ارتقای امنیت آپاچی با ابزار mod_md Let’s Encrypt در اوبونتو 20.04 LTS

1sudo apt update2sudo apt upgrade

1sudo apt install libapache2-mod-md

1sudo a2enmod md

1Enabling module md.2To activate the new configuration, you need to run:3systemctl restart apache2

1sudo a2enmod ssl

1Considering dependency setenvif for ssl:2Module setenvif already enabled3Considering dependency mime for ssl:4Module mime already enabled5Considering dependency socache_shmcb for ssl:6Enabling module socache_shmcb.7Enabling module ssl.8See /usr/share/doc/apache2/README.Debian.gz on how to configure SSL and create self-signed certificates.9To activate the new configuration, you need to run:10systemctl restart apache2

1sudo systemctl reload apache2.service

1sudo netstat -tulpn | grep ':80'2## or ##3sudo ss -tulpn | grep ':80'

1tcp    LISTEN  0       128                        *:80                  *:*      users:(("apache2",pid=2550,fd=4),("apache2",pid=2549,fd=4),("apache2",pid=2548,fd=4))

1curl -I http://www42.ariaservice.net

1HTTP/1.1 200 OK2Date: Wed, 06 May 2020 19:30:43 GMT3Server: Apache/2.4.41 (Ubuntu)4Last-Modified: Wed, 06 May 2020 19:15:29 GMT5ETag: "15e-5a4ff965902a3"6Accept-Ranges: bytes7Content-Length: 3508Vary: Accept-Encoding9Connection: close10Content-Type: text/html

1sudo nano /etc/apache2/sites-available/www42.ariaservice.net.conf

1## Secure Apache with mod_md Let's Encrypt directives ##2ServerAdmin webmaster@ariaservice.net3MDCertificateAgreement accepted4MDomain www42.ariaservice.net5MDPrivateKeys RSA 4096

1## Apache with mod_md Let's Encrypt ##2## mod_md config for Let's Encrypt ##3ServerAdmin webmaster@cyberciti.biz4MDCertificateAgreement accepted5MDomain www42.cyberciti.biz6MDPrivateKeys RSA 40967## HTTP port 80 config ##8<VirtualHost *:80>9ServerAdmin webmaster@ariaservice.net10ServerName www42.ariaservice.net11DocumentRoot /home/ariaservice.net/html12DirectoryIndex index.html13ErrorLog ${APACHE_LOG_DIR}/www42.ariaservice.net-error.log14CustomLog ${APACHE_LOG_DIR}/www42.ariaservice.net-access.log combined15# Redirect all http requests to HTTPS (uncomment the following two lines when HTTPS issued)16# RewriteEngine On17# RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [R=301,L]18</VirtualHost>19## HTTPS Config ##20<VirtualHost *:443>21SSLEngine on22ServerAdmin webmaster@ariaservice.net23ServerName www42.ariaservice.net24DocumentRoot /home/ariaservice.net/html25DirectoryIndex index.html26ErrorLog ${APACHE_LOG_DIR}/www42.ariaservice.net-ssl-error.log27CustomLog ${APACHE_LOG_DIR}/www42.ariaservice.net-ssl-access.log combined28# Turn on HTTP/229Protocols h2 http/1.130# Set HTTP Strict Transport Security31Header always set Strict-Transport-Security "max-age=63072000"32</VirtualHost>33## Only enable TLS v1.3 and avoid older protocols ##34SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1 -TLSv1.235SSLHonorCipherOrder     off36SSLSessionTickets       off37## Turn on OCSP Stapling ##38SSLUseStapling On39SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"40## Permission for our DocumentRoot  ##41<Directory /home/ariaservice.net/html>42Options Indexes FollowSymLinks43AllowOverride None44Require all granted45</Directory>

1sudo a2enmod rewrite

1Enabling module rewrite.2To activate the new configuration, you need to run:3systemctl restart apache2

1sudo a2enmod headers2Enabling module headers.3To activate the new configuration, you need to run:4systemctl restart apache2

1sudo apache2ctl configtest

1Syntax OK

1sudo ufw allow 443/tcp comment 'accept secure Apache connections'

1sudo ufw status

1sudo systemctl restart apache2.service

1sudo tail -f /var/log/apache2/error.log

1sudo grep 'The Managed Domain' /var/log/apache2/error.log

1[Wed May 06 20:17:38.112849 2020] [md:notice]  AH10059: The Managed Domain www42.ariaservice.net has been setup and changes will be activated on next (graceful) server restart.

1http://www42.ariaservice.net/server-status2http://your-public-ip-here/server-status

1sudo systemctl reload apache2.service

1curl -I https://www42.ariaservice.net

1sudo apache2ctl -M2sudo apache2ctl -M | grep mod_watchdog

1core_module (static)2so_module (static)3watchdog_module (static)4http_module (static)5unixd_module (static)6access_compat_module (shared)7alias_module (shared)8auth_basic_module (shared)9authn_core_module (shared)10....11..12...13ssl_module (shared)14status_module (shared)

1https://www42.ariaservice.net/server-status2https://your-public-ip-here/server-status

1sudo nano /etc/apache2/sites-available/www42.ariaservice.net.conf

1<Location "/md-status">2SetHandler md-status3</Location>

1sudo systemctl restart apache2.service2curl https://www42.ariaservice.net /md-status

1{2"version": "2.0.10",3"managed-domains": [4{5"name": "www42.cyberciti.biz",6"domains": [7"www42.cyberciti.biz",8"www43.cyberciti.biz"9],10"contacts": [11"mailto:webmaster@cyberciti.biz"12],13"transitive": 1,14"ca": {15"proto": "ACME",16"url": "https://acme-v02.api.letsencrypt.org/directory",17"agreement": "accepted"18},19"state": 2,20"renew-mode": 1,21"renew-window": "33%",22"warn-window": "10%",23"must-staple": false,24"cert": {25"valid-from": "Wed, 06 May 2020 19:17:37 GMT",26"valid-until": "Tue, 04 Aug 2020 19:17:37 GMT",27"serial": "040E339A0A7D2224819A550BBB4596279F67",28"sha256-fingerprint": "d78933fa946cb71810111876049defa4feb6820c319c69918ba925b463bbd11c"29},30"renew": false31}32]33}