From 236d796455c44b0ca40ca6582ae1fbb614f8bf21 Mon Sep 17 00:00:00 2001
From: tbrehm <t.brehm@ispconfig.org>
Date: Tue, 03 Jan 2012 06:08:04 -0500
Subject: [PATCH] Fixed: FS#1858 - Old SSH-RSA Public Key not deleted from authorized_keys when deleted or changed
---
server/plugins-available/apache2_plugin.inc.php | 159 ++++++++++++++++++++++++++++++++--------------------
1 files changed, 98 insertions(+), 61 deletions(-)
diff --git a/server/plugins-available/apache2_plugin.inc.php b/server/plugins-available/apache2_plugin.inc.php
index 5a0c215..3cba835 100644
--- a/server/plugins-available/apache2_plugin.inc.php
+++ b/server/plugins-available/apache2_plugin.inc.php
@@ -167,7 +167,7 @@
$app->log("Creating CA-signed SSL Cert for: $domain",LOGLEVEL_DEBUG);
if (filesize($crt_file)==0 || !file_exists($crt_file)) $app->log("CA-Certificate signing failed. openssl ca -out $crt_file -config ".$web_config['CA_path']."/openssl.cnf -passin pass:".$web_config['CA_pass']." -in $csr_file",LOGLEVEL_ERROR);
};
- if (filesize($crt_file)==0 || !file_exists($crt_file)){
+ if (@filesize($crt_file)==0 || !file_exists($crt_file)){
exec("openssl req -x509 -passin pass:$ssl_password -passout pass:$ssl_password -key $key_file -in $csr_file -out $crt_file -days $ssl_days -config $config_file ");
$app->log("Creating self-signed SSL Cert for: $domain",LOGLEVEL_DEBUG);
};
@@ -190,7 +190,7 @@
//* Save a SSL certificate to disk
if($data["new"]["ssl_action"] == 'save') {
$ssl_dir = $data["new"]["document_root"]."/ssl";
- $domain = $data["new"]["ssl_domain"];
+ $domain = ($data["new"]["ssl_domain"] != '')?$data["new"]["ssl_domain"]:$data["new"]["domain"];
$csr_file = $ssl_dir.'/'.$domain.".csr";
$crt_file = $ssl_dir.'/'.$domain.".crt";
$bundle_file = $ssl_dir.'/'.$domain.".bundle";
@@ -207,7 +207,7 @@
//* Delete a SSL certificate
if($data['new']['ssl_action'] == 'del') {
$ssl_dir = $data['new']['document_root'].'/ssl';
- $domain = $data['new']['ssl_domain'];
+ $domain = ($data["new"]["ssl_domain"] != '')?$data["new"]["ssl_domain"]:$data["new"]["domain"];
$csr_file = $ssl_dir.'/'.$domain.'.csr';
$crt_file = $ssl_dir.'/'.$domain.'.crt';
$bundle_file = $ssl_dir.'/'.$domain.'.bundle';
@@ -227,7 +227,6 @@
$app->dbmaster->query("UPDATE web_domain SET ssl_action = '' WHERE domain = '".$data['new']['domain']."'");
$app->log('Deleting SSL Cert for: '.$domain,LOGLEVEL_DEBUG);
}
-
}
@@ -542,74 +541,91 @@
if($this->action == 'insert' || $data["new"]["system_user"] != $data["old"]["system_user"]) {
// Chown and chmod the directories below the document root
- $this->_exec('chown -R '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']));
+ $this->_exec('chown -R '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']).'/web');
// The document root itself has to be owned by root in normal level and by the web owner in security level 20
if($web_config['security_level'] == 20) {
- $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']));
+ $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']).'/web');
} else {
- $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']));
+ $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']).'/web');
}
}
//* If the security level is set to high
- if($web_config['security_level'] == 20) {
+ if(($this->action == 'insert' && $data['new']['type'] == 'vhost') or ($web_config['set_folder_permissions_on_update'] == 'y' && $data['new']['type'] == 'vhost')) {
+ if($web_config['security_level'] == 20) {
- $this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']));
- $this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']).'/*');
- $this->_exec('chmod 710 '.escapeshellcmd($data['new']['document_root'].'/web'));
+ $this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']));
+ $this->_exec('chmod 751 '.escapeshellcmd($data['new']['document_root']).'/*');
+ $this->_exec('chmod 710 '.escapeshellcmd($data['new']['document_root'].'/web'));
- // make tmp directory writable for Apache and the website users
- $this->_exec('chmod 777 '.escapeshellcmd($data['new']['document_root'].'/tmp'));
+ // make tmp directory writable for Apache and the website users
+ $this->_exec('chmod 777 '.escapeshellcmd($data['new']['document_root'].'/tmp'));
- // Set Log symlink to 755 to make the logs accessible by the FTP user
- $this->_exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"])."/log");
+ // Set Log symlink to 755 to make the logs accessible by the FTP user
+ $this->_exec("chmod 755 ".escapeshellcmd($data["new"]["document_root"])."/log");
- $command = 'usermod';
- $command .= ' --groups sshusers';
- $command .= ' '.escapeshellcmd($data['new']['system_user']);
- $this->_exec($command);
+ $command = 'usermod';
+ $command .= ' --groups sshusers';
+ $command .= ' '.escapeshellcmd($data['new']['system_user']);
+ $this->_exec($command);
- //* if we have a chrooted Apache environment
- if($apache_chrooted) {
- $this->_exec('chroot '.escapeshellcmd($web_config['website_basedir']).' '.$command);
+ //* if we have a chrooted Apache environment
+ if($apache_chrooted) {
+ $this->_exec('chroot '.escapeshellcmd($web_config['website_basedir']).' '.$command);
- //* add the apache user to the client group in the chroot environment
- $tmp_groupfile = $app->system->server_conf['group_datei'];
- $app->system->server_conf['group_datei'] = $web_config['website_basedir'].'/etc/group';
+ //* add the apache user to the client group in the chroot environment
+ $tmp_groupfile = $app->system->server_conf['group_datei'];
+ $app->system->server_conf['group_datei'] = $web_config['website_basedir'].'/etc/group';
+ $app->system->add_user_to_group($groupname, escapeshellcmd($web_config['user']));
+ $app->system->server_conf['group_datei'] = $tmp_groupfile;
+ unset($tmp_groupfile);
+ }
+
+ //* add the Apache user to the client group
$app->system->add_user_to_group($groupname, escapeshellcmd($web_config['user']));
- $app->system->server_conf['group_datei'] = $tmp_groupfile;
- unset($tmp_groupfile);
- }
+
+ //* Chown all default directories
+ $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']));
+ $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/cgi-bin'));
+ $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/log'));
+ $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/ssl'));
+ $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/tmp'));
+ $this->_exec('chown -R '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/web'));
- //* add the Apache user to the client group
- $app->system->add_user_to_group($groupname, escapeshellcmd($web_config['user']));
+ /*
+ * Workaround for jailkit: If jailkit is enabled for the site, the
+ * website root has to be owned by the root user and we have to chmod it to 755 then
+ */
- $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root']));
+ //* Check if there is a jailkit user for this site
+ $tmp = $app->db->queryOneRecord('SELECT count(shell_user_id) as number FROM shell_user WHERE parent_domain_id = '.$data['new']['domain_id']." AND chroot = 'jailkit'");
+ if($tmp['number'] > 0) {
+ $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root']));
+ $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']));
+ }
+ unset($tmp);
- /*
- * Workaround for jailkit: If jailkit is enabled for the site, the
- * website root has to be owned by the root user and we have to chmod it to 755 then
- */
+ // If the security Level is set to medium
+ } else {
- //* Check if there is a jailkit user for this site
- $tmp = $app->db->queryOneRecord('SELECT count(shell_user_id) as number FROM shell_user WHERE parent_domain_id = '.$data['new']['domain_id']." AND chroot = 'jailkit'");
- if($tmp['number'] > 0) {
$this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root']));
+ $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/cgi-bin'));
+ $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/log'));
+ $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/ssl'));
+ $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/web'));
+
+ // make temp directory writable for Apache and the website users
+ $this->_exec('chmod 777 '.escapeshellcmd($data['new']['document_root'].'/tmp'));
+
$this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']));
+ $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/cgi-bin'));
+ $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root'].'/log'));
+ $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/tmp'));
+ $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/ssl'));
+ $this->_exec('chown '.$username.':'.$groupname.' '.escapeshellcmd($data['new']['document_root'].'/web'));
}
- unset($tmp);
-
- // If the security Level is set to medium
- } else {
-
- $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root']));
- $this->_exec('chmod 755 '.escapeshellcmd($data['new']['document_root'].'/*'));
- $this->_exec('chown root:root '.escapeshellcmd($data['new']['document_root']));
-
- // make temp directory writable for Apache and the website users
- $this->_exec('chmod 777 '.escapeshellcmd($data['new']['document_root'].'/tmp'));
}
// Change the ownership of the error log to the owner of the website
@@ -636,7 +652,7 @@
if($master_php_ini_path != '' && substr($master_php_ini_path,-7) == 'php.ini' && is_file($master_php_ini_path)) {
$php_ini_content .= file_get_contents($master_php_ini_path)."\n";
}
- $php_ini_content .= trim($data['new']['custom_php_ini']);
+ $php_ini_content .= str_replace("\r",'',trim($data['new']['custom_php_ini']));
file_put_contents($custom_php_ini_dir.'/php.ini',$php_ini_content);
} else {
$has_custom_php_ini = false;
@@ -729,7 +745,7 @@
'rewrite_target_ssl' => $rewrite_target_ssl);
break;
case '*':
- $rewrite_rules[] = array( 'rewrite_domain' => $data['new']['domain'],
+ $rewrite_rules[] = array( 'rewrite_domain' => '(^|\.)'.$data['new']['domain'],
'rewrite_type' => ($data['new']['redirect_type'] == 'no')?'':'['.$data['new']['redirect_type'].']',
'rewrite_target' => $rewrite_target,
'rewrite_target_ssl' => $rewrite_target_ssl);
@@ -795,7 +811,7 @@
'rewrite_target_ssl' => $rewrite_target_ssl);
break;
case '*':
- $rewrite_rules[] = array( 'rewrite_domain' => $alias['domain'],
+ $rewrite_rules[] = array( 'rewrite_domain' => '(^|\.)'.$alias['domain'],
'rewrite_type' => ($alias['redirect_type'] == 'no')?'':'['.$alias['redirect_type'].']',
'rewrite_target' => $rewrite_target,
'rewrite_target_ssl' => $rewrite_target_ssl);
@@ -1050,6 +1066,11 @@
unlink($vhost_symlink);
$app->log('Removing symlink: '.$vhost_symlink.'->'.$vhost_file,LOGLEVEL_DEBUG);
}
+ $vhost_symlink = escapeshellcmd($web_config['vhost_conf_enabled_dir'].'/'.$data['old']['domain'].'.vhost');
+ if(is_link($vhost_symlink)) {
+ unlink($vhost_symlink);
+ $app->log('Removing symlink: '.$vhost_symlink.'->'.$vhost_file,LOGLEVEL_DEBUG);
+ }
$vhost_file = escapeshellcmd($web_config['vhost_conf_dir'].'/'.$data['old']['domain'].'.vhost');
unlink($vhost_file);
$app->log('Removing file: '.$vhost_file,LOGLEVEL_DEBUG);
@@ -1094,7 +1115,13 @@
if($apache_online_status_before_restart && !$apache_online_status_after_restart) {
$app->log('Apache did not restart after the configuration change for website '.$data['new']['domain'].' Reverting the configuration. Saved non-working config as '.$vhost_file.'.err',LOGLEVEL_WARN);
copy($vhost_file,$vhost_file.'.err');
- copy($vhost_file.'~',$vhost_file);
+ if(is_file($vhost_file.'~')) {
+ //* Copy back the last backup file
+ copy($vhost_file.'~',$vhost_file);
+ } else {
+ //* There is no backup file, so we create a empty vhost file with a warning message inside
+ file_put_contents($vhost_file,"# Apache did not start after modifying this vhost file.\n# Please check file $vhost_file.err for syntax errors.");
+ }
$app->services->restartService('httpd','restart');
}
} else {
@@ -1305,7 +1332,7 @@
if(substr($folder['path'],0,1) == '/') $folder['path'] = substr($folder['path'],1);
if(substr($folder['path'],-1) == '/') $folder['path'] = substr($folder['path'],0,-1);
$folder_path = escapeshellcmd($website['document_root'].'/web/'.$folder['path']);
- if(substr($folder_path,-1) != '/' && $folder['path'] != '') $folder_path .= '/';
+ if(substr($folder_path,-1) != '/') $folder_path .= '/';
//* Check if the resulting path is inside the docroot
if(stristr($folder_path,'..') || stristr($folder_path,'./') || stristr($folder_path,'\\')) {
@@ -1314,12 +1341,18 @@
}
//* Create the folder path, if it does not exist
- if(!is_dir($folder_path)) exec('mkdir -p '.$folder_path);
+ if(!is_dir($folder_path)) {
+ exec('mkdir -p '.$folder_path);
+ chown($folder_path,$website['system_user']);
+ chgrp($folder_path,$website['system_group']);
+ }
//* Create empty .htpasswd file, if it does not exist
if(!is_file($folder_path.'.htpasswd')) {
touch($folder_path.'.htpasswd');
chmod($folder_path.'.htpasswd',0755);
+ chown($folder_path.'.htpasswd',$website['system_user']);
+ chgrp($folder_path.'.htpasswd',$website['system_group']);
$app->log('Created file '.$folder_path.'.htpasswd',LOGLEVEL_DEBUG);
}
@@ -1357,7 +1390,9 @@
//if(!is_file($folder_path.'.htaccess')) {
$ht_file = "AuthType Basic\nAuthName \"Members Only\"\nAuthUserFile ".$folder_path.".htpasswd\nrequire valid-user";
file_put_contents($folder_path.'.htaccess',$ht_file);
- chmod($folder_path.'.htpasswd',0755);
+ chmod($folder_path.'.htaccess',0755);
+ chown($folder_path.'.htaccess',$website['system_user']);
+ chgrp($folder_path.'.htaccess',$website['system_group']);
$app->log('Created file '.$folder_path.'.htaccess',LOGLEVEL_DEBUG);
//}
@@ -1381,7 +1416,7 @@
if(substr($folder['path'],0,1) == '/') $folder['path'] = substr($folder['path'],1);
if(substr($folder['path'],-1) == '/') $folder['path'] = substr($folder['path'],0,-1);
$folder_path = realpath($website['document_root'].'/web/'.$folder['path']);
- if(substr($folder_path,-1) != '/' && $folder['path'] != '') $folder_path .= '/';
+ if(substr($folder_path,-1) != '/') $folder_path .= '/';
//* Check if the resulting path is inside the docroot
if(substr($folder_path,0,strlen($website['document_root'])) != $website['document_root']) {
@@ -1417,12 +1452,12 @@
if(substr($data['old']['path'],0,1) == '/') $data['old']['path'] = substr($data['old']['path'],1);
if(substr($data['old']['path'],-1) == '/') $data['old']['path'] = substr($data['old']['path'],0,-1);
$old_folder_path = realpath($website['document_root'].'/web/'.$data['old']['path']);
- if(substr($old_folder_path,-1) != '/' && $data['old']['path'] != '') $old_folder_path .= '/';
+ if(substr($old_folder_path,-1) != '/') $old_folder_path .= '/';
if(substr($data['new']['path'],0,1) == '/') $data['new']['path'] = substr($data['new']['path'],1);
if(substr($data['new']['path'],-1) == '/') $data['new']['path'] = substr($data['new']['path'],0,-1);
$new_folder_path = escapeshellcmd($website['document_root'].'/web/'.$data['new']['path']);
- if(substr($new_folder_path,-1) != '/' && $data['new']['path'] != '') $new_folder_path .= '/';
+ if(substr($new_folder_path,-1) != '/') $new_folder_path .= '/';
//* Check if the resulting path is inside the docroot
if(stristr($new_folder_path,'..') || stristr($new_folder_path,'./') || stristr($new_folder_path,'\\')) {
@@ -1469,7 +1504,9 @@
$ht_file = "AuthType Basic\nAuthName \"Members Only\"\nAuthUserFile ".$new_folder_path.".htpasswd\nrequire valid-user";
file_put_contents($new_folder_path.'.htaccess',$ht_file);
chmod($new_folder_path.'.htpasswd',0755);
- $app->log('Created file '.$new_folder_path.'.htaccess',LOGLEVEL_DEBUG);
+ chown($folder_path.'.htpasswd',$website['system_user']);
+ chgrp($folder_path.'.htpasswd',$website['system_group']);
+ $app->log('Created file '.$new_folder_path.'.htpasswd',LOGLEVEL_DEBUG);
}
//* Remove .htaccess file
@@ -1757,7 +1794,7 @@
$app->log('Created AWStats config file: '.$awstats_conf_dir.'/awstats.'.$data['new']['domain'].'.conf',LOGLEVEL_DEBUG);
}
- unlink($data['new']['document_root']."/web/stats/index.html");
+ if(is_file($data['new']['document_root']."/web/stats/index.html")) unlink($data['new']['document_root']."/web/stats/index.html");
copy("/usr/local/ispconfig/server/conf/awstats_index.php.master",$data['new']['document_root']."/web/stats/index.php");
}
--
Gitblit v1.9.1