diff --git a/actions/admin/settings/131.ssl.php b/actions/admin/settings/131.ssl.php index 430724e8..06895c9d 100644 --- a/actions/admin/settings/131.ssl.php +++ b/actions/admin/settings/131.ssl.php @@ -31,6 +31,15 @@ return array( 'save_method' => 'storeSettingField', 'overview_option' => true ), + 'system_ssl_cipher_list' => array( + 'label' => $lng['serversettings']['ssl']['ssl_cipher_list'], + 'settinggroup' => 'system', + 'varname' => 'ssl_cipher_list', + 'type' => 'string', + 'string_emptyallowed' => false, + 'default' => 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH', + 'save_method' => 'storeSettingField', + ), 'system_ssl_cert_file' => array( 'label' => $lng['serversettings']['ssl']['ssl_cert_file'], 'settinggroup' => 'system', @@ -51,20 +60,20 @@ return array( 'default' => '/etc/apache2/apache2.key', 'save_method' => 'storeSettingField', ), - 'system_ssl_ca_file' => array( - 'label' => $lng['serversettings']['ssl']['ssl_ca_file'], + 'system_ssl_cert_chainfile' => array( + 'label' => $lng['admin']['ipsandports']['ssl_cert_chainfile'], 'settinggroup' => 'system', - 'varname' => 'ssl_ca_file', + 'varname' => 'ssl_cert_chainfile', 'type' => 'string', 'string_type' => 'file', 'string_emptyallowed' => true, 'default' => '', 'save_method' => 'storeSettingField', ), - 'system_ssl_cert_chainfile' => array( - 'label' => $lng['admin']['ipsandports']['ssl_cert_chainfile'], + 'system_ssl_ca_file' => array( + 'label' => $lng['serversettings']['ssl']['ssl_ca_file'], 'settinggroup' => 'system', - 'varname' => 'ssl_cert_chainfile', + 'varname' => 'ssl_ca_file', 'type' => 'string', 'string_type' => 'file', 'string_emptyallowed' => true, diff --git a/install/froxlor.sql b/install/froxlor.sql index e0b59f7e..fb8dc014 100644 --- a/install/froxlor.sql +++ b/install/froxlor.sql @@ -503,6 +503,7 @@ INSERT INTO `panel_settings` (`settinggroup`, `varname`, `value`) VALUES ('system', 'mod_fcgid_defaultini_ownvhost', '1'), ('system', 'awstats_icons', '/usr/share/awstats/icon/'), ('system', 'ssl_cert_chainfile', ''), + ('system', 'ssl_cipher_list', 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH'), ('system', 'nginx_php_backend', '127.0.0.1:8888'), ('system', 'perl_server', 'unix:/var/run/nginx/cgiwrap-dispatch.sock'), ('system', 'phpreload_command', ''), @@ -538,7 +539,7 @@ INSERT INTO `panel_settings` (`settinggroup`, `varname`, `value`) VALUES ('panel', 'phpconfigs_hidestdsubdomain', '0'), ('panel', 'allow_theme_change_admin', '1'), ('panel', 'allow_theme_change_customer', '1'), - ('panel', 'version', '0.9.30-rc1'); + ('panel', 'version', '0.9.30'); DROP TABLE IF EXISTS `panel_tasks`; diff --git a/install/updates/froxlor/0.9/update_0.9.inc.php b/install/updates/froxlor/0.9/update_0.9.inc.php index ad55b88b..627fcd2f 100644 --- a/install/updates/froxlor/0.9/update_0.9.inc.php +++ b/install/updates/froxlor/0.9/update_0.9.inc.php @@ -2266,3 +2266,14 @@ if (isFroxlorVersion('0.9.30-dev1')) { lastStepStatus(0); updateToVersion('0.9.30-rc1'); } + +if (isFroxlorVersion('0.9.30-rc1')) { + showUpdateStep("Updating from 0.9.30-rc1 to 0.9.30 final", true); + lastStepStatus(0); + + showUpdateStep("Adding ssl-cipher-list setting"); + $db->query("INSERT INTO `panel_settings` SET `settinggroup` = 'system', `varname` = 'ssl_cipher_list', `value` = 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH'"); + lastStepStatus(0); + + updateToVersion('0.9.30'); +} diff --git a/lib/tables.inc.php b/lib/tables.inc.php index a2fb3565..db51be4d 100644 --- a/lib/tables.inc.php +++ b/lib/tables.inc.php @@ -74,6 +74,6 @@ define('PACKAGE_LOCKED', 1); define('PACKAGE_ENABLED', 2); // VERSION INFO -$version = '0.9.30-rc1'; +$version = '0.9.30'; $dbversion = '2'; $branding = ''; diff --git a/lng/english.lng.php b/lng/english.lng.php index cde9455a..dfe87261 100644 --- a/lng/english.lng.php +++ b/lng/english.lng.php @@ -755,8 +755,10 @@ $lng['logger']['truncate'] = 'Empty log'; // ADDED IN 1.2.19-svn7 -$lng['serversettings']['ssl']['use_ssl'] = 'Use SSL'; -$lng['serversettings']['ssl']['ssl_cert_file'] = 'Path to the SSL certificate'; +$lng['serversettings']['ssl']['use_ssl']['title'] = 'Enable SSL usage'; +$lng['serversettings']['ssl']['use_ssl']['description'] = 'Check this if you want to use SSL for your webserver'; +$lng['serversettings']['ssl']['ssl_cert_file']['title'] = 'Path to the SSL certificate'; +$lng['serversettings']['ssl']['ssl_cert_file']['description'] = 'Specify the path including the filename of the .crt or .pem file (main certificate)'; $lng['serversettings']['ssl']['openssl_cnf'] = 'Defaults for creating the Cert file'; $lng['panel']['reseller'] = 'reseller'; $lng['panel']['admin'] = 'admin'; @@ -1205,8 +1207,10 @@ $lng['admin']['ipsandports']['webserverssldomainconfig'] = 'Webserver SSL config $lng['admin']['ipsandports']['ssl_key_file'] = 'Path to the SSL Keyfile'; $lng['admin']['ipsandports']['ssl_ca_file'] = 'Path to the SSL CA certificate'; $lng['admin']['ipsandports']['default_vhostconf_domain'] = 'Default vHost-settings for every domain container'; -$lng['serversettings']['ssl']['ssl_key_file'] = 'Path to the SSL Keyfile'; -$lng['serversettings']['ssl']['ssl_ca_file'] = 'Path to the SSL CA certificate'; +$lng['serversettings']['ssl']['ssl_key_file']['title'] = 'Path to the SSL Keyfile'; +$lng['serversettings']['ssl']['ssl_key_file']['description'] = 'Specify the path including the filename for the private-key file (.key mostly)'; +$lng['serversettings']['ssl']['ssl_ca_file']['title'] = 'Path to the SSL CA certificate (optional)'; +$lng['serversettings']['ssl']['ssl_ca_file']['description'] = 'Client authentification, set this only if you know what it is.'; $lng['error']['usernamealreadyexists'] = 'The username %s already exists.'; @@ -1476,28 +1480,19 @@ $lng['admin']['store_defaultindex'] = 'Store default index-file to customers doc // ADDED IN FROXLOR 0.9.13-svn1 $lng['customer']['autoresponder'] = 'Autoresponder'; -// ADDED IN FROXLOR 0.9.14-svn1 +// ADDED IN FROXLOR 0.9.14 $lng['serversettings']['mod_fcgid']['defaultini_ownvhost'] = 'Default PHP configuration for Froxlor-vHost'; - -// ADDED IN FROXLOR 0.9.14-svn3 $lng['serversettings']['awstats_icons']['title'] = 'Path to AWstats icons folder'; $lng['serversettings']['awstats_icons']['description'] = 'e.g. /usr/share/awstats/htdocs/icon/'; - -// ADDED IN FROXLOR 0.9.14-svn4 -$lng['admin']['ipsandports']['ssl_cert_chainfile'] = 'Path to the SSL CertificateChainFile'; - -// ADDED IN FROXLOR 0.9.14-svn5 +$lng['admin']['ipsandports']['ssl_cert_chainfile']['title'] = 'Path to the SSL CertificateChainFile'; +$lng['admin']['ipsandports']['ssl_cert_chainfile']['description'] = 'Mostly CA_Bundle, or similar, you probably want to set this if you bought a SSL certificate.'; $lng['admin']['ipsandports']['docroot']['title'] = 'Custom docroot (empty = point to Froxlor)'; $lng['admin']['ipsandports']['docroot']['description'] = 'You can define a custom document-root (the destination for a request) for this ip/port combination here.
ATTENTION: Please be careful with what you enter here!'; - -// ADDED IN FROXLOR 0.9.14-svn6 $lng['serversettings']['login_domain_login'] = 'Allow login with domains'; - -// ADDED IN FROXLOR 0.9.14 $lng['panel']['unlock'] = 'unlock'; $lng['question']['customer_reallyunlock'] = 'Do you really want to unlock customer %s?'; -// ADDED IN FROXLOR 0.9.15-svn1 +// ADDED IN FROXLOR 0.9.15 $lng['serversettings']['perl_server']['title'] = 'Perl server location'; $lng['serversettings']['perl_server']['description'] = 'Default is set for using the guide found at: http://wiki.nginx.org/SimpleCGI'; $lng['serversettings']['nginx_php_backend']['title'] = 'Nginx PHP backend'; @@ -1972,3 +1967,5 @@ $lng['domains']['serveraliasoption_wildcard'] = 'Wildcard (*.domain.tld)'; $lng['domains']['serveraliasoption_www'] = 'WWW (www.domain.tld)'; $lng['domains']['serveraliasoption_none'] = 'No alias'; $lng['error']['givendirnotallowed'] = 'The given directory in field %s is not allowed.'; +$lng['serversettings']['ssl']['ssl_cipher_list']['title'] = 'Configure the allowed SSL ciphers'; +$lng['serversettings']['ssl']['ssl_cipher_list']['description'] = 'This is a list of ciphers that you want (or don\'t want) to use when talking SSL. For a list of ciphers and how to include/exclude them, see sections "CIPHER LIST FORMAT" and "CIPHER STRINGS" on the man-page for ciphers.

Default value is:
ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH
'; diff --git a/lng/german.lng.php b/lng/german.lng.php index bdf9ec4d..d2b8059e 100644 --- a/lng/german.lng.php +++ b/lng/german.lng.php @@ -754,8 +754,10 @@ $lng['logger']['truncate'] = 'Log leeren'; // ADDED IN 1.2.19-svn7 -$lng['serversettings']['ssl']['use_ssl'] = 'SSL nutzen'; -$lng['serversettings']['ssl']['ssl_cert_file'] = 'Pfad zum Zertifikat'; +$lng['serversettings']['ssl']['use_ssl']['title'] = 'Aktiviere SSL'; +$lng['serversettings']['ssl']['use_ssl']['description'] = 'Erlaubt die Nutzung von SSL für den Webserver'; +$lng['serversettings']['ssl']['ssl_cert_file']['title'] = 'Pfad zum SSL-Zertifikat'; +$lng['serversettings']['ssl']['ssl_cert_file']['description'] = 'Geben Sie den Pfad inklusive Dateinamen des Zertifikats an (meist .crt or .pem).'; $lng['serversettings']['ssl']['openssl_cnf'] = 'Standardwerte zum Erstellen eines Zertifikats'; $lng['panel']['reseller'] = 'Reseller'; $lng['panel']['admin'] = 'Administrator'; @@ -1319,8 +1321,10 @@ $lng['admin']['ipsandports']['webserverssldomainconfig'] = 'Webserver-SSL-Konfig $lng['admin']['ipsandports']['ssl_key_file'] = 'Pfad zu der SSL-Schlüsseldatei'; $lng['admin']['ipsandports']['ssl_ca_file'] = 'Pfad zu dem SSL-CA-Zertifikat'; $lng['admin']['ipsandports']['default_vhostconf_domain'] = 'Standard vHost - Einstellungen für jeden Domain - Kontainer'; -$lng['serversettings']['ssl']['ssl_key_file'] = 'Pfad zu der SSL-Schlüsseldatei'; -$lng['serversettings']['ssl']['ssl_ca_file'] = 'Pfad zu dem SSL-CA-Zertifikat'; +$lng['serversettings']['ssl']['ssl_key_file']['title'] = 'Pfad zum SSL Private-key'; +$lng['serversettings']['ssl']['ssl_key_file']['description'] = 'Geben Sie den Pfad inklusive Dateinamen der Schlüssel-Datei an (der private-key, meist .key).'; +$lng['serversettings']['ssl']['ssl_ca_file']['title'] = 'Pfad zu dem SSL-CA-Zertifikat (optional)'; +$lng['serversettings']['ssl']['ssl_ca_file']['description'] = 'Client Authentifizierung, dieses Feld sollte nur gesetzt werden, wenn es wirklich gebraucht wird.'; $lng['error']['usernamealreadyexists'] = 'Der Benutzername "%s" existiert bereits.'; $lng['error']['plausibilitychecknotunderstood'] = 'Die Antwort des Plausibilitätschecks wurde nicht verstanden'; $lng['error']['errorwhensaving'] = 'Bei dem Speichern des Feldes "%s" trat ein Fehler auf'; @@ -1454,28 +1458,19 @@ $lng['admin']['store_defaultindex'] = 'Erstelle Standard-Index-Datei im Kunden-O // ADDED IN FROXLOR 0.9.13-svn1 $lng['customer']['autoresponder'] = 'Abwesenheitsnachrichten'; -// ADDED IN FROXLOR 0.9.14-svn1 +// ADDED IN FROXLOR 0.9.14 $lng['serversettings']['mod_fcgid']['defaultini_ownvhost'] = 'Voreingestellte PHP-Konfiguration für den Froxlor-Vhost'; - -// ADDED IN FROXLOR 0.9.14-svn3 $lng['serversettings']['awstats_icons']['title'] = 'Pfad zum AWstats-Icon-Ordner'; $lng['serversettings']['awstats_icons']['description'] = 'z.B. /usr/share/awstats/htdocs/icon/'; - -// ADDED IN FROXLOR 0.9.14-svn4 -$lng['admin']['ipsandports']['ssl_cert_chainfile'] = 'Pfad zu dem SSL-CertificateChainFile'; - -// ADDED IN FROXLOR 0.9.14-svn5 +$lng['admin']['ipsandports']['ssl_cert_chainfile']['title'] = 'Pfad zu dem SSL-CertificateChainFile (optional)'; +$lng['admin']['ipsandports']['ssl_cert_chainfile']['description'] = 'Meist CA_Bundle, o.Ä., dies ist das Feld, dass gesetzt werden sollte, wenn ein gekauftes SSL-Zertifikat vorliegt.'; $lng['admin']['ipsandports']['docroot']['title'] = 'Benutzerdefinierter Docroot (leer = zeige auf Froxlor)'; $lng['admin']['ipsandports']['docroot']['description'] = 'Hier kann ein benutzerdefinierter Document-Root (der Zielordner für einen Zugriff) für diese IP/Port Kombination gesetzt werden.
ACHTUNG: Bitte überlege vorher, welchen Pfad du hier angibst!'; - -// ADDED IN FROXLOR 0.9.14-svn6 $lng['serversettings']['login_domain_login'] = 'Erlaube Anmeldung mit Domains'; - -// ADDED IN FROXLOR 0.9.14 $lng['panel']['unlock'] = 'entsperren'; $lng['question']['customer_reallyunlock'] = 'Wollen Sie den Kunden "%s" wirklich entsperren?'; -// ADDED IN FROXLOR 0.9.15-svn1 +// ADDED IN FROXLOR 0.9.15 $lng['serversettings']['perl_server']['title'] = 'Perl-Server-Ort'; $lng['serversettings']['perl_server']['description'] = 'Der Standardwert ist diesem Guide entnommen: http://wiki.nginx.org/SimpleCGI'; $lng['serversettings']['nginx_php_backend']['title'] = 'Nginx-PHP-Backend'; @@ -1692,3 +1687,5 @@ $lng['domains']['serveraliasoption_wildcard'] = 'Wildcard (*.domain.tld)'; $lng['domains']['serveraliasoption_www'] = 'WWW (www.domain.tld)'; $lng['domains']['serveraliasoption_none'] = 'Kein alias'; $lng['error']['givendirnotallowed'] = 'Das angegebene Verzeichnis im Feld %s ist nicht erlaubt.'; +$lng['serversettings']['ssl']['ssl_cipher_list']['title'] = 'Erlaubte SSL Ciphers festlegen'; +$lng['serversettings']['ssl']['ssl_cipher_list']['description'] = 'Dies ist eine Liste von Ciphers die genutzt werden sollen (oder auch nicht genutzt werden sollen) wenn eine SSL Verbindung besteht. Eine Liste aller Ciphers und wie diese hinzugefügt/ausgeschlossen werden ist in den Abschnitten "CIPHER LIST FORMAT" und "CIPHER STRINGS" in der man-page für Ciphers zu finden.

Standard-Wert ist:
ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH
'; diff --git a/scripts/jobs/cron_tasks.inc.http.10.apache.php b/scripts/jobs/cron_tasks.inc.http.10.apache.php index fbf8826a..8916c2ee 100644 --- a/scripts/jobs/cron_tasks.inc.http.10.apache.php +++ b/scripts/jobs/cron_tasks.inc.http.10.apache.php @@ -339,7 +339,7 @@ class apache $this->virtualhosts_data[$vhosts_filename] .= ' SSLEngine On' . "\n"; // this makes it more secure, thx to Marcel (08/2013) $this->virtualhosts_data[$vhosts_filename] .= ' SSLHonorCipherOrder On' . "\n"; - $this->virtualhosts_data[$vhosts_filename] .= ' SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH' . "\n"; + $this->virtualhosts_data[$vhosts_filename] .= ' SSLCipherSuite ' . $this->settings['system']['ssl_cipher_list'] . "\n"; $this->virtualhosts_data[$vhosts_filename] .= ' SSLVerifyDepth 10' . "\n"; $this->virtualhosts_data[$vhosts_filename] .= ' SSLCertificateFile ' . makeCorrectFile($row_ipsandports['ssl_cert_file']) . "\n"; @@ -716,7 +716,7 @@ class apache $vhost_content .= ' SSLEngine On' . "\n"; // this makes it more secure, thx to Marcel (08/2013) $vhost_content .= ' SSLHonorCipherOrder On' . "\n"; - $vhost_content .= ' SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH' . "\n"; + $vhost_content .= ' SSLCipherSuite ' . $this->settings['system']['ssl_cipher_list'] . "\n"; $vhost_content .= ' SSLVerifyDepth 10' . "\n"; $vhost_content .= ' SSLCertificateFile ' . makeCorrectFile($domain['ssl_cert_file']) . "\n"; diff --git a/scripts/jobs/cron_tasks.inc.http.20.lighttpd.php b/scripts/jobs/cron_tasks.inc.http.20.lighttpd.php index 623098ff..d5b07c30 100644 --- a/scripts/jobs/cron_tasks.inc.http.20.lighttpd.php +++ b/scripts/jobs/cron_tasks.inc.http.20.lighttpd.php @@ -182,6 +182,9 @@ class lighttpd if ($row_ipsandports['ssl_cert_file'] != '') { $this->lighttpd_data[$vhost_filename].= 'ssl.engine = "enable"' . "\n"; + $this->lighttpd_data[$vhost_filename].= 'ssl.use-sslv2 = "disable"' . "\n"; + $this->lighttpd_data[$vhost_filename].= 'ssl.cipher-list = "' . $this->settings['system']['ssl_cipher_list'] . '"' . "\n"; + $this->lighttpd_data[$vhost_filename].= 'ssl.honor-cipher-order = "enable"' . "\n"; $this->lighttpd_data[$vhost_filename].= 'ssl.pemfile = "' . makeCorrectFile($row_ipsandports['ssl_cert_file']) . '"' . "\n"; if ($row_ipsandports['ssl_ca_file'] != '') { @@ -512,6 +515,9 @@ class lighttpd if ($domain['ssl_cert_file'] != '') { $ssl_settings.= 'ssl.engine = "enable"' . "\n"; + $ssl_settings.= 'ssl.use-sslv2 = "disable"' . "\n"; + $ssl_settings.= 'ssl.cipher-list = "' . $this->settings['system']['ssl_cipher_list'] . '"' . "\n"; + $ssl_settings.= 'ssl.honor-cipher-order = "enable"' . "\n"; $ssl_settings.= 'ssl.pemfile = "' . makeCorrectFile($domain['ssl_cert_file']) . '"' . "\n"; if ($domain['ssl_ca_file'] != '') { diff --git a/scripts/jobs/cron_tasks.inc.http.30.nginx.php b/scripts/jobs/cron_tasks.inc.http.30.nginx.php index 6879f062..49776e66 100644 --- a/scripts/jobs/cron_tasks.inc.http.30.nginx.php +++ b/scripts/jobs/cron_tasks.inc.http.30.nginx.php @@ -506,7 +506,7 @@ class nginx // obsolete: ssl on now belongs to the listen block as 'ssl' at the end //$sslsettings .= "\t" . 'ssl on;' . "\n"; $sslsettings .= "\t" . 'ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;' . "\n"; - $sslsettings .= "\t" . 'ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;' . "\n"; + $sslsettings .= "\t" . 'ssl_ciphers ' . $this->settings['system']['ssl_cipher_list'] . ';' . "\n"; $sslsettings .= "\t" . 'ssl_prefer_server_ciphers on;' . "\n"; $sslsettings .= "\t" . 'ssl_certificate ' . makeCorrectFile($domain['ssl_cert_file']) . ';' . "\n"; @@ -515,7 +515,7 @@ class nginx } if ($domain['ssl_ca_file'] != '') { - $sslsettings.= 'ssl_client_certificate ' . makeCorrectFile($domain['ssl_ca_file']) . ';' . "\n"; + $sslsettings.= "\t" . 'ssl_client_certificate ' . makeCorrectFile($domain['ssl_ca_file']) . ';' . "\n"; } } diff --git a/scripts/jobs/cron_tasks.php b/scripts/jobs/cron_tasks.php index 312d02c4..e65d837f 100644 --- a/scripts/jobs/cron_tasks.php +++ b/scripts/jobs/cron_tasks.php @@ -87,6 +87,13 @@ while ($row = $db->fetch_array($result_tasks)) { } else { echo "Please check you Webserver settings\n"; } + + /** + * as we might have a change from mod_php to fcgid/fpm or the other way around + * we need to check customer directory permissions + * -> 0.9.31 + */ + } /** @@ -387,14 +394,11 @@ while ($row = $db->fetch_array($result_tasks)) { } } -if($db->num_rows($result_tasks) != 0) -{ +if ($db->num_rows($result_tasks) != 0) { $where = array(); - foreach($resultIDs as $id) - { + foreach ($resultIDs as $id) { $where[] = '`id`=\'' . (int)$id . '\''; } - $where = implode($where, ' OR '); $db->query('DELETE FROM `' . TABLE_PANEL_TASKS . '` WHERE ' . $where); unset($resultIDs);