mirror of
https://salsa.debian.org/freeipa-team/freeipa.git
synced 2025-02-25 18:55:28 -06:00
ec73de969f
AJP implementation in Tomcat is vulnerable to CVE-2020-1938 if used without shared secret. Set up a shared secret between localhost connector and Apache mod_proxy_ajp pass-through. For existing secured AJP pass-through make sure the option used for configuration on the tomcat side is up to date. Tomcat 9.0.31.0 deprecated 'requiredSecret' option name in favor of 'secret'. Details can be found at https://tomcat.apache.org/migration-9.html#Upgrading_9.0.x Fixes: https://pagure.io/freeipa/issue/8221 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> Reviewed-By: Florence Blanc-Renaud <flo@redhat.com> Reviewed-By: Rob Crittenden <rcritten@redhat.com>
47 lines
2.8 KiB
Plaintext
47 lines
2.8 KiB
Plaintext
# VERSION 14 - DO NOT REMOVE THIS LINE
|
|
|
|
ProxyRequests Off
|
|
|
|
# matches for ee port
|
|
<LocationMatch "^/ca/ee/ca/checkRequest|^/ca/ee/ca/getCertChain|^/ca/ee/ca/getTokenInfo|^/ca/ee/ca/tokenAuthenticate|^/ca/ocsp|^/ca/ee/ca/updateNumberRange|^/ca/ee/ca/getCRL|^/ca/ee/ca/profileSubmit">
|
|
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
|
|
SSLVerifyClient none
|
|
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET
|
|
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
|
|
</LocationMatch>
|
|
|
|
# matches for admin port and installer
|
|
<LocationMatch "^/ca/admin/ca/getCertChain|^/ca/admin/ca/getConfigEntries|^/ca/admin/ca/getCookie|^/ca/admin/ca/getStatus|^/ca/admin/ca/securityDomainLogin|^/ca/admin/ca/getDomainXML|^/ca/admin/ca/updateNumberRange|^/ca/admin/ca/tokenAuthenticate|^/ca/admin/ca/updateNumberRange|^/ca/admin/ca/updateDomainXML|^/ca/admin/ca/updateConnector|^/ca/admin/ca/getSubsystemCert|^/kra/admin/kra/updateNumberRange|^/kra/admin/kra/getConfigEntries">
|
|
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
|
|
SSLVerifyClient none
|
|
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET
|
|
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
|
|
</LocationMatch>
|
|
|
|
# matches for agent port and eeca port
|
|
<LocationMatch "^/ca/agent/ca/displayBySerial|^/ca/agent/ca/doRevoke|^/ca/agent/ca/doUnrevoke|^/ca/agent/ca/updateDomainXML|^/ca/eeca/ca/profileSubmitSSLClient|^/kra/agent/kra/connector">
|
|
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
|
|
SSLVerifyClient require
|
|
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET
|
|
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
|
|
</LocationMatch>
|
|
|
|
# matches for CA REST API
|
|
<LocationMatch "^/ca/rest/account/login|^/ca/rest/account/logout|^/ca/rest/installer/installToken|^/ca/rest/securityDomain/domainInfo|^/ca/rest/securityDomain/installToken|^/ca/rest/profiles|^/ca/rest/authorities|^/ca/rest/certrequests|^/ca/rest/admin/kraconnector/remove|^/ca/rest/certs/search">
|
|
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
|
|
SSLVerifyClient optional
|
|
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET
|
|
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
|
|
</LocationMatch>
|
|
|
|
# matches for KRA REST API
|
|
<LocationMatch "^/kra/rest/config/cert/transport|^/kra/rest/account|^/kra/rest/agent/keyrequests|^/kra/rest/agent/keys">
|
|
SSLOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
|
|
SSLVerifyClient optional
|
|
ProxyPassMatch ajp://localhost:$DOGTAG_PORT $DOGTAG_AJP_SECRET
|
|
ProxyPassReverse ajp://localhost:$DOGTAG_PORT
|
|
</LocationMatch>
|
|
|
|
# Only enable this on servers that are not generating a CRL
|
|
${CLONE}RewriteRule ^/ipa/crl/MasterCRL.bin http://$FQDN/ca/ee/ca/getCRL?op=getCRL&crlIssuingPoint=MasterCRL [L,R=301,NC]
|