Testing SSL Certs Using Apache on Docker

Sometimes we have a need to test our SSL, before we deploy it to production. If we have a development or staging environment, then we can test it there. But if we do not have that, we can always rely on trusty old docker to test the ssl in our own machine. Please follow along to learn how to do it.

Pre-requisite:

- have docker installed 

1. Put our ssl cert, intermediate cert (if we have one) and key into our current directory. Rename them as server.crt, server.key and server-ca.crt

2. Prepare a configuration file like below inside our current directory, and save it as https.conf

Listen 443

<VirtualHost _default_:443>

  DocumentRoot "/usr/local/apache2/htdocs"

  ServerName linuxwave.info

  ServerAdmin me@linuxwave.info

  ErrorLog /proc/self/fd/2

  TransferLog /proc/self/fd/1

  SSLEngine on

  SSLCertificateFile "/ssl/server.crt"

  SSLCertificateKeyFile "/ssl/server.key"

  SSLCertificateChainFile "/ssl/server-ca.crt"

</VirtualHost>

3. Run a container based on the httpd image from dockerhub, and mount the current folder with our ssl key and certs into /ssl in the container

docker run -dit --name apache -v ${PWD}:/ssl httpd

4. Copy /usr/local/apache2/conf into /ssl, so that we can edit it inside our host machine

docker exec -it apache cp /usr/local/apache2/conf/httpd.conf /ssl

5. Enable ssl in apache config by adding these lines into httpd.conf. We can just edit the file in our host machine, since text editor is not installed by default inside the apache image. The first 2 lines are to enable ssl support for apache, and the last line is for apache to include any files that end with .conf into its configuration

LoadModule ssl_module modules/mod_ssl.so

LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

Include conf/extra/https.conf

6. Copy the edited httpd.conf file back into its original location

docker exec -it apache cp /ssl/httpd/conf /usr/local/apache2/conf

7. Create a symlink from /ssl/https.conf into /usr/local/apache2/conf/extra/

docker exec -it apache ln -s /ssl/https.conf /usr/local/apache2/conf/extra

8. Test the configuration file

docker exec -it apache httpd -t

9. If no error was found from the above command, restart the container

docker restart apache

10. Open a new terminal, and get the ip address of the container

docker inspect apache | grep IPAddress

11. Put the ip address and your hostname inside your machine's /etc/hosts

echo "172.17.0.2 linuxwave.info" | sudo tee -a /etc/hosts 

12. Try to access the above domain using a web browser, and check the ssl cert information

13. If the ssl certs are working fine inside docker, you can be sure that it will work just fine in your production server

Connect to Fortinet VPN using Openfortivpn

Fortivpn does offer 2 clients for linux, one is for redhat family and the other installer is for ubuntu/debian family. You can download the installers from here. 

But for those who wanted to used opensource vpn client to connect to Fortinet VPN, we can use openfortivpn. Please follow below steps to connect using openfortivpn

1. Install openfortivpn

$ sudo apt install openfortivpn

2. We can connect just by using openfortivpn with some options, like below

$ sudo openfortivpn myvpnserver.local:10443 -u vpnuser -p mypass 

where:

-u : please provide username

-p : please provide password

myvpnserver.local:10443 : please provide vpn server address and port

3. We can also use a configuration file with content like below

host = myvpnserver.local

port = 10443 

username = vpnuser

password = mypass

save the above file as myvpn.config and connect using below command so that openfortivpn can use the configuration inside the file to connect to vpn

$ sudo openfortivpn -c myvpn.config 

4. We can get all the configuration for the file, by referring to the manual page of openfortivpn. We can access the manual by running below command

$ man openfortivpn

Another Way To Check UDP Port to a Linux Server

In a previous post, I have shared a way to check for udp port allowance to a linux server using netcat and ngrep.

I have found out an even easier way to accomplish this, just by using netcat, without the need to install additional software like ngrep.

To do this, first we need to setup a netcat to listen to the udp port, in the target machine. For example, we wanted to test udp port 10000 allowance, just run below command on the target machine

$ nc -klu 10000

The command will hang there, waiting for a connection to be sent to it.

In the client machine, just use netcat to send some text over to the target machine, like below (assuming the ip address of the target machine is 10.10.10.10)

$ echo "testing udp" | nc -u 10.10.10.10.10000

If the udp port is not blocked, we will see the "testing udp" text printed on the terminal in the target machine, where we listen for 10000 udp, like example below

Run A Mysql Query From Command Line

To run a mysql query directly from command line, without entering the interactive mode, use -e flag, like below

$ mysql -u user -p -e 'show tables;' mydbname

In the above example, the output would be, a list of tables inside mydbname, displayed on the command line, after you have put in the mysql user password.

Test UDP Port to Linux Server

To test if a udp port is allowed to a linux server, and not blocked by any firewall, we need ngrep on the server side, and nc (netcat) on the client side.

First, install ngrep on the server

$ sudo apt install ngrep -y

And start to watch the udp 10000 traffic (for example)

$ ngrep -q "accessible" udp port 10000

In the client side, we need to install netcat-openbsd 

$ sudo apt install netcat-openbsd

We are now going to test port 10000 udp in the server, from the client (the "yes, accessible" message could be anything, as long as it contains accessible keyword)

$ echo "yes, accesible" | nc -u server-ip 10000

If the port is opened (not blocked by any firewall), you will get message like below in the server terminal

U client-ip:39062 -> server-ip:443 #1

  yes, accessible...    

If the port is blocked, you won't get any output on the server terminal