blob: b522596512564676571740bea28921e4f450ed04 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
#!/bin/bash
declare -rg PUBLIC_BOTH="/etc/lighttpd/server.pem"
declare -rg DHPARAM="/etc/lighttpd/dhparam.pem"
declare -rg REDIR_FLAG="/etc/lighttpd/redirect.flag"
declare -rg INTERNAL_BOTH="/etc/ssl/openslx/lighttpd/server.pem"
if ! [ -s "$DHPARAM" ]; then
curl -sS -m 10 "https://ssl-config.mozilla.org/ffdhe2048.txt" > "$DHPARAM"
fi
if ! openssl dhparam -noout -in "$DHPARAM" >&2; then
rm -f -- "$DHPARAM"
fi
if ! [ -s "$DHPARAM" ] && ! ps aux | grep 'openssl dhparam' | grep -q -v grep; then
openssl dhparam -out "$DHPARAM" 2048 &>/dev/null &
fi
/opt/openslx/slx-cert >&2 &
wait
if ! openssl dhparam -noout -in "$DHPARAM" >&2; then
rm -f -- "$DHPARAM"
fi
if [ -f "/usr/lib/lighttpd/mod_openssl.so" ]; then
echo 'server.modules += ( "mod_openssl" )'
fi
debian="$( lsb_release -sr )"
debian="${debian%%.*}"
cat <<HEREDOC
\$SERVER["socket"] == ":443" {
protocol = "https://"
ssl.engine = "enable"
ssl.disable-client-renegotiation = "enable"
HEREDOC
if (( debian == 9 )); then
cat <<HEREDOC
ssl.use-sslv2 = "disable"
ssl.use-sslv3 = "disable"
ssl.honor-cipher-order = "disable"
ssl.cipher-list = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"
HEREDOC
elif (( debian == 10 )); then
cat <<HEREDOC
ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.2", "Options" => "-SessionTicket")
ssl.honor-cipher-order = "disable"
ssl.cipher-list = "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305"
HEREDOC
else # if (( debian >= 11 )); then
cat <<HEREDOC
ssl.openssl.ssl-conf-cmd = ("MinProtocol" => "TLSv1.2")
ssl.openssl.ssl-conf-cmd += ("Options" => "-ServerPreference")
ssl.openssl.ssl-conf-cmd += ("CipherString" => "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305")
HEREDOC
fi
echo " # pemfile is cert+privkey, ca-file is the intermediate chain in one file"
if [ -s "$PUBLIC_BOTH" ]; then
echo " ssl.pemfile = \"${PUBLIC_BOTH}\""
elif [ -s "$INTERNAL_BOTH" ]; then
echo " ssl.pemfile = \"${INTERNAL_BOTH}\""
fi
[ -s "$DHPARAM" ] && echo " ssl.dh-file = \"${DHPARAM}\""
# VHost for server.bwlehrpool
if [ -s "${INTERNAL_BOTH}" ]; then
cat <<HEREDOC
\$HTTP["host"] == "satellite.bwlehrpool" {
ssl.pemfile = "${INTERNAL_BOTH}"
}
HEREDOC
#
fi
echo "}" # End main block
[ -f "$REDIR_FLAG" ] && cat <<"HEREDOC"
$HTTP["scheme"] == "http" {
# capture vhost name with regex condition -> %0 in redirect pattern
# must be the most inner block to the redirect rule
$HTTP["host"] =~ ".*" {
url.redirect = ( "^/slx-admin/($|\?|index.php).*" => "https://%0$0" )
url.redirect-code = 302
}
}
HEREDOC
exit 0
|
