From 2e5d9d52e1b8e219329c84eea0313d14b7fd5a5c Mon Sep 17 00:00:00 2001
From: Rich Bowen For example, to make the server accept connections on both
port 80 and port 8000, on all interfaces, use: To make the server accept connections on port 80 for one interface,
and port 8000 on another, use IPv6 addresses must be enclosed in square brackets, as in the
following example: Overlapping If your platform supports it and you want httpd to handle IPv4 and
IPv6 connections on separate sockets (i.e., to disable IPv4-mapped
@@ -156,9 +160,10 @@
You only need to set the protocol if you are running on non-standard
ports. For example, running an Configuration du serveur HTTP Apache pour l'écoute
sur un port et une adresse IP spécifiques.
- Listen 80
- Listen 8000
-
+Listen 80
+Listen 8000
+
+
- Listen 192.0.2.1:80
- Listen 192.0.2.5:8000
-
+Listen 192.0.2.1:80
+Listen 192.0.2.5:8000
+
+
+
Listen [2001:db8::a00:20ff:fea7:ccea]:80
-
Listen
directives will result in a
fatal error which will prevent the server from starting up.Listen
directives, as in the
following examples:
-
- Listen 0.0.0.0:80
- Listen 192.0.2.1:80
-
+Listen 0.0.0.0:80
+Listen 192.0.2.1:80
+
+
https
site on port 8443:
+
Listen 192.170.2.1:8443 https
-
How This Works With Virtual Hosts
diff --git a/docs/manual/bind.html.fr b/docs/manual/bind.html.fr
index 86bf0e79d0..b48b646a07 100644
--- a/docs/manual/bind.html.fr
+++ b/docs/manual/bind.html.fr
@@ -28,6 +28,8 @@
ko |
tr
Apache HTTPD sunucusunun belli adresleri ve portları dinlemek üzere yapılandırılması.
diff --git a/docs/manual/bind.xml.de b/docs/manual/bind.xml.de index 4eef8998d6..f4b34a7faa 100644 --- a/docs/manual/bind.xml.de +++ b/docs/manual/bind.xml.de @@ -1,7 +1,7 @@ - + - + + + + - + + + + diff --git a/docs/manual/custom-error.xml.ja b/docs/manual/custom-error.xml.ja index cd28ce8eb6..ffefc68cc4 100644 --- a/docs/manual/custom-error.xml.ja +++ b/docs/manual/custom-error.xml.ja @@ -1,7 +1,7 @@ - + + + + diff --git a/docs/manual/env.xml.ja b/docs/manual/env.xml.ja index 7f055439e6..b47a605432 100644 --- a/docs/manual/env.xml.ja +++ b/docs/manual/env.xml.ja @@ -1,7 +1,7 @@ - + + + + - + + + + + - + + + + + diff --git a/docs/manual/misc/security_tips.xml.ko b/docs/manual/misc/security_tips.xml.ko index 94d8c0135f..68b5680216 100644 --- a/docs/manual/misc/security_tips.xml.ko +++ b/docs/manual/misc/security_tips.xml.ko @@ -1,7 +1,7 @@ - + + + + + diff --git a/docs/manual/mod/core.xml.ja b/docs/manual/mod/core.xml.ja index a328999e3d..e3f480f25c 100644 --- a/docs/manual/mod/core.xml.ja +++ b/docs/manual/mod/core.xml.ja @@ -1,7 +1,7 @@ - + + + - + + + + + diff --git a/docs/manual/ssl/ssl_faq.xml.meta b/docs/manual/ssl/ssl_faq.xml.meta index 61db826966..a5d5a97804 100644 --- a/docs/manual/ssl/ssl_faq.xml.meta +++ b/docs/manual/ssl/ssl_faq.xml.meta @@ -8,6 +8,6 @@Your SSL configuration will need to contain, at minimum, the following directives.
-
- Listen 443
- <VirtualHost *:443>
-
- ServerName www.example.com
- SSLEngine on
- SSLCertificateFile /path/to/www.example.com.cert
- SSLCertificateKeyFile /path/to/www.example.com.key
-
- </VirtualHost>
-
+Listen 443 +<VirtualHost *:443> + ServerName www.example.com + SSLEngine on + SSLCertificateFile /path/to/www.example.com.cert + SSLCertificateKeyFile /path/to/www.example.com.key +</VirtualHost> ++
The following enables only the strongest ciphers:
-
- SSLCipherSuite HIGH:!aNULL:!MD5
-
+ SSLCipherSuite HIGH:!aNULL:!MD5 ++
While with the following configuration you specify a preference for specific speed-optimized ciphers (which will be selected by mod_ssl, provided that they are supported by the client):
-
- SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5
- SSLHonorCipherOrder on
-
+SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:!aNULL:!MD5 +SSLHonorCipherOrder on ++
- # be liberal in general
- SSLCipherSuite ALL:!aNULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP:+eNULL
-
- <Location /strong/area>
- # but https://hostname/strong/area/ and below
- # requires strong ciphers
- SSLCipherSuite HIGH:!aNULL:!MD5
- </Location>
-
+# be liberal in general +SSLCipherSuite ALL:!aNULL:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP:+eNULL + +<Location /strong/area> +# but https://hostname/strong/area/ and below +# requires strong ciphers +SSLCipherSuite HIGH:!aNULL:!MD5 +</Location> ++
ca.crt
) and then verify the clients against this
certificate.
-
- # require a client certificate which has to be directly
- # signed by our CA certificate in ca.crt
- SSLVerifyClient require
- SSLVerifyDepth 1
- SSLCACertificateFile conf/ssl.crt/ca.crt
-
+# require a client certificate which has to be directly +# signed by our CA certificate in ca.crt +SSLVerifyClient require +SSLVerifyDepth 1 +SSLCACertificateFile conf/ssl.crt/ca.crt ++
mod_ssl
:
-
- SSLVerifyClient none
- SSLCACertificateFile conf/ssl.crt/ca.crt
-
- <Location /secure/area>
- SSLVerifyClient require
- SSLVerifyDepth 1
- </Location>
-
+SSLVerifyClient none +SSLCACertificateFile conf/ssl.crt/ca.crt + +<Location /secure/area> +SSLVerifyClient require +SSLVerifyDepth 1 +</Location> ++
+SSLVerifyClient none <Directory /usr/local/apache2/htdocs/secure/area> + SSLVerifyClient require + SSLVerifyDepth 5 + SSLCACertificateFile conf/ssl.crt/ca.crt + SSLCACertificatePath conf/ssl.crt + SSLOptions +FakeBasicAuth + SSLRequireSSL + AuthName "Snake Oil Authentication" + AuthType Basic + AuthBasicProvider file + AuthUserFile /usr/local/apache2/conf/httpd.passwd + Require valid-user +</Directory> +-SSLVerifyClient require -SSLVerifyDepth 5 -SSLCACertificateFile conf/ssl.crt/ca.crt -SSLCACertificatePath conf/ssl.crt -SSLOptions +FakeBasicAuth -SSLRequireSSL -AuthName "Snake Oil Authentication" -AuthType Basic -AuthBasicProvider file -AuthUserFile /usr/local/apache2/conf/httpd.passwd -Require valid-user -</Directory>
The password used in this example is the DES encrypted string "password".
See the SSLOptions
docs for more
@@ -202,10 +207,9 @@ Require valid-user
into the DN, you can match them more easily using SSLRequire
, as follows:
+SSLVerifyClient none <Directory /usr/local/apache2/htdocs/secure/area> - SSLVerifyClient require SSLVerifyDepth 5 SSLCACertificateFile conf/ssl.crt/ca.crt @@ -214,7 +218,9 @@ SSLVerifyClient none SSLRequireSSL SSLRequire %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \ and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} -</Directory>
+SSLCACertificateFile conf/ssl.crt/company-ca.crt <Directory /usr/local/apache2/htdocs> -# Outside the subarea only Intranet access is granted -Order deny,allow -Deny from all -Allow from 192.168.1.0/24 + # Outside the subarea only Intranet access is granted + Order deny,allow + Deny from all + Allow from 192.168.1.0/24 </Directory> <Directory /usr/local/apache2/htdocs/subarea> -# Inside the subarea any Intranet access is allowed -# but from the Internet only HTTPS + Strong-Cipher + Password -# or the alternative HTTPS + Strong-Cipher + Client-Certificate - -# If HTTPS is used, make sure a strong cipher is used. -# Additionally allow client certs as alternative to basic auth. -SSLVerifyClient optional -SSLVerifyDepth 1 -SSLOptions +FakeBasicAuth +StrictRequire -SSLRequire %{SSL_CIPHER_USEKEYSIZE} >= 128 - -# Force clients from the Internet to use HTTPS -RewriteEngine on -RewriteCond %{REMOTE_ADDR} !^192\.168\.1\.[0-9]+$ -RewriteCond %{HTTPS} !=on -RewriteRule . - [F] - -# Allow Network Access and/or Basic Auth -Satisfy any - -# Network Access Control -Order deny,allow -Deny from all -Allow 192.168.1.0/24 - -# HTTP Basic Authentication -AuthType basic -AuthName "Protected Intranet Area" -AuthBasicProvider file -AuthUserFile conf/protected.passwd -Require valid-user -</Directory>
Ce document doit vous permettre de démarrer et de faire fonctionner
diff --git a/docs/manual/ssl/ssl_howto.xml.fr b/docs/manual/ssl/ssl_howto.xml.fr
index 632ea4b289..035106e20d 100644
--- a/docs/manual/ssl/ssl_howto.xml.fr
+++ b/docs/manual/ssl/ssl_howto.xml.fr
@@ -1,7 +1,7 @@
-
+
diff --git a/docs/manual/ssl/ssl_howto.xml.meta b/docs/manual/ssl/ssl_howto.xml.meta
index b7c021fd9a..8d9a5237f4 100644
--- a/docs/manual/ssl/ssl_howto.xml.meta
+++ b/docs/manual/ssl/ssl_howto.xml.meta
@@ -8,6 +8,6 @@
If for example, your web server is configured to run as:
-
- User www
- Group webgroup
-
+User www +Group webgroup ++
and suexec
is installed at
"/usr/local/apache2/bin/suexec", you should run:
La fonctionnalité suEXEC permet l'exécution des programmes CGI et diff --git a/docs/manual/suexec.xml.fr b/docs/manual/suexec.xml.fr index 19fbaac9bb..a346dba3bf 100644 --- a/docs/manual/suexec.xml.fr +++ b/docs/manual/suexec.xml.fr @@ -3,7 +3,7 @@ - + + + + - + - + + + + + diff --git a/docs/manual/vhosts/examples.xml.ja b/docs/manual/vhosts/examples.xml.ja index 0da43c657e..ed7237d7f2 100644 --- a/docs/manual/vhosts/examples.xml.ja +++ b/docs/manual/vhosts/examples.xml.ja @@ -1,7 +1,7 @@ - + + + + + + + + diff --git a/docs/manual/vhosts/ip-based.xml.ja b/docs/manual/vhosts/ip-based.xml.ja index 2acee10af0..7bb1e28ad8 100644 --- a/docs/manual/vhosts/ip-based.xml.ja +++ b/docs/manual/vhosts/ip-based.xml.ja @@ -1,7 +1,7 @@ - + + + + + + + + diff --git a/docs/manual/vhosts/name-based.xml.ja b/docs/manual/vhosts/name-based.xml.ja index f9d8bd8e77..e9167b986a 100644 --- a/docs/manual/vhosts/name-based.xml.ja +++ b/docs/manual/vhosts/name-based.xml.ja @@ -1,7 +1,7 @@ - + + +