Drupal admin area and login, Securing them with HTTPS

Question

I've been reading a lot about this and trying many of the methods I've found and haven't yet been able to get anything working properly.

I want to be able to secure the admin area and associated login pages. So anything in example.com/admin/* or example.com/user/* etc, needs to go over SSL/TLS. We'd like this to apply to each site withing the multisite setup. So example1.com, example2.com, example3.com are all on the same server/user account.

The Setup

• Drupal 7 multi site
• Clean URLs enabled
• PHP 5.3
• MySQL v14 d5
• Apache2

Notes

• Securepages is not an option, as there's no stable Drupal 7 release, and using the existing dev version requires patching Drupal Core, which goes against our policy
• Have tried Session 443 with no success
• Have tried Secure Login with no success
• An SSL cert (a self-signed one for now, while testing) is installed and works on the server for other purposes, just not Drupal.
• I've read all the docs on Drupal.org about enabling HTTPS and have attempted to follow the directions there with little success
• I've toggled the $conf['https'] setting in settings.php with no discernable results.

The Questions

If I enable HTTPS for everything on a site, I get a 404 for anything attempting to go through https://, which leads me to think that the rewrite rules aren't applying for the https pages. What am I missing here? Is there a rewrite condition/rule I can add to htaccess to fix this?

Is this not a solved problem in the Drupal community? Are people just leaving their admin areas unsecured, with user passwords being sent in the clear? I find this hard to believe, yet it seems that there's no built-in or commonly known solution to the problem.

Answer 1

It's not the question you asked, but the simplest answer is you should just change your policy.

"Hacking" core (patching it) and running unstable releases is reality of running a website.

The two patches needed for securepages frequently need re-rolls, reviews, or improvements. Get involved in that cycle and help get them stable.

Answer 2

I used the following settings pull this off... and didn't need a module to do it. 1) httpd.conf

#APACHE stuff...
Listen 443
NameVirtualHost *:443
Include conf.d/vhosts/*.conf #Need this for multi-site and subdomains

<IfModule mod_header.c>
#enable HSTS
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
</IfModule>

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

2) conf.d/vhosts/site1.conf

<VirtualHost *:443>
#APACHE stuff...
SSLEngine on
RewriteCond %{HTTP_HOST} !^www\. [NC] #Force www... be careful with subdomains
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</VirtualHost>

3) settings.php

$base_url = 'https://www.example.com';  // NO trailing slash!

And voooala!! this will make all http traffic travel over https including resources like js and css. If you want subdomains, be sure to add the appropriate ServerAlias directives in the vhosts file(s).

Answer 3

I use the Ubercart SSL module which is a fantastic module, though it is horribly named. You do not need to be running Ubercart to take advantage of this module which is very stable and easy to use.