##
## httpd.conf -- kssl Apache HTTP server test configuration file
##

ServerType standalone
ServerRoot SERVERROOT
DocumentRoot SERVERROOT/htdocs
User nobody
Group nogroup
ServerAdmin root@localhost

DefaultType text/plain
HostnameLookups Off
ServerSignature On
IndexOptions FancyIndexing

Port 8080
<IfDefine SSL>
Listen 8080
Listen 8443
</IfDefine>

<Directory />
    Options FollowSymLinks
    AllowOverride None
</Directory>

<Directory SERVERROOT/htdocs>
    Options Indexes FollowSymLinks
    AllowOverride None
    Order allow,deny
    Allow from all
</Directory>

<Location /open/>
</Location>

#	NOTE WELL: 
#		In these test pages, the Kerberized VirtualHost's 
#		DocumentRoot is located below the regular web server's
#		DocumentRoot.  I don't think this is a good practice.
#		The following directive is all that prevents access to
#		the "kerberized" web pages through the regular port 8080
#		web server.  In a production environment it would be 
#		much safer to locate the Kerberos DocumentRoot outside of
#		any non-Kerberized DocumentRoot.  In any event, you should
#		test your configuration using a non-kerberized web client
#		to verify your access restrictions.
#
<Location /any_ssl/>
	SSLRequireSSL
</Location>

UserDir public_html
DirectoryIndex index.html
AccessFileName .htaccess
<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
</Files>

ErrorLog SERVERROOT/logs/error_log
LogLevel warn
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
CustomLog SERVERROOT/logs/access_log common

ScriptAlias /cgi-bin/ SERVERROOT/cgi-bin/

<Directory SERVERROOT/cgi-bin>
	SSLRequireSSL
	SSLCipherSuite  KRB5-DES-CBC3-MD5
	KRB5Realm		YOUR.REALM
    AllowOverride None
    Options None
    Order allow,deny
    Allow from all
</Directory>


### Section 3: Virtual Hosts

##
##  SSL Global Context
##
##  All SSL configuration in this context applies both to
##  the main server and all SSL-enabled virtual hosts.
##

#
#   Some MIME-types for downloading Certificates and CRLs
#
<IfDefine SSL>
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl
</IfDefine>

<IfModule mod_ssl.c>

SSLPassPhraseDialog  builtin

#SSLSessionCache        none
#SSLSessionCache        shm:SERVERROOT/logs/ssl_scache(512000)
SSLSessionCache         dbm:SERVERROOT/logs/ssl_scache
SSLSessionCacheTimeout  300

SSLMutex  file:SERVERROOT/logs/ssl_mutex

#   Pseudo Random Number Generator (PRNG):
#   Configure one or more sources to seed the PRNG of the 
#   SSL library. The seed data should be of good random quality.
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random  512
#SSLRandomSeed startup file:/dev/urandom 512
#SSLRandomSeed connect file:/dev/random  512
#SSLRandomSeed connect file:/dev/urandom 512

#   Logging:
#   The home of the dedicated SSL protocol logfile.  Put
#   this somewhere where it cannot be used for symlink attacks on
#   a real server (i.e. somewhere where only root can write).
SSLLog      SERVERROOT/logs/ssl_engine_log
SSLLogLevel info

</IfModule>

<IfDefine SSL>

##
## SSL Virtual Host Context
##

<VirtualHost _default_:8443>

#  General setup for the virtual host
DocumentRoot SERVERROOT/htdocs
ErrorLog SERVERROOT/logs/error_log
TransferLog SERVERROOT/logs/access_log

<Files ~ "\.status$">
	SetHandler  kssl-status-handler
</Files>

<Location /open/>
</Location>

<Location /any_ssl/>
	SSLRequireSSL
</Location>

<Location /any_ssl/any_krb5/>
	SSLRequireSSL
	SSLCipherSuite KRB5-DES-CBC3-MD5
	#  or  SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP-KRB5|KRB5)-/	)
</Location>

<Location /any_ssl/any_krb5/krb5_realm/>
	KRB5Realm		YOUR.REALM
</Location>

<Location /any_ssl/any_krb5/krb5_princ/>
	KRB5Principal	USERNAME@YOUR.REALM
</Location>
<Location /any_ssl/any_krb5/krb5_princ/bad/>
	KRB5Principal	blofeles@S.P.E.C.T.R.E
</Location>

<Location /any_ssl/any_krb5/krb5_user/>
	KRB5Realm		YOUR.REALM
	KRB5User		USERNAME
</Location>


SSLEngine on
#SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

SSLCertificateFile SERVERROOT/conf/ssl.crt/server.crt
#SSLCertificateFile SERVERROOT/conf/ssl.crt/server-dsa.crt

SSLCertificateKeyFile SERVERROOT/conf/ssl.key/server.key
#SSLCertificateKeyFile SERVERROOT/conf/ssl.key/server-dsa.key

#SSLCertificateChainFile SERVERROOT/conf/ssl.crt/ca.crt
#SSLCACertificatePath SERVERROOT/conf/ssl.crt
#SSLCACertificateFile SERVERROOT/conf/ssl.crt/ca-bundle.crt
#SSLCARevocationPath SERVERROOT/conf/ssl.crl
#SSLCARevocationFile SERVERROOT/conf/ssl.crl/ca-bundle.crl

#   Per-Server Logging:
CustomLog SERVERROOT/logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>                                  

</IfDefine>

