Am 13.02.2024 um 16:10 schrieb Emmanuel Seyman emmanuel@seyman.fr:
- Peter Boy [13/02/2024 10:36] :
Unfortunately we are experiencing a common Fedora problem, nobody responds to it and the bug reports are left unprocessed and pile up. And because none of the maintainers respond at all, we have now also missed all the deadlines for improving something for f40.
Sad but not surprising...
- Would someone take the bug report and check my analyses?
Looking at httpd's git repo, it doesn't look like we change the configuration as shipped upstream to a significant degree. And, looking at httpd's subversion repo, _default_ is used both at the tip of the 2.4 branch and trunk.
Question is, what is upstream? If I remember correctly, we use historically httpd, which is a specially licensed version of Apache, so that Red Hat can distribute an Apache server under its own name. I don't remember the exact details, the origin is about 2 decades ago. In any case, the original, "real" upstream is Apache.
And "real" upstream has changed the meaning of the string _default_ with version 2.4. Up to 2.3, this specifically referred to the default server, which is used if none of the configured ServerNames or ServerAlias correspond to a request. This was abandoned with 2.4 and the string _default_ has been a synonym for "*" since the first release of version 2.4, so it applies to all Servers!
And since then, the default server is the configuration which was find first in the alphabetical sorting. So when the configuration for the default server is determined, the configuration from httpd.conf is taken first, then the one for * (now the one with the server name _default_) and then the vhost configuration file, which is the first in alphabetical order. And since the vhosts inherit the general settings, they also inherit, for example, the DocumentRoot on the _default_ server for port 443 in ssl.conf and - even worse - the self-signed certificate created there. The user therefore creates a certificate in his configuration file, but this is not used because it has already been configured in _default_.
If you look at a Fedora version with Apache 2.3 - which must be something around Fedora 20 or maybe even earlier - you will find the same ssl.conf as now. This lets me assume that the change to the string _default_ was overlooked back then. Presumably the admins have since developed various local customizations for themselves, or they have immediately used Debian or similar for web servers. In any case, I have been deleting the ssl.conf for years and configuring everything in the host files. But that really isn't a long-term solution.
I'll also argue that using virtual hosts for the domain matching your server's name is a mistake but I'm not sure how popular the sentiment is...
- Should we create a new https-server package which takes the binaries and provides an alternative configuration? Probably similar to default-editor-vim / default-editor-nano?
I really don't like this idea. I would much rather we work with upstream to improve the default configuration.
I really don’t like that either. But what can we do if the maintainer(s) won't budge? Should we contact them directly? I don’t even know, who is maintainer and co-maintainer.
A configuration that was good 10 or 20 years ago may no longer be suitable today.
-- Peter Boy https://fedoraproject.org/wiki/User:Pboy PBoy@fedoraproject.org
Timezone: CET (UTC+1) / CEST (UTC+2)
Fedora Server Edition Working Group member Fedora Docs team contributor and board member Java developer and enthusiast