IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

Fix HTTPD SSL configuration for Debian.

Browse Source 
The site and module configs are split on Debian, server setup needs
to match that.

Fixes: https://pagure.io/freeipa/issue/7554
Reviewed-By: Stanislav Laznicka <slaznick@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
This commit is contained in:
Timo Aaltonen
2018-05-21 13:46:42 +03:00
committed by Christian Heimes
parent ffdb20aeb3
commit 8c0d7bb92f
7 changed files with 28 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
ipaserver/install/httpinstance.py
View File

@@ -214,6 +214,7 @@ class HTTPInstance(service.Service):
def backup_ssl_conf(self):
self.fstore.backup_file(paths.HTTPD_SSL_CONF)
self.fstore.backup_file(paths.HTTPD_SSL_SITE_CONF)
def disable_nss_conf(self):
"""
@@ -235,12 +236,7 @@ class HTTPInstance(service.Service):
'+TLSv1 +TLSv1.1 +TLSv1.2', False)
def set_mod_ssl_logdir(self):
installutils.set_directive(paths.HTTPD_SSL_CONF,
'ErrorLog',
'logs/error_log', False)
installutils.set_directive(paths.HTTPD_SSL_CONF,
'TransferLog',
'logs/access_log', False)
tasks.setup_httpd_logging()
def disable_mod_ssl_ocsp(self):
if sysupgrade.get_upgrade_state('http', OCSP_ENABLED) is None:
@@ -272,14 +268,14 @@ class HTTPInstance(service.Service):
def __add_include(self):
"""This should run after __set_mod_nss_port so is already backed up"""
if installutils.update_file(paths.HTTPD_SSL_CONF,
if installutils.update_file(paths.HTTPD_SSL_SITE_CONF,
'</VirtualHost>',
'Include {path}\n'
'</VirtualHost>'.format(
path=paths.HTTPD_IPA_REWRITE_CONF)
) != 0:
self.print_msg("Adding Include conf.d/ipa-rewrite to "
"%s failed." % paths.HTTPD_SSL_CONF)
"%s failed." % paths.HTTPD_SSL_SITE_CONF)
def configure_certmonger_renewal_guard(self):
certmonger = services.knownservices.certmonger
@@ -404,10 +400,10 @@ class HTTPInstance(service.Service):
def configure_mod_ssl_certs(self):
"""Configure the mod_ssl certificate directives"""
installutils.set_directive(paths.HTTPD_SSL_CONF,
installutils.set_directive(paths.HTTPD_SSL_SITE_CONF,
'SSLCertificateFile',
paths.HTTPD_CERT_FILE, False)
installutils.set_directive(paths.HTTPD_SSL_CONF,
installutils.set_directive(paths.HTTPD_SSL_SITE_CONF,
'SSLCertificateKeyFile',
paths.HTTPD_KEY_FILE, False)
installutils.set_directive(
@@ -415,7 +411,7 @@ class HTTPInstance(service.Service):
'SSLPassPhraseDialog',
'exec:{passread}'.format(passread=paths.IPA_HTTPD_PASSWD_READER),
False)
installutils.set_directive(paths.HTTPD_SSL_CONF,
installutils.set_directive(paths.HTTPD_SSL_SITE_CONF,
'SSLCACertificateFile',
paths.IPA_CA_CRT, False)
# set SSLVerifyDepth for external CA installations
@@ -512,7 +508,7 @@ class HTTPInstance(service.Service):
'external-helper', helper)
for f in [paths.HTTPD_IPA_CONF, paths.HTTPD_SSL_CONF,
paths.HTTPD_NSS_CONF]:
paths.HTTPD_SSL_SITE_CONF, paths.HTTPD_NSS_CONF]:
try:
self.fstore.restore_file(f)
except ValueError as error:

1
ipaserver/install/ipa_backup.py
View File

@@ -148,6 +148,7 @@ class Backup(admintool.AdminTool):
paths.HTTPD_IPA_PKI_PROXY_CONF,
paths.HTTPD_IPA_REWRITE_CONF,
paths.HTTPD_SSL_CONF,
paths.HTTPD_SSL_SITE_CONF,
paths.HTTPD_CERT_FILE,
paths.HTTPD_KEY_FILE,
paths.HTTPD_IPA_CONF,