maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

make ssl-cipher-list an option, fixes #1274 ; improve ssl-related language-strings; setting version to 0.9.30 for release

Browse Source 
Signed-off-by: Michael Kaufmann (d00p) <d00p@froxlor.org>
This commit is contained in:
Michael Kaufmann (d00p)
2013-10-24 19:45:13 +02:00
parent b81d163e1d
commit 6ac4b87a84
10 changed files with 76 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
actions/admin/settings/131.ssl.php
View File

@@ -31,6 +31,15 @@ return array(
'save_method' => 'storeSettingField',
'overview_option' => true
),
'system_ssl_cipher_list' => array(
'label' => $lng['serversettings']['ssl']['ssl_cipher_list'],
'settinggroup' => 'system',
'varname' => 'ssl_cipher_list',
'type' => 'string',
'string_emptyallowed' => false,
'default' => 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH',
'save_method' => 'storeSettingField',
),
'system_ssl_cert_file' => array(
'label' => $lng['serversettings']['ssl']['ssl_cert_file'],
'settinggroup' => 'system',
@@ -51,20 +60,20 @@ return array(
'default' => '/etc/apache2/apache2.key',
'save_method' => 'storeSettingField',
),
'system_ssl_ca_file' => array(
'label' => $lng['serversettings']['ssl']['ssl_ca_file'],
'system_ssl_cert_chainfile' => array(
'label' => $lng['admin']['ipsandports']['ssl_cert_chainfile'],
'settinggroup' => 'system',
'varname' => 'ssl_ca_file',
'varname' => 'ssl_cert_chainfile',
'type' => 'string',
'string_type' => 'file',
'string_emptyallowed' => true,
'default' => '',
'save_method' => 'storeSettingField',
),
'system_ssl_cert_chainfile' => array(
'label' => $lng['admin']['ipsandports']['ssl_cert_chainfile'],
'system_ssl_ca_file' => array(
'label' => $lng['serversettings']['ssl']['ssl_ca_file'],
'settinggroup' => 'system',
'varname' => 'ssl_cert_chainfile',
'varname' => 'ssl_ca_file',
'type' => 'string',
'string_type' => 'file',
'string_emptyallowed' => true,

3
install/froxlor.sql
View File

@@ -503,6 +503,7 @@ INSERT INTO `panel_settings` (`settinggroup`, `varname`, `value`) VALUES
('system', 'mod_fcgid_defaultini_ownvhost', '1'),
('system', 'awstats_icons', '/usr/share/awstats/icon/'),
('system', 'ssl_cert_chainfile', ''),
('system', 'ssl_cipher_list', 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH'),
('system', 'nginx_php_backend', '127.0.0.1:8888'),
('system', 'perl_server', 'unix:/var/run/nginx/cgiwrap-dispatch.sock'),
('system', 'phpreload_command', ''),
@@ -538,7 +539,7 @@ INSERT INTO `panel_settings` (`settinggroup`, `varname`, `value`) VALUES
('panel', 'phpconfigs_hidestdsubdomain', '0'),
('panel', 'allow_theme_change_admin', '1'),
('panel', 'allow_theme_change_customer', '1'),
('panel', 'version', '0.9.30-rc1');
('panel', 'version', '0.9.30');
DROP TABLE IF EXISTS `panel_tasks`;

11
install/updates/froxlor/0.9/update_0.9.inc.php
View File

@@ -2266,3 +2266,14 @@ if (isFroxlorVersion('0.9.30-dev1')) {
lastStepStatus(0);
updateToVersion('0.9.30-rc1');
}
if (isFroxlorVersion('0.9.30-rc1')) {
showUpdateStep("Updating from 0.9.30-rc1 to 0.9.30 final", true);
lastStepStatus(0);
showUpdateStep("Adding ssl-cipher-list setting");
$db->query("INSERT INTO `panel_settings` SET `settinggroup` = 'system', `varname` = 'ssl_cipher_list', `value` = 'ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH'");
lastStepStatus(0);
updateToVersion('0.9.30');
}

2
lib/tables.inc.php
View File

@@ -74,6 +74,6 @@ define('PACKAGE_LOCKED', 1);
define('PACKAGE_ENABLED', 2);
// VERSION INFO
$version = '0.9.30-rc1';
$version = '0.9.30';
$dbversion = '2';
$branding = '';

31
lng/english.lng.php
View File

@@ -755,8 +755,10 @@ $lng['logger']['truncate'] = 'Empty log';
// ADDED IN 1.2.19-svn7
$lng['serversettings']['ssl']['use_ssl'] = 'Use SSL';
$lng['serversettings']['ssl']['ssl_cert_file'] = 'Path to the SSL certificate';
$lng['serversettings']['ssl']['use_ssl']['title'] = 'Enable SSL usage';
$lng['serversettings']['ssl']['use_ssl']['description'] = 'Check this if you want to use SSL for your webserver';
$lng['serversettings']['ssl']['ssl_cert_file']['title'] = 'Path to the SSL certificate';
$lng['serversettings']['ssl']['ssl_cert_file']['description'] = 'Specify the path including the filename of the .crt or .pem file (main certificate)';
$lng['serversettings']['ssl']['openssl_cnf'] = 'Defaults for creating the Cert file';
$lng['panel']['reseller'] = 'reseller';
$lng['panel']['admin'] = 'admin';
@@ -1205,8 +1207,10 @@ $lng['admin']['ipsandports']['webserverssldomainconfig'] = 'Webserver SSL config
$lng['admin']['ipsandports']['ssl_key_file'] = 'Path to the SSL Keyfile';
$lng['admin']['ipsandports']['ssl_ca_file'] = 'Path to the SSL CA certificate';
$lng['admin']['ipsandports']['default_vhostconf_domain'] = 'Default vHost-settings for every domain container';
$lng['serversettings']['ssl']['ssl_key_file'] = 'Path to the SSL Keyfile';
$lng['serversettings']['ssl']['ssl_ca_file'] = 'Path to the SSL CA certificate';
$lng['serversettings']['ssl']['ssl_key_file']['title'] = 'Path to the SSL Keyfile';
$lng['serversettings']['ssl']['ssl_key_file']['description'] = 'Specify the path including the filename for the private-key file (.key mostly)';
$lng['serversettings']['ssl']['ssl_ca_file']['title'] = 'Path to the SSL CA certificate (optional)';
$lng['serversettings']['ssl']['ssl_ca_file']['description'] = 'Client authentification, set this only if you know what it is.';
$lng['error']['usernamealreadyexists'] = 'The username %s already exists.';
@@ -1476,28 +1480,19 @@ $lng['admin']['store_defaultindex'] = 'Store default index-file to customers doc
// ADDED IN FROXLOR 0.9.13-svn1
$lng['customer']['autoresponder'] = 'Autoresponder';
// ADDED IN FROXLOR 0.9.14-svn1
// ADDED IN FROXLOR 0.9.14
$lng['serversettings']['mod_fcgid']['defaultini_ownvhost'] = 'Default PHP configuration for Froxlor-vHost';
// ADDED IN FROXLOR 0.9.14-svn3
$lng['serversettings']['awstats_icons']['title'] = 'Path to AWstats icons folder';
$lng['serversettings']['awstats_icons']['description'] = 'e.g. /usr/share/awstats/htdocs/icon/';
// ADDED IN FROXLOR 0.9.14-svn4
$lng['admin']['ipsandports']['ssl_cert_chainfile'] = 'Path to the SSL CertificateChainFile';
// ADDED IN FROXLOR 0.9.14-svn5
$lng['admin']['ipsandports']['ssl_cert_chainfile']['title'] = 'Path to the SSL CertificateChainFile';
$lng['admin']['ipsandports']['ssl_cert_chainfile']['description'] = 'Mostly CA_Bundle, or similar, you probably want to set this if you bought a SSL certificate.';
$lng['admin']['ipsandports']['docroot']['title'] = 'Custom docroot (empty = point to Froxlor)';
$lng['admin']['ipsandports']['docroot']['description'] = 'You can define a custom document-root (the destination for a request) for this ip/port combination here.<br /><strong>ATTENTION:</strong> Please be careful with what you enter here!';
// ADDED IN FROXLOR 0.9.14-svn6
$lng['serversettings']['login_domain_login'] = 'Allow login with domains';
// ADDED IN FROXLOR 0.9.14
$lng['panel']['unlock'] = 'unlock';
$lng['question']['customer_reallyunlock'] = 'Do you really want to unlock customer %s?';
// ADDED IN FROXLOR 0.9.15-svn1
// ADDED IN FROXLOR 0.9.15
$lng['serversettings']['perl_server']['title'] = 'Perl server location';
$lng['serversettings']['perl_server']['description'] = 'Default is set for using the guide found at: <a target="blank" href="http://wiki.nginx.org/SimpleCGI">http://wiki.nginx.org/SimpleCGI</a>';
$lng['serversettings']['nginx_php_backend']['title'] = 'Nginx PHP backend';
@@ -1972,3 +1967,5 @@ $lng['domains']['serveraliasoption_wildcard'] = 'Wildcard (*.domain.tld)';
$lng['domains']['serveraliasoption_www'] = 'WWW (www.domain.tld)';
$lng['domains']['serveraliasoption_none'] = 'No alias';
$lng['error']['givendirnotallowed'] = 'The given directory in field %s is not allowed.';
$lng['serversettings']['ssl']['ssl_cipher_list']['title'] = 'Configure the allowed SSL ciphers';
$lng['serversettings']['ssl']['ssl_cipher_list']['description'] = 'This is a list of ciphers that you want (or don\'t want) to use when talking SSL. For a list of ciphers and how to include/exclude them, see sections "CIPHER LIST FORMAT" and "CIPHER STRINGS" on <a href="http://openssl.org/docs/apps/ciphers.html">the man-page for ciphers</a>.<br /><br /><b>Default value is:</b><pre>ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH</pre>';

31
lng/german.lng.php
View File

@@ -754,8 +754,10 @@ $lng['logger']['truncate'] = 'Log leeren';
// ADDED IN 1.2.19-svn7
$lng['serversettings']['ssl']['use_ssl'] = 'SSL nutzen';
$lng['serversettings']['ssl']['ssl_cert_file'] = 'Pfad zum Zertifikat';
$lng['serversettings']['ssl']['use_ssl']['title'] = 'Aktiviere SSL';
$lng['serversettings']['ssl']['use_ssl']['description'] = 'Erlaubt die Nutzung von SSL für den Webserver';
$lng['serversettings']['ssl']['ssl_cert_file']['title'] = 'Pfad zum SSL-Zertifikat';
$lng['serversettings']['ssl']['ssl_cert_file']['description'] = 'Geben Sie den Pfad inklusive Dateinamen des Zertifikats an (meist .crt or .pem).';
$lng['serversettings']['ssl']['openssl_cnf'] = 'Standardwerte zum Erstellen eines Zertifikats';
$lng['panel']['reseller'] = 'Reseller';
$lng['panel']['admin'] = 'Administrator';
@@ -1319,8 +1321,10 @@ $lng['admin']['ipsandports']['webserverssldomainconfig'] = 'Webserver-SSL-Konfig
$lng['admin']['ipsandports']['ssl_key_file'] = 'Pfad zu der SSL-Schlüsseldatei';
$lng['admin']['ipsandports']['ssl_ca_file'] = 'Pfad zu dem SSL-CA-Zertifikat';
$lng['admin']['ipsandports']['default_vhostconf_domain'] = 'Standard vHost - Einstellungen für jeden Domain - Kontainer';
$lng['serversettings']['ssl']['ssl_key_file'] = 'Pfad zu der SSL-Schlüsseldatei';
$lng['serversettings']['ssl']['ssl_ca_file'] = 'Pfad zu dem SSL-CA-Zertifikat';
$lng['serversettings']['ssl']['ssl_key_file']['title'] = 'Pfad zum SSL Private-key';
$lng['serversettings']['ssl']['ssl_key_file']['description'] = 'Geben Sie den Pfad inklusive Dateinamen der Schlüssel-Datei an (der private-key, meist .key).';
$lng['serversettings']['ssl']['ssl_ca_file']['title'] = 'Pfad zu dem SSL-CA-Zertifikat (optional)';
$lng['serversettings']['ssl']['ssl_ca_file']['description'] = 'Client Authentifizierung, dieses Feld sollte nur gesetzt werden, wenn es wirklich gebraucht wird.';
$lng['error']['usernamealreadyexists'] = 'Der Benutzername "%s" existiert bereits.';
$lng['error']['plausibilitychecknotunderstood'] = 'Die Antwort des Plausibilitätschecks wurde nicht verstanden';
$lng['error']['errorwhensaving'] = 'Bei dem Speichern des Feldes "%s" trat ein Fehler auf';
@@ -1454,28 +1458,19 @@ $lng['admin']['store_defaultindex'] = 'Erstelle Standard-Index-Datei im Kunden-O
// ADDED IN FROXLOR 0.9.13-svn1
$lng['customer']['autoresponder'] = 'Abwesenheitsnachrichten';
// ADDED IN FROXLOR 0.9.14-svn1
// ADDED IN FROXLOR 0.9.14
$lng['serversettings']['mod_fcgid']['defaultini_ownvhost'] = 'Voreingestellte PHP-Konfiguration für den Froxlor-Vhost';
// ADDED IN FROXLOR 0.9.14-svn3
$lng['serversettings']['awstats_icons']['title'] = 'Pfad zum AWstats-Icon-Ordner';
$lng['serversettings']['awstats_icons']['description'] = 'z.B. /usr/share/awstats/htdocs/icon/';
// ADDED IN FROXLOR 0.9.14-svn4
$lng['admin']['ipsandports']['ssl_cert_chainfile'] = 'Pfad zu dem SSL-CertificateChainFile';
// ADDED IN FROXLOR 0.9.14-svn5
$lng['admin']['ipsandports']['ssl_cert_chainfile']['title'] = 'Pfad zu dem SSL-CertificateChainFile (optional)';
$lng['admin']['ipsandports']['ssl_cert_chainfile']['description'] = 'Meist CA_Bundle, o.Ä., dies ist das Feld, dass gesetzt werden sollte, wenn ein gekauftes SSL-Zertifikat vorliegt.';
$lng['admin']['ipsandports']['docroot']['title'] = 'Benutzerdefinierter Docroot (leer = zeige auf Froxlor)';
$lng['admin']['ipsandports']['docroot']['description'] = 'Hier kann ein benutzerdefinierter Document-Root (der Zielordner für einen Zugriff) für diese IP/Port Kombination gesetzt werden.<br /><strong>ACHTUNG:</strong> Bitte überlege vorher, welchen Pfad du hier angibst!';
// ADDED IN FROXLOR 0.9.14-svn6
$lng['serversettings']['login_domain_login'] = 'Erlaube Anmeldung mit Domains';
// ADDED IN FROXLOR 0.9.14
$lng['panel']['unlock'] = 'entsperren';
$lng['question']['customer_reallyunlock'] = 'Wollen Sie den Kunden "%s" wirklich entsperren?';
// ADDED IN FROXLOR 0.9.15-svn1
// ADDED IN FROXLOR 0.9.15
$lng['serversettings']['perl_server']['title'] = 'Perl-Server-Ort';
$lng['serversettings']['perl_server']['description'] = 'Der Standardwert ist diesem Guide entnommen: <a target="blank" href="http://wiki.nginx.org/SimpleCGI">http://wiki.nginx.org/SimpleCGI</a>';
$lng['serversettings']['nginx_php_backend']['title'] = 'Nginx-PHP-Backend';
@@ -1692,3 +1687,5 @@ $lng['domains']['serveraliasoption_wildcard'] = 'Wildcard (*.domain.tld)';
$lng['domains']['serveraliasoption_www'] = 'WWW (www.domain.tld)';
$lng['domains']['serveraliasoption_none'] = 'Kein alias';
$lng['error']['givendirnotallowed'] = 'Das angegebene Verzeichnis im Feld %s ist nicht erlaubt.';
$lng['serversettings']['ssl']['ssl_cipher_list']['title'] = 'Erlaubte SSL Ciphers festlegen';
$lng['serversettings']['ssl']['ssl_cipher_list']['description'] = 'Dies ist eine Liste von Ciphers die genutzt werden sollen (oder auch nicht genutzt werden sollen) wenn eine SSL Verbindung besteht. Eine Liste aller Ciphers und wie diese hinzugefügt/ausgeschlossen werden ist in den Abschnitten "CIPHER LIST FORMAT" und "CIPHER STRINGS" in <a href="http://openssl.org/docs/apps/ciphers.html">der man-page für Ciphers</a> zu finden.<br /><br /><b>Standard-Wert ist:</b><pre>ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH</pre>';

4
scripts/jobs/cron_tasks.inc.http.10.apache.php
View File

@@ -339,7 +339,7 @@ class apache
$this->virtualhosts_data[$vhosts_filename] .= ' SSLEngine On' . "\n";
// this makes it more secure, thx to Marcel (08/2013)
$this->virtualhosts_data[$vhosts_filename] .= ' SSLHonorCipherOrder On' . "\n";
$this->virtualhosts_data[$vhosts_filename] .= ' SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH' . "\n";
$this->virtualhosts_data[$vhosts_filename] .= ' SSLCipherSuite ' . $this->settings['system']['ssl_cipher_list'] . "\n";
$this->virtualhosts_data[$vhosts_filename] .= ' SSLVerifyDepth 10' . "\n";
$this->virtualhosts_data[$vhosts_filename] .= ' SSLCertificateFile ' . makeCorrectFile($row_ipsandports['ssl_cert_file']) . "\n";
@@ -716,7 +716,7 @@ class apache
$vhost_content .= ' SSLEngine On' . "\n";
// this makes it more secure, thx to Marcel (08/2013)
$vhost_content .= ' SSLHonorCipherOrder On' . "\n";
$vhost_content .= ' SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH' . "\n";
$vhost_content .= ' SSLCipherSuite ' . $this->settings['system']['ssl_cipher_list'] . "\n";
$vhost_content .= ' SSLVerifyDepth 10' . "\n";
$vhost_content .= ' SSLCertificateFile ' . makeCorrectFile($domain['ssl_cert_file']) . "\n";

6
scripts/jobs/cron_tasks.inc.http.20.lighttpd.php
View File

@@ -182,6 +182,9 @@ class lighttpd
if ($row_ipsandports['ssl_cert_file'] != '') {
$this->lighttpd_data[$vhost_filename].= 'ssl.engine = "enable"' . "\n";
$this->lighttpd_data[$vhost_filename].= 'ssl.use-sslv2 = "disable"' . "\n";
$this->lighttpd_data[$vhost_filename].= 'ssl.cipher-list = "' . $this->settings['system']['ssl_cipher_list'] . '"' . "\n";
$this->lighttpd_data[$vhost_filename].= 'ssl.honor-cipher-order = "enable"' . "\n";
$this->lighttpd_data[$vhost_filename].= 'ssl.pemfile = "' . makeCorrectFile($row_ipsandports['ssl_cert_file']) . '"' . "\n";
if ($row_ipsandports['ssl_ca_file'] != '') {
@@ -512,6 +515,9 @@ class lighttpd
if ($domain['ssl_cert_file'] != '') {
$ssl_settings.= 'ssl.engine = "enable"' . "\n";
$ssl_settings.= 'ssl.use-sslv2 = "disable"' . "\n";
$ssl_settings.= 'ssl.cipher-list = "' . $this->settings['system']['ssl_cipher_list'] . '"' . "\n";
$ssl_settings.= 'ssl.honor-cipher-order = "enable"' . "\n";
$ssl_settings.= 'ssl.pemfile = "' . makeCorrectFile($domain['ssl_cert_file']) . '"' . "\n";
if ($domain['ssl_ca_file'] != '') {

4
scripts/jobs/cron_tasks.inc.http.30.nginx.php
View File

@@ -506,7 +506,7 @@ class nginx
// obsolete: ssl on now belongs to the listen block as 'ssl' at the end
//$sslsettings .= "\t" . 'ssl on;' . "\n";
$sslsettings .= "\t" . 'ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;' . "\n";
$sslsettings .= "\t" . 'ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;' . "\n";
$sslsettings .= "\t" . 'ssl_ciphers ' . $this->settings['system']['ssl_cipher_list'] . ';' . "\n";
$sslsettings .= "\t" . 'ssl_prefer_server_ciphers on;' . "\n";
$sslsettings .= "\t" . 'ssl_certificate ' . makeCorrectFile($domain['ssl_cert_file']) . ';' . "\n";
@@ -515,7 +515,7 @@ class nginx
}
if ($domain['ssl_ca_file'] != '') {
$sslsettings.= 'ssl_client_certificate ' . makeCorrectFile($domain['ssl_ca_file']) . ';' . "\n";
$sslsettings.= "\t" . 'ssl_client_certificate ' . makeCorrectFile($domain['ssl_ca_file']) . ';' . "\n";
}
}

14
scripts/jobs/cron_tasks.php
View File

@@ -87,6 +87,13 @@ while ($row = $db->fetch_array($result_tasks)) {
} else {
echo "Please check you Webserver settings\n";
}
/**
* as we might have a change from mod_php to fcgid/fpm or the other way around
* we need to check customer directory permissions
* -> 0.9.31
*/
}
/**
@@ -387,14 +394,11 @@ while ($row = $db->fetch_array($result_tasks)) {
}
}
if($db->num_rows($result_tasks) != 0)
{
if ($db->num_rows($result_tasks) != 0) {
$where = array();
foreach($resultIDs as $id)
{
foreach ($resultIDs as $id) {
$where[] = '`id`=\'' . (int)$id . '\'';
}
$where = implode($where, ' OR ');
$db->query('DELETE FROM `' . TABLE_PANEL_TASKS . '` WHERE ' . $where);
unset($resultIDs);