diff --git a/install/lib/installer_base.lib.php b/install/lib/installer_base.lib.php index 5309c91dcac1f8460edd3c131d4158848a6d0404..eee1f811a71001acf96ea41e865dc219880fca5e 100644 --- a/install/lib/installer_base.lib.php +++ b/install/lib/installer_base.lib.php @@ -1752,6 +1752,31 @@ class installer_base { exec($this->getinitcommand($conf['xmpp']['init_script'], 'restart')); } + public function make_defaultvhost_ssl_cert() { + global $conf,$autoinstall; + + $install_dir = $conf['ispconfig_install_dir']; + + $ssl_crt_file = $install_dir.'/interface/ssl/defaultvhost.crt'; + $ssl_csr_file = $install_dir.'/interface/ssl/defaultvhost.csr'; + $ssl_key_file = $install_dir.'/interface/ssl/defaultvhost.key'; + + if(!@is_dir($install_dir.'/interface/ssl')) mkdir($install_dir.'/interface/ssl', 0755, true); + + echo "Creating Self-Signed certificate for Apache default vHost\n"; + + $ssl_pw = substr(md5(mt_rand()), 0, 6); + exec("openssl genrsa -des3 -passout pass:$ssl_pw -out $ssl_key_file 4096"); + //We do not use * as CN as if someone trusts this certificate globally else this would be a miuch too big security issue + exec("openssl req -new -passin pass:$ssl_pw -passout pass:$ssl_pw -subj '/C=XX/ST=XX/L=XX/O=Not a real Certificate/OU=Only issued for displaying errors/CN=ISPConfig Dummy Certificate' -key $ssl_key_file -out $ssl_csr_file"); + exec("openssl req -x509 -passin pass:$ssl_pw -passout pass:$ssl_pw -key $ssl_key_file -in $ssl_csr_file -out $ssl_crt_file -days 36500"); + exec("openssl rsa -passin pass:$ssl_pw -in $ssl_key_file -out $ssl_key_file.insecure"); + rename($ssl_key_file, $ssl_key_file.'.secure'); + rename($ssl_key_file.'.insecure', $ssl_key_file); + + exec('chown -R root:root '.$install_dir.'/interface/ssl'); + + } public function configure_apache() { global $conf; @@ -1838,6 +1863,12 @@ class installer_base { wf($vhost_conf_dir.'/ispconfig.conf', $tpl->grab()); unset($tpl); + + if (!@is_dir('/var/www/default')) mkdir('/var/www/default/'); + if (!@file_exists('/usr/local/ispconfig/interface/ssl/defaultvhost.crt')) $this->make_defaultvhost_ssl_cert(); //Clients should never see this page and if they do there will always be an error so there is no reason to refresh the certificate. This is just for falback access to default vHost... + $tpl = new tpl('apache_defaultindex.html.master'); + wf('/var/www/default/ispconfig.html', $tpl->grab()); + unset($tpl); if(!@is_link($vhost_conf_enabled_dir.'/000-ispconfig.conf')) { symlink($vhost_conf_dir.'/ispconfig.conf', $vhost_conf_enabled_dir.'/000-ispconfig.conf'); @@ -2210,7 +2241,7 @@ class installer_base { rename($ssl_key_file, $ssl_key_file.'.secure'); rename($ssl_key_file.'.insecure', $ssl_key_file); - exec('chown -R root:root /usr/local/ispconfig/interface/ssl'); + exec('chown -R root:root '.$install_dir.'/interface/ssl'); } diff --git a/install/tpl/apache_defaultindex.html.master b/install/tpl/apache_defaultindex.html.master new file mode 100644 index 0000000000000000000000000000000000000000..f7732c2a88fbb046e322dc46a18653fb416e3b46 --- /dev/null +++ b/install/tpl/apache_defaultindex.html.master @@ -0,0 +1,91 @@ + + + + + + + + + + + + + + + + + + + + + + + Welcome! + + + + + +
+ +
+

Oops!

+

The domain name you tried to access is registered and points to a server which is managed using ISPConfig

+

If this is your domain you have to log in to ISPConfig and configure a Website for this domain.

+

If you need some assistance feel free to contact our support.

+
+ +
+ + \ No newline at end of file diff --git a/install/tpl/apache_ispconfig.conf.master b/install/tpl/apache_ispconfig.conf.master index c6a3b651a8e36a209805ea2faa83027d6050c105..f1c428af741827465c1da58bde0c2c2aa6ae03df 100644 --- a/install/tpl/apache_ispconfig.conf.master +++ b/install/tpl/apache_ispconfig.conf.master @@ -144,3 +144,33 @@ NameVirtualHost *:443 NameVirtualHost {tmpl_var name="ip_address"}:{tmpl_var name="port"} + + +################################################ +# ISPConfig default vHosts +################################################ + + + ServerAdmin webmaster@localhost + + + # This will always cause a cert error to clients so we simply try to redirect to http afterwards - so the visitor will eighter see the website in http + # or see an error stating the website is not known. Worst case - if something is wrong with the web config clients will se an infinite + # redirect error (is http->https is active and SSL is inactive or non-functional) + SSLEngine on + SSLCertificateFile /usr/local/ispconfig/interface/ssl/defaultvhost.crt + SSLCertificateKeyFile /usr/local/ispconfig/interface/ssl/defaultvhost.key + + RewriteEngine On + RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R=303,L] + + + DocumentRoot /var/www/default + DirectoryIndex index.php index.html ispconfig.html + + + ErrorLog ${APACHE_LOG_DIR}/default-error.log + CustomLog ${APACHE_LOG_DIR}/default-access.log combined + + +