3

I'm just getting started using Apache and I pretty much have everything configured the way I want, I'm just having trouble with one aspect. A quick overview: I have a document root of "/var/www", then I have two sites at "/var/www/site1" and "/var/www/site2". Both sites have SSL and authenticate using a simple htpasswd file and run on two different ports (443 & 444). Everything works as I would expect, the auth and SSL both work fine. The only problem is that I can access "site2" without a password under certain conditions.

If I browse to "https://10.0.0.13:444/site2" I get the SSL and auth prompt, I can log in and everything works fine. The same goes for "site1", both the SSL and auth work correctly. However if I browse to "https://10.0.0.13/site2", then Apache lets me access "site2" without a password. Both site1 and site2 DNS resolve to the server's IP address. I know it's gotta be something that I'm just not understanding with the vhosts configuration. I've poked around a lot and cannot seem to get it working nor have I found an example online that helps me figure it out either. Any help would be greatly appreciated!! Here is the current "default-ssl" vhost configuration I'm using:

<VirtualHost *:443>
        ServerName  site1.domain.com
        ServerAdmin site1@localhost

        SSLEngine on
        SSLCertificateFile /etc/apache2/site1.pem

        DocumentRoot /var/www/
        <Directory />
                Options FollowSymLinks
                AllowOverride All
        </Directory>
        <Directory /var/www/>
                Options -Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>

        ErrorLog /var/log/apache2/error.log
        LogLevel warn
        CustomLog /var/log/apache2/access.log combined

    <Location /site1>
        AuthType Digest
        AuthName "site1"
        AuthDigestDomain /var/www/site1/ http://site1.domain.com/site1

        AuthDigestProvider file
        AuthUserFile /etc/apache2/htpasswd
        Require valid-user
        SetEnv R_ENV "/var/www/site1"
     </Location>
</VirtualHost>

<VirtualHost *:444>
        ServerName  site2.domain.com
        ServerAdmin site2@localhost

        SSLEngine on
        SSLCertificateFile /etc/apache2/site2.pem

        DocumentRoot /var/www/
        <Directory />
                Options FollowSymLinks
                AllowOverride All
        </Directory>
        <Directory /var/www/>
                Options -Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>

        ErrorLog /var/log/apache2/error.log
        LogLevel warn
        CustomLog /var/log/apache2/access.log combined

    <Location /site2>
        AuthType Digest
        AuthName "site2"
        AuthDigestDomain /var/www/site2/ http://site2.domain.com/site2

        AuthDigestProvider file
        AuthUserFile /etc/apache2/htpasswd
        Require valid-user
        SetEnv R_ENV "/var/www/site2"
     </Location>
</VirtualHost>
Improve this question
9
  • I rather suspect your use of port 444 is tripping you up. Accessing the system via 10.0.0.13/site2 is very likely using port 443. You may get the results you want by making both sites port 443.
    – closetnoc
    Jan 29, 2015 at 15:43
  • Thanks for your suggestion closetnoc, unfortunately this was how I originally had it configured. If I leave both vhosts set to port 443 I receive a warning from Apache stating: "default VirtualHost overlap on port 443, the first has precedence". Both sites work with each set to the same port but "site2" has no login prompt at all. The only way I was able to get "site2" to have a login prompt was by putting it on a different port. I'd prefer both sites to be on port 443 as that would be advantageous.
    – Cragmuer
    Jan 29, 2015 at 22:53
  • You are missing that fact that HTTPS is SSL on port 443. So when you enter https in your browser, it is using port 443 and you cannot change this.
    – closetnoc
    Jan 29, 2015 at 23:48
  • So how can I serve up these two websites so they remain separate from each other? I just need two separate websites, behind a password and using SSL. I'm open to any suggestions on how I can successfully implement this. I've also tried using the same configuration but splitting each site up in sites-enabled, so I had "site1" and "site2" in sites-enabled instead of both in one config file and that didn't work either.
    – Cragmuer
    Jan 30, 2015 at 0:58
  • 1
    Define both sites on 443 and use SNI to tell browsers that all the SSL's run on 1 IP. Using a port other than 443 for SSL is asking for all kinds of extra work and heartache. wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI
    – dhaupin
    Jan 30, 2015 at 14:24

1 Answer 1

Reset to default
3

@Cragmuer If all you want to do is host two different directories with separate user authentication, just add another <location> directive to your site config. I will assume that you have your ports.conf file setup correctly but I'll include a sample anyway. An example configuration would look like something like this:

/etc/apache2/sites-available

<VirtualHost *:443>
        SSLEngine on
        SSLCertificateFile /etc/apache2/cert-file.pem

        DocumentRoot /var/www/
        <Directory />
                Options FollowSymLinks
                AllowOverride All
        </Directory>
        <Directory /var/www/>
                Options -Indexes FollowSymLinks MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
        </Directory>

        ErrorLog /var/log/apache2/error.log
        LogLevel warn
        CustomLog /var/log/apache2/access.log combined

    <Location /site1>
        AuthType Digest
        AuthName "site1"
        AuthDigestDomain /var/www/site1/ http://10.0.0.13/site1

        AuthDigestProvider file
        AuthUserFile /etc/apache2/htpasswd
        Require valid-user
        SetEnv R_ENV "/var/www/site1"
     </Location>

    <Location /site2>
        AuthType Digest
        AuthName "site2"
        AuthDigestDomain /var/www/site2/ http://10.0.0.13/site2

        AuthDigestProvider file
        AuthUserFile /etc/apache2/htpasswd
        Require valid-user
        SetEnv R_ENV "/var/www/site2"
    </Location>
</VirtualHost>

/etc/apache2/ports.conf

<IfModule mod_ssl.c>
    NameVirtualHost *:443
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

If you want to add more directories simply insert another <location> directive. Now if you want to actually host separate domains with different document roots, then you need to look into using the NamedVirtualHost directive. Also you don't need two different certificate files for the configuration you posted, one will work just fine.

Improve this answer
1
  • Thank you very much for your answer mosipd, it is much appreciated! This worked great and was exactly what I was trying to do. I didn't need two different domains like you said and I only wanted to have more than one directory behind a password while using an encrypted connection. Thanks again :)
    – Cragmuer
    Feb 1, 2015 at 8:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.