Project 3

HyperText Transfer Protocol Apache2

Table of Contents

1. Project description
2. Part I : Apache2 server configuration
   • Install the Apache2 server
   • Verify the configuration files and identify the role of each file:
   • apache2.conf, envvars, ports.conf, conf.d, sites-available, sites-enabled, mods-available and mods-enabled
   • Website configuration.
3. Part II: HTTP and DNS
   • Reconfigure the zone-files (DNS)
   • Test the access (addr/ns)
4. Part III: Secure a repository
   • Access filtering at user's level
   • Modification the configuration
   • Create accounts (Apache provides a tool to easily generate encrypted passwords)
   • Create a password for the admin account
   • Verify the encrypting of the username and the password
   • Test the access to the website, what do you notice?
   • Check if the password is encrypted at the level of transfer from the client to the server
   • What is the solution?
5. Part IV: Configuration with .htaccess
   • Configure Apache with .htaccess.
   • Authorize the modification
   • Create a file named “.htaccess” in/var/www/mywebsite2/.
   • Configure the .htaccess.
   • Create the digest-users file.
   • Check if the password is encrypted
6. Part V: Personal Directories
   • Create a user
   • Each user must have a “public_html” folder in their home directory

Project description:

Apache is an open-source web server that powers a large number of websites around the world. Its official name is Apache HTTP Server and it is maintained and developed by the Apache Software Foundation.

Apache allows website owners to provide content on the web, hence the name “web server”. It is one of the oldest and most reliable web servers with a first version released over 25 years ago, in 1995.

When a user wants to visit a website, they type a domain name (or IP address) in the browser’s bar. Then the web server delivers the requested files by acting as a virtual delivery agent.

Part-I

Installation

sudo apt install apache2 -y

That’s it, Apache is installed in your Kali Linux now you have to start the service using this command:

sudo service apache2 start

Now you can check the status of the Apache service using this command:

sudo service apache2 status

verification-the-configuration-files

To verify that apache server working correctly in Kali Linux, open your browser, type your server IP address or domain name http://YOUR_IP_OR_DOMAIN/ and you will see the default Apache welcome page as shown below:

role-of-each-file

In Kali Linux, the Apache configuration files are stored in the /etc/apache2 directory:

apache configuration files

Here is a brief description of the files in this directory:

• apache2.conf : the main Apache2 configuration file that contains settings global to Apache.

• envvars : a file where Apache environment variables are set.

• ports.conf : a configuration file that houses the directives that determine the TCP ports Apache is listening on.

• conf.d : This directory is used for controlling specific aspects of the Apache configuration. For example, it is often used to define SSL configuration and default security choices.

• sites-available : a directory that has configuration files for Apache Virtual Hosts. Virtual Hosts allow Apache2 to be configured for multiple sites that have separate configurations.

• sites-enabled : a directory that contains symlinks to the /etc/apache2/sites-available directory.

• mods-available : a directory that contains configuration files to both load modules and configure them.

• mods-enabled : a directory that holds symlinks to the files in /etc/apache2/mods-available.

Website-configuration

The first thing we're going to do is create two directories (mywebsite1 and mywebsite2) with the command:

sudo mkdir  /var/www/mywebsite1

sudo mkdir  /var/www/mywebsite2

Then we're going to create two pages in each directory (index.html) with the command:

sudo nano  /var/www/mywebsite1/html.index

sudo nano  /var/www/mywebsite2/html.index

Note : we're going to focus on the first page only in the rest of the project

After that we create the conf-file (mywebsite1.conf)

Where we put our settings for the good fonctionality of the manipulated website

And then we avtivate the vhost :

sudo a2ensite mywebsite1.conf

Wich create a symlink from site-available to site-enabled

In order to update the new configuration we simply reload the service :

sudo systemctl reload apache2

And finally we're going to test our conf :

(back to top)

Part-II

Registration-of-the-website-in-zone-files-of-the-DNS

We added new records for the website :

dir_resol	rev_resol

Testing-the-access-by-ADDR-&-NS

by NS	by ADDR

(back to top)

Part-III

Access-filtering-at-users-level

Modification-the-configuration

Create-accounts

Create-a-password-for-the-admin-account

We are going to create the .htpasswd file with a new user (oussama)

sudo htpasswd -c /etc/apache2/.htpasswd oussama

Then we will be asked to supply and confirm a password for that user.

Verify-the-encrypting-of-the-username-and-the-password

(back to top)

Test-the-access-to-the-website

Now the access is restricted :

If you do a mistake while typing your username and pass :

But if you got it right you will have access to the page

Check-if-the-password-is-encrypted

We're going to ckeck if the password is encrypted at the level of transer : (using wireshark)

What-is-the-solution

Well, the solution is simply to find another way of authentification, that makes sure that the password is encrypted at the level of transfer.

(back to top)

Part-IV

The .htaccess files are Apache configuration files, allowing to define rules in a directory and in all its subdirectories (which do not have such a file inside). They can be used to protect a directory with a password, to change the name or extension of the index page, or to prohibit access to the directory.

The .htaccess file is placed in the directory in which it must act. It thus acts on the permissions of the directory that contains it and of all its sub-directories. Another .htaccess file can be placed in a subdirectory of a directory already controlled by an .htaccess file. The .htaccess file in the parent directory remains in “activity” until the functionality is rewritten.

Configure-Apache-with__htaccess

Authorize-the-modification

By default, the .htaccess file is not enabled.

1. Open the default host configuration file by entering the following command in the terminal:

sudo nano /etc/apache2/sites-available/mywebsite1.conf

2. Locate the section labeled <Directory /var/www>. In that section, change the AllowOverride None entry to all: AllowOverride All

3. Next, restart the Apache service:

sudo systemctl apache2 restart

Create-a-file-named-htaccess

To create and open the .htaccess file for editing, enter:

sudo nano /var/www/mywebsite1.com/.htaccess

Configure-the-htaccess

Create-the-digest_users-file

For digest authentication we need to use a utility called htdigest, unlike with basic authentication where we used htpasswd. The application takes the file name, private and ataman as arguments, then prompts twice for the user’s password. The flag -c creates a new file, it overrides the existing one if exists.

htdigest -c /etc/apache2/.htpasswd private ataman

Command to see Apache password file:

sudo nano /etc/apache2/.htpasswd 

Check-if-the-password-is-encrypted

login	wireshark

(back to top)

Part-V

Create-a-user

Each-user-must-have-a--public_html--folder-in-their-home-directory

(back to top)

Out Team - AIT EL KADI Ilyas - AZIZ Oussama

Project Link: https://github.com/IlyasKadi/Domain-Name-System-Protocol

(back to top)