From e3fa19dfdea4974be622b4e68589d17164390be9 Mon Sep 17 00:00:00 2001 From: Zoran Pericic Date: Wed, 2 Jun 2021 17:24:34 +0200 Subject: [PATCH] ipaserver: Use apache VirtualHost for IPA UI --- install/share/Makefile.am | 1 + install/share/ipa-vhost.conf.template | 50 +++++++++++++++++++++++++++ install/share/ipa.conf.template | 8 ----- ipaplatform/base/paths.py | 10 +++--- ipaplatform/debian/paths.py | 10 +++--- ipaplatform/suse/paths.py | 10 +++--- ipaserver/install/httpinstance.py | 43 +++++++++++++++-------- ipaserver/install/ipa_backup.py | 1 + ipaserver/install/server/upgrade.py | 13 ++++++- 9 files changed, 111 insertions(+), 35 deletions(-) create mode 100644 install/share/ipa-vhost.conf.template diff --git a/install/share/Makefile.am b/install/share/Makefile.am index e0fe4b7d1..eca50c5fd 100644 --- a/install/share/Makefile.am +++ b/install/share/Makefile.am @@ -101,6 +101,7 @@ dist_app_DATA = \ ipa-kdc-proxy.conf.template \ ipa-pki-proxy.conf.template \ ipa-rewrite.conf.template \ + ipa-vhost.conf.template \ ipaca_default.ini \ ipaca_customize.ini \ ipaca_softhsm2.ini \ diff --git a/install/share/ipa-vhost.conf.template b/install/share/ipa-vhost.conf.template new file mode 100644 index 000000000..eb1e07e2a --- /dev/null +++ b/install/share/ipa-vhost.conf.template @@ -0,0 +1,50 @@ +# +# VERSION 32 - DO NOT REMOVE THIS LINE +# +# This file may be overwritten on upgrades. +# + +# FIXME: WSGISocketPrefix is a server-scope directive. The mod_wsgi package +# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf: +WSGISocketPrefix $WSGI_PREFIX_DIR + +# Configure mod_wsgi handler for /ipa +WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \ + user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \ + lang=C.UTF-8 locale=C.UTF-8 + + + ServerName $FQDN + ServerAlias ipa-ca.$DOMAIN + + # Logging + CustomLog /var/log/httpd/ipa-access.log combined + ErrorLog /var/log/httpd/ipa-error.log + + IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF + Include $HTTPD_IPA_REWRITE_CONF + Include $HTTPD_IPA_CONF + + +# the below section is only need if you have above 3 lines and want SSL + + ServerName $FQDN + ServerAlias ipa-ca.$DOMAIN + + # Logging + CustomLog /var/log/httpd/ipa-access.log combined + ErrorLog /var/log/httpd/ipa-error.log + + # SSL + SSLEngine on + SSLCertificateFile $HTTPD_CERT_FILE + SSLCertificateKeyFile $HTTPD_KEY_FILE + SSLCACertificateFile $IPA_CA_CRT + SSLVerifyDepth $MOD_SSL_VERIFY_DEPTH + + # FreeIPA + IncludeOptional $HTTPD_IPA_KDCPROXY_CONF_SYMLINK + IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF + Include $HTTPD_IPA_REWRITE_CONF + Include $HTTPD_IPA_CONF + diff --git a/install/share/ipa.conf.template b/install/share/ipa.conf.template index e68ced258..302ac9940 100644 --- a/install/share/ipa.conf.template +++ b/install/share/ipa.conf.template @@ -35,19 +35,11 @@ AddOutputFilterByType DEFLATE text/html text/plain text/xml \ application/javascript application/json text/css \ application/x-font-ttf -# FIXME: WSGISocketPrefix is a server-scope directive. The mod_wsgi package -# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf: -WSGISocketPrefix $WSGI_PREFIX_DIR - # Configure mod_wsgi handler for /ipa -WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \ - user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \ - lang=C.UTF-8 locale=C.UTF-8 WSGIScriptAlias /ipa /usr/share/ipa/wsgi.py process-group=ipa \ application-group=%{GLOBAL} WSGIScriptReloading Off - # Turn off mod_msgi handler for errors, config, crl: SetHandler None diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py index 729a66a62..de6b94ca9 100644 --- a/ipaplatform/base/paths.py +++ b/ipaplatform/base/paths.py @@ -45,11 +45,13 @@ class BasePathNamespace: GSSAPI_SESSION_KEY = "/etc/httpd/alias/ipasession.key" OLD_KRA_AGENT_PEM = "/etc/httpd/alias/kra-agent.pem" HTTPD_CONF_D_DIR = "/etc/httpd/conf.d/" + HTTPD_IPA_DIR = "/etc/httpd/ipa" HTTPD_IPA_KDCPROXY_CONF = "/etc/ipa/kdcproxy/ipa-kdc-proxy.conf" - HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/conf.d/ipa-kdc-proxy.conf" - HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/conf.d/ipa-pki-proxy.conf" - HTTPD_IPA_REWRITE_CONF = "/etc/httpd/conf.d/ipa-rewrite.conf" - HTTPD_IPA_CONF = "/etc/httpd/conf.d/ipa.conf" + HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/ipa/ipa-kdc-proxy.conf" + HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/ipa/ipa-pki-proxy.conf" + HTTPD_IPA_REWRITE_CONF = "/etc/httpd/ipa/ipa-rewrite.conf" + HTTPD_IPA_CONF = "/etc/httpd/ipa/ipa.conf" + HTTPD_IPA_SITE_CONF = "/etc/httpd/conf.d/ipa-vhost.conf" HTTPD_NSS_CONF = "/etc/httpd/conf.d/nss.conf" HTTPD_SSL_CONF = "/etc/httpd/conf.d/ssl.conf" HTTPD_SSL_SITE_CONF = "/etc/httpd/conf.d/ssl.conf" diff --git a/ipaplatform/debian/paths.py b/ipaplatform/debian/paths.py index 8ac18d29c..e90e6e141 100644 --- a/ipaplatform/debian/paths.py +++ b/ipaplatform/debian/paths.py @@ -20,10 +20,12 @@ class DebianPathNamespace(BasePathNamespace): ETC_HTTPD_DIR = "/etc/apache2" HTTPD_ALIAS_DIR = "/etc/apache2/ipa" HTTPD_CONF_D_DIR = "/etc/apache2/conf-enabled/" - HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf-enabled/ipa-kdc-proxy.conf" - HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf-enabled/ipa-pki-proxy.conf" - HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf-available/ipa-rewrite.conf" - HTTPD_IPA_CONF = "/etc/apache2/conf-enabled/ipa.conf" + HTTPD_IPA_DIR = "/etc/apache2/ipa/" + HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/ipa/ipa-kdc-proxy.conf" + HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/ipa/ipa-pki-proxy.conf" + HTTPD_IPA_REWRITE_CONF = "/etc/apache2/ipa/ipa-rewrite.conf" + HTTPD_IPA_CONF = "/etc/apache2/ipa/ipa.conf" + HTTPD_IPA_SITE_CONF = "/etc/apache2/sites-available/ipa.conf" HTTPD_NSS_CONF = "/etc/apache2/mods-available/nss.conf" HTTPD_SSL_CONF = "/etc/apache2/mods-available/ssl.conf" HTTPD_SSL_SITE_CONF = "/etc/apache2/sites-available/default-ssl.conf" diff --git a/ipaplatform/suse/paths.py b/ipaplatform/suse/paths.py index cf0fe6a9f..7d21ee147 100644 --- a/ipaplatform/suse/paths.py +++ b/ipaplatform/suse/paths.py @@ -17,10 +17,12 @@ class SusePathNamespace(BasePathNamespace): HTTPD_ALIAS_DIR = "/etc/apache2/ipa" GSSAPI_SESSION_KEY = "/etc/apache2/ipa/ipasession.key" HTTPD_CONF_D_DIR = "/etc/apache2/conf.d/" - HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf.d/ipa-kdc-proxy.conf" - HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf.d/ipa-pki-proxy.conf" - HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf.d/ipa-rewrite.conf" - HTTPD_IPA_CONF = "/etc/apache2/conf.d/ipa.conf" + HTTPD_IPA_DIR = "/etc/apache2/ipa/" + HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/ipa/ipa-kdc-proxy.conf" + HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/ipa/ipa-pki-proxy.conf" + HTTPD_IPA_REWRITE_CONF = "/etc/apache2/ipa/ipa-rewrite.conf" + HTTPD_IPA_CONF = "/etc/apache2/ipa/ipa.conf" + HTTPD_IPA_SITE_CONF = "/etc/apache2/conf.d/ipa-vhost.conf" HTTPD_NSS_CONF = "/etc/apache2/conf.d/nss.conf" HTTPD_SSL_CONF = "/etc/apache2/conf.d/ssl.conf" HTTPD_SSL_SITE_CONF = "/etc/apache2/conf.d/ssl.conf" diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py index 50ccf5e50..313866e31 100644 --- a/ipaserver/install/httpinstance.py +++ b/ipaserver/install/httpinstance.py @@ -112,6 +112,14 @@ class HTTPInstance(service.Service): IPA_CCACHES=paths.IPA_CCACHES, WSGI_PREFIX_DIR=paths.WSGI_PREFIX_DIR, WSGI_PROCESSES=constants.WSGI_PROCESSES, + HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK, + HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF, + HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF, + HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF, + HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE, + HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE, + IPA_CA_CRT=paths.IPA_CA_CRT, + MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH, ) self.ca_file = ca_file if ca_is_configured is not None: @@ -129,7 +137,6 @@ class HTTPInstance(service.Service): self.step("configuring mod_ssl log directory", self.set_mod_ssl_logdir) self.step("disabling mod_ssl OCSP", self.disable_mod_ssl_ocsp) - self.step("adding URL rewriting rules", self.__add_include) self.step("configuring httpd", self.__configure_http) self.step("setting up httpd keytab", self.request_service_keytab) self.step("configuring Gssproxy", self.configure_gssproxy) @@ -198,6 +205,14 @@ class HTTPInstance(service.Service): # https://pagure.io/freeipa/issue/7662 tasks.restore_context(session_dir) + # create /etc/httpd/ipa + if not os.path.isdir(paths.HTTPD_IPA_DIR): + os.makedirs(paths.HTTPD_IPA_DIR) + # Must be world-readable / executable + os.chmod(paths.HTTPD_IPA_DIR, 0o755) + # Restore SELinux context of /etc/httpd/ipa + tasks.restore_context(paths.HTTPD_IPA_DIR) + target_fname = paths.HTTPD_IPA_CONF http_txt = ipautil.template_file( os.path.join(paths.USR_SHARE_IPA_DIR, @@ -209,6 +224,17 @@ class HTTPInstance(service.Service): http_fd.close() os.chmod(target_fname, 0o644) + target_fname = paths.HTTPD_IPA_SITE_CONF + http_txt = ipautil.template_file( + os.path.join(paths.USR_SHARE_IPA_DIR, + "ipa-vhost.conf.template"), + self.sub_dict) + self.fstore.backup_file(paths.HTTPD_IPA_SITE_CONF) + http_fd = open(target_fname, "w") + http_fd.write(http_txt) + http_fd.close() + os.chmod(target_fname, 0o644) + target_fname = paths.HTTPD_IPA_REWRITE_CONF http_txt = ipautil.template_file( os.path.join(paths.USR_SHARE_IPA_DIR, @@ -286,17 +312,6 @@ class HTTPInstance(service.Service): aug.set(ocsp_comment, '{} {}'.format(OCSP_DIRECTIVE, ocsp_state)) aug.save() - def __add_include(self): - """This should run after __set_mod_nss_port so is already backed up""" - if installutils.update_file(paths.HTTPD_SSL_SITE_CONF, - '', - 'Include {path}\n' - ''.format( - path=paths.HTTPD_IPA_REWRITE_CONF) - ) != 0: - self.print_msg("Adding Include conf.d/ipa-rewrite to " - "%s failed." % paths.HTTPD_SSL_SITE_CONF) - def configure_certmonger_renewal_guard(self): certmonger = services.knownservices.certmonger certmonger_stopped = not certmonger.is_running() @@ -554,13 +569,14 @@ class HTTPInstance(service.Service): paths.HTTPD_PASSWD_FILE_FMT.format(host=api.env.host), paths.HTTPD_IPA_REWRITE_CONF, paths.HTTPD_IPA_CONF, + paths.HTTPD_IPA_SITE_CONF, paths.HTTPD_IPA_PKI_PROXY_CONF, paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK, paths.HTTPD_IPA_KDCPROXY_CONF, paths.GSSPROXY_CONF, paths.GSSAPI_SESSION_KEY, paths.HTTPD_PASSWORD_CONF, - paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF, + paths.SYSTEMD_SYSTEM_HTTPD_IPA_CONF ] # NSS DB backups remove_files.extend( @@ -672,7 +688,6 @@ class HTTPInstance(service.Service): self.configure_mod_ssl_certs() self.set_mod_ssl_protocol() self.set_mod_ssl_logdir() - self.__add_include() self.cert = x509.load_certificate_from_file(paths.HTTPD_CERT_FILE) diff --git a/ipaserver/install/ipa_backup.py b/ipaserver/install/ipa_backup.py index 2904c9e2e..716dd2fe3 100644 --- a/ipaserver/install/ipa_backup.py +++ b/ipaserver/install/ipa_backup.py @@ -154,6 +154,7 @@ class Backup(admintool.AdminTool): paths.HTTPD_CERT_FILE, paths.HTTPD_KEY_FILE, paths.HTTPD_IPA_CONF, + paths.HTTPD_IPA_SITE_CONF, paths.SSHD_CONFIG, paths.SSHD_IPA_CONFIG, paths.SSH_CONFIG, diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py index 757d20dc4..bfe20f00a 100644 --- a/ipaserver/install/server/upgrade.py +++ b/ipaserver/install/server/upgrade.py @@ -20,7 +20,7 @@ from contextlib import contextmanager from augeas import Augeas from ipalib import api, x509 -from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD +from ipalib.constants import RENEWAL_CA_NAME, RA_AGENT_PROFILE, IPA_CA_RECORD, MOD_SSL_VERIFY_DEPTH from ipalib.install import certmonger from ipalib import sysrestore from ipalib.facts import is_ipa_configured @@ -1697,6 +1697,14 @@ def upgrade_configuration(): IPA_CUSTODIA_SOCKET=paths.IPA_CUSTODIA_SOCKET, KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG, DOMAIN=api.env.domain, + HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK, + HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF, + HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF, + HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF, + HTTPD_CERT_FILE=paths.HTTPD_CERT_FILE, + HTTPD_KEY_FILE=paths.HTTPD_KEY_FILE, + IPA_CA_CRT=paths.IPA_CA_CRT, + MOD_SSL_VERIFY_DEPTH=MOD_SSL_VERIFY_DEPTH, ) subject_base = find_subject_base() @@ -1733,6 +1741,9 @@ def upgrade_configuration(): upgrade_file(sub_dict, paths.HTTPD_IPA_CONF, os.path.join(paths.USR_SHARE_IPA_DIR, "ipa.conf.template")) + upgrade_file(sub_dict, paths.HTTPD_IPA_SITE_CONF, + os.path.join(paths.USR_SHARE_IPA_DIR, + "ipa-vhost.conf.template")) upgrade_file(sub_dict, paths.HTTPD_IPA_REWRITE_CONF, os.path.join(paths.USR_SHARE_IPA_DIR, "ipa-rewrite.conf.template"))