At times, we need to serve some sort of file sharing over the Internet but instead of just grant the access anonymously, we need also to control who can access it. And also some SSL encryptions along the way.
The instructions herein are based on Ubuntu Server v.22.04.3 system, a TrueNAS Scale and all in the same VLAN.
The TrueNAS Scale server already have Samba Service (SMB) enabled with all the necessary credentials and folders permissions created.
1. As always, ensure the Ubuntu repositories are up-to-date. If there are "Kernel" update, a system restart is required.
|
|
2. Next is to install Apache2 server.
|
|
3. Now we need to create a folder to hold the website. Replace "demo.com.my" with your domain name. You can also a Dynamic DNS, ensure the DDNS is updated.
4. Next is to assign the proper ownership and access to the new folder. Replaced the text in "Red" accordingly.
5. For testing purposes, we need to create a temporary "index.html" file so that we can be sure the website is working as expected. Replaced the text in "Red" accordingly.
6. Type-in the following scripts.
7. Next is to create apache's configuration file that correspond to the website. Replaced the text in "Red" accordingly.
8. Type-in the following configuration scripts. Replace text in "Red" accordingly.
<VirtualHost *:80> ServerAdmin webmaster@localhost ServerName demo.com.my ServerAlias www.demo.com.my DocumentRoot /var/www/demo.com.my ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined </VirtualHost> |
9. Then we need to enable the new site. Replaced the text in "Red" accordingly.
10. Next is to disabled the "Default" site.
11. To ensure the configuration file is error free, perform a simple test. The result of the test return back should have "Syntax OK" displayed on the screen.
12. Now, restart apache2 services.
13. Next is to test whether the apache server is running correctly or not, open any preferred browser and browse to the URL. You will see the simple text word created earlier in the "index.html" file. Replaced the text in "Red" accordingly.
In case, that the DNS is not up-to-date; you can use IP Address instead. Replaced the text in "Red" accordingly.
13. In order for the server to access the TrueNAS Scale's SMB service, we need to install CIFS Utility.
14. After installation complete, we now need to create a "Mount Point" or folder in the server first. Replaced the text in "Red" accordingly.
15. Now, assuming that my TrueNAS Scale's IP Address is "192.168.0.2", where the intended share folder name is "Public", we need to manually mount the share to our local mount point. Replaced the text in "Red" accordingly.
You will be prompted for the password, type-in the password that corresponds to the credentials in TrueNAS Scale.
16. Next is to enabled the "WebDAV" module in Apache2 and restart the service.
17. Grant the proper access permissions for apache to that folder. Replaced the text in "Red" accordingly.
18. We need to create a folder location to store WedDAV's database file for storing username and password that have access to the webdav services.
19. Now, we need to modify the configuration of the website to work with webdav. Replaced the text in "Red" accordingly.
DavLockDB /usr/local/apache/var/DavLock <VirtualHost *:80> ServerAdmin webmaster@localhost ServerName demo.com.my ServerAlias www.demo.com.my DocumentRoot /var/www/demo.com.my ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined Alias /samba_share /mnt/samba_share <Directory /mnt/samba_share> Options Indexes DAV ON AuthType Digest AuthName "webdav" AuthUserFile /usr/local/apache/var/users.password Require valid-user </Directory> </VirtualHost> |
20. Verify the configurations and restart apache2 service.
|
sudo systemctl restart apache2
|
21. Next is to create the WebDAV's database file for storing the username and password, the password is encrypted in the file.
| sudo touch /usr/local/apache/var/users.password |
22. Assign the proper ownership to the file.
| sudo chown www-data:www-data /usr/local/apache/var/users.password |
23. Next is to create the first user into the database. Replaced the text in "Red" accordingly
| sudo htdigest -c /usr/local/apache/var/users.password webdav demo_user |
Note :
(1) "webdav" = Realm
You will be prompted to key-in a password for this username and re-confirm the password again. Ensure that both password matches exactly the same.
24. Now, we need to enable the Authentication Digest module in apache and restart the service.
| sudo a2enmod auth_digest |
| sudo systemctl restart apache2 |
25. Once all done, we can test whether the WebDAV services is configured directly or not. Open any preferred browser and type-in the following URL. Replaced the text in "Red" accordingly
| http://demo.com.my/samba_share |
You should be prompted for a username and password, key-in the credentials we have created earlier for WebDAV services.
26. You might also want to configure the auto-mount for the samba services, after every-time the server restart. This step is OPTIONAL.
| sudo nano /etc/fstab |
Type-in the following configurations. Replaced the text in "Red" accordingly
| //192.168.0.1/public /mnt/samba_share cifs username=demo_user,password=demo123 0 0 |
27. If you want to allow access from External Internet, it is advised to have SSL Certificate (Let's Encrypt) installed. Also ensure that your "Router" or "Firewall" have the appropriate port "Whitelisted" or enabled "Port Forwarding" accordingly. (eg. 443/TCP)
| sudo apt install certbot python3-certbot-apache -y |
28. Now request for a new SSL Certificate from Let's Encrypt.
| sudo certbot --apache |
29. You will be prompted for an email address, please ensure the email address you type-in is "VALID", this is to ensure you will receive email notification about the renewal of the SSL Certificate.
Also you must agreed to Let's Encrypt's Terms and Conditions of use, type-in "Y" to accept it.
You can also opt-in to their newsletter and marketing materials, but as this is a demo I have chosen "N" for this tutorials.
30. Next, you will prompted to select which domain you want to have the SSL certificate installed, in this case I will just select "demo.com.my" domain, but you can also do the same steps for "www.demo.com.my" too.
31. Once everything is completed, we need to restart apache2 services again.
| sudo systemctl restart apache2 |
32. Now we can test the new SSL certificate, open your preferred browser and type-in the following URL. Take note now we are using "HTTPS" instead. Replaced the text in "Red" accordingly
| https://demo.com.my/samba_share |
And as expected, you should be prompted for a username and password to access the content.
!!! HAPPY COMPUTING !!!
No comments:
Post a Comment