Subversion Repositories configs

#

# This is the Apache server configuration file providing SSL support.

# It contains the configuration directives to instruct the server how to

# serve pages over an https connection. For detailing information about these

# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>

#

# Do NOT simply read the instructions in here without understanding

# what they do.  They're here only as hints or reminders.  If you are unsure

# consult the online docs. You have been warned.

#

LoadModule ssl_module modules/mod_ssl.so

#

# When we also provide SSL we have to listen to the

# the HTTPS port in addition.

#

Listen 443

NameVirtualHost *:443

##

##  SSL Global Context

##

##  All SSL configuration in this context applies both to

##  the main server and all SSL-enabled virtual hosts.

##

#   Pass Phrase Dialog:

#   Configure the pass phrase gathering process.

#   The filtering dialog program (`builtin' is a internal

#   terminal dialog) has to provide the pass phrase on stdout.

SSLPassPhraseDialog  builtin

#   Inter-Process Session Cache:

#   Configure the SSL Session Cache: First the mechanism

#   to use and second the expiring timeout (in seconds).

SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)

SSLSessionCacheTimeout  300

#   Semaphore:

#   Configure the path to the mutual exclusion semaphore the

#   SSL engine uses internally for inter-process synchronization.

SSLMutex default

#   Pseudo Random Number Generator (PRNG):

#   Configure one or more sources to seed the PRNG of the

#   SSL library. The seed data should be of good random quality.

#   WARNING! On some platforms /dev/random blocks if not enough entropy

#   is available. This means you then cannot use the /dev/random device

#   because it would lead to very long connection times (as long as

#   it requires to make more entropy available). But usually those

#   platforms additionally provide a /dev/urandom device which doesn't

#   block. So, if available, use this one instead. Read the mod_ssl User

#   Manual for more details.

SSLRandomSeed startup file:/dev/urandom  256

SSLRandomSeed connect builtin

#SSLRandomSeed startup file:/dev/random  512

#SSLRandomSeed connect file:/dev/random  512

#SSLRandomSeed connect file:/dev/urandom 512

#

# Use "SSLCryptoDevice" to enable any supported hardware

# accelerators. Use "openssl engine -v" to list supported

# engine names.  NOTE: If you enable an accelerator and the

# server does not start, consult the error logs and ensure

# your accelerator is functioning properly.

#

SSLCryptoDevice builtin

#SSLCryptoDevice ubsec

##

## SSL Virtual Host Context

##

<VirtualHost *:443>

# General setup for the virtual host, inherited from global configuration

DocumentRoot "/var/www/shtml"

ServerName www.ujsoftware.com

ServerAlias ujsoftware.com

# Use separate log files for the SSL virtual host; note that LogLevel

# is not inherited from httpd.conf.

ErrorLog logs/ssl_error_log

TransferLog logs/ssl_access_log

LogLevel warn

#   SSL Engine Switch:

#   Enable/Disable SSL for this virtual host.

SSLEngine on

#   SSL Protocol support:

# List the enable protocol levels with which clients will be able to

# connect.  Disable SSLv2 access by default:

SSLProtocol all -SSLv2 -SSLv3

#   SSL Cipher Suite:

# List the ciphers that the client is permitted to negotiate.

# See the mod_ssl documentation for a complete list.

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

SSLHonorCipherOrder On

#   Server Certificate:

# Point SSLCertificateFile at a PEM encoded certificate.  If

# the certificate is encrypted, then you will be prompted for a

# pass phrase.  Note that a kill -HUP will prompt again.  A new

# certificate can be generated using the genkey(1) command.

SSLCertificateFile /etc/letsencrypt/live/ujsoftware.com/cert.pem

#   Server Private Key:

#   If the key is not combined with the certificate, use this

#   directive to point at the key file.  Keep in mind that if

#   you've both a RSA and a DSA private key you can configure

#   both in parallel (to also allow the use of DSA ciphers, etc.)

SSLCertificateKeyFile /etc/letsencrypt/live/ujsoftware.com/privkey.pem

#   Server Certificate Chain:

#   Point SSLCertificateChainFile at a file containing the

#   concatenation of PEM encoded CA certificates which form the

#   certificate chain for the server certificate. Alternatively

#   the referenced file can be the same as SSLCertificateFile

#   when the CA certificates are directly appended to the server

#   certificate for convinience.

SSLCertificateChainFile /etc/letsencrypt/live/ujsoftware.com/chain.pem

#   Certificate Authority (CA):

#   Set the CA certificate verification path where to find CA

#   certificates for client authentication or alternatively one

#   huge file containing all of them (file must be PEM encoded)

#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt

#   Client Authentication (Type):

#   Client certificate verification type and depth.  Types are

#   none, optional, require and optional_no_ca.  Depth is a

#   number which specifies how deeply to verify the certificate

#   issuer chain before deciding the certificate is not valid.

#SSLVerifyClient require

#SSLVerifyDepth  10

#   Access Control:

#   With SSLRequire you can do per-directory access control based

#   on arbitrary complex boolean expressions containing server

#   variable checks and other lookup directives.  The syntax is a

#   mixture between C and Perl.  See the mod_ssl documentation

#   for more details.

#<Location />

#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \

#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \

#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \

#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \

#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \

#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/

#</Location>

#   SSL Engine Options:

#   Set various options for the SSL engine.

#   o FakeBasicAuth:

#     Translate the client X.509 into a Basic Authorisation.  This means that

#     the standard Auth/DBMAuth methods can be used for access control.  The

#     user name is the `one line' version of the client's X.509 certificate.

#     Note that no password is obtained from the user. Every entry in the user

#     file needs this password: `xxj31ZMTZzkVA'.

#   o ExportCertData:

#     This exports two additional environment variables: SSL_CLIENT_CERT and

#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the

#     server (always existing) and the client (only existing when client

#     authentication is used). This can be used to import the certificates

#     into CGI scripts.

#   o StdEnvVars:

#     This exports the standard SSL/TLS related `SSL_*' environment variables.

#     Per default this exportation is switched off for performance reasons,

#     because the extraction step is an expensive operation and is usually

#     useless for serving static content. So one usually enables the

#     exportation for CGI and SSI requests only.

#   o StrictRequire:

#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even

#     under a "Satisfy any" situation, i.e. when it applies access is denied

#     and no other module can change it.

#   o OptRenegotiate:

#     This enables optimized SSL connection renegotiation handling when SSL

#     directives are used in per-directory context.

#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire

<Files ~ "\.(cgi|shtml|phtml|php3?)$">

    SSLOptions +StdEnvVars

</Files>

<Directory "/var/www/cgi-bin">

    SSLOptions +StdEnvVars

</Directory>

#   SSL Protocol Adjustments:

#   The safe and default but still SSL/TLS standard compliant shutdown

#   approach is that mod_ssl sends the close notify alert but doesn't wait for

#   the close notify alert from client. When you need a different shutdown

#   approach you can use one of the following variables:

#   o ssl-unclean-shutdown:

#     This forces an unclean shutdown when the connection is closed, i.e. no

#     SSL close notify alert is send or allowed to received.  This violates

#     the SSL/TLS standard but is needed for some brain-dead browsers. Use

#     this when you receive I/O errors because of the standard approach where

#     mod_ssl sends the close notify alert.

#   o ssl-accurate-shutdown:

#     This forces an accurate shutdown when the connection is closed, i.e. a

#     SSL close notify alert is send and mod_ssl waits for the close notify

#     alert of the client. This is 100% SSL/TLS standard compliant, but in

#     practice often causes hanging connections with brain-dead browsers. Use

#     this only for browsers where you know that their SSL implementation

#     works correctly.

#   Notice: Most problems of broken clients are also related to the HTTP

#   keep-alive facility, so you usually additionally want to disable

#   keep-alive for those clients, too. Use variable "nokeepalive" for this.

#   Similarly, one has to force some clients to use HTTP/1.0 to workaround

#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and

#   "force-response-1.0" for this.

SetEnvIf User-Agent ".*MSIE.*" \

         nokeepalive ssl-unclean-shutdown \

         downgrade-1.0 force-response-1.0

#   Per-Server Logging:

#   The home of a custom SSL log file. Use this when you want a

#   compact non-error SSL logfile on a virtual host basis.

CustomLog logs/ssl_request_log \

          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

<VirtualHost *:443>

DocumentRoot "/var/www/munatrading"

ServerName www.munatrading.linkpc.net

ServerAlias munatrading.linkpc.net

ErrorLog logs/ssl_error_log

TransferLog logs/ssl_access_log

LogLevel warn

# HSTS (15768000 seconds = 6 month)

Header always set Strict-Transport-Security "max-age=15768000; preload"

# Prevent browsers from incorrectly detecting non-scripts as scripts

Header always set X-Content-Type-Options nosniff

# Cors

Header always set Access-Control-Allow-Origin "*"

# CSP calculated by FF Addon Laboratory

Header always set Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src https://fonts.gstatic.com https://maxcdn.bootstrapcdn.com; frame-src data:; img-src 'self' data: https://counters.auctiva.com https://i.ebayimg.com https://i.thenile.io https://img.comc.com https://ir.ebaystatic.com https://scimg.auctiva.com https://storage.googleapis.com https://thumbs1.ebaystatic.com https://thumbs2.ebaystatic.com https://thumbs3.ebaystatic.com https://thumbs4.ebaystatic.com https://ti2.auctiva.com https://www.thenile.com.au; script-src 'self' 'unsafe-inline' https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js https://cdn.jsdelivr.net/npm/lodash@4.17.11/lodash.min.js https://cdnjs.cloudflare.com/ajax/libs/Chart.js/2.7.3/Chart.min.js https://cdnjs.cloudflare.com/ajax/libs/bootstrap-select/1.13.2/js/bootstrap-select.js https://cdnjs.cloudflare.com/ajax/libs/moment-timezone/0.5.23/moment-timezone-with-data-2012-2022.min.js https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.23.0/moment.min.js https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/popper.min.js https://maps.googleapis.com/maps-api-v3/api/js/36/10a/common.js https://maps.googleapis.com/maps-api-v3/api/js/36/10a/geocoder.js https://maps.googleapis.com/maps-api-v3/api/js/36/10a/util.js https://maps.googleapis.com/maps/api/js https://maps.googleapis.com/maps/api/js/AuthenticationService.Authenticate https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com/ajax/libs/bootstrap-select/1.13.2/css/ https://fonts.googleapis.com/ https://img.comc.com/Content/eBay/ https://maxcdn.bootstrapcdn.com/bootstrap/4.1.3/css/ https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ https://scrollinggallery.auctiva.com/gallery/css/2(0)/AUCTIVA/1362185/0/25/ https://storage.googleapis.com/ebay-assets/grandeagle/css/ https://www.w3schools.com/w3css/4/;frame-ancestors 'self'"

# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do

Header always set Referrer-Policy "no-referrer"

# Only allow my site to frame itself

#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"

Header always set X-Frame-Options SAMEORIGIN

# XSS Protection

Header set X-XSS-Protection "1; mode=block"

# Redirect all non-www access to www

RewriteEngine On

RewriteCond %{HTTP_HOST} !^www\. [NC]

RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

SSLEngine on

SSLProtocol all -SSLv2 -SSLv3

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

SSLHonorCipherOrder On

SSLCertificateFile /etc/letsencrypt/live/munatrading.linkpc.net/cert.pem

SSLCertificateKeyFile /etc/letsencrypt/live/munatrading.linkpc.net/privkey.pem

SSLCertificateChainFile /etc/letsencrypt/live/munatrading.linkpc.net/chain.pem

<Files ~ "\.(cgi|shtml|phtml|php3?)$">

    SSLOptions +StdEnvVars

</Files>

<Directory "/var/www/cgi-bin">

    SSLOptions +StdEnvVars

</Directory>

<Directory "/var/www/munatrading/ebay/listings">

  Options +Indexes

  IndexOptions IgnoreCase FancyIndexing FoldersFirst NameWidth=* DescriptionWidth=* SuppressHTMLPreamble

</Directory>

SetEnvIf User-Agent ".*MSIE.*" \

         nokeepalive ssl-unclean-shutdown \

         downgrade-1.0 force-response-1.0

CustomLog logs/ssl_request_log \

          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

<VirtualHost *:443>

DocumentRoot "/var/www/cheapmusic/www"

ServerName www.findcheapmusic.linkpc.net

ServerAlias findcheapmusic.linkpc.net

ErrorDocument 403 /index.php

ErrorDocument 404 /index.php

ErrorLog logs/ssl_error_log

TransferLog logs/ssl_access_log

LogLevel warn

# HSTS (31536000 seconds = 1 year)

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# Prevent browsers from incorrectly detecting non-scripts as scripts

Header always set X-Content-Type-Options nosniff

# Cors

Header always set Access-Control-Allow-Origin "*"

# Disable unsafe inline/eval, only allow loading of resources (images, fonts, scripts, etc.) over https

Header always set Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src data: https://fonts.gstatic.com https://use.fontawesome.com; form-action 'self'; frame-src https://www.google.com; img-src 'self' data: http://abs.twimg.com https://abs.twimg.com https://i5.walmartimages.com https://images.samash.com https://img.discogs.com https://lh4.googleusercontent.com https://thumbs1.ebaystatic.com https://thumbs2.ebaystatic.com https://thumbs3.ebaystatic.com https://thumbs4.ebaystatic.com https://www.fye.com https://www.musicnotes.com https://www.secondspin.com https://platform-lookaside.fbsbx.com https://ad.linksynergy.com https://www.lduhtrp.net https://i5.wal.co https://cj.dotomi.com https://www.awltovhc.com https://www.ftjcfx.com https://www.tqlkg.com https://www.emjcd.com https://www.yceml.net https://beacon.affil.walmart.com https://assets.sheetmusicplus.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.7/umd/popper.min.js https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com/ https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/ https://use.fontawesome.com/releases/v5.8.1/css/;frame-ancestors 'self'"

# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do

Header always set Referrer-Policy "no-referrer"

# Only allow my site to frame itself

#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"

Header always set X-Frame-Options SAMEORIGIN

# XSS Protection

Header set X-XSS-Protection "1; mode=block"

# Protect cookies with HTTPOnly flag

Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure

# Redirect all non-www access to www

RewriteEngine On

RewriteCond %{HTTP_HOST} !^www\. [NC]

RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

SSLEngine on

SSLProtocol all -SSLv2 -SSLv3

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

SSLHonorCipherOrder On

SSLCertificateFile /etc/letsencrypt/live/findcheapmusic.linkpc.net/cert.pem

SSLCertificateKeyFile /etc/letsencrypt/live/findcheapmusic.linkpc.net/privkey.pem

SSLCertificateChainFile /etc/letsencrypt/live/findcheapmusic.linkpc.net/chain.pem

<Files ~ "\.(cgi|shtml|phtml|php3?)$">

    SSLOptions +StdEnvVars

</Files>

<Directory "/var/www/cgi-bin">

    SSLOptions +StdEnvVars

</Directory>

SetEnvIf User-Agent ".*MSIE.*" \

         nokeepalive ssl-unclean-shutdown \

         downgrade-1.0 force-response-1.0

CustomLog logs/ssl_request_log \

          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

<VirtualHost *:443>

DocumentRoot "/var/www/archerygear"

ServerName www.archerygearonline.linkpc.net

ServerAlias archerygearonline.linkpc.net

ErrorDocument 403 /index.php

ErrorDocument 404 /index.php

ErrorLog logs/ssl_error_log

TransferLog logs/ssl_access_log

LogLevel warn

# HSTS (31536000 seconds = 1 year)

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# Prevent browsers from incorrectly detecting non-scripts as scripts

Header always set X-Content-Type-Options nosniff

# Cors

Header always set Access-Control-Allow-Origin "*"

# CSP calculated by FF Addon Laboratory

Header always set Content-Security-Policy "default-src 'none'; frame-src https://ws-na.amazon-adsystem.com https://www.youtube-nocookie.com; img-src 'self' data: https://www.google-analytics.com; script-src 'self' 'unsafe-inline' https://ajax.googleapis.com/ajax/libs/jquery/3.4.0/jquery.min.js https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/js/bootstrap.min.js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/js; style-src 'self' 'unsafe-inline' https://maxcdn.bootstrapcdn.com/bootstrap/4.3.1/css/;frame-ancestors 'self'"

# Disable referrers for browsers that don't support strict-origin-when-cross-origin; Uses strict-origin-when-cross-origin for browsers that do

Header always set Referrer-Policy "no-referrer"

# Only allow my site to frame itself

#add above# Header always add Content-Security-Policy "frame-ancestors 'self'"

Header always set X-Frame-Options SAMEORIGIN

# XSS Protection

Header set X-XSS-Protection "1; mode=block"

# Redirect all non-www access to www

RewriteEngine On

RewriteCond %{HTTP_HOST} !^www\. [NC]

RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

SSLEngine on

SSLProtocol all -SSLv2 -SSLv3

SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH

SSLHonorCipherOrder On

SSLCertificateFile /etc/letsencrypt/live/archerygearonline.linkpc.net/cert.pem

SSLCertificateKeyFile /etc/letsencrypt/live/archerygearonline.linkpc.net/privkey.pem

SSLCertificateChainFile /etc/letsencrypt/live/archerygearonline.linkpc.net/chain.pem

<Files ~ "\.(cgi|shtml|phtml|php3?)$">

    SSLOptions +StdEnvVars

</Files>

<Directory "/var/www/cgi-bin">

    SSLOptions +StdEnvVars

</Directory>

SetEnvIf User-Agent ".*MSIE.*" \

         nokeepalive ssl-unclean-shutdown \

         downgrade-1.0 force-response-1.0

CustomLog logs/ssl_request_log \

          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>