1: <!DOCTYPE piml PUBLIC "-//TUX/DTD piml 1.0 Final//EN"
2: "http://lpml.sourceforge.net/DTD/piml.dtd">
3: <!-- webserver.piml -->
4:
5: <!-- $Id: webserver.piml,v 1.43.2.8 2020/09/06 21:51:19 raeburn Exp $ -->
6:
7: <!--
8:
9: Copyright Michigan State University Board of Trustees
10:
11: This file is part of the LearningOnline Network with CAPA (LON-CAPA).
12:
13: LON-CAPA is free software; you can redistribute it and/or modify
14: it under the terms of the GNU General Public License as published by
15: the Free Software Foundation; either version 2 of the License, or
16: (at your option) any later version.
17:
18: LON-CAPA is distributed in the hope that it will be useful,
19: but WITHOUT ANY WARRANTY; without even the implied warranty of
20: MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21: GNU General Public License for more details.
22:
23: You should have received a copy of the GNU General Public License
24: along with LON-CAPA; if not, write to the Free Software
25: Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
26:
27: /home/httpd/html/adm/gpl.txt
28:
29: http://www.lon-capa.org/
30:
31: -->
32:
33: <!-- Default values must be defined before specific values. -->
34: <!-- If no 'dist' attribute is specified, then it is always installed. -->
35: <!-- If 'dist' attribute is set to 'default', then the specification. -->
36: <!-- is accepted if an alternative distribution is not requested or not -->
37: <!-- defined. -->
38:
39: <piml>
40: <targetroot>/</targetroot>
41: <specialnotices>
42: <specialnotice>
43: </specialnotice>
44: </specialnotices>
45: <files>
46: <file>
47: <target dist='default'>/etc/httpd/conf/httpd.conf</target>
48: <target dist='suse9.2 suse9.3 sles9'>/etc/httpd/httpd.conf</target>
49: <target dist='sles10 sles11 sles12 sles15 suse10.1 suse10.2 suse10.3 suse11.1 suse11.2 suse11.3 suse11.4 suse12.1 suse12.2 suse12.3 suse13.1 suse13.2'>/etc/apache2/default-server.conf</target>
50: <target dist='debian5 debian6 ubuntu6 ubuntu8 ubuntu10 ubuntu12'>/etc/apache2/sites-available/loncapa</target>
51: <target dist='ubuntu14 ubuntu16 ubuntu18 ubuntu20'>/etc/apache2/conf-available/loncapa</target>
52: <note>This is for Apache 1.X for Red Hat 4ES, Fedora 2, 3 and 4, SusSE 9.2 and 9.3, and SLES 9 distributions. This is for Apache 2.X for Fedora 5, Red Hat 5, CentOS 5, Scientific Linux 5, Oracle Linux 5, SuSE 10.1, SLES 10, Debian 5, Ubuntu LTS 8 and later distributions</note>
53: <dependencies dist='default'>
54: /etc/httpd/conf/httpd.conf
55: </dependencies>
56: <dependencies dist='suse9.2 suse9.3 sles9'>
57: /etc/httpd/httpd.conf
58: </dependencies>
59: <dependencies dist='debian5 debian6 ubuntu6 ubuntu8 ubuntu10 ubuntu12'>
60: /etc/apache2/sites-available/loncapa
61: </dependencies>
62: <dependencies dist='ubuntu14 ubuntu16 ubuntu18 ubuntu20'>
63: /etc/apache2/conf-available/loncapa
64: </dependencies>
65: <dependencies dist='sles10 sles11 sles12 sles15 suse10.1 suse10.2 suse10.3 suse11.1 suse11.2 suse11.3 suse11.4 suse12.1 suse12.2 suse12.3 suse13.1 suse13.2'>
66: /etc/apache2/default-server.conf
67: </dependencies>
68: <perlscript mode='fg' dist="default">
69: # Generated from doc/loncapafiles/webserver.piml
70: use Socket;
71: use Sys::Hostname::FQDN();
72: unless (-e "<TARGET />") {
73: print '**** ERROR! <TARGET /> should exist! Are you missing the Apache '.
74: 'software package?';
75: exit(1);
76: }
77: else {
78: # Append loncapa_apache.conf inclusion to httpd.conf
79: # (or sites-available/loncapa or conf-available/loncapa) if not present.
80: $flag=0;
81: open(IN,'<<TARGET />');
82: while (<IN>) {
83: if (/^\s*Include\s+conf\/loncapa_apache.conf/) {
84: $flag=1;
85: }
86: }
87: close(IN);
88: unless ($flag==1) {
89: open(OUT,'>><TARGET />');
90: print(OUT 'Include conf/loncapa_apache.conf'."\n");
91: close(OUT);
92: }
93: # Remove loncapa.conf inclusion from httpd.conf
94: # (or sites-available/loncapa or conf-available/loncapa) if present.
95: $flag=0;
96: open(IN,'<<TARGET />');
97: while (<IN>) {
98: if (/^\s*Include\s+conf\/loncapa.conf/) {
99: $flag=1;
100: }
101: }
102: close(IN);
103: $in='';
104: if ($flag==1) {
105: open(IN,'<<TARGET />');
106: while(<IN>) {
107: $in.=$_ unless /^\s*Include\s+conf\/loncapa.conf/;
108: }
109: close(IN);
110: open(OUT,'><TARGET />');
111: print(OUT $in."\n");
112: close(OUT);
113: }
114:
115: # Checking for overlapping ScriptAlias and DocumentRoot definitions.
116: $scriptalias_flag=0;
117: $documentroot_flag=0;
118: my $scriptalias;
119: my $documentroot;
120: open(IN,'<<TARGET />');
121: while (<IN>) {
122: if (m!^\s*ScriptAlias\s+/cgi-bin/\s+(.*)$!) {
123: $scriptalias = $1;
124: if ($scriptalias !~ m!home/httpd/cgi-bin!) {
125: $scriptalias_flag = 1;
126: }
127: }
128: if (m!^\s*DocumentRoot\s+(.*)$!) {
129: $documentroot = $1;
130: if ($documentroot !~ m!home/httpd/html!) {
131: $documentroot_flag = 1;
132: }
133: }
134: }
135: close(IN);
136: if ($scriptalias_flag==1) {
137: my $conffile = '/etc/httpd/conf/httpd.conf';
138: if ('<DIST />' eq 'suse9.2' || '<DIST />' eq 'suse9.3'
139: || '<DIST />' eq 'sles9') {
140: $conffile = '/etc/httpd/httpd.conf';
141: } elsif ('<DIST />' =~ /^(suse|sles)/) {
142: $conffile = '/etc/apache2/default-server.conf';
143: } elsif ('<DIST />' =~ /^(debian|ubuntu)/) {
144: $conffile = '/etc/apache2/sites-available/loncapa';
145: }
146: print('**** ERROR **** '.$conffile.' has an overlapping definition of '.
147: 'ScriptAlias (it is incorrectly set to '.$scriptalias.').'."\n".
148: 'This conflicts with loncapa_apache.conf.'."\n");
149: }
150: if ($documentroot_flag==1) {
151: print('**** ERROR **** '.$conffile.' has an overlapping definition of '.
152: 'DocumentRoot (it is incorrectly set to '.$documentroot.').'."\n".
153: 'This conflicts with loncapa_apache.conf.'."\n");
154: }
155:
156: # Checking for rewrites of http:// to https://
157: my $rewrite_dir = '/etc/httpd/conf/rewrites';
158: my $curr_rewrite = '/etc/httpd/conf/loncapa_rewrite.conf';
159: if ('<DIST />' eq 'suse9.2' || '<DIST />' eq 'suse9.3'
160: || '<DIST />' eq 'sles9') {
161: $rewrite_dir = '/etc/httpd/rewrites/';
162: $curr_rewrite = '/etc/httpd/loncapa_rewrite.conf';
163: } elsif ('<DIST />' =~ /^(suse|sles|debian|ubuntu)/) {
164: $rewrite_dir = '/etc/apache2/rewrites';
165: $curr_rewrite = '/etc/apache2/loncapa_rewrite.conf';
166: }
167: my $rewrite_off = $rewrite_dir.'/loncapa_rewrite_off.conf';
168: my $rewrite_on = $rewrite_dir.'/loncapa_rewrite_on.conf';
169: if (!-e $curr_rewrite) {
170: system("cp $rewrite_off $curr_rewrite");
171: chmod(0644, $curr_rewrite);
172: } else {
173: my ($not_rewrite_on,$not_rewrite_off,$rewrite_state);
174: if (open(PIPE, "diff --brief $rewrite_off $curr_rewrite |")) {
175: my $diffres = <PIPE> ;
176: close(PIPE);
177: chomp($diffres);
178: if ($diffres) {
179: $not_rewrite_off = 1;
180: } else {
181: $rewrite_state = 'off';
182: }
183: }
184: if (open(PIPE, "diff --brief $rewrite_on $curr_rewrite |")) {
185: my $diffres = <PIPE> ;
186: close(PIPE);
187: chomp($diffres);
188: if ($diffres) {
189: $not_rewrite_on = 1;
190: } else {
191: $rewrite_state = 'on';
192: }
193: }
194: if ($not_rewrite_off && $not_rewrite_on) {
195: print('**** WARNING **** '."\n".$curr_rewrite.' does not match '.
196: 'either:'."\n".$rewrite_on.' - the file used to enable rewriting '.
197: 'of requests for http:// to https:// '."\n".'or:'."\n".$rewrite_off.
198: ' - the file used to disable such rewriting'."\n\n".
199: 'This may be because '. $curr_rewrite.' has been '.
200: 'previously customized,'."\n".'or it may be because of a change '.
201: 'to the files in '.$rewrite_dir."\n");
202: if (open(my $fh,'<',$curr_rewrite)) {
203: while(<$fh>) {
204: if (/^\s*RewriteEngine\s+(on|off)\s*$/i) {
205: if ($1 eq 'on') {
206: $rewrite_state = 'on';
207: } else {
208: $rewrite_state = 'off';
209: }
210: last;
211: }
212: }
213: }
214: }
215: if ($rewrite_state eq 'on') {
216: # Checking for rewrites of https:// to http://
217: my ($gotrules,$rulestr,$ssldir);
218: if ('<DIST />' eq 'suse9.2' || '<DIST />' eq 'suse9.3'
219: || '<DIST />' eq 'sles9') {
220: $ssldir = '/etc/apache/vhosts.d';
221: } elsif ('<DIST />' =~ /^(suse|sles)/) {
222: $ssldir = '/etc/apache2/vhosts.d';
223: } elsif ('<DIST />' =~ /^(debian|ubuntu)/) {
224: $ssldir = '/etc/apache2/sites-available';
225: } else {
226: $ssldir = '/etc/httpd/conf.d';
227: }
228: my $hostname = Sys::Hostname::FQDN::fqdn();
229: my $hostip = Socket::inet_ntoa(scalar(gethostbyname($hostname)) || 'localhost');
230: my @expected = ('RewriteEngine on',
231: 'RewriteCond %{HTTPS} =on',
232: 'RewriteCond %{REQUEST_URI} ^/adm/wrapper/ext/(?!https:)',
233: 'RewriteCond %{QUERY_STRING} (^|&(|amp;))usehttp=1($|&)',
234: 'RewriteRule ^/adm/wrapper/ext/(?!https:) http://%{HTTP_HOST}%{REQUEST_URI} [R,L,NE]',
235: 'RewriteCond %{REMOTE_ADDR} 127.0.0.1',
236: 'RewriteRule (.*) - [L]');
237: if (($hostip ne '') && ($hostip ne '127.0.0.1')) {
238: push(@expected,('RewriteCond %{REMOTE_ADDR} '.$hostip,
239: 'RewriteRule (.*) - [L]'));
240: }
241: push(@expected,('RewriteCond %{REQUEST_URI} ^/public/.*/syllabus$',
242: 'RewriteCond %{QUERY_STRING} (^|&(|amp;))usehttp=1($|&)',
243: 'RewriteRule ^/public/.*/syllabus$ http://%{HTTP_HOST}%{REQUEST_URI} [R,L,NE]'));
244: if (-d $ssldir) {
245: my @rewrites;
246: if (opendir(my $dir,$ssldir)) {
247: my @sslconf_files;
248: foreach my $file (grep(!/^\./,readdir($dir))) {
249: next if ($file =~ /\.rpmnew$/);
250: if (open(my $fh,'<',"$ssldir/$file")) {
251: while (<$fh>) {
252: if (/^\s*<VirtualHost\s+[^:]*\:443>\s*$/) {
253: push(@sslconf_files,$file);
254: last;
255: }
256: }
257: close($fh);
258: }
259: }
260: if (@sslconf_files) {
261: foreach my $file (@sslconf_files) {
262: if (open(my $fh,'<',"$ssldir/$file")) {
263: my ($rewrite,$num) = (0,0);
264: while (<$fh>) {
265: if ($rewrite) {
266: if (/^\s*<\/IfModule>/) {
267: $rewrite = 0;
268: $num ++;
269: } else {
270: chomp();
271: s/^\s+|\s+$//g;
272: push(@{$rewrites[$num]},$_);
273: }
274: } elsif (/^\s*<IfModule\s+mod_rewrite.c>/) {
275: $rewrite = 1;
276: }
277: }
278: close($fh);
279: }
280: }
281: }
282: closedir($dir);
283: }
284: if (@rewrites) {
285: foreach my $item (@rewrites) {
286: if (ref($item) eq 'ARRAY') {
287: my $found = 0;
288: foreach my $line (@{$item}) {
289: foreach my $match (@expected) {
290: if ($match eq $line) {
291: $found ++;
292: last;
293: }
294: }
295: }
296: if ($found >= scalar(@expected)) {
297: $gotrules = 1;
298: last;
299: }
300: }
301: }
302: }
303: }
304: unless ($gotrules) {
305: print('**** WARNING **** '."\n".$curr_rewrite.' is currently set so rewrites '.
306: 'of http to https are enabled for most URLs.'."\n".
307: 'Unless your Apache configuration includes Strict-Transport-Security '.
308: '(with max-age > 0), it is recommended to also set rewrites from https to http '.
309: 'for specific URLs in a file in '.$ssldir.' by including the following:'."\n".
310: "<IfModule mod_rewrite.c>\n".' '.
311: join("\n ",@expected)."\n".
312: "</IfModule>\n");
313: }
314: }
315: }
316: }
317: </perlscript>
318: </file>
319: </files>
320: </piml>
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/back.gif){kind=icon}
Return to webserver.piml CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [LON-CAPA] / doc / loncapafiles