2

I am setting up a Virtual Machine with Ubuntu 10.04 Lucid Lynx Server.

I have been reading the section on setting up Apache with an SSL certificate within the book : "Beginning Ubuntu LTS Server Administration - 2nd Edition"

Contrary to the official documentation, the book advises to always use a 'pass phrase' when setting up Apache with SSL (to protect your reputation if the private SSL key is compromised).

If you set-up a 'pass phrased SSL key' then you are required to type a pass phrase each time you start Apache. This is a slight problem if Apache starts up automatically when Ubuntu boots up.

On page 338 it then offers a tip to prevent Apache from starting up at boot time.

...To ensure that it doesn't start automatically, enter the line NO_START=0 in /etc/default/apache2

I have modified that /etc/default/apache2 file accordingly, rebooted and Apache2 is still trying to start-up upon boot. The NO_START=0 line seems to have no effect.

As I look through forums on the web, it seems that most people have issues and then end up skirting the problem by simply using a certificate without a pass phrase.

Does anyone know the the best practice method of preventing Apache from starting up at boot time for a passphrased secure SSL'd Apache?

3
  • Are you sure /etc/default/apache2 is being read? Depending on your configuration, this may not be the case. If the answer is yes, I recommend you file a bug. Can you preproduce this problem on Debian?
    – Faheem Mitha
    Jun 23, 2011 at 16:29
  • I checked the file: # vim /etc/init.d/apache2 and could not see any mention of NO_START within it. So, I guessed it wasn't a variable that made a difference. I'm not experienced enough to know if its a bug or not, though. I haven't tried it on Debian per se - just 'Ubuntu 10.04 server' installed as 'minimal virtual machine' on VMWware player. With Apache/2.2.14 (Ubuntu)
    – JW01
    Jun 23, 2011 at 16:40
  • If the variable does not appear in/etc/init.d/apache that is not conclusive. It might be read somewhere else. However, it is possible you are referring to some distribution specific documentation. I don't know what pg 338 you are referring to. The page you linked to was an Ubuntu web page entitled 'Certificates'.
    – Faheem Mitha
    Jun 23, 2011 at 18:17

2 Answers 2

Reset to default
5

To disable the auto-starting of a service you can use:

sudo update-rc.d -f SERVICE disable

so in your case a

sudo update-rc.d -f apache2 disable

should do the job. To enable a service just replace the disable with an enable ;-)

Aux: To get an overview of services starting with a specific runlevel you might install sysv-rc-conf. Executing sysv-rc-conf you can enable/disable services with space. q closes the program and saves the changes.

1
  • Thanks. I have just tried this out and it works perfectly. Bonus for telling me how to enable it again too. ;o)
    – JW01
    Jun 23, 2011 at 15:50
1

You dont need to disable apache from starting for just entering passphrase to ssl certificate. There is a better way. Add the following line to the httpd.conf file.

SSLPassPhraseDialog exec:/etc/apache2/conf.d/passphrase.sh

Make sure you have execute permission bit set on the file passphrase.sh and file is secure. And create the file passphrase.sh in the above path with the following content.

#!/bin/bash
echo "your passphrase here"

Now your apache web server can be started and stopped without needing to enter the passphrase manually and without needing to resort to passphraseless key file and you dont have to disable automatic startup of apache web server.

1
  • 1
    I suspect it defeats the point of having a passphrase if the passphrase is sitting on the same machine as the private key. But, thanks for the tip... its always handy to know these things.
    – JW01
    Jun 27, 2011 at 22:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .