Development September 2017

development@lists.ipfire.org

12 participants
43 discussions

[PATCH v2] WebUI: print more information on used nameservers
by Peter Müller 29 Jan '18

29 Jan '18

Show rDNS/PTR entry and country flag of the used nameservers on the nameserver status list at "netexternal.cgi". These information might be useful for debugging, or are just "nice to have" and do not harm anything. :-) Changes since v1: Corrected file link to country.cgi and added title to flag. Please disregard the first version of this patch. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- diff --git a/html/cgi-bin/netexternal.cgi b/html/cgi-bin/netexternal.cgi index 299612d4c..6fe0cc7d6 100644 --- a/html/cgi-bin/netexternal.cgi +++ b/html/cgi-bin/netexternal.cgi @@ -25,9 +25,13 @@ use strict; #use warnings; #use CGI::Carp 'fatalsToBrowser'; +use IO::Socket; +use Geo::IP::PurePerl; + require '/var/ipfire/general-functions.pl'; require "${General::swroot}/lang.pl"; require "${General::swroot}/header.pl"; +require "${General::swroot}/geoip-functions.pl"; require "${General::swroot}/graphs.pl"; my %color = (); @@ -99,6 +103,12 @@ if ( $querry[0] ne~ ""){ $Lang::tr{'nameserver'} </th> <th align="center"> + $Lang::tr{'flag'} + </th> + <th align="center"> + $Lang::tr{'rdns'} + </th> + <th align="center"> $Lang::tr{'status'} </th> </tr> @@ -139,9 +149,22 @@ END my $table_colour = ($id++ % 2) ? $color{'color22'} : $color{'color20'}; + # Get rDNS entry for nameserver (might be useful) + my $iaddr = inet_aton($nameserver); + my $rdns = gethostbyaddr($iaddr, AF_INET); + if (!$rdns) { $rdns = $Lang::tr{'lookup failed'}; } + + # Get country flag for the nameserver (might be useful) + my $gi = Geo::IP::PurePerl->new(); + my $ccode = $gi->country_code_by_name($nameserver); + my $fcode = lc($ccode); + my $flag_icon = &GeoIP::get_flag_icon($fcode); + print <<END; <tr bgcolor="$table_colour"> <td>$nameserver</td> + <td align="center"><a href="country.cgi#$fcode"><img src="$flag_icon" border="0" align="absmiddle" alt="$ccode" title="$ccode"></a></td> + <td>$rdns</td> <td bgcolor="$bgcolour" align="center"> $message </td> @@ -271,3 +294,4 @@ sub check_dnssec($$) { return $aware + $validating; } + diff --git a/langs/de/cgi-bin/de.pl b/langs/de/cgi-bin/de.pl index 0138cbc02..a63eb3160 100644 --- a/langs/de/cgi-bin/de.pl +++ b/langs/de/cgi-bin/de.pl @@ -1902,6 +1902,7 @@ 'quick playlist' => 'Quick Playlist', 'ram' => 'RAM-Speicher', 'random number generator daemon' => 'Random Number Generator Daemon', +'rdns' => 'rDNS', 'read bytes' => 'Gelesene Bytes', 'read list' => 'Liste der Leseberechtigten', 'real address' => 'Reale Addresse', diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl index b3aee5a2b..13c18f4c8 100644 --- a/langs/en/cgi-bin/en.pl +++ b/langs/en/cgi-bin/en.pl @@ -1936,6 +1936,7 @@ 'quick playlist' => 'Quick Playlist', 'ram' => 'RAM', 'random number generator daemon' => 'Random Number Generator Daemon', +'rdns' => 'rDNS', 'read bytes' => 'Read Bytes', 'read list' => 'list with readonly hosts', 'real address' => 'Real Address',

4 16

[PATCH] squid-graph 3.2: Proxy Graphs rebuilt (V2)
by Matthias Fischer 23 Oct '17

23 Oct '17

This is a rather old fellow. For details see: https://sourceforge.net/projects/squid-graph/ "Squid Graph is a free, simple, yet powerful Squid v2 native logfile analysis tool that generates reports with graphical representation of the proxy server's traffic, somewhat like the popular MRTG tool." I found by chance that the corresponding translation strings were still present, so I thought "Why not?". ;-) Here, it works without problems and 'squid 3.5.27'. The original 'sgraph.cgi' was slightly tuned - like in IPCop - and polished for better readability. If someone likes it, here it is - again... Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- config/menu/20-status.menu | 10 +++- config/rootfiles/common/squid-graph | 3 ++ config/rootfiles/common/web-user-interface | 1 + html/cgi-bin/sgraph.cgi | 72 ++++++++++++++++++++++++++ lfs/squid-graph | 81 ++++++++++++++++++++++++++++++ make.sh | 1 + src/scripts/makegraphs | 9 +++- 7 files changed, 175 insertions(+), 2 deletions(-) create mode 100644 config/rootfiles/common/squid-graph create mode 100644 html/cgi-bin/sgraph.cgi create mode 100644 lfs/squid-graph diff --git a/config/menu/20-status.menu b/config/menu/20-status.menu index 2bcf0d5e8..dfc6dae9b 100644 --- a/config/menu/20-status.menu +++ b/config/menu/20-status.menu @@ -58,7 +58,15 @@ 'title' => "$Lang::tr{'hardware graphs'}", 'enabled' => 1, }; - $substatus->{'61.entropy'} = { + + $substatus->{'61.proxygraphs'} = { + 'caption' => "$Lang::tr{'ssproxy graphs'}", + 'uri' => '/cgi-bin/sgraph.cgi', + 'title' => "$Lang::tr{'ssproxy graphs'}", + 'enabled' => 1, + }; + + $substatus->{'62.entropy'} = { 'caption' => "$Lang::tr{'entropy'}", 'uri' => '/cgi-bin/entropy.cgi', 'title' => "$Lang::tr{'entropy graphs'}", diff --git a/config/rootfiles/common/squid-graph b/config/rootfiles/common/squid-graph new file mode 100644 index 000000000..0b558d87a --- /dev/null +++ b/config/rootfiles/common/squid-graph @@ -0,0 +1,3 @@ +srv/web/ipfire/html/sgraph +srv/web/ipfire/html/sgraph/logo.png +usr/bin/squid-graph diff --git a/config/rootfiles/common/web-user-interface b/config/rootfiles/common/web-user-interface index f204f1657..b14efb402 100644 --- a/config/rootfiles/common/web-user-interface +++ b/config/rootfiles/common/web-user-interface @@ -72,6 +72,7 @@ srv/web/ipfire/cgi-bin/routing.cgi #srv/web/ipfire/cgi-bin/samba.cgi #srv/web/ipfire/cgi-bin/sambahlp.cgi srv/web/ipfire/cgi-bin/services.cgi +srv/web/ipfire/cgi-bin/sgraph.cgi srv/web/ipfire/cgi-bin/shutdown.cgi srv/web/ipfire/cgi-bin/speed.cgi srv/web/ipfire/cgi-bin/system.cgi diff --git a/html/cgi-bin/sgraph.cgi b/html/cgi-bin/sgraph.cgi new file mode 100644 index 000000000..dea4c068a --- /dev/null +++ b/html/cgi-bin/sgraph.cgi @@ -0,0 +1,72 @@ +#!/usr/bin/perl +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2016 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +use strict; + +# enable only the following on debugging purpose +#use warnings; +#use CGI::Carp 'fatalsToBrowser'; + +require '/var/ipfire/general-functions.pl'; +require "${General::swroot}/lang.pl"; +require "${General::swroot}/header.pl"; + +my @graphs = (); + +&Header::showhttpheaders(); + +my $dir = "/srv/web/ipfire/html/sgraph"; +my $sgraphdir = "/srv/web/ipfire/html/sgraph"; + +&Header::openpage($Lang::tr{'ssproxy graphs'}, 1, ''); + +&Header::openbigbox('100%', 'left'); + +&Header::openbox('100%', 'left', $Lang::tr{'proxy access graphs'} . ":" ); + +if (open(IPACHTML, "$sgraphdir/index.html")) +{ + my $skip = 1; + while (<IPACHTML>) + { + $skip = 1 if /^<HR>$/; + if ($skip) + { + $skip = 0 if /<H1>/; + next; + } + s/<IMG SRC=([^"'>]+)>/<img src='\/sgraph\/$1' alt='Graph' \/>/; + s/<HR>/<hr \/>/g; + s/ / /g; + s/<([^>]*)>/\L<$1>\E/g; + s/(size|align|border|color)=([^'"> ]+)/$1='$2'/g; + print; + } + close(IPACHTML); +} +else { + print $Lang::tr{'no information available'}; } + +&Header::closebox(); + +&Header::closebigbox(); + +&Header::closepage(); diff --git a/lfs/squid-graph b/lfs/squid-graph new file mode 100644 index 000000000..e94c0c130 --- /dev/null +++ b/lfs/squid-graph @@ -0,0 +1,81 @@ +############################################################################### +# # +# IPFire.org - A linux based firewall # +# Copyright (C) 2007-2015 IPFire Team <info(a)ipfire.org> # +# # +# This program is free software: you can redistribute it and/or modify # +# it under the terms of the GNU General Public License as published by # +# the Free Software Foundation, either version 3 of the License, or # +# (at your option) any later version. # +# # +# This program is distributed in the hope that it will be useful, # +# but WITHOUT ANY WARRANTY; without even the implied warranty of # +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # +# GNU General Public License for more details. # +# # +# You should have received a copy of the GNU General Public License # +# along with this program. If not, see <http://www.gnu.org/licenses/>. # +# # +############################################################################### + +############################################################################### +# Definitions +############################################################################### + +include Config + +VER = 3.2 + +THISAPP = squid-graph-$(VER) +DL_FILE = $(THISAPP).tar.gz +DL_FROM = $(URL_IPFIRE) +DIR_APP = $(DIR_SRC)/$(THISAPP) +TARGET = $(DIR_INFO)/$(THISAPP) + +############################################################################### +# Top-level Rules +############################################################################### + +objects = $(DL_FILE) + +$(DL_FILE) = $(DL_FROM)/$(DL_FILE) + +$(DL_FILE)_MD5 = 89ac122a99dc2db67efbdcd2467b9939 + +install : $(TARGET) + +check : $(patsubst %,$(DIR_CHK)/%,$(objects)) + +download :$(patsubst %,$(DIR_DL)/%,$(objects)) + +md5 : $(subst %,%_MD5,$(objects)) + +############################################################################### +# Downloading, checking, md5sum +############################################################################### + +$(patsubst %,$(DIR_CHK)/%,$(objects)) : + @$(CHECK) + +$(patsubst %,$(DIR_DL)/%,$(objects)) : + @$(LOAD) + +$(subst %,%_MD5,$(objects)) : + @$(MD5) + +############################################################################### +# Installation Details +############################################################################### + +$(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) + @$(PREBUILD) + @rm -rf $(DIR_APP) && cd $(DIR_SRC) && tar zxf $(DIR_DL)/$(DL_FILE) + + cp -f $(DIR_SRC)/squid-graph/squid-graph /usr/bin/squid-graph + chmod 755 /usr/bin/squid-graph + + -mkdir -p /srv/web/ipfire/html/sgraph + cp -f $(DIR_SRC)/squid-graph/logo.png /srv/web/ipfire/html/sgraph + + @rm -rf $(DIR_APP) + @$(POSTBUILD) diff --git a/make.sh b/make.sh index 815b25aca..eac4b229f 100755 --- a/make.sh +++ b/make.sh @@ -638,6 +638,7 @@ buildipfire() { lfsmake2 snort lfsmake2 oinkmaster lfsmake2 squid + lfsmake2 squid-graph lfsmake2 squidguard lfsmake2 calamaris lfsmake2 tcpdump diff --git a/src/scripts/makegraphs b/src/scripts/makegraphs index 0b56b9325..0191ef70b 100644 --- a/src/scripts/makegraphs +++ b/src/scripts/makegraphs @@ -79,7 +79,7 @@ sub updatehdddata{ print "Error in RRD::create for hdd-".$array[$#array].": $ERROR\n" if $ERROR; } - # Temperaturlesen w�rde die Platte aufwecken!!! + # Temperaturlesen würde die Platte aufwecken!!! if (!$standby){ $temp = 0; my $smart_output = ''; @@ -134,3 +134,10 @@ foreach (@disks){ updatehdddata($disk); } + +### +### Squid Graphs +### +if ( -e "/var/log/squid/access.log" ) { + system ("/usr/bin/squid-graph --no-console-log --tcp-only --output-dir=/srv/web/ipfire/html/sgraph < /var/log/squid/access.log >/dev/null 2>&1"); +} -- 2.14.2

2 6

[PATCH] remove unused directories from Apache vhost configs
by Peter Müller 10 Oct '17

10 Oct '17

Remove unused vhost configuration directives. They are related to "dial.cgi" and /cgi-bin/dial/, which both do not exist in IPFire. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf index bec0d580b..eef2d45e2 100644 --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf @@ -45,29 +45,12 @@ <Files webaccess.cgi> Require all granted </Files> - <Files dial.cgi> - <RequireAll> - Require user admin - Require ssl - </RequireAll> - </Files> - </Directory> - <Directory /srv/web/ipfire/cgi-bin/dial> - AllowOverride None - Options None - AuthName "IPFire - Restricted" - AuthType Basic - AuthUserFile /var/ipfire/auth/users - <RequireAll> - Require user admin dial - Require ssl - </RequireAll> </Directory> <Files ~ "\.(cgi|shtml?)$"> - SSLOptions +StdEnvVars + SSLOptions +StdEnvVars </Files> <Directory /srv/web/ipfire/cgi-bin> - SSLOptions +StdEnvVars + SSLOptions +StdEnvVars </Directory> SetEnv HOME /home/nobody SetEnvIf User-Agent ".*MSIE.*" \ diff --git a/config/httpd/vhosts.d/ipfire-interface.conf b/config/httpd/vhosts.d/ipfire-interface.conf index a0537b392..57cf8ba17 100644 --- a/config/httpd/vhosts.d/ipfire-interface.conf +++ b/config/httpd/vhosts.d/ipfire-interface.conf @@ -25,13 +25,6 @@ RewriteCond %{HTTPS} off RewriteRule (.*) https://%{SERVER_NAME}:444/$1 [R=301,L] </Directory> - <Directory /srv/web/ipfire/cgi-bin/dial> - AllowOverride None - Options SymLinksIfOwnerMatch - RewriteEngine on - RewriteCond %{HTTPS} off - RewriteRule (.*) https://%{SERVER_NAME}:444/$1 [R=301,L] - </Directory> Alias /updatecache/ /var/updatecache/ <Directory /var/updatecache> Options ExecCGI

2 3

[PATCH] proxy.cgi: Even more cosmetics for lazy ones (V3)
by Matthias Fischer 09 Oct '17

09 Oct '17

Another clickable link, this time for the 'Cache Manager Interface' - this one opens in a new window. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- html/cgi-bin/proxy.cgi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi index dd83bba73..ab490c3d3 100644 --- a/html/cgi-bin/proxy.cgi +++ b/html/cgi-bin/proxy.cgi @@ -1118,7 +1118,7 @@ print <<END <td colspan='4'>$Lang::tr{'advproxy cache management'}</td> </tr> <tr> - <td class='base'>$Lang::tr{'proxy cachemgr'}:</td> + <td class='base'><a href='/cgi-bin/cachemgr.cgi\' target=\'_blank\'>$Lang::tr{'proxy cachemgr'}</a>:</td> <td><input type='checkbox' name='CACHEMGR' $checked{'CACHEMGR'}{'on'} /></td> <td class='base'>$Lang::tr{'advproxy admin mail'}:</td> <td><input type='text' name='ADMIN_MAIL_ADDRESS' value='$proxysettings{'ADMIN_MAIL_ADDRESS'}' /></td> -- 2.14.2

2 2

Question concerning ipfire-2.x/html/html/dial.cgi
by Peter Müller 09 Oct '17

09 Oct '17

Hello Michael, can we safely remove "ipfire-2.x/html/html/dial.cgi" (SHA256 checksum: b4a34124b478d25c805379acd9ffa35ec3558e41e45b22c5ddf8ab3f20c6aeda)? It appeared in the Apache vhost configuration, and seems to be defunct - redirects with 302 to a non-existing file. If yes, I will send in another patch to clean this up. Best regards, Peter Müller

2 1

Captive Portal
by Michael Tremer 06 Oct '17

06 Oct '17

Hi, the captive portal development needs a few more hands. Below you can download the latest ISO image (and other image formats) with the captive portal integrated. So far this seems to work fine. I have given it a good test and despite a few design things, I couldn't find any bigger issues. http://people.ipfire.org/~ms/captive-portal/ Who would like to give it a try and help testing so that we can ship this with 115? Best, -Michael

2 3

Bugzilla #11494
by Matthias Fischer 01 Oct '17

01 Oct '17

Hi, Just for information: Please pay attention to https://bugzilla.ipfire.org/show_bug.cgi?id=11494 Reference: https://forum.ipfire.org/viewtopic.php?f=27&t=19550&p=111033#p111030 Can anyone else confirm? Best, Matthias

1 1

[PATCH] openvpn: Update to 2.3.18
by Matthias Fischer 30 Sep '17

30 Sep '17

Fixes CVE-2017-12166: out of bounds write in key-method 1 For details see: https://community.openvpn.net/openvpn/wiki/CVE-2017-12166 Changelog: https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn23#OpenVPN2.3.18 Removed an unrecognized 'configure'-option. Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/openvpn | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/lfs/openvpn b/lfs/openvpn index b7f521759..8307d0147 100644 --- a/lfs/openvpn +++ b/lfs/openvpn @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2015 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2017 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.3.17 +VER = 2.3.18 THISAPP = openvpn-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = df9291c5bd466fe73c2544a800f3b441 +$(DL_FILE)_MD5 = 844ec9c64aae62051478784b8562f881 install : $(TARGET) @@ -74,7 +74,6 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) --prefix=/usr \ --sysconfdir=/var/ipfire/ovpn \ --enable-iproute2 \ - --enable-password-save \ --enable-plugins \ --enable-plugin-auth-pam \ --enable-plugin-down-root -- 2.14.2

1 0

[PATCH] tor: Update to 3.1.7
by Matthias Fischer 29 Sep '17

29 Sep '17

Fixes TROVE-2017-008 and CVE-2017-0380 and others.... For details see https://gitweb.torproject.org/tor.git/plain/ReleaseNotes?id=tor-0.3.1.7 "Tor 0.3.1.7 is the first stable release in the 0.3.1 series." Best, Matthias Signed-off-by: Matthias Fischer <matthias.fischer(a)ipfire.org> --- lfs/tor | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lfs/tor b/lfs/tor index 9e463445b..867f01fb4 100644 --- a/lfs/tor +++ b/lfs/tor @@ -24,7 +24,7 @@ include Config -VER = 0.3.0.10 +VER = 0.3.1.7 THISAPP = tor-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -32,7 +32,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = tor -PAK_VER = 22 +PAK_VER = 23 DEPS = "" @@ -44,7 +44,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_MD5 = c9920169798c28b60b03fa3f0e592509 +$(DL_FILE)_MD5 = ec7c9f588c9e1a42c09bcc097a1e55eb install : $(TARGET) -- 2.14.2

1 0

[PATCH v2] force transport encryption for WebUI logins
by Peter Müller 29 Sep '17

29 Sep '17

Force the usage of SSL when accessing protected locations. Queries to the plain text interface on port 81 will be answered with a 301 ("Moved permanently") status. All authentication directives on port 81 are disabled to prevent data leakage. Signed-off-by: Peter Müller <peter.mueller(a)link38.eu> --- diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf index 6f353962e..bec0d580b 100644 --- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf +++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf @@ -23,7 +23,10 @@ AuthName "IPFire - Restricted" AuthType Basic AuthUserFile /var/ipfire/auth/users - Require user admin + <RequireAll> + Require user admin + Require ssl + </RequireAll> </DirectoryMatch> ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/ <Directory /srv/web/ipfire/cgi-bin> @@ -32,7 +35,10 @@ AuthName "IPFire - Restricted" AuthType Basic AuthUserFile /var/ipfire/auth/users - Require user admin + <RequireAll> + Require user admin + Require ssl + </RequireAll> <Files chpasswd.cgi> Require all granted </Files> @@ -40,7 +46,10 @@ Require all granted </Files> <Files dial.cgi> - Require user admin + <RequireAll> + Require user admin + Require ssl + </RequireAll> </Files> </Directory> <Directory /srv/web/ipfire/cgi-bin/dial> @@ -49,7 +58,10 @@ AuthName "IPFire - Restricted" AuthType Basic AuthUserFile /var/ipfire/auth/users - Require user dial admin + <RequireAll> + Require user dial admin + Require ssl + </RequireAll> </Directory> <Files ~ "\.(cgi|shtml?)$"> SSLOptions +StdEnvVars @@ -85,6 +97,9 @@ AuthName "IPFire - Restricted" AuthType Basic AuthUserFile /var/ipfire/auth/users - Require user admin + <RequireAll> + Require user admin + Require ssl + </RequireAll> </Directory> </VirtualHost> diff --git a/config/httpd/vhosts.d/ipfire-interface.conf b/config/httpd/vhosts.d/ipfire-interface.conf index 619f90fcc..a0537b392 100644 --- a/config/httpd/vhosts.d/ipfire-interface.conf +++ b/config/httpd/vhosts.d/ipfire-interface.conf @@ -12,36 +12,25 @@ Require all granted </Directory> <DirectoryMatch "/srv/web/ipfire/html/(graphs|sgraph)"> - AuthName "IPFire - Restricted" - AuthType Basic - AuthUserFile /var/ipfire/auth/users - Require user admin + Options SymLinksIfOwnerMatch + RewriteEngine on + RewriteCond %{HTTPS} off + RewriteRule (.*) https://%{SERVER_NAME}:444/$1 [R=301,L] </DirectoryMatch> ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/ <Directory /srv/web/ipfire/cgi-bin> AllowOverride None - Options None - AuthName "IPFire - Restricted" - AuthType Basic - AuthUserFile /var/ipfire/auth/users - Require user admin - <Files chpasswd.cgi> - Require all granted - </Files> - <Files webaccess.cgi> - Require all granted - </Files> - <Files dial.cgi> - Require user admin - </Files> + Options SymLinksIfOwnerMatch + RewriteEngine on + RewriteCond %{HTTPS} off + RewriteRule (.*) https://%{SERVER_NAME}:444/$1 [R=301,L] </Directory> <Directory /srv/web/ipfire/cgi-bin/dial> AllowOverride None - Options None - AuthName "IPFire - Restricted" - AuthType Basic - AuthUserFile /var/ipfire/auth/users - Require user dial admin + Options SymLinksIfOwnerMatch + RewriteEngine on + RewriteCond %{HTTPS} off + RewriteRule (.*) https://%{SERVER_NAME}:444/$1 [R=301,L] </Directory> Alias /updatecache/ /var/updatecache/ <Directory /var/updatecache>

4 15

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development September 2017