HTTPS access to MindTouch

Modify your LocalSettings.php

Make sure your LocalSettings.php files contains the following:

$wgDreamServer     = "http://localhost:8081";
$wgDekiApi         = "deki";

Note: If you've moved your DekiHost to a different server or port, you'll need to modify the $wgDreamServer key in localsettings as well as your Apache mod_proxy ProxyPass and ProxyPassReverse.

Install existing SSL certificate

If you already have an SSL certificate do the following:

mkdir /etc/apache2/ssl

Copy the file containing your PEM encoded private key and cert file:

cp mycert.pem /etc/apache2/ssl/apache2.pem

Create a self-signed certificate

If you don't already have an SSL certificate, do the following to generate a self-signed cert:

mkdir /etc/apache2/ssl
apt-get install ssl-cert
make-ssl-cert /usr/share/ssl-cert/ssleay.cnf /etc/apache2/ssl/apache2.pem

If you don't want to install the ssl-cert package you can manually create the file like this:

openssl req -new -x509 -days 365 -nodes -out /etc/apache2/ssl/apache2.pem  -keyout /etc/apache2/ssl/apache2.pem

Configure Apache

Add "Listen 443" to /etc/apache2/ports.conf

Edit your /etc/apache2/sites-available/deki file and make sure it looks like this:

(NB, the right file might be /etc/apache2/sites-available/dekiwiki for later versions)

<VirtualHost *:443> 
       ServerName deki-hayes 
 
       SSLEngine on 
       SSLCertificateFile /etc/apache2/ssl/apache2.pem 
 
       ErrorLog /var/log/apache2/error.log 
       CustomLog /var/log/apache2/access.log common 
 
       DocumentRoot "/var/www/deki-hayes" 
 
       RewriteEngine On 
       RewriteCond %{REQUEST_URI} ^/$ 
       RewriteRule ^/$ /index.php?title= [L,NE] 
 
       RewriteCond %{REQUEST_URI} !/(@api|editor|skins|config)/ 
       RewriteCond %{REQUEST_URI} !/(redirect|texvc|index|Version).php 
       RewriteCond %{REQUEST_URI} !/error/(40(1|3|4)|500).html 
       RewriteCond %{REQUEST_URI} !/favicon.ico 
       RewriteCond %{REQUEST_URI} !/robots.txt 
       RewriteCond %{QUERY_STRING} ^$ [OR] %{REQUEST_URI} ^/Special:Search 
       RewriteRule ^/(.*)$ /index.php?title=$1 [L,QSA,NE] 
 
       # deki-api uses encoded slashes in query parameters so AllowEncodedSlashes must be On 
       AllowEncodedSlashes On 
 
       # mod_proxy rules 
       ProxyPass /@api http://localhost:8081 retry=1 
       ProxyPassReverse /@api http://localhost:8081 
       SetEnv force-proxy-request-1.0 1 
       SetEnv proxy-nokeepalive 1 
</VirtualHost> 

Enable the apache ssl module

a2enmod ssl

Restart apache

/etc/init.d/apache2 restart

NameVirtualHost *:443
NameVirtualHost *:80

<VirtualHost *:80>
       # snip
</VirtualHost>
<VirtualHost *:443>
       SSLEngine on 
       SSLCertificateFile /etc/apache2/ssl/apache2.pem 
       # snip
</VirtualHost>

crypt_pass = md5( user_id & "-" & md5( clear_password ) )

AddExternalAuth dekisql-auth /usr/sbin/dekisql-auth.pl
SetExternalAuthMethod dekisql-auth pipe

<Location />
    SSLRequireSSL
    AuthType Basic
    AuthName "Deki - Restricted"
    AuthBasicProvider external
    AuthExternal dekisql-auth
    require valid-user
</Location>

my $dbq = $dbh->prepare("select user_name as username, user_password as password, user_id as userid from users where user_name like \'$user\' and user_active=1;");

if ($row->{password} eq md5_hex($row->{userid} . '-' . md5_hex($pass))) {

print STDERR  $row->{userid} . "  - " . md5_hex($row->{userid} . '-' . md5_hex($pass)) . "\n";