Deebs
Well-known member
Default config at the moment. Everything working correctly. All non ssl images are being converted to ssl via the camo proxy.
No, for this I am running on ubuntu so using my own stuff compiled from source.
Who uses SSL with XenForo?
- Thread starter Floren
- Start date
No, for this I am running on ubuntu so using my own stuff compiled from source.
Floren
Well-known member
I was wrong... the Redhat repo is not maintained at all. They push v8-3.6.6 which is pretty old and compiled with the deprecated scons maker. I compiled yesterday v8-3.12.16 for Redhat 5 and 6, with Google's GYP. I'm awaiting a reply from the dev team to see if we still need the libv8preparser library. Then, I will tackle the nodejs and npm RPM's so we are game for camo setup.
Anyone made progress on the initial setup? I'm still waiting for some feedback from you guys.
whyweprotest
Well-known member
I've been running it for months, the only thing you might want to do is remove the FS bit at the bottom since it doesn't work half the time and is pretty much unnecessary.
Floren
Well-known member
What I'm trying to determine first is: What is the minimum python version nodejs wafadmin can run on?
I'm building the nodejs packages for CentOS 5 and I want to make sure it can run on 2.4.3+. There are several scripts that still point to 2.4 env so I'm not sure... Thanks for letting me know, guys.
I'm building the nodejs packages for CentOS 5 and I want to make sure it can run on 2.4.3+. There are several scripts that still point to 2.4 env so I'm not sure... Thanks for letting me know, guys.
A
account8226
Guest
I uses SSL with my admin.php only.
whyweprotest
Well-known member
I use the debian stable package so won't be of much help there.
Floren
Well-known member
No prob. I'm awaiting a reply from nodejs devs, hopefully we will clear that last part.
Now, back to camo. In their wiki, they post this:
This is all Chinese to me, except the node server.js part. What are those coffee commands?
Never mind is the coffee-script, you install it with npm. Can anyone post what exactly they did with camo to set it up? I don't care if is Debian or other distro, I'll figure it out.
For example, what camo key you used? Is that the ssl certificate key you have on server?
whyweprotest
Well-known member
I use a hex key that you can set in the server.js, I don't run the coffee script. What I did is setup monit to check node's status every 5 minutes and reload/ restart if it doesn't respond 200.No prob. I'm awaiting a reply from nodejs devs, hopefully we will clear that last part.
Now, back to camo. In their wiki, they post this:
This is all Chinese to me, except the node server.js part. What are those coffee commands?
Never mind is the coffee-script, you install it with npm. Can anyone post what exactly they did with camo to set it up? I don't care if is Debian or other distro, I'll figure it out.
For example, what camo key you used? Is that the ssl certificate key you have on server?
Floren
Well-known member
I see... how did you generated the new key, like that?
I dont think so, the format is: 0x24FEEDFACEDEADBEEFCAFE
Let me know please. I planned to create a wrapper that executes both commands as daemon. From what I see the server.coffee does the same thing as server.js, runs as daemon, processes all predefined params, pid, etc.
You could pass that key (as well other params) without editing the server.js, no?
Code:
$ echo -n 'value' | openssl sha1 -hmac 'mysite.com'
(stdin)= f331eb9012e17e034e52980cca40fa76b1e424bcLet me know please. I planned to create a wrapper that executes both commands as daemon. From what I see the server.coffee does the same thing as server.js, runs as daemon, processes all predefined params, pid, etc.
You could pass that key (as well other params) without editing the server.js, no?
Code:
/usr/bin/env PORT=9090 CAMO_KEY="0x24FEEDFACEDEADBEEFCAFE" node server.jswhyweprotest
Well-known member
I works for me.
Right, they do the same thing
Possibly, I don't see why you would want to do that, but you can likely do that yes.
Floren
Well-known member
I looked and that key acts more like a salt into file. Thanks for confirming.
Well, that command should be into a .js file, where you can define all params you want. I'm looking at other npm packages and camo should be packed the same. I will ask the dev and let you know.
Do you mind creating tutorials on how to implement ssl/https fully into xenforo?
Anthony Parsons
Well-known member
There is nothing more to do implementing HTTPS than adding a htaccess redirect to force HTTPS. Most of the above discussion is about trying to optimise the server to deliver HTTPS that minute bit faster.
You change your ACP URL to https and you force it in your htaccess... that's it.
My problem now is Google Adsense
How can I use it on https without modifying the code.
Mike Edge
Well-known member
My problem now is Google Adsense
How can I use it on https without modifying the code.
remove the http: so it is just "//pagead2.google etc etc
Not violating google policies?
DRE
Well-known member
guess that counts me out at the moment. Knownhost ssd vps only has 32bit OSI'm pretty sure nobody beside Axivo Repository has the Google 64bits optimization implemented. I think is done this way just for packaging uniformity, Google optimization is available since OpenSSL 1.0.0 version but only for 64bits platforms. Axivo provides only 64bits packages,Nobody runs a serious setup on 32bits machines.
Compared to previous RSA tests on OpenSSL, the Google optimized ephemeral Elliptic Curve Diffie-Hellman key exchange over P-224 runs at twice the speed of standard OpenSSL, while atomic elliptic curve operations are up to 4 times faster in 1.0.1c version.
In addition, the implementation is immune to timing attacks. Axivo SSL setup gets a 90 score on SSL Labs, close to Google score. Not to bash vBulletin.com but is unfortunate they run a weak setup. Even if they get an 88 score, their site is vulnerable to Beast, DDoS and MITM attacks.
Comparison of keys between the two RPM sets (without EC, FIPS enabled on axivoplus repo and with EC Google optimized for 64bits, FIPS disabled on axivo repo):
View attachment 29729
I've created both packages, in case some people will not be allowed to legally use EC in their country/setup. For example, Google SSL sites do not run a built-in FIPS OpenSSL package mainly because FIPS is not compatible with EC.
If anyone have law knowledge related to EC usage on a website, I would appreciate some feedback. It will help all of us. Personally, I've put a disclaimer just to protect myself. Technically, Axivo allows you to install whatever flavor you think is appropriate for your country/website (Debian or Redhat).
DRE
Well-known member
Does it have that EC curve thingy he was talking about? It sounds so cool especially if it makes a site faster.