Apache-SecSess
view release on metacpan or search on metacpan
[RFC2964] K. Moore and N. Freed, Use of HTTP State Management
RFC 2964, BCP 44, October 2000.
[RFC2965] D. Kristol, L. Montulli, HTTP State Management Mechanism,
RFC 2965 (Obsoletes 2109), October 2000.
[W3C] World Wide Web Consortium Security FAQ,
URL: http://www.w3.org/Security/Faq/.
[SSL] D. Wagner, B. Schneier, "Analysis of the SSL 3.0 Protocol",
1996, URL: http://www.counterpane.com/ssl.html.
The values of qop and authqop issued are determined by the
Apache::SecSess object in all cases. For URL credentials they come
directly from arguments sessQOP and authQOP, respectively. For cookie
credentials, they come from the hash keys of the argument cookieDomain
described below.
Note that no attempt is made to check the correctness of the QOP
settings against the values of the httpd.conf directive SSLCipherSuite.
This would be mistake in fact because the session strength is dependent
on global factors as described in README. Nevertheless, you should
check your assumptions about your local site's openssl with the script
utils/minstren which prints the weakest cipher strength for common
SSLCipherSuite arguments. At my site, I was surprised to find
ALL:!ADH:!EXP:!EXP56 => 56 bits.
=head2 Cookie Domain Argument
cookieDomain => <hashref>
The cookieDomain argument expects a hash reference of the form:
demo/httpdconf/httpd.adam.conf view on Meta::CPAN
# General setup for the virtual host
DocumentRoot "/usr/local/apache/ht/adam.acme.com"
ServerName adam.acme.com
ServerAdmin potsmaster@acme.org.com.net.ch
ErrorLog /usr/local/apache/logs/error_log
TransferLog /usr/local/apache/logs/access_log
SSLEngine on
SSLCipherSuite ALL:!ADH
SSLCertificateFile /usr/local/apache/conf/ssl.crt/adam-cert.pem
SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/adam-key.pem
SSLCACertificateFile /usr/local/apache/conf/ssl.crt/acme-ca.crt
<Location /authen>
SetHandler perl-script
AuthName "Adam Realm"
AuthType Basic
PerlAuthenHandler $Acme::adam->issue
require valid-user
</Location>
</VirtualHost>
demo/httpdconf/httpd.john.conf view on Meta::CPAN
# General setup for the virtual host
DocumentRoot "/usr/local/apache/ht/john.sec.acme.com"
ServerName john.sec.acme.com
ServerAdmin root@localhost.localdomain
ErrorLog /usr/local/apache/logs/error_log
TransferLog /usr/local/apache/logs/access_log
## strong SSL
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXP:!EXP56:!DES:!LOW:!MEDIUM:!SSLv2
SSLCertificateFile /usr/local/apache/conf/ssl.crt/john.sec-cert.pem
SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/john.sec-key.pem
SSLCACertificateFile /usr/local/apache/conf/ssl.crt/acme-ca.crt
## require X.509 client cert
SSLVerifyClient require
SSLVerifyDepth 1
SSLOptions +StdEnvVars
<Location /protected>
SetHandler perl-script
PerlHandler HTML::Mason::ApacheHandler
AuthName "John Secure Realm"
demo/httpdconf/httpd.lysander.conf view on Meta::CPAN
# General setup for the virtual host
DocumentRoot "/usr/local/apache/ht/lysander.acme.com"
ServerName lysander.acme.com
ServerAdmin root@localhost.localdomain
ErrorLog /usr/local/apache/logs/error_log
TransferLog /usr/local/apache/logs/access_log
SSLEngine on
SSLCipherSuite ALL:!ADH
SSLCertificateFile /usr/local/apache/conf/ssl.crt/lysander-cert.pem
SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/lysander-key.pem
SSLCACertificateFile /usr/local/apache/conf/ssl.crt/acme-ca.crt
<Location /authen>
SetHandler perl-script
AuthName "Lysander Realm"
AuthType LoginForm
PerlAuthenHandler $Acme::lysander->issue
require valid-user
</Location>
</VirtualHost>
demo/httpdconf/httpd.milt.conf view on Meta::CPAN
# General setup for the virtual host
DocumentRoot "/usr/local/apache/ht/milt.sec.acme.com"
ServerName milt.sec.acme.com
ServerAdmin root@localhost.localdomain
ErrorLog /usr/local/apache/logs/error_log
TransferLog /usr/local/apache/logs/access_log
## strong SSL
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXP:!EXP56:!DES:!LOW:!MEDIUM:!SSLv2
SSLCertificateFile /usr/local/apache/conf/ssl.crt/milt.sec-cert.pem
SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/milt.sec-key.pem
SSLCACertificateFile /usr/local/apache/conf/ssl.crt/acme-ca.crt
<Location /protected>
SetHandler perl-script
PerlHandler HTML::Mason::ApacheHandler
AuthName "Milt Secure Realm"
AuthType Apache::SecSess
PerlAuthenHandler $Acme::milt->authen
require valid-user
</Location>
demo/httpdconf/httpd.noam.conf view on Meta::CPAN
# General setup for the virtual host
DocumentRoot "/usr/local/apache/ht/noam.acme.org"
ServerName noam.acme.org
ServerAdmin root@localhost.localdomain
ErrorLog /usr/local/apache/logs/error_log
TransferLog /usr/local/apache/logs/access_log
## strong SSL
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXP:!EXP56:!DES:!LOW:!MEDIUM:!SSLv2
SSLCertificateFile /usr/local/apache/conf/ssl.crt/noam.acme.org-cert.pem
SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/noam.acme.org-key.pem
SSLCACertificateFile /usr/local/apache/conf/ssl.crt/acme-ca.crt
<Location /protected>
SetHandler perl-script
PerlHandler HTML::Mason::ApacheHandler
AuthName "Stu Secure Realm"
AuthType Apache::SecSess
PerlAuthenHandler $Acme::noam->authen
require valid-user
</Location>
demo/httpdconf/httpd.sec2.conf view on Meta::CPAN
##
#
# Some MIME-types for downloading Certificates and CRLs
#
<IfDefine SSL>
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
</IfDefine>
<IfModule mod_ssl.c>
# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin' is a internal
# terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog builtin
# Inter-Process Session Cache:
# Configure the SSL Session Cache: First either `none'
# or `dbm:/path/to/file' for the mechanism to use and
# second the expiring timeout (in seconds).
#SSLSessionCache none
#SSLSessionCache shm:/usr/local/apache/logs/ssl_scache(512000)
SSLSessionCache dbm:/usr/local/apache/logs/ssl_scache
SSLSessionCacheTimeout 300
# Semaphore:
# Configure the path to the mutual explusion semaphore the
# SSL engine uses internally for inter-process synchronization.
SSLMutex file:/usr/local/apache/logs/ssl_mutex
# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the
# SSL library. The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. This means you then cannot use the /dev/random device
# because it would lead to very long connection times (as long as
# it requires to make more entropy available). But usually those
# platforms additionally provide a /dev/urandom device which doesn't
# block. So, if available, use this one instead. Read the mod_ssl User
# Manual for more details.
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random 512
#SSLRandomSeed startup file:/dev/urandom 512
#SSLRandomSeed connect file:/dev/random 512
#SSLRandomSeed connect file:/dev/urandom 512
# Logging:
# The home of the dedicated SSL protocol logfile. Errors are
# additionally duplicated in the general error log file. Put
# this somewhere where it cannot be used for symlink attacks on
# a real server (i.e. somewhere where only root can write).
# Log levels are (ascending order: higher ones include lower ones):
# none, error, warn, info, trace, debug.
SSLLog /usr/local/apache/logs/ssl_engine_log
SSLLogLevel info
</IfModule>
<Directory />
<FilesMatch "\.html$">
SetHandler perl-script
PerlHandler HTML::Mason::ApacheHandler
</FilesMatch>
</Directory>
demo/httpdconf/httpd.stu.conf view on Meta::CPAN
# General setup for the virtual host
DocumentRoot "/usr/local/apache/ht/stu.transacme.com"
ServerName stu.transacme.com
ServerAdmin root@localhost.localdomain
ErrorLog /usr/local/apache/logs/error_log
TransferLog /usr/local/apache/logs/access_log
## strong SSL
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXP:!EXP56:!DES:!LOW:!MEDIUM:!SSLv2
SSLCertificateFile /usr/local/apache/conf/ssl.crt/stu.transacme.com-cert.pem
SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/stu.transacme.com-key.pem
SSLCACertificateFile /usr/local/apache/conf/ssl.crt/acme-ca.crt
## require X.509 client cert
SSLVerifyClient require
SSLVerifyDepth 1
SSLOptions +StdEnvVars
<Location /protected>
SetHandler perl-script
PerlHandler HTML::Mason::ApacheHandler
AuthName "Stu Secure Realm"
demo/httpdconf/httpd.tom.conf view on Meta::CPAN
# General setup for the virtual host
DocumentRoot "/usr/local/apache/ht/tom.acme.com"
ServerName tom.acme.com
ServerAdmin root@localhost.localdomain
ErrorLog /usr/local/apache/logs/error_log
TransferLog /usr/local/apache/logs/access_log
## strong SSL
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXP:!EXP56:!DES:!LOW
SSLCertificateFile /usr/local/apache/conf/ssl.crt/tom-cert.pem
SSLCertificateKeyFile /usr/local/apache/conf/ssl.key/tom-key.pem
SSLCACertificateFile /usr/local/apache/conf/ssl.crt/acme-ca.crt
## require X.509 client cert
SSLVerifyClient require
SSLVerifyDepth 1
SSLOptions +StdEnvVars
<Location /protected>
SetHandler perl-script
PerlHandler HTML::Mason::ApacheHandler
AuthName "Tom Realm"
utils/Makefile view on Meta::CPAN
# Makefile - make certs w/ mkcerts
#
# $Id: Makefile,v 1.1 2002/04/20 22:58:46 pliam Exp $
#
#
# config
#
APACHE=/usr/local/apache
CACERT=acme-ca.crt
CRTPATH=$(APACHE)/conf/ssl.crt
KEYPATH=$(APACHE)/conf/ssl.key
DOCROOT=$(APACHE)/ht/adam.acme.com
#
# targets
#
all: scratch
# make a CA from scratch
scratch:
(umask 066; ./mkcerts -d -n)
utils/minstren view on Meta::CPAN
#!/usr/bin/perl
# minstren - check/generate minimum cipher strengths for current openssl
#
# $Id: minstren,v 1.2 2002/04/21 06:27:07 pliam Exp $
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# minstren
# Copyright (c) 2001, 2002 John Pliam (pliam@atbash.com)
# This is open-source software.
# See file 'COPYING' in original distribution for complete details.
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
use Getopt::Std;
use Data::Dumper;
$Data::Dumper::Indent = 1;
$Data::Dumper::Terse = 1;
$usage = "usage: $0 [-c <cipher_string>]\n";
getopts('c:') || die $usage;
$ciphercmd = '/usr/bin/openssl ciphers -v';
# common exclusion tags for SSLCipherSuite
@nots = qw(ADH EXP EXP56 DES LOW MEDIUM SSLv2 RC4);
# form typical cipher suites
@ciph = qw(ALL);
for $i (1..scalar(@nots)) { # add increasing exclusion
@n = @nots;
push(@ciph, sprintf("ALL:!%s", join(':!', splice(@n, 0, $i))));
}
# but ...
if ($opt_c) { @ciph = ($opt_c); }
for $ciph (@ciph) {
open(OPENSSL, "$ciphercmd '$ciph' |")
|| die "Cannot run openssl ciphers.\n";
$min = 2048;
while (<OPENSSL>) {
next unless /Enc=[^\(]+\(([^\)]+)\)/;
$min = ($1 < $min) ? $1 : $min;
}
close(OPENSSL);
$stren->{$ciph} = $min;
}
print Dumper($stren);
utils/mkcerts view on Meta::CPAN
#!/usr/bin/perl
# mkcerts - (the anti-CA script) make x509 certificates with openssl
#
# $Id: mkcerts,v 1.3 2002/05/08 02:14:59 pliam Exp $
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# mkcerts
# Copyright (c) 2001, 2002 John Pliam (pliam@atbash.com)
# This is open-source software.
# See file 'COPYING' in original distribution for complete details.
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
use Getopt::Std;
system("openssl version");
#
# cmd line args
#
$usage = "usage: $0 [-d] [-e] [-n]";
getopts('den') || die $usage;
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
utils/mkcerts view on Meta::CPAN
# configuration info which should be OK to LEAVE ALONE
#
$confile = './request.cnf'; # config file for requests
#
# create CA cert, if necessary
#
if ($opt_n) { &newca; }
#
# make basic ssl server certs under CA's domain
#
for $s (@servers) { &mksslserv($s); }
#
# make pkcs12 client cert/key's
#
for $c (@clients) { &mkpkcs12($c); }
#
# subroutine to create new CA
#
sub newca {
utils/mkcerts view on Meta::CPAN
open(CONFILE, ">$confile") || die "cannot create config file: $confile";
printf CONFILE "%s\n", $configinfo;
close(CONFILE);
#
# create self-signed root cert for CA, and display
#
# create/sign
system(
"openssl req -config $confile -x509 -new -days $cadays -out $cacert"
) == 0 or die "problem creating root CA certificate";
# clean up
unlink($confile) || die "cannot remove $confile";
# display
if ($opt_d) {
printf(":\n: Newly Created Root CA Certificate\n:\n");
system(
"openssl x509 -in $cacert -noout -text"
) == 0 or die "problem printing root CA certificate: $cacert";
}
printf(":\n: CA's MD5 fingerprint\n:\n");
system(
"openssl x509 -in $cacert -noout -fingerprint"
) == 0 or die "fingerprint problem with root CA certificate: $cacert";
}
#
# general subroutine to create and sign x509 certs
#
sub mknsign {
my ($opt_e, $hr) = @_; # global $opt_e doesn't apply to pkcs12
my($name, $req, $key, $cert);
my($enccmd, $dtag, $configinfo);
utils/mkcerts view on Meta::CPAN
$req = sprintf("%s-req.pem", $name); # request file
$key = sprintf("%s-key.pem", $name); # private key file
$cert = sprintf("%s-cert.pem", $name); # cert file
printf("\n:\n: Creating and Signing Cert for '%s' ...\n:\n", $name);
if ($opt_d) {
printf("%s: creating request/key (%s,%s)\n", $name, $req, $key);
}
#
# make configuation file for openssl req
#
$enccmd = ($opt_e) ?
"output_password = $spasswd" :
"encrypt_key = no";
$configinfo = <<"END_CONFILE";
[ req ]
default_bits = $rsabits
default_md = $digest
default_keyfile = $key
utils/mkcerts view on Meta::CPAN
$configinfo .= sprintf("emailAddress\t\t= %s\n", $hr->{'email'});
}
open(CONFILE, ">$confile") || die "cannot create config file: $confile";
printf CONFILE "%s\n", $configinfo;
close(CONFILE);
#
# create cert request
#
system(
"openssl req -config $confile -new -out $req"
) == 0 or die "problem creating certificate request for: $name";
#
# sign the request
#
# sign
open(SIGNREQ, "| openssl x509 -req -in $req -passin stdin -$digest " .
"-CA $cacert -CAkey $cakey -CAcreateserial -days $days -out $cert"
) or die "problem signing certificate request for: $name";
printf SIGNREQ "%s\n", $capasswd;
close(SIGNREQ);
# clean up
unlink($confile, $req) || die "cannot clean up";
# display
if ($opt_d) {
printf(":\n: Newly Signed Certificate for '%s'\n:\n", $name);
system(
"openssl x509 -in $cert -noout -text"
) == 0 or die "problem printing certificate: $cert";
printf(":\n: Verifying '%s' ...\n:\n", $name);
system(
"openssl x509 -in $cert -noout -fingerprint"
) == 0 or die "certificate fingerprint problem: $name";
printf("verifying signature ...\n");
system(
"openssl verify -verbose -CAfile $cacert $cert"
) == 0 or die "certificate fingerprint problem: $name";
}
}
#
# create the SSL server certs under CA's domain
#
sub mksslserv {
my $s = shift;
my($servdns, $name);
if ($s =~ /\.$/) { # host within signing domain
$name = $`;
$servdns = sprintf("%s%s", $s, $dns);
}
else { # hosts outside signing domain
$name = $s;
$servdns = $s;
utils/mkcerts view on Meta::CPAN
#
# create .p12 file
#
$cert = sprintf("%s-cert.pem", $nick);
$key = sprintf("%s-key.pem", $nick);
$pemfile = sprintf("%s.pem", $nick);
$p12file = sprintf("%s.p12", $nick);
system("cat $cert $key > $pemfile") == 0
or die "cannot create concatenated file: $pemfile";
open(PKCSCMD,
"| openssl pkcs12 -export -in $pemfile -out $p12file " .
"-name \"$full\" -passout stdin"
) or die "problem creating PKCS file: $p12file";
printf PKCSCMD "%s\n", $cpasswd;
close(PKCSCMD);
unlink($cert, $key, $pemfile) || die "cannot clean up";
}
( run in 0.816 second using v1.01-cache-2.11-cpan-acf6aa7dc9e )