Dedicated Port for EasyEngine Admin Tools

[rahul286]

As of now, we are using rewrites for path /ee which is:

1. inefficient
2. might conflict with actual page/content if that decide to use /ee
3. hard to separate away from user-space

Lets go with a dedicated port e.g. 12345 (not sure which port number will make up for a good choice)

Dedicated port will remove dependency for a server_name or path and we can simply listen on that port for all domains. Plus we can use iptables to restrict traffic to that port (added layer of security).

• Decide a port number
• Code changes to make use of new port!
• Add self signed SSL for new port

[rahul286]

Let's use port no: 22222 for now. This is currently unassigned port so chances of conflicts will be very less.

[rahul286]

Rough config:

We can put following in: /etc/nginx/conf.d/eeadmin.conf

server {
    listen 90
    listen 22222 ssl default_server;
        server_name _;

    access_log   /var/log/nginx/eeadmin.access.log;
    error_log    /var/log/nginx/eeadmin.error.log;

        root /var/www/eeadmin/htdocs;
        root /var/www/eeadmin/htdocs;

        index index.php;

        location / {
        satisfy any;
                try_files $uri $uri/ /index.php?$args; 
        }

        location ~ \.php$ {
                try_files $uri =404;
                include fastcgi_params;
                fastcgi_pass unix:/var/run/php5-fpm.sock;
        }
}

For SSL, we can use self-signed certficate. An admin will obviously ignore browser warning.

We will NOT force SSL. Port 22222 will be accessible over both.

[MiteshShah]

Step One—Create a Directory for the Certificate

mkdir /etc/nginx/ssl
cd /etc/nginx/ssl

Step Two—Create the Server Key and Certificate Signing Request

openssl genrsa -out eeadmin.key 2048
openssl req -new -key eeadmin.key -out eeadmin.csr

This command will prompt terminal to display a lists of fields that need to be filled in.

The most important line is "Common Name". Enter your official domain name here or, if you don't have one yet, your site's IP address. Leave the challenge password and optional company name blank.

NOTE:

We need to automate this things

Step Three—Remove the Passphrase We are almost finished creating the certificate.

However, it would serve us to remove the passphrase. Although having the passphrase in place does provide heightened security, the issue starts when one tries to reload nginx. In the event that nginx crashes or needs to reboot, you will always have to re-enter your passphrase to get your entire web server back online.

Use this command to remove the password:

mv eeadmin.key eeadmin.key.org
openssl rsa -in eeadmin.key.org -out eeadmin.key

Step Four— Sign your SSL Certificate

openssl x509 -req -days 3652 -in eeadmin.csr -signkey eeadmin.key -out eeadmin.crt

Step Five—Set Up the Certificate

server {

        listen 22222 ssl;
        server_name _;

        access_log   /var/log/nginx/eeadmin.access.log rt_cache;
        error_log    /var/log/nginx/eeadmin.error.log;

        ssl_certificate /etc/nginx/ssl/eeadmin.crt;
        ssl_certificate_key /etc/nginx/ssl/eeadmin.key;

        root /var/www/eeadmin/htdocs;
        index index.php index.htm index.html;

        location / {
                autoindex on;
                include common/acl.conf;
                try_files $uri $uri/ /index.php?$args;
        }

        location ~ \.php$ {
                try_files $uri =404;
                include fastcgi_params;
                fastcgi_pass php;
        }

}

Ref: https://www.digitalocean.com/community/articles/how-to-create-a-ssl-certificate-on-nginx-for-ubuntu-12-04

[MiteshShah]

CSR Automation

openssl req -new -batch -subj /C=IN/ST=Maharashtra/O="rtCamp Solutions Pvt. Ltd."/localityName=Pune/commonName=127.0.0.1/organizationalUnitName=EasyEngine/emailAddress=$(git config user.email)/ -key eeadmin.key -out eeadmin.csr