[debian-edu-commits] [Git][debian-edu/debian-edu-config][mr/implement-apache2-update-allowlist] 12 commits: share/debian-edu-config/tools/copy-host-keytab: Support SSH publickey login to...
Daniel Teichmann (@dzatoah)
gitlab at salsa.debian.org
Mon Aug 17 19:34:28 BST 2026
Daniel Teichmann pushed to branch mr/implement-apache2-update-allowlist at Debian Edu / debian-edu-config
Commits:
c53528cf by Mike Gabriel at 2026-05-07T22:28:30+02:00
share/debian-edu-config/tools/copy-host-keytab: Support SSH publickey login to tjener, if this is possible (e.g. if admin is using SSH agent forwarding).
- - - - -
b892e2fa by Daniel Teichmann at 2026-05-22T22:28:45+00:00
apache2 debian-edu-default.conf: Do not force HTTPS on *.crt (including Debian-Edu_rootCA.crt).
Closes: #1068388
- - - - -
a624dc1c by Daniel Teichmann at 2026-05-22T22:29:28+00:00
etc/dovecot/local.conf: Fix passdb block syntax for Dovecot 2.4.x compatibility.
Dovecot 2.4.x introduced a breaking change to the passdb/userdb
configuration block syntax. A prior commit 63523d4c partially adapted
etc/dovecot/local.conf to Dovecot 2.4.x by splitting mail_location
into mail_driver, mail_path, and mail_inbox_path, but did not update
the passdb block, leaving the configuration broken.
This causes Dovecot to fail immediately at startup with:
- doveconf: Fatal: Error in configuration file /etc/dovecot/local.conf line 10: passdb { }
- dovecot.service: Main process exited, code=exited, status=89/n/a
- - - - -
17c18602 by Daniel Teichmann at 2026-05-22T22:30:02+00:00
debian/control: Add 'Conflicts: firefox-esr-mobile-config'.
This ensures that /usr/share/firefox-esr/distribution/policies.json
will not be overwritten by the other package.
Closes: #1126881
- - - - -
16922109 by Daniel Teichmann at 2026-05-22T22:34:37+00:00
v3CA.cnf: Fix Root CA X.509v3 extensions for OpenSSL 3 compatibility
OpenSSL 3 strictly enforces certificate purposes.
The old Root CA configuration lacked the required critical
basic constraints (CA:TRUE) and the proper key usage flags
(cRLSign, keyCertSign) necessary to act as an issuing authority.
Without these, OpenSSL 3 rejects the CA with an
"invalid CA certificate" error.
The flag "critical" is also required by OpenSSLv3.
- - - - -
1ef598be by Daniel Teichmann at 2026-05-22T22:34:37+00:00
v3.cnf: Fix server cert X.509v3 extensions for OpenSSL 3 compatibility
OpenSSL 3 requires server certificates to explicitly declare
their extended key usage.
The v3.cnf file previously only defined Subject Alternative Names,
lacking the serverAuth Extended Key Usage flag.
This caused OpenSSL 3 clients (like libldap) to reject the server
certificate during the TLS handshake with an
"unsuitable certificate purpose" error.
This commit adds the necessary Key Usage and Extended Key Usage definitions.
- - - - -
e5573407 by Daniel Teichmann at 2026-05-22T22:34:37+00:00
tools/create-debian-edu-certs: Fix script to apply correct configurations
1. It failed to apply the $V3_CA_CONF extensions when generating the Root CA,
resulting in a CA missing its basic constraints.
2. It erroneously used the CA configuration ($SSL_CA_CONF) instead of the
server configuration ($SSL_CONF) when generating the server CSR.
This caused the Root CA and the Server Certificate to share identical
Subject DNs, confusing the OpenSSL 3 validation chain.
This commit corrects the openssl req invocations to use the appropriate
configuration and extension files.
- - - - -
f2bacf68 by Daniel Teichmann at 2026-05-22T22:34:37+00:00
tools/create-server-cert: Add OpenSSL 3 extensions and fix base config
* Injects missing `keyUsage` and `extendedKeyUsage` into the generated
v3.conf to satisfy OpenSSL 3 strict validation requirements.
* Switches the template from `sslCA.cnf` to `ssl.cnf` so server
certificates do not inherit the Root CA's Organizational Unit.
NOTE: These are fixes, which come from previous commits.
See history of create-debian-edu-certs for more info.
- - - - -
0092caec by Mike Gabriel at 2026-05-23T00:49:22+02:00
release 2.13.0
- - - - -
57b7fda3 by Daniel Teichmann at 2026-08-17T20:34:11+02:00
Add new daily running script 'debian-edu-apache2-update-allowlist', which updates Apache2 'Host:' allowlist.
- - - - -
3aaed7b6 by Daniel Teichmann at 2026-08-17T20:34:11+02:00
Apache2 debian-edu-default.conf: Make Tjener be reachable with custom aliases without 302 redirects.
+ 10.x.x.x/8 is always allowed.
+ Allows .crt .dat files to be downloaded without HTTPS.
+ Supports custom aliases using allowlist map at: '/usr/share/debian-edu-config/apache2_host-allowlist.map'.
+ Allowlist map will be updated by systemd/cron once a day.
+ Uses predefined fallback (www.intern).
- - - - -
1ca2ebec by Daniel Teichmann at 2026-08-17T20:34:11+02:00
Apache2 debian-edu-default.conf: Convert indentation spaces to tabs (whitespace-only).
- - - - -
16 changed files:
- Makefile
- debian/changelog
- debian/control
- debian/debian-edu-config.cron.daily
- + debian/debian-edu-config.debian-edu-apache2-update-allowlist.service
- + debian/debian-edu-config.debian-edu-apache2-update-allowlist.timer
- debian/rules
- etc/apache2/sites-available/debian-edu-default.conf
- etc/dovecot/local.conf
- + libexec/debian-edu-apache2-update-allowlist
- + share/debian-edu-config/apache2_host-allowlist.map
- share/debian-edu-config/tools/copy-host-keytab
- share/debian-edu-config/tools/create-debian-edu-certs
- share/debian-edu-config/tools/create-server-cert
- share/debian-edu-config/v3.cnf
- share/debian-edu-config/v3CA.cnf
Changes:
=====================================
Makefile
=====================================
@@ -22,6 +22,7 @@ SPROGS = \
$(NULL)
LIBEXECPROGS = \
+ debian-edu-apache2-update-allowlist \
debian-edu-cups-queue-autoflush-for-netgroup-hosts \
debian-edu-cups-queue-autoreenable-for-netgroup-hosts \
debian-edu-fsautoresize-for-netgroup-hosts \
@@ -360,6 +361,7 @@ install: install-testsuite
$(INSTALL_DATA) sbin/debian-edu-fsautoresizetab $(DESTDIR)/usr/share/debian-edu-config/fsautoresizetab
set -e ; for f in \
+ share/debian-edu-config/apache2_host-allowlist.map \
share/debian-edu-config/avahi.smb.service \
share/debian-edu-config/rsyslog-collector \
share/debian-edu-config/rsyslog-filters \
=====================================
debian/changelog
=====================================
@@ -1,3 +1,41 @@
+debian-edu-config (2.13.0) unstable; urgency=medium
+
+ [ Mike Gabriel ]
+ * sbin/debian-edu-fsautoresize:
+ - Avoid division by zero error on unused mountpoints.
+ * sbin/debian-edu-pxeinstall:
+ - Support overriding tasksel/desktop selection via mydesktop parameter in
+ /etc/debian-edu/pxeinstall.conf.
+ - Fix comment about mapping debconf template keywords to kernel cmdline
+ keywords and drop unused variable assignment.
+ - sbin/debian-edu-pxeinstall: Regression fix, only adjust desktop to
+ mydesktop from pxeinstall.conf if we are processing the tasksel/desktop
+ setting.
+ * share/debian-edu-config/tools/copy-host-keytab:
+ - Support SSH publickey login to tjener, if this is possible (e.g. if admin
+ is using SSH agent forwarding).
+
+ [ Daniel Teichmann ]
+ * Add new file 'debian-edu-router.ldif'. Empty proxy groups should be
+ installed on all new Tjeners.
+ * ldap-bootstrap/debian-edu-router.ldif: Add 'server-hosts' nisNetgroup
+ to 'proxy-trusted' nisNetgroup, via 'memberNisNetgroup' attribute.
+ * share/debian-edu-config/gosa.conf.template: Activate nisNetgroup tab
+ for user accounts.
+ * apache2 debian-edu-default.conf: Do not force HTTPS on *.crt (including
+ Debian-Edu_rootCA.crt).
+ (Closes: #1068388)
+ * etc/dovecot/local.conf: Fix passdb block syntax for Dovecot 2.4.x
+ compatibility.
+ * debian/control: Add 'Conflicts: firefox-esr-mobile-config'.
+ (Closes: #1126881)
+ * v3CA.cnf: Fix Root CA X.509v3 extensions for OpenSSL 3 compatibility.
+ * v3.cnf: Fix server cert X.509v3 extensions for OpenSSL 3 compatibility.
+ * tools/create-debian-edu-certs: Fix script to apply correct configurations.
+ * tools/create-server-cert: Add OpenSSL 3 extensions and fix base config.
+
+ -- Mike Gabriel <sunweaver at debian.org> Sat, 23 May 2026 00:45:16 +0200
+
debian-edu-config (2.12.904) unstable; urgency=medium
* share/glib-2.0/schemas/32-debian-edu.arctica-greeter.gschema.override:
=====================================
debian/control
=====================================
@@ -18,6 +18,7 @@ Vcs-Git: https://salsa.debian.org/debian-edu/debian-edu-config.git
Package: debian-edu-config
Architecture: all
+Conflicts: firefox-esr-mobile-config,
Depends: ${misc:Depends},
adduser,
bind9-host,
=====================================
debian/debian-edu-config.cron.daily
=====================================
@@ -9,3 +9,8 @@ export PATH
if [ -x /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts ]; then
exec /usr/libexec/debian-edu-config/debian-edu-cups-queue-autoflush-for-netgroup-hosts
fi
+
+# regularly run Apache2 allowlist update if the script is present
+if [ -x /usr/libexec/debian-edu-config/debian-edu-apache2-update-allowlist ]; then
+ exec /usr/libexec/debian-edu-config/debian-edu-apache2-update-allowlist
+fi
=====================================
debian/debian-edu-config.debian-edu-apache2-update-allowlist.service
=====================================
@@ -0,0 +1,6 @@
+[Unit]
+Description=Update Apache2 allowlist at /usr/share/debian-edu-config/apache2_host-allowlist.map
+
+[Service]
+Type=oneshot
+ExecStart=/usr/libexec/debian-edu-config/debian-edu-apache2-update-allowlist
=====================================
debian/debian-edu-config.debian-edu-apache2-update-allowlist.timer
=====================================
@@ -0,0 +1,9 @@
+[Unit]
+Description=Run debian-edu-apache2-update-allowlist.service every day.
+
+[Timer]
+OnBootSec=15min
+OnUnitActiveSec=1d
+
+[Install]
+WantedBy=timers.target
=====================================
debian/rules
=====================================
@@ -23,6 +23,7 @@ override_dh_installsystemd:
dh_installsystemd --no-start --name firefox-ldapconf
dh_installsystemd --no-start --name debian-edu-fsautoresize
dh_installsystemd --no-start --name debian-edu-update-netblock
+ dh_installsystemd --no-start --name debian-edu-apache2-update-allowlist
dh_installsystemd --no-start --name debian-edu-cups-queue-autoflush
dh_installsystemd --no-start --name debian-edu-cups-queue-autoreenable
=====================================
etc/apache2/sites-available/debian-edu-default.conf
=====================================
@@ -1,14 +1,37 @@
<VirtualHost *:80>
- ServerName www.intern
+ ServerName www.intern
ServerAdmin webmaster at postoffice.intern
DocumentRoot /etc/debian-edu/www/
+# ---- <Host-Based Redirection Logic> ----
+ UseCanonicalName On
+
+ RewriteEngine On
+ RewriteMap hostallow "txt:/usr/share/debian-edu-config/apache2_host-allowlist.map"
+
+ # 1. Exclusions: Skip the redirect rules entirely for wpad.dat and Debian-Edu_rootCA.crt
+ RewriteCond %{REQUEST_URI} \.(?:dat|crt)$ [NC]
+ RewriteRule ^ - [L]
+
+ # 2. Check if the requested host matches Edu IP subnet e.g. 10.x.x.x/8 subnet..
+ # NOTE: Single IPs should be part of allow map.
+ # NOTE: .999.999 is technically possible, but harmless.
+ RewriteCond %1 ^10\.\d{1,3}\.\d{1,3}\.\d{1,3}$ [OR]
+
+ # 3. Path A (The Happy Path): Host is VALID in the map
+ # We strip the port, check the map. If it matches, redirect preserving the user's host.
+ RewriteCond %{HTTP_HOST} ^([^:]+)
+ RewriteCond ${hostallow:%1|DENY} ^ALLOW$ [NC]
+ RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
+
+ # 4. Path B (The Fallback): Host is INVALID or missing from the map
+ # If the request makes it past Rule 3 without triggering the [L] flag,
+ # it means the Host was not allowed. We safely redirect to the static ServerName.
+ RewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R=301,L]
+# ---- </Host-Based Redirection Logic> ----
+
<Directory /etc/debian-edu/www/ >
- RewriteEngine On
- RewriteCond %{SERVER_PORT} 80
- RewriteCond %{REQUEST_URI} !\.dat$
- RewriteRule ^(.*)$ https://%{SERVER_ADDRESS}/$1 [R=301,L]
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Require all granted
@@ -30,20 +53,20 @@
CustomLog /var/log/apache2/access.log combined
ServerSignature On
- Alias /doc/ "/usr/share/doc/"
- <Directory "/usr/share/doc/">
- Options Indexes MultiViews FollowSymLinks
- AllowOverride None
+ Alias /doc/ "/usr/share/doc/"
+ <Directory "/usr/share/doc/">
+ Options Indexes MultiViews FollowSymLinks
+ AllowOverride None
Require all denied
- Allow from 127.0.0.0/255.0.0.0 ::1/128
- </Directory>
+ Allow from 127.0.0.0/255.0.0.0 ::1/128
+ </Directory>
- # add alias for munin, though it should really be handled by munin itself,
- # rather than assuming /var/www is the defaultroot..
- Alias /munin "/var/cache/munin/www/"
- <Directory /var/cache/munin/www/ >
+ # add alias for munin, though it should really be handled by munin itself,
+ # rather than assuming /var/www is the defaultroot..
+ Alias /munin "/var/cache/munin/www/"
+ <Directory /var/cache/munin/www/ >
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Require all granted
- </Directory>
+ </Directory>
</VirtualHost>
=====================================
etc/dovecot/local.conf
=====================================
@@ -7,8 +7,12 @@ auth_gssapi_hostname = postoffice.intern
mail_driver = maildir
mail_path = ~/Maildir
mail_inbox_path = /var/mail/%u
-passdb {
- args = uid=uid home=homeDirectory
- driver = static
+
+passdb static {
+ fields {
+ uid = uid
+ home = homeDirectory
+ }
}
+
protocols = "imap"
=====================================
libexec/debian-edu-apache2-update-allowlist
=====================================
@@ -0,0 +1,218 @@
+#!/bin/bash
+#
+# Author: Daniel Teichmann
+# Date: 2026-03-21
+# License: GNU General Public License v2 or later (GPL-2+)
+#
+
+# =============================================================================
+# Queries LDAP for cNAMERecord entries under the Debian Edu DNS zone and
+# smartly merges them into the Apache2 host allowlist map file.
+#
+# Usage: /usr/libexec/debian-edu-config/update-apache2-allowlist.sh
+# =============================================================================
+
+set -euo pipefail
+
+# -----------------------------------------------------------------------------
+# Configuration
+# -----------------------------------------------------------------------------
+SCRIPT_PATH="/usr/libexec/debian-edu-config/update-apache2-allowlist.sh"
+MAP_FILE="/usr/share/debian-edu-config/apache2_host-allowlist.map"
+BACKUP_DIR="/var/backups/apache2-allowlist"
+LDAP_BASE="relativeDomainName=tjener,zoneName=intern,cn=tjener,ou=servers,ou=systems,dc=skole,dc=skolelinux,dc=no"
+LDAP_OPTS="-x"
+LOG_TAG="update-apache2-allowlist"
+
+# Debian Edu default hostnames (short + .intern variants) — always included
+# in the auto-generated block regardless of LDAP output.
+DEBIAN_EDU_DEFAULTS=(
+ "www" "www.intern"
+ "tjener" "tjener.intern"
+ "ldap" "ldap.intern"
+)
+
+# -----------------------------------------------------------------------------
+# Helpers
+# -----------------------------------------------------------------------------
+log() { logger -t "$LOG_TAG" "$*"; echo "[$(date '+%F %T')] $*"; }
+die() { log "ERROR: $*"; exit 1; }
+
+# -----------------------------------------------------------------------------
+# Sanity checks
+# -----------------------------------------------------------------------------
+command -v ldapsearch >/dev/null 2>&1 || die "ldapsearch not found. Install ldap-utils."
+[[ -d "$(dirname "$MAP_FILE")" ]] || die "Target directory does not exist: $(dirname "$MAP_FILE")"
+
+# -----------------------------------------------------------------------------
+# Backup existing map file
+# -----------------------------------------------------------------------------
+mkdir -p "$BACKUP_DIR"
+if [[ -f "$MAP_FILE" ]]; then
+ BACKUP_FILE="$BACKUP_DIR/apache2_host-allowlist.map.$(date '+%Y%m%d_%H%M%S')"
+ cp "$MAP_FILE" "$BACKUP_FILE"
+ log "Backed up existing map to: $BACKUP_FILE"
+
+ # Prune backups older than 30 days
+ find "$BACKUP_DIR" -name "apache2_host-allowlist.map.*" -mtime +30 -delete
+fi
+
+# -----------------------------------------------------------------------------
+# Parse HAND-EDIT block from existing file (preserve user additions)
+# -----------------------------------------------------------------------------
+HAND_EDIT_BLOCK=""
+if [[ -f "$MAP_FILE" ]]; then
+ # Extract everything from the HAND-EDIT marker to end of file
+ HAND_EDIT_BLOCK=$(awk '/^# ----- IMPORTANT HAND-EDIT ADDITIONS -----/{found=1} found{print}' "$MAP_FILE")
+fi
+
+# If there was no hand-edit block yet, use the default placeholder
+if [[ -z "$HAND_EDIT_BLOCK" ]]; then
+ HAND_EDIT_BLOCK='# ----- IMPORTANT HAND-EDIT ADDITIONS -----
+# If a user browses to the raw IP and it is not here, it will trigger a 302
+# response to a pre-defined server name.
+# Add any other IP addresses assigned to Tjeners interfaces:
+# 192.168.0.1 ALLOW'
+fi
+
+# -----------------------------------------------------------------------------
+# Query LDAP for cNAMERecord entries
+# -----------------------------------------------------------------------------
+log "Querying LDAP for cNAMERecord entries..."
+LDAP_OUTPUT=$(ldapsearch $LDAP_OPTS -b "$LDAP_BASE" 2>&1) \
+ || die "ldapsearch failed: $LDAP_OUTPUT"
+
+# Parse relativeDomainName values that have a cNAMERecord attribute.
+# Strategy: track the current relativeDomainName per stanza; only emit it
+# if a cNAMERecord line is also present in the same stanza.
+mapfile -t LDAP_CNAMES < <(
+ awk '
+ /^$/ { if (has_cname && rdn != "" && rdn != "tjener") print rdn; rdn=""; has_cname=0; next }
+ /^relativeDomainName:/ { rdn=$2 }
+ /^cNAMERecord:/ { has_cname=1 }
+ END { if (has_cname && rdn != "" && rdn != "tjener") print rdn }
+ ' <<< "$LDAP_OUTPUT" | sort -u
+)
+
+log "LDAP returned ${#LDAP_CNAMES[@]} cNAME entries: ${LDAP_CNAMES[*]:-<none>}"
+
+# -----------------------------------------------------------------------------
+# Build the de-duplicated LDAP-only section
+# (skip anything already in the Debian Edu defaults block)
+# -----------------------------------------------------------------------------
+
+# Build a lookup set of already-covered hostnames (short names only)
+declare -A COVERED
+for h in "${DEBIAN_EDU_DEFAULTS[@]}"; do
+ # Strip .intern suffix for comparison
+ short="${h%.intern}"
+ COVERED["$short"]=1
+done
+# Also mark static entries
+for h in localhost tjener; do COVERED["$h"]=1; done
+
+LDAP_EXTRA_LINES=()
+for cname in "${LDAP_CNAMES[@]}"; do
+ if [[ -z "${COVERED[$cname]+_}" ]]; then
+ LDAP_EXTRA_LINES+=("$cname")
+ COVERED["$cname"]=1
+ fi
+done
+
+# -----------------------------------------------------------------------------
+# Format helper: pad hostname to column 20 then append ALLOW
+# -----------------------------------------------------------------------------
+fmt_allow() {
+ printf "%-20s ALLOW\n" "$1"
+}
+
+# -----------------------------------------------------------------------------
+# Assemble the new map file in a temp file, then atomically replace
+# -----------------------------------------------------------------------------
+TMPFILE=$(mktemp "${MAP_FILE}.tmp.XXXXXX")
+trap 'rm -f "$TMPFILE"' EXIT
+
+{
+# ── Static header ─────────────────────────────────────────────────────────────
+cat <<HEADER
+# /usr/share/debian-edu-config/apache2_host-allowlist.map
+# Format: <hostname_or_IP> ALLOW
+#
+# IMPORTANT: This file will be changed daily by a script using cron/systemd.
+# It contains allowed \`HOST:\` entries for the Apache2 webserver.
+# The script tries to smartly merge existing hand-made entries,
+# but you should execute the script manually once to make sure your
+# changes are sticking:
+# $ ${SCRIPT_PATH}
+
+# Local loopback devices
+$(fmt_allow localhost)
+$(fmt_allow "::1")
+$(fmt_allow "127.0.0.1")
+HEADER
+
+# ── Auto-generated Debian Edu defaults ────────────────────────────────────────
+cat <<'AUTOGEN_HEADER'
+
+# ---------------------------
+# | Debian Edu defaults |
+# ---------------------------
+AUTOGEN_HEADER
+
+echo "# NOTE: 10.x.x.x/8 network is allowed anyway, so next line is redundand."
+fmt_allow "10.0.2.2"
+fmt_allow "www"
+fmt_allow "www.intern"
+fmt_allow "tjener"
+fmt_allow "tjener.intern"
+fmt_allow "ldap"
+fmt_allow "ldap.intern"
+echo "# ---------------------------"
+
+# ── LDAP-discovered cNAMEs (not already in defaults) ──────────────────────────
+if [[ ${#LDAP_EXTRA_LINES[@]} -gt 0 ]]; then
+ echo ""
+ echo ""
+ echo "# ---------------------------"
+ echo "# | LDAP-discovered CNAMEs |"
+ echo "# | (auto-updated daily) |"
+ echo "# ---------------------------"
+ echo "# Last updated: $(date '+%Y-%m-%d %H:%M:%S')"
+ for h in "${LDAP_EXTRA_LINES[@]}"; do
+ fmt_allow "$h"
+ # Also emit the .intern variant if not already covered
+ intern_variant="${h}.intern"
+ if [[ -z "${COVERED[$intern_variant]+_}" ]]; then
+ fmt_allow "$intern_variant"
+ COVERED["$intern_variant"]=1
+ fi
+ done
+ echo "# ---------------------------"
+fi
+
+# ── Preserved hand-edit block ─────────────────────────────────────────────────
+echo ""
+echo ""
+echo "$HAND_EDIT_BLOCK"
+
+} > "$TMPFILE"
+
+# Validate the temp file is non-empty before replacing
+[[ -s "$TMPFILE" ]] || die "Generated file is empty — aborting."
+
+# Atomic replace
+mv "$TMPFILE" "$MAP_FILE"
+chmod 644 "$MAP_FILE"
+log "Successfully updated: $MAP_FILE"
+
+# -----------------------------------------------------------------------------
+# Reload Apache2 if running (graceful — no dropped connections)
+# -----------------------------------------------------------------------------
+if systemctl is-active --quiet apache2; then
+ log "Reloading Apache2..."
+ systemctl reload apache2 \
+ && log "Apache2 reloaded successfully." \
+ || log "WARNING: Apache2 reload failed. Check 'systemctl status apache2'."
+else
+ log "Apache2 is not running — skipping reload."
+fi
=====================================
share/debian-edu-config/apache2_host-allowlist.map
=====================================
@@ -0,0 +1,43 @@
+# /usr/share/debian-edu-config/apache2_host-allowlist.map
+# Format: <hostname_or_IP> ALLOW
+#
+# IMPORTANT: This file will be changed daily by a script using cron/systemd.
+# It contains allowed `HOST:` entries for the Apache2 webserver.
+# The script tries to smartly merge existing hand-made entries,
+# but you should execute the script manually once to make sure your
+# changes are sticking:
+# $ /usr/libexec/debian-edu-config/update-apache2-allowlist.sh
+#
+# WARNING: If you can read this and the file modification date is more than 24h
+# in the past, then there is an issue with the automatic updating
+# script managed by either cron or systemd. This file only contains
+# the most basic configuration settings for Debian Edu and needs to be
+# updated.
+#
+# DEV NOTE: If you're are updating this file in the debian-edu-config package
+# please be aware that you'll have to adapt the update script too.
+
+# Local loopback devices
+localhost ALLOW
+::1 ALLOW
+127.0.0.1 ALLOW
+
+# ---------------------------
+# | Debian Edu defaults |
+# ---------------------------
+# NOTE: 10.x.x.x/8 network is allowed, so next line is redundand.
+10.0.2.2 ALLOW
+www ALLOW
+www.intern ALLOW
+tjener ALLOW
+tjener.intern ALLOW
+ldap ALLOW
+ldap.intern ALLOW
+# ---------------------------
+
+
+# ----- IMPORTANT HAND-EDIT ADDITIONS -----
+# If a user browses to the raw IP and it is not here, it will trigger a 302
+# response to a pre-defined server name.
+# Add any other IP addresses assigned to Tjeners interfaces:
+# 172.16.0.51 ALLOW
=====================================
share/debian-edu-config/tools/copy-host-keytab
=====================================
@@ -1,6 +1,21 @@
#!/bin/sh
set -e
-kinit
+
+if [ $(id -u) -gt 0 ]; then
+ echo "ERROR: This script has to run as super-user root."
+ exit 1
+fi
+
+# Attempt passwordless SSH login root at tjener (could be publickey, gssapi-keyex, or gssapi-with-mic)
+set +e
+ssh -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no tjener "echo -n" 2>/dev/null
+ret=$?
+set -e
+if [ "${ret}" != "0" ]; then
+ # Try to get a Kerberos ticket for root instead to use GSSAPI login.
+ kinit root
+fi
+
scp tjener:/var/lib/debian-edu/host-keytabs/$(hostname -s).intern.keytab /etc/krb5.keytab
# Special case separate LTSP server.
=====================================
share/debian-edu-config/tools/create-debian-edu-certs
=====================================
@@ -33,10 +33,11 @@ SERVER_KEY="$KEY_DIR/debian-edu-server.key"
generate() {
# Generate Debian Edu root CA private key.
openssl genrsa -out $CA_KEY 2048
- # Request rootCA certificate.
- openssl req -x509 -new -nodes -key $CA_KEY -days 3650 -out $CA_CERT -config $SSL_CA_CONF
+ # Request rootCA CSR and self-sign it to apply v3 extensions.
+ openssl req -new -nodes -key $CA_KEY -out $TMP/ca.csr -config $SSL_CA_CONF
+ openssl x509 -req -in $TMP/ca.csr -signkey $CA_KEY -days 3650 -out $CA_CERT -extfile $V3_CA_CONF
# Request web server key.
- openssl req -new -nodes -out $TMP/server.csr -newkey rsa:2048 -keyout $SERVER_KEY -config $SSL_CA_CONF
+ openssl req -new -nodes -out $TMP/server.csr -newkey rsa:2048 -keyout $SERVER_KEY -config $SSL_CONF
# Request web server certificate.
openssl x509 -req -in $TMP/server.csr -CA $CA_CERT -CAkey $CA_KEY -CAcreateserial -out $SERVER_CERT -days 3650 -extfile $V3_CONF
# Adjust owner and rights.
=====================================
share/debian-edu-config/tools/create-server-cert
=====================================
@@ -135,20 +135,23 @@ csrfile="${certname}.csr"
tempdir=$(mktemp -d)
+# Same as in /usr/share/debian-edu-config/tools/create-debian-edu-certs
cat > "${tempdir}/v3.conf" <<EOF
# v3.ext
authorityKeyIdentifier=keyid,issuer
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
$(for item in ${SANs[*]}; do echo $item; done)
EOF
-# same as in /usr/share/debian-edu-config/tools/create-debian-edu-certs
-SSL_CA_CONF="/usr/share/debian-edu-config/sslCA.cnf"
+# Same as in /usr/share/debian-edu-config/tools/create-debian-edu-certs
+SSL_CONF="/usr/share/debian-edu-config/ssl.cnf"
# tweak the common name to match our FQDN
-cp "${SSL_CA_CONF}" "${tempdir}/ssl.cnf"
+cp "${SSL_CONF}" "${tempdir}/ssl.cnf"
sed -r -i "${tempdir}/ssl.cnf" -e "s/(commonName\s+=\s+)(.*)/\1${server_name}.${server_domain}/"
if [ -f "${keydir}/${keyfile}" ]; then
=====================================
share/debian-edu-config/v3.cnf
=====================================
@@ -1,5 +1,7 @@
# v3.ext
authorityKeyIdentifier=keyid,issuer
+keyUsage = digitalSignature, keyEncipherment
+extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
=====================================
share/debian-edu-config/v3CA.cnf
=====================================
@@ -1,9 +1,8 @@
# v3.ext
-authorityKeyIdentifier=keyid,issuer
-basicConstraints=CA:True
-keyUsage = digitalSignature
+authorityKeyIdentifier = keyid, issuer
+basicConstraints = critical, CA:TRUE
+keyUsage = critical, digitalSignature, cRLSign, keyCertSign
subjectAltName = @alt_names
[alt_names]
DNS = www
-
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/12cb3c394ebe3ae0905ee4db43425b126934841f...1ca2ebecfe0fcacb440f0bd5fa2857ef4599f1a2
--
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/-/compare/12cb3c394ebe3ae0905ee4db43425b126934841f...1ca2ebecfe0fcacb440f0bd5fa2857ef4599f1a2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-edu-commits/attachments/20260817/6387d212/attachment-0001.htm>
More information about the debian-edu-commits
mailing list