mirror of
https://github.com/internetee/registry.git
synced 2025-05-17 09:57:23 +02:00
Apache security config update
This commit is contained in:
parent
0345d57706
commit
c77d38b6e3
2 changed files with 191 additions and 173 deletions
|
@ -1,3 +1,8 @@
|
||||||
|
16.05.2015
|
||||||
|
|
||||||
|
* Security config update. Please replace all Location and RedirectMatch
|
||||||
|
in Admin, Registrar and Registrant Apache2 config. New one are in readme.
|
||||||
|
|
||||||
15.05.2015
|
15.05.2015
|
||||||
|
|
||||||
* Refer to doc/certificates.md for ID card login, note that CRL files in Apache config are not paths to CRL directory. (SSLCARevocationFile -> SSLCARevocationPath)
|
* Refer to doc/certificates.md for ID card login, note that CRL files in Apache config are not paths to CRL directory. (SSLCARevocationFile -> SSLCARevocationPath)
|
||||||
|
|
111
README.md
111
README.md
|
@ -20,8 +20,8 @@ Documentation
|
||||||
|
|
||||||
### Updating documentation
|
### Updating documentation
|
||||||
|
|
||||||
AUTODOC=true rspec spec/requests
|
AUTODOC=true rspec spec/requests
|
||||||
EPP_DOC=true rspec spec/epp --tag epp --require support/epp_doc.rb --format EppDoc > doc/epp-examples.md
|
EPP_DOC=true rspec spec/epp --tag epp --require support/epp_doc.rb --format EppDoc > doc/epp-examples.md
|
||||||
|
|
||||||
Installation
|
Installation
|
||||||
------------
|
------------
|
||||||
|
@ -32,53 +32,49 @@ Registry based on Rails 4 installation (rbenv install is under Debian build doc)
|
||||||
|
|
||||||
Manual demo install and database setup:
|
Manual demo install and database setup:
|
||||||
|
|
||||||
cd /home/registry
|
cd /home/registry
|
||||||
git clone git@github.com:internetee/registry.git demo-registry
|
git clone git@github.com:internetee/registry.git demo-registry
|
||||||
cd demo-registry
|
cd demo-registry
|
||||||
rbenv local 2.2.2
|
rbenv local 2.2.2
|
||||||
bundle
|
bundle
|
||||||
cp config/application-example.yml config/application.yml # and edit it
|
cp config/application-example.yml config/application.yml # and edit it
|
||||||
cp config/database-example.yml config/database.yml # and edit it
|
cp config/database-example.yml config/database.yml # and edit it
|
||||||
bundle exec rake db:all:setup # for production, please follow deployment howto
|
bundle exec rake db:all:setup # for production, please follow deployment howto
|
||||||
bundle exec rake assets:precompile
|
bundle exec rake assets:precompile
|
||||||
|
|
||||||
### Apache with patched mod_epp (Debian 7/Ubuntu 14.04 LTS)
|
### Apache with patched mod_epp (Debian 7/Ubuntu 14.04 LTS)
|
||||||
|
|
||||||
sudo apt-get install apache2
|
sudo apt-get install apache2
|
||||||
|
|
||||||
sudo apt-get install apache2-threaded-dev # needed to compile mod_epp
|
sudo apt-get install apache2-threaded-dev # needed to compile mod_epp
|
||||||
wget sourceforge.net/projects/aepps/files/mod_epp/1.10/mod_epp-1.10.tar.gz
|
wget sourceforge.net/projects/aepps/files/mod_epp/1.10/mod_epp-1.10.tar.gz
|
||||||
tar -xzvf mod_epp-1.10.tar.gz
|
tar -xzvf mod_epp-1.10.tar.gz
|
||||||
cd mod_epp-1.10
|
cd mod_epp-1.10
|
||||||
|
|
||||||
Patch mod_epp for Rack. Beacause Rack multipart parser expects specifically
|
Patch mod_epp for Rack. Beacause Rack multipart parser expects specifically
|
||||||
formatted content boundaries, the mod_epp needs to be modified before building:
|
formatted content boundaries, the mod_epp needs to be modified before building:
|
||||||
|
|
||||||
wget https://github.com/internetee/registry/raw/master/doc/patches/mod_epp_1.10-rack-friendly.patch
|
wget https://github.com/internetee/registry/raw/master/doc/patches/mod_epp_1.10-rack-friendly.patch
|
||||||
wget https://raw.githubusercontent.com/domify/registry/master/doc/patches/mod_epp_1.10-frame-size.patch
|
wget https://raw.githubusercontent.com/domify/registry/master/doc/patches/mod_epp_1.10-frame-size.patch
|
||||||
patch < mod_epp_1.10-rack-friendly.patch
|
patch < mod_epp_1.10-rack-friendly.patch
|
||||||
patch < mod_epp_1.10-frame-size.patch
|
patch < mod_epp_1.10-frame-size.patch
|
||||||
sudo apxs2 -a -c -i mod_epp.c
|
sudo apxs2 -a -c -i mod_epp.c
|
||||||
|
|
||||||
Enable ssl:
|
Enable ssl:
|
||||||
|
|
||||||
sudo a2enmod proxy_http
|
sudo a2enmod proxy_http
|
||||||
sudo mkdir /etc/apache2/ssl
|
sudo mkdir /etc/apache2/ssl
|
||||||
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt
|
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/apache.key -out /etc/apache2/ssl/apache.crt
|
||||||
sudo a2enmod ssl
|
sudo a2enmod ssl
|
||||||
sudo nano /etc/apache2/sites-enabled/epp_ssl.conf
|
sudo nano /etc/apache2/sites-enabled/epp_ssl.conf
|
||||||
|
|
||||||
For Apache, registry admin goes to port 443 in production, /etc/apache2/sites-enabled/registry.conf short example:
|
For Apache, registry admin goes to port 443 in production, /etc/apache2/sites-enabled/registry.conf short example:
|
||||||
|
|
||||||
```
|
```
|
||||||
<VirtualHost *:443>
|
<VirtualHost *:443>
|
||||||
ServerName your-domain
|
ServerName your-domain
|
||||||
ServerAdmin your@example.com
|
ServerAdmin your@example.com
|
||||||
|
|
||||||
# Rewrite /login to /admin/login
|
|
||||||
RewriteEngine on
|
|
||||||
RewriteCond %{REQUEST_URI} ^/login [NC]
|
|
||||||
RewriteRule ^/(.*) /admin/$1 [PT,L,QSA]
|
|
||||||
|
|
||||||
PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini
|
PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini
|
||||||
PassengerRuby /home/registry/.rbenv/shims/ruby
|
PassengerRuby /home/registry/.rbenv/shims/ruby
|
||||||
PassengerEnabled on
|
PassengerEnabled on
|
||||||
|
@ -105,21 +101,29 @@ For Apache, registry admin goes to port 443 in production, /etc/apache2/sites-en
|
||||||
SSLHonorCipherOrder On
|
SSLHonorCipherOrder On
|
||||||
SSLCipherSuite RC4-SHA:HIGH:!ADH
|
SSLCipherSuite RC4-SHA:HIGH:!ADH
|
||||||
|
|
||||||
|
RewriteEnginriteEngine on
|
||||||
|
RedirectMatch ^/$ /admin
|
||||||
|
RedirectMatch ^/login$ /admin/login
|
||||||
|
|
||||||
<Directory /app/registry/registry/current/public>
|
<Directory /app/registry/registry/current/public>
|
||||||
# for Apache older than version 2.4
|
# for Apache older than version 2.4
|
||||||
Allow from all
|
Allow from all
|
||||||
|
|
||||||
# for Apache verison 2.4 or newer
|
# for Apache verison 2.4 or newer
|
||||||
# Require all granted
|
# Require all granted
|
||||||
|
|
||||||
Options -MultiViews
|
Options -MultiViews
|
||||||
</Directory>
|
</Directory>
|
||||||
|
|
||||||
<Location ~ "/.+/" >
|
<Location />
|
||||||
|
Allow from none
|
||||||
Deny from all
|
Deny from all
|
||||||
</Location>
|
</Location>
|
||||||
|
|
||||||
<Location ~ "/(admin|assets)\/.+">
|
<Location /admin>
|
||||||
|
Allow from all
|
||||||
|
</Location>
|
||||||
|
|
||||||
|
<Location /assets>
|
||||||
Allow from all
|
Allow from all
|
||||||
</Location>
|
</Location>
|
||||||
</VirtualHost>
|
</VirtualHost>
|
||||||
|
@ -131,11 +135,6 @@ Registrar configuration (/etc/apache2/sites-enabled/registrar.conf) is as follow
|
||||||
ServerName your-registrar-domain
|
ServerName your-registrar-domain
|
||||||
ServerAdmin your@example.com
|
ServerAdmin your@example.com
|
||||||
|
|
||||||
# Rewrite /login to /registrar/login
|
|
||||||
RewriteEngine on
|
|
||||||
RewriteCond %{REQUEST_URI} ^/login [NC]
|
|
||||||
RewriteRule ^/(.*) /registrar/$1 [PT,L,QSA]
|
|
||||||
|
|
||||||
PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini
|
PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini
|
||||||
PassengerRuby /home/registry/.rbenv/shims/ruby
|
PassengerRuby /home/registry/.rbenv/shims/ruby
|
||||||
PassengerEnabled on
|
PassengerEnabled on
|
||||||
|
@ -162,6 +161,10 @@ Registrar configuration (/etc/apache2/sites-enabled/registrar.conf) is as follow
|
||||||
SSLHonorCipherOrder On
|
SSLHonorCipherOrder On
|
||||||
SSLCipherSuite RC4-SHA:HIGH:!ADH
|
SSLCipherSuite RC4-SHA:HIGH:!ADH
|
||||||
|
|
||||||
|
RewriteEngine on
|
||||||
|
RedirectMatch ^/$ /registrar
|
||||||
|
RedirectMatch ^/login$ /registrar/login
|
||||||
|
|
||||||
<Directory /app/registry/registrar/current/public>
|
<Directory /app/registry/registrar/current/public>
|
||||||
# for Apache older than version 2.4
|
# for Apache older than version 2.4
|
||||||
Allow from all
|
Allow from all
|
||||||
|
@ -172,11 +175,16 @@ Registrar configuration (/etc/apache2/sites-enabled/registrar.conf) is as follow
|
||||||
Options -MultiViews
|
Options -MultiViews
|
||||||
</Directory>
|
</Directory>
|
||||||
|
|
||||||
<Location ~ "/.+/" >
|
<Location />
|
||||||
|
Allow from none
|
||||||
Deny from all
|
Deny from all
|
||||||
</Location>
|
</Location>
|
||||||
|
|
||||||
<Location ~ "/(registrar|assets)\/.+">
|
<Location /registrar>
|
||||||
|
Allow from all
|
||||||
|
</Location>
|
||||||
|
|
||||||
|
<Location /assets>
|
||||||
Allow from all
|
Allow from all
|
||||||
</Location>
|
</Location>
|
||||||
|
|
||||||
|
@ -208,11 +216,6 @@ Registrant configuration (/etc/apache2/sites-enabled/registrant.conf) is as foll
|
||||||
ServerName your-registrant-domain
|
ServerName your-registrant-domain
|
||||||
ServerAdmin your@example.com
|
ServerAdmin your@example.com
|
||||||
|
|
||||||
# Rewrite /login to /registrant/login
|
|
||||||
RewriteEngine on
|
|
||||||
RewriteCond %{REQUEST_URI} ^/login [NC]
|
|
||||||
RewriteRule ^/(.*) /registrant/$1 [PT,L,QSA]
|
|
||||||
|
|
||||||
PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini
|
PassengerRoot /usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini
|
||||||
PassengerRuby /home/registry/.rbenv/shims/ruby
|
PassengerRuby /home/registry/.rbenv/shims/ruby
|
||||||
PassengerEnabled on
|
PassengerEnabled on
|
||||||
|
@ -239,6 +242,10 @@ Registrant configuration (/etc/apache2/sites-enabled/registrant.conf) is as foll
|
||||||
SSLHonorCipherOrder On
|
SSLHonorCipherOrder On
|
||||||
SSLCipherSuite RC4-SHA:HIGH:!ADH
|
SSLCipherSuite RC4-SHA:HIGH:!ADH
|
||||||
|
|
||||||
|
RewriteEngine on
|
||||||
|
RedirectMatch ^/$ /registrant
|
||||||
|
RedirectMatch ^/login$ /registrant/login
|
||||||
|
|
||||||
<Directory /app/registry/registrant/current/public>
|
<Directory /app/registry/registrant/current/public>
|
||||||
# for Apache older than version 2.4
|
# for Apache older than version 2.4
|
||||||
Allow from all
|
Allow from all
|
||||||
|
@ -249,11 +256,16 @@ Registrant configuration (/etc/apache2/sites-enabled/registrant.conf) is as foll
|
||||||
Options -MultiViews
|
Options -MultiViews
|
||||||
</Directory>
|
</Directory>
|
||||||
|
|
||||||
<Location ~ "/.+/" >
|
<Location />
|
||||||
|
Allow from none
|
||||||
Deny from all
|
Deny from all
|
||||||
</Location>
|
</Location>
|
||||||
|
|
||||||
<Location ~ "/(registrant|assets)\/.+">
|
<Location /registrant>
|
||||||
|
Allow from all
|
||||||
|
</Location>
|
||||||
|
|
||||||
|
<Location /assets>
|
||||||
Allow from all
|
Allow from all
|
||||||
</Location>
|
</Location>
|
||||||
|
|
||||||
|
@ -302,10 +314,11 @@ For Apache, REPP goes to port 443 in production, /etc/apache2/sites-enabled/repp
|
||||||
RequestHeader set SSL_CLIENT_S_DN_CN ""
|
RequestHeader set SSL_CLIENT_S_DN_CN ""
|
||||||
|
|
||||||
<Location />
|
<Location />
|
||||||
|
Allow from none
|
||||||
Deny from all
|
Deny from all
|
||||||
</Location>
|
</Location>
|
||||||
|
|
||||||
<Location /repp/*/*>
|
<Location /repp>
|
||||||
Allow from all
|
Allow from all
|
||||||
SSLVerifyClient require
|
SSLVerifyClient require
|
||||||
RequestHeader set SSL_CLIENT_S_DN_CN "%{SSL_CLIENT_S_DN_CN}s"
|
RequestHeader set SSL_CLIENT_S_DN_CN "%{SSL_CLIENT_S_DN_CN}s"
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue