SAC Problems with SSL

Discuss Scalix Management Services ( formerly Scalix Admin Console )

Moderator: ScalixSupport

fibbs

SAC Problems with SSL

Postby fibbs » Wed Nov 26, 2008 4:25 am

Hey folks!

I am using scalix community edition 11.4.2 on CentOs 5.2.

Now i wanted to use the installed apache server to server a website, but to not needing to open scalix web access from the internet, i wanted to move ALL scalix stuff to SSL vhost.

I did the following:

in /etc/httpd/conf.d/scalix-tomcat.connector.conf i hashed out the following line:

Code: Select all

#Include /etc/opt/scalix-tomcat/connector/ajp/instance-*.conf


Now i've set up mod_ssl and in my ssl vhost i added the include line:

Code: Select all

Include /etc/opt/scalix-tomcat/connector/ajp/app-cose2201.*.conf


Now the /sac, /webmail, /.... aliases in apache configuration defined by the instance*.conf files in /etc/opt/scalix-tomcat/connector/ajp/ are only valid via https, not via http anymore.

Webmail ist working fine, but the Mobile web client and the SAC not anymore, the log file /var/opt/scalix/c1/tomcat/logs/scalix-caa.log tells me the following:

Code: Select all

2008-11-26 09:11:58,969  INFO [NotificationEventListener$WorkerThread.run:51] Event Notification: heartbeat|http://cose2201.makevo.com/res/RESDispatcher|LISTEN|300|cose2201|cose2201.makevo.com|11.4.2 from host:cose2201.makevo.com
2008-11-26 09:12:19,379 FATAL [RESServiceHandler.executeRESCommand:2180] java.io.FileNotFoundException: http://cose2201.makevo.com/res/RESDispatcher
2008-11-26 09:12:19,379 FATAL [RESServiceHandler.executeRESCommand:2189] com.scalix.sac.ubermgr.res.RESServiceHandler:Fatal Exception raised. Check the CAA logs


I think the mobile client has a similar problem: Something still tries to connect to http://<hostname>/res....., which is not anymore accessible.

Is there a way to _really_ change _everything_ to ssl? Is this communication i see just internal, from localhost to localhost? or does the client try to connect via ssl and non-encrypted http at the same time?

Any help would be very appreciated


Christian

Valerion
Scalix Star
Scalix Star
Posts: 2730
Joined: Thu Feb 26, 2004 7:40 am
Location: Johannesburg, South Africa
Contact:

Postby Valerion » Wed Nov 26, 2008 7:39 am

I recommend you leave /res, /caa, /sis and /api HTTP-accessible. /res and /caa are never used by users, so you can lock them down to only use the servers' IPs, and you can secure them with Kerberos. /sis should also need access from the servers only. Not sure about /api, OI normally leave it HTTP for safety, but it's possible that you can get away with having it purely HTTPS.


Return to “Scalix Management Services”



Who is online

Users browsing this forum: No registered users and 1 guest