Configurazione tipo per un reverse proxy SSL basato su Gentoo Linux e apache2
TimeOut 30 SetOutputFilter DEFLATE AddOutputFilterByType INCLUDES application/pdf AddEncoding x-gzip .gz AddType application/x-javascript .gz AddType application/javascript .gz BrowserMatch Firefox/1\.0\.[0-9] no-gzip # Netscape 4.x has some problems... BrowserMatch ^Mozilla/4 gzip-only-text/html # Netscape 4.06-4.08 have some more problems BrowserMatch ^Mozilla/4\.0[678] no-gzip # MSIE masquerades as Netscape, but it is fine BrowserMatch \bMSIE !no-gzip !gzip-only-text/html BrowserMatch "MSIE 6" no-gzip gzip-only-text/html SetEnvIfNoCase Request_URI \.(gif|jpg|jpeg|png)$ no-gzip dont-vary SetEnvIfNoCase Request_URI \.(htm|html|js|jsp|asp|php|do)$ !no-gzip SetEnvIfNoCase Request_URI \.(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary SetEnvIfNoCase Request_URI \.pdf$ no-gzip dont-vary SetEnvIfNoCase Request_URI \.(gif|jpg|jpeg|png)$ no-gzip dont-vary SetEnvIfNoCase Request_URI \.(htm|html|js|jsp|asp|php|do)$ !no-gzip SetEnvIfNoCase Request_URI \.(?:exe|t?gz|zip|bz2|sit|rar)$ no-gzip dont-vary SetEnvIfNoCase Request_URI \.pdf$ no-gzip dont-vary Header append Vary User-Agent env=!dont-vary #SetEnvIfNoCase Request_URI \.* no-gzip dont-vary #SetEnvIfNoCase Request_URI \.jsp$ !no-gzip !dont-vary #SetEnvIfNoCase Request_URI \.htm$ !no-gzip !dont-vary #SetEnvIfNoCase Request_URI \.html$ !no-gzip !dont-vary #SetEnvIfNoCase Request_URI \.asp$ !no-gzip !dont-vary DeflateFilterNote Input instream DeflateFilterNote Output outstream DeflateFilterNote Ratio ratio DeflateWindowSize 15 DeflateMemLevel 9 DeflateCompressionLevel 9 ServerName nome_server LoadModule proxy_module modules/mod_proxy.so LoadModule ssl_module modules/mod_ssl.so SetEnvIf User-Agent ".*MSIE.*" ssl-unclean-shutdown SSLSessionCache shm:/var/cache/apache2/ssl_scache(4096000) SSLSessionCacheTimeout 600 LogLevel error ErrorLog /var/log/apache2/ssl_error_log Listen 80 Options -All -Multiviews AllowOverride None Order allow,deny Allow from all DocumentRoot /home/domini-web/locale/www # ServerName nome_server # ServerAlias alias_server DirectoryIndex index.shtml index.php index.php3 index.html ScriptAlias /cgi-bin/ /home/domini-web/locale/cgi-bin/ CustomLog /var/log/apache2/access_log combined AddHandler server-parsed shtml Options +Includes Options -Indexes -All -Multiviews +Includes AllowOverride None Order allow,deny Allow from all Include /etc/apache2/conf/*.conf
/etc/apache2/conf/server_A.conf
Listen 400
#
RewriteEngine on
#RewriteCond %{REQUEST_URI} !^/galileo/public/
#RewriteCond %{REQUEST_URI} !^/galileo/
#RewriteRule / /galileo/public/menu.faces [R,L]
# direttive proxypass ------------------------------------------
ProxyPass / http://X.X.X.X:8888/ retry=0 ttl=120 timeout=120
ProxyPassReverse / http://X.X.X.X:8888/
# autenticazione server ------------------------------------------
SSLEngine On
#128bit
SSLCipherSuite RC4-SHA:RC4-MD5:HIGH:MEDIUM:!ADH:!DSS:!SSLv2:+3DES
SSLHonorCipherOrder on
# 40 bit
#SSLCipherSuite ALL:!ADH:!EXPORT56:!EXPORT40:!SSLv2:!LOW
SSLCertificateFile /etc/apache2/ssl/server.crt
#SSLCertificateChainFile /etc/apache2/ssl/cert-new.verisign.pem
#SSLCertificateChainFile /etc/apache2/ssl/cert.verisign.pem
SSLCertificateChainFile /etc/apache2/ssl/intermediate_good.crt
SSLCertificateKeyFile /etc/apache2/ssl/server.nopassword.key
# autenticazione client ------------------------------------------
# accesso permesso solo in presenza di comunicazione almeno a 128bit
ErrorDocument 403 http://www.tuo_sito.it/
ErrorDocument 404 http://www.tuo_sito.it/
#SSLCACertificateFile /etc/apache2/ssl/client/CAcert.chain
#SSLCARevocationFile /etc/apache2/ssl/crl.pem
#SSLVerifyClient none
#SSLVerifyDepth 10
#SSLOptions +StdEnvVars
ServerName www.tuo_sito.it
#ServerAlias Y.Y.Y.Y
ProxyRequests on
ProxyVia on
AddOutputFilterByType SUBSTITUTE text/html
#Eventuale sostituzione del testo proxato
#Substitute "s|test_da_sostituire|vuoto|i"
# eventuale log verso syslog esterno
#CustomLog "|/usr/bin/logger -t reverseproxy -n syslog " combined
Ulteriori personalizzazioni possono essere inserite riguardi a questi tre moduli:
mod_evasive
mod_cband
mod_security
