4 |
- |
1 |
#
|
|
|
2 |
# This is the Apache server configuration file providing SSL support.
|
|
|
3 |
# It contains the configuration directives to instruct the server how to
|
|
|
4 |
# serve pages over an https connection. For detailing information about these
|
|
|
5 |
# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
|
|
|
6 |
#
|
|
|
7 |
# Do NOT simply read the instructions in here without understanding
|
|
|
8 |
# what they do. They're here only as hints or reminders. If you are unsure
|
|
|
9 |
# consult the online docs. You have been warned.
|
|
|
10 |
#
|
|
|
11 |
|
|
|
12 |
LoadModule ssl_module modules/mod_ssl.so
|
|
|
13 |
|
|
|
14 |
#
|
|
|
15 |
# When we also provide SSL we have to listen to the
|
|
|
16 |
# the HTTPS port in addition.
|
|
|
17 |
#
|
|
|
18 |
Listen 443
|
141 |
- |
19 |
NameVirtualHost *:443
|
4 |
- |
20 |
|
|
|
21 |
##
|
|
|
22 |
## SSL Global Context
|
|
|
23 |
##
|
|
|
24 |
## All SSL configuration in this context applies both to
|
|
|
25 |
## the main server and all SSL-enabled virtual hosts.
|
|
|
26 |
##
|
|
|
27 |
|
|
|
28 |
# Pass Phrase Dialog:
|
|
|
29 |
# Configure the pass phrase gathering process.
|
|
|
30 |
# The filtering dialog program (`builtin' is a internal
|
|
|
31 |
# terminal dialog) has to provide the pass phrase on stdout.
|
|
|
32 |
SSLPassPhraseDialog builtin
|
|
|
33 |
|
|
|
34 |
# Inter-Process Session Cache:
|
|
|
35 |
# Configure the SSL Session Cache: First the mechanism
|
|
|
36 |
# to use and second the expiring timeout (in seconds).
|
|
|
37 |
SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
|
|
|
38 |
SSLSessionCacheTimeout 300
|
|
|
39 |
|
|
|
40 |
# Semaphore:
|
|
|
41 |
# Configure the path to the mutual exclusion semaphore the
|
|
|
42 |
# SSL engine uses internally for inter-process synchronization.
|
|
|
43 |
SSLMutex default
|
|
|
44 |
|
|
|
45 |
# Pseudo Random Number Generator (PRNG):
|
|
|
46 |
# Configure one or more sources to seed the PRNG of the
|
|
|
47 |
# SSL library. The seed data should be of good random quality.
|
|
|
48 |
# WARNING! On some platforms /dev/random blocks if not enough entropy
|
|
|
49 |
# is available. This means you then cannot use the /dev/random device
|
|
|
50 |
# because it would lead to very long connection times (as long as
|
|
|
51 |
# it requires to make more entropy available). But usually those
|
|
|
52 |
# platforms additionally provide a /dev/urandom device which doesn't
|
|
|
53 |
# block. So, if available, use this one instead. Read the mod_ssl User
|
|
|
54 |
# Manual for more details.
|
|
|
55 |
SSLRandomSeed startup file:/dev/urandom 256
|
|
|
56 |
SSLRandomSeed connect builtin
|
|
|
57 |
#SSLRandomSeed startup file:/dev/random 512
|
|
|
58 |
#SSLRandomSeed connect file:/dev/random 512
|
|
|
59 |
#SSLRandomSeed connect file:/dev/urandom 512
|
|
|
60 |
|
|
|
61 |
#
|
|
|
62 |
# Use "SSLCryptoDevice" to enable any supported hardware
|
|
|
63 |
# accelerators. Use "openssl engine -v" to list supported
|
|
|
64 |
# engine names. NOTE: If you enable an accelerator and the
|
|
|
65 |
# server does not start, consult the error logs and ensure
|
|
|
66 |
# your accelerator is functioning properly.
|
|
|
67 |
#
|
|
|
68 |
SSLCryptoDevice builtin
|
|
|
69 |
#SSLCryptoDevice ubsec
|
|
|
70 |
|
|
|
71 |
##
|
|
|
72 |
## SSL Virtual Host Context
|
|
|
73 |
##
|
|
|
74 |
|
141 |
- |
75 |
<VirtualHost *:443>
|
4 |
- |
76 |
|
|
|
77 |
# General setup for the virtual host, inherited from global configuration
|
132 |
- |
78 |
DocumentRoot "/var/www/shtml"
|
143 |
- |
79 |
ServerName www.ujsoftware.com
|
159 |
- |
80 |
ServerAlias ujsoftware.com
|
4 |
- |
81 |
|
|
|
82 |
# Use separate log files for the SSL virtual host; note that LogLevel
|
|
|
83 |
# is not inherited from httpd.conf.
|
|
|
84 |
ErrorLog logs/ssl_error_log
|
|
|
85 |
TransferLog logs/ssl_access_log
|
|
|
86 |
LogLevel warn
|
|
|
87 |
|
|
|
88 |
# SSL Engine Switch:
|
|
|
89 |
# Enable/Disable SSL for this virtual host.
|
|
|
90 |
SSLEngine on
|
|
|
91 |
|
|
|
92 |
# SSL Protocol support:
|
|
|
93 |
# List the enable protocol levels with which clients will be able to
|
|
|
94 |
# connect. Disable SSLv2 access by default:
|
132 |
- |
95 |
SSLProtocol all -SSLv2 -SSLv3
|
4 |
- |
96 |
|
|
|
97 |
# SSL Cipher Suite:
|
|
|
98 |
# List the ciphers that the client is permitted to negotiate.
|
|
|
99 |
# See the mod_ssl documentation for a complete list.
|
132 |
- |
100 |
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
|
|
|
101 |
SSLHonorCipherOrder On
|
4 |
- |
102 |
|
|
|
103 |
# Server Certificate:
|
|
|
104 |
# Point SSLCertificateFile at a PEM encoded certificate. If
|
|
|
105 |
# the certificate is encrypted, then you will be prompted for a
|
|
|
106 |
# pass phrase. Note that a kill -HUP will prompt again. A new
|
|
|
107 |
# certificate can be generated using the genkey(1) command.
|
143 |
- |
108 |
SSLCertificateFile /etc/letsencrypt/live/ujsoftware.com/cert.pem
|
4 |
- |
109 |
|
|
|
110 |
# Server Private Key:
|
|
|
111 |
# If the key is not combined with the certificate, use this
|
|
|
112 |
# directive to point at the key file. Keep in mind that if
|
|
|
113 |
# you've both a RSA and a DSA private key you can configure
|
|
|
114 |
# both in parallel (to also allow the use of DSA ciphers, etc.)
|
143 |
- |
115 |
SSLCertificateKeyFile /etc/letsencrypt/live/ujsoftware.com/privkey.pem
|
4 |
- |
116 |
|
|
|
117 |
# Server Certificate Chain:
|
|
|
118 |
# Point SSLCertificateChainFile at a file containing the
|
|
|
119 |
# concatenation of PEM encoded CA certificates which form the
|
|
|
120 |
# certificate chain for the server certificate. Alternatively
|
|
|
121 |
# the referenced file can be the same as SSLCertificateFile
|
|
|
122 |
# when the CA certificates are directly appended to the server
|
|
|
123 |
# certificate for convinience.
|
143 |
- |
124 |
SSLCertificateChainFile /etc/letsencrypt/live/ujsoftware.com/chain.pem
|
4 |
- |
125 |
|
|
|
126 |
# Certificate Authority (CA):
|
|
|
127 |
# Set the CA certificate verification path where to find CA
|
|
|
128 |
# certificates for client authentication or alternatively one
|
|
|
129 |
# huge file containing all of them (file must be PEM encoded)
|
141 |
- |
130 |
#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
|
|
|
131 |
|
|
|
132 |
# Client Authentication (Type):
|
|
|
133 |
# Client certificate verification type and depth. Types are
|
|
|
134 |
# none, optional, require and optional_no_ca. Depth is a
|
|
|
135 |
# number which specifies how deeply to verify the certificate
|
|
|
136 |
# issuer chain before deciding the certificate is not valid.
|
|
|
137 |
#SSLVerifyClient require
|
|
|
138 |
#SSLVerifyDepth 10
|
|
|
139 |
|
|
|
140 |
# Access Control:
|
|
|
141 |
# With SSLRequire you can do per-directory access control based
|
|
|
142 |
# on arbitrary complex boolean expressions containing server
|
|
|
143 |
# variable checks and other lookup directives. The syntax is a
|
|
|
144 |
# mixture between C and Perl. See the mod_ssl documentation
|
|
|
145 |
# for more details.
|
|
|
146 |
#<Location />
|
|
|
147 |
#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
|
|
|
148 |
# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
|
|
|
149 |
# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
|
|
|
150 |
# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
|
|
|
151 |
# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
|
|
|
152 |
# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
|
|
|
153 |
#</Location>
|
|
|
154 |
|
|
|
155 |
# SSL Engine Options:
|
|
|
156 |
# Set various options for the SSL engine.
|
|
|
157 |
# o FakeBasicAuth:
|
|
|
158 |
# Translate the client X.509 into a Basic Authorisation. This means that
|
|
|
159 |
# the standard Auth/DBMAuth methods can be used for access control. The
|
|
|
160 |
# user name is the `one line' version of the client's X.509 certificate.
|
|
|
161 |
# Note that no password is obtained from the user. Every entry in the user
|
|
|
162 |
# file needs this password: `xxj31ZMTZzkVA'.
|
|
|
163 |
# o ExportCertData:
|
|
|
164 |
# This exports two additional environment variables: SSL_CLIENT_CERT and
|
|
|
165 |
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
|
|
|
166 |
# server (always existing) and the client (only existing when client
|
|
|
167 |
# authentication is used). This can be used to import the certificates
|
|
|
168 |
# into CGI scripts.
|
|
|
169 |
# o StdEnvVars:
|
|
|
170 |
# This exports the standard SSL/TLS related `SSL_*' environment variables.
|
|
|
171 |
# Per default this exportation is switched off for performance reasons,
|
|
|
172 |
# because the extraction step is an expensive operation and is usually
|
|
|
173 |
# useless for serving static content. So one usually enables the
|
|
|
174 |
# exportation for CGI and SSI requests only.
|
|
|
175 |
# o StrictRequire:
|
|
|
176 |
# This denies access when "SSLRequireSSL" or "SSLRequire" applied even
|
|
|
177 |
# under a "Satisfy any" situation, i.e. when it applies access is denied
|
|
|
178 |
# and no other module can change it.
|
|
|
179 |
# o OptRenegotiate:
|
|
|
180 |
# This enables optimized SSL connection renegotiation handling when SSL
|
|
|
181 |
# directives are used in per-directory context.
|
|
|
182 |
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
|
|
|
183 |
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
|
|
|
184 |
SSLOptions +StdEnvVars
|
|
|
185 |
</Files>
|
|
|
186 |
<Directory "/var/www/cgi-bin">
|
|
|
187 |
SSLOptions +StdEnvVars
|
|
|
188 |
</Directory>
|
|
|
189 |
|
|
|
190 |
# SSL Protocol Adjustments:
|
|
|
191 |
# The safe and default but still SSL/TLS standard compliant shutdown
|
|
|
192 |
# approach is that mod_ssl sends the close notify alert but doesn't wait for
|
|
|
193 |
# the close notify alert from client. When you need a different shutdown
|
|
|
194 |
# approach you can use one of the following variables:
|
|
|
195 |
# o ssl-unclean-shutdown:
|
|
|
196 |
# This forces an unclean shutdown when the connection is closed, i.e. no
|
|
|
197 |
# SSL close notify alert is send or allowed to received. This violates
|
|
|
198 |
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
|
|
|
199 |
# this when you receive I/O errors because of the standard approach where
|
|
|
200 |
# mod_ssl sends the close notify alert.
|
|
|
201 |
# o ssl-accurate-shutdown:
|
|
|
202 |
# This forces an accurate shutdown when the connection is closed, i.e. a
|
|
|
203 |
# SSL close notify alert is send and mod_ssl waits for the close notify
|
|
|
204 |
# alert of the client. This is 100% SSL/TLS standard compliant, but in
|
|
|
205 |
# practice often causes hanging connections with brain-dead browsers. Use
|
|
|
206 |
# this only for browsers where you know that their SSL implementation
|
|
|
207 |
# works correctly.
|
|
|
208 |
# Notice: Most problems of broken clients are also related to the HTTP
|
|
|
209 |
# keep-alive facility, so you usually additionally want to disable
|
|
|
210 |
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
|
|
|
211 |
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
|
|
|
212 |
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
|
|
|
213 |
# "force-response-1.0" for this.
|
|
|
214 |
SetEnvIf User-Agent ".*MSIE.*" \
|
|
|
215 |
nokeepalive ssl-unclean-shutdown \
|
|
|
216 |
downgrade-1.0 force-response-1.0
|
|
|
217 |
|
|
|
218 |
# Per-Server Logging:
|
|
|
219 |
# The home of a custom SSL log file. Use this when you want a
|
|
|
220 |
# compact non-error SSL logfile on a virtual host basis.
|
|
|
221 |
CustomLog logs/ssl_request_log \
|
|
|
222 |
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
|
|
223 |
|
|
|
224 |
</VirtualHost>
|
|
|
225 |
|
142 |
- |
226 |
<VirtualHost *:443>
|
|
|
227 |
DocumentRoot "/var/www/munatrading"
|
|
|
228 |
ServerName www.munatrading.linkpc.net
|
|
|
229 |
ServerAlias munatrading.linkpc.net
|
141 |
- |
230 |
|
142 |
- |
231 |
ErrorLog logs/ssl_error_log
|
|
|
232 |
TransferLog logs/ssl_access_log
|
|
|
233 |
LogLevel warn
|
141 |
- |
234 |
|
143 |
- |
235 |
# HSTS (15768000 seconds = 6 month)
|
|
|
236 |
Header always set Strict-Transport-Security "max-age=15768000; preload"
|
|
|
237 |
# Prevent browsers from incorrectly detecting non-scripts as scripts
|
|
|
238 |
Header always set X-Content-Type-Options nosniff
|
|
|
239 |
# Cors
|
|
|
240 |
Header always set Access-Control-Allow-Origin "*"
|
|
|
241 |
# CSP calculated by FF Addon Laboratory
|
|
|
242 |
Header always set Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com; frame-src data:; img-src 'self' data: https://counters.auctiva.com https://i.ebayimg.com https://i.thenile.io https://img.comc.com https://ir.ebaystatic.com https://scimg.auctiva.com https://storage.googleapis.com https://thumbs1.ebaystatic.com https://thumbs2.ebaystatic.com https://thumbs3.ebaystatic.com https://thumbs4.ebaystatic.com https://ti2.auctiva.com https://www.thenile.com.au; script-src 'self' 'unsafe-inline' https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js https://cdn.jsdelivr.net/npm/lodash@4.17.11/lodash.min.js https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.7.3/Chart.min.js https://cdnjs.cloudflare.com/ajax/libs/bootstrap-select/1.13.2/js/bootstrap-select.js https://cdnjs.cloudflare.com/ajax/libs/moment-timezone/0.5.23/moment-timezone-with-data-2012-2022.min.js https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.23.0/moment.min.js https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/popper.min.js https://maps.googleapis.com/maps-api-v3/api/js/36/10a/common.js https://maps.googleapis.com/maps-api-v3/api/js/36/10a/geocoder.js https://maps.googleapis.com/maps-api-v3/api/js/36/10a/util.js https://maps.googleapis.com/maps/api/js https://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com/ajax/libs/bootstrap-select/1.13.2/css/ https://fonts.googleapis.com/ https://img.comc.com/Content/eBay/ https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/css/ https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ https://scrollinggallery.auctiva.com/gallery/css/2(0)/AUCTIVA/1362185/0/25/ https://storage.googleapis.com/ebay-assets/grandeagle/css/ https://www.w3schools.com/w3css/4/;frame-ancestors 'self'"
|
|
|
243 |
# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do
|
|
|
244 |
Header always set Referrer-Policy "no-referrer"
|
|
|
245 |
# Only allow my site to frame itself
|
|
|
246 |
#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"
|
|
|
247 |
Header always set X-Frame-Options SAMEORIGIN
|
|
|
248 |
# XSS Protection
|
|
|
249 |
Header set X-XSS-Protection "1; mode=block"
|
152 |
- |
250 |
# Redirect all non-www access to www
|
|
|
251 |
RewriteEngine On
|
|
|
252 |
RewriteCond %{HTTP_HOST} !^www\. [NC]
|
|
|
253 |
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
|
143 |
- |
254 |
|
142 |
- |
255 |
SSLEngine on
|
|
|
256 |
SSLProtocol all -SSLv2 -SSLv3
|
|
|
257 |
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
|
|
|
258 |
SSLHonorCipherOrder On
|
143 |
- |
259 |
SSLCertificateFile /etc/letsencrypt/live/munatrading.linkpc.net/cert.pem
|
|
|
260 |
SSLCertificateKeyFile /etc/letsencrypt/live/munatrading.linkpc.net/privkey.pem
|
|
|
261 |
SSLCertificateChainFile /etc/letsencrypt/live/munatrading.linkpc.net/chain.pem
|
142 |
- |
262 |
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
|
|
|
263 |
SSLOptions +StdEnvVars
|
|
|
264 |
</Files>
|
|
|
265 |
<Directory "/var/www/cgi-bin">
|
|
|
266 |
SSLOptions +StdEnvVars
|
|
|
267 |
</Directory>
|
|
|
268 |
<Directory "/var/www/munatrading/ebay/listings">
|
|
|
269 |
Options +Indexes
|
|
|
270 |
IndexOptions IgnoreCase FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=* SuppressHTMLPreamble
|
|
|
271 |
</Directory>
|
|
|
272 |
SetEnvIf User-Agent ".*MSIE.*" \
|
|
|
273 |
nokeepalive ssl-unclean-shutdown \
|
|
|
274 |
downgrade-1.0 force-response-1.0
|
|
|
275 |
CustomLog logs/ssl_request_log \
|
|
|
276 |
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
|
|
277 |
</VirtualHost>
|
141 |
- |
278 |
|
|
|
279 |
<VirtualHost *:443>
|
152 |
- |
280 |
DocumentRoot "/var/www/cheapmusic/www"
|
|
|
281 |
ServerName www.findcheapmusic.linkpc.net
|
|
|
282 |
ServerAlias findcheapmusic.linkpc.net
|
141 |
- |
283 |
|
146 |
- |
284 |
ErrorDocument 403 /index.php
|
|
|
285 |
ErrorDocument 404 /index.php
|
|
|
286 |
|
141 |
- |
287 |
ErrorLog logs/ssl_error_log
|
|
|
288 |
TransferLog logs/ssl_access_log
|
|
|
289 |
LogLevel warn
|
|
|
290 |
|
143 |
- |
291 |
# HSTS (31536000 seconds = 1 year)
|
|
|
292 |
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
|
293 |
# Prevent browsers from incorrectly detecting non-scripts as scripts
|
|
|
294 |
Header always set X-Content-Type-Options nosniff
|
|
|
295 |
# Cors
|
|
|
296 |
Header always set Access-Control-Allow-Origin "*"
|
|
|
297 |
# Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https
|
164 |
- |
298 |
Header always set Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src data: https://fonts.gstatic.com https://use.fontawesome.com; form-action 'self'; frame-src https://www.google.com; img-src 'self' data: http://abs.twimg.com https://abs.twimg.com https://i5.walmartimages.com https://images.samash.com https://img.discogs.com https://lh4.googleusercontent.com https://thumbs1.ebaystatic.com https://thumbs2.ebaystatic.com https://thumbs3.ebaystatic.com https://thumbs4.ebaystatic.com https://www.fye.com https://www.musicnotes.com https://www.secondspin.com https://platform-lookaside.fbsbx.com https://ad.linksynergy.com https://www.lduhtrp.net https://i5.wal.co https://cj.dotomi.com https://www.awltovhc.com https://www.ftjcfx.com https://www.tqlkg.com https://www.emjcd.com https://www.yceml.net https://beacon.affil.walmart.com https://assets.sheetmusicplus.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/ https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/ https://use.fontawesome.com/releases/v5.8.1/css/;frame-ancestors 'self'"
|
143 |
- |
299 |
# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do
|
|
|
300 |
Header always set Referrer-Policy "no-referrer"
|
|
|
301 |
# Only allow my site to frame itself
|
|
|
302 |
#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"
|
|
|
303 |
Header always set X-Frame-Options SAMEORIGIN
|
|
|
304 |
# XSS Protection
|
|
|
305 |
Header set X-XSS-Protection "1; mode=block"
|
146 |
- |
306 |
# Protect cookies with HTTPOnly flag
|
|
|
307 |
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
|
|
|
308 |
# Redirect all non-www access to www
|
|
|
309 |
RewriteEngine On
|
|
|
310 |
RewriteCond %{HTTP_HOST} !^www\. [NC]
|
|
|
311 |
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
|
143 |
- |
312 |
|
141 |
- |
313 |
SSLEngine on
|
|
|
314 |
SSLProtocol all -SSLv2 -SSLv3
|
|
|
315 |
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
|
|
|
316 |
SSLHonorCipherOrder On
|
152 |
- |
317 |
SSLCertificateFile /etc/letsencrypt/live/findcheapmusic.linkpc.net/cert.pem
|
|
|
318 |
SSLCertificateKeyFile /etc/letsencrypt/live/findcheapmusic.linkpc.net/privkey.pem
|
|
|
319 |
SSLCertificateChainFile /etc/letsencrypt/live/findcheapmusic.linkpc.net/chain.pem
|
142 |
- |
320 |
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
|
|
|
321 |
SSLOptions +StdEnvVars
|
|
|
322 |
</Files>
|
|
|
323 |
<Directory "/var/www/cgi-bin">
|
|
|
324 |
SSLOptions +StdEnvVars
|
|
|
325 |
</Directory>
|
|
|
326 |
SetEnvIf User-Agent ".*MSIE.*" \
|
|
|
327 |
nokeepalive ssl-unclean-shutdown \
|
|
|
328 |
downgrade-1.0 force-response-1.0
|
|
|
329 |
CustomLog logs/ssl_request_log \
|
|
|
330 |
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
|
|
331 |
</VirtualHost>
|
141 |
- |
332 |
|
4 |
- |
333 |
|
142 |
- |
334 |
<VirtualHost *:443>
|
|
|
335 |
DocumentRoot "/var/www/archerygear"
|
159 |
- |
336 |
ServerName www.archerygearonline.linkpc.net
|
|
|
337 |
ServerAlias archerygearonline.linkpc.net
|
4 |
- |
338 |
|
152 |
- |
339 |
ErrorDocument 403 /index.php
|
|
|
340 |
ErrorDocument 404 /index.php
|
|
|
341 |
|
142 |
- |
342 |
ErrorLog logs/ssl_error_log
|
|
|
343 |
TransferLog logs/ssl_access_log
|
|
|
344 |
LogLevel warn
|
4 |
- |
345 |
|
143 |
- |
346 |
# HSTS (31536000 seconds = 1 year)
|
|
|
347 |
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
|
|
|
348 |
# Prevent browsers from incorrectly detecting non-scripts as scripts
|
|
|
349 |
Header always set X-Content-Type-Options nosniff
|
|
|
350 |
# Cors
|
|
|
351 |
Header always set Access-Control-Allow-Origin "*"
|
|
|
352 |
# CSP calculated by FF Addon Laboratory
|
152 |
- |
353 |
Header always set Content-Security-Policy "default-src 'none'; frame-src https://ws-na.amazon-adsystem.com https://www.youtube-nocookie.com; img-src 'self' data: https://www.google-analytics.com; script-src 'self' 'unsafe-inline' https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/js; style-src 'self' 'unsafe-inline' https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/;frame-ancestors 'self'"
|
143 |
- |
354 |
# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do
|
|
|
355 |
Header always set Referrer-Policy "no-referrer"
|
|
|
356 |
# Only allow my site to frame itself
|
|
|
357 |
#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"
|
|
|
358 |
Header always set X-Frame-Options SAMEORIGIN
|
|
|
359 |
# XSS Protection
|
|
|
360 |
Header set X-XSS-Protection "1; mode=block"
|
152 |
- |
361 |
# Redirect all non-www access to www
|
|
|
362 |
RewriteEngine On
|
|
|
363 |
RewriteCond %{HTTP_HOST} !^www\. [NC]
|
|
|
364 |
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
|
143 |
- |
365 |
|
142 |
- |
366 |
SSLEngine on
|
|
|
367 |
SSLProtocol all -SSLv2 -SSLv3
|
|
|
368 |
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
|
|
|
369 |
SSLHonorCipherOrder On
|
159 |
- |
370 |
SSLCertificateFile /etc/letsencrypt/live/archerygearonline.linkpc.net/cert.pem
|
|
|
371 |
SSLCertificateKeyFile /etc/letsencrypt/live/archerygearonline.linkpc.net/privkey.pem
|
|
|
372 |
SSLCertificateChainFile /etc/letsencrypt/live/archerygearonline.linkpc.net/chain.pem
|
4 |
- |
373 |
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
|
|
|
374 |
SSLOptions +StdEnvVars
|
|
|
375 |
</Files>
|
|
|
376 |
<Directory "/var/www/cgi-bin">
|
|
|
377 |
SSLOptions +StdEnvVars
|
|
|
378 |
</Directory>
|
|
|
379 |
SetEnvIf User-Agent ".*MSIE.*" \
|
|
|
380 |
nokeepalive ssl-unclean-shutdown \
|
|
|
381 |
downgrade-1.0 force-response-1.0
|
|
|
382 |
CustomLog logs/ssl_request_log \
|
|
|
383 |
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
|
132 |
- |
384 |
</VirtualHost>
|