Sync from SUSE:SLFO:Main apache2 revision 3122774273c66f9a28ec050b3a5807bf
This commit is contained in:
commit
80a23ce35f
23
.gitattributes
vendored
Normal file
23
.gitattributes
vendored
Normal file
@ -0,0 +1,23 @@
|
||||
## Default LFS
|
||||
*.7z filter=lfs diff=lfs merge=lfs -text
|
||||
*.bsp filter=lfs diff=lfs merge=lfs -text
|
||||
*.bz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.gem filter=lfs diff=lfs merge=lfs -text
|
||||
*.gz filter=lfs diff=lfs merge=lfs -text
|
||||
*.jar filter=lfs diff=lfs merge=lfs -text
|
||||
*.lz filter=lfs diff=lfs merge=lfs -text
|
||||
*.lzma filter=lfs diff=lfs merge=lfs -text
|
||||
*.obscpio filter=lfs diff=lfs merge=lfs -text
|
||||
*.oxt filter=lfs diff=lfs merge=lfs -text
|
||||
*.pdf filter=lfs diff=lfs merge=lfs -text
|
||||
*.png filter=lfs diff=lfs merge=lfs -text
|
||||
*.rpm filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.tgz filter=lfs diff=lfs merge=lfs -text
|
||||
*.ttf filter=lfs diff=lfs merge=lfs -text
|
||||
*.txz filter=lfs diff=lfs merge=lfs -text
|
||||
*.whl filter=lfs diff=lfs merge=lfs -text
|
||||
*.xz filter=lfs diff=lfs merge=lfs -text
|
||||
*.zip filter=lfs diff=lfs merge=lfs -text
|
||||
*.zst filter=lfs diff=lfs merge=lfs -text
|
14
_multibuild
Normal file
14
_multibuild
Normal file
@ -0,0 +1,14 @@
|
||||
<multibuild>
|
||||
<package>event</package>
|
||||
<package>worker</package>
|
||||
<package>prefork</package>
|
||||
<package>utils</package>
|
||||
<package>devel</package>
|
||||
<package>manual</package>
|
||||
<package>test_event</package>
|
||||
<package>test_worker</package>
|
||||
<package>test_prefork</package>
|
||||
<package>test_devel</package>
|
||||
<package>test_main</package>
|
||||
</multibuild>
|
||||
|
12
apache-test-application-xml-type.patch
Normal file
12
apache-test-application-xml-type.patch
Normal file
@ -0,0 +1,12 @@
|
||||
Index: httpd-framework/t/conf/extra.conf.in
|
||||
===================================================================
|
||||
--- a/httpd-framework/t/conf/extra.conf.in 2020-06-15 10:43:26.156701553 +0200
|
||||
+++ b/httpd-framework/t/conf/extra.conf.in 2020-06-15 10:46:16.141693081 +0200
|
||||
@@ -875,6 +875,7 @@ LimitRequestFields 32
|
||||
</IfModule>
|
||||
</Directory>
|
||||
<Directory @SERVERROOT@/htdocs/modules/filter/bytype>
|
||||
+ AddType application/xml .xml
|
||||
<IfModule mod_deflate.c>
|
||||
AddOutputFilterByType DEFLATE application/xml
|
||||
AddOutputFilterByType DEFLATE text/xml
|
14
apache-test-turn-off-variables-in-ssl-var-lookup.patch
Normal file
14
apache-test-turn-off-variables-in-ssl-var-lookup.patch
Normal file
@ -0,0 +1,14 @@
|
||||
Index: httpd-framework/t/ssl/varlookup.t
|
||||
===================================================================
|
||||
--- a/httpd-framework/t/ssl/varlookup.t 2016-10-25 14:30:54.250707932 +0200
|
||||
+++ b/httpd-framework/t/ssl/varlookup.t 2016-10-27 15:38:52.440667690 +0200
|
||||
@@ -210,9 +210,7 @@ SSL_SERVER_S_DN_UID
|
||||
SSL_CLIENT_S_DN_Email "$client_dn{$email_field}"
|
||||
SSL_SERVER_S_DN_Email "$server_dn{$email_field}"
|
||||
SSL_CLIENT_SAN_Email_0 "$san_email"
|
||||
-SSL_SERVER_SAN_DNS_0 "$san_dns"
|
||||
SSL_CLIENT_SAN_OTHER_msUPN_0 "$san_msupn"
|
||||
-SSL_SERVER_SAN_OTHER_dnsSRV_0 "$san_dnssrv"
|
||||
|
||||
SSL_CLIENT_I_DN "$client_i_dn"
|
||||
SSL_SERVER_I_DN "$server_i_dn"
|
173
apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
Normal file
173
apache2-HttpContentLengthHeadZero-HttpExpectStrict.patch
Normal file
@ -0,0 +1,173 @@
|
||||
From 530b5797af919d6d7ab7d6418d9feeb1abb914ae Mon Sep 17 00:00:00 2001
|
||||
From: Justin Erenkrantz <jerenkrantz@apache.org>
|
||||
Date: Mon, 30 Dec 2013 20:01:14 +0000
|
||||
Subject: [PATCH] Add directives to control two protocol options:
|
||||
|
||||
HttpContentLengthHeadZero - allow Content-Length of 0 to be returned on HEAD
|
||||
HttpExpectStrict - allow admin to control whether we must see "100-continue"
|
||||
|
||||
This is helpful when using Ceph's radosgw and httpd.
|
||||
|
||||
Inspired by: Yehuda Sadeh <yehuda@inktank.com>
|
||||
See https://github.com/ceph/apache2/commits/precise
|
||||
|
||||
* include/http_core.h
|
||||
(core_server_config): Add http_cl_head_zero and http_expect_strict fields.
|
||||
* modules/http/http_filters.c
|
||||
(ap_http_header_filter): Only clear out the C-L if http_cl_head_zero is not
|
||||
explictly set.
|
||||
* server/core.c
|
||||
(merge_core_server_configs): Add new fields.
|
||||
(set_cl_head_zero, set_expect_strict): New config helpers.
|
||||
(HttpContentLengthHeadZero, HttpExpectStrict): Declare new directives.
|
||||
* server/protocol.c
|
||||
(ap_read_request): Allow http_expect_strict to control if we return 417.
|
||||
* include/ap_mmn.h
|
||||
(MODULE_MAGIC_NUMBER_MAJOR, MODULE_MAGIC_NUMBER_MINOR): Bump.
|
||||
* CHANGES: Add a brief description.
|
||||
|
||||
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1554303 13f79535-47bb-0310-9956-ffa450edef68
|
||||
|
||||
Conflicts:
|
||||
CHANGES
|
||||
include/ap_mmn.h
|
||||
include/http_core.h
|
||||
server/core.c
|
||||
---
|
||||
CHANGES | 3 +++
|
||||
include/ap_mmn.h | 4 +++-
|
||||
include/http_core.h | 9 +++++++++
|
||||
modules/http/http_filters.c | 10 +++++++++-
|
||||
server/core.c | 36 ++++++++++++++++++++++++++++++++++++
|
||||
server/protocol.c | 25 +++++++++++++++++--------
|
||||
6 files changed, 77 insertions(+), 10 deletions(-)
|
||||
|
||||
Index: httpd-2.4.49/modules/http/http_filters.c
|
||||
===================================================================
|
||||
--- httpd-2.4.49.orig/modules/http/http_filters.c 2021-05-11 17:21:43.000000000 +0200
|
||||
+++ httpd-2.4.49/modules/http/http_filters.c 2021-09-17 09:33:49.496853894 +0200
|
||||
@@ -1488,10 +1488,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_
|
||||
* zero C-L to the client. We can't just remove the C-L filter,
|
||||
* because well behaved 2.0 handlers will send their data down the stack,
|
||||
* and we will compute a real C-L for the head request. RBB
|
||||
+ *
|
||||
+ * Allow modification of this behavior through the
|
||||
+ * HttpContentLengthHeadZero directive.
|
||||
+ *
|
||||
+ * The default (unset) behavior is to squelch the C-L in this case.
|
||||
*/
|
||||
+ core_server_config *conf = ap_get_core_module_config(r->server->module_config);
|
||||
if (r->header_only
|
||||
&& (clheader = apr_table_get(r->headers_out, "Content-Length"))
|
||||
- && !strcmp(clheader, "0")) {
|
||||
+ && !strcmp(clheader, "0")
|
||||
+ && conf->http_cl_head_zero != AP_HTTP_CL_HEAD_ZERO_ENABLE) {
|
||||
apr_table_unset(r->headers_out, "Content-Length");
|
||||
}
|
||||
|
||||
Index: httpd-2.4.49/server/core.c
|
||||
===================================================================
|
||||
--- httpd-2.4.49.orig/server/core.c 2021-05-27 15:08:21.000000000 +0200
|
||||
+++ httpd-2.4.49/server/core.c 2021-09-17 09:33:49.496853894 +0200
|
||||
@@ -551,6 +551,12 @@ static void *merge_core_server_configs(a
|
||||
if (virt->http_methods != AP_HTTP_METHODS_UNSET)
|
||||
conf->http_methods = virt->http_methods;
|
||||
|
||||
+ if (virt->http_cl_head_zero != AP_HTTP_CL_HEAD_ZERO_UNSET)
|
||||
+ conf->http_cl_head_zero = virt->http_cl_head_zero;
|
||||
+
|
||||
+ if (virt->http_expect_strict != AP_HTTP_EXPECT_STRICT_UNSET)
|
||||
+ conf->http_expect_strict = virt->http_expect_strict;
|
||||
+
|
||||
/* no action for virt->accf_map, not allowed per-vhost */
|
||||
|
||||
if (virt->protocol)
|
||||
@@ -4142,6 +4148,32 @@ static const char *set_http_method(cmd_p
|
||||
return NULL;
|
||||
}
|
||||
|
||||
+static const char *set_cl_head_zero(cmd_parms *cmd, void *dummy, int arg)
|
||||
+{
|
||||
+ core_server_config *conf =
|
||||
+ ap_get_core_module_config(cmd->server->module_config);
|
||||
+
|
||||
+ if (arg) {
|
||||
+ conf->http_cl_head_zero = AP_HTTP_CL_HEAD_ZERO_ENABLE;
|
||||
+ } else {
|
||||
+ conf->http_cl_head_zero = AP_HTTP_CL_HEAD_ZERO_DISABLE;
|
||||
+ }
|
||||
+ return NULL;
|
||||
+}
|
||||
+
|
||||
+static const char *set_expect_strict(cmd_parms *cmd, void *dummy, int arg)
|
||||
+{
|
||||
+ core_server_config *conf =
|
||||
+ ap_get_core_module_config(cmd->server->module_config);
|
||||
+
|
||||
+ if (arg) {
|
||||
+ conf->http_expect_strict = AP_HTTP_EXPECT_STRICT_ENABLE;
|
||||
+ } else {
|
||||
+ conf->http_expect_strict = AP_HTTP_EXPECT_STRICT_DISABLE;
|
||||
+ }
|
||||
+ return NULL;
|
||||
+}
|
||||
+
|
||||
static apr_hash_t *errorlog_hash;
|
||||
|
||||
static int log_constant_item(const ap_errorlog_info *info, const char *arg,
|
||||
@@ -4685,6 +4717,10 @@ AP_INIT_TAKE1("TraceEnable", set_trace_e
|
||||
"'on' (default), 'off' or 'extended' to trace request body content"),
|
||||
AP_INIT_FLAG("MergeTrailers", set_merge_trailers, NULL, RSRC_CONF,
|
||||
"merge request trailers into request headers or not"),
|
||||
+AP_INIT_FLAG("HttpContentLengthHeadZero", set_cl_head_zero, NULL, OR_OPTIONS,
|
||||
+ "whether to permit Content-Length of 0 responses to HEAD requests"),
|
||||
+AP_INIT_FLAG("HttpExpectStrict", set_expect_strict, NULL, OR_OPTIONS,
|
||||
+ "whether to return a 417 if a client doesn't send 100-Continue"),
|
||||
AP_INIT_ITERATE("Protocols", set_protocols, NULL, RSRC_CONF,
|
||||
"Controls which protocols are allowed"),
|
||||
AP_INIT_TAKE1("ProtocolsHonorOrder", set_protocols_honor_order, NULL, RSRC_CONF,
|
||||
Index: httpd-2.4.49/server/protocol.c
|
||||
===================================================================
|
||||
--- httpd-2.4.49.orig/server/protocol.c 2021-09-17 09:33:49.496853894 +0200
|
||||
+++ httpd-2.4.49/server/protocol.c 2021-09-17 10:15:28.643596021 +0200
|
||||
@@ -1056,6 +1056,11 @@ AP_DECLARE(int) ap_check_request_header(
|
||||
if (ap_cstr_casecmp(expect, "100-continue") == 0) {
|
||||
r->expecting_100 = 1;
|
||||
}
|
||||
+ else if (conf->http_expect_strict == AP_HTTP_EXPECT_STRICT_DISABLE) {
|
||||
+ ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, APLOGNO(02595)
|
||||
+ "client sent an unrecognized expectation value "
|
||||
+ "of Expect (not fatal): %s", expect);
|
||||
+ }
|
||||
else {
|
||||
ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, APLOGNO(00570)
|
||||
"client sent an unrecognized expectation value "
|
||||
Index: httpd-2.4.49/include/http_core.h
|
||||
===================================================================
|
||||
--- httpd-2.4.49.orig/include/http_core.h 2021-05-27 15:08:21.000000000 +0200
|
||||
+++ httpd-2.4.49/include/http_core.h 2021-09-17 09:33:49.496853894 +0200
|
||||
@@ -733,6 +733,16 @@ typedef struct {
|
||||
#define AP_MERGE_TRAILERS_DISABLE 2
|
||||
int merge_trailers;
|
||||
|
||||
+#define AP_HTTP_CL_HEAD_ZERO_UNSET 0
|
||||
+#define AP_HTTP_CL_HEAD_ZERO_ENABLE 1
|
||||
+#define AP_HTTP_CL_HEAD_ZERO_DISABLE 2
|
||||
+ int http_cl_head_zero;
|
||||
+
|
||||
+#define AP_HTTP_EXPECT_STRICT_UNSET 0
|
||||
+#define AP_HTTP_EXPECT_STRICT_ENABLE 1
|
||||
+#define AP_HTTP_EXPECT_STRICT_DISABLE 2
|
||||
+ int http_expect_strict;
|
||||
+
|
||||
apr_array_header_t *protocols;
|
||||
int protocols_honor_order;
|
||||
|
||||
@@ -776,7 +786,6 @@ apr_status_t ap_core_input_filter(ap_fil
|
||||
apr_off_t readbytes);
|
||||
apr_status_t ap_core_output_filter(ap_filter_t *f, apr_bucket_brigade *b);
|
||||
|
||||
-
|
||||
AP_DECLARE(const char*) ap_get_server_protocol(server_rec* s);
|
||||
AP_DECLARE(void) ap_set_server_protocol(server_rec* s, const char* proto);
|
||||
|
51
apache2-LimitRequestFieldSize-limits-headers.patch
Normal file
51
apache2-LimitRequestFieldSize-limits-headers.patch
Normal file
@ -0,0 +1,51 @@
|
||||
Index: httpd-2.4.46/server/util_script.c
|
||||
===================================================================
|
||||
--- httpd-2.4.46.orig/server/util_script.c 2020-07-20 07:58:49.000000000 +0200
|
||||
+++ httpd-2.4.46/server/util_script.c 2020-11-10 16:10:54.525476516 +0100
|
||||
@@ -468,11 +468,20 @@ AP_DECLARE(int) ap_scan_script_header_er
|
||||
apr_table_t *cookie_table;
|
||||
int trace_log = APLOG_R_MODULE_IS_LEVEL(r, module_index, APLOG_TRACE1);
|
||||
int first_header = 1;
|
||||
+ int wlen;
|
||||
|
||||
if (buffer) {
|
||||
*buffer = '\0';
|
||||
}
|
||||
- w = buffer ? buffer : x;
|
||||
+
|
||||
+ if (r->server->limit_req_fieldsize + 2 > MAX_STRING_LEN) {
|
||||
+ w = apr_palloc(r->pool, r->server->limit_req_fieldsize + 2);
|
||||
+ wlen = r->server->limit_req_fieldsize + 2;
|
||||
+ } else {
|
||||
+ w = buffer ? buffer : x;
|
||||
+ wlen = MAX_STRING_LEN;
|
||||
+ }
|
||||
+
|
||||
|
||||
/* temporary place to hold headers to merge in later */
|
||||
merge = apr_table_make(r->pool, 10);
|
||||
@@ -488,7 +497,7 @@ AP_DECLARE(int) ap_scan_script_header_er
|
||||
|
||||
while (1) {
|
||||
|
||||
- int rv = (*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data);
|
||||
+ int rv = (*getsfunc) (w, wlen - 1, getsfunc_data);
|
||||
if (rv == 0) {
|
||||
const char *msg = "Premature end of script headers";
|
||||
if (first_header)
|
||||
@@ -603,10 +612,13 @@ AP_DECLARE(int) ap_scan_script_header_er
|
||||
if (!(l = strchr(w, ':'))) {
|
||||
if (!buffer) {
|
||||
/* Soak up all the script output - may save an outright kill */
|
||||
- while ((*getsfunc)(w, MAX_STRING_LEN - 1, getsfunc_data) > 0) {
|
||||
+ while ((*getsfunc) (w, wlen - 1, getsfunc_data)) {
|
||||
continue;
|
||||
}
|
||||
- }
|
||||
+ } else if (w != buffer) {
|
||||
+ strncpy(buffer, w, MAX_STRING_LEN - 1);
|
||||
+ buffer[MAX_STRING_LEN - 1] = 0;
|
||||
+ }
|
||||
|
||||
/* Intentional no APLOGNO */
|
||||
ap_log_rerror(SCRIPT_LOG_MARK, APLOG_ERR|APLOG_TOCLIENT, 0, r,
|
66
apache2-README-access_compat.txt
Normal file
66
apache2-README-access_compat.txt
Normal file
@ -0,0 +1,66 @@
|
||||
Dear System Administrator,
|
||||
|
||||
with apache 2.4, some changes have been introduced that affect apache's
|
||||
access control scheme.
|
||||
|
||||
Previously, the directives "Allow", "Deny" and "Order" have determined
|
||||
if access to a resource has been granted with apache 2.2.
|
||||
Example (from /etc/apache2/httpd.conf, the main apache configuration file):
|
||||
<Directory />
|
||||
Options None
|
||||
AllowOverride None
|
||||
Order deny,allow
|
||||
Deny from all
|
||||
</Directory>
|
||||
|
||||
With 2.4, these directives have been replaced by the "Require" directive,
|
||||
which is contained in the mod_authz_core module, and enhanced by the
|
||||
mod_authz_host module.
|
||||
"Require" understands several regulative groups, such as
|
||||
env access granted if an apache environment variable is set
|
||||
method access granted only for given HTTP methods (GET, POST, ...)
|
||||
expr access granted if the expression following expr evaluates to true
|
||||
user access granted if the named users can access the resource
|
||||
group analogous to user for groups
|
||||
valid-user access granted if a valid user requests it
|
||||
ip access granted if the client's IP address matches
|
||||
all granted unconditionally accepted/granted
|
||||
all denied unconditionally denied access
|
||||
|
||||
By consequence, the set of 2.2 directives
|
||||
Order deny,allow
|
||||
Deny from all
|
||||
can be translated to the apache 2.4 Require directive
|
||||
Require all denied
|
||||
|
||||
|
||||
The SUSE Linux Enterprise 12 package set for apache comes with a compatibility
|
||||
module called mod_access_compat, which, if loaded, causes apache to understand
|
||||
the 2.2 "Allow/Deny" directives. Unfortunately, the mixed usage of the
|
||||
2.2 "Allow/Deny" and the 2.4 "Require" directive will lead to either unexpected
|
||||
or inconclusive results. By consequence, one should decide if the 2.2 or the
|
||||
2.4 access control mimics shall be used.
|
||||
|
||||
Fortunately, it is easy to switch from the new back to the old scheme:
|
||||
|
||||
a2enmod access_compat
|
||||
|
||||
will enable the 2.2 scheme,
|
||||
|
||||
a2enmod -d access_compat
|
||||
|
||||
will disable the old scheme again, thereby enabling the new scheme.
|
||||
Of course, an apache restart is needed:
|
||||
|
||||
systemctl restart apache2
|
||||
|
||||
The SUSE apache configuration framework can work with both the new and the
|
||||
old scheme, conditional if the access_compat apache module is loaded.
|
||||
|
||||
Additional pointers about the access controls new in apache 2.4 and about
|
||||
the access_compat module can be found here:
|
||||
|
||||
http://httpd.apache.org/docs/current/mod/mod_authz_core.html
|
||||
http://httpd.apache.org/docs/current/mod/mod_authz_host.html
|
||||
http://httpd.apache.org/docs/current/mod/mod_access_compat.html
|
||||
|
27
apache2-README-configuration.txt
Normal file
27
apache2-README-configuration.txt
Normal file
@ -0,0 +1,27 @@
|
||||
httpd configuration @ SUSE
|
||||
==========================
|
||||
|
||||
`httpd` command can stand for `httpd-prefork`, `httpd-worker`
|
||||
and `httpd-event`, depending on which httpd mpm rpm package is
|
||||
installed. In case more such mpm packages are installed, `httpd`
|
||||
points to one with higher priority defined in update alternatives.
|
||||
|
||||
There are several levels of configuration possible:
|
||||
|
||||
1. systemctl start apache2
|
||||
When httpd is run trough systemctl service, /etc/apache2/httpd.conf
|
||||
is used as a base and sysconfig varibables translated into
|
||||
/etc/apache2/sysconfig.d/ used.
|
||||
|
||||
2. httpd -f /etc/apache2/httpd.conf
|
||||
/etc/apache2/httpd.conf can be used directly, without systemd
|
||||
assistance. /etc/apache2/sysconfig.d is not included in that
|
||||
case.
|
||||
|
||||
3. httpd -f /usr/share/doc/package/apache2/conf/httpd.conf
|
||||
It is possible to experiment with upstream example
|
||||
configuration. Do not forgot
|
||||
|
||||
For more configuration tips, install documentation package
|
||||
apache-rex.
|
||||
|
42
apache2-README-instances.txt
Normal file
42
apache2-README-instances.txt
Normal file
@ -0,0 +1,42 @@
|
||||
Dear System Administrator,
|
||||
|
||||
SUSE Apache package comes with the possibility to run more instances
|
||||
of Apache process on one system.
|
||||
|
||||
As always,
|
||||
|
||||
sytemctl start apache2
|
||||
|
||||
activates default instance of the server, which expects sysconfig setting
|
||||
in /etc/sysconfig/apache2. If this file is not present, or APACHE_HTTPD_CONF
|
||||
in there is not set, then it requires /etc/apache2/httpd.conf.
|
||||
|
||||
Any other instance can be activated via
|
||||
|
||||
systemctl start apache2@<instancename>
|
||||
|
||||
where <instancename> is ASCII identifier of the instance. For example
|
||||
|
||||
systemctl start apache2@myweb.org
|
||||
|
||||
This call tries to read /etc/sysconfig/apache2@<instancename> and if this
|
||||
file is not present or APACHE_HTTPD_CONF is not set there, it requires
|
||||
/etc/apache2@<instancename>/httpd.conf.
|
||||
|
||||
NOTES:
|
||||
* /etc/sysconfig/apache2@<instancename> can hold any sysconfig variable
|
||||
/etc/sysconfig/apache2 can, including module loading and MPM setting,
|
||||
* default instance does not have to run when running other instances
|
||||
* a2enmod, a2dismod and apachectl operates over default instance if
|
||||
not specified otherwise via HTTPD_INSTANCE. For example,
|
||||
|
||||
export HTTPD_INSTANCE=myweb.org
|
||||
a2enmod access_compat
|
||||
a2enmod status
|
||||
apachectl start
|
||||
|
||||
will add access_compat and status modules to APACHE_MODULES
|
||||
variable of /etc/sysconfig/apache2@myweb.org and then starts
|
||||
myweb.org instance.
|
||||
* /usr/sbin/httpd link is created according to setup of default
|
||||
instance (/etc/sysconfig/apache2:APACHE_MPM)
|
55
apache2-a2enflag
Normal file
55
apache2-a2enflag
Normal file
@ -0,0 +1,55 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2005 Peter Poeml <apache@suse.de>. All Rights Reserved.
|
||||
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
|
||||
|
||||
function usage() {
|
||||
echo "$(basename $0): enable/disable a flag in $var in $sysconf"
|
||||
echo
|
||||
echo "usage: $(basename $0) [-d] flag"
|
||||
echo
|
||||
echo "HTTPD_INSTANCE=<instance_name> environment variable can be used to specify"
|
||||
echo "apache instance (see README-instances.txt); sysconfig file is expected"
|
||||
echo "at /etc/sysconfig/apache2@<instance_name> ."
|
||||
exit 1
|
||||
}
|
||||
|
||||
unset instance_suffix
|
||||
if [ -n "$HTTPD_INSTANCE" ]; then
|
||||
instance_suffix="@$HTTPD_INSTANCE"
|
||||
fi
|
||||
|
||||
sysconf=/etc/sysconfig/apache2$instance_suffix
|
||||
var=APACHE_SERVER_FLAGS
|
||||
PATH="$PATH:/usr/bin:/usr/sbin:/usr/share/apache2"
|
||||
|
||||
if [ $# -lt 1 ]; then
|
||||
usage
|
||||
fi
|
||||
|
||||
action=enable
|
||||
case "$1" in
|
||||
-d) action=disable; shift;;
|
||||
-*) usage;;
|
||||
esac
|
||||
|
||||
case $(basename $0) in
|
||||
a2disflag) action=disable;;
|
||||
esac
|
||||
|
||||
flag=$1
|
||||
|
||||
|
||||
if [ $action = enable ]; then
|
||||
sysconf_addword $sysconf $var $flag
|
||||
exit $?
|
||||
else
|
||||
sysconf_addword -r $sysconf $var $flag
|
||||
exit $?
|
||||
fi
|
||||
|
68
apache2-a2enmod
Normal file
68
apache2-a2enmod
Normal file
@ -0,0 +1,68 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright 2005 Peter Poeml <apache@suse.de>. All Rights Reserved.
|
||||
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of the GNU General Public License as published by
|
||||
# the Free Software Foundation; either version 2 of the License, or
|
||||
# (at your option) any later version.
|
||||
|
||||
|
||||
function usage() {
|
||||
echo "$(basename $0): enable/disable an apache module in $var in $sysconf"
|
||||
echo
|
||||
echo "usage: $(basename $0) [-d] module"
|
||||
echo " $(basename $0) -l list modules"
|
||||
echo " $(basename $0) -q module query if module is installed"
|
||||
echo
|
||||
echo "HTTPD_INSTANCE=<instance_name> environment variable can be used to specify"
|
||||
echo "apache instance (see README-instances.txt); sysconfig file is expected"
|
||||
echo "at /etc/sysconfig/apache2@<instance_name> ."
|
||||
exit 1
|
||||
}
|
||||
|
||||
unset instance_suffix
|
||||
if [ -n "$HTTPD_INSTANCE" ]; then
|
||||
instance_suffix="@$HTTPD_INSTANCE"
|
||||
fi
|
||||
|
||||
sysconf=/etc/sysconfig/apache2$instance_suffix
|
||||
var=APACHE_MODULES
|
||||
PATH="$PATH:/usr/bin:/usr/sbin:/usr/share/apache2"
|
||||
|
||||
if [ $# -lt 1 ]; then
|
||||
usage
|
||||
fi
|
||||
|
||||
action=enable
|
||||
case "$1" in
|
||||
-d) action=disable; shift;;
|
||||
-l) action=list; shift;;
|
||||
-q) action=query; shift;;
|
||||
-*) usage;;
|
||||
esac
|
||||
|
||||
case $(basename $0) in
|
||||
a2dismod) action=disable;;
|
||||
esac
|
||||
|
||||
mod=$1
|
||||
|
||||
|
||||
if [ $action = enable ]; then
|
||||
sysconf_addword $sysconf $var $mod
|
||||
exit $?
|
||||
elif [ $action = disable ]; then
|
||||
sysconf_addword -r $sysconf $var $mod
|
||||
exit $?
|
||||
elif [ $action = query ]; then
|
||||
if a2enmod -l | grep -q "\<$mod\>"; then
|
||||
exit 0
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
source $sysconf
|
||||
eval echo \$$var
|
||||
fi
|
||||
|
27
apache2-apachectl.patch
Normal file
27
apache2-apachectl.patch
Normal file
@ -0,0 +1,27 @@
|
||||
|
||||
Index: httpd-2.4.46/support/apachectl.in
|
||||
===================================================================
|
||||
--- httpd-2.4.46.orig/support/apachectl.in 2012-02-01 04:47:28.000000000 +0100
|
||||
+++ httpd-2.4.46/support/apachectl.in 2020-11-09 15:29:52.479823800 +0100
|
||||
@@ -42,7 +42,7 @@ ARGV="$@"
|
||||
# -------------------- --------------------
|
||||
#
|
||||
# the path to your httpd binary, including options if necessary
|
||||
-HTTPD='@exp_sbindir@/@progname@'
|
||||
+HTTPD='@exp_sbindir@/start_apache2'
|
||||
#
|
||||
# pick up any necessary environment variables
|
||||
if test -f @exp_sbindir@/envvars; then
|
||||
@@ -52,7 +52,11 @@ fi
|
||||
# a command that outputs a formatted text version of the HTML at the
|
||||
# url given on the command line. Designed for lynx, however other
|
||||
# programs may work.
|
||||
-LYNX="@LYNX_PATH@ -dump"
|
||||
+if [ -x "`which w3m`" ]; then
|
||||
+ LYNX="w3m -dump -cols ${COLUMNS:-80}"
|
||||
+elif [ -x "`which lynx`" ]; then
|
||||
+ LYNX="lynx -dump -width=${COLUMNS:-80}"
|
||||
+fi
|
||||
#
|
||||
# the URL to your server's mod_status status page. If you do not
|
||||
# have one, then status and fullstatus will not work.
|
23
apache2-check_forensic
Normal file
23
apache2-check_forensic
Normal file
@ -0,0 +1,23 @@
|
||||
#!/bin/sh
|
||||
|
||||
# check_forensic <forensic log file>
|
||||
# Author: Peter Poeml <apache@suse.de>
|
||||
|
||||
# check the forensic log for requests that did not complete
|
||||
# output the request log for each one
|
||||
|
||||
# This script is based on Ben Laurie's check_forensic, but is adjusted for GNU
|
||||
# tools (as used on Linux) and it works in a safe tmpdir directory.
|
||||
# todo: rewrite in a form that allows running on more operating systems.
|
||||
|
||||
F=${1:?give filename as argument. cannot read from stdin.}
|
||||
|
||||
tmpprefix=${TMPDIR:-/tmp}/check_forensic.XXXXXX
|
||||
tdir=$(mktemp -d $tmpprefix); test $? = 0 || { echo >&2 Could not create tmpdir. Exiting; exit 1; }
|
||||
|
||||
cut -f 1 -d '|' $F > $tdir/fc-all.$$
|
||||
grep ^+ < $tdir/fc-all.$$ | cut -c2- | sort > $tdir/fc-in.$$
|
||||
grep -- ^- < $tdir/fc-all.$$ | cut -c2- | sort > $tdir/fc-out.$$
|
||||
join -v 1 $tdir/fc-in.$$ $tdir/fc-out.$$ | xargs -ixx egrep "^\\+xx" $F
|
||||
rm $tdir/fc-all.$$ $tdir/fc-in.$$ $tdir/fc-out.$$
|
||||
rmdir $tdir
|
123
apache2-default-server.conf
Normal file
123
apache2-default-server.conf
Normal file
@ -0,0 +1,123 @@
|
||||
#
|
||||
# Global configuration that will be applicable for all virtual hosts, unless
|
||||
# deleted here, or overriden elswhere.
|
||||
#
|
||||
|
||||
DocumentRoot "/srv/www/htdocs"
|
||||
|
||||
#
|
||||
# Configure the DocumentRoot
|
||||
#
|
||||
<Directory "/srv/www/htdocs">
|
||||
# Possible values for the Options directive are "None", "All",
|
||||
# or any combination of:
|
||||
# Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
|
||||
#
|
||||
# Note that "MultiViews" must be named *explicitly* --- "Options All"
|
||||
# doesn't give it to you.
|
||||
#
|
||||
# The Options directive is both complicated and important. Please see
|
||||
# https://httpd.apache.org/docs/2.4/mod/core.html#options
|
||||
# for more information.
|
||||
# NOTE: For directories where RewriteRule is used, FollowSymLinks
|
||||
# or SymLinksIfOwnerMatch needs to be set in Options directive.
|
||||
Options None
|
||||
# AllowOverride controls what directives may be placed in .htaccess files.
|
||||
# It can be "All", "None", or any combination of the keywords:
|
||||
# Options FileInfo AuthConfig Limit
|
||||
AllowOverride None
|
||||
# Controls who can get stuff from this server.
|
||||
<IfModule !mod_access_compat.c>
|
||||
Require all granted
|
||||
</IfModule>
|
||||
<IfModule mod_access_compat.c>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</IfModule>
|
||||
</Directory>
|
||||
|
||||
# Aliases: aliases can be added as needed (with no limit). The format is
|
||||
# Alias fakename realname
|
||||
#
|
||||
# Note that if you include a trailing / on fakename then the server will
|
||||
# require it to be present in the URL. So "/icons" isn't aliased in this
|
||||
# example, only "/icons/". If the fakename is slash-terminated, then the
|
||||
# realname must also be slash terminated, and if the fakename omits the
|
||||
# trailing slash, the realname must also omit it.
|
||||
#
|
||||
# We include the /icons/ alias for FancyIndexed directory listings. If you
|
||||
# do not use FancyIndexing, you may comment this out.
|
||||
#
|
||||
Alias /icons/ "/usr/share/apache2/icons/"
|
||||
|
||||
<Directory "/usr/share/apache2/icons">
|
||||
Options Indexes MultiViews
|
||||
AllowOverride None
|
||||
<IfModule !mod_access_compat.c>
|
||||
Require all granted
|
||||
</IfModule>
|
||||
<IfModule mod_access_compat.c>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</IfModule>
|
||||
</Directory>
|
||||
|
||||
# ScriptAlias: This controls which directories contain server scripts.
|
||||
# ScriptAliases are essentially the same as Aliases, except that
|
||||
# documents in the realname directory are treated as applications and
|
||||
# run by the server when requested rather than as documents sent to the client.
|
||||
# The same rules about trailing "/" apply to ScriptAlias directives as to
|
||||
# Alias.
|
||||
#
|
||||
ScriptAlias /cgi-bin/ "/srv/www/cgi-bin/"
|
||||
|
||||
# "/srv/www/cgi-bin" should be changed to whatever your ScriptAliased
|
||||
# CGI directory exists, if you have that configured.
|
||||
#
|
||||
<Directory "/srv/www/cgi-bin">
|
||||
AllowOverride None
|
||||
Options +ExecCGI -Includes
|
||||
<IfModule !mod_access_compat.c>
|
||||
Require all granted
|
||||
</IfModule>
|
||||
<IfModule mod_access_compat.c>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</IfModule>
|
||||
</Directory>
|
||||
|
||||
# UserDir: The name of the directory that is appended onto a user's home
|
||||
# directory if a ~user request is received.
|
||||
#
|
||||
# To disable it, simply remove userdir from the list of modules in APACHE_MODULES
|
||||
# in /etc/sysconfig/apache2.
|
||||
#
|
||||
<IfModule mod_userdir.c>
|
||||
# Note that the name of the user directory ("public_html") cannot simply be
|
||||
# changed here, since it is a compile time setting. The apache package
|
||||
# would have to be rebuilt. You could work around by deleting
|
||||
# /usr/sbin/suexec, but then all scripts from the directories would be
|
||||
# executed with the UID of the webserver.
|
||||
UserDir public_html
|
||||
# The actual configuration of the directory is in
|
||||
# /etc/apache2/mod_userdir.conf.
|
||||
Include /etc/apache2/mod_userdir.conf
|
||||
# You can, however, change the ~ if you find it awkward, by mapping e.g.
|
||||
# http://www.example.com/users/karl-heinz/ --> /home/karl-heinz/public_html/
|
||||
#AliasMatch ^/users/([a-zA-Z0-9-_.]*)/?(.*) /home/$1/public_html/$2
|
||||
</IfModule>
|
||||
|
||||
|
||||
# Include all *.conf files from /etc/apache2/conf.d/.
|
||||
#
|
||||
# This is mostly meant as a place for other RPM packages to drop in their
|
||||
# configuration snippet.
|
||||
#
|
||||
# You can comment this out here if you want those bits include only in a
|
||||
# certain virtual host, but not here.
|
||||
#
|
||||
IncludeOptional /etc/apache2/conf.d/*.conf
|
||||
|
||||
# The manual... if it is installed ('?' means it won't complain)
|
||||
IncludeOptional /etc/apache2/conf.d/apache2-manual?conf
|
||||
|
73
apache2-errors.conf
Normal file
73
apache2-errors.conf
Normal file
@ -0,0 +1,73 @@
|
||||
|
||||
#
|
||||
# Customizable error responses come in three flavors:
|
||||
# 1) plain text 2) local redirects 3) external redirects
|
||||
#
|
||||
# Some examples:
|
||||
#ErrorDocument 500 "The server made a boo boo."
|
||||
#ErrorDocument 404 /missing.html
|
||||
#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
|
||||
#ErrorDocument 402 http://www.example.com/subscription_info.html
|
||||
#
|
||||
|
||||
#
|
||||
# Putting this all together, we can internationalize error responses.
|
||||
#
|
||||
# We use Alias to redirect any /error/HTTP_<error>.html.var response to
|
||||
# our collection of by-error message multi-language collections. We use
|
||||
# includes to substitute the appropriate text.
|
||||
#
|
||||
# You can modify the messages' appearance without changing any of the
|
||||
# default HTTP_<error>.html.var files by adding the line:
|
||||
#
|
||||
# Alias /error/include/ "/your/include/path/"
|
||||
#
|
||||
# which allows you to create your own set of files by starting with the
|
||||
# /usr/share/apache2/error/include/ files and copying them to /your/include/path/,
|
||||
# even on a per-VirtualHost basis. The default include files will display
|
||||
# your Apache version number and your ServerAdmin email address regardless
|
||||
# of the setting of ServerSignature.
|
||||
#
|
||||
# The internationalized error documents require mod_alias, mod_include
|
||||
# and mod_negotiation. To activate them, uncomment the following 30 lines.
|
||||
|
||||
Alias /error/ "/usr/share/apache2/error/"
|
||||
|
||||
<IfModule mod_negotiation.c>
|
||||
<IfModule mod_include.c>
|
||||
<Directory "/usr/share/apache2/error">
|
||||
AllowOverride None
|
||||
Options IncludesNoExec
|
||||
AddOutputFilter Includes html
|
||||
AddHandler type-map var
|
||||
<IfModule !mod_access_compat.c>
|
||||
Require all granted
|
||||
</IfModule>
|
||||
<IfModule mod_access_compat.c>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</IfModule>
|
||||
LanguagePriority en cs de es fr it ja ko nl pl pt-br ro sv tr
|
||||
ForceLanguagePriority Prefer Fallback
|
||||
</Directory>
|
||||
|
||||
ErrorDocument 400 /error/HTTP_BAD_REQUEST.html.var
|
||||
ErrorDocument 401 /error/HTTP_UNAUTHORIZED.html.var
|
||||
ErrorDocument 403 /error/HTTP_FORBIDDEN.html.var
|
||||
ErrorDocument 404 /error/HTTP_NOT_FOUND.html.var
|
||||
ErrorDocument 405 /error/HTTP_METHOD_NOT_ALLOWED.html.var
|
||||
ErrorDocument 408 /error/HTTP_REQUEST_TIME_OUT.html.var
|
||||
ErrorDocument 410 /error/HTTP_GONE.html.var
|
||||
ErrorDocument 411 /error/HTTP_LENGTH_REQUIRED.html.var
|
||||
ErrorDocument 412 /error/HTTP_PRECONDITION_FAILED.html.var
|
||||
ErrorDocument 413 /error/HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
|
||||
ErrorDocument 414 /error/HTTP_REQUEST_URI_TOO_LARGE.html.var
|
||||
ErrorDocument 415 /error/HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
|
||||
ErrorDocument 500 /error/HTTP_INTERNAL_SERVER_ERROR.html.var
|
||||
ErrorDocument 501 /error/HTTP_NOT_IMPLEMENTED.html.var
|
||||
ErrorDocument 502 /error/HTTP_BAD_GATEWAY.html.var
|
||||
ErrorDocument 503 /error/HTTP_SERVICE_UNAVAILABLE.html.var
|
||||
ErrorDocument 506 /error/HTTP_VARIANT_ALSO_VARIES.html.var
|
||||
</IfModule>
|
||||
</IfModule>
|
||||
|
151
apache2-find_directives
Normal file
151
apache2-find_directives
Normal file
@ -0,0 +1,151 @@
|
||||
#!/bin/bash
|
||||
|
||||
exit_code=1
|
||||
|
||||
function usage
|
||||
{
|
||||
echo "Check for directives in apache configuration (including"
|
||||
echo "potentially reachable .htaccess files)"
|
||||
echo ""
|
||||
echo "Usage: $0 [options]"
|
||||
echo ""
|
||||
echo " options: "
|
||||
echo " -s string system configuration root"
|
||||
echo " [default: $system_conf_root]"
|
||||
echo " -d string directives to search"
|
||||
echo " [default: $check_directives]"
|
||||
echo " -n string htaccess file name(s)"
|
||||
echo " [default: $htaccess_names]"
|
||||
echo " -q do not print where directive(s) was found"
|
||||
echo " -v as -v plus trace and matched lines"
|
||||
echo " -h this help"
|
||||
echo ""
|
||||
echo "Return Value: 0 at least one occurence found in apache config"
|
||||
echo " 1 no occurence found"
|
||||
echo " 2 wrong arguments"
|
||||
echo ""
|
||||
echo "Example: "
|
||||
echo " $ $0 -s '/etc/apache2/default-server.conf' -n '.htaccess .htconfig' -d 'Require' -v"
|
||||
echo " Checking /etc/apache2/default-server.conf .. FOUND"
|
||||
echo " Checking /srv/www/htdocs/foo/.htaccess .. FOUND"
|
||||
echo " Checking /etc/apache2/conf.d/gitweb.conf .. FOUND"
|
||||
echo " $"
|
||||
}
|
||||
|
||||
|
||||
function find_directives_in_file
|
||||
{
|
||||
file=$1
|
||||
|
||||
pattern=$(echo $check_directives |
|
||||
sed 's:\([^ \t]\+\):\\b\1\\b:g' |
|
||||
sed 's:\s\+:\\|:g')
|
||||
|
||||
output=$(cat $file | sed 's:#.*::' | grep -i "$pattern")
|
||||
if [ $? -eq 0 ]; then
|
||||
[ $verbosity -ge 1 ] && echo " Checking $file .. FOUND"
|
||||
[ $verbosity -ge 2 ] && echo " Output: [$output]"
|
||||
exit_code=0
|
||||
else
|
||||
[ $verbosity -ge 2 ] && echo " Checking $file .. NOT FOUND"
|
||||
fi
|
||||
}
|
||||
|
||||
function check_conf_file
|
||||
{
|
||||
conf_file=$1
|
||||
|
||||
[ $verbosity -ge 2 ] && echo "CONFIG FILE: $conf_file"
|
||||
|
||||
find_directives_in_file $conf_file
|
||||
|
||||
# check all directories with AllowOverride not None
|
||||
# for .htaccess files
|
||||
directories=$(grep -i '<directory' $conf_file |
|
||||
sed 's:#.*::' |
|
||||
sed 's:.*<directory\s*\([^ \t]*\)\s*>:\1:I' |
|
||||
tr -d '"')
|
||||
|
||||
find_names=$(echo $htaccess_names |
|
||||
sed 's:^\s\+::' |
|
||||
sed 's:\s\+$::' |
|
||||
sed 's:\s\+: -o -name :g' |
|
||||
sed 's:^:-name :')
|
||||
|
||||
for dir in $directories; do
|
||||
[ $verbosity -ge 2 ] && echo " Directory: $dir"
|
||||
|
||||
allow_override=$(grep -i -Pzo "(?s)<directory[\s\"]*$dir.*?</directory>" $conf_file |
|
||||
sed 's:#.*::'|
|
||||
grep AllowOverride)
|
||||
|
||||
[ $verbosity -ge 2 ] && echo " override: $allow_override"
|
||||
|
||||
shopt -s nocasematch
|
||||
if [[ ! $allow_override =~ allowoverride.*none ]]; then
|
||||
for htfile in $(find $dir $find_names); do
|
||||
find_directives_in_file $htfile
|
||||
done
|
||||
fi
|
||||
shopt -u nocasematch
|
||||
done
|
||||
|
||||
# check all Include or IncludeOptional files recursively
|
||||
include_files=$(grep '^\s*Include' $conf_file |
|
||||
sed 's:#.*::' |
|
||||
sed 's:Include[^ ]*\s\+::' |
|
||||
tr '\n' ' ')
|
||||
[ $verbosity -ge 2 ] && echo " Include Files: [$include_files]"
|
||||
|
||||
for ifile in $include_files; do
|
||||
if [ -f $ifile ]; then
|
||||
check_conf_file $ifile
|
||||
fi
|
||||
done
|
||||
}
|
||||
|
||||
system_conf_root="/etc/apache2/httpd.conf"
|
||||
check_directives="allow deny order satisfy"
|
||||
htaccess_names=".htaccess"
|
||||
verbosity=1
|
||||
|
||||
while getopts ":hs:d:n:vq" opt; do
|
||||
case $opt in
|
||||
s)
|
||||
system_conf_root=$OPTARG
|
||||
;;
|
||||
d)
|
||||
check_directives=$OPTARG
|
||||
;;
|
||||
n)
|
||||
htaccess_names=$OPTARG
|
||||
;;
|
||||
q)
|
||||
verbosity=0
|
||||
;;
|
||||
v)
|
||||
verbosity=2
|
||||
;;
|
||||
h)
|
||||
usage
|
||||
exit 0
|
||||
;;
|
||||
\?)
|
||||
echo "ERROR: Invalid option: -$OPTARG" >&2
|
||||
usage
|
||||
exit 2
|
||||
;;
|
||||
:)
|
||||
echo "ERROR: Option -$OPTARG requires an argument." >&2
|
||||
usage
|
||||
exit 2
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
check_conf_file $system_conf_root
|
||||
|
||||
exit $exit_code
|
||||
|
||||
|
||||
|
225
apache2-gensslcert
Normal file
225
apache2-gensslcert
Normal file
@ -0,0 +1,225 @@
|
||||
#!/bin/bash
|
||||
# Peter Poeml <apache@suse.de>
|
||||
#
|
||||
# Script to generate ssl keys for mod_ssl, without requiring user input
|
||||
# most of it is copied from mkcert.sh of the mod_ssl distribution
|
||||
#
|
||||
# XXX This is just a hack, it won't be able to do anything you want!
|
||||
#
|
||||
|
||||
function usage
|
||||
{
|
||||
cat <<-EOF
|
||||
`basename $0` will generate a test certificate "the quick way", i.e. without interaction.
|
||||
You can change some defaults however.
|
||||
It will overwrite /root/.mkcert.cfg
|
||||
|
||||
These options are recognized: Default:
|
||||
|
||||
-N comment "$comment"
|
||||
-c country (two letters, e.g. DE) $C
|
||||
-s state $ST
|
||||
-l city $L
|
||||
-o organisation "$O"
|
||||
-u organisational unit "$U"
|
||||
-n fully qualified domain name $CN (hostname -f)
|
||||
-e email address of webmaster webmaster@$CN
|
||||
-a subject alternative name $altName
|
||||
-y days server cert is valid for $srvdays
|
||||
-Y days CA cert is valid for $CAdays
|
||||
-d run in debug mode
|
||||
-h show usage
|
||||
EOF
|
||||
}
|
||||
|
||||
|
||||
test -t && { BRIGHT='[01m'; RED='[31m'; NORMAL='[00m'; }
|
||||
function myecho { echo $BRIGHT$@$NORMAL; }
|
||||
function error { echo $RED$@$NORMAL; }
|
||||
function myexit { error something ugly seems to have happened in line $1...; exit $2; }
|
||||
|
||||
hostname=/usr/bin/hostname
|
||||
FQHOSTNAME=""
|
||||
if [ -x $hostname ]; then
|
||||
FQHOSTNAME=`$hostname -f 2>/dev/null`
|
||||
# bsc#1035829
|
||||
fqlength=`echo -n $FQHOSTNAME|wc -c`
|
||||
if [ $fqlength -gt 64 ]; then
|
||||
FQHOSTNAME=`$hostname 2>/dev/null`
|
||||
fi
|
||||
fi
|
||||
# bsc#1057406
|
||||
if [ -z $FQHOSTNAME ]; then
|
||||
FQHOSTNAME='localhost'
|
||||
fi
|
||||
|
||||
# defaults
|
||||
comment="mod_ssl server certificate"
|
||||
C=XY
|
||||
ST=unknown
|
||||
L=unknown
|
||||
U="web server"
|
||||
O="SUSE Linux Web Server"
|
||||
CN=$FQHOSTNAME
|
||||
email=webmaster@$FQHOSTNAME
|
||||
altName=DNS:$CN
|
||||
CAdays=$((365 * 6))
|
||||
srvdays=$((365 * 2))
|
||||
|
||||
while getopts C:N:c:s:l:o:u:n:e:a:y:Y:dh OPT; do
|
||||
case $OPT in
|
||||
N) comment=$OPTARG;;
|
||||
c) C=$OPTARG;;
|
||||
s) ST=$OPTARG;;
|
||||
l) L=$OPTARG;;
|
||||
u) U=$OPTARG;;
|
||||
o) O=$OPTARG;;
|
||||
n) CN=$OPTARG;;
|
||||
e) email=$OPTARG;;
|
||||
a) altName=$OPTARG;;
|
||||
y) srvdays=$OPTARG;;
|
||||
Y) CAdays=$OPTARG;;
|
||||
d) set -x;;
|
||||
h) usage; exit 2;;
|
||||
*) echo unrecognized option: $OPT; usage; exit 2;;
|
||||
esac
|
||||
done
|
||||
|
||||
GO_LEFT="\033[80D"
|
||||
GO_MIDDLE="$GO_LEFT\033[15C"
|
||||
for i in comment C ST L U O CN email altName srvdays CAdays; do
|
||||
eval "echo -e $i\"$GO_MIDDLE\" \$$i;"
|
||||
done
|
||||
|
||||
|
||||
openssl=/usr/bin/openssl
|
||||
sslcrtdir=/etc/apache2/ssl.crt
|
||||
sslcsrdir=/etc/apache2/ssl.csr
|
||||
sslkeydir=/etc/apache2/ssl.key
|
||||
sslprmdir=/etc/apache2/ssl.prm
|
||||
|
||||
name="$CN-"
|
||||
|
||||
#
|
||||
# CA
|
||||
#
|
||||
echo;myecho creating CA key ...
|
||||
(umask 0377 ; $openssl genrsa -rand /dev/urandom -out $sslkeydir/${name}ca.key 2048 || myexit $LINENO $?)
|
||||
|
||||
cat >/root/.mkcert.cfg <<EOT
|
||||
[ req ]
|
||||
default_bits = 2048
|
||||
default_keyfile = keyfile.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
prompt = no
|
||||
output_password = mypass
|
||||
x509_extensions = req_v3_ca
|
||||
|
||||
[ req_distinguished_name ]
|
||||
C = $C
|
||||
ST = $ST
|
||||
L = $L
|
||||
O = $O
|
||||
OU = CA
|
||||
CN = $CN
|
||||
emailAddress = $email
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = $RANDOM$RANDOMA challenge password
|
||||
|
||||
[req_v3_ca]
|
||||
# bsc#1180530
|
||||
basicConstraints = critical,CA:true
|
||||
EOT
|
||||
|
||||
echo;myecho creating CA request/certificate ...
|
||||
(umask 0377 ; $openssl req -config /root/.mkcert.cfg -new -x509 -days $CAdays -key $sslkeydir/${name}ca.key -out $sslcrtdir/${name}ca.crt || myexit $LINENO $?)
|
||||
|
||||
cp -pv $sslcrtdir/${name}ca.crt /srv/www/htdocs/$(echo $name | tr 'a-z' 'A-Z')CA.crt
|
||||
|
||||
#
|
||||
# Server CERT
|
||||
#
|
||||
echo;myecho creating server key ...
|
||||
(umask 0377 ; $openssl genrsa -rand /dev/urandom -out $sslkeydir/${name}server.key 2048 || myexit $LINENO $?)
|
||||
|
||||
cat >/root/.mkcert.cfg <<EOT
|
||||
[ req ]
|
||||
default_bits = 2048
|
||||
default_keyfile = keyfile.pem
|
||||
distinguished_name = req_distinguished_name
|
||||
attributes = req_attributes
|
||||
prompt = no
|
||||
output_password = mypass
|
||||
req_extensions = x509v3
|
||||
|
||||
[ req_distinguished_name ]
|
||||
C = $C
|
||||
ST = $ST
|
||||
L = $L
|
||||
O = $O
|
||||
OU = $U
|
||||
CN = $CN
|
||||
emailAddress = $email
|
||||
|
||||
[ x509v3 ]
|
||||
subjectAltName = $altName
|
||||
nsComment = $comment
|
||||
nsCertType = server
|
||||
|
||||
[ req_attributes ]
|
||||
challengePassword = $RANDOM$RANDOMA challenge password
|
||||
EOT
|
||||
|
||||
echo;myecho creating server request ...
|
||||
(umask 0377 ; $openssl req -config /root/.mkcert.cfg -new -key $sslkeydir/${name}server.key -out $sslcsrdir/${name}server.csr || myexit $LINENO $?)
|
||||
|
||||
|
||||
cat >/root/.mkcert.cfg <<EOT
|
||||
extensions = x509v3
|
||||
[ x509v3 ]
|
||||
subjectAltName = $altName
|
||||
nsComment = $comment
|
||||
nsCertType = server
|
||||
EOT
|
||||
|
||||
|
||||
test -f /root/.mkcert.serial || echo 01 >/root/.mkcert.serial
|
||||
myecho "creating server certificate ..."
|
||||
(umask 0377 ; $openssl x509 \
|
||||
-extfile /root/.mkcert.cfg \
|
||||
-days $srvdays \
|
||||
-CAserial /root/.mkcert.serial \
|
||||
-CA $sslcrtdir/${name}ca.crt \
|
||||
-CAkey $sslkeydir/${name}ca.key \
|
||||
-in $sslcsrdir/${name}server.csr -req \
|
||||
-out $sslcrtdir/${name}server.crt || myexit $LINENO $?)
|
||||
|
||||
rm -f /root/.mkcert.cfg
|
||||
|
||||
|
||||
|
||||
|
||||
echo;myecho "Verify: matching certificate & key modulus"
|
||||
modcrt=`$openssl x509 -noout -modulus -in $sslcrtdir/${name}server.crt | sed -e 's;.*Modulus=;;' || myexit $LINENO $?`
|
||||
modkey=`$openssl rsa -noout -modulus -in $sslkeydir/${name}server.key | sed -e 's;.*Modulus=;;' || myexit $LINENO $?`
|
||||
|
||||
if [ ".$modcrt" != ".$modkey" ]; then
|
||||
error "gensslcert:Error: Failed to verify modulus on resulting X.509 certificate" 1>&2
|
||||
myexit $LINENO $?
|
||||
fi
|
||||
|
||||
echo;myecho Verify: matching certificate signature
|
||||
$openssl verify -CAfile $sslcrtdir/${name}ca.crt $sslcrtdir/${name}server.crt || myexit $LINENO $?
|
||||
if [ $? -ne 0 ]; then
|
||||
error "gensslcert:Error: Failed to verify signature on resulting X.509 certificate" 1>&2
|
||||
myexit $LINENO $?
|
||||
fi
|
||||
|
||||
echo;myecho generating dhparams and appending it to the server certificate file...
|
||||
openssl dhparam 2048 >> $sslcrtdir/${name}server.crt
|
||||
|
||||
|
||||
exit 0
|
||||
|
7
apache2-global.conf
Normal file
7
apache2-global.conf
Normal file
@ -0,0 +1,7 @@
|
||||
ServerSignature off
|
||||
UseCanonicalName off
|
||||
ServerTokens ProductOnly
|
||||
TraceEnable off
|
||||
LogLevel warn
|
||||
CustomLog /var/log/apache2/access_log combined
|
||||
|
234
apache2-httpd.conf
Normal file
234
apache2-httpd.conf
Normal file
@ -0,0 +1,234 @@
|
||||
#
|
||||
# /etc/apache2/httpd.conf
|
||||
#
|
||||
# This is the main Apache server configuration file. It contains the
|
||||
# configuration directives that give the server its instructions.
|
||||
# See <URL:https://httpd.apache.org/docs/2.4/> for detailed information about
|
||||
# the directives.
|
||||
|
||||
# Based upon the default apache configuration file that ships with apache,
|
||||
# which is based upon the NCSA server configuration files originally by Rob
|
||||
# McCool. This file was knocked together by Peter Poeml <poeml+apache@suse.de>.
|
||||
|
||||
# If possible, avoid changes to this file. It does mainly contain Include
|
||||
# statements and global settings that can/should be overridden in the
|
||||
# configuration of your virtual hosts.
|
||||
|
||||
# Quickstart guide:
|
||||
# https://en.opensuse.org/SDB:Apache_installation
|
||||
|
||||
|
||||
# Overview of include files, chronologically:
|
||||
#
|
||||
# httpd.conf
|
||||
# |
|
||||
# |-- uid.conf . . . . . . . . . . . . . . UserID/GroupID to run under
|
||||
# |-- server-tuning.conf . . . . . . . . . sizing of the server (how many processes to start, ...)
|
||||
# |-- loadmodule.conf . . . . . . . . . . . [*] load these modules
|
||||
# |-- listen.conf . . . . . . . . . . . . . IP adresses / ports to listen on
|
||||
# |-- mod_log_config.conf . . . . . . . . . define logging formats
|
||||
# |-- global.conf . . . . . . . . . . . . . [*] server-wide general settings
|
||||
# |-- mod_status.conf . . . . . . . . . . . restrict access to mod_status (server monitoring)
|
||||
# |-- mod_info.conf . . . . . . . . . . . . restrict access to mod_info
|
||||
# |-- mod_reqtimeout.conf . . . . . . . . . set timeout and minimum data rate for receiving requests
|
||||
# |-- mod_cgid-timeout.conf . . . . . . . . set CGIDScriptTimeout if mod_cgid is loaded/active
|
||||
# |-- mod_usertrack.conf . . . . . . . . . defaults for cookie-based user tracking
|
||||
# |-- mod_autoindex-defaults.conf . . . . . defaults for displaying of server-generated directory listings
|
||||
# |-- mod_mime-defaults.conf . . . . . . . defaults for mod_mime configuration
|
||||
# |-- errors.conf . . . . . . . . . . . . . customize error responses
|
||||
# |-- ssl-global.conf . . . . . . . . . . . SSL conf that applies to default server _and all_ virtual hosts
|
||||
# |-- protocols.conf . . . . . . . . . . . Protocol settings that applies to default server _and all_ virtual hosts
|
||||
# |
|
||||
# |-- default-server.conf . . . . . . . . . set up the default server that replies to non-virtual-host requests
|
||||
# | |--mod_userdir.conf . . . . . . . . enable UserDir (if mod_userdir is loaded)
|
||||
# | `--conf.d/apache2-manual?conf . . . add the docs ('?' = if installed)
|
||||
# |
|
||||
# `-- vhosts.d/ . . . . . . . . . . . . . . for each virtual host, place one file here
|
||||
# `-- *.conf . . . . . . . . . . . . . (*.conf is automatically included)
|
||||
#
|
||||
#
|
||||
# Files marked [*] are NOT read when server is started via systemd service. When server
|
||||
# is started via service, defaults from /etc/sysconfig/apache2 are taken into account.
|
||||
#
|
||||
|
||||
|
||||
|
||||
# Filesystem layout:
|
||||
#
|
||||
# /etc/apache2/
|
||||
# |-- charset.conv . . . . . . . . . . . . for mod_auth_ldap
|
||||
# |-- conf.d/
|
||||
# | |-- apache2-manual.conf . . . . . . . conf that comes with apache2-doc
|
||||
# | |-- mod_php4.conf . . . . . . . . . . (example) conf that comes with apache2-mod_php4
|
||||
# | `-- ... . . . . . . . . . . . . . . . other configuration added by packages
|
||||
# |-- default-server.conf
|
||||
# |-- errors.conf
|
||||
# |-- httpd.conf . . . . . . . . . . . . . top level configuration file
|
||||
# |-- listen.conf
|
||||
# |-- magic
|
||||
# |-- mime.types -> ../mime.types
|
||||
# |-- mod_autoindex-defaults.conf
|
||||
# |-- mod_info.conf
|
||||
# |-- mod_log_config.conf
|
||||
# |-- mod_mime-defaults.conf
|
||||
# |-- mod_perl-startup.pl
|
||||
# |-- mod_status.conf
|
||||
# |-- mod_userdir.conf
|
||||
# |-- mod_usertrack.conf
|
||||
# |-- server-tuning.conf
|
||||
# |-- ssl-global.conf
|
||||
# |-- protocols.conf
|
||||
# |-- ssl.crl/ . . . . . . . . . . . . . . PEM-encoded X.509 Certificate Revocation Lists (CRL)
|
||||
# |-- ssl.crt/ . . . . . . . . . . . . . . PEM-encoded X.509 Certificates
|
||||
# |-- ssl.csr/ . . . . . . . . . . . . . . PEM-encoded X.509 Certificate Signing Requests
|
||||
# |-- ssl.key/ . . . . . . . . . . . . . . PEM-encoded RSA Private Keys
|
||||
# |-- ssl.prm/ . . . . . . . . . . . . . . public DSA Parameter Files
|
||||
# |-- global.conf
|
||||
# |-- loadmodule.conf
|
||||
# |-- uid.conf
|
||||
# `-- vhosts.d/ . . . . . . . . . . . . . . put your virtual host configuration (*.conf) here
|
||||
# |-- vhost-ssl.template
|
||||
# `-- vhost.template
|
||||
|
||||
|
||||
|
||||
### Global Environment ######################################################
|
||||
#
|
||||
# The directives in this section affect the overall operation of Apache,
|
||||
# such as the number of concurrent requests.
|
||||
|
||||
# run under this user/group id
|
||||
Include /etc/apache2/uid.conf
|
||||
|
||||
# - how many server processes to start (server pool regulation)
|
||||
# - usage of KeepAlive
|
||||
Include /etc/apache2/server-tuning.conf
|
||||
|
||||
# ErrorLog: The location of the error log file.
|
||||
# If you do not specify an ErrorLog directive within a <VirtualHost>
|
||||
# container, error messages relating to that virtual host will be
|
||||
# logged here. If you *do* define an error logfile for a <VirtualHost>
|
||||
# container, that host's errors will be logged there and not here.
|
||||
ErrorLog /var/log/apache2/error_log
|
||||
|
||||
# generated from default value of APACHE_MODULES in /etc/sysconfig/apache2
|
||||
<IfDefine !SYSCONFIG>
|
||||
Include /etc/apache2/loadmodule.conf
|
||||
</IfDefine>
|
||||
|
||||
# IP addresses / ports to listen on
|
||||
Include /etc/apache2/listen.conf
|
||||
|
||||
# predefined logging formats
|
||||
Include /etc/apache2/mod_log_config.conf
|
||||
|
||||
# generated from default values of global settings in /etc/sysconfig/apache2
|
||||
<IfDefine !SYSCONFIG>
|
||||
Include /etc/apache2/global.conf
|
||||
</IfDefine>
|
||||
|
||||
# optional mod_status, mod_info
|
||||
Include /etc/apache2/mod_status.conf
|
||||
Include /etc/apache2/mod_info.conf
|
||||
|
||||
# mod_reqtimeout protects the server from the so-called "slowloris"
|
||||
# attack: The server is not swamped with requests in fast succession,
|
||||
# but with slowly transmitted request headers and body, thereby filling up
|
||||
# the request slots until the server runs out of them.
|
||||
# mod_reqtimeout is lightweight and should deliver good results
|
||||
# with the configured default values. You shouldn't notice it at all.
|
||||
Include /etc/apache2/mod_reqtimeout.conf
|
||||
|
||||
# Fix for CVE-2014-0231 introduces new configuration parameter
|
||||
# CGIDScriptTimeout. This directive and its effect prevent request
|
||||
# workers to be eaten until starvation if cgi programs do not send
|
||||
# output back to the server within the timout set by CGIDScriptTimeout.
|
||||
Include /etc/apache2/mod_cgid-timeout.conf
|
||||
|
||||
# optional cookie-based user tracking
|
||||
# read the documentation before using it!!
|
||||
Include /etc/apache2/mod_usertrack.conf
|
||||
|
||||
# configuration of server-generated directory listings
|
||||
Include /etc/apache2/mod_autoindex-defaults.conf
|
||||
|
||||
# associate MIME types with filename extensions
|
||||
TypesConfig /etc/apache2/mime.types
|
||||
Include /etc/apache2/mod_mime-defaults.conf
|
||||
|
||||
# set up (customizable) error responses
|
||||
Include /etc/apache2/errors.conf
|
||||
|
||||
# global (server-wide) SSL configuration, that is not specific to
|
||||
# any virtual host
|
||||
Include /etc/apache2/ssl-global.conf
|
||||
|
||||
# global (server-wide) protocol configuration, that is not specific
|
||||
# to any virtual host
|
||||
Include /etc/apache2/protocols.conf
|
||||
|
||||
# forbid access to the entire filesystem by default
|
||||
<Directory />
|
||||
Options None
|
||||
AllowOverride None
|
||||
<IfModule !mod_access_compat.c>
|
||||
Require all denied
|
||||
</IfModule>
|
||||
<IfModule mod_access_compat.c>
|
||||
Order deny,allow
|
||||
Deny from all
|
||||
</IfModule>
|
||||
</Directory>
|
||||
|
||||
# use .htaccess files for overriding,
|
||||
AccessFileName .htaccess
|
||||
# and never show them
|
||||
<Files ~ "^\.ht">
|
||||
<IfModule !mod_access_compat.c>
|
||||
Require all denied
|
||||
</IfModule>
|
||||
<IfModule mod_access_compat.c>
|
||||
Order allow,deny
|
||||
Deny from all
|
||||
</IfModule>
|
||||
</Files>
|
||||
|
||||
# List of resources to look for when the client requests a directory
|
||||
DirectoryIndex index.html index.html.var
|
||||
|
||||
### 'Main' server configuration #############################################
|
||||
#
|
||||
# The directives in this section set up the values used by the 'main'
|
||||
# server, which responds to any requests that aren't handled by a
|
||||
# <VirtualHost> definition. These values also provide defaults for
|
||||
# any <VirtualHost> containers you may define later in the file.
|
||||
#
|
||||
# All of these directives may appear inside <VirtualHost> containers,
|
||||
# in which case these default settings will be overridden for the
|
||||
# virtual host being defined.
|
||||
#
|
||||
Include /etc/apache2/default-server.conf
|
||||
|
||||
|
||||
### Virtual server configuration ############################################
|
||||
#
|
||||
# VirtualHost: If you want to maintain multiple domains/hostnames on your
|
||||
# machine you can setup VirtualHost containers for them. Most configurations
|
||||
# use only name-based virtual hosts so the server doesn't need to worry about
|
||||
# IP addresses. This is indicated by the asterisks in the directives below.
|
||||
#
|
||||
# Please see the documentation at
|
||||
# <URL:https://httpd.apache.org/docs/2.4/vhosts/>
|
||||
# for further details before you try to setup virtual hosts.
|
||||
#
|
||||
# You may use the command line option '-S' to verify your virtual host
|
||||
# configuration.
|
||||
#
|
||||
IncludeOptional /etc/apache2/vhosts.d/*.conf
|
||||
|
||||
|
||||
# Note: instead of adding your own configuration here, consider
|
||||
# adding it in your own file (/etc/apache2/httpd.conf.local)
|
||||
# putting its name into APACHE_CONF_INCLUDE_FILES in
|
||||
# /etc/sysconfig/apache2 -- this will make system updates
|
||||
# easier :)
|
32
apache2-listen.conf
Normal file
32
apache2-listen.conf
Normal file
@ -0,0 +1,32 @@
|
||||
# Listen: Allows you to bind Apache to specific IP addresses and/or
|
||||
# ports. See also the <VirtualHost> directive.
|
||||
#
|
||||
# https://httpd.apache.org/docs/2.4/mod/mpm_common.html#listen
|
||||
#
|
||||
# Change this to Listen on specific IP addresses as shown below to
|
||||
# prevent Apache from glomming onto all bound IP addresses (0.0.0.0)
|
||||
#
|
||||
# When we also provide SSL we have to listen to the
|
||||
# standard HTTP port (see above) and to the HTTPS port
|
||||
#
|
||||
# Note: Configurations that use IPv6 but not IPv4-mapped addresses need two
|
||||
# Listen directives: "Listen [::]:443" and "Listen 0.0.0.0:443"
|
||||
#
|
||||
#Listen 12.34.56.78:80
|
||||
#Listen 80
|
||||
#Listen 443
|
||||
|
||||
Listen 80
|
||||
|
||||
|
||||
<IfDefine SSL>
|
||||
<IfDefine !NOSSL>
|
||||
<IfModule mod_ssl.c>
|
||||
|
||||
Listen 443
|
||||
|
||||
</IfModule>
|
||||
</IfDefine>
|
||||
</IfDefine>
|
||||
|
||||
|
75
apache2-loadmodule.conf
Normal file
75
apache2-loadmodule.conf
Normal file
@ -0,0 +1,75 @@
|
||||
<IfModule prefork.c>
|
||||
LoadModule actions_module /usr/lib64/apache2-prefork/mod_actions.so
|
||||
LoadModule alias_module /usr/lib64/apache2-prefork/mod_alias.so
|
||||
LoadModule auth_basic_module /usr/lib64/apache2-prefork/mod_auth_basic.so
|
||||
LoadModule authn_file_module /usr/lib64/apache2-prefork/mod_authn_file.so
|
||||
LoadModule authz_host_module /usr/lib64/apache2-prefork/mod_authz_host.so
|
||||
LoadModule authz_groupfile_module /usr/lib64/apache2-prefork/mod_authz_groupfile.so
|
||||
LoadModule authz_user_module /usr/lib64/apache2-prefork/mod_authz_user.so
|
||||
LoadModule autoindex_module /usr/lib64/apache2-prefork/mod_autoindex.so
|
||||
LoadModule cgi_module /usr/lib64/apache2-prefork/mod_cgi.so
|
||||
LoadModule dir_module /usr/lib64/apache2-prefork/mod_dir.so
|
||||
LoadModule env_module /usr/lib64/apache2-prefork/mod_env.so
|
||||
LoadModule expires_module /usr/lib64/apache2-prefork/mod_expires.so
|
||||
LoadModule include_module /usr/lib64/apache2-prefork/mod_include.so
|
||||
LoadModule log_config_module /usr/lib64/apache2-prefork/mod_log_config.so
|
||||
LoadModule mime_module /usr/lib64/apache2-prefork/mod_mime.so
|
||||
LoadModule negotiation_module /usr/lib64/apache2-prefork/mod_negotiation.so
|
||||
LoadModule setenvif_module /usr/lib64/apache2-prefork/mod_setenvif.so
|
||||
LoadModule ssl_module /usr/lib64/apache2-prefork/mod_ssl.so
|
||||
LoadModule socache_shmcb_module /usr/lib64/apache2-prefork/mod_socache_shmcb.so
|
||||
LoadModule userdir_module /usr/lib64/apache2-prefork/mod_userdir.so
|
||||
LoadModule reqtimeout_module /usr/lib64/apache2-prefork/mod_reqtimeout.so
|
||||
LoadModule authn_core_module /usr/lib64/apache2-prefork/mod_authn_core.so
|
||||
LoadModule authz_core_module /usr/lib64/apache2-prefork/mod_authz_core.so
|
||||
</IfModule>
|
||||
<IfModule worker.c>
|
||||
LoadModule actions_module /usr/lib64/apache2-worker/mod_actions.so
|
||||
LoadModule alias_module /usr/lib64/apache2-worker/mod_alias.so
|
||||
LoadModule auth_basic_module /usr/lib64/apache2-worker/mod_auth_basic.so
|
||||
LoadModule authn_file_module /usr/lib64/apache2-worker/mod_authn_file.so
|
||||
LoadModule authz_host_module /usr/lib64/apache2-worker/mod_authz_host.so
|
||||
LoadModule authz_groupfile_module /usr/lib64/apache2-worker/mod_authz_groupfile.so
|
||||
LoadModule authz_user_module /usr/lib64/apache2-worker/mod_authz_user.so
|
||||
LoadModule autoindex_module /usr/lib64/apache2-worker/mod_autoindex.so
|
||||
LoadModule cgi_module /usr/lib64/apache2-worker/mod_cgi.so
|
||||
LoadModule dir_module /usr/lib64/apache2-worker/mod_dir.so
|
||||
LoadModule env_module /usr/lib64/apache2-worker/mod_env.so
|
||||
LoadModule expires_module /usr/lib64/apache2-worker/mod_expires.so
|
||||
LoadModule include_module /usr/lib64/apache2-worker/mod_include.so
|
||||
LoadModule log_config_module /usr/lib64/apache2-worker/mod_log_config.so
|
||||
LoadModule mime_module /usr/lib64/apache2-worker/mod_mime.so
|
||||
LoadModule negotiation_module /usr/lib64/apache2-worker/mod_negotiation.so
|
||||
LoadModule setenvif_module /usr/lib64/apache2-worker/mod_setenvif.so
|
||||
LoadModule ssl_module /usr/lib64/apache2-worker/mod_ssl.so
|
||||
LoadModule socache_shmcb_module /usr/lib64/apache2-worker/mod_socache_shmcb.so
|
||||
LoadModule userdir_module /usr/lib64/apache2-worker/mod_userdir.so
|
||||
LoadModule reqtimeout_module /usr/lib64/apache2-worker/mod_reqtimeout.so
|
||||
LoadModule authn_core_module /usr/lib64/apache2-worker/mod_authn_core.so
|
||||
LoadModule authz_core_module /usr/lib64/apache2-worker/mod_authz_core.so
|
||||
</IfModule>
|
||||
<IfModule event.c>
|
||||
LoadModule actions_module /usr/lib64/apache2-event/mod_actions.so
|
||||
LoadModule alias_module /usr/lib64/apache2-event/mod_alias.so
|
||||
LoadModule auth_basic_module /usr/lib64/apache2-event/mod_auth_basic.so
|
||||
LoadModule authn_file_module /usr/lib64/apache2-event/mod_authn_file.so
|
||||
LoadModule authz_host_module /usr/lib64/apache2-event/mod_authz_host.so
|
||||
LoadModule authz_groupfile_module /usr/lib64/apache2-event/mod_authz_groupfile.so
|
||||
LoadModule authz_user_module /usr/lib64/apache2-event/mod_authz_user.so
|
||||
LoadModule autoindex_module /usr/lib64/apache2-event/mod_autoindex.so
|
||||
LoadModule cgi_module /usr/lib64/apache2-event/mod_cgi.so
|
||||
LoadModule dir_module /usr/lib64/apache2-event/mod_dir.so
|
||||
LoadModule env_module /usr/lib64/apache2-event/mod_env.so
|
||||
LoadModule expires_module /usr/lib64/apache2-event/mod_expires.so
|
||||
LoadModule include_module /usr/lib64/apache2-event/mod_include.so
|
||||
LoadModule log_config_module /usr/lib64/apache2-event/mod_log_config.so
|
||||
LoadModule mime_module /usr/lib64/apache2-event/mod_mime.so
|
||||
LoadModule negotiation_module /usr/lib64/apache2-event/mod_negotiation.so
|
||||
LoadModule setenvif_module /usr/lib64/apache2-event/mod_setenvif.so
|
||||
LoadModule ssl_module /usr/lib64/apache2-event/mod_ssl.so
|
||||
LoadModule socache_shmcb_module /usr/lib64/apache2-event/mod_socache_shmcb.so
|
||||
LoadModule userdir_module /usr/lib64/apache2-event/mod_userdir.so
|
||||
LoadModule reqtimeout_module /usr/lib64/apache2-event/mod_reqtimeout.so
|
||||
LoadModule authn_core_module /usr/lib64/apache2-event/mod_authn_core.so
|
||||
LoadModule authz_core_module /usr/lib64/apache2-event/mod_authz_core.so
|
||||
</IfModule>
|
56
apache2-logresolve-tmp-security.patch
Normal file
56
apache2-logresolve-tmp-security.patch
Normal file
@ -0,0 +1,56 @@
|
||||
--- httpd-2.4.6.orig/support/logresolve.pl.in
|
||||
+++ httpd-2.4.6/support/logresolve.pl.in
|
||||
@@ -57,6 +57,7 @@ $|=1;
|
||||
|
||||
use FileHandle;
|
||||
use Socket;
|
||||
+use File::Temp;
|
||||
|
||||
use strict;
|
||||
no strict 'refs';
|
||||
@@ -71,11 +72,13 @@ my $filename;
|
||||
my %hash = ();
|
||||
my $parent = $$;
|
||||
|
||||
+my $tempdir = File::Temp::tempdir("logresolve.pl.sockets.XXXXXX", CLEANUP => 1);
|
||||
+
|
||||
my @children = ();
|
||||
for (my $child = 1; $child <=$CHILDREN; $child++) {
|
||||
my $f = fork();
|
||||
if (!$f) {
|
||||
- $filename = "./.socket.$parent.$child";
|
||||
+ $filename = "$tempdir/socket.$parent.$child";
|
||||
if (-e $filename) { unlink($filename) || warn "$filename .. $!\n";}
|
||||
&child($child);
|
||||
exit(0);
|
||||
@@ -91,9 +94,9 @@ sub cleanup {
|
||||
# die kiddies, die
|
||||
kill(15, @children);
|
||||
for (my $child = 1; $child <=$CHILDREN; $child++) {
|
||||
- if (-e "./.socket.$parent.$child") {
|
||||
- unlink("./.socket.$parent.$child")
|
||||
- || warn ".socket.$parent.$child $!";
|
||||
+ if (-e "$tempdir/socket.$parent.$child") {
|
||||
+ unlink("$tempdir/socket.$parent.$child")
|
||||
+ || warn "$tempdir/socket.$parent.$child $!";
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -113,7 +116,7 @@ sub parent {
|
||||
if (!socket($CHILDSOCK{$child}, AF_UNIX, SOCK_STREAM, $PROTOCOL)) {
|
||||
warn "parent socket to child failed $!";
|
||||
}
|
||||
- $filename = "./.socket.$parent.$child";
|
||||
+ $filename = "$tempdir/socket.$parent.$child";
|
||||
my $response;
|
||||
do {
|
||||
$response = connect($CHILDSOCK{$child}, sockaddr_un($filename));
|
||||
@@ -176,7 +179,7 @@ sub child {
|
||||
# create a socket to communicate with parent
|
||||
socket(INBOUND, AF_UNIX, SOCK_STREAM, $PROTOCOL)
|
||||
|| die "Error with Socket: !$\n";
|
||||
- $filename = "./.socket.$parent.$me";
|
||||
+ $filename = "$tempdir/socket.$parent.$me";
|
||||
bind(INBOUND, sockaddr_un($filename))
|
||||
|| die "Error Binding $filename: $!\n";
|
||||
listen(INBOUND, 5) || die "Error Listening: $!\n";
|
28
apache2-manual.conf
Normal file
28
apache2-manual.conf
Normal file
@ -0,0 +1,28 @@
|
||||
#
|
||||
# This configuration file belongs to the apache2-doc package.
|
||||
#
|
||||
# The alias provides the manual, even if you choose to move your DocumentRoot.
|
||||
# Comment this out if you do not care for the documentation.
|
||||
#
|
||||
AliasMatch ^/manual(?:/(?:de|en|es|fr|ja|ko|ru))?(/.*)?$ "/usr/share/apache2/manual$1"
|
||||
|
||||
<Directory "/usr/share/apache2/manual">
|
||||
Options Indexes
|
||||
AllowOverride None
|
||||
<IfModule !mod_access_compat.c>
|
||||
Require local
|
||||
</IfModule>
|
||||
<IfModule mod_access_compat.c>
|
||||
Order deny,allow
|
||||
Deny from all
|
||||
Allow from localhost 127.0.0.1
|
||||
</IfModule>
|
||||
|
||||
<Files *.html>
|
||||
SetHandler type-map
|
||||
</Files>
|
||||
|
||||
SetEnvIf Request_URI ^/manual/(de|en|es|fr|ja|ko|ru)/ prefer-language=$1
|
||||
RedirectMatch 301 ^/manual(?:/(de|en|es|fr|ja|ko|ru)){2,}(/.*)?$ /manual/$1$2
|
||||
</Directory>
|
||||
|
51
apache2-mod_autoindex-defaults.conf
Normal file
51
apache2-mod_autoindex-defaults.conf
Normal file
@ -0,0 +1,51 @@
|
||||
#
|
||||
# Directives controlling the display of server-generated directory listings.
|
||||
#
|
||||
# see https://httpd.apache.org/docs/2.4/mod/mod_autoindex.html
|
||||
#
|
||||
|
||||
<IfModule mod_autoindex.c>
|
||||
|
||||
IndexOptions FancyIndexing VersionSort NameWidth=*
|
||||
|
||||
# Add Last-Modified and ETag values for the listed directory in the HTTP header,
|
||||
# based on files' modification dates
|
||||
#IndexOptions +TrackModified
|
||||
|
||||
AddIconByEncoding (CMP,/icons/compressed.gif) x-compress x-gzip
|
||||
|
||||
AddIconByType (TXT,/icons/text.gif) text/*
|
||||
AddIconByType (IMG,/icons/image2.gif) image/*
|
||||
AddIconByType (SND,/icons/sound2.gif) audio/*
|
||||
AddIconByType (VID,/icons/movie.gif) video/*
|
||||
|
||||
AddIcon /icons/binary.gif .bin .exe
|
||||
AddIcon /icons/binhex.gif .hqx
|
||||
AddIcon /icons/tar.gif .tar
|
||||
AddIcon /icons/world2.gif .wrl .wrl.gz .vrml .vrm .iv
|
||||
AddIcon /icons/compressed.gif .Z .z .tgz .gz .zip
|
||||
AddIcon /icons/a.gif .ps .ai .eps
|
||||
AddIcon /icons/layout.gif .html .shtml .htm .pdf
|
||||
AddIcon /icons/text.gif .txt
|
||||
AddIcon /icons/c.gif .c
|
||||
AddIcon /icons/p.gif .pl .py
|
||||
AddIcon /icons/f.gif .for
|
||||
AddIcon /icons/dvi.gif .dvi
|
||||
AddIcon /icons/uuencoded.gif .uu
|
||||
AddIcon /icons/script.gif .conf .sh .shar .csh .ksh .tcl
|
||||
AddIcon /icons/tex.gif .tex
|
||||
AddIcon /icons/bomb.gif core
|
||||
|
||||
AddIcon /icons/back.gif ..
|
||||
AddIcon /icons/hand.right.gif README
|
||||
AddIcon /icons/folder.gif ^^DIRECTORY^^
|
||||
AddIcon /icons/blank.gif ^^BLANKICON^^
|
||||
|
||||
DefaultIcon /icons/unknown.gif
|
||||
|
||||
ReadmeName README.html
|
||||
HeaderName HEADER.html
|
||||
|
||||
IndexIgnore .??* *~ *# HEADER* RCS CVS *,v *,t
|
||||
|
||||
</IfModule>
|
15
apache2-mod_cgid-timeout.conf
Normal file
15
apache2-mod_cgid-timeout.conf
Normal file
@ -0,0 +1,15 @@
|
||||
#
|
||||
# The length of time in seconds to wait for more output
|
||||
# from a CGI program.
|
||||
#
|
||||
# This will prevent a DoS if too many CGI's don't send their output quickly
|
||||
# enough.
|
||||
# The value for CGIDScriptTimeout defaults to the value of Timeout.
|
||||
# CGIDScriptTimeout is used by mod_cgid only!
|
||||
#
|
||||
|
||||
<IfModule mod_cgid.c>
|
||||
CGIDScriptTimeout 60
|
||||
</IfModule>
|
||||
|
||||
|
48
apache2-mod_example.c
Normal file
48
apache2-mod_example.c
Normal file
@ -0,0 +1,48 @@
|
||||
/* Include the required headers from httpd */
|
||||
#include "httpd.h"
|
||||
#include "http_core.h"
|
||||
#include "http_protocol.h"
|
||||
#include "http_request.h"
|
||||
|
||||
/* Define prototypes of our functions in this module */
|
||||
static void register_hooks(apr_pool_t *pool); |