Rudder

Can you please attach to this the configuration you installed in Apache for Rudder to use HTTP/S ? (you are of course invited to remove any sensitive information from it :)

Thanks in advance

• Follow redirects by default ( http://curl.haxx.se/docs/faq.html#How_do_I_tell_curl_to_follow_HTT )
• Allow connections to untrusted HTTP/S services ( like a self signed certificate )

Thus, for now you should use this configuration:

• rudder-default
  

  <VirtualHost *:80>
      ServerAdmin webmaster@localhost
      ServerName  rudder
  
      RewriteEngine On
  
      RewriteCond %{REQUEST_URI} !^/uuid
      RewriteCond %{REQUEST_URI} !^/inventories/?
      RewriteCond %{REQUEST_URI} !^/inventory-updates/?
      RewriteCond %{REQUEST_URI} !^/api/?
  
      RewriteRule  ^/(.*)$  https://%{SERVER_NAME}/$1 [R]
  
      DocumentRoot /var/www
  
      # Expose the server UUID through http
      Alias /uuid /opt/rudder/etc/uuid.hive
      <Directory /opt/rudder/etc>
          Order deny,allow
          Allow from all
      </Directory>
  
      # WebDAV share to receive inventories
      Alias /inventories /var/rudder/inventories/incoming
      <Directory /var/rudder/inventories/incoming>
          DAV on 
          AuthName "WebDAV Storage" 
          AuthType Basic
          AuthUserFile /opt/rudder/etc/htpasswd-webdav-initial
          Require valid-user
          Order deny,allow
          # This file is automatically generated according to
          # the hosts allowed by rudder.
          Include /opt/rudder/etc/rudder-networks.conf
          <LimitExcept PUT>
              Order allow,deny
              Deny from all
          </LimitExcept>
      </Directory>
  
      # WebDAV share to receive inventories
      Alias /inventory-updates /var/rudder/inventories/accepted-nodes-updates
      <Directory /var/rudder/inventories/accepted-nodes-updates>
          DAV on 
          AuthName "WebDAV Storage" 
          AuthType Basic
          AuthUserFile /opt/rudder/etc/htpasswd-webdav
          Require valid-user
          Order deny,allow
          # This file is automatically generated according to
          # the hosts allowed by rudder.
          Include /opt/rudder/etc/rudder-networks.conf
          <LimitExcept PUT>
              Order allow,deny
              Deny from all
          </LimitExcept>
      </Directory>
  
      # NO access to the API unless you are localhost
      <Location /rudder/api>
          Order deny,allow
          Deny from all
          Allow from localhost
      </Location>
  
      # Logs
      ErrorLog /var/log/rudder/apache2/error.log
      LogLevel warn
      CustomLog /var/log/rudder/apache2/access.log combined
  
  </VirtualHost>
  

• rudder-default-ssl
  

  <IfModule mod_ssl.c>
  <VirtualHost _default_:443>
  
      ServerAdmin webmaster@localhost
      ServerName  rudder
  
      DocumentRoot /var/www
  
      # Rudder webapp
      RewriteEngine on
      RewriteRule   ^/$  /rudder [R]
  
      ProxyPass         "/rudder" "http://localhost:8080/rudder" 
      ProxyPassReverse  "/rudder" "http://localhost:8080/rudder" 
      ProxyRequests     Off
  
      # Local reverse proxy authorization override
      # Most unix distribution deny proxy by default (ie /etc/apache2/mods-enabled/proxy.conf in Ubuntu)
      <Proxy http://localhost:8080/rudder*>
          Order deny,allow
          Allow from all
      </Proxy>
  
      # Nice loading page if the Java server is not ready
      ErrorDocument 503 /opt/rudder/share/load-page/rudder-loading.html
  
      # Enforce permissive access to the load page directory
      <Directory /opt/rudder/share/load-page>
          Order deny,allow
          Allow From all
      </Directory>
  
      # Expose the server UUID through http
      Alias /uuid /opt/rudder/etc/uuid.hive
      <Directory /opt/rudder/etc>
          Order deny,allow
          Allow from all
      </Directory>
  
          # NO access to the API unless you are localhost
      <Location /rudder/api>
          Order deny,allow
          Deny from all
          Allow from localhost
      </Location>
  
      # Logs
      ErrorLog /var/log/rudder/apache2/error.log
      ErrorLog ${APACHE_LOG_DIR}/error.log
  
      # Possible values include: debug, info, notice, warn, error, crit,
      # alert, emerg.
      LogLevel warn
  
      CustomLog /var/log/rudder/apache2/access.log combined
  
      #   SSL Engine Switch:
      #   Enable/Disable SSL for this virtual host.
      SSLEngine on
  
      SSLCertificateFile      /etc/ssl/certs/server.crt
      SSLCertificateKeyFile   /etc/ssl/private/server.key
      # SSLCertificateChainFile    /etc/ssl/certs/GandiStandardSSLCA.pem
  
      #   Certificate Revocation Lists (CRL):
      #   Set the CA revocation path where to find CA CRLs for client
      #   authentication or alternatively one huge file containing all
      #   of them (file must be PEM encoded)
      #   Note: Inside SSLCARevocationPath you need hash symlinks
      #         to point to the certificate files. Use the provided
      #         Makefile to update the hash symlinks after changes.
      #SSLCARevocationPath /etc/apache2/ssl.crl/
      #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
  
      #   Client Authentication (Type):
      #   Client certificate verification type and depth.  Types are
      #   none, optional, require and optional_no_ca.  Depth is a
      #   number which specifies how deeply to verify the certificate
      #   issuer chain before deciding the certificate is not valid.
      #SSLVerifyClient require
      #SSLVerifyDepth  10
  
      #   Access Control:
      #   With SSLRequire you can do per-directory access control based
      #   on arbitrary complex boolean expressions containing server
      #   variable checks and other lookup directives.  The syntax is a
      #   mixture between C and Perl.  See the mod_ssl documentation
      #   for more details.
      #<Location />
      #SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
      #            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
      #            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
      #            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
      #            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
      #           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
      #</Location>
  
      #   SSL Engine Options:
      #   Set various options for the SSL engine.
      #   o FakeBasicAuth:
      #     Translate the client X.509 into a Basic Authorisation.  This means that
      #     the standard Auth/DBMAuth methods can be used for access control.  The
      #     user name is the `one line' version of the client's X.509 certificate.
      #     Note that no password is obtained from the user. Every entry in the user
      #     file needs this password: `xxj31ZMTZzkVA'.
      #   o ExportCertData:
      #     This exports two additional environment variables: SSL_CLIENT_CERT and
      #     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
      #     server (always existing) and the client (only existing when client
      #     authentication is used). This can be used to import the certificates
      #     into CGI scripts.
      #   o StdEnvVars:
      #     This exports the standard SSL/TLS related `SSL_*' environment variables.
      #     Per default this exportation is switched off for performance reasons,
      #     because the extraction step is an expensive operation and is usually
      #     useless for serving static content. So one usually enables the
      #     exportation for CGI and SSI requests only.
      #   o StrictRequire:
      #     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
      #     under a "Satisfy any" situation, i.e. when it applies access is denied
      #     and no other module can change it.
      #   o OptRenegotiate:
      #     This enables optimized SSL connection renegotiation handling when SSL
      #     directives are used in per-directory context.
      #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
      <FilesMatch "\.(cgi|shtml|phtml|php)$">
          SSLOptions +StdEnvVars
      </FilesMatch>
      <Directory /usr/lib/cgi-bin>
          SSLOptions +StdEnvVars
      </Directory>
  
      #   SSL Protocol Adjustments:
      #   The safe and default but still SSL/TLS standard compliant shutdown
      #   approach is that mod_ssl sends the close notify alert but doesn't wait for
      #   the close notify alert from client. When you need a different shutdown
      #   approach you can use one of the following variables:
      #   o ssl-unclean-shutdown:
      #     This forces an unclean shutdown when the connection is closed, i.e. no
      #     SSL close notify alert is send or allowed to received.  This violates
      #     the SSL/TLS standard but is needed for some brain-dead browsers. Use
      #     this when you receive I/O errors because of the standard approach where
      #     mod_ssl sends the close notify alert.
      #   o ssl-accurate-shutdown:
      #     This forces an accurate shutdown when the connection is closed, i.e. a
      #     SSL close notify alert is send and mod_ssl waits for the close notify
      #     alert of the client. This is 100% SSL/TLS standard compliant, but in
      #     practice often causes hanging connections with brain-dead browsers. Use
      #     this only for browsers where you know that their SSL implementation
      #     works correctly.
      #   Notice: Most problems of broken clients are also related to the HTTP
      #   keep-alive facility, so you usually additionally want to disable
      #   keep-alive for those clients, too. Use variable "nokeepalive" for this.
      #   Similarly, one has to force some clients to use HTTP/1.0 to workaround
      #   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
      #   "force-response-1.0" for this.
      BrowserMatch "MSIE [2-6]" \
          nokeepalive ssl-unclean-shutdown \
          downgrade-1.0 force-response-1.0
      # MSIE 7 and newer should be able to use keepalive
      BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
  
  </VirtualHost>
  </IfModule>
  

I'm rejecting this because I cannot simply close the ticket, but the actual integration work will be done in #3682, don't worry ! :)

Stay tuned !

(And of course, please feel free to reopen this if the problem reappears !)

• Documented procedure to add HTTP/S support in 2.6/2.7
• Have HTTP/S by default in 2.8