Beiträge von colbond

dpkg -l | grep php
ii  php-json-schema                       0.2.0                             all          PHP implementation of JSON schema
ii  php-pear                              5.4.45-1~dotdeb+7.1               all          PEAR - PHP Extension and Application Repository
ii  php-xml-parser                        1.3.4-6                           all          PHP PEAR module for parsing XML
ii  php5                                  5.4.45-1~dotdeb+7.1               all          server-side, HTML-embedded scripting language (metapackage)
ii  php5-cgi                              5.4.45-1~dotdeb+7.1               amd64        server-side, HTML-embedded scripting language (CGI binary)
ii  php5-cli                              5.4.45-1~dotdeb+7.1               amd64        command-line interpreter for the php5 scripting language
ii  php5-common                           5.4.45-1~dotdeb+7.1               amd64        Common files for packages built from the php5 source
ii  php5-curl                             5.4.45-1~dotdeb+7.1               amd64        CURL module for php5
ii  php5-fpm                              5.4.45-1~dotdeb+7.1               amd64        server-side, HTML-embedded scripting language (FPM-CGI binary)
ii  php5-gd                               5.4.45-1~dotdeb+7.1               amd64        GD module for php5
ii  php5-intl                             5.4.45-1~dotdeb+7.1               amd64        internationalisation module for php5
ii  php5-mcrypt                           5.4.45-1~dotdeb+7.1               amd64        MCrypt module for php5
ii  php5-mysql                            5.4.45-1~dotdeb+7.1               amd64        MySQL module for php5
ii  php5-pam                              1.0.3-2                           amd64        pam module for PHP 5
ii  php5-pgsql                            5.4.45-1~dotdeb+7.1               amd64        PostgreSQL module for php5
ii  php5-proctitle                        0.1.2-2                           amd64        proctitle module for PHP 5
ii  php5-sqlite                           5.4.45-1~dotdeb+7.1               amd64        SQLite module for php5

# PFS (Perfect Forward Secrecy)
# https://mozilla.github.io/server-side-tls/ssl-config-generator
ssl_protocols TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-S
HA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-
AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';


# Content Security Policy (CSP)
# https://www.owasp.org/index.php/Content_Security_Policy
add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;";


# https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options
add_header X-Frame-Options "SAMEORIGIN";


# http://blogs.msdn.com/b/ie/archive/2008/07/02/ie8-security-part-v-comprehensive-protection.aspx
add_header X-Content-Type-Options "nosniff";


# https://wiki.mozilla.org/Security/Features/XSS_Filter
# http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx
add_header X-XSS-Protection "1; mode=block";

more openmediavault-webgui.conf
[openmediavault-webgui]
user = openmediavault
group = openmediavault


listen = /var/run/php5-fpm-openmediavault-webgui.sock
listen.owner = www-data
listen.group = www-data
listen.mode = 0660


pm = ondemand
pm.max_children = 25
pm.process_idle_timeout = 10s


chdir = /


;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; OpenMediaVault php.ini settings ;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;


; Paths and Directories
php_value[include_path] = ".:/usr/share/php:/var/www/openmediavault"


; Pam Authentication Support (see /etc/pam.d) ;
php_value[pam.servicename] = "openmediavault-webgui";


; Maximum allowed size for uploaded files.
; http://php.net/upload-max-filesize
php_value[upload_max_filesize] = 25M


; Maximum size of POST data that PHP will accept.
; http://php.net/post-max-size
php_value[post_max_size] = 25M


; Do not expose to the world that PHP is installed on the server.
; http://php.net/expose-php
php_value[expose_php] = Off


; Name of the session (used as cookie name).
; http://php.net/session.name
php_value[session.name] = OMVSESSID


; Default timeout for socket based streams (seconds)
; http://php.net/default-socket-timeout
php_value[default_socket_timeout] = 90


; Maximum execution time of each script, in seconds
; http://php.net/max-execution-time
; Note: This directive is hardcoded to 0 for the CLI SAPI
php_value[max_execution_time] = 90

more openmediavault-webgui
server {
    server_name openmediavault-webgui;
    root /var/www/openmediavault;
    index index.php;
    autoindex off;
    server_tokens off;
    sendfile on;
    large_client_header_buffers 4 32k;
    client_max_body_size 25M;
    error_log /var/log/nginx/openmediavault-webgui_error.log error;
    access_log /var/log/nginx/openmediavault-webgui_access.log combined;
    location /extjs/ {
        alias /usr/share/javascript/extjs5/;
    }
    location /images/ {
        alias /var/www/openmediavault/images/;
    }
    location ~ \.php$ {
        try_files $uri = 404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php5-fpm-openmediavault-webgui.sock;
        fastcgi_index index.php;
        fastcgi_read_timeout 60s;
        include fastcgi_params;
    }
    listen [::]:8080 default_server ipv6only=off;
    listen [::]:443 default_server ipv6only=off ssl deferred;
    ssl_certificate /etc/ssl/certs/openmediavault-378223d6-e3a1-426f-ab98-3b4663594d7f.crt;
    ssl_certificate_key /etc/ssl/private/openmediavault-378223d6-e3a1-426f-ab98-3b4663594d7f.key;
    include /etc/nginx/openmediavault-webgui.d/*.conf;
}

upstream php-handler {
       server unix:/var/run/php5-fpm-openmediavault-owncloud.sock;
       }


server {
        listen 8443 ssl;
        server_name openmediavault;


#        ssl_certificate /etc/ssl/nginx/cloud.example.com.crt;
#        ssl_certificate_key /etc/ssl/nginx/cloud.example.com.key;
#        ssl_certificate /etc/ssl/certs/openmediavault-378223d6-e3a1-426f-ab98-3b4663594d7f.crt;
#        ssl_certificate_key /etc/ssl/private/openmediavault-378223d6-e3a1-426f-ab98-3b4663594d7f.key;
        ssl_certificate /etc/ssl/certs/owncloud-2015.crt;
        ssl_certificate_key /etc/ssl/private/owncloud-2015.key;


        # Path to the root of your installation
        root /var/www/owncloud;


        error_log /var/log/nginx/openmediavault-owncloud_error.log error;
        access_log /var/log/nginx/openmediavault-owncloud_access.log combined;


        client_max_body_size 10G; # set max upload size
        fastcgi_buffers 64 4K;


        rewrite ^/caldav(.*)$ /remote.php/caldav$1 redirect;
        rewrite ^/carddav(.*)$ /remote.php/carddav$1 redirect;
        rewrite ^/webdav(.*)$ /remote.php/webdav$1 redirect;


        index index.php;
        error_page 403 /core/templates/403.php;
        error_page 404 /core/templates/404.php;


        location = /robots.txt {
            allow all;
            log_not_found off;
            access_log off;
        }


        location ~ ^/(data|config|\.ht|db_structure\.xml|README) {
                deny all;
        }


        location / {
                # The following 2 rules are only needed with webfinger
                rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
                rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;


                rewrite ^/.well-known/carddav /remote.php/carddav/ redirect;
                rewrite ^/.well-known/caldav /remote.php/caldav/ redirect;


                rewrite ^(/core/doc/[^\/]+/)$ $1/index.html;


                try_files $uri $uri/ index.php;
        }
        location ~ ^(.+?\.php)(/.*)?$ {
                try_files $1 = 404;


                include fastcgi_params;
                fastcgi_param SCRIPT_FILENAME $document_root$1;
                fastcgi_param PATH_INFO $2;
                fastcgi_param HTTPS on;
#                fastcgi_pass 127.0.0.1:9000;
                fastcgi_pass unix:/var/run/php5-fpm-openmediavault-webgui.sock;
                # Or use unix-socket with 'fastcgi_pass unix:/var/run/php5-fpm.sock;'
        }


        # Optional: set long EXPIRES header on static assets
        location ~* ^.+\.(jpg|jpeg|gif|bmp|ico|png|css|js|swf)$ {
                expires 30d;
                # Optional: Don't log access to assets
                access_log off;
        }


}

root@openmediavault nginx # tail *error.log
==> error.log <==


==> openmediavault-owncloud_error.log <==


==> openmediavault-webgui_error.log <==
 root@openmediavault nginx # tail *access.log
==> access.log <==


==> openmediavault-owncloud_access.log <==


==> openmediavault-webgui_access.log <==
::ffff:192.168.1.150 - - [16/Sep/2015:11:41:00 -0600] "GET / HTTP/1.1" 200 31 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36"
::ffff:192.168.1.150 - - [16/Sep/2015:11:41:01 -0600] "GET /favicon.ico HTTP/1.1" 200 1150 "https://omv.<domain>.com/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36"