From fb1266d3a1314ade3ac9bd30dee3acdf762cbef9 Mon Sep 17 00:00:00 2001 From: Matthew Grooms Date: Tue, 9 Sep 2008 04:08:22 +0000 Subject: [PATCH] Moves the protocol and certificate options out of the general config page to the Advanced admin access tab. The thought is that they should be next to each other. The certificate management has also been modified to use the centralized certificate manager. I took the liberty of removing the default certificate/key definitions from the web server configuration function as it is now trivial to create these locally. The global SSH authorized keys have also been removed. Any existing key data will be migrated to the admin account. I also added some new checks to ensure the sshd process is only restarted when its configuration has actually changed. --- etc/inc/auth.inc | 17 +- etc/inc/config.inc | 36 +++++ etc/inc/priv.inc | 16 -- etc/inc/system.inc | 165 ++------------------ usr/local/www/system.php | 47 ------ usr/local/www/system_advanced_admin.php | 197 ++++++++++++++++-------- usr/local/www/system_usermanager.php | 37 ++--- 7 files changed, 206 insertions(+), 309 deletions(-) diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc index 0d695055ea..3bb00e7e4e 100644 --- a/etc/inc/auth.inc +++ b/etc/inc/auth.inc @@ -187,8 +187,8 @@ function local_user_set(& $user) { $user_group = "nobody"; /* configure shell type */ - if (!hasPrivilegeShell($user)) { - if (!hasPrivilegeCopyFiles($user)) + if (!userHasPrivilege($user, "user-shell-access")) { + if (!userHasPrivilege($user, "user-copy-files")) $user_shell = "/sbin/nologin"; else $user_shell = "/usr/local/bin/scponly"; @@ -227,14 +227,17 @@ function local_user_set(& $user) { /* create user directory if required */ if (!is_dir($user_home)) - mkdir($user_home, 0755); + mkdir($user_home, 0700); chown($user_home, $user_name); chgrp($user_home, $user_group); - chmod($user_home, 0700); - /* FIXME : ssh keys should be per-admin user */ - if(isset($config['system']['ssh']['sshdkeyonly']) && hasPrivilegeShell($user)) - create_authorized_keys($user_name, $user_home); + /* write out ssh authorized key file */ + if($user['authorizedkeys']) { + if (!is_dir("{$user_home}/.ssh")) + mkdir("{$user_home}/.ssh", 0700); + $keys = base64_decode($user['authorizedkeys']); + file_put_contents("{$user_home}/.ssh/authorized_keys", $keys); + } } function local_user_del($user) { diff --git a/etc/inc/config.inc b/etc/inc/config.inc index da5bea6cdc..62a6a89130 100644 --- a/etc/inc/config.inc +++ b/etc/inc/config.inc @@ -1926,6 +1926,42 @@ endif; $config['version'] = "5.2"; } + /* Convert 5.2 -> 5.3 */ + if ($config['version'] <= 5.2) { + + if (!is_array($config['system']['ca'])) + $config['system']['ca'] = array(); + if (!is_array($config['system']['cert'])) + $config['system']['cert'] = array(); + + /* migrate advanced admin page webui ssl to certifcate mngr */ + if ($config['system']['webgui']['certificate'] && + $config['system']['webgui']['private-key']) { + + /* create cert entry */ + $cert = array(); + $cert['refid'] = uniqid(); + $cert['name'] = "webConfigurator SSL Certificate"; + $cert['crt'] = $config['system']['webgui']['certificate']; + $cert['prv'] = $config['system']['webgui']['private-key']; + $config['system']['cert'][] = $cert; + + /* create cert reference */ + unset($config['system']['webgui']['certificate']); + unset($config['system']['webgui']['private-key']); + $config['system']['webgui']['ssl-certref'] = $cert['refid']; + } + + /* migrate advanced admin page ssh keys to user manager */ + if ($config['system']['ssh']['authorizedkeys']) { + $admin_user =& getUserEntryByUID(0); + $admin_user['authorizedkeys'] = $config['system']['ssh']['authorizedkeys']; + unset($config['system']['ssh']['authorizedkeys']); + } + + $config['version'] = "5.3"; + } + $now = date("H:i:s"); log_error("Ended Configuration upgrade at $now"); diff --git a/etc/inc/priv.inc b/etc/inc/priv.inc index 89701aa099..824ea7bd55 100644 --- a/etc/inc/priv.inc +++ b/etc/inc/priv.inc @@ -279,20 +279,4 @@ function userHasPrivilege($userent, $privid = false) { return true; } -function hasPrivilegeLock($userent) { - return userHasPrivilege($userent, "user-lock-webcfg"); -} - -function hasPrivilegeLockPages($userent) { - return userHasPrivilege($userent, "user-lock-ipages"); -} - -function hasPrivilegeShell($userent) { - return userHasPrivilege($userent, "user-shell-access"); -} - -function hasPrivilegeCopyFiles($userent) { - return userHasPrivilege($userent, "user-copy-files"); -} - ?> diff --git a/etc/inc/system.inc b/etc/inc/system.inc index 3b19b48da3..0a4c5d1f4a 100644 --- a/etc/inc/system.inc +++ b/etc/inc/system.inc @@ -496,72 +496,30 @@ function system_webgui_start() { chdir($g['www_path']); + /* defaults */ + $portarg = "80"; + $crt = ""; + $key = ""; + /* non-standard port? */ if ($config['system']['webgui']['port']) $portarg = "{$config['system']['webgui']['port']}"; - else - $portarg = ""; if ($config['system']['webgui']['protocol'] == "https") { - if(!$config['system']['webgui']['port']) - $portarg = "443"; - - if ($config['system']['webgui']['certificate'] && $config['system']['webgui']['private-key']) { - $cert = base64_decode($config['system']['webgui']['certificate']); - $key = base64_decode($config['system']['webgui']['private-key']); - } else { - /* default certificate/key */ - $cert = << 0) write_config($changedesc); - if ($restart_webgui) { - global $_SERVER; - list($host) = explode(":", $_SERVER['HTTP_HOST']); - if ($config['system']['webgui']['port']) { - $url="{$config['system']['webgui']['protocol']}://{$host}:{$config['system']['webgui']['port']}/system.php"; - } else { - $url = "{$config['system']['webgui']['protocol']}://{$host}/system.php"; - } - } - $retval = 0; config_lock(); $retval = system_hostname_configure(); @@ -206,8 +186,6 @@ if ($_POST) { config_unlock(); $savemsg = get_std_save_message($retval); - if ($restart_webgui) - $savemsg .= "
One moment...redirecting to {$url} in 10 seconds."; } } @@ -294,20 +272,6 @@ include("head.inc"); the DNS forwarder). They will not be assigned to DHCP and PPTP VPN clients, though.

- - webConfigurator protocol - > - HTTP     > - HTTPS - - - webConfigurator port - -
- Enter a custom port number for the webConfigurator - above if you want to override the default (80 for HTTP, 443 - for HTTPS). Changes will take effect immediately after save. - Time zone + + onClick="prot_change()"> + HTTP +     + onClick="prot_change()"> + HTTPS +
- Paste a signed certificate in X.509 PEM format here. Create certificates automatically. + No Certificates have been defined. You must + Create or Import + a Certificate before SSL can be enabled. + + + + + SSL Certificate + + - Key - - -
- Paste an RSA private key in PEM format here. + TCP port + + +
+ + Enter a custom port number for the webConfigurator + above if you want to override the default (80 for HTTP, 443 + for HTTPS). Changes will take effect immediately after save. + @@ -246,9 +312,9 @@ include("head.inc"); /> Disable Password login for Secure Shell (rsa key only)
- When this option is enabled, you will need to configure - allowed keys for each user that has secure shell - access. + When enabled, authorized keys need to be configured for each + user + that has been granted secure shell access. @@ -259,14 +325,6 @@ include("head.inc"); Note: Leave this blank for the default of 22 - - - - -
- Paste an authorized keys file here. - -   @@ -311,22 +369,35 @@ include("head.inc"); + +"; +?> diff --git a/usr/local/www/system_usermanager.php b/usr/local/www/system_usermanager.php index 54265244ff..cdb2c35ac5 100644 --- a/usr/local/www/system_usermanager.php +++ b/usr/local/www/system_usermanager.php @@ -197,12 +197,7 @@ if (isAllowedPage("system_usermanager")) { } } - if(is_array($_POST['groups'])) - foreach($_POST['groups'] as $groupname) - if ($pconfig['utype'] <> "system" && !isset($groupindex[$groupname])) - $input_errors[] = gettext("group {$groupname} does not exist, please define the group before assigning users."); - - if (isset($config['system']['ssh']['sshdkeyonly']) && empty($_POST['authorizedkeys'])) + if (isset($config['system']['ssh']['sshdkeyonly']) && empty($_POST['authorizedkeys'])) $input_errors[] = gettext("You must provide an authorized key otherwise you won't be able to login into this system."); /* if this is an AJAX caller then handle via JSON */ @@ -216,6 +211,8 @@ if (isAllowedPage("system_usermanager")) { if (isset($id) && $a_user[$id]) $userent = $a_user[$id]; + isset($_POST['utype']) ? $userent['scope'] = $_POST['utype'] : $userent['scope'] = "system"; + /* the user name was modified */ if ($_POST['usernamefld'] <> $_POST['oldusername']) $_SERVER['REMOTE_USER'] = $_POST['usernamefld']; @@ -226,11 +223,7 @@ if (isAllowedPage("system_usermanager")) { $userent['name'] = $_POST['usernamefld']; $userent['fullname'] = $_POST['fullname']; - - isset($_POST['utype']) ? $userent['scope'] = $_POST['utype'] : $userent['scope'] = "system"; - - if(isset($config['system']['ssh']['sshdkeyonly'])) - $userent['authorizedkeys'] = base64_encode($_POST['authorizedkeys']); + $userent['authorizedkeys'] = base64_encode($_POST['authorizedkeys']); if (isset($id) && $a_user[$id]) $a_user[$id] = $userent; @@ -367,20 +360,6 @@ function presubmit() { - - - - - - - -
- - - - - - @@ -551,6 +530,14 @@ function presubmit() { + + + + +
+ + +