mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-04-29 10:10:19 +00:00
72d7a05ead
Closes: #2264. - Set apache-auth fail2ban jail's backend to read from journal instead of syslog. Tweak the regex matching to deal with the custom format. - Adjust the apache error log format to remove unnecessary timestamp. It causes problems for fail2ban regex matching. - There was an error in the earlier patch the make apache log into journald. Configuration for TLS sites still contained ErrorLog and CustomLog directives. Remove them. - There is also file with CustomLog directive that logs for other vhosts. - For some reason, for custom error log format, %T - thread ID did not work and had to switch to %{g}T global thread ID. - Added journalmatch to improve performance by matching the regular expressions against only specific journal entries. Tests: - In a container, apply the patch, run setup and start FreedomBox. Apache app is updated to new version. Apache web server is reloaded. The other-vhosts-access-log configuration is disabled. - On a production machine, remove the directives in freedombox-tls-site-macro.conf and disabling other-vhosts-access-log stopped the logging into /var/log/apache2/ directory. - Use TTRSS /tt-rss-app/ URL and type wrong credentials for 10 times. The client is banned for 10 minutes. Repeat after unban. Client is banned again. Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org> Reviewed-by: James Valleroy <jvalleroy@mailbox.org>
31 lines
1.1 KiB
Plaintext
31 lines
1.1 KiB
Plaintext
<Macro FreedomBoxTLSSiteMacro $domain>
|
|
|
|
# mod_ssl default options. See /etc/apache2/sites-available/default-ssl.conf
|
|
<IfModule mod_ssl.c>
|
|
<VirtualHost _default_:443>
|
|
ServerAdmin webmaster@localhost
|
|
ServerName $domain
|
|
DocumentRoot /var/www/html
|
|
|
|
SSLEngine on
|
|
|
|
# Disable TLS1.1 and below. Client support: Firefox: 27, Android:
|
|
# 4.4.2, Chrome: 31, Edge: 12, IE: 11 (Win7), Java: 8u31, OpenSSL:
|
|
# 1.0.1, Opera: 20, Safari: 9. See:
|
|
# https://wiki.mozilla.org/Security/Server_Side_TLS
|
|
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
|
|
|
|
# Automatically obtained certificates from Let's Encrypt
|
|
SSLCertificateFile /etc/letsencrypt/live/$domain/fullchain.pem
|
|
SSLCertificateKeyFile /etc/letsencrypt/live/$domain/privkey.pem
|
|
|
|
<FilesMatch "\.(cgi|shtml|phtml|php)$">
|
|
SSLOptions +StdEnvVars
|
|
</FilesMatch>
|
|
<Directory /usr/lib/cgi-bin>
|
|
SSLOptions +StdEnvVars
|
|
</Directory>
|
|
</VirtualHost>
|
|
</IfModule>
|
|
</Macro>
|