From: ms Date: Sun, 19 Feb 2006 11:25:43 +0000 (+0000) Subject: Port 445 -> 444 gewechselt und XTAccess-Regeln ausgeschaltet. X-Git-Tag: v2.3-beta1~1209 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=35f994e98e3e00b252255ad8057aeabe277caf83;p=ipfire-2.x.git Port 445 -> 444 gewechselt und XTAccess-Regeln ausgeschaltet. Nach der Installation sind alle Ports geschlossen! git-svn-id: http://svn.ipfire.org/svn/ipfire/trunk@41 ea5c0bd1-69bd-2848-81d8-4f18e57aeed8 --- diff --git a/config/cfgroot/proxy-acl b/config/cfgroot/proxy-acl index ca1ccdfb2b..038f64d8f7 100644 --- a/config/cfgroot/proxy-acl +++ b/config/cfgroot/proxy-acl @@ -1,49 +1,49 @@ -# Do not modify '/var/ipcop/proxy/squid.conf' directly since any changes -# you make will be overwritten whenever you resave proxy settings using the -# web interface! Instead, modify the file '/var/ipcop/proxy/acl' and then -# restart squid using the web interface. Changes made to the 'acl' file -# will propagate to the 'squid.conf' file at that time. -# [Scott Tregear, 22 Feb 2005] - -# Uncomment the following line to enable logging of User-Agent header: -#useragent_log /var/log/squid/user_agent.log - -# Uncomment the following line to enable logging of Referer header: -#referer_log /var/log/squid/referer.log - -acl all src 0.0.0.0/0.0.0.0 -acl localhost src 127.0.0.1/255.255.255.255 -acl SSL_ports port 443 563 -acl Safe_ports port 80 # http -acl Safe_ports port 21 # ftp -acl Safe_ports port 443 563 # https, snews -acl Safe_ports port 70 # gopher -acl Safe_ports port 210 # wais -acl Safe_ports port 1025-65535 # unregistered ports -acl Safe_ports port 280 # http-mgmt -acl Safe_ports port 488 # gss-http -acl Safe_ports port 591 # filemaker -acl Safe_ports port 777 # multiling http -acl Safe_ports port __PROXY_PORT__ # Squid port (for icons) - -acl IPCop_http port 81 -acl IPCop_https port 445 -acl IPCop_ips dst __GREEN_IP__ __BLUE_IP__ -acl IPCop_networks src __GREEN_NET__ __BLUE_NET__ -acl CONNECT method CONNECT - -##Access to squid: -#local machine, no restriction -http_access allow localhost - -#GUI admin if local machine connects -http_access allow IPCop_ips IPCop_networks IPCop_http -http_access allow CONNECT IPCop_ips IPCop_networks IPCop_https - -#Deny not web services -http_access deny !Safe_ports -http_access deny CONNECT !SSL_ports - -#Finally allow IPCop_networks clients -http_access allow IPCop_networks -http_access deny all +# Do not modify '/var/ipcop/proxy/squid.conf' directly since any changes +# you make will be overwritten whenever you resave proxy settings using the +# web interface! Instead, modify the file '/var/ipcop/proxy/acl' and then +# restart squid using the web interface. Changes made to the 'acl' file +# will propagate to the 'squid.conf' file at that time. +# [Scott Tregear, 22 Feb 2005] + +# Uncomment the following line to enable logging of User-Agent header: +#useragent_log /var/log/squid/user_agent.log + +# Uncomment the following line to enable logging of Referer header: +#referer_log /var/log/squid/referer.log + +acl all src 0.0.0.0/0.0.0.0 +acl localhost src 127.0.0.1/255.255.255.255 +acl SSL_ports port 443 563 +acl Safe_ports port 80 # http +acl Safe_ports port 21 # ftp +acl Safe_ports port 443 563 # https, snews +acl Safe_ports port 70 # gopher +acl Safe_ports port 210 # wais +acl Safe_ports port 1025-65535 # unregistered ports +acl Safe_ports port 280 # http-mgmt +acl Safe_ports port 488 # gss-http +acl Safe_ports port 591 # filemaker +acl Safe_ports port 777 # multiling http +acl Safe_ports port __PROXY_PORT__ # Squid port (for icons) + +acl IPCop_http port 81 +acl IPCop_https port 444 +acl IPCop_ips dst __GREEN_IP__ __BLUE_IP__ +acl IPCop_networks src __GREEN_NET__ __BLUE_NET__ +acl CONNECT method CONNECT + +##Access to squid: +#local machine, no restriction +http_access allow localhost + +#GUI admin if local machine connects +http_access allow IPCop_ips IPCop_networks IPCop_http +http_access allow CONNECT IPCop_ips IPCop_networks IPCop_https + +#Deny not web services +http_access deny !Safe_ports +http_access deny CONNECT !SSL_ports + +#Finally allow IPCop_networks clients +http_access allow IPCop_networks +http_access deny all diff --git a/config/cfgroot/xtaccess-config b/config/cfgroot/xtaccess-config index 74019ef20d..69d4e164a8 100644 --- a/config/cfgroot/xtaccess-config +++ b/config/cfgroot/xtaccess-config @@ -1 +1 @@ -tcp,0.0.0.0/0,113,on,0.0.0.0 +tcp,0.0.0.0/0,113,off,0.0.0.0 diff --git a/config/httpd/httpd.conf b/config/httpd/httpd.conf index ad54da9051..11e5438d7d 100644 --- a/config/httpd/httpd.conf +++ b/config/httpd/httpd.conf @@ -1,149 +1,149 @@ -## -## httpd.conf -- Apache HTTP server configuration file -## -## $Id: httpd.conf,v 1.15.2.7 2005/04/16 11:40:15 rkerr Exp $ -## -ServerType standalone -ServerRoot /etc/httpd - -LockFile /var/lock/httpd.lock -PidFile /var/run/httpd.pid -ScoreBoardFile /var/run/httpd.scoreboard -Timeout 900 -KeepAlive On -MaxKeepAliveRequests 100 -KeepAliveTimeout 15 -MinSpareServers 1 -MaxSpareServers 2 -StartServers 2 -MaxClients 10 -MaxRequestsPerChild 100 -Port 81 -Listen 81 -Listen 445 -User nobody -Group nobody -ServerAdmin root@localhost -ServerTokens Prod -DocumentRoot /home/httpd/html -# Limit track/trace requests -RewriteEngine on -RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS) -RewriteRule .* - [F] - - - Options None - AllowOverride None - - - Options ExecCGI - AllowOverride None - Order allow,deny - Allow from all - - - AuthName "Restricted" - AuthType Basic - AuthUserFile CONFIG_ROOT/auth/users - require user admin - -ScriptAlias /cgi-bin/ /home/httpd/cgi-bin/ - - AllowOverride None - Options None - AuthName "Restricted" - AuthType Basic - AuthUserFile CONFIG_ROOT/auth/users - Require user admin - - Satisfy Any - Allow from All - - - Satisfy Any - Allow from All - - - Require user admin dial - - - - DirectoryIndex index.html index.htm index.shtml index.cgi - -AccessFileName .htaccess - - Order allow,deny - Deny from all - - - TypesConfig /etc/mime.types - -DefaultType text/plain - -HostnameLookups Off -ErrorLog /var/log/httpd/error_log -LogLevel warn -LogFormat "%h %l %u %t \"%r\" %>s %b" common -CustomLog /var/log/httpd/access_log common -ServerSignature Off -AddHandler cgi-script .cgi - - BrowserMatch "Mozilla/2" nokeepalive - BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0 - BrowserMatch "RealPlayer 4\.0" force-response-1.0 - BrowserMatch "Java/1\.0" force-response-1.0 - BrowserMatch "JDK/1\.0" force-response-1.0 - - -### -### SSL Configuration -### -AddType application/x-x509-ca-cert .crt -AddType application/x-pkcs7-crl .crl - -SSLPassPhraseDialog builtin -SSLSessionCache dbm:/var/log/httpd/ssl_scache -SSLSessionCacheTimeout 900 -SSLMutex file:/var/log/httpd/ssl_mutex -SSLRandomSeed startup builtin -SSLRandomSeed connect builtin -SSLLog /var/log/httpd/ssl_engine_log -SSLLogLevel info - - - RewriteEngine on - RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS) - RewriteRule .* - [F] - DocumentRoot /home/httpd/html - ServerAdmin root@localhost - ErrorLog /var/log/httpd/error_log - TransferLog /var/log/httpd/access_log - SSLEngine on - SSLProtocol all -SSLv2 - SSLCipherSuite ALL:!ADH:!EXPORT56:!eNULL:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP - SSLCertificateFile /etc/httpd/server.crt - SSLCertificateKeyFile /etc/httpd/server.key - - SSLOptions +StdEnvVars - - - SSLOptions +StdEnvVars - - SetEnv HOME /home/nobody - SetEnvIf User-Agent ".*MSIE.*" \ - nokeepalive ssl-unclean-shutdown \ - downgrade-1.0 force-response-1.0 - CustomLog /var/log/httpd/ssl_request_log \ - "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" - - - - Options None - AllowOverride None - AuthName "Restricted" - AuthType Basic - AuthUserFile /var/ipcop/auth/users - require user admin - - -include /etc/httpd/conf/hostname.conf +## +## httpd.conf -- Apache HTTP server configuration file +## +## $Id: httpd.conf,v 1.15.2.7 2005/04/16 11:40:15 rkerr Exp $ +## +ServerType standalone +ServerRoot /etc/httpd + +LockFile /var/lock/httpd.lock +PidFile /var/run/httpd.pid +ScoreBoardFile /var/run/httpd.scoreboard +Timeout 900 +KeepAlive On +MaxKeepAliveRequests 100 +KeepAliveTimeout 15 +MinSpareServers 1 +MaxSpareServers 2 +StartServers 2 +MaxClients 10 +MaxRequestsPerChild 100 +Port 81 +Listen 81 +Listen 444 +User nobody +Group nobody +ServerAdmin root@localhost +ServerTokens Prod +DocumentRoot /home/httpd/html +# Limit track/trace requests +RewriteEngine on +RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS) +RewriteRule .* - [F] + + + Options None + AllowOverride None + + + Options ExecCGI + AllowOverride None + Order allow,deny + Allow from all + + + AuthName "Restricted" + AuthType Basic + AuthUserFile CONFIG_ROOT/auth/users + require user admin + +ScriptAlias /cgi-bin/ /home/httpd/cgi-bin/ + + AllowOverride None + Options None + AuthName "Restricted" + AuthType Basic + AuthUserFile CONFIG_ROOT/auth/users + Require user admin + + Satisfy Any + Allow from All + + + Satisfy Any + Allow from All + + + Require user admin dial + + + + DirectoryIndex index.html index.htm index.shtml index.cgi + +AccessFileName .htaccess + + Order allow,deny + Deny from all + + + TypesConfig /etc/mime.types + +DefaultType text/plain + +HostnameLookups Off +ErrorLog /var/log/httpd/error_log +LogLevel warn +LogFormat "%h %l %u %t \"%r\" %>s %b" common +CustomLog /var/log/httpd/access_log common +ServerSignature Off +AddHandler cgi-script .cgi + + BrowserMatch "Mozilla/2" nokeepalive + BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0 + BrowserMatch "RealPlayer 4\.0" force-response-1.0 + BrowserMatch "Java/1\.0" force-response-1.0 + BrowserMatch "JDK/1\.0" force-response-1.0 + + +### +### SSL Configuration +### +AddType application/x-x509-ca-cert .crt +AddType application/x-pkcs7-crl .crl + +SSLPassPhraseDialog builtin +SSLSessionCache dbm:/var/log/httpd/ssl_scache +SSLSessionCacheTimeout 900 +SSLMutex file:/var/log/httpd/ssl_mutex +SSLRandomSeed startup builtin +SSLRandomSeed connect builtin +SSLLog /var/log/httpd/ssl_engine_log +SSLLogLevel info + + + RewriteEngine on + RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS) + RewriteRule .* - [F] + DocumentRoot /home/httpd/html + ServerAdmin root@localhost + ErrorLog /var/log/httpd/error_log + TransferLog /var/log/httpd/access_log + SSLEngine on + SSLProtocol all -SSLv2 + SSLCipherSuite ALL:!ADH:!EXPORT56:!eNULL:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW:+EXP + SSLCertificateFile /etc/httpd/server.crt + SSLCertificateKeyFile /etc/httpd/server.key + + SSLOptions +StdEnvVars + + + SSLOptions +StdEnvVars + + SetEnv HOME /home/nobody + SetEnvIf User-Agent ".*MSIE.*" \ + nokeepalive ssl-unclean-shutdown \ + downgrade-1.0 force-response-1.0 + CustomLog /var/log/httpd/ssl_request_log \ + "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" + + + + Options None + AllowOverride None + AuthName "Restricted" + AuthType Basic + AuthUserFile /var/ipcop/auth/users + require user admin + + +include /etc/httpd/conf/hostname.conf diff --git a/html/cgi-bin/portfw.cgi b/html/cgi-bin/portfw.cgi index bfa9e99e71..ca626f8b08 100644 --- a/html/cgi-bin/portfw.cgi +++ b/html/cgi-bin/portfw.cgi @@ -1040,7 +1040,7 @@ sub disallowreserved { # port 67 and 68 same for tcp and udp, don't bother putting in an array my $msg = ""; - my @tcp_reserved = (81,222,445); + my @tcp_reserved = (81,222,444); my $prt = $_[0]; # the port or range my $ryn = $_[1]; # tells us whether or not it is a port range my $prot = $_[2]; # protocol