Regenerating Apache SSL certificate for 10 years

I noticed the SSL certificate I had previously generated for Apache had expired, so I set about generating a new one. This time I wanted to generate a really long-lived (10 year) certificate so I didn't have to deal with this again in a year.

I started by cleaning out the old certificate (you'll get an error later if you don't do this):

# rm /etc/apache2/ssl/*

Now I edited the Openssl configuration file to bump the lifetime to 10 years (3650 days):

# cp /usr/share/ssl-cert/ssleay.cnf /usr/share/ssl-cert/ssleay.cnf.orig
# vi /usr/share/ssl-cert/ssleay.cnf
# diff -c /usr/share/ssl-cert/ssleay.cnf /usr/share/ssl-cert/ssleay.cnf.orig
*** /usr/share/ssl-cert/ssleay.cnf 2009-01-31 13:37:24.000000000 -0600
--- /usr/share/ssl-cert/ssleay.cnf.orig 2009-01-31 13:36:58.000000000 -0600
***************
*** 7,13 ****
[ req ]
default_bits = 1024
default_keyfile = privkey.pem
- default_days = 3650
distinguished_name = req_distinguished_name
prompt = no
policy = policy_anything
--- 7,12 ----

Now I went ahead and generated the new certificate. The hostname was already filled in, so I just had to hit return at the only prompt.

# make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/apache2/ssl/apache.pem

Finally I took a peak at the generated certificate to make sure it had the 10 year lifetime. Looking at the "Not Before" and "Not After" fields in the output below shows the lifetime.

# openssl x509 -noout -text -in /etc/apache2/ssl/apache.pem
Certificate:
Data:
Version: 1 (0x0)
Serial Number:
9e:cd:82:bd:cb:03:19:d7
Signature Algorithm: sha1WithRSAEncryption
Issuer: CN=your.hostname.here
Validity
Not Before: Jan 31 19:37:42 2009 GMT
Not After : Jan 29 19:37:42 2019 GMT
Subject: CN=your.hostname.here
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public Key: (1024 bit)
Modulus (1024 bit):
00:c5:5a:c0:c9:d0:d8:e7:d9:69:ac:04:74:13:4f:
62:d5:7d:70:4f:47:60:a1:42:d7:26:6f:e1:ff:11:
fc:94:e7:70:6c:48:b7:46:87:62:14:81:91:59:f2:
43:d0:1c:76:5f:27:47:6a:f0:d6:e3:8d:2b:5f:9c:
53:56:12:56:cc:a4:0e:62:2c:a5:16:0a:e6:72:11:
a2:ea:89:a1:3c:82:9d:02:d8:01:4a:e3:25:b7:5f:
47:4b:bc:7a:98:ba:57:f0:15:17:74:fd:e5:8d:6a:
fd:cc:37:b2:a0:08:e8:a9:35:9b:2a:1a:9e:75:b1:
7d:dd:69:a4:ca:87:a4:ac:33
Exponent: 65537 (0x10001)
Signature Algorithm: sha1WithRSAEncryption
1a:e9:96:fb:02:c5:86:fa:4d:3b:84:3e:fb:88:b9:db:00:fe:
a7:89:15:bb:a0:af:72:13:2f:d3:0e:a5:ff:59:00:cb:ca:67:
e6:6e:3c:24:92:9b:0d:2d:d5:46:77:7d:a3:7f:68:b3:7d:d7:
38:09:bb:48:e9:96:17:ba:02:e4:59:48:06:66:9a:ee:9b:bc:
64:6e:c9:ea:da:57:18:f7:bb:21:b1:61:38:1a:3a:31:4c:0f:
f0:b5:6c:05:8f:4b:30:76:bb:68:b0:f2:a7:8e:ae:07:c5:7e:
16:f5:86:78:4f:2a:b0:b7:fe:21:be:a9:79:ee:89:6d:07:4a:
68:a9

Creating ssh-only account

I wanted to create some accounts that could only be accessed via ssh key authentication. These would be accessed via cron jobs on another system for backing things up. Here's my process.

On the target host, create the account:

# useradd -m web-server-backup

You can verify this account has no password by the prescence of the "!" in the second field in /etc/shadow:

# grep web-server-backup /etc/shadow
web-server-backup:!:14171:0:99999:7:::

Now, back on the system that will be accessing the account, create a ssh key pair. Since this will be running unattended from cron, I will leave the password empty (i.e. just hit return):

# ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/root/.ssh/id_rsa):
Created directory '/root/.ssh'.
Enter passphrase (empty for no passphrase): just hit return
Enter same passphrase again: just hit return
Your identification has been saved in /root/.ssh/id_rsa.
Your public key has been saved in /root/.ssh/id_rsa.pub.
The key fingerprint is:
d3:ac:99:5f:9c:30:69:98:ad:ab:e9:e5:ef:34:38:bf root@web-server

Copy the public key you just created into your clipboard:

# cat ~/.ssh/id_rsa.pub
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArh6BSw0F1Li/Oh1GbqF6uTv34P4e0Ow7NMco962aHe070vGjlyqIE3CrOU9d3/ztoL7QgalegWj7WfWQ44I8Jz0WGTzLcssYhvluaHzBp5z8QKVvmSpj39f43kAYP0b2GdUwGZL9AER72MRZSxmaybzGoVK12bPr6t18gaAWl9c3b1Ng8MFbp7vvNptfb6NwikfOaL4vTqRfNuVWv6vxaw3xfE+8iuI8ubckUCqrNfayVmfgCmxNS5o9GauHSAZdXhH1xDkZ0ikjo4SAjYz83/eyNdrwef6GTQj+FXwsaiGSpz9B0IOWt613+MhI/uoXRTO2jNzJstBcQa19GbX0Hw== root@web-server

Now on the target account, create ~/.ssh:and copy the public key into ~/.ssh/authorized_keys:

# sudo -u web-server-backup -i
$ mkdir ~/.ssh
$ chmod 700 ~/.ssh
$ cat > ~/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEArh6BSw0F1Li/Oh1GbqF6uTv34P4e0Ow7NMco962aHe070vGjlyqIE3CrOU9d3/ztoL7QgalegWj7WfWQ44I8Jz0WGTzLcssYhvluaHzBp5z8QKVvmSpj39f43kAYP0b2GdUwGZL9AER72MRZSxmaybzGoVK12bPr6t18gaAWl9c3b1Ng8MFbp7vvNptfb6NwikfOaL4vTqRfNuVWv6vxaw3xfE+8iuI8ubckUCqrNfayVmfgCmxNS5o9GauHSAZdXhH1xDkZ0ikjo4SAjYz83/eyNdrwef6GTQj+FXwsaiGSpz9B0IOWt613+MhI/uoXRTO2jNzJstBcQa19GbX0Hw== root@web-server
$ chmod 600 ~/.ssh/authorized_keys

Now back on the accessing account, you should be able to access the target account without a password. The first time you do this you will be prompted to trust the host key of the target system, so you should do this once to make this process without prompt.

# ssh -l web-server-backup file-server date
The authenticity of host 'file-server (192.168.1.12)' can't be established.
RSA key fingerprint is 4c:7a:f0:ba:0f:60:45:4b:b8:f1:cc:17:88:59:74:f0.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'file-server,192.168.1.12' (RSA) to the list of known hosts.
Sun Oct 19 13:06:52 CDT 2008

Now it should work seamlessly:

# ssh -l web-server-backup file-server date
Sun Oct 19 13:08:19 CDT 2008

Locking, but not expiring, root

I don't want to allow direct root login (not just via ssh as described here but via console or any other way. Basically I want to make it so everything has to go through sudo. (Why? Because I like the fact everything is traceable back to given user.)

I had previously tried using 'passwd -l' as root to lock that account, but that seems to have the unwanted side effect of causing root's cron jobs to fail, as I see the following message in syslog whenever a roon cron job comes time to run:

CRON[11591]: User account has expired

The solution I found is as follows. Before you do this you want to make sure you have the ability to do things as root via sudo, or you will lock yourself out (see here for directions on this).

First, I undid what I did before and unlock the account (skip this if you didn't previously lock the root account):

# passwd -u root
Password changed.

Then edit /etc/shadow by hand and change root's password field to "!", e.g.:

# grep root /etc/shadow
root:!:14145:0:99999:7::1:

Just to make sure test the setup by running 'ssh -l root localhost' and try logging in. You shouldn't be able to.

Changing the mythweb password

The Mythbuntu installation of mythweb uses htdigest instead of htpassword, with a domain of "MythTV":

# htdigest /etc/mythtv/mythweb-digest MythTV mythtv
Adding user mythtv in realm MythTV
New password:
Re-type new password:

Testing web server with nikto

I wanted to give my web server a quick test for any major security problems. nikto was recommended to me as a good way to do that. I downloaded and installed (unpacked really) it:

# cd /tmp
# wget http://www.cirt.net/nikto/nikto-current.tar.gz
# tar xvfz nikto-current.tar.gz
# mv nikto /usr/local/nikto-2.03

And then I ran it against my webserver. Seems like a number of software packages are out of date, but are the freshest in the Ubuntu repositories. All together, nothing I'm concerned about.

# /usr/local/nikto-2.03/nikto.pl -h web-server
- Nikto v2.03/2.04
---------------------------------------------------------------------------
+ Target IP: 192.168.1.11
+ Target Hostname: web-server
+ Target Port: 80
+ Start Time: 2008-09-15 16:58:59
---------------------------------------------------------------------------
+ Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.3 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g
- Root page / redirects to: /wiki/
+ Apache/2.2.8 appears to be outdated (current is at least Apache/2.2.9). Apache 1.3.39 and 2.0.61 are also current.
+ PHP/5.2.4-2ubuntu5.3 appears to be outdated (current is at least 5.2.6RC4)
+ mod_ssl/2.2.8 appears to be outdated (current is at least 2.8.31) (may depend on server version)
+ mod_ssl/2.2.8 OpenSSL/0.9.8g - mod_ssl 2.8.7 and lower are vulnerable to a remote buffer overflow which may allow a remote shell (difficult to exploit). http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0082.
+ OSVDB-3268: GET /icons/ : Directory indexing is enabled: /icons
+ OSVDB-3233: GET /icons/README : Apache default file found.
+ 3577 items checked: 6 item(s) reported on remote host
+ End Time: 2008-09-15 17:00:48 (109 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

Test Options: -h web-server
---------------------------------------------------------------------------

Locking down the web server

My next step was to lock down the web server to prevent any anonymous access.

First was to tweak /etc/apache2/apache2.conf (see this previous post for more information:

<Directory /var/www/>
AuthType Basic
AuthName "Casey Web"
AuthUserFile /etc/apache2/basicauth
Require valid-user
</Directory>

Second, I tweaked mediawiki to not allow anonymous access to any page by editing /var/lib/mediawiki1.7/LocalSettings.php. I changed the following line:

$wgWhitelistRead = array ("Main Page", "Special:Userlogin", "Wikipedia:Help");

to:

$wgWhitelistRead = array ("Special:Userlogin");

Adding SSL support to Apache2

I wanted to increase security and add https support to my Apache2 install. Poking around I found directions here. Which I basically followed:

# apt-get install ssl-cert
# mkdir /etc/apache2/ssl
# make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/apache2/ssl/apache.pem
# a2enmod ssl
# cp /etc/apache2/sites-available/default /etc/apache2/sites-available/ssl
# vi /etc/apache2/sites-available/ssl
# diff /etc/apache2/sites-available/default /etc/apache2/sites-available/ssl

1,2c1,2
< NameVirtualHost *
< <VirtualHost *>
---
> NameVirtualHost *:443
> <VirtualHost *:443>
4a5,7
>       SSLEngine On
>       SSLCertificateFile /etc/apache2/ssl/apache.pem
>

# a2ensite ssl
# /etc/init.d/apache2 reload
# cp /etc/apache2/sites-available/default /etc/apache2/sites-available/default.orig
# vi /etc/apache2/sites-available/default
# diff /etc/apache2/sites-available/default.orig /etc/apache2/sites-available/default

1,2c1,2
< NameVirtualHost *
< <VirtualHost *>
---
> NameVirtualHost *:80
> <VirtualHost *:80>

But then I ran into this problem:
# /etc/init.d/apache2 start

* Starting web server (apache2)...
[Sat Aug 09 17:28:50 2008] [warn] The Alias directive in /etc/apache2/sites-enabled/001-mediawiki at line 1 will probably never match because it overlaps an earlier Alias.
(98)Address already in use: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
...fail!

Which I fixed by commenting out the Listen directive in ports.conf:
# vi /etc/apache2/ports.conf
# cat /etc/apache2/ports.conf

#Listen 80

That got things working.

While I was playing with Apache configuration, I went ahead and fixed a warning about a undefined server name:

# vi /etc/apache2/apache2.conf
# grep ServerName /etc/apache2/apache2.conf
ServerName casey.vwelch.com

Securing MythWeb

Ok, in my last post I set up MythWeb. Now to lock it down so that it's not publicly accessible. I basically followed the directions at the KnoppMythWiki, with a couple of twists:

1. I'm running Apache2
2. I only locked down MythWeb and not my whole web space.
   

First I edited /etc/apache2/apache2.conf and added the following (I did it right before UseCanonicalName Off but I don't think it matters):

<Directory /var/www/mythweb>
       AuthType Basic
       AuthName "BasicAuth"
       AuthUserFile /etc/apache2/basicauth
       Require valid-user
</Directory>

Then I created /etc/apache2/basicauth with a mythtv user, setting the password in the process:

# htpasswd -c /etc/apache2/basicauth mythtv

Then I restarted apache and all was good:

# /etc/init.d/apache2 restart