Fixed: FS#2325 - httpd log directory permissions allow symlink attacks.

tbrehm

2012-07-23 393ca8c757481e73cc2af00d69cd6266de311bd6

 server/plugins-available/apache2_plugin.inc.php

@@ -35,6 +35,7 @@

   // private variables
   var $action = '';
   var $ssl_certificate_changed = false;

   //* This function is called during ispconfig installation to determine
   //  if a symlink shall be created for this plugin.
@@ -85,6 +86,8 @@
      $app->plugins->registerEvent('web_folder_update',$this->plugin_name,'web_folder_update');
      $app->plugins->registerEvent('web_folder_delete',$this->plugin_name,'web_folder_delete');
      
      $app->plugins->registerEvent('ftp_user_delete',$this->plugin_name,'ftp_user_delete');
		
   }

   // Handle the creation of SSL certificates
@@ -110,6 +113,15 @@

      //* Create a SSL Certificate
      if($data['new']['ssl_action'] == 'create') {
			
         $this->ssl_certificate_changed = true;
			
         //* Rename files if they exist
         if(file_exists($key_file)) rename($key_file,$key_file.'.bak');
         if(file_exists($key_file2)) rename($key_file2,$key_file2.'.bak');
         if(file_exists($csr_file)) rename($csr_file,$csr_file.'.bak');
         if(file_exists($crt_file)) rename($crt_file,$crt_file.'.bak');
			
         $rand_file = $ssl_dir.'/random_file';
         $rand_data = md5(uniqid(microtime(),1));
         for($i=0; $i<1000; $i++) {
@@ -133,11 +145,11 @@
        output_password        = $ssl_password

        [ req_distinguished_name ]
        C                      = ".$data['new']['ssl_country']."
        ST                     = ".$data['new']['ssl_state']."
        L                      = ".$data['new']['ssl_locality']."
        O                      = ".$data['new']['ssl_organisation']."
        OU                     = ".$data['new']['ssl_organisation_unit']."
        C                      = ".trim($data['new']['ssl_country'])."
        ST                     = ".trim($data['new']['ssl_state'])."
        L                      = ".trim($data['new']['ssl_locality'])."
        O                      = ".trim($data['new']['ssl_organisation'])."
        OU                     = ".trim($data['new']['ssl_organisation_unit'])."
        CN                     = $domain
        emailAddress           = webmaster@".$data['new']['domain']."

@@ -189,16 +201,30 @@

      //* Save a SSL certificate to disk
      if($data["new"]["ssl_action"] == 'save') {
         $this->ssl_certificate_changed = true;
         $ssl_dir = $data["new"]["document_root"]."/ssl";
         $domain = ($data["new"]["ssl_domain"] != '')?$data["new"]["ssl_domain"]:$data["new"]["domain"];
         $key_file = $ssl_dir.'/'.$domain.'.key.org';
      $key_file2 = $ssl_dir.'/'.$domain.'.key';
         $csr_file = $ssl_dir.'/'.$domain.".csr";
         $crt_file = $ssl_dir.'/'.$domain.".crt";
         $bundle_file = $ssl_dir.'/'.$domain.".bundle";
			
         //* Backup files
         if(file_exists($key_file)) copy($key_file,$key_file.'~');
         if(file_exists($key_file2)) copy($key_file2,$key_file2.'~');
         if(file_exists($csr_file)) copy($csr_file,$csr_file.'~');
         if(file_exists($crt_file)) copy($crt_file,$crt_file.'~');
         if(file_exists($bundle_file)) copy($bundle_file,$bundle_file.'~');
			
         //* Write new ssl files
         if(trim($data["new"]["ssl_request"]) != '') file_put_contents($csr_file,$data["new"]["ssl_request"]);
         if(trim($data["new"]["ssl_cert"]) != '') file_put_contents($crt_file,$data["new"]["ssl_cert"]);
         if(trim($data["new"]["ssl_bundle"]) != '') file_put_contents($bundle_file,$data["new"]["ssl_bundle"]);
			
         /* Update the DB of the (local) Server */
         $app->db->query("UPDATE web_domain SET ssl_action = '' WHERE domain = '".$data['new']['domain']."'");
			
         /* Update also the master-DB of the Server-Farm */
         $app->dbmaster->query("UPDATE web_domain SET ssl_action = '' WHERE domain = '".$data['new']['domain']."'");
         $app->log('Saving SSL Cert for: '.$domain,LOGLEVEL_DEBUG);
@@ -288,6 +314,10 @@
         $app->log('Websites cannot be owned by the root user or group.',LOGLEVEL_WARN);
         return 0;
      }
      if(trim($data['new']['domain']) == '') {
         $app->log('domain is empty',LOGLEVEL_WARN);
         return 0;
      }
      
      // Create group and user, if not exist
      $app->uses('system');
@@ -353,6 +383,9 @@
               }
            }
         }
			
         //* Remove protection of old folders
         $app->system->web_folder_protection($data['old']['document_root'],false);

         //* Move the site data
         $tmp_docroot = explode('/',$data['new']['document_root']);
@@ -401,7 +434,7 @@
      if(!is_dir($data['new']['document_root'].'/ssl')) exec('mkdir -p '.$data['new']['document_root'].'/ssl');
      if(!is_dir($data['new']['document_root'].'/cgi-bin')) exec('mkdir -p '.$data['new']['document_root'].'/cgi-bin');
      if(!is_dir($data['new']['document_root'].'/tmp')) exec('mkdir -p '.$data['new']['document_root'].'/tmp');

		
      // Remove the symlink for the site, if site is renamed
      if($this->action == 'update' && $data['old']['domain'] != '' && $data['new']['domain'] != $data['old']['domain']) {
         if(is_dir('/var/log/ispconfig/httpd/'.$data['old']['domain'])) exec('rm -rf /var/log/ispconfig/httpd/'.$data['old']['domain']);
@@ -580,15 +613,17 @@
         }
      }



      //* If the security level is set to high
      if(($this->action == 'insert' && $data['new']['type'] == 'vhost') or ($web_config['set_folder_permissions_on_update'] == 'y' && $data['new']['type'] == 'vhost')) {
			
         $app->system->web_folder_protection($data['new']['document_root'],false);
			
         if($web_config['security_level'] == 20) {

            $this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']));
            $this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']).'/*');
            $this->_exec('chmod 710 '.escapeshellcmd($data['new']['document_root'].'/web'));
            $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/ssl'));

            // make tmp directory writable for Apache and the website users
            $this->_exec('chmod 777 '.escapeshellcmd($data['new']['document_root'].'/tmp'));
@@ -621,8 +656,9 @@
            //* Chown all default directories
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/cgi-bin'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/log'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/ssl'));
            // $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/log'));
            $this->_exec('chown root:'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/log'));
            $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root'].'/ssl'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/tmp'));
            $this->_exec('chown -R '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/web'));

@@ -631,9 +667,10 @@
            * website root has to be owned by the root user and we have to chmod it to 755 then
            */

            //* Check if there is a jailkit user for this site
            //* Check if there is a jailkit user or cronjob for this site
            $tmp = $app->db->queryOneRecord('SELECT count(shell_user_id) as number FROM shell_user WHERE parent_domain_id = '.$data['new']['domain_id']." AND chroot = 'jailkit'");
            if($tmp['number'] > 0) {
            $tmp2 = $app->db->queryOneRecord('SELECT count(id) as number FROM cron WHERE parent_domain_id = '.$data['new']['domain_id']." AND `type` = 'chrooted'");
            if($tmp['number'] > 0 || $tmp2['number'] > 0) {
               $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root']));
               $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']));
            }
@@ -655,19 +692,28 @@
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/cgi-bin'));
            $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root'].'/log'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/tmp'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/ssl'));
            $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root'].'/ssl'));
            $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/web'));
         }
      }
		
      //* Protect web folders
      $app->system->web_folder_protection($data['new']['document_root'],true);

      // Change the ownership of the error log to the owner of the website
      if(!@is_file($data['new']['document_root'].'/log/error.log')) exec('touch '.escapeshellcmd($data['new']['document_root']).'/log/error.log');
      $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']).'/log/error.log');


      //* Write the custom php.ini file, if custom_php_ini filed is not empty
      //* Write the custom php.ini file, if custom_php_ini fieled is not empty
      $custom_php_ini_dir = $web_config['website_basedir'].'/conf/'.$data['new']['system_user'];
      if(!is_dir($web_config['website_basedir'].'/conf')) mkdir($web_config['website_basedir'].'/conf');
		
      //* add open_basedir restriction to custom php.ini content, required for suphp only
      if(!stristr($data['new']['custom_php_ini'],'open_basedir') && $data['new']['php'] == 'suphp') {
         $data['new']['custom_php_ini'] .= "\nopen_basedir = '".$data['new']['php_open_basedir']."'\n";
      }
      //* Create custom php.ini
      if(trim($data['new']['custom_php_ini']) != '') {
         $has_custom_php_ini = true;
         if(!is_dir($custom_php_ini_dir)) mkdir($custom_php_ini_dir);
@@ -960,18 +1006,38 @@
         $tpl->setVar('fastcgi_starter_script',$fastcgi_config['fastcgi_starter_script']);
         $tpl->setVar('fastcgi_config_syntax',$fastcgi_config['fastcgi_config_syntax']);

      } else {
         //remove the php fastgi starter script if available
         if ($data['old']['php'] == 'fast-cgi') {
            $fastcgi_config = $app->getconf->get_server_config($conf['server_id'], 'fastcgi');
            $fastcgi_starter_path = str_replace('[system_user]',$data['old']['system_user'],$fastcgi_config['fastcgi_starter_path']);
            $fastcgi_starter_path = str_replace('[client_id]',$client_id,$fastcgi_starter_path);
            if (is_dir($fastcgi_starter_path)) {
               exec('rm -rf '.$fastcgi_starter_path);
            }
         }
      }
      
      /**
      * PHP-FPM
      */
      // Support for multiple PHP versions
      if(trim($data['new']['fastcgi_php_version']) != ''){
         $default_php_fpm = false;
         list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['new']['fastcgi_php_version']));
         if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
      if($data['new']['php'] == 'php-fpm'){
         if(trim($data['new']['fastcgi_php_version']) != ''){
            $default_php_fpm = false;
            list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['new']['fastcgi_php_version']));
            if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
         } else {
            $default_php_fpm = true;
         }
      } else {
         $default_php_fpm = true;
         if(trim($data['old']['fastcgi_php_version']) != '' && $data['old']['php'] == 'php-fpm'){
            $default_php_fpm = false;
            list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['old']['fastcgi_php_version']));
            if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
         } else {
            $default_php_fpm = true;
         }
      }
      
      if($default_php_fpm){
@@ -1071,6 +1137,11 @@
      }
      
      //* Add vhost for ipv4 IP with SSL
      $ssl_dir = $data['new']['document_root'].'/ssl';
      $domain = $data['new']['ssl_domain'];
      $key_file = $ssl_dir.'/'.$domain.'.key';
      $crt_file = $ssl_dir.'/'.$domain.'.crt';
		
      if($data['new']['ssl_domain'] != '' && $data['new']['ssl'] == 'y' && @is_file($crt_file) && @is_file($key_file) && (@filesize($crt_file)>0)  && (@filesize($key_file)>0)) {
         if(count($rewrite_rules) > 0){
            $vhosts[] = array('ip_address' => $data['new']['ip_address'], 'ssl_enabled' => 1, 'port' => '443', 'redirects' => $rewrite_rules);
@@ -1177,7 +1248,9 @@
      if(!is_file($data['new']['document_root'].'/.htpasswd_stats') || $data['new']['stats_password'] != $data['old']['stats_password']) {
         if(trim($data['new']['stats_password']) != '') {
            $htp_file = 'admin:'.trim($data['new']['stats_password']);
            $app->system->web_folder_protection($data['new']['document_root'],false);
            file_put_contents($data['new']['document_root'].'/.htpasswd_stats',$htp_file);
            $app->system->web_folder_protection($data['new']['document_root'],true);
            chmod($data['new']['document_root'].'/.htpasswd_stats',0755);
            unset($htp_file);
         }
@@ -1213,6 +1286,33 @@
               //* There is no backup file, so we create a empty vhost file with a warning message inside
               file_put_contents($vhost_file,"# Apache did not start after modifying this vhost file.\n# Please check file $vhost_file.err for syntax errors.");
            }
            if($this->ssl_certificate_changed === true) {

               $ssl_dir = $data['new']['document_root'].'/ssl';
               $domain = $data['new']['ssl_domain'];
               $key_file = $ssl_dir.'/'.$domain.'.key.org';
               $key_file2 = $ssl_dir.'/'.$domain.'.key';
               $csr_file = $ssl_dir.'/'.$domain.'.csr';
               $crt_file = $ssl_dir.'/'.$domain.'.crt';
               $bundle_file = $ssl_dir.'/'.$domain.'.bundle';
					
               //* Backup the files that might have caused the error
               if(is_file($key_file)) copy($key_file,$key_file.'.err');
               if(is_file($key_file2)) copy($key_file2,$key_file2.'.err');
               if(is_file($csr_file)) copy($csr_file,$csr_file.'.err');
               if(is_file($crt_file)) copy($crt_file,$crt_file.'.err');
               if(is_file($bundle_file)) copy($bundle_file,$bundle_file.'.err');
					
               //* Restore the ~ backup files
               if(is_file($key_file.'~')) copy($key_file.'~',$key_file);
               if(is_file($key_file2.'~')) copy($key_file2.'~',$key_file2);
               if(is_file($crt_file.'~')) copy($crt_file.'~',$crt_file);
               if(is_file($csr_file.'~')) copy($csr_file.'~',$csr_file);
               if(is_file($bundle_file.'~')) copy($bundle_file.'~',$bundle_file);
					
               $app->log('Apache did not restart after the configuration change for website '.$data['new']['domain'].' Reverting the SSL configuration. Saved non-working SSL files with .err extension.',LOGLEVEL_WARN);
            }
				
            $app->services->restartService('httpd','restart');
         }
      } else {
@@ -1225,9 +1325,26 @@
         }
      }
      
      //* The vhost is written and apache has been restarted, so we 
      // can reset the ssl changed var to false and cleanup some files
      $this->ssl_certificate_changed = false;
		
      $ssl_dir = $data['new']['document_root'].'/ssl';
      $domain = $data['new']['ssl_domain'];
      $key_file = $ssl_dir.'/'.$domain.'.key.org';
      $key_file2 = $ssl_dir.'/'.$domain.'.key';
      $csr_file = $ssl_dir.'/'.$domain.'.csr';
      $crt_file = $ssl_dir.'/'.$domain.'.crt';
      $bundle_file = $ssl_dir.'/'.$domain.'.bundle';
		
      if(@is_file($key_file.'~')) unlink($key_file.'~');
      if(@is_file($key2_file.'~')) unlink($key2_file.'~');
      if(@is_file($crt_file.'~')) unlink($crt_file.'~');
      if(@is_file($csr_file.'~')) unlink($csr_file.'~');
      if(@is_file($bundle_file.'~')) unlink($bundle_file.'~');
		
      // Remove the backup copy of the config file.
      if(@is_file($vhost_file.'~')) unlink($vhost_file.'~');
		

      //* Unset action to clean it for next processed vhost.
      $this->action = '';
@@ -1239,7 +1356,10 @@

      // load the server configuration options
      $app->uses('getconf');
      $app->uses('system');
      $web_config = $app->getconf->get_server_config($conf['server_id'], 'web');
		
      $app->system->web_folder_protection($data['new']['document_root'],false);

      //* Check if this is a chrooted setup
      if($web_config['website_basedir'] != '' && @is_file($web_config['website_basedir'].'/etc/passwd')) {
@@ -1613,6 +1733,16 @@
      
      
   }
	
   public function ftp_user_delete($event_name,$data) {
      global $app, $conf;
		
      $ftpquota_file = $data['old']['dir'].'/.ftpquota';
      if(file_exists($ftpquota_file)) unlink($ftpquota_file);
		
   }
	
	

   /**
    * This function is called when a Webdav-User is inserted, updated or deleted.
@@ -1926,12 +2056,22 @@
      global $app, $conf;
      //$reload = false;
      
      if(trim($data['new']['fastcgi_php_version']) != ''){
         $default_php_fpm = false;
         list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['new']['fastcgi_php_version']));
         if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
      if($data['new']['php'] == 'php-fpm'){
         if(trim($data['new']['fastcgi_php_version']) != ''){
            $default_php_fpm = false;
            list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['new']['fastcgi_php_version']));
            if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
         } else {
            $default_php_fpm = true;
         }
      } else {
         $default_php_fpm = true;
         if(trim($data['old']['fastcgi_php_version']) != '' && $data['old']['php'] == 'php-fpm'){
            $default_php_fpm = false;
            list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['old']['fastcgi_php_version']));
            if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
         } else {
            $default_php_fpm = true;
         }
      }
      
      $app->uses("getconf");
@@ -1975,10 +2115,13 @@
      $tpl->setVar('fpm_port', $web_config['php_fpm_start_port'] + $data['new']['domain_id'] - 1);
      $tpl->setVar('fpm_user', $data['new']['system_user']);
      $tpl->setVar('fpm_group', $data['new']['system_group']);
      $tpl->setVar('pm', $data['new']['pm']);
      $tpl->setVar('pm_max_children', $data['new']['pm_max_children']);
      $tpl->setVar('pm_start_servers', $data['new']['pm_start_servers']);
      $tpl->setVar('pm_min_spare_servers', $data['new']['pm_min_spare_servers']);
      $tpl->setVar('pm_max_spare_servers', $data['new']['pm_max_spare_servers']);
      $tpl->setVar('pm_process_idle_timeout', $data['new']['pm_process_idle_timeout']);
      $tpl->setVar('pm_max_requests', $data['new']['pm_max_requests']);
      $tpl->setVar('document_root', $data['new']['document_root']);
      $tpl->setVar('security_level',$web_config['security_level']);
      $php_open_basedir = ($data['new']['php_open_basedir'] == '')?escapeshellcmd($data['new']['document_root']):escapeshellcmd($data['new']['php_open_basedir']);
@@ -2004,12 +2147,12 @@
                     $value = escapeshellcmd(trim($value));
                     $key = escapeshellcmd(trim($key));
                     switch (strtolower($value)) {
                        case 'on':
                        case 'off':
                        case '1':
                        case '0':
                           // PHP-FPM might complain about invalid boolean value if you use 0
                           $value = 'off';
                        case '1':
                        case 'on':
                        case 'off':
                        case 'true':
                        case 'false':
                        case 'yes':
@@ -2070,7 +2213,7 @@
   private function php_fpm_pool_delete ($data,$web_config) {
      global $app, $conf;
      
      if(trim($data['old']['fastcgi_php_version']) != ''){
      if(trim($data['old']['fastcgi_php_version']) != '' && $data['old']['php'] == 'php-fpm'){
         $default_php_fpm = false;
         list($custom_php_fpm_name, $custom_php_fpm_init_script, $custom_php_fpm_ini_dir, $custom_php_fpm_pool_dir) = explode(':', trim($data['old']['fastcgi_php_version']));
         if(substr($custom_php_fpm_ini_dir,-1) != '/') $custom_php_fpm_ini_dir .= '/';
@@ -2195,4 +2338,4 @@

} // end class

?>
?>