📄 00000044.htm

📁 一份很好的linux入门资料
💻 HTM
字号:
<HTML><HEAD>  <TITLE>BBS水木清华站∶精华区</TITLE></HEAD><BODY><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER>发信人:&nbsp;mv&nbsp;(蓝花·无争|19:50),&nbsp;信区:&nbsp;Linux&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<BR>标&nbsp;&nbsp;题:&nbsp;Installing&nbsp;a&nbsp;secure&nbsp;web&nbsp;server&nbsp;<BR>发信站:&nbsp;BBS&nbsp;水木清华站&nbsp;(Sat&nbsp;Dec&nbsp;16&nbsp;05:56:14&nbsp;2000)&nbsp;<BR>&nbsp;<BR>&nbsp;<BR>&nbsp;<BR>&nbsp;<BR>With&nbsp;``e-commerce''&nbsp;becoming&nbsp;an&nbsp;important&nbsp;part&nbsp;of&nbsp;many&nbsp;businesses,&nbsp;it's&nbsp;use&nbsp;<BR>ful&nbsp;to&nbsp;know&nbsp;how&nbsp;to&nbsp;set&nbsp;up&nbsp;your&nbsp;server&nbsp;to&nbsp;run&nbsp;SSL&nbsp;for&nbsp;secure&nbsp;transfer&nbsp;of&nbsp;sens&nbsp;<BR>itive&nbsp;information.&nbsp;<BR>What's&nbsp;SSL?&nbsp;<BR>SSL,&nbsp;which&nbsp;stands&nbsp;for&nbsp;Secure&nbsp;Socket&nbsp;Layers,&nbsp;is&nbsp;a&nbsp;protocol&nbsp;by&nbsp;which&nbsp;a&nbsp;client&nbsp;&nbsp;<BR>(web&nbsp;browser)&nbsp;and&nbsp;server&nbsp;(Apache,&nbsp;for&nbsp;example)&nbsp;can&nbsp;communicate&nbsp;with&nbsp;one&nbsp;anot&nbsp;<BR>her&nbsp;securely,&nbsp;using&nbsp;encrypted&nbsp;messages.&nbsp;Anyone&nbsp;intercepting&nbsp;the&nbsp;message&nbsp;will&nbsp;<BR>&nbsp;receive&nbsp;only&nbsp;garbage,&nbsp;since&nbsp;the&nbsp;messages&nbsp;are&nbsp;encoded&nbsp;with&nbsp;the&nbsp;public&nbsp;keys&nbsp;o&nbsp;<BR>f&nbsp;the&nbsp;conversants,&nbsp;but&nbsp;must&nbsp;be&nbsp;decrypted&nbsp;with&nbsp;their&nbsp;private&nbsp;keys,&nbsp;which&nbsp;are&nbsp;&nbsp;<BR>not&nbsp;distributed.&nbsp;<BR>Getting&nbsp;SSL&nbsp;<BR>There&nbsp;are&nbsp;a&nbsp;variety&nbsp;of&nbsp;SSL&nbsp;solutions&nbsp;available,&nbsp;and&nbsp;you&nbsp;should&nbsp;probably&nbsp;chec&nbsp;<BR>k&nbsp;out&nbsp;all&nbsp;the&nbsp;options&nbsp;before&nbsp;making&nbsp;the&nbsp;decision&nbsp;that&nbsp;is&nbsp;right&nbsp;for&nbsp;your&nbsp;busi&nbsp;<BR>ness,&nbsp;or&nbsp;that&nbsp;of&nbsp;your&nbsp;clients.&nbsp;<BR>Being&nbsp;an&nbsp;Open&nbsp;Source&nbsp;advocate,&nbsp;I&nbsp;am&nbsp;partial&nbsp;to&nbsp;OpenSSL.&nbsp;You&nbsp;can&nbsp;get&nbsp;OpenSSL&nbsp;&nbsp;<BR>from&nbsp;<A HREF="http://www.openssl.org/">http://www.openssl.org/</A>&nbsp;in&nbsp;source&nbsp;code&nbsp;form.&nbsp;It&nbsp;is&nbsp;free&nbsp;software,&nbsp;and&nbsp;y&nbsp;<BR>ou&nbsp;can&nbsp;build&nbsp;it&nbsp;to&nbsp;run&nbsp;on&nbsp;whatever&nbsp;platform&nbsp;you&nbsp;are&nbsp;using.&nbsp;<BR>As&nbsp;of&nbsp;this&nbsp;writing,&nbsp;the&nbsp;latest&nbsp;version&nbsp;of&nbsp;OpenSSL&nbsp;is&nbsp;0.9.6.&nbsp;The&nbsp;file&nbsp;is&nbsp;appr&nbsp;<BR>oximately&nbsp;2&nbsp;MB,&nbsp;so&nbsp;be&nbsp;prepared&nbsp;to&nbsp;wait&nbsp;a&nbsp;while.&nbsp;<BR>You&nbsp;need&nbsp;to&nbsp;click&nbsp;on&nbsp;the&nbsp;``Source''&nbsp;link,&nbsp;and&nbsp;get&nbsp;the&nbsp;file&nbsp;that&nbsp;is&nbsp;labelled&nbsp;&nbsp;<BR>as&nbsp;&quot;LATEST&quot;.&nbsp;<BR>Installing&nbsp;SSL&nbsp;<BR>Please&nbsp;note&nbsp;that&nbsp;SSL&nbsp;is&nbsp;the&nbsp;engine,&nbsp;and&nbsp;you'll&nbsp;still&nbsp;need&nbsp;mod_ssl&nbsp;for&nbsp;the&nbsp;in&nbsp;<BR>teraction&nbsp;between&nbsp;SSL&nbsp;and&nbsp;Apache.&nbsp;<BR>Once&nbsp;you've&nbsp;downloaded&nbsp;OpenSSL,&nbsp;you&nbsp;will&nbsp;need&nbsp;to&nbsp;unpack&nbsp;it.&nbsp;Do&nbsp;this&nbsp;in&nbsp;the&nbsp;s&nbsp;<BR>ame&nbsp;location&nbsp;where&nbsp;you&nbsp;have&nbsp;Apache&nbsp;source&nbsp;code&nbsp;unpacked.&nbsp;I'll&nbsp;assume&nbsp;for&nbsp;thi&nbsp;<BR>s&nbsp;article&nbsp;that&nbsp;you're&nbsp;working&nbsp;in&nbsp;/usr/src.&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;gunzip&nbsp;openssl-0.9.6.tar.gz&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;tar&nbsp;-vxf&nbsp;openssl-0.9.6.tar&nbsp;<BR>Then&nbsp;change&nbsp;into&nbsp;the&nbsp;openssl-0.9.6&nbsp;directory,&nbsp;and&nbsp;type&nbsp;the&nbsp;following:&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;./config&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;make&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;make&nbsp;test&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;make&nbsp;install&nbsp;<BR>That's&nbsp;it.&nbsp;You're&nbsp;ready&nbsp;to&nbsp;move&nbsp;on&nbsp;to&nbsp;the&nbsp;next&nbsp;stage.&nbsp;For&nbsp;detailed&nbsp;instructi&nbsp;<BR>ons&nbsp;and&nbsp;advanced&nbsp;options,&nbsp;read&nbsp;the&nbsp;INSTALL&nbsp;file.&nbsp;<BR>Installing&nbsp;mod_ssl&nbsp;<BR>Here's&nbsp;where&nbsp;things&nbsp;get&nbsp;interesting.&nbsp;mod_ssl&nbsp;has&nbsp;a&nbsp;reputation&nbsp;of&nbsp;being&nbsp;somew&nbsp;<BR>hat&nbsp;difficult&nbsp;to&nbsp;install,&nbsp;but&nbsp;it&nbsp;does&nbsp;not&nbsp;need&nbsp;to&nbsp;be.&nbsp;<BR>Warning:&nbsp;Make&nbsp;an&nbsp;effort&nbsp;to&nbsp;understand&nbsp;what&nbsp;you&nbsp;are&nbsp;doing&nbsp;before&nbsp;you&nbsp;do&nbsp;it.&nbsp;I&nbsp;<BR>&nbsp;gave&nbsp;a&nbsp;very&nbsp;skimpy&nbsp;definition&nbsp;of&nbsp;SSL&nbsp;above.&nbsp;You&nbsp;really&nbsp;should&nbsp;read&nbsp;the&nbsp;refe&nbsp;<BR>renced&nbsp;article.&nbsp;Security&nbsp;that&nbsp;you&nbsp;don't&nbsp;understand&nbsp;is&nbsp;much&nbsp;more&nbsp;likely&nbsp;to&nbsp;be&nbsp;<BR>&nbsp;compromized&nbsp;than&nbsp;security&nbsp;which&nbsp;you&nbsp;know&nbsp;what&nbsp;it's&nbsp;doing.&nbsp;<BR>Note&nbsp;also&nbsp;that&nbsp;you're&nbsp;going&nbsp;to&nbsp;need&nbsp;to&nbsp;rebuild&nbsp;Apache,&nbsp;so&nbsp;you&nbsp;should&nbsp;have&nbsp;th&nbsp;<BR>e&nbsp;Apache&nbsp;source&nbsp;code&nbsp;handy&nbsp;also.&nbsp;Take&nbsp;this&nbsp;opportunity&nbsp;to&nbsp;upgrade&nbsp;to&nbsp;the&nbsp;lat&nbsp;<BR>est&nbsp;version&nbsp;of&nbsp;Apache.&nbsp;1.3.15&nbsp;should&nbsp;be&nbsp;out&nbsp;real&nbsp;soon.&nbsp;<BR>Get&nbsp;mod_ssl&nbsp;from&nbsp;<A HREF="http://www.modssl.org/">http://www.modssl.org/</A>&nbsp;You&nbsp;should&nbsp;notice&nbsp;a&nbsp;resemblance&nbsp;betw&nbsp;<BR>een&nbsp;this&nbsp;site&nbsp;and&nbsp;the&nbsp;OpenSSL&nbsp;web&nbsp;site.&nbsp;It's&nbsp;not&nbsp;a&nbsp;conicidence.&nbsp;<BR>Download&nbsp;the&nbsp;latest&nbsp;source&nbsp;code&nbsp;file,&nbsp;and&nbsp;unpack&nbsp;it&nbsp;somewhere&nbsp;you&nbsp;can&nbsp;get&nbsp;to&nbsp;<BR>&nbsp;it.&nbsp;It&nbsp;is&nbsp;useful&nbsp;to&nbsp;unpack&nbsp;it&nbsp;in&nbsp;the&nbsp;same&nbsp;place&nbsp;where&nbsp;you&nbsp;have&nbsp;your&nbsp;Apache&nbsp;&nbsp;<BR>source&nbsp;code&nbsp;unpacked,&nbsp;such&nbsp;as&nbsp;in&nbsp;/usr/src,&nbsp;for&nbsp;example.&nbsp;<BR>Now,&nbsp;follow&nbsp;the&nbsp;following&nbsp;carefully.&nbsp;This&nbsp;assumes&nbsp;that&nbsp;you&nbsp;have&nbsp;unpacked&nbsp;all&nbsp;<BR>&nbsp;of&nbsp;these&nbsp;packages&nbsp;in&nbsp;/usr/src,&nbsp;and&nbsp;that&nbsp;you&nbsp;have&nbsp;the&nbsp;Apache&nbsp;source&nbsp;code,&nbsp;th&nbsp;<BR>e&nbsp;OpenSSL&nbsp;source&nbsp;code,&nbsp;and&nbsp;the&nbsp;mod_ssl&nbsp;source&nbsp;code&nbsp;all&nbsp;there.&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cd&nbsp;mod_ssl-2.7.xxxx&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;./configure&nbsp;--with-apache=../apache_1.3.14&nbsp;\&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;--with-ssl=../openssl-0.9.6&nbsp;\&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;--with-crt=/path/to/your/server/certificate&nbsp;\&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;--with-key=/path/to/your/server/key&nbsp;\&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cd&nbsp;../apache_1.3.14&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;make&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;make&nbsp;install&nbsp;<BR>And&nbsp;then&nbsp;you're&nbsp;done.&nbsp;<BR>Yes,&nbsp;perhaps&nbsp;there's&nbsp;a&nbsp;little&nbsp;more&nbsp;to&nbsp;it&nbsp;than&nbsp;that.&nbsp;<BR>Certificate&nbsp;<BR>You&nbsp;need&nbsp;a&nbsp;certificate.&nbsp;It's&nbsp;going&nbsp;to&nbsp;cost&nbsp;you&nbsp;a&nbsp;little&nbsp;money.&nbsp;There&nbsp;are&nbsp;a&nbsp;f&nbsp;<BR>ew&nbsp;companies&nbsp;(VeriSign,&nbsp;for&nbsp;example)&nbsp;that&nbsp;sell&nbsp;secure&nbsp;server&nbsp;certificates&nbsp;th&nbsp;<BR>at&nbsp;are&nbsp;automatically&nbsp;accepted&nbsp;by&nbsp;the&nbsp;major&nbsp;browsers.&nbsp;<BR>You&nbsp;can&nbsp;generate&nbsp;one&nbsp;of&nbsp;your&nbsp;own,&nbsp;but&nbsp;it&nbsp;will&nbsp;show&nbsp;up&nbsp;in&nbsp;the&nbsp;clients&nbsp;browser&nbsp;<BR>&nbsp;window&nbsp;as&nbsp;possibly&nbsp;insecure,&nbsp;and&nbsp;they&nbsp;will&nbsp;have&nbsp;to&nbsp;verify&nbsp;that&nbsp;they&nbsp;are&nbsp;wil&nbsp;<BR>ling&nbsp;to&nbsp;accept&nbsp;it.&nbsp;<BR>Once&nbsp;you&nbsp;have&nbsp;gone&nbsp;through&nbsp;the&nbsp;painful&nbsp;process&nbsp;of&nbsp;purchasing&nbsp;a&nbsp;secure&nbsp;certif&nbsp;<BR>icate,&nbsp;you'll&nbsp;be&nbsp;able&nbsp;to&nbsp;use&nbsp;the&nbsp;--with-crt&nbsp;and&nbsp;--with-key&nbsp;lines&nbsp;above&nbsp;to&nbsp;te&nbsp;<BR>ll&nbsp;SSL&nbsp;to&nbsp;use&nbsp;those&nbsp;certificates.&nbsp;<BR>If&nbsp;you&nbsp;don't&nbsp;have&nbsp;a&nbsp;certificate,&nbsp;skip&nbsp;those&nbsp;two&nbsp;lines,&nbsp;and&nbsp;add&nbsp;a&nbsp;make&nbsp;certif&nbsp;<BR>icate&nbsp;between&nbsp;the&nbsp;make&nbsp;and&nbsp;the&nbsp;make&nbsp;install&nbsp;at&nbsp;the&nbsp;end&nbsp;of&nbsp;the&nbsp;process.&nbsp;This&nbsp;&nbsp;<BR>will&nbsp;generate&nbsp;a&nbsp;test&nbsp;certificate&nbsp;for&nbsp;you&nbsp;to&nbsp;use&nbsp;while&nbsp;you're&nbsp;waiting&nbsp;for&nbsp;the&nbsp;<BR>&nbsp;real&nbsp;one&nbsp;to&nbsp;arrive.&nbsp;<BR>Configuration&nbsp;<BR>The&nbsp;above&nbsp;process&nbsp;added&nbsp;a&nbsp;large&nbsp;number&nbsp;of&nbsp;directives&nbsp;to&nbsp;your&nbsp;configuration&nbsp;f&nbsp;<BR>ile.&nbsp;You&nbsp;should&nbsp;look&nbsp;through&nbsp;httpd.conf&nbsp;and&nbsp;see&nbsp;what&nbsp;sorts&nbsp;of&nbsp;new&nbsp;things&nbsp;are&nbsp;<BR>&nbsp;in&nbsp;there.&nbsp;As&nbsp;you&nbsp;learn&nbsp;more&nbsp;about&nbsp;SSL,&nbsp;the&nbsp;things&nbsp;in&nbsp;there&nbsp;will&nbsp;begin&nbsp;to&nbsp;ma&nbsp;<BR>ke&nbsp;more&nbsp;sense.&nbsp;The&nbsp;purpose&nbsp;of&nbsp;this&nbsp;article&nbsp;is&nbsp;to&nbsp;get&nbsp;you&nbsp;running&nbsp;with&nbsp;SSL&nbsp;as&nbsp;<BR>&nbsp;quickly&nbsp;as&nbsp;possible,&nbsp;and&nbsp;so&nbsp;I'm&nbsp;not&nbsp;going&nbsp;to&nbsp;spend&nbsp;a&nbsp;lot&nbsp;of&nbsp;time&nbsp;on&nbsp;configu&nbsp;<BR>ration,&nbsp;except&nbsp;to&nbsp;make&nbsp;the&nbsp;following&nbsp;important&nbsp;point.&nbsp;<BR>SSL&nbsp;and&nbsp;name-based&nbsp;virtual&nbsp;hosts&nbsp;<BR>Because&nbsp;of&nbsp;the&nbsp;way&nbsp;SSL&nbsp;works,&nbsp;you&nbsp;can't&nbsp;use&nbsp;SSL&nbsp;on&nbsp;name-based&nbsp;virtual&nbsp;hosts.&nbsp;<BR>&nbsp;There&nbsp;are&nbsp;no&nbsp;configuration&nbsp;tricks&nbsp;that&nbsp;you&nbsp;can&nbsp;to&nbsp;do&nbsp;make&nbsp;this&nbsp;work.&nbsp;SSL&nbsp;mu&nbsp;<BR>st&nbsp;run&nbsp;on&nbsp;the&nbsp;primary&nbsp;name&nbsp;on&nbsp;the&nbsp;IP&nbsp;address&nbsp;to&nbsp;which&nbsp;it&nbsp;answers.&nbsp;This&nbsp;has&nbsp;t&nbsp;<BR>o&nbsp;do&nbsp;with&nbsp;the&nbsp;order&nbsp;in&nbsp;which&nbsp;things&nbsp;are&nbsp;said&nbsp;in&nbsp;the&nbsp;SSL&nbsp;negotiation&nbsp;conversa&nbsp;<BR>tion&nbsp;--&nbsp;the&nbsp;secure&nbsp;connection&nbsp;is&nbsp;made&nbsp;before&nbsp;the&nbsp;client&nbsp;ever&nbsp;tells&nbsp;the&nbsp;serve&nbsp;<BR>r&nbsp;what&nbsp;document&nbsp;it&nbsp;is&nbsp;looking&nbsp;for,&nbsp;so&nbsp;the&nbsp;virtual&nbsp;host&nbsp;negotiation&nbsp;is&nbsp;too&nbsp;la&nbsp;<BR>te.&nbsp;<BR>So,&nbsp;in&nbsp;order&nbsp;to&nbsp;run&nbsp;SSL&nbsp;on&nbsp;multiple&nbsp;virtual&nbsp;hosts,&nbsp;you'll&nbsp;need&nbsp;to&nbsp;use&nbsp;IP-bas&nbsp;<BR>ed&nbsp;virtual&nbsp;hosts.&nbsp;This&nbsp;is&nbsp;being&nbsp;addressed&nbsp;in&nbsp;upcoming&nbsp;revisions&nbsp;to&nbsp;the&nbsp;SSL&nbsp;p&nbsp;<BR>rotocol,&nbsp;but&nbsp;that&nbsp;could&nbsp;be&nbsp;a&nbsp;while&nbsp;away.&nbsp;<BR>More&nbsp;information&nbsp;<BR>One&nbsp;of&nbsp;the&nbsp;clearest&nbsp;explanations&nbsp;of&nbsp;how&nbsp;mod_ssl&nbsp;works&nbsp;is&nbsp;Ralf&nbsp;Engelschall's&nbsp;&nbsp;<BR>talk&nbsp;from&nbsp;ApacheCon&nbsp;in&nbsp;London.&nbsp;You&nbsp;can&nbsp;see&nbsp;this&nbsp;talk&nbsp;at&nbsp;<A HREF="http://www.modssl.or">http://www.modssl.or</A>&nbsp;<BR>g/docs/apachecon2000/.&nbsp;I&nbsp;was&nbsp;able&nbsp;to&nbsp;attend&nbsp;that&nbsp;talk,&nbsp;and&nbsp;learned&nbsp;a&nbsp;lot&nbsp;of&nbsp;&nbsp;<BR>interesting&nbsp;things.&nbsp;<BR>The&nbsp;talk&nbsp;also&nbsp;has&nbsp;a&nbsp;step-by-step&nbsp;guide&nbsp;for&nbsp;installing&nbsp;mod_ssl.&nbsp;It&nbsp;does&nbsp;thing&nbsp;<BR>s&nbsp;a&nbsp;little&nbsp;differently&nbsp;than&nbsp;I&nbsp;do&nbsp;above,&nbsp;and&nbsp;it&nbsp;might&nbsp;give&nbsp;you&nbsp;some&nbsp;additiona&nbsp;<BR>l&nbsp;insight&nbsp;into&nbsp;what's&nbsp;going&nbsp;on.&nbsp;<BR>Conclusion&nbsp;<BR>The&nbsp;documentation&nbsp;that&nbsp;comes&nbsp;with&nbsp;OpenSSL&nbsp;and&nbsp;mod_ssl&nbsp;is&nbsp;pretty&nbsp;complete.&nbsp;Th&nbsp;<BR>e&nbsp;trick&nbsp;is&nbsp;in&nbsp;knowing&nbsp;that&nbsp;you&nbsp;have&nbsp;to&nbsp;install&nbsp;both&nbsp;in&nbsp;order&nbsp;to&nbsp;make&nbsp;things&nbsp;&nbsp;<BR>work.&nbsp;Reading&nbsp;the&nbsp;docs&nbsp;for&nbsp;both&nbsp;will&nbsp;teach&nbsp;you&nbsp;a&nbsp;lot&nbsp;about&nbsp;how&nbsp;the&nbsp;technolog&nbsp;<BR>ies&nbsp;work,&nbsp;as&nbsp;well&nbsp;as&nbsp;how&nbsp;to&nbsp;get&nbsp;them&nbsp;working.&nbsp;<BR>&nbsp;<BR>&nbsp;<BR>--&nbsp;<BR>&nbsp;<BR>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;影子与尘土&nbsp;<BR>&nbsp;<BR>&nbsp;<BR>※&nbsp;来源:·BBS&nbsp;水木清华站&nbsp;smth.org·[FROM:&nbsp;166.111.168.2]&nbsp;<BR><CENTER><H1>BBS水木清华站∶精华区</H1></CENTER></BODY></HTML>
⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -