Por Félix Molinuevo, FMSI Sistemas de Informática

Con este método, se puede configurar Apache para almacenar todos los vhosts que se desee, trabajando al principio, mientras que para cada vhost nuevo sólo se debe crear un link simbólico. Asimismo, se realizará la configuración necesaria para que funcione con HTTPS también; para ello, se debe instalar OpenSSL previamente.

Nota: esta configuración considera que la distribución instalada es Debian GNU/Linux, pero cambiando algunas rutas y cosas menores, se puede usar obviamente para cualquier Linux.

1. Crear tres directorios:

   mkdir /var/www/{sites,www-virtuales,www-virtualesssl}

2. Asignar el dueño y los permisos correctos:

   chown www-data: /var/www/*
   chmod 750 /var/www/*

3. Modificar el archivo /etc/apache2/ports.conf asegurándose que se encuentre lo siguiente:

   Listen 80
   Listen 443

4. Configurar un certificado para Apache siguiendo, por ejemplo, el procedimiento descrito aquí.
5. Asegurarse que Apache tenga activado el módulo SSL y el módulo de vhosts:

   a2enmod ssl
   a2enmod vhost_alias

6. Crear un archivo llamado “dynamicvhosting” en /etc/apache2/sites-available con el siguiente contenido, y cambiar cualquier cosa que se necesite según requerimientos:

   # $Header: /home/cvsroot/gentoo-x86/net-www/apache/files/conf/DynamicVhosts.conf,v 1.2 2002/05/04 23:23:01 woodchip Exp $
   
   #Simple dynamic virtual hosts
   #
   #   This extract from apache.conf implements the virtual host arrangement
   #   outlined at http://www.apache.org/docs/vhosts/mass.html, using
   #   mod_vhost_alias.
   
   # get the server name from the Host: header
   UseCanonicalName Off
   #
   # this log format can be split per-virtual-host based on the first field
   #LogFormat "%V %h %l %u %t \"%r\" %s %b" vcommon
   #CustomLog logs/access_log vcommon
   #
   # include the server name in the filenames used to satisfy requests
   #VirtualDocumentRoot /var/www/%0/docs
   #VirtualScriptAlias  /var/www/%0/cgi-bin
   #
   #   This configuration can be changed into an IP-based virtual hosting
   #   solution by just turning UseCanonicalName Off into UseCanonicalName DNS.
   #   The server name that is inserted into the filename is then derived from
   #   the IP address of the virtual host.
   
   <VirtualHost _default_:80>
       # SSLDisable
       SSLEngine off
       # this log format can be split per-virtual-host based on the first field
       # LogFormat "%V %h %l %u %t \"%r\" %s %b" vcommon
       LogFormat "%V (Intranet host: %h) %{X-Forwarded-For}i %l %u %t \"%r\" %s %b" vcommon
       CustomLog /var/log/apache2/access.log vcommon
   
       # include the server name in the filenames used to satisfy requests
       VirtualDocumentRoot /var/www/www-virtuales/%0
       VirtualScriptAlias  /var/www/www-virtuales/%0/cgi-bin
       DirectoryIndex index.php index.html index.htm default.htm
       Options FollowSymLinks MultiViews
       <Directory "/">
           AllowOverride All
       </Directory>
   
   </VirtualHost>
   
   #Listen *:443
   <VirtualHost _default_:443>
       # SSLEnable
       SSLEngine on
       # this log format can be split per-virtual-host based on the first field
       # LogFormat "%V %h %l %u %t \"%r\" %s %b" vcommon
       LogFormat "%V (Intranet host: %h) %{X-Forwarded-For}i %l %u %t \"%r\" %s %b" vcommon
       CustomLog /var/log/apache2/access.log vcommon
   
       # include the server name in the filenames used to satisfy requests
       VirtualDocumentRoot /var/www/www-virtualesssl/%0
       VirtualScriptAlias  /var/www/www-virtualesssl/%0/cgi-bin
       DirectoryIndex index.php index.html index.htm default.htm
       Options FollowSymLinks MultiViews
       <Directory "/">
       </Directory>
   
       #
       # Para SQL Ledger
       #
       ServerName ledger.dominio
       Alias /sql-ledger/ /var/www/sites/sql-ledger/
       <Directory /var/www/sites/sql-ledger>
         AllowOverride All
         AddHandler cgi-script .pl
         Options ExecCGI Includes FollowSymlinks
         Order Allow,Deny
         Allow from All
       </Directory>
   
       <Directory /var/www/sites/sql-ledger/users>
         Order Deny,Allow
         Deny from All
       </Directory>
   
   #   SSL Cipher Suite:
   #   List the ciphers that the client is permitted to negotiate.
   #   See the mod_ssl documentation for a complete list.
   SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
   
   #   Server Certificate:
   #   Point SSLCertificateFile at a PEM encoded certificate.  If
   #   the certificate is encrypted, then you will be prompted for a
   #   pass phrase.  Note that a kill -HUP will prompt again. A test
   #   certificate can be generated with `make certificate' under
   #   built time.
   #SSLCertificateFile conf/ssl/server.crt
   SSLCertificateFile /etc/apache2/ssl/server.crt
   
   #   Server Private Key:
   #   If the key is not combined with the certificate, use this
   #   directive to point at the key file.
   #SSLCertificateKeyFile conf/ssl/server.key
   SSLCertificateKeyFile /etc/apache2/ssl/server.key
   
   #   Server Certificate Chain:
   #   Point SSLCertificateChainFile at a file containing the
   #   concatenation of PEM encoded CA certificates which form the
   #   certificate chain for the server certificate. Alternatively
   #   the referenced file can be the same as SSLCertificateFile
   #   when the CA certificates are directly appended to the server
   #   certificate for convinience.
   #SSLCertificateChainFile @@ServerRoot@@/conf/ssl/ssl.crt/ca.crt
   
   #   Certificate Authority (CA):
   #   Set the CA certificate verification path where to find CA
   #   certificates for client authentication or alternatively one
   #   huge file containing all of them (file must be PEM encoded)
   #   Note: Inside SSLCACertificatePath you need hash symlinks
   #         to point to the certificate files. Use the provided
   #         Makefile to update the hash symlinks after changes.
   #SSLCACertificatePath @@ServerRoot@@/conf/ssl/ssl.crt
   #SSLCACertificateFile @@ServerRoot@@/conf/sssl/sl.crt/ca-bundle.crt
   
   #   Certificate Revocation Lists (CRL):
   #   Set the CA revocation path where to find CA CRLs for client
   #   authentication or alternatively one huge file containing all
   #   of them (file must be PEM encoded)
   #   Note: Inside SSLCARevocationPath you need hash symlinks
   #         to point to the certificate files. Use the provided
   #         Makefile to update the hash symlinks after changes.
   #SSLCARevocationPath @@ServerRoot@@/conf/ssl/ssl.crl
   #SSLCARevocationFile @@ServerRoot@@/conf/ssl/ssl.crl/ca-bundle.crl
   
   #   Client Authentication (Type):
   #   Client certificate verification type and depth.  Types are
   #   none, optional, require and optional_no_ca.  Depth is a
   #   number which specifies how deeply to verify the certificate
   #   issuer chain before deciding the certificate is not valid.
   #SSLVerifyClient require
   #SSLVerifyDepth  10
   
   #   Access Control:
   #   With SSLRequire you can do per-directory access control based
   #   on arbitrary complex boolean expressions containing server
   #   variable checks and other lookup directives.  The syntax is a
   #   mixture between C and Perl.  See the mod_ssl documentation
   #   for more details.
   #<Location />
   #SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
   #            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
   #            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
   #            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
   #            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
   #           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
   #</Location>
   
   #   SSL Engine Options:
   #   Set various options for the SSL engine.
   #   FakeBasicAuth:
   #     Translate the client X.509 into a Basic Authorisation.  This means that
   #     the standard Auth/DBMAuth methods can be used for access control.  The
   #     user name is the `one line' version of the client's X.509 certificate.
   #     Note that no password is obtained from the user. Every entry in the user
   #     file needs this password: `xxj31ZMTZzkVA'.
   #   ExportCertData:
   #     This exports two additional environment variables: SSL_CLIENT_CERT and
   #     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
   #     server (always existing) and the client (only existing when client
   #     authentication is used). This can be used to import the certificates
   #     into CGI scripts.
   #   CompatEnvVars:
   #     This exports obsolete environment variables for backward compatibility
   #     to Apache-SSL 1.x, mod_ssl 2.0.x, Sioux 1.0 and Stronghold 2.x. Use this
   #     to provide compatibility to existing CGI scripts.
   #   StrictRequire:
   #     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
   #     under a "Satisfy any" situation, i.e. when it applies access is denied
   #     and no other module can change it.
   #   OptRenegotiate:
   #     This enables optimized SSL connection renegotiation handling when SSL
   #     directives are used in per-directory context.
   #SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire
   
   #   SSL Protocol Adjustments:
   #   The safe and default but still SSL/TLS standard compliant shutdown
   #   approach is that mod_ssl sends the close notify alert but doesn't wait for
   #   the close notify alert from client. When you need a different shutdown
   #   approach you can use one of the following variables:
   #   ssl-unclean-shutdown:
   #     This forces an unclean shutdown when the connection is closed, i.e. no
   #     SSL close notify alert is send or allowed to received.  This violates
   #     the SSL/TLS standard but is needed for some brain-dead browsers. Use
   #     this when you receive I/O errors because of the standard approach where
   #     mod_ssl sends the close notify alert.
   #   ssl-accurate-shutdown:
   #     This forces an accurate shutdown when the connection is closed, i.e. a
   #     SSL close notify alert is send and mod_ssl waits for the close notify
   #     alert of the client. This is 100% SSL/TLS standard compliant, but in
   #     practice often causes hanging connections with brain-dead browsers. Use
   #     this only for browsers where you know that their SSL implementation
   #     works correctly.
   #   Notice: Most problems of broken clients are also related to the HTTP
   #   keep-alive facility, so you usually additionally want to disable
   #   keep-alive for those clients, too. Use variable "nokeepalive" for this.
   SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
   
   #   Per-Server Logging:
   #   The home of a custom SSL log file. Use this when you want a
   #   compact non-error SSL logfile on a virtual host basis.
   CustomLog /var/log/apache2/ssl_request.log \
             "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
   
   # RewriteEngine On
   # RewriteOptions inherit
   
   </VirtualHost>

7. Desactivar el archivo de configuración de sitios por defecto, y activar el nuevo recién creado:

   a2dissite default
   a2ensite dynamicvhosting

8. Reiniciar Apache

Ahora, para crear un nuevo vhost, es suficiente con el siguiente procedimiento sin que fuese necesario siquiera reiniciar Apache:

1. Crear un directorio en /var/www/sites/
2. Crear un enlace simbólico en /var/www/www-virtuales (si se desea un sitio sin SSL) o en /var/www/www-virtualesssl (si se desea un sitio con SSL) a dicho directorio, con el nombre del host, exactamente tal como se lo va a escribir en el browser. Por ejemplo:

   ln -s /var/www/sites/dokuwiki /var/www/www-virtuales/wiki.dominio.com.ar

3. Probar el nuevo sitio, accediendo con un navegador a wiki.dominio.com.ar

Nota: se puede crear un sólo directorio raíz de un sitio, y generar varios enlaces simbólicos para cada uno de los distintos nombres de host que pueda tener el sitio. Por ejemplo: www.dominio.com, dominio.com, www.dominio.com.ar, dominio.com.ar. Y también se puede tener el mismo sitio, con y sin soporte SSL, simplemente creando un enlace simbólico con el mismo nombre en /var/www/www-virtuales y otro en /var/www/www-virtualessl.

El archivo anteriormente descrito, de configuración de vhosts, posee una sección específica para SQL Ledger.

1. Para que funcione adecuadamente se debe crear otro archivo de configuración en /etc/apache2/sites-available llamado por ejemplo “sql-ledger”, y con el siguiente contenido:

   Alias /sql-ledger/ /var/www/sites/sql-ledger/
   <Directory /var/www/sites/sql-ledger>
     AllowOverride All
     AddHandler cgi-script .pl
     Options ExecCGI Includes FollowSymlinks
     Order Allow,Deny
     Allow from All
   </Directory>
   
   <Directory /var/www/sites/sql-ledger/users>
     Order Deny,Allow
     Deny from All
   </Directory>

2. Activar el sitio en Apache:

   a2ensite sql-ledger

3. Reiniciar Apache
4. Finalmente, crear un enlace simbólico tal como se explicó anteriormente

• Este documento tiene información tomada de muchos documentos, los que han sido revisados a lo largo de los años en que he ido modificando esta configuración, y de los cuales no me ha quedado registro. Sepan disculparme los respectivos autores, si he usado alguna parte o idea sin mencionarlos.