Apache with Self Signed Certificate

PREREQUISITE

• Linux server with apache installed (Port 80 and 443 should open from FW)
• There should be a DNS entry for your site. Local host entry is enough.
• "openssl" package should be installed in your server.
• Download this file to your server and extract. (Download Link)

In this example I am using Ubuntu 20.04 LTS server. Command can be different  you are using OS like Redhat or CentOS.

My site name is : my-testweb.nocompany.lk

We server IP     : 192.168.1.23

Add host entry for your site.

Step 01: Install Apache

apt install apache2

After install enable the service and start the apache2 service

systemctl enable apache2

systemctl start apache2

Now try to access default site using host name. 

Step 02: Create a Custom Page

Now create a virtual host configuration file with your custom website in below location.

Location : "/etc/apache2/sites-available"

<VirtualHost *:80>

        ServerName my-testweb.nocompany.lk

        ServerAlias my-testweb.nocompany.lk

        DocumentRoot /var/www/html/my-site

        ErrorLog ${APACHE_LOG_DIR}/my-testweb.nocompany.lk-error.log

        CustomLog ${APACHE_LOG_DIR}/my-testweb.nocompany.lk-access.log combined

</VirtualHost>

Create "DocumentRoot" folder and create simple index.html file.

Include that config file to site-enable folder.

Go to "/etc/apache2/sites-enabled" folder and execute this command.

ln -s ../sites-available/my-site.conf my-site.conf

Now restart the apache service and check.

systemctl restart apache2

Step 03: Obtain Self-sign Certificate

Download this file to your server and extract. (Download Link)

First generate CA certificate

Execute "./createCA.sh" to proceed.

Put strong password during CA certificate generation. 

For Common name, you can put your company name.

Cert Path.: sslCA/cacert.pem

Key Path.: sslCA/private/cakey.pem

Now generate host certificate and sign with CA certificate

Execute "./createHostCert.sh" to proceed. Please make sure to put your web site name under "Common Name". You can keep rest of the things default. Challenge password also you and keep as a blank. Just press enter. You have to put password you put for CA certificate for "cakey.pem"  

Press "y" to sign the certificate.

Once you successfully completed, it will generate two files. 

• hostcert.pem --> Sign certificate for your website
• hostkey.pem --> Key for your website certificate

Create a folder under "/etc/apache2/" call "ssl" and copy those files to "ssl" folder with below names.

Step 04: Make your Site Secure

Now enable SSL module for apache. Execute below command to do this. You have to restart the apache service to apply the changes. 

a2enmod ssl

Now open virtual host configuration file you created before and add another virtual host configuration block as follow.

You have to include certificated files you obtained to configuration files.

<VirtualHost *:443>

        ServerName my-testweb.nocompany.lk

        ServerAlias my-testweb.nocompany.lk

        DocumentRoot /var/www/html/my-site

        SSLEngine on

        SSLCertificateFile /etc/apache2/ssl/my-testweb.crt

        SSLCertificateKeyFile /etc/apache2/ssl/my-testweb.key

        ErrorLog ${APACHE_LOG_DIR}/ssl-my-testweb.nocompany.lk-error.log

        CustomLog ${APACHE_LOG_DIR}/ssl-my-testweb.nocompany.lk-access.log combined

</VirtualHost>

Restart the apache service to apply the changers.

systemctl restart apache2

Step 05: Import CA Certificate to your Browser

Now, you have to import CA certificate you generate previously, to your browser. First copy the CA certificate where your normal user can access. You can copy it to user's home directory.

Open your browser and go to where certificate and import. It can be different from browser to browser. Here I am using Firefox.

Go to Authorities tab and select "Import"

Then you have to navigate to CA certificate file. Once you select and open you have to trust this CA certificate for website. Then press "OK" button.

You can verify by go through CA list whether it is successfully imported or not.

Now brows your site with https and check whether certificated is downloading without any issue.

 

Apache with Letsencrypt

Let's Encrypt is a non-profit certificate authority run by Internet Security Research Group (ISRG) that provides X.509 certificates for Transport Layer Security (TLS) encryption at no charge. It launched on April 12, 2016.

Let's Encrypt certificates are valid for 90 days, during which renewal can take place at any time. The offer is accompanied by an automated process designed to overcome manual creation, validation, signing, installation, and renewal of certificates for secure websites. The project claims its goal is to make encrypted connections to World Wide Web servers ubiquitous.[6] By eliminating payment, web server configuration, validation email management and certificate renewal tasks, it is meant to significantly lower the complexity of setting up and maintaining TLS encryption.[1]

[1] Wikipedia

PREREQUISITE

• Linux server with apache installed (Port 80 and 443 should open for public)
• There should be a DNS entry for your site.
• Enable "add-apt-repository universe" repo.
• "certbot" packages should be install in your server.

In this example I am using Ubuntu 20.04 LTS server. Command can be different  you are using OS like Redhat or CentOS.

Step 01: Install Apache

apt install apache2

After install enable the service and start the apache2 service

systemctl enable apache2

systemctl start apache2

Now try to access your site using host name. 

Step 02: Create a Custom Page

Now create a virtual host configuration file with your custom website in below location.

<VirtualHost *:80>

        ServerName <Your-Site>

        ServerAlias <Your-Site>

        DocumentRoot /var/www/html/my-site

        ErrorLog ${APACHE_LOG_DIR}/vidu-test-error.log

        CustomLog ${APACHE_LOG_DIR}/vidu-test-access.log combined

</VirtualHost>

Create "DocumentRoot" folder and create simple index.html file.

Include that config file to site-enable folder.

Now restart the apache service and check.

Step 03: Obtain Letsencrypt Certificate

Enable "add-apt-repository universe" repo.

Now install "certbot"

Execute below command to obtain certificates.

certbot certonly --webroot --webroot-path /var/www/html/my-site -d <Your-Site> -m <Your-Email>

Step 04: Make your Site Secure

Now enable SSL module for apache. Execute below command to do this. You have to restart the apache service to apply the changes. 

Now open virtual host configuration file you created before and and add another virtual host configuration block as follow.

You have to include certificated files you obtained from letsencrypt.

<VirtualHost *:443>

        ServerName <Your-Site>

        ServerAlias <Your-Site>

        DocumentRoot /var/www/html/my-site

        SSLEngine on

        SSLCertificateFile /etc/letsencrypt/live/vidu-test.ddns.net/fullchain.pem

        SSLCertificateKeyFile /etc/letsencrypt/live/vidu-test.ddns.net/privkey.pem

        ErrorLog ${APACHE_LOG_DIR}/ssl-vidu-test-error.log

        CustomLog ${APACHE_LOG_DIR}/ssl-vidu-test-access.log combined

</VirtualHost>

Restart the apache service to apply the changers.

systemctl restart apache2

Now its time to brows your site with https. 

Check your web site with SSL-LAB

You can add below configurations for your conf file to achieve "A" Grade.

To achieve, you have to disable insecure SSL cipher suit and insecure SSL protocols 

SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA"

SSLProtocol -all +TLSv1.3 +TLSv1.2

SSLHonorCipherOrder On

SSLCompression off

Now you are one more step behind to achieve "A+" grade.

To do that you have to enable "mod_header" module in apache. You can include that module by executing this command.

Goto "/etc/apache2/mods-enabled" folder and create a symlink to "headers.load".

ln -s ../mods-available/headers.load headers.load

Now include below headers to conf file. 

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

Header always set X-Frame-Options DENY

Header always set X-Content-Type-Options nosniff

After adding all the configurations.

<VirtualHost *:80>

        ServerName vidu-test.ddns.net

        ServerAlias vidu-test.ddns.net

        DocumentRoot /var/www/html/my-site

        ErrorLog ${APACHE_LOG_DIR}/vidu-test-error.log

        CustomLog ${APACHE_LOG_DIR}/vidu-test-access.log combined

</VirtualHost>

<VirtualHost *:443>

        ServerName vidu-test.ddns.net

        ServerAlias vidu-test.ddns.net

        DocumentRoot /var/www/html/my-site

        SSLEngine on

        SSLCertificateFile /etc/letsencrypt/live/vidu-test.ddns.net/fullchain.pem

        SSLCertificateKeyFile /etc/letsencrypt/live/vidu-test.ddns.net/privkey.pem

        SSLCipherSuite "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA"

        SSLProtocol -all +TLSv1.3 +TLSv1.2

        SSLHonorCipherOrder On

        SSLCompression off

        Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"

        Header always set X-Frame-Options DENY

        Header always set X-Content-Type-Options nosniff

        ErrorLog ${APACHE_LOG_DIR}/ssl-vidu-test-error.log

        CustomLog ${APACHE_LOG_DIR}/ssl-vidu-test-access.log combined

</VirtualHost>

Now restart the apahe service and check your site from SSL Lab.

NGINX with Letsencrypt

 

Let's Encrypt is a non-profit certificate authority run by Internet Security Research Group (ISRG) that provides X.509 certificates for Transport Layer Security (TLS) encryption at no charge. It launched on April 12, 2016.

Let's Encrypt certificates are valid for 90 days, during which renewal can take place at any time. The offer is accompanied by an automated process designed to overcome manual creation, validation, signing, installation, and renewal of certificates for secure websites. The project claims its goal is to make encrypted connections to World Wide Web servers ubiquitous.[6] By eliminating payment, web server configuration, validation email management and certificate renewal tasks, it is meant to significantly lower the complexity of setting up and maintaining TLS encryption.[1]

[1] Wikipedia

Prerequisite

• Linux server with nginx installed (Port 80 and 443 should open for public)
• There should be a DNS entry for your site.
• "git" "wget" packages should install in your server.

In this example I am using CentOS 8

Step 01: Install Prerequisite

Install git and wget

yum install git wget

Step 02: Install NGINX

Download the nginx RPM from nginx official site base on your operation system and install.

NGINX Official Site: https://nginx.org/packages/

Install the nginx RPM

rpm -ivh nginx-1.18.0-2.el8.ngx.x86_64.rpm

Enable the nginx service and start

systemctl enable nginx

systemctl start nginx

Now try to access your site using host name. 

Step 03: Install letsencrypt

Clone the "letsencrypt" from GitHub

git clone https://github.com/letsencrypt/letsencrypt

Go inside the letsencrypt folder and execute this command.

./letsencrypt-auto certonly --webroot --webroot-path /usr/share/nginx/html/ --email <your-email-address> -d <your-site-name>

This will take some time to do the installation. 

Finally you will get a output like this.

Step 04: Configure NGINX for HTTPS

Got to nginx configuration folder "/etc/nginx/conf.d"

Create a new .conf file and add below content.

server {

    listen 443 ssl;

    server_name <Your-Site-Name>;

    ssl_certificate             /etc/letsencrypt/live/<Your-Site-Name>/fullchain.pem;

    ssl_certificate_key         /etc/letsencrypt/live/<Your-Site-Name>/privkey.pem;

    ssl_session_cache shared:SSL:10m;

    ssl_session_timeout  5m;

    ssl_protocols   TLSv1.2;

    ssl_ciphers  ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!eNULL:!MD5:!DSS;

    ssl_prefer_server_ciphers   on;

    # HSTS

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    access_log /var/log/nginx/<Your-Site-Name>-access main;

    error_log  /var/log/nginx/<Your-Site-Name>-error warn;

    location / {

        root /usr/share/nginx/html;

    }

    location /.well-known/acme-challenge/ {

        root   /usr/share/nginx/html;

    }

}

server {

    listen 80;

    server_name <Your-Site-Name>;

    rewrite     ^ https://<Your-Site-Name>$request_uri? permanent;

}

Include new .conf file to nginx.conf 

Now check the nginx config test by typing below command.

nginx -t

Now restart the nginx service

Now browse your site with https and check whether you are getting "letsencrypt" certificate.

Check your site with sslshopper and ssllabs to verify it further.

Sslshopper: https://www.sslshopper.com/ssl-checker.html

Ssllabs : https://www.ssllabs.com/ssltest/

Since letsencrypt certificate only valid for 3 month we have to put schedule job to renew. You can add these two lines to crontab.

00 00 * * * /root/letsencrypt/certbot-auto renew

00 01 * * * /bin/systemctl reload nginx

Docker Swarm With Multi Master

 

Please go through the "Docker Swarm Single Master" configuration if you are new to this concept.

URL: https://sltechgeekx.blogspot.com/2020/07/docker-swarm.html

Docker Swarm With Multi-Master 

If the swarm loses the quorum of managers, the swarm cannot perform management tasks. If your swarm has multiple managers, always have more than two. To maintain quorum, a majority of managers must be available. An odd number of managers is recommended, because the next even number does not make the quorum easier to keep. For instance, whether you have 3 or 4 managers, you can still only lose 1 manager and maintain the quorum. If you have 5 or 6 managers, you can still only lose two.

Even if a swarm loses the quorum of managers, swarm tasks on existing worker nodes continue to run. However, swarm nodes cannot be added, updated, or removed, and new or existing tasks cannot be started, stopped, moved, or updated.

You should maintain an odd number of managers in the swarm to support manager node failures.

Configurations

In this example we need 5 servers.

Manager Node --> 3

Worker Node --> 2

Manager-1 --> 192.168.1.131

Manager-2 --> 192.168.1.132

Manager-3 --> 192.168.1.133

Worker-1 --> 192.168.1.134

Worker-2 --> 192.168.1.135

Step 1

Install and enable docker service in each servers

yum install docker-ce docker-ce-cli containerd.io

systemctl enable docker

systemctl start docker

Step 2

Configure docker swarm in manager-1 node

docker swarm init --advertise-addr 192.168.1.131

Step 3

Add Worker Node to docker swarm. You will get join token for worker nodes from above command.

docker swarm join --token SWMTKN-1-17drizdszlt8ftwnw4nzafrmv9h0cjp9f53dcwm10kk52baulp-44vv9fwo8upmoba3j1vxcruro 192.168.1.131:2377

Step 4

Add Manager Nodes to docker swarm

Execute below command to generate manager token

docker swarm join-token manager

Execute the join token in each manager nodes.

docker swarm join --token SWMTKN-1-17drizdszlt8ftwnw4nzafrmv9h0cjp9f53dcwm10kk52baulp-bvfss1vww7caykf6tfk23ijg9 192.168.1.131:2377

To verify the docker nodes execute below command.

docker node ls

Step 5

Create Docker Service

Here I am using nginx docker image to create docker image. Initially I am creating five docker-nginx containers and expose port 80 and 443 for out side. Also I am limit the memory and CPU for each containers.

docker service create --limit-cpu 1 --limit-memory 500MB --replicas 5 -p 80:80 -p 443:443 --hostname=docker-nginx.local --name docker-nginx nginx

To verify the docker service 

docker service ls

You can type manager IP to load the webserver default page.

http://192.168.1.131/

Checking high availability of the Docker Swarm

As pet the below image, we have 3 manager nodes and "Leader" is manager-1. 

Now we are going to shutdown the manager-1 node. 

After Shutdown the manager-1, you can verify docker swarm node status by executing below command.

Now our new leader is manager-2