Fixed: FS#1858 - Old SSH-RSA Public Key not deleted from authorized_keys wh...

tbrehm

2012-01-03 236d796455c44b0ca40ca6582ae1fbb614f8bf21

 server/plugins-available/apache2_plugin.inc.php

@@ -167,7 +167,7 @@
               $app->log("Creating CA-signed SSL Cert for: $domain",LOGLEVEL_DEBUG);
               if (filesize($crt_file)==0 || !file_exists($crt_file)) $app->log("CA-Certificate signing failed.  openssl ca -out $crt_file -config ".$web_config['CA_path']."/openssl.cnf -passin pass:".$web_config['CA_pass']." -in $csr_file",LOGLEVEL_ERROR);
            };
            if (filesize($crt_file)==0 || !file_exists($crt_file)){
            if (@filesize($crt_file)==0 || !file_exists($crt_file)){
               exec("openssl req -x509 -passin pass:$ssl_password -passout pass:$ssl_password -key $key_file -in $csr_file -out $crt_file -days $ssl_days -config $config_file ");
               $app->log("Creating self-signed SSL Cert for: $domain",LOGLEVEL_DEBUG);
            };
@@ -190,7 +190,7 @@
      //* Save a SSL certificate to disk
      if($data["new"]["ssl_action"] == 'save') {
         $ssl_dir = $data["new"]["document_root"]."/ssl";
         $domain = $data["new"]["ssl_domain"];
         $domain = ($data["new"]["ssl_domain"] != '')?$data["new"]["ssl_domain"]:$data["new"]["domain"];
         $csr_file = $ssl_dir.'/'.$domain.".csr";
         $crt_file = $ssl_dir.'/'.$domain.".crt";
         $bundle_file = $ssl_dir.'/'.$domain.".bundle";
@@ -207,7 +207,7 @@
      //* Delete a SSL certificate
      if($data['new']['ssl_action'] == 'del') {
         $ssl_dir = $data['new']['document_root'].'/ssl';
         $domain = $data['new']['ssl_domain'];
         $domain = ($data["new"]["ssl_domain"] != '')?$data["new"]["ssl_domain"]:$data["new"]["domain"];
         $csr_file = $ssl_dir.'/'.$domain.'.csr';
         $crt_file = $ssl_dir.'/'.$domain.'.crt';
         $bundle_file = $ssl_dir.'/'.$domain.'.bundle';
@@ -227,7 +227,6 @@
         $app->dbmaster->query("UPDATE web_domain SET ssl_action = '' WHERE domain = '".$data['new']['domain']."'");
         $app->log('Deleting SSL Cert for: '.$domain,LOGLEVEL_DEBUG);
      }


   }

@@ -542,74 +541,91 @@

      if($this->action == 'insert' || $data["new"]["system_user"] != $data["old"]["system_user"]) {
         // Chown and chmod the directories below the document root
         $this->_exec('chown -R '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']));
         $this->_exec('chown -R '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']).'/web');
         // The document root itself has to be owned by root in normal level and by the web owner in security level 20
         if($web_config['security_level'] == 20) {
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']).'/web');
         } else {
            $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']));
            $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']).'/web');
         }
      }



      //* If the security level is set to high
      if($web_config['security_level'] == 20) {
      if(($this->action == 'insert' && $data['new']['type'] == 'vhost') or ($web_config['set_folder_permissions_on_update'] == 'y' && $data['new']['type'] == 'vhost')) {
         if($web_config['security_level'] == 20) {

         $this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']));
         $this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']).'/*');
         $this->_exec('chmod 710 '.escapeshellcmd($data['new']['document_root'].'/web'));
            $this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']));
            $this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']).'/*');
            $this->_exec('chmod 710 '.escapeshellcmd($data['new']['document_root'].'/web'));

         // make tmp directory writable for Apache and the website users
         $this->_exec('chmod 777 '.escapeshellcmd($data['new']['document_root'].'/tmp'));
            // make tmp directory writable for Apache and the website users
            $this->_exec('chmod 777 '.escapeshellcmd($data['new']['document_root'].'/tmp'));
         
         // Set Log symlink to 755 to make the logs accessible by the FTP user
         $this->_exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"])."/log");
            // Set Log symlink to 755 to make the logs accessible by the FTP user
            $this->_exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"])."/log");

         $command = 'usermod';
         $command .= ' --groups sshusers';
         $command .= ' '.escapeshellcmd($data['new']['system_user']);
         $this->_exec($command);
            $command = 'usermod';
            $command .= ' --groups sshusers';
            $command .= ' '.escapeshellcmd($data['new']['system_user']);
            $this->_exec($command);

         //* if we have a chrooted Apache environment
         if($apache_chrooted) {
            $this->_exec('chroot '.escapeshellcmd($web_config['website_basedir']).' '.$command);
            //* if we have a chrooted Apache environment
            if($apache_chrooted) {
               $this->_exec('chroot '.escapeshellcmd($web_config['website_basedir']).' '.$command);

            //* add the apache user to the client group in the chroot environment
            $tmp_groupfile = $app->system->server_conf['group_datei'];
            $app->system->server_conf['group_datei'] = $web_config['website_basedir'].'/etc/group';
               //* add the apache user to the client group in the chroot environment
               $tmp_groupfile = $app->system->server_conf['group_datei'];
               $app->system->server_conf['group_datei'] = $web_config['website_basedir'].'/etc/group';
               $app->system->add_user_to_group($groupname, escapeshellcmd($web_config['user']));
               $app->system->server_conf['group_datei'] = $tmp_groupfile;
               unset($tmp_groupfile);
            }

            //* add the Apache user to the client group
            $app->system->add_user_to_group($groupname, escapeshellcmd($web_config['user']));
            $app->system->server_conf['group_datei'] = $tmp_groupfile;
            unset($tmp_groupfile);
         }
				
            //* Chown all default directories
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/cgi-bin'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/log'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/ssl'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/tmp'));
            $this->_exec('chown -R '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/web'));

         //* add the Apache user to the client group
         $app->system->add_user_to_group($groupname, escapeshellcmd($web_config['user']));
            /*
            * Workaround for jailkit: If jailkit is enabled for the site, the 
            * website root has to be owned by the root user and we have to chmod it to 755 then
            */

         $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']));
            //* Check if there is a jailkit user for this site
            $tmp = $app->db->queryOneRecord('SELECT count(shell_user_id) as number FROM shell_user WHERE parent_domain_id = '.$data['new']['domain_id']." AND chroot = 'jailkit'");
            if($tmp['number'] > 0) {
               $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root']));
               $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']));
            }
            unset($tmp);

         /*
         * Workaround for jailkit: If jailkit is enabled for the site, the 
         * website root has to be owned by the root user and we have to chmod it to 755 then
         */
            // If the security Level is set to medium
         } else {

         //* Check if there is a jailkit user for this site
         $tmp = $app->db->queryOneRecord('SELECT count(shell_user_id) as number FROM shell_user WHERE parent_domain_id = '.$data['new']['domain_id']." AND chroot = 'jailkit'");
         if($tmp['number'] > 0) {
            $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root']));
            $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/cgi-bin'));
            $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/log'));
            $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/ssl'));
            $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/web'));
				
            // make temp directory writable for Apache and the website users
            $this->_exec('chmod 777 '.escapeshellcmd($data['new']['document_root'].'/tmp'));
				
            $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/cgi-bin'));
            $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root'].'/log'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/tmp'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/ssl'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/web'));
         }
         unset($tmp);

         // If the security Level is set to medium
      } else {

         $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root']));
         $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/*'));
         $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']));

         // make temp directory writable for Apache and the website users
         $this->_exec('chmod 777 '.escapeshellcmd($data['new']['document_root'].'/tmp'));
      }

      // Change the ownership of the error log to the owner of the website
@@ -636,7 +652,7 @@
         if($master_php_ini_path != '' && substr($master_php_ini_path,-7) == 'php.ini' && is_file($master_php_ini_path)) {
            $php_ini_content .= file_get_contents($master_php_ini_path)."\n";
         }
         $php_ini_content .= trim($data['new']['custom_php_ini']);
         $php_ini_content .= str_replace("\r",'',trim($data['new']['custom_php_ini']));
         file_put_contents($custom_php_ini_dir.'/php.ini',$php_ini_content);
      } else {
         $has_custom_php_ini = false;
@@ -729,7 +745,7 @@
                     'rewrite_target_ssl' => $rewrite_target_ssl);
               break;
            case '*':
               $rewrite_rules[] = array(   'rewrite_domain'    => $data['new']['domain'],
               $rewrite_rules[] = array(   'rewrite_domain'    => '(^|\.)'.$data['new']['domain'],
                  'rewrite_type'       => ($data['new']['redirect_type'] == 'no')?'':'['.$data['new']['redirect_type'].']',
                  'rewrite_target'    => $rewrite_target,
                  'rewrite_target_ssl' => $rewrite_target_ssl);
@@ -795,7 +811,7 @@
                           'rewrite_target_ssl' => $rewrite_target_ssl);
                     break;
                  case '*':
                     $rewrite_rules[] = array(   'rewrite_domain'    => $alias['domain'],
                     $rewrite_rules[] = array(   'rewrite_domain'    => '(^|\.)'.$alias['domain'],
                        'rewrite_type'       => ($alias['redirect_type'] == 'no')?'':'['.$alias['redirect_type'].']',
                        'rewrite_target'    => $rewrite_target,
                        'rewrite_target_ssl' => $rewrite_target_ssl);
@@ -1050,6 +1066,11 @@
            unlink($vhost_symlink);
            $app->log('Removing symlink: '.$vhost_symlink.'->'.$vhost_file,LOGLEVEL_DEBUG);
         }
         $vhost_symlink = escapeshellcmd($web_config['vhost_conf_enabled_dir'].'/'.$data['old']['domain'].'.vhost');
         if(is_link($vhost_symlink)) {
            unlink($vhost_symlink);
            $app->log('Removing symlink: '.$vhost_symlink.'->'.$vhost_file,LOGLEVEL_DEBUG);
         }
         $vhost_file = escapeshellcmd($web_config['vhost_conf_dir'].'/'.$data['old']['domain'].'.vhost');
         unlink($vhost_file);
         $app->log('Removing file: '.$vhost_file,LOGLEVEL_DEBUG);
@@ -1094,7 +1115,13 @@
         if($apache_online_status_before_restart && !$apache_online_status_after_restart) {
            $app->log('Apache did not restart after the configuration change for website '.$data['new']['domain'].' Reverting the configuration. Saved non-working config as '.$vhost_file.'.err',LOGLEVEL_WARN);
            copy($vhost_file,$vhost_file.'.err');
            copy($vhost_file.'~',$vhost_file);
            if(is_file($vhost_file.'~')) {
               //* Copy back the last backup file
               copy($vhost_file.'~',$vhost_file);
            } else {
               //* There is no backup file, so we create a empty vhost file with a warning message inside
               file_put_contents($vhost_file,"# Apache did not start after modifying this vhost file.\n# Please check file $vhost_file.err for syntax errors.");
            }
            $app->services->restartService('httpd','restart');
         }
      } else {
@@ -1314,12 +1341,18 @@
      }
      
      //* Create the folder path, if it does not exist
      if(!is_dir($folder_path)) exec('mkdir -p '.$folder_path);
      if(!is_dir($folder_path)) {
         exec('mkdir -p '.$folder_path);
         chown($folder_path,$website['system_user']);
         chgrp($folder_path,$website['system_group']);
      }
      
      //* Create empty .htpasswd file, if it does not exist
      if(!is_file($folder_path.'.htpasswd')) {
         touch($folder_path.'.htpasswd');
         chmod($folder_path.'.htpasswd',0755);
         chown($folder_path.'.htpasswd',$website['system_user']);
         chgrp($folder_path.'.htpasswd',$website['system_group']);
         $app->log('Created file '.$folder_path.'.htpasswd',LOGLEVEL_DEBUG);
      }
      
@@ -1357,7 +1390,9 @@
      //if(!is_file($folder_path.'.htaccess')) {
         $ht_file = "AuthType Basic\nAuthName \"Members Only\"\nAuthUserFile ".$folder_path.".htpasswd\nrequire valid-user";
         file_put_contents($folder_path.'.htaccess',$ht_file);
         chmod($folder_path.'.htpasswd',0755);
         chmod($folder_path.'.htaccess',0755);
         chown($folder_path.'.htaccess',$website['system_user']);
         chgrp($folder_path.'.htaccess',$website['system_group']);
         $app->log('Created file '.$folder_path.'.htaccess',LOGLEVEL_DEBUG);
      //}
      
@@ -1469,7 +1504,9 @@
         $ht_file = "AuthType Basic\nAuthName \"Members Only\"\nAuthUserFile ".$new_folder_path.".htpasswd\nrequire valid-user";
         file_put_contents($new_folder_path.'.htaccess',$ht_file);
         chmod($new_folder_path.'.htpasswd',0755);
         $app->log('Created file '.$new_folder_path.'.htaccess',LOGLEVEL_DEBUG);
         chown($folder_path.'.htpasswd',$website['system_user']);
         chgrp($folder_path.'.htpasswd',$website['system_group']);
         $app->log('Created file '.$new_folder_path.'.htpasswd',LOGLEVEL_DEBUG);
      }
      
      //* Remove .htaccess file