Leopard Server Install

From cosign wiki

Revision as of 15:39, 30 March 2009

Changes from before that I got hung up on:

• Web directory changed from /etc/httpd to /etc/apache2
• Edits made Mar 09 to reflect what to do with the signed certificate and instructions to update the umwebCA.pem file

Generate Certificate Signing Request (optional)

Depending on your environment, you may need to generate a Certificate Signing Request (CSR) to get a certificate for your HTTPS and cosign installation.

• In Server Admin, select the hostname of the server
• Click the Certificates tab
• Click the + button

Common Name: [Host name of server]
Org: [Your Organization, e.g., University of Insightful Examples]
OU: [Organization Unit, e.g., ALAS IT]
City: [Your city]
State: [Your State]
(leave the others as defaults)

• Click Save
• Select the cert you just created
• Under the gearwheel menu, choose Generate CSR
• Submit your CSR to your certificate provider

When you get the signed certificate back from your certificate provider, return to Server Admin and:

• Select the self-signed cert in Server Admin you created earlier
• Under the gearwheel menu, choose 'Add Signed or Renewed Certificate from Certificate Authority' and add the signed certificate you received.

Create and Edit the Cosign Configuration

In the Terminal:

bash$ sudo -s
Password:
root# mkdir /etc/apache2/cosign

In a good editor, like vi or BBEdit, both of which can be used to edit files owned by root, open /etc/apache2/cosign/site_conf, copying and pasting the configuration lines below. Your weblogin administrators will be able to provide you with the actual values you should use. Have those values in hand as you edit the site_conf file.

CosignHostname weblogin.example.edu
CosignRedirect https://weblogin.example.edu/
CosignPostErrorRedirect http://weblogin.example.edu/post_error.html
CosignService some-service.example.edu
CosignCrypto /etc/certificates/some-service.example.edu.crtkey /etc/certificates/some-service.example.edu.crtkey   /etc/certificates/CAcerts

# uncomment this line if your site allows access over HTTP.
# note: CosignHttpOnly means that anyone can sniff and
# steal your service cookie, making it trivial to pose as
# different users of your service.
#
#CosignHttpOnly on
<Location />
CosignProtected on
</Location>
<Location /unprotected>
CosignProtected off
</Location>

• Edit your virtual host configuration in /etc/apache2/sites. Add this line to your site, anywhere inside the <VirtualHost> block:

Include "/etc/apache2/cosign/site_conf"

In Server Admin, start the Web Service

• Click the Sites button, and select the default site (*)
• On the Options tab, allow 'CGI Execution' if you intend to offer CGI support on your site.
• Select the Logging tab to configure log rotation and archiving.
• Click Save