Cutter's Crossing - Apache

Local Development Setup Pt 4: ColdFusion + Apache + SSL

Tue, 24 Jul 2007 11:44:00 -0400

In previous posts we setup ColdFusion on Apache, created multiple ColdFusion instances, and created Virtual Directories to remote, UNC pathed resources. What's left? Well, what if you need to test SSL secure pages? Perhaps you have areas of your sites that need to have secure encryption, where you're harvesting personal information from your users. No one feels comfortable submitting personal information online if they don't see that little lock in the bottom of their browser. You, as a developer, want to be able to code this functionality, without the need to test it in your production environment. With a little work, setting up a secure site within Apache is relatively simple. You already completed your first step when you installed ColdFusion and Apache, because the Apache version you installed was precompiled for SSL. With a few more steps you'll be on your way. Download the openssl.cnf.txt file from the Download link below, and place the file in your Apache bin directory (C:\Program Files\Apache Group\Apache2\bin). Then, rename the file, removing the .txt extension. After you've done this, you may not see the remaining .cnf extension in your file browser, and it may say that it's a SpeedDial file type. That's OK, it's supposed to look that way. The next thing you need to do is copy the ssleay32.dll and lebeay32.dll files from your bin folder into your Windows\System32 folder. Make sure you copy the .dll files and not the .lib files. Now you're ready to create your personal security certificates. Open a command prompt and navigate to your bin folder. Once there you can begin to use the openssl executable to create your certs. You will need one for each secure site you configure. Here we'll create one for secure.companyname.loc, by executing the following commands in your console.


openssl req -config openssl.cnf -new -out secure.csr

The .csr file can have any name, but I've named it like this so I know that it's associated with my 'secure' domain. Note that you must create a certificate for each fully qualified domain name that you wish to be secure. The web browser will scream if the domain names don't match exactly. Here is a step by step of what you should see, with my responses bracketed by percentage signs.


Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
........++++++
.......++++++
writing new private key to 'privkey.pem'
Enter PEM pass phrase: %my-made-up-pass%
Verifying - Enter PEM pass phrase: %my-made-up-pass%
-----
You are about to be asked to enter information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) []:%US%
State or Province Name (full name) []:%mystate%
Locality Name (eg, city) []:%mycity%
Organization Name (eg, company) []:%companyname%
Organizational Unit Name (eg, section) []:%mydept%
Common Name (eg, your websites domain name) []:%secure.companyname.loc%
Email Address []:%username@companyname.com%

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:%my-made-up-pass%

This will create the .csr file. Now, on to the next step, the private key file.


openssl rsa -in privkey.pem -out secure.key
Enter pass phrase for privkey.pem:%my-made-up-pass%
writing RSA key

Ok, now that we have a private key all that's left is to get a certificate.


openssl x509 -in secure.csr -out secure.cert -req -signkey secure.key -days 365
Loading 'screen' into random state - done
Signature OK
subject=/C=US/ST=mystate/L=mycity/O=companyname/OU=mydept/CN=secure.companyname.loc/emailAddress=username@companyname.com
Getting Private key

Alright, now you have your certificate for your 'secure' domain. Create, within your Apache conf folder, two new folders ssl.cert and ssl.key, and move your secure.cert and secure.key files into their respective folders. You may also delete the .rnd file from your Apache bin folder. This file contains entropy information for creating the key and could be used for cryptographic attacks against your private key. Although this isn't likely within your local development environment, it is still good practice. As this is for your local environment, this is a simple way of creating a self-signed certificate for development use. All you have to do is install the certificate in your browser the first time you come to a secure page. Also note that this certificate expires after a year, and you can increase the -days 365 if you want. Now we start getting into actually configuring your server for your SSL connection. First you will want to remove the comment hash (#) from the LoadModule line for ssl_module modules/mod_ssl.so. This is generally the last line of the LoadModule descriptors in your httpd.conf file.


# SGB: [072408]: Enabling SSL
LoadModule ssl_module modules/mod_ssl.so

Next you'll find the IfModule block below:



	Include conf/ssl.conf

And add a few necessary lines:



	Include conf/ssl.conf

# SGB [072408]: Some added config for our SSL
SSLMutex default
SSLRandomSeed startup builtin
SSLSessionCache none
ErrorLog logs/ssl.log
LogLevel info

It is very important that you move this descriptor block below the JRun Settings descriptor block. When you define which instance serves your secure pages you want it to know the JRun is needed. The next step took a great deal of trial and error to get straight. First, make a backup copy of the ssl.conf file. Then, within the original file, we're going to make several changes. First, comment (with a hash sign [#]) the opening and closing IfDefine tags near the top and very bottom of the file.


# SGB [072408]: Removed for proper load
#
	....
# SGB [072408]: Removed for proper load
#

And, set it up for NameVirtualHost, just as you did within your httpd.conf, but with the correct port for SSL.


# SGB [072408]: Enable NameVirtualHost configurations on SSL
NameVirtualHost 127.0.0.1:443

Next, remove the entire VirtualHost block from the file. This is loaded with lines and lines of comments, is already in your backup file for later reference, and only confuses what is needed (and caused me errors somewhere anyway). We'll setup a 'secure' VirtualHost entry for your secure domain, using the certificate and key you created before.


# SGB [072408]: 'secure' SSL domain setup directive

	DocumentRoot "C:\Documents and Settings\username\My Documents\wwwroot\siteroot"
	ServerName secure.companyname.loc
	ServerAdmin username@companyname.com
	ErrorLog logs/secure-ssl-error.log
	TransferLog logs/secure-ssl-access.log
	SSLEngine On
	SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
	SSLCertificateFile conf/ssl.cert/secure.cert
	SSLCertificateKeyFile conf/ssl.key/secure.key
	
		SSLOptions +StdEnvVars
	
	
		SSLOptions +StdEnvVars
	
	SetEnvIf User-Agent ".*MSIE.*" \
			 nokeepalive ssl-unclean-shutdown \
			 downgrade-1.0 force-response-1.0
	CustomLog logs/ssl_request_log \
			  "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

OK, what's left? Oh yeah! We need a ColdFusion instance to associate it with (in this case the 'sites' instance). And, we'll probably need those Aliases too. Easy enough. Just add your Include statements.


# SGB [072408]: 'secure' SSL domain setup directive

	DocumentRoot "C:\Documents and Settings\username\My Documents\wwwroot\siteroot"
	ServerName secure.companyname.loc
	ServerAdmin username@companyname.com
	ErrorLog logs/secure-ssl-error.log
	TransferLog logs/secure-ssl-access.log
	SSLEngine On
	SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
	SSLCertificateFile conf/ssl.cert/secure.cert
	SSLCertificateKeyFile conf/ssl.key/secure.key
	
		SSLOptions +StdEnvVars
	
	
		SSLOptions +StdEnvVars
	
	SetEnvIf User-Agent ".*MSIE.*" \
			 nokeepalive ssl-unclean-shutdown \
			 downgrade-1.0 force-response-1.0
	CustomLog logs/ssl_request_log \
			  "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
	Include conf/cf_sitesinstance.conf
	Include conf/site_aliases.conf

That's it! Restart your Apache server and go to https://secure.companyname.loc (make sure your put a test 'index.cfm' in there). First you will be asked to accept the development certificate that you created, and then you should see your test message display, with the little lock down in the corner. And that is how to configure ColdFusion (7 or 8) on top of Apache, in a multi-instance configuration, with virtual, UNC pathed directories, SSL support, and access to your instance administrators. Verify your instance settings, setup your Data Sources, fire-up CFEclipse, checkout from the Subversion repository, and get to writin' some code!

Resources:

And a hellavalotta trial and error. No one, single post answered every issue (some didn't even answer one issue by itself), and so...here it is.

Local Development Setup Pt 3: Virtual Directories in Apache

Mon, 23 Jul 2007 08:02:00 -0400

In a previous post we touched upon the Alias statement in your VirtualHost directives. An Alias is a way of defining a virtual directory for your site. This is a pretty common practice in the web world. Your site code may be stored in your site's root (wwwroot) folder, but you may want to store your assets (images, video, stylesheets, etc.) outside your webroot. You might even want to store them on another server altogether. You'll want to access these items as if they're part of your site, like http://username.companyname.loc/Images/mypic.jpg or http://username.companyname.loc/Media/myvideo.flv. Defining an Alias is easy, when dealing with your local file system. An Alias that points to a UNC path, in Windows, is another story. You have to use a UNC path because Apache will not allow you to utilize a mapped drive (it'll crash Apache, at least under 2.0). What took me a while to figure out was that you can not use Apache to control the directory access (as in permissions), you must do this through the user account access. You can not use the Directory Apache directives for access control. This also means that your Apache instance must run as the user who has access to the remote resource (I also setup CF instance to run as the same user). I also discovered something else the hard way, Apache Aliases are case-specific. This means that you have to use double Aliases for each virtual directory that you define via an Alias. Remember, this is Windows, so code can go either way. You'll want to plan for either eventuality. In our last post we defined a 'sites' instance, for the display of a mythical, templated application system. So, imagine that each site of that system would require it's own VirtualHost directive. Each one, though, would also be using shared media resources from the same location outside the webroot, like on a media server. For this, you can create another include in your Apache conf folder - site_aliases.conf, within which you could singularly define your remote virtual directories:


Alias /Images/ //remote-serv1/Inetpub/wwwroot/Images/

Alias /images/ //remote-serv1/Inetpub/wwwroot/Images/

Alias /Video/ //remote-serv1/Inetpub/wwwroot/Video/

Alias /video/ //remote-serv1/Inetpub/wwwroot/Video/

Alias /Styles/ //remote-serv1/Inetpub/wwwroot/Styles/

Alias /styles/ //remote-serv1/Inetpub/wwwroot/Styles/

Alias /SiteSpecific/ //remote-serv1/Inetpub/wwwroot/SiteSpecific/

Alias /sitespecific/ //remote-serv1/Inetpub/wwwroot/SiteSpecific/

Once you've defined these remote shared resources, you can then Include them in your site definitions in your VirtualHost directives:



	ServerAdmin username@companyname.com
	# Root folder for thisdomain.com, in the 'sites' instance
	DocumentRoot "C:\Documents and Settings\username\My Documents\wwwroot\siteroot"
	ServerName *.thisdomain.loc
	# SGB [072007]: shared Alias Include
	Include conf/site_aliases.conf
	ErrorLog logs/thisdomain.loc-error.log
	CustomLog logs/thisdomain.loc-access.log common
	# SGB [072007]: Add include for the 'sites' ColdFusion instance
	Include conf/cf_sitesinstance.conf

Once you've restarted your Apache instance you will be able to access these resources as part of the domain.

Local Development Setup Pt 2: Multiple ColdFusion Instances

Mon, 23 Jul 2007 08:01:00 -0400

Our last post discussed installing Apache and ColdFusion, as well as configuring your default instance for Apache access. Now it's time to create additional ColdFusion instances. By default, ColdFusion (or, more appropriately, JRun) is only configured to utilize 512MB of RAM per instance, and is only capable of accessing 1024MB. This is due to a limitation of 32bit JVMs, and will someday be formerly addressed by Adobe. But that doesn't mean that you are necessarily restricted to only using 1GB of RAM for ColdFusion. You may define multiple instances of the server, each of which will address it's own memory space, it's own instance of the JVM, and it's own instance of ColdFusion (and JRun). Not only does this allow you to utilize more of the memory available to you today, in our high powered systems, but it will also sandbox applications that are separated into their own instances. For instance: Let's say you have a dynamic template application. One that reads the requested URL and supplies customized content dependent upon the site identified. Any number of sites could be configured in a database, rendered by the same code, off of a single instance of ColdFusion (or a clustered set of instances, maybe). You could have a 'sites' instance of ColdFusion that served this content. Now, the same set of sites might require a backend administrator, or content management system, for the configuration of those sites. You might set this up on a single domain name, with users logging in to their specific set of tools and data. It would be it's own application, with dynamic options and data according to the user logging in. This might be placed in another 'control' instance of ColdFusion. Setting up additional instances of ColdFusion is easy, but requires a small bit of manual effort when working with Apache. First of all, the connectors for JRun and Apache are not completed automatic, so you need to setup a few folders on the file system. Find the root directory for JRun. The default location is C:\JRun4. You are creating folder for the connectors, which will be located in the {JRun Root}\lib\wsconfig. Notice that there is already a subdirectory titled 1. This is the connector for your default ColdFusion instance. You'll want to create an empty subdirectory for each instance you setup, named exactly as you will name your instances. According to the above example, you want to create a 'sites' directory, and a 'control' directory. Your next step requires logging into the ColdFusion Administrator of your default ColdFusion instance. In our last post we setup a url for accessing this, http://username.companyname.loc/CFIDE/Administrator. Once you've logged in, in the default instance (and only the default instance) you will see an option at the bottom of the menu for Enterprise Manager. You'll want to select this, and it's sub-item, Instance Manager. Here you will see a samples instance that is already defined, though disabled. This is the instance for running the sample applications that ship with ColdFusion. To create a new instance you simply select Add New Instance. This will bring up the new instance dialog. In the server name type 'sites' (exactly as you named the folder, including case) and select the Create Windows Service option, then hit Submit. That's it! ColdFusion automatically goes through a four step process to create your new instance, giving you status updates along the way. Once it's complete, go back to the Instance Manager and do the same thing for your 'control' instance. OK, so you have new instances, but Apache still can't talk to them yet. We need to do a little more work on the Apache config before we can really start to play. The first thing you'll need to do here is locate the JRun Settings block in your httpd.conf. It'll look very similar to this:


# JRun Settings
LoadModule jrun_module "C:/JRun4/lib/wsconfig/1/mod_jrun20.so"

	JRunConfig Verbose false
	JRunConfig Apialloc false
	JRunConfig Ssl false
	JRunConfig Ignoresuffixmap false
	JRunConfig Serverstore "C:/JRun4/lib/wsconfig/1/jrunserver.store"
	JRunConfig Bootstrap 127.0.0.1:51000
	#JRunConfig Errorurl 
	#JRunConfig ProxyRetryInterval 
	#JRunConfig ConnectTimeout 15
	#JRunConfig RecvTimeout 300
	#JRunConfig SendTimeout 15
	AddHandler jrun-handler .jsp .jws .cfm .cfml .cfc .cfr .cfswf

Alright, some major points to notice here. Two big lines to look at for multiserver configuration stuff, the Serverstore and the Bootstrap. These will be different for each instance of ColdFusion. You probably already recognize most of the path in the Serverstore value. The 'control' and 'sites' instance folders that you had created will replace the 1 in your new definitions. The Bootstrap value comes from each instance's port setting in it's JRunProxyService. To get this value, go to that instance's jrun.xml file, located at C:\JRun4\servers\[instance name]\SERVER-INF\jrun.xml. Open this file and find the following service definition block:



	25
	500
	false
	*
	1000
	1
	51002
	....

Two things you need here. First, make sure that the deactivated attribute is set to false. Next, write down the port value. So, if you are in the jrun.xml of your 'control' instance, and the port is '51020', then write that down (control: 51020) and do the same for your 'sites' instance. Also remember that you will need to restart these instances after changing the deactivated attribute. Next, let's break out the default ColdFusion instance specific information and place it inside it's own include config file. In your Apache conf directory, create a new file - cf_defaultinstance.conf. In this file we'll place those settings we want for our default instance:



	JRunConfig Verbose false
	JRunConfig Ignoresuffixmap false
	JRunConfig Serverstore "C:/JRun4/lib/wsconfig/1/jrunserver.store"
	JRunConfig Bootstrap 127.0.0.1:51000

With these settings now within their own include, we can now remove them from the httpd.conf file:


# JRun Settings
LoadModule jrun_module "C:/JRun4/lib/wsconfig/1/mod_jrun20.so"

	JRunConfig Verbose false
	JRunConfig Apialloc false
	JRunConfig Ssl false
	JRunConfig Ignoresuffixmap false
	#JRunConfig Serverstore "C:/JRun4/lib/wsconfig/1/jrunserver.store"
	#JRunConfig Bootstrap 127.0.0.1:51000
	#JRunConfig Errorurl 
	#JRunConfig ProxyRetryInterval 
	#JRunConfig ConnectTimeout 15
	#JRunConfig RecvTimeout 300
	#JRunConfig SendTimeout 15
	AddHandler jrun-handler .jsp .jws .cfm .cfml .cfc .cfr .cfswf

Notice that I just commented them out. You can remove the entirely if you like, but I'm gonna leave it. Next I'm going to adjust my VirtualHost for my default instance administrator access:


#
# Use name-based virtual hosting.
#
NameVirtualHost 127.0.0.1:80

	....


	ServerAdmin username@companyname.com
	# Root folder for my scratchpad stuff
	DocumentRoot "C:\Documents and Settings\username\My Documents\wwwroot"
	ServerName username.companyname.loc
	# Alias for /CFIDE, which the CF install placed in my Apache webroot.
	# This is solely for our dev environment, and would not be a good practice
	# within a production environment
	Alias /CFIDE "C:/Program Files/Apache Group/Apache2/htdocs/CFIDE"
	
		AllowOverride All
		Order allow,deny
		Allow from all
	
	ErrorLog logs/username.companyname.loc-error.log
	CustomLog logs/username.companyname.loc-access.log common
	# SGB [072007]: Add include for default ColdFusion instance
	Include conf/cf_defaultinstance.conf

Now username.companyname.loc is setup to use the default ColdFusion instance. Next, setup an include for your 'control' instance. In Apache's conf directory, create another config file - cf_controlinstance.conf. Remember those port numbers you wrote down from the jrun.xml files? It's in the Bootstrap:



	JRunConfig Verbose false
	JRunConfig Ignoresuffixmap false
	JRunConfig Serverstore "C:/JRun4/lib/wsconfig/control/jrunserver.store"
	JRunConfig Bootstrap 127.0.0.1:51020

Then you could define a special domain for accessing the 'control' instance's ColdFusion Administrator, by adding another VirtualHost directive to the Apache config:



	ServerAdmin username@companyname.com
	# Root folder for a 'control' instance
	DocumentRoot "C:\Documents and Settings\username\My Documents\wwwroot\admin"
	ServerName control.companyname.loc
	# Alias for /CFIDE, each CF instance has it's own CFIDE.
	# This is solely for our dev environment, and would not be a good practice
	# within a production environment
	Alias /CFIDE "C:/JRun4/servers/control/cfusion.ear/cfusion.war/CFIDE"
	
		AllowOverride All
		Order allow,deny
		Allow from all
	
	ErrorLog logs/control.companyname.loc-error.log
	CustomLog logs/control.companyname.loc-access.log common
	# SGB [072007]: Add include for the 'control' ColdFusion instance
	Include conf/cf_controlinstance.conf

Notice the different path for the CFIDE folder. Each created instance will have a unique CFIDE. Also notice that I changed the DocumentRoot path, to reflect the root of the application I'll use with the instance. Now that you've setup your 'control' instance, config, and VirtualHost, you can do the same thing for your 'sites' instance. Just watch your port value, Serverstore path, and CFIDE and DocumentRoot paths.

Local Development Setup Pt 1: Apache and ColdFusion (7 or 8)

Mon, 23 Jul 2007 08:00:00 -0400

OK, so now that we are moving to localized development it has become necessary to learn how to configure our desktops for running a localized copy of our sites. The trick here is the complexity of our setup. We have multiple sites, sharing the same code base, accessing media from external resources. We also have to setup for multi-instance, to separate our front-end site and our back-end administration. We also need to be setup for one SSL site. Oh yeah, and we have to do it on Apache, since XP pro's version of IIS has some limitations about running multiple domains simultaneously. To top it all off (at least in my case) I also have to run Apache 2.0.59 so that I can also run Subversion, which is not yet compatible with Apache 2.2. [More]

CFMX7 and Apache 2.2.4

Tue, 16 Jan 2007 22:33:00 -0400

So, in my infinite wisdom, and much to the dismay of my wife, I decided to replace my server with a new (used) one. A slightly more powerful machine that a friend of mine was going to put on FreeCycle (Thanks Patti!), I thought it was perfect to go ahead and make some changes to my dev environment. I want to begin using Subversion, plus I figured I would go ahead and switch to CF on top of Apache (since IIS Sucks!), not to mention setting up CF on the multiserver install. Hey, why not.

Stephen Collins has a fine document called the ACME guide (for the uninitiated) that thoroughly covers setting up a basic, free development environment: Apache, ColdFusion, MySQL, (CF)Eclipse. I thought this would be a good place to start, but didn't realize that Apache had upgraded their server before AcidLabs could update the ACME guide. Whoops! ColdFusion install completes but Apache won't restart!

[More]