##
## ksslproxy.conf -- example Apache config file for kssl local proxy
##
##  This is a config file for running Apache as a kerberized local
##  Unmodified web clients (Netscape) can access kssl web pages by
##  using this proxy as their Secure/https: proxy.  The proxy must
##  be run by the user on the same machine as their web browser and
##  kerberos ticket cache.  Common invocation:
##      src/httpd -DSSL -X -f /tmp/kssl.web/conf/ksslproxy.conf
##  
##  Security Issue:  Anyone with access to the proxy port will get
##  access to the kssl web server using the kerberos principle of
##  the person running the proxy.  Port access is therefore protected
##  by a random nonce (cookie) value.  The proxy will reject input
##  which does not include the nonce, and shutdown after a few such
##  illegal access attempts.  The nonce value is supplied by default
##  in the Accept-Language: HTTP header; alternatively the Cookie:
##  header may be used.  The proxy will edit the user's Netscape
##  preferences file to accomplish this; the user must therefore
##  shutdown netscape before starting the proxy.
##
##  Proxy modes:  There are two proxy modes: Man-in-the-Middle (MitM)
##  and Rescheme.  MitM requires no changes to the web pages on the
##  server while Rescheme is faster.
##
##    o  MitM:  
##          The proxy sets up an SSL session between itself and the
##          browser for any host:port pairs specified by the
##          KRB5ProxyHttps directive.  The SSLCipherSuite directive
##          should be used to select the fastest possible cipher
##          for the local link.  The proxy sets up a second ssl 
##          session between itself and the web server using the
##          server's choice of ssl ciphers, including KRB5-*.
##          The browser shows the page as being protected by the
##          local cipher and displays the certificate of the proxy
##          rather than the web server's certificate.
##    o  Rescheme:
##          The URLs specified by the KRB5ProxyRescheme directive
##          are rewritten from "http:" to "https:".  Any bookmarks,
##          web page links, and other references must be changed to
##          "http:".  Supporting both kssl and regular ssl access to
##          same pages becomes problematic.  The link between the
##          browser and proxy is unencrypted, while the proxy to web
##          server link is encrypted with the server's choice of ssl
##          ciphers, including KRB5-*.  The browser shows the page
##          as being unprotected.  Throughput approaches what you'd
##          get from a browser that directly supports kssl.
##

ServerType standalone
ServerRoot SERVERROOT
DocumentRoot SERVERROOT/htdocs
User nobody
Group nogroup
ServerAdmin root@localhost

ProxyRequests On

## KRB5ProxyAuthMethod:     local port access protected by Cookie: or 'Language:
## KRB5ProxyCookie:         can specify explicit nonce; otherwise random
## KRB5ProxyCookieLength:   length for random nonce; 0 => no access control!
## KRB5ProxyMaxTries:       number of failed connection attempts, then shutdown
## KRB5ProxyRescheme:       list URLs to change from http: to https:
## KRB5ProxyHttps:          list host:port pairs for access via MitM proxy

KRB5ProxyAuthMethod     NS4:lang
KRB5ProxyMaxTries       3
KRB5ProxyCookieLength   4
KRB5ProxyHttps			WEBHOST:8443
Port                    43443
AllowCONNECT            43443 8443 443 543
SSLCipherSuite          RC4-MD5:RSA+DES:KRB5-DES-CBC3-MD5

PidFile SERVERROOT/logs/klp.httpd.pid

DefaultType text/plain
HostnameLookups Off
ServerSignature On
IndexOptions FancyIndexing

<Location />
    SSLRequireSSL
</Location>

UserDir public_html
DirectoryIndex index.html
AccessFileName .htaccess
<Files ~ "^\.ht">
    Order allow,deny
    Deny from all
</Files>

ErrorLog SERVERROOT/logs/klp.error_log
LogLevel warn
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
CustomLog SERVERROOT/logs/klp.access_log common


### Section 3: Virtual Hosts

##
##  SSL Global Context
##
##  All SSL configuration in this context applies both to
##  the main server and all SSL-enabled virtual hosts.
##

#
#   Some MIME-types for downloading Certificates and CRLs
#
<IfDefine SSL>
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl
</IfDefine>

<IfModule mod_ssl.c>

SSLPassPhraseDialog  builtin

SSLSessionCache         dbm:SERVERROOT/logs/klp.ssl_scache
SSLSessionCacheTimeout  300

SSLMutex  file:SERVERROOT/logs/klp.ssl_mutex

#   Pseudo Random Number Generator (PRNG):
#   Configure one or more sources to seed the PRNG of the 
#   SSL library. The seed data should be of good random quality.
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random  512
#SSLRandomSeed startup file:/dev/urandom 512
#SSLRandomSeed connect file:/dev/random  512
#SSLRandomSeed connect file:/dev/urandom 512

#   Logging:
#   The home of the dedicated SSL protocol logfile.  Put
#   this somewhere where it cannot be used for symlink attacks on
#   a real server (i.e. somewhere where only root can write).
SSLLog      SERVERROOT/logs/klp.ssl_engine_log
SSLLogLevel info

</IfModule>

<IfDefine SSL>

##
## SSL Virtual Host Context
##

<VirtualHost _default_:43443>

##  The following would actually go to https:.
## KRB5ProxyRescheme http://www.modssl.org:443/

#  General setup for the virtual host
DocumentRoot SERVERROOT/htdocs
ErrorLog SERVERROOT/logs/klp.error_log
TransferLog SERVERROOT/logs/klp.access_log
SSLOptions +OptRenegotiate

<Location />
    SSLRequireSSL
</Location>

SSLCertificateFile  SERVERROOT/conf/ssl.crt/klp.pem

#   Per-Server Logging:
CustomLog SERVERROOT/logs/klp.ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

####################  </VirtualHost>                                  
</VirtualHost>                                  

</IfDefine>

