Skip to content
This repository was archived by the owner on Jul 2, 2024. It is now read-only.

Commit 69d4273

Browse files
jdeathejdeathe
committed
ISSUE 72: Relocate php-wrapper copy following changes to source image. Remove php.conf as it's no longer installed. Updated ssl.conf copy to reflect upstream changes.
1 parent 56433e5 commit 69d4273

File tree

4 files changed

+154
-204
lines changed

4 files changed

+154
-204
lines changed

‎etc/services-config/httpd/conf.d/php.conf.default‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎etc/services-config/httpd/conf.d/php.conf.off‎

Lines changed: 0 additions & 28 deletions
This file was deleted.

‎etc/services-config/httpd/conf.d/ssl.conf‎

Lines changed: 154 additions & 148 deletions
Original file line numberDiff line numberDiff line change
@@ -71,152 +71,158 @@ SSLCryptoDevice builtin
7171
## SSL Virtual Host Context
7272
##
7373

74-
<VirtualHost _default_:404>
75-
76-
# General setup for the virtual host, inherited from global configuration
77-
#DocumentRoot "/var/www/html"
78-
#ServerName www.example.com:443
79-
80-
# Use separate log files for the SSL virtual host; note that LogLevel
81-
# is not inherited from httpd.conf.
82-
ErrorLog logs/ssl_error_log
83-
TransferLog logs/ssl_access_log
84-
LogLevel warn
85-
86-
# SSL Engine Switch:
87-
# Enable/Disable SSL for this virtual host.
88-
SSLEngine on
89-
90-
# SSL Protocol support:
91-
# List the enable protocol levels with which clients will be able to
92-
# connect. Disable SSLv2 access by default:
93-
SSLProtocol all -SSLv2
94-
95-
# SSL Cipher Suite:
96-
# List the ciphers that the client is permitted to negotiate.
97-
# See the mod_ssl documentation for a complete list.
98-
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
99-
100-
# Server Certificate:
101-
# Point SSLCertificateFile at a PEM encoded certificate. If
102-
# the certificate is encrypted, then you will be prompted for a
103-
# pass phrase. Note that a kill -HUP will prompt again. A new
104-
# certificate can be generated using the genkey(1) command.
105-
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
106-
107-
# Server Private Key:
108-
# If the key is not combined with the certificate, use this
109-
# directive to point at the key file. Keep in mind that if
110-
# you've both a RSA and a DSA private key you can configure
111-
# both in parallel (to also allow the use of DSA ciphers, etc.)
112-
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
113-
114-
# Server Certificate Chain:
115-
# Point SSLCertificateChainFile at a file containing the
116-
# concatenation of PEM encoded CA certificates which form the
117-
# certificate chain for the server certificate. Alternatively
118-
# the referenced file can be the same as SSLCertificateFile
119-
# when the CA certificates are directly appended to the server
120-
# certificate for convinience.
121-
#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
122-
123-
# Certificate Authority (CA):
124-
# Set the CA certificate verification path where to find CA
125-
# certificates for client authentication or alternatively one
126-
# huge file containing all of them (file must be PEM encoded)
127-
#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
128-
129-
# Client Authentication (Type):
130-
# Client certificate verification type and depth. Types are
131-
# none, optional, require and optional_no_ca. Depth is a
132-
# number which specifies how deeply to verify the certificate
133-
# issuer chain before deciding the certificate is not valid.
134-
#SSLVerifyClient require
135-
#SSLVerifyDepth 10
136-
137-
# Access Control:
138-
# With SSLRequire you can do per-directory access control based
139-
# on arbitrary complex boolean expressions containing server
140-
# variable checks and other lookup directives. The syntax is a
141-
# mixture between C and Perl. See the mod_ssl documentation
142-
# for more details.
143-
#<Location />
144-
#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
145-
# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
146-
# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
147-
# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
148-
# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
149-
# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
150-
#</Location>
151-
152-
# SSL Engine Options:
153-
# Set various options for the SSL engine.
154-
# o FakeBasicAuth:
155-
# Translate the client X.509 into a Basic Authorisation. This means that
156-
# the standard Auth/DBMAuth methods can be used for access control. The
157-
# user name is the `one line' version of the client's X.509 certificate.
158-
# Note that no password is obtained from the user. Every entry in the user
159-
# file needs this password: `xxj31ZMTZzkVA'.
160-
# o ExportCertData:
161-
# This exports two additional environment variables: SSL_CLIENT_CERT and
162-
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
163-
# server (always existing) and the client (only existing when client
164-
# authentication is used). This can be used to import the certificates
165-
# into CGI scripts.
166-
# o StdEnvVars:
167-
# This exports the standard SSL/TLS related `SSL_*' environment variables.
168-
# Per default this exportation is switched off for performance reasons,
169-
# because the extraction step is an expensive operation and is usually
170-
# useless for serving static content. So one usually enables the
171-
# exportation for CGI and SSI requests only.
172-
# o StrictRequire:
173-
# This denies access when "SSLRequireSSL" or "SSLRequire" applied even
174-
# under a "Satisfy any" situation, i.e. when it applies access is denied
175-
# and no other module can change it.
176-
# o OptRenegotiate:
177-
# This enables optimized SSL connection renegotiation handling when SSL
178-
# directives are used in per-directory context.
179-
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
180-
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
181-
SSLOptions +StdEnvVars
182-
</Files>
183-
<Directory "/var/www/cgi-bin">
184-
SSLOptions +StdEnvVars
185-
</Directory>
186-
187-
# SSL Protocol Adjustments:
188-
# The safe and default but still SSL/TLS standard compliant shutdown
189-
# approach is that mod_ssl sends the close notify alert but doesn't wait for
190-
# the close notify alert from client. When you need a different shutdown
191-
# approach you can use one of the following variables:
192-
# o ssl-unclean-shutdown:
193-
# This forces an unclean shutdown when the connection is closed, i.e. no
194-
# SSL close notify alert is send or allowed to received. This violates
195-
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
196-
# this when you receive I/O errors because of the standard approach where
197-
# mod_ssl sends the close notify alert.
198-
# o ssl-accurate-shutdown:
199-
# This forces an accurate shutdown when the connection is closed, i.e. a
200-
# SSL close notify alert is send and mod_ssl waits for the close notify
201-
# alert of the client. This is 100% SSL/TLS standard compliant, but in
202-
# practice often causes hanging connections with brain-dead browsers. Use
203-
# this only for browsers where you know that their SSL implementation
204-
# works correctly.
205-
# Notice: Most problems of broken clients are also related to the HTTP
206-
# keep-alive facility, so you usually additionally want to disable
207-
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
208-
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
209-
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
210-
# "force-response-1.0" for this.
211-
SetEnvIf User-Agent ".*MSIE.*" \
212-
nokeepalive ssl-unclean-shutdown \
213-
downgrade-1.0 force-response-1.0
214-
215-
# Per-Server Logging:
216-
# The home of a custom SSL log file. Use this when you want a
217-
# compact non-error SSL logfile on a virtual host basis.
218-
CustomLog logs/ssl_request_log \
219-
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
220-
221-
</VirtualHost>
74+
#<VirtualHost _default_:443>
75+
#
76+
## General setup for the virtual host, inherited from global configuration
77+
##DocumentRoot "/var/www/html"
78+
##ServerName www.example.com:443
79+
#
80+
## Use separate log files for the SSL virtual host; note that LogLevel
81+
## is not inherited from httpd.conf.
82+
#ErrorLog logs/ssl_error_log
83+
#TransferLog logs/ssl_access_log
84+
#LogLevel warn
85+
#
86+
## SSL Engine Switch:
87+
## Enable/Disable SSL for this virtual host.
88+
#SSLEngine on
89+
#
90+
## SSL Protocol support:
91+
## List the enable protocol levels with which clients will be able to
92+
## connect. Disable SSLv2 access by default:
93+
#SSLProtocol all -SSLv2
94+
#
95+
## SSL Cipher Suite:
96+
## List the ciphers that the client is permitted to negotiate.
97+
## See the mod_ssl documentation for a complete list.
98+
#SSLCipherSuite DEFAULT:!EXP:!SSLv2:!DES:!IDEA:!SEED:+3DES
99+
#
100+
## Server Certificate:
101+
## Point SSLCertificateFile at a PEM encoded certificate. If
102+
## the certificate is encrypted, then you will be prompted for a
103+
## pass phrase. Note that a kill -HUP will prompt again. A new
104+
## certificate can be generated using the genkey(1) command.
105+
#SSLCertificateFile /etc/pki/tls/certs/localhost.crt
106+
#
107+
## Server Private Key:
108+
## If the key is not combined with the certificate, use this
109+
## directive to point at the key file. Keep in mind that if
110+
## you've both a RSA and a DSA private key you can configure
111+
## both in parallel (to also allow the use of DSA ciphers, etc.)
112+
#SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
113+
#
114+
## Server Certificate Chain:
115+
## Point SSLCertificateChainFile at a file containing the
116+
## concatenation of PEM encoded CA certificates which form the
117+
## certificate chain for the server certificate. Alternatively
118+
## the referenced file can be the same as SSLCertificateFile
119+
## when the CA certificates are directly appended to the server
120+
## certificate for convinience.
121+
##SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
122+
#
123+
## Certificate Authority (CA):
124+
## Set the CA certificate verification path where to find CA
125+
## certificates for client authentication or alternatively one
126+
## huge file containing all of them (file must be PEM encoded)
127+
##SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
128+
#
129+
## Client Authentication (Type):
130+
## Client certificate verification type and depth. Types are
131+
## none, optional, require and optional_no_ca. Depth is a
132+
## number which specifies how deeply to verify the certificate
133+
## issuer chain before deciding the certificate is not valid.
134+
##SSLVerifyClient require
135+
##SSLVerifyDepth 10
136+
#
137+
## Access Control:
138+
## With SSLRequire you can do per-directory access control based
139+
## on arbitrary complex boolean expressions containing server
140+
## variable checks and other lookup directives. The syntax is a
141+
## mixture between C and Perl. See the mod_ssl documentation
142+
## for more details.
143+
##<Location />
144+
##SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
145+
## and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
146+
## and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
147+
## and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
148+
## and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
149+
## or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
150+
##</Location>
151+
#
152+
## SSL Engine Options:
153+
## Set various options for the SSL engine.
154+
## o FakeBasicAuth:
155+
## Translate the client X.509 into a Basic Authorisation. This means that
156+
## the standard Auth/DBMAuth methods can be used for access control. The
157+
## user name is the `one line' version of the client's X.509 certificate.
158+
## Note that no password is obtained from the user. Every entry in the user
159+
## file needs this password: `xxj31ZMTZzkVA'.
160+
## o ExportCertData:
161+
## This exports two additional environment variables: SSL_CLIENT_CERT and
162+
## SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
163+
## server (always existing) and the client (only existing when client
164+
## authentication is used). This can be used to import the certificates
165+
## into CGI scripts.
166+
## o StdEnvVars:
167+
## This exports the standard SSL/TLS related `SSL_*' environment variables.
168+
## Per default this exportation is switched off for performance reasons,
169+
## because the extraction step is an expensive operation and is usually
170+
## useless for serving static content. So one usually enables the
171+
## exportation for CGI and SSI requests only.
172+
## o StrictRequire:
173+
## This denies access when "SSLRequireSSL" or "SSLRequire" applied even
174+
## under a "Satisfy any" situation, i.e. when it applies access is denied
175+
## and no other module can change it.
176+
## o OptRenegotiate:
177+
## This enables optimized SSL connection renegotiation handling when SSL
178+
## directives are used in per-directory context.
179+
##SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
180+
#<Files ~ "\.(cgi|shtml|phtml|php3?)$">
181+
# SSLOptions +StdEnvVars
182+
#</Files>
183+
#<Directory "/var/www/cgi-bin">
184+
# SSLOptions +StdEnvVars
185+
#</Directory>
186+
#
187+
## SSL Protocol Adjustments:
188+
## The safe and default but still SSL/TLS standard compliant shutdown
189+
## approach is that mod_ssl sends the close notify alert but doesn't wait for
190+
## the close notify alert from client. When you need a different shutdown
191+
## approach you can use one of the following variables:
192+
## o ssl-unclean-shutdown:
193+
## This forces an unclean shutdown when the connection is closed, i.e. no
194+
## SSL close notify alert is send or allowed to received. This violates
195+
## the SSL/TLS standard but is needed for some brain-dead browsers. Use
196+
## this when you receive I/O errors because of the standard approach where
197+
## mod_ssl sends the close notify alert.
198+
## o ssl-accurate-shutdown:
199+
## This forces an accurate shutdown when the connection is closed, i.e. a
200+
## SSL close notify alert is send and mod_ssl waits for the close notify
201+
## alert of the client. This is 100% SSL/TLS standard compliant, but in
202+
## practice often causes hanging connections with brain-dead browsers. Use
203+
## this only for browsers where you know that their SSL implementation
204+
## works correctly.
205+
## Notice: Most problems of broken clients are also related to the HTTP
206+
## keep-alive facility, so you usually additionally want to disable
207+
## keep-alive for those clients, too. Use variable "nokeepalive" for this.
208+
## Similarly, one has to force some clients to use HTTP/1.0 to workaround
209+
## their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
210+
## "force-response-1.0" for this.
211+
#SetEnvIf User-Agent ".*MSIE.*" \
212+
# nokeepalive ssl-unclean-shutdown \
213+
# downgrade-1.0 force-response-1.0
214+
#
215+
## Per-Server Logging:
216+
## The home of a custom SSL log file. Use this when you want a
217+
## compact non-error SSL logfile on a virtual host basis.
218+
#CustomLog logs/ssl_request_log \
219+
# "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
220+
#
221+
#</VirtualHost>
222+
#
222223

224+
#
225+
# Custom SSL configuration
226+
#
227+
NameVirtualHost *:443
228+
Include ${APACHE_CONTENT_ROOT}/vhost-ssl.conf

‎var/www/app-bin/php-wrapper‎ renamed to ‎var/www/app/bin/php-wrapper‎

File renamed without changes.

0 commit comments

Comments
 (0)