X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=web-conf;h=e682259a053bebbdc5fe3a59a8f14279a3b1a36b;hb=14753334d058cd515f82a0892411608abcd8223d;hp=61b735be95269f415e84e152d4ae86df49120e22;hpb=1a4204b328a226284b26329e10518740837d84e5;p=basic-https-conf diff --git a/web-conf b/web-conf index 61b735b..e682259 100755 --- a/web-conf +++ b/web-conf @@ -40,6 +40,7 @@ EXTRA_SETTINGS_FILE can be - for stdin -i Insecure, no ssl. -p PORT Main port to listen on, default 443. 80 implies -i. -r DIR DocumentRoot +-s Allow symlinks from the doucmentroot -h|--help Print help and exit Note: Uses GNU getopt options parsing style @@ -49,10 +50,11 @@ EOF ##### begin command line parsing ######## +symlinkarg=- ssl=true extra_settings= port=443 -temp=$(getopt -l help e:if:p:r:h "$@") || usage 1 +temp=$(getopt -l help e:if:p:r:sh "$@") || usage 1 eval set -- "$temp" while true; do case $1 in @@ -61,6 +63,7 @@ while true; do -i) ssl=false; shift ;; -p) port="$2"; shift 2 ;; -r) root="$2"; shift 2 ;; + -s) symlinkarg=+; shift ;; --) shift; break ;; -h|--help) usage ;; *) echo "$0: Internal error!" ; exit 1 ;; @@ -115,12 +118,13 @@ fi if $ssl; then f=$cert_dir/fullchain.pem - if [[ ! -e $f ]] || openssl x509 -checkend 86400 -noout -in $f; then + threedays=259200 # in seconds + if [[ ! -e $f ]] || ! openssl x509 -checkend $threedays -noout -in $f >/dev/null; then # cerbot needs an existing virtualhost. $0 -p 80 $t $h # when generating an example config, add all relevant security options: - # --hsts --staple-ocsp --uir - certbot certonly -n --must-staple --email $email --no-self-upgrade \ + # --hsts --staple-ocsp --uir --must-staple + certbot certonly -n --email $email --no-self-upgrade \ --agree-tos --${t%2} -d $h rm $vhost_file fi @@ -145,7 +149,6 @@ if [[ $t == apache2 ]]; then case $(readlink -f "$f") in $vhost_file|$redir_file) continue ;; esac - echo "$f" for p in $(sed -rn "s,^\s*listen\s+(\S+).*,\1,Ip" "$f"); do case $p in 80) listen_80=true ;;& @@ -157,9 +160,12 @@ if [[ $t == apache2 ]]; then cat >$vhost_file < - ServerName $h - ServerAlias www.$h - DocumentRoot $root +ServerName $h +ServerAlias www.$h +DocumentRoot $root + + Options -Indexes ${symlinkarg}FollowSymlinks + EOF if [[ $extra_settings ]]; then @@ -169,52 +175,52 @@ EOF # go faster! if [[ -e /etc/apache2/mods-available/http2.load ]]; then # https://httpd.apache.org/docs/2.4/mod/mod_http2.html - a2enmod http2 + a2enmod -q http2 cat >>$vhost_file <>$vhost_file <>$vhost_file <$redir_file < - ServerName $h - ServerAdmin webmaster@localhost - DocumentRoot /var/www/html +ServerName $h +ServerAdmin webmaster@localhost +DocumentRoot /var/www/html - ErrorLog \${APACHE_LOG_DIR}/error.log - CustomLog \${APACHE_LOG_DIR}/access.log vhost_time_combined +ErrorLog \${APACHE_LOG_DIR}/error.log +CustomLog \${APACHE_LOG_DIR}/access.log vhost_time_combined - RewriteEngine on - RewriteCond %{SERVER_NAME} =$h - RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent] +RewriteEngine on +RewriteCond %{SERVER_NAME} =$h +RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent] EOF if ! $listen_80; then @@ -226,32 +232,29 @@ EOF # this is a copy of a file certbot, see below. echo "$0: creating $common_ssl_conf" cat >$common_ssl_conf <<'EOF' -# Baseline setting to Include for SSL sites +# This file contains important security parameters. If you modify this file +# manually, Certbot will be unable to automatically provide future security +# updates. Instead, Certbot will print and log an error message with a path to +# the up-to-date file that you will need to refer to when manually updating +# this file. SSLEngine on # Intermediate configuration, tweak to your needs -SSLProtocol all -SSLv2 -SSLv3 -SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA -SSLHonorCipherOrder on -SSLCompression off +SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1 +SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384 +SSLHonorCipherOrder off +SSLSessionTickets off SSLOptions +StrictRequire # Add vhost name to log entries: LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common - -#CustomLog /var/log/apache2/access.log vhost_combined -#LogLevel warn -#ErrorLog /var/log/apache2/error.log - -# Always ensure Cookies have "Secure" set (JAH 2012/1) -#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4" EOF - upstream=https://github.com/certbot/certbot/raw/master/certbot-apache/certbot_apache/options-ssl-apache.conf - if ! diff -c <(wget -q -O - $upstream) $common_ssl_conf; then + upstream=https://raw.githubusercontent.com/certbot/certbot/master/certbot-apache/certbot_apache/_internal/tls_configs/current-options-ssl-apache.conf + if ! diff -u <(wget -q -O - $upstream) $common_ssl_conf; then cat <>$vhost_file <<'EOF' - ErrorLog ${APACHE_LOG_DIR}/error.log - CustomLog ${APACHE_LOG_DIR}/access.log vhost_time_combined +ErrorLog ${APACHE_LOG_DIR}/error.log +CustomLog ${APACHE_LOG_DIR}/access.log vhost_time_combined EOF @@ -281,7 +284,7 @@ EOF fi - a2enmod ssl rewrite # rewrite needed for httpredir + a2enmod -q ssl rewrite # rewrite needed for httpredir service apache2 restart # I rarely look at how much traffic I get, so let's keep that info @@ -337,25 +340,27 @@ ssl_stapling_verify on; EOF cat >$vhost_file <>$vhost_file <$redir_file <>$vhost_file <