8. 付録

8.1. Apache HTTP サーバーの設定ファイルの例

Apache HTTP サーバーをリバースプロキシサーバーとし、Unicorn ID Manager と連携する設定のサンプルファイルです。

設定の詳細に関しては Apacheの公式ドキュメント を参考にしてください。

/etc/httpd/conf/httpd.conf

## Apache HTTPD 2.4 (RHEL): httpd.conf
##
## Template by OSS Technology Corp. <http://www.OSSTech.co.jp/>
## Date: 2015-02-27, since 2015-02-27

ServerRoot "/etc/httpd"

Include conf.modules.d/*.conf

User apache
Group apache

PidFile run/httpd.pid

Listen 80

Timeout 60
KeepAlive Off
MaxKeepAliveRequests 100
KeepAliveTimeout 15

<IfModule prefork.c>
StartServers		   8
MinSpareServers		   5
MaxSpareServers		  20
ServerLimit		  64
MaxClients		  64
MaxRequestsPerChild	4000
</IfModule>

<IfModule worker.c>
StartServers		   4
MaxClients		 300
MinSpareThreads		  25
MaxSpareThreads		  75
ThreadsPerChild		  25
MaxRequestsPerChild	4000
</IfModule>

EnableSendfile On
Include conf.d/*.conf

## Avoid warnings from noisy security scanners
TraceEnable Off
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^OPTIONS
RewriteRule ^ - [forbidden]

ServerName uidm.example.com
ServerAdmin root@uidm.example.com
ServerTokens ProductOnly
ServerSignature Off

HostnameLookups Off
UseCanonicalName Off

LogLevel warn
ErrorLog logs/error_log

LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D %P" osstech
<IfModule mod_ssl.c>
  LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %D %P %{SSL_PROTOCOL}x %{SSL_CIPHER}x" osstech_ssl
</IfModule>
LogFormat "host:%h\tident:%l\tuser:%u\ttime:%t\treq:%r\tstatus:%>s\tsize:%b\treferer:\%{Referer}i\tua:%{User-Agent}i" combined_ltsv
LogFormat "time:%t\tforwardedfor:%{X-Forwarded-For}i\thost:%h\treq:%r\tstatus:%>s\tsize:%B\treferer:%{Referer}i\tua:%{User-Agent}i\treqtime_microsec:%D\tcache:%{X-Cache}o\truntime:%{X-Runtime}o\tvhost:%{Host}i" ltsv
CustomLog logs/access_log osstech

DirectoryIndex index.html index.htm
TypesConfig /etc/mime.types
DefaultType None
AddDefaultCharset UTF-8

DocumentRoot "/var/www/html"


<Directory />
  Options FollowSymLinks
  AllowOverride None
</Directory>

<FilesMatch "^\.ht">
  Require all denied
</FilesMatch>

<VirtualHost *:80>
  # http://httpd.apache.org/docs/2.4/mod/mod_alias.html#redirect
  Redirect permanent /unicornidm https://uidm.example.com/unicornidm
</VirtualHost>

<VirtualHost *:443>
  ServerName uidm.example.com
  ErrorLog logs/uidm.error.log
  CustomLog logs/uidm.access.log osstech_ssl

  SSLEngine On
  SSLUseStapling On
  SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
  SSLCertificateFile /etc/pki/tls/certs/localhost.crt
  ## NOTE: SSLCertificateChainFile became obsolete with Apache httpd 2.4.8,
  ##       when SSLCertificateFile was extended to also load intermediate
  ##       CA certificates from the server certificate file.
  #SSLCertificateChainFile /etc/httpd/certs/cachain.crt
  #RequestHeader set X-Forwarded-Proto "https"

  #Header always set Strict-Transport-Security "max-age=63072000"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"

  #DocumentRoot "/var/www/html"
  #<Directory /var/www/html>
  #  Require all granted
  #</Directory>

  <Location "/unicornidm/user">
    Require all granted
  </Location>

  <Location "/unicornidm/admin">
    Require all granted
  </Location>

ProxyPass /unicornidm http://localhost:8081/unicornidm
ProxyPassReverse /unicornidm http://localhost:8081/unicornidm

</VirtualHost>

注釈

上記の設定ファイルではサーバーのホスト名は uidm.example.com として設定されています。実際に利用する際は、適切なホスト名に書き換えてください。

注釈

上記の設定ファイルではサーバー証明書に /etc/pki/tls/certs/localhost.crt と /etc/pki/tls/private/localhost.key が設定されています。実際に利用する際は、適切な証明書ファイルに書き換えてください。

/etc/httpd/conf.d/ssl.conf

## Apache HTTPD 2.4 (RHEL): ssl.conf
##
## Template by OSS Technology Corp. <http://www.OSSTech.co.jp/>
## Date: 2015-05-12, since 2015-02-27

Listen 443 https

SSLProtocol All -SSLv3 -SSLv2
SSLCipherSuite ALL:!SSLv2:!RC4:!MD5:!EXP:!LOW:!aNULL:!eNULL:@STRENGTH
SSLHonorCipherOrder On

SSLPassPhraseDialog  builtin

SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random  512
#SSLRandomSeed connect file:/dev/random  512
#SSLRandomSeed connect file:/dev/urandom 512

SSLCryptoDevice builtin
#SSLCryptoDevice ubsec

SSLSessionCache shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout 300

SSLStaplingCache shmcb:/run/httpd/staplingcache(128000)

## vim: filetype=apache