconcilers.org:8)\n port 80 namevhost vtaction.org (/etc/apache2/sites-enabled/vtacton.org:18)\n port 80 namevhost www.dfavt.org (/etc/apache2/sites-enabled/www.dfavt.org:18)\n port 80 namevhost www.fissg.com (/etc/apache2/sites-enabled/www.fissg.com:9)\nSyntax OK\nroot@docbox:/etc/apache2/sites-enabled# \n\n}}}\n\n\n\n

! Zope Rewrite Engine\n\nZope contains a program object called [[virtual host monster]] (VHM) it is detailed in the very nice page that comes up when you are in the zmi and invoke virtual_hosting.\n\nThis can work as a standalone rewriter. I am not going to do this.\n

! Rewrite Rules\n\n[[rewrite witch | http://betabug.ch/zope/witch]]\n

! Proxy problems\n\n[[SOURCE | http://povich.co.uk/blog/?tag=ubuntu]]\n {{{\nSo proxying needs enabling. If I do 'sudo a2enmod proxy' the error changes to 'client denied by server configuration' so I try changing ProxyRequests to on in /etc/apache2/mods-available/proxy.conf, and the very insecure 'Allow from all' in the proxy block.\n\nNow I'm getting a warning 'proxy: No protocol handler was valid for the URL /. If you are using a DSO version of mod_proxy, make sure the proxy submodules are included in the configuration using LoadModule.' in the error log - so I try 'sudo ln -s ../mods-available/proxy_http.load /etc/apache2/mods-enabled/proxy_http.load' to manually add the http sub_module and bingo!\n\nNow to tidy up the mess - other than the manually created symbolic link, all I've done is tweak /etc/apache2/mods-available/proxy.conf thusly:\n\n <IfModule mod_proxy.c>\n #turning ProxyRequests on and allowing proxying from all may allow\n #spammers to use your proxy to send email.\n\n ProxyRequests On\n\n # <Proxy *>\n # AddDefaultCharset off\n # Order deny,allow\n # Deny from all\n # #Allow from 192.168.1.\n # </Proxy>\n\n <Proxy http://mysite.com/*>\n Order deny,allow\n Allow from all\n </Proxy>\n\n # Enable/disable the handling of HTTP/1.1 "Via:" headers.\n # ("Full" adds the server version; "Block" removes all outgoing Via: headers)\n # Set to one of: Off | On | Full | Block\n\n ProxyVia On\n </IfModule>\n\nThat seems to be working, although I'm sure there must have been a tidier way.\n}}

! Typical operational problems\nTry gathering information:\n{{{\napache2 -V\n}}}\n\n\n# [[Error Code: -12263]]\n\n# [[Invalid method in request]]\n\nhttp://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#vhosts2\n\nWhy is it not possible to use Name-Based Virtual Hosting to identify different SSL virtual hosts?\n\nName-Based Virtual Hosting is a very popular method of identifying different virtual hosts. It allows you to use the same IP address and the same port number for many different sites. When people move on to SSL, it seems natural to assume that the same method can be used to have lots of different SSL virtual hosts on the same server.\n\nIt comes as rather a shock to learn that it is impossible.\n\nThe reason is that the SSL protocol is a separate layer which encapsulates the HTTP protocol. So the SSL session is a separate transaction, that takes place before the HTTP session has begun. The server receives an SSL request on IP address X and port Y (usually 443). Since the SSL request does not contain any Host: field, the server has no way to decide which SSL virtual host to use. Usually, it will just use the first one it finds, which matches the port and IP address specified.

! Fix for 'Invalid method in request'\n\n[[ubuntu click here | http://ubuntuforums.org/showthread.php?p=2615445]]\n\nWhat happens if you try to access http:\s\syourserver:443

!SSL Cert variables are:\n\n{{{\nUS\nIllinois\nLindenhurst\nPaladin Technology \nInformation Assurance Unit\nskydyv.paladintek.com\nskydyv043@yahoo.com\n}}}

! apache controls \na2dismod - Disable module \na2dissite - Disable site\na2enmod - Enable module \na2ensite - Enable site\n\nWhat is NameVirtualHost?

! This works for setting the default page for 64.22.103.241 to assurance_rfa\n\nSource: http://betabug.ch/zope/witch\n\n{{{\nRewriteRule ^($|/.*) \s\nhttp://127.0.0.1:8081/VirtualHostBase/\s\nhttps/%{SERVER_NAME}:443/assurance_rfa/VirtualHostRoot$1 [L,P]\n\n}}}

! The error of -- mixing * ports and non-* ports with a NameVirtualHost\n\nWhat is this problem?\n\n{{{\nReloading web server config: apache2[Mon Sep 15 07:02:29 2008] [error] VirtualHost *:443 -- mixing * ports and non-* ports with a NameVirtualHost address is not supported, proceeding with undefined results\n[Mon Sep 15 07:02:29 2008] [warn] NameVirtualHost *:0 has no VirtualHosts\n[Mon Sep 15 07:02:29 2008] [warn] NameVirtualHost *:0 has no VirtualHosts\n}}}\n\n{{{\nroot@li16-241:/etc/apache2/sites-available# /etc/init.d/apache2 reload \nReloading web server config: apache2[Mon Sep 15 07:00:35 2008] [warn] NameVirtualHost *:0 has no VirtualHosts\n\n}}}\n\nThis [[Apache2 SSL HOWTO | http://www.debian-administration.org/articles/349]] states:\n\n>If you check in /etc/apache2/sites-enabled/ you will see a symlink named "000-default" which points to a file, /etc/apache2/sites-available/default, that contains a wild card NameVirtualHost directive for *. Because that host does not specify ports as a separate setting, like *:* it bullies all of the other NameVirtualHost directives you might want to create. This creates an unstable situation where Apache is not sure what all of the directives will do and it gives a warning that explains this.\n\n> A reasonable solution would be to remove the 000-default site from the sites-enabled folder. Or you could edit the default site to be a little more friendly. It is possible that *:* would play nicer than simply *.\n\n

! What is a NameVirtualHost?

'30 September 2008'\n\n[[Zope/Apache | http://wiki.zope.org/zope2/ZopeAndApache]]\n[[Apache 1.3 Rewrite Rules | http://httpd.apache.org/docs/1.3/mod/mod_rewrite.html]]\n[[Setting up apache ssl | http://www.linode.com/wiki/index.php/Apache2_SSL_in_Ubuntu]] gives guidance to move all ports from 80 to 443. Not what we want.\n\n\n

! apache2ctl \nThis is a very useful tool.\n\nFor details of what site you are running try:\n{{{\n/usr/sbin/apache2ctl -S\n}}}\n\nNote different versions on different systems:\n\ndocbox:\n{{{\nServer version: Apache/2.0.55\nServer built: Feb 4 2008 19:57:47\n}}}\n\n...not nearly as useful as...\n\nskydyv\n{{{\nServer version: Apache/2.2.8 (Ubuntu)\nServer built: May 29 2008 08:40:10\n}}}\n\n{{{\napache2ctl configtest\n}}}\n\n\n{{{\n# apache2ctl configtest\nSyntax OK\n}}}\nAnything else is bad...\n\nThe later version can list modules.\n\n

!Certificates\n\nhttps uses certificates. These are generated according to the documentation located [[here | https://help.ubuntu.com/7.10/server/C/httpd.html#https-configuration]]\n\nThese are kept in files and typically spread all over the machine.\n\nfind these with this command:\n{{{\nfind . | grep "csr\s|key\s|pem\s|crt"\n}}}\n\nApache2 seems to only need two of these files:\n\n{{{\n SSLCertificateFile /etc/apache2/ssl/apache.crt\n SSLCertificateKeyFile /etc/apache2/ssl/apache.pem\n}}}\n\n

[error] VirtualHost \nAdd \nNameVirtualHost *:80\n\nto top of config file

Abbreviated site file for bosivt:\n\n{{{\nroot@docbox:/etc/apache2/sites-enabled# sc bosivt.org\n<VirtualHost *:80>\n ServerName bosivt.org\n ServerAlias www.bosivt.org\n ServerAdmin flint@flint.com\n ServerSignature On\n LogLevel warn\n CustomLog /var/log/apache2/bosivt.org/access.log combined\n ErrorLog /var/log/apache2/bosivt.org/error.log\n<IfModule mod_proxy.c>\n ProxyVia On\n <LocationMatch "^[^/]">\n Deny from all\n </LocationMatch>\n </IfModule>\n <IfModule mod_rewrite.c>\n RewriteEngine On\n RewriteRule ^/(.*) \s\n http://127.0.0.1:8081/VirtualHostBase/http/%{SERVER_NAME}:80/bosivt.org/VirtualHostRoot/$1 [L,P]\n </IfModule>\n</VirtualHost>\n}}}