IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Code page problem with httpd.conf for PKIServer

    Posted Mon November 15, 2021 07:33 AM

    I'm trying to configure the httpd server for the pki server.

    Ive cut and pasted RewriteRule ^/(AdmRootca|Rootca)/ssl-cgi/(.*)  from the red book, and I get
    RewriteRule: bad argument line '\xac/(AdmRootca|Rootca)/ssl-cgi/(.*)'

    My httpd.conf has been tagged as EBCDIC.  (For the z/OS® operating system, IBM HTTP Server expects the characters in the httpd.conf file to be in EBCDIC (code page IBM-1047).
    chtag -p httpd.conf gives
    t IBM-1047 T=on httpd.conf

    x'ac' looks like a unicode  ¬

    Is there a magic setting I need to enable for ihs to pick up the correct code page?

    Ive tried it with x'B0' ^, and x'5f' (¬)
    5f gives me RewriteRule: bad argument line '¬/(AdmRootca|Rootca)/ssl-cgi/(.*)' 
    b0 gives me RewriteRule: bad argument line '\xac/(AdmRootca|Rootca)/ssl-cgi/(.*)' 

    Colin



    ------------------------------
    Colin Paice
    ------------------------------


  • 2.  RE: Code page problem with httpd.conf for PKIServer

    Posted Tue November 16, 2021 07:23 AM
    Solved..
    The documentation had
    RewriteRule ^/(AdmRootca|Rootca)/ssl-cgi/(.*)
    it needs to be
    RewriteRule "^/(AdmRootca|Rootca)/ssl-cgi/(.*)"

    ------------------------------
    Colin Paice
    ------------------------------

    Original Message


  • 3.  RE: Code page problem with httpd.conf for PKIServer

    Posted Tue November 16, 2021 08:04 AM
    Thanks for sharing the solution Colin.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------

    Original Message


  • 4.  RE: Code page problem with httpd.conf for PKIServer

    Posted Tue November 16, 2021 09:18 AM
    and
    RewriteRule ^/(AdmRootca|Rootca)/ssl-cgi/(.*)
    https://wtsc76.itso.ibm.com/$1/ssl-cgi-bin/$2 [R,NE]
    should be on one line

    RewriteRule "^/(AdmRootca|Rootca)/ssl-cgi/(.*) https://wtsc76.itso.ibm.com/$1/ssl-cgi-bin/$2 [R,NE]"

    I set up

    define url http://10.1.1.2
    define urls https://10.1.1.2
    RewriteRule "^/(AdmRootca|Rootca)/ssl-cgi/(.*) ${urls}/$1/ssl-cgi-bin/$2 [R,NE] "

    to make it easier ( and so it fits on one line) ad can isolate the url from the rules.
    Similarly use ${application-root} instead of  application-root in the vhost files.

    I also put my stuff into

    /u/mqweb/conf/colin.conf
    and put
    Include /u/mqweb/conf/colin.conf

    at the bottom of the httpd.conf file.

    I'm working on a blog entry for this stuff, and I'll include it in the blog post.

    ------------------------------
    Colin Paice
    ------------------------------

    Original Message


  • 5.  RE: Code page problem with httpd.conf for PKIServer

    Posted Wed November 17, 2021 01:50 PM
    Jon / Colin,

    What platform is the http configuration file used? There are no quotes used in the RewriteRule in the shipped http configuration files from PKI Services. RewriteRule without qutoes works on z/OS.

    Would you share your experience on z/OS PKI Services?

    ------------------------------
    Wai Choi
    ------------------------------

    Original Message


  • 6.  RE: Code page problem with httpd.conf for PKIServer

    Posted Wed November 17, 2021 03:08 PM

    Hi Wai Choi,

    Perhaps the problem is that the line was split onto two lines
    so the doc says...
    RewriteRule ^/(AdmRootca|Rootca)/ssl-cgi/(.*)
    https://wtsc76.itso.ibm.com/$1/ssl-cgi-bin/$2 [R,NE]

    which fails
    but
    RewriteRule ^/(AdmRootca|Rootca)/ssl-cgi/(.*) https://wtsc76.itso.ibm.com/$1/ssl-cgi-bin/$2 [R,NE]
    works

    I dont have my z/OS up at the moment. to check.

    re PKI Services..
    I found that it you can use IKYSETUP as is - then it looks OK at a naive level.

    I really struggled with it, as it didnt match my environment, and found I was having to make a lot of changes to the rexx it to get it to work.  In the end, I gave up, and have some PDS members which I found much simpler to use.

    I'll blog my work and put the files up on github.

    I hit problems like a group was defined (I changed it to use AUTOGID).  When I reran IKYSETUP, the group already existed.
    Deleting the group didn't work, as I did not know you can only delete a group with no userids connected. (This is not documented)  The messages were unhelpful  (and wrong).

    Ive raised an RFE for a  RACF delgroup .. purge(YES) so I can delete without having to remove all of the users.

    I reckon that all products should be installable in under 2 hours -  from 0 customisation up to to getting something up and working.  It took me a morning to sort out the define/delete group!

    I'm currently playing with httpd apache, and understanding that (and working on blogging about it).   The red books you pointed me to are a good start, but I think they need a bit more work to make it slicker.
    For example

    - put an Include conf/colin.conf  in the httpd.conf file, and keep people's fingers out of httpd.conf.
    - ship httpd.conf with a conditional include conf/user.conf so that people just create the user.conf - and do not have to change the httpd.conf file.
    - user variables for the url etc, so I do not have to any (many) changes in the vhost*.conf files...   This means
    RewriteRule ^/(AdmRootca|Rootca)/ssl-cgi/(.*) https://wtsc76.itso.ibm.com/$1/ssl-cgi-bin/$2 [R,NE]
    would be RewriteRule ^/(AdmRootca|Rootca)/ssl-cgi/(.*) ${url}/$1/ssl-cgi-bin/$2 [R,NE] 
    or even
    RewriteRule ^/(${ca})/ssl-cgi/(.*) ${url}/$1/ssl-cgi-bin/$2 [R,NE]

    regards

    Colin



    ------------------------------
    Colin Paice
    ------------------------------

    Original Message


  • 7.  RE: Code page problem with httpd.conf for PKIServer

    Posted Wed November 17, 2021 05:20 PM
    Colin,

    Thanks for sharing.

    You can run IKYSETUP with options: EX 'data-set-name(IKYSETUP)' 'RUN(YES | NO | PROMPT)' 
    YES - indicates to run it as is
    NO - indicates to display the commands only
    PROMPT - indicates to prompt the user prior to invoking each command

    The http server that PKI Services uses doesn't need to be used only for PKI Services. We envision that other applications are already using it in the system. The configuration files we shipped only contain the information specific to PKI Services.

    ------------------------------
    Wai Choi
    ------------------------------

    Original Message


Related Content