15

I've been reading a lot about this and trying many of the methods I've found and haven't yet been able to get anything working properly.

I want to be able to secure the admin area and associated login pages. So anything in example.com/admin/* or example.com/user/* etc, needs to go over SSL/TLS. We'd like this to apply to each site withing the multisite setup. So example1.com, example2.com, example3.com are all on the same server/user account.

The Setup

  • Drupal 7 multi site
  • Clean URLs enabled
  • PHP 5.3
  • MySQL v14 d5
  • Apache2

Notes

  • Securepages is not an option, as there's no stable Drupal 7 release, and using the existing dev version requires patching Drupal Core, which goes against our policy
  • Have tried Session 443 with no success
  • Have tried Secure Login with no success
  • An SSL cert (a self-signed one for now, while testing) is installed and works on the server for other purposes, just not Drupal.
  • I've read all the docs on Drupal.org about enabling HTTPS and have attempted to follow the directions there with little success
  • I've toggled the $conf['https'] setting in settings.php with no discernable results.

The Questions

If I enable HTTPS for everything on a site, I get a 404 for anything attempting to go through https://, which leads me to think that the rewrite rules aren't applying for the https pages. What am I missing here? Is there a rewrite condition/rule I can add to htaccess to fix this?

Is this not a solved problem in the Drupal community? Are people just leaving their admin areas unsecured, with user passwords being sent in the clear? I find this hard to believe, yet it seems that there's no built-in or commonly known solution to the problem.

  • Good question. You have read this one? drupal.stackexchange.com/questions/23149/… – undersound Oct 3 '12 at 22:12
  • Drupal should work without a problem on both http and https. I'd guess your problem lies in the Apache configuration (maybe SSL site points to a different DocumentRoot). Could you please post your Apache config and Drupal's .htaccess for further analysis? – por Oct 5 '12 at 10:02
  • @undersound Thank you. Yes I have read that one. We're really interested in securing all administrative tasks over HTTPS, not just the sign-in event. – KevinL Oct 5 '12 at 12:56
  • 2
    Probably the best bet is to help test and push the two core patches required towards approval. They both have updates from this week... – squarecandy Nov 24 '12 at 17:23
4

It's not the question you asked, but the simplest answer is you should just change your policy.

"Hacking" core (patching it) and running unstable releases is reality of running a website.

The two patches needed for securepages frequently need re-rolls, reviews, or improvements. Get involved in that cycle and help get them stable.

0

I used the following settings pull this off... and didn't need a module to do it. 1) httpd.conf

#APACHE stuff...
Listen 443
NameVirtualHost *:443
Include conf.d/vhosts/*.conf #Need this for multi-site and subdomains

<IfModule mod_header.c>
#enable HSTS
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
</IfModule>

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

2) conf.d/vhosts/site1.conf

<VirtualHost *:443>
#APACHE stuff...
SSLEngine on
RewriteCond %{HTTP_HOST} !^www\. [NC] #Force www... be careful with subdomains
RewriteRule ^ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</VirtualHost>

3) settings.php

$base_url = 'https://www.example.com';  // NO trailing slash!

And voooala!! this will make all http traffic travel over https including resources like js and css. If you want subdomains, be sure to add the appropriate ServerAlias directives in the vhosts file(s).

0

I use the Ubercart SSL module which is a fantastic module, though it is horribly named. You do not need to be running Ubercart to take advantage of this module which is very stable and easy to use.

protected by kiamlaluno Aug 26 '14 at 3:42

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.