Configuring apache virtual hosts for one domain and multiple IP addresses - apache

I have two apache servers at two separate IP addresses and one domain name (example.com) administer on godaddy.com. I want to use this single domain to point traffic to my two separate servers over ssl.
I set up the first server through a fios router with port forwarding and associated the public IP address with a DDNS address (xxx.ddns.net). My godaddy config looks like this:
Type Name Value
-------------------------------
A # 184.168.131.241
CNAME www xxx.ddns.net
Forwarding
------------
domain https://www.example.com
... and my apache ssl.conf file looks like this:
<VirtualHost *:443>
...
ServerName www.example.com
DocumentRoot /var/www/html
</VirtualHost>
This works fine, but now I want to set up a subdomain ('mysub') so that traffic directed to mysub.example.com gets handled by my second server available at a separate IP address (MY.2ND.IP.ADDR). I've tried all sorts of settings on godaddy and in the ssl.conf file, but to no avail. In particular, I've tried:
Setting godaddy so that traffic sent to subdomain mysub.example.com is redirected straight to MY.2ND.IP.ADDR; it's not at all clear to me if this is possible. (Godaddy has a form under the title "Forwarding" and a subsection therein called "subdomain", but setting that subdomain to mysub and setting "forward to" to http://MY.2ND.IP.ADDR doesn't seem to do anything; what is this 'subdomain' field in the godaddy interface supposed to be used for?)
Directing all traffic to the first server, and configuring apache to proxy traffic for the subdomain on to the second server.
I've tried adding another virtual host element to ssl.conf like so:
<VirtualHost MY.2ND.IP.ADDR:443>
ServerName mysub.example.com
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location />
ProxyPass http://MY.2ND.IP.ADDR
ProxyPassReverse http://MY.2ND.IP.ADDR
</Location>
</VirtualHost>
... but this doesn't work either.
In summary, what is the best way to direct traffic for a subdomain to a separate IP address using godaddy and/or apache configurations?

Related

Apache virtualhost with a domain

I have an apache server with a bought domain.
I want to know if it is possible to redirect some web pages... For example
I have a NextCloud Server that I want to access by www.example.com/nextcloud
And a plex server I want to access by www.example.com/plex
PD: I don't have the possibilities of subdomains like www.plex.example.com because I didn't hire it when I bought the domain
Is this possible? How do I need to configure apache virtualhost? Thanks!
You mention that you want to access by www.example.com/nextcloud and by www.example.com/plex. I will therefore take for granted that you do not want the site address to change in your client's browser. So no redirection here. Redirection would change the address bar value.
Then the option you want is a reverse proxy. It will "hide" the fact that the client is being served pages by another site or application.
Assumptions:
You have system 1 with an Apache server that responds to http://www.example.com
You have system 2 with an application that responds to http://www.domain1.com/nextcloud.
You have system 3 with an a plex application that reponds to http://www.domain2.com/plex
Therefore on system 1, in the configuration file for your Apache (most probably httpd.conf), you will:
load the proxy modules
add these lines in your <VirtualHost>:
<VirtualHost *:80>
ServerName www.example.com
ServerAlias example.com
[... SOME OTHER CONFIG ...]
ProxyPass "/nextcloud" "http://www.domain1.com/nextcloud"
ProxyPassReverse "/nextcloud" "http://www.domain1.com/nextcloud"
ProxyPass "/plex "http://www.domain2.com/plex"
ProxyPassReverse "/plex" "http://www.domain2.com/plex"
[... SOME OTHER CONFIG ...]
</VirtualHost>
Now domain1.com and domain2.com can be IP addresses, but using dns is so much better for flexibility. Adjust this sample as required.
Complete mod_proxy documentation: https://httpd.apache.org/docs/2.4/mod/mod_proxy.html

Apache same domain multi virtual host

I'm currently trying to set my Apache configuration.
I have one IP (ex: 10.10.10.10) and one domain (ex: www.mydomain.com).
This server is currently hosting 2 sites and each site has his own Apache Instance with his own conf and php.ini :
/appli/projects/project1/apache_2.4/conf/project1.conf => Site 1
/appli/projects/project2/apache_2.4/conf/project2.conf => Site 2
project1.conf is set like that (same with 443 for SSL) :
<VirtualHost 10.10.10.10:80>
DocumentRoot /appli/projects/project1/apache_2.4/htdocs/project1folder/
ServerName mydomain.com
</virtualHost>
project2.conf is set like that (same with 453 for SSL) :
<VirtualHost 10.10.10.10:90>
DocumentRoot /appli/projects/project2/apache_2.4/htdocs/project2folder/
ServerName mydomain.com
</virtualHost>
So when I am connecting to "mydomain.com" I am going to "Site 1" but I have to hit mydomain.com:453 for accessing to "Site 2" which is not really good...
I would like to have something like that :
mydomain.com/site1 => "Site 1" (or site1.mydomain.com)
mydomain.com/site2 => "Site 2" (or site2.mydomain.com)
And I would like to keep the mydomain.com hitting the "Site 1".
Unfortunatly, because each site has his own instance of Apache, I have no idea how to set them.
Last but not the Least I would like to know if it's possible to share PHP (Apache) SESSION accross the multi Apache Instance or if I have to use COOKIES accross the domain to share informations between sites.
I don't know if it's really clear, just ask if you need more informations.
Thanks you in advance.
My recommendation is this:
File structure:
htdocs/
site1
...files...
site2
...files...
Apache vhost:
<VirtualHost 10.10.10.10:80>
DocumentRoot /appli/projects/project1/apache_2.4/htdocs/
ServerName example.com
</virtualHost>
...and then do the same thing for the SSL-vhost.
Now you can use http://example.com/site1 and http://example.com/site2 and the same for https.
If you start using different ports (anything other than the defaults 80 and 443, you need to explicitly write the port names to be able to access the sites, or set up a reverse proxy (adds extra complexity with no real gain).
You can even define specific rules for site1 and site2 in your vhost.
Config per site:
<VirtualHost 10.10.10.10:80>
DocumentRoot /appli/projects/project1/apache_2.4/htdocs/
ServerName example.com
<Directory /appli/projects/project1/apache_2.4/htdocs/site1/>
# Some specific vhost config...
</Directory>
<Directory /appli/projects/project1/apache_2.4/htdocs/site2/>
# Some specific vhost config...
</Directory>
</virtualHost>
If you want different sub domains like: site1.example.com and site2.example.com, then just do different vhosts that point to the folders directly, still using port 80 for http and port 443 for https.
Just remember that you then need to have a multi-domain-certificate or a wildcard certificate for https (since they are two different hostnames). Or you could install Let's Encrypt.

How to protect my server from false proxy requests

I have a website, call it
http://www.example.com
Users create a site for themselves and they each get a sub-domain automatically, so something like
http://user1.example.com
http://user2.example.com
In addition, some users can use their own domain name, by creating a A-Record in their domain name DNS setup to point to my server's IP address.
http://www.myownname.com > 10.10.10.10 (my site's server IP address)
In my Apache VirtualHost, it's set up as follows
<VirtualHost 10.10.10.10:80>
ServerName www.example.com
ServerAlias *
UseCanonicalName Off
DirectoryIndex index.php index.html
DocumentRoot /home/public/
<Directory /home/public/>
Require all granted
Allowoverride ALL
</Directory>
</VirtualHost>
Line "ServerAlias *" is there so that I can catch any domain name pointing to my IP address and then handle it via my site.
Everything is working well up to this point.
Now, recently, I've checked my Apache access log and I see strange access such as follows
10.10.10.10 - - [25/Jul/2014:12:48:04 -0700] "GET http://www.some-random-site.com/ HTTP/1.0" 200 1456
It looks like someone is trying to use my server as a proxy to access other sites. I've read quite a few pages in order to block this proxy requests (e.g. https://wiki.apache.org/httpd/ProxyAbuse)
For example, if I use "default virtual host" to block everything except what's specified in my virtual host, all the custom domain names pointing to my server's IP address doesn't work anymore. But it does block the proxy requests.
How can I block proxy requests, while still being able to allow custom domain names via A-Record (or CNAME) pointing to my IP address?

Apache reverse proxy, one server, multiple domains

I am trying to manage 2 domains with one server (running proxmox with several CT), I am using reverse proxy but seems to be wrong.. here's my configuration:
Let's say we have the main server running proxmox where I managed IPTables to redirect port 80 to the port 80 of my first container (CT01) and port 8109 to port 80 of my second container (CT02).
While using the port in my browser, everything is working well, and I am able to reach each container.
I bought 2 domain names, one for my private server (CT01) and another one for a business server (CT02). I associated both of the domain to my server address, and while typing one or another of them I am redirected to CT01 (normal, browser is running the address to the default port).
So now I tried to use reverse proxy in order to redirect to the desired server (DomainA -> CT01, DomainB -> CT02), I created 2 files in /var/apache2/sites-available/ :
/var/apache2/sites-available/domainA.com:
<VirtualHost *:80>
ServerName domainA.com
DocumentRoot /var/www/
</VirtualHost>
/var/apache2/sites-available/domainB.com:
<VirtualHost *:80>
ServerName domainB.com
ProxyPreserveHost On
ProxyRequests On
ProxyPass / http://x.y.z.h:8109/
ProxyPassReverse / http://x.y.z.h:8109/
<Location />
Order allow,deny
Allow from all
</Location>
</VirtualHost>
Then I runned a2ensite domainA.com and a2ensite domainB.com. I restarted my apache service.
But nothing have changed: both my domainA and domainB redirect me to the same container (CT01).
Any idea?
What i may suggest is doing a new CT just to host a proxy (nginx for example) that will route the requests to one or the other site depending of the Host: field value of the HTTP request. This may be a little bit overkill if it's just for two sites, but when you want to have more, it can be very useful. Plus the NGinx can be used to cache, etc.
Let me know if you are interested. I know a tutorial that you may follow, but it's in french : http://blog.ganbaranai.fr/2013/08/il-etait-une-fois-proxmox-derriere-une-ip-unique/
Hope it helps.
Regards,

Why should we create A DNS record for subdomains when we can do it via httpd.conf?

I want to implement a blog in my site with usernames as subdomains like user1.domain.com.
I've read bunch of articles that was mentioned to create an A record like below in DNS:
*.domain.com A 127.0.0.1 ;OR you site ip address
Then use .htaccess to redirect requests from subdomains to a folder in your server.
But I find another approach that was said to just modify your httpd.conf as below:
<VirtualHost *:80>
DocumentRoot /abs/path/to/webroot
ServerName domainname.com
ServerAlias *.domainname.com
<Directory /abs/path/to/webroot>
AllowOverride All
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
Then retrieve subdomains via $_SERVER['HTTP_HOST'].
The question is why should someone use htaccess and put pressure on apache and create A DNS record when we can do a simple thing like ServerAlias *.domainname.com in httpd.conf?
I appreciate in advance for your views.
You need to setup both a wildcard DNS record and configure a server alias in httpd.conf to enable the hosting of arbitrary sub domains. They configure completely different things.
Add the wildcard DNS records is what allows clients to determine the IP address of your sub domain. With the wildcard DNS record about user1.domain.com will resolve to 127.0.0.1. If you do not have a DNS record no user1.domain.com will not be a valid name and it will not resolve to an IP address. the DNS record is to allow clients to connect to your server.
The httpd.conf configuration is local to your Apache server. It does not affect clients. The line ServerAlias *.domainname.com will configure Apache to tell it to process the arbitrary sub domains. Client's will not be directly affected by this setting.
You have added the ServerAlias, but for your computer to find that user1.domain.com and user2.domain.com should resolve to 127.0.0.1, you need to update your HOSTS file or DNS Table.
The configuration you have written is for Apache Server for handling the redirects when the user requests the domain. So, essentially, either you need a Dynamic HOSTS file or a service which resolves *.domain.com to your 127.0.0.1 server.
Hope this helps. :)