xSmurf

# Virtual host
# Most of the hosts were removed for clarity

# Secure Server
##
## SSL Virtual Host Context
##
<IfDefine SSL>
<VirtualHost _default_:443>
        DocumentRoot "/var/www/secure_http"
        ServerName secure.domain.tld:443
        ServerAlias secure secure.domain.tld
        ServerAdmin admin@domain.tld
        ErrorLog /var/log/httpd/error_log
        TransferLog /var/log/httpd/access_log
        
        SSLEngine on
        
        #SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+!LOW:+SSLv2:+EXP:+eNULL
        SSLCipherSuite HIGH:MEDIUM

        SSLCertificateFile /usr/pkg/etc/httpd/ssl.key/cert.crt
        SSLCertificateKeyFile /usr/pkg/etc/httpd/ssl.key/key.key
        
        #SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire        
        SSLOptions +StrictRequire

        <FilesMatch "\.(cgi|shtml|phtml|php3?)$">
                SSLOptions +StdEnvVars
        </FilesMatch>
        
        <Directory "/usr/pkg/libexec/cgi-bin">
                SSLOptions +StdEnvVars
        </Directory>
        
        <Directory "/var/www/secure_http">
                Options +FollowSymLinks
                
                <IfModule mod_dav.c>
                        DAV Off
                </IfModule>
        </Directory>
        
        SetEnvIf User-Agent ".*MSIE.*" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
        
        #   Per-Server Logging:
        #   The home of a custom SSL log file. Use this when you want a
        #   compact non-error SSL logfile on a virtual host basis.
        CustomLog /var/log/httpd/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
        <IfModule mod_rewrite.c>
                RewriteEngine On
                
                # this is a host that also exists in http
                RewriteCond %{HTTP_HOST} ^mail\.smurfturf\.net$          [NC]
                RewriteRule ^(.*)$ https://secure.smurfturf.net/mail$1  [R=301,L]

                # This is the main http server
                RewriteCond %{HTTP_HOST} ^((www\.)|^)smurfturf\.net$          [NC]
                RewriteRule ^(.*)$ https://secure.smurfturf.net/www$1  [R=301,L]

                RewriteCond %{HTTP_HOST} !^secure\.smurfturf\.net$          [NC]
                RewriteRule ^(.*)$ https://secure.smurfturf.net$1           [R=301,L]
                
                # Block TRACE/TRACK XSS vector
                RewriteCond %{REQUEST_METHOD} ^TRAC(E|K)
                RewriteRule .* - [F]
        </IfModule>
</VirtualHost>
</IfDefine>