Page History

...

• In /etc/httpd/conf.d/ssl.conf, set the SSLRandomSeed options:

  No Format
  SSLRandomSeed startup file:/dev/urandom 1024 SSLRandomSeed connect file:/dev/urandom 1024

  within the VirtualHost block, set the ServerName:

  No Format
  ServerName idp.mit.edu:443

  set the SSL cipher suite:

  No Format
  SSLCipherSuite HIGH:MEDIUM:EXP:!aNULL:!SSLv2:+SHA1:+MD5:+HIGH:+MEDIUM:+EXP

  Install the server certificate, key, and CA files in /etc/pki/tls/certs/ and /etc/pki/tls/private/, as appropriate, and set the paths in ssl.conf:

  No Format
  SSLCertificateFile /etc/pki/tls/certs/idp-staging.mit.edu-cert.pem SSLCertificateKeyFile /etc/pki/tls/private/idp-staging.mit.edu-key.pem SSLCertificateChainFile /etc/pki/tls/certs/EquifaxCA.pem SSLCACertificateFile /etc/pki/tls/certs/mitCAclient.pem

  set the SSL options:

  No Format
  SSLOptions +StrictRequire

  configure custom logging:

  No Format
  CustomLog logs/ssl_request_log \ "%t %h %{HTTPS}x %{SSL_PROTOCOL}x %{SSL_CIPHER}x %{SSL_CIPHER_USEKEYSIZE}x %{SSL_CLIENT_VERIFY}x \"%r\" %b"

  ensure that all access is via SSL:

  No Format
  <Directory /> SSLRequireSSL </Directory>

  ensure that all rewrite rules are inherited:

  No Format
  RewriteEngine On RewriteOptions inherit

• Install an HTTP keytab in /etc/httpd/conf/keytab; it must be readable by (only) the apache user. This is used for authentication by HTTP/SPNEGO, as configured in /etc/httpd/conf.d/auth_kerb.conf; install this .conf file from the touchstone locker, /mit/touchstone/config/idp2-core/auth_kerb.con.
• Install cert-authn.conf from the touchstone locker (XXX), which sets up the separate virtual hosts for certificate authentication on ports 446 and 447 (for certificate optional and required, respectively). SELinux context mappings must be added for these ports, so that httpd can use them, e.g.:

  No Format
  # semanage port -a -t http_port_t -p tcp 446 # semanage port -a -t http_port_t -p tcp 447 XXX # semanage port -a -t http_port_t -p tcp 8444

• Disable the stock "Welcome" page, by commenting out the lines in /etc/httpd/conf.d/welcome.conf
• Install our standard robots.txt and favicon.ico files in /var/www/html. The robots.txt should disallow all access:

  No Format
  User-agent: * Disallow: /

  Current versions of these files may be found in the touchstone locker, in /mit/touchstone/config/htdocs/.
• Make sure httpd is started at boot time:

  No Format
  # chkconfig httpd on

...

• Download current Tomcat 6.0 binary distribution (tested with 6.0.20, available in /mit/touchstone/downloads/apache-tomcat-6.0.20.tar.gz, and install under /usr/local:

  No Format
  # cd /usr/local # tar xzf /path/to/apache-tomcat-6.0.20.tar.gz # rm -f tomcat # ln -s apache-tomcat-6.0.20.tar.gz tomcat

• Create the tomcat user, and change the ownership of the tomcat tree:

  No Format
  # groupadd -g 52 tomcat # useradd -u 52 -g tomcat -c "Tomcat User" -d /usr/local/tomcat tomcat # chown -R tomcat:tomcat /usr/local/apache-tomcat-6.0.20

• XXX Configure server.xml!!Install our version of conf/server.xml (from /mit/touchstone/config/idp2-core/tomcat), which properly configures the AJP connector on port 8009, and disables the HTTP connector on port 8080.

• Install the tomcat init script in /etc/init.d/, and make sure tomcat is started at boot time:

  No Format
  # chkconfig --add tomcat

...