Subversion Repositories configs

Rev

Rev 161 | Rev 165 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed

Rev Author Line No. Line
4 - 1
#
2
# This is the Apache server configuration file providing SSL support.
3
# It contains the configuration directives to instruct the server how to
4
# serve pages over an https connection. For detailing information about these
5
# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
6
#
7
# Do NOT simply read the instructions in here without understanding
8
# what they do.  They're here only as hints or reminders.  If you are unsure
9
# consult the online docs. You have been warned.
10
#
11
 
12
LoadModule ssl_module modules/mod_ssl.so
13
 
14
#
15
# When we also provide SSL we have to listen to the
16
# the HTTPS port in addition.
17
#
18
Listen 443
141 - 19
NameVirtualHost *:443
4 - 20
 
21
##
22
##  SSL Global Context
23
##
24
##  All SSL configuration in this context applies both to
25
##  the main server and all SSL-enabled virtual hosts.
26
##
27
 
28
#   Pass Phrase Dialog:
29
#   Configure the pass phrase gathering process.
30
#   The filtering dialog program (`builtin' is a internal
31
#   terminal dialog) has to provide the pass phrase on stdout.
32
SSLPassPhraseDialog  builtin
33
 
34
#   Inter-Process Session Cache:
35
#   Configure the SSL Session Cache: First the mechanism
36
#   to use and second the expiring timeout (in seconds).
37
SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
38
SSLSessionCacheTimeout  300
39
 
40
#   Semaphore:
41
#   Configure the path to the mutual exclusion semaphore the
42
#   SSL engine uses internally for inter-process synchronization.
43
SSLMutex default
44
 
45
#   Pseudo Random Number Generator (PRNG):
46
#   Configure one or more sources to seed the PRNG of the
47
#   SSL library. The seed data should be of good random quality.
48
#   WARNING! On some platforms /dev/random blocks if not enough entropy
49
#   is available. This means you then cannot use the /dev/random device
50
#   because it would lead to very long connection times (as long as
51
#   it requires to make more entropy available). But usually those
52
#   platforms additionally provide a /dev/urandom device which doesn't
53
#   block. So, if available, use this one instead. Read the mod_ssl User
54
#   Manual for more details.
55
SSLRandomSeed startup file:/dev/urandom  256
56
SSLRandomSeed connect builtin
57
#SSLRandomSeed startup file:/dev/random  512
58
#SSLRandomSeed connect file:/dev/random  512
59
#SSLRandomSeed connect file:/dev/urandom 512
60
 
61
#
62
# Use "SSLCryptoDevice" to enable any supported hardware
63
# accelerators. Use "openssl engine -v" to list supported
64
# engine names.  NOTE: If you enable an accelerator and the
65
# server does not start, consult the error logs and ensure
66
# your accelerator is functioning properly.
67
#
68
SSLCryptoDevice builtin
69
#SSLCryptoDevice ubsec
70
 
71
##
72
## SSL Virtual Host Context
73
##
74
 
141 - 75
<VirtualHost *:443>
4 - 76
 
77
# General setup for the virtual host, inherited from global configuration
132 - 78
DocumentRoot "/var/www/shtml"
143 - 79
ServerName www.ujsoftware.com
159 - 80
ServerAlias ujsoftware.com
4 - 81
 
82
# Use separate log files for the SSL virtual host; note that LogLevel
83
# is not inherited from httpd.conf.
84
ErrorLog logs/ssl_error_log
85
TransferLog logs/ssl_access_log
86
LogLevel warn
87
 
88
#   SSL Engine Switch:
89
#   Enable/Disable SSL for this virtual host.
90
SSLEngine on
91
 
92
#   SSL Protocol support:
93
# List the enable protocol levels with which clients will be able to
94
# connect.  Disable SSLv2 access by default:
132 - 95
SSLProtocol all -SSLv2 -SSLv3
4 - 96
 
97
#   SSL Cipher Suite:
98
# List the ciphers that the client is permitted to negotiate.
99
# See the mod_ssl documentation for a complete list.
132 - 100
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
101
SSLHonorCipherOrder On
4 - 102
 
103
#   Server Certificate:
104
# Point SSLCertificateFile at a PEM encoded certificate.  If
105
# the certificate is encrypted, then you will be prompted for a
106
# pass phrase.  Note that a kill -HUP will prompt again.  A new
107
# certificate can be generated using the genkey(1) command.
143 - 108
SSLCertificateFile /etc/letsencrypt/live/ujsoftware.com/cert.pem
4 - 109
 
110
#   Server Private Key:
111
#   If the key is not combined with the certificate, use this
112
#   directive to point at the key file.  Keep in mind that if
113
#   you've both a RSA and a DSA private key you can configure
114
#   both in parallel (to also allow the use of DSA ciphers, etc.)
143 - 115
SSLCertificateKeyFile /etc/letsencrypt/live/ujsoftware.com/privkey.pem
4 - 116
 
117
#   Server Certificate Chain:
118
#   Point SSLCertificateChainFile at a file containing the
119
#   concatenation of PEM encoded CA certificates which form the
120
#   certificate chain for the server certificate. Alternatively
121
#   the referenced file can be the same as SSLCertificateFile
122
#   when the CA certificates are directly appended to the server
123
#   certificate for convinience.
143 - 124
SSLCertificateChainFile /etc/letsencrypt/live/ujsoftware.com/chain.pem
4 - 125
 
126
#   Certificate Authority (CA):
127
#   Set the CA certificate verification path where to find CA
128
#   certificates for client authentication or alternatively one
129
#   huge file containing all of them (file must be PEM encoded)
141 - 130
#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
131
 
132
#   Client Authentication (Type):
133
#   Client certificate verification type and depth.  Types are
134
#   none, optional, require and optional_no_ca.  Depth is a
135
#   number which specifies how deeply to verify the certificate
136
#   issuer chain before deciding the certificate is not valid.
137
#SSLVerifyClient require
138
#SSLVerifyDepth  10
139
 
140
#   Access Control:
141
#   With SSLRequire you can do per-directory access control based
142
#   on arbitrary complex boolean expressions containing server
143
#   variable checks and other lookup directives.  The syntax is a
144
#   mixture between C and Perl.  See the mod_ssl documentation
145
#   for more details.
146
#<Location />
147
#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
148
#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
149
#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
150
#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
151
#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
152
#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
153
#</Location>
154
 
155
#   SSL Engine Options:
156
#   Set various options for the SSL engine.
157
#   o FakeBasicAuth:
158
#     Translate the client X.509 into a Basic Authorisation.  This means that
159
#     the standard Auth/DBMAuth methods can be used for access control.  The
160
#     user name is the `one line' version of the client's X.509 certificate.
161
#     Note that no password is obtained from the user. Every entry in the user
162
#     file needs this password: `xxj31ZMTZzkVA'.
163
#   o ExportCertData:
164
#     This exports two additional environment variables: SSL_CLIENT_CERT and
165
#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
166
#     server (always existing) and the client (only existing when client
167
#     authentication is used). This can be used to import the certificates
168
#     into CGI scripts.
169
#   o StdEnvVars:
170
#     This exports the standard SSL/TLS related `SSL_*' environment variables.
171
#     Per default this exportation is switched off for performance reasons,
172
#     because the extraction step is an expensive operation and is usually
173
#     useless for serving static content. So one usually enables the
174
#     exportation for CGI and SSI requests only.
175
#   o StrictRequire:
176
#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
177
#     under a "Satisfy any" situation, i.e. when it applies access is denied
178
#     and no other module can change it.
179
#   o OptRenegotiate:
180
#     This enables optimized SSL connection renegotiation handling when SSL
181
#     directives are used in per-directory context.
182
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
183
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
184
    SSLOptions +StdEnvVars
185
</Files>
186
<Directory "/var/www/cgi-bin">
187
    SSLOptions +StdEnvVars
188
</Directory>
189
 
190
#   SSL Protocol Adjustments:
191
#   The safe and default but still SSL/TLS standard compliant shutdown
192
#   approach is that mod_ssl sends the close notify alert but doesn't wait for
193
#   the close notify alert from client. When you need a different shutdown
194
#   approach you can use one of the following variables:
195
#   o ssl-unclean-shutdown:
196
#     This forces an unclean shutdown when the connection is closed, i.e. no
197
#     SSL close notify alert is send or allowed to received.  This violates
198
#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
199
#     this when you receive I/O errors because of the standard approach where
200
#     mod_ssl sends the close notify alert.
201
#   o ssl-accurate-shutdown:
202
#     This forces an accurate shutdown when the connection is closed, i.e. a
203
#     SSL close notify alert is send and mod_ssl waits for the close notify
204
#     alert of the client. This is 100% SSL/TLS standard compliant, but in
205
#     practice often causes hanging connections with brain-dead browsers. Use
206
#     this only for browsers where you know that their SSL implementation
207
#     works correctly.
208
#   Notice: Most problems of broken clients are also related to the HTTP
209
#   keep-alive facility, so you usually additionally want to disable
210
#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
211
#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
212
#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
213
#   "force-response-1.0" for this.
214
SetEnvIf User-Agent ".*MSIE.*" \
215
         nokeepalive ssl-unclean-shutdown \
216
         downgrade-1.0 force-response-1.0
217
 
218
#   Per-Server Logging:
219
#   The home of a custom SSL log file. Use this when you want a
220
#   compact non-error SSL logfile on a virtual host basis.
221
CustomLog logs/ssl_request_log \
222
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
223
 
224
</VirtualHost>
225
 
142 - 226
<VirtualHost *:443>
227
DocumentRoot "/var/www/munatrading"
228
ServerName www.munatrading.linkpc.net
229
ServerAlias munatrading.linkpc.net
141 - 230
 
142 - 231
ErrorLog logs/ssl_error_log
232
TransferLog logs/ssl_access_log
233
LogLevel warn
141 - 234
 
143 - 235
# HSTS (15768000 seconds = 6 month)
236
Header always set Strict-Transport-Security "max-age=15768000; preload"
237
# Prevent browsers from incorrectly detecting non-scripts as scripts
238
Header always set X-Content-Type-Options nosniff
239
# Cors
240
Header always set Access-Control-Allow-Origin "*"
241
# CSP calculated by FF Addon Laboratory
242
Header always set Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com; frame-src data:; img-src 'self' data: https://counters.auctiva.com https://i.ebayimg.com https://i.thenile.io https://img.comc.com https://ir.ebaystatic.com https://scimg.auctiva.com https://storage.googleapis.com https://thumbs1.ebaystatic.com https://thumbs2.ebaystatic.com https://thumbs3.ebaystatic.com https://thumbs4.ebaystatic.com https://ti2.auctiva.com https://www.thenile.com.au; script-src 'self' 'unsafe-inline' https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js https://cdn.jsdelivr.net/npm/lodash@4.17.11/lodash.min.js https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.7.3/Chart.min.js https://cdnjs.cloudflare.com/ajax/libs/bootstrap-select/1.13.2/js/bootstrap-select.js https://cdnjs.cloudflare.com/ajax/libs/moment-timezone/0.5.23/moment-timezone-with-data-2012-2022.min.js https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.23.0/moment.min.js https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/popper.min.js https://maps.googleapis.com/maps-api-v3/api/js/36/10a/common.js https://maps.googleapis.com/maps-api-v3/api/js/36/10a/geocoder.js https://maps.googleapis.com/maps-api-v3/api/js/36/10a/util.js https://maps.googleapis.com/maps/api/js https://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com/ajax/libs/bootstrap-select/1.13.2/css/ https://fonts.googleapis.com/ https://img.comc.com/Content/eBay/ https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/css/ https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ https://scrollinggallery.auctiva.com/gallery/css/2(0)/AUCTIVA/1362185/0/25/ https://storage.googleapis.com/ebay-assets/grandeagle/css/ https://www.w3schools.com/w3css/4/;frame-ancestors 'self'"
243
# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do
244
Header always set Referrer-Policy "no-referrer"
245
# Only allow my site to frame itself
246
#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"
247
Header always set X-Frame-Options SAMEORIGIN
248
# XSS Protection
249
Header set X-XSS-Protection "1; mode=block"
152 - 250
# Redirect all non-www access to www
251
RewriteEngine On
252
RewriteCond %{HTTP_HOST} !^www\. [NC]
253
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
143 - 254
 
142 - 255
SSLEngine on
256
SSLProtocol all -SSLv2 -SSLv3
257
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
258
SSLHonorCipherOrder On
143 - 259
SSLCertificateFile /etc/letsencrypt/live/munatrading.linkpc.net/cert.pem
260
SSLCertificateKeyFile /etc/letsencrypt/live/munatrading.linkpc.net/privkey.pem
261
SSLCertificateChainFile /etc/letsencrypt/live/munatrading.linkpc.net/chain.pem
142 - 262
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
263
    SSLOptions +StdEnvVars
264
</Files>
265
<Directory "/var/www/cgi-bin">
266
    SSLOptions +StdEnvVars
267
</Directory>
268
<Directory "/var/www/munatrading/ebay/listings">
269
  Options +Indexes
270
  IndexOptions IgnoreCase FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=* SuppressHTMLPreamble
271
</Directory>
272
SetEnvIf User-Agent ".*MSIE.*" \
273
         nokeepalive ssl-unclean-shutdown \
274
         downgrade-1.0 force-response-1.0
275
CustomLog logs/ssl_request_log \
276
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
277
</VirtualHost>
141 - 278
 
279
<VirtualHost *:443>
152 - 280
DocumentRoot "/var/www/cheapmusic/www"
281
ServerName www.findcheapmusic.linkpc.net
282
ServerAlias findcheapmusic.linkpc.net
141 - 283
 
146 - 284
ErrorDocument 403 /index.php
285
ErrorDocument 404 /index.php
286
 
141 - 287
ErrorLog logs/ssl_error_log
288
TransferLog logs/ssl_access_log
289
LogLevel warn
290
 
143 - 291
# HSTS (31536000 seconds = 1 year)
292
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
293
# Prevent browsers from incorrectly detecting non-scripts as scripts
294
Header always set X-Content-Type-Options nosniff
295
# Cors
296
Header always set Access-Control-Allow-Origin "*"
297
# Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https
164 - 298
Header always set Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src data: https://fonts.gstatic.com https://use.fontawesome.com; form-action 'self'; frame-src https://www.google.com; img-src 'self' data: http://abs.twimg.com https://abs.twimg.com https://i5.walmartimages.com https://images.samash.com https://img.discogs.com https://lh4.googleusercontent.com https://thumbs1.ebaystatic.com https://thumbs2.ebaystatic.com https://thumbs3.ebaystatic.com https://thumbs4.ebaystatic.com https://www.fye.com https://www.musicnotes.com https://www.secondspin.com https://platform-lookaside.fbsbx.com https://ad.linksynergy.com https://www.lduhtrp.net https://i5.wal.co https://cj.dotomi.com https://www.awltovhc.com https://www.ftjcfx.com https://www.tqlkg.com https://www.emjcd.com https://www.yceml.net https://beacon.affil.walmart.com https://assets.sheetmusicplus.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/ https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/ https://use.fontawesome.com/releases/v5.8.1/css/;frame-ancestors 'self'"
143 - 299
# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do
300
Header always set Referrer-Policy "no-referrer"
301
# Only allow my site to frame itself
302
#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"
303
Header always set X-Frame-Options SAMEORIGIN
304
# XSS Protection
305
Header set X-XSS-Protection "1; mode=block"
146 - 306
# Protect cookies with HTTPOnly flag
307
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
308
# Redirect all non-www access to www
309
RewriteEngine On
310
RewriteCond %{HTTP_HOST} !^www\. [NC]
311
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
143 - 312
 
141 - 313
SSLEngine on
314
SSLProtocol all -SSLv2 -SSLv3
315
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
316
SSLHonorCipherOrder On
152 - 317
SSLCertificateFile /etc/letsencrypt/live/findcheapmusic.linkpc.net/cert.pem
318
SSLCertificateKeyFile /etc/letsencrypt/live/findcheapmusic.linkpc.net/privkey.pem
319
SSLCertificateChainFile /etc/letsencrypt/live/findcheapmusic.linkpc.net/chain.pem
142 - 320
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
321
    SSLOptions +StdEnvVars
322
</Files>
323
<Directory "/var/www/cgi-bin">
324
    SSLOptions +StdEnvVars
325
</Directory>
326
SetEnvIf User-Agent ".*MSIE.*" \
327
         nokeepalive ssl-unclean-shutdown \
328
         downgrade-1.0 force-response-1.0
329
CustomLog logs/ssl_request_log \
330
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
331
</VirtualHost>
141 - 332
 
4 - 333
 
142 - 334
<VirtualHost *:443>
335
DocumentRoot "/var/www/archerygear"
159 - 336
ServerName www.archerygearonline.linkpc.net
337
ServerAlias archerygearonline.linkpc.net
4 - 338
 
152 - 339
ErrorDocument 403 /index.php
340
ErrorDocument 404 /index.php
341
 
142 - 342
ErrorLog logs/ssl_error_log
343
TransferLog logs/ssl_access_log
344
LogLevel warn
4 - 345
 
143 - 346
# HSTS (31536000 seconds = 1 year)
347
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
348
# Prevent browsers from incorrectly detecting non-scripts as scripts
349
Header always set X-Content-Type-Options nosniff
350
# Cors
351
Header always set Access-Control-Allow-Origin "*"
352
# CSP calculated by FF Addon Laboratory
152 - 353
Header always set Content-Security-Policy "default-src 'none'; frame-src https://ws-na.amazon-adsystem.com https://www.youtube-nocookie.com; img-src 'self' data: https://www.google-analytics.com; script-src 'self' 'unsafe-inline' https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/js; style-src 'self' 'unsafe-inline' https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/;frame-ancestors 'self'"
143 - 354
# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do
355
Header always set Referrer-Policy "no-referrer"
356
# Only allow my site to frame itself
357
#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"
358
Header always set X-Frame-Options SAMEORIGIN
359
# XSS Protection
360
Header set X-XSS-Protection "1; mode=block"
152 - 361
# Redirect all non-www access to www
362
RewriteEngine On
363
RewriteCond %{HTTP_HOST} !^www\. [NC]
364
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
143 - 365
 
142 - 366
SSLEngine on
367
SSLProtocol all -SSLv2 -SSLv3
368
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
369
SSLHonorCipherOrder On
159 - 370
SSLCertificateFile /etc/letsencrypt/live/archerygearonline.linkpc.net/cert.pem
371
SSLCertificateKeyFile /etc/letsencrypt/live/archerygearonline.linkpc.net/privkey.pem
372
SSLCertificateChainFile /etc/letsencrypt/live/archerygearonline.linkpc.net/chain.pem
4 - 373
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
374
    SSLOptions +StdEnvVars
375
</Files>
376
<Directory "/var/www/cgi-bin">
377
    SSLOptions +StdEnvVars
378
</Directory>
379
SetEnvIf User-Agent ".*MSIE.*" \
380
         nokeepalive ssl-unclean-shutdown \
381
         downgrade-1.0 force-response-1.0
382
CustomLog logs/ssl_request_log \
383
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
132 - 384
</VirtualHost>