zydronium/internetee-registry
1
0
Fork 0
mirror of https://github.com/internetee/registry.git synced 2025-05-17 01:47:18 +02:00
Code Issues Projects Releases Packages Wiki Activity

Apache security config update

Browse source
This commit is contained in:
Priit Tark 2015-05-16 08:16:18 +03:00
parent 0345d57706
commit c77d38b6e3
2 changed files with 191 additions and 173 deletions
Download patch file Download diff file Expand all files Collapse all files

5
CHANGELOG.md
View file

@ -1,3 +1,8 @@
16.05.2015
* Security config update. Please replace all Location and RedirectMatch
in Admin, Registrar and Registrant Apache2 config. New one are in readme.
15.05.2015 15.05.2015
* Refer to doc/certificates.md for ID card login, note that CRL files in Apache config are not paths to CRL directory. (SSLCARevocationFile -> SSLCARevocationPath) * Refer to doc/certificates.md for ID card login, note that CRL files in Apache config are not paths to CRL directory. (SSLCARevocationFile -> SSLCARevocationPath)

111
README.md
View file

@ -20,8 +20,8 @@ Documentation
### Updating documentation ### Updating documentation
AUTODOC=true rspec spec/requests AUTODOC=true rspec spec/requests
EPP_DOC=true rspec spec/epp --tag epp --require support/epp_doc.rb --format EppDoc > doc/epp-examples.md EPP_DOC=true rspec spec/epp --tag epp --require support/epp_doc.rb --format EppDoc > doc/epp-examples.md
Installation Installation
------------ ------------
@ -32,53 +32,49 @@ Registry based on Rails 4 installation (rbenv install is under Debian build doc)
Manual demo install and database setup: Manual demo install and database setup:
cd /home/registry cd /home/registry
git clone git@github.com:internetee/registry.git demo-registry git clone git@github.com:internetee/registry.git demo-registry
cd demo-registry cd demo-registry
rbenv local 2.2.2 rbenv local 2.2.2
bundle bundle
cp config/application-example.yml config/application.yml # and edit it cp config/application-example.yml config/application.yml # and edit it
cp config/database-example.yml config/database.yml # and edit it cp config/database-example.yml config/database.yml # and edit it
bundle exec rake db:all:setup # for production, please follow deployment howto bundle exec rake db:all:setup # for production, please follow deployment howto
bundle exec rake assets:precompile bundle exec rake assets:precompile
### Apache with patched mod_epp (Debian 7/Ubuntu 14.04 LTS) ### Apache with patched mod_epp (Debian 7/Ubuntu 14.04 LTS)
sudo apt-get install apache2 sudo apt-get install apache2
sudo apt-get install apache2-threaded-dev # needed to compile mod_epp sudo apt-get install apache2-threaded-dev # needed to compile mod_epp
wget sourceforge.net/projects/aepps/files/mod_epp/1.10/mod_epp-1.10.tar.gz wget sourceforge.net/projects/aepps/files/mod_epp/1.10/mod_epp-1.10.tar.gz
tar -xzvf mod_epp-1.10.tar.gz tar -xzvf mod_epp-1.10.tar.gz
cd mod_epp-1.10 cd mod_epp-1.10
Patch mod_epp for Rack. Beacause Rack multipart parser expects specifically Patch mod_epp for Rack. Beacause Rack multipart parser expects specifically
formatted content boundaries, the mod_epp needs to be modified before building: formatted content boundaries, the mod_epp needs to be modified before building:
wget https://github.com/internetee/registry/raw/master/doc/patches/mod_epp_1.10-rack-friendly.patch wget https://github.com/internetee/registry/raw/master/doc/patches/mod_epp_1.10-rack-friendly.patch
wget https://raw.githubusercontent.com/domify/registry/master/doc/patches/mod_epp_1.10-frame-size.patch wget https://raw.githubusercontent.com/domify/registry/master/doc/patches/mod_epp_1.10-frame-size.patch
patch < mod_epp_1.10-rack-friendly.patch patch < mod_epp_1.10-rack-friendly.patch
patch < mod_epp_1.10-frame-size.patch patch < mod_epp_1.10-frame-size.patch
sudo apxs2 -a -c -i mod_epp.c sudo apxs2 -a -c -i mod_epp.c
Enable ssl: Enable ssl:
sudo a2enmod proxy_http sudo a2enmod proxy_http
sudo mkdir /etc/apache2/ssl sudo mkdir /etc/apache2/ssl
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt
sudo a2enmod ssl sudo a2enmod ssl
sudo nano /etc/apache2/sites-enabled/epp_ssl.conf sudo nano /etc/apache2/sites-enabled/epp_ssl.conf
For Apache, registry admin goes to port 443 in production, /etc/apache2/sites-enabled/registry.conf short example: For Apache, registry admin goes to port 443 in production, /etc/apache2/sites-enabled/registry.conf short example:
``` ```
<VirtualHost *:443> <VirtualHost *:443>
ServerName your-domain ServerName your-domain
ServerAdmin your@example.com ServerAdmin your@example.com
# Rewrite /login to /admin/login
RewriteEngine on
RewriteCond %{REQUEST_URI} ^/login [NC]
RewriteRule ^/(.*) /admin/$1 [PT,L,QSA]
PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini
PassengerRuby /home/registry/.rbenv/shims/ruby PassengerRuby /home/registry/.rbenv/shims/ruby
PassengerEnabled on PassengerEnabled on
@ -105,21 +101,29 @@ For Apache, registry admin goes to port 443 in production, /etc/apache2/sites-en
SSLHonorCipherOrder On SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:HIGH:!ADH SSLCipherSuite RC4-SHA:HIGH:!ADH
RewriteEnginriteEngine on
RedirectMatch ^/$ /admin
RedirectMatch ^/login$ /admin/login
<Directory /app/registry/registry/current/public> <Directory /app/registry/registry/current/public>
# for Apache older than version 2.4 # for Apache older than version 2.4
Allow from all Allow from all
# for Apache verison 2.4 or newer # for Apache verison 2.4 or newer
# Require all granted # Require all granted
Options -MultiViews Options -MultiViews
</Directory> </Directory>
<Location ~ "/.+/" > <Location />
Allow from none
Deny from all Deny from all
</Location> </Location>
<Location ~ "/(admin|assets)\/.+"> <Location /admin>
Allow from all
</Location>
<Location /assets>
Allow from all Allow from all
</Location> </Location>
</VirtualHost> </VirtualHost>
@ -131,11 +135,6 @@ Registrar configuration (/etc/apache2/sites-enabled/registrar.conf) is as follow
ServerName your-registrar-domain ServerName your-registrar-domain
ServerAdmin your@example.com ServerAdmin your@example.com
# Rewrite /login to /registrar/login
RewriteEngine on
RewriteCond %{REQUEST_URI} ^/login [NC]
RewriteRule ^/(.*) /registrar/$1 [PT,L,QSA]
PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini
PassengerRuby /home/registry/.rbenv/shims/ruby PassengerRuby /home/registry/.rbenv/shims/ruby
PassengerEnabled on PassengerEnabled on
@ -162,6 +161,10 @@ Registrar configuration (/etc/apache2/sites-enabled/registrar.conf) is as follow
SSLHonorCipherOrder On SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:HIGH:!ADH SSLCipherSuite RC4-SHA:HIGH:!ADH
RewriteEngine on
RedirectMatch ^/$ /registrar
RedirectMatch ^/login$ /registrar/login
<Directory /app/registry/registrar/current/public> <Directory /app/registry/registrar/current/public>
# for Apache older than version 2.4 # for Apache older than version 2.4
Allow from all Allow from all
@ -172,11 +175,16 @@ Registrar configuration (/etc/apache2/sites-enabled/registrar.conf) is as follow
Options -MultiViews Options -MultiViews
</Directory> </Directory>
<Location ~ "/.+/" > <Location />
Allow from none
Deny from all Deny from all
</Location> </Location>
<Location ~ "/(registrar|assets)\/.+"> <Location /registrar>
Allow from all
</Location>
<Location /assets>
Allow from all Allow from all
</Location> </Location>
@ -208,11 +216,6 @@ Registrant configuration (/etc/apache2/sites-enabled/registrant.conf) is as foll
ServerName your-registrant-domain ServerName your-registrant-domain
ServerAdmin your@example.com ServerAdmin your@example.com
# Rewrite /login to /registrant/login
RewriteEngine on
RewriteCond %{REQUEST_URI} ^/login [NC]
RewriteRule ^/(.*) /registrant/$1 [PT,L,QSA]
PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini
PassengerRuby /home/registry/.rbenv/shims/ruby PassengerRuby /home/registry/.rbenv/shims/ruby
PassengerEnabled on PassengerEnabled on
@ -239,6 +242,10 @@ Registrant configuration (/etc/apache2/sites-enabled/registrant.conf) is as foll
SSLHonorCipherOrder On SSLHonorCipherOrder On
SSLCipherSuite RC4-SHA:HIGH:!ADH SSLCipherSuite RC4-SHA:HIGH:!ADH
RewriteEngine on
RedirectMatch ^/$ /registrant
RedirectMatch ^/login$ /registrant/login
<Directory /app/registry/registrant/current/public> <Directory /app/registry/registrant/current/public>
# for Apache older than version 2.4 # for Apache older than version 2.4
Allow from all Allow from all
@ -249,11 +256,16 @@ Registrant configuration (/etc/apache2/sites-enabled/registrant.conf) is as foll
Options -MultiViews Options -MultiViews
</Directory> </Directory>
<Location ~ "/.+/" > <Location />
Allow from none
Deny from all Deny from all
</Location> </Location>
<Location ~ "/(registrant|assets)\/.+"> <Location /registrant>
Allow from all
</Location>
<Location /assets>
Allow from all Allow from all
</Location> </Location>
@ -302,10 +314,11 @@ For Apache, REPP goes to port 443 in production, /etc/apache2/sites-enabled/repp
RequestHeader set SSL_CLIENT_S_DN_CN "" RequestHeader set SSL_CLIENT_S_DN_CN ""
<Location /> <Location />
Allow from none
Deny from all Deny from all
</Location> </Location>
<Location /repp/*/*> <Location /repp>
Allow from all Allow from all
SSLVerifyClient require SSLVerifyClient require
RequestHeader set SSL_CLIENT_S_DN_CN "%{SSL_CLIENT_S_DN_CN}s" RequestHeader set SSL_CLIENT_S_DN_CN "%{SSL_CLIENT_S_DN_CN}s"