I am trying to set up Zope so that it is accessible via secure link through Apache. Configuration: Solaris 2.8 Apache-2.0 with mod_ssl and mod_proxy shared Zope 2.5 Apache lives in /usr/local/apache2 and has the following in its configuration: <IfModule mod_proxy.c> ProxyRequests On ProxyPass /Zope/ http://myhost:8080/ ProxyPassReverse /Zope/ http://myhost:8080/ ProxyPass /misc_ http://myhost:8080/misc_ ProxyPass /p_ http://myhost:8080/p_ </IfModule> Zope lives in /usr/local/Zope. If I just use it like this, all forms are insecure, so I added a SiteRoot object to a root folder with Base https://myhost/Zope and Path / Now everything is secure, but the top frame of the management interface returns Object not found! error (404), and apache error_log shows that it tried to access https://myhost/manage_page_style.css If I try to go to https://myhost/Zope/manage_zmi_prefs and change there "Use Style Sheets" to "No", it is accepted, but going to https://myhost/Zope/manage still gives me the same error, even if I try to restart Zope. Anybody can help me with that? Pretty please? With sugar on top ;-) -- Alexandre Peshansky, Systems Manager, RUH, NY (note last name spelling change)
Alexandre Peshansky wrote:
I am trying to set up Zope so that it is accessible via secure link through Apache. Configuration: Solaris 2.8 Apache-2.0 with mod_ssl and mod_proxy shared Zope 2.5
Apache lives in /usr/local/apache2 and has the following in its configuration: <IfModule mod_proxy.c> ProxyRequests On ^^^^^^^^^^^^^^ Nooooo! Don't do that (at least if you haven't really configured/secured your server). You have just opened your server as a proxy for the whole world. Put in ProxyRequests Off an everything you configured below will still work, you just won't function as a public anonymizer.
Btw, did you get that config option from a howto on zope? If so, please post the URL so that we can slap the creator ;->. Sorry, no time to help with your problem, just wanted to get that hole out of the way. Btw: google shows me the following pages on www.zope.org which contain this false and dangerous information http://www.zope.org/Members/Jace/apache-vhm http://www.zope.org/About/Apache The last one should IMO at least contain remarks about the dangers of that config line. cheers, oliver
participants (2)
-
Alexandre Peshansky -
Oliver Bleutgen