Update SNI on your Apache server

Manual – SW Hosting

---

Introduction

This document provides you with detailed instructions on how to update the integration of our SW Panel with your Unmanaged Cloud server.

Why is this update necessary?

Our development team is implementing new functionalities in the SW Panel. To ensure the correct operation of these functionalities, it is necessary for you to review the internal configuration of your server and make the changes specified in this document.

Why must I be the one to make the server-level changes?

We are sending you this manual because you have an Unmanaged Cloud server. This means that you have the root password (administrator) and we do not have access to it.

Since it is a server not managed by our engineering team, you, as the administrator, must be the one to make the necessary changes.

What will happen if I do not perform the update?

In the event that the necessary components for the SW Panel are not updated at the server level, in the near future you may not have access to certain functionalities that we wish to introduce with the new versions of the SW Panel.

It is also possible that compatibility or operational problems may arise in the SW Panel.

Is there an easier alternative?

Yes. We can perform this procedure for you if you give us access to your Unmanaged Cloud server. Please note that, as this is an intervention on an unmanaged server, it requires you to have a support plan and sufficient ‘minutes’ for engineering interventions.

Summary of manual tasks:

• Review Apache and OpenSSL versions.
• Verify that Apache has the SSL module enabled.
• Ensure correct SNI configuration.
• Replace IP addresses with * in the Virtual Hosts.
• Edit the configuration of the SW Hosting RPC service and restart it.

---

Prerequisites

This manual assumes you have the following knowledge. These are common knowledge in server maintenance tasks and should be known by any administrator or owner of an unmanaged server.

• IP address of your server.
• SSH Port (default 22, with SW Panel 2200).
• Password for the root user.
• Basic use of an SSH client.
• Basic Linux handling.
• Use of CLI editors such as nano.

In case you do not have this knowledge, we recommend that you consult a specialized person who can follow this manual for you. Alternatively, you can also use one of our support plans to request an engineering intervention in which our team will perform the necessary steps for you.

---

Warning about errors and problems during the intervention

Following this manual without the necessary knowledge can cause the incorrect operation of your Cloud server and even cause your website to stop being visible.

We recommend that you take a Snapshot from your SW Panel before starting the process described in the following pages. Likewise, we recommend that during the process you make a temporary copy of each file (style “cp file file.bak”) in order to be able to undo the changes.

In case of an error or incident that you do not know how to fix, we can help you if you have a support plan and sufficient ‘support minutes’. Please keep in mind that fixing errors produced by not following this manual correctly or not having sufficient knowledge may require a much more costly intervention.

---

Step-by-step procedure

The steps to perform the update are detailed below.

1. Log in to your server via SSH

• If you do not have SW Panel, your connection port is probably 22 (unless you have made changes).

• If you have SW Panel, your connection port will be 2200.

2. Verify the version of Apache and OpenSSL

Run the following commands to obtain the version of each package.

dpkg -l openssl | grep openssl
dpkg -l apache2 | grep apache2

Example result:

openssl   1.0.1e-2+deb7u21    amd64
apache2   2.2.22-13+deb7u7    amd64

• Verify that the openSSL version is higher than 0.9.8j

• Verify that the apache version is higher than 2.2.12

IMPORTANT.

Do not proceed with this manual if you do not have the minimum required versions.

3. Verify if the SSL module is enabled in Apache

apache2ctl -M

If it is enabled, it will appear as “ssl_mod “ssl_module (shared)” “ssl_module (shared)” in the list. ule (shared)”

Example:

root@server:~# apache2ctl -M 
Loaded Modules: 
 core_module (static) 
 log_config_module (static) 
 logio_module (static) 
 version_module (static) 
 mpm_prefork_module (static) 
 http_module (static) 
 so_module (static) 
 alias_module (shared) 
 auth_basic_module (shared) 
 authn_file_module (shared) 
 authz_default_module (shared) 
 authz_groupfile_module (shared) 
 authz_host_module (shared) 
 authz_user_module (shared) 
 autoindex_module (shared) 
 cgi_module (shared) 
 deflate_module (shared) 
 dir_module (shared) 
 env_module (shared) 
 headers_module (shared) 
 mime_module (shared) 
 negotiation_module (shared) 
 php5_module (shared) 
 reqtimeout_module (shared) 
 rewrite_module (shared) 
 setenvif_module (shared) 
 ssl_module (shared)  Check that this module appears. 
 status_module (shared) 
Syntax OK

If the apache SSL module is not enabled, you can enable it by running the following commands:

We use the following command to enable the module

a2enmod ssl

Next, we restart apache with the following command:

service apache2 restart

You can run “apache2ctl–M” again to verify that the activated module now appears in the list.

4. Verify the SNI configuration in Apache

Open the following file in a text editor of your preference. For example, “nano”.

In old versions of Debian or Ubuntu:

nano /etc/apache2/apache2.conf

In recent versions of Debian or Ubuntu:

nano /etc/apache2/mods-enabled/ssl.conf

Search for the parameter “SSLStrictSNIVHostCheck” and enable it if it is not. Ensure that “On” is written and it is not preceded by any hash “#”.

SSLStrictSNIVHostCheck On

Remember to save the changes when exiting the editor.

We verify that there are no errors in the configuration file by checking the syntax and we restart the server to apply the changes.

Check syntax:

apache2ctl -t

Restart:

service apache2 restart

5. Change the IP to '*' in the Virtual Hosts

Next, access all the Virtual Hosts hosted in the following path: “/etc/apache2/serveisweb/vhost/”

Edit each of the available virtual hosts and make the following changes:

• In the <VirtualHost> tag, detect patterns such as <VirtualHost IPADDRESS:80> or <VirtualHost IPADDRESS:443>

• Replace IP ADDRESS with an ‘*’ (asterisk) character.

The result should be similar to the following:

Before making the change:

<VirtualHost 81.25.112.128:80> 
<VirtualHost 81.25.112.128:443> 

After making the change:

<VirtualHost *:80> 
<VirtualHost *:443> 

Make the same changes also to the files contained in the directory “/etc/apache2/sites etc/apache2/sites etc/apache2/sitesavailable”.

Once the changes have been made, verify the syntax of the files again and restart apache.

Check syntax:

apache2ctl -t

Apply changes:

apache2ctl graceful

6. Modify the SW Hosting RPC configuration

Finally, edit the SW Hosting RPC configuration file.

Open the file “/etc/swhosting-rpc/swhostingrpc.yml“ with an editor. For example, “nano”.

nano /etc/swhosting-rpc/swhostingrpc.yml

Search for:

server_IP: X.X.X.X

Change it to:

server_IP: *

Restart the service by running:

service swhostingrpcd restart

---

Conclusion

If you have successfully followed the steps of this manual, you will be able to continue using SW Panel with total normality, using all its current and future functions.

Remember that, if you have any kind of doubt regarding the content of this manual, you can contact our engineering team by opening a “Systems Engineering Ticket” from your SW Panel. This support service is available 24x7 and has a response SLA of less than 2H.

Likewise, you can also write a comment on your “Support Wall” completely free of charge.