Skip to content

Commit 6b029af

Browse files
tbrehmtbrehm
committed
Added security levels for apache.
1 parent c8d40dc commit 6b029af

File tree

10 files changed

+126
-26
lines changed

10 files changed

+126
-26
lines changed

‎install/dist/lib/fedora.lib.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -444,6 +444,10 @@ public function configure_apache()
444444
exec("ln -s ".$vhost_conf_dir."/ispconfig.conf ".$vhost_conf_enabled_dir."/000-ispconfig.conf");
445445
}
446446

447+
//* add a sshusers group
448+
$command = 'groupadd sshusers';
449+
if(!is_group('sshusers')) caselog($command.' &> /dev/null 2> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
450+
447451
}
448452

449453
public function configure_firewall()

‎install/dist/lib/opensuse.lib.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -464,6 +464,10 @@ public function configure_apache()
464464
exec("ln -s ".$vhost_conf_dir."/ispconfig.conf ".$vhost_conf_enabled_dir."/000-ispconfig.conf");
465465
}
466466

467+
//* add a sshusers group
468+
$command = 'groupadd sshusers';
469+
if(!is_group('sshusers')) caselog($command.' &> /dev/null 2> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
470+
467471
}
468472

469473
public function configure_firewall()

‎install/lib/installer_base.lib.php‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -211,6 +211,9 @@ public function add_database_server_record() {
211211
$tpl_ini_array['web']['website_path'] = $conf['web']['website_path'];
212212
$tpl_ini_array['web']['website_symlinks'] = $conf['web']['website_symlinks'];
213213
$tpl_ini_array['cron']['crontab_dir'] = $conf['cron']['crontab_dir'];
214+
$tpl_ini_array['web']['security_level'] = 20;
215+
$tpl_ini_array['web']['user'] = $conf['web']['user'];
216+
$tpl_ini_array['web']['group'] = $conf['web']['group'];
214217

215218
$server_ini_content = array_to_ini($tpl_ini_array);
216219
$server_ini_content = mysql_real_escape_string($server_ini_content);
@@ -815,6 +818,11 @@ public function configure_apache()
815818
exec('ln -s /etc/webalizer.conf /etc/webalizer/webalizer.conf');
816819
}
817820

821+
//* add a sshusers group
822+
$command = 'groupadd sshusers';
823+
if(!is_group('sshusers')) caselog($command.' &> /dev/null 2> /dev/null', __FILE__, __LINE__, "EXECUTED: $command", "Failed to execute the command $command");
824+
825+
818826

819827
}
820828

‎install/tpl/server.ini.master‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,9 @@ website_path=/var/www/clients/client[client_id]/web[website_id]
3434
website_symlinks=/var/www/[website_domain]/:/var/www/clients/client[client_id]/[website_domain]/
3535
vhost_conf_dir=/etc/apache2/sites-available
3636
vhost_conf_enabled_dir=/etc/apache2/sites-enabled
37+
securiry_level=10
38+
apache_user=www-data
39+
apache_group=www-data
3740

3841
[fastcgi]
3942
fastcgi_starter_path=/var/www/php-fcgi-scripts/[system_user]/

‎interface/web/admin/form/server_config.tform.php‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -339,6 +339,34 @@
339339
'width' => '40',
340340
'maxlength' => '255'
341341
),
342+
'security_level' => array (
343+
'datatype' => 'VARCHAR',
344+
'formtype' => 'SELECT',
345+
'default' => '20',
346+
'value' => array('10' => 'Medium', '20' => 'High')
347+
),
348+
'user' => array (
349+
'datatype' => 'VARCHAR',
350+
'formtype' => 'TEXT',
351+
'default' => '',
352+
'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY',
353+
'errmsg'=> 'apache_user_error_empty'),
354+
),
355+
'value' => '',
356+
'width' => '40',
357+
'maxlength' => '255'
358+
),
359+
'group' => array (
360+
'datatype' => 'VARCHAR',
361+
'formtype' => 'TEXT',
362+
'default' => '',
363+
'validators' => array ( 0 => array ( 'type' => 'NOTEMPTY',
364+
'errmsg'=> 'apache_group_error_empty'),
365+
),
366+
'value' => '',
367+
'width' => '40',
368+
'maxlength' => '255'
369+
),
342370
##################################
343371
# ENDE Datatable fields
344372
##################################

‎interface/web/admin/lib/lang/en_server_config.lng‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,4 +43,5 @@ $wb["config_dir_txt"] = 'Config directory';
4343
$wb["init_script_txt"] = 'Cron init script name';
4444
$wb["crontab_dir_txt"] = 'Path for individual crontabs';
4545
$wb["wget_txt"] = 'Path to wget program';
46+
$wb["security_level_txt"] = 'Security level';
4647
?>

‎interface/web/admin/templates/server_config_web_edit.htm‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,22 @@ <h2><tmpl_var name="list_head_txt"></h2>
2525
<label for="vhost_conf_enabled_dir">{tmpl_var name='vhost_conf_enabled_dir_txt'}</label>
2626
<input name="vhost_conf_enabled_dir" id="vhost_conf_enabled_dir" value="{tmpl_var name='vhost_conf_enabled_dir'}" size="40" maxlength="255" type="text" class="textInput" />
2727
</div>
28+
<div class="ctrlHolder">
29+
<p class="label">{tmpl_var name='security_level_txt'}</p>
30+
<div class="multiField">
31+
<select name="security_level" id="security_level" class="selectInput">
32+
{tmpl_var name='security_level'}
33+
</select>
34+
</div>
35+
</div>
36+
<div class="ctrlHolder">
37+
<label for="user">{tmpl_var name='user_txt'}</label>
38+
<input name="user" id="user" value="{tmpl_var name='user'}" size="40" maxlength="255" type="text" class="textInput" />
39+
</div>
40+
<div class="ctrlHolder">
41+
<label for="group">{tmpl_var name='group_txt'}</label>
42+
<input name="group" id="group" value="{tmpl_var name='group'}" size="40" maxlength="255" type="text" class="textInput" />
43+
</div>
2844
</fieldset>
2945

3046
<input type="hidden" name="id" value="{tmpl_var name='id'}">

‎interface/web/dns/lib/module.conf.php‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,26 @@
66
$module["startpage"] = "dns/dns_soa_list.php";
77
$module["tab_width"] = '';
88

9+
10+
$items[] = array( 'title' => "Add DNS Zone",
11+
'target' => 'content',
12+
'link' => 'dns/dns_wizard.php');
13+
14+
if($_SESSION["s"]["user"]["typ"] == 'admin') {
15+
16+
$items[] = array( 'title' => "Templates",
17+
'target' => 'content',
18+
'link' => 'dns/dns_template_list.php');
19+
}
20+
21+
22+
$module["nav"][] = array( 'title' => 'DNS Wizard',
23+
'open' => 1,
24+
'items' => $items);
25+
26+
27+
unset($items);
28+
929
/*
1030
Email accounts menu
1131
*/
@@ -28,26 +48,6 @@
2848
unset($items);
2949

3050

31-
$items[] = array( 'title' => "Add DNS Zone",
32-
'target' => 'content',
33-
'link' => 'dns/dns_wizard.php');
34-
35-
if($_SESSION["s"]["user"]["typ"] == 'admin') {
36-
37-
$items[] = array( 'title' => "Templates",
38-
'target' => 'content',
39-
'link' => 'dns/dns_template_list.php');
40-
}
41-
42-
43-
$module["nav"][] = array( 'title' => 'DNS Wizard',
44-
'open' => 1,
45-
'items' => $items);
46-
47-
48-
49-
50-
5151

5252

5353

‎server/conf/vhost.conf.master‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,9 @@
9595
php_admin_value sendmail_path "/usr/sbin/sendmail -t -i -fwebmaster@<tmpl_var name='domain'>"
9696
php_admin_value upload_tmp_dir <tmpl_var name='document_root'>/tmp
9797
php_admin_value session.save_path <tmpl_var name='document_root'>/tmp
98-
#php_admin_value open_basedir <tmpl_var name='document_root'>:/usr/share/php5
98+
<tmpl_if name='security_level' op='==' value='20'>
99+
php_admin_value open_basedir <tmpl_var name='document_root'>/web:<tmpl_var name='document_root'>/tmp:/usr/share/php5
100+
</tmpl_if>
99101
</tmpl_if>
100102
<tmpl_if name='php' op='==' value='suphp'>
101103
# suphp enabled
@@ -249,7 +251,9 @@
249251
php_admin_value sendmail_path "/usr/sbin/sendmail -t -i -fwebmaster@<tmpl_var name='domain'>"
250252
php_admin_value upload_tmp_dir <tmpl_var name='document_root'>/tmp
251253
php_admin_value session.save_path <tmpl_var name='document_root'>/tmp
252-
#php_admin_value open_basedir <tmpl_var name='document_root'>:/usr/share/php5
254+
<tmpl_if name='security_level' op='==' value='20'>
255+
php_admin_value open_basedir <tmpl_var name='document_root'>/web:<tmpl_var name='document_root'>/tmp:/usr/share/php5
256+
</tmpl_if>
253257
</tmpl_if>
254258
<tmpl_if name='php' op='==' value='suphp'>
255259
suPHP_Engine on

‎server/plugins-available/apache2_plugin.inc.php‎

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -443,7 +443,7 @@ function update($event_name,$data) {
443443

444444
$username = escapeshellcmd($data["new"]["system_user"]);
445445
if($data["new"]["system_user"] != '' && !$app->system->is_user($data["new"]["system_user"])) {
446-
exec("useradd -d ".escapeshellcmd($data["new"]["document_root"])." -g $groupname $username -s /bin/false");
446+
exec("useradd -d ".escapeshellcmd($data["new"]["document_root"])." -g $groupname -G sshusers $username -s /bin/false");
447447
$app->log("Adding the user: $username",LOGLEVEL_DEBUG);
448448
}
449449

@@ -459,7 +459,6 @@ function update($event_name,$data) {
459459
exec("setquota -T -u $username 604800 604800 -a &> /dev/null");
460460
}
461461

462-
463462
if($this->action == 'insert') {
464463
// Chown and chmod the directories below the document root
465464
exec("chown -R $username:$groupname ".escapeshellcmd($data["new"]["document_root"]));
@@ -468,8 +467,40 @@ function update($event_name,$data) {
468467
exec("chown root:root ".escapeshellcmd($data["new"]["document_root"]));
469468
}
470469

471-
// make temp direcory writable for the apache user and the website user
472-
exec("chmod 777 ".escapeshellcmd($data["new"]["document_root"]."/tmp"));
470+
471+
472+
// If the security level is set to high
473+
if($web_config['security_level'] == 20) {
474+
475+
exec("chmod 711 ".escapeshellcmd($data["new"]["document_root"]."/"));
476+
exec("chmod 711 ".escapeshellcmd($data["new"]["document_root"]."/*"));
477+
exec("chmod 710 ".escapeshellcmd($data["new"]["document_root"]."/web"));
478+
479+
//* Change the home directory and group of the website user
480+
$command = 'usermod';
481+
$command .= ' --groups sshusers,'.escapeshellcmd($web_config['group']);
482+
$command .= ' '.escapeshellcmd($data["new"]["system_user"]);
483+
exec($command);
484+
$app->log("Modifying user: $command",LOGLEVEL_DEBUG);
485+
486+
// make temp direcory writable for the apache user and the website user
487+
// exec("chmod 777 ".escapeshellcmd($data["new"]["document_root"]."/tmp"));
488+
// If the security Level is set to medium
489+
} else {
490+
491+
exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"]."/"));
492+
exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"]."/*"));
493+
494+
//* Change the home directory and group of the website user
495+
$command = 'usermod';
496+
$command .= ' --groups sshusers ';
497+
$command .= ' '.escapeshellcmd($data["new"]["system_user"]);
498+
exec($command);
499+
$app->log("Modifying user: $command",LOGLEVEL_DEBUG);
500+
501+
// make temp direcory writable for the apache user and the website user
502+
exec("chmod 777 ".escapeshellcmd($data["new"]["document_root"]."/tmp"));
503+
}
473504

474505

475506
// Create the vhost config file
@@ -482,6 +513,7 @@ function update($event_name,$data) {
482513
$vhost_data["web_document_root"] = $data["new"]["document_root"]."/web";
483514
$vhost_data["web_document_root_www"] = $web_config["website_basedir"]."/".$data["new"]["domain"]."/web";
484515
$vhost_data["web_basedir"] = $web_config["website_basedir"];
516+
$vhost_data["security_level"] = $web_config["security_level"];
485517

486518
// Check if a SSL cert exists
487519
$ssl_dir = $data["new"]["document_root"]."/ssl";

0 commit comments

Comments
 (0)