Skip to content

Commit 54987a9

Browse files
ms217ms217
committed
try to detect the correct OpenSSL version and activate TLS 1.3 if available for Nginx systems
1 parent c8ddb95 commit 54987a9

File tree

4 files changed

+274
-1
lines changed

4 files changed

+274
-1
lines changed

‎server/conf/nginx_vhost.conf.master‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,12 @@ server {
1818
listen <tmpl_var name='ip_address'>:<tmpl_var name='proxy_protocol_https'> ssl proxy_protocol;
1919
</tmpl_if>
2020
</tmpl_if>
21-
ssl_protocols TLSv1.2;
21+
22+
<tmpl_if name='openssl_version' op='>=' value='1.1.1' format='version'>
23+
<tmpl_var name="ssl_comment">ssl_protocols TLSv1.3 TLSv1.2;
24+
<tmpl_else>
25+
<tmpl_var name="ssl_comment">ssl_protocols TLSv1.2;
26+
</tmpl_if>
2227
# ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
2328
# ssl_prefer_server_ciphers on;
2429
<tmpl_if name='ipv6_enabled'>

‎server/lib/classes/cron.d/100-monitor_needs_restarting.inc.php‎

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
<?php
2+
3+
/*
4+
Copyright (c) 2013, Marius Cramer, pixcept KG
5+
All rights reserved.
6+
7+
Redistribution and use in source and binary forms, with or without modification,
8+
are permitted provided that the following conditions are met:
9+
10+
* Redistributions of source code must retain the above copyright notice,
11+
this list of conditions and the following disclaimer.
12+
* Redistributions in binary form must reproduce the above copyright notice,
13+
this list of conditions and the following disclaimer in the documentation
14+
and/or other materials provided with the distribution.
15+
* Neither the name of ISPConfig nor the names of its contributors
16+
may be used to endorse or promote products derived from this software without
17+
specific prior written permission.
18+
19+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
20+
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
21+
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22+
IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
23+
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
24+
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25+
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
26+
OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
27+
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
28+
EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29+
*/
30+
31+
class cronjob_monitor_system_update extends cronjob {
32+
33+
// job schedule
34+
protected $_schedule = '0 * * * *';
35+
protected $_run_at_new = true;
36+
37+
private $_tools = null;
38+
39+
/* this function is optional if it contains no custom code */
40+
public function onPrepare() {
41+
global $app;
42+
43+
parent::onPrepare();
44+
}
45+
46+
/* this function is optional if it contains no custom code */
47+
public function onBeforeRun() {
48+
global $app;
49+
50+
return parent::onBeforeRun();
51+
}
52+
53+
public function onRunJob() {
54+
global $app, $conf;
55+
56+
$app->uses('getconf');
57+
$server_config = $app->getconf->get_server_config($conf['server_id'], 'server');
58+
if($server_config['monitor_system_updates'] == 'n') return;
59+
60+
/* used for all monitor cronjobs */
61+
$app->load('monitor_tools');
62+
$this->_tools = new monitor_tools();
63+
/* end global section for monitor cronjobs */
64+
65+
/* the id of the server as int */
66+
$server_id = intval($conf['server_id']);
67+
68+
/** The type of the data */
69+
70+
71+
$type = 'system_update';
72+
73+
/* This monitoring is only available on Debian or Ubuntu */
74+
if (file_exists('/etc/debian_version')) {
75+
76+
/*
77+
* first update the "apt database"
78+
*/
79+
shell_exec('while fuser /var/lib/apt/lists/lock >/dev/null 2>&1 ; do sleep 2; done; apt-get update');
80+
81+
/*
82+
* Then test the upgrade.
83+
* if there is any output, then there is a needed update
84+
*/
85+
$aptData = shell_exec('while fuser /var/lib/dpkg/lock >/dev/null 2>&1 || fuser /var/lib/apt/lists/lock >/dev/null 2>&1 ; do sleep 2; done; apt-get -s -qq dist-upgrade');
86+
if ($aptData == '') {
87+
/* There is nothing to update! */
88+
$state = 'ok';
89+
} else {
90+
/*
91+
* There is something to update! this is in most cases not critical, so we can
92+
* do a system-update once a month or so...
93+
*/
94+
$state = 'info';
95+
}
96+
97+
/*
98+
* Fetch the output
99+
*/
100+
$data['output'] = $aptData;
101+
} elseif (file_exists('/etc/gentoo-release')) {
102+
103+
/*
104+
* first update the portage tree
105+
*/
106+
107+
// In keeping with gentoo's rsync policy, don't update to frequently (every four hours - taken from http://www.gentoo.org/doc/en/source_mirrors.xml)
108+
$do_update = true;
109+
if (file_exists('/usr/portage/metadata/timestamp.chk')) {
110+
$datetime = file_get_contents('/usr/portage/metadata/timestamp.chk');
111+
$datetime = trim($datetime);
112+
113+
$dstamp = strtotime($datetime);
114+
if ($dstamp) {
115+
$checkat = $dstamp + 14400; // + 4hours
116+
if (mktime() < $checkat) {
117+
$do_update = false;
118+
}
119+
}
120+
}
121+
122+
if ($do_update) {
123+
shell_exec('emerge --sync --quiet');
124+
}
125+
126+
/*
127+
* Then test the upgrade.
128+
* if there is any output, then there is a needed update
129+
*/
130+
$emergeData = shell_exec('glsa-check -t affected');
131+
if ($emergeData == '') {
132+
/* There is nothing to update! */
133+
$state = 'ok';
134+
$data['output'] = 'No unapplied GLSA\'s found on the system.';
135+
} else {
136+
/* There is something to update! */
137+
$state = 'info';
138+
$data['output'] = shell_exec('glsa-check -pv --nocolor affected 2>/dev/null');
139+
}
140+
} elseif (file_exists('/etc/SuSE-release')) {
141+
142+
/*
143+
* update and find the upgrade.
144+
* if there is any output, then there is a needed update
145+
*/
146+
$aptData = shell_exec('zypper -q lu');
147+
if ($aptData == '') {
148+
/* There is nothing to update! */
149+
$state = 'ok';
150+
} else {
151+
/*
152+
* There is something to update! this is in most cases not critical, so we can
153+
* do a system-update once a month or so...
154+
*/
155+
$state = 'info';
156+
}
157+
158+
/*
159+
* Fetch the output
160+
*/
161+
$data['output'] = shell_exec('zypper lu');
162+
163+
} elseif(file_exists('/etc/redhat-release')) {
164+
/*
165+
* update and find the upgrade.
166+
* if there is any output, then there is a needed update
167+
*/
168+
169+
/* try to figure out the default package manager first */
170+
if(file_exists('/usr/bin/dnf') && (is_link('/usr/bin/yum'))) {
171+
$rhPkgMgr = 'dnf';
172+
} elseif(file_exists('/usr/bin/dnf') && (!file_exists('/usr/bin/yum'))) {
173+
$rhPkgMgr = 'dnf';
174+
} else {
175+
$rhPkgMgr = 'yum';
176+
}
177+
178+
$aptData = shell_exec($rhPkgMgr. ' -q list updates');
179+
180+
if ($aptData == '') {
181+
/* There is nothing to update! */
182+
$state = 'ok';
183+
} else {
184+
/*
185+
* There is something to update! this is in most cases not critical, so we can
186+
* do a system-update once a month or so...
187+
*/
188+
$state = 'info';
189+
}
190+
191+
/*
192+
* Fetch the output
193+
*/
194+
195+
$data['output'] = shell_exec($rhPkgMgr. ' -q list updates');
196+
197+
} else {
198+
/*
199+
* It is not Debian/Ubuntu, so there is no data and no state
200+
*
201+
* no_state, NOT unknown, because "unknown" is shown as state
202+
* inside the GUI. no_state is hidden.
203+
*
204+
* We have to write NO DATA inside the DB, because the GUI
205+
* could not know, if there is any dat, or not...
206+
*/
207+
$state = 'no_state';
208+
$data['output'] = '';
209+
}
210+
211+
$res = array();
212+
$res['server_id'] = $server_id;
213+
$res['type'] = $type;
214+
$res['data'] = $data;
215+
$res['state'] = $state;
216+
217+
//* Ensure that output is encoded so that it does not break the serialize
218+
//$res['data']['output'] = htmlentities($res['data']['output']);
219+
$res['data']['output'] = htmlentities($res['data']['output'], ENT_QUOTES, 'UTF-8');
220+
221+
/*
222+
* Insert the data into the database
223+
*/
224+
$sql = 'REPLACE INTO monitor_data (server_id, type, created, data, state) ' .
225+
'VALUES (?, ?, UNIX_TIMESTAMP(), ?, ?)';
226+
$app->dbmaster->query($sql, $res['server_id'], $res['type'], serialize($res['data']), $res['state']);
227+
228+
/* The new data is written, now we can delete the old one */
229+
$this->_tools->delOldRecords($res['type'], $res['server_id']);
230+
231+
parent::onRunJob();
232+
}
233+
234+
/* this function is optional if it contains no custom code */
235+
public function onAfterRun() {
236+
global $app;
237+
238+
parent::onAfterRun();
239+
}
240+
241+
}
242+
243+
?>

‎server/lib/classes/system.inc.php‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2087,6 +2087,27 @@ function getinitcommand($servicename, $action, $init_script_directory = '', $che
20872087
}
20882088
}
20892089

2090+
function getopensslversion($get_minor = false) {
2091+
global $app;
2092+
if($this->is_installed('openssl')) $cmd = 'openssl version';
2093+
else {
2094+
$app->log("Could not check OpenSSL version, openssl not found.", LOGLEVEL_DEBUG);
2095+
return '1.0.1';
2096+
}
2097+
exec($cmd, $output, $return_var);
2098+
if($return_var != 0 || !$output[0]) {
2099+
$app->log("Could not check OpenSSL version, openssl did not return any data.", LOGLEVEL_WARN);
2100+
return '1.0.1';
2101+
}
2102+
if(preg_match('/OpenSSL\s*(\d+)(\.(\d+)(\.(\d+))*)?(\D|$)/i', $output[0], $matches)) {
2103+
return $matches[1] . (isset($matches[3]) ? '.' . $matches[3] : '') . (isset($matches[5]) && $get_minor == true ? '.' . $matches[5] : '');
2104+
} else {
2105+
$app->log("Could not check OpenSSL version, did not find version string in openssl output.", LOGLEVEL_WARN);
2106+
return '1.0.1';
2107+
}
2108+
2109+
}
2110+
20902111
function getapacheversion($get_minor = false) {
20912112
global $app;
20922113

‎server/plugins-available/nginx_plugin.inc.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1621,6 +1621,10 @@ function update($event_name, $data) {
16211621
// set logging variable
16221622
$vhost_data['logging'] = $web_config['logging'];
16231623

1624+
$app->log("Found OpenSSL version: " . $app->system->getopensslversion($get_minor = true), LOGLEVEL_DEBUG);
1625+
1626+
$vhost_data['openssl_version'] = $app->system->getopensslversion($get_minor = true);
1627+
16241628
$tpl->setVar($vhost_data);
16251629

16261630
$server_alias = array();

0 commit comments

Comments
 (0)