Skip to content

Commit aa488bf

Browse files
LupulLupul
authored
Merge branch 'master' into dev-0714
2 parents e40c591 + d6f94c9 commit aa488bf

18 files changed

+135
-104
lines changed

‎CHANGELOG.md‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,20 @@ All notable changes to this project will be documented in this file.
33

44
## [CURRENT] - Development
55
### Features
6-
- Add read only/demo mode function if DEMO_MODE is set to yes in hestia.conf
6+
- Add read only/demo mode function if DEMO_MODE is set to yes in hestia.conf.
7+
- Add php-imagick module to installer and upgrade scripts.
8+
- Add recidive filter function to fail2ban.
79

810
### Bugfixes
9-
-
11+
- Add a detection of web root for add .well-known acme challenge.
12+
- Rework Let's Encrypt acme staging to use hestia conform standard.
13+
- Fix if condition, use nginx for Let's Encrypt acme request if present.
14+
- Rework v-add-sys-ip, remove centos/redhat support and rework conditions.
15+
- Enable hsts and force ssl on v-add-letsencrypt-host.
16+
- Prevent login action for webmail in list user view.
17+
- Remove hardcoded mail in helo data (cosmetic fix).
18+
- Fix sftp server validation check, thanks to @dbannik!
19+
- Implement warning message for creating web domains under admin user.
1020

1121
## [1.0.4] - 2019-07-09 - Hotfix
1222
### Bugfixes

‎bin/v-add-backup-host‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,7 @@ EOF
3838
sftpc() {
3939
expect -f "-" <<EOF "$@"
4040
set count 0
41-
spawn "/usr/bin/sftp -o StrictHostKeyChecking=no -o \
42-
Port=$port '$user@$host'"
41+
spawn /usr/bin/sftp -o StrictHostKeyChecking=no -o Port=$port $user@$host
4342
expect {
4443
"password:" {
4544
send "$password\r"

‎bin/v-add-letsencrypt-domain‎

Lines changed: 28 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ source $HESTIA/conf/hestia.conf
2323
# LE API
2424
LE_API='https://acme-v02.api.letsencrypt.org'
2525

26-
if [[ "$LE_STAGING" =~ ^(YES|TRUE)$ ]]; then
26+
if [[ "$LE_STAGING" = 'yes' ]]; then
2727
LE_API='https://acme-staging-v02.api.letsencrypt.org'
2828
fi
2929

@@ -228,30 +228,33 @@ for auth in $authz; do
228228
check_result $? "DNS _acme-challenge record wasn't created"
229229
else
230230
if [ -z "$mail" ]; then
231-
if [ "$WEB_SYSTEM" = 'nginx' ] && [ ! -z "$PROXY_SYSTEM" ]; then
232-
if [ ! -z "$mail" ]; then
233-
conf="$HOMEDIR/$user/conf/mail/$root_domain/$PROXY_SYSTEM.conf_letsencrypt"
234-
sconf="$HOMEDIR/$user/conf/mail/$root_domain/$PROXY_SYSTEM.ssl.conf_letsencrypt"
235-
else
236-
conf="$HOMEDIR/$user/conf/web/$domain/$PROXY_SYSTEM.conf_letsencrypt"
237-
sconf="$HOMEDIR/$user/conf/web/$domain/$PROXY_SYSTEM.ssl.conf_letsencrypt"
238-
fi
239-
240-
if [ ! -e "$conf" ]; then
241-
echo 'location ~ "^/\.well-known/acme-challenge/(.*)$" {' \
242-
> $conf
243-
echo ' default_type text/plain;' >> $conf
244-
echo ' return 200 "$1.'$THUMB'";' >> $conf
245-
echo '}' >> $conf
246-
fi
231+
if [ "$WEB_SYSTEM" = 'nginx' ] || [ "$PROXY_SYSTEM" = 'nginx' ]; then
232+
conf="$HOMEDIR/$user/conf/web/$domain/nginx.conf_letsencrypt"
233+
sconf="$HOMEDIR/$user/conf/web/$domain/nginx.ssl.conf_letsencrypt"
234+
echo 'location ~ "^/\.well-known/acme-challenge/(.*)$" {' \
235+
> $conf
236+
echo ' default_type text/plain;' >> $conf
237+
echo ' return 200 "$1.'$THUMB'";' >> $conf
238+
echo '}' >> $conf
247239
if [ ! -e "$sconf" ]; then
248240
ln -s "$conf" "$sconf"
249241
fi
250-
$BIN/v-restart-proxy
251-
check_result $? "Proxy restart failed" > /dev/null
252-
242+
if [ ! -z "$PROXY_SYSTEM" ]; then
243+
$BIN/v-restart-proxy
244+
check_result $? "Proxy restart failed" > /dev/null
245+
fi
253246
else
254-
well_known="$HOMEDIR/$user/web/$domain/public_html/.well-known"
247+
# Get root directory from configuration
248+
domain_config="$HOMEDIR/$user/conf/web/$domain"
249+
if [ -f "$domain_config/apache2.conf" ]; then
250+
well_known="$(cat $domain_config/apache2.conf | egrep \
251+
'^\s+DocumentRoot'| awk '{split($0, a, " "); \
252+
print a[2]}')/.well-known"
253+
else
254+
well_known="$(cat $domain_config/nginx.conf | egrep '^\s+root'| \
255+
awk '{split($0, a, " "); print a[2]}' | \
256+
sed 's/;$//')/.well-known"
257+
fi
255258
acme_challenge="$well_known/acme-challenge"
256259
mkdir -p $acme_challenge
257260
echo "$token.$THUMB" > $acme_challenge/$token
@@ -264,8 +267,10 @@ for auth in $authz; do
264267
echo "$token.$THUMB" > $acme_challenge/$token
265268
chown -R $user:$user $well_known
266269
fi
267-
$BIN/v-restart-web
268-
check_result $? "Web restart failed" > /dev/null
270+
if [ "$WEB_SYSTEM" = 'nginx' ]; then
271+
$BIN/v-restart-web
272+
check_result $? "Web restart failed" > /dev/null
273+
fi
269274
fi
270275

271276
# Requesting ACME validation / STEP 5

‎bin/v-add-letsencrypt-host‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,10 @@ fi
7373
# Add certificate to backend
7474
$BIN/v-update-host-certificate $user $domain
7575

76+
# Enable automatic ssl forward and hsts
77+
$BIN/v-add-web-domain-ssl-force $user $domain
78+
$BIN/v-add-web-domain-ssl-hsts $user $domain
79+
7680

7781
#----------------------------------------------------------#
7882
# Hestia #

‎bin/v-add-letsencrypt-user‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ source $HESTIA/conf/hestia.conf
1919
# LE API
2020
LE_API='https://acme-v02.api.letsencrypt.org'
2121

22-
if [[ "$LE_STAGING" =~ ^(YES|TRUE)$ ]]; then
22+
if [[ "$LE_STAGING" = 'yes' ]]; then
2323
LE_API='https://acme-staging-v02.api.letsencrypt.org'
2424
fi
2525

‎bin/v-add-sys-ip‎

Lines changed: 21 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -66,43 +66,29 @@ if [ -z "$sys_ip_check" ]; then
6666
/sbin/ip addr add $ip/$cidr dev $iface \
6767
broadcast $broadcast label $iface
6868

69-
# Adding RHEL/CentOS/Fedora/Amazon startup script
70-
if [ -d "/etc/sysconfig" ]; then
71-
sys_ip="# Added by hestia"
72-
sys_ip="$sys_ip\nDEVICE=$iface"
73-
sys_ip="$sys_ip\nBOOTPROTO=static"
74-
sys_ip="$sys_ip\nONBOOT=yes"
75-
sys_ip="$sys_ip\nIPADDR=$ip"
76-
sys_ip="$sys_ip\nNETMASK=$netmask"
77-
echo -e $sys_ip > /etc/sysconfig/network-scripts/ifcfg-$iface
78-
fi
79-
80-
# Adding Debian/Ubuntu startup script
81-
if [ -e "/etc/debian_version" ]; then
82-
if dpkg-query -W -f'${Status}' "netplan*" 2>/dev/null | grep -q "ok installed"; then
83-
if [ -f "/etc/netplan/60-hestia.yaml" ]; then
84-
sys_ip=" - $ip/$cidr"
85-
else
86-
sys_ip="# Added by hestia, please do not edit the file manually!"
87-
sys_ip="$sys_ip\nnetwork:"
88-
sys_ip="$sys_ip\n version: 2"
89-
sys_ip="$sys_ip\n renderer: networkd"
90-
sys_ip="$sys_ip\n ethernets:"
91-
sys_ip="$sys_ip\n eth0:"
92-
sys_ip="$sys_ip\n addresses:"
93-
sys_ip="$sys_ip\n - $ip/$cidr"
94-
fi
95-
IFS='%'
96-
echo -e $sys_ip >> /etc/netplan/60-hestia.yaml
97-
unset IFS
69+
if dpkg-query -W -f'${Status}' "netplan*" 2>/dev/null | grep -q "ok installed"; then
70+
if [ -f "/etc/netplan/60-hestia.yaml" ]; then
71+
sys_ip=" - $ip/$cidr"
9872
else
99-
sys_ip="\n# Added by hestia"
100-
sys_ip="$sys_ip\nauto $iface"
101-
sys_ip="$sys_ip\niface $iface inet static"
102-
sys_ip="$sys_ip\naddress $ip"
103-
sys_ip="$sys_ip\nnetmask $netmask"
104-
echo -e $sys_ip >> /etc/network/interfaces
73+
sys_ip="# Added by hestia, please do not edit the file manually!"
74+
sys_ip="$sys_ip\nnetwork:"
75+
sys_ip="$sys_ip\n version: 2"
76+
sys_ip="$sys_ip\n renderer: networkd"
77+
sys_ip="$sys_ip\n ethernets:"
78+
sys_ip="$sys_ip\n eth0:"
79+
sys_ip="$sys_ip\n addresses:"
80+
sys_ip="$sys_ip\n - $ip/$cidr"
10581
fi
82+
IFS='%'
83+
echo -e $sys_ip >> /etc/netplan/60-hestia.yaml
84+
unset IFS
85+
else
86+
sys_ip="\n# Added by hestia"
87+
sys_ip="$sys_ip\nauto $iface"
88+
sys_ip="$sys_ip\niface $iface inet static"
89+
sys_ip="$sys_ip\naddress $ip"
90+
sys_ip="$sys_ip\nnetmask $netmask"
91+
echo -e $sys_ip >> /etc/network/interfaces
10692
fi
10793
fi
10894

‎bin/v-list-sys-config‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ json_list() {
4444
"REPOSITORY": "'$REPOSITORY'",
4545
"VERSION": "'$VERSION'",
4646
"RELEASE_BRANCH": "'$RELEASE_BRANCH'",
47+
"DEMO_MODE": "'$DEMO_MODE'",
4748
"THEME": "'$THEME'",
4849
"LANGUAGE": "'$LANGUAGE'",
4950
"BACKUP_GZIP": "'$BACKUP_GZIP'",
@@ -130,6 +131,9 @@ shell_list() {
130131
echo "Language: $LANGUAGE"
131132
fi
132133
echo "Version: $VERSION"
134+
if [ ! -z "$DEMO_MODE" ]; then
135+
echo "Demo Mode: $DEMO_MODE"
136+
fi
133137
echo "Release Branch: $RELEASE_BRANCH"
134138
echo "Theme: $THEME"
135139
}
@@ -141,8 +145,8 @@ plain_list() {
141145
echo -ne "$PROXY_SSL_PORT\t$FTP_SYSTEM\t$MAIL_SYSTEM\t$IMAP_SYSTEM\t"
142146
echo -ne "$ANTIVIRUS_SYSTEM\t$ANTISPAM_SYSTEM\t$DB_SYSTEM\t"
143147
echo -ne "$DNS_SYSTEM\t$DNS_CLUSTER\t$STATS_SYSTEM\t$BACKUP_SYSTEM\t"
144-
echo -ne "$CRON_SYSTEM\t$DISK_QUOTA\t$FIREWALL_SYSTEM\t"
145-
echo -ne "$FIREWALL_EXTENSION\t$REPOSITORY\t$VERSION\t$RELEASE_BRANCH\t$THEME\t$LANGUAGE\t"
148+
echo -ne "$CRON_SYSTEM\t$DISK_QUOTA\t$FIREWALL_SYSTEM\t$FIREWALL_EXTENSION\t"
149+
echo -ne "$REPOSITORY\t$VERSION\t$DEMO_MODE\t$RELEASE_BRANCH\t$THEME\t$LANGUAGE\t"
146150
echo -e "$BACKUP_GZIP\t$BACKUP\t$WEBMAIL_ALIAS\t$DB_PMA_URL\t$DB_PGA_URL"
147151
}
148152

@@ -162,11 +166,11 @@ csv_list() {
162166
echo -n "'$WEB_SYSTEM','$WEB_RGROUPS','$WEB_PORT','$WEB_SSL',"
163167
echo -n "'$WEB_SSL_PORT','$WEB_BACKEND','$PROXY_SYSTEM','$PROXY_PORT',"
164168
echo -n "'$PROXY_SSL_PORT','$FTP_SYSTEM','$MAIL_SYSTEM','$IMAP_SYSTEM',"
165-
echo -n "'$ANTIVIRUS_SYSTEM','$ANTISPAM_SYSTEM','$DB_SYSTEM',"
166-
echo -n "'$DNS_SYSTEM','$DNS_CLUSTER','$STATS_SYSTEM','$BACKUP_SYSTEM',"
167-
echo -n "'$CRON_SYSTEM','$DISK_QUOTA','$FIREWALL_SYSTEM','$REPOSITORY',"
168-
echo -n "'$FIREWALL_EXTENSION','$VERSION','$RELEASE_BRANCH','$THEME','$LANGUAGE','$BACKUP_GZIP',"
169-
echo -n "'$BACKUP','$WEBMAIL_ALIAS','$DB_PMA_URL','$DB_PGA_URL'"
169+
echo -n "'$ANTIVIRUS_SYSTEM','$ANTISPAM_SYSTEM','$DB_SYSTEM','$DNS_SYSTEM',"
170+
echo -n "'$DNS_CLUSTER','$STATS_SYSTEM','$BACKUP_SYSTEM','$CRON_SYSTEM',"
171+
echo -n "'$DISK_QUOTA','$FIREWALL_SYSTEM','$REPOSITORY','$FIREWALL_EXTENSION',"
172+
echo -n "'$VERSION','$DEMO_MODE','$RELEASE_BRANCH','$THEME','$LANGUAGE',"
173+
echo -n "'$BACKUP_GZIP','$BACKUP','$WEBMAIL_ALIAS','$DB_PMA_URL','$DB_PGA_URL'"
170174
echo
171175
}
172176

‎install/deb/exim/exim4.conf.template‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -324,7 +324,7 @@ begin transports
324324

325325
remote_smtp:
326326
driver = smtp
327-
helo_data = mail.${sender_address_domain}
327+
helo_data = ${sender_address_domain}
328328
dkim_domain = DKIM_DOMAIN
329329
dkim_selector = mail
330330
dkim_private_key = DKIM_PRIVATE_KEY

‎install/hst-install-debian.sh‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ if [ "$release" -eq 8 ]; then
3131
apache2-suexec-custom libapache2-mod-ruid2
3232
libapache2-mod-fcgid libapache2-mod-php5 php5 php5-common php5-cgi
3333
php5-mysql php5-curl php5-pgsql awstats vsftpd net-tools
34-
proftpd-basic bind9 exim4 exim4-daemon-heavy clamav-daemon
34+
php5-imagick proftpd-basic bind9 exim4 exim4-daemon-heavy clamav-daemon
3535
spamassassin dovecot-imapd dovecot-pop3d roundcube-core
3636
roundcube-mysql roundcube-plugins mariadb-client mariadb-common
3737
mariadb-server postgresql postgresql-contrib phppgadmin phpMyAdmin mc
@@ -43,7 +43,7 @@ elif [ "$release" -eq 9 ]; then
4343
software="nginx apache2 apache2-utils apache2-suexec-custom
4444
libapache2-mod-ruid2 libapache2-mod-fcgid libapache2-mod-php php
4545
php-common php-cgi php-mysql php-curl php-pgsql php-imap php-ldap php-apcu
46-
awstats vsftpd proftpd-basic bind9 exim4 exim4-daemon-heavy
46+
php-imagick awstats vsftpd proftpd-basic bind9 exim4 exim4-daemon-heavy
4747
clamav-daemon spamassassin dovecot-imapd dovecot-pop3d roundcube-core net-tools
4848
roundcube-mysql roundcube-plugins mariadb-client mariadb-common
4949
mariadb-server postgresql postgresql-contrib phppgadmin phpmyadmin mc
@@ -55,7 +55,7 @@ else
5555
software="nginx apache2 apache2-utils apache2-suexec-custom
5656
apache2-suexec-pristine libapache2-mod-fcgid libapache2-mod-php php
5757
php-common php-cgi php-mysql php-curl php-pgsql php-imap php-ldap php-apcu
58-
awstats vsftpd proftpd-basic bind9 exim4 exim4-daemon-heavy
58+
php-imagick awstats vsftpd proftpd-basic bind9 exim4 exim4-daemon-heavy
5959
clamav-daemon spamassassin dovecot-imapd dovecot-pop3d roundcube-core net-tools
6060
roundcube-mysql roundcube-plugins mariadb-client mariadb-common
6161
mariadb-server postgresql postgresql-contrib phpmyadmin phppgadmin mc
@@ -722,7 +722,8 @@ if [ "$phpfpm" = 'yes' ]; then
722722
fpm="php$fpm_v php$fpm_v-common php$fpm_v-bcmath php$fpm_v-cli
723723
php$fpm_v-curl php$fpm_v-fpm php$fpm_v-gd php$fpm_v-intl
724724
php$fpm_v-mysql php$fpm_v-soap php$fpm_v-xml php$fpm_v-zip
725-
php$fpm_v-mbstring php$fpm_v-json php$fpm_v-bz2 php$fpm_v-pspell"
725+
php$fpm_v-mbstring php$fpm_v-json php$fpm_v-bz2 php$fpm_v-pspell
726+
php$fpm_v-imagick"
726727
software="$software $fpm"
727728
fi
728729

‎install/hst-install-ubuntu.sh‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ software="apache2 apache2.2-common apache2-suexec-custom apache2-utils
3131
apparmor-utils awstats bc bind9 bsdmainutils bsdutils clamav-daemon
3232
cron curl dnsutils dovecot-imapd dovecot-pop3d e2fslibs e2fsprogs exim4
3333
exim4-daemon-heavy expect fail2ban flex ftp git idn imagemagick
34-
libapache2-mod-fcgid libapache2-mod-php libapache2-mod-rpaf
34+
libapache2-mod-fcgid libapache2-mod-php libapache2-mod-rpaf php-imagick
3535
libapache2-mod-ruid2 lsof mc mariadb-client mariadb-common mariadb-server nginx
3636
ntpdate php php-cgi php-common php-curl phpmyadmin php-mysql php-imap php-ldap
3737
php-apcu phppgadmin php-pgsql postgresql postgresql-contrib proftpd-basic quota
@@ -676,7 +676,8 @@ if [ "$phpfpm" = 'yes' ]; then
676676
fpm="php$fpm_v php$fpm_v-common php$fpm_v-bcmath php$fpm_v-cli
677677
php$fpm_v-curl php$fpm_v-fpm php$fpm_v-gd php$fpm_v-intl
678678
php$fpm_v-mysql php$fpm_v-soap php$fpm_v-xml php$fpm_v-zip
679-
php$fpm_v-mbstring php$fpm_v-json php$fpm_v-bz2 php$fpm_v-pspell"
679+
php$fpm_v-mbstring php$fpm_v-json php$fpm_v-bz2 php$fpm_v-pspell
680+
php$fpm_v-imagick"
680681
software="$software $fpm"
681682
fi
682683

0 commit comments

Comments
 (0)