Force the usage of SSL when accessing protected locations.

Queries to the plain text interface on port 81 will be answered
with a 301 ("Moved permanently") status.

All authentication directives on port 81 are disabled to prevent
data leakage.

Signed-off-by: Peter Müller <peter.mueller(a)link38.eu>
---
diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/vhosts.d/ipfire-interface-ssl.conf
index 6f353962e..bec0d580b 100644
--- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf
+++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf
@@ -23,7 +23,10 @@
         AuthName "IPFire - Restricted"
         AuthType Basic
         AuthUserFile /var/ipfire/auth/users
-        Require user admin
+	<RequireAll>
+		Require user admin
+		Require ssl
+	</RequireAll>
     </DirectoryMatch>
     ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/
     <Directory /srv/web/ipfire/cgi-bin>
@@ -32,7 +35,10 @@
         AuthName "IPFire - Restricted"
         AuthType Basic
         AuthUserFile /var/ipfire/auth/users
-        Require user admin
+	<RequireAll>
+		Require user admin
+		Require ssl
+	</RequireAll>
         <Files chpasswd.cgi>
             Require all granted
         </Files>
@@ -40,7 +46,10 @@
             Require all granted
         </Files>
         <Files dial.cgi>
-            Require user admin
+		<RequireAll>
+			Require user admin
+			Require ssl
+		</RequireAll>
         </Files>
     </Directory>
     <Directory /srv/web/ipfire/cgi-bin/dial>
@@ -49,7 +58,10 @@
         AuthName "IPFire - Restricted"
         AuthType Basic
         AuthUserFile /var/ipfire/auth/users
-        Require user dial admin
+	<RequireAll>
+		Require user dial admin
+		Require ssl
+	</RequireAll>
     </Directory>
     <Files ~ "\.(cgi|shtml?)$">
 	SSLOptions +StdEnvVars
@@ -85,6 +97,9 @@
         AuthName "IPFire - Restricted"
         AuthType Basic
         AuthUserFile /var/ipfire/auth/users
-        Require user admin
+	<RequireAll>
+		Require user admin
+		Require ssl
+	</RequireAll>
     </Directory>
 </VirtualHost>
diff --git a/config/httpd/vhosts.d/ipfire-interface.conf b/config/httpd/vhosts.d/ipfire-interface.conf
index 619f90fcc..a0537b392 100644
--- a/config/httpd/vhosts.d/ipfire-interface.conf
+++ b/config/httpd/vhosts.d/ipfire-interface.conf
@@ -12,36 +12,25 @@
         Require all granted
     </Directory>
     <DirectoryMatch "/srv/web/ipfire/html/(graphs|sgraph)">
-        AuthName "IPFire - Restricted"
-        AuthType Basic
-        AuthUserFile /var/ipfire/auth/users
-        Require user admin
+		Options SymLinksIfOwnerMatch
+		RewriteEngine on
+		RewriteCond %{HTTPS} off
+		RewriteRule (.*) https://%{SERVER_NAME}:444/$1 [R=301,L]
     </DirectoryMatch>
     ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/
     <Directory /srv/web/ipfire/cgi-bin>
         AllowOverride None
-        Options None
-        AuthName "IPFire - Restricted"
-        AuthType Basic
-        AuthUserFile /var/ipfire/auth/users
-        Require user admin
-         <Files chpasswd.cgi>
-            Require all granted
-        </Files>
-        <Files webaccess.cgi>
-            Require all granted
-        </Files>
-        <Files dial.cgi>
-            Require user admin
-        </Files>
+		Options SymLinksIfOwnerMatch
+		RewriteEngine on
+		RewriteCond %{HTTPS} off
+		RewriteRule (.*) https://%{SERVER_NAME}:444/$1 [R=301,L]
     </Directory>
     <Directory /srv/web/ipfire/cgi-bin/dial>
         AllowOverride None
-        Options None
-        AuthName "IPFire - Restricted"
-        AuthType Basic
-        AuthUserFile /var/ipfire/auth/users
-        Require user dial admin
+		Options SymLinksIfOwnerMatch
+		RewriteEngine on
+		RewriteCond %{HTTPS} off
+		RewriteRule (.*) https://%{SERVER_NAME}:444/$1 [R=301,L]
     </Directory>
     Alias /updatecache/ /var/updatecache/
 	<Directory /var/updatecache>