Fixed: FS#3696 - Interface SSL keys should be owned by root

Till Brehm · Till Brehm · commit 980485c46c2d · 2014-10-17T12:04:41.000+02:00
- Improved postfix SSL configuration to protect against poodle attack.
diff --git a/install/dist/lib/fedora.lib.php b/install/dist/lib/fedora.lib.php
@@ -1058,6 +1058,13 @@ public function install_ispconfig()
 			exec("chmod 600 $install_dir/server/lib/mysql_clientdb.conf");
 			exec("chown root:root $install_dir/server/lib/mysql_clientdb.conf");
 		}
+		
+		if(is_dir($install_dir.'/interface/invoices')) {
+			exec('chmod -R 770 '.escapeshellarg($install_dir.'/interface/invoices'));
+			exec('chown -R ispconfig:ispconfig '.escapeshellarg($install_dir.'/interface/invoices'));
+		}
+		
+		exec('chown -R root:root /usr/local/ispconfig/interface/ssl');
 
 		// TODO: FIXME: add the www-data user to the ispconfig group. This is just for testing
 		// and must be fixed as this will allow the apache user to read the ispconfig files.
diff --git a/install/dist/lib/gentoo.lib.php b/install/dist/lib/gentoo.lib.php
@@ -962,6 +962,8 @@ public function install_ispconfig()
 			exec('chmod -R 770 '.escapeshellarg($install_dir.'/interface/invoices'));
 			exec('chown -R ispconfig:ispconfig '.escapeshellarg($install_dir.'/interface/invoices'));
 		}
+		
+		exec('chown -R root:root /usr/local/ispconfig/interface/ssl');
 
 		// TODO: FIXME: add the www-data user to the ispconfig group. This is just for testing
 		// and must be fixed as this will allow the apache user to read the ispconfig files.
diff --git a/install/dist/lib/opensuse.lib.php b/install/dist/lib/opensuse.lib.php
@@ -1131,6 +1131,13 @@ public function install_ispconfig()
 			exec("chmod 600 $install_dir/server/lib/mysql_clientdb.conf");
 			exec("chown root:root $install_dir/server/lib/mysql_clientdb.conf");
 		}
+		
+		if(is_dir($install_dir.'/interface/invoices')) {
+			exec('chmod -R 770 '.escapeshellarg($install_dir.'/interface/invoices'));
+			exec('chown -R ispconfig:ispconfig '.escapeshellarg($install_dir.'/interface/invoices'));
+		}
+		
+		exec('chown -R root:root /usr/local/ispconfig/interface/ssl');
 
 		// TODO: FIXME: add the www-data user to the ispconfig group. This is just for testing
 		// and must be fixed as this will allow the apache user to read the ispconfig files.
diff --git a/install/lib/installer_base.lib.php b/install/lib/installer_base.lib.php
@@ -1716,6 +1716,8 @@ public function make_ispconfig_ssl_cert() {
 		exec("openssl rsa -passin pass:$ssl_pw -in $ssl_key_file -out $ssl_key_file.insecure");
 		rename($ssl_key_file, $ssl_key_file.'.secure');
 		rename($ssl_key_file.'.insecure', $ssl_key_file);
+		
+		exec('chown -R root:root /usr/local/ispconfig/interface/ssl');
 
 	}
 
@@ -1994,6 +1996,8 @@ public function install_ispconfig() {
 			exec('chmod -R 770 '.escapeshellarg($install_dir.'/interface/invoices'));
 			exec('chown -R ispconfig:ispconfig '.escapeshellarg($install_dir.'/interface/invoices'));
 		}
+		
+		exec('chown -R root:root /usr/local/ispconfig/interface/ssl');
 
 		// TODO: FIXME: add the www-data user to the ispconfig group. This is just for testing
 		// and must be fixed as this will allow the apache user to read the ispconfig files.
diff --git a/install/tpl/debian_postfix.conf.master b/install/tpl/debian_postfix.conf.master
@@ -32,4 +32,6 @@ nested_header_checks = regexp:{config_dir}/nested_header_checks
 body_checks = regexp:{config_dir}/body_checks
 owner_request_special = no
 smtp_tls_security_level = may
-smtpd_tls_mandatory_protocols=!SSLv2, !SSLv3
+smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
+smtpd_tls_protocols = !SSLv2,!SSLv3
+smtp_tls_protocols = !SSLv2,!SSLv3
diff --git a/install/tpl/fedora_postfix.conf.master b/install/tpl/fedora_postfix.conf.master
@@ -29,4 +29,6 @@ nested_header_checks = regexp:{config_dir}/nested_header_checks
 body_checks = regexp:{config_dir}/body_checks
 inet_interfaces = all
 smtp_tls_security_level = may
-smtpd_tls_mandatory_protocols=!SSLv2, !SSLv3
+smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
+smtpd_tls_protocols = !SSLv2,!SSLv3
+smtp_tls_protocols = !SSLv2,!SSLv3
diff --git a/install/tpl/gentoo_postfix.conf.master b/install/tpl/gentoo_postfix.conf.master
@@ -29,4 +29,6 @@ nested_header_checks = regexp:{config_dir}/nested_header_checks
 body_checks = regexp:{config_dir}/body_checks
 inet_interfaces = all
 smtp_tls_security_level = may
-smtpd_tls_mandatory_protocols=!SSLv2, !SSLv3
+smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
+smtpd_tls_protocols = !SSLv2,!SSLv3
+smtp_tls_protocols = !SSLv2,!SSLv3
diff --git a/install/tpl/opensuse_postfix.conf.master b/install/tpl/opensuse_postfix.conf.master
@@ -31,4 +31,6 @@ nested_header_checks = regexp:{config_dir}/nested_header_checks
 body_checks = regexp:{config_dir}/body_checks
 inet_interfaces = all
 smtp_tls_security_level = may
-smtpd_tls_mandatory_protocols=!SSLv2, !SSLv3
+smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3
+smtpd_tls_protocols = !SSLv2,!SSLv3
+smtp_tls_protocols = !SSLv2,!SSLv3

Original file line number	Diff line number	Diff line change
`@@ -962,6 +962,8 @@ public function install_ispconfig()`
`962`	`962`	`exec('chmod -R 770 '.escapeshellarg($install_dir.'/interface/invoices'));`
`963`	`963`	`exec('chown -R ispconfig:ispconfig '.escapeshellarg($install_dir.'/interface/invoices'));`
`964`	`964`	`}`
	`965`	`+`
	`966`	`+ exec('chown -R root:root /usr/local/ispconfig/interface/ssl');`
`965`	`967`
`966`	`968`	`// TODO: FIXME: add the www-data user to the ispconfig group. This is just for testing`
`967`	`969`	`// and must be fixed as this will allow the apache user to read the ispconfig files.`
Original file line number	Diff line number	Diff line change
`@@ -1716,6 +1716,8 @@ public function make_ispconfig_ssl_cert() {`
`1716`	`1716`	`exec("openssl rsa -passin pass:$ssl_pw -in $ssl_key_file -out $ssl_key_file.insecure");`
`1717`	`1717`	`rename($ssl_key_file, $ssl_key_file.'.secure');`
`1718`	`1718`	`rename($ssl_key_file.'.insecure', $ssl_key_file);`
	`1719`	`+`
	`1720`	`+ exec('chown -R root:root /usr/local/ispconfig/interface/ssl');`
`1719`	`1721`
`1720`	`1722`	`}`
`1721`	`1723`
`@@ -1994,6 +1996,8 @@ public function install_ispconfig() {`
`1994`	`1996`	`exec('chmod -R 770 '.escapeshellarg($install_dir.'/interface/invoices'));`
`1995`	`1997`	`exec('chown -R ispconfig:ispconfig '.escapeshellarg($install_dir.'/interface/invoices'));`
`1996`	`1998`	`}`
	`1999`	`+`
	`2000`	`+ exec('chown -R root:root /usr/local/ispconfig/interface/ssl');`
`1997`	`2001`
`1998`	`2002`	`// TODO: FIXME: add the www-data user to the ispconfig group. This is just for testing`
`1999`	`2003`	`// and must be fixed as this will allow the apache user to read the ispconfig files.`