Securing my Moodle site with HTTPS

Securing my Moodle site with HTTPS

by Pál Csányi -
Number of replies: 24

Hello,

I am running Moodle  version 3.2.3 on a RaspBerry Pi Model 2 hardware.

I am using NGINX web server on it.

I just set up my nginx server to use https only. I get a certificate from Let's Encrypt for it.

What I want is to secure my Moodle site so it can be opened with https only.

First I set up my Moodle site through Settings > Site administration > Security > HTTP security

to not to use https login but just use secure coockies.

Then I turn on https on Nginx and reload my Moodle site using https like this: https://www.cspl.hu/moodle. There is no images, everything is messed up.

I am reading these for help:

https://docs.moodle.org/33/en/HTTP_security

https://moodle.org/mod/forum/discuss.php?d=339129

Just do not understand then what to turn on and what to turn off in the HTTP security out there?

What to do to get my Moodle site secure and beautiful?

Best, from Pal

Average of ratings: -
In reply to Pál Csányi

Re: Securing my Moodle site with HTTPS

by Bret Miller -
Picture of Particularly helpful Moodlers

When you change from http to https, you are changing the URL the site runs on. When you do that, you need to update the database with the new URL by running the search/replace tool. Read https://docs.moodle.org/32/en/Moodle_migration


In reply to Bret Miller

Tárgy: Re: Securing my Moodle site with HTTPS

by Pál Csányi -
When you change from http to https, you are changing the URL the site runs on. When you do that, you need to update the database with the new URL by running the search/replace tool. Read https://docs.moodle.org/32/en/Moodle_migration

Well, I am trying to follow https://docs.moodle.org/32/en/Search_and_replace_tool and try to open

http://www.cspl.hu/admin/tool/replace/index.php which is my Moodle site but then I get the web page:

http://www.cspl.hu/moodle/

so nothing happens out there.

When I am trying to run this command:

php admin/tool/replace/cli/replace.php --search=//http://www.cspl.hu --replace=//https://www.cspl.hu

I get the output:

The replacement string is longer than the original, it can not be shortened, the operation can not be resumed.

So what am I missing here?

In reply to Pál Csányi

Tárgy: Re: Securing my Moodle site with HTTPS

by Pál Csányi -

So I just tried to search and replace in my PostgreSQL moodle database the text 'http://www.cspl.hu' with 'https://cspl.hu' like this:

postgres@malnap ~ $ psql moodle
psql (9.5.7)
Type "help" for help.

moodle=# select
REPLACE('http://www.cspl.hu', 'http://www.cspl.hu', 'http://cspl.hu' );
    replace    
----------------
 http://cspl.hu
(1 row)

moodle=# select
REPLACE('http://cspl.hu', 'http://cspl.hu', 'https://cspl.hu' );
     replace    
-----------------
 https://cspl.hu
(1 row)

moodle=#

and changed in the config.php this too ( it was 'http://cspl.hu/moodle'):

$CFG->wwwroot   = 'https://cspl.hu/moodle';

but it seems that that nothing changed. Why?

In reply to Pál Csányi

Tárgy: Re: Securing my Moodle site with HTTPS

by Pál Csányi -

Well, the situation is changing a little.

These days, I was working to secure my web site https://cspl.hu .

I had difficulties to set up Nginx web server where is running my Moodle site on.

It is a small hardware called Raspberry Pi Model 2.

I must ask a public IP address from my ISP for this too.

So these days my web site was unreachable for some reason. The reason was the lack of the right setup of my Cable modem. On this modem is connected the RasPi too.

Finally, today I have success to set up the modem so my site is now reachable from the Internet.

And see the miracle, I can open in my Moodle site http://cspl.hu/admin/tool/replace/index.php so I can perform the run of the search - replace tool. I just changed the 'http://www.cspl.hu' into 'https://cspl.hu' in my moodle database through the Moodle's web interface.

But, still can't use my Moodle site in secure way. When I try to open it at https://cspl.hu/moodle I came to te site http://www.cspl.hu/moodle/my/ which is not secure. Why?

In reply to Pál Csányi

Tárgy: Re: Securing my Moodle site with HTTPS

by Pál Csányi -

Actually the situation is that that I can use my Moodle site unsecurely, with http.

However, when I open it with https, there are no images, fancy things.

Does it mean that that Moodle can't be setup for https?!

Or does it mean just that that I do not know how to do it?

In reply to Pál Csányi

Re: Tárgy: Re: Securing my Moodle site with HTTPS

by Ken Task -
Picture of Particularly helpful Moodlers

Two things to do when changing from http to https ... assuming there is a valid certificate for the server (not self signed, but purchased via a Certificate of Authority entity) ... see you are using "let's encrypt", however.

The search and replace is one.   Can be used via browser.   http://site/admin/tool/replace/ There is no link in Moodle menus for the tool - must use URL line of browser.

The other is changing config.php ... look for http://yoursitte/ and change to https://yoursite.

Moodle uses the wwwroot variable in config.php to build *every* internal link ... ie, Moodle menus, internal Moodle links to activities/mods,etc.

'spirit of sharing', Ken

In reply to Ken Task

Tárgy: Re: Tárgy: Re: Securing my Moodle site with HTTPS

by Pál Csányi -

Hello Ken,

all these two things are setup as you advice.

Still does not work. So it seems that that something has a wrong setup?

I did run the searh/replace tool via browser already. However, can I verify this?

The config.php file is setup to $CFG->wwwroot   = 'https://cspl.hu/moodle';

Any advices will be appreciated!

Best, from Pali


In reply to Pál Csányi

Re: Tárgy: Re: Tárgy: Re: Securing my Moodle site with HTTPS

by Ken Task -
Picture of Particularly helpful Moodlers

www.cspi.hu or cspi.hu?

The latter is top level domain ... where as www.cspi.hu is a host within the domain.

A curl test @

curl -I https://www.cspl.hu/moodle/

does get a moodle session/cookie

curl -I https://cspl.hu/moodle/

does *not* get a moodle session/cookie

DNS queries for TLD or www resolve to the same IP address.

accessing the site with browser via https://cspi.hu/moodle/ gets auto'd to http://www.cspi.hu/moodle/ and theme looks correct.

However, going to: https://www.cspi.hu/moodle one gets a wonky theme ...

So what's in config.php again?

Search and replace my not have been done correctly.

Some internal links on the page one gets with https are http others are not.

Suggest doing an SQL dump of database and then using nano or similar text editor, search for http://www.cspi.hu to see what you can find ... as well as http://cspi.hu ....

Nano has search and replace and one can replace one reference at a time.

What's in the DB has to match what's in config.php.

After getting the sql dump file correctly, use it to import into a *new* DB for the moodle.  Edit config.php and point to new DB.

'spirit of sharing', Ken



In reply to Ken Task

Tárgy: Re: Tárgy: Re: Tárgy: Re: Securing my Moodle site with HTTPS

by Pál Csányi -

So what's in config.php again?

Now is

$CFG->wwwroot   = 'https://www.cspl.hu/moodle';

in config.php and

I did before SQL dump so I have moodle database backup prior modifying http to https at all.

I used nano to search in moodle20170713.sql dump file string 'http://cspl.hu', 'http://www.cspl.hu' so what I find after this search I replaced to be 'https://www.cspl.hu'.

Then I copy this dump file to place where postgres user will find it:

cp moodle20170713.sql /var/lib/postgresql/

Then I login as postgres user

su - postgres

and drop the moodle database, then create it again, and import to it the edited dump file:

dropdb moodle
psql -c "create database moodle with encoding 'unicode';" -U postgres template1
psql moodle < moodle20170713.sql

However, I do not see any changes out there.

Still get not work https://www.cspl.hu/moodle . Why?

In reply to Pál Csányi

Re: Tárgy: Re: Tárgy: Re: Tárgy: Re: Securing my Moodle site with HTTPS

by Ken Task -
Picture of Particularly helpful Moodlers

Moodle caches a lot now-a-days ... so after one makes a change to the URL, purge the caches .... manually.

In moodledata, remove the contents of the 'cache' directory.   In moodledata, remove the contents of 'localcache' directory.   Moodle will rebuild those.

This part where you said ...

"I used nano to search in moodle20170713.sql dump file string 'http://cspl.hu', 'http://www.cspl.hu' so what I find after this search I replaced to be 'https://www.cspl.hu'."

**IF your old site** was http://cspi.hu/ ... and there was no 'moodle' subdirectory ... the url worked no issues.

In your new site where you want https://www.cspi.hu/ **there is** a moodle subdirectory.

Search for http://cspi.hu/  replace with https://www.cspi/hu/moodle/

Make sure you use http protrocol (URL) in front .... and put a trailing slash at the end ... using the Nano search and replace.

In the config.php file, no trailing slashes.

'spirit of sharing', Ken

Vaariable in config.php has https://www.cspi.hu/moodle

'spirit of sharing', Ken


In reply to Ken Task

Tárgy: Re: Tárgy: Re: Tárgy: Re: Tárgy: Re: Securing my Moodle site with HTTPS

by Pál Csányi -

I did purge cahces as you adviced. Still no success here.

When I search and replace my moodle dump file, I replaced the part http://www.cspl.hu only, so if there was a subdirectory, like http://www.cspl.hu/moodle/login/forgot_password.php?token=Bxdx1WeQcOV6maXBXXe5aUOR1HONOzeG

it is now, after I replaced it like:

https://www.cspl.hu/moodle/login/forgot_password.php?token=Bxdx1WeQcOV6maXBXXe5aUOR1HONOzeG

So this is good. Something other is wrong, because if I open https://www.cspl.hu/moodle/ then it is look not good. Say when I move my mice pointer over some hyperlink, but not clik on it, I can see it's address, and htose address still remain like:

the hyperlink to start page of my moodle site shows following address

http://www.cspl.hu/moodle/

but it should shows

https://www.cspl.hu/moodle/

right, and so on the other ones too.

Well, I do not know what is wrong here?

In reply to Pál Csányi

Re: Tárgy: Re: Tárgy: Re: Tárgy: Re: Tárgy: Re: Securing my Moodle site with HTTPS

by Ken Task -
Picture of Particularly helpful Moodlers

All internal links should be stored in the DB.   No exceptions ... unless hard coded into something ... which I doubt anyone has done.   So those http:// links that appear ... are they in an HTML block?   Think HTML blocks might have been the exception to the Moodle Admin UI search and replace.

That's why I suggested working with an SQL dump.

So take another SQL dump of your DB as it is right now, edit in nano ... search for http://site/moodle/

Replace with https://site/moodle/

Create new DB, import newly edited sql dump.

Double check config.php

Did you change anything related in apache config ... main file or virtual server?

After importing ... manually remove contents of moodledata/cache/ moodledata/localcache/

Then, in your browser, do the same ...

Yesterday, I could reach your site ... today ... can't get there (times out).  Soooo ?????

'spirit of sharing', Ken

In reply to Ken Task

Re: Securing my Moodle site with HTTPS

by Pál Csányi -

Hello Ken,

All internal links should be stored in the DB.   No exceptions ... unless hard coded into something ... which I doubt anyone has done.   So those http:// links that appear ... are they in an HTML block?

I do not understand the question abowe: "are they in an HTML block?".

I did everything exactly ( with slash at the and of moodle/) as you adviced:

So take another SQL dump of your DB as it is right now, edit in nano ... search for http://site/moodle/
Replace with https://site/moodle/
Create new DB, import newly edited sql dump.
Double check config.php

After importing ... manually remove contents of moodledata/cache/ moodledata/localcache/
Then, in your browser, do the same ...

Nothing changed.

Did you change anything related in apache config ... main file or virtual server?

I am running nginx server, and must change it to get it work with HTTPS. But, with these settings I can open my moodle site booth with HTTP at this address: http://www.cspl.hu/moodle ( note "l" in cspl, it is not "i". ) and with HTTPS at address https://www.cspl.hu/moodle . So booth address can be opened with the difference that when opened with HTTPS, it is not look good. Moreover, as I said, on the opened page https://www.cspl.hu/moodle when I move over Login hyperlink my mice, it shows the address: http://www.cspl.hu/moodle/login/index.php and not the desired: https://www.cspl.hu/moodle/login/index.php .

Yesterday, I could reach your site ... today ... can't get there (times out).  Soooo ?????

Well, it is an issue with my ISP ( Internet Service Provider ) here. It is unusual that that one uses GNU/Linux operating system and not MS Windows here. I am using Gentoo Linux operating system booth on my laptop and on my Raspberry Pi Model 2 on which I am running the Nginx web server and my Moodle site. I wrote an e-mail to my ISP about this issue, namely my site is unreachable somethimes from the Internet. I am waiting it's respond.

So, no success here. Why?

Best, from Pali

In reply to Pál Csányi

Re: Securing my Moodle site with HTTPS

by Ken Task -
Picture of Particularly helpful Moodlers

What are the settings for use online YUI  libraries? .... that YUI stuff has to do with themes (css - what makes your theme nice or whonky) and if combo loading, that will try to access the Yahoo Libraries to acquire css (theme) code to render.   So IF I cannot see your site can your server 'see' yahoo libraries (inside your private network -> outside ... *but* combo loading *must* pull in from Yahoo libraries files?

Go to: http://YOUIRSERVER/moodle/admin/settings.php?section=ajax

UNCHECK use online YUI libraries.  Check for YUI combo loading ... what your Moodle can't acquire from the network it will try to use what it has .... at least that's what I understand of it .... maybe Mary Evans, very active in themes, could verify or assist here.

Also, thanks for the update on OS's .... comment: GenToo Linux is traditionally a good desktop Linux distro but there aren't many who run GenToo as a server platform serving WordPress, Joomla, Drupal, and maybe especially Moodle.   Could there be a difference?   Uhhhh ... yes, but don't know what.

That's also true of nginx ... compared to the blogs/wikis/docs on apache there is very little on nginx.

Don't run nginx myself .... when setting up https did you have to setup any kind of reverse proxy?

Did find this:

http://nginx.org/en/docs/http/configuring_https_servers.html

which shows to config https you do have to give a server name.

Are you runninng virtual nginx's?   See the link above.

All this to say, from what you described, I've not told or suggested anything wrong to you (I don't think).

Check the docs in Moodle ...

https://docs.moodle.org/33/en/Nginx

Here's a GenToo forum posting from way back .... might apply:

https://forums.gentoo.org/viewtopic-t-1037142-start-0.html

At this point .... think I've attempted to  'help' as much as a can!

As with anything open source and related to serving internet, we all choose our poisons ... and then must learn our antedotes! smile

'spirit of sharing', Ken



In reply to Ken Task

Re: Securing my Moodle site with HTTPS

by Pál Csányi -

Go to: http://YOUIRSERVER/moodle/admin/settings.php?section=ajax

UNCHECK use online YUI libraries.  Check for YUI combo loading ... what your Moodle can't acquire from the network it will try to use what it has .... at least that's what I understand of it .... maybe Mary Evans, very active in themes, could verify or assist here.

I did so, but these settings are exactly as it be if I follow your advice:

use online YUI libraries UNCHECKED

YUI combo loading CHECKED

when setting up https did you have to setup any kind of reverse proxy?

No, I did have not to setup reverse proxy.

which shows to config https you do have to give a server name.

I have it:

server_name www.cspl.hu;

Are you runninng virtual nginx's?

I am running virtual server ( https://www.nginx.com/resources/admin-guide/nginx-web-server/ )

user nginx nginx;
worker_processes 1;

error_log /var/log/nginx/error_log info;

events {
        worker_connections 1024;
        use epoll;
}

http {
        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        log_format main
        '$remote_addr - $remote_user [$time_local] '
        '"$request" $status $bytes_sent '
        '"$http_referer" "$http_user_agent" '
        '"$gzip_ratio"';

        client_max_body_size 15m;
        client_header_timeout 10m;
        client_body_timeout 10m;
        send_timeout 10m;

        connection_pool_size 256;
        client_header_buffer_size 1k;
        large_client_header_buffers 4 2k;
        request_pool_size 4k;

        gzip off;

        output_buffers 1 32k;
        postpone_output 1460;

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;

        keepalive_timeout 75 20;

        ignore_invalid_headers on;

        index index.html index.php;

        server {
                listen 80;
                listen 443 ssl;

                server_name www.cspl.hu;

                root /var/www/localhost/htdocs;
                location = /KisTechTavOktKulcsosPicike.ico {
                log_not_found off;
                access_log off;
                }
               
                ssl_certificate /etc/ssl/certs/chained.pem;
                ssl_certificate_key /etc/ssl/private/domain.key;
                ssl_session_timeout 5m;
                ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
                ssl_ciphers *************;
                ssl_session_cache shared:SSL:50m;
                ssl_dhparam /etc/ssl/certs/dhparam.pem;
                ssl_prefer_server_ciphers on;

                access_log /var/log/nginx/localhost.access_log main;
                error_log /var/log/nginx/localhost.error_log info;

                access_log /var/log/nginx/localhost.ssl_access_log main;
                error_log /var/log/nginx/localhost.ssl_error_log info;

                location ~ [^/]\.php(/|$) {
                fastcgi_split_path_info ^(.+?\.php)(/.*)$;
                if (!-f $document_root$fastcgi_script_name) {
                return 404;
                }

                fastcgi_pass unix:/var/run/php-fpm/php-fpm.sock;
                fastcgi_index index.php;
                include fastcgi_params;
                include fastcgi.conf;

                }

                location /dataroot/ {
                internal;
                alias /var/www/localhost/moodle/; # ensure the path ends with /
                }
               
                location /moodlelib/ {
                internal;
                alias /var/www/localhost/htdocs/moodle/lib/; # ensure the path ends with /
                }
 
        }
}             
                location /moodlepix/ {
                internal;
                alias /var/www/localhost/htdocs/moodle/pix/; # ensure the path ends with /
                }
               
                location /moodletheme/ {
                internal;
                alias /var/www/localhost/htdocs/moodle/theme/; # ensure the path ends with /
                }
        }
}

Here's a GenToo forum posting from way back .... might apply:
https://forums.gentoo.org/viewtopic-t-1037142-start-0.html

paul_chany is me. smile

At this point .... think I've attempted to  'help' as much as a can!

Thank you very much for your help that you give so far.

Other who would help?


Best, from Pali

In reply to Pál Csányi

Re: Securing my Moodle site with HTTPS

by Ken Task -
Picture of Particularly helpful Moodlers

I can only provide an example of what you should see ***IF*** config.php has https://site/moodle/ for $CFG->wwwroot   = 'https://example.com/moodle';

http://sos.tcea.org/

above link is not a moodle but a static page

https://sos.tcea.org ... is same static page but using https

http://sos.tcea.org/moodle33/ - this link will get a notification that the site can be accessed only by using https ... not http.

Your site, however, doesn't present that notice ... it displays with http:// just fine ... theme looks just fine.    It displays with https:// without css stuff.

Using FireFox webdeveloper tool to view the site as https shows




In reply to Ken Task

Re: Securing my Moodle site with HTTPS

by Pál Csányi -

When you open this webpage on my Moodle site:

https://www.cspl.hu/moodle/?lang=en

then when hover the mice pointer over Home hyperlink, it shows:

http://www.cspl.hu/moodle/

and not shows:

https://www.cspl.hu/moodle/

Similarly on that webpage the 'Log in' hyperlink shows:

http://www.cspl.hu/moodle/login/index.php

and not

https://www.cspl.hu/moodle/login/index.php

So, I think that that in my Moodle site there are still not set up all the hyperlinks to HTTPS out there. How can it be, when I search and replace my moodle database from http://www.cspl.hu/moodle/ to https://www.cspl.hu/moodle/ ??

As you can see in the image of my Moodle site you posted abowe, there are http addresses and not https addresses. Why?

I just tied to set up my Nginx server as adviced here:

https://www.digitalocean.com/community/tutorials/how-to-set-up-nginx-with-http-2-support-on-ubuntu-16-04

but that not helped to much.

In reply to Pál Csányi

Re: Securing my Moodle site with HTTPS

by Ken Task -
Picture of Particularly helpful Moodlers

Have a bash shell script that ask two questions then searches all the tables
of the database given for the search string.    Here's the output of that script.

[root@sos ~]# ./searchdb
Which database do you want to search in (press 0 to see all databases): moodle32
Which string do you want to search: https://sos.tcea.org/moodle32/
Your searchstring was found in table mdl_grade_grades, column rawgrademin
Your searchstring was found in table mdl_grade_grades, column aggregationweight
Your searchstring was found in table mdl_grade_grades_history, column rawgrademin
Your searchstring was found in table mdl_grade_items, column grademax
Your searchstring was found in table mdl_grade_items, column grademin
Your searchstring was found in table mdl_grade_items, column gradepass
Your searchstring was found in table mdl_grade_items, column plusfactor
Your searchstring was found in table mdl_grade_items, column aggregationcoef
Your searchstring was found in table mdl_grade_items, column aggregationcoef2
Your searchstring was found in table mdl_grade_items_history, column grademin
Your searchstring was found in table mdl_grade_items_history, column gradepass
Your searchstring was found in table mdl_grade_items_history, column plusfactor
Your searchstring was found in table mdl_grade_items_history, column aggregationcoef
Your searchstring was found in table mdl_grade_items_history, column aggregationcoef
Your searchstring was found in table mdl_question, column defaultmark
Your searchstring was found in table mdl_question_answers, column fraction

In 3.2 code searched for $CFG->wwwroot one sees these related to theme (there are many other
references all throughout the code).

But, just for themes:

[root@sos moodle30]# fgrep '$CFG->wwwroot' ./*/*.php |grep theme
./theme/index.php:    echo $OUTPUT->continue_button($CFG->wwwroot . '/theme/index.php');
./theme/styles.php:    $relroot = preg_replace('|^http.?://[^/]+|', '', $CFG->wwwroot);
./theme/yui_combo.php:    $relroot = preg_replace('|^http.?://[^/]+|', '', $CFG->wwwroot);

Now am not a coder, but ... see the $relroot variable?  it replaces http:// with whatever
is in $CFG->wwwroot= of the config.php file at the root of moodle code.

So once again, check config.php ... leave the $CFG->wwwroot variable for the
protocol and FQDN and /moodle/ ... cause that's where your moodle code resides.   There is only one $CFG->wwwroot line.   It does not have apache variables, etc. .... just the URL to your site as one would use on the browser URL line.

What you were following was a tutorial for Ubuntu 16.04.
That certainly is NOT Gentoo!!!

Ok, here's a site for gentoo Linux and nginx.
https://wiki.gentoo.org/wiki/Nginx

Compare what it shows with what you have.

Ok, ... am really at an end now!

'spirit of sharing', Ken


In reply to Ken Task

Re: Securing my Moodle site with HTTPS

by Pál Csányi -

Have a bash shell script that ask two questions then searches all the tables of the database given for the search string.

Can you give to me that bash shell script please?

By the way I am going now to upgrade my Moodle site from 3.2.3 to 3.3.1.

In reply to Pál Csányi

Re: Securing my Moodle site with HTTPS

by Ken Task -
Picture of Particularly helpful Moodlers

Search DB shared
http://sos.tcea.org/searchdbshared.zip

Unzip it in /root.   Edit the script with nano change DB user and the password to your superuser and password for that superuser.

Dunno what good upgrading 3.2.3 to 3.3.1 will do .... issue will be the same if nginx/config.php are not configured correctly - makes no difference as to Moodle version ... the sos.tcea.org site has a 3.0,3.1,3.2, and a 3.3 installed and they all are configured the same as far as config.php and the wwwroot variable are concerned ... cept the directory in which the moodle code resides.

Did you compare the nginx page about setting it up with what you have?   Did you make any changes as a result?

If you are ever successful, you should come back to Moodle docs and add a page sharing how you setup Gento Linux, with nginx, and Moodle.    Might be the only document in all of internet like it. ;)

'spirit of sharing', Ken


In reply to Ken Task

Tárgy: Re: Securing my Moodle site with HTTPS

by Pál Csányi -

Hello Ken,

I have finally fix it.

I once again set up my Nginx for HTTPS.

Then I just uninstalled moodle, delete everything, moodledata too ( however, I have it as a copy here ).

Then I installed moodle again.

Now I can use my Moodle site securely.

I will add a page to Moodle docs sharing how I did setup Gentoo Linux, with nginx, and Moodle.

Best, from Pali

In reply to Pál Csányi

Tárgy: Re: Securing my Moodle site with HTTPS

by Pál Csányi -

Hi Ken,

I just added the page that is about installing Gentoo Linux on to Raspberry Pi and configuring Nginx web server and install Moodle on these base.

Best, from Pali

Average of ratings: Useful (1)