Skip to content

Commit df1f8b3

Browse files
author
Till Brehm
committed
Merge branch 'ssl-for-apps' into 'stable-3.1'
Add SSL support for ISPConfig Apps (#5435) Closes #5435 See merge request ispconfig/ispconfig3!1121
2 parents 40bf1a8 + 4f4f07c commit df1f8b3

File tree

3 files changed

+122
-10
lines changed

3 files changed

+122
-10
lines changed

‎install/lib/installer_base.lib.php‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -745,7 +745,7 @@ public function process_postfix_config($configfile) {
745745
copy($full_file_name, $config_dir.$configfile.'~');
746746
chmod($config_dir.$configfile.'~',0600);
747747
}
748-
748+
749749
//* Replace variables in config file template
750750
$content = rfsel($conf['ispconfig_install_dir'].'/server/conf-custom/install/'.$configfile.'.master', 'tpl/'.$configfile.'.master');
751751
$content = str_replace('{mysql_server_ispconfig_user}', $conf['mysql']['ispconfig_user'], $content);
@@ -754,13 +754,13 @@ public function process_postfix_config($configfile) {
754754
$content = str_replace('{mysql_server_ip}', $conf['mysql']['ip'], $content);
755755
$content = str_replace('{server_id}', $conf['server_id'], $content);
756756
wf($full_file_name, $content);
757-
757+
758758
//* Changing mode and group of the new created config file
759759
caselog('chmod u=rw,g=r,o= '.escapeshellarg($full_file_name).' &> /dev/null',
760760
__FILE__, __LINE__, 'chmod on '.$full_file_name, 'chmod on '.$full_file_name.' failed');
761761
caselog('chgrp '.escapeshellarg($postfix_group).' '.escapeshellarg($full_file_name).' &> /dev/null',
762762
__FILE__, __LINE__, 'chgrp on '.$full_file_name, 'chgrp on '.$full_file_name.' failed');
763-
763+
764764
}
765765

766766
public function configure_jailkit() {
@@ -1097,7 +1097,7 @@ public function configure_postfix($options = '') {
10971097
}
10981098

10991099
unset($server_ini_array);
1100-
1100+
11011101
$myhostname = str_replace('.','\.',$conf['hostname']);
11021102

11031103
$postconf_placeholders = array('{config_dir}' => $config_dir,
@@ -1680,7 +1680,7 @@ public function configure_amavis() {
16801680

16811681
public function configure_rspamd() {
16821682
global $conf;
1683-
1683+
16841684
//* These postconf commands will be executed on installation and update
16851685
$server_ini_rec = $this->db->queryOneRecord("SELECT config FROM ?? WHERE server_id = ?", $conf["mysql"]["database"] . '.server', $conf['server_id']);
16861686
$server_ini_array = ini_to_array(stripslashes($server_ini_rec['config']));
@@ -2503,6 +2503,16 @@ public function configure_apps_vhost() {
25032503
$tpl->setVar('apps_vhost_dir',$conf['web']['website_basedir'].'/apps');
25042504
$tpl->setVar('apps_vhost_basedir',$conf['web']['website_basedir']);
25052505
$tpl->setVar('apps_vhost_servername',$apps_vhost_servername);
2506+
if(is_file($install_dir.'/interface/ssl/ispserver.crt') && is_file($install_dir.'/interface/ssl/ispserver.key')) {
2507+
$tpl->setVar('ssl_comment','');
2508+
} else {
2509+
$tpl->setVar('ssl_comment','#');
2510+
}
2511+
if(is_file($install_dir.'/interface/ssl/ispserver.crt') && is_file($install_dir.'/interface/ssl/ispserver.key') && is_file($install_dir.'/interface/ssl/ispserver.bundle')) {
2512+
$tpl->setVar('ssl_bundle_comment','');
2513+
} else {
2514+
$tpl->setVar('ssl_bundle_comment','#');
2515+
}
25062516
$tpl->setVar('apache_version',getapacheversion());
25072517
if($this->is_update == true) {
25082518
$tpl->setVar('logging',get_logging_state());

‎install/tpl/apache_apps.vhost.master‎

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
######################################################
32
# This virtual host contains the configuration
43
# for the ISPConfig apps vhost
@@ -15,6 +14,57 @@
1514
SetHandler None
1615
</FilesMatch>
1716

17+
# SSL Configuration
18+
<tmpl_var name="ssl_comment">SSLEngine On
19+
<tmpl_if name='apache_version' op='>=' value='2.3.16' format='version'>
20+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1
21+
<tmpl_else>
22+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv2 -SSLv3
23+
</tmpl_if>
24+
<tmpl_var name="ssl_comment">SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
25+
<tmpl_var name="ssl_comment">SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
26+
<tmpl_var name="ssl_bundle_comment">SSLCACertificateFile /usr/local/ispconfig/interface/ssl/ispserver.bundle
27+
28+
<tmpl_var name="ssl_comment">SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
29+
<tmpl_var name="ssl_comment">SSLHonorCipherOrder On
30+
<tmpl_if name='apache_version' op='>=' value='2.4.3' format='version'>
31+
<tmpl_var name="ssl_comment">SSLCompression Off
32+
</tmpl_if>
33+
<tmpl_if name='apache_version' op='>=' value='2.4.11' format='version'>
34+
<tmpl_var name="ssl_comment">SSLSessionTickets Off
35+
</tmpl_if>
36+
37+
<IfModule mod_headers.c>
38+
# ISPConfig 3.1 currently requires unsafe-line for both scripts and styles, as well as unsafe-eval
39+
Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'"
40+
<tmpl_var name="ssl_comment">Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'; upgrade-insecure-requests"
41+
Header set X-Content-Type-Options: nosniff
42+
Header set X-Frame-Options: SAMEORIGIN
43+
Header set X-XSS-Protection: "1; mode=block"
44+
Header always edit Set-Cookie (.*) "$1; HTTPOnly"
45+
<tmpl_var name="ssl_comment">Header always edit Set-Cookie (.*) "$1; Secure"
46+
<IfVersion >= 2.4.7>
47+
Header setifempty Strict-Transport-Security "max-age=15768000"
48+
</IfVersion>
49+
<IfVersion < 2.4.7>
50+
Header set Strict-Transport-Security "max-age=15768000"
51+
</IfVersion>
52+
RequestHeader unset Proxy early
53+
</IfModule>
54+
55+
<tmpl_if name='apache_version' op='>=' value='2.3.3' format='version'>
56+
<tmpl_var name="ssl_comment">SSLUseStapling On
57+
<tmpl_var name="ssl_comment">SSLStaplingResponderTimeout 5
58+
<tmpl_var name="ssl_comment">SSLStaplingReturnResponderErrors Off
59+
</tmpl_if>
60+
</VirtualHost>
61+
62+
<tmpl_if name='apache_version' op='>=' value='2.3.3' format='version'>
63+
<IfModule mod_ssl.c>
64+
<tmpl_var name="ssl_comment">SSLStaplingCache shmcb:/var/run/ocsp(128000)
65+
</IfModule>
66+
</tmpl_if>
67+
1868
<IfModule mod_headers.c>
1969
RequestHeader unset Proxy early
2070
</IfModule>

‎server/conf/apache_apps.vhost.master‎

Lines changed: 56 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
21
######################################################
32
# This virtual host contains the configuration
43
# for the ISPConfig apps vhost
@@ -15,6 +14,57 @@
1514
SetHandler None
1615
</FilesMatch>
1716

17+
# SSL Configuration
18+
<tmpl_var name="ssl_comment">SSLEngine On
19+
<tmpl_if name='apache_version' op='>=' value='2.3.16' format='version'>
20+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv3 -TLSv1 -TLSv1.1
21+
<tmpl_else>
22+
<tmpl_var name="ssl_comment">SSLProtocol All -SSLv2 -SSLv3
23+
</tmpl_if>
24+
<tmpl_var name="ssl_comment">SSLCertificateFile /usr/local/ispconfig/interface/ssl/ispserver.crt
25+
<tmpl_var name="ssl_comment">SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/ispserver.key
26+
<tmpl_var name="ssl_bundle_comment">SSLCACertificateFile /usr/local/ispconfig/interface/ssl/ispserver.bundle
27+
28+
<tmpl_var name="ssl_comment">SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
29+
<tmpl_var name="ssl_comment">SSLHonorCipherOrder On
30+
<tmpl_if name='apache_version' op='>=' value='2.4.3' format='version'>
31+
<tmpl_var name="ssl_comment">SSLCompression Off
32+
</tmpl_if>
33+
<tmpl_if name='apache_version' op='>=' value='2.4.11' format='version'>
34+
<tmpl_var name="ssl_comment">SSLSessionTickets Off
35+
</tmpl_if>
36+
37+
<IfModule mod_headers.c>
38+
# ISPConfig 3.1 currently requires unsafe-line for both scripts and styles, as well as unsafe-eval
39+
Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'"
40+
<tmpl_var name="ssl_comment">Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'; upgrade-insecure-requests"
41+
Header set X-Content-Type-Options: nosniff
42+
Header set X-Frame-Options: SAMEORIGIN
43+
Header set X-XSS-Protection: "1; mode=block"
44+
Header always edit Set-Cookie (.*) "$1; HTTPOnly"
45+
<tmpl_var name="ssl_comment">Header always edit Set-Cookie (.*) "$1; Secure"
46+
<IfVersion >= 2.4.7>
47+
Header setifempty Strict-Transport-Security "max-age=15768000"
48+
</IfVersion>
49+
<IfVersion < 2.4.7>
50+
Header set Strict-Transport-Security "max-age=15768000"
51+
</IfVersion>
52+
RequestHeader unset Proxy early
53+
</IfModule>
54+
55+
<tmpl_if name='apache_version' op='>=' value='2.3.3' format='version'>
56+
<tmpl_var name="ssl_comment">SSLUseStapling On
57+
<tmpl_var name="ssl_comment">SSLStaplingResponderTimeout 5
58+
<tmpl_var name="ssl_comment">SSLStaplingReturnResponderErrors Off
59+
</tmpl_if>
60+
</VirtualHost>
61+
62+
<tmpl_if name='apache_version' op='>=' value='2.3.3' format='version'>
63+
<IfModule mod_ssl.c>
64+
<tmpl_var name="ssl_comment">SSLStaplingCache shmcb:/var/run/ocsp(128000)
65+
</IfModule>
66+
</tmpl_if>
67+
1868
<IfModule mod_headers.c>
1969
RequestHeader unset Proxy early
2070
</IfModule>
@@ -55,9 +105,9 @@
55105
<Directory {tmpl_var name='apps_vhost_dir'}>
56106
Options +Indexes +FollowSymLinks +MultiViews +ExecCGI
57107
AllowOverride AuthConfig Indexes Limit Options FileInfo
58-
<FilesMatch "\.php$">
59-
SetHandler fcgid-script
60-
</FilesMatch>
108+
<FilesMatch "\.php$">
109+
SetHandler fcgid-script
110+
</FilesMatch>
61111
FCGIWrapper {tmpl_var name='apps_vhost_basedir'}/php-fcgi-scripts/apps/.php-fcgi-starter .php
62112
<tmpl_if name='apache_version' op='>' value='2.2' format='version'>
63113
Require all granted
@@ -78,4 +128,6 @@
78128
RewriteRule ^/rspamd/(.*) http://127.0.0.1:11334/$1 [P]
79129
{/tmpl_if}
80130

131+
132+
81133
</VirtualHost>

0 commit comments

Comments
 (0)