synyx GmbH & Co. KG Homepage Welcome Guest   | Login
  Search  
  Index  | Recent Threads  | Who's Online  | User List  | Register  | Search  | Help  | RSS feeds


Quick Go »
Thread Status: Normal
Total posts in this thread: 15
Posts: 15   Pages: 2   [ 1 2 | Next Page ]
[Add To My Favorites] [Watch this Thread]
Author
Previous Thread This topic has been viewed 23619 times and has 14 replies Next Thread
Male Daniel
Member



Joined: Mar 8, 2003
Posts: 72
Status: Offline

Multisite-, SSL, modRewrite- Tutorial

This tutorial is based on a lot of informations from the opencms-Mailinglist, from opencms-forum.de, from alkacon opencms.org and it is based on the "Get rid of the /opencms/opencms-prefix"-Tutorial from Sebastian Himberger.

prerequsites:
installed and working
Apache2 (mod_rewrite, mod_jk, mod_proxy) (tested with 2.2.3)
Tomcat (tested with 6.0.13)
OpenCms 6 or 7 (tested with 6.7.2 (7 beta 1 and 7rc2))

goals:
- a lot of domains on one opencms
- a clean URL (no opencms/opencms)
- workplace with ssl
- setting some OpenCms-resources to encrypted

our environment:
Debian etch 2.6.16-2-amd64-k8-smp
Apache2 2.2.3
Java 1.6.0_01-b06
Apache Tomcat/5.5.23/6.0.13 with jsvc
Opencms 6.2.3,7beta1,7rc2

If a different linux distribution is in use the default directories can be different, take care about that.

Configure Tomcat:
Enable the ajp13-Connector to communicate with apache-mod_jk
edit the server.xml
 <!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" address="127.0.0.1" protocol="AJP/1.3" redirectPort="8443" emptySessionPath="true" enableLookups="false" />

per default this tag is commeted out, just comment in and extend as in the example.
Add the attribute address to make the connector just listening for the apacheWebServer.
Comment the default connector on Port 8080 out to make the tomcat unreachable.

Compiling and using the jsvc tool from the commons-daemon project.
@see: http://tomcat.apache.org/tomcat-6.0-doc/setup.html
and the attached start/stop-Script tomcat.sh

Hint: You can install APR (Apache portable runtime) to increase the performance of tomcat.
@see: http://tomcat.apache.org/tomcat-6.0-doc/apr.html for installing and compiling instructions.
If you meet this
"configure: error: APR could not be located. Please use the --with-apr option"
try ./configure --with-apr=/usr/bin/apr-config or apr-1-config

To start the tomcat with this compiled libs add

-Djava.library.path=/usr/local/apr/lib

to CATALINA_OPTS.
The Tomcat Log will tell you if it founds the native libs or not.

Configure OpenCms:
Edit the file opencms-system.xml in WEB-INF/config/

<sites>
<workplace-server>https://worksplace.synyx.de</workplace-server>
<default-uri>/sites/default/</default-uri>
<site server="test1.synyx.de" uri="/sites/default/">
<secure server="https://test1.synyx.de" exclusive="true" error="false"/>
<alias server="foo.synyx.de"/>
<alias server="bar.synyx.de"/>
</site>
<site server="test2.synyx.de" uri="/sites/test2/">
<secure server="https://test2.synyx.de" exclusive="true" error="false"/>
</site>
</sites>

Be carefull the workplace-server must not be the same as any of the secure server.

Edit the file opencms-importexport.xml in WEB-INF/config/
Just remove the opencms-String (webapp-name, servlet-name)

<rfs-prefix>/export</rfs-prefix>
<vfs-prefix></vfs-prefix>


Login to the OpenCms-Workplace and create a new folder in the same hierarchy like
/sites/test2 (must be the same name as in opencms-system.xml)

To have the static export properly change the web.xml like this:

<error-page>
<error-code>404</error-code>
<location>/opencms/handle404</location>
</error-page


Configure mod_jk:
After installing mod_jk you have a symlink jk.load in /etc/apache2/mods-enabled/.
Create the file jk.conf in the /etc/apache2/mods-enabled directory
jk.conf

#
# mod_jk configuration
#
JkWorkersFile /etc/apache2/workers.properties
JkLogFile /var/log/apache2/mod_jk.log
JkLogLevel info
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "
JkOptions +ForwardKeySize +ForwardURICompat
JkShmFile /var/log/apache2/jk-runtime-status

Create the file workers.properties in the defined directory.
workers.properties

worker.list=ocms
worker.ocms.type=ajp13
worker.ocms.host=localhost
worker.ocms.port=8009
worker.ocms.retries=10
worker.ocms.connection_pool_minsize=13


Configure Apache2:
To use different domains with its own certificate we use IP-based virtualhost because namebased is not possible.
There are the directories /etc/apache2/sites-available with the virtualhostConfig and sites-enabled with symlinks to sites-available, you need the symlinks otherwise apache2 wouldn't recognize the configs.
We need two config files per domain, one for http and one for https, you can put all the config in one file but that is not very clear.
/etc/apache2/sites/available/$yourdomain.tld

<Directory /usr/share/tomcat/webapps/opencms/>
Options Indexes Includes FollowSymLinks MultiViews
AllowOverride AuthConfig
Order allow,deny
Allow from all
</Directory>

# IP-based virtualhost is used, can be combined with namebased virtualhost, take care of https will only work with IP-based
<VirtualHost $yourIP:80>

ServerName test.synyx.de
ServerAlias test1.synyx.de

DocumentRoot /usr/share/tomcat/webapps/opencms/

# some aliases for non Tomcat apps
Alias /phpmyadmin /var/www/phpmyadmin
Alias /webalizer /var/www/webalizer

RewriteEngine On

#if its one of the aliases above, force https and forget about the following rules
RewriteCond %{REQUEST_URI} ^/phpmyadmin.*$ [OR]
RewriteCond %{REQUEST_URI} ^/webalizer.*$ [OR]
# to get access to the probe WebApp
RewriteCond %{REQUEST_URI} ^/probe.*$ [OR]
# to get access to the webdav-servlet
RewriteCond %{REQUEST_URI} ^/opencms/webdav.*$
RewriteRule ^(.+)$ https://%{SERVER_NAME}$1 [L]

#If the request URI is starting with /nagios2 do a dummy rewrite and send to
#next uri-handler, but not mod-jk (if nothing exotic is installed later, this
#should be mod-alias ;)
RewriteCond %{REQUEST_URI} ^/nagios2.*$ [OR]
RewriteCond %{REQUEST_URI} ^/cgi-bin.*$
RewriteRule ^(.*)$ $1 [E=no-jk:true,PT]

# If the requested URI is located in the resources folder, do not forward the request
SetEnvIfNoCase Request_URI ^/opencms/resources/.*$ no-jk

# If the requested URI is static content do not forward the request
SetEnvIfNoCase Request_URI ^/export/.*$ no-jk

# If the requested URI is NOT located in the resources folder.
# Prepend an /opencms/opencms to everything that does not already starts with it
# and force the result to be handled by the next URI-handler ([PT]) (JkMount in this case)
RewriteCond %{REQUEST_URI} !^/opencms/resources/.*$
RewriteCond %{REQUEST_URI} !^/export/.*$
# get access to the opencms WebDAV-servlet
RewriteCond %{REQUEST_URI} !^/opencms/webdav.*$
RewriteRule !^/opencms/opencms/(.*)$ /opencms/opencms%{REQUEST_URI} [PT]

# These are the settings for static export. If the requested resource is not already
# statically exported create a new request to the opencms404 handler. This has to be
# a new request, because the current would not get through mod_jk because of the "no-jk" var.
RewriteCond %{REQUEST_URI} ^/export/.*$
RewriteCond %{DOCUMENT_ROOT}%{REQUEST_FILENAME} !-f
RewriteCond "%{DOCUMENT_ROOT}%{REQUEST_FILENAME}/index_export.html" !-f
RewriteRule .* http://%{HTTP_HOST}/opencms/opencms/handle404?exporturi=%{REQUEST_URI}&%{QUERY_STRING}]

# If the request starts with /opencms/resources, delete the /opencms prefix
RewriteCond %{REQUEST_URI} ^/opencms/resources/.*$
RewriteRule ^/opencms/(.*)$ /$1

# Finally, forward the request to mod_jk
JkMount /* ocms
</VirtualHost>

and /etc/apache2/sites/available/$yourdomain.tld-ssl

<VirtualHost $yourIP:443>
# SSL (START)
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/synyx.de/synyx.crt
SSLCertificateKeyFile /etc/apache2/ssl/synyx.de/synyx.key
SSLProtocol all
SSLCipherSuite HIGH:MEDIUM
SSLOptions +StdEnvVars
# SSL (ENDE)

#kann auch einfach eine IP sein
ServerName test.synyx.de
ServerAlias test1.synyx.de
ServerAdmin info@synyx.de

DocumentRoot /usr/share/tomcat/webapps/opencms

Alias /phpmyadmin /var/www/phpmyadmin
Alias /webalizer /var/www/webalizer

RewriteEngine On

#rewrite rules for an URL with /opencms/opencms to clean the url
RewriteRule ^/opencms/opencms(.*)$ https://%{SERVER_NAME}$1 [R=301,L]

# If its one of the aliases above, forget about the following rules and ignore mod_jk
RewriteCond %{REQUEST_URI} ^/phpmyadmin.*$ [OR]
RewriteCond %{REQUEST_URI} ^/webalizer.*$
RewriteRule ^(.*)$ $1 [E=no-jk:true,PT]

# If the requested URI is located in the resources folder, do not forward the request
SetEnvIfNoCase Request_URI ^/opencms/resources/.*$ no-jk

# If the requested URI is static content do not forward the request
SetEnvIfNoCase Request_URI ^/export/.*$ no-jk

# If the requested URI is NOT located in the resources folder.
# Prepend an /opencms/opencms to everything that does not already starts with it
# and force the result to be handled by the next URI-handler ([PT]) (JkMount in this case)
RewriteCond %{REQUEST_URI} !^/opencms/resources/.*$
RewriteCond %{REQUEST_URI} !^/export/.*$
# Some calls should go to tomcat but to a different webapp
RewriteCond %{REQUEST_URI} !^/manager.*$
# for the webdavservlet
RewriteCond %{REQUEST_URI} !^/opencms/webdav.*$
RewriteRule !^/opencms/opencms/(.*)$ /opencms/opencms%{REQUEST_URI} [PT]

# These are the settings for static export. If the requested resource is not already
# statically exported create a new request to the opencms404 handler. This has to be
# a new request, because the current would net get through mod_jk because of the "no-jk" var.
RewriteCond %{REQUEST_URI} ^/export/.*$
RewriteCond "%{DOCUMENT_ROOT}%{REQUEST_FILENAME}" !-f
RewriteCond "%{DOCUMENT_ROOT}%{REQUEST_FILENAME}/index_export.html" !-f
RewriteRule .* https://%{HTTP_HOST}/opencms/opencms/handle404?exporturi=%{REQUEST_URI}&%{QUERY_STRING}

# If the request starts with /opencms/resources, delete the /opencms prefix
RewriteCond %{REQUEST_URI} ^/opencms/resources/.*$
RewriteRule ^/opencms/(.*)$ /$1

# Finally, forward the request to mod_jk
JkMount /* ocms

</VirtualHost>


Files attached:
- tomcat.sh (start/stop-script)
----------------------------------------
Attachment tomcat.sh (3961 bytes) (Download Count: 47) (Start-,Stop-,Debug-Script)

----------------------------------------
[Edit 2 times, last edit by Daniel at Mar 15, 2008 1:09:43 PM]
[Jul 3, 2007 1:25:42 PM] Show Printable Version of Post     [Link] Report threatening or abusive post: please login first  Go to top 
Male languitar
Stranger



Joined: Oct 10, 2007
Posts: 3
Status: Offline

Re: Multisite-, SSL, modRewrite- Tutorial

I've tried to use this tutorial for name based virtual hosting, but after doing the steps described I can't login any more. Am I right that I have to use the rules for the virtual host also on the subdomain that hosts the workspace? Can this be a problem with a cookie url?
[Oct 10, 2007 7:59:48 PM] Show Printable Version of Post     [Link] Report threatening or abusive post: please login first  Go to top 
Male languitar
Stranger



Joined: Oct 10, 2007
Posts: 3
Status: Offline

Re: Multisite-, SSL, modRewrite- Tutorial

emptySessionPath="true" wasn't set, as this was not in the default config file provided by tomcat.
[Oct 11, 2007 1:03:53 PM] Show Printable Version of Post     [Link] Report threatening or abusive post: please login first  Go to top 
Male Daniel
Member



Joined: Mar 8, 2003
Posts: 72
Status: Offline

Re: Multisite-, SSL, modRewrite- Tutorial

You can not reach the opencms-workplace via domain.tld/system/login ?

What do you see instead?
Who answers Tomcat or Apache?

regards
Markus
[Oct 11, 2007 3:50:19 PM] Show Printable Version of Post     [Link] Report threatening or abusive post: please login first  Go to top 
Male languitar
Stranger



Joined: Oct 10, 2007
Posts: 3
Status: Offline

Re: Multisite-, SSL, modRewrite- Tutorial

I could reach it but the login didn't work because of the missing emptySessionPath="true". That solved my problem.
[Oct 12, 2007 1:05:40 AM] Show Printable Version of Post     [Link] Report threatening or abusive post: please login first  Go to top 
Male bseufert
Stranger



Joined: Dec 7, 2007
Posts: 1
Status: Offline

Re: Multisite-, SSL, modRewrite- Tutorial

I installed openCMS 7.0.3 and without the multi-site i could do everything including the administration.

I have configured using these instructions, and all the demos/documentation modules work, but when I try to login to /system/login/ the login says it was successful, but the popup goes back to the login dialog.

here is virtual host of httpd.conf (the other files i believe are correct). please help!

<VirtualHost 64.15.152.4>
ServerName www.techwest.com
ServerAlias www.rodeologic.com
ServerAlias www.canadiannationals.com

DocumentRoot /usr/share/tomcat5/webapps/opencms/

RewriteEngine on

RewriteCond %{HTTP_HOST} ^trailriding.ab.ca$ [NC]
RewriteRule ^(.*)$ $1 [PT]

SetEnvIfNoCase Request_URI ^/opencms/resources/.*$ no-jk
SetEnvIfNoCase Request_URI ^/export/.*$ no-jk

RewriteCond %{REQUEST_URI} !^/opencms/resources/.*$
RewriteCond %{REQUEST_URI} !^/export/.*$
RewriteCond %{REQUEST_URI} !^/opencms/webdav.*$
RewriteRule !^/opencms/opencms/(.*)$ /opencms/opencms%{REQUEST_URI} [PT]

RewriteCond %{REQUEST_URI} ^/export/.*$
RewriteCond %{DOCUMENT_ROOT}%{REQUEST_FILENAME} !-f
RewriteCond "%{DOCUMENT_ROOT}%{REQUEST_FILENAME}/index_export.html" !-f
RewriteRule .* http://%{HTTP_HOST}/opencms/opencms/hand404?exporturi=%{REQUEST_URI}&%{QUERY_STRING}

RewriteCond %{REQUEST_URI} ^/opencms/resources/.*$
RewriteRule ^/opencms/(.*)$ /$1

ErrorLog logs/www.techwest.com-error_log
CustomLog logs/www.techwest.com-access_log common
AddType application/x-httpd-php .php
ServerAdmin Brent.Seufert@techwest.com
JkMount /* default
</VirtualHost>
[Dec 8, 2007 2:38:19 AM] Show Printable Version of Post        Hidden to Guest [Link] Report threatening or abusive post: please login first  Go to top 
Male giuliato
Stranger



Joined: Dec 12, 2007
Posts: 1
Status: Offline

Re: Multisite-, SSL, modRewrite- Tutorial

Hello! I have done everything like the Howto! I have the problem that when I change the value in the opencms-importexport from
<vfs-prefix>{webapp-name}{servlet-name}</vfs-prefix> to <vfs-prefix></vfs-prefix>it is no longer possible to login into opencms!
I can see the login screen and it is possible to login but then ask me opencms again for login!
When I don't change to value it is possible to log in but all links in opencms have still the prefix /opencms/opencms.
Can somebody help me?
[Dec 12, 2007 5:33:05 PM] Show Printable Version of Post     [Link] Report threatening or abusive post: please login first  Go to top 
Male Daniel
Member



Joined: Mar 8, 2003
Posts: 72
Status: Offline

Re: Multisite-, SSL, modRewrite- Tutorial

sounds like you have not exactly configured the virtual host in Apache or you have forgotten some /opencms/ in the opencms-system.xml

please check your config.

hth,
Markus
[Jan 26, 2008 1:39:57 PM] Show Printable Version of Post     [Link] Report threatening or abusive post: please login first  Go to top 
Female kshtejer
Stranger


France
Joined: Dec 12, 2007
Posts: 2
Status: Offline

sad   Re: Multisite-, SSL, modRewrite- Tutorial

Hello

I recently installed the OpenCms 7.0.5. Before this version I had the 6.2.3 one working OK. I migrated all content from the 6.2.3 to the 7.0.5 and every think was OK. But I decided to follw this tutorial to get ride of the opencms/opencms from the path and to secure my site b using the https.

After have done all the steps one of the problems I have is that the workplace seems to be misconfigured. The links on the right windows don't work and the top frame dissapeared.

Is there some information about this problem. Please, I wold appreciate any help or suggestion.

Thanks in advance

Katherin
[Oct 15, 2008 6:59:02 PM] Show Printable Version of Post        kshtejer [Link] Report threatening or abusive post: please login first  Go to top 
Male craigchapman
Stranger



Joined: Apr 12, 2009
Posts: 2
Status: Offline

Re: Multisite-, SSL, modRewrite- Tutorial

Hi,

I've followed this tutorial (very helpful) and have 1 minor problem that I can't solve.

I'm using OpenCms 7.0.5, Tomcat 5.5.25 & Apache 1.3.41 (shipped with Mac os x 10.4)

The problem I'm seeing is that all links in the opencms workplace (folders etc) open in a new window. This also causes some of the dialogs such as user/group choosers to break.

My apache config is as follows (without ssl)


<VirtualHost *>
ServerName www.opencmsdefault.com.au
ServerAlias opencmsdefault.com.au opencmsworkspace.com.au conquest.co.uk
# <Directory />
# Options FollowSymLinks
# AllowOverride None
# </Directory>
<Directory "/Users/craig/Dev/tomcat-5.5.25/webapps/opencms">
Options Indexes Includes FollowSymLinks MultiViews
AllowOverride AuthConfig
Order allow,deny
Allow from all
</Directory>


DocumentRoot /Users/craig/Dev/tomcat-5.5.25/webapps/opencms/

# some aliases for non Tomcat apps
Alias /phpmyadmin /var/www/phpmyadmin
Alias /webalizer /var/www/webalizer

RewriteEngine On

#rewrite rules for an URL with /opencms/opencms to clean the url
RewriteRule ^/opencms/opencms(.*)$ http://%{SERVER_NAME}$1 [R=301,L]

#if its one of the aliases above, force https and forget about the following rules
RewriteCond %{REQUEST_URI} ^/phpmyadmin.*$ [OR]
RewriteCond %{REQUEST_URI} ^/webalizer.*$ [OR]
# to get access to the probe WebApp
RewriteCond %{REQUEST_URI} ^/probe.*$ [OR]
# to get access to the webdav-servlet
RewriteCond %{REQUEST_URI} ^/opencms/webdav.*$
RewriteRule ^(.+)$ http://%{SERVER_NAME}$1 [L]

#If the request URI is starting with /nagios2 do a dummy rewrite and send to
#next uri-handler, but not mod-jk (if nothing exotic is installed later, this
#should be mod-alias ;)
RewriteCond %{REQUEST_URI} ^/nagios2.*$ [OR]
RewriteCond %{REQUEST_URI} ^/cgi-bin.*$

RewriteRule ^(.*)$ $1 [E=no-jk:true,PT]

# If the requested URI is located in the resources folder, do not forward the request
SetEnvIfNoCase Request_URI ^/opencms/resources/.*$ no-jk

# If the requested URI is static content do not forward the request
SetEnvIfNoCase Request_URI ^/export/.*$ no-jk

# If the requested URI is NOT located in the resources folder.
# Prepend an /opencms/opencms to everything that does not already starts with it
# and force the result to be handled by the next URI-handler ([PT]) (JkMount in this case)
RewriteCond %{REQUEST_URI} !^/opencms/resources/.*$
RewriteCond %{REQUEST_URI} !^/export/.*$
# get access to the opencms WebDAV-servlet
RewriteCond %{REQUEST_URI} !^/opencms/webdav.*$
RewriteRule !^/opencms/opencms/(.*)$ /opencms/opencms%{REQUEST_URI} [PT]

# These are the settings for static export. If the requested resource is not already
# statically exported create a new request to the opencms404 handler. This has to be
# a new request, because the current would not get through mod_jk because of the "no-jk" var.
RewriteCond %{REQUEST_URI} ^/export/.*$
RewriteCond %{DOCUMENT_ROOT}%{REQUEST_FILENAME} !-f
RewriteCond "%{DOCUMENT_ROOT}%{REQUEST_FILENAME}/index_export.html" !-f
RewriteRule .* http://%{HTTP_HOST}/opencms/opencms/handle404?exporturi=%{REQUEST_URI}&%{QUERY_STRING}]

# If the request starts with /opencms/resources, delete the /opencms prefix
RewriteCond %{REQUEST_URI} ^/opencms/resources/.*$
RewriteRule ^/opencms/(.*)$ /$1

# Finally, forward the request to mod_jk

JkMount /* worker1
</VirtualHost>




Snippet from my opencms-system.xml


<sites>
<workplace-server>http://opencmsworkspace.com.au</workplace-server>
<default-uri>/sites/default/</default-uri>
<site server="http://www.opencmsdefault.com.au" uri="/sites/default/">
<alias server="http://opencmsdefault.com.au" />
</site>
<site server="http://www.conquest.co.uk" uri="/sites/conquestuk/">
<alias server="http://conquest.co.uk" />
</site>

</sites>


Snippet from my opencms-importexport.xml


<rendersettings>
<rfs-prefix>/export</rfs-prefix>
<vfs-prefix></vfs-prefix>
<userelativelinks>false</userelativelinks>
<exporturl>http://127.0.0.1:8080${CONTEXT_NAME}/handle404</exporturl>
<plainoptimization>true</plainoptimization>
<testresource uri="/system/shared/page.dtd"/>
<resourcestorender>
<regex>/sites/.*</regex>
<regex>/system/workplace/commons/style/.*</regex>
<regex>/system/galleries/.*</regex>
<regex>/system/modules/.*/resources/.*</regex>
</resourcestorender>
</rendersettings>




Any hints greatly appreciated.
[Apr 12, 2009 12:31:36 AM] Show Printable Version of Post        Hidden to Guest [Link] Report threatening or abusive post: please login first  Go to top 
Posts: 15   Pages: 2   [ 1 2 | Next Page ]
[Show Printable Version of Thread]